Commit | Line | Data |
---|---|---|
5ba9f198 | 1 | |
dce2dd9a | 2 | RFC: Common Trace Format (CTF) Proposal (v1.6) |
5ba9f198 MD |
3 | |
4 | Mathieu Desnoyers, EfficiOS Inc. | |
5 | ||
6 | The goal of the present document is to propose a trace format that suits the | |
cc089c3a | 7 | needs of the embedded, telecom, high-performance and kernel communities. It is |
5ba9f198 | 8 | based on the Common Trace Format Requirements (v1.4) document. It is designed to |
cc089c3a MD |
9 | allow traces to be natively generated by the Linux kernel, Linux user-space |
10 | applications written in C/C++, and hardware components. | |
11 | ||
12 | The latest version of this document can be found at: | |
13 | ||
14 | git tree: git://git.efficios.com/ctf.git | |
15 | gitweb: http://git.efficios.com/?p=ctf.git | |
5ba9f198 MD |
16 | |
17 | A reference implementation of a library to read and write this trace format is | |
18 | being implemented within the BabelTrace project, a converter between trace | |
19 | formats. The development tree is available at: | |
20 | ||
21 | git tree: git://git.efficios.com/babeltrace.git | |
22 | gitweb: http://git.efficios.com/?p=babeltrace.git | |
23 | ||
24 | ||
25 | 1. Preliminary definitions | |
26 | ||
3bf79539 MD |
27 | - Event Trace: An ordered sequence of events. |
28 | - Event Stream: An ordered sequence of events, containing a subset of the | |
29 | trace event types. | |
30 | - Event Packet: A sequence of physically contiguous events within an event | |
31 | stream. | |
5ba9f198 MD |
32 | - Event: This is the basic entry in a trace. (aka: a trace record). |
33 | - An event identifier (ID) relates to the class (a type) of event within | |
3bf79539 MD |
34 | an event stream. |
35 | e.g. event: irq_entry. | |
5ba9f198 MD |
36 | - An event (or event record) relates to a specific instance of an event |
37 | class. | |
3bf79539 MD |
38 | e.g. event: irq_entry, at time X, on CPU Y |
39 | - Source Architecture: Architecture writing the trace. | |
40 | - Reader Architecture: Architecture reading the trace. | |
5ba9f198 MD |
41 | |
42 | ||
43 | 2. High-level representation of a trace | |
44 | ||
3bf79539 MD |
45 | A trace is divided into multiple event streams. Each event stream contains a |
46 | subset of the trace event types. | |
5ba9f198 | 47 | |
3bf79539 MD |
48 | The final output of the trace, after its generation and optional transport over |
49 | the network, is expected to be either on permanent or temporary storage in a | |
50 | virtual file system. Because each event stream is appended to while a trace is | |
51 | being recorded, each is associated with a separate file for output. Therefore, | |
52 | a stored trace can be represented as a directory containing one file per stream. | |
5ba9f198 | 53 | |
3bf79539 | 54 | A metadata event stream contains information on trace event types. It describes: |
5ba9f198 MD |
55 | |
56 | - Trace version. | |
57 | - Types available. | |
3bf79539 MD |
58 | - Per-stream event header description. |
59 | - Per-stream event header selection. | |
60 | - Per-stream event context fields. | |
5ba9f198 | 61 | - Per-event |
3bf79539 | 62 | - Event type to stream mapping. |
5ba9f198 MD |
63 | - Event type to name mapping. |
64 | - Event type to ID mapping. | |
65 | - Event fields description. | |
66 | ||
67 | ||
3bf79539 | 68 | 3. Event stream |
5ba9f198 | 69 | |
3bf79539 MD |
70 | An event stream is divided in contiguous event packets of variable size. These |
71 | subdivisions have a variable size. An event packet can contain a certain amount | |
72 | of padding at the end. The rationale for the event stream design choices is | |
73 | explained in Appendix B. Stream Header Rationale. | |
5ba9f198 | 74 | |
3bf79539 MD |
75 | An event stream is divided in contiguous event packets of variable size. These |
76 | subdivisions have a variable size. An event packet can contain a certain amount | |
77 | of padding at the end. The stream header is repeated at the beginning of each | |
78 | event packet. | |
5ba9f198 | 79 | |
3bf79539 MD |
80 | The event stream header will therefore be referred to as the "event packet |
81 | header" throughout the rest of this document. | |
5ba9f198 MD |
82 | |
83 | ||
84 | 4. Types | |
85 | ||
86 | 4.1 Basic types | |
87 | ||
88 | A basic type is a scalar type, as described in this section. | |
89 | ||
90 | 4.1.1 Type inheritance | |
91 | ||
80fd2569 MD |
