Commit | Line | Data |
---|---|---|
5ba9f198 | 1 | |
80fd2569 | 2 | RFC: Common Trace Format Proposal for Linux (v1.6) |
5ba9f198 MD |
3 | |
4 | Mathieu Desnoyers, EfficiOS Inc. | |
5 | ||
6 | The goal of the present document is to propose a trace format that suits the | |
7 | needs of the embedded, telecom, high-performance and kernel communities. It is | |
8 | based on the Common Trace Format Requirements (v1.4) document. It is designed to | |
3bf79539 MD |
9 | allow tracing that is natively generated by the Linux kernel and Linux |
10 | user-space applications written in C/C++. | |
5ba9f198 MD |
11 | |
12 | A reference implementation of a library to read and write this trace format is | |
13 | being implemented within the BabelTrace project, a converter between trace | |
14 | formats. The development tree is available at: | |
15 | ||
16 | git tree: git://git.efficios.com/babeltrace.git | |
17 | gitweb: http://git.efficios.com/?p=babeltrace.git | |
18 | ||
19 | ||
20 | 1. Preliminary definitions | |
21 | ||
3bf79539 MD |
22 | - Event Trace: An ordered sequence of events. |
23 | - Event Stream: An ordered sequence of events, containing a subset of the | |
24 | trace event types. | |
25 | - Event Packet: A sequence of physically contiguous events within an event | |
26 | stream. | |
5ba9f198 MD |
27 | - Event: This is the basic entry in a trace. (aka: a trace record). |
28 | - An event identifier (ID) relates to the class (a type) of event within | |
3bf79539 MD |
29 | an event stream. |
30 | e.g. event: irq_entry. | |
5ba9f198 MD |
31 | - An event (or event record) relates to a specific instance of an event |
32 | class. | |
3bf79539 MD |
33 | e.g. event: irq_entry, at time X, on CPU Y |
34 | - Source Architecture: Architecture writing the trace. | |
35 | - Reader Architecture: Architecture reading the trace. | |
5ba9f198 MD |
36 | |
37 | ||
38 | 2. High-level representation of a trace | |
39 | ||
3bf79539 MD |
40 | A trace is divided into multiple event streams. Each event stream contains a |
41 | subset of the trace event types. | |
5ba9f198 | 42 | |
3bf79539 MD |
43 | The final output of the trace, after its generation and optional transport over |
44 | the network, is expected to be either on permanent or temporary storage in a | |
45 | virtual file system. Because each event stream is appended to while a trace is | |
46 | being recorded, each is associated with a separate file for output. Therefore, | |
47 | a stored trace can be represented as a directory containing one file per stream. | |
5ba9f198 | 48 | |
3bf79539 | 49 | A metadata event stream contains information on trace event types. It describes: |
5ba9f198 MD |
50 | |
51 | - Trace version. | |
52 | - Types available. | |
3bf79539 MD |
53 | - Per-stream event header description. |
54 | - Per-stream event header selection. | |
55 | - Per-stream event context fields. | |
5ba9f198 | 56 | - Per-event |
3bf79539 | 57 | - Event type to stream mapping. |
5ba9f198 MD |
58 | - Event type to name mapping. |
59 | - Event type to ID mapping. | |
60 | - Event fields description. | |
61 | ||
62 | ||
3bf79539 | 63 | 3. Event stream |
5ba9f198 | 64 | |
3bf79539 MD |
65 | An event stream is divided in contiguous event packets of variable size. These |
66 | subdivisions have a variable size. An event packet can contain a certain amount | |
67 | of padding at the end. The rationale for the event stream design choices is | |
68 | explained in Appendix B. Stream Header Rationale. | |
5ba9f198 | 69 | |
3bf79539 MD |
70 | An event stream is divided in contiguous event packets of variable size. These |
71 | subdivisions have a variable size. An event packet can contain a certain amount | |
72 | of padding at the end. The stream header is repeated at the beginning of each | |
73 | event packet. | |
5ba9f198 | 74 | |
3bf79539 MD |
75 | The event stream header will therefore be referred to as the "event packet |
76 | header" throughout the rest of this document. | |
5ba9f198 MD |
77 | |
78 | ||
79 | 4. Types | |
80 | ||
81 | 4.1 Basic types | |
82 | ||
83 | A basic type is a scalar type, as described in this section. | |
84 | ||
85 | 4.1.1 Type inheritance | |
86 | ||
80fd2569 MD |
87 | Type specifications can be inherited to allow deriving types from a |
88 | type class. For example, see the uint32_t named type derived from the "integer" | |
