Quick core file status

Quick core file status

[Phil Muldoon]

Because there has been some interest in core files (I bet you don't hear 
that too often ;), I'm giving a quick update. I think Yong over at IBM 
had a keen interest.

I've written fcore and am 50% done with FCore. These are mapped 
functionality similar to fstack/FStack. I'll check them in, but first I 
don't want the resultant fcore binary to be installed just yet. Is that 
just an rpm thing? Stepan?

I've also made several changes to the Java lib/elf bindings that allow 
updating of Java elf structures back to the native structures. Before 
this, alterations after a get{E,P,Sh}header had no way to be written 
back into libelf.  I'm cleaning those changes up, and will check them in 
very soon.

In summary fcore can:

- stop all tasks
- construct an elf header
- working on program segment headers

There is a bit of an issue with libelf in that it will (for some reason) 
not allow me to write program segments when the e_type in the header is 
set to ET_CORE (which is a problem). Thinking on various ways to get 
around that.

Been researching the various aspects of .notes with roland/andrew. The 
only thing I can see right now that will be needed is access to the 
floating point register for each architecture, and a means to 
differentiate between general purpose and floating point register (a 
separate iterator convenience function maybe?). This is needed as fp 
registers are written to a separate data structure in the notes, while 
general purpose registers are written as part of the pr_status struct. 
As a general guide notes are:

1) elf_prpsinfo for the process
2) then N * tasks (main task first) of:

elf_prstatus
and
elf_fpregset_t (actually a kernel core file only writes these if fp 
operations have  been accessed, but for our case, we will write them 
always, even if empty).


Regards

Phil

Re: Quick core file status

[Andrew Cagney]

Phil,

For the moment I'd put main(String[]) in FCore.java in the util 
directory.   The build system will construct a build-tree executable for 
you.  frysk.bindir.fcore can be added later.

Andrew

Phil Muldoon wrote:
> Because there has been some interest in core files (I bet you don't 
> hear that too often ;), I'm giving a quick update. I think Yong over 
> at IBM had a keen interest.
>
> I've written fcore and am 50% done with FCore. These are mapped 
> functionality similar to fstack/FStack. I'll check them in, but first 
> I don't want the resultant fcore binary to be installed just yet. Is 
> that just an rpm thing? Stepan?
>
> I've also made several changes to the Java lib/elf bindings that allow 
> updating of Java elf structures back to the native structures. Before 
> this, alterations after a get{E,P,Sh}header had no way to be written 
> back into libelf.  I'm cleaning those changes up, and will check them 
> in very soon.

Re: Quick core file status

[Yong Zheng]

On Wed, 2006-10-11 at 21:03 -0500, Phil Muldoon wrote:
> I've written fcore and am 50% done with FCore. These are mapped 
> functionality similar to fstack/FStack. I'll check them in, but first I 
> don't want the resultant fcore binary to be installed just yet. Is that 
> just an rpm thing? Stepan?
> 
> I've also made several changes to the Java lib/elf bindings that allow 
> updating of Java elf structures back to the native structures. Before 
> this, alterations after a get{E,P,Sh}header had no way to be written 
> back into libelf.  I'm cleaning those changes up, and will check them in 
> very soon.

Great work! I think frysk will support core debug soon!
> In summary fcore can:
> 
> - stop all tasks

Stop all tasks by attaching to them!

> - construct an elf header
> - working on program segment headers
> 
> There is a bit of an issue with libelf in that it will (for some reason) 
> not allow me to write program segments when the e_type in the header is 
> set to ET_CORE (which is a problem). Thinking on various ways to get 
> around that.

Besides ET_CORE problem, I think we will meet more such kind "bugs" in
further core process. It's not sure whether such "bugs" would block
core.

> Been researching the various aspects of .notes with roland/andrew. The 
> only thing I can see right now that will be needed is access to the 
> floating point register for each architecture, and a means to 
> differentiate between general purpose and floating point register (a 
> separate iterator convenience function maybe?). 
> This is needed as fp 
> registers are written to a separate data structure in the notes, while 
> general purpose registers are written as part of the pr_status struct. 

Phil, "pr_status struct" means "elf_prstatus struct"? if not, which
header file is it difined? 
> As a general guide notes are:
> 
> 1) elf_prpsinfo for the process
> 2) then N * tasks (main task first) of:
> 
> elf_prstatus
> and
> elf_fpregset_t (actually a kernel core file only writes these if fp 
> operations have  been accessed, but for our case, we will write them 
> always, even if empty).

