2 RFC: Common Trace Format (CTF) Proposal (v1.6)
4 Mathieu Desnoyers, EfficiOS Inc.
6 The goal of the present document is to propose a trace format that suits the
7 needs of the embedded, telecom, high-performance and kernel communities. It is
8 based on the Common Trace Format Requirements (v1.4) document. It is designed to
9 allow traces to be natively generated by the Linux kernel, Linux user-space
10 applications written in C/C++, and hardware components.
12 The latest version of this document can be found at:
14 git tree: git://git.efficios.com/ctf.git
15 gitweb: http://git.efficios.com/?p=ctf.git
17 A reference implementation of a library to read and write this trace format is
18 being implemented within the BabelTrace project, a converter between trace
19 formats. The development tree is available at:
21 git tree: git://git.efficios.com/babeltrace.git
22 gitweb: http://git.efficios.com/?p=babeltrace.git
25 1. Preliminary definitions
27 - Event Trace: An ordered sequence of events.
28 - Event Stream: An ordered sequence of events, containing a subset of the
30 - Event Packet: A sequence of physically contiguous events within an event
32 - Event: This is the basic entry in a trace. (aka: a trace record).
33 - An event identifier (ID) relates to the class (a type) of event within
35 e.g. event: irq_entry.
36 - An event (or event record) relates to a specific instance of an event
38 e.g. event: irq_entry, at time X, on CPU Y
39 - Source Architecture: Architecture writing the trace.
40 - Reader Architecture: Architecture reading the trace.
43 2. High-level representation of a trace
45 A trace is divided into multiple event streams. Each event stream contains a
46 subset of the trace event types.
48 The final output of the trace, after its generation and optional transport over
49 the network, is expected to be either on permanent or temporary storage in a
50 virtual file system. Because each event stream is appended to while a trace is
51 being recorded, each is associated with a separate file for output. Therefore,
52 a stored trace can be represented as a directory containing one file per stream.
54 A metadata event stream contains information on trace event types. It describes:
58 - Per-stream event header description.
59 - Per-stream event header selection.
60 - Per-stream event context fields.
62 - Event type to stream mapping.
63 - Event type to name mapping.
64 - Event type to ID mapping.
65 - Event fields description.
70 An event stream is divided in contiguous event packets of variable size. These
71 subdivisions have a variable size. An event packet can contain a certain amount
72 of padding at the end. The rationale for the event stream design choices is
73 explained in Appendix B. Stream Header Rationale.
75 An event stream is divided in contiguous event packets of variable size. These
76 subdivisions have a variable size. An event packet can contain a certain amount
77 of padding at the end. The stream header is repeated at the beginning of each
80 The event stream header will therefore be referred to as the "event packet
81 header" throughout the rest of this document.
88 A basic type is a scalar type, as described in this section.
90 4.1.1 Type inheritance
92 Type specifications can be inherited to allow deriving types from a
93 type class. For example, see the uint32_t named type derived from the "integer"
94 type class below ("Integers" section). Types have a precise binary
95 representation in the trace. A type class has methods to read and write these
96 types, but must be derived into a type to be usable in an event field.
100 We define "byte-packed" types as aligned on the byte size, namely 8-bit.
101 We define "bit-packed" types as following on the next bit, as defined by the
104 All basic types, except bitfields, are either aligned on an architecture-defined
105 specific alignment or byte-packed, depending on the architecture preference.
106 Architectures providing fast unaligned write byte-packed basic types to save
107 space, aligning each type on byte boundaries (8-bit). Architectures with slow
108 unaligned writes align types on specific alignment values. If no specific
109 alignment is declared for a type nor its parents, it is assumed to be bit-packed
110 for bitfields and byte-packed for other types.
112 Metadata attribute representation of a specific alignment:
114 align = value; /* value in bits */
118 By default, the native endianness of the source architecture the trace is used.
119 Byte order can be overridden for a basic type by specifying a "byte_order"
120 attribute. Typical use-case is to specify the network byte order (big endian:
121 "be") to save data captured from the network into the trace without conversion.
