solaris Man Page: crash(1m)

Man Pages

Back to Software Index BORDER=0

Manpage Top Level

crash(1M) manual page Table of Contents

Synopsis

/usr/sbin/crash [ -d dumpfile ] [ -n namelist ] [ -w output-file ]

The crash command is used to examine the system memory image of a running or a crashed system by formatting and printing control structures, tables, and other information. Command line arguments to crash are dumpfile, namelist, and output-file.

Options

-d dumpfile: Specify dumpfile as the file containing the system memory image. The default dumpfile is /dev/mem. The system image can also be the pathname of a dump file generated by the savecore(1M) utility.
-n namelist: Specify the text file namelist which contains the symbol table information needed for symbolic access to the system memory image to be examined. The default namelist is /dev/ksyms. Note: It is recommended that crash dumps be analyzed on a machine having the same kernel architecture as the machine that the dump was taken from.
-w output-file: When the crash command is invoked, a session is initiated. The output from a crash session is directed to output-file. The default output-file is the standard output.

Usage

Input during a crash session is of the form:

function [ argument... ]

where function is one of the crash functions described in the Functions subsection of this manual page, and arguments are qualifying data that indicate which items of the system image are to be printed.

The default for process-related items is the current process for a running system or the process that was running at the time of the crash for a crashed system. Similarly, the default for thread-related items is the current thread for a running system or the thread that was running at the time of the crash for a crash system. If the contents of a table are being dumped, the default is all active table entries.

Function Options

The following function options are available to crash functions wherever they are semantically valid. Valid function options are shown in Functions .

-e: Display every entry in a table.
-f: Display the full structure.
-p: Interpret all address arguments in the command line as physical addresses. If the addresses specified are not physical addresses, results are inconsistent.
-s process: Specify a process slot other than the default.
-w filename: Redirect the output of a function to filename.

The functions mode, defproc, and redirect correspond to the function options -p, -s, and -w. The mode function may be used to set the address translation mode to physical or virtual for all subsequently entered functions; defproc sets the value of the process slot argument for subsequent functions; and redirect redirects all subsequent output.

Output from crash functions may be piped to another program in the following way:

function [ argument... ] ! shell_command

For example,

mount ! grep rw

writes all mount table entries with an rw flag to the standard output. The redirection option (-w) cannot be used with this feature.

Depending on the context of the function, numeric arguments are assumed to be in a specific radix. Counts are assumed to be decimal. Addresses are always hexadecimal. Table address arguments larger than the size of the function table are interpreted as hexadecimal addresses; those smaller are assumed to be decimal slots in the table. Default bases on all arguments may be overridden. The C conventions for designating the bases of numbers are recognized. A number that is usually interpreted as decimal is interpreted as hexadecimal if it is preceded by 0x and as octal if it is preceded by 0. Decimal override is designated by 0d, and binary by 0b.

Aliases for functions may be any uniquely identifiable initial substring of the function name. Traditional aliases of one letter, such as p for proc, remain valid.

Many functions accept different forms of entry for the same argument. Requests for table information accept a table entry number, a physical address, a virtual address, a symbol, a range, or an expression. A range of slot numbers may be specified in the form a-b where a and b are decimal numbers. An expression consists of two operands and an operator. An operand may be an address, a symbol, or a number; the operator may be +, -, *, /, &,or |. An operand that is a number should be preceded by a radix prefix if it is not a decimal number (0 for octal, 0x for hexadecimal, 0b for binary). The expression must be enclosed in parentheses. Other functions accept any of these argument forms that are meaningful.

Two abbreviated arguments to crash functions are used throughout. Both accept data entered in several forms. They may be expanded into the following:

