xref: /freebsd/usr.bin/gcore/elfcore.c (revision 076ad2f8)
1 /*-
2  * Copyright (c) 2007 Sandvine Incorporated
3  * Copyright (c) 1998 John D. Polstra
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #include <sys/endian.h>
32 #include <sys/param.h>
33 #include <sys/procfs.h>
34 #include <sys/ptrace.h>
35 #include <sys/queue.h>
36 #include <sys/linker_set.h>
37 #include <sys/sbuf.h>
38 #include <sys/sysctl.h>
39 #include <sys/user.h>
40 #include <sys/wait.h>
41 #include <machine/elf.h>
42 #include <vm/vm_param.h>
43 #include <vm/vm.h>
44 #include <vm/pmap.h>
45 #include <vm/vm_map.h>
46 #include <assert.h>
47 #include <err.h>
48 #include <errno.h>
49 #include <fcntl.h>
50 #include <stdbool.h>
51 #include <stdint.h>
52 #include <stdio.h>
53 #include <stdlib.h>
54 #include <string.h>
55 #include <unistd.h>
56 #include <libutil.h>
57 
58 #include "extern.h"
59 
60 /*
61  * Code for generating ELF core dumps.
62  */
63 
64 typedef void (*segment_callback)(vm_map_entry_t, void *);
65 
66 /* Closure for cb_put_phdr(). */
67 struct phdr_closure {
68 	Elf_Phdr *phdr;		/* Program header to fill in */
69 	Elf_Off offset;		/* Offset of segment in core file */
70 };
71 
72 /* Closure for cb_size_segment(). */
73 struct sseg_closure {
74 	int count;		/* Count of writable segments. */
75 	size_t size;		/* Total size of all writable segments. */
76 };
77 
78 #ifdef ELFCORE_COMPAT_32
79 typedef struct fpreg32 elfcore_fpregset_t;
80 typedef struct reg32   elfcore_gregset_t;
81 typedef struct prpsinfo32 elfcore_prpsinfo_t;
82 typedef struct prstatus32 elfcore_prstatus_t;
83 static void elf_convert_gregset(elfcore_gregset_t *rd, struct reg *rs);
84 static void elf_convert_fpregset(elfcore_fpregset_t *rd, struct fpreg *rs);
85 #else
86 typedef fpregset_t elfcore_fpregset_t;
87 typedef gregset_t  elfcore_gregset_t;
88 typedef prpsinfo_t elfcore_prpsinfo_t;
89 typedef prstatus_t elfcore_prstatus_t;
90 #define elf_convert_gregset(d,s)	*d = *s
91 #define elf_convert_fpregset(d,s)	*d = *s
92 #endif
93 
94 typedef void* (*notefunc_t)(void *, size_t *);
95 
96 static void cb_put_phdr(vm_map_entry_t, void *);
97 static void cb_size_segment(vm_map_entry_t, void *);
98 static void each_dumpable_segment(vm_map_entry_t, segment_callback,
99     void *closure);
100 static void elf_detach(void);	/* atexit() handler. */
101 static void *elf_note_fpregset(void *, size_t *);
102 static void *elf_note_prpsinfo(void *, size_t *);
103 static void *elf_note_prstatus(void *, size_t *);
104 static void *elf_note_thrmisc(void *, size_t *);
105 #if defined(__i386__) || defined(__amd64__)
106 static void *elf_note_x86_xstate(void *, size_t *);
107 #endif
108 #if defined(__powerpc__)
109 static void *elf_note_powerpc_vmx(void *, size_t *);
110 #endif
111 static void *elf_note_procstat_auxv(void *, size_t *);
112 static void *elf_note_procstat_files(void *, size_t *);