122 If not specified, the byte order is native.
124 Metadata representation:
126 byte_order = native OR network OR be OR le; /* network and be are aliases */
130 Type size, in bits, for integers and floats is that returned by "sizeof()" in C
131 multiplied by CHAR_BIT.
132 We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed
133 to 8 bits for cross-endianness compatibility.
135 Metadata representation:
137 size = value; (value is in bits)
141 Signed integers are represented in two-complement. Integer alignment, size,
142 signedness and byte ordering are defined in the metadata. Integers aligned on
143 byte size (8-bit) and with length multiple of byte size (8-bit) correspond to
144 the C99 standard integers. In addition, integers with alignment and/or size that
145 are _not_ a multiple of the byte size are permitted; these correspond to the C99
146 standard bitfields, with the added specification that the CTF integer bitfields
147 have a fixed binary representation. A MIT-licensed reference implementation of
148 the CTF portable bitfields is available at:
150 http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h
152 Binary representation of integers:
154 - On little and big endian:
155 - Within a byte, high bits correspond to an integer high bits, and low bits
156 correspond to low bits.
158 - Integer across multiple bytes are placed from the less significant to the
160 - Consecutive integers are placed from lower bits to higher bits (even within
163 - Integer across multiple bytes are placed from the most significant to the
165 - Consecutive integers are placed from higher bits to lower bits (even within
168 This binary representation is derived from the bitfield implementation in GCC
169 for little and big endian. However, contrary to what GCC does, integers can
170 cross units boundaries (no padding is required). Padding can be explicitely
171 added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed.
173 Metadata representation:
176 signed = true OR false; /* default false */
177 byte_order = native OR network OR be OR le; /* default native */
178 size = value; /* value in bits, no default */
179 align = value; /* value in bits */
182 Example of type inheritance (creation of a uint32_t named type):
190 Definition of a named 5-bit signed bitfield:
198 4.1.6 GNU/C bitfields
200 The GNU/C bitfields follow closely the integer representation, with a
201 particularity on alignment: if a bitfield cannot fit in the current unit, the
202 unit is padded and the bitfield starts at the following unit. The unit size is
203 defined by the size of the type "unit_type".
205 Metadata representation:
209 As an example, the following structure declared in C compiled by GCC:
216 The example structure is aligned on the largest element (short). The second
217 bitfield would be aligned on the next unit boundary, because it would not fit in
222 The floating point values byte ordering is defined in the metadata.
224 Floating point values follow the IEEE 754-2008 standard interchange formats.
225 Description of the floating point values include the exponent and mantissa size
226 in bits. Some requirements are imposed on the floating point values:
228 - FLT_RADIX must be 2.
229 - mant_dig is the number of digits represented in the mantissa. It is specified
230 by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and
231 LDBL_MANT_DIG as defined by <float.h>.
232 - exp_dig is the number of digits represented in the exponent. Given that
233 mant_dig is one bit more than its actual size in bits (leading 1 is not
234 needed) and also given that the sign bit always takes one bit, exp_dig can be
237 - sizeof(float) * CHAR_BIT - FLT_MANT_DIG
238 - sizeof(double) * CHAR_BIT - DBL_MANT_DIG
239 - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG
241 Metadata representation:
246 byte_order = native OR network OR be OR le;
249 Example of type inheritance:
251 typedef floating_point {
252 exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */
253 mant_dig = 24; /* FLT_MANT_DIG */
257 TODO: define NaN, +inf, -inf behavior.
261 Enumerations are a mapping between an integer type and a table of strings. The
262 numerical representation of the enumeration follows the integer type specified
263 by the metadata. The enumeration mapping table is detailed in the enumeration
264 description within the metadata. The mapping table maps inclusive value ranges
265 (or single values) to strings. Instead of being limited to simple
266 "value -> string" mappings, these enumerations map
267 "[ start_value ... end_value ] -> string", which map inclusive ranges of
268 values to strings. An enumeration from the C language can be represented in
269 this format by having the same start_value and end_value for each element, which
270 is in fact a range of size 1. This single-value range is supported without
271 repeating the start and end values with the value = string declaration. If the
272 <integer_type> is omitted, the type chosen by the C compiler to hold the
273 enumeration is used. The <integer_type> specifier can only be omitted for
274 enumerations containing only simple "value -> string" mappings (compatible with
