CTF proposal v1.6
[ctf.git] / common-trace-format-linux-proposal.txt
CommitLineData
5ba9f198 1
80fd2569 2RFC: Common Trace Format Proposal for Linux (v1.6)
5ba9f198
MD
3
4Mathieu Desnoyers, EfficiOS Inc.
5
6The goal of the present document is to propose a trace format that suits the
7needs of the embedded, telecom, high-performance and kernel communities. It is
8based on the Common Trace Format Requirements (v1.4) document. It is designed to
3bf79539
MD
9allow tracing that is natively generated by the Linux kernel and Linux
10user-space applications written in C/C++.
5ba9f198
MD
11
12A reference implementation of a library to read and write this trace format is
13being implemented within the BabelTrace project, a converter between trace
14formats. The development tree is available at:
15
16 git tree: git://git.efficios.com/babeltrace.git
17 gitweb: http://git.efficios.com/?p=babeltrace.git
18
19
201. Preliminary definitions
21
3bf79539
MD
22 - Event Trace: An ordered sequence of events.
23 - Event Stream: An ordered sequence of events, containing a subset of the
24 trace event types.
25 - Event Packet: A sequence of physically contiguous events within an event
26 stream.
5ba9f198
MD
27 - Event: This is the basic entry in a trace. (aka: a trace record).
28 - An event identifier (ID) relates to the class (a type) of event within
3bf79539
MD
29 an event stream.
30 e.g. event: irq_entry.
5ba9f198
MD
31 - An event (or event record) relates to a specific instance of an event
32 class.
3bf79539
MD
33 e.g. event: irq_entry, at time X, on CPU Y
34 - Source Architecture: Architecture writing the trace.
35 - Reader Architecture: Architecture reading the trace.
5ba9f198
MD
36
37
382. High-level representation of a trace
39
3bf79539
MD
40A trace is divided into multiple event streams. Each event stream contains a
41subset of the trace event types.
5ba9f198 42
3bf79539
MD
43The final output of the trace, after its generation and optional transport over
44the network, is expected to be either on permanent or temporary storage in a
45virtual file system. Because each event stream is appended to while a trace is
46being recorded, each is associated with a separate file for output. Therefore,
47a stored trace can be represented as a directory containing one file per stream.
5ba9f198 48
3bf79539 49A metadata event stream contains information on trace event types. It describes:
5ba9f198
MD
50
51- Trace version.
52- Types available.
3bf79539
MD
53- Per-stream event header description.
54- Per-stream event header selection.
55- Per-stream event context fields.
5ba9f198 56- Per-event
3bf79539 57 - Event type to stream mapping.
5ba9f198
MD
58 - Event type to name mapping.
59 - Event type to ID mapping.
60 - Event fields description.
61
62
3bf79539 633. Event stream
5ba9f198 64
3bf79539
MD
65An event stream is divided in contiguous event packets of variable size. These
66subdivisions have a variable size. An event packet can contain a certain amount
67of padding at the end. The rationale for the event stream design choices is
68explained in Appendix B. Stream Header Rationale.
5ba9f198 69
3bf79539
MD
70An event stream is divided in contiguous event packets of variable size. These
71subdivisions have a variable size. An event packet can contain a certain amount
72of padding at the end. The stream header is repeated at the beginning of each
73event packet.
5ba9f198 74
3bf79539
MD
75The event stream header will therefore be referred to as the "event packet
76header" throughout the rest of this document.
5ba9f198
MD
77
78
794. Types
80
814.1 Basic types
82
83A basic type is a scalar type, as described in this section.
84
854.1.1 Type inheritance
86
80fd2569
MD
87Type specifications can be inherited to allow deriving types from a
88type class. For example, see the uint32_t named type derived from the "integer"
89type class below ("Integers" section). Types have a precise binary
90representation in the trace. A type class has methods to read and write these
91types, but must be derived into a type to be usable in an event field.
5ba9f198
MD
92
934.1.2 Alignment
94
95We define "byte-packed" types as aligned on the byte size, namely 8-bit.
96We define "bit-packed" types as following on the next bit, as defined by the
97"bitfields" section.
