Re: [RFC PATCH] Add a new 'info proc time' subcommand of 'info proc'.

[Rustam Kovhaev via Gdb-patches <gdb-patches@sourceware.org>]

Hi John,

On Wed, Jul 28, 2021 at 08:00:28AM -0700, John Baldwin wrote:
> On 7/27/21 3:08 PM, Rustam Kovhaev via Gdb-patches wrote:
> > Sometimes (unfortunately) I have to review windows user-space cores in
> > windbg, and there is one feature that I really want to implement in gdb,
> > but I don't know whether it is a good idea or not, and why it has not
> > yet been implemented in gdb.
> > 
> > In wdbg there is a .time command that gives me time when core was taken.
> > I could not find the same functionality in gdb and in elf core.
> > I know about kernel core_pattern and timestamp, and there are user-space
> > daemons that write the timestamp, and sometimes if I am lucky I can get
> > timestamp from modified/created file attributes and this solves the
> > problem most of the time, but quite often I get only core.PID file +
> > some app log and there is no way for me to figure out when exactly the
> > core was taken.
> > 
> > Current patch does not take into account lots of things like endianness,
> > cpu archs other than x86, other code paths, etc, and there is also
> > kernel side to modify and coordinate, but it does work in my lab, and I
> > was pretty happy to learn a little bit about the project.
> 
> Does the Linux kernel write out NT_TIME notes when creating core dumps
> or would this command only work on cores generated by a patched gdb's
> 'gcore' command?

It does not. Linux kernel will need to be patched too, but before
sending a kernel RFC patch I wanted to run this proposal by gdb
mainteners.