The crash command is a particularly useful tool for device-driver development and debugging, which interprets and formats the system structures. The crash command is interactive and allows you to examine an operating system image or an active system. An operating system image is held in a system dump file, either as a file or on the dump device. When you run the crash command, you can optionally specify a system image file and kernel file, as shown in the syntax below:
crash [-a] [-i IncludeFile] [ SystemImageFile [ KernelFile ] ]
The default SystemImageFile is /dev/mem and the default KernelFile is /usr/lib/boot/unix.
To run the crash command on the active system, enter:
crash
Because the command uses /dev/mem, you need root permissions.
To invoke the crash command on a system image file, enter:
crash SystemImageFile
where SystemImageFile is either a file name or the name of the dump device.
Note that by convention, the symbol names for function entry points always begin with a . (period). In most cases, there is a corresponding symbol name without the period that points to the function descriptor. However, when you specify a function symbol name on a crash command, without a leading period, crash inserts the period for you. For data items, there usually are table-of-contents (TOC) entries corresponding to each data item, but there are no differences in the names. The crash command assumes that when a data item symbol is specified, it is the actual data item that is wanted, not the TOC entry.
Use the -a flag to generate a list of data structures without using subcommands. The resulting list is large, so you can redirect the output to either a file or to a printer.
Use the -i flag to read the given include file, allowing the print subcommand to output data according to the include file structures.
You can use a variety of subcommands to view the system structures. These subcommands can have flags that modify the format of the data. If you do not use a flag to specify what you want to see, all valid entries are displayed.
Many of the commands in crash take addresses as parameters. Addresses are always specified in hexadecimal, and can usually be specified in one of the following forms:
| addr | An 8 digit hexadecimal number, which is treated as an effective address within the context of the current process and thread, or (in some cases) the context of the thread specified on a previous cm command. addr can be prefixed with the characters 0x . |
| segid:offset | segid is the segment ID for a virtual memory segment. The maximum size is 6 hex digits. offset is the offset (in bytes) from the beginning of that segment. The maximum size is 7 hex digits. |
| r:realaddr | r is the literal character "r". realaddr is a real memory address. This form can only be used when running crash against a system dump, and it only will display dump data areas that were dumped by real address instead of virtual address. readaddr can be up to 12 hexadecimal digits. |
To enhance readability, you may include underscores ("_") anywhere within these values.
Examples:
18340050 2314:55300 r:14_3370_0560 (same as r:1433700560)
The crash command provides command line editing features similar to those provided by the Korn shell. vi mode provides vi-like editing features, while emacs mode gives you controls similar to emacs. You can turn these features on by using the crash subcommand set edit. So, to turn on vi-style command-line editing, you would type the subcommand set edit vi .
The crash command provides a subset of Korn shell input/output redirection. Specifically, the following operators are provided:
| (pipe symbol)
Pipes all output of the command before the symbol to the input of the command after the symbol. Both standard output and error output are affected, which is different than standard shell behavior.
> filename
Writes the output of the command before the > to filename. Both standard and error output are written to the file.
> > filename
Adds the output of the command before the >> to the end of filename. Both standard and error output are written to the file.
Once you initiate the crash command, > is the prompt character. For a list of the available subcommands, type the ? character. To exit, type q. You can run any shell command from within the crash command by preceding it with an ! (exclamation mark).
Since the crash command only deals with kernel threads, the word "thread" when used alone will be used to mean kernel thread in the crash documentation that follows. The default thread for several subcommands is the current thread (the thread currently running). On a multiprocessor system, you can use the cpu subcommand to change the current processor; the default thread becomes the running thread on the selected processor.
The parameters ProcessSlotNumber and ThreadSlotNumber are used in many subcommands to indicate a process or thread respectively. These parameters are simply numbers for table entry indexes which can be displayed using the proc and thread subcommands.
Note that many structures displayed are longer than one screen length.
The buf subcommand displays the system buffer headers. A buffer header contains the information required to perform block I/O. If you type the buf subcommand with no BufferHeaderNumber, a summary of the system buffer headers is displayed.
> buf BUF MAJ MIN BLOCK FLAGS 0 000a 000b 8 done stale 1 000a 000b 243 done stale 2 000a 000b 24 done stale ...
If you type the buf subcommand with a BufferHeaderNumber, a single complete header is displayed:
> buf 3 BUFFER HEADER 3: b_forw: 0x014d0528, b_back: 0x014d0160, b_vp: 0x00000000 av_forw: 0x014d0160, av_back: 0x014d0528, b_iodone: 0x000185f8 b_dev: 0x000a000b, b_blkno: 0, b_addr: 0x014e9000 b_bcount: 4096, b_error: 0, b_resid: 0 b_work: 0x80000000, b_options:0x00000000, b_event: 0xffffffff b_start.tv_sec: 0, b_start.tv_nsec: 0 b_xmemd.aspace_id: 0x00000000, b_xmemd.subspace_id: 0x00000000 b_flags: read done stale
Refer to the sys/buf.h header file for the structure definition.
The buffer subcommand displays the data in a system buffer according to the Format parameter. When specifying a buffer header number, the buffer associated with that buffer header is displayed. If you do not provide a Format parameter, the previous Format is used. Valid options are decimal, octal, hex, character, byte, i-node, directory, and write. The write option creates a file in the current directory containing the buffer data.
> buffer hex 3 BUFFER FOR BUF_HDR 3 00000: 41495820 4c564342 00006a66 73000000 00020: 00000000 00000000 00000000 00000000 00040: 00000000 00000000 00003030 30303033 ...
The callout subcommand displays all active entries on the active trblist. When the time-out kernel extension is used in a device driver, this timer request is entered on a system-wide list of active timer requests. This list of timer requests is the trblist. Any timer which is active is on this list until it expires.
Aliases = c, call, calls, time, timeout, tout
>callout
TRB's On The Active List Of Processor 0.
TRB #1 on Active List
Timer address......................0x0
trb.to_next........................0x0
trb.knext..........................0x59aa100
trb.kprev..........................0x0
Thread id (-1 for dev drv).........0xfffffffe
Timer flags........................0x12
trb.timerid........................0x0
trb.eventlist......................0xffffffff
trb.timeout.it_interval.tv_nsec....0x0
trb.timeout.it_interval.tv_sec.....0x0
Next scheduled timeout (secs)......0x2d63f6a8
Next scheduled timeout (nanosecs)..0xc849a80
Timeout function...................0x8c748
Timeout function data..............0x59aa040
TRB #2 on Active List
...
Refer to sys/timer.h for the structure definitions, and to InfoExplorer for a description of the time-out mechanism.
The cm subcommand is used by the od subcommand to change the current segment map. The cm subcommand changes the map of the crash command internal pointers for any process thread segment not paged out, if you specify ThreadSlotNumber and SegmentNumber. This allows the od subcommand to display data from the segment desired rather than the segment for the current thread. The following example sets the map to ThreadSlotNumber3 and SegmentNumber 2, then displays 20 words from segment 2 for the thread in slot number 3:
>
cm 3 2
t3,2 >
>
od 2ff3b400 20
2ff3b400: 00000000 00000000 2ff22e28 00000000
2ff3b410: 00000306 00000000 0002a7ec 000010b0
2ff3b420: 82202220 0002a7ec 00000000 0000001c
2ff3b430: 00000000 00000000 00000000 00000000
2ff3b440: d80a5000 40000000 00002c0b d80a5000
t3,2 >
>
...
Using the cm subcommand without any parameters resets the map of internal pointers.
If no argument is given, the cpu subcommand displays the number of the currently selected processor. Initially, the selected processor is processor 0 (on a running system) or the processor on which the crash occurred (when running crash against a dump). If the ProcessorNumber argument is given, the cpu subcommand selects the specified processor as the current processor. By extension, this selects the current kernel thread (the running kernel thread on the selected processor). Processor numbering starts from zero.