5ba9f198 98
3bf79539
MD
99All basic types, except bitfields, are either aligned on an architecture-defined
100specific alignment or byte-packed, depending on the architecture preference.
101Architectures providing fast unaligned write byte-packed basic types to save
5ba9f198 102space, aligning each type on byte boundaries (8-bit). Architectures with slow
3bf79539
MD
103unaligned writes align types on specific alignment values. If no specific
104alignment is declared for a type nor its parents, it is assumed to be bit-packed
105for bitfields and byte-packed for other types.
5ba9f198 106
3bf79539 107Metadata attribute representation of a specific alignment:
5ba9f198
MD
108
109 align = value; /* value in bits */
110
1114.1.3 Byte order
112
3bf79539
MD
113By default, the native endianness of the source architecture the trace is used.
114Byte order can be overridden for a basic type by specifying a "byte_order"
115attribute. Typical use-case is to specify the network byte order (big endian:
116"be") to save data captured from the network into the trace without conversion.
117If not specified, the byte order is native.
5ba9f198
MD
118
119Metadata representation:
120
121 byte_order = native OR network OR be OR le; /* network and be are aliases */
122
1234.1.4 Size
124
125Type size, in bits, for integers and floats is that returned by "sizeof()" in C
126multiplied by CHAR_BIT.
127We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed
128to 8 bits for cross-endianness compatibility.
129
130Metadata representation:
131
132 size = value; (value is in bits)
133
1344.1.5 Integers
135
136Signed integers are represented in two-complement. Integer alignment, size,
137signedness and byte ordering are defined in the metadata. Integers aligned on
138byte size (8-bit) and with length multiple of byte size (8-bit) correspond to
139the C99 standard integers. In addition, integers with alignment and/or size that
140are _not_ a multiple of the byte size are permitted; these correspond to the C99
141standard bitfields, with the added specification that the CTF integer bitfields
142have a fixed binary representation. A MIT-licensed reference implementation of
143the CTF portable bitfields is available at:
144
145 http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h
146
147Binary representation of integers:
148
149- On little and big endian:
150 - Within a byte, high bits correspond to an integer high bits, and low bits
151 correspond to low bits.
152- On little endian:
153 - Integer across multiple bytes are placed from the less significant to the
154 most significant.
155 - Consecutive integers are placed from lower bits to higher bits (even within
156 a byte).
157- On big endian:
158 - Integer across multiple bytes are placed from the most significant to the
159 less significant.
160 - Consecutive integers are placed from higher bits to lower bits (even within
161 a byte).
162
163This binary representation is derived from the bitfield implementation in GCC
164for little and big endian. However, contrary to what GCC does, integers can
165cross units boundaries (no padding is required). Padding can be explicitely
166added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed.
167
168Metadata representation:
169
80fd2569 170 integer {
5ba9f198
MD
171 signed = true OR false; /* default false */
172 byte_order = native OR network OR be OR le; /* default native */
173 size = value; /* value in bits, no default */
174 align = value; /* value in bits */
3bf79539 175 };
5ba9f198 176
80fd2569 177Example of type inheritance (creation of a uint32_t named type):
5ba9f198 178
80fd2569 179typedef integer {
9e4e34e9 180 size = 32;
5ba9f198
MD
181 signed = false;
182 align = 32;
80fd2569 183} uint32_t;
5ba9f198 184
80fd2569 185Definition of a named 5-bit signed bitfield:
5ba9f198 186
80fd2569 187typedef integer {
5ba9f198
MD
188 size = 5;
189 signed = true;
190 align = 1;
80fd2569 191} int5_t;
5ba9f198
MD
192
1934.1.6 GNU/C bitfields
194
195The GNU/C bitfields follow closely the integer representation, with a
196particularity on alignment: if a bitfield cannot fit in the current unit, the
80fd2569
MD
197unit is padded and the bitfield starts at the following unit. The unit size is
198defined by the size of the type "unit_type".
5ba9f198 199
80fd2569 200Metadata representation. Either:
5ba9f198 201
80fd2569
MD
202gcc_bitfield {
203 unit_type = integer {
204 ...
