COREDUMPER_REGISTER(9)

💖 COREDUMPER_REGISTER(9) 💖

okay bestie, this page is from the Kernel Developer's Manual, and it's all about coredumper_register / coredumper_unregister and loadable user coredumper support. it's giving kernel-module core-dump realness, no cap 🫶

---

🌸 NAME 🌸

• coredumper_register, coredumper_unregister — loadable user coredumper support. literally the whole vibe ✨

🦋 SYNOPSIS 🦋

here's the exact code, bestie — do not freestyle this part:

#include <sys/ucoredump.h>

void
coredumper_register(struct coredumper *cd);

void
coredumper_unregister(struct coredumper *cd);

int
coredumper_probe_fn(struct thread *td);

int
coredumper_handle_fn(struct thread *td, off_t limit);

/* Incomplete, but the useful members are depicted here. */
struct coredumper {
        const char              *cd_name;
        coredumper_probe_fn     *cd_probe;
        coredumper_handle_fn    *cd_handle;
};

int
coredump_init_fn(const struct coredump_writer *,
    const struct coredump_params *);

int
coredump_write_fn(const struct coredump_writer *, const void *, size_t,
    off_t, enum uio_seg, struct ucred *, size_t *, struct thread *);

int
coredump_extend_fn(const struct coredump_writer *, off_t,
    struct ucred *);

struct coredump_writer {
        void                    *ctx;
        coredump_init_fn        *init_fn;
        coredump_write_fn       *write_fn;
        coredump_extend_fn      *extend_fn;
};

✨ DESCRIPTION ✨

okay so the coredumper_register mechanism gives kernel modules a path to register a brand-new user process core dumper. 🎀 the expected use is: a module defines the fields of the struct coredumper shown above, then calls coredumper_register() at MOD_LOAD time. then a matching coredumper_unregister() should be called at MOD_UNLOAD time. important: coredumper_unregister() will block until the specified coredumper is no longer processing coredumps. 💅

when a user process is getting ready to start dumping core, the kernel runs the cd_probe() function for every coredumper currently registered. cd_probe() is expected to return either -1 if it would decline to dump the process, or a priority level greater than 0. the coredumper with the highest priority handles the coredump. the following default priorities are defined: 👑

• COREDUMPER_NOMATCH — this dumper declines dumping the process.
• COREDUMPER_GENERIC — this dumper will dump the process at the lowest priority. this priority is not recommended, because the default vnode dumper will bid at COREDUMPER_GENERIC too. 💀
• COREDUMPER_SPECIAL — this dumper provides special behavior, and will dump the process at a higher priority.
• COREDUMPER_HIGHPRIORITY — this dumper would prefer to handle this coredump. this may be used by, for instance, a custom or vendor-specific coredump mechanism that wishes to preempt others. 🔥

note that this system has been designed so the cd_probe() function can examine the process in question and make an informed decision. different processes being dumped could probe at different priorities in the same coredumper. 🧚

once the highest-priority coredumper has been selected, the cd_handle() function gets invoked. cd_handle() receives both the thread and the RLIMIT_CORE setrlimit(2) limit. the proc lock will be held on entry, and should be unlocked before the handler returns. that limit is typically passed to the sv_coredump() that belongs to the process's p_sysent. 🫶

the cd_handle() function should return either 0 if the dump was successful, or an appropriate errno(2) otherwise. 🌈

🎀 Customized Coredump Writers 🎀

custom coredumpers can define their own coredump_writer to pass to sv_coredump(). iconic 💖

the ctx member is opaque and only to be used by the coredumper itself. 🙈

the init_fn function, if it's provided, will be called by the sv_coredump() implementation before any data is to be written. this lets the writer implementation record any coredump parameters that it might need to capture, or set up the object to be written to. ✨

the write_fn function will be called by the sv_coredump() implementation to write out data. the extend_fn function will be called to enlarge the coredump, in the sense that a hole is created in any difference between the current size and the new size. 🕳️

for convenience, the core_vn_write() and core_vn_extend() functions used by the vnode coredumper are exposed in <sys/ucordumper.h>, and the coredump_vnode_ctx defined there should be populated with the vnode to write to. 💅

👑 SEE ALSO 👑

• setrlimit(2)
• core(5)

🍓 AUTHORS 🍓

this manual page was written by Kyle Evans <kevans@FreeBSD.org>. 🫶

---

this page is from Debian, dated July 23, 2025 — mwah, and good luck out there, bestie 💋🌈