>cpu Selected cpu number : 0
The dblock subcommand displays the allocated streams data-block headers. The address parameter is required. If the address is not supplied, this command will print an error message stating that the address is required. Refer to the sys/stream.h file for the datab structure definitions. The freep and db_size definitions are not included in /usr/include/sys/stream.h. These structure members are described here:
| freep | Address of the free pointer |
| db_size | Size of the data block |
There is no checking performed on the address passed in as the required parameter. The dblock subcommand will accept any address. It is up to the user to be sure that a valid address is specified.
To determine a valid address, run the mblock subcommand. From the output of the mblock subcommand, select a nonzero data block address under the DATABLOCK column heading.
This subcommand can be issued from crash on either a running system or a system dump.
> queue 59d5a74 QUEUE QINFO NEXT PRIVATE FLAGS HEAD OTHERQ COUNT 59d5a74 1884c1c 59d5474 59d5500 0x003e 59e1c00 59d5a00 4096 > mblk 59e1c00 ADDRESS NEXT PREVIOUS CONT RPTR WPTR DATABLOCK 59e1c00 0 0 0 59e2000 59e3000 59e1c44 > dblk 59e1c44 ADDRESS FREEP BASE LIM REFCNT TYPE SIZE 59e1c44 0 59e2000 59e3000 1 0 1000
Displays deadlock analysis information about all types of locks (simple, complex, and lockl). The dlock subcommand searches for deadlocks from a given start point. If ThreadIdentifier is given, the corresponding kernel thread is the start point. If -p is given without a ProcessorNumber, the start point is the running kernel thread on the current processor. If -p ProcessorNumber is given, the running kernel thread on the specified processor is the start point. If no arguments are given, dlock searches for deadlocks among all threads on all processors.
The first output line gives information about the starting kernel thread, including the lock which is blocking the kernel thread, and a stack trace showing the function calls which led to the blocking lock request. Each subsequent line shows the lock held by the blocked kernel thread from the previous line, and identifies the kernel thread or interrupt handler which is blocked by those locks. If the information required for a full analysis is not available (paged out), an abbreviated display is shown; in this case, examine the stack trace to locate the locking operations which are causing the deadlock. The display stops when a lock is encountered for a second time, or no blocking lock is found for the current kernel thread.
>
dlock
Deadlock from tid 00d3f. This tid waits for the first line lock,
owned by Owner-Id that waits for the next line lock, and so on...
LOCK NAME | ADDRESS | OWNER-ID | WAITING FUNCTION
lockC1 | 0x001f79e0 | Tid 113d | .lock_write_ppc
called from : .times + 0000020c
Dump data incomplete.Only 0 bytes found out of 4.
called from : .file + 0000000b
lockC2 | 0x001f79e8 | Tid d3f | .lock_write_ppc
called from : .times + 000001c8
Dump data incomplete.Only 0 bytes found out of 4.
called from : .file + 0000000b
The dmodsw subcommand displays the streams drivers-switch table. The information printed is contained in an internal structure. The following members of this internal structure are described here:
The flags structure member, if set, is based on one of the following values:
| #define | Value | Description |
| F_MODSW_OLD_OPEN | 0x1 | Supports old-style (V.3) open/close parameters |
| F_MODSW_QSAFETY | 0x2 | Module requires safe timeout/bufcall callbacks |
| F_MODSW_MPSAFE | 0x4 | Non-MP-Safe drivers need funneling |
The synchronization level codes are described in the /usr/include/sys/strconf.h file.
This subcommand can be issued from crash on either a running system or a system dump.
> dmodsw NAME ADDRESS NEXT PREVIOUS FLAG SYNCHQ STREAMTAB S-LVL COUNT MAJOR sad 5a0cf40 5a0cf00 5a0c9c0 0x0 5a0ad40 188c600 3 0 12 slog 5a0cf00 5a0cec0 5a0cf40 0x0 5a0ad20 188c8a0 3 0 13 en 5a0cec0 5a0ce80 5a0cf00 0x0 5a0ad00 1893ee0 3 0 27 et 5a0ce80 5a0ce40 5a0cec0 0x0 5a0ace0 1893ee0 3 0 28 tr 5a0ce40 5a0ce00 5a0ce80 0x0 5a0acc0 1893ee0 3 0 29 fi 5a0ce00 5a0cdc0 5a0ce40 0x0 5a0aca0 1893ee0 3 0 30 echo 5a0cdc0 5a0cd80 5a0ce00 0x0 0 18951a0 5 0 31 nuls 5a0cd80 5a0cd40 5a0cdc0 0x0 0 1895190 5 0 32 spx 5a0cd40 5a0cd00 5a0cd80 0x0 5a0ac80 1895d70 3 0 33 unixdg 5a0cd00 5a0ccc0 5a0cd40 0x0 5a0ac60 18a14e0 3 0 34 unixst 5a0ccc0 5a0cc80 5a0cd00 0x0 5a0ac40 18a14e0 3 0 35 udp 5a0cc80 5a0cc40 5a0ccc0 0x0 5a0ac20 18a14e0 3 0 36 tcp 5a0cc40 5a0cb40 5a0cc80 0x0 5a0ac00 18a14e0 3 0 37 rs 5a0cb40 5a0cb00 5a0cc40 0x0 0 18b31d0 5 1 15 pts 5a0cb00 5a0ca40 5a0cb40 0x0 0 18fc930 4 7 24 ptc 5a0ca40 5a0ca00 5a0cb00 0x0 0 18fa5c0 4 2 23 ttyp 5a0ca00 5a0c9c0 5a0ca40 0x0 0 18fc950 4 0 26 ptyp 5a0c9c0 5a0cf40 5a0ca00 0x0 0 18fc940 4 0 25
The ds subcommand returns the symbols closest to the given address. The ds subcommand can take either a text address or a data address.
> ds 012345 .ioctl_systrace + 0x000001b5
When a number such as 0x000001b5 is displayed, it shows the number of bytes by which the given address is offset from the entry point of the routine.
Uses the specified process slot number to display a combined hex and ASCII dump of the user block for any processs that is not swapped out. The default is the current process. Displays a combined hex and ASCII dump of the specified thread's uthread structure and of the user structure of the process which owns the thread. If the data is not available (paged out), a message is displayed. The default is the current thread.
> du 3 Uthread structure of thread slot 3 00000000 00000000 00000000 2ff7fec0 00000000 *......../.......* 00000010 00000303 00000000 00030644 000010b0 *...........D....* 00000020 22222828 00030644 00006244 00000009 *""((...D..bD....* . . .
The dump subcommand displays the name of each component for which there is data present. After you select a component name from the list, the crash program loads and runs the associated formatting routine contained in the /usr/lib/ras/dmprtns directory.
If there is more than one data area for the selected component, the formatting routine displays a list of the data areas and allows you to select one. The crash command then displays the selected data area. You can enter the quit subcommand to return to the previously displayed list and make another selection or enter quit a second time to leave the dump subcommand loop.
errpt [ count]Displays messages in the error log. Count is the number of messages to print that have already been read by the errdemon process. (The default is 3 messages.) errpt always prints all messages that have not yet been read by the errdemon process.
The file subcommand displays the file table. Unless you request specific file entries, the command displays only those with a nonzero reference.
> f 3 SLOT REF INODE FLAGS 3 1 0x018e53f0 read
Refer to sys/file.h for the structure definition.
find [-u] [-s] [-p slot] [-c context] [-a alignment] pattern
Recognized by the x subcommand alias. Search user-space for a given pattern. The default is to search the GPR save areas in the mstsave areas which are both on the Current Save Area Chain (CSA) and in each uthread area for every thread.
| -u | Search all process private segments, (Stack, Uarea,...) |
| -s | Search all process private segment from the current stack pointer. |
| -c context | Number of bytes of context to print on a match. |
| -a alignment | Byte alignment for pattern. The default is 4. |
| -p slot | Search only specified process. The default is to search all processes. |
Attention: Using the find command on a running system may cause system crashes.
