Add ELF Symbol Resolution for Linux .nettrace Traces by brianrob · Pull Request #2397 · microsoft/perfview

brianrob · 2026-03-25T00:08:25Z

Summary

Wires up end-to-end ELF debug symbol resolution so PerfView can symbolize native Linux modules (e.g. libcoreclr.so) in .nettrace traces. This builds on the previous PR that added ELF symbol parsing by integrating it into the TraceEvent symbol resolution pipeline, introducing a type hierarchy to cleanly separate PE and ELF module metadata, and aligning all three symbol formats (PDB, R2R, ELF) to follow a consistent Find→Matches→Open pattern.

During integration, an RVA computation bug was discovered and fixed: the ELF symbol lookup did not account for the Linux loader's page-alignment of the executable PT_LOAD segment, producing incorrect symbols when p_vaddr ≠ p_offset (as in libcoreclr.so).

Changes

Commit 1: ELF Symbol Resolution with SymbolInfo Type Hierarchy

Introduce TraceModuleFileSymbolInfo hierarchy (PESymbolInfo, ElfSymbolInfo) to separate Windows PE and Linux ELF module metadata
Migrate existing PDB/R2R fields from TraceModuleFile into PESymbolInfo; add MatchOrInitPE/MatchOrInitELF for type-safe access
Fix RVA computation: use page-aligned p_vaddr with SystemPageSize from trace headers
Add ReadBuildId, FindElfSymbolFilePath (with SSQP symbol server), ElfBuildIdMatches, OpenElfSymbolFile
Update LookupSymbolsForModule to dispatch by ModuleBinaryFormat

Commit 2: Align R2R and ELF with PDB Find→Matches→Open Pattern

Add R2RPerfMapMatches and ElfBuildIdMatches mirroring PdbMatches
Move validation into Matches classes; simplify Open methods and TraceLog callers
Add lightweight R2R header probe to avoid double-parsing

Commit 3: Read `.gnu_debuglink` from ELF Binaries

Add ReadDebugLink to parse the .gnu_debuglink section for the actual debug file name
Update FindElfSymbolFilePath to probe debuglink paths (same dir, .debug/ subdir) instead of only guessing suffixes

Commit 4: Harden ElfSymbolModule

Hoist 20+ magic numbers to named constants
Cap PT_NOTE allocation at 64KB to prevent OOM from crafted ELF
Add overflow guard in ExtractBuildId alignment arithmetic
Thread-safe lazy name resolution (Volatile.Read/Interlocked.CompareExchange)
ThreadLocal<T> demanglers for concurrent FindNameForRva

Unit Testing

93 tests across ElfSymbolModuleTests (48) and SymbolReaderTests (45), covering:

ELF parsing (32/64-bit, LE/BE, error handling, symbol lookup)
ReadBuildId and ReadDebugLink (valid, corrupt, stripped binaries)
MatchOrInit type safety assertions
FindElfSymbolFilePath (local, SSQP, debuglink, cache behavior)
R2R and PDB Find/Matches/Open paths

All tests pass on both net8.0 and net462.

Real-World Symbol Testing

100% pass rate for symbol file parsing across x64 and arm64 covering a random assortment of distro-hosted symbol files (500+ per distro per architecture) and all .NET SDKs.

Linux Distro Datasets

Dataset	Files	Symbols
Alpine (x64)	551	115,261
Alpine (arm64)	555	114,778
CentOS (x64)	550	219,067
CentOS (arm64)	550	137,407
Debian (x64)	541	12,716
Debian (arm64)	541	12,980
Debian (i386)	541	11,833
Fedora (x64)	500	5,807
Fedora (arm64)	500	4,967
openSUSE (x64)	550	13,378
openSUSE (arm64)	550	16,594
Ubuntu (x64)	568	109,293

