Commit | Line | Data |
---|---|---|
5ba9f198 | 1 | |
dce2dd9a | 2 | RFC: Common Trace Format (CTF) Proposal (v1.6) |
5ba9f198 MD |
3 | |
4 | Mathieu Desnoyers, EfficiOS Inc. | |
5 | ||
6 | The goal of the present document is to propose a trace format that suits the | |
cc089c3a | 7 | needs of the embedded, telecom, high-performance and kernel communities. It is |
5ba9f198 | 8 | based on the Common Trace Format Requirements (v1.4) document. It is designed to |
cc089c3a MD |
9 | allow traces to be natively generated by the Linux kernel, Linux user-space |
10 | applications written in C/C++, and hardware components. | |
11 | ||
12 | The latest version of this document can be found at: | |
13 | ||
14 | git tree: git://git.efficios.com/ctf.git | |
15 | gitweb: http://git.efficios.com/?p=ctf.git | |
5ba9f198 MD |
16 | |
17 | A reference implementation of a library to read and write this trace format is | |
18 | being implemented within the BabelTrace project, a converter between trace | |
19 | formats. The development tree is available at: | |
20 | ||
21 | git tree: git://git.efficios.com/babeltrace.git | |
22 | gitweb: http://git.efficios.com/?p=babeltrace.git | |
23 | ||
24 | ||
25 | 1. Preliminary definitions | |
26 | ||
3bf79539 MD |
27 | - Event Trace: An ordered sequence of events. |
28 | - Event Stream: An ordered sequence of events, containing a subset of the | |
29 | trace event types. | |
30 | - Event Packet: A sequence of physically contiguous events within an event | |
31 | stream. | |
5ba9f198 MD |
32 | - Event: This is the basic entry in a trace. (aka: a trace record). |
33 | - An event identifier (ID) relates to the class (a type) of event within | |
3bf79539 MD |
34 | an event stream. |
35 | e.g. event: irq_entry. | |
5ba9f198 MD |
36 | - An event (or event record) relates to a specific instance of an event |
37 | class. | |
3bf79539 MD |
38 | e.g. event: irq_entry, at time X, on CPU Y |
39 | - Source Architecture: Architecture writing the trace. | |
40 | - Reader Architecture: Architecture reading the trace. | |
5ba9f198 MD |
41 | |
42 | ||
43 | 2. High-level representation of a trace | |
44 | ||
3bf79539 MD |
45 | A trace is divided into multiple event streams. Each event stream contains a |
46 | subset of the trace event types. | |
5ba9f198 | 47 | |
3bf79539 MD |
48 | The final output of the trace, after its generation and optional transport over |
49 | the network, is expected to be either on permanent or temporary storage in a | |
50 | virtual file system. Because each event stream is appended to while a trace is | |
51 | being recorded, each is associated with a separate file for output. Therefore, | |
52 | a stored trace can be represented as a directory containing one file per stream. | |
5ba9f198 | 53 | |
3bf79539 | 54 | A metadata event stream contains information on trace event types. It describes: |
5ba9f198 MD |
55 | |
56 | - Trace version. | |
57 | - Types available. | |
3bf79539 MD |
58 | - Per-stream event header description. |
59 | - Per-stream event header selection. | |
60 | - Per-stream event context fields. | |
5ba9f198 | 61 | - Per-event |
3bf79539 | 62 | - Event type to stream mapping. |
5ba9f198 MD |
63 | - Event type to name mapping. |
64 | - Event type to ID mapping. | |
65 | - Event fields description. | |
66 | ||
67 | ||
3bf79539 | 68 | 3. Event stream |
5ba9f198 | 69 | |
3bf79539 MD |
70 | An event stream is divided in contiguous event packets of variable size. These |
71 | subdivisions have a variable size. An event packet can contain a certain amount | |
72 | of padding at the end. The rationale for the event stream design choices is | |
73 | explained in Appendix B. Stream Header Rationale. | |
5ba9f198 | 74 | |
3bf79539 MD |
75 | An event stream is divided in contiguous event packets of variable size. These |
76 | subdivisions have a variable size. An event packet can contain a certain amount | |
77 | of padding at the end. The stream header is repeated at the beginning of each | |
78 | event packet. | |
5ba9f198 | 79 | |
3bf79539 MD |
80 | The event stream header will therefore be referred to as the "event packet |
81 | header" throughout the rest of this document. | |
5ba9f198 MD |
82 | |
83 | ||
84 | 4. Types | |
85 | ||
86 | 4.1 Basic types | |
87 | ||
88 | A basic type is a scalar type, as described in this section. | |
89 | ||
90 | 4.1.1 Type inheritance | |