92 | Type specifications can be inherited to allow deriving types from a |
93 | type class. For example, see the uint32_t named type derived from the "integer" | |
94 | type class below ("Integers" section). Types have a precise binary | |
95 | representation in the trace. A type class has methods to read and write these | |
96 | types, but must be derived into a type to be usable in an event field. | |
5ba9f198 MD |
97 | |
98 | 4.1.2 Alignment | |
99 | ||
100 | We define "byte-packed" types as aligned on the byte size, namely 8-bit. | |
101 | We define "bit-packed" types as following on the next bit, as defined by the | |
102 | "bitfields" section. | |
5ba9f198 | 103 | |
3bf79539 MD |
104 | All basic types, except bitfields, are either aligned on an architecture-defined |
105 | specific alignment or byte-packed, depending on the architecture preference. | |
106 | Architectures providing fast unaligned write byte-packed basic types to save | |
5ba9f198 | 107 | space, aligning each type on byte boundaries (8-bit). Architectures with slow |
3bf79539 MD |
108 | unaligned writes align types on specific alignment values. If no specific |
109 | alignment is declared for a type nor its parents, it is assumed to be bit-packed | |
110 | for bitfields and byte-packed for other types. | |
5ba9f198 | 111 | |
3bf79539 | 112 | Metadata attribute representation of a specific alignment: |
5ba9f198 MD |
113 | |
114 | align = value; /* value in bits */ | |
115 | ||
116 | 4.1.3 Byte order | |
117 | ||
3bf79539 MD |
118 | By default, the native endianness of the source architecture the trace is used. |
119 | Byte order can be overridden for a basic type by specifying a "byte_order" | |
120 | attribute. Typical use-case is to specify the network byte order (big endian: | |
121 | "be") to save data captured from the network into the trace without conversion. | |
122 | If not specified, the byte order is native. | |
5ba9f198 MD |
123 | |
124 | Metadata representation: | |
125 | ||
126 | byte_order = native OR network OR be OR le; /* network and be are aliases */ | |
127 | ||
128 | 4.1.4 Size | |
129 | ||
130 | Type size, in bits, for integers and floats is that returned by "sizeof()" in C | |
131 | multiplied by CHAR_BIT. | |
132 | We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed | |
133 | to 8 bits for cross-endianness compatibility. | |
134 | ||
135 | Metadata representation: | |
136 | ||
137 | size = value; (value is in bits) | |
138 | ||
139 | 4.1.5 Integers | |
140 | ||
141 | Signed integers are represented in two-complement. Integer alignment, size, | |
142 | signedness and byte ordering are defined in the metadata. Integers aligned on | |
143 | byte size (8-bit) and with length multiple of byte size (8-bit) correspond to | |
144 | the C99 standard integers. In addition, integers with alignment and/or size that | |
145 | are _not_ a multiple of the byte size are permitted; these correspond to the C99 | |
146 | standard bitfields, with the added specification that the CTF integer bitfields | |
147 | have a fixed binary representation. A MIT-licensed reference implementation of | |
148 | the CTF portable bitfields is available at: | |
149 | ||
150 | http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h | |
151 | ||
152 | Binary representation of integers: | |
153 | ||
154 | - On little and big endian: | |
155 | - Within a byte, high bits correspond to an integer high bits, and low bits | |
156 | correspond to low bits. | |
157 | - On little endian: | |
158 | - Integer across multiple bytes are placed from the less significant to the | |
159 | most significant. | |
160 | - Consecutive integers are placed from lower bits to higher bits (even within | |
161 | a byte). | |
162 | - On big endian: | |
163 | - Integer across multiple bytes are placed from the most significant to the | |
164 | less significant. | |
165 | - Consecutive integers are placed from higher bits to lower bits (even within | |
166 | a byte). | |
167 | ||
168 | This binary representation is derived from the bitfield implementation in GCC | |
169 | for little and big endian. However, contrary to what GCC does, integers can | |
170 | cross units boundaries (no padding is required). Padding can be explicitely | |
171 | added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed. | |
172 | ||
173 | Metadata representation: | |
174 | ||
80fd2569 | 175 | integer { |