205 };
206 size = value;
3bf79539 207};
5ba9f198 208
80fd2569
MD
209Or bitfield within structures as specified by the C standard
210
211 unit_type name:size:
212
5ba9f198
MD
213As an example, the following structure declared in C compiled by GCC:
214
215struct example {
216 short a:12;
217 short b:5;
218};
219
80fd2569
MD
220is equivalent to the following structure declaration, aligned on the largest
221element (short). The second bitfield would be aligned on the next unit boundary,
222because it would not fit in the current unit. The two declarations (C
223declaration above or CTF declaration with "type gcc_bitfield") are strictly
224equivalent.
225
226struct example {
227 gcc_bitfield {
228 unit_type = short;
229 size = 12;
230 } a;
231 gcc_bitfield {
232 unit_type = short;
233 size = 5;
234 } b;
3bf79539 235};
5ba9f198
MD
236
2374.1.7 Floating point
238
239The floating point values byte ordering is defined in the metadata.
240
241Floating point values follow the IEEE 754-2008 standard interchange formats.
242Description of the floating point values include the exponent and mantissa size
243in bits. Some requirements are imposed on the floating point values:
244
245- FLT_RADIX must be 2.
246- mant_dig is the number of digits represented in the mantissa. It is specified
247 by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and
248 LDBL_MANT_DIG as defined by <float.h>.
249- exp_dig is the number of digits represented in the exponent. Given that
250 mant_dig is one bit more than its actual size in bits (leading 1 is not
251 needed) and also given that the sign bit always takes one bit, exp_dig can be
252 specified as:
253
254 - sizeof(float) * CHAR_BIT - FLT_MANT_DIG
255 - sizeof(double) * CHAR_BIT - DBL_MANT_DIG
256 - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG
257
258Metadata representation:
259
80fd2569 260floating_point {
5ba9f198
MD
261 exp_dig = value;
262 mant_dig = value;
263 byte_order = native OR network OR be OR le;
3bf79539 264};
5ba9f198
MD
265
266Example of type inheritance:
267
80fd2569 268typedef floating_point {
5ba9f198
MD
269 exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */
270 mant_dig = 24; /* FLT_MANT_DIG */
271 byte_order = native;
80fd2569 272} float;
5ba9f198
MD
273
274TODO: define NaN, +inf, -inf behavior.
275
2764.1.8 Enumerations
277
278Enumerations are a mapping between an integer type and a table of strings. The
279numerical representation of the enumeration follows the integer type specified
280by the metadata. The enumeration mapping table is detailed in the enumeration
3bf79539
MD
281description within the metadata. The mapping table maps inclusive value ranges
282(or single values) to strings. Instead of being limited to simple
283"value -> string" mappings, these enumerations map
80fd2569 284"[ start_value ... end_value ] -> string", which map inclusive ranges of
3bf79539
MD
285values to strings. An enumeration from the C language can be represented in
286this format by having the same start_value and end_value for each element, which
287is in fact a range of size 1. This single-value range is supported without
80fd2569
MD
288repeating the start and end values with the value = string declaration. If the
289<integer_type> is omitted, the type chosen by the C compiler to hold the
290enumeration is used. The <integer_type> specifier can only be omitted for
291enumerations containing only simple "value -> string" mappings (compatible with
292C).
293
294enum <integer_type> name {
295 string = start_value1 ... end_value1,
296 "other string" = start_value2 ... end_value2,
297 yet_another_string, /* will be assigned to end_value2 + 1 */
298 "some other string" = value,
299 ...
300};
301
302If the values are omitted, the enumeration starts at 0 and increment of 1 for
303each entry:
304
305enum {
306 ZERO,
307 ONE,
308 TWO,
309 TEN = 10,
310 ELEVEN,
3bf79539 311};
5ba9f198 312
80fd2569 313Overlapping ranges within a single enumeration are implementation defined.
5ba9f198
MD
314
3154.2 Compound types
316
3174.2.1 Structures
318
319Structures are aligned on the largest alignment required by basic types
320contained within the structure. (This follows the ISO/C standard for structures)
321
80fd2569 322Metadata representation of a named structure:
5ba9f198 323
80fd2569
MD
324struct name {
325 field_type field_name;
326 field_type field_name;
327 ...
