Commit | Line | Data |
---|---|---|
5ba9f198 | 1 | |
9e4e34e9 | 2 | RFC: Common Trace Format Proposal for Linux (pre-v1.6) |
5ba9f198 MD |
3 | |
4 | Mathieu Desnoyers, EfficiOS Inc. | |
5 | ||
6 | The goal of the present document is to propose a trace format that suits the | |
7 | needs of the embedded, telecom, high-performance and kernel communities. It is | |
8 | based on the Common Trace Format Requirements (v1.4) document. It is designed to | |
3bf79539 MD |
9 | allow tracing that is natively generated by the Linux kernel and Linux |
10 | user-space applications written in C/C++. | |
5ba9f198 MD |
11 | |
12 | A reference implementation of a library to read and write this trace format is | |
13 | being implemented within the BabelTrace project, a converter between trace | |
14 | formats. The development tree is available at: | |
15 | ||
16 | git tree: git://git.efficios.com/babeltrace.git | |
17 | gitweb: http://git.efficios.com/?p=babeltrace.git | |
18 | ||
19 | ||
20 | 1. Preliminary definitions | |
21 | ||
3bf79539 MD |
22 | - Event Trace: An ordered sequence of events. |
23 | - Event Stream: An ordered sequence of events, containing a subset of the | |
24 | trace event types. | |
25 | - Event Packet: A sequence of physically contiguous events within an event | |
26 | stream. | |
5ba9f198 MD |
27 | - Event: This is the basic entry in a trace. (aka: a trace record). |
28 | - An event identifier (ID) relates to the class (a type) of event within | |
3bf79539 MD |
29 | an event stream. |
30 | e.g. event: irq_entry. | |
5ba9f198 MD |
31 | - An event (or event record) relates to a specific instance of an event |
32 | class. | |
3bf79539 MD |
33 | e.g. event: irq_entry, at time X, on CPU Y |
34 | - Source Architecture: Architecture writing the trace. | |
35 | - Reader Architecture: Architecture reading the trace. | |
5ba9f198 MD |
36 | |
37 | ||
38 | 2. High-level representation of a trace | |
39 | ||
3bf79539 MD |
40 | A trace is divided into multiple event streams. Each event stream contains a |
41 | subset of the trace event types. | |
5ba9f198 | 42 | |
3bf79539 MD |
43 | The final output of the trace, after its generation and optional transport over |
44 | the network, is expected to be either on permanent or temporary storage in a | |
45 | virtual file system. Because each event stream is appended to while a trace is | |
46 | being recorded, each is associated with a separate file for output. Therefore, | |
47 | a stored trace can be represented as a directory containing one file per stream. | |
5ba9f198 | 48 | |
3bf79539 | 49 | A metadata event stream contains information on trace event types. It describes: |
5ba9f198 MD |
50 | |
51 | - Trace version. | |
52 | - Types available. | |
3bf79539 MD |
53 | - Per-stream event header description. |
54 | - Per-stream event header selection. | |
55 | - Per-stream event context fields. | |
5ba9f198 | 56 | - Per-event |
3bf79539 | 57 | - Event type to stream mapping. |
5ba9f198 MD |
58 | - Event type to name mapping. |
59 | - Event type to ID mapping. | |
60 | - Event fields description. | |
61 | ||
62 | ||
3bf79539 | 63 | 3. Event stream |
5ba9f198 | 64 | |
3bf79539 MD |
65 | An event stream is divided in contiguous event packets of variable size. These |
66 | subdivisions have a variable size. An event packet can contain a certain amount | |
67 | of padding at the end. The rationale for the event stream design choices is | |
68 | explained in Appendix B. Stream Header Rationale. | |
5ba9f198 | 69 | |
3bf79539 MD |
70 | An event stream is divided in contiguous event packets of variable size. These |
71 | subdivisions have a variable size. An event packet can contain a certain amount | |
72 | of padding at the end. The stream header is repeated at the beginning of each | |
73 | event packet. | |
5ba9f198 | 74 | |
3bf79539 MD |
75 | The event stream header will therefore be referred to as the "event packet |
76 | header" throughout the rest of this document. | |
5ba9f198 MD |
77 | |
78 | ||
79 | 4. Types | |
80 | ||
81 | 4.1 Basic types | |
82 | ||
83 | A basic type is a scalar type, as described in this section. | |
84 | ||
85 | 4.1.1 Type inheritance | |