113 static void *elf_note_procstat_groups(void *, size_t *);
114 static void *elf_note_procstat_osrel(void *, size_t *);
115 static void *elf_note_procstat_proc(void *, size_t *);
116 static void *elf_note_procstat_psstrings(void *, size_t *);
117 static void *elf_note_procstat_rlimit(void *, size_t *);
118 static void *elf_note_procstat_umask(void *, size_t *);
119 static void *elf_note_procstat_vmmap(void *, size_t *);
120 static void elf_puthdr(int, pid_t, vm_map_entry_t, void *, size_t, size_t,
121     size_t, int);
122 static void elf_putnote(int, notefunc_t, void *, struct sbuf *);
123 static void elf_putnotes(pid_t, struct sbuf *, size_t *);
124 static void freemap(vm_map_entry_t);
125 static vm_map_entry_t readmap(pid_t);
126 static void *procstat_sysctl(void *, int, size_t, size_t *sizep);
127 
128 static pid_t g_pid;		/* Pid being dumped, global for elf_detach */
129 static int g_status;		/* proc status after ptrace attach */
130 
131 static int
132 elf_ident(int efd, pid_t pid __unused, char *binfile __unused)
133 {
134 	Elf_Ehdr hdr;
135 	int cnt;
136 	uint16_t machine;
137 
138 	cnt = read(efd, &hdr, sizeof(hdr));
139 	if (cnt != sizeof(hdr))
140 		return (0);
141 	if (!IS_ELF(hdr))
142 		return (0);
143 	switch (hdr.e_ident[EI_DATA]) {
144 	case ELFDATA2LSB:
145 		machine = le16toh(hdr.e_machine);
146 		break;
147 	case ELFDATA2MSB:
148 		machine = be16toh(hdr.e_machine);
149 		break;
150 	default:
151 		return (0);
152 	}
153 	if (!ELF_MACHINE_OK(machine))
154 		return (0);
155 
156 	/* Looks good. */
157 	return (1);
158 }
159 
160 static void
161 elf_detach(void)
162 {
163 	int sig;
164 
165 	if (g_pid != 0) {
166 		/*
167 		 * Forward any pending signals. SIGSTOP is generated by ptrace
168 		 * itself, so ignore it.
169 		 */
170 		sig = WIFSTOPPED(g_status) ? WSTOPSIG(g_status) : 0;
171 		if (sig == SIGSTOP)
172 			sig = 0;
173 		ptrace(PT_DETACH, g_pid, (caddr_t)1, sig);
174 	}
175 }
176 
177 /*
178  * Write an ELF coredump for the given pid to the given fd.
179  */
180 static void
181 elf_coredump(int efd, int fd, pid_t pid)
182 {
183 	vm_map_entry_t map;
184 	struct sseg_closure seginfo;
185 	struct sbuf *sb;
186 	void *hdr;
187 	size_t hdrsize, notesz, segoff;
188 	ssize_t n, old_len;
189 	Elf_Phdr *php;
190 	int i;
191 
192 	/* Attach to process to dump. */
193 	g_pid = pid;
194 	if (atexit(elf_detach) != 0)
195 		err(1, "atexit");
196 	errno = 0;
197 	ptrace(PT_ATTACH, pid, NULL, 0);
198 	if (errno)
199 		err(1, "PT_ATTACH");
200 	if (waitpid(pid, &g_status, 0) == -1)
201 		err(1, "waitpid");
202 
203 	/* Get the program's memory map. */
204 	map = readmap(pid);
205 
206 	/* Size the program segments. */
207 	seginfo.count = 0;
208 	seginfo.size = 0;
209 	each_dumpable_segment(map, cb_size_segment, &seginfo);
210 
211 	/*
212 	 * Build the header and the notes using sbuf and write to the file.
