🚀 go-pugleaf

  41593	Re: help with unexec                          [35] Oliver Laumann      In article <1992Jul28.100513.29858@cs.tu-berlin.de>, net@cs.tu-berlin.de (Oliver Laumann) writes:
|> dnicodem@cs.ulowell.edu (David Nicodemus) writes:
|> > I am looking for a way to force a program out of execution, and save an
|> > image of the program that can be restarted from the same point at a later
|> > time. 
|> > 
|> > It appears that the gnu unexec() function from gnu emacs will do this;
|> > however, the last parameter asks for a "starting address." 
|> > 
|> > How can I find this "starting address" (which I want to be the current
|> > point of execution)?  Is this even possible?
|> 
|> I'm not sure I understand what exactly you want to accomplish.  You
|> certainly cannot *force* a program to dump its image to disk using
|> unexec(); the program must call unexec() voluntarily.

But you can. Look at gcore(1) on SunOS and SVR4. This is a ptrace(2) and
/proc -based utility which can generate a snapshot core image of a running
process. But, note that core files usually do not have a copy of the executable
text - this would have to be recovered from the original a.out, and any shared
object libraries that were loaded.

Many pieces of the process context are difficult, if not impossible to
either capture and/or reconstruct:

	- open file context, including tty
	- STREAMS context
	- mapped-file context (/proc gives you inode #, but not file name)
	- SIGNALS context (try reconstructing a process that was unexeced while it
	  was in a signal handler)
	- IPC context
|> 
|> The entry point you can supply to unexec() is the address where the
|> a.out file produced by unexec() will start when it is invoked later.
|> Every a.out file has an entry point; it's part of the a.out header.
|> 
|> Anyway, when using unexec(), you cannot have the newly created a.out
|> file resume execution at the point where the original invocation saved
|> its image.  To be able to do this, unexec() would have to save not only
|> the text and data segment of the running program, but also the entire
|> execution state (stack and registers).
|> 

True, unexec would have to restore the execution state. Data, stack and registers
can be recovered from the core file. Text must be recovered from the original
a.out and any associated shared libraries. The entry point for the new 
executable image could be a strip of code which performs

	- reloading of the registers, old pc last. Restoring privileged bits
	  in whatever your psw is could be tricky or downright impossible.
	- re-establishment of the prior stack context - restoring the sp is
	  not nearly enough!
	- resetting the brk value. The initial break value can be determined by
	  summing the .data and .bss-like sections of the a.out


-- 
--------------------------------------------------------------------------------
-- Doug Gibbons			| ldg@druhi.ATT.COM or att!druhi!ldg
-- AT&T Bell Laboratories 
-- Denver CO