CORE(5) BSD Programmer's Manual CORE(5)NAMEcore - file format of a core dump
SYNOPSIS
#include <sys/elf.h>
DESCRIPTION
A core file or core dump contains the contents of the writable memory
segments of a previously running program. Core dumps are ELF binary
files (see elf(5)).
The system will terminate a program and create a core dump in certain
situations. The system or another process may send a signal (see
sigaction(2)) to a given process to notify it of a condition, and if the
given process does not arrange to ignore, block or catch the signal, the
system may terminate the process and create a core dump. Only certain
signals will produce a core dump. The system will send some of these
signals automatically if it detects a serious error in the process.
These errors include references to unallocated memory, attempts to write
to write-protected memory, attempts to execute privileged instructions or
division by zero. A user may also send signals to create core dumps.
The SIGQUIT signal is a software signal that can be generated at the key-
board (see termios(4)). If a process calls the abort(3) function, the
system will send it a SIGABRT signal. There are restrictions on sending
signals to other processes that prevent unauthorized users from terminat-
ing processes (see kill(2)). A process may choose to ignore, block or
catch signals that cause core dumps.
When the system automatically creates a core dump, it writes the informa-
tion to a file named program.core in the process's current directory,
where program is the name of the program. Core files have mode u=rw; on-
ly the process's owner may read or write a core file.
The system will refuse to create an automatic core dump in certain condi-
tions:
o if the process has had setuid or setgid privileges and isn't
currently running with superuser privileges
o if the process does not have permission to create a file in its
current directory
o if a file with the same name as the core dump already exists,
and the process's owner doesn't own the file
o if the file exists, and it is not a regular file
o if the file exists, and it has hard links (its link count is
greater than one)
o if the file exists, and it is readable or writable by group or
other
o if the process's core file size limit is zero (see
setrlimit(2))
The system refuses to follow a symlink to a core file if the process cur-
rently has setuid or setgid privileges.
A process may also request a core dump without termination (see
fcore(2)). Such core dumps contain snapshots of a process's running
state.
A core dump is an ELF binary file with type ET_CORE. It contains a pro-
gram header table but no section header table. The program header table
contains a note segment plus one segment for each writable memory segment
in the process's virtual memory.
The note segment contains BSD/OS-specific and architecture-specific core
notes that describe process state other than memory. The core notes each
have the name BSD/OS. The note with type 1 has a descriptor section con-
taining register state. On the i386 architecture, it holds 17 32-bit
slots for the process's general registers in trap frame format (see
<machine/reg.h>) plus an integer containing the terminating signal (if
any). On the SPARC, it holds both general registers and floating point
registers. Note that the system performs a register window flush on the
SPARC immediately before creating a core dump. The note with type 2 con-
tains a pcb structure (see <machine/pcb.h>). This structure contains the
floating point registers on the i386. The note with type 3 contains a
kinfo_proc structure (see <sys/sysctl.h>).
SEE ALSOgcore(1), gdb(1), fcore(2), setrlimit(2), sigaction(2), elf(5)HISTORY
ELF core files originated in Unix System V. The BSD/OS-specific notes
first appeared in BSD/OS 4.0.
BUGS
If the core dump file size limit is greater than zero but not unlimited,
the system will create zero-length core dump files when the core dump
size would exceed the limit.
BSDI BSD/OS December 13, 1997 2