91 | ||
80fd2569 MD |
92 | Type specifications can be inherited to allow deriving types from a |
93 | type class. For example, see the uint32_t named type derived from the "integer" | |
94 | type class below ("Integers" section). Types have a precise binary | |
95 | representation in the trace. A type class has methods to read and write these | |
96 | types, but must be derived into a type to be usable in an event field. | |
5ba9f198 MD |
97 | |
98 | 4.1.2 Alignment | |
99 | ||
100 | We define "byte-packed" types as aligned on the byte size, namely 8-bit. | |
101 | We define "bit-packed" types as following on the next bit, as defined by the | |
102 | "bitfields" section. | |
5ba9f198 | 103 | |
3bf79539 MD |
104 | All basic types, except bitfields, are either aligned on an architecture-defined |
105 | specific alignment or byte-packed, depending on the architecture preference. | |
106 | Architectures providing fast unaligned write byte-packed basic types to save | |
5ba9f198 | 107 | space, aligning each type on byte boundaries (8-bit). Architectures with slow |
3bf79539 MD |
108 | unaligned writes align types on specific alignment values. If no specific |
109 | alignment is declared for a type nor its parents, it is assumed to be bit-packed | |
110 | for bitfields and byte-packed for other types. | |
5ba9f198 | 111 | |
3bf79539 | 112 | Metadata attribute representation of a specific alignment: |
5ba9f198 MD |
113 | |
114 | align = value; /* value in bits */ | |
115 | ||
116 | 4.1.3 Byte order | |
117 | ||
3bf79539 MD |
118 | By default, the native endianness of the source architecture the trace is used. |
119 | Byte order can be overridden for a basic type by specifying a "byte_order" | |
120 | attribute. Typical use-case is to specify the network byte order (big endian: | |
121 | "be") to save data captured from the network into the trace without conversion. | |
122 | If not specified, the byte order is native. | |
5ba9f198 MD |
123 | |
124 | Metadata representation: | |
125 | ||
126 | byte_order = native OR network OR be OR le; /* network and be are aliases */ | |
127 | ||
128 | 4.1.4 Size | |
129 | ||
130 | Type size, in bits, for integers and floats is that returned by "sizeof()" in C | |
131 | multiplied by CHAR_BIT. | |
132 | We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed | |
133 | to 8 bits for cross-endianness compatibility. | |
134 | ||
135 | Metadata representation: | |
136 | ||
137 | size = value; (value is in bits) | |
138 | ||
139 | 4.1.5 Integers | |
140 | ||
141 | Signed integers are represented in two-complement. Integer alignment, size, | |
142 | signedness and byte ordering are defined in the metadata. Integers aligned on | |
143 | byte size (8-bit) and with length multiple of byte size (8-bit) correspond to | |
144 | the C99 standard integers. In addition, integers with alignment and/or size that | |
145 | are _not_ a multiple of the byte size are permitted; these correspond to the C99 | |
146 | standard bitfields, with the added specification that the CTF integer bitfields | |
147 | have a fixed binary representation. A MIT-licensed reference implementation of | |
148 | the CTF portable bitfields is available at: | |
149 | ||
150 | http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h | |
151 | ||
152 | Binary representation of integers: | |
153 | ||
154 | - On little and big endian: | |
155 | - Within a byte, high bits correspond to an integer high bits, and low bits | |
156 | correspond to low bits. | |
157 | - On little endian: | |
158 | - Integer across multiple bytes are placed from the less significant to the | |
159 | most significant. | |
160 | - Consecutive integers are placed from lower bits to higher bits (even within | |
161 | a byte). | |
162 | - On big endian: | |
163 | - Integer across multiple bytes are placed from the most significant to the | |
164 | less significant. | |
165 | - Consecutive integers are placed from higher bits to lower bits (even within | |
166 | a byte). | |
167 | ||
168 | This binary representation is derived from the bitfield implementation in GCC | |
169 | for little and big endian. However, contrary to what GCC does, integers can | |
170 | cross units boundaries (no padding is required). Padding can be explicitely | |
171 | added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed. | |
172 | ||
173 | Metadata representation: | |
