Dear Mr Rostedt and mr Stoyanov, thanks for your warming welcoming and for your answers. I had clearer ideas now. If possible, I would like to ask some clarifications. Once everything is clear in my mind, I will write a resume with an example for the mailing list, so it can be usefulf for future experiments. Let's suppose that I want to write some events like the "function tracer": Thanks to your explanation, I successfully communicated in the header this format. This is confirmed by: ``` dreamer@dreamer-VB:~/Desktop/mydotdat/input$ trace-cmd dump --events -i ../mytrace_v7.dat [Section 18 @ 617: "Unknown", flags 0x0, 485 bytes] [Events format, 1 systems] name: function ID: 1 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:unsigned long ip; offset:8; size:8; signed:0; field:unsigned long parent_ip; offset:16; size:8; signed:0; print fmt: " %ps <-- %ps", (void *)REC->ip, (void *)REC->parent_ip ``` Now, in my trace.dat, I want to write the real information. If you permit me, I'd like to continue this discussion with a concrete example. Let's suppose that I want to represent the following information: Event: function trace event Timestamp 9 seconds PID: 7777 Function address: 0x2266D Parent: 0x2266E I start by filling the header_event information: - Writing 900000000000 on 8 bytes (timestamp). - Writing `24`in 8 bytes (commit) --> event data for event ID are on 24 bytes, indeed: common_* are on 8 bytes, ip and parent ip on 8. - Ignoring overwrite: indeed, I already used commit. Then, I have the 4080 bytes of payload event, but I use only 24 of them, as expressed in commit. - common_type is 1, (2 bytes), because I want a function event - common_flags is 0 (1 byte) - common_preempt_count is 0 (1 byte) - common_pid is 7777 (4 bytes) - ip is 0x2266D (8 bytes) - parent_ip is 0x2266E (8 bytes) - the remaining 4096 - 24 bytes are of padding, so I can complete the 4080 bytes of data. Unfortunately, in this way, only CPU number and timestamp are correctly displayed on the frontend (kernelshark). Event is marked as "unknown" and PID is wrong. Timestamp astonishes me too: to correctly display it, I just need to write 900000000000 on 8 bytes. Trying to put "1" on time_type (5bits), 0 on delta (27 bits) and 900000000000 on array (1*4 bytes), the timestamp is not correct. Thus, I think I am doing something wrong. May you help me in correcting this example, please? Another thing that did let me with a doubt is the following one: do I need a page (4096 bytes) for an event? In other words: the 4096-24 bytes of padding to complete the 4080 bytes of "data" are mandatory to express another event? Thanks for your help, Matteo -----Original Message----- From: Steven Rostedt [mailto:rostedt@xxxxxxxxxxx] Sent: Thursday, June 16, 2022 3:04 PM To: Matteo Bertolino <matteo.bertolino@xxxxxxxxxx> Cc: linux-trace-users@xxxxxxxxxxxxxxx Subject: Re: Format of trace.dat flyrecord section OK, this is a claws-mail bug. It added the '\' in the email address when doing a reply all. -- Steve On Thu, 16 Jun 2022 09:02:37 -0400 Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > This is just a test to see if the added '\' was due to a claws-mail > bug or somehow I did it. > > -- Steve
|