2 RFC: Common Trace Format Proposal for Linux (pre-v1.6)
4 Mathieu Desnoyers, EfficiOS Inc.
6 The goal of the present document is to propose a trace format that suits the
7 needs of the embedded, telecom, high-performance and kernel communities. It is
8 based on the Common Trace Format Requirements (v1.4) document. It is designed to
9 allow tracing that is natively generated by the Linux kernel and Linux
10 user-space applications written in C/C++.
12 A reference implementation of a library to read and write this trace format is
13 being implemented within the BabelTrace project, a converter between trace
14 formats. The development tree is available at:
16 git tree: git://git.efficios.com/babeltrace.git
17 gitweb: http://git.efficios.com/?p=babeltrace.git
20 1. Preliminary definitions
22 - Event Trace: An ordered sequence of events.
23 - Event Stream: An ordered sequence of events, containing a subset of the
25 - Event Packet: A sequence of physically contiguous events within an event
27 - Event: This is the basic entry in a trace. (aka: a trace record).
28 - An event identifier (ID) relates to the class (a type) of event within
30 e.g. event: irq_entry.
31 - An event (or event record) relates to a specific instance of an event
33 e.g. event: irq_entry, at time X, on CPU Y
34 - Source Architecture: Architecture writing the trace.
35 - Reader Architecture: Architecture reading the trace.
38 2. High-level representation of a trace
40 A trace is divided into multiple event streams. Each event stream contains a
41 subset of the trace event types.
43 The final output of the trace, after its generation and optional transport over
44 the network, is expected to be either on permanent or temporary storage in a
45 virtual file system. Because each event stream is appended to while a trace is
46 being recorded, each is associated with a separate file for output. Therefore,
47 a stored trace can be represented as a directory containing one file per stream.
49 A metadata event stream contains information on trace event types. It describes:
53 - Per-stream event header description.
54 - Per-stream event header selection.
55 - Per-stream event context fields.
57 - Event type to stream mapping.
58 - Event type to name mapping.
59 - Event type to ID mapping.
60 - Event fields description.
65 An event stream is divided in contiguous event packets of variable size. These
66 subdivisions have a variable size. An event packet can contain a certain amount
67 of padding at the end. The rationale for the event stream design choices is
68 explained in Appendix B. Stream Header Rationale.
70 An event stream is divided in contiguous event packets of variable size. These
71 subdivisions have a variable size. An event packet can contain a certain amount
72 of padding at the end. The stream header is repeated at the beginning of each
75 The event stream header will therefore be referred to as the "event packet
76 header" throughout the rest of this document.
83 A basic type is a scalar type, as described in this section.
85 4.1.1 Type inheritance
87 Type specifications can be inherited to allow deriving concrete types from an
88 abstract type. For example, see the uint32_t type derived from the "integer"
89 abstract type below ("Integers" section). Concrete types have a precise binary
90 representation in the trace. Abstract types have methods to read and write these
91 types, but must be derived into a concrete type to be usable in an event field.
93 Concrete types inherit from abstract types. Abstract types can inherit from
98 We define "byte-packed" types as aligned on the byte size, namely 8-bit.
99 We define "bit-packed" types as following on the next bit, as defined by the
102 All basic types, except bitfields, are either aligned on an architecture-defined
103 specific alignment or byte-packed, depending on the architecture preference.
104 Architectures providing fast unaligned write byte-packed basic types to save
105 space, aligning each type on byte boundaries (8-bit). Architectures with slow
106 unaligned writes align types on specific alignment values. If no specific
107 alignment is declared for a type nor its parents, it is assumed to be bit-packed
108 for bitfields and byte-packed for other types.
110 Metadata attribute representation of a specific alignment:
112 align = value; /* value in bits */
116 By default, the native endianness of the source architecture the trace is used.
117 Byte order can be overridden for a basic type by specifying a "byte_order"
118 attribute. Typical use-case is to specify the network byte order (big endian:
119 "be") to save data captured from the network into the trace without conversion.
