[ Previous | Next | Contents | Home | Search ]
AIX Version 4.3 Kernel Extensions and Device Support Programming Concepts

The crash Command

The crash command is a particularly useful tool for device-driver development and debugging, which interprets and formats the system structures. The crash command is interactive and allows you to examine an operating system image or an active system. An operating system image is held in a system dump file, either as a file or on the dump device. When you run the crash command, you can optionally specify a system image file and kernel file, as shown in the syntax below:

crash [-a] [-i IncludeFile] [ SystemImageFile [ KernelFile ] ]

The default SystemImageFile is /dev/mem and the default KernelFile is /usr/lib/boot/unix.

To run the crash command on the active system, enter:

crash

Because the command uses /dev/mem, you need root permissions.

To invoke the crash command on a system image file, enter:

crash SystemImageFile

where SystemImageFile is either a file name or the name of the dump device.

Note that by convention, the symbol names for function entry points always begin with a . (period). In most cases, there is a corresponding symbol name without the period that points to the function descriptor. However, when you specify a function symbol name on a crash command, without a leading period, crash inserts the period for you. For data items, there usually are table-of-contents (TOC) entries corresponding to each data item, but there are no differences in the names. The crash command assumes that when a data item symbol is specified, it is the actual data item that is wanted, not the TOC entry.

Use the -a flag to generate a list of data structures without using subcommands. The resulting list is large, so you can redirect the output to either a file or to a printer.

Use the -i flag to read the given include file, allowing the print subcommand to output data according to the include file structures.

You can use a variety of subcommands to view the system structures. These subcommands can have flags that modify the format of the data. If you do not use a flag to specify what you want to see, all valid entries are displayed.

Addresses in crash

Many of the commands in crash take addresses as parameters. Addresses are always specified in hexadecimal, and can usually be specified in one of the following forms:

addr An 8 digit hexadecimal number, which is treated as an effective address within the context of the current process and thread, or (in some cases) the context of the thread specified on a previous cm command. addr can be prefixed with the characters 0x .
segid:offset segid is the segment ID for a virtual memory segment. The maximum size is 6 hex digits. offset is the offset (in bytes) from the beginning of that segment. The maximum size is 7 hex digits.
r:realaddr r is the literal character "r". realaddr is a real memory address. This form can only be used when running crash against a system dump, and it only will display dump data areas that were dumped by real address instead of virtual address. readaddr can be up to 12 hexadecimal digits.

To enhance readability, you may include underscores ("_") anywhere within these values.

Examples:

18340050
2314:55300
r:14_3370_0560 (same as r:1433700560)

Command-line Editing

The crash command provides command line editing features similar to those provided by the Korn shell. vi mode provides vi-like editing features, while emacs mode gives you controls similar to emacs. You can turn these features on by using the crash subcommand set edit. So, to turn on vi-style command-line editing, you would type the subcommand set edit vi .

Output Redirection

The crash command provides a subset of Korn shell input/output redirection. Specifically, the following operators are provided:

| (pipe symbol)

Pipes all output of the command before the symbol to the input of the command after the symbol. Both standard output and error output are affected, which is different than standard shell behavior.

>
 filename

Writes the output of the command before the > to filename. Both standard and error output are written to the file.

>
>
 filename

Adds the output of the command before the >> to the end of filename. Both standard and error output are written to the file.

crash Subcommands

Once you initiate the crash command, > is the prompt character. For a list of the available subcommands, type the ? character. To exit, type q. You can run any shell command from within the crash command by preceding it with an ! (exclamation mark).

Since the crash command only deals with kernel threads, the word "thread" when used alone will be used to mean kernel thread in the crash documentation that follows. The default thread for several subcommands is the current thread (the thread currently running). On a multiprocessor system, you can use the cpu subcommand to change the current processor; the default thread becomes the running thread on the selected processor.

The parameters ProcessSlotNumber and ThreadSlotNumber are used in many subcommands to indicate a process or thread respectively. These parameters are simply numbers for table entry indexes which can be displayed using the proc and thread subcommands.

Note that many structures displayed are longer than one screen length.

buf [BufferHeaderNumber]

The buf subcommand displays the system buffer headers. A buffer header contains the information required to perform block I/O. If you type the buf subcommand with no BufferHeaderNumber, a summary of the system buffer headers is displayed.

Aliases = bufhdr, hdr

> buf
BUF MAJ  MIN    BLOCK   FLAGS
  0 000a 000b       8   done stale
  1 000a 000b     243   done stale
  2 000a 000b      24   done stale
...

If you type the buf subcommand with a BufferHeaderNumber, a single complete header is displayed:

> buf 3
BUFFER HEADER 3:
 b_forw:  0x014d0528, b_back:   0x014d0160, b_vp:      0x00000000
 av_forw: 0x014d0160, av_back:  0x014d0528, b_iodone:  0x000185f8
 b_dev:   0x000a000b, b_blkno:           0, b_addr:    0x014e9000
 b_bcount:      4096, b_error:           0, b_resid:            0
 b_work:  0x80000000, b_options:0x00000000, b_event:   0xffffffff
 b_start.tv_sec:             0, b_start.tv_nsec:              0
 b_xmemd.aspace_id: 0x00000000, b_xmemd.subspace_id: 0x00000000
 b_flags: read done stale

Refer to the sys/buf.h header file for the structure definition.

buffer [Format] [BufferHeaderNumber]

The buffer subcommand displays the data in a system buffer according to the Format parameter. When specifying a buffer header number, the buffer associated with that buffer header is displayed. If you do not provide a Format parameter, the previous Format is used. Valid options are decimal, octal, hex, character, byte, i-node, directory, and write. The write option creates a file in the current directory containing the buffer data.

Aliases = b

> buffer hex 3
   
BUFFER FOR BUF_HDR 3
00000: 41495820  4c564342  00006a66  73000000
00020: 00000000  00000000  00000000  00000000
00040: 00000000  00000000  00003030  30303033
...

callout

The callout subcommand displays all active entries on the active trblist. When the time-out kernel extension is used in a device driver, this timer request is entered on a system-wide list of active timer requests. This list of timer requests is the trblist. Any timer which is active is on this list until it expires.

Aliases = c, call, calls, time, timeout, tout

>callout
        
TRB's On The Active List Of Processor 0. 
        
TRB #1 on Active List 
 Timer address......................0x0 
 trb.to_next........................0x0 
 trb.knext..........................0x59aa100
 trb.kprev..........................0x0 
 Thread id (-1 for dev drv).........0xfffffffe 
 Timer flags........................0x12 
 trb.timerid........................0x0  
 trb.eventlist......................0xffffffff 
 trb.timeout.it_interval.tv_nsec....0x0 
 trb.timeout.it_interval.tv_sec.....0x0 
 Next scheduled timeout (secs)......0x2d63f6a8 
 Next scheduled timeout (nanosecs)..0xc849a80  
 Timeout function...................0x8c748 
 Timeout function data..............0x59aa040 
 TRB #2 on Active List 
... 

Refer to sys/timer.h for the structure definitions, and to InfoExplorer for a description of the time-out mechanism.

cm [Thread SlotNumber SegmentNumber]

The cm subcommand is used by the od subcommand to change the current segment map. The cm subcommand changes the map of the crash command internal pointers for any process thread segment not paged out, if you specify ThreadSlotNumber and SegmentNumber. This allows the od subcommand to display data from the segment desired rather than the segment for the current thread. The following example sets the map to ThreadSlotNumber3 and SegmentNumber 2, then displays 20 words from segment 2 for the thread in slot number 3:

Aliases =none

>
 cm 3 2                                                                        
t3,2 >
>
 od 2ff3b400 20                                                          
2ff3b400: 00000000 00000000 2ff22e28 00000000                                   
2ff3b410: 00000306 00000000 0002a7ec 000010b0                                   
2ff3b420: 82202220 0002a7ec 00000000 0000001c                                   
2ff3b430: 00000000 00000000 00000000 00000000                                   
2ff3b440: d80a5000 40000000 00002c0b d80a5000                                   
                                                                               t3,2 >
>

...

Using the cm subcommand without any parameters resets the map of internal pointers.

cpu [ProcessorNumber]

If no argument is given, the cpu subcommand displays the number of the currently selected processor. Initially, the selected processor is processor 0 (on a running system) or the processor on which the crash occurred (when running crash against a dump). If the ProcessorNumber argument is given, the cpu subcommand selects the specified processor as the current processor. By extension, this selects the current kernel thread (the running kernel thread on the selected processor). Processor numbering starts from zero.

Aliases = none

>cpu
Selected cpu number :  0

dblock [Address]

The dblock subcommand displays the allocated streams data-block headers. The address parameter is required. If the address is not supplied, this command will print an error message stating that the address is required. Refer to the sys/stream.h file for the datab structure definitions. The freep and db_size definitions are not included in /usr/include/sys/stream.h. These structure members are described here:

freep Address of the free pointer
db_size Size of the data block

There is no checking performed on the address passed in as the required parameter. The dblock subcommand will accept any address. It is up to the user to be sure that a valid address is specified.