5ba9f198 MD |
176 | signed = true OR false; /* default false */ |
177 | byte_order = native OR network OR be OR le; /* default native */ | |
178 | size = value; /* value in bits, no default */ | |
179 | align = value; /* value in bits */ | |
2152348f | 180 | } |
5ba9f198 | 181 | |
80fd2569 | 182 | Example of type inheritance (creation of a uint32_t named type): |
5ba9f198 | 183 | |
80fd2569 | 184 | typedef integer { |
9e4e34e9 | 185 | size = 32; |
5ba9f198 MD |
186 | signed = false; |
187 | align = 32; | |
80fd2569 | 188 | } uint32_t; |
5ba9f198 | 189 | |
80fd2569 | 190 | Definition of a named 5-bit signed bitfield: |
5ba9f198 | 191 | |
80fd2569 | 192 | typedef integer { |
5ba9f198 MD |
193 | size = 5; |
194 | signed = true; | |
195 | align = 1; | |
80fd2569 | 196 | } int5_t; |
5ba9f198 MD |
197 | |
198 | 4.1.6 GNU/C bitfields | |
199 | ||
200 | The GNU/C bitfields follow closely the integer representation, with a | |
201 | particularity on alignment: if a bitfield cannot fit in the current unit, the | |
80fd2569 MD |
202 | unit is padded and the bitfield starts at the following unit. The unit size is |
203 | defined by the size of the type "unit_type". | |
5ba9f198 | 204 | |
2152348f | 205 | Metadata representation: |
80fd2569 MD |
206 | |
207 | unit_type name:size: | |
208 | ||
5ba9f198 MD |
209 | As an example, the following structure declared in C compiled by GCC: |
210 | ||
211 | struct example { | |
212 | short a:12; | |
213 | short b:5; | |
214 | }; | |
215 | ||
2152348f MD |
216 | The example structure is aligned on the largest element (short). The second |
217 | bitfield would be aligned on the next unit boundary, because it would not fit in | |
218 | the current unit. | |
5ba9f198 MD |
219 | |
220 | 4.1.7 Floating point | |
221 | ||
222 | The floating point values byte ordering is defined in the metadata. | |
223 | ||
224 | Floating point values follow the IEEE 754-2008 standard interchange formats. | |
225 | Description of the floating point values include the exponent and mantissa size | |
226 | in bits. Some requirements are imposed on the floating point values: | |
227 | ||
228 | - FLT_RADIX must be 2. | |
229 | - mant_dig is the number of digits represented in the mantissa. It is specified | |
230 | by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and | |
231 | LDBL_MANT_DIG as defined by <float.h>. | |
232 | - exp_dig is the number of digits represented in the exponent. Given that | |
233 | mant_dig is one bit more than its actual size in bits (leading 1 is not | |
234 | needed) and also given that the sign bit always takes one bit, exp_dig can be | |
235 | specified as: | |
236 | ||
237 | - sizeof(float) * CHAR_BIT - FLT_MANT_DIG | |
238 | - sizeof(double) * CHAR_BIT - DBL_MANT_DIG | |
239 | - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG | |
240 | ||
241 | Metadata representation: | |
242 | ||
80fd2569 | 243 | floating_point { |
5ba9f198 MD |
244 | exp_dig = value; |
245 | mant_dig = value; | |
246 | byte_order = native OR network OR be OR le; | |
2152348f | 247 | } |
5ba9f198 MD |
248 | |
249 | Example of type inheritance: | |
250 | ||
80fd2569 | 251 | typedef floating_point { |
5ba9f198 MD |
252 | exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */ |
253 | mant_dig = 24; /* FLT_MANT_DIG */ | |
254 | byte_order = native; | |
80fd2569 | 255 | } float; |
5ba9f198 MD |
256 | |
257 | TODO: define NaN, +inf, -inf behavior. | |
258 | ||
259 | 4.1.8 Enumerations | |
260 | ||
261 | Enumerations are a mapping between an integer type and a table of strings. The | |
262 | numerical representation of the enumeration follows the integer type specified | |
263 | by the metadata. The enumeration mapping table is detailed in the enumeration | |
3bf79539 MD |
264 | description within the metadata. The mapping table maps inclusive value ranges |
265 | (or single values) to strings. Instead of being limited to simple | |
266 | "value -> string" mappings, these enumerations map | |
80fd2569 | 267 | "[ start_value ... end_value ] -> string", which map inclusive ranges of |
3bf79539 MD |
268 | values to strings. An enumeration from the C language can be represented in |
269 | this format by having the same start_value and end_value for each element, which | |
270 | is in fact a range of size 1. This single-value range is supported without | |
80fd2569 MD |
271 | repeating the start and end values with the value = string declaration. If the |