120 If not specified, the byte order is native.
122 Metadata representation:
124 byte_order = native OR network OR be OR le; /* network and be are aliases */
128 Type size, in bits, for integers and floats is that returned by "sizeof()" in C
129 multiplied by CHAR_BIT.
130 We require the size of "char" and "unsigned char" types (CHAR_BIT) to be fixed
131 to 8 bits for cross-endianness compatibility.
133 Metadata representation:
135 size = value; (value is in bits)
139 Signed integers are represented in two-complement. Integer alignment, size,
140 signedness and byte ordering are defined in the metadata. Integers aligned on
141 byte size (8-bit) and with length multiple of byte size (8-bit) correspond to
142 the C99 standard integers. In addition, integers with alignment and/or size that
143 are _not_ a multiple of the byte size are permitted; these correspond to the C99
144 standard bitfields, with the added specification that the CTF integer bitfields
145 have a fixed binary representation. A MIT-licensed reference implementation of
146 the CTF portable bitfields is available at:
148 http://git.efficios.com/?p=babeltrace.git;a=blob;f=include/babeltrace/bitfield.h
150 Binary representation of integers:
152 - On little and big endian:
153 - Within a byte, high bits correspond to an integer high bits, and low bits
154 correspond to low bits.
156 - Integer across multiple bytes are placed from the less significant to the
158 - Consecutive integers are placed from lower bits to higher bits (even within
161 - Integer across multiple bytes are placed from the most significant to the
163 - Consecutive integers are placed from higher bits to lower bits (even within
166 This binary representation is derived from the bitfield implementation in GCC
167 for little and big endian. However, contrary to what GCC does, integers can
168 cross units boundaries (no padding is required). Padding can be explicitely
169 added (see 4.1.6 GNU/C bitfields) to follow the GCC layout if needed.
171 Metadata representation:
173 abstract_type integer {
174 signed = true OR false; /* default false */
175 byte_order = native OR network OR be OR le; /* default native */
176 size = value; /* value in bits, no default */
177 align = value; /* value in bits */
180 Example of type inheritance (creation of a concrete type uint32_t):
189 Definition of a 5-bit signed bitfield:
198 4.1.6 GNU/C bitfields
200 The GNU/C bitfields follow closely the integer representation, with a
201 particularity on alignment: if a bitfield cannot fit in the current unit, the
202 unit is padded and the bitfield starts at the following unit. We therefore need
203 to express the extra "unit size" information.
205 Metadata representation:
207 abstract_type gcc_bitfield {
212 As an example, the following structure declared in C compiled by GCC:
219 Would correspond to the following structure, aligned on the largest element
220 (short). The second bitfield would be aligned on the next unit boundary, because
221 it would not fit in the current unit.
223 type struct_example {
227 parent = gcc_bitfield;
228 unit_size = 16; /* sizeof(short) */
234 parent = gcc_bitfield;
235 unit_size = 16; /* sizeof(short) */
245 The floating point values byte ordering is defined in the metadata.
247 Floating point values follow the IEEE 754-2008 standard interchange formats.
248 Description of the floating point values include the exponent and mantissa size
249 in bits. Some requirements are imposed on the floating point values:
251 - FLT_RADIX must be 2.
252 - mant_dig is the number of digits represented in the mantissa. It is specified
253 by the ISO C99 standard, section 5.2.4, as FLT_MANT_DIG, DBL_MANT_DIG and
254 LDBL_MANT_DIG as defined by <float.h>.
255 - exp_dig is the number of digits represented in the exponent. Given that
256 mant_dig is one bit more than its actual size in bits (leading 1 is not
257 needed) and also given that the sign bit always takes one bit, exp_dig can be
260 - sizeof(float) * CHAR_BIT - FLT_MANT_DIG
261 - sizeof(double) * CHAR_BIT - DBL_MANT_DIG
262 - sizeof(long double) * CHAR_BIT - LDBL_MANT_DIG
264 Metadata representation:
266 abstract_type floating_point {
269 byte_order = native OR network OR be OR le;