To determine a valid address, run the mblock subcommand. From the output of the mblock subcommand, select a nonzero data block address under the DATABLOCK column heading.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = dblk

> queue 59d5a74
   QUEUE    QINFO     NEXT  PRIVATE  FLAGS     HEAD   OTHERQ      COUNT
 59d5a74  1884c1c  59d5474  59d5500 0x003e  59e1c00  59d5a00       4096
> mblk 59e1c00
 ADDRESS     NEXT PREVIOUS     CONT     RPTR     WPTR DATABLOCK
 59e1c00        0        0        0  59e2000  59e3000   59e1c44
> dblk 59e1c44
 ADDRESS    FREEP     BASE      LIM   REFCNT     TYPE     SIZE
 59e1c44        0  59e2000  59e3000        1        0     1000

dlock [ThreadIdentifier | -p [ProcessorNumber] ]

Displays deadlock analysis information about all types of locks (simple, complex, and lockl). The dlock subcommand searches for deadlocks from a given start point. If ThreadIdentifier is given, the corresponding kernel thread is the start point. If -p is given without a ProcessorNumber, the start point is the running kernel thread on the current processor. If -p ProcessorNumber is given, the running kernel thread on the specified processor is the start point. If no arguments are given, dlock searches for deadlocks among all threads on all processors.

The first output line gives information about the starting kernel thread, including the lock which is blocking the kernel thread, and a stack trace showing the function calls which led to the blocking lock request. Each subsequent line shows the lock held by the blocked kernel thread from the previous line, and identifies the kernel thread or interrupt handler which is blocked by those locks. If the information required for a full analysis is not available (paged out), an abbreviated display is shown; in this case, examine the stack trace to locate the locking operations which are causing the deadlock. The display stops when a lock is encountered for a second time, or no blocking lock is found for the current kernel thread.

Aliases = none

>
dlock

Deadlock from tid 00d3f. This tid waits for the first line lock,
owned by Owner-Id that waits for the next line lock, and so on...
     LOCK NAME    |   ADDRESS  |  OWNER-ID | WAITING FUNCTION
           lockC1 | 0x001f79e0 | Tid  113d | .lock_write_ppc
                   called from : .times + 0000020c
Dump data incomplete.Only 0 bytes found out of 4.
                   called from : .file + 0000000b
           lockC2 | 0x001f79e8 | Tid   d3f | .lock_write_ppc
                   called from : .times + 000001c8
Dump data incomplete.Only 0 bytes found out of 4.
                   called from : .file + 0000000b

dmodsw

The dmodsw subcommand displays the streams drivers-switch table. The information printed is contained in an internal structure. The following members of this internal structure are described here:

address Address of dmodsw
d_next Pointer to the next driver in the list
d_prev Pointer to the previous driver in the list
d_name Name of the driver
d_flags Flags specified at configuration time
d_sqh Pointer to synch queue for driver-level synchronization
d_str Pointer to streamtab associated with the driver
d_sq_level Synchronization level specified at configuration time
d_refcnt Number of open or pushed count
d_major Major number of a driver

The flags structure member, if set, is based on one of the following values:

#define Value Description
F_MODSW_OLD_OPEN 0x1 Supports old-style (V.3) open/close parameters
F_MODSW_QSAFETY 0x2 Module requires safe timeout/bufcall callbacks
F_MODSW_MPSAFE 0x4 Non-MP-Safe drivers need funneling

The synchronization level codes are described in the /usr/include/sys/strconf.h file.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = none

> dmodsw
NAME        ADDRESS  NEXT    PREVIOUS FLAG  SYNCHQ  STREAMTAB S-LVL COUNT MAJOR
sad         5a0cf40  5a0cf00  5a0c9c0  0x0  5a0ad40   188c600     3     0    12
slog        5a0cf00  5a0cec0  5a0cf40  0x0  5a0ad20   188c8a0     3     0    13
en          5a0cec0  5a0ce80  5a0cf00  0x0  5a0ad00   1893ee0     3     0    27
et          5a0ce80  5a0ce40  5a0cec0  0x0  5a0ace0   1893ee0     3     0    28
tr          5a0ce40  5a0ce00  5a0ce80  0x0  5a0acc0   1893ee0     3     0    29
fi          5a0ce00  5a0cdc0  5a0ce40  0x0  5a0aca0   1893ee0     3     0    30
echo        5a0cdc0  5a0cd80  5a0ce00  0x0        0   18951a0     5     0    31
nuls        5a0cd80  5a0cd40  5a0cdc0  0x0        0   1895190     5     0    32
spx         5a0cd40  5a0cd00  5a0cd80  0x0  5a0ac80   1895d70     3     0    33
unixdg      5a0cd00  5a0ccc0  5a0cd40  0x0  5a0ac60   18a14e0     3     0    34
unixst      5a0ccc0  5a0cc80  5a0cd00  0x0  5a0ac40   18a14e0     3     0    35
udp         5a0cc80  5a0cc40  5a0ccc0  0x0  5a0ac20   18a14e0     3     0    36
tcp         5a0cc40  5a0cb40  5a0cc80  0x0  5a0ac00   18a14e0     3     0    37
rs          5a0cb40  5a0cb00  5a0cc40  0x0        0   18b31d0     5     1    15
pts         5a0cb00  5a0ca40  5a0cb40  0x0        0   18fc930     4     7    24
ptc         5a0ca40  5a0ca00  5a0cb00  0x0        0   18fa5c0     4     2    23
ttyp        5a0ca00  5a0c9c0  5a0ca40  0x0        0   18fc950     4     0    26
ptyp        5a0c9c0  5a0cf40  5a0ca00  0x0        0   18fc940     4     0    25

ds [Address]

The ds subcommand returns the symbols closest to the given address. The ds subcommand can take either a text address or a data address.

Aliases = ts

> ds 012345
       .ioctl_systrace  + 0x000001b5

When a number such as 0x000001b5 is displayed, it shows the number of bytes by which the given address is offset from the entry point of the routine.

du [SlotNumber ThreadSlotNumber]

Uses the specified process slot number to display a combined hex and ASCII dump of the user block for any processs that is not swapped out. The default is the current process. Displays a combined hex and ASCII dump of the specified thread's uthread structure and of the user structure of the process which owns the thread. If the data is not available (paged out), a message is displayed. The default is the current thread.

Aliases = none

> du 3

Uthread structure of thread slot  3

  00000000 00000000 00000000 2ff7fec0 00000000 *......../.......*
  00000010 00000303 00000000 00030644 000010b0 *...........D....*
  00000020 22222828 00030644 00006244 00000009 *""((...D..bD....*
.
.
.

dump

The dump subcommand displays the name of each component for which there is data present. After you select a component name from the list, the crash program loads and runs the associated formatting routine contained in the /usr/lib/ras/dmprtns directory.

If there is more than one data area for the selected component, the formatting routine displays a list of the data areas and allows you to select one. The crash command then displays the selected data area. You can enter the quit subcommand to return to the previously displayed list and make another selection or enter quit a second time to leave the dump subcommand loop.

Aliases = none

errpt [ count]

Displays messages in the error log. Count is the number of messages to print that have already been read by the errdemon process. (The default is 3 messages.) errpt always prints all messages that have not yet been read by the errdemon process.

Aliases = none

file [FileSlotNumber]

The file subcommand displays the file table. Unless you request specific file entries, the command displays only those with a nonzero reference.

Aliases = files, f

> f 3
SLOT  REF     INODE    FLAGS
   3    1  0x018e53f0   read

Refer to sys/file.h for the structure definition.

find [-u] [-s] [-p slot] [-c context] [-a alignment] pattern

Recognized by the x subcommand alias. Search user-space for a given pattern. The default is to search the GPR save areas in the mstsave areas which are both on the Current Save Area Chain (CSA) and in each uthread area for every thread.

-u Search all process private segments, (Stack, Uarea,...)
-s Search all process private segment from the current stack pointer.
-c context Number of bytes of context to print on a match.
-a alignment Byte alignment for pattern. The default is 4.
-p slot Search only specified process. The default is to search all processes.

Attention: Using the find command on a running system may cause system crashes.

Rules for pattern

pattern is a search pattern of any arbitrary length that contains either a hexadecimal number or a string. To specify a hexadecimal pattern, just type the hex digits. "Don't care" digits can be represented with the character x . To specify a string pattern, enclose the pattern in double quotes. "Don't care" characters can be represented with the sequence \x

Examples:

> find -k 02x4
00110a28: 02140008                             |....|
00110af0: 02640004                             |.d..|
00110c80: 02e40004                             |....|
003f0ed8: 02242ff8                             |.$/.|
...