86 | ||
87 | Type specifications can be inherited to allow deriving concrete types from an | |
88 | abstract type. For example, see the uint32_t type derived from the "integer" | |
89 | abstract type below ("Integers" section). Concrete types have a precise binary | |
90 | representation in the trace. Abstract types have methods to read and write these | |
91 | types, but must be derived into a concrete type to be usable in an event field. | |
92 | ||
93 | Concrete types inherit from abstract types. Abstract types can inherit from | |
94 | other abstract types. | |
95 | ||
96 | 4.1.2 Alignment | |
97 | ||
98 | We define "byte-packed" types as aligned on the byte size, namely 8-bit. | |
99 | We define "bit-packed" types as following on the next bit, as defined by the | |
100 | "bitfields" section. | |
5ba9f198 | 101 | |
3bf79539 MD |
102 | All basic types, except bitfields, are either aligned on an architecture-defined |
103 | specific alignment or byte-packed, depending on the architecture preference. | |
104 | Architectures providing fast unaligned write byte-packed basic types to save | |
5ba9f198 | 105 | space, aligning each type on byte boundaries (8-bit). Architectures with slow |
3bf79539 MD |
106 | unaligned writes align types on specific alignment values. If no specific |
107 | alignment is declared for a type nor its parents, it is assumed to be bit-packed | |
108 | for bitfields and byte-packed for other types. | |
5ba9f198 | 109 | |
3bf79539 | 110 | Metadata attribute representation of a specific alignment: |
5ba9f198 MD |
111 | |
112 | align = value; /* value in bits */ | |
113 | ||
114 | 4.1.3 Byte order | |
115 | ||
3bf79539 MD |
116 | By default, the native endianness of the source architecture the trace is used. |
117 | Byte order can be overridden for a basic type by specifying a "byte_order" | |
118 | attribute. Typical use-case is to specify the network byte order (big endian: | |
119 | "be") to save data captured from the network into the trace without conversion. | |
120 | If not specified, the byte order is native. | |
5ba9f198 MD |
121 | |
122 | Metadata representation: | |
123 | ||
124 | byte_order = native OR network OR be OR le; /* network and be are aliases */ | |
125 | ||
126 | 4.1.4 Size | |
127 | ||
128 | Type size, in bits, for integers and floats is that returned by "sizeof()" in C | |
129 | multiplied by CHAR_BIT. | |
130 | We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed | |
131 | to 8 bits for cross-endianness compatibility. | |
132 | ||
133 | Metadata representation: | |
134 | ||
135 | size = value; (value is in bits) | |
136 | ||
137 | 4.1.5 Integers | |
138 | ||
139 | Signed integers are represented in two-complement. Integer alignment, size, | |
140 | signedness and byte ordering are defined in the metadata. Integers aligned on | |
141 | byte size (8-bit) and with length multiple of byte size (8-bit) correspond to | |
142 | the C99 standard integers. In addition, integers with alignment and/or size that | |
143 | are _not_ a multiple of the byte size are permitted; these correspond to the C99 | |
144 | standard bitfields, with the added specification that the CTF integer bitfields | |
145 | have a fixed binary representation. A MIT-licensed reference implementation of | |
146 | the CTF portable bitfields is available at: | |
147 | ||
148 | http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h | |
149 | ||
150 | Binary representation of integers: | |
151 | ||
152 | - On little and big endian: | |
153 | - Within a byte, high bits correspond to an integer high bits, and low bits | |
154 | correspond to low bits. | |
155 | - On little endian: | |
156 | - Integer across multiple bytes are placed from the less significant to the | |
157 | most significant. | |
158 | - Consecutive integers are placed from lower bits to higher bits (even within | |
159 | a byte). | |
160 | - On big endian: | |
161 | - Integer across multiple bytes are placed from the most significant to the | |
162 | less significant. | |
163 | - Consecutive integers are placed from higher bits to lower bits (even within | |
164 | a byte). | |
165 | ||