277 enum <integer_type> name {
278 string = start_value1 ... end_value1,
279 "other string" = start_value2 ... end_value2,
280 yet_another_string, /* will be assigned to end_value2 + 1 */
281 "some other string" = value,
285 If the values are omitted, the enumeration starts at 0 and increment of 1 for
296 Overlapping ranges within a single enumeration are implementation defined.
298 A nameless enumeration can be declared as a field type or as part of a typedef:
300 enum <integer_type> {
308 Structures are aligned on the largest alignment required by basic types
309 contained within the structure. (This follows the ISO/C standard for structures)
311 Metadata representation of a named structure:
314 field_type field_name;
315 field_type field_name;
322 integer { /* Nameless type */
327 uint64_t second_field_name; /* Named type declared in the metadata */
330 The fields are placed in a sequence next to each other. They each possess a
331 field name, which is a unique identifier within the structure.
333 A nameless structure can be declared as a field type or as part of a typedef:
341 Arrays are fixed-length. Their length is declared in the type declaration within
342 the metadata. They contain an array of "inner type" elements, which can refer to
343 any type not containing the type of the array being declared (no circular
344 dependency). The length is the number of elements in an array.
346 Metadata representation of a named array:
348 typedef elem_type name[length];
350 A nameless array can be declared as a field type within a structure, e.g.:
352 uint8_t field_name[10];
357 Sequences are dynamically-sized arrays. They start with an integer that specify
358 the length of the sequence, followed by an array of "inner type" elements.
359 The length is the number of elements in the sequence.
361 Metadata representation for a named sequence:
363 typedef elem_type name[length_type];
365 A nameless sequence can be declared as a field type, e.g.:
367 long field_name[int];
369 The length type follows the integer types specifications, and the sequence
370 elements follow the "array" specifications.
374 Strings are an array of bytes of variable size and are terminated by a '\0'
375 "NULL" character. Their encoding is described in the metadata. In absence of
376 encoding attribute information, the default encoding is UTF-8.
378 Metadata representation of a named string type:
381 encoding = UTF8 OR ASCII;
384 A nameless string type can be declared as a field type:
386 string field_name; /* Use default UTF8 encoding */
388 5. Event Packet Header
390 The event packet header consists of two part: one is mandatory and have a fixed
391 layout. The second part, the "event packet context", has its layout described in
394 - Aligned on page size. Fixed size. Fields either aligned or packed (depending
395 on the architecture preference).
396 No padding at the end of the event packet header. Native architecture byte
399 Fixed layout (event packet header):
401 - Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness
402 representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise
403 representation. Used to distinguish between big and little endian traces (this
404 information is determined by knowing the endianness of the architecture
405 reading the trace and comparing the magic number against its value and the
406 reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata
407 description language described in this document. Different magic numbers
408 should be used for other metadata description languages.
409 - Trace UUID, used to ensure the event packet match the metadata used.
410 (note: we cannot use a metadata checksum because metadata can be appended to
411 while tracing is active)
412 - Stream ID, used as reference to stream description in metadata.
414 Metadata-defined layout (event packet context):
416 - Event packet content size (in bytes).
417 - Event packet size (in bytes, includes padding).
418 - Event packet content checksum (optional). Checksum excludes the event packet
420 - Per-stream event packet sequence count (to deal with UDP packet loss). The
421 number of significant sequence counter bits should also be present, so
422 wrap-arounds are deal with correctly.
423 - Timestamp at the beginning and timestamp at the end of the event packet.
424 Both timestamps are written in the packet header, but sampled respectively
425 while (or before) writing the first event and while (or after) writing the
426 last event in the packet. The inclusive range between these timestamps should
427 include all event timestamps assigned to events contained within the packet.
428 - Events discarded count
429 - Snapshot of a per-stream free-running counter, counting the number of
430 events discarded that were supposed to be written in the stream prior to
431 the first event in the event packet.