> find -k "b\xt"
00012534: 6269745f                             |bit_|
00012618: 6269745f                             |bit_|
0001264c: 6269745f                             |bit_|
00021cb0: 62797465                             |byte|
00021d60: 62797465                             |byte|
...

> find -k "i_ena" 0 250000     
001ceaa8: 695f656e 61626c65                    |i_enable|

find -k [-c context][-a alignment] pattern [start[end]]

Recognized by the x subcommand alias. Search the kernel segments. The default range is the whole of each kernel segment.

  -c context Number of bytes of context to print on a match.
  -a alignment Byte alignment for pattern. The default is 4.

find -b branch_addr [start_addr[end_addr]]

Recognized by the x subcommand alias. Search for a branch to the given address. The default range is the whole of each kernel segment.

find -m [-a addr] [-t type] [-c] [-i] [start[end]]

Recognized by the x subcommand alias. Search the things that look like mbufs. The default search range is the network memory heap.

  -a Search for mbufs that point to this cluster address.
  -t type Only search for this type of mbuf.
  -c Only search for clusters.
  -i Ignore length sanity checks.

find -v [-f] wordval [start[end]]

Recognized by the x subcommand alias. Search for the first word not matching the given value. The default is to search the kernel segments.

  -f Force scan to continue when a region not in the dump is scanned.

find -U seg_id

Recognized by the x subcommand alias. Search for processes whose segment registers contain the given segment ID.

fmodsw

The fmodsw subcommand displays the streams modules-switch table. The information printed is contained in an internal structure. The following members of this internal structure are described here:

address Address of fmodsw
d_next Pointer to the next module in the list
d_prev Pointer to the previous module in the list
d_name Name of the module
d_flags Flags specified at configuration time
d_sqh Pointer to synch queue for module-level synchronization
d_str Pointer to streamtab associated with the module
d_sq_level Synchronization level specified at configuration time
d_refcnt Number of open or pushed count
d_major -1

The flags structure member, if set, is based one of the following values:

#define Value Description
F_MODSW_OLD_OPEN 0x1 Supports old-style (V.3) open/close parameters
F_MODSW_QSAFETY 0x2 Module requires safe timeout/bufcall callbacks
F_MODSW_MPSAFE 0x4 Non-MP-Safe drivers need funneling

The synchronization level codes are described in the /usr/include/sys/strconf.h file.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = none

> fmodsw
NAME        ADDRESS  NEXT     PREVIOUS FLAG SYNCHQ  STREAMTAB S-LVL COUNT MAJOR
bufcall     5a0cf80  5a0cc00  5a0ca80  0x1  5a0ad60   188bf80     3     0    -1
sc          5a0cc00  5a0cbc0  5a0cf80  0x0  5a0abe0   18a29b0     3     0    -1
timod       5a0cbc0  5a0cb80  5a0cc00  0x0  5a0abc0   18a34b0     3     0    -1
tirdwr      5a0cb80  5a0cac0  5a0cbc0  0x0  5a0aba0   18a4010     3     0    -1
ldterm      5a0cac0  5a0ca80  5a0cb80  0x0        0   18ef460     4     8    -1

fs [ThreadSlotNumber]

Traces a kernel stack for the thread specified by ThreadSlotNumber. Displays the called subroutines with a hex dump of the stack frame for the subroutine that contains the parameters passed to the subroutine. By default, the current thread is traced. This subcommand will not work on the current thread of a running system because it uses stack tracing; however, it does work on a dump image.

Aliases = none

> fs
STACK TRACE:
        **** .et_wait ****
2ff97e78  2FF97ED8 0080D568 00000000 018F4C60   /.^....h......L`
2ff97e88  2FF97EE8 0080D568 00082BC0 000BA020   /.^....h..+.....
2ff97e98  2FF97ED8 28008044 00082418 2FF98000   /.^.(..D..B./...
2ff97ea8  00000000 000B8468 00000000 00000000   .......h........
2ff97eb8  2FF97F38 0000000B 00000004 00000004   /..8............
2ff97ec8  00000005 01DFE258 00000000 E3000600   .......X........

hide symbol...

Hide the specified symbol from the crash commands that convert addresses to symbols and offsets. The main reason for this ability is to hide symbols that may show up in the middle of a function. This occurs in assembly routines. See the unhide subcommand .

hide

Show all hidden symbols. See the unhide subcommand .

inode [-] [<Major> <Minor> <INumber>]

The inode subcommand displays the i-node table and the i-node data block addresses. You can display a specific i-node by specifying the major and minor device numbers of the device where the i-node resides and the i-node number. The command displays the i-node only if it is currently on the system hash list.

Aliases = ino, i

>inode
 ADDRESS   MAJ MIN  INUMB REF LINK  UID  GID   SIZE    MODE  SMAJ SMIN FLAGS
0x018e4e50 010 0007 11264   0    1    2    2     30 ----777    -    -
0x018f9fd0 010 0009 16384   1    6  201    0    512 d---755    -    -
0x018ea940 010 0011     0   1    0    0    0      0 ----  0    -    -
...

kfp [FramePointer]

If you use the kfp subcommand without parameters, it displays the last kernel frame pointer address that was set using kfp. If you specify a frame pointer address, it sets the kernel frame pointer to the new address. Use this subcommand in conjunction with the -r flag of the trace subcommand.

Aliases = fp, rl


 >
 kfp                                                                           
 kfp:  00000000                                                                  

knlist [Symbol]

The knlist subcommand displays the addresses of all the specified symbol names. If there is no such symbol, the subcommand displays a no match message. Run this subcommand only on an active system.

The knlist subcommand runs a subroutine to the active kernel to obtain the address from the system's knlist. The nm subcommand provides the same function but searches the symbol table in the Kernel Image File for the address and therefore can be used on a dump.

Aliases = none

> knlist open
        open:0x000bbc98

le [Module Address]

The le subcommand displays the kernel load-list entries. If you specify an address in a kernel extension, the corresponding load list entry is displayed. If you attempt to display a paged-out loader entry, the subcommand displays an error message.

Aliases = none

 >
 le                                                                            
 LoadList entry at 0x02593e00                                                    
   Module start:0x00000000_03412000  Module filesize:0x00000000_00005428         
   Module *end:0x00000000_03417428                                               
   *data:0x00000000_03414a00  data length:0x00000000_00002a28                    
   Use-count:0x0001  load_count:0x0001  *file:0x00000000                         
   flags:0x00000262 TEXT DATAINTEXT DATA DATAEXISTS                              
   *exp:0x00000000  *lex:0x00000000  *deferred:0x00000000  *expsize:0x66666666   
   Name: xmdbgdd                                                                 
   ndepend:0x0001  maxdepend:0x0001                                              
   *depend[00]:0x02593900                                                        
   le_next:  02593900                                                            
                                                                                 
 LoadList entry at 0x02593900                                                    
   Module start:0x00000000_02fd5000  Module filesize:0x00000000_0006eafc         
   Module *end:0x00000000_03043afc                                               
   *data:0x00000000_03039a20  data length:0x00000000_0000a0dc                    
   Use-count:0x0004  load_count:0x0001  *file:0x00000000                         
   flags:0x00000272 TEXT KERNELEX DATAINTEXT DATA DATAEXISTS                     
   *exp:0x03050000  *lex:0x00000000  *deferred:0x00000000  *expsize:0x66666666   
   Name: /usr/lib/drivers/nfs.ext                                                
   ndepend:0x0001  maxdepend:0x0001                                              
   *depend[00]:0x02593b00                                                        
   le_next:  02593880                                                            
 ...                                                                             
                                                                                 
 >
 le 3414568                                                                    
 LoadList entry at 0x02593e00                                                    
   Module start:0x00000000_03412000  Module filesize:0x00000000_00005428         
   Module *end:0x00000000_03417428                                               
   *data:0x00000000_03414a00  data length:0x00000000_00002a28                    
   Use-count:0x0001  load_count:0x0001  *file:0x00000000                         
   flags:0x00000262 TEXT DATAINTEXT DATA DATAEXISTS                              
   *exp:0x00000000  *lex:0x00000000  *deferred:0x00000000  *expsize:0x66666666   
   Name: xmdbgdd                                                                 
   ndepend:0x0001  maxdepend:0x0001                                              
   *depend[00]:0x02593900                                                        
   le_next:  02593900                                                            

linkblk

The linkblk subcommand displays the streams linkblk table. Refer to the /usr/include/sys/stream.h file for the linkblk structure definitions. If there are no linkblk structures found on the system, the linkblk subcommand will print a message stating that no structures are found.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = lblk

This example shows a regular link:

> linkblk
    QTOP     QBOT    INDEX
 5ab8b74  5ae5074  5ab4200

This example shows a persistent link:

> linkblk
    QTOP     QBOT    INDEX
       0  5ae5174  5a4ef00

mblock Address

The mblock subcommand displays the allocated streams message-block headers. The address parameter is required. If the address is not supplied, this command will print an error message stating that the address is required. Refer to the /usr/include/sys/stream.h file for the queue structure definitions.