166 | This binary representation is derived from the bitfield implementation in GCC | |
167 | for little and big endian. However, contrary to what GCC does, integers can | |
168 | cross units boundaries (no padding is required). Padding can be explicitely | |
169 | added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed. | |
170 | ||
171 | Metadata representation: | |
172 | ||
173 | abstract_type integer { | |
174 | signed = true OR false; /* default false */ | |
175 | byte_order = native OR network OR be OR le; /* default native */ | |
176 | size = value; /* value in bits, no default */ | |
177 | align = value; /* value in bits */ | |
3bf79539 | 178 | }; |
5ba9f198 MD |
179 | |
180 | Example of type inheritance (creation of a concrete type uint32_t): | |
181 | ||
182 | type uint32_t { | |
183 | parent = integer; | |
9e4e34e9 | 184 | size = 32; |
5ba9f198 MD |
185 | signed = false; |
186 | align = 32; | |
3bf79539 | 187 | }; |
5ba9f198 MD |
188 | |
189 | Definition of a 5-bit signed bitfield: | |
190 | ||
191 | type int5_t { | |
192 | parent = integer; | |
193 | size = 5; | |
194 | signed = true; | |
195 | align = 1; | |
3bf79539 | 196 | }; |
5ba9f198 MD |
197 | |
198 | 4.1.6 GNU/C bitfields | |
199 | ||
200 | The GNU/C bitfields follow closely the integer representation, with a | |
201 | particularity on alignment: if a bitfield cannot fit in the current unit, the | |
202 | unit is padded and the bitfield starts at the following unit. We therefore need | |
203 | to express the extra "unit size" information. | |
204 | ||
205 | Metadata representation: | |
206 | ||
207 | abstract_type gcc_bitfield { | |
208 | parent = integer; | |
209 | unit_size = value; | |
3bf79539 | 210 | }; |
5ba9f198 MD |
211 | |
212 | As an example, the following structure declared in C compiled by GCC: | |
213 | ||
214 | struct example { | |
215 | short a:12; | |
216 | short b:5; | |
217 | }; | |
218 | ||
219 | Would correspond to the following structure, aligned on the largest element | |
220 | (short). The second bitfield would be aligned on the next unit boundary, because | |
221 | it would not fit in the current unit. | |
222 | ||
223 | type struct_example { | |
224 | parent = struct; | |
225 | fields = { | |
3bf79539 MD |
226 | type { |
227 | parent = gcc_bitfield; | |
228 | unit_size = 16; /* sizeof(short) */ | |
229 | size = 12; | |
230 | signed = true; | |
231 | align = 1; | |
232 | } a; | |
233 | type { | |
234 | parent = gcc_bitfield; | |
235 | unit_size = 16; /* sizeof(short) */ | |
236 | size = 5; | |
237 | signed = true; | |
238 | align = 1; | |
239 | } b; | |
5ba9f198 | 240 | }; |
3bf79539 | 241 | }; |
5ba9f198 MD |
242 | |
243 | 4.1.7 Floating point | |
244 | ||
245 | The floating point values byte ordering is defined in the metadata. | |
246 | ||
247 | Floating point values follow the IEEE 754-2008 standard interchange formats. | |
248 | Description of the floating point values include the exponent and mantissa size | |
249 | in bits. Some requirements are imposed on the floating point values: | |
250 | ||
251 | - FLT_RADIX must be 2. | |
252 | - mant_dig is the number of digits represented in the mantissa. It is specified | |
253 | by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and | |
254 | LDBL_MANT_DIG as defined by <float.h>. | |
255 | - exp_dig is the number of digits represented in the exponent. Given that | |
256 | mant_dig is one bit more than its actual size in bits (leading 1 is not | |
257 | needed) and also given that the sign bit always takes one bit, exp_dig can be | |
258 | specified as: | |
259 | ||
260 | - sizeof(float) * CHAR_BIT - FLT_MANT_DIG | |
261 | - sizeof(double) * CHAR_BIT - DBL_MANT_DIG | |
262 | - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG | |
263 | ||
264 | Metadata representation: | |
265 | ||
266 | abstract_type floating_point { | |
267 | exp_dig = value; | |
268 | mant_dig = value; | |
269 | byte_order = native OR network OR be OR le; | |
3bf79539 | 270 | }; |
5ba9f198 MD |
271 | |
272 | Example of type inheritance: | |
273 | ||
274 | type float { | |
275 | exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */ | |
276 | mant_dig = 24; /* FLT_MANT_DIG */ | |
277 | byte_order = native; | |