213 	 */
214 	sb = sbuf_new_auto();
215 	hdrsize = sizeof(Elf_Ehdr) + sizeof(Elf_Phdr) * (1 + seginfo.count);
216 	if (seginfo.count + 1 >= PN_XNUM)
217 		hdrsize += sizeof(Elf_Shdr);
218 	/* Start header + notes section. */
219 	sbuf_start_section(sb, NULL);
220 	/* Make empty header subsection. */
221 	sbuf_start_section(sb, &old_len);
222 	sbuf_putc(sb, 0);
223 	sbuf_end_section(sb, old_len, hdrsize, 0);
224 	/* Put notes. */
225 	elf_putnotes(pid, sb, &notesz);
226 	/* Align up to a page boundary for the program segments. */
227 	sbuf_end_section(sb, -1, PAGE_SIZE, 0);
228 	if (sbuf_finish(sb) != 0)
229 		err(1, "sbuf_finish");
230 	hdr = sbuf_data(sb);
231 	segoff = sbuf_len(sb);
232 	/* Fill in the header. */
233 	elf_puthdr(efd, pid, map, hdr, hdrsize, notesz, segoff, seginfo.count);
234 
235 	n = write(fd, hdr, segoff);
236 	if (n == -1)
237 		err(1, "write");
238 	if (n < segoff)
239               errx(1, "short write");
240 
241 	/* Write the contents of all of the writable segments. */
242 	php = (Elf_Phdr *)((char *)hdr + sizeof(Elf_Ehdr)) + 1;
243 	for (i = 0;  i < seginfo.count;  i++) {
244 		struct ptrace_io_desc iorequest;
245 		uintmax_t nleft = php->p_filesz;
246 
247 		iorequest.piod_op = PIOD_READ_D;
248 		iorequest.piod_offs = (caddr_t)(uintptr_t)php->p_vaddr;
249 		while (nleft > 0) {
250 			char buf[8*1024];
251 			size_t nwant;
252 			ssize_t ngot;
253 
254 			if (nleft > sizeof(buf))
255 				nwant = sizeof buf;
256 			else
257 				nwant = nleft;
258 			iorequest.piod_addr = buf;
259 			iorequest.piod_len = nwant;
260 			ptrace(PT_IO, pid, (caddr_t)&iorequest, 0);
261 			ngot = iorequest.piod_len;
262 			if ((size_t)ngot < nwant)
263 				errx(1, "short read wanted %zu, got %zd",
264 				    nwant, ngot);
265 			ngot = write(fd, buf, nwant);
266 			if (ngot == -1)
267 				err(1, "write of segment %d failed", i);
268 			if ((size_t)ngot != nwant)
269 				errx(1, "short write");
270 			nleft -= nwant;
271 			iorequest.piod_offs += ngot;
272 		}
273 		php++;
274 	}
275 	sbuf_delete(sb);
276 	freemap(map);
277 }
278 
279 /*
280  * A callback for each_dumpable_segment() to write out the segment's
281  * program header entry.
282  */
283 static void
284 cb_put_phdr(vm_map_entry_t entry, void *closure)
285 {
286 	struct phdr_closure *phc = (struct phdr_closure *)closure;
287 	Elf_Phdr *phdr = phc->phdr;
288 
289 	phc->offset = round_page(phc->offset);
290 
291 	phdr->p_type = PT_LOAD;
292 	phdr->p_offset = phc->offset;
293 	phdr->p_vaddr = entry->start;
294 	phdr->p_paddr = 0;
295 	phdr->p_filesz = phdr->p_memsz = entry->end - entry->start;
296 	phdr->p_align = PAGE_SIZE;
297 	phdr->p_flags = 0;
298 	if (entry->protection & VM_PROT_READ)
299 		phdr->p_flags |= PF_R;
300 	if (entry->protection & VM_PROT_WRITE)
301 		phdr->p_flags |= PF_W;
302 	if (entry->protection & VM_PROT_EXECUTE)
303 		phdr->p_flags |= PF_X;
304 
305 	phc->offset += phdr->p_filesz;
306 	phc->phdr++;
307 }
308 
309 /*
310  * A callback for each_dumpable_segment() to gather information about
311  * the number of segments and their total size.
312  */
313 static void
314 cb_size_segment(vm_map_entry_t entry, void *closure)
315 {
316 	struct sseg_closure *ssc = (struct sseg_closure *)closure;
317 
318 	ssc->count++;
319 	ssc->size += entry->end - entry->start;
320 }
321 
322 /*
323  * For each segment in the given memory map, call the given function
324  * with a pointer to the map entry and some arbitrary caller-supplied
325  * data.