table_entry = slot number | address | symbol | range | expression

start_addr = address | symbol | expression

Functions

?: [ -w filename ]
List available functions.
!command: Escape to the shell and execute command.
as: [ -e ] [ -f ] [ -l ] [ -p ] [ -w filename ] [ proc... ]
Print information on process address space. If the -l is specified, all locks relevant to the address space structure are also displayed.
base: [ -w filename ] number...
Print number in binary, octal, decimal, and hexadecimal. A number in a radix other than decimal should be preceded by a prefix that indicates its radix as follows: 0x, hexadecimal; 0, octal; and 0b, binary.
buffer: [ -w filename ] [ -format ] bufferslot
buffer: [ -w filename ] [ -format ] [ -p ] start_addr
Alias: b
Print the contents of a buffer in the designated format. The following format designations are recognized: -b, byte; -c, character; -d, decimal; -x, hexadecimal; -o, octal; and, -i, inode. If no format is given, the previous format is used. The default format at the beginning of a crash session is hexadecimal.
bufhdr: [ -f ] [ -w filename ] [ [ -p ] table_entry... ]
Alias: buf
Print system buffer headers.
callout: [ -l ] [ -w filename ]
Alias: c
Print the callout table. If the -l option is specified, the contents of the locks pertaining to the callout structure are also displayed.
class: [ -w filename ] [ table_entry...]
Print information about process scheduler classes.
cpu: [ -w filename ] start_addr...
Display the cpu structure pointed to by start_addr.
ctx: [ -w filename ] start_addr
SPARC: Display the context structure given its starting address.
defproc: [ -w filename ] [ -c ] [ -r ]
defproc: [ -w filename ] [ slot ] [ -r ]
Set the value of the process slot argument. The process slot argument may be set to the current process’ slot number (-c) or the slot number may be specified. If the -r option is specified, the process slot number and the current thread pointer are reset (the process slot number is set to the current process’ slot number and the current thread pointer is set to the currently running thread). If no argument is entered, the value of the previously set slot number is printed. At the start of a crash session, the process slot is set to the current process.
defthread: [ -p ] [ -w filename ] [ -r ] [ -c thread_addr ]
With no argument defthread displays the address of the current thread. If -c is specified, the current thread is set to point to the currently running thread. If an address is specified the current thread is specified to be that thread. If -r is specified, the default process is also set to be the process pertaining to current thread.
dispq: [ -w filename ] [ table_entry...]
Print the dispatcher (scheduler) queues.
ds: [ -w filename ] virtual_address...
Alias: ts
Print the data symbol whose address is closest to, but not greater than, the address entered.
file: [ -e ] [ -f ] [ -w filename ] [[ -p ] table_entry... ]
Alias: f
Print the file table.
findaddr: [ -w filename ] table slot
Print the address of slot in table. Only tables available to the size function are available to findaddr.
findslot: [ -w filename ] virtual_address...
Print the table, entry slot number, and offset for the address entered. Only tables available to the size function are available to findslot.
fs: [ -f ] [ -w filename ] [ [ -p ] table_entry... ]
Alias: vfssw
Print the filename system information table.
gdp [-e] [-f] [-l] [-w filename] [[-p]table_entry...]: x86: Print the gift descriptor protocol table. If the -l option is specified, display all relevant lock information.
hat: [ -a ] [ -w filename ] start_addr...
Display the hat structure pointed to by start_addr. If the -a option is specified, the chain of hat structures is displayed.
help: [ -w filename ] function...
Print a description of the named function, including syntax and aliases.
hment: [ -a ] [ -w filename ] start_addr...
Display the hment structure pointed to by start_addr. If the -a option is specified, the chain of hment structures is displayed.
kfp: [ -w filename ] [ thread_addr ]
Print the kernel frame pointer (kfp) for the start of a kernel stack trace. If thread_addr is specified the kfp for that thread is printed.
kmastat: [ -w filename ]
Print kernel memory allocator statistics.
kmausers: [ -e ] [ -f ] [ -w filename ] [ cachename... ]
Print the information about the medium and large users of the kernel memory allocator that have current memory allocations. The output consists of one entry for each unique stack trace specifying the total amount of memory and number of allocations that was made with that stack trace.
This function is only available if the kernel: has the KMF_AUDIT flag set in kmem_flags. (See the NOTES below.)
If one or more cache names (e.g. kmem_alloc_256) are specified: the scan of memory usage is restricted to those caches. By default all caches are included.
If the: (-e) option is used, the small users of the allocator are included. The small users are allocations that total less than 1024 bytes of memory or for which there are less than 10 allocations with the same stack trace.
If the: (-f) option is used, the stack traces are printed for each individual allocation.
lck: [ -e ] [ -w filename ] [ [ -p ] lock_addr... ]
Alias: l
Print record locking information. If the -e option is used or lock address arguments are given, the record lock list is printed. If no argument is entered, information on locks relative to UFS inodes is printed.
linkblk: [ -e ] [ -w filename ] [ [ -p ] table_entry... ]
Print the linkblk table.
lwp: [ -w filename ] [ lwp_addr... ]
Display the lwp structure pointed to by lwp_addr. If no address is specified as an argument, the lwp structure associated with the current thread is displayed.
major: [ -w filename ] [ entry... ]