272 Example of type inheritance:
275 exp_dig = 8; /* sizeof(float) * CHAR_BIT - FLT_MANT_DIG */
276 mant_dig = 24; /* FLT_MANT_DIG */
280 TODO: define NaN, +inf, -inf behavior.
284 Enumerations are a mapping between an integer type and a table of strings. The
285 numerical representation of the enumeration follows the integer type specified
286 by the metadata. The enumeration mapping table is detailed in the enumeration
287 description within the metadata. The mapping table maps inclusive value ranges
288 (or single values) to strings. Instead of being limited to simple
289 "value -> string" mappings, these enumerations map
290 "[ start_value .. end_value ] -> string", which map inclusive ranges of
291 values to strings. An enumeration from the C language can be represented in
292 this format by having the same start_value and end_value for each element, which
293 is in fact a range of size 1. This single-value range is supported without
294 repeating the start and end values with the { value, string } declaration.
299 { { start_value, end_value }, string },
300 { { start_value, end_value }, string },
301 { { start_value, end_value }, string },
313 Structures are aligned on the largest alignment required by basic types
314 contained within the structure. (This follows the ISO/C standard for structures)
316 Metadata representation:
318 abstract_type struct {
320 field_type field_name;
321 field_type field_name;
328 type struct_example {
331 type { /* Nameless type */
337 uint64_t second_field_name; /* Named type declared in the metadata */
341 The fields are placed in a sequence next to each other. They each possess a
342 field name, which is a unique identifier within the structure.
346 Arrays are fixed-length. Their length is declared in the type declaration within
347 the metadata. They contain an array of "inner type" elements, which can refer to
348 any type not containing the type of the array being declared (no circular
349 dependency). The length is the number of elements in an array.
351 Metadata representation:
353 abstract_type array {
363 elem_type = uint32_t;
368 Sequences are dynamically-sized arrays. They start with an integer that specify
369 the length of the sequence, followed by an array of "inner type" elements.
370 The length is the number of elements in the sequence.
372 abstract_type sequence {
373 length_type = type; /* Inheriting from integer */
377 The integer type follows the integer types specifications, and the sequence
378 elements follow the "array" specifications.
382 Strings are an array of bytes of variable size and are terminated by a '\0'
383 "NULL" character. Their encoding is described in the metadata. In absence of
384 encoding attribute information, the default encoding is UTF-8.
386 abstract_type string {
387 encoding = UTF8 OR ASCII;
391 5. Event Packet Header
393 The event packet header consists of two part: one is mandatory and have a fixed
394 layout. The second part, the "event packet context", has its layout described in
397 - Aligned on page size. Fixed size. Fields either aligned or packed (depending
398 on the architecture preference).
399 No padding at the end of the event packet header. Native architecture byte
402 Fixed layout (event packet header):
404 - Magic number (CTF magic numbers: 0xC1FC1FC1 and its reverse endianness
405 representation: 0xC11FFCC1) It needs to have a non-symmetric bytewise
406 representation. Used to distinguish between big and little endian traces (this
407 information is determined by knowing the endianness of the architecture
408 reading the trace and comparing the magic number against its value and the
409 reverse, 0xC11FFCC1). This magic number specifies that we use the CTF metadata
410 description language described in this document. Different magic numbers
411 should be used for other metadata description languages.
412 - Trace UUID, used to ensure the event packet match the metadata used.
413 (note: we cannot use a metadata checksum because metadata can be appended to
414 while tracing is active)
415 - Stream ID, used as reference to stream description in metadata.
417 Metadata-defined layout (event packet context):
419 - Event packet content size (in bytes).
420 - Event packet size (in bytes, includes padding).
421 - Event packet content checksum (optional). Checksum excludes the event packet
423 - Per-stream event packet sequence count (to deal with UDP packet loss). The
424 number of significant sequence counter bits should also be present, so
425 wrap-arounds are deal with correctly.
426 - Timestamp at the beginning and timestamp at the end of the event packet.
427 Both timestamps are written in the packet header, but sampled respectively
428 while (or before) writing the first event and while (or after) writing the
429 last event in the packet. The inclusive range between these timestamps should
430 include all event timestamps assigned to events contained within the packet.