3bf79539 | 278 | }; |
5ba9f198 MD |
279 | |
280 | TODO: define NaN, +inf, -inf behavior. | |
281 | ||
282 | 4.1.8 Enumerations | |
283 | ||
284 | Enumerations are a mapping between an integer type and a table of strings. The | |
285 | numerical representation of the enumeration follows the integer type specified | |
286 | by the metadata. The enumeration mapping table is detailed in the enumeration | |
3bf79539 MD |
287 | description within the metadata. The mapping table maps inclusive value ranges |
288 | (or single values) to strings. Instead of being limited to simple | |
289 | "value -> string" mappings, these enumerations map | |
290 | "[ start_value .. end_value ] -> string", which map inclusive ranges of | |
291 | values to strings. An enumeration from the C language can be represented in | |
292 | this format by having the same start_value and end_value for each element, which | |
293 | is in fact a range of size 1. This single-value range is supported without | |
294 | repeating the start and end values with the { value, string } declaration. | |
295 | ||
296 | abstract_type enum { | |
297 | parent = integer; | |
298 | map = { | |
299 | { { start_value, end_value }, string }, | |
300 | { { start_value, end_value }, string }, | |
301 | { { start_value, end_value }, string }, | |
302 | { value, string }, | |
303 | { value, string }, | |
5ba9f198 MD |
304 | ... |
305 | }; | |
3bf79539 | 306 | }; |
5ba9f198 MD |
307 | |
308 | ||
309 | 4.2 Compound types | |
310 | ||
311 | 4.2.1 Structures | |
312 | ||
313 | Structures are aligned on the largest alignment required by basic types | |
314 | contained within the structure. (This follows the ISO/C standard for structures) | |
315 | ||
316 | Metadata representation: | |
317 | ||
318 | abstract_type struct { | |
319 | fields = { | |
3bf79539 MD |
320 | field_type field_name; |
321 | field_type field_name; | |
5ba9f198 MD |
322 | ... |
323 | }; | |
324 | } | |
325 | ||
326 | Example: | |
327 | ||
328 | type struct_example { | |
329 | parent = struct; | |
330 | fields = { | |
3bf79539 MD |
331 | type { /* Nameless type */ |
332 | parent = integer; | |
333 | size = 16; | |
334 | signed = true; | |
335 | align = 16; | |
336 | } first_field_name; | |
337 | uint64_t second_field_name; /* Named type declared in the metadata */ | |
5ba9f198 | 338 | }; |
3bf79539 | 339 | }; |
5ba9f198 MD |
340 | |
341 | The fields are placed in a sequence next to each other. They each possess a | |
342 | field name, which is a unique identifier within the structure. | |
343 | ||
344 | 4.2.2 Arrays | |
345 | ||
346 | Arrays are fixed-length. Their length is declared in the type declaration within | |
347 | the metadata. They contain an array of "inner type" elements, which can refer to | |
348 | any type not containing the type of the array being declared (no circular | |
3bf79539 | 349 | dependency). The length is the number of elements in an array. |
5ba9f198 MD |
350 | |
351 | Metadata representation: | |
352 | ||
353 | abstract_type array { | |
354 | length = value; | |
355 | elem_type = type; | |
3bf79539 | 356 | }; |
5ba9f198 MD |
357 | |
358 | E.g.: | |
359 | ||
360 | type example_array { | |
361 | parent = array; | |
362 | length = 10; | |
363 | elem_type = uint32_t; | |
3bf79539 | 364 | }; |
5ba9f198 MD |
365 | |
366 | 4.2.3 Sequences | |
367 | ||
368 | Sequences are dynamically-sized arrays. They start with an integer that specify | |
369 | the length of the sequence, followed by an array of "inner type" elements. | |
3bf79539 | 370 | The length is the number of elements in the sequence. |
5ba9f198 MD |
371 | |
372 | abstract_type sequence { | |
373 | length_type = type; /* Inheriting from integer */ | |
374 | elem_type = type; | |
3bf79539 | 375 | }; |
5ba9f198 MD |
376 | |
377 | The integer type follows the integer types specifications, and the sequence | |
378 | elements follow the "array" specifications. | |
379 | ||
380 | 4.2.4 Strings | |
381 | ||
382 | Strings are an array of bytes of variable size and are terminated by a '\0' | |
383 | "NULL" character. Their encoding is described in the metadata. In absence of | |
384 | encoding attribute information, the default encoding is UTF-8. | |