328};
5ba9f198
MD
329
330Example:
331
80fd2569
MD
332struct example {
333 integer { /* Nameless type */
334 size = 16;
335 signed = true;
336 align = 16;
337 } first_field_name;
338 uint64_t second_field_name; /* Named type declared in the metadata */
3bf79539 339};
5ba9f198
MD
340
341The fields are placed in a sequence next to each other. They each possess a
342field name, which is a unique identifier within the structure.
343
80fd2569
MD
344A nameless structure can be declared as a field type:
345
346struct {
347 ...
348} field_name;
349
5ba9f198
MD
3504.2.2 Arrays
351
352Arrays are fixed-length. Their length is declared in the type declaration within
353the metadata. They contain an array of "inner type" elements, which can refer to
354any type not containing the type of the array being declared (no circular
3bf79539 355dependency). The length is the number of elements in an array.
5ba9f198 356
80fd2569 357Metadata representation of a named array, either:
5ba9f198 358
80fd2569 359typedef array {
5ba9f198
MD
360 length = value;
361 elem_type = type;
80fd2569
MD
362} name;
363
364or:
365
366typedef elem_type name[length];
5ba9f198
MD
367
368E.g.:
369
80fd2569 370typedef array {
5ba9f198
MD
371 length = 10;
372 elem_type = uint32_t;
80fd2569
MD
373} example;
374
375A nameless array can be declared as a field type, e.g.:
376
377array {
378 length = 5;
379 elem_type = uint8_t;
380} field_name;
381
382or
383
384uint8_t field_name[10];
385
5ba9f198
MD
386
3874.2.3 Sequences
388
389Sequences are dynamically-sized arrays. They start with an integer that specify
390the length of the sequence, followed by an array of "inner type" elements.
3bf79539 391The length is the number of elements in the sequence.
5ba9f198 392
80fd2569
MD
393Metadata representation for a named sequence, either:
394
395typedef sequence {
396 length_type = type; /* integer class */
5ba9f198 397 elem_type = type;
80fd2569
MD
398} name;
399
400or:
401
402typedef elem_type name[length_type];
403
404A nameless sequence can be declared as a field type, e.g.:
405
406sequence {
407 length_type = int;
408 elem_type = long;
409} field_name;
410
411or
5ba9f198 412
80fd2569
MD
413long field_name[int];
414
415The length type follows the integer types specifications, and the sequence
5ba9f198
MD
416elements follow the "array" specifications.
417
4184.2.4 Strings
419
420Strings are an array of bytes of variable size and are terminated by a '\0'
421"NULL" character. Their encoding is described in the metadata. In absence of
422encoding attribute information, the default encoding is UTF-8.
423
80fd2569
MD
424Metadata representation of a named string type:
425
426typedef string {
5ba9f198 427 encoding = UTF8 OR ASCII;
80fd2569 428} name;
5ba9f198 429
80fd2569
MD
430A nameless string type can be declared as a field type:
431
432string field_name; /* Use default UTF8 encoding */
5ba9f198 433
3bf79539
MD
4345. Event Packet Header
435
436The event packet header consists of two part: one is mandatory and have a fixed
437layout. The second part, the "event packet context", has its layout described in
438the metadata.
5ba9f198 439
3bf79539
MD
440- Aligned on page size. Fixed size. Fields either aligned or packed (depending
441 on the architecture preference).
442 No padding at the end of the event packet header. Native architecture byte
5ba9f198 443 ordering.
3bf79539
MD
444
445Fixed layout (event packet header):
446
5ba9f198
MD
447- Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness
448 representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise
449 representation. Used to distinguish between big and little endian traces (this
450 information is determined by knowing the endianness of the architecture
451 reading the trace and comparing the magic number against its value and the
452 reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata
453 description language described in this document. Different magic numbers
454 should be used for other metadata description languages.
3bf79539 455- Trace UUID, used to ensure the event packet match the metadata used.