Rules for pattern
pattern is a search pattern of any arbitrary length that contains either a hexadecimal number or a string. To specify a hexadecimal pattern, just type the hex digits. "Don't care" digits can be represented with the character x . To specify a string pattern, enclose the pattern in double quotes. "Don't care" characters can be represented with the sequence \x
Examples:
> find -k 02x4 00110a28: 02140008 |....| 00110af0: 02640004 |.d..| 00110c80: 02e40004 |....| 003f0ed8: 02242ff8 |.$/.| ... > find -k "b\xt" 00012534: 6269745f |bit_| 00012618: 6269745f |bit_| 0001264c: 6269745f |bit_| 00021cb0: 62797465 |byte| 00021d60: 62797465 |byte| ... > find -k "i_ena" 0 250000 001ceaa8: 695f656e 61626c65 |i_enable|
find -k [-c context][-a alignment] pattern [start[end]]
Recognized by the x subcommand alias. Search the kernel segments. The default range is the whole of each kernel segment.
| -c context | Number of bytes of context to print on a match. | |
| -a alignment | Byte alignment for pattern. The default is 4. |
find -b branch_addr [start_addr[end_addr]]
Recognized by the x subcommand alias. Search for a branch to the given address. The default range is the whole of each kernel segment.
find -m [-a addr] [-t type] [-c] [-i] [start[end]]
Recognized by the x subcommand alias. Search the things that look like mbufs. The default search range is the network memory heap.
| -a | Search for mbufs that point to this cluster address. | |
| -t type | Only search for this type of mbuf. | |
| -c | Only search for clusters. | |
| -i | Ignore length sanity checks. |
find -v [-f] wordval [start[end]]
Recognized by the x subcommand alias. Search for the first word not matching the given value. The default is to search the kernel segments.
| -f | Force scan to continue when a region not in the dump is scanned. |
find -U seg_id
Recognized by the x subcommand alias. Search for processes whose segment registers contain the given segment ID.
The fmodsw subcommand displays the streams modules-switch table. The information printed is contained in an internal structure. The following members of this internal structure are described here:
The flags structure member, if set, is based one of the following values:
| #define | Value | Description |
| F_MODSW_OLD_OPEN | 0x1 | Supports old-style (V.3) open/close parameters |
| F_MODSW_QSAFETY | 0x2 | Module requires safe timeout/bufcall callbacks |
| F_MODSW_MPSAFE | 0x4 | Non-MP-Safe drivers need funneling |
The synchronization level codes are described in the /usr/include/sys/strconf.h file.
This subcommand can be issued from crash on either a running system or a system dump.
> fmodsw NAME ADDRESS NEXT PREVIOUS FLAG SYNCHQ STREAMTAB S-LVL COUNT MAJOR bufcall 5a0cf80 5a0cc00 5a0ca80 0x1 5a0ad60 188bf80 3 0 -1 sc 5a0cc00 5a0cbc0 5a0cf80 0x0 5a0abe0 18a29b0 3 0 -1 timod 5a0cbc0 5a0cb80 5a0cc00 0x0 5a0abc0 18a34b0 3 0 -1 tirdwr 5a0cb80 5a0cac0 5a0cbc0 0x0 5a0aba0 18a4010 3 0 -1 ldterm 5a0cac0 5a0ca80 5a0cb80 0x0 0 18ef460 4 8 -1
Traces a kernel stack for the thread specified by ThreadSlotNumber. Displays the called subroutines with a hex dump of the stack frame for the subroutine that contains the parameters passed to the subroutine. By default, the current thread is traced. This subcommand will not work on the current thread of a running system because it uses stack tracing; however, it does work on a dump image.
> fs STACK TRACE: **** .et_wait **** 2ff97e78 2FF97ED8 0080D568 00000000 018F4C60 /.^....h......L` 2ff97e88 2FF97EE8 0080D568 00082BC0 000BA020 /.^....h..+..... 2ff97e98 2FF97ED8 28008044 00082418 2FF98000 /.^.(..D..B./... 2ff97ea8 00000000 000B8468 00000000 00000000 .......h........ 2ff97eb8 2FF97F38 0000000B 00000004 00000004 /..8............ 2ff97ec8 00000005 01DFE258 00000000 E3000600 .......X........
Hide the specified symbol from the crash commands that convert addresses to symbols and offsets. The main reason for this ability is to hide symbols that may show up in the middle of a function. This occurs in assembly routines. See the unhide subcommand .
hide
Show all hidden symbols. See the unhide subcommand .
The inode subcommand displays the i-node table and the i-node data block addresses. You can display a specific i-node by specifying the major and minor device numbers of the device where the i-node resides and the i-node number. The command displays the i-node only if it is currently on the system hash list.
>inode ADDRESS MAJ MIN INUMB REF LINK UID GID SIZE MODE SMAJ SMIN FLAGS 0x018e4e50 010 0007 11264 0 1 2 2 30 ----777 - - 0x018f9fd0 010 0009 16384 1 6 201 0 512 d---755 - - 0x018ea940 010 0011 0 1 0 0 0 0 ---- 0 - - ...
If you use the kfp subcommand without parameters, it displays the last kernel frame pointer address that was set using kfp. If you specify a frame pointer address, it sets the kernel frame pointer to the new address. Use this subcommand in conjunction with the -r flag of the trace subcommand.
> kfp kfp: 00000000
The knlist subcommand displays the addresses of all the specified symbol names. If there is no such symbol, the subcommand displays a no match message. Run this subcommand only on an active system.
The knlist subcommand runs a subroutine to the active kernel to obtain the address from the system's knlist. The nm subcommand provides the same function but searches the symbol table in the Kernel Image File for the address and therefore can be used on a dump.
> knlist open open:0x000bbc98
The le subcommand displays the kernel load-list entries. If you specify an address in a kernel extension, the corresponding load list entry is displayed. If you attempt to display a paged-out loader entry, the subcommand displays an error message.
>
le
LoadList entry at 0x02593e00
Module start:0x00000000_03412000 Module filesize:0x00000000_00005428
Module *end:0x00000000_03417428
*data:0x00000000_03414a00 data length:0x00000000_00002a28
Use-count:0x0001 load_count:0x0001 *file:0x00000000
flags:0x00000262 TEXT DATAINTEXT DATA DATAEXISTS
*exp:0x00000000 *lex:0x00000000 *deferred:0x00000000 *expsize:0x66666666
Name: xmdbgdd
ndepend:0x0001 maxdepend:0x0001
*depend[00]:0x02593900
le_next: 02593900
LoadList entry at 0x02593900
Module start:0x00000000_02fd5000 Module filesize:0x00000000_0006eafc
Module *end:0x00000000_03043afc
*data:0x00000000_03039a20 data length:0x00000000_0000a0dc
Use-count:0x0004 load_count:0x0001 *file:0x00000000
flags:0x00000272 TEXT KERNELEX DATAINTEXT DATA DATAEXISTS
*exp:0x03050000 *lex:0x00000000 *deferred:0x00000000 *expsize:0x66666666
Name: /usr/lib/drivers/nfs.ext
ndepend:0x0001 maxdepend:0x0001
*depend[00]:0x02593b00
le_next: 02593880
...
