NAME
rd - read memory
SYNOPSIS
rd [-adDsSupxmfNR][-8|-16|-32|-64][-o offs][-e addr][-r file][address|symbol]
[count]
DESCRIPTION
This command displays the contents of memory, with the output formatted
in several different manners. The starting address may be entered either
symbolically or by address. The default output size is the size of a long
data type, and the default output format is hexadecimal. When hexadecimal
output is used, the output will be accompanied by an ASCII translation.
-p address argument is a physical address.
-u address argument is a user virtual address; only required on
processors with common user and kernel virtual address spaces.
-m address argument is a xen host machine address.
-f address argument is a dumpfile offset.
-d display output in signed decimal format (default is hexadecimal).
-D display output in unsigned decimal format (default is hexadecimal).
-s displays output symbolically when appropriate.
-S[S] displays output symbolically when appropriate; if the memory
contents reference a slab cache object, the name of the slab cache
will be displayed in brackets. If -S is entered twice, and the
memory contents reference a slab cache object, both the memory
contents and the name of the slab cache will be displayed in
brackets.
-x do not display ASCII translation at end of each line.
-8 display output in 8-bit values.
-16 display output in 16-bit values.
-32 display output in 32-bit values (default on 32-bit machines).
-64 display output in 64-bit values (default on 64-bit machines).
-a display output in ASCII characters if the memory contains printable
ASCII characters; if no count argument is entered, stop at the first
non-printable character.
-N display output in network byte order (only valid for 16- and 32-bit
values)
-R display memory in reverse order; memory will be displayed up to and
including the address argument, requiring the count argument to be
greater than 1 in order to display memory before the specified
address.
-o offs offset the starting address by offs.
-e addr display memory until reaching specified ending hexadecimal address.
-r file dumps raw data to the specified output file; the number of bytes that
are copied to the file must be specified either by a count argument
or by the -e option.
address starting hexadecimal address:
1 the default presumes a kernel virtual address.
2. -p specifies a physical address.
3. -u specifies a user virtual address, but is only necessary on
processors with common user and kernel virtual address spaces.
symbol symbol of starting address to read.
count number of memory locations to display; if entered, it must be the
last argument on the command line; if not entered, the count defaults
to 1, or unlimited for -a; when used with the -r option, it is the
number of bytes to be written to the file.
EXAMPLES
Display the kernel's version string:
crash> rd -a linux_banner
c082a020: Linux version 2.6.32-119.el6.i686 (mockbuild@hs20-bc2-4.buil
c082a05c: d.redhat.com) (gcc version 4.4.4 20100726 (Red Hat 4.4.4-13)
c082a098: (GCC) ) #1 SMP Tue Mar 1 18:16:57 EST 2011
Display the same block of memory, first without symbols, again
with symbols, and then with symbols and slab cache references:
crash> rd f6e31f70 28
f6e31f70: f6e31f6c f779c180 c04a4032 00a9dd40 l.....y.2@J.@...
f6e31f80: 00000fff c0472da0 f6e31fa4 f779c180 .....-G.......y.
f6e31f90: fffffff7 00a9b70f f6e31000 c04731ee .............1G.
f6e31fa0: f6e31fa4 00000000 00000000 00000000 ................
f6e31fb0: 00000000 00a9dd40 c0404f17 00000000 ....@....O@.....
f6e31fc0: 00a9dd40 00000fff 00a9dd40 00a9b70f @.......@.......
f6e31fd0: bf9e2718 ffffffda c040007b 0000007b .'......{.@.{...
crash> rd -s f6e31f70 28
f6e31f70: f6e31f6c f779c180 kmsg_read 00a9dd40
f6e31f80: 00000fff vfs_read+159 f6e31fa4 f779c180
f6e31f90: fffffff7 00a9b70f f6e31000 sys_read+60
f6e31fa0: f6e31fa4 00000000 00000000 00000000
f6e31fb0: 00000000 00a9dd40 syscall_call+7 00000000
f6e31fc0: 00a9dd40 00000fff 00a9dd40 00a9b70f
f6e31fd0: bf9e2718 ffffffda startup_32+123 0000007b
crash> rd -S f6e31f70 28
f6e31f70: [size-4096] [filp] kmsg_read 00a9dd40
f6e31f80: 00000fff vfs_read+159 [size-4096] [filp]
f6e31f90: fffffff7 00a9b70f [size-4096] sys_read+60
f6e31fa0: [size-4096] 00000000 00000000 00000000
f6e31fb0: 00000000 00a9dd40 syscall_call+7 00000000
f6e31fc0: 00a9dd40 00000fff 00a9dd40 00a9b70f
f6e31fd0: bf9e2718 ffffffda startup_32+123 0000007b
crash> rd -SS f6e31f70 28
f6e31f70: [f6e31f6c:size-4096] [f779c180:filp] kmsg_read 00a9dd40
f6e31f80: 00000fff vfs_read+159 [f6e31fa4:size-4096] [f779c180:filp]
f6e31f90: fffffff7 00a9b70f [f6e31000:size-4096] sys_read+60
f6e31fa0: [f6e31fa4:size-4096] 00000000 00000000 00000000
f6e31fb0: 00000000 00a9dd40 syscall_call+7 00000000
f6e31fc0: 00a9dd40 00000fff 00a9dd40 00a9b70f
f6e31fd0: bf9e2718 ffffffda startup_32+123 0000007b
Read jiffies in hexadecimal and decimal format:
crash> rd jiffies
c0213ae0: 0008cc3a :...
crash> rd -d jiffies
c0213ae0: 577376
Access the same memory in different sizes:
crash> rd -64 kernel_version
c0226a6c: 35312d352e322e32 2.2.5-15
crash> rd -32 kernel_version 2
c0226a6c: 2e322e32 35312d35 2.2.5-15
crash> rd -16 kernel_version 4
c0226a6c: 2e32 2e32 2d35 3531 2.2.5-15
crash> rd -8 kernel_version 8
c0226a6c: 32 2e 32 2e 35 2d 31 35 2.2.5-15
Read the range of memory from c009bf2c to c009bf60:
crash> rd c009bf2c -e c009bf60
c009bf2c: c009bf64 c01328c3 c009bf64 c0132838 d....(..d...8(..
c009bf3c: 0000002a 00000004 c57d77e8 00000104 *........w}.....
c009bf4c: 0000000b c009a000 7fffffff 00000000 ................
c009bf5c: 00000000 ....
|
