[Profiler] Count value of 0xffffffff in GCSuspendEEBegin_V1 event

[Liangjia0411]

While monitoring .NET Runtime ETW events, I've noticed a peculiar value in the GCSuspendEEBegin_V1 (EventID: 9) event payload:

• When Reason == 2, the Count value in the payload is 0xffffffff
  

Steps to Reproduce

1. Register an EventListener to monitor the Microsoft-Windows-DotNETRuntime event source
2. Focus on events with EventID 9 (GCSuspendEEBegin_V1)
3. Examine the event payload and observe the difference in Count values with different Reasons

Sample Code

protected override void OnEventWritten(EventWrittenEventArgs eventData)
{
    if (eventData.EventId == 9) // GCSuspendEEBegin_V1
    {
        var reason = (uint)eventData.Payload[0];
        var count = (uint)eventData.Payload[1];
        
        Console.WriteLine($"GCSuspendEEBegin: Reason={reason}, Count={count:X}");
    }
}

Questions

1. Is 0xffffff a special marker value? What does it signify?
2. Why does this value only appear when Reason == 2?
3. How should this value be correctly interpreted when processing these events?

Environment Information

• .NET version: 9.0.3

[Liangjia0411]

Hi, @mdh1418 ,Do you know why?

[mdh1418]

For reference, the manifest entry for GCSuspendEEBegin_V1 is here:

runtime/src/coreclr/vm/ClrEtwAll.man

Lines 1092 to 1104 in f76e203

	<template tid="GCSuspendEE_V1">
	<data name="Reason" inType="win:UInt32" map="GCSuspendEEReasonMap" />
	<data name="Count" inType="win:UInt32" />
	<data name="ClrInstanceID" inType="win:UInt16" />
	<UserData>
	<GCSuspendEE_V1 xmlns="myNs">
	<Reason> %1 </Reason>
	<Count> %2 </Count>
	<ClrInstanceID> %3 </ClrInstanceID>
	</GCSuspendEE_V1>
	</UserData>
	</template>

Typically, the events are fired through a helper like FireETW<event_name>, so in the case of GCSuspendEEBegin_V1, the corresponding callsite is at

runtime/src/coreclr/vm/threadsuspend.cpp

Line 5540 in 4caf064

FireEtwGCSuspendEEBegin_V1(Info.SuspendEE.Reason, Info.SuspendEE.GcCount, GetClrInstanceId());

.

1. From the manifest, the count, I believe refers to the GC Generation count. In this case, we are seeing a value of 0xffffffff, which looking at where the event was fired, means that the reason the runtime was suspended was not for GC.
2. The reason == 2 confirms that the runtime was suspended for a reason that is not GC, based on the thread suspend reasons here

   runtime/src/coreclr/vm/threadsuspend.h

   Lines 169 to 180 in f76e203

   	typedef enum
   	{
   	SUSPEND_OTHER = 0,
   	SUSPEND_FOR_GC = 1,
   	SUSPEND_FOR_APPDOMAIN_SHUTDOWN = 2,
   	SUSPEND_FOR_REJIT = 3,
   	SUSPEND_FOR_SHUTDOWN = 4,
   	SUSPEND_FOR_DEBUGGER = 5,
   	SUSPEND_FOR_GC_PREP = 6,
   	SUSPEND_FOR_DEBUGGER_SWEEP = 7, // This must only be used in Thread::SysSweepThreadsForDebug
   	SUSPEND_FOR_PROFILER = 8
   	} SUSPEND_REASON;

   , which alludes to the runtime being suspended for SUSPEND_FOR_APPDOMAIN_SHUTDOWN. So it looks like this callsite

   runtime/src/coreclr/vm/loaderallocator.cpp

   Line 604 in f76e203

   ThreadSuspend::SuspendEE(ThreadSuspend::SUSPEND_FOR_APPDOMAIN_SHUTDOWN);

   corresponds to that GCSuspendEEBegin_V1.

In short, the runtime can be suspended for a variety of reasons besides GC, as alluded to in the threadsuspend.h header file. The name was never updated to not be prefixed with GC, but I believe whenever you see the reason for runtime suspension, referring back to the list of reasons, you can find the keyword that can help track down the exact callsite. Which hopefully answers 3.

[Liangjia0411]

Field Count should not represent 'GC Generation Count', it looks like an Index indicating the number of times GC occurred, but this Index does not appear to be continuous and sometimes jumps.
For example, in the following picture, "112,113,4294967295 (0xffffffff), 113,4294967295,124"

[mdh1418]

Ah, you're right. I was mistaken that it represented the gen of GC. From

runtime/src/coreclr/gc/gcpriv.h

Line 635 in 0d628da

VOLATILE(size_t) gc_index; // starts from 1 for the first GC, like dd_collection_count

and https://github.com/dotnet/runtime/blob/main/src/coreclr/gc/gc.cpp it does look more like representing the number of times GC.

I still think the "jumps" to 0xFFFFFFFF means that the runtime suspension was not due to GC, and that it is this else case before the FireETWGCSuspendEEBegin_V1