I am wondering if its possible to access the "u area" of the process
in its "core" image.

Basically, when a process cores, does the core contain kernel data
segment?

Thanks
Steve

steven_mark_99@yahoo.com (Mark) writes:

>I am wondering if its possible to access the "u area" of the process
>in its "core" image.

>Basically, when a process cores, does the core contain kernel data
>segment?


Depends very much on the OS; in the old days, it would contain the
"u. area" but those days are now (mostly?) gone and the data is
presented in a more permanent fashion.

In Solaris, all the relevant information is now contained in an
Elf NOTE section (this contains process status, credential, information
about the OS, status of all the lwps, and more)

Casper
-- 
Expressed in this posting are my opinions.  They are in no way related
to opinions held by my employer, Sun Microsystems.
Statements on Sun products included here are not gospel and may
be fiction rather than truth.

Casper H.S. Dik <Casper.Dik@Sun.COM> wrote in message news:<41a9df6e$0$78279$e4fe514c@news.xs4all.nl>...
> steven_mark_99@yahoo.com (Mark) writes:
> 
> >I am wondering if its possible to access the "u area" of the process
> >in its "core" image.
>  
> >Basically, when a process cores, does the core contain kernel data
> >segment?
> 
> 
> Depends very much on the OS; in the old days, it would contain the
> "u. area" but those days are now (mostly?) gone and the data is
> presented in a more permanent fashion.

I am talking about FreeBSD here and following is the u area structure

<sys/user.h>

struct  user {
        struct  pcb u_pcb;
        struct  sigacts u_sigacts;      /* p_sigacts points here (use
it!) */
        struct  pstats u_stats;         /* p_stats points here (use
it!) */
        /*
         * Remaining fields only for core dump and/or ptrace--
         * not valid at other times!
         */
        struct  kinfo_proc u_kproc;     /* proc + eproc */
        struct  md_coredump u_md;       /* machine dependent glop */
};

What I am asking is in the ELF core for the process where do I find
this information for the concerned process?

Thanks
Steve



> 
> In Solaris, all the relevant information is now contained in an
> Elf NOTE section (this contains process status, credential, information
> about the OS, status of all the lwps, and more)
> 
> Casper

On 28 Nov 2004 16:59:48 -0800,
    Mark <steven_mark_99@yahoo.com> wrote:


>
> I am talking about FreeBSD here and following is the u area structure
>


The usual way is to open and read from /dev/mem or /dev/kmem.  The
lsof program and SystemV version of ps usualy do exactly that.


Villy

steven_mark_99@yahoo.com (Mark) writes:

>I am talking about FreeBSD here and following is the u area structure

><sys/user.h>

>struct  user {
>        struct  pcb u_pcb;
>        struct  sigacts u_sigacts;      /* p_sigacts points here (use
>it!) */
>        struct  pstats u_stats;         /* p_stats points here (use
>it!) */
>        /*
>         * Remaining fields only for core dump and/or ptrace--
>         * not valid at other times!
>         */
>        struct  kinfo_proc u_kproc;     /* proc + eproc */
>        struct  md_coredump u_md;       /* machine dependent glop */
>};

>What I am asking is in the ELF core for the process where do I find
>this information for the concerned process?


The structure does not make sense for Solaris executables.

There's an ELF notes section which has all this information; in
<sys/elf.h> all the "NT_XXXX" sections are defined.
(Notes with name CORE and one of the NT type codes)

Casper