431 - Events discarded count
432 - Snapshot of a per-stream free-running counter, counting the number of
433 events discarded that were supposed to be written in the stream prior to
434 the first event in the event packet.
435 * Note: producer-consumer buffer full condition should fill the current
436 event packet with padding so we know exactly where events have been
438 - Lossless compression scheme used for the event packet content. Applied
439 directly to raw data. New types of compression can be added in following
440 versions of the format.
441 0: no compression scheme
445 - Cypher used for the event packet content. Applied after compression.
448 - Checksum scheme used for the event packet content. Applied after encryption.
454 5.1 Event Packet Header Fixed Layout Description
456 type event_packet_header {
468 5.2 Event Packet Context Description
470 Event packet context example. These are declared within the stream declaration
471 in the metadata. All these fields are optional except for "content_size" and
472 "packet_size", which must be present in the context.
474 An example event packet context type:
476 type event_packet_context {
477 uint64_t timestamp_begin;
478 uint64_t timestamp_end;
480 uint32_t stream_packet_count;
481 uint32_t events_discarded;
483 uint32_t/uint16_t content_size;
484 uint32_t/uint16_t packet_size;
485 uint8_t stream_packet_count_bits; /* Significant counter bits */
486 uint8_t compression_scheme;
487 uint8_t encryption_scheme;
493 The overall structure of an event is:
495 - Event Header (as specifed by the stream metadata)
496 - Extended Event Header (as specified by the event header)
497 - Event Context (as specified by the stream metadata)
498 - Event Payload (as specified by the event metadata)
503 One major factor can vary between streams: the number of event IDs assigned to
504 a stream. Luckily, this information tends to stay relatively constant (modulo
505 event registration while trace is being recorded), so we can specify different
506 representations for streams containing few event IDs and streams containing
507 many event IDs, so we end up representing the event ID and timestamp as densely
508 as possible in each case.
510 We therefore provide two types of events headers. Type 1 accommodates streams
511 with less than 31 event IDs. Type 2 accommodates streams with 31 or more event
514 The "extended headers" are used in the rare occasions where the information
515 cannot be represented in the ranges available in the event header. They are also
516 used in the rare occasions where the data required for a field could not be
517 collected: the flag corresponding to the missing field within the missing_fields
518 array is then set to 1.
520 Types uintX_t represent an X-bit unsigned integer.
523 6.1.1 Type 1 - Few event IDs
525 - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture
527 - Fixed size: 32 bits.
528 - Native architecture byte ordering.
530 type event_header_1 {
535 * id 31 is reserved to indicate a following
542 The end of a type 1 header is aligned on a 32-bit boundary (or packed).
545 6.1.2 Extended Type 1 Event Header
547 - Follows struct event_header_1, which is aligned on 32-bit, so no need to
549 - Variable size (depends on the number of fields per event).
550 - Native architecture byte ordering.
552 type event_header_1_ext {
555 uint32_t id; /* 32-bit event IDs */
556 uint64_t timestamp; /* 64-bit timestamps */
559 length = NR_FIELDS; /* Number of fields within the event */
560 elem_type = uint1_t; /* 1-bit bitfield */
566 6.1.3 Type 2 - Many event IDs
568 - Aligned on 32-bit (or 8-bit if byte-packed, depending on the architecture
570 - Fixed size: 48 bits.
571 - Native architecture byte ordering.
573 type event_header_2 {
578 * id: range: 0 - 65534.
579 * id 65535 is reserved to indicate a following
585 The end of a type 2 header is aligned on a 16-bit boundary (or 8-bit if
589 6.1.4 Extended Type 2 Event Header
591 - Follows struct event_header_2, which alignment end on a 16-bit boundary, so
592 we need to align on 64-bit integer architecture alignment (or 8-bit if
594 - Variable size (depends on the number of fields per event).
595 - Native architecture byte ordering.
