core(4) core(4)
NAME
core - core image file
DESCRIPTION
The UNIX system writes out a core image of a process when it
is terminated due to the receipt of some signals. The core
image is called core.procid and is written in the process's
current directory (provided it can be; normal access controls
apply). procid is the process identifier of the process
receiving the signal. A process with an effective user ID
different from the real user ID will not produce a core image.
The core image contains information that allows user-level
tools to determine the cause of process termination and its
state at termination. This information includes the contents
of hardware registers, process status, and the writable
segments of the process including its stack. The status
information in a core file is divided into process-wide
information and information specific to each Light Weight
Process (LWP) in the address space.
For both COFF and ELF executable programs [see a.out(4)], the
core file generated is an ELF file, consisting of the images
of the process' data segments plus per-LWP status information.
The e_type field in the file header has type ET_CORE.
A process is composed of several discrete areas of memory or
segments. Each segment comprise one or more areas with
identical permissions called regions. Each core file contains
a program header table. There is a program header entry for
every region of the process at termination. This includes all
regions from the shared objects used by the process. If a
region had read-only permission and was never written to
during the process lifetime, then the contents of that region
is not dumped to the core file. The p_filesz member of its
program header will be zero. Each writable region of the
process plus each region that was read-only at process
termination but was writable at some point in the lifetime of
the process is dumped to the core image.
A core file contains a NOTE section containing information
common to the process as a whole and an additional NOTE
section for each LWP existing in the process at termination.
Each of these sections has an accompanying program header
entry. The NOTE section containing information common to the
process as a whole contains up to four entries. Each entry
Copyright 1994 Novell, Inc. Page 1
core(4) core(4)
has the name CORE and presents the contents of a system
structure:
prstatus_t
The entry containing this structure has a NOTE type of
CF_T_PRSTATUS. This structure contains things of
interest to a debugger from the operating system's u-
area, such as system call trace masks, signal
dispositions, process ID and so forth. This information
is common to all LWPs in the process but this entry will
also contain information on the LWP that encountered the
signal that resulted in the process' termination. The
structure is defined in <sys/procfs.h>.
prpsinfo_t
The entry containing this structure has a NOTE type of
CF_T_PRPSINFO. It contains information of interest to
the ps(1) command that is common to all LWPs in the
process, such as process status, cpu usage, ``nice''
value, controlling terminal, user ID, process ID, the
name of the executable and so forth. The structure is
defined in <sys/procfs.h>.
prcred_t
The entry containing this structure has a NOTE type of
CF_T_PRCRED. This entry contains the credential
information for the terminated process. The structure
is defined in <sys/procfs.h>.
struct utsname
The entry containing this structure has a NOTE type of
CF_T_UTSNAME. It contains information about the system
on which the process was running when it terminated.
The structure is defined in <sys/utsname.h>.
Each LWP-specific NOTE section contains up to two entries,
each named CORE. The entries contain the following system
structures:
lwpstatus_t
The entry containing this structure has a NOTE type of
CF_T_LWPSTATUS. This entry contains things of interest
to a debugger from the LWP's u-area, such as the
processor registers, signal mask, state, reason for
stopping and others. The structure is defined in
<sys/procfs.h>.
Copyright 1994 Novell, Inc. Page 2
core(4) core(4)
lwpsinfo_t
The entry containing this structure has a NOTE type of
CF_T_LWPSINFO. This entry contains things of interest
to the ps command, such as flags, status, priority, cpu
usage. The structure is defined in <sys/procfs.h>.
The definitions for NOTE types are contained in the header
file <sys/core.h>.
The size of the core file created by a process may be
controlled by the user [see getrlimit(2)].
REFERENCES
a.out(4), crash(1M), debug(1), elf(3E), getrlimit(2),
setuid(2), signal(5) sp 0.4
Copyright 1994 Novell, Inc. Page 3