385 | ||
386 | abstract_type string { | |
387 | encoding = UTF8 OR ASCII; | |
3bf79539 | 388 | }; |
5ba9f198 MD |
389 | |
390 | ||
3bf79539 MD |
391 | 5. Event Packet Header |
392 | ||
393 | The event packet header consists of two part: one is mandatory and have a fixed | |
394 | layout. The second part, the "event packet context", has its layout described in | |
395 | the metadata. | |
5ba9f198 | 396 | |
3bf79539 MD |
397 | - Aligned on page size. Fixed size. Fields either aligned or packed (depending |
398 | on the architecture preference). | |
399 | No padding at the end of the event packet header. Native architecture byte | |
5ba9f198 | 400 | ordering. |
3bf79539 MD |
401 | |
402 | Fixed layout (event packet header): | |
403 | ||
5ba9f198 MD |
404 | - Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness |
405 | representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise | |
406 | representation. Used to distinguish between big and little endian traces (this | |
407 | information is determined by knowing the endianness of the architecture | |
408 | reading the trace and comparing the magic number against its value and the | |
409 | reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata | |
410 | description language described in this document. Different magic numbers | |
411 | should be used for other metadata description languages. | |
3bf79539 | 412 | - Trace UUID, used to ensure the event packet match the metadata used. |
5ba9f198 MD |
413 | (note: we cannot use a metadata checksum because metadata can be appended to |
414 | while tracing is active) | |
3bf79539 MD |
415 | - Stream ID, used as reference to stream description in metadata. |
416 | ||
417 | Metadata-defined layout (event packet context): | |
418 | ||
419 | - Event packet content size (in bytes). | |
420 | - Event packet size (in bytes, includes padding). | |
421 | - Event packet content checksum (optional). Checksum excludes the event packet | |
422 | header. | |
423 | - Per-stream event packet sequence count (to deal with UDP packet loss). The | |
424 | number of significant sequence counter bits should also be present, so | |
425 | wrap-arounds are deal with correctly. | |
426 | - Timestamp at the beginning and timestamp at the end of the event packet. | |
427 | Both timestamps are written in the packet header, but sampled respectively | |
428 | while (or before) writing the first event and while (or after) writing the | |
429 | last event in the packet. The inclusive range between these timestamps should | |
430 | include all event timestamps assigned to events contained within the packet. | |
5ba9f198 | 431 | - Events discarded count |
3bf79539 MD |
432 | - Snapshot of a per-stream free-running counter, counting the number of |
433 | events discarded that were supposed to be written in the stream prior to | |
434 | the first event in the event packet. | |
5ba9f198 | 435 | * Note: producer-consumer buffer full condition should fill the current |
3bf79539 | 436 | event packet with padding so we know exactly where events have been |
5ba9f198 | 437 | discarded. |
3bf79539 MD |
438 | - Lossless compression scheme used for the event packet content. Applied |
439 | directly to raw data. New types of compression can be added in following | |
440 | versions of the format. | |
5ba9f198 MD |
441 | 0: no compression scheme |
442 | 1: bzip2 | |
443 | 2: gzip | |
3bf79539 MD |
444 | 3: xz |
445 | - Cypher used for the event packet content. Applied after compression. | |
5ba9f198 MD |
446 | 0: no encryption |
447 | 1: AES | |
3bf79539 | 448 | - Checksum scheme used for the event packet content. Applied after encryption. |
5ba9f198 MD |
449 | 0: no checksum |
450 | 1: md5 | |
451 | 2: sha1 | |
452 | 3: crc32 | |
453 | ||
3bf79539 MD |
454 | 5.1 Event Packet Header Fixed Layout Description |
455 | ||
456 | type event_packet_header { | |
5ba9f198 MD |
457 | parent = struct; |
458 | fields = { | |
3bf79539 MD |
459 | uint32_t magic; |
460 | type { | |
461 | parent = array; | |
462 | length = 16; | |
463 | elem_type = uint8_t; | |
464 | } trace_uuid; | |
465 | uint32_t stream_id; | |
466 | } | |
5ba9f198 | 467 | |