Total: 6,497 files, 774,081 symbols

.NET Version Datasets

Dataset	Versions
.NET 8 (x64)	25
.NET 8 (arm64)	25
.NET 9 (x64)	15
.NET 9 (arm64)	15
.NET 10 (x64)	6
.NET 10 (arm64)	6

Fixes #2382

Introduce a TraceModuleFileSymbolInfo type hierarchy (PESymbolInfo, ElfSymbolInfo) to cleanly separate Windows PE and Linux ELF module metadata. Migrate existing PDB and R2R fields from TraceModuleFile into PESymbolInfo with MatchOrInit pattern for type-safe access. Add end-to-end ELF symbol resolution: - ElfSymbolModule: add ReadBuildId, fix RVA computation using page-aligned p_vaddr with SystemPageSize from trace headers - SymbolReader: add FindElfSymbolFilePath with SSQP symbol server support, ElfBuildIdMatches for build-id validation, OpenElfSymbolFile - TraceLog: add OpenElfSymbolsForModuleFile, update LookupSymbolsForModule to dispatch by ModuleBinaryFormat - Populate ELF metadata (BuildId, VirtualAddress, FileOffset, PageSize) from trace events Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Refactor symbol resolution so all three formats (PDB, R2R, ELF) follow the same Find -> Matches -> Open pipeline: - Add R2RPerfMapMatches and ElfBuildIdMatches mirroring PdbMatches - Move validation from Open methods into Matches classes - Add lightweight R2R header probe to avoid double-parsing - Make CheckSecurity private (only used internally) - Simplify TraceLog callers (fallback logic now in Find methods) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add ReadDebugLink static method to ElfSymbolModule that parses ELF section headers to find the .gnu_debuglink section and extract the debug file name. Update FindElfSymbolFilePath to use debuglink-based probing (same directory and .debug/ subdirectory) instead of only trying hardcoded suffixes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Hoist 20+ magic numbers to named constants for all ELF struct field offsets, sizes, and limits - Cap PT_NOTE allocation at 64KB (MaxNoteSizeBytes) to prevent OOM - Add overflow guard in ExtractBuildId note alignment arithmetic - Make FindNameForRva thread-safe: parallel string[] with Volatile.Read/Interlocked.CompareExchange for lazy name cache - Use ThreadLocal<T> for demanglers (mutable parser state) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The binary itself (which typically only has .dynsym exported symbols) was being tried as a fallback before consulting symbol servers that could provide proper debug symbol files (with .symtab full symbols). Restructure the search into three ordered phases: Phase 1: Local debug files adjacent to binary (.debug, .dbg, debuglink) Phase 2: Symbol servers and symbol path directories Phase 3: Binary itself as absolute last resort This ensures we prefer debug symbols from symbol servers over the stripped binary whenever they are available. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

leculver

I think this style of reading structs is a bit hard to reason about and understand when there are bugs and issues. Parsing fields by calculating offsets feels error prone or at least hard to follow/reason about.

What would you think of modifying this to define copies of structs with the right layout, then simply reading those structs? Something similar to:

https://github.com/microsoft/clrmd/blob/main/src/Microsoft.Diagnostics.Runtime/Linux/Structs/ElfHeader64.cs
https://github.com/microsoft/clrmd/blob/main/src/Microsoft.Diagnostics.Runtime/Linux/ElfProgramHeader.cs#L54