89 | type class below ("Integers" section). Types have a precise binary | |
90 | representation in the trace. A type class has methods to read and write these | |
91 | types, but must be derived into a type to be usable in an event field. | |
5ba9f198 MD |
92 | |
93 | 4.1.2 Alignment | |
94 | ||
95 | We define "byte-packed" types as aligned on the byte size, namely 8-bit. | |
96 | We define "bit-packed" types as following on the next bit, as defined by the | |
97 | "bitfields" section. | |
5ba9f198 | 98 | |
3bf79539 MD |
99 | All basic types, except bitfields, are either aligned on an architecture-defined |
100 | specific alignment or byte-packed, depending on the architecture preference. | |
101 | Architectures providing fast unaligned write byte-packed basic types to save | |
5ba9f198 | 102 | space, aligning each type on byte boundaries (8-bit). Architectures with slow |
3bf79539 MD |
103 | unaligned writes align types on specific alignment values. If no specific |
104 | alignment is declared for a type nor its parents, it is assumed to be bit-packed | |
105 | for bitfields and byte-packed for other types. | |
5ba9f198 | 106 | |
3bf79539 | 107 | Metadata attribute representation of a specific alignment: |
5ba9f198 MD |
108 | |
109 | align = value; /* value in bits */ | |
110 | ||
111 | 4.1.3 Byte order | |
112 | ||
3bf79539 MD |
113 | By default, the native endianness of the source architecture the trace is used. |
114 | Byte order can be overridden for a basic type by specifying a "byte_order" | |
115 | attribute. Typical use-case is to specify the network byte order (big endian: | |
116 | "be") to save data captured from the network into the trace without conversion. | |
117 | If not specified, the byte order is native. | |
5ba9f198 MD |
118 | |
119 | Metadata representation: | |
120 | ||
121 | byte_order = native OR network OR be OR le; /* network and be are aliases */ | |
122 | ||
123 | 4.1.4 Size | |
124 | ||
125 | Type size, in bits, for integers and floats is that returned by "sizeof()" in C | |
126 | multiplied by CHAR_BIT. | |
127 | We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed | |
128 | to 8 bits for cross-endianness compatibility. | |
129 | ||
130 | Metadata representation: | |
131 | ||
132 | size = value; (value is in bits) | |
133 | ||
134 | 4.1.5 Integers | |
135 | ||
136 | Signed integers are represented in two-complement. Integer alignment, size, | |
137 | signedness and byte ordering are defined in the metadata. Integers aligned on | |
138 | byte size (8-bit) and with length multiple of byte size (8-bit) correspond to | |
139 | the C99 standard integers. In addition, integers with alignment and/or size that | |
140 | are _not_ a multiple of the byte size are permitted; these correspond to the C99 | |
141 | standard bitfields, with the added specification that the CTF integer bitfields | |
142 | have a fixed binary representation. A MIT-licensed reference implementation of | |
143 | the CTF portable bitfields is available at: | |
144 | ||
145 | http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h | |
146 | ||
147 | Binary representation of integers: | |
148 | ||
149 | - On little and big endian: | |
150 | - Within a byte, high bits correspond to an integer high bits, and low bits | |
151 | correspond to low bits. | |
152 | - On little endian: | |
153 | - Integer across multiple bytes are placed from the less significant to the | |
154 | most significant. | |
155 | - Consecutive integers are placed from lower bits to higher bits (even within | |
156 | a byte). | |
157 | - On big endian: | |
158 | - Integer across multiple bytes are placed from the most significant to the | |
159 | less significant. | |
160 | - Consecutive integers are placed from higher bits to lower bits (even within | |
161 | a byte). | |
162 | ||
163 | This binary representation is derived from the bitfield implementation in GCC | |
164 | for little and big endian. However, contrary to what GCC does, integers can | |
165 | cross units boundaries (no padding is required). Padding can be explicitely | |
166 | added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed. | |
167 | ||
168 | Metadata representation: | |
169 | ||
80fd2569 | 170 | integer { |
5ba9f198 MD |
171 | signed = true OR false; /* default false */ |
172 | byte_order = native OR network OR be OR le; /* default native */ | |