326  */
327 static void
328 each_dumpable_segment(vm_map_entry_t map, segment_callback func, void *closure)
329 {
330 	vm_map_entry_t entry;
331 
332 	for (entry = map;  entry != NULL;  entry = entry->next)
333 		(*func)(entry, closure);
334 }
335 
336 static void
337 elf_putnotes(pid_t pid, struct sbuf *sb, size_t *sizep)
338 {
339 	lwpid_t *tids;
340 	size_t threads, old_len;
341 	ssize_t size;
342 	int i;
343 
344 	errno = 0;
345 	threads = ptrace(PT_GETNUMLWPS, pid, NULL, 0);
346 	if (errno)
347 		err(1, "PT_GETNUMLWPS");
348 	tids = malloc(threads * sizeof(*tids));
349 	if (tids == NULL)
350 		errx(1, "out of memory");
351 	errno = 0;
352 	ptrace(PT_GETLWPLIST, pid, (void *)tids, threads);
353 	if (errno)
354 		err(1, "PT_GETLWPLIST");
355 
356 	sbuf_start_section(sb, &old_len);
357 	elf_putnote(NT_PRPSINFO, elf_note_prpsinfo, &pid, sb);
358 
359 	for (i = 0; i < threads; ++i) {
360 		elf_putnote(NT_PRSTATUS, elf_note_prstatus, tids + i, sb);
361 		elf_putnote(NT_FPREGSET, elf_note_fpregset, tids + i, sb);
362 		elf_putnote(NT_THRMISC, elf_note_thrmisc, tids + i, sb);
363 #if defined(__i386__) || defined(__amd64__)
364 		elf_putnote(NT_X86_XSTATE, elf_note_x86_xstate, tids + i, sb);
365 #endif
366 #if defined(__powerpc__)
367 		elf_putnote(NT_PPC_VMX, elf_note_powerpc_vmx, tids + i, sb);
368 #endif
369 	}
370 
371 #ifndef ELFCORE_COMPAT_32
372 	elf_putnote(NT_PROCSTAT_PROC, elf_note_procstat_proc, &pid, sb);
373 	elf_putnote(NT_PROCSTAT_FILES, elf_note_procstat_files, &pid, sb);
374 	elf_putnote(NT_PROCSTAT_VMMAP, elf_note_procstat_vmmap, &pid, sb);
375 	elf_putnote(NT_PROCSTAT_GROUPS, elf_note_procstat_groups, &pid, sb);
376 	elf_putnote(NT_PROCSTAT_UMASK, elf_note_procstat_umask, &pid, sb);
377 	elf_putnote(NT_PROCSTAT_RLIMIT, elf_note_procstat_rlimit, &pid, sb);
378 	elf_putnote(NT_PROCSTAT_OSREL, elf_note_procstat_osrel, &pid, sb);
379 	elf_putnote(NT_PROCSTAT_PSSTRINGS, elf_note_procstat_psstrings, &pid,
380 	    sb);
381 	elf_putnote(NT_PROCSTAT_AUXV, elf_note_procstat_auxv, &pid, sb);
382 #endif
383 
384 	size = sbuf_end_section(sb, old_len, 1, 0);
385 	if (size == -1)
386 		err(1, "sbuf_end_section");
387 	free(tids);
388 	*sizep = size;
389 }
390 
391 /*
392  * Emit one note section to sbuf.
393  */
394 static void
395 elf_putnote(int type, notefunc_t notefunc, void *arg, struct sbuf *sb)
396 {
397 	Elf_Note note;
398 	size_t descsz;
399 	ssize_t old_len;
400 	void *desc;
401 
402 	desc = notefunc(arg, &descsz);
403 	note.n_namesz = 8; /* strlen("FreeBSD") + 1 */
404 	note.n_descsz = descsz;
405 	note.n_type = type;
406 
407 	sbuf_bcat(sb, &note, sizeof(note));
408 	sbuf_start_section(sb, &old_len);
409 	sbuf_bcat(sb, "FreeBSD", note.n_namesz);
410 	sbuf_end_section(sb, old_len, sizeof(Elf32_Size), 0);
411 	if (descsz == 0)
412 		return;
413 	sbuf_start_section(sb, &old_len);
414 	sbuf_bcat(sb, desc, descsz);
415 	sbuf_end_section(sb, old_len, sizeof(Elf32_Size), 0);
416 	free(desc);
417 }
418 
419 /*
420  * Generate the ELF coredump header.