>
le 3414568
LoadList entry at 0x02593e00
Module start:0x00000000_03412000 Module filesize:0x00000000_00005428
Module *end:0x00000000_03417428
*data:0x00000000_03414a00 data length:0x00000000_00002a28
Use-count:0x0001 load_count:0x0001 *file:0x00000000
flags:0x00000262 TEXT DATAINTEXT DATA DATAEXISTS
*exp:0x00000000 *lex:0x00000000 *deferred:0x00000000 *expsize:0x66666666
Name: xmdbgdd
ndepend:0x0001 maxdepend:0x0001
*depend[00]:0x02593900
le_next: 02593900
The linkblk subcommand displays the streams linkblk table. Refer to the /usr/include/sys/stream.h file for the linkblk structure definitions. If there are no linkblk structures found on the system, the linkblk subcommand will print a message stating that no structures are found.
This subcommand can be issued from crash on either a running system or a system dump.
This example shows a regular link:
> linkblk
QTOP QBOT INDEX
5ab8b74 5ae5074 5ab4200
This example shows a persistent link:
> linkblk
QTOP QBOT INDEX
0 5ae5174 5a4ef00
The mblock subcommand displays the allocated streams message-block headers. The address parameter is required. If the address is not supplied, this command will print an error message stating that the address is required. Refer to the /usr/include/sys/stream.h file for the queue structure definitions.
The mblock subcommand's checking of the address parameter is limited to verifying that the address falls on a 128-byte boundary. It is up to the user to be sure that a valid address is specified.
To determine a valid address, run the queue subcommand. From the output of the queue subcommand, select a non-zero address for the head of the message queue under the HEAD column heading for either a read queue or a write queue.
This subcommand can be issued from crash on either a running system or a system dump.
> queue WRITEQ QINFO NEXT PRIVATE FLAGS HEAD READQ COUNT NAME 1802c08c 22dac00 1802c48c 1802c200 0x002a 0 1802c000 0 sth 1802c48c 2324960 1802ec8c 1807a2ec 0x0028 0 1802c400 0 mi_timod 1802ec8c 2320158 0 1802cc2c 0x8028 0 1802ec00 0 xtiso 1806ac8c 22dac00 1806c88c 1806aa00 0x002a 0 1806ac00 0 sth 1806c88c 2324960 1806ce8c 1807a02c 0x0028 0 1806c800 0 mi_timod 1806ce8c 2320158 0 1806cc2c 0x8028 0 1806ce00 0 xtiso 1806ae8c 22dac00 1806a88c 1806a000 0x002a 0 1806ae00 0 sth 1806a88c 2324960 1806a28c 1807a56c 0x0028 0 1806a800 0 mi_timod 1806a28c 2320158 0 1806a42c 0x8028 0 1806a200 0 xtiso 1802e68c 22dac00 1802ea8c 1802e400 0x002a 0 1802e600 0 sth 1802ea8c 2b2b580 1802e88c 1802e200 0x0028 0 1802ea00 0 ldterm 1802e88c 25a48d0 0 2b19130 0x0020 180abe00 1802e800 684 rs > mblk 180abe00 ADDRESS NEXT PREVIOUS CONT RPTR WPTR DATABLOCK 180abe00 180ab800 0 0 180abe6c 180abeb8 0
The mbuf subcommand displays mbuf structures in the system. These structures are memory buffers that are chained together and can be manipulated by the Memory Buffer kernel services. If you specify the -d flag, the subcommand also displays the data associated with the mbuf structure. The -l flag causes the subcommand to display an entire chain of mbuf structures. The -c flag tells mbuf to use the cluster free list rather than the mbuf pointer. If addr is not specified, then mbuf defaults to using the system mbuf pointer. Note that valid mbuf pointers must be on a 128-byte boundary.
> mbuf -l
mbuf:0x18099900 len: 120 type: header act:00000000 next:18099400
data:1809995e
mbuf:0x18099400 len: 62 type: header act:00000000 next:18099d00
data:1809942e
mbuf:0x18099d00 len: 156 type: header act:00000000 next:18096800
data:1809b858
mbuf:0x18096800 len: 156 type: header act:00000000 next:18099300
data:1809b858
mbuf:0x18099300 len: 62 type: header act:00000000 next:18099700
data:1809932e
mbuf:0x18099700 len: 4 type: data act:00000000 next:18099500
data:180a103e
...
Displays the mstsave portion of the uthread structure at the addresses specified (see the uthread.h and mstsave.h header files in /usr/include/sys). If you do not specify an address, it displays all of the mstsave entries on the current save area (CSA) chain except the first. If you specify the -f flag the first mstsave area on the CSA chain displays.
Displays network kernel data structures either for a running system or a system dump. The ndb (network debugger) subcommand displays the following options:
The nm subcommand displays the symbol value and type found in KernelFile.
> nm open 00095484 000C70 PR SD <.open> 00095484 PR LD .open 000BBC98 00000C SV SD open
The od subcommand dumps the number of data values specified by Count starting at Symbol value or Address according to Format. Possible formats are octal, longoct, decimal, longdec, character, hex, instruction, and byte. The default is hex. Note that if you use the Format parameter, you must also use Count. If the SymbolName or Address is preceeded by an asterisk, then the symbol or address is dereferenced before displaying the data.
The od subcommand is especially useful during program development in order to see structure values at a given point in time.
>
od open 10
00095484: 7c0802a6 bf21ffe4 90010008 9421ff30
00095494: 609c0000 832202e0 607b0000 60bd0000
000954a4: 63230000 38800000
>
od open 10 byte
00095484: 0174 0010 0002 0246 0277 0041 0377 0344
0009548c: 0220 0001
>
od 12345
warning: word alignment performed
00012344: 480001d8
>
user -s 3
MST Segment Regs
0:0x00000000 1:0x00002c0b 2:0x00004411 3:0x007fffff
4:0x007fffff 5:0x007fffff 6:0x007fffff 7:0x007fffff
8:0x007fffff 9:0x007fffff 10:0x007fffff 11:0x007fffff
12:0x007fffff 13:0x007fffff 14:0x00001004 15:0x007fffff
...
>
od 4411:ff3b400 12
004411:ff3b400: 00000000 00000000 2ff22e28 00000000
004411:ff3b410: 00000306 00000000 0002a7ec 000010b0
004411:ff3b420: 82202220 0002a7ec 00000000 0000001c
>
od Debug_record
001cc378: 00000000
>
od *Debug_record
00000000: 00000000
Displays per-processor data area (PPDA) structures for the specified processor. If no processor is specified, the current processor selected by the cpu subcommand is used. If the asterisk argument is given, the PPDA of every enabled processor is displayed.
>
ppd
Per Processor Data Area for processor 0
alsave[ 0]...............0000000000000000
alsave[ 1]...............0000000000000000
alsave[ 2]...............0000000000000000
alsave[ 3]...............0000000000000000
alsave[ 4]...............0000000000000000
alsave[ 5]...............0000000000000000
alsave[ 6]...............0000000000000000
alsave[ 7]...............0000000000000000
alsave[ 8]...............0000000000000000
alsave[ 9]...............0000000000000000
alsave[10]...............0000000000000000
alsave[11]...............0000000000000000
alsave[12]...............0000000000000000
alsave[13]...............0000000000000000
alsave[14]...............0000000000000000
alsave[15]...............0000000000000000
csa......................003f0eb0
mstack...................003efeb0
fpowner..................00000000
curthread................e60013ec
...
Does dbx-style printing of structures. The -i option must be given on the command line to use this feature.
If type is omitted, the default type set by the last print -d command is used.
print -d type
Recognized by the pr, str, or struct subcommand aliases. Sets the default type for subsequent print commands to type.
The proc subcommand displays the process table, including the kernel thread count (the number of threads in the process) and state of each process . Use the -r flag to display only runnable processes. Use the - flag to display a longer listing of the process table.
>p
SLT ST PID PPID PGRP UID EUID TCNT NAME
0 a 0 0 0 0 0 1 swapper
FLAGS: swapped_in no_swap fixed_pri kproc
1 a 1 0 0 0 0 1 init
FLAGS: swapped_in no_swap
2 a 204 0 0 0 0 1 wait
FLAGS: swapped_in no_swap fixed_pri kproc
...