174 | ||
80fd2569 | 175 | integer { |
5ba9f198 MD |
176 | signed = true OR false; /* default false */ |
177 | byte_order = native OR network OR be OR le; /* default native */ | |
178 | size = value; /* value in bits, no default */ | |
179 | align = value; /* value in bits */ | |
3bf79539 | 180 | }; |
5ba9f198 | 181 | |
80fd2569 | 182 | Example of type inheritance (creation of a uint32_t named type): |
5ba9f198 | 183 | |
80fd2569 | 184 | typedef integer { |
9e4e34e9 | 185 | size = 32; |
5ba9f198 MD |
186 | signed = false; |
187 | align = 32; | |
80fd2569 | 188 | } uint32_t; |
5ba9f198 | 189 | |
80fd2569 | 190 | Definition of a named 5-bit signed bitfield: |
5ba9f198 | 191 | |
80fd2569 | 192 | typedef integer { |
5ba9f198 MD |
193 | size = 5; |
194 | signed = true; | |
195 | align = 1; | |
80fd2569 | 196 | } int5_t; |
5ba9f198 MD |
197 | |
198 | 4.1.6 GNU/C bitfields | |
199 | ||
200 | The GNU/C bitfields follow closely the integer representation, with a | |
201 | particularity on alignment: if a bitfield cannot fit in the current unit, the | |
80fd2569 MD |
202 | unit is padded and the bitfield starts at the following unit. The unit size is |
203 | defined by the size of the type "unit_type". | |
5ba9f198 | 204 | |
80fd2569 | 205 | Metadata representation. Either: |
5ba9f198 | 206 | |
80fd2569 MD |
207 | gcc_bitfield { |
208 | unit_type = integer { | |
209 | ... | |
210 | }; | |
211 | size = value; | |
3bf79539 | 212 | }; |
5ba9f198 | 213 | |
80fd2569 MD |
214 | Or bitfield within structures as specified by the C standard |
215 | ||
216 | unit_type name:size: | |
217 | ||
5ba9f198 MD |
218 | As an example, the following structure declared in C compiled by GCC: |
219 | ||
220 | struct example { | |
221 | short a:12; | |
222 | short b:5; | |
223 | }; | |
224 | ||
80fd2569 MD |
225 | is equivalent to the following structure declaration, aligned on the largest |
226 | element (short). The second bitfield would be aligned on the next unit boundary, | |
227 | because it would not fit in the current unit. The two declarations (C | |
228 | declaration above or CTF declaration with "type gcc_bitfield") are strictly | |
229 | equivalent. | |
230 | ||
231 | struct example { | |
232 | gcc_bitfield { | |
233 | unit_type = short; | |
234 | size = 12; | |
235 | } a; | |
236 | gcc_bitfield { | |
237 | unit_type = short; | |
238 | size = 5; | |
239 | } b; | |
3bf79539 | 240 | }; |
5ba9f198 MD |
241 | |
242 | 4.1.7 Floating point | |
243 | ||
244 | The floating point values byte ordering is defined in the metadata. | |
245 | ||
246 | Floating point values follow the IEEE 754-2008 standard interchange formats. | |
247 | Description of the floating point values include the exponent and mantissa size | |
248 | in bits. Some requirements are imposed on the floating point values: | |
249 | ||
250 | - FLT_RADIX must be 2. | |
251 | - mant_dig is the number of digits represented in the mantissa. It is specified | |
252 | by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and | |
253 | LDBL_MANT_DIG as defined by <float.h>. | |
254 | - exp_dig is the number of digits represented in the exponent. Given that | |
255 | mant_dig is one bit more than its actual size in bits (leading 1 is not | |
256 | needed) and also given that the sign bit always takes one bit, exp_dig can be | |
257 | specified as: | |
258 | ||
259 | - sizeof(float) * CHAR_BIT - FLT_MANT_DIG | |
260 | - sizeof(double) * CHAR_BIT - DBL_MANT_DIG | |
261 | - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG | |
262 | ||
263 | Metadata representation: | |
264 | ||
80fd2569 | 265 | floating_point { |
5ba9f198 MD |
266 | exp_dig = value; |
267 | mant_dig = value; | |
268 | byte_order = native OR network OR be OR le; | |
3bf79539 | 269 | }; |
5ba9f198 MD |
270 | |
271 | Example of type inheritance: | |
272 | ||
80fd2569 | 273 | typedef floating_point { |
5ba9f198 MD |
274 | exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */ |
275 | mant_dig = 24; /* FLT_MANT_DIG */ | |
276 | byte_order = native; | |
80fd2569 | 277 | } float; |
5ba9f198 MD |
278 | |
279 | TODO: define NaN, +inf, -inf behavior. | |
280 | ||
281 | 4.1.8 Enumerations | |
282 | ||
283 | Enumerations are a mapping between an integer type and a table of strings. The | |
284 | numerical representation of the enumeration follows the integer type specified | |
285 | by the metadata. The enumeration mapping table is detailed in the enumeration | |