421  */
422 static void
423 elf_puthdr(int efd, pid_t pid, vm_map_entry_t map, void *hdr, size_t hdrsize,
424     size_t notesz, size_t segoff, int numsegs)
425 {
426 	Elf_Ehdr *ehdr, binhdr;
427 	Elf_Phdr *phdr;
428 	Elf_Shdr *shdr;
429 	struct phdr_closure phc;
430 	ssize_t cnt;
431 
432 	cnt = read(efd, &binhdr, sizeof(binhdr));
433 	if (cnt < 0)
434 		err(1, "Failed to re-read ELF header");
435 	else if (cnt != sizeof(binhdr))
436 		errx(1, "Failed to re-read ELF header");
437 
438 	ehdr = (Elf_Ehdr *)hdr;
439 
440 	ehdr->e_ident[EI_MAG0] = ELFMAG0;
441 	ehdr->e_ident[EI_MAG1] = ELFMAG1;
442 	ehdr->e_ident[EI_MAG2] = ELFMAG2;
443 	ehdr->e_ident[EI_MAG3] = ELFMAG3;
444 	ehdr->e_ident[EI_CLASS] = ELF_CLASS;
445 	ehdr->e_ident[EI_DATA] = ELF_DATA;
446 	ehdr->e_ident[EI_VERSION] = EV_CURRENT;
447 	ehdr->e_ident[EI_OSABI] = ELFOSABI_FREEBSD;
448 	ehdr->e_ident[EI_ABIVERSION] = 0;
449 	ehdr->e_ident[EI_PAD] = 0;
450 	ehdr->e_type = ET_CORE;
451 	ehdr->e_machine = binhdr.e_machine;
452 	ehdr->e_version = EV_CURRENT;
453 	ehdr->e_entry = 0;
454 	ehdr->e_phoff = sizeof(Elf_Ehdr);
455 	ehdr->e_flags = binhdr.e_flags;
456 	ehdr->e_ehsize = sizeof(Elf_Ehdr);
457 	ehdr->e_phentsize = sizeof(Elf_Phdr);
458 	ehdr->e_shentsize = sizeof(Elf_Shdr);
459 	ehdr->e_shstrndx = SHN_UNDEF;
460 	if (numsegs + 1 < PN_XNUM) {
461 		ehdr->e_phnum = numsegs + 1;
462 		ehdr->e_shnum = 0;
463 	} else {
464 		ehdr->e_phnum = PN_XNUM;
465 		ehdr->e_shnum = 1;
466 
467 		ehdr->e_shoff = ehdr->e_phoff +
468 		    (numsegs + 1) * ehdr->e_phentsize;
469 
470 		shdr = (Elf_Shdr *)((char *)hdr + ehdr->e_shoff);
471 		memset(shdr, 0, sizeof(*shdr));
472 		/*
473 		 * A special first section is used to hold large segment and
474 		 * section counts.  This was proposed by Sun Microsystems in
475 		 * Solaris and has been adopted by Linux; the standard ELF
476 		 * tools are already familiar with the technique.
477 		 *
478 		 * See table 7-7 of the Solaris "Linker and Libraries Guide"
479 		 * (or 12-7 depending on the version of the document) for more
480 		 * details.
481 		 */
482 		shdr->sh_type = SHT_NULL;
483 		shdr->sh_size = ehdr->e_shnum;
484 		shdr->sh_link = ehdr->e_shstrndx;
485 		shdr->sh_info = numsegs + 1;
486 	}
487 
488 	/*
489 	 * Fill in the program header entries.
490 	 */
491 	phdr = (Elf_Phdr *)((char *)hdr + ehdr->e_phoff);
492 
493 	/* The note segement. */
494 	phdr->p_type = PT_NOTE;
495 	phdr->p_offset = hdrsize;
496 	phdr->p_vaddr = 0;
497 	phdr->p_paddr = 0;
498 	phdr->p_filesz = notesz;
499 	phdr->p_memsz = 0;
500 	phdr->p_flags = PF_R;
501 	phdr->p_align = sizeof(Elf32_Size);
502 	phdr++;
503 
504 	/* All the writable segments from the program. */
505 	phc.phdr = phdr;
506 	phc.offset = segoff;
507 	each_dumpable_segment(map, cb_put_phdr, &phc);
508 }
509 
510 /*
511  * Free the memory map.
512  */
513 static void
514 freemap(vm_map_entry_t map)
515 {
516 
517 	while (map != NULL) {
518 		vm_map_entry_t next = map->next;
519 		free(map);
520 		map = next;
521 	}
522 }
523 
524 /*
525  * Read the process's memory map using kinfo_getvmmap(), and return a list of
526  * VM map entries.  Only the non-device read/writable segments are
527  * returned.  The map entries in the list aren't fully filled in; only
528  * the items we need are present.