173 | size = value; /* value in bits, no default */ | |
174 | align = value; /* value in bits */ | |
3bf79539 | 175 | }; |
5ba9f198 | 176 | |
80fd2569 | 177 | Example of type inheritance (creation of a uint32_t named type): |
5ba9f198 | 178 | |
80fd2569 | 179 | typedef integer { |
9e4e34e9 | 180 | size = 32; |
5ba9f198 MD |
181 | signed = false; |
182 | align = 32; | |
80fd2569 | 183 | } uint32_t; |
5ba9f198 | 184 | |
80fd2569 | 185 | Definition of a named 5-bit signed bitfield: |
5ba9f198 | 186 | |
80fd2569 | 187 | typedef integer { |
5ba9f198 MD |
188 | size = 5; |
189 | signed = true; | |
190 | align = 1; | |
80fd2569 | 191 | } int5_t; |
5ba9f198 MD |
192 | |
193 | 4.1.6 GNU/C bitfields | |
194 | ||
195 | The GNU/C bitfields follow closely the integer representation, with a | |
196 | particularity on alignment: if a bitfield cannot fit in the current unit, the | |
80fd2569 MD |
197 | unit is padded and the bitfield starts at the following unit. The unit size is |
198 | defined by the size of the type "unit_type". | |
5ba9f198 | 199 | |
80fd2569 | 200 | Metadata representation. Either: |
5ba9f198 | 201 | |
80fd2569 MD |
202 | gcc_bitfield { |
203 | unit_type = integer { | |
204 | ... | |
205 | }; | |
206 | size = value; | |
3bf79539 | 207 | }; |
5ba9f198 | 208 | |
80fd2569 MD |
209 | Or bitfield within structures as specified by the C standard |
210 | ||
211 | unit_type name:size: | |
212 | ||
5ba9f198 MD |
213 | As an example, the following structure declared in C compiled by GCC: |
214 | ||
215 | struct example { | |
216 | short a:12; | |
217 | short b:5; | |
218 | }; | |
219 | ||
80fd2569 MD |
220 | is equivalent to the following structure declaration, aligned on the largest |
221 | element (short). The second bitfield would be aligned on the next unit boundary, | |
222 | because it would not fit in the current unit. The two declarations (C | |
223 | declaration above or CTF declaration with "type gcc_bitfield") are strictly | |
224 | equivalent. | |
225 | ||
226 | struct example { | |
227 | gcc_bitfield { | |
228 | unit_type = short; | |
229 | size = 12; | |
230 | } a; | |
231 | gcc_bitfield { | |
232 | unit_type = short; | |
233 | size = 5; | |
234 | } b; | |
3bf79539 | 235 | }; |
5ba9f198 MD |
236 | |
237 | 4.1.7 Floating point | |
238 | ||
239 | The floating point values byte ordering is defined in the metadata. | |
240 | ||
241 | Floating point values follow the IEEE 754-2008 standard interchange formats. | |
242 | Description of the floating point values include the exponent and mantissa size | |
243 | in bits. Some requirements are imposed on the floating point values: | |
244 | ||
245 | - FLT_RADIX must be 2. | |
246 | - mant_dig is the number of digits represented in the mantissa. It is specified | |
247 | by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and | |
248 | LDBL_MANT_DIG as defined by <float.h>. | |
249 | - exp_dig is the number of digits represented in the exponent. Given that | |
250 | mant_dig is one bit more than its actual size in bits (leading 1 is not | |
251 | needed) and also given that the sign bit always takes one bit, exp_dig can be | |
252 | specified as: | |
253 | ||
254 | - sizeof(float) * CHAR_BIT - FLT_MANT_DIG | |
255 | - sizeof(double) * CHAR_BIT - DBL_MANT_DIG | |
256 | - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG | |
257 | ||
258 | Metadata representation: | |
259 | ||
80fd2569 | 260 | floating_point { |
5ba9f198 MD |
261 | exp_dig = value; |
262 | mant_dig = value; | |
263 | byte_order = native OR network OR be OR le; | |
3bf79539 | 264 | }; |
5ba9f198 MD |
265 | |
266 | Example of type inheritance: | |
267 | ||
80fd2569 | 268 | typedef floating_point { |
5ba9f198 MD |
269 | exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */ |
270 | mant_dig = 24; /* FLT_MANT_DIG */ | |
271 | byte_order = native; | |
80fd2569 | 272 | } float; |
5ba9f198 MD |
273 | |
274 | TODO: define NaN, +inf, -inf behavior. | |
275 | ||
276 | 4.1.8 Enumerations | |
277 | ||
278 | Enumerations are a mapping between an integer type and a table of strings. The | |
279 | numerical representation of the enumeration follows the integer type specified | |
280 | by the metadata. The enumeration mapping table is detailed in the enumeration | |
3bf79539 MD |
281 | description within the metadata. The mapping table maps inclusive value ranges |