272 | <integer_type> is omitted, the type chosen by the C compiler to hold the | |
273 | enumeration is used. The <integer_type> specifier can only be omitted for | |
274 | enumerations containing only simple "value -> string" mappings (compatible with | |
275 | C). | |
276 | ||
277 | enum <integer_type> name { | |
278 | string = start_value1 ... end_value1, | |
279 | "other string" = start_value2 ... end_value2, | |
280 | yet_another_string, /* will be assigned to end_value2 + 1 */ | |
281 | "some other string" = value, | |
282 | ... | |
283 | }; | |
284 | ||
285 | If the values are omitted, the enumeration starts at 0 and increment of 1 for | |
286 | each entry: | |
287 | ||
2152348f | 288 | enum name { |
80fd2569 MD |
289 | ZERO, |
290 | ONE, | |
291 | TWO, | |
292 | TEN = 10, | |
293 | ELEVEN, | |
3bf79539 | 294 | }; |
5ba9f198 | 295 | |
80fd2569 | 296 | Overlapping ranges within a single enumeration are implementation defined. |
5ba9f198 | 297 | |
2152348f MD |
298 | A nameless enumeration can be declared as a field type or as part of a typedef: |
299 | ||
300 | enum <integer_type> { | |
301 | ... | |
302 | } | |
303 | ||
5ba9f198 MD |
304 | 4.2 Compound types |
305 | ||
306 | 4.2.1 Structures | |
307 | ||
308 | Structures are aligned on the largest alignment required by basic types | |
309 | contained within the structure. (This follows the ISO/C standard for structures) | |
310 | ||
80fd2569 | 311 | Metadata representation of a named structure: |
5ba9f198 | 312 | |
80fd2569 MD |
313 | struct name { |
314 | field_type field_name; | |
315 | field_type field_name; | |
316 | ... | |
317 | }; | |
5ba9f198 MD |
318 | |
319 | Example: | |
320 | ||
80fd2569 MD |
321 | struct example { |
322 | integer { /* Nameless type */ | |
323 | size = 16; | |
324 | signed = true; | |
325 | align = 16; | |
326 | } first_field_name; | |
327 | uint64_t second_field_name; /* Named type declared in the metadata */ | |
3bf79539 | 328 | }; |
5ba9f198 MD |
329 | |
330 | The fields are placed in a sequence next to each other. They each possess a | |
331 | field name, which is a unique identifier within the structure. | |
332 | ||
2152348f | 333 | A nameless structure can be declared as a field type or as part of a typedef: |
80fd2569 MD |
334 | |
335 | struct { | |
336 | ... | |
2152348f | 337 | } |
80fd2569 | 338 | |
5ba9f198 MD |
339 | 4.2.2 Arrays |
340 | ||
341 | Arrays are fixed-length. Their length is declared in the type declaration within | |
342 | the metadata. They contain an array of "inner type" elements, which can refer to | |
343 | any type not containing the type of the array being declared (no circular | |
3bf79539 | 344 | dependency). The length is the number of elements in an array. |
5ba9f198 | 345 | |
2152348f | 346 | Metadata representation of a named array: |
80fd2569 MD |
347 | |
348 | typedef elem_type name[length]; | |
5ba9f198 | 349 | |
2152348f | 350 | A nameless array can be declared as a field type within a structure, e.g.: |
5ba9f198 | 351 | |
2152348f | 352 | uint8_t field_name[10]; |
80fd2569 | 353 | |
5ba9f198 MD |
354 | |
355 | 4.2.3 Sequences | |
356 | ||
357 | Sequences are dynamically-sized arrays. They start with an integer that specify | |
358 | the length of the sequence, followed by an array of "inner type" elements. | |
3bf79539 | 359 | The length is the number of elements in the sequence. |
5ba9f198 | 360 | |
2152348f | 361 | Metadata representation for a named sequence: |
80fd2569 MD |
362 | |
363 | typedef elem_type name[length_type]; | |
364 | ||
365 | A nameless sequence can be declared as a field type, e.g.: | |
366 | ||
80fd2569 MD |
367 | long field_name[int]; |
368 | ||
369 | The length type follows the integer types specifications, and the sequence | |
5ba9f198 MD |
370 | elements follow the "array" specifications. |
371 | ||
372 | 4.2.4 Strings | |
373 | ||
374 | Strings are an array of bytes of variable size and are terminated by a '\0' | |
375 | "NULL" character. Their encoding is described in the metadata. In absence of | |
376 | encoding attribute information, the default encoding is UTF-8. | |
377 | ||
80fd2569 MD |
378 | Metadata representation of a named string type: |
379 | ||
380 | typedef string { | |
5ba9f198 | 381 | encoding = UTF8 OR ASCII; |
80fd2569 | 382 | } name; |
5ba9f198 | 383 | |
80fd2569 MD |
384 | A nameless string type can be declared as a field type: |