529  */
530 static vm_map_entry_t
531 readmap(pid_t pid)
532 {
533 	vm_map_entry_t ent, *linkp, map;
534 	struct kinfo_vmentry *vmentl, *kve;
535 	int i, nitems;
536 
537 	vmentl = kinfo_getvmmap(pid, &nitems);
538 	if (vmentl == NULL)
539 		err(1, "cannot retrieve mappings for %u process", pid);
540 
541 	map = NULL;
542 	linkp = &map;
543 	for (i = 0; i < nitems; i++) {
544 		kve = &vmentl[i];
545 
546 		/*
547 		 * Ignore 'malformed' segments or ones representing memory
548 		 * mapping with MAP_NOCORE on.
549 		 * If the 'full' support is disabled, just dump the most
550 		 * meaningful data segments.
551 		 */
552 		if ((kve->kve_protection & KVME_PROT_READ) == 0 ||
553 		    (kve->kve_flags & KVME_FLAG_NOCOREDUMP) != 0 ||
554 		    kve->kve_type == KVME_TYPE_DEAD ||
555 		    kve->kve_type == KVME_TYPE_UNKNOWN ||
556 		    ((pflags & PFLAGS_FULL) == 0 &&
557 		    kve->kve_type != KVME_TYPE_DEFAULT &&
558 		    kve->kve_type != KVME_TYPE_VNODE &&
559 		    kve->kve_type != KVME_TYPE_SWAP &&
560 		    kve->kve_type != KVME_TYPE_PHYS))
561 			continue;
562 
563 		ent = calloc(1, sizeof(*ent));
564 		if (ent == NULL)
565 			errx(1, "out of memory");
566 		ent->start = (vm_offset_t)kve->kve_start;
567 		ent->end = (vm_offset_t)kve->kve_end;
568 		ent->protection = VM_PROT_READ | VM_PROT_WRITE;
569 		if ((kve->kve_protection & KVME_PROT_EXEC) != 0)
570 			ent->protection |= VM_PROT_EXECUTE;
571 
572 		*linkp = ent;
573 		linkp = &ent->next;
574 	}
575 	free(vmentl);
576 	return (map);
577 }
578 
579 /*
580  * Miscellaneous note out functions.
581  */
582 
583 static void *
584 elf_note_prpsinfo(void *arg, size_t *sizep)
585 {
586 	char *cp, *end;
587 	pid_t pid;
588 	elfcore_prpsinfo_t *psinfo;
589 	struct kinfo_proc kip;
590 	size_t len;
591 	int name[4];
592 
593 	pid = *(pid_t *)arg;
594 	psinfo = calloc(1, sizeof(*psinfo));
595 	if (psinfo == NULL)
596 		errx(1, "out of memory");
597 	psinfo->pr_version = PRPSINFO_VERSION;
598 	psinfo->pr_psinfosz = sizeof(*psinfo);
599 
600 	name[0] = CTL_KERN;
601 	name[1] = KERN_PROC;
602 	name[2] = KERN_PROC_PID;
603 	name[3] = pid;
604 	len = sizeof(kip);
605 	if (sysctl(name, 4, &kip, &len, NULL, 0) == -1)
606 		err(1, "kern.proc.pid.%u", pid);
607 	if (kip.ki_pid != pid)
608 		err(1, "kern.proc.pid.%u", pid);
609 	strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname));
610 	name[2] = KERN_PROC_ARGS;
611 	len = sizeof(psinfo->pr_psargs) - 1;
612 	if (sysctl(name, 4, psinfo->pr_psargs, &len, NULL, 0) == 0 && len > 0) {
613 		cp = psinfo->pr_psargs;
614 		end = cp + len - 1;
615 		for (;;) {
616 			cp = memchr(cp, '\0', end - cp);
617 			if (cp == NULL)
618 				break;
619 			*cp = ' ';
620 		}
621 	} else
622 		strlcpy(psinfo->pr_psargs, kip.ki_comm,
623 		    sizeof(psinfo->pr_psargs));
624 	psinfo->pr_pid = pid;
625 
626 	*sizep = sizeof(*psinfo);
627 	return (psinfo);
628 }
629 
630 static void *
631 elf_note_prstatus(void *arg, size_t *sizep)
632 {
633 	lwpid_t tid;
634 	elfcore_prstatus_t *status;
635 	struct reg greg;
636 
637 	tid = *(lwpid_t *)arg;
638 	status = calloc(1, sizeof(*status));