Replace manual offset constants and ReadUXX helpers with [StructLayout(Sequential, Pack=1)] structs matching the ELF binary format. Use MemoryMarshal.Read<T> to read structs from byte arrays, following the same pattern as PEFile.cs. Each struct has a SwapEndian() method for big-endian support via BinaryPrimitives.ReverseEndianness. This eliminates ~35 offset constants, 8 ReadUXX helper methods, and collapses 4 symbol parsing branches into 2. Structs defined: Elf32/64_Ehdr, Elf32/64_Phdr, Elf32/64_Shdr, Elf32/64_Sym, Elf_Nhdr. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…lpers - Add IElfStruct interface implemented by all 9 ELF structs - ReadStruct<T> now accepts bigEndian param and calls SwapEndian() internally, eliminating ~15 caller-side endian checks - Add TryReadElfHeader helper consolidating ELF header validation and field extraction duplicated across ReadBuildId, ReadDebugLink, and ParseElf - Add ReadProgramHeader and ReadSymbolEntry helpers parallel to existing ReadSectionHeader - Extend ReadSectionHeader with sh_name output; replace inline Shdr extraction in ReadDebugLink and ParseElf extended section count - Net reduction of ~40 lines with significantly less code duplication Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brianrob · 2026-03-27T17:55:38Z

I think this style of reading structs is a bit hard to reason about and understand when there are bugs and issues. Parsing fields by calculating offsets feels error prone or at least hard to follow/reason about.

What would you think of modifying this to define copies of structs with the right layout, then simply reading those structs? Something similar to:

https://github.com/microsoft/clrmd/blob/main/src/Microsoft.Diagnostics.Runtime/Linux/Structs/ElfHeader64.cs https://github.com/microsoft/clrmd/blob/main/src/Microsoft.Diagnostics.Runtime/Linux/ElfProgramHeader.cs#L54

Thanks for this feedback @leculver. I'm on-board for this kind of change. Please see the latest commits.

leculver

Some minor feedback here.

leculver · 2026-03-27T18:46:11Z

+                            // ELF RVA = (address - ImageBase) + FileOffset, matching ElfSymbolModule's
+                            // (st_value - pVaddr) + pOffset formula.
+                            ulong fileOffset = moduleFile.ElfInfo.FileOffset;
+                            computeRva = (address) => (uint)(address - moduleFile.ImageBase) + (uint)fileOffset;


Need to check for overflow of uint here. Either for bad or malicious input.

leculver · 2026-03-27T18:49:16Z

+                    if (string.IsNullOrEmpty(expectedBuildId))
+                    {
+                        m_log.WriteLine("FindElfSymbolFilePath: No expected build-id provided, assuming unsafe match for {0}", filePath);
+                        return true;


What happens if this binary actually doesn't match? Do we have any way to know that "this trace came from my local computer" vs "this trace is from another computer"? If so we could be smarter in whether we return true or false here. Because the default case when moving a nettrace file to a new machine is that we should have returned false for not matching.

This is a bug. It should be false. If we need to handle cases where binaries don't have buildids, then we'll likely want to add an option similiar to /UnsafePDBMatch which allows the user to override the check. Thanks for catching this.

leculver · 2026-03-27T18:51:23Z

+        /// <param name="fileName">The simple filename of the ELF module (e.g., "libcoreclr.so")</param>
+        /// <param name="buildId">The GNU build-id as a lowercase hex string</param>
+        /// <returns>The local file path to the downloaded symbol file, or null if not found.</returns>
+        public string FindElfSymbolFilePath(string fileName, string buildId, string elfFilePath = null)


We unconditionally use buildId.ToLowerInvariant(). We need to either:

if (buildId is null) throw new ArgumentNullException(...);

Or below, buildId?.ToLowerInvariant();.

(Actually, all of this code needs to be updated to be nullable someday. That might be a good job for copilot cli with a ralph loop. These issues would be clearer.)

leculver · 2026-03-27T18:52:21Z

+        // Used as the key to the m_elfPathCache.
+        private struct ElfBuildIdSignature : IEquatable<ElfBuildIdSignature>
+        {
+            public override int GetHashCode() { return FileName.GetHashCode() + BuildId.GetHashCode(); }


Use HashCode.Combine

…h, HashCode.Combine - TraceLog.cs: Wrap RVA computation in checked context for uint overflow - SymbolReader.cs: Add null guard for buildId parameter - SymbolReader.cs: Return false when no expected build-id (safer default) - SymbolReader.cs: Use HashCode.Combine for ElfBuildIdSignature/ElfModuleSignature - Add Microsoft.Bcl.HashCode NuGet package with PerfView DLL embedding Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brianrob · 2026-03-27T23:39:41Z

Thanks @leculver. Feedback should be addressed now.