385 | ||
386 | string field_name; /* Use default UTF8 encoding */ | |
5ba9f198 | 387 | |
3bf79539 MD |
388 | 5. Event Packet Header |
389 | ||
390 | The event packet header consists of two part: one is mandatory and have a fixed | |
391 | layout. The second part, the "event packet context", has its layout described in | |
392 | the metadata. | |
5ba9f198 | 393 | |
3bf79539 MD |
394 | - Aligned on page size. Fixed size. Fields either aligned or packed (depending |
395 | on the architecture preference). | |
396 | No padding at the end of the event packet header. Native architecture byte | |
5ba9f198 | 397 | ordering. |
3bf79539 MD |
398 | |
399 | Fixed layout (event packet header): | |
400 | ||
5ba9f198 MD |
401 | - Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness |
402 | representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise | |
403 | representation. Used to distinguish between big and little endian traces (this | |
404 | information is determined by knowing the endianness of the architecture | |
405 | reading the trace and comparing the magic number against its value and the | |
406 | reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata | |
407 | description language described in this document. Different magic numbers | |
408 | should be used for other metadata description languages. | |
3bf79539 | 409 | - Trace UUID, used to ensure the event packet match the metadata used. |
5ba9f198 MD |
410 | (note: we cannot use a metadata checksum because metadata can be appended to |
411 | while tracing is active) | |
3bf79539 MD |
412 | - Stream ID, used as reference to stream description in metadata. |
413 | ||
414 | Metadata-defined layout (event packet context): | |
415 | ||
416 | - Event packet content size (in bytes). | |
417 | - Event packet size (in bytes, includes padding). | |
418 | - Event packet content checksum (optional). Checksum excludes the event packet | |
419 | header. | |
420 | - Per-stream event packet sequence count (to deal with UDP packet loss). The | |
421 | number of significant sequence counter bits should also be present, so | |
422 | wrap-arounds are deal with correctly. | |
423 | - Timestamp at the beginning and timestamp at the end of the event packet. | |
424 | Both timestamps are written in the packet header, but sampled respectively | |
425 | while (or before) writing the first event and while (or after) writing the | |
426 | last event in the packet. The inclusive range between these timestamps should | |
427 | include all event timestamps assigned to events contained within the packet. | |
5ba9f198 | 428 | - Events discarded count |
3bf79539 MD |
429 | - Snapshot of a per-stream free-running counter, counting the number of |
430 | events discarded that were supposed to be written in the stream prior to | |
431 | the first event in the event packet. | |
5ba9f198 | 432 | * Note: producer-consumer buffer full condition should fill the current |
3bf79539 | 433 | event packet with padding so we know exactly where events have been |
5ba9f198 | 434 | discarded. |
3bf79539 MD |
435 | - Lossless compression scheme used for the event packet content. Applied |
436 | directly to raw data. New types of compression can be added in following | |
437 | versions of the format. | |
5ba9f198 MD |
438 | 0: no compression scheme |
439 | 1: bzip2 | |
440 | 2: gzip | |
3bf79539 MD |
441 | 3: xz |
442 | - Cypher used for the event packet content. Applied after compression. | |
5ba9f198 MD |
443 | 0: no encryption |
444 | 1: AES | |
3bf79539 | 445 | - Checksum scheme used for the event packet content. Applied after encryption. |
5ba9f198 MD |
446 | 0: no checksum |
447 | 1: md5 | |
448 | 2: sha1 | |
449 | 3: crc32 | |
450 | ||
3bf79539 MD |
451 | 5.1 Event Packet Header Fixed Layout Description |
452 | ||
80fd2569 MD |
453 | struct event_packet_header { |
454 | uint32_t magic; | |
455 | uint8_t trace_uuid[16]; | |
3bf79539 | 456 | uint32_t stream_id; |
80fd2569 | 457 | }; |
5ba9f198 | 458 | |
3bf79539 MD |
459 | 5.2 Event Packet Context Description |
460 | ||
461 | Event packet context example. These are declared within the stream declaration | |
462 | in the metadata. All these fields are optional except for "content_size" and | |
463 | "packet_size", which must be present in the context. | |
464 | ||
465 | An example event packet context type: | |
466 | ||