>p 20
SLT ST PID PPID PGRP UID EUID TCNT NAME
20 a 1406 1 1406 0 0 1 ksh
FLAGS: swapped_in no_swap
> p - 0
SLT ST PID PPID PGRP UID EUID TCNT NAME
0 a 0 0 0 0 0 1 swapper
FLAGS: swapped_in no_swap fixed_pri kproc
Links: *child:0xe30013b0 *siblings:0x00000000 *uidl:0xe3002490
*ganchor:0x00000000 *pgrpl:0x00000000 *ttyl:0x00000000
Dispatch Fields: pevent:0x00000000 *synch:0xffffffff
lock:0x00000000 lock_d:0x00000000
Thread Fields: *threadlist:0xe6000000 threadcount:1
active:1 suspended:0 local:0 terminating:0
Scheduler Fields: fixed pri: 16 repage:0x00000000 scount:0 sched_pri:0
*sched_next:0x00000000 *sched_back:0x00000000 cpticks:130
msgcnt:0 majfltsec:0
Misc: adspace:0x0000340d kstackseg:0x007fffff xstat:0x0000
*p_ipc:0x00000000 *p_dblist:0x00000000 *p_dbnext:0x00000000
Signal Information:
pending:hi 0x00000000,lo 0x00000000
sigcatch:hi 0x00000000,lo 0x00000000 sigignore:hi 0xffffffff,lo 0xfff7ffff
Statistics: size:0x00000000(pages) audit:0x00000000
accounting page frames:0 page space blocks:0
Refer to the sys/proc.h header file for the structure definition.
The qrun subcommand displays the list of scheduled streams queues. If there are no queues found for scheduling, the qrun subcommand will print a message stating there are no queues scheduled for service.
This subcommand can be issued from crash on either a running system or a system dump.
> qrun QUEUE 59d5a74
The queue subcommand displays the STREAMS queue. If the address optional parameter is not supplied, crash will display information for all queues available. Refer to the /usr/include/sys/stream.h file for the queue structure definitions.
If you wish to see the information stored for a read queue, issue the queue subcommand with the read queue address specified as the parameter.
When you issue the queue subcommand with the address parameter, the column headings do not distinguish between the read queue and the write queue. One queue address will be displayed under the column heading QUEUE . The other queue in the pair will be displayed under the column heading OTHERQ . The write queue will have a numerically higher address than the read queue.
This subcommand can be issued from crash on either a running system or a system dump.
> queue WRITEQ QINFO NEXT PRIVATE FLAGS HEAD READQ COUNT NAME 1802e08c 2268c00 1802e48c 1802e200 0x002a 0 1802e000 0 sth 1802e48c 22b2960 1802cc8c 1807a32c 0x0028 0 1802e400 0 mi_timod 1802cc8c 22ae158 0 1802ec2c 0x8028 0 1802cc00 0 xtiso 1806cc8c 2268c00 1806a88c 1806ca00 0x002a 0 1806cc00 0 sth 1806a88c 22b2960 1806ae8c 1807a06c 0x0028 0 1806a800 0 mi_timod 1806ae8c 22ae158 0 1806ac2c 0x8028 0 1806ae00 0 xtiso 1806ce8c 2268c00 1806c88c 1806c000 0x002a 0 1806ce00 0 sth 1806c88c 22b2960 1806c28c 1807a5ac 0x0028 0 1806c800 0 mi_timod 1806c28c 22ae158 0 1806c42c 0x8028 0 1806c200 0 xtiso 1802c68c 2268c00 1802ca8c 1802c400 0x002a 0 1802c600 0 sth 1802ca8c 2ab9580 1802c88c 1802c200 0x0028 0 1802ca00 0 ldterm 1802c88c 25328d0 0 2aa7130 0x0028 0 1802c800 0 rs
Search the symbols table for name.
| -s | Prints symbols matching name in the nm format. Also prints the symbol table entry for the last symbol found. |
| -n | Prevents the search from examining kernel extensions.. |
search[-n] addr
Search for the symbol with the largest value less than or equal to addr.
| -n | Prevents the search from examining kernel extensions.. |
Displays segstate information for a 64-bit process. The segstate for the current process displays unless the -p or -t flags are specified. All of the segstate entries display unless limited by the -l flag or the starting esid, start_esid and possible ending esid, end_esid. Specifying the -s flag limits the display to only those segstate entries matching the given segflags, matching pattern types, as well as their corresponding values. The -l flag limits the display to a maximum number of entries. The -n flag also prints the segnodes for the displayed data. Segnode entries are not included in the count when limiting the data with -l.
| -p pslot | Specifies the process slot number. |
| -t tslot | Specifies the thread slot number. |
| -s segflag:[value] | Limites the display to the segstate entries matching that segflag and value. |
| -l limit | Specifies the number of entries to print. |
| -n | Prints the uadnodes for the displayed data. |
Recognized by the sel subcommand alias. Displays all select control blocks.
select p proc_slot
Recognized by the sel subcommand alias. Displays select control blocks for process in specified slot.
Note: The p flag is not prefixed with a -.
select dev_id unique_id
Recognized by the sel subcommand alias. Displays select control blocks matching the specified device and unique IDs.
Display crash variables and values.
set allhex [no]
Causes crash to use only hex values for both input and output as oppossed to a mixture of hex and decimal. Specify no to turn this option off.
set edit [emacs|gmacs|none|vi]
Sets command line editing mode.
set fpregs [yes|no|auto]
Specify whether or not floating-point registers should be displayed. If auto is used, the fpeu variable in the mstsave area determines when to display the registers.
set idarch [ppc|pwr|auto]
Set instruction decode architecture. auto detects the architecture from the system.
set logfile [filename]
Set logfile to given name, or turn off logging if no name is given.
set loglevel [0|1|2]
Set logging granularity to:
| 0 | coarse-only commands will be logged. |
| 1 | medium-commands and output to terminal will be logged. |
| 2 | fine-commands and all outputs will be logged, including redirected. |
set prtype [type]
Set the default print type. This is equivalent to print -d type.
set quiet [no]
Suppress error messages concerning missing or swapped out threads and processes. Specify no to turn off this option.
The socket subcommand displays the system socket structures. Use the - flag to also display the socket buffers.
> sock
1802e800: type:0x0002 (DGRAM) opts:0x0000 ()
state:0x0082 (ISCONNECTED|PRIV) linger:0x0000
pcb:0x1807a6c0 proto:0x000bbd30 q0:0x00000000 q0len:0
q:0x00000000 qlen:0 qlimit:0 head:0x00000000
timeo:0 error:0 oobmark:0 pgid:0
18074400: type:0x0002 (DGRAM) opts:0x0000 ()
state:0x0080 (PRIV) linger:0x0000
pcb:0x1807a100 proto:0x000bbd30 q0:0x00000000 q0len:0
q:0x00000000 qlen:0 qlimit:0 head:0x00000000
timeo:0 error:0 oobmark:0 pgid:0
...
Refer to the sys/socket.h header file for structure definitions.
Recognized by the segst and seg subcommand aliases. Displays the effective segment IDs (esid) and their corresponding segvals for a 64-bit process. If you do not specify the -p or -t flags, sr64 uses the current process. Otherwise, it uses pslot as the process slot number for the desired process, or tslot as the thread slot number of a thread contained within the desired process. It lists all entries in the adspace unless a starting esid, start_esid and possible ending esid, end_esid is given. Also, it stops listing if the number of entries specified by the -l flag have printed. Since adspace_t holds 16 entries, each line consists of an esid, its corresponding value, and the 3 subsequent values following it in the adspace_t. The -n flag also prints the uadnodes for the displayed data. uadnode entries are not included in th count when limiting the data with -l.
| -p pslot | Specifies the process slot number. |
| -t tslot | Specifies the thread slot number. |
| -l limit | Specifies the number of entries to print. |
| -n | Prints the uadnodes for the displayed data. |
The stack subcommand displays a dump of the kernel stack of a process the kernel thread identified by ThreadSlotNumber. The addresses are virtual data addresses rather than true physical addresses. If you do not specify an entry, the subcommand displays information about the last running process kernel thread. You cannot trace the stack of the current running process kernel thread on a running system.
