[Crash-utility] [PATCH] Fix get_xtime() for kernel 6.17 and higher
On kernels 6.17 and higher, DATE is not displayed properly:
crash> sys | grep -e DATE -e REL
DATE: Wed Dec 31 18:00:00 CST 1969
RELEASE: 7.0.0-14-generic
The function get_xtime() was enhanced to support:
- kernel 6.17 ("shadow_timekeeper" moved to "tk_core")
- kernel 7.0 ("tk_core" is now "timekeeper_data[0]).
With this get_xtime() enhancement:
crash> sys | grep DATE
DATE: Mon Apr 27 09:19:50 CDT 2026
Signed-off-by: Georges Aureau <georges.aureau(a)hpe.com>
--
defs.h | 1 +
kernel.c | 19 ++++++++++++++++++-
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/defs.h b/defs.h
index a6f4372..c07b9a2 100644
--- a/defs.h
+++ b/defs.h
@@ -2290,6 +2290,7 @@ struct offset_table { /* stash of commonly-used
offsets */
long bpf_ringbuf_nr_pages;
long hrtimer_clock_base_index;
long klp_patch_list;
+ long tk_data_timekeeper;
};
struct size_table { /* stash of commonly-used sizes */
diff --git a/kernel.c b/kernel.c
index 8781d6a..d54e825 100644
--- a/kernel.c
+++ b/kernel.c
@@ -258,6 +258,7 @@ kernel_init()
MEMBER_OFFSET_INIT(timekeeper_xtime, "timekeeper", "xtime");
MEMBER_OFFSET_INIT(timekeeper_xtime_sec, "timekeeper",
"xtime_sec");
+ MEMBER_OFFSET_INIT(tk_data_timekeeper, "tk_data",
"timekeeper");
get_xtime(&kt->date);
if (CRASHDEBUG(1))
fprintf(fp, "xtime timespec.tv_sec: %lx: %s\n",
@@ -11134,7 +11135,23 @@ get_xtime(struct timespec *date)
struct syment *sp;
uint64_t xtime_sec;
- if (VALID_MEMBER(timekeeper_xtime) &&
+ if (VALID_MEMBER(tk_data_timekeeper) &&
+ VALID_MEMBER(timekeeper_xtime_sec)) {
+ long offset = OFFSET(tk_data_timekeeper) +
+ OFFSET(timekeeper_xtime_sec);
+ if ((sp = kernel_symbol_search("timekeeper_data"))) {
+ readmem(sp->value + offset, KVADDR,
+ &xtime_sec, sizeof(uint64_t),
+ "timekeeper_data xtime_sec", RETURN_ON_ERROR);
+ date->tv_sec = (__time_t)xtime_sec;
+ } else if ((sp = kernel_symbol_search("tk_core"))) {
+ readmem(sp->value + offset, KVADDR,
+ &xtime_sec, sizeof(uint64_t),
+ "tk_core xtime_sec", RETURN_ON_ERROR);
+ date->tv_sec = (__time_t)xtime_sec;
+ }
+ }
+ else if (VALID_MEMBER(timekeeper_xtime) &&
(sp = kernel_symbol_search("timekeeper"))) {
readmem(sp->value + OFFSET(timekeeper_xtime), KVADDR,
date, sizeof(struct timespec),