Print the MAJOR table.
map: [ -w filename ] mapname...
Print the map structure of the given mapname.
mblk: [ -e ] [ -f ] [ -w filename ] [[ -p ] table_entry...]
Print allocated streams message block and data block headers.
mblkusers: [ -e ] [ [ -f ] [ -w filename ]
Print the information about the medium and large users of the stream message memory allocator that have current mblk allocations. The output consists of one entry for each unique stack trace specifying the total amount of memory and number of allocations that was made with that stack trace.
This function is only available if the kernel: has the KMF_AUDIT flag set in kmem_flags. (See the NOTES below.)
If the: (-e) option is used, the small users of the allocator are included. The small users are allocations that total less than 1024 bytes of memory or for which there are less than 10 allocations with the same stack trace.
If the: (-f) option is used, the stack traces are printed for each individual allocation.
mode: [ -w filename ] [ mode ]
Set address translation of arguments to virtual (v) or physical (p) mode. If no mode argument is given, the current mode is printed. At the start of a crash session, the mode is virtual.
mount: [ -f ] [ -w filename ] [ [ -p ] table_entry...]
Alias: m, vfs
Print information about mounted filename systems.
mutex: [ -w filename ] mutex_addr...
Dump the contents of the mutex pointed to by mutex_addr.
mutextable: [ -w filename ]
Display every entry in the mutex_init_table.
nfsnode: [ -w filename ] [ node_addr ]
Print the NFS remote nodes.
nm: [ -w filename ] symbol...
Print value and type for the given symbol.
od: [ -p ] [ -w filename ] [ -format ] [ -mode ] [ -s process ] start_addr [ count ]
Alias: rd
Print count values starting at start_addr in one of the following formats: character (-c), decimal (-d), hexadecimal (-x), octal (-o), ASCII (-a), or hexadecimal/character (-h), and one of the following modes: long (-l), short (-t), or byte (-b). The default mode for character and ASCII formats is byte; the default mode for decimal, hexadecimal, and octal formats is long. The format -h prints both hexadecimal and character representations of the addresses dumped; no mode needs to be specified. When format or mode is omitted, the previous value is used. At the start of a crash session, the format is hexadecimal and the mode is long. If no count is entered, 1 is assumed.
page: [ -e ] [ -l ] [ -w filename ] [ [ -p ] table_entry... ]
Print information about pages. If -l is specified, display all relevant locking information.
pcb: [ -w filename ] [ thread_addr ]
Print the process control block. If no arguments are given, the active pcb for the current thread is printed. If thread_addr is specified, the pcb associated with that thread is printed.
pcfsnode: [ -w filename ] [ node_address ]
Print the PCFS filename and directory node tables.
pmgrp: [ -l ] [ -w filename ] start_addr...
Display the pmgrp structure pointed to by start_addr. If the -l option is specified, the chain of pmgrp structures is displayed.
prnode: [ -e ] [ -f ] [ -l ] [ -w filename ] [[ -p ] table_entry...]
Print information about the private data of processes being traced. If -l is specified, all relevant locking information is also displayed.
proc: [ -e ] [ -f ] [ -l ] [ -w filename ] [[ -p ] [ -a ] table_entry... | #procid...]
proc: [ -e ] [ -f ] [ -l ] [ -w filename ] [ -r ]
Alias: p
Print the process table. Process table information may be specified in two ways. First, any mixture of table entries and process ID s may be entered. Each process ID must be preceded by a #. Alternatively, process table information for runnable processes may be specified with the runnable option (-r). If the -l option is specified, all relevant locking information is displayed.
pte: [ -w filename ] start_addr...
Display the pte structure pointed to by start_addr.
pty: [ -e ] [ -f ] [ -w filename ] [ -s ] [ -h ] [ -l ] [ -t type ] [[ -p ] table_entry ]
Print the pseudo ttys presently configured. The -l, -h and -s options give information about the STREAMS modules ldterm, ptem and pckt, respectively. If the -t option is used, the table for the single pty type specified is printed.
qrun: [ -w filename ]
Print the list of scheduled STREAMS queues.
queue: [ -e ] [ -f ] [ -w filename ] [[ -p ] table_entry...]
Print the allocated STREAMS queues.
quit: Alias: q
Terminate the crash session. Exit.
redirect: [ -w filename ] [ -c ]
redirect: [ -w filename ] [ newfile ]
Used with a filename, redirects output of a crash session to newfile. If no argument is given, the filename name to which output is being redirected is printed. Alternatively, the close option (-c) closes the previously set filename and redirects output to the standard output.
rtdptbl: [ -w filename ] [ table_entry...]
Print the real-time dispatcher (scheduler) parameter table. See rt_dptbl(4) .
rtproc: [ -w filename ]
Print information about processes in the real-time scheduler class.
rwlock: [ -w filename ] rw_addr...
Dump the contents of the rwlock (read/write lock) structure pointed to by rw_addr.
search: [ -w filename ] [ -m mask ] [ -s process ] pattern [ -p ] start_addr length
Print the words in memory that match pattern, beginning at the start_addr for length words. The mask is AND ’ed (&) with each memory word and the result compared against the pattern. The mask defaults to 0xffffffff.
sema: [ -w filename ] sema_addr...
Dump the contents of the semaphore structure pointed to by sema_addr.
size: [ -x ] [ -w filename ] [ structure_name...]
Print the size of the designated structure. The -x option prints the size in hexadecimal. If no argument is given, a list of the structure names for which sizes are available is printed. The following example lists those structures:

> size
buf    callout    flckinfo    fifonode
filock    flox    lwp    pp
prnode    proc    snode    thread
tty    ufs_inode    user    vfs
vfssw    vnode
datab    dblk    linkblk
mblk    msgb    queue
stdata    streams
>

sment: [ -w filename ] start_addr...
Display the sment structure pointed to by start_addr.
smgrp: [ -l ] [ -w filename ] start_addr...
Display the smgrp structure pointed to by start_addr. If the -l option is specified, the chain of smgrp structures is displayed.
snode: [ -e ] [ -f ] [ -l ] [ -w filename ] [[ -p ] table_entry...]
Print information about open special filenames. If the -l option is specified, all relevant locking information is also displayed.
stack: [ -w filename ] [ -u ] [ -p ] [ thread]
stack: [ -w filename ] [ -k ] [ -p ] [ thread]
Alias: s
Dump the stack. The -u option prints the user stack. The -k option prints the kernel stack. If no arguments are entered, the kernel stack for the current thread is printed. Otherwise, the kernel stack for the currently running thread is printed.
status: [ -w filename ]
Print system statistics.
stream: [ -e ] [ -f ] [ -w filename ] [[ -p ] start_addr...]
Print the STREAMS table.
strstat: [ -w filename ]
Print STREAMS statistics.
trace: [ -w filename ] [[ -p ] [ thread_addr]]
Alias: t
Print stack trace. Displays the stack trace of the currently running or the specified thread.
thread: [ -e ] [ -f ] [ -l ] [ -w filename ] slot number
With no option, displays the current thread. If -e is specified, all threads in the system are displayed. Otherwise all threads pointed to by the addresses specified as argument are displayed.
ts: [ -w filename ] virtual_address...
Alias: ds
Print text symbol closest to the designated address.
tsdptbl: [ -w filename ] [ table_entry...]
Print the time-sharing dispatcher parameter table. See ts_dptbl(4) .
tsproc: [ -w filename ]
Print information about processes in the time-sharing dispatcher parameter table (scheduler class).
tty: [ -e ] [ -f ] [ -l ] [ -w filename ] [ -t type [[ -p ] table_entry...]]
tty: [ -e ] [ -f ] [ -l ] [ -w filename ] [[ -p ] start_addr ]
Valid types: pp, iu.
Print the tty table. If no arguments are given, the tty table for both tty types is printed. If the -t option is used, the table for the single tty type specified is printed. If no argument follows the type option, all entries in the table are printed. A single tty entry may be specified using start_addr. The -l option prints the line discipline information.
uinode: [ -d ] [ -e ] [ -f ] [ -l ] [ -r ] [ -w filename ] [[ -p ] table_entry...]
Alias: ui
Print the UFS inode table. The -d option will list the address and i-number of all UFS inodes in use and on the free list. If the -l option is specified, all relevant locking information is also displayed. The -r option will display all free UFS inodes.
user: [ -e ] [ -f ] [ -l ] [ -w filename ] [ process ]
Alias: u
Print the user structure for the designated process. If the -l option is specified, display all relevant locking information.
var: [ -w filename ]
Alias: v
Print the tunable system parameters.
vfs: [ -e ] [ -w filename ] [[ -p ] address...]
Alias: m, mount
Print information about mounted filename systems.
vfssw: [ -f ] [ -w filename ] [[ -p ] table_entry...]
Alias: fs
Print information about configured filename system types.
vnode: [ -w filename ] [ -l ] [ -p ] vnode_addr...]
Print information about vnodes.
vtop: [ -w filename ] [ -s process ] start_addr...
Print the physical address translation of the virtual address start_addr.

Exit Status

The following exit values are returned:

Success.

An error has occurred.

Files

/dev/mem: system image of currently running system
/dev/ksyms: system namelist

Notes

Kernel core dumps should be examined on the same platform they were created on.

The following steps are necessary in order to set KMF_AUDIT in kmem_flags (which is needed for the kmausers and mblkusers commands):

ok boot kadb -d
kadb: kernel/unix
kadb[0]: startup:b
kadb[0]: :c
kadb[0]: startup:b
kadb[0]: :c
kadb[0]: kmem_flags/W1
kadb[0]: :c

Table of Contents

Name
Synopsis
Availability
Description
Options
Usage

Function Options
Functions

Exit Status
Files
See Also
Notes