> s KERNEL STACK: 2ff97a50: 8eaa4 16 2ff97ac8 2 2ff97a60: 90b0 8e8b4 2ff97ad8 0 2ff97a70: 1 26 2ff97ac8 2ff98938 ...
The stat subcommand displays statistics found in the dump. These statistics include the panic message (if there is one), time of crash, and system name. If the memory overlay detection system (MODS) was enabled (shown here as xmalloc debug), and it detected a problem, stat displays the MODS error message.
> stat
sysname: AIX
nodename: riva
release: 3
version: 4
machine: 000018654100
time of crash: Thu Aug 28 21:03:49 1997
age of system: 18 min.
xmalloc debug: enabled
dump code: 300
csa: 0x2ff3b400
exception struct:
dar: 0x00000000
dsisr: 0x00000000:
srv: 0x00000000
dar2: 0x00000000
dsirr: 0x00000000: (errno) "Error 0"
Debug kernel error message: A program has tried to access freed
xmalloc memory.
Displays a description of the kernel thread scheduled on the designated processor. If no processor is specified, the status subcommand displays information for all processors. The information displayed includes the processor number, kernel thread identifier, kernel thread table slot, process identifier, process table slot, and process name.
> status 0 CPU TID TSLOT PID PSLOT PROC_NAME 0 1fe1 31 1fd8 31 crash
The stream subcommand displays the stream head table. The information printed is contained in an internal structure. The following members of this internal structure are described here:
The flags structure member, if set, is based on combinations of the following values:
| #define | Value | Description |
| F_STH_READ_ERROR | 0x0001 | M_ERROR with read error received, fail all read calls. |
| F_STH_WRITE_ERROR | 0x0002 | M_ERROR with write error received, fail all writes. |
| F_STH_HANGUP | 0x0004 | M_HANGUP received, no more data. |
| F_STH_NDELON | 0x0008 | Do TTY semantics for ONDELAY handling. |
| F_STH_ISATTY | 0x0010 | This stream acts a terminal. |
| F_STH_MREADON | 0x0020 | Generate M_READ messages. |
| F_STH_TOSTOP | 0x0040 | Disallow background writes (for job control). |
| F_STH_PIPE | 0x0080 | Stream is one end of a pipe or FIFO. |
| F_STH_WPIPE | 0x0100 | Stream is the "write" side of a pipe. |
| F_STH_FIFO | 0x0200 | Stream is a FIFO. |
| F_STH_LINKED | 0x0400 | Stream has one or more lower streams linked. |
| F_STH_CTTY | 0x0800 | Stream controlling tty. |
| F_STH_CLOSED | 0x4000 | Stream has been closed, and should be freed. |
| F_STH_CLOSING | 0x8000 | Actively on the way down. |
This subcommand can be issued from crash on either a running system or a system dump.
> stream ADDRESS WRITEQ MAJ/MIN RERR WERR FLAGS IOCID WOFF PCNT POLQNEXT SIGQNEXT 59b1900 59c2a74 15, 0 0 0 0x0838 0 0 2 0 0 59d3c00 59d5a74 23, 5 0 0 0x0020 0 0 1 0 0 59ffe00 59ff074 23, 4 0 0 0x0020 0 0 1 0 0 5ab4c00 5ab4374 24, 0 0 5 0x0816 0 0 2 0 0 59d3f00 59ee974 24, 1 0 5 0x0816 0 0 2 0 0 59d3800 59dff74 24, 2 0 5 0x0816 0 0 2 0 0 59d3700 5a9c174 24, 3 0 5 0x0816 0 0 2 0 0 59ff800 59ff774 24, 4 0 0 0x0810 0 0 2 0 0 5a94d00 59ee574 24, 5 0 0 0x0830 0 0 2 0 0 5a94600 5a96c74 24, 6 0 5 0x0816 0 0 2 0 0
Displays the symptom string for a dump. It is not valid on a running system. The optional -e option will create an error log entry containing the symptom string, and is normally only used by the system and not entered manually. The symptom string can be used to identify duplicate problems.
Displays the mstsave portion of the user structures of the named kernel threads (see the user.h and mstsave.h header files). If you do not specify an entry, information about the last running kernel thread is displayed. Floating point register information is only shown if the fpeu value in the mstsave area is set to 1, or if the command set fpregs yes has been run. This subcommand replaces the pcb subcommand.
> tcb
UTHREAD AREA FOR SLOT 25 (ucfgxmdbg)
SAVED MACHINE STATE
curid:0x00001736 m/q:0xb651f200 iar:0x0014397c cr:0x20228824
msr:0x000090b0 lr:0x0014395c xer:0x00000008 kjmpbuf:0x00000000
backtrack:0x00 tid:0x00000000 fpeu:0x00 excp_type:0x00000000
ctr:0x00000000 *prevmst:0x00000000 *stackfix:0x00000000 intpri:0x0b
o_iar:0x00000000 o_toc:0x00000000 o_arg1:0x00000000 excbranch:0x00000000
o_vaddr:0x00000000
msr flags: EE ME AL IR DR
cr flags: | = | | = | = |< |< | = | > |
Exception Struct
0x0114807c 0x40000000 0x00000000 0x0114807c 0x00000106
MST Segment Regs
0:0x00000000 1:0x00002c0b 2:0x0000759d 3:0x007fffff
4:0x007fffff 5:0x007fffff 6:0x007fffff 7:0x007fffff
8:0x007fffff 9:0x007fffff 10:0x007fffff 11:0x007fffff
12:0x007fffff 13:0x40003c0f 14:0x00001004 15:0x007fffff
alloc flags: 0xe01f0000 (Seg Regs: 0, 1, 2, 11, 12, 13, 14, 15)
General Purpose Regs
0:0x0113b000 1:0x2ff3b2d0 2:0x001cc368 3:0x01148040
4:0x0000d040 5:0xd0000000 6:0x00000000 7:0x000090b0
8:0x80000000 9:0x40003c0f 10:0x00000001 11:0xb8000080
12:0x034123f0 13:0xdeadbeef 14:0xdeadbeef 15:0xdeadbeef
16:0xdeadbeef 17:0xdeadbeef 18:0x20000474 19:0xdeadbeef
20:0xdeadbeef 21:0xdeadbeef 22:0xdeadbeef 23:0xdeadbeef
24:0x2ff3b6e0 25:0x2ff3b400 26:0x100002e4 27:0x42424424
28:0xe3002058 29:0xe60013ec 30:0x00143dac 31:0x00000000
Kernel stack address: 0x2ff3b400
Displays the contents of the kernel thread table. The - (minus) flag displays a longer listing of the thread table. The -r flag displays only runnable kernel threads. The -p flag displays only those kernel threads which belong to the process identified by ProcessSlotNumber. The -a flag displays the kernel thread structure at Address. If ThreadSlotNumber is given, only the corresponding kernel thread is displayed.
> thread 1
SLT ST TID PID CPUID POLICY PRI CPU EVENT PROCNAME
1 s 1e1 1 unbound other 3c 0 init
FLAGS: wakeonsig
> th
SLT ST TID PID CPUID POLICY PRI CPU EVENT PROCNAME
0 s 3 0 0 FIFO 10 78 swapper
t_flags: wakeonsig kthread
1 s 105 1 0 other 3c 0 init
t_flags: wakeonsig
2 r 205 204 0 FIFO 7f 78 wait
t_flags: sig_avail kthread
3 s 307 306 0 RR 24 0 netm
t_flags: sig_avail kthread
...