3bf79539 MD |
468 | 5.2 Event Packet Context Description |
469 | ||
470 | Event packet context example. These are declared within the stream declaration | |
471 | in the metadata. All these fields are optional except for "content_size" and | |
472 | "packet_size", which must be present in the context. | |
473 | ||
474 | An example event packet context type: | |
475 | ||
476 | type event_packet_context { | |
477 | uint64_t timestamp_begin; | |
478 | uint64_t timestamp_end; | |
479 | uint32_t checksum; | |
480 | uint32_t stream_packet_count; | |
481 | uint32_t events_discarded; | |
482 | uint32_t cpu_id; | |
483 | uint32_t/uint16_t content_size; | |
484 | uint32_t/uint16_t packet_size; | |
485 | uint8_t stream_packet_count_bits; /* Significant counter bits */ | |
486 | uint8_t compression_scheme; | |
487 | uint8_t encryption_scheme; | |
488 | uint8_t checksum; | |
489 | }; | |
5ba9f198 MD |
490 | |
491 | 6. Event Structure | |
492 | ||
493 | The overall structure of an event is: | |
494 | ||
3bf79539 | 495 | - Event Header (as specifed by the stream metadata) |
5ba9f198 | 496 | - Extended Event Header (as specified by the event header) |
3bf79539 | 497 | - Event Context (as specified by the stream metadata) |
5ba9f198 MD |
498 | - Event Payload (as specified by the event metadata) |
499 | ||
500 | ||
501 | 6.1 Event Header | |
502 | ||
3bf79539 MD |
503 | One major factor can vary between streams: the number of event IDs assigned to |
504 | a stream. Luckily, this information tends to stay relatively constant (modulo | |
5ba9f198 | 505 | event registration while trace is being recorded), so we can specify different |
3bf79539 | 506 | representations for streams containing few event IDs and streams containing |
5ba9f198 MD |
507 | many event IDs, so we end up representing the event ID and timestamp as densely |
508 | as possible in each case. | |
509 | ||
3bf79539 MD |
510 | We therefore provide two types of events headers. Type 1 accommodates streams |
511 | with less than 31 event IDs. Type 2 accommodates streams with 31 or more event | |
5ba9f198 MD |
512 | IDs. |
513 | ||
514 | The "extended headers" are used in the rare occasions where the information | |
3bf79539 MD |
515 | cannot be represented in the ranges available in the event header. They are also |
516 | used in the rare occasions where the data required for a field could not be | |
517 | collected: the flag corresponding to the missing field within the missing_fields | |
518 | array is then set to 1. | |
5ba9f198 MD |
519 | |
520 | Types uintX_t represent an X-bit unsigned integer. | |
521 | ||
522 | ||
523 | 6.1.1 Type 1 - Few event IDs | |
524 | ||
525 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
526 | preference). | |
527 | - Fixed size: 32 bits. | |
528 | - Native architecture byte ordering. | |
529 | ||
530 | type event_header_1 { | |
531 | parent = struct; | |
532 | fields = { | |
3bf79539 | 533 | uint5_t id; /* |
5ba9f198 MD |
534 | * id: range: 0 - 30. |
535 | * id 31 is reserved to indicate a following | |
536 | * extended header. | |
537 | */ | |
3bf79539 | 538 | uint27_t timestamp; |
5ba9f198 MD |
539 | }; |
540 | }; | |
541 | ||
542 | The end of a type 1 header is aligned on a 32-bit boundary (or packed). | |
543 | ||
544 | ||
545 | 6.1.2 Extended Type 1 Event Header | |
546 | ||
547 | - Follows struct event_header_1, which is aligned on 32-bit, so no need to | |
548 | realign. | |
3bf79539 | 549 | - Variable size (depends on the number of fields per event). |
5ba9f198 MD |
550 | - Native architecture byte ordering. |
551 | ||
552 | type event_header_1_ext { | |
553 | parent = struct; | |
554 | fields = { | |
3bf79539 MD |
555 | uint32_t id; /* 32-bit event IDs */ |
556 | uint64_t timestamp; /* 64-bit timestamps */ | |
557 | type { | |
558 | parent = array; | |
559 | length = NR_FIELDS; /* Number of fields within the event */ | |
560 | elem_type = uint1_t; /* 1-bit bitfield */ | |
561 | } missing_fields; | |
5ba9f198 MD |
562 | }; |
563 | }; | |
564 | ||
5ba9f198 MD |
565 | |
566 | 6.1.3 Type 2 - Many event IDs | |
567 | ||
568 | - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture | |
569 | preference). | |