432 * Note: producer-consumer buffer full condition should fill the current
433 event packet with padding so we know exactly where events have been
435 - Lossless compression scheme used for the event packet content. Applied
436 directly to raw data. New types of compression can be added in following
437 versions of the format.
438 0: no compression scheme
442 - Cypher used for the event packet content. Applied after compression.
445 - Checksum scheme used for the event packet content. Applied after encryption.
451 5.1 Event Packet Header Fixed Layout Description
453 struct event_packet_header {
455 uint8_t trace_uuid[16];
459 5.2 Event Packet Context Description
461 Event packet context example. These are declared within the stream declaration
462 in the metadata. All these fields are optional except for "content_size" and
463 "packet_size", which must be present in the context.
465 An example event packet context type:
467 struct event_packet_context {
468 uint64_t timestamp_begin;
469 uint64_t timestamp_end;
471 uint32_t stream_packet_count;
472 uint32_t events_discarded;
474 uint32_t/uint16_t content_size;
475 uint32_t/uint16_t packet_size;
476 uint8_t stream_packet_count_bits; /* Significant counter bits */
477 uint8_t compression_scheme;
478 uint8_t encryption_scheme;
484 The overall structure of an event is:
486 - Event Header (as specifed by the stream metadata)
487 - Extended Event Header (as specified by the event header)
488 - Event Context (as specified by the stream metadata)
489 - Event Payload (as specified by the event metadata)
494 One major factor can vary between streams: the number of event IDs assigned to
495 a stream. Luckily, this information tends to stay relatively constant (modulo
496 event registration while trace is being recorded), so we can specify different
497 representations for streams containing few event IDs and streams containing
498 many event IDs, so we end up representing the event ID and timestamp as densely
499 as possible in each case.
501 We therefore provide two types of events headers. Type 1 accommodates streams
502 with less than 31 event IDs. Type 2 accommodates streams with 31 or more event
505 The "extended headers" are used in the rare occasions where the information
506 cannot be represented in the ranges available in the event header. They are also
507 used in the rare occasions where the data required for a field could not be
508 collected: the flag corresponding to the missing field within the missing_fields
509 array is then set to 1.
511 Types uintX_t represent an X-bit unsigned integer.
514 6.1.1 Type 1 - Few event IDs
516 - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture
518 - Fixed size: 32 bits.
519 - Native architecture byte ordering.
521 struct event_header_1 {
524 * id 31 is reserved to indicate a following
530 The end of a type 1 header is aligned on a 32-bit boundary (or packed).
533 6.1.2 Extended Type 1 Event Header
535 - Follows struct event_header_1, which is aligned on 32-bit, so no need to
537 - Variable size (depends on the number of fields per event).
538 - Native architecture byte ordering.
539 - NR_FIELDS is the number of fields within the event.
541 struct event_header_1_ext {
542 uint32_t id; /* 32-bit event IDs */
543 uint64_t timestamp; /* 64-bit timestamps */
544 uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */
548 6.1.3 Type 2 - Many event IDs
550 - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture
552 - Fixed size: 48 bits.
553 - Native architecture byte ordering.
555 struct event_header_2 {
558 * id: range: 0 - 65534.
559 * id 65535 is reserved to indicate a following
564 The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if
568 6.1.4 Extended Type 2 Event Header
570 - Follows struct event_header_2, which alignment end on a 16-bit boundary, so
571 we need to align on 64-bit integer architecture alignment (or 8-bit if
573 - Variable size (depends on the number of fields per event).
574 - Native architecture byte ordering.
575 - NR_FIELDS is the number of fields within the event.
577 struct event_header_2_ext {
578 uint64_t timestamp; /* 64-bit timestamps */
579 uint32_t id; /* 32-bit event IDs */
580 uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */
586 The event context contains information relative to the current event. The choice
587 and meaning of this information is specified by the metadata "stream"
588 information. For this trace format, event context is usually empty, except when
589 the metadata "stream" information specifies otherwise by declaring a non-empty
590 structure for the event context. An example of event context is to save the
591 event payload size with each event, or to save the current PID with each event.