282 | (or single values) to strings. Instead of being limited to simple | |
283 | "value -> string" mappings, these enumerations map | |
80fd2569 | 284 | "[ start_value ... end_value ] -> string", which map inclusive ranges of |
3bf79539 MD |
285 | values to strings. An enumeration from the C language can be represented in |
286 | this format by having the same start_value and end_value for each element, which | |
287 | is in fact a range of size 1. This single-value range is supported without | |
80fd2569 MD |
288 | repeating the start and end values with the value = string declaration. If the |
289 | <integer_type> is omitted, the type chosen by the C compiler to hold the | |
290 | enumeration is used. The <integer_type> specifier can only be omitted for | |
291 | enumerations containing only simple "value -> string" mappings (compatible with | |
292 | C). | |
293 | ||
294 | enum <integer_type> name { | |
295 | string = start_value1 ... end_value1, | |
296 | "other string" = start_value2 ... end_value2, | |
297 | yet_another_string, /* will be assigned to end_value2 + 1 */ | |
298 | "some other string" = value, | |
299 | ... | |
300 | }; | |
301 | ||
302 | If the values are omitted, the enumeration starts at 0 and increment of 1 for | |
303 | each entry: | |
304 | ||
305 | enum { | |
306 | ZERO, | |
307 | ONE, | |
308 | TWO, | |
309 | TEN = 10, | |
310 | ELEVEN, | |
3bf79539 | 311 | }; |
5ba9f198 | 312 | |
80fd2569 | 313 | Overlapping ranges within a single enumeration are implementation defined. |
5ba9f198 MD |
314 | |
315 | 4.2 Compound types | |
316 | ||
317 | 4.2.1 Structures | |
318 | ||
319 | Structures are aligned on the largest alignment required by basic types | |
320 | contained within the structure. (This follows the ISO/C standard for structures) | |
321 | ||
80fd2569 | 322 | Metadata representation of a named structure: |
5ba9f198 | 323 | |
80fd2569 MD |
324 | struct name { |
325 | field_type field_name; | |
326 | field_type field_name; | |
327 | ... | |
328 | }; | |
5ba9f198 MD |
329 | |
330 | Example: | |
331 | ||
80fd2569 MD |
332 | struct example { |
333 | integer { /* Nameless type */ | |
334 | size = 16; | |
335 | signed = true; | |
336 | align = 16; | |
337 | } first_field_name; | |
338 | uint64_t second_field_name; /* Named type declared in the metadata */ | |
3bf79539 | 339 | }; |
5ba9f198 MD |
340 | |
341 | The fields are placed in a sequence next to each other. They each possess a | |
342 | field name, which is a unique identifier within the structure. | |
343 | ||
80fd2569 MD |
344 | A nameless structure can be declared as a field type: |
345 | ||
346 | struct { | |
347 | ... | |
348 | } field_name; | |
349 | ||
5ba9f198 MD |
350 | 4.2.2 Arrays |
351 | ||
352 | Arrays are fixed-length. Their length is declared in the type declaration within | |
353 | the metadata. They contain an array of "inner type" elements, which can refer to | |
354 | any type not containing the type of the array being declared (no circular | |
3bf79539 | 355 | dependency). The length is the number of elements in an array. |
5ba9f198 | 356 | |
80fd2569 | 357 | Metadata representation of a named array, either: |
5ba9f198 | 358 | |
80fd2569 | 359 | typedef array { |
5ba9f198 MD |
360 | length = value; |
361 | elem_type = type; | |
80fd2569 MD |
362 | } name; |
363 | ||
364 | or: | |
365 | ||
366 | typedef elem_type name[length]; | |
5ba9f198 MD |
367 | |
368 | E.g.: | |
369 | ||
80fd2569 | 370 | typedef array { |
5ba9f198 MD |
371 | length = 10; |
372 | elem_type = uint32_t; | |
80fd2569 MD |
373 | } example; |
374 | ||
375 | A nameless array can be declared as a field type, e.g.: | |
376 | ||
377 | array { | |
378 | length = 5; | |
379 | elem_type = uint8_t; | |
380 | } field_name; | |
381 | ||
382 | or | |
383 | ||
384 | uint8_t field_name[10]; | |
385 | ||
5ba9f198 MD |
386 | |
387 | 4.2.3 Sequences | |
388 | ||
389 | Sequences are dynamically-sized arrays. They start with an integer that specify | |
390 | the length of the sequence, followed by an array of "inner type" elements. | |
3bf79539 | 391 | The length is the number of elements in the sequence. |
5ba9f198 | 392 | |
80fd2569 MD |
393 | Metadata representation for a named sequence, either: |
394 | ||
395 | typedef sequence { | |
396 | length_type = type; /* integer class */ | |
5ba9f198 | 397 | elem_type = type; |
80fd2569 MD |