> th - 3
SLT ST TID PID CPUID POLICY PRI CPU EVENT PROCNAME
3 s 307 306 0 RR 24 0 netm
t_flags: sig_avail kthread
Links: *procp:0xe3000438 *uthreadp:0x2ff3b400 *userp:0x2ff3b6e0
*prevthread:0xe6000264 *nextthread:0xe6000264, *stackp:0x00000000
*wchan1(real):0x00000000 *wchan2(VMM):0x00000000 *swchan:0x00000000
wchan1sid:0x00000000 wchan1offset:0x00000000
pevent:0x00000000 wevent:0x00000912 *slist:0x00000000
Dispatch Fields: *prior:0xe6000264 *next:0xe6000264
polevel:0x00000000 ticks:0x0000 *synch:0xffffffff result:0x00000000
*eventlst:0x00000000 *wchan(hashed):0x00000000 suspend:0x0001
thread waiting for: event(s)
Scheduler Fields: cpuid:0x0000 scpuid:0x0000 pri: 36 policy:RR
affinity:0x0000 cpu:0x0000 lpri: 0 wpri:127 time:0xff
sav_pri:0x24
Misc: lockcount:0x00000000 ulock:0x00000000 *graphics:0x00000000
dispct:0x0000a5ae fpuct:0x00000000 boosted:0x0000
userdata:0x00000000
Signal Information: cursig:0x00 *scp:0x00000000
pending:hi 0x00000000,lo 0x00000000 sigmask:hi 0x00000000,lo 0x00000000
The trace subcommand displays a kernel stack trace of the process kernel thread identified by ThreadSlotNumber. The trace starts at the top of the stack and attempts to find valid stack frames deeper in the stack. By default, the current process kernel thread is used.
When using the -k flag, the stack frame addresses indicate the stack frame containing the link register of the function that is displayed. The -m flag causes trace to display the traceback associated with each mstsave area on the current save area chain, except the first. To see a traceback from the first mstsave area, specify the -f flag. When either the -m or -k flags are used, trace may also show the LR (link register)and top stack frame pointer. These are not part of the stack trace and are therefore marked with an asterisk. The -s flag displays saved register information for each stack frame.
Use the -r flag to use the kernel frame pointer set up by the kfp subcommand as the starting address instead of the frame pointer found in the SystemImageFile. The trace subcommand stops and reports an error if an invalid frame pointer is encountered.
> t STACK TRACE: .et_wait () .e_sleep () .e_sleepl () .sleepx () .fifo_read () .fifo_rdwr () .vno_rw () .rwuio () .rdwr () .kreadv ()
> t -k 5
STACK TRACE:
0x2ff3b400 (excpt=2ef636d8:40000000:00004812:2ef636d8:00000106) (intpri=0)
IAR: .e_block_thread+23c (00029e04): l r0,0xc(r30)
LR: .e_block_thread+23c (00029e04)
2ef62ee8: .e_sleep_thread+ec (0002a454)
2ef62f48: .netisr_thread+28 (0006f854)
2ef62f88: .threadentry+18 (00047244)
2ef62fc8: .low+0 (00000000)
>
Refer to the sys/tty.h header file for the structure definition.
Unhide the specified symbol. See the hide subcommand .
unhide
Unhide all hidden symbols. See the hide subcommand .
Recognized by the uarea, u_area, and u subcommand aliases. Displays the uthread structure and the associated user structure of the thread identified by ThreadSlotNumber. (See the/usr/include/sys/user.h file for the user structure definition.) If you do not specify the entry, the information about the last running thread displays. The -s flag limits the output to segment register information.
> u 4
UTHREAD AREA FOR SLOT 4 (gil)
SAVED MACHINE STATE
curid:0x00000408 m/q:0x0000ff34 iar:0x0002a7ec cr:0x82002820
msr:0x000010b0 lr:0x0002a7ec xer:0x00000000 kjmpbuf:0x00000000
backtrack:0x00 tid:0x00000000 fpeu:0x00 excp_type:0x00000000
ctr:0x00000000 *prevmst:0x00000000 *stackfix:0x2ff22ea8 intpri:0x00
o_iar:0x00000000 o_toc:0x00000000 o_arg1:0x00000000 excbranch:0x00000000
o_vaddr:0x00000000
msr flags: ME AL IR DR
cr flags: |< | = | | | = |< | = | |
Exception Struct
0x00000000 0x40000000 0x00000000 0xd1733000 0x00000106
MST Segment Regs
0:0x00000000 1:0x00002c0b 2:0x00004812 3:0x007fffff
4:0x007fffff 5:0x007fffff 6:0x007fffff 7:0x007fffff
8:0x007fffff 9:0x007fffff 10:0x007fffff 11:0x007fffff
12:0x007fffff 13:0x007fffff 14:0x00001004 15:0x007fffff
alloc flags: 0xe01e0000 (Seg Regs: 0, 1, 2, 11, 12, 13, 14)
General Purpose Regs
0:0x00000000 1:0x2ff22ea8 2:0x001cc368 3:0x00000000
4:0x00000001 5:0x2ff3b400 6:0x0000000b 7:0x000090b0
8:0x80000000 9:0x00000001 10:0x2ff22f28 11:0x80000080
12:0x000010b0 13:0xdeadbeef 14:0xdeadbeef 15:0xdeadbeef
16:0xdeadbeef 17:0xdeadbeef 18:0xdeadbeef 19:0xdeadbeef
20:0xe6000330 21:0x00000003 22:0x01000001 23:0x00000001
24:0x00000000 25:0xe60003cc 26:0x001cc4bc 27:0x000ac498
28:0x00000000 29:0x00000000 30:0xe30005a0 31:0x00000726
Kernel stack address: 0x2ff22ff8
SYSTEM CALL STATE
error code:0x00 *kjmpbuf:0x00000000
PER-THREAD TIMER MANAGEMENT
Real/Alarm Timer (ut_timer[TIMERID_ALRM]) = 0x0
Virtual Timer (ut_timer[TIMERID_VIRTUAL]) = 0x0
Prof Timer (ut_timer[TIMERID_PROF]) = 0x0
Posix Timer (ut_timer[POSIX0]) = 0x0
Posix Timer (ut_timer[POSIX1]) = 0x0
Posix Timer (ut_timer[POSIX2]) = 0x0
Posix Timer (ut_timer[POSIX3]) = 0x0
Posix Timer (ut_timer[POSIX4]) = 0x0
SIGNAL MANAGEMENT
*sigsp:0x0 oldmask:hi 0x0,lo 0x0 code:0x0
MISCELLANOUS FIELDS:
fstid:0x00000000 ioctlrv:0x00000000 selchn:0x00000000
link:0x00000000 loginfo:0x00000000 fselchn:0x00000000
selbuc:0x00000000 sigssz:0x00000000 User msr:0x00000000
*context:0x00000000 **errnopp:0xc0c0fade *stkb:0x00000000
*audsvc:0x00000000 scsave[0]:0x00000000 scsave[1]:0x00000000
scsave[2]:0x00000000 scsave[3]:0x00000000 scsave[4]:0x00000000
scsave[5]:0x00000000 scsave[6]:0x00000000 scsave[7]:0x00000000
USER AREA OF ASSOCIATED PROCESS gil (SLOT 4, PROCTAB 0xe30005a0)
handy_lock:0x00000000 timer_lock:0x00000000
map:0x00000000 *semundo:0x00000000 *pinu_block:0x00000000
compatibility:0x00000000 lock:0x00000000
ulocks:0x00000000 *message:0x00000000 irss:0x0000000000000000
lock_word:0xffffffff *vmm_lock_wait:0x00000000 vmmflags:0x00000000
SIGNAL MANAGEMENT
Signals to be blocked (sig#:hi/lo mask,flags,func)
1:hi 0x00000000,lo 0x00000000,0x00000000,0x00000000
2:hi 0x00000000,lo 0x00000000,0x00000000,0x00000000
3:hi 0x00000000,lo 0x00000000,0x00000000,0x00000000
...