80fd2569 | 467 | struct event_packet_context { |
3bf79539 MD |
468 | uint64_t timestamp_begin; |
469 | uint64_t timestamp_end; | |
470 | uint32_t checksum; | |
471 | uint32_t stream_packet_count; | |
472 | uint32_t events_discarded; | |
473 | uint32_t cpu_id; | |
474 | uint32_t/uint16_t content_size; | |
475 | uint32_t/uint16_t packet_size; | |
476 | uint8_t stream_packet_count_bits; /* Significant counter bits */ | |
477 | uint8_t compression_scheme; | |
478 | uint8_t encryption_scheme; | |
479 | uint8_t checksum; | |
480 | }; | |
5ba9f198 MD |
481 | |
482 | 6. Event Structure | |
483 | ||
484 | The overall structure of an event is: | |
485 | ||
3bf79539 | 486 | - Event Header (as specifed by the stream metadata) |
5ba9f198 | 487 | - Extended Event Header (as specified by the event header) |
3bf79539 | 488 | - Event Context (as specified by the stream metadata) |
5ba9f198 MD |
489 | - Event Payload (as specified by the event metadata) |
490 | ||
491 | ||
492 | 6.1 Event Header | |
493 | ||
3bf79539 MD |
494 | One major factor can vary between streams: the number of event IDs assigned to |
495 | a stream. Luckily, this information tends to stay relatively constant (modulo | |
5ba9f198 | 496 | event registration while trace is being recorded), so we can specify different |
3bf79539 | 497 | representations for streams containing few event IDs and streams containing |
5ba9f198 MD |
498 | many event IDs, so we end up representing the event ID and timestamp as densely |
499 | as possible in each case. | |
500 | ||
3bf79539 MD |
501 | We therefore provide two types of events headers. Type 1 accommodates streams |
502 | with less than 31 event IDs. Type 2 accommodates streams with 31 or more event | |
5ba9f198 MD |
503 | IDs. |
504 | ||
505 | The "extended headers" are used in the rare occasions where the information | |
3bf79539 MD |
506 | cannot be represented in the ranges available in the event header. They are also |
507 | used in the rare occasions where the data required for a field could not be | |
508 | collected: the flag corresponding to the missing field within the missing_fields | |
509 | array is then set to 1. | |
5ba9f198 MD |
510 | |
511 | Types uintX_t represent an X-bit unsigned integer. | |
512 | ||
513 | ||
514 | 6.1.1 Type 1 - Few event IDs | |
515 | ||
516 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
517 | preference). | |
518 | - Fixed size: 32 bits. | |
519 | - Native architecture byte ordering. | |
520 | ||
80fd2569 MD |
521 | struct event_header_1 { |
522 | uint5_t id; /* | |
5ba9f198 MD |
523 | * id: range: 0 - 30. |
524 | * id 31 is reserved to indicate a following | |
525 | * extended header. | |
526 | */ | |
80fd2569 | 527 | uint27_t timestamp; |
5ba9f198 MD |
528 | }; |
529 | ||
530 | The end of a type 1 header is aligned on a 32-bit boundary (or packed). | |
531 | ||
532 | ||
533 | 6.1.2 Extended Type 1 Event Header | |
534 | ||
535 | - Follows struct event_header_1, which is aligned on 32-bit, so no need to | |
536 | realign. | |
3bf79539 | 537 | - Variable size (depends on the number of fields per event). |
5ba9f198 | 538 | - Native architecture byte ordering. |
80fd2569 | 539 | - NR_FIELDS is the number of fields within the event. |
5ba9f198 | 540 | |
80fd2569 MD |
541 | struct event_header_1_ext { |
542 | uint32_t id; /* 32-bit event IDs */ | |
543 | uint64_t timestamp; /* 64-bit timestamps */ | |
544 | uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */ | |
5ba9f198 MD |
545 | }; |
546 | ||
5ba9f198 MD |
547 | |
548 | 6.1.3 Type 2 - Many event IDs | |
549 | ||
550 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
551 | preference). | |
552 | - Fixed size: 48 bits. | |
553 | - Native architecture byte ordering. | |
554 | ||
80fd2569 MD |
555 | struct event_header_2 { |
556 | uint32_t timestamp; | |
557 | uint16_t id; /* | |
5ba9f198 MD |
558 | * id: range: 0 - 65534. |
559 | * id 65535 is reserved to indicate a following | |
560 | * extended header. | |
561 | */ | |
5ba9f198 MD |
562 | }; |
563 | ||
564 | The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if | |
565 | byte-packed). | |
566 | ||
567 | ||
568 | 6.1.4 Extended Type 2 Event Header | |
569 | ||
570 | - Follows struct event_header_2, which alignment end on a 16-bit boundary, so | |
3bf79539 | 571 | we need to align on 64-bit integer architecture alignment (or 8-bit if |
5ba9f198 | 572 | byte-packed). |