398 | } name; |
399 | ||
400 | or: | |
401 | ||
402 | typedef elem_type name[length_type]; | |
403 | ||
404 | A nameless sequence can be declared as a field type, e.g.: | |
405 | ||
406 | sequence { | |
407 | length_type = int; | |
408 | elem_type = long; | |
409 | } field_name; | |
410 | ||
411 | or | |
5ba9f198 | 412 | |
80fd2569 MD |
413 | long field_name[int]; |
414 | ||
415 | The length type follows the integer types specifications, and the sequence | |
5ba9f198 MD |
416 | elements follow the "array" specifications. |
417 | ||
418 | 4.2.4 Strings | |
419 | ||
420 | Strings are an array of bytes of variable size and are terminated by a '\0' | |
421 | "NULL" character. Their encoding is described in the metadata. In absence of | |
422 | encoding attribute information, the default encoding is UTF-8. | |
423 | ||
80fd2569 MD |
424 | Metadata representation of a named string type: |
425 | ||
426 | typedef string { | |
5ba9f198 | 427 | encoding = UTF8 OR ASCII; |
80fd2569 | 428 | } name; |
5ba9f198 | 429 | |
80fd2569 MD |
430 | A nameless string type can be declared as a field type: |
431 | ||
432 | string field_name; /* Use default UTF8 encoding */ | |
5ba9f198 | 433 | |
3bf79539 MD |
434 | 5. Event Packet Header |
435 | ||
436 | The event packet header consists of two part: one is mandatory and have a fixed | |
437 | layout. The second part, the "event packet context", has its layout described in | |
438 | the metadata. | |
5ba9f198 | 439 | |
3bf79539 MD |
440 | - Aligned on page size. Fixed size. Fields either aligned or packed (depending |
441 | on the architecture preference). | |
442 | No padding at the end of the event packet header. Native architecture byte | |
5ba9f198 | 443 | ordering. |
3bf79539 MD |
444 | |
445 | Fixed layout (event packet header): | |
446 | ||
5ba9f198 MD |
447 | - Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness |
448 | representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise | |
449 | representation. Used to distinguish between big and little endian traces (this | |
450 | information is determined by knowing the endianness of the architecture | |
451 | reading the trace and comparing the magic number against its value and the | |
452 | reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata | |
453 | description language described in this document. Different magic numbers | |
454 | should be used for other metadata description languages. | |
3bf79539 | 455 | - Trace UUID, used to ensure the event packet match the metadata used. |
5ba9f198 MD |
456 | (note: we cannot use a metadata checksum because metadata can be appended to |
457 | while tracing is active) | |
3bf79539 MD |
458 | - Stream ID, used as reference to stream description in metadata. |
459 | ||
460 | Metadata-defined layout (event packet context): | |
461 | ||
462 | - Event packet content size (in bytes). | |
463 | - Event packet size (in bytes, includes padding). | |
464 | - Event packet content checksum (optional). Checksum excludes the event packet | |
465 | header. | |
466 | - Per-stream event packet sequence count (to deal with UDP packet loss). The | |
467 | number of significant sequence counter bits should also be present, so | |
468 | wrap-arounds are deal with correctly. | |
469 | - Timestamp at the beginning and timestamp at the end of the event packet. | |
470 | Both timestamps are written in the packet header, but sampled respectively | |
471 | while (or before) writing the first event and while (or after) writing the | |
472 | last event in the packet. The inclusive range between these timestamps should | |
473 | include all event timestamps assigned to events contained within the packet. | |
5ba9f198 | 474 | - Events discarded count |
3bf79539 MD |
475 | - Snapshot of a per-stream free-running counter, counting the number of |
476 | events discarded that were supposed to be written in the stream prior to | |
477 | the first event in the event packet. | |
5ba9f198 | 478 | * Note: producer-consumer buffer full condition should fill the current |
3bf79539 | 479 | event packet with padding so we know exactly where events have been |
5ba9f198 | 480 | discarded. |
3bf79539 MD |
481 | - Lossless compression scheme used for the event packet content. Applied |
482 | directly to raw data. New types of compression can be added in following | |
483 | versions of the format. | |