570 | - Fixed size: 48 bits. | |
571 | - Native architecture byte ordering. | |
572 | ||
573 | type event_header_2 { | |
574 | parent = struct; | |
575 | fields = { | |
3bf79539 MD |
576 | uint32_t timestamp; |
577 | uint16_t id; /* | |
5ba9f198 MD |
578 | * id: range: 0 - 65534. |
579 | * id 65535 is reserved to indicate a following | |
580 | * extended header. | |
581 | */ | |
582 | }; | |
583 | }; | |
584 | ||
585 | The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if | |
586 | byte-packed). | |
587 | ||
588 | ||
589 | 6.1.4 Extended Type 2 Event Header | |
590 | ||
591 | - Follows struct event_header_2, which alignment end on a 16-bit boundary, so | |
3bf79539 | 592 | we need to align on 64-bit integer architecture alignment (or 8-bit if |
5ba9f198 | 593 | byte-packed). |
3bf79539 | 594 | - Variable size (depends on the number of fields per event). |
5ba9f198 MD |
595 | - Native architecture byte ordering. |
596 | ||
597 | type event_header_2_ext { | |
598 | parent = struct; | |
599 | fields = { | |
3bf79539 MD |
600 | uint64_t timestamp; /* 64-bit timestamps */ |
601 | uint32_t id; /* 32-bit event IDs */ | |
602 | type { | |
603 | parent = array; | |
604 | length = NR_FIELDS; /* Number of fields within the event */ | |
605 | elem_type = uint1_t; /* 1-bit bitfield */ | |
606 | } missing_fields; | |
5ba9f198 MD |
607 | }; |
608 | }; | |
609 | ||
5ba9f198 MD |
610 | |
611 | 6.2 Event Context | |
612 | ||
613 | The event context contains information relative to the current event. The choice | |
3bf79539 | 614 | and meaning of this information is specified by the metadata "stream" |
5ba9f198 | 615 | information. For this trace format, event context is usually empty, except when |
3bf79539 | 616 | the metadata "stream" information specifies otherwise by declaring a non-empty |
5ba9f198 MD |
617 | structure for the event context. An example of event context is to save the |
618 | event payload size with each event, or to save the current PID with each event. | |
3bf79539 | 619 | These are declared within the stream declaration within the metadata. |
5ba9f198 | 620 | |
3bf79539 | 621 | An example event context type: |
5ba9f198 | 622 | |
3bf79539 MD |
623 | type event_context { |
624 | parent = struct; | |
625 | fields = { | |
626 | uint pid; | |
627 | uint16_t payload_size; | |
628 | }; | |
629 | }; | |
5ba9f198 MD |
630 | |
631 | ||
632 | 6.3 Event Payload | |
633 | ||
634 | An event payload contains fields specific to a given event type. The fields | |
635 | belonging to an event type are described in the event-specific metadata | |
636 | within a structure type. | |
637 | ||
638 | 6.3.1 Padding | |
639 | ||
640 | No padding at the end of the event payload. This differs from the ISO/C standard | |
641 | for structures, but follows the CTF standard for structures. In a trace, even | |
642 | though it makes sense to align the beginning of a structure, it really makes no | |
643 | sense to add padding at the end of the structure, because structures are usually | |
644 | not followed by a structure of the same type. | |
645 | ||
646 | This trick can be done by adding a zero-length "end" field at the end of the C | |
647 | structures, and by using the offset of this field rather than using sizeof() | |
3bf79539 | 648 | when calculating the size of a structure (see Appendix "A. Helper macros"). |
5ba9f198 MD |
649 | |
650 | 6.3.2 Alignment | |
651 | ||
652 | The event payload is aligned on the largest alignment required by types | |
653 | contained within the payload. (This follows the ISO/C standard for structures) | |
654 | ||
655 | ||
656 | ||
657 | 7. Metadata | |
658 | ||
3bf79539 MD |
659 | The meta-data is located in a stream named "metadata". It is made of "event |
660 | packets", which each start with an event packet header. The event type within | |
661 | the metadata stream have no event header nor event context. Each event only | |
5ba9f198 | 662 | contains a null-terminated "string" payload, which is a metadata description |
3bf79539 MD |
663 | entry. The events are packed one next to another. Each event packet start with |
664 | an event packet header, which contains, amongst other fields, the magic number | |