The mblock subcommand's checking of the address parameter is limited to verifying that the address falls on a 128-byte boundary. It is up to the user to be sure that a valid address is specified.

To determine a valid address, run the queue subcommand. From the output of the queue subcommand, select a non-zero address for the head of the message queue under the HEAD column heading for either a read queue or a write queue.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = mblk


 >
 queue                                                                         
   WRITEQ    QINFO     NEXT  PRIVATE  FLAGS     HEAD    READQ   COUNT  NAME      
 1802c08c  22dac00 1802c48c 1802c200 0x002a        0 1802c000    0      sth      
 1802c48c  2324960 1802ec8c 1807a2ec 0x0028        0 1802c400    0 mi_timod      
 1802ec8c  2320158        0 1802cc2c 0x8028        0 1802ec00    0    xtiso      
 1806ac8c  22dac00 1806c88c 1806aa00 0x002a        0 1806ac00    0      sth      
 1806c88c  2324960 1806ce8c 1807a02c 0x0028        0 1806c800    0 mi_timod      
 1806ce8c  2320158        0 1806cc2c 0x8028        0 1806ce00    0    xtiso      
 1806ae8c  22dac00 1806a88c 1806a000 0x002a        0 1806ae00    0      sth      
 1806a88c  2324960 1806a28c 1807a56c 0x0028        0 1806a800    0 mi_timod      
 1806a28c  2320158        0 1806a42c 0x8028        0 1806a200    0    xtiso      
 1802e68c  22dac00 1802ea8c 1802e400 0x002a        0 1802e600    0      sth      
 1802ea8c  2b2b580 1802e88c 1802e200 0x0028        0 1802ea00    0   ldterm      
 1802e88c  25a48d0        0  2b19130 0x0020 180abe00 1802e800  684       rs      
 > mblk 180abe00                                                                 
  ADDRESS     NEXT PREVIOUS     CONT     RPTR     WPTR DATABLOCK                 
 180abe00 180ab800        0        0 180abe6c 180abeb8         0                 

mbuf [-c] [-d] [-l] [addr]

The mbuf subcommand displays mbuf structures in the system. These structures are memory buffers that are chained together and can be manipulated by the Memory Buffer kernel services. If you specify the -d flag, the subcommand also displays the data associated with the mbuf structure. The -l flag causes the subcommand to display an entire chain of mbuf structures. The -c flag tells mbuf to use the cluster free list rather than the mbuf pointer. If addr is not specified, then mbuf defaults to using the system mbuf pointer. Note that valid mbuf pointers must be on a 128-byte boundary.

                                                                           
                                                                                 
 > mbuf -l                                                                       
 mbuf:0x18099900  len: 120 type: header  act:00000000 next:18099400              
 data:1809995e                                                                   
 mbuf:0x18099400  len:  62 type: header  act:00000000 next:18099d00              
 data:1809942e                                                                   
 mbuf:0x18099d00  len: 156 type: header  act:00000000 next:18096800              
 data:1809b858                                                                   
 mbuf:0x18096800  len: 156 type: header  act:00000000 next:18099300              
 data:1809b858                                                                   
 mbuf:0x18099300  len:  62 type: header  act:00000000 next:18099700              
 data:1809932e                                                                   
 mbuf:0x18099700  len:   4 type: data    act:00000000 next:18099500              
 data:180a103e                                                                   
 ...                                                                             
                                                                                 
 

mst [-f] [Address] . . .

Displays the mstsave portion of the uthread structure at the addresses specified (see the uthread.h and mstsave.h header files in /usr/include/sys). If you do not specify an address, it displays all of the mstsave entries on the current save area (CSA) chain except the first. If you specify the -f flag the first mstsave area on the CSA chain displays.

Aliases = none

ndb

Displays network kernel data structures either for a running system or a system dump. The ndb (network debugger) subcommand displays the following options:

? Provides first-level help information.
help Provides additional help information.
tcb [Addr] Shows TCBs. The default is HEAD TCB.
udb [Addr] Shows UDBs. The default is HEAD UDB.
sockets Shows sockets from the file table.
mbuf [Addr] Shows the mbuf at the specified address.
ifnet [Addr] Shows the ifnet structures at the specified address.
quit Stops the running option.
xit Exits the ndb submenu.

Aliases = none

nm [Symbol]

The nm subcommand displays the symbol value and type found in KernelFile.

Aliases = none

> nm open
        00095484 000C70  PR SD    <.open>
        00095484         PR LD    .open
        000BBC98 00000C  SV SD    open

od [*...] [SymbolName | Address] [Count] [Format]

The od subcommand dumps the number of data values specified by Count starting at Symbol value or Address according to Format. Possible formats are octal, longoct, decimal, longdec, character, hex, instruction, and byte. The default is hex. Note that if you use the Format parameter, you must also use Count. If the SymbolName or Address is preceeded by an asterisk, then the symbol or address is dereferenced before displaying the data.

The od subcommand is especially useful during program development in order to see structure values at a given point in time.

Aliases = none

>
 od open 10
00095484: 7c0802a6 bf21ffe4 90010008 9421ff30
00095494: 609c0000 832202e0 607b0000 60bd0000
000954a4: 63230000 38800000
      
>
 od open 10 byte
00095484: 0174 0010 0002 0246 0277 0041 0377 0344
0009548c: 0220 0001
       
>
 od 12345
warning: word alignment performed
00012344: 480001d8

>
 user -s 3                                                                     
MST Segment Regs                                                                
     0:0x00000000   1:0x00002c0b   2:0x00004411   3:0x007fffff                  
     4:0x007fffff   5:0x007fffff   6:0x007fffff   7:0x007fffff                  
     8:0x007fffff   9:0x007fffff  10:0x007fffff  11:0x007fffff                  
    12:0x007fffff  13:0x007fffff  14:0x00001004  15:0x007fffff                  
...                                                                             
                                                                                 
>
 od 4411:ff3b400 12                                                            
 004411:ff3b400: 00000000 00000000 2ff22e28 00000000                             
 004411:ff3b410: 00000306 00000000 0002a7ec 000010b0                             
 004411:ff3b420: 82202220 0002a7ec 00000000 0000001c                             
                                                                                 
>
 od Debug_record                                                               
001cc378: 00000000                                                              
>
 od *Debug_record                                                              
00000000: 00000000                                                              

ppd [ProcessorNumber | *]

Displays per-processor data area (PPDA) structures for the specified processor. If no processor is specified, the current processor selected by the cpu subcommand is used. If the asterisk argument is given, the PPDA of every enabled processor is displayed.

Aliases = none

>
 ppd                                                                           
Per Processor Data Area for processor  0                                        
                                                                                 
alsave[ 0]...............0000000000000000                                       
alsave[ 1]...............0000000000000000                                       
alsave[ 2]...............0000000000000000                                       
alsave[ 3]...............0000000000000000                                       
alsave[ 4]...............0000000000000000                                       
alsave[ 5]...............0000000000000000                                       
alsave[ 6]...............0000000000000000                                        
alsave[ 7]...............0000000000000000                                       
alsave[ 8]...............0000000000000000                                       
alsave[ 9]...............0000000000000000                                       
alsave[10]...............0000000000000000                                       
alsave[11]...............0000000000000000                                       
alsave[12]...............0000000000000000                                       
alsave[13]...............0000000000000000                                       
alsave[14]...............0000000000000000                                       
alsave[15]...............0000000000000000                                       
csa......................003f0eb0                                               
mstack...................003efeb0                                               
fpowner..................00000000                                               
curthread................e60013ec                                               
...                                                                             
                                                                                 

print [type] Address

Does dbx-style printing of structures. The -i option must be given on the command line to use this feature.

If type is omitted, the default type set by the last print -d command is used.

Aliases = none

print -d type

Recognized by the pr, str, or struct subcommand aliases. Sets the default type for subsequent print commands to type.

Aliases = set prtype

proc [-] [-r] [ProcessSlotNumber]

The proc subcommand displays the process table, including the kernel thread count (the number of threads in the process) and state of each process . Use the -r flag to display only runnable processes. Use the - flag to display a longer listing of the process table.

Aliases = ps, p

>p 
   
SLT ST    PID   PPID   PGRP   UID  EUID  TCNT  NAME 
  0 a       0      0      0     0     0     1  swapper 
        FLAGS: swapped_in no_swap fixed_pri kproc 
  1 a       1      0      0     0     0     1  init 
        FLAGS: swapped_in no_swap 
  2 a     204      0      0     0     0     1  wait 
        FLAGS: swapped_in no_swap fixed_pri kproc 
 ...
   