5ba9f198 MD |
484 | 0: no compression scheme |
485 | 1: bzip2 | |
486 | 2: gzip | |
3bf79539 MD |
487 | 3: xz |
488 | - Cypher used for the event packet content. Applied after compression. | |
5ba9f198 MD |
489 | 0: no encryption |
490 | 1: AES | |
3bf79539 | 491 | - Checksum scheme used for the event packet content. Applied after encryption. |
5ba9f198 MD |
492 | 0: no checksum |
493 | 1: md5 | |
494 | 2: sha1 | |
495 | 3: crc32 | |
496 | ||
3bf79539 MD |
497 | 5.1 Event Packet Header Fixed Layout Description |
498 | ||
80fd2569 MD |
499 | struct event_packet_header { |
500 | uint32_t magic; | |
501 | uint8_t trace_uuid[16]; | |
3bf79539 | 502 | uint32_t stream_id; |
80fd2569 | 503 | }; |
5ba9f198 | 504 | |
3bf79539 MD |
505 | 5.2 Event Packet Context Description |
506 | ||
507 | Event packet context example. These are declared within the stream declaration | |
508 | in the metadata. All these fields are optional except for "content_size" and | |
509 | "packet_size", which must be present in the context. | |
510 | ||
511 | An example event packet context type: | |
512 | ||
80fd2569 | 513 | struct event_packet_context { |
3bf79539 MD |
514 | uint64_t timestamp_begin; |
515 | uint64_t timestamp_end; | |
516 | uint32_t checksum; | |
517 | uint32_t stream_packet_count; | |
518 | uint32_t events_discarded; | |
519 | uint32_t cpu_id; | |
520 | uint32_t/uint16_t content_size; | |
521 | uint32_t/uint16_t packet_size; | |
522 | uint8_t stream_packet_count_bits; /* Significant counter bits */ | |
523 | uint8_t compression_scheme; | |
524 | uint8_t encryption_scheme; | |
525 | uint8_t checksum; | |
526 | }; | |
5ba9f198 MD |
527 | |
528 | 6. Event Structure | |
529 | ||
530 | The overall structure of an event is: | |
531 | ||
3bf79539 | 532 | - Event Header (as specifed by the stream metadata) |
5ba9f198 | 533 | - Extended Event Header (as specified by the event header) |
3bf79539 | 534 | - Event Context (as specified by the stream metadata) |
5ba9f198 MD |
535 | - Event Payload (as specified by the event metadata) |
536 | ||
537 | ||
538 | 6.1 Event Header | |
539 | ||
3bf79539 MD |
540 | One major factor can vary between streams: the number of event IDs assigned to |
541 | a stream. Luckily, this information tends to stay relatively constant (modulo | |
5ba9f198 | 542 | event registration while trace is being recorded), so we can specify different |
3bf79539 | 543 | representations for streams containing few event IDs and streams containing |
5ba9f198 MD |
544 | many event IDs, so we end up representing the event ID and timestamp as densely |
545 | as possible in each case. | |
546 | ||
3bf79539 MD |
547 | We therefore provide two types of events headers. Type 1 accommodates streams |
548 | with less than 31 event IDs. Type 2 accommodates streams with 31 or more event | |
5ba9f198 MD |
549 | IDs. |
550 | ||
551 | The "extended headers" are used in the rare occasions where the information | |
3bf79539 MD |
552 | cannot be represented in the ranges available in the event header. They are also |
553 | used in the rare occasions where the data required for a field could not be | |
554 | collected: the flag corresponding to the missing field within the missing_fields | |
555 | array is then set to 1. | |
5ba9f198 MD |
556 | |
557 | Types uintX_t represent an X-bit unsigned integer. | |
558 | ||
559 | ||
560 | 6.1.1 Type 1 - Few event IDs | |
561 | ||
562 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
563 | preference). | |
564 | - Fixed size: 32 bits. | |
565 | - Native architecture byte ordering. | |
566 | ||
80fd2569 MD |
567 | struct event_header_1 { |
568 | uint5_t id; /* | |
5ba9f198 MD |
569 | * id: range: 0 - 30. |
570 | * id 31 is reserved to indicate a following | |
571 | * extended header. | |
572 | */ | |
80fd2569 | 573 | uint27_t timestamp; |
5ba9f198 MD |
574 | }; |
575 | ||
576 | The end of a type 1 header is aligned on a 32-bit boundary (or packed). | |
577 | ||
578 | ||
579 | 6.1.2 Extended Type 1 Event Header | |
580 | ||
581 | - Follows struct event_header_1, which is aligned on 32-bit, so no need to | |
582 | realign. | |
3bf79539 | 583 | - Variable size (depends on the number of fields per event). |
5ba9f198 | 584 | - Native architecture byte ordering. |
80fd2569 | 585 | - NR_FIELDS is the number of fields within the event. |
5ba9f198 | 586 | |
80fd2569 MD |
