| CORE(5) | File Formats Manual | CORE(5) |
For a.out-format core files:
#include <sys/core.h>
For ELF-format core files:
#include <sys/exec.h>
#include <sys/exec_elf.h>
This memory image is written to a file named from a per-process template; provided the terminated process had write permission, and provided the abnormality did not cause a system crash. (In this event, the decision to save the core file is arbitrary, see savecore(8).) The file is named from a per-process template, mapped to the sysctl variable proc.<pid>.corename (where <pid> has to be replaced by the pid in decimal format of the process). This template is either an absolute or relative path name, in which format characters can be used, preceded by the percent character (“%”). The following characters are recognized as format and substituted:
By default, the per-process template string points to the default core name template, which is mapped to the sysctl variable kern.defcorename. Changing this value on a live system will change the core name template for all processes which didn't have a per-process template set. The default value of the default core name template is %n.core and can be changed at compile-time with the kernel configuration option options DEFCORENAME (see options(4))
The per-process template string is inherited on process creation, but is reset to point to the default core name template on execution of a set-id binary.
The maximum size of a core file is limited by setrlimit(2). Files which would be larger than the limit are not created.
In addition, NetBSD ELF core files include an ELF note section which provides additional information about the process. The first note in the note section has a note name of “NetBSD-CORE” and a note type of ELF_NOTE_NETBSD_CORE_PROCINFO (1), and contains the following structure:
struct netbsd_elfcore_procinfo {
/* Version 1 fields start here. */
uint32_t cpi_version; /* netbsd_elfcore_procinfo version */
uint32_t cpi_cpisize; /* sizeof(netbsd_elfcore_procinfo) */
uint32_t cpi_signo; /* killing signal */
uint32_t cpi_sigcode; /* signal code */
uint32_t cpi_sigpend[4]; /* pending signals */
uint32_t cpi_sigmask[4]; /* blocked signals */
uint32_t cpi_sigignore[4]; /* blocked signals */
uint32_t cpi_sigcatch[4]; /* blocked signals */
int32_t cpi_pid; /* process ID */
int32_t cpi_ppid; /* parent process ID */
int32_t cpi_pgrp; /* process group ID */
int32_t cpi_sid; /* session ID */
uint32_t cpi_ruid; /* real user ID */
uint32_t cpi_euid; /* effective user ID */
uint32_t cpi_svuid; /* saved user ID */
uint32_t cpi_rgid; /* real group ID */
uint32_t cpi_egid; /* effective group ID */
uint32_t cpi_svgid; /* saved group ID */
uint32_t cpi_nlwps; /* number of LWPs */
int8_t cpi_name[32]; /* copy of p->p_comm */
/* Add version 2 fields below here. */
};
The fields of struct netbsd_elfcore_procinfo are as follows:
The note section also contains additional notes for each kernel-visible execution context of the process (LWP). These notes have names of the form “NetBSD-CORE@nn” where “nn” is the LWP ID of the execution context, for example: “NetBSD-CORE@1”. These notes contain register and other per-execution context data in the same format as is used by the ptrace(2) system call. The note types correspond to the ptrace(2) request numbers that return the same data. For example, a note with a note type of PT_GETREGS would contain a struct reg with the register contents of the execution context. For a complete list of available ptrace(2) request types for a given architecture, refer to that architecture's <machine/ptrace.h> header file.
The core header, struct core, specifies the lengths of the core header itself and each of the following core segment headers to allow for any machine dependent alignment requirements.
struct core {
uint32_t c_midmag; /* magic, id, flags */
uint16_t c_hdrsize; /* Size of this header (machdep algn) */
uint16_t c_seghdrsize; /* Size of a segment header */
uint32_t c_nseg; /* # of core segments */
char c_name[MAXCOMLEN+1]; /* Copy of p->p_comm */
uint32_t c_signo; /* Killing signal */
u_long c_ucode; /* Signal code */
u_long c_cpusize; /* Size of machine dependent segment */
u_long c_tsize; /* Size of traditional text segment */
u_long c_dsize; /* Size of traditional data segment */
u_long c_ssize; /* Size of traditional stack segment */
};
The fields of struct core are as follows:
struct coreseg {
uint32_t c_midmag; /* magic, id, flags */
u_long c_addr; /* Virtual address of segment */
u_long c_size; /* Size of this segment */
};
The fields of struct coreseg are as follows:
In releases previous to NetBSD 1.6, ELF program images produced a.out-format core files.
| July 8, 2002 | NetBSD 6.1 |