tree: fba6bb03b10f0afaa455a69eb285886b811d321e [path history] [tgz]
  5. decoder.h
  7. third_party/

Intel Processor Trace Decoder

This library is used to read Intel Processor Trace files.

Notes on the implementation

Several pieces are needed to properly interpret IPT traces. The trace format is highly condensed, relying on offline access to the code that was running. IPT can be used in a way to only trace a particular program, or even particular threads. But when doing full system tracing the decoder needs access to all the binaries. The traces record cr3 values to allow the decoder to know what program the trace is for. Part of the complexity is from needing to take random cr3 values and mapping them to the ELF. The Fuchsia build system creates “ids.txt” files that map build ids to the ELF. On top of that the dynamic linker has a tracing mode that can print build ids for each loaded ELF (binary or shared library), and where in the address space they were loaded. But the dynamic linker only knows a program by its pid. The final piece is to have the kernel emit cr3->pid mappings, which is done via ktrace. With this information we can then take any cr3 value and any pc value within that address space, and find the associated ELF.