587 | struct event_header_1_ext { |
588 | uint32_t id; /* 32-bit event IDs */ | |
589 | uint64_t timestamp; /* 64-bit timestamps */ | |
590 | uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */ | |
5ba9f198 MD |
591 | }; |
592 | ||
5ba9f198 MD |
593 | |
594 | 6.1.3 Type 2 - Many event IDs | |
595 | ||
596 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
597 | preference). | |
598 | - Fixed size: 48 bits. | |
599 | - Native architecture byte ordering. | |
600 | ||
80fd2569 MD |
601 | struct event_header_2 { |
602 | uint32_t timestamp; | |
603 | uint16_t id; /* | |
5ba9f198 MD |
604 | * id: range: 0 - 65534. |
605 | * id 65535 is reserved to indicate a following | |
606 | * extended header. | |
607 | */ | |
5ba9f198 MD |
608 | }; |
609 | ||
610 | The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if | |
611 | byte-packed). | |
612 | ||
613 | ||
614 | 6.1.4 Extended Type 2 Event Header | |
615 | ||
616 | - Follows struct event_header_2, which alignment end on a 16-bit boundary, so | |
3bf79539 | 617 | we need to align on 64-bit integer architecture alignment (or 8-bit if |
5ba9f198 | 618 | byte-packed). |
3bf79539 | 619 | - Variable size (depends on the number of fields per event). |
5ba9f198 | 620 | - Native architecture byte ordering. |
80fd2569 | 621 | - NR_FIELDS is the number of fields within the event. |
5ba9f198 | 622 | |
80fd2569 MD |
623 | struct event_header_2_ext { |
624 | uint64_t timestamp; /* 64-bit timestamps */ | |
625 | uint32_t id; /* 32-bit event IDs */ | |
626 | uint1_t missing_fields[NR_FIELDS]; /* missing event fields bitmap */ | |
5ba9f198 MD |
627 | }; |
628 | ||
5ba9f198 MD |
629 | |
630 | 6.2 Event Context | |
631 | ||
632 | The event context contains information relative to the current event. The choice | |
3bf79539 | 633 | and meaning of this information is specified by the metadata "stream" |
5ba9f198 | 634 | information. For this trace format, event context is usually empty, except when |
3bf79539 | 635 | the metadata "stream" information specifies otherwise by declaring a non-empty |
5ba9f198 MD |
636 | structure for the event context. An example of event context is to save the |
637 | event payload size with each event, or to save the current PID with each event. | |
3bf79539 | 638 | These are declared within the stream declaration within the metadata. |
5ba9f198 | 639 | |
3bf79539 | 640 | An example event context type: |
5ba9f198 | 641 | |
80fd2569 MD |
642 | struct event_context { |
643 | uint pid; | |
644 | uint16_t payload_size; | |
3bf79539 | 645 | }; |
5ba9f198 MD |
646 | |
647 | ||
648 | 6.3 Event Payload | |
649 | ||
650 | An event payload contains fields specific to a given event type. The fields | |
651 | belonging to an event type are described in the event-specific metadata | |
652 | within a structure type. | |
653 | ||
654 | 6.3.1 Padding | |
655 | ||
656 | No padding at the end of the event payload. This differs from the ISO/C standard | |
657 | for structures, but follows the CTF standard for structures. In a trace, even | |
658 | though it makes sense to align the beginning of a structure, it really makes no | |
659 | sense to add padding at the end of the structure, because structures are usually | |
660 | not followed by a structure of the same type. | |
661 | ||
662 | This trick can be done by adding a zero-length "end" field at the end of the C | |
663 | structures, and by using the offset of this field rather than using sizeof() | |
3bf79539 | 664 | when calculating the size of a structure (see Appendix "A. Helper macros"). |
5ba9f198 MD |
665 | |
666 | 6.3.2 Alignment | |
667 | ||
668 | The event payload is aligned on the largest alignment required by types | |
669 | contained within the payload. (This follows the ISO/C standard for structures) | |
670 | ||
671 | ||
672 | ||
673 | 7. Metadata | |
674 | ||
3bf79539 MD |
675 | The meta-data is located in a stream named "metadata". It is made of "event |
676 | packets", which each start with an event packet header. The event type within | |
677 | the metadata stream have no event header nor event context. Each event only | |
5ba9f198 | 678 | contains a null-terminated "string" payload, which is a metadata description |
3bf79539 MD |
679 | entry. The events are packed one next to another. Each event packet start with |
680 | an event packet header, which contains, amongst other fields, the magic number | |