>p 20
  
SLT ST    PID   PPID   PGRP   UID  EUID  TCNT  NAME 
 20 a    1406      1   1406     0     0     1  ksh  
        FLAGS: swapped_in no_swap 
     
> p - 0                                                                           
SLT ST    PID   PPID   PGRP   UID  EUID  TCNT  NAME                             
  0 a       0      0      0     0     0     1  swapper                          
        FLAGS: swapped_in no_swap fixed_pri kproc                               
                                                                                
Links:  *child:0xe30013b0  *siblings:0x00000000  *uidl:0xe3002490               
    *ganchor:0x00000000  *pgrpl:0x00000000  *ttyl:0x00000000                    
Dispatch Fields:  pevent:0x00000000  *synch:0xffffffff                          
    lock:0x00000000  lock_d:0x00000000                                          
Thread Fields:  *threadlist:0xe6000000  threadcount:1                           
active:1  suspended:0  local:0   terminating:0                                                                                 
Scheduler Fields:   fixed pri: 16  repage:0x00000000  scount:0  sched_pri:0                                                        
     *sched_next:0x00000000  *sched_back:0x00000000 cpticks:130                 
     msgcnt:0    majfltsec:0                                                    
Misc:  adspace:0x0000340d  kstackseg:0x007fffff  xstat:0x0000                  
     *p_ipc:0x00000000  *p_dblist:0x00000000  *p_dbnext:0x00000000              
Signal Information:                                                            
     pending:hi 0x00000000,lo 0x00000000                                        
     sigcatch:hi 0x00000000,lo 0x00000000  sigignore:hi 0xffffffff,lo 0xfff7ffff
Statistics:  size:0x00000000(pages)  audit:0x00000000                          
     accounting page frames:0   page space blocks:0                             
                                                                                

Refer to the sys/proc.h header file for the structure definition.

qrun

The qrun subcommand displays the list of scheduled streams queues. If there are no queues found for scheduling, the qrun subcommand will print a message stating there are no queues scheduled for service.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = none

> qrun
   QUEUE
 59d5a74

queue [Address]

The queue subcommand displays the STREAMS queue. If the address optional parameter is not supplied, crash will display information for all queues available. Refer to the /usr/include/sys/stream.h file for the queue structure definitions.

If you wish to see the information stored for a read queue, issue the queue subcommand with the read queue address specified as the parameter.

When you issue the queue subcommand with the address parameter, the column headings do not distinguish between the read queue and the write queue. One queue address will be displayed under the column heading QUEUE . The other queue in the pair will be displayed under the column heading OTHERQ . The write queue will have a numerically higher address than the read queue.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = que

> queue                                                                        
  WRITEQ    QINFO     NEXT  PRIVATE  FLAGS     HEAD    READQ   COUNT  NAME     
1802e08c  2268c00 1802e48c 1802e200 0x002a        0 1802e000    0      sth     
1802e48c  22b2960 1802cc8c 1807a32c 0x0028        0 1802e400    0 mi_timod     
1802cc8c  22ae158        0 1802ec2c 0x8028        0 1802cc00    0    xtiso     
1806cc8c  2268c00 1806a88c 1806ca00 0x002a        0 1806cc00    0      sth     
1806a88c  22b2960 1806ae8c 1807a06c 0x0028        0 1806a800    0 mi_timod     
1806ae8c  22ae158        0 1806ac2c 0x8028        0 1806ae00    0    xtiso     
1806ce8c  2268c00 1806c88c 1806c000 0x002a        0 1806ce00    0      sth     
1806c88c  22b2960 1806c28c 1807a5ac 0x0028        0 1806c800    0 mi_timod     
1806c28c  22ae158        0 1806c42c 0x8028        0 1806c200    0    xtiso     
1802c68c  2268c00 1802ca8c 1802c400 0x002a        0 1802c600    0      sth     
1802ca8c  2ab9580 1802c88c 1802c200 0x0028        0 1802ca00    0   ldterm     
1802c88c  25328d0        0  2aa7130 0x0028        0 1802c800    0       rs     

quit

Exit from the crash command.

Aliases = q

search [-sn] name

Search the symbols table for name.

-s Prints symbols matching name in the nm format. Also prints the symbol table entry for the last symbol found.
-n Prevents the search from examining kernel extensions..

search[-n] addr

Search for the symbol with the largest value less than or equal to addr.

-n Prevents the search from examining kernel extensions..

segst64 [-p pslot | -t tslot] [-l limit [-s segflag[:value][, segflag[:value]]...] [-n [start_esid [end_esid]]

Displays segstate information for a 64-bit process. The segstate for the current process displays unless the -p or -t flags are specified. All of the segstate entries display unless limited by the -l flag or the starting esid, start_esid and possible ending esid, end_esid. Specifying the -s flag limits the display to only those segstate entries matching the given segflags, matching pattern types, as well as their corresponding values. The -l flag limits the display to a maximum number of entries. The -n flag also prints the segnodes for the displayed data. Segnode entries are not included in the count when limiting the data with -l.

-p pslot Specifies the process slot number.
-t tslot Specifies the thread slot number.
-s segflag:[value] Limites the display to the segstate entries matching that segflag and value.
-l limit Specifies the number of entries to print.
-n Prints the uadnodes for the displayed data.

Aliases = adspace, as, sr

select

Recognized by the sel subcommand alias. Displays all select control blocks.

select p proc_slot

Recognized by the sel subcommand alias. Displays select control blocks for process in specified slot.

Note: The p flag is not prefixed with a -.

select dev_id unique_id

Recognized by the sel subcommand alias. Displays select control blocks matching the specified device and unique IDs.

set>

Display crash variables and values.

set allhex [no]

Causes crash to use only hex values for both input and output as oppossed to a mixture of hex and decimal. Specify no to turn this option off.

set edit [emacs|gmacs|none|vi]

Sets command line editing mode.

set fpregs [yes|no|auto]

Specify whether or not floating-point registers should be displayed. If auto is used, the fpeu variable in the mstsave area determines when to display the registers.

set idarch [ppc|pwr|auto]

Set instruction decode architecture. auto detects the architecture from the system.

set logfile [filename]

Set logfile to given name, or turn off logging if no name is given.

set loglevel [0|1|2]

Set logging granularity to:

0 coarse-only commands will be logged.
1 medium-commands and output to terminal will be logged.
2 fine-commands and all outputs will be logged, including redirected.

set prtype [type]

Set the default print type. This is equivalent to print -d type.

set quiet [no]

Suppress error messages concerning missing or swapped out threads and processes. Specify no to turn off this option.

socket [-]

The socket subcommand displays the system socket structures. Use the - flag to also display the socket buffers.

Aliases = sock


> sock                                                                         
1802e800:  type:0x0002 (DGRAM)  opts:0x0000 ()                                 
     state:0x0082 (ISCONNECTED|PRIV)  linger:0x0000                            
     pcb:0x1807a6c0  proto:0x000bbd30  q0:0x00000000  q0len:0                  
     q:0x00000000   qlen:0   qlimit:0   head:0x00000000                        
     timeo:0   error:0   oobmark:0   pgid:0                                    
                                                                               
18074400:  type:0x0002 (DGRAM)  opts:0x0000 ()                                 
     state:0x0080 (PRIV)  linger:0x0000                                        
     pcb:0x1807a100  proto:0x000bbd30  q0:0x00000000  q0len:0                  
     q:0x00000000   qlen:0   qlimit:0   head:0x00000000                        
     timeo:0   error:0   oobmark:0   pgid:0                                    
...                                                                            

Refer to the sys/socket.h header file for structure definitions.

sr64 [-p pslot> | -t tslot] [-l limit [-n [start_esid [ end_esid]]

Recognized by the segst and seg subcommand aliases. Displays the effective segment IDs (esid) and their corresponding segvals for a 64-bit process. If you do not specify the -p or -t flags, sr64 uses the current process. Otherwise, it uses pslot as the process slot number for the desired process, or tslot as the thread slot number of a thread contained within the desired process. It lists all entries in the adspace unless a starting esid, start_esid and possible ending esid, end_esid is given. Also, it stops listing if the number of entries specified by the -l flag have printed. Since adspace_t holds 16 entries, each line consists of an esid, its corresponding value, and the 3 subsequent values following it in the adspace_t. The -n flag also prints the uadnodes for the displayed data. uadnode entries are not included in th count when limiting the data with -l.

-p pslot Specifies the process slot number.
-t tslot Specifies the thread slot number.
-l limit Specifies the number of entries to print.
-n Prints the uadnodes for the displayed data.

stack [ProcessSlotNumber ThreadSlotNumber]

The stack subcommand displays a dump of the kernel stack of a process the kernel thread identified by ThreadSlotNumber. The addresses are virtual data addresses rather than true physical addresses. If you do not specify an entry, the subcommand displays information about the last running process kernel thread. You cannot trace the stack of the current running process kernel thread on a running system.

