ELF-format core files are described by a standard ELF exec header and a series of ELF program headers. Each program header describes a range of the virtual address space of the process.
In addition,
NetBSD ELF core files include an ELF note section which provides additional information about the process. The first note in the note section has a note name of “NetBSD-CORE” and a note type of ELF_NOTE_NETBSD_CORE_PROCINFO (1), and contains the following structure:
struct netbsd_elfcore_procinfo {
/* Version 1 fields start here. */
uint32_t cpi_version; /* netbsd_elfcore_procinfo version */
uint32_t cpi_cpisize; /* sizeof(netbsd_elfcore_procinfo) */
uint32_t cpi_signo; /* killing signal */
uint32_t cpi_sigcode; /* signal code */
uint32_t cpi_sigpend[4]; /* pending signals */
uint32_t cpi_sigmask[4]; /* blocked signals */
uint32_t cpi_sigignore[4]; /* blocked signals */
uint32_t cpi_sigcatch[4]; /* blocked signals */
int32_t cpi_pid; /* process ID */
int32_t cpi_ppid; /* parent process ID */
int32_t cpi_pgrp; /* process group ID */
int32_t cpi_sid; /* session ID */
uint32_t cpi_ruid; /* real user ID */
uint32_t cpi_euid; /* effective user ID */
uint32_t cpi_svuid; /* saved user ID */
uint32_t cpi_rgid; /* real group ID */
uint32_t cpi_egid; /* effective group ID */
uint32_t cpi_svgid; /* saved group ID */
uint32_t cpi_nlwps; /* number of LWPs */
int8_t cpi_name[32]; /* copy of p->p_comm */
/* Add version 2 fields below here. */
};
The fields of
struct netbsd_elfcore_procinfo are as follows:
cpi_version
The version of this structure. The current version is defined by the NETBSD_ELFCORE_PROCINFO_VERSION constant.
cpi_cpisize
The size of this structure.
cpi_signo
Signal that caused the process to dump core.
cpi_sigcode
Signal-specific code, if any, corresponding to cpi_signo.
cpi_sigpend
A mask of signals pending delivery to the process. This may be examined by copying it to a sigset_t.
cpi_sigmask
The set of signals currently blocked by the process. This may be examined by copying it to a sigset_t.
cpi_sigignore
The set of signals currently being ignored by the process. This may be examined by copying it to a sigset_t.
cpi_sigcatch
The set of signals with registers signals handlers for the process. This may be examined by copying it to a sigset_t.
cpi_pid
Process ID of the process.
cpi_ppid
Process ID of the parent process.
cpi_pgrp
Process group ID of the process.
cpi_sid
Session ID of the process.
cpi_ruid
Real user ID of the process.
cpi_euid
Effective user ID of the process.
cpi_svuid
Saved user ID of the process.
cpi_rgid
Real group ID of the process.
cpi_egid
Effective group ID of the process.
cpi_svgid
Saved group ID of the process.
cpi_nlwps
Number of kernel-visible execution contexts (LWPs) of the process.
cpi_name
Process name, copied from the p_comm field of struct proc.
The note section also contains additional notes for each kernel-visible execution context of the process (LWP). These notes have names of the form “NetBSD-CORE@nn” where “nn” is the LWP ID of the execution context, for example: “NetBSD-CORE@1”. These notes contain register and other per-execution context data in the same format as is used by the
ptrace(2) system call. The note types correspond to the
ptrace(2) request numbers that return the same data. For example, a note with a note type of PT_GETREGS would contain a
struct reg with the register contents of the execution context. For a complete list of available
ptrace(2) request types for a given architecture, refer to that architecture's
<machine/ptrace.h> header file.