elfcore 2.0.2

elfcore is a crate to create ELF core dumps for processes on Linux.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.

//! Aarch64 specifics for ELF core dump files.

#[cfg(target_os = "linux")]
use super::ArchComponentState;
#[cfg(target_os = "linux")]
use crate::linux::ptrace::ptrace_get_reg_set;
#[cfg(target_os = "linux")]
use crate::CoreError;
#[cfg(target_os = "linux")]
use nix::unistd::Pid;
use zerocopy::Immutable;
use zerocopy::IntoBytes;

// aarch64 machine
pub const EM_AARCH64: u16 = 183;

// aarch64 notes
pub const NT_ARM_TLS: u32 = 0x401;
pub const NT_ARM_HW_BREAK: u32 = 0x402;
pub const NT_ARM_HW_WATCH: u32 = 0x403;
pub const NT_ARM_SYSTEM_CALL: u32 = 0x404;

#[repr(C, packed)]
#[derive(Clone, Copy, Debug, IntoBytes, Immutable)]
pub struct elf_gregset_t {
    pub regs: [u64; 31],
    pub sp: u64,
    pub pc: u64,
    pub pstate: u64,
}

#[cfg(target_os = "linux")]
pub fn get_aarch64_tls(pid: Pid) -> Result<Vec<u8>, CoreError> {
    ptrace_get_reg_set(pid, NT_ARM_TLS)
}
#[cfg(target_os = "linux")]
pub fn get_aarch64_hw_break(pid: Pid) -> Result<Vec<u8>, CoreError> {
    ptrace_get_reg_set(pid, NT_ARM_HW_BREAK)
}
#[cfg(target_os = "linux")]
pub fn get_aarch64_hw_watch(pid: Pid) -> Result<Vec<u8>, CoreError> {
    ptrace_get_reg_set(pid, NT_ARM_HW_WATCH)
}
#[cfg(target_os = "linux")]
pub fn get_aarch64_system_call(pid: Pid) -> Result<Vec<u8>, CoreError> {
    ptrace_get_reg_set(pid, NT_ARM_SYSTEM_CALL)
}

#[cfg(target_os = "linux")]
pub fn get_arch_components(pid: Pid) -> Result<Vec<ArchComponentState>, CoreError> {
    let components = vec![
        ArchComponentState {
            name: "TLS",
            note_type: NT_ARM_TLS,
            note_name: b"LINUX",
            data: get_aarch64_tls(pid)?,
        },
        ArchComponentState {
            name: "HW BREAK",
            note_type: NT_ARM_HW_BREAK,
            note_name: b"LINUX",
            data: get_aarch64_hw_break(pid)?,
        },
        ArchComponentState {
            name: "HW WATCH",
            note_type: NT_ARM_HW_WATCH,
            note_name: b"LINUX",
            data: get_aarch64_hw_watch(pid)?,
        },
        ArchComponentState {
            name: "SYSCALL",
            note_type: NT_ARM_SYSTEM_CALL,
            note_name: b"LINUX",
            data: get_aarch64_system_call(pid)?,
        },
    ];

    Ok(components)
}

pub fn get_gpr_set(gpr_state: &[u64]) -> elf_gregset_t {
    elf_gregset_t {
        regs: [
            gpr_state[0],
            gpr_state[1],
            gpr_state[2],
            gpr_state[3],
            gpr_state[4],
            gpr_state[5],
            gpr_state[6],
            gpr_state[7],
            gpr_state[8],
            gpr_state[9],
            gpr_state[10],
            gpr_state[11],
            gpr_state[12],
            gpr_state[13],
            gpr_state[14],
            gpr_state[15],
            gpr_state[16],
            gpr_state[17],
            gpr_state[18],
            gpr_state[19],
            gpr_state[20],
            gpr_state[21],
            gpr_state[22],
            gpr_state[23],
            gpr_state[24],
            gpr_state[25],
            gpr_state[26],
            gpr_state[27],
            gpr_state[28],
            gpr_state[29],
            gpr_state[30],
        ],
        sp: gpr_state[31],
        pc: gpr_state[32],
        pstate: gpr_state[33],
    }
}