NAME

core − format of core image file

DESCRIPTION

The UNIX system writes out a core image of a terminated process when any of various errors occur.  See signal(2) for the list of reasons; the most common are memory violations, illegal instructions, bus errors, and user-generated quit signals. The core image is called core and is written in the process’s working directory (provided it can be; normal access controls apply).  A process with an effective user ID different from the real user ID does not produce a core image. 

The core image contains one or more header sections, followed by the data and stack spaces of the user process.  There is one header section for each active thread in the user process and only one header section if there are no threads. 

Each header section consists of a copy of the system’s user data for the process, including the registers as they existed at the time of the fault.  The size of this section is USIZE pages; USIZE is defined in <sys/param.h>. 

Following the user data in the header is the contents of the vector register file for the process.  The VRF is only included if the thread/process was actually using the floating point unit.  Following the VRF is any thread local storage.  If there is no thread local storage in the process, this section is empty. 

The format of the information in the first section is described by the user structure of the system, defined in <sys/user.h>.  Not included in this file are the locations of the registers.  These are outlined in <machine/reg.h>.  The registers occupy the last EF_SIZE words of the user area. 

Each section of the core file, user area, VRF, thread local, data space, and stack space is page-aligned. 

SEE ALSO

a.out(4), crash(1M), dbg(1), setuid(2), signal(2), thread(2)

September 02, 1992