681 | and trace UUID. | |
5ba9f198 MD |
682 | |
683 | The metadata can be parsed by reading through the metadata strings, skipping | |
3bf79539 | 684 | newlines and null-characters. Type names may contain spaces. |
5ba9f198 MD |
685 | |
686 | trace { | |
687 | major = value; /* Trace format version */ | |
688 | minor = value; | |
3bf79539 MD |
689 | uuid = value; /* Trace UUID */ |
690 | word_size = value; | |
691 | }; | |
5ba9f198 | 692 | |
3bf79539 MD |
693 | stream { |
694 | id = stream_id; | |
5ba9f198 | 695 | event { |
3bf79539 MD |
696 | /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */ |
697 | header_type = event_header_1 OR event_header_2; | |
698 | /* | |
699 | * Extended event header type. Only present if specified in event header | |
700 | * on a per-event basis. | |
701 | */ | |
702 | header_type_ext = event_header_1_ext OR event_header_2_ext; | |
80fd2569 MD |
703 | context_type = struct { |
704 | ... | |
705 | }; | |
3bf79539 MD |
706 | }; |
707 | packet { | |
80fd2569 MD |
708 | context_type = struct { |
709 | ... | |
710 | }; | |
3bf79539 MD |
711 | }; |
712 | }; | |
5ba9f198 MD |
713 | |
714 | event { | |
3bf79539 MD |
715 | name = eventname; |
716 | id = value; /* Numeric identifier within the stream */ | |
717 | stream = stream_id; | |
80fd2569 MD |
718 | fields = struct { |
719 | ... | |
720 | }; | |
3bf79539 | 721 | }; |
5ba9f198 MD |
722 | |
723 | /* More detail on types in section 4. Types */ | |
724 | ||
725 | /* Named types */ | |
80fd2569 MD |
726 | typedef some existing type new_type; |
727 | ||
728 | typedef type_class { | |
729 | ... | |
730 | } new_type; | |
731 | ||
732 | struct name { | |
3bf79539 MD |
733 | ... |
734 | }; | |
5ba9f198 | 735 | |
80fd2569 | 736 | enum name { |
3bf79539 MD |
737 | ... |
738 | }; | |
739 | ||
80fd2569 MD |
740 | /* Unnamed types, contained within compound type fields or type assignments. */ |
741 | struct { | |
742 | ... | |
743 | }; | |
5ba9f198 | 744 | |
80fd2569 MD |
745 | enum { |
746 | ... | |
747 | }; | |
3bf79539 | 748 | |
80fd2569 MD |
749 | array { |
750 | ... | |
751 | }; | |
3bf79539 | 752 | |
80fd2569 MD |
753 | sequence { |
754 | ... | |
755 | }; | |
3bf79539 MD |
756 | |
757 | A. Helper macros | |
5ba9f198 MD |
758 | |
759 | The two following macros keep track of the size of a GNU/C structure without | |
760 | padding at the end by placing HEADER_END as the last field. A one byte end field | |
761 | is used for C90 compatibility (C99 flexible arrays could be used here). Note | |
762 | that this does not affect the effective structure size, which should always be | |
763 | calculated with the header_sizeof() helper. | |
764 | ||
765 | #define HEADER_END char end_field | |
766 | #define header_sizeof(type) offsetof(typeof(type), end_field) | |
3bf79539 MD |
767 | |
768 | ||
769 | B. Stream Header Rationale | |
770 | ||
771 | An event stream is divided in contiguous event packets of variable size. These | |
772 | subdivisions allow the trace analyzer to perform a fast binary search by time | |
773 | within the stream (typically requiring to index only the event packet headers) | |
774 | without reading the whole stream. These subdivisions have a variable size to | |
775 | eliminate the need to transfer the event packet padding when partially filled | |
776 | event packets must be sent when streaming a trace for live viewing/analysis. | |
777 | An event packet can contain a certain amount of padding at the end. Dividing | |
778 | streams into event packets is also useful for network streaming over UDP and | |
779 | flight recorder mode tracing (a whole event packet can be swapped out of the | |
780 | buffer atomically for reading). | |
781 | ||
782 | The stream header is repeated at the beginning of each event packet to allow | |
783 | flexibility in terms of: | |
784 | ||
785 | - streaming support, | |
786 | - allowing arbitrary buffers to be discarded without making the trace | |
787 | unreadable, | |
788 | - allow UDP packet loss handling by either dealing with missing event packet | |
789 | or asking for re-transmission. | |
790 | - transparently support flight recorder mode, | |
791 | - transparently support crash dump. | |
792 | ||
793 | The event stream header will therefore be referred to as the "event packet | |
794 | header" throughout the rest of this document. |