On Sat, Jan 04, 2025 at 11:38:34PM +0900, Akihiko Odaki wrote:
> elf.h had a comment saying:
> > Notes used in ET_CORE. Architectures export some of the arch register
> > sets using the corresponding note types via the PTRACE_GETREGSET and
> > PTRACE_SETREGSET requests.
> > The note name for these types is "LINUX", except NT_PRFPREG that is
> > named "CORE".
>
> However, NT_PRSTATUS is also named "CORE". It is also unclear what
> "these types" refers to.
>
> To fix these problems, define a name for each note type. The added
> definitions are macros so the kernel and userspace can directly refer to
> them.
While ELF is specified in the Tool Interface Standard[1], the core dump
format doesn't have an official specification. It does follow a lot of
agreed rules, though, and the "note name" is intended to help coredump
consumers distinguish between "common" things ("CORE") and Linux-specific
things ("LINUX").
I think this should be explicitly spelled out in the UAPI header,
even if we have "mistakes" for this mapping.
I'm not convinced we need these macros, though: everything is "LINUX"
expect the common types. And the GNU types are "GNU". There are only 7
types under the "CORE" name. :)
For the macros, I'd much prefer NN_CORE, NN_LINUX, and NN_GNU.
If you really want to be able to examine the name from the type, then
yeah, I guess we need something like the macros you have, but I'd much
prefer also adding a macro like Dave suggested[2], and then replace the
fill_note() with a macro that can unwrap it:
fill_note(note, NT_SIGINFO, size..., data...);
The repetition of NN_type, NT_type doesn't feel robust if we have a
programmatic mapping: only the "type" is needed to determine both, so
why supply both?
-Kees
[1] https://refspecs.linuxfoundation.org/elf/elf.pdf
[2] https://lore.kernel.org/lkml/Z3vuBTiQvnRvv9DQ@xxxxxxxxxxxxxxx/
--
Kees Cook