Updated [Microsoft.Diagnostics.Tracing.TraceEvent](https://github.com/Microsoft/perfview) from 3.1.16 to 3.2.4. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Diagnostics.Tracing.TraceEvent's releases](https://github.com/Microsoft/perfview/releases)._ ## 3.2.4 ## Security This release contains security hardening fixes for a number of malformed-input parsing and path-traversal vulnerabilities: - Bounds-checking for malformed event payloads in the BPerf ULZ777 decompressor and event-record parser - Bounds-checking for malformed metadata in the GCDynamic, RegisteredTraceEventParser (TDH), Dynamic, and EventPipe V3 parsers - Bounds-checking for malformed PE CodeView and Resource directory entries - Path containment hardening for PDB extraction (zipped ETL + container PDBs), DiagSession resource extraction, R2R perf map writes, PdbScope module paths, and dynamic manifest writes - Path-traversal and command-execution hardening for Source Server lookups ## What's Changed * Update CsWin32 Package Version by @brianrob in microsoft/perfview#2425 * Fix incorrect field offsets when parsing ETW events with fixed-count array fields by @Copilot in microsoft/perfview#2427 * Retarget Native Profiler Builds To VS 2026 V145 Toolset by @brianrob in microsoft/perfview#2428 * Stabilize XamlMessageBox UI-thread dispatch test by @brianrob in microsoft/perfview#2430 **Full Changelog**: microsoft/perfview@v3.2.3...v3.2.4 ## 3.2.3 ## What's Changed * Upgrade Microsoft.Windows.CsWin32 to 0.3.209 (GHSA-ghhp-997w-qr28) by @Copilot in microsoft/perfview#2409 * Enable Spectre mitigations and linker optimizations for EtwClrProfiler by @danmoseley in microsoft/perfview#2410 * Fix 'unhanded' / 'occured' typos in UnhandledExceptionDialog body text by @SAY-5 in microsoft/perfview#2413 * Fix GCStats failures on dotnet trace gc-verbose collections (#2414) by @cincuranet in microsoft/perfview#2415 * C entrypoint fixes by @zachcmadsen in microsoft/perfview#2421 ## New Contributors * @SAY-5 made their first contribution in microsoft/perfview#2413 **Full Changelog**: microsoft/perfview@v3.2.2...v3.2.3 ## 3.2.2 ## What's Changed * Fix PDB Symbol Resolution for Unmerged Windows Traces by @brianrob in microsoft/perfview#2407 **Full Changelog**: microsoft/perfview@v3.2.1...v3.2.2 ## 3.2.1 ## Native and R2R Symbol Download and Parsing Now Available As of this release, if you capture a trace using [`dotnet-trace collect-linux`](https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace#dotnet-trace-collect-linux) or [`record-trace`](https://github.com/microsoft/one-collect/tree/main/record-trace), **native and R2R symbols can now be downloaded and resolved at analysis time**. All .NET symbols (both native and R2R) are available on the Microsoft Symbol Server. Additionally, many Azure Linux symbol files are available on the Microsoft Symbol Server. For those targeting other distros, PerfView and TraceEvent are capable of pulling those symbol files from local directories by adding a local symbol path pointing to the files. Most of the work for this was completed in PerfView and TraceEvent 3.2.1 with the final required fixes present in this release. ## What's Changed * Optimize nettrace-to-TraceLog Conversion by @brianrob in microsoft/perfview#2403 * Embed missing System.Text.Json transitive dependencies in PerfView by @brianrob in microsoft/perfview#2404 **Full Changelog**: microsoft/perfview@v3.2.0...v3.2.1 ## 3.2.0 ## What's Changed * Fix Debug.Assert failures in SpeedScope tests and DynamicTraceEventParser by @brianrob in microsoft/perfview#2368 * Add TraceParserGen.Tests project and fix code generation bugs by @Copilot in microsoft/perfview#2308 * Update UsersGuide.htm by @AftabAnsari10662 in microsoft/perfview#2370 * Strip .il and .ni suffixes