639 	if (status == NULL)
640 		errx(1, "out of memory");
641 	status->pr_version = PRSTATUS_VERSION;
642 	status->pr_statussz = sizeof(*status);
643 	status->pr_gregsetsz = sizeof(elfcore_gregset_t);
644 	status->pr_fpregsetsz = sizeof(elfcore_fpregset_t);
645 	status->pr_osreldate = __FreeBSD_version;
646 	status->pr_pid = tid;
647 	ptrace(PT_GETREGS, tid, (void *)&greg, 0);
648 	elf_convert_gregset(&status->pr_reg, &greg);
649 
650 	*sizep = sizeof(*status);
651 	return (status);
652 }
653 
654 static void *
655 elf_note_fpregset(void *arg, size_t *sizep)
656 {
657 	lwpid_t tid;
658 	elfcore_fpregset_t *fpregset;
659 	fpregset_t fpreg;
660 
661 	tid = *(lwpid_t *)arg;
662 	fpregset = calloc(1, sizeof(*fpregset));
663 	if (fpregset == NULL)
664 		errx(1, "out of memory");
665 	ptrace(PT_GETFPREGS, tid, (void *)&fpreg, 0);
666 	elf_convert_fpregset(fpregset, &fpreg);
667 
668 	*sizep = sizeof(*fpregset);
669 	return (fpregset);
670 }
671 
672 static void *
673 elf_note_thrmisc(void *arg, size_t *sizep)
674 {
675 	lwpid_t tid;
676 	struct ptrace_lwpinfo lwpinfo;
677 	thrmisc_t *thrmisc;
678 
679 	tid = *(lwpid_t *)arg;
680 	thrmisc = calloc(1, sizeof(*thrmisc));
681 	if (thrmisc == NULL)
682 		errx(1, "out of memory");
683 	ptrace(PT_LWPINFO, tid, (void *)&lwpinfo,
684 	    sizeof(lwpinfo));
685 	memset(&thrmisc->_pad, 0, sizeof(thrmisc->_pad));
686 	strcpy(thrmisc->pr_tname, lwpinfo.pl_tdname);
687 
688 	*sizep = sizeof(*thrmisc);
689 	return (thrmisc);
690 }
691 
692 #if defined(__i386__) || defined(__amd64__)
693 static void *
694 elf_note_x86_xstate(void *arg, size_t *sizep)
695 {
696 	lwpid_t tid;
697 	char *xstate;
698 	static bool xsave_checked = false;
699 	static struct ptrace_xstate_info info;
700 
701 	tid = *(lwpid_t *)arg;
702 	if (!xsave_checked) {
703 		if (ptrace(PT_GETXSTATE_INFO, tid, (void *)&info,
704 		    sizeof(info)) != 0)
705 			info.xsave_len = 0;
706 		xsave_checked = true;
707 	}
708 	if (info.xsave_len == 0) {
709 		*sizep = 0;
710 		return (NULL);
711 	}
712 	xstate = calloc(1, info.xsave_len);
713 	ptrace(PT_GETXSTATE, tid, xstate, 0);
714 	*(uint64_t *)(xstate + X86_XSTATE_XCR0_OFFSET) = info.xsave_mask;
715 	*sizep = info.xsave_len;
716 	return (xstate);
717 }
718 #endif
719 
720 #if defined(__powerpc__)
721 static void *
722 elf_note_powerpc_vmx(void *arg, size_t *sizep)
723 {
724 	lwpid_t tid;
725 	struct vmxreg *vmx;
726 	static bool has_vmx = true;
727 	struct vmxreg info;
728 
729 	tid = *(lwpid_t *)arg;
730 	if (has_vmx) {
731 		if (ptrace(PT_GETVRREGS, tid, (void *)&info,
732 		    sizeof(info)) != 0)
733 			has_vmx = false;
734 	}
735 	if (!has_vmx) {
736 		*sizep = 0;
737 		return (NULL);
738 	}
739 	vmx = calloc(1, sizeof(*vmx));
740 	memcpy(vmx, &info, sizeof(*vmx));
741 	*sizep = sizeof(*vmx);
742 	return (vmx);
743 }
744 #endif
745 
746 static void *
747 procstat_sysctl(void *arg, int what, size_t structsz, size_t *sizep)
748 {
749 	size_t len;
750 	pid_t pid;
751 	int name[4], structsize;
752 	void *buf, *p;
753 
754 	pid = *(pid_t *)arg;
755 	structsize = structsz;
756 	name[0] = CTL_KERN;