3bf79539 MD |
286 | description within the metadata. The mapping table maps inclusive value ranges |
287 | (or single values) to strings. Instead of being limited to simple | |
288 | "value -> string" mappings, these enumerations map | |
80fd2569 | 289 | "[ start_value ... end_value ] -> string", which map inclusive ranges of |
3bf79539 MD |
290 | values to strings. An enumeration from the C language can be represented in |
291 | this format by having the same start_value and end_value for each element, which | |
292 | is in fact a range of size 1. This single-value range is supported without | |
80fd2569 MD |
293 | repeating the start and end values with the value = string declaration. If the |
294 | <integer_type> is omitted, the type chosen by the C compiler to hold the | |
295 | enumeration is used. The <integer_type> specifier can only be omitted for | |
296 | enumerations containing only simple "value -> string" mappings (compatible with | |
297 | C). | |
298 | ||
299 | enum <integer_type> name { | |
300 | string = start_value1 ... end_value1, | |
301 | "other string" = start_value2 ... end_value2, | |
302 | yet_another_string, /* will be assigned to end_value2 + 1 */ | |
303 | "some other string" = value, | |
304 | ... | |
305 | }; | |
306 | ||
307 | If the values are omitted, the enumeration starts at 0 and increment of 1 for | |
308 | each entry: | |
309 | ||
310 | enum { | |
311 | ZERO, | |
312 | ONE, | |
313 | TWO, | |
314 | TEN = 10, | |
315 | ELEVEN, | |
3bf79539 | 316 | }; |
5ba9f198 | 317 | |
80fd2569 | 318 | Overlapping ranges within a single enumeration are implementation defined. |
5ba9f198 MD |
319 | |
320 | 4.2 Compound types | |
321 | ||
322 | 4.2.1 Structures | |
323 | ||
324 | Structures are aligned on the largest alignment required by basic types | |
325 | contained within the structure. (This follows the ISO/C standard for structures) | |
326 | ||
80fd2569 | 327 | Metadata representation of a named structure: |
5ba9f198 | 328 | |
80fd2569 MD |
329 | struct name { |
330 | field_type field_name; | |
331 | field_type field_name; | |
332 | ... | |
333 | }; | |
5ba9f198 MD |
334 | |
335 | Example: | |
336 | ||
80fd2569 MD |
337 | struct example { |
338 | integer { /* Nameless type */ | |
339 | size = 16; | |
340 | signed = true; | |
341 | align = 16; | |
342 | } first_field_name; | |
343 | uint64_t second_field_name; /* Named type declared in the metadata */ | |
3bf79539 | 344 | }; |
5ba9f198 MD |
345 | |
346 | The fields are placed in a sequence next to each other. They each possess a | |
347 | field name, which is a unique identifier within the structure. | |
348 | ||
80fd2569 MD |
349 | A nameless structure can be declared as a field type: |
350 | ||
351 | struct { | |
352 | ... | |
353 | } field_name; | |
354 | ||
5ba9f198 MD |
355 | 4.2.2 Arrays |
356 | ||
357 | Arrays are fixed-length. Their length is declared in the type declaration within | |
358 | the metadata. They contain an array of "inner type" elements, which can refer to | |
359 | any type not containing the type of the array being declared (no circular | |
3bf79539 | 360 | dependency). The length is the number of elements in an array. |
5ba9f198 | 361 | |
80fd2569 | 362 | Metadata representation of a named array, either: |
5ba9f198 | 363 | |
80fd2569 | 364 | typedef array { |
5ba9f198 MD |
365 | length = value; |
366 | elem_type = type; | |
80fd2569 MD |
367 | } name; |
368 | ||
369 | or: | |
370 | ||
371 | typedef elem_type name[length]; | |
5ba9f198 MD |
372 | |
373 | E.g.: | |
374 | ||
80fd2569 | 375 | typedef array { |
5ba9f198 MD |
376 | length = 10; |
377 | elem_type = uint32_t; | |
80fd2569 MD |
378 | } example; |
379 | ||
380 | A nameless array can be declared as a field type, e.g.: | |
381 | ||
382 | array { | |
383 | length = 5; | |
384 | elem_type = uint8_t; | |
385 | } field_name; | |
386 | ||
387 | or | |
388 | ||
389 | uint8_t field_name[10]; | |
390 | ||
5ba9f198 MD |
391 | |
392 | 4.2.3 Sequences | |
393 | ||
394 | Sequences are dynamically-sized arrays. They start with an integer that specify | |
395 | the length of the sequence, followed by an array of "inner type" elements. | |
3bf79539 | 396 | The length is the number of elements in the sequence. |
5ba9f198 | 397 | |
80fd2569 MD |
398 | Metadata representation for a named sequence, either: |
399 | ||
400 | typedef sequence { | |