from TraceModuleFile.Name by @leculver in microsoft/perfview#2364 * Handle provider names that start with a numeric digit. by @brianrob in microsoft/perfview#2369 * Dispose WebView2 controls before Environment.Exit to prevent finalizer crash by @brianrob in microsoft/perfview#2371 * Refactor GetManifestForRegisteredProvider to use XmlWriter by @Copilot in microsoft/perfview#2353 * docs: Add investigation guidance for JIT-inlined missing stack frames by @Copilot in microsoft/perfview#2377 * Fix spurious BROKEN frame at top of Linux thread stacks in CPU Stacks viewer by @Copilot in microsoft/perfview#2375 * Fix NRE in AddUniversalDynamicSymbol for invalid symbol address ranges by @brianrob in microsoft/perfview#2376 * Add missing authority parameter to log by @hoyosjs in microsoft/perfview#2379 * Replace individual code owners with microsoft/perfview-reviewers group by @brianrob in microsoft/perfview#2381 * Fix Dynamic Symbol Resolution for Mappings Shared Across Multiple Processes in Universal Traces by @brianrob in microsoft/perfview#2380 * Implement Symbol Demanglers for Linux Binaries by @brianrob in microsoft/perfview#2383 * Fix NullReferenceException race condition in TraceLog.AllocLookup/FreeLookup by @Copilot in microsoft/perfview#2387 * Add typed schema for AllocationSampled (EventID 303, .NET 10+) in ClrTraceEventParser by @Copilot in microsoft/perfview#2388 * Add ElfSymbolModule for Parsing ELF Symbol Tables by @brianrob in microsoft/perfview#2384 * Update BDN to latest version. by @cincuranet in microsoft/perfview#2389 * Fixed overflow when working with large dumps by @remilema in microsoft/perfview#2399 * Fix XamlMessageBox STA Threading Crash from Background Threads by @brianrob in microsoft/perfview#2400 * Add ELF Symbol Resolution for Linux .nettrace Traces by @brianrob in microsoft/perfview#2397 * Add Missing WCF Event Templates by @brianrob in microsoft/perfview#2390 ## New Contributors * @AftabAnsari10662 made their first contribution in microsoft/perfview#2370 * @remilema made their first contribution in microsoft/perfview#2399 **Full Changelog**: microsoft/perfview@v3.1.30...v3.2.0 ## 3.1.30 ## What's Changed * doc: fix typos by @chinwobble in microsoft/perfview#2359 * Fix SourceLink parsing to support both wildcard and exact path mappings by @ivberg in microsoft/perfview#2355 * add horizontal scrolling to eventviewer by @logangeorge01 in microsoft/perfview#2361 * Add SHA-384 and SHA-512 hash algorithm support for PDB checksums by @Copilot in microsoft/perfview#2366 ## New Contributors * @chinwobble made their first contribution in microsoft/perfview#2359 * @logangeorge01 made their first contribution in microsoft/perfview#2361 **Full Changelog**: microsoft/perfview@v3.1.29...v3.1.30 ## 3.1.29 ## What's Changed * Warn users when circular buffer overflow causes missing type info in allocation views for selected processes by @Copilot in microsoft/perfview#2326 * Special-Case BitMask Parsing by @brianrob in microsoft/perfview#2327 * Refactor PEFile and PEHeader to use ReadOnlySpan exclusively with zero-copy buffer sharing by @Copilot in microsoft/perfview#2317 * Fix cdbstack parser dropping last sample and missing metrics by @Copilot in microsoft/perfview#2329 * Fix unhandled ArgumentOutOfRangeException when exporting FlameGraph with unrendered canvas by @Copilot in microsoft/perfview#2339 * Add guidance for capturing ETW traces in Kubernetes pods by @Copilot in microsoft/perfview#2344 * Fix merge command line order in kubernetes documentation by @Copilot in microsoft/perfview#2346 * Fix GetRegisteredOrEnabledProviders() documentation claiming list is small by @Copilot in microsoft/perfview#2348 * Fix duplicate stringTable elements in instrumentation manifest by @Copilot in microsoft/perfview#2347 * Fix Histogram.AddMetric losing values after single-bucket to array transition by @Copilot in microsoft/perfview#2337 * Fix clipboard copy formatting based on selection dimensions in Stack Viewer by @Copilot in microsoft/perfview#2332 * Fix XML escaping in GetManifestForRegisteredProvider by @Copilot in microsoft/perfview#2351 * Fix race condition in ProviderNameToGuid causing ERROR_INSUFFICIENT_BUFFER crashes by @Copilot in microsoft/perfview#2357 **Full Changelog**: microsoft/perfview@v3.1.28...v3.1.29 ## 3.1.28 ## What's Changed * Add support for Boolean8 to NetTrace V6. by @noahfalk in microsoft/perfview#2318 * Implement A Thread Time View for Universal Traces by @brianrob in microsoft/perfview#2320 * Remove Incorrect Argument Description by @brianrob in microsoft/perfview#2323 **Full Changelog**: microsoft/perfview@v3.1.26...v3.1.28 ## 3.1.26 Roll-up through 2025/10/10. * Only dispose non-null handles in `ETWTraceEventSource` [#2291](microsoft/perfview#2291) * Small cleanup in `NettraceUniversalConverter` [#2292](microsoft/perfview#2292) * Fix hyperlink focus visibility in dark mode and improve keyboard navigation [#2295](microsoft/perfview#2295) * Gracefully handle invalid characters in `PATH` [#2296](microsoft/perfview#2296) * Fix copying First/Last columns with pipe symbols to work in time range input [#2304](microsoft/perfview#2304) ## 3.1.24 Roll-up through 2025/08/26. * Implement NuGet Central Package Version Management [#2262] * Fix broken stacks warning for universal traces [#2268] * Fix jitted code symbols in universal traces to show assembly names instead of memfd:doublemapper [#2269] * Use themed background brush for menu and filter [#2272] * Improve rendering and dark mode [#2274] * Implement configurable symbol server authentication with /SymbolsAuth command line argument for PerfView and HeapDump [#2278] * Add a themed dialog [#2276] * Fix regression: "Goto Item in Callers/Callees" now accumulates across all threads [#2284] * Fix parsing issues and add support for additional events to the Linux perf text file parser [#2286] * Fix TraceLog live session RelatedActivityID/ContainerID corruption by preserving ExtendedData [#2285] * NetTrace LabelList metadata overrides and metadata flushing [#2281] * Fix NullReferenceException in ProviderBrowser.LevelSelected when deselecting level [#2289] ## 3.1.23 Roll-up through 2025/07/11. - Fixed TraceEvent CaptureState API to support previously unsupported keyword configurations. [#2222] - Added Exception Stacks view for .nettrace files to enhance exception diagnostics. [#2223] - Corrected outdated documentation references to "GC Heap Alloc Stacks". [#2224] - Fixed off-by-one error in P/Invoke buffer handling for Windows volume events. [#2227] - Fixed broken links in the PerfView user guide. [#2225] - Improved error handling by throwing when TdhEnumerateProviders fails, enabling better diagnostics. [#2177] - Added AutomationProperties.Name to the Process Selection DataGrid for improved accessibility. [#2239] - Fixed focus indicator visibility for hyperlinks in dark mode and high contrast themes. [#2235] - Addressed NullReferenceException in Anti-Malware view. [#2233] - Fixed WebView2 crash on close by implementing proper disposal pattern. [#2230] - Added support for native AOT gcdumps, expanding compatibility with modern .NET workloads. [#2242] - Fixed NVDA screen reader issue where Theme menu items did not announce selection state. [#2237] - Extended PredefinedDynamicTraceEventParser to support dynamic events from additional sources. [#2232] - Implemented MSFZ symbol format support in SymbolReader. [#2244] - Removed usage of DefaultAzureCredential, simplifying authentication dependencies. [#2255] - Added option to hide TimeStamp columns in the