Dear community, My problem was a bad understanding of the `type_len` field of the event header. You can ignore this mail, sorry. Bests, Matteo -----Original Message----- From: Matteo Bertolino Sent: Tuesday, August 30, 2022 11:20 AM To: 'linux-trace-users@xxxxxxxxxxxxxxx' <linux-trace-users@xxxxxxxxxxxxxxx> Subject: `fungraph_entry` and `funcgraph_exit` entries: is there a mismatch between trace-cmd and the format of debugfs? Dear Community, I would like to share with you something interesting came out from one of my tests. I am manually writing a binary trace composed of `funcgraph_entry` and `funcgraph_exit` entries: This is an example: CPU0: Task A entry ------- Task B entry ------- Task B exit ------- Task A exit. After writing the trace, I display it with Kernelshark. Both entries and exit give me problems. Let's start with the entry. I gave to the section 17 of the trace.dat the following file: ```` name: funcgraph_entry ID: 11 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:unsigned long func; offset:8; size:8; signed:0; field:int depth; offset:16; size:4; signed:1; print fmt: "--> %ps (%d)", (void *)REC->func, REC->depth ```` So, in the trace, after the event header, I write 2 bytes for the ID (11 in this case), 1 for the flags, and so and so, until the last one: 4 bytes for depth. The problem arrives there: if I don't write 4 additional bytes on field `depth` (or 4 additional bytes of padding), the next entry is not displayed on Kernelshark, which shows an [UNKNOWN EVENT[. A little hypothesis: I noticed that `fgraph_ent_handler()` function on `trace-ftrace.c` calls `print_graph_nested()`. The latter declares `depth` as `unsigned long long depth;` , namely on 8 bytes instead of the declared 4. If I modify the file in this way (below) and, for each `funcgraph_entry` entry, I write the depth 8 bytes instead of 4, everything is ok: ```` name: funcgraph_entry ID: 11 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:unsigned long func; offset:8; size:8; signed:0; field:int depth; offset:16; size:8; signed:1; print fmt: "--> %ps (%d)", (void *)REC->func, REC->depth ```` Now, unfortunately, I have the same problem with `funcgraph_exit` entries, but this this I cannot find a workaround. The first `funcgraph_exit` entry that I write is perfectly displayed on Kernelshark, but everything subsequent to it is broken. Example of `funcgraph_exit` entry: 4 bytes of TS delta 2 bytes for the ID (11) 1 byte for common_flags, I don't use this field, so I wrote the value 0. 1 byte for common_preempt_count, I don't use this field, so I wrote the value 0. 4 bytes of PID 8 bytes of func field 4 bytes of depth (here, I left this on 4 bytes) 4 bytes of overrun, I don't use this field, so I wrote value 0. 8 bytes for calltime 8 bytes for rettime. My questions are: 1- Do you think that my fix for `funcgraph_entry` entry's depth value is correct? 2- If so, can we have a double check on the `funcgraph_exit` entry as well? Cheers, Matteo
|