597 type event_header_2_ext {
600 uint64_t timestamp; /* 64-bit timestamps */
601 uint32_t id; /* 32-bit event IDs */
604 length = NR_FIELDS; /* Number of fields within the event */
605 elem_type = uint1_t; /* 1-bit bitfield */
613 The event context contains information relative to the current event. The choice
614 and meaning of this information is specified by the metadata "stream"
615 information. For this trace format, event context is usually empty, except when
616 the metadata "stream" information specifies otherwise by declaring a non-empty
617 structure for the event context. An example of event context is to save the
618 event payload size with each event, or to save the current PID with each event.
619 These are declared within the stream declaration within the metadata.
621 An example event context type:
627 uint16_t payload_size;
634 An event payload contains fields specific to a given event type. The fields
635 belonging to an event type are described in the event-specific metadata
636 within a structure type.
640 No padding at the end of the event payload. This differs from the ISO/C standard
641 for structures, but follows the CTF standard for structures. In a trace, even
642 though it makes sense to align the beginning of a structure, it really makes no
643 sense to add padding at the end of the structure, because structures are usually
644 not followed by a structure of the same type.
646 This trick can be done by adding a zero-length "end" field at the end of the C
647 structures, and by using the offset of this field rather than using sizeof()
648 when calculating the size of a structure (see Appendix "A. Helper macros").
652 The event payload is aligned on the largest alignment required by types
653 contained within the payload. (This follows the ISO/C standard for structures)
659 The meta-data is located in a stream named "metadata". It is made of "event
660 packets", which each start with an event packet header. The event type within
661 the metadata stream have no event header nor event context. Each event only
662 contains a null-terminated "string" payload, which is a metadata description
663 entry. The events are packed one next to another. Each event packet start with
664 an event packet header, which contains, amongst other fields, the magic number
667 The metadata can be parsed by reading through the metadata strings, skipping
668 newlines and null-characters. Type names may contain spaces.
671 major = value; /* Trace format version */
673 uuid = value; /* Trace UUID */
680 /* Type 1 - Few event IDs; Type 2 - Many event IDs. See section 6.1. */
681 header_type = event_header_1 OR event_header_2;
683 * Extended event header type. Only present if specified in event header
684 * on a per-event basis.
686 header_type_ext = event_header_1_ext OR event_header_2_ext;
687 context_type = type inheriting from "struct" abstract type;
690 context_type = type inheriting from "struct" abstract type;
696 id = value; /* Numeric identifier within the stream */
698 fields = type inheriting from "struct" abstract type;
701 /* More detail on types in section 4. Types */
709 /* Unnamed types, contained within compound type fields or type assignments. */
715 Structure types used for fields and context_type implicitly inherit from
716 "struct" and require no "type" identifier before the braces. E.g.:
727 The two following macros keep track of the size of a GNU/C structure without
728 padding at the end by placing HEADER_END as the last field. A one byte end field
729 is used for C90 compatibility (C99 flexible arrays could be used here). Note
730 that this does not affect the effective structure size, which should always be
731 calculated with the header_sizeof() helper.
733 #define HEADER_END char end_field
734 #define header_sizeof(type) offsetof(typeof(type), end_field)
737 B. Stream Header Rationale
739 An event stream is divided in contiguous event packets of variable size. These
740 subdivisions allow the trace analyzer to perform a fast binary search by time
741 within the stream (typically requiring to index only the event packet headers)
742 without reading the whole stream. These subdivisions have a variable size to
743 eliminate the need to transfer the event packet padding when partially filled
744 event packets must be sent when streaming a trace for live viewing/analysis.
745 An event packet can contain a certain amount of padding at the end. Dividing
746 streams into event packets is also useful for network streaming over UDP and
747 flight recorder mode tracing (a whole event packet can be swapped out of the
748 buffer atomically for reading).
750 The stream header is repeated at the beginning of each event packet to allow
751 flexibility in terms of:
754 - allowing arbitrary buffers to be discarded without making the trace
756 - allow UDP packet loss handling by either dealing with missing event packet
757 or asking for re-transmission.
758 - transparently support flight recorder mode,
759 - transparently support crash dump.
761 The event stream header will therefore be referred to as the "event packet
762 header" throughout the rest of this document.