3bf79539 | 573 | - Variable size (depends on the number of fields per event). |
5ba9f198 | 574 | - Native architecture byte ordering. |
80fd2569 | 575 | - NR_FIELDS is the number of fields within the event. |
5ba9f198 | 576 | |
80fd2569 MD |
577 | struct event_header_2_ext { |
578 | uint64_t timestamp; /* 64-bit timestamps */ | |
579 | uint32_t id; /* 32-bit event IDs */ | |
580 | uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */ | |
5ba9f198 MD |
581 | }; |
582 | ||
5ba9f198 MD |
583 | |
584 | 6.2 Event Context | |
585 | ||
586 | The event context contains information relative to the current event. The choice | |
3bf79539 | 587 | and meaning of this information is specified by the metadata "stream" |
5ba9f198 | 588 | information. For this trace format, event context is usually empty, except when |
3bf79539 | 589 | the metadata "stream" information specifies otherwise by declaring a non-empty |
5ba9f198 MD |
590 | structure for the event context. An example of event context is to save the |
591 | event payload size with each event, or to save the current PID with each event. | |
3bf79539 | 592 | These are declared within the stream declaration within the metadata. |
5ba9f198 | 593 | |
3bf79539 | 594 | An example event context type: |
5ba9f198 | 595 | |
80fd2569 MD |
596 | struct event_context { |
597 | uint pid; | |
598 | uint16_t payload_size; | |
3bf79539 | 599 | }; |
5ba9f198 MD |
600 | |
601 | ||
602 | 6.3 Event Payload | |
603 | ||
604 | An event payload contains fields specific to a given event type. The fields | |
605 | belonging to an event type are described in the event-specific metadata | |
606 | within a structure type. | |
607 | ||
608 | 6.3.1 Padding | |
609 | ||
610 | No padding at the end of the event payload. This differs from the ISO/C standard | |
611 | for structures, but follows the CTF standard for structures. In a trace, even | |
612 | though it makes sense to align the beginning of a structure, it really makes no | |
613 | sense to add padding at the end of the structure, because structures are usually | |
614 | not followed by a structure of the same type. | |
615 | ||
616 | This trick can be done by adding a zero-length "end" field at the end of the C | |
617 | structures, and by using the offset of this field rather than using sizeof() | |
3bf79539 | 618 | when calculating the size of a structure (see Appendix "A. Helper macros"). |
5ba9f198 MD |
619 | |
620 | 6.3.2 Alignment | |
621 | ||
622 | The event payload is aligned on the largest alignment required by types | |
623 | contained within the payload. (This follows the ISO/C standard for structures) | |
624 | ||
625 | ||
626 | ||
627 | 7. Metadata | |
628 | ||
3bf79539 MD |
629 | The meta-data is located in a stream named "metadata". It is made of "event |
630 | packets", which each start with an event packet header. The event type within | |
631 | the metadata stream have no event header nor event context. Each event only | |
5ba9f198 | 632 | contains a null-terminated "string" payload, which is a metadata description |
3bf79539 MD |
633 | entry. The events are packed one next to another. Each event packet start with |
634 | an event packet header, which contains, amongst other fields, the magic number | |
635 | and trace UUID. | |
5ba9f198 MD |
636 | |
637 | The metadata can be parsed by reading through the metadata strings, skipping | |
3bf79539 | 638 | newlines and null-characters. Type names may contain spaces. |
5ba9f198 MD |
639 | |
640 | trace { | |
641 | major = value; /* Trace format version */ | |
642 | minor = value; | |
3bf79539 MD |
643 | uuid = value; /* Trace UUID */ |
644 | word_size = value; | |
645 | }; | |
5ba9f198 | 646 | |
3bf79539 MD |
647 | stream { |
648 | id = stream_id; | |
5ba9f198 | 649 | event { |
3bf79539 MD |
650 | /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */ |
651 | header_type = event_header_1 OR event_header_2; | |
652 | /* | |
653 | * Extended event header type. Only present if specified in event header | |
654 | * on a per-event basis. | |
655 | */ | |
656 | header_type_ext = event_header_1_ext OR event_header_2_ext; | |
80fd2569 MD |
657 | context_type = struct { |
658 | ... | |
659 | }; | |
3bf79539 MD |
660 | }; |
661 | packet { | |
80fd2569 MD |
662 | context_type = struct { |
663 | ... | |
664 | }; | |
3bf79539 MD |
665 | }; |
666 | }; | |
5ba9f198 MD |
667 | |
668 | event { | |
3d13ef1a | 669 | name = event_name; |