5ba9f198
MD
456 (note: we cannot use a metadata checksum because metadata can be appended to
457 while tracing is active)
3bf79539
MD
458- Stream ID, used as reference to stream description in metadata.
459
460Metadata-defined layout (event packet context):
461
462- Event packet content size (in bytes).
463- Event packet size (in bytes, includes padding).
464- Event packet content checksum (optional). Checksum excludes the event packet
465 header.
466- Per-stream event packet sequence count (to deal with UDP packet loss). The
467 number of significant sequence counter bits should also be present, so
468 wrap-arounds are deal with correctly.
469- Timestamp at the beginning and timestamp at the end of the event packet.
470 Both timestamps are written in the packet header, but sampled respectively
471 while (or before) writing the first event and while (or after) writing the
472 last event in the packet. The inclusive range between these timestamps should
473 include all event timestamps assigned to events contained within the packet.
5ba9f198 474- Events discarded count
3bf79539
MD
475 - Snapshot of a per-stream free-running counter, counting the number of
476 events discarded that were supposed to be written in the stream prior to
477 the first event in the event packet.
5ba9f198 478 * Note: producer-consumer buffer full condition should fill the current
3bf79539 479 event packet with padding so we know exactly where events have been
5ba9f198 480 discarded.
3bf79539
MD
481- Lossless compression scheme used for the event packet content. Applied
482 directly to raw data. New types of compression can be added in following
483 versions of the format.
5ba9f198
MD
484 0: no compression scheme
485 1: bzip2
486 2: gzip
3bf79539
MD
487 3: xz
488- Cypher used for the event packet content. Applied after compression.
5ba9f198
MD
489 0: no encryption
490 1: AES
3bf79539 491- Checksum scheme used for the event packet content. Applied after encryption.
5ba9f198
MD
492 0: no checksum
493 1: md5
494 2: sha1
495 3: crc32
496
3bf79539
MD
4975.1 Event Packet Header Fixed Layout Description
498
80fd2569
MD
499struct event_packet_header {
500 uint32_t magic;
501 uint8_t trace_uuid[16];
3bf79539 502 uint32_t stream_id;
80fd2569 503};
5ba9f198 504
3bf79539
MD
5055.2 Event Packet Context Description
506
507Event packet context example. These are declared within the stream declaration
508in the metadata. All these fields are optional except for "content_size" and
509"packet_size", which must be present in the context.
510
511An example event packet context type:
512
80fd2569 513struct event_packet_context {
3bf79539
MD
514 uint64_t timestamp_begin;
515 uint64_t timestamp_end;
516 uint32_t checksum;
517 uint32_t stream_packet_count;
518 uint32_t events_discarded;
519 uint32_t cpu_id;
520 uint32_t/uint16_t content_size;
521 uint32_t/uint16_t packet_size;
522 uint8_t stream_packet_count_bits; /* Significant counter bits */
523 uint8_t compression_scheme;
524 uint8_t encryption_scheme;
525 uint8_t checksum;
526};
5ba9f198
MD
527
5286. Event Structure
529
530The overall structure of an event is:
531
3bf79539 532 - Event Header (as specifed by the stream metadata)
5ba9f198 533 - Extended Event Header (as specified by the event header)
3bf79539 534 - Event Context (as specified by the stream metadata)
5ba9f198
MD
535 - Event Payload (as specified by the event metadata)
536
537
5386.1 Event Header
539
3bf79539
MD
540One major factor can vary between streams: the number of event IDs assigned to
541a stream. Luckily, this information tends to stay relatively constant (modulo
5ba9f198 542event registration while trace is being recorded), so we can specify different
3bf79539 543representations for streams containing few event IDs and streams containing
5ba9f198
MD
544many event IDs, so we end up representing the event ID and timestamp as densely
545as possible in each case.
546
3bf79539
MD
547We therefore provide two types of events headers. Type 1 accommodates streams
548with less than 31 event IDs. Type 2 accommodates streams with 31 or more event
5ba9f198
MD
549IDs.
550
551The "extended headers" are used in the rare occasions where the information
3bf79539
MD
552cannot be represented in the ranges available in the event header. They are also
553used in the rare occasions where the data required for a field could not be
554collected: the flag corresponding to the missing field within the missing_fields
555array is then set to 1.