401 | length_type = type; /* integer class */ | |
5ba9f198 | 402 | elem_type = type; |
80fd2569 MD |
403 | } name; |
404 | ||
405 | or: | |
406 | ||
407 | typedef elem_type name[length_type]; | |
408 | ||
409 | A nameless sequence can be declared as a field type, e.g.: | |
410 | ||
411 | sequence { | |
412 | length_type = int; | |
413 | elem_type = long; | |
414 | } field_name; | |
415 | ||
416 | or | |
5ba9f198 | 417 | |
80fd2569 MD |
418 | long field_name[int]; |
419 | ||
420 | The length type follows the integer types specifications, and the sequence | |
5ba9f198 MD |
421 | elements follow the "array" specifications. |
422 | ||
423 | 4.2.4 Strings | |
424 | ||
425 | Strings are an array of bytes of variable size and are terminated by a '\0' | |
426 | "NULL" character. Their encoding is described in the metadata. In absence of | |
427 | encoding attribute information, the default encoding is UTF-8. | |
428 | ||
80fd2569 MD |
429 | Metadata representation of a named string type: |
430 | ||
431 | typedef string { | |
5ba9f198 | 432 | encoding = UTF8 OR ASCII; |
80fd2569 | 433 | } name; |
5ba9f198 | 434 | |
80fd2569 MD |
435 | A nameless string type can be declared as a field type: |
436 | ||
437 | string field_name; /* Use default UTF8 encoding */ | |
5ba9f198 | 438 | |
3bf79539 MD |
439 | 5. Event Packet Header |
440 | ||
441 | The event packet header consists of two part: one is mandatory and have a fixed | |
442 | layout. The second part, the "event packet context", has its layout described in | |
443 | the metadata. | |
5ba9f198 | 444 | |
3bf79539 MD |
445 | - Aligned on page size. Fixed size. Fields either aligned or packed (depending |
446 | on the architecture preference). | |
447 | No padding at the end of the event packet header. Native architecture byte | |
5ba9f198 | 448 | ordering. |
3bf79539 MD |
449 | |
450 | Fixed layout (event packet header): | |
451 | ||
5ba9f198 MD |
452 | - Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness |
453 | representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise | |
454 | representation. Used to distinguish between big and little endian traces (this | |
455 | information is determined by knowing the endianness of the architecture | |
456 | reading the trace and comparing the magic number against its value and the | |
457 | reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata | |
458 | description language described in this document. Different magic numbers | |
459 | should be used for other metadata description languages. | |
3bf79539 | 460 | - Trace UUID, used to ensure the event packet match the metadata used. |
5ba9f198 MD |
461 | (note: we cannot use a metadata checksum because metadata can be appended to |
462 | while tracing is active) | |
3bf79539 MD |
463 | - Stream ID, used as reference to stream description in metadata. |
464 | ||
465 | Metadata-defined layout (event packet context): | |
466 | ||
467 | - Event packet content size (in bytes). | |
468 | - Event packet size (in bytes, includes padding). | |
469 | - Event packet content checksum (optional). Checksum excludes the event packet | |
470 | header. | |
471 | - Per-stream event packet sequence count (to deal with UDP packet loss). The | |
472 | number of significant sequence counter bits should also be present, so | |
473 | wrap-arounds are deal with correctly. | |
474 | - Timestamp at the beginning and timestamp at the end of the event packet. | |
475 | Both timestamps are written in the packet header, but sampled respectively | |
476 | while (or before) writing the first event and while (or after) writing the | |
477 | last event in the packet. The inclusive range between these timestamps should | |
478 | include all event timestamps assigned to events contained within the packet. | |
5ba9f198 | 479 | - Events discarded count |
3bf79539 MD |
480 | - Snapshot of a per-stream free-running counter, counting the number of |
481 | events discarded that were supposed to be written in the stream prior to | |
482 | the first event in the event packet. | |
5ba9f198 | 483 | * Note: producer-consumer buffer full condition should fill the current |
3bf79539 | 484 | event packet with padding so we know exactly where events have been |
5ba9f198 | 485 | discarded. |
3bf79539 MD |
486 | - Lossless compression scheme used for the event packet content. Applied |