3bf79539 MD |
670 | id = value; /* Numeric identifier within the stream */ |
671 | stream = stream_id; | |
80fd2569 MD |
672 | fields = struct { |
673 | ... | |
674 | }; | |
3bf79539 | 675 | }; |
5ba9f198 MD |
676 | |
677 | /* More detail on types in section 4. Types */ | |
678 | ||
3d13ef1a MD |
679 | /* |
680 | * Named types: | |
681 | * | |
682 | * A named type can only have a prefix and postfix if it aliases a CTF basic | |
683 | * type. A type name aliasing another type name cannot have prefix nor postfix, | |
684 | * but the type aliased can have a prefix and/or postfix. | |
685 | */ | |
686 | ||
687 | typedef aliased_type_prefix aliased_type new_type aliased_type_postfix; | |
2152348f | 688 | |
3d13ef1a | 689 | /* e.g.: typedef struct example new_type_name[10]; */ |
80fd2569 MD |
690 | |
691 | typedef type_class { | |
692 | ... | |
3d13ef1a | 693 | } new_type_prefix new_type new_type_postfix; |
2152348f | 694 | |
3d13ef1a MD |
695 | /* |
696 | * e.g.: | |
697 | * typedef integer { | |
698 | * size = 32; | |
699 | * align = 32; | |
700 | * signed = false; | |
701 | * } struct page *; | |
702 | */ | |
80fd2569 MD |
703 | |
704 | struct name { | |
3bf79539 MD |
705 | ... |
706 | }; | |
5ba9f198 | 707 | |
3d13ef1a | 708 | enum <integer_type> name { |
3bf79539 MD |
709 | ... |
710 | }; | |
711 | ||
2152348f MD |
712 | |
713 | /* Unnamed types, contained within compound type fields or typedef. */ | |
714 | ||
80fd2569 MD |
715 | struct { |
716 | ... | |
2152348f | 717 | } |
5ba9f198 | 718 | |
3d13ef1a | 719 | enum <integer_type> { |
80fd2569 | 720 | ... |
2152348f MD |
721 | } |
722 | ||
723 | typedef type new_type[length]; | |
3bf79539 | 724 | |
2152348f MD |
725 | struct { |
726 | type field_name[length]; | |
727 | } | |
728 | ||
729 | typedef type new_type[length_type]; | |
730 | ||
731 | struct { | |
732 | type field_name[length_type]; | |
733 | } | |
734 | ||
735 | integer { | |
80fd2569 | 736 | ... |
2152348f | 737 | } |
3bf79539 | 738 | |
2152348f | 739 | floating_point { |
80fd2569 | 740 | ... |
2152348f MD |
741 | } |
742 | ||
743 | struct { | |
744 | integer_type field_name:size; /* GNU/C bitfield */ | |
745 | } | |
746 | ||
747 | struct { | |
748 | string field_name; | |
749 | } | |
3bf79539 MD |
750 | |
751 | A. Helper macros | |
5ba9f198 MD |
752 | |
753 | The two following macros keep track of the size of a GNU/C structure without | |
754 | padding at the end by placing HEADER_END as the last field. A one byte end field | |
755 | is used for C90 compatibility (C99 flexible arrays could be used here). Note | |
756 | that this does not affect the effective structure size, which should always be | |
757 | calculated with the header_sizeof() helper. | |
758 | ||
759 | #define HEADER_END char end_field | |
760 | #define header_sizeof(type) offsetof(typeof(type), end_field) | |
3bf79539 MD |
761 | |
762 | ||
763 | B. Stream Header Rationale | |
764 | ||
765 | An event stream is divided in contiguous event packets of variable size. These | |
766 | subdivisions allow the trace analyzer to perform a fast binary search by time | |
767 | within the stream (typically requiring to index only the event packet headers) | |
768 | without reading the whole stream. These subdivisions have a variable size to | |
769 | eliminate the need to transfer the event packet padding when partially filled | |
770 | event packets must be sent when streaming a trace for live viewing/analysis. | |
771 | An event packet can contain a certain amount of padding at the end. Dividing | |
772 | streams into event packets is also useful for network streaming over UDP and | |
773 | flight recorder mode tracing (a whole event packet can be swapped out of the | |
774 | buffer atomically for reading). | |
775 | ||
776 | The stream header is repeated at the beginning of each event packet to allow | |
777 | flexibility in terms of: | |
778 | ||
779 | - streaming support, | |
780 | - allowing arbitrary buffers to be discarded without making the trace | |
781 | unreadable, | |
782 | - allow UDP packet loss handling by either dealing with missing event packet | |
783 | or asking for re-transmission. | |
784 | - transparently support flight recorder mode, | |
785 | - transparently support crash dump. | |
786 | ||
787 | The event stream header will therefore be referred to as the "event packet | |
788 | header" throughout the rest of this document. |