5ba9f198
MD
556
557Types uintX_t represent an X-bit unsigned integer.
558
559
5606.1.1 Type 1 - Few event IDs
561
562 - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture
563 preference).
564 - Fixed size: 32 bits.
565 - Native architecture byte ordering.
566
80fd2569
MD
567struct event_header_1 {
568 uint5_t id; /*
5ba9f198
MD
569 * id: range: 0 - 30.
570 * id 31 is reserved to indicate a following
571 * extended header.
572 */
80fd2569 573 uint27_t timestamp;
5ba9f198
MD
574};
575
576The end of a type 1 header is aligned on a 32-bit boundary (or packed).
577
578
5796.1.2 Extended Type 1 Event Header
580
581 - Follows struct event_header_1, which is aligned on 32-bit, so no need to
582 realign.
3bf79539 583 - Variable size (depends on the number of fields per event).
5ba9f198 584 - Native architecture byte ordering.
80fd2569 585 - NR_FIELDS is the number of fields within the event.
5ba9f198 586
80fd2569
MD
587struct event_header_1_ext {
588 uint32_t id; /* 32-bit event IDs */
589 uint64_t timestamp; /* 64-bit timestamps */
590 uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */
5ba9f198
MD
591};
592
5ba9f198
MD
593
5946.1.3 Type 2 - Many event IDs
595
596 - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture
597 preference).
598 - Fixed size: 48 bits.
599 - Native architecture byte ordering.
600
80fd2569
MD
601struct event_header_2 {
602 uint32_t timestamp;
603 uint16_t id; /*
5ba9f198
MD
604 * id: range: 0 - 65534.
605 * id 65535 is reserved to indicate a following
606 * extended header.
607 */
5ba9f198
MD
608};
609
610The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if
611byte-packed).
612
613
6146.1.4 Extended Type 2 Event Header
615
616 - Follows struct event_header_2, which alignment end on a 16-bit boundary, so
3bf79539 617 we need to align on 64-bit integer architecture alignment (or 8-bit if
5ba9f198 618 byte-packed).
3bf79539 619 - Variable size (depends on the number of fields per event).
5ba9f198 620 - Native architecture byte ordering.
80fd2569 621 - NR_FIELDS is the number of fields within the event.
5ba9f198 622
80fd2569
MD
623struct event_header_2_ext {
624 uint64_t timestamp; /* 64-bit timestamps */
625 uint32_t id; /* 32-bit event IDs */
626 uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */
5ba9f198
MD
627};
628
5ba9f198
MD
629
6306.2 Event Context
631
632The event context contains information relative to the current event. The choice
3bf79539 633and meaning of this information is specified by the metadata "stream"
5ba9f198 634information. For this trace format, event context is usually empty, except when
3bf79539 635the metadata "stream" information specifies otherwise by declaring a non-empty
5ba9f198
MD
636structure for the event context. An example of event context is to save the
637event payload size with each event, or to save the current PID with each event.
3bf79539 638These are declared within the stream declaration within the metadata.
5ba9f198 639
3bf79539 640An example event context type:
5ba9f198 641
80fd2569
MD
642 struct event_context {
643 uint pid;
644 uint16_t payload_size;
3bf79539 645 };
5ba9f198
MD
646
647
6486.3 Event Payload
649
650An event payload contains fields specific to a given event type. The fields
651belonging to an event type are described in the event-specific metadata
652within a structure type.
653
6546.3.1 Padding
655
656No padding at the end of the event payload. This differs from the ISO/C standard
657for structures, but follows the CTF standard for structures. In a trace, even
658though it makes sense to align the beginning of a structure, it really makes no
659sense to add padding at the end of the structure, because structures are usually
660not followed by a structure of the same type.
661
662This trick can be done by adding a zero-length "end" field at the end of the C
663structures, and by using the offset of this field rather than using sizeof()
3bf79539 664when calculating the size of a structure (see Appendix "A. Helper macros").