Aliases = s, stk, k, kernel

> s 
KERNEL STACK:
2ff97a50:            8eaa4        16  2ff97ac8         2
2ff97a60:             90b0     8e8b4  2ff97ad8         0
2ff97a70:                1        26  2ff97ac8  2ff98938
...

stat

The stat subcommand displays statistics found in the dump. These statistics include the panic message (if there is one), time of crash, and system name. If the memory overlay detection system (MODS) was enabled (shown here as xmalloc debug), and it detected a problem, stat displays the MODS error message.

Aliases = none


> stat                                                                         
        sysname: AIX                                                           
        nodename: riva                                                         
        release: 3                                                             
        version: 4                                                             
        machine: 000018654100                                                  
        time of crash: Thu Aug 28 21:03:49 1997                                
        age of system: 18 min.                                                 
        xmalloc debug: enabled                                                 
        dump code: 300                                                         
        csa: 0x2ff3b400                                                        
        exception struct:                                                      
                dar:   0x00000000                                              
                dsisr: 0x00000000:                                             
                srv:   0x00000000                                              
                dar2:  0x00000000                                              
                dsirr: 0x00000000: (errno) "Error 0"                           
        Debug kernel error message: A program has tried to access freed        
                xmalloc memory.                                                

status [ProcessorNumber]

Displays a description of the kernel thread scheduled on the designated processor. If no processor is specified, the status subcommand displays information for all processors. The information displayed includes the processor number, kernel thread identifier, kernel thread table slot, process identifier, process table slot, and process name.

Aliases = none

> status 0
CPU     TID  TSLOT     PID  PSLOT  PROC_NAME
  0    1fe1     31    1fd8     31  crash

stream

The stream subcommand displays the stream head table. The information printed is contained in an internal structure. The following members of this internal structure are described here:

address Address of stream head
wq Address of streams write queue
dev Associated device number of the stream
read error Read error on the stream
write_error Write error on the stream
flags Stream head flag values
push_cnt Number of modules pushed on the stream
wroff Write offset to prepend M_DATA
ioc_id ID of outstanding M_IOCTL request
pollq List of active polls
sigsq List of active M_SETSIGs

The flags structure member, if set, is based on combinations of the following values:

#define Value Description
F_STH_READ_ERROR 0x0001 M_ERROR with read error received, fail all read calls.
F_STH_WRITE_ERROR 0x0002 M_ERROR with write error received, fail all writes.
F_STH_HANGUP 0x0004 M_HANGUP received, no more data.
F_STH_NDELON 0x0008 Do TTY semantics for ONDELAY handling.
F_STH_ISATTY 0x0010 This stream acts a terminal.
F_STH_MREADON 0x0020 Generate M_READ messages.
F_STH_TOSTOP 0x0040 Disallow background writes (for job control).
F_STH_PIPE 0x0080 Stream is one end of a pipe or FIFO.
F_STH_WPIPE 0x0100 Stream is the "write" side of a pipe.
F_STH_FIFO 0x0200 Stream is a FIFO.
F_STH_LINKED 0x0400 Stream has one or more lower streams linked.
F_STH_CTTY 0x0800 Stream controlling tty.
F_STH_CLOSED 0x4000 Stream has been closed, and should be freed.
F_STH_CLOSING 0x8000 Actively on the way down.

This subcommand can be issued from crash on either a running system or a system dump.

Aliases = none

> stream
ADDRESS WRITEQ  MAJ/MIN RERR WERR FLAGS  IOCID WOFF PCNT POLQNEXT SIGQNEXT
59b1900 59c2a74  15, 0   0    0   0x0838   0     0    2     0        0
59d3c00 59d5a74  23, 5   0    0   0x0020   0     0    1     0        0
59ffe00 59ff074  23, 4   0    0   0x0020   0     0    1     0        0
5ab4c00 5ab4374  24, 0   0    5   0x0816   0     0    2     0        0
59d3f00 59ee974  24, 1   0    5   0x0816   0     0    2     0        0
59d3800 59dff74  24, 2   0    5   0x0816   0     0    2     0        0
59d3700 5a9c174  24, 3   0    5   0x0816   0     0    2     0        0
59ff800 59ff774  24, 4   0    0   0x0810   0     0    2     0        0
5a94d00 59ee574  24, 5   0    0   0x0830   0     0    2     0        0
5a94600 5a96c74  24, 6   0    5   0x0816   0     0    2     0        0

symptom[-e]

Displays the symptom string for a dump. It is not valid on a running system. The optional -e option will create an error log entry containing the symptom string, and is normally only used by the system and not entered manually. The symptom string can be used to identify duplicate problems.

tcb [ThreadSlotNumber] . . .

Displays the mstsave portion of the user structures of the named kernel threads (see the user.h and mstsave.h header files). If you do not specify an entry, information about the last running kernel thread is displayed. Floating point register information is only shown if the fpeu value in the mstsave area is set to 1, or if the command set fpregs yes has been run. This subcommand replaces the pcb subcommand.

Aliases = none

> tcb                                                                          
        UTHREAD AREA FOR SLOT  25 (ucfgxmdbg)                                  
                                                                               
SAVED MACHINE STATE                                                            
    curid:0x00001736  m/q:0xb651f200  iar:0x0014397c  cr:0x20228824            
    msr:0x000090b0    lr:0x0014395c   xer:0x00000008  kjmpbuf:0x00000000       
    backtrack:0x00    tid:0x00000000  fpeu:0x00       excp_type:0x00000000     
    ctr:0x00000000    *prevmst:0x00000000   *stackfix:0x00000000   intpri:0x0b 
    o_iar:0x00000000  o_toc:0x00000000  o_arg1:0x00000000  excbranch:0x00000000
    o_vaddr:0x00000000                                                         
    msr flags: EE ME AL IR DR                                                  
    cr flags: |  = |    |  = |  = |<   |<   |  = | >  |                        
    Exception Struct                                                           
      0x0114807c  0x40000000  0x00000000  0x0114807c  0x00000106               
    MST Segment Regs                                                           
     0:0x00000000   1:0x00002c0b   2:0x0000759d   3:0x007fffff                 
     4:0x007fffff   5:0x007fffff   6:0x007fffff   7:0x007fffff                 
     8:0x007fffff   9:0x007fffff  10:0x007fffff  11:0x007fffff                 
    12:0x007fffff  13:0x40003c0f  14:0x00001004  15:0x007fffff                 
    alloc flags: 0xe01f0000  (Seg Regs: 0, 1, 2, 11, 12, 13, 14, 15)           
                                                                               
General Purpose Regs                                                           
     0:0x0113b000   1:0x2ff3b2d0   2:0x001cc368   3:0x01148040                 
     4:0x0000d040   5:0xd0000000   6:0x00000000   7:0x000090b0                 
     8:0x80000000   9:0x40003c0f  10:0x00000001  11:0xb8000080                 
    12:0x034123f0  13:0xdeadbeef  14:0xdeadbeef  15:0xdeadbeef                 
    16:0xdeadbeef  17:0xdeadbeef  18:0x20000474  19:0xdeadbeef                 
    20:0xdeadbeef  21:0xdeadbeef  22:0xdeadbeef  23:0xdeadbeef                 
    24:0x2ff3b6e0  25:0x2ff3b400  26:0x100002e4  27:0x42424424                 
    28:0xe3002058  29:0xe60013ec  30:0x00143dac  31:0x00000000                 
                                                                               
                                                                               
                                                                               
Kernel stack address: 0x2ff3b400                                               

thread [-] [-r] [-p ProcessSlotNumber | -a Address | ThreadSlotNumber]

Displays the contents of the kernel thread table. The - (minus) flag displays a longer listing of the thread table. The -r flag displays only runnable kernel threads. The -p flag displays only those kernel threads which belong to the process identified by ProcessSlotNumber. The -a flag displays the kernel thread structure at Address. If ThreadSlotNumber is given, only the corresponding kernel thread is displayed.