487 | directly to raw data. New types of compression can be added in following | |
488 | versions of the format. | |
5ba9f198 MD |
489 | 0: no compression scheme |
490 | 1: bzip2 | |
491 | 2: gzip | |
3bf79539 MD |
492 | 3: xz |
493 | - Cypher used for the event packet content. Applied after compression. | |
5ba9f198 MD |
494 | 0: no encryption |
495 | 1: AES | |
3bf79539 | 496 | - Checksum scheme used for the event packet content. Applied after encryption. |
5ba9f198 MD |
497 | 0: no checksum |
498 | 1: md5 | |
499 | 2: sha1 | |
500 | 3: crc32 | |
501 | ||
3bf79539 MD |
502 | 5.1 Event Packet Header Fixed Layout Description |
503 | ||
80fd2569 MD |
504 | struct event_packet_header { |
505 | uint32_t magic; | |
506 | uint8_t trace_uuid[16]; | |
3bf79539 | 507 | uint32_t stream_id; |
80fd2569 | 508 | }; |
5ba9f198 | 509 | |
3bf79539 MD |
510 | 5.2 Event Packet Context Description |
511 | ||
512 | Event packet context example. These are declared within the stream declaration | |
513 | in the metadata. All these fields are optional except for "content_size" and | |
514 | "packet_size", which must be present in the context. | |
515 | ||
516 | An example event packet context type: | |
517 | ||
80fd2569 | 518 | struct event_packet_context { |
3bf79539 MD |
519 | uint64_t timestamp_begin; |
520 | uint64_t timestamp_end; | |
521 | uint32_t checksum; | |
522 | uint32_t stream_packet_count; | |
523 | uint32_t events_discarded; | |
524 | uint32_t cpu_id; | |
525 | uint32_t/uint16_t content_size; | |
526 | uint32_t/uint16_t packet_size; | |
527 | uint8_t stream_packet_count_bits; /* Significant counter bits */ | |
528 | uint8_t compression_scheme; | |
529 | uint8_t encryption_scheme; | |
530 | uint8_t checksum; | |
531 | }; | |
5ba9f198 MD |
532 | |
533 | 6. Event Structure | |
534 | ||
535 | The overall structure of an event is: | |
536 | ||
3bf79539 | 537 | - Event Header (as specifed by the stream metadata) |
5ba9f198 | 538 | - Extended Event Header (as specified by the event header) |
3bf79539 | 539 | - Event Context (as specified by the stream metadata) |
5ba9f198 MD |
540 | - Event Payload (as specified by the event metadata) |
541 | ||
542 | ||
543 | 6.1 Event Header | |
544 | ||
3bf79539 MD |
545 | One major factor can vary between streams: the number of event IDs assigned to |
546 | a stream. Luckily, this information tends to stay relatively constant (modulo | |
5ba9f198 | 547 | event registration while trace is being recorded), so we can specify different |
3bf79539 | 548 | representations for streams containing few event IDs and streams containing |
5ba9f198 MD |
549 | many event IDs, so we end up representing the event ID and timestamp as densely |
550 | as possible in each case. | |
551 | ||
3bf79539 MD |
552 | We therefore provide two types of events headers. Type 1 accommodates streams |
553 | with less than 31 event IDs. Type 2 accommodates streams with 31 or more event | |
5ba9f198 MD |
554 | IDs. |
555 | ||
556 | The "extended headers" are used in the rare occasions where the information | |
3bf79539 MD |
557 | cannot be represented in the ranges available in the event header. They are also |
558 | used in the rare occasions where the data required for a field could not be | |
559 | collected: the flag corresponding to the missing field within the missing_fields | |
560 | array is then set to 1. | |
5ba9f198 MD |
561 | |
562 | Types uintX_t represent an X-bit unsigned integer. | |
563 | ||
564 | ||
565 | 6.1.1 Type 1 - Few event IDs | |
566 | ||
567 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
568 | preference). | |
569 | - Fixed size: 32 bits. | |
570 | - Native architecture byte ordering. | |
571 | ||
80fd2569 MD |
572 | struct event_header_1 { |
573 | uint5_t id; /* | |
5ba9f198 MD |
574 | * id: range: 0 - 30. |
575 | * id 31 is reserved to indicate a following | |
576 | * extended header. | |
577 | */ | |
80fd2569 | 578 | uint27_t timestamp; |
5ba9f198 MD |
579 | }; |
580 | ||
581 | The end of a type 1 header is aligned on a 32-bit boundary (or packed). | |
582 | ||
583 | ||
584 | 6.1.2 Extended Type 1 Event Header | |
585 | ||
586 | - Follows struct event_header_1, which is aligned on 32-bit, so no need to | |
587 | realign. | |
3bf79539 | 588 | - Variable size (depends on the number of fields per event). |
5ba9f198 | 589 | - Native architecture byte ordering. |
80fd2569 | 590 | - NR_FIELDS is the number of fields within the event. |