757 	name[1] = KERN_PROC;
758 	name[2] = what;
759 	name[3] = pid;
760 	len = 0;
761 	if (sysctl(name, 4, NULL, &len, NULL, 0) == -1)
762 		err(1, "kern.proc.%d.%u", what, pid);
763 	buf = calloc(1, sizeof(structsize) + len * 4 / 3);
764 	if (buf == NULL)
765 		errx(1, "out of memory");
766 	bcopy(&structsize, buf, sizeof(structsize));
767 	p = (char *)buf + sizeof(structsize);
768 	if (sysctl(name, 4, p, &len, NULL, 0) == -1)
769 		err(1, "kern.proc.%d.%u", what, pid);
770 
771 	*sizep = sizeof(structsize) + len;
772 	return (buf);
773 }
774 
775 static void *
776 elf_note_procstat_proc(void *arg, size_t *sizep)
777 {
778 
779 	return (procstat_sysctl(arg, KERN_PROC_PID | KERN_PROC_INC_THREAD,
780 	    sizeof(struct kinfo_proc), sizep));
781 }
782 
783 static void *
784 elf_note_procstat_files(void *arg, size_t *sizep)
785 {
786 
787 	return (procstat_sysctl(arg, KERN_PROC_FILEDESC,
788 	    sizeof(struct kinfo_file), sizep));
789 }
790 
791 static void *
792 elf_note_procstat_vmmap(void *arg, size_t *sizep)
793 {
794 
795 	return (procstat_sysctl(arg, KERN_PROC_VMMAP,
796 	    sizeof(struct kinfo_vmentry), sizep));
797 }
798 
799 static void *
800 elf_note_procstat_groups(void *arg, size_t *sizep)
801 {
802 
803 	return (procstat_sysctl(arg, KERN_PROC_GROUPS, sizeof(gid_t), sizep));
804 }
805 
806 static void *
807 elf_note_procstat_umask(void *arg, size_t *sizep)
808 {
809 
810 	return (procstat_sysctl(arg, KERN_PROC_UMASK, sizeof(u_short), sizep));
811 }
812 
813 static void *
814 elf_note_procstat_osrel(void *arg, size_t *sizep)
815 {
816 
817 	return (procstat_sysctl(arg, KERN_PROC_OSREL, sizeof(int), sizep));
818 }
819 
820 static void *
821 elf_note_procstat_psstrings(void *arg, size_t *sizep)
822 {
823 
824 	return (procstat_sysctl(arg, KERN_PROC_PS_STRINGS,
825 	    sizeof(vm_offset_t), sizep));
826 }
827 
828 static void *
829 elf_note_procstat_auxv(void *arg, size_t *sizep)
830 {
831 
832 	return (procstat_sysctl(arg, KERN_PROC_AUXV,
833 	    sizeof(Elf_Auxinfo), sizep));
834 }
835 
836 static void *
837 elf_note_procstat_rlimit(void *arg, size_t *sizep)
838 {
839 	pid_t pid;
840 	size_t len;
841 	int i, name[5], structsize;
842 	void *buf, *p;
843 
844 	pid = *(pid_t *)arg;
845 	structsize = sizeof(struct rlimit) * RLIM_NLIMITS;
846 	buf = calloc(1, sizeof(structsize) + structsize);
847 	if (buf == NULL)
848 		errx(1, "out of memory");
849 	bcopy(&structsize, buf, sizeof(structsize));
850 	p = (char *)buf + sizeof(structsize);
851 	name[0] = CTL_KERN;
852 	name[1] = KERN_PROC;
853 	name[2] = KERN_PROC_RLIMIT;
854 	name[3] = pid;
855 	len = sizeof(struct rlimit);
856 	for (i = 0; i < RLIM_NLIMITS; i++) {
857 		name[4] = i;
858 		if (sysctl(name, 5, p, &len, NULL, 0) == -1)
859 			err(1, "kern.proc.rlimit.%u", pid);
860 		if (len != sizeof(struct rlimit))
861 			errx(1, "kern.proc.rlimit.%u: short read", pid);
862 		p += len;
863 	}
864 
865 	*sizep = sizeof(structsize) + structsize;
866 	return (buf);
867 }
868 
869 struct dumpers __elfN(dump) = { elf_ident, elf_coredump };
870 TEXT_SET(dumpset, __elfN(dump));
871