For the PT_NOTE segment, it may need one ore more types of structs in
the followings:

#define NT_PRSTATUS     1        /* Contains copy of prstatus struct */
#define NT_FPREGSET     2        /* Contains copy of fpregset struct */
#define NT_PRPSINFO     3        /* Contains copy of prpsinfo struct */
#define NT_PRXREG       4        /* Contains copy of prxregset struct */
#define NT_TASKSTRUCT   4        /* Contains copy of task structure */
#define NT_PLATFORM     5        /* String from sysinfo(SI_PLATFORM) */
#define NT_AUXV         6        /* Contains copy of auxv array */
#define NT_GWINDOWS     7        /* Contains copy of gwindows struct */
#define NT_ASRS         8        /* Contains copy of asrset struct */
#define NT_PSTATUS      10       /* Contains copy of pstatus struct */
#define NT_PSINFO       13       /* Contains copy of psinfo struct */
#define NT_PRCRED       14       /* Contains copy of prcred struct */
#define NT_UTSNAME      15       /* Contains copy of utsname struct */
#define NT_LWPSTATUS    16       /* Contains copy of lwpstatus struct */
#define NT_LWPSINFO     17       /* Contains copy of lwpinfo struct */
#define NT_PRFPXREG     20       /* Contains copy of fprxregset struct*/

for the above all types, no specification defines explicitly which ones
are necessary for one core but which ones are optional. But if we could
record more information of process, it will be more easy for frysk to
restore one process's image. So NT_PRSINFO, NT_PRXREG, NT_AUXV are
necessary for one process(NT_TASKSTRUCT is necessary for one process
with multi-threads). Am I right?

Best regards.
Yong Zheng

Re: Quick core file status

[Yong Zheng]

[-- Attachment #1: Type: text/plain, Size: 1133 bytes --]

On Wed, 2006-10-11 at 21:03 -0500, Phil Muldoon wrote:
> Because there has been some interest in core files (I bet you don't hear 
> that too often ;), I'm giving a quick update. I think Yong over at IBM 
> had a keen interest.
> 
> I've written fcore and am 50% done with FCore. These are mapped 
> functionality similar to fstack/FStack. I'll check them in, but first I 
> don't want the resultant fcore binary to be installed just yet. Is that 
> just an rpm thing? Stepan?
> 

Phil, I've read your source codes and dumped one core file on X86_64.
Yes, it can dump the core file's header(including ELF header and program
header). I don't know whether you have finished the code on dumping ELF
header and program header. If yes, I found some problems on program
header:

1)didn't dump out p_flags for each entry.
2)didn't dump out p_filesz for each entry.

The above two values are import when loading a core file later. So I
attach one small patch to add these two values' dumping. For the next
step, it will be on how to dump PT_NOTE segment. This will be
arch-dependent. Do you have some ideas on this?

Best regards
Yong Zheng

[-- Attachment #2: fcore-1013.patch --]
[-- Type: text/x-patch, Size: 1788 bytes --]

Index: frysk-core/frysk/util/FCore.java
===================================================================
RCS file: /cvs/frysk/frysk-core/frysk/util/FCore.java,v
retrieving revision 1.1
diff -u -r1.1 FCore.java
--- frysk-core/frysk/util/FCore.java	12 Oct 2006 18:48:14 -0000	1.1
+++ frysk-core/frysk/util/FCore.java	13 Oct 2006 10:13:01 -0000
@@ -296,6 +295,21 @@
 				pheader.type = 1;
 				pheader.vaddr = addressLow;
 				pheader.memsz = addressHigh - addressLow;
+                
+				pheader.flags = ElfPHeader.PHFLAG_NONE;
+				if (true == permRead)
+					pheader.flags = pheader.flags | ElfPHeader.PHFLAG_READABLE;
+            
+				if (true == permWrite)
+					pheader.flags = pheader.flags | ElfPHeader.PHFLAG_WRITABLE;
+                
+				if (true == permExecute)
+					pheader.flags = pheader.flags | ElfPHeader.PHFLAG_EXECUTABLE;
+                
+				pheader.filesz = 0;
+				if (ElfPHeader.PHFLAG_WRITABLE == (pheader.flags & ElfPHeader.PHFLAG_WRITABLE))
+					pheader.filesz = pheader.memsz;
+                
 				local_elf.updatePHeader(numW, pheader);
 				numW++;
 			}
Index: frysk-imports/lib/elf/ElfPHeader.java
===================================================================
RCS file: /cvs/frysk/frysk-imports/lib/elf/ElfPHeader.java,v
retrieving revision 1.5
diff -u -r1.5 ElfPHeader.java
--- frysk-imports/lib/elf/ElfPHeader.java	20 Jun 2006 19:44:30 -0000	1.5
+++ frysk-imports/lib/elf/ElfPHeader.java	13 Oct 2006 10:14:18 -0000
@@ -44,7 +44,11 @@
  *
  */
 public class ElfPHeader {
-
+	public static final int PHFLAG_NONE = 0x0;
+	public static final int PHFLAG_EXECUTABLE = 0x01;
+	public static final int PHFLAG_WRITABLE = 0x02;
+	public static final int PHFLAG_READABLE = 0x04;
+    
 	public int type;
 	public int flags;
 	public long offset;