Aliases = th


> thread 1
SLT ST    TID      PID    CPUID  POLICY PRI CPU   EVENT  PROCNAME
  1 s     1e1        1  unbound   other  3c   0              init
        FLAGS: wakeonsig
                                                                           
 > th                                                                            
 SLT ST    TID      PID    CPUID  POLICY PRI CPU    EVENT  PROCNAME              
   0 s       3        0        0    FIFO  10  78            swapper              
         t_flags:  wakeonsig kthread                                             
   1 s     105        1        0   other  3c   0               init              
         t_flags:  wakeonsig                                                     
   2 r     205      204        0    FIFO  7f  78               wait              
         t_flags:  sig_avail kthread                                             
   3 s     307      306        0      RR  24   0               netm              
         t_flags:  sig_avail kthread                                             
 ...                                                                             
                                                                                 
 > th - 3                                                                        
 SLT ST    TID      PID    CPUID  POLICY PRI CPU    EVENT  PROCNAME              
   3 s     307      306        0      RR  24   0               netm              
         t_flags:  sig_avail kthread                                             
                                                                                 
 Links:  *procp:0xe3000438  *uthreadp:0x2ff3b400  *userp:0x2ff3b6e0              
     *prevthread:0xe6000264  *nextthread:0xe6000264,  *stackp:0x00000000         
     *wchan1(real):0x00000000  *wchan2(VMM):0x00000000 *swchan:0x00000000        
     wchan1sid:0x00000000  wchan1offset:0x00000000                               
     pevent:0x00000000  wevent:0x00000912  *slist:0x00000000                     
 Dispatch Fields:  *prior:0xe6000264  *next:0xe6000264                           
     polevel:0x00000000  ticks:0x0000  *synch:0xffffffff  result:0x00000000      
     *eventlst:0x00000000  *wchan(hashed):0x00000000  suspend:0x0001             
     thread waiting for:  event(s)                                               
 Scheduler Fields:  cpuid:0x0000  scpuid:0x0000  pri: 36  policy:RR              
     affinity:0x0000  cpu:0x0000    lpri:  0  wpri:127    time:0xff              
 sav_pri:0x24                                                                    
 Misc:  lockcount:0x00000000  ulock:0x00000000  *graphics:0x00000000             
     dispct:0x0000a5ae  fpuct:0x00000000  boosted:0x0000                         
     userdata:0x00000000                                                         
 Signal Information:  cursig:0x00  *scp:0x00000000                               
     pending:hi 0x00000000,lo 0x00000000  sigmask:hi 0x00000000,lo 0x00000000    
                                                                                 
 

trace [-r | -m [-f]] [-k | -s] [-r] [ThreadSlotNumber ] . . .

The trace subcommand displays a kernel stack trace of the process kernel thread identified by ThreadSlotNumber. The trace starts at the top of the stack and attempts to find valid stack frames deeper in the stack. By default, the current process kernel thread is used.

When using the -k flag, the stack frame addresses indicate the stack frame containing the link register of the function that is displayed. The -m flag causes trace to display the traceback associated with each mstsave area on the current save area chain, except the first. To see a traceback from the first mstsave area, specify the -f flag. When either the -m or -k flags are used, trace may also show the LR (link register)and top stack frame pointer. These are not part of the stack trace and are therefore marked with an asterisk. The -s flag displays saved register information for each stack frame.

Use the -r flag to use the kernel frame pointer set up by the kfp subcommand as the starting address instead of the frame pointer found in the SystemImageFile. The trace subcommand stops and reports an error if an invalid frame pointer is encountered.

Aliases = t

> t 
STACK TRACE:
         .et_wait ()
         .e_sleep ()
         .e_sleepl ()
         .sleepx ()
         .fifo_read ()
         .fifo_rdwr ()
         .vno_rw ()
         .rwuio ()
         .rdwr ()
         .kreadv ()
                                                                           
 > t -k 5                                                                        
 STACK TRACE:                                                                    
 0x2ff3b400 (excpt=2ef636d8:40000000:00004812:2ef636d8:00000106) (intpri=0)      
         IAR:      .e_block_thread+23c (00029e04):       l   r0,0xc(r30)         
         LR:       .e_block_thread+23c (00029e04)                                
         2ef62ee8: .e_sleep_thread+ec (0002a454)                                 
         2ef62f48: .netisr_thread+28 (0006f854)                                  
         2ef62f88: .threadentry+18 (00047244)                                    
         2ef62fc8: .low+0 (00000000)                                             
                                                                                 
 >                                                                               

tty

Aliases = term, dz, dh

Refer to the sys/tty.h header file for the structure definition.

unhide symbol...

Unhide the specified symbol. See the hide subcommand .

unhide

Unhide all hidden symbols. See the hide subcommand .

user [ThreadSlotNumber]

Recognized by the uarea, u_area, and u subcommand aliases. Displays the uthread structure and the associated user structure of the thread identified by ThreadSlotNumber. (See the/usr/include/sys/user.h file for the user structure definition.) If you do not specify the entry, the information about the last running thread displays. The -s flag limits the output to segment register information.

Aliases = u, uarea, u_area



> u 4                                                                           
        UTHREAD AREA FOR SLOT   4 (gil)                                         
                                                                                
SAVED MACHINE STATE                                                             
    curid:0x00000408  m/q:0x0000ff34  iar:0x0002a7ec  cr:0x82002820             
    msr:0x000010b0    lr:0x0002a7ec   xer:0x00000000  kjmpbuf:0x00000000        
    backtrack:0x00    tid:0x00000000  fpeu:0x00       excp_type:0x00000000      
    ctr:0x00000000    *prevmst:0x00000000   *stackfix:0x2ff22ea8   intpri:0x00  
    o_iar:0x00000000  o_toc:0x00000000  o_arg1:0x00000000  excbranch:0x00000000 
    o_vaddr:0x00000000                                                          
    msr flags: ME AL IR DR                                                      
    cr flags: |<   |  = |    |    |  = |<   |  = |    |                         
    Exception Struct                                                            
      0x00000000  0x40000000  0x00000000  0xd1733000  0x00000106                
    MST Segment Regs                                                            
     0:0x00000000   1:0x00002c0b   2:0x00004812   3:0x007fffff                  
     4:0x007fffff   5:0x007fffff   6:0x007fffff   7:0x007fffff                  
     8:0x007fffff   9:0x007fffff  10:0x007fffff  11:0x007fffff                  
    12:0x007fffff  13:0x007fffff  14:0x00001004  15:0x007fffff                  
    alloc flags: 0xe01e0000  (Seg Regs: 0, 1, 2, 11, 12, 13, 14)                
                                                                                
General Purpose Regs                                                            
     0:0x00000000   1:0x2ff22ea8   2:0x001cc368   3:0x00000000                  
     4:0x00000001   5:0x2ff3b400   6:0x0000000b   7:0x000090b0                  
     8:0x80000000   9:0x00000001  10:0x2ff22f28  11:0x80000080                  
    12:0x000010b0  13:0xdeadbeef  14:0xdeadbeef  15:0xdeadbeef                  
    16:0xdeadbeef  17:0xdeadbeef  18:0xdeadbeef  19:0xdeadbeef                  
    20:0xe6000330  21:0x00000003  22:0x01000001  23:0x00000001                  
    24:0x00000000  25:0xe60003cc  26:0x001cc4bc  27:0x000ac498                  
    28:0x00000000  29:0x00000000  30:0xe30005a0  31:0x00000726                  
                                                                                
                                                                                
                                                                                
Kernel stack address: 0x2ff22ff8                                                
                                                                                
SYSTEM CALL STATE                                                               
    error code:0x00  *kjmpbuf:0x00000000                                        
                                                                                
PER-THREAD TIMER MANAGEMENT                                                     
    Real/Alarm Timer (ut_timer[TIMERID_ALRM]) = 0x0                             
    Virtual Timer (ut_timer[TIMERID_VIRTUAL]) = 0x0                             
    Prof Timer (ut_timer[TIMERID_PROF]) = 0x0                                   
    Posix Timer (ut_timer[POSIX0]) = 0x0                                        
    Posix Timer (ut_timer[POSIX1]) = 0x0                                        
    Posix Timer (ut_timer[POSIX2]) = 0x0                                        
    Posix Timer (ut_timer[POSIX3]) = 0x0                                        
    Posix Timer (ut_timer[POSIX4]) = 0x0                                        
                                                                                
SIGNAL MANAGEMENT                                                               
    *sigsp:0x0  oldmask:hi 0x0,lo 0x0  code:0x0                                 
                                                                                
MISCELLANOUS FIELDS:                                                            
   fstid:0x00000000   ioctlrv:0x00000000   selchn:0x00000000                    
   link:0x00000000   loginfo:0x00000000   fselchn:0x00000000                    
   selbuc:0x00000000   sigssz:0x00000000   User msr:0x00000000                  
   *context:0x00000000   **errnopp:0xc0c0fade   *stkb:0x00000000                
   *audsvc:0x00000000     scsave[0]:0x00000000   scsave[1]:0x00000000           
   scsave[2]:0x00000000   scsave[3]:0x00000000   scsave[4]:0x00000000           
   scsave[5]:0x00000000   scsave[6]:0x00000000   scsave[7]:0x00000000           
                                                                                
                                                                                
        USER AREA OF ASSOCIATED PROCESS gil (SLOT   4, PROCTAB 0xe30005a0)      
                                                                                
    handy_lock:0x00000000  timer_lock:0x00000000                                
    map:0x00000000  *semundo:0x00000000  *pinu_block:0x00000000                 
    compatibility:0x00000000  lock:0x00000000                                   
    ulocks:0x00000000  *message:0x00000000  irss:0x0000000000000000             
    lock_word:0xffffffff  *vmm_lock_wait:0x00000000  vmmflags:0x00000000        
                                                                                