665 | and trace UUID. | |
5ba9f198 MD |
666 | |
667 | The metadata can be parsed by reading through the metadata strings, skipping | |
3bf79539 | 668 | newlines and null-characters. Type names may contain spaces. |
5ba9f198 MD |
669 | |
670 | trace { | |
671 | major = value; /* Trace format version */ | |
672 | minor = value; | |
3bf79539 MD |
673 | uuid = value; /* Trace UUID */ |
674 | word_size = value; | |
675 | }; | |
5ba9f198 | 676 | |
3bf79539 MD |
677 | stream { |
678 | id = stream_id; | |
5ba9f198 | 679 | event { |
3bf79539 MD |
680 | /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */ |
681 | header_type = event_header_1 OR event_header_2; | |
682 | /* | |
683 | * Extended event header type. Only present if specified in event header | |
684 | * on a per-event basis. | |
685 | */ | |
686 | header_type_ext = event_header_1_ext OR event_header_2_ext; | |
687 | context_type = type inheriting from "struct" abstract type; | |
688 | }; | |
689 | packet { | |
690 | context_type = type inheriting from "struct" abstract type; | |
691 | }; | |
692 | }; | |
5ba9f198 MD |
693 | |
694 | event { | |
3bf79539 MD |
695 | name = eventname; |
696 | id = value; /* Numeric identifier within the stream */ | |
697 | stream = stream_id; | |
698 | fields = type inheriting from "struct" abstract type; | |
699 | }; | |
5ba9f198 MD |
700 | |
701 | /* More detail on types in section 4. Types */ | |
702 | ||
703 | /* Named types */ | |
3bf79539 MD |
704 | type { |
705 | name = typename; | |
706 | ... | |
707 | }; | |
5ba9f198 | 708 | |
3bf79539 | 709 | /* Unnamed types, contained within compound type fields or type assignments. */ |
5ba9f198 | 710 | type { |
3bf79539 MD |
711 | ... |
712 | }; | |
713 | ||
5ba9f198 | 714 | |
3bf79539 MD |
715 | Structure types used for fields and context_type implicitly inherit from |
716 | "struct" and require no "type" identifier before the braces. E.g.: | |
717 | ||
718 | fields = { | |
719 | typeA name1; | |
720 | typeB name2; | |
721 | ... | |
722 | }; | |
723 | ||
724 | ||
725 | A. Helper macros | |
5ba9f198 MD |
726 | |
727 | The two following macros keep track of the size of a GNU/C structure without | |
728 | padding at the end by placing HEADER_END as the last field. A one byte end field | |
729 | is used for C90 compatibility (C99 flexible arrays could be used here). Note | |
730 | that this does not affect the effective structure size, which should always be | |
731 | calculated with the header_sizeof() helper. | |
732 | ||
733 | #define HEADER_END char end_field | |
734 | #define header_sizeof(type) offsetof(typeof(type), end_field) | |
3bf79539 MD |
735 | |
736 | ||
737 | B. Stream Header Rationale | |
738 | ||
739 | An event stream is divided in contiguous event packets of variable size. These | |
740 | subdivisions allow the trace analyzer to perform a fast binary search by time | |
741 | within the stream (typically requiring to index only the event packet headers) | |
742 | without reading the whole stream. These subdivisions have a variable size to | |
743 | eliminate the need to transfer the event packet padding when partially filled | |
744 | event packets must be sent when streaming a trace for live viewing/analysis. | |
745 | An event packet can contain a certain amount of padding at the end. Dividing | |
746 | streams into event packets is also useful for network streaming over UDP and | |
747 | flight recorder mode tracing (a whole event packet can be swapped out of the | |
748 | buffer atomically for reading). | |
749 | ||
750 | The stream header is repeated at the beginning of each event packet to allow | |
751 | flexibility in terms of: | |
752 | ||
753 | - streaming support, | |
754 | - allowing arbitrary buffers to be discarded without making the trace | |
755 | unreadable, | |
756 | - allow UDP packet loss handling by either dealing with missing event packet | |
757 | or asking for re-transmission. | |
758 | - transparently support flight recorder mode, | |
759 | - transparently support crash dump. | |
760 | ||
761 | The event stream header will therefore be referred to as the "event packet | |
762 | header" throughout the rest of this document. |