USER INFORMATION
euid:0x0000 egid:0x0000 ruid:0x0000 rgid:0x0000 luid:0x00000000
suid:0x00000000 ngrps:0x0000 *groups:0x2ff20b38 compat:0x00000000
ref:0x00000004 pag:0x00000000 cr_lock:0x00000000
acctid:0x00000000 sgid:0x00000000 epriv:0x00000000
ipriv:0x00000000 bpriv:0x00000000 mpriv:0x00000000
u_info:
ACCOUNTING DATA
start:0x340629ff ticks:0x0000000a acflag:0x0000
pr_base:0x00000000_00000000
pr_size:0x00000000 pr_off:0x00000000_00000000 pr_scale:0x00000000
process times:
user:0x00000000s 0x00000000us
sys:0x00000000s 0x376eac80us
children's times:
user:0x00000000s 0x00000000us
sys:0x00000000s 0x00000000us
CONTROLLING TTY
*ttysid:0x00000000 *ttyp(pgrp):0x00000000
ttyd(evice):0x00000000 ttympx:0x00000000 *ttys(tate):0x00000000
tty id: 0x00000000 *query function: 0x00000000
RESOURCE LIMITS AND COUNTERS
ior:0x00000000_00000000 iow:0x00000000_00000000 ioch:0x00000000_00000000
text:0x00000000_00000000 data:0x00000000_00000000 stk:0x01000000
max data:0x08000000 max stk:0x01000000 max file(blks):0xffffffff
*tstart:0x00000000_00000000 sdsize:0x00000000
*datastart:0x00000000_20000000 *stkstart0x00000000_2ff23000
soft core dump:0x7fffffff hard core dump:0x7fffffff
soft rss:0x7fffffff hard rss:0x7fffffff
cpu soft:0x7fffffff cpu hard:0x7fffffff
hard ulimit:0x7fffffff
minflt:0x00000000_00000000 majflt:0x00000000_00000000
AUDITING INFORMATION
auditstatus:0x00000000
SEGMENT REGISTER INFORMATION
ADSPACE SEGSTATE
Reg Value Alloc # Segs Fno/Shmptr Flags
0 0x40000000 yes 0x0000 0x00000000 AVAILABLE
1 0x007fffff 0x0000 0x00000000 AVAILABLE
2 0x40004812 yes 0x0000 0x00000000 AVAILABLE
3 0x007fffff 0x0000 0x00000000 AVAILABLE
4 0x007fffff 0x0000 0x00000000 AVAILABLE
5 0x007fffff 0x0000 0x00000000 AVAILABLE
6 0x007fffff 0x0000 0x00000000 AVAILABLE 7 0x007fffff 0x0000 0x00000000 AVAILABLE
8 0x007fffff 0x0000 0x00000000 AVAILABLE
9 0x007fffff 0x0000 0x00000000 AVAILABLE
10 0x007fffff 0x0000 0x00000000 AVAILABLE
11 0x007fffff 0x0000 0x00000000 AVAILABLE
12 0x007fffff 0x0000 0x00000000 AVAILABLE
13 0x007fffff 0x0000 0x00000000 AVAILABLE
14 0x007fffff 0x0000 0x00000000 AVAILABLE
15 0x007fffff 0x0000 0x00000000 AVAILABLE
FILE SYSTEM STATE
*curdir:0x00000000 *rootdir:0x00000000
cmask:0x0000 maxindex:0x0000 fd_lock:0x00000000
fso_lock:0x00000000 lockflag:0x00000000 fdevent:0x00000000
FILE DESCRIPTOR TABLE
*ufd: 0x20052164
Rest of user area paged out.
The var subcommand displays the tunable system parameters.
Aliases = tune, tunable, tunables
> var buffers 20 files 255 e_files 255 procs 131072 e_procs 45 threads 262144 e_threads 40 clists 16384 maxproc 40 iostats 1 locks 200 e_locks 4443672
The vfs uses the specified Vfs SlotNumber to display an entry in the vfs table. Use the - flag to display the vnodes associated with the vfs. The default displays the entire vfs table.
> vfs 3 VFS ADDRESS TYPE OBJECT STUB NUM FLAGS PATHS 3 1a62494 jfs 1a6d47c 1a6d650 5 D /dev/hd1 mounted over /u flags: C=disconnected D=device I=remote P=removable R=readonly S=shutdown U=unmounted Y=dummy > vfs - 3 VFS ADDRESS TYPE OBJECT STUB NUM FLAGS PATHS 3 1a62494 jfs 1a6d47c 1a6d650 5 D /dev/hd1 mounted over /u ADDRESS VFS MVFS VNTYPE FSTYPE COUNT ISLOT INODE FLAGS 1a6e0ac 3 - vreg jfs 1 - 18f82c0 1a6e218 3 - vreg jfs 1 - 18f8770 1a6e24c 3 - vreg jfs 1 - 18f8590 1a6e17c 3 - vdir jfs 3 - 18f7f00 1a6dea4 3 - vreg jfs 2 - 18f65b0 1a6dfa8 3 - vdir jfs 5 - 18f6100 1a6d47c 3 - vdir jfs 1 - 18ea580 vfs_root
Refer to the sys/vfs.h header file for structure definitions.
The vnode subcommand displays data at the specified VNodeAddress as a vnode. VNodeAddress must be specified in hexadecimal notation.The default is to display all vnodes in the vnode table.
> vnode 1a6e078 ADDRESS VFS MVFS VNTYPE FSTYPE COUNT ISLOT DATAPTR FLAGS 1a6e078 0 - vreg jfs 4 - 18f6790 Total VNODES printed 1
Refer to the sys/vnode.h header file for the structure definition.
Recognized by the xm and malloc subcommand aliases. Prints information concerning the allocation and usage of kernel memory (the pinned_heap and the kernel_heap). If a MODS-related system crash has occurred, xmalloc displays information about the address involved in the crash (if available).
xmalloc [addr]
Recognized by the xm and malloc subcommand aliases. Prints xmalloc information about addr.
xmalloc -s [addr]
Recognized by the xm and malloc subcommand aliases. Prints debug xmalloc allocation records associated with addr.
Note: The -s flag requires that the memory overlay detection system (MODS) has been turned on.
xmalloc -h [addr]
Recognized by the xm and malloc subcommand aliases. Prints MODS xmalloc free list records associated with addr.
Note: The -h flag requires that the memory overlay detection system (MODS) has been turned on.
xmalloc [-l] -f
Recognized by the xm and malloc subcommand aliases. Prints allocation records on free list from earliest-freed to latest-freed. The -l flag prints a long listing.
Note: The -f flag requires that the memory overlay detection system (MODS) has been turned on.
xmalloc [-l] -a
Recognized by the xm and malloc subcommand aliases. Prints the allocation record table. The -l flag prints a long listing.
Note: The -a flag requires that the memory overlay detection system (MODS) has been turned on.
xmalloc [-l] -p pageno
Recognized by the xm and malloc subcommand aliases. Prints page descriptor information for page pageno. The -l flag prints additional information.
xmalloc -d [addr]
Recognized by the xm and malloc subcommand aliases. Prints debug xmalloc allocation record hash chain associated with the record hash value for addr.
xmalloc -v
Recognized by the xm and malloc subcommand aliases. Verify allocation trailers of allocated records, and free fill patterns of freed records.
Note: The -v flag requires that the memory overlay detection system (MODS) has been turned on.