Re: Quick core file status

[Phil Muldoon]

Yong thanks, I'll check them in. FCore is definitely unfinished (ie the 
segments have not actually been written yet, and .notes have not been 
done) so lots of work to do yet!

Thanks for the patches!

Regards

Phil

Yong Zheng wrote:
> On Wed, 2006-10-11 at 21:03 -0500, Phil Muldoon wrote:
>   
>> Because there has been some interest in core files (I bet you don't hear 
>> that too often ;), I'm giving a quick update. I think Yong over at IBM 
>> had a keen interest.
>>
>> I've written fcore and am 50% done with FCore. These are mapped 
>> functionality similar to fstack/FStack. I'll check them in, but first I 
>> don't want the resultant fcore binary to be installed just yet. Is that 
>> just an rpm thing? Stepan?
>>
>>     
>
> Phil, I've read your source codes and dumped one core file on X86_64.
> Yes, it can dump the core file's header(including ELF header and program
> header). I don't know whether you have finished the code on dumping ELF
> header and program header. If yes, I found some problems on program
> header:
>
> 1)didn't dump out p_flags for each entry.
> 2)didn't dump out p_filesz for each entry.
>
> The above two values are import when loading a core file later. So I
> attach one small patch to add these two values' dumping. For the next
> step, it will be on how to dump PT_NOTE segment. This will be
> arch-dependent. Do you have some ideas on this?
>
> Best regards
> Yong Zheng
>   
> ------------------------------------------------------------------------
>
> Index: frysk-core/frysk/util/FCore.java
> ===================================================================
> RCS file: /cvs/frysk/frysk-core/frysk/util/FCore.java,v
> retrieving revision 1.1
> diff -u -r1.1 FCore.java
> --- frysk-core/frysk/util/FCore.java	12 Oct 2006 18:48:14 -0000	1.1
> +++ frysk-core/frysk/util/FCore.java	13 Oct 2006 10:13:01 -0000
> @@ -296,6 +295,21 @@
>  				pheader.type = 1;
>  				pheader.vaddr = addressLow;
>  				pheader.memsz = addressHigh - addressLow;
> +                
> +				pheader.flags = ElfPHeader.PHFLAG_NONE;
> +				if (true == permRead)
> +					pheader.flags = pheader.flags | ElfPHeader.PHFLAG_READABLE;
> +            
> +				if (true == permWrite)
> +					pheader.flags = pheader.flags | ElfPHeader.PHFLAG_WRITABLE;
> +                
> +				if (true == permExecute)
> +					pheader.flags = pheader.flags | ElfPHeader.PHFLAG_EXECUTABLE;
> +                
> +				pheader.filesz = 0;
> +				if (ElfPHeader.PHFLAG_WRITABLE == (pheader.flags & ElfPHeader.PHFLAG_WRITABLE))
> +					pheader.filesz = pheader.memsz;
> +                
>  				local_elf.updatePHeader(numW, pheader);
>  				numW++;
>  			}
> Index: frysk-imports/lib/elf/ElfPHeader.java
> ===================================================================
> RCS file: /cvs/frysk/frysk-imports/lib/elf/ElfPHeader.java,v
> retrieving revision 1.5
> diff -u -r1.5 ElfPHeader.java
> --- frysk-imports/lib/elf/ElfPHeader.java	20 Jun 2006 19:44:30 -0000	1.5
> +++ frysk-imports/lib/elf/ElfPHeader.java	13 Oct 2006 10:14:18 -0000
> @@ -44,7 +44,11 @@
>   *
>   */
>  public class ElfPHeader {
> -
> +	public static final int PHFLAG_NONE = 0x0;
> +	public static final int PHFLAG_EXECUTABLE = 0x01;
> +	public static final int PHFLAG_WRITABLE = 0x02;
> +	public static final int PHFLAG_READABLE = 0x04;
> +    
>  	public int type;
>  	public int flags;
>  	public long offset;
>