5ba9f198 | 591 | |
80fd2569 MD |
592 | struct event_header_1_ext { |
593 | uint32_t id; /* 32-bit event IDs */ | |
594 | uint64_t timestamp; /* 64-bit timestamps */ | |
595 | uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */ | |
5ba9f198 MD |
596 | }; |
597 | ||
5ba9f198 MD |
598 | |
599 | 6.1.3 Type 2 - Many event IDs | |
600 | ||
601 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
602 | preference). | |
603 | - Fixed size: 48 bits. | |
604 | - Native architecture byte ordering. | |
605 | ||
80fd2569 MD |
606 | struct event_header_2 { |
607 | uint32_t timestamp; | |
608 | uint16_t id; /* | |
5ba9f198 MD |
609 | * id: range: 0 - 65534. |
610 | * id 65535 is reserved to indicate a following | |
611 | * extended header. | |
612 | */ | |
5ba9f198 MD |
613 | }; |
614 | ||
615 | The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if | |
616 | byte-packed). | |
617 | ||
618 | ||
619 | 6.1.4 Extended Type 2 Event Header | |
620 | ||
621 | - Follows struct event_header_2, which alignment end on a 16-bit boundary, so | |
3bf79539 | 622 | we need to align on 64-bit integer architecture alignment (or 8-bit if |
5ba9f198 | 623 | byte-packed). |
3bf79539 | 624 | - Variable size (depends on the number of fields per event). |
5ba9f198 | 625 | - Native architecture byte ordering. |
80fd2569 | 626 | - NR_FIELDS is the number of fields within the event. |
5ba9f198 | 627 | |
80fd2569 MD |
628 | struct event_header_2_ext { |
629 | uint64_t timestamp; /* 64-bit timestamps */ | |
630 | uint32_t id; /* 32-bit event IDs */ | |
631 | uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */ | |
5ba9f198 MD |
632 | }; |
633 | ||
5ba9f198 MD |
634 | |
635 | 6.2 Event Context | |
636 | ||
637 | The event context contains information relative to the current event. The choice | |
3bf79539 | 638 | and meaning of this information is specified by the metadata "stream" |
5ba9f198 | 639 | information. For this trace format, event context is usually empty, except when |
3bf79539 | 640 | the metadata "stream" information specifies otherwise by declaring a non-empty |
5ba9f198 MD |
641 | structure for the event context. An example of event context is to save the |
642 | event payload size with each event, or to save the current PID with each event. | |
3bf79539 | 643 | These are declared within the stream declaration within the metadata. |
5ba9f198 | 644 | |
3bf79539 | 645 | An example event context type: |
5ba9f198 | 646 | |
80fd2569 MD |
647 | struct event_context { |
648 | uint pid; | |
649 | uint16_t payload_size; | |
3bf79539 | 650 | }; |
5ba9f198 MD |
651 | |
652 | ||
653 | 6.3 Event Payload | |
654 | ||
655 | An event payload contains fields specific to a given event type. The fields | |
656 | belonging to an event type are described in the event-specific metadata | |
657 | within a structure type. | |
658 | ||
659 | 6.3.1 Padding | |
660 | ||
661 | No padding at the end of the event payload. This differs from the ISO/C standard | |
662 | for structures, but follows the CTF standard for structures. In a trace, even | |
663 | though it makes sense to align the beginning of a structure, it really makes no | |
664 | sense to add padding at the end of the structure, because structures are usually | |
665 | not followed by a structure of the same type. | |
666 | ||
667 | This trick can be done by adding a zero-length "end" field at the end of the C | |
668 | structures, and by using the offset of this field rather than using sizeof() | |
3bf79539 | 669 | when calculating the size of a structure (see Appendix "A. Helper macros"). |
5ba9f198 MD |
670 | |
671 | 6.3.2 Alignment | |
672 | ||
673 | The event payload is aligned on the largest alignment required by types | |
674 | contained within the payload. (This follows the ISO/C standard for structures) | |
675 | ||
676 | ||
677 | ||
678 | 7. Metadata | |
679 | ||
3bf79539 MD |
680 | The meta-data is located in a stream named "metadata". It is made of "event |
681 | packets", which each start with an event packet header. The event type within | |
682 | the metadata stream have no event header nor event context. Each event only | |
5ba9f198 | 683 | contains a null-terminated "string" payload, which is a metadata description |
3bf79539 MD |
684 | entry. The events are packed one next to another. Each event packet start with |