EventWindow View menu. [#2247] - Fixed NVDA screen reader reporting incorrect list count for File menu separators. [#2257] - Fixed unhandled exception when double-clicking in scroll bar area with no content. [#2254] - Fixed universal symbol conversion for overlapping mappings. [#2252] - Fixed TraceEvent.props to respect ProcessorArchitecture when RuntimeIdentifier is set. [#2249] ## 3.1.22 Roll-up through 2025/06/04. - Added GC Heap Analyzer support for .nettrace files to enhance memory analysis workflows. [#2216] - Introduced PredefinedDynamicTraceEventParser for known TraceLogging events, improving trace event parsing. [#2220] - Enabled selection of process trees in the process selection dialog for multi-process analysis, allowing deeper inspection across related processes. [#2195] - Implemented sorting for the Duration column in the process selection dialog using TotalDurationSeconds, improving usability. [#2194] - Improved NetTrace parameter parsing for better command-line flexibility. [#2200] - Fixed GetActiveSessionNames to handle ERROR_MORE_DATA, resolving session enumeration issues. [#2196] - Fixed ObjectDisposedException when opening Net OS Heap Alloc Stacks, improving stability. [#2212] - Fixed null reference exception in GenFragmentationPercent method, enhancing reliability. [#2211] - Fixed TreeView auto-expansion when opening trace files. [#2218] - Fixed StackViewer issue where "Set Time Range" reset "Goto Items by callees". [#2208] - Fixed markdown table formatting when copying from the stack viewer. [#2203] - Fixed TraceEvent NuGet package to exclude Windows-specific native DLLs. [#2215] - Removed PDB generation for .NET Core assemblies using CrossGen, reducing build overhead. [#2202] - Made symbol server timeout configurable and removed dead code in SymbolReader. [#2209] - Changed help ribbons to use textblocks, enabling tab navigation. [#2201] ## 3.1.21 Roll-up through 2025/05/02. - Change NetTrace format version support - Add /OSHeapMaxMB to set a max size for OS heap sessions - Implement Nettrace Support for Traces with Universal Providers - Implement R2R Symbol Lookup for Linux Traces - Fix NetTrace parsing for Start/Stop event names - Fix IndexOutOfRangeException in ProcessGlobalHistory ## 3.1.20 Roll-up through 2025/04/01. - Flamegraph and drill-in menu improvements - Performance improvements around unhandled event dispatch - Add configurable real-time delay in TraceLogEventSource - Don't queue another flush during a real-time ETW session if one is already in-process - Allow configuration of rundown providers for real-time EventPipe sessions - Fix stack handling for NetTrace V4 - Add multi-line view for events viewer - Misc accessibility fixes ## 3.1.19 Roll-up through 2025/01/30. - Added missing time information in the Raw XML View for GCStats. - Updated activity computation logic to support OpenTelemetry events. - Changed timestamp values to use QPC time based on UTC for Relogger. - Fixed issues with report command handling. - Addressed various POH-related issues. - Implemented file-size limitation for rundown using an ETW-based approach. ## 3.1.18 Roll-up through 2024/12/11. - Fixed `perfcollect` install script on Azure Linux 3. - Updated `System.Text.Json` to address dotnet/announcements#329. ## 3.1.17 Roll-up through 2024/11/08. - Numerous accessibility fixes to PerfView. This includes switching out the previous web browser plugin to use WebView2. - Breaking changes to FastSerialization to ensure that only expected types are deserialized. This addresses potential vulnerabilities during deserialization of untrusted input. Details at microsoft/perfview#2121. Commits viewable in [compare view](microsoft/perfview@v3.1.16...v3.2.4). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