592 These are declared within the stream declaration within the metadata.
594 An example event context type:
596 struct event_context {
598 uint16_t payload_size;
604 An event payload contains fields specific to a given event type. The fields
605 belonging to an event type are described in the event-specific metadata
606 within a structure type.
610 No padding at the end of the event payload. This differs from the ISO/C standard
611 for structures, but follows the CTF standard for structures. In a trace, even
612 though it makes sense to align the beginning of a structure, it really makes no
613 sense to add padding at the end of the structure, because structures are usually
614 not followed by a structure of the same type.
616 This trick can be done by adding a zero-length "end" field at the end of the C
617 structures, and by using the offset of this field rather than using sizeof()
618 when calculating the size of a structure (see Appendix "A. Helper macros").
622 The event payload is aligned on the largest alignment required by types
623 contained within the payload. (This follows the ISO/C standard for structures)
629 The meta-data is located in a stream named "metadata". It is made of "event
630 packets", which each start with an event packet header. The event type within
631 the metadata stream have no event header nor event context. Each event only
632 contains a null-terminated "string" payload, which is a metadata description
633 entry. The events are packed one next to another. Each event packet start with
634 an event packet header, which contains, amongst other fields, the magic number
637 The metadata can be parsed by reading through the metadata strings, skipping
638 newlines and null-characters. Type names may contain spaces.
641 major = value; /* Trace format version */
643 uuid = value; /* Trace UUID */
650 /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */
651 header_type = event_header_1 OR event_header_2;
653 * Extended event header type. Only present if specified in event header
654 * on a per-event basis.
656 header_type_ext = event_header_1_ext OR event_header_2_ext;
657 context_type = struct {
662 context_type = struct {
670 id = value; /* Numeric identifier within the stream */
677 /* More detail on types in section 4. Types */
682 * A named type can only have a prefix and postfix if it aliases a CTF basic
683 * type. A type name aliasing another type name cannot have prefix nor postfix,
684 * but the type aliased can have a prefix and/or postfix.
687 typedef aliased_type_prefix aliased_type new_type aliased_type_postfix;
689 /* e.g.: typedef struct example new_type_name[10]; */
693 } new_type_prefix new_type new_type_postfix;
708 enum <integer_type> name {
713 /* Unnamed types, contained within compound type fields or typedef. */
719 enum <integer_type> {
723 typedef type new_type[length];
726 type field_name[length];
729 typedef type new_type[length_type];
732 type field_name[length_type];
744 integer_type field_name:size; /* GNU/C bitfield */
753 The two following macros keep track of the size of a GNU/C structure without
754 padding at the end by placing HEADER_END as the last field. A one byte end field
755 is used for C90 compatibility (C99 flexible arrays could be used here). Note
756 that this does not affect the effective structure size, which should always be
757 calculated with the header_sizeof() helper.
759 #define HEADER_END char end_field
760 #define header_sizeof(type) offsetof(typeof(type), end_field)
763 B. Stream Header Rationale
765 An event stream is divided in contiguous event packets of variable size. These
766 subdivisions allow the trace analyzer to perform a fast binary search by time
767 within the stream (typically requiring to index only the event packet headers)
768 without reading the whole stream. These subdivisions have a variable size to
769 eliminate the need to transfer the event packet padding when partially filled
770 event packets must be sent when streaming a trace for live viewing/analysis.
771 An event packet can contain a certain amount of padding at the end. Dividing
772 streams into event packets is also useful for network streaming over UDP and
773 flight recorder mode tracing (a whole event packet can be swapped out of the
774 buffer atomically for reading).
776 The stream header is repeated at the beginning of each event packet to allow
777 flexibility in terms of:
780 - allowing arbitrary buffers to be discarded without making the trace
782 - allow UDP packet loss handling by either dealing with missing event packet
783 or asking for re-transmission.
784 - transparently support flight recorder mode,
785 - transparently support crash dump.
787 The event stream header will therefore be referred to as the "event packet
788 header" throughout the rest of this document.