685 | an event packet header, which contains, amongst other fields, the magic number | |
686 | and trace UUID. | |
5ba9f198 MD |
687 | |
688 | The metadata can be parsed by reading through the metadata strings, skipping | |
3bf79539 | 689 | newlines and null-characters. Type names may contain spaces. |
5ba9f198 MD |
690 | |
691 | trace { | |
692 | major = value; /* Trace format version */ | |
693 | minor = value; | |
3bf79539 MD |
694 | uuid = value; /* Trace UUID */ |
695 | word_size = value; | |
696 | }; | |
5ba9f198 | 697 | |
3bf79539 MD |
698 | stream { |
699 | id = stream_id; | |
5ba9f198 | 700 | event { |
3bf79539 MD |
701 | /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */ |
702 | header_type = event_header_1 OR event_header_2; | |
703 | /* | |
704 | * Extended event header type. Only present if specified in event header | |
705 | * on a per-event basis. | |
706 | */ | |
707 | header_type_ext = event_header_1_ext OR event_header_2_ext; | |
80fd2569 MD |
708 | context_type = struct { |
709 | ... | |
710 | }; | |
3bf79539 MD |
711 | }; |
712 | packet { | |
80fd2569 MD |
713 | context_type = struct { |
714 | ... | |
715 | }; | |
3bf79539 MD |
716 | }; |
717 | }; | |
5ba9f198 MD |
718 | |
719 | event { | |
3bf79539 MD |
720 | name = eventname; |
721 | id = value; /* Numeric identifier within the stream */ | |
722 | stream = stream_id; | |
80fd2569 MD |
723 | fields = struct { |
724 | ... | |
725 | }; | |
3bf79539 | 726 | }; |
5ba9f198 MD |
727 | |
728 | /* More detail on types in section 4. Types */ | |
729 | ||
730 | /* Named types */ | |
80fd2569 MD |
731 | typedef some existing type new_type; |
732 | ||
733 | typedef type_class { | |
734 | ... | |
735 | } new_type; | |
736 | ||
737 | struct name { | |
3bf79539 MD |
738 | ... |
739 | }; | |
5ba9f198 | 740 | |
80fd2569 | 741 | enum name { |
3bf79539 MD |
742 | ... |
743 | }; | |
744 | ||
80fd2569 MD |
745 | /* Unnamed types, contained within compound type fields or type assignments. */ |
746 | struct { | |
747 | ... | |
748 | }; | |
5ba9f198 | 749 | |
80fd2569 MD |
750 | enum { |
751 | ... | |
752 | }; | |
3bf79539 | 753 | |
80fd2569 MD |
754 | array { |
755 | ... | |
756 | }; | |
3bf79539 | 757 | |
80fd2569 MD |
758 | sequence { |
759 | ... | |
760 | }; | |
3bf79539 MD |
761 | |
762 | A. Helper macros | |
5ba9f198 MD |
763 | |
764 | The two following macros keep track of the size of a GNU/C structure without | |
765 | padding at the end by placing HEADER_END as the last field. A one byte end field | |
766 | is used for C90 compatibility (C99 flexible arrays could be used here). Note | |
767 | that this does not affect the effective structure size, which should always be | |
768 | calculated with the header_sizeof() helper. | |
769 | ||
770 | #define HEADER_END char end_field | |
771 | #define header_sizeof(type) offsetof(typeof(type), end_field) | |
3bf79539 MD |
772 | |
773 | ||
774 | B. Stream Header Rationale | |
775 | ||
776 | An event stream is divided in contiguous event packets of variable size. These | |
777 | subdivisions allow the trace analyzer to perform a fast binary search by time | |
778 | within the stream (typically requiring to index only the event packet headers) | |
779 | without reading the whole stream. These subdivisions have a variable size to | |
780 | eliminate the need to transfer the event packet padding when partially filled | |
781 | event packets must be sent when streaming a trace for live viewing/analysis. | |
782 | An event packet can contain a certain amount of padding at the end. Dividing | |
783 | streams into event packets is also useful for network streaming over UDP and | |
784 | flight recorder mode tracing (a whole event packet can be swapped out of the | |
785 | buffer atomically for reading). | |
786 | ||
787 | The stream header is repeated at the beginning of each event packet to allow | |
788 | flexibility in terms of: | |
789 | ||
790 | - streaming support, | |
791 | - allowing arbitrary buffers to be discarded without making the trace | |
792 | unreadable, | |
793 | - allow UDP packet loss handling by either dealing with missing event packet | |
794 | or asking for re-transmission. | |
795 | - transparently support flight recorder mode, | |
796 | - transparently support crash dump. | |
797 | ||
798 | The event stream header will therefore be referred to as the "event packet | |
799 | header" throughout the rest of this document. |