5ba9f198
MD
665
6666.3.2 Alignment
667
668The event payload is aligned on the largest alignment required by types
669contained within the payload. (This follows the ISO/C standard for structures)
670
671
672
6737. Metadata
674
3bf79539
MD
675The meta-data is located in a stream named "metadata". It is made of "event
676packets", which each start with an event packet header. The event type within
677the metadata stream have no event header nor event context. Each event only
5ba9f198 678contains a null-terminated "string" payload, which is a metadata description
3bf79539
MD
679entry. The events are packed one next to another. Each event packet start with
680an event packet header, which contains, amongst other fields, the magic number
681and trace UUID.
5ba9f198
MD
682
683The metadata can be parsed by reading through the metadata strings, skipping
3bf79539 684newlines and null-characters. Type names may contain spaces.
5ba9f198
MD
685
686trace {
687 major = value; /* Trace format version */
688 minor = value;
3bf79539
MD
689 uuid = value; /* Trace UUID */
690 word_size = value;
691};
5ba9f198 692
3bf79539
MD
693stream {
694 id = stream_id;
5ba9f198 695 event {
3bf79539
MD
696 /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */
697 header_type = event_header_1 OR event_header_2;
698 /*
699 * Extended event header type. Only present if specified in event header
700 * on a per-event basis.
701 */
702 header_type_ext = event_header_1_ext OR event_header_2_ext;
80fd2569
MD
703 context_type = struct {
704 ...
705 };
3bf79539
MD
706 };
707 packet {
80fd2569
MD
708 context_type = struct {
709 ...
710 };
3bf79539
MD
711 };
712};
5ba9f198
MD
713
714event {
3bf79539
MD
715 name = eventname;
716 id = value; /* Numeric identifier within the stream */
717 stream = stream_id;
80fd2569
MD
718 fields = struct {
719 ...
720 };
3bf79539 721};
5ba9f198
MD
722
723/* More detail on types in section 4. Types */
724
725/* Named types */
80fd2569
MD
726typedef some existing type new_type;
727
728typedef type_class {
729 ...
730} new_type;
731
732struct name {
3bf79539
MD
733 ...
734};
5ba9f198 735
80fd2569 736enum name {
3bf79539
MD
737 ...
738};
739
80fd2569
MD
740/* Unnamed types, contained within compound type fields or type assignments. */
741struct {
742 ...
743};
5ba9f198 744
80fd2569
MD
745enum {
746 ...
747};
3bf79539 748
80fd2569
MD
749array {
750 ...
751};
3bf79539 752
80fd2569
MD
753sequence {
754 ...
755};
3bf79539
MD
756
757A. Helper macros
5ba9f198
MD
758
759The two following macros keep track of the size of a GNU/C structure without
760padding at the end by placing HEADER_END as the last field. A one byte end field
761is used for C90 compatibility (C99 flexible arrays could be used here). Note
762that this does not affect the effective structure size, which should always be
763calculated with the header_sizeof() helper.
764
765#define HEADER_END char end_field
766#define header_sizeof(type) offsetof(typeof(type), end_field)
3bf79539
MD
767
768
769B. Stream Header Rationale
770
771An event stream is divided in contiguous event packets of variable size. These
772subdivisions allow the trace analyzer to perform a fast binary search by time
773within the stream (typically requiring to index only the event packet headers)
774without reading the whole stream. These subdivisions have a variable size to
775eliminate the need to transfer the event packet padding when partially filled
776event packets must be sent when streaming a trace for live viewing/analysis.
777An event packet can contain a certain amount of padding at the end. Dividing
778streams into event packets is also useful for network streaming over UDP and
779flight recorder mode tracing (a whole event packet can be swapped out of the
780buffer atomically for reading).
781
782The stream header is repeated at the beginning of each event packet to allow
783flexibility in terms of:
784
785 - streaming support,
786 - allowing arbitrary buffers to be discarded without making the trace
787 unreadable,
788 - allow UDP packet loss handling by either dealing with missing event packet
789 or asking for re-transmission.
790 - transparently support flight recorder mode,
791 - transparently support crash dump.
792
793The event stream header will therefore be referred to as the "event packet
794header" throughout the rest of this document.
This page took 0.093224 seconds and 4 git commands to generate.