SIGNAL MANAGEMENT                                                               
    Signals to be blocked (sig#:hi/lo mask,flags,func)                         
     1:hi 0x00000000,lo 0x00000000,0x00000000,0x00000000                        
     2:hi 0x00000000,lo 0x00000000,0x00000000,0x00000000                        
     3:hi 0x00000000,lo 0x00000000,0x00000000,0x00000000                        
...                                                                             
                                                                                
USER INFORMATION                                                                
    euid:0x0000  egid:0x0000  ruid:0x0000  rgid:0x0000  luid:0x00000000         
    suid:0x00000000  ngrps:0x0000  *groups:0x2ff20b38  compat:0x00000000        
    ref:0x00000004   pag:0x00000000   cr_lock:0x00000000                        
    acctid:0x00000000   sgid:0x00000000   epriv:0x00000000                      
    ipriv:0x00000000   bpriv:0x00000000   mpriv:0x00000000                      
    u_info:                                                                     
                                                                                
ACCOUNTING DATA                                                                 
    start:0x340629ff  ticks:0x0000000a  acflag:0x0000                           
pr_base:0x00000000_00000000                                                     
    pr_size:0x00000000  pr_off:0x00000000_00000000  pr_scale:0x00000000         
    process times:                                                              
           user:0x00000000s 0x00000000us                                        
            sys:0x00000000s 0x376eac80us                                        
    children's times:                                                           
           user:0x00000000s 0x00000000us                                        
            sys:0x00000000s 0x00000000us                                        
                                                                                
CONTROLLING TTY                                                                 
    *ttysid:0x00000000  *ttyp(pgrp):0x00000000                                  
    ttyd(evice):0x00000000  ttympx:0x00000000  *ttys(tate):0x00000000           
    tty id: 0x00000000  *query function: 0x00000000                             
                                                                                
RESOURCE LIMITS AND COUNTERS                                                    
    ior:0x00000000_00000000  iow:0x00000000_00000000  ioch:0x00000000_00000000  
    text:0x00000000_00000000  data:0x00000000_00000000  stk:0x01000000          
    max data:0x08000000  max stk:0x01000000  max file(blks):0xffffffff          
    *tstart:0x00000000_00000000  sdsize:0x00000000                              
    *datastart:0x00000000_20000000  *stkstart0x00000000_2ff23000                
    soft core dump:0x7fffffff  hard core dump:0x7fffffff                        
    soft rss:0x7fffffff  hard rss:0x7fffffff                                    
    cpu soft:0x7fffffff  cpu hard:0x7fffffff                                    
    hard ulimit:0x7fffffff                                                      
    minflt:0x00000000_00000000   majflt:0x00000000_00000000                     
                                                                                
AUDITING INFORMATION                                                            
   auditstatus:0x00000000                                                      
                                                                                
SEGMENT REGISTER INFORMATION                                                    
                                                                                
    ADSPACE                    SEGSTATE                                         
    Reg     Value   Alloc      # Segs  Fno/Shmptr  Flags                        
      0  0x40000000   yes      0x0000  0x00000000  AVAILABLE                    
      1  0x007fffff            0x0000  0x00000000  AVAILABLE                    
      2  0x40004812   yes      0x0000  0x00000000  AVAILABLE                    
      3  0x007fffff            0x0000  0x00000000  AVAILABLE                    
      4  0x007fffff            0x0000  0x00000000  AVAILABLE                    
      5  0x007fffff            0x0000  0x00000000  AVAILABLE                    
      6  0x007fffff            0x0000  0x00000000  AVAILABLE                         7  0x007fffff            0x0000  0x00000000  AVAILABLE                    
      8  0x007fffff            0x0000  0x00000000  AVAILABLE                    
      9  0x007fffff            0x0000  0x00000000  AVAILABLE                    
     10  0x007fffff            0x0000  0x00000000  AVAILABLE                    
     11  0x007fffff            0x0000  0x00000000  AVAILABLE                    
     12  0x007fffff            0x0000  0x00000000  AVAILABLE                    
     13  0x007fffff            0x0000  0x00000000  AVAILABLE                    
     14  0x007fffff            0x0000  0x00000000  AVAILABLE                    
     15  0x007fffff            0x0000  0x00000000  AVAILABLE                    
                                                                                
FILE SYSTEM STATE                                                               
    *curdir:0x00000000  *rootdir:0x00000000                                     
    cmask:0x0000  maxindex:0x0000  fd_lock:0x00000000                           
    fso_lock:0x00000000  lockflag:0x00000000  fdevent:0x00000000                
FILE DESCRIPTOR TABLE                                                           
    *ufd: 0x20052164                                                            
Rest of user area paged out.                                                    
										

var

The var subcommand displays the tunable system parameters.

Aliases = tune, tunable, tunables



> var                                                                           
buffers    20                                                                   
files     255                                                                   
e_files   255                                                                   
procs     131072                                                                
e_procs    45                                                                   
threads   262144                                                                
e_threads  40                                                                   
clists    16384                                                                 
maxproc    40                                                                   
iostats     1                                                                   
locks     200                                                                   
e_locks   4443672                                                               

vfs [-] [Vfs SlotNumber]

The vfs uses the specified Vfs SlotNumber to display an entry in the vfs table. Use the - flag to display the vnodes associated with the vfs. The default displays the entire vfs table.

Aliases = m, mnt, mount

> vfs 3
VFS ADDRESS TYPE  OBJECT    STUB NUM FLAGS  PATHS
  3 1a62494  jfs 1a6d47c 1a6d650   5 D     /dev/hd1 mounted over /u
        flags:  C=disconnected D=device   I=remote P=removable
                R=readonly     S=shutdown U=unmounted Y=dummy
> vfs - 3
VFS ADDRESS TYPE  OBJECT    STUB NUM FLAGS  PATHS
  3 1a62494  jfs 1a6d47c 1a6d650   5 D     /dev/hd1 mounted over /u
ADDRESS VFS MVFS VNTYPE FSTYPE COUNT ISLOT    INODE FLAGS
1a6e0ac   3    -   vreg    jfs     1     -  18f82c0
1a6e218   3    -   vreg    jfs     1     -  18f8770
1a6e24c   3    -   vreg    jfs     1     -  18f8590
1a6e17c   3    -   vdir    jfs     3     -  18f7f00
1a6dea4   3    -   vreg    jfs     2     -  18f65b0
1a6dfa8   3    -   vdir    jfs     5     -  18f6100
1a6d47c   3    -   vdir    jfs     1     -  18ea580 vfs_root

Refer to the sys/vfs.h header file for structure definitions.

vnode [VNodeAddress]

The vnode subcommand displays data at the specified VNodeAddress as a vnode. VNodeAddress must be specified in hexadecimal notation.The default is to display all vnodes in the vnode table.

Aliases = none

> vnode 1a6e078
ADDRESS VFS MVFS VNTYPE FSTYPE COUNT ISLOT  DATAPTR FLAGS
1a6e078   0    -   vreg    jfs     4     -  18f6790
 Total VNODES printed 1

Refer to the sys/vnode.h header file for the structure definition.

xmalloc

Recognized by the xm and malloc subcommand aliases. Prints information concerning the allocation and usage of kernel memory (the pinned_heap and the kernel_heap). If a MODS-related system crash has occurred, xmalloc displays information about the address involved in the crash (if available).

xmalloc [addr]

Recognized by the xm and malloc subcommand aliases. Prints xmalloc information about addr.

xmalloc -s [addr]

Recognized by the xm and malloc subcommand aliases. Prints debug xmalloc allocation records associated with addr.

Note: The -s flag requires that the memory overlay detection system (MODS) has been turned on.

xmalloc -h [addr]

Recognized by the xm and malloc subcommand aliases. Prints MODS xmalloc free list records associated with addr.

Note: The -h flag requires that the memory overlay detection system (MODS) has been turned on.

xmalloc [-l] -f

Recognized by the xm and malloc subcommand aliases. Prints allocation records on free list from earliest-freed to latest-freed. The -l flag prints a long listing.

Note: The -f flag requires that the memory overlay detection system (MODS) has been turned on.

xmalloc [-l] -a

Recognized by the xm and malloc subcommand aliases. Prints the allocation record table. The -l flag prints a long listing.

Note: The -a flag requires that the memory overlay detection system (MODS) has been turned on.

xmalloc [-l] -p pageno

Recognized by the xm and malloc subcommand aliases. Prints page descriptor information for page pageno. The -l flag prints additional information.

xmalloc -d [addr]

Recognized by the xm and malloc subcommand aliases. Prints debug xmalloc allocation record hash chain associated with the record hash value for addr.

xmalloc -v

Recognized by the xm and malloc subcommand aliases. Verify allocation trailers of allocated records, and free fill patterns of freed records.

Note: The -v flag requires that the memory overlay detection system (MODS) has been turned on.


[ Previous | Next | Contents | Home | Search ]