title: Fork and core dump with threads
body: <p>Similar points to the one in this question have been raised before <a href="https://stackoverflow.com/q/131439/596781">here</a> and <a href="https://stackoverflow.com/q/979141/596781">here</a>, and I'm aware of the Google coredump library (which I've appraised and found lacking, though I might try and work on that if I understand the problem better).</p>
  
  <p>I want to obtain a core dump of a running Linux process without interrupting the process. The natural approach is to say:</p>
  
  <pre><code>if (!fork()) { abort(); }
  </code></pre>
  
  <p>Since the forked process gets a fixed snapshot copy of the original process's memory, I should get a complete core dump, and since the copy uses copy-on-write, it should generally be cheap. However, a critical shortcoming of this approach is that <code>fork()</code> only forks the current thread, and all other threads of the original process won't exist in the forked copy.</p>
  
  <p>My question is whether it is possible to somehow obtain the relevant data of the other, original threads. I'm not entirely sure how to approach this problem, but here are a couple of sub-questions I've come up with:</p>
  
  <ol>
  <li><p>Is the memory that contains all of the threads' stacks still available and accessible in the forked process?</p></li>
  <li><p>Is it possible to (quicky) enumerate all the running threads in the original process and store the addresses of the bases of their stacks? As I understand it, the base of a thread stack on Linux contains a pointer to the kernel's thread bookkeeping data, so...</p></li>
  <li><p>with the stored thread base addresses, could you read out the relevant data for each of the original threads in the forked process?</p></li>
  </ol>
  
  <p>If that is possible, perhaps it would only be a matter of appending the data of the other threads to the core dump. However, if that data is lost at the point of the fork already, then there doesn't seem to be any hope for this approach.</p>