brianrob and others added 5 commits March 24, 2026 16:59

brianrob marked this pull request as ready for review March 26, 2026 22:33

brianrob requested a review from a team as a code owner March 26, 2026 22:33

leculver reviewed Mar 27, 2026

View reviewed changes

brianrob and others added 2 commits March 27, 2026 08:11

leculver requested changes Mar 27, 2026

View reviewed changes

brianrob and others added 3 commits March 27, 2026 16:33

Update Microsoft.Bcl.HashCode to version 6.0.0

3169b42

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add null check for fileName in FindElfSymbolFilePath

1cdfc02

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brianrob force-pushed the brianrob/elf-symbols-squashed branch from 10d3cbf to 1cdfc02 Compare March 27, 2026 23:38

brianrob mentioned this pull request Mar 27, 2026

Add ELF symbol metadata to TraceModuleFile #2372

Closed

leculver approved these changes Mar 30, 2026

View reviewed changes

brianrob merged commit fec1368 into microsoft:main Mar 30, 2026
5 checks passed

brianrob deleted the brianrob/elf-symbols-squashed branch March 30, 2026 16:39

github-actions Bot mentioned this pull request Mar 31, 2026

Update PerfView to version 3.2.0 ilabutin/chocolatey-packages#10

Merged

This was referenced Apr 22, 2026

Bump Microsoft.Diagnostics.Tracing.TraceEvent from 3.1.6 to 3.2.2 AndrewRathbun/BeaconHunter#10

Open

Bump Microsoft.Diagnostics.Tracing.TraceEvent from 3.1.20 to 3.2.2 OffroadOps/Hatch#24

Closed

This was referenced May 13, 2026

Bump Microsoft.Diagnostics.Tracing.TraceEvent from 3.1.22 to 3.2.2 mikeyhodl/docs-1#4975

Closed

Bump Microsoft.Diagnostics.Tracing.TraceEvent from 3.1.30 to 3.2.3 endjin/deadcode#57

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add ELF Symbol Resolution for Linux .nettrace Traces#2397

Add ELF Symbol Resolution for Linux .nettrace Traces#2397
brianrob merged 10 commits into
microsoft:mainfrom
brianrob:brianrob/elf-symbols-squashed

brianrob commented Mar 25, 2026 •

edited

Loading

Uh oh!

leculver left a comment

Uh oh!

brianrob commented Mar 27, 2026

Uh oh!

leculver left a comment

Uh oh!

leculver Mar 27, 2026

Uh oh!

leculver Mar 27, 2026

Uh oh!

brianrob Mar 27, 2026

Uh oh!

leculver Mar 27, 2026

Uh oh!

leculver Mar 27, 2026

Uh oh!

brianrob commented Mar 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

brianrob commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Commit 1: ELF Symbol Resolution with SymbolInfo Type Hierarchy

Commit 2: Align R2R and ELF with PDB Find→Matches→Open Pattern

Commit 3: Read .gnu_debuglink from ELF Binaries

Commit 4: Harden ElfSymbolModule

Unit Testing

Real-World Symbol Testing

Linux Distro Datasets

.NET Version Datasets

Uh oh!

leculver left a comment

Choose a reason for hiding this comment

Uh oh!

brianrob commented Mar 27, 2026

Uh oh!

leculver left a comment

Choose a reason for hiding this comment

Uh oh!

leculver Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

leculver Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

brianrob Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

leculver Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

leculver Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

brianrob commented Mar 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

brianrob commented Mar 25, 2026 •

edited

Loading

Commit 3: Read `.gnu_debuglink` from ELF Binaries