The CTF file format

2.1.1 CTF file-wide flags

The preamble contains bitflags in its ctp_flags field that describe various file-wide properties. Some of the flags are valid only for particular file-format versions, which means the flags can be used to fix file-format bugs. Consumers that see unknown flags should accordingly assume that the dictionary is not comprehensible, and refuse to open them.

The following flags are currently defined. Many are bug workarounds, valid only in CTFv3, and will not be valid in any future versions: the same values may be reused for other flags in v4+.

CTF_F_NEWFUNCINFO and CTF_F_IDXSORTED relate to the function info and data object sections. See The symtypetab sections.

Further flags (and further compression methods) wil be added in future.

2.3.1 The info word, ctt_info

The info word is a bitfield split into three parts. From MSB to LSB:

The most mysterious of these is undoubtedly isroot. This indicates whether types with names (nonzero ctt_name) are visible to name lookup: if zero, this type is considered a non-root type and you can’t look it up by name at all. Multiple types with the same name in the same C namespace (struct, union, enum, other) can exist in a single dictionary, but only one of them may have a nonzero value for isroot. libctf validates this at open time and refuses to open dictionaries that violate this constraint.

Historically, this feature was introduced for the encoding of bitfields (see Integer types): for instance, int bitfields will all be named int with different widths or offsets, but only the full-width one at offset zero is wanted when you look up the type named int. With the introduction of slices (see Slices) as a more general bitfield encoding mechanism, this is less important, but we still use non-root types to handle conflicts if the linker API is used to fuse multiple translation units into one dictionary and those translation units contain types with the same name and conflicting definitions. (We do not discuss this further here, because the linker never does this: only specialized type mergers do, like that used for the Linux kernel. The libctf documentation will describe this in more detail.)

The CTF_TYPE_INFO macro can be used to compose an info word from a kind, isroot, and vlen; CTF_V2_INFO_KIND, CTF_V2_INFO_ISROOT and CTF_V2_INFO_VLEN pick it apart again.

2.3.2 Type indexes and type IDs

Types are referred to within the CTF file via type IDs. A type ID is a number from 0 to 2^32, from a space divided in half. Types 2^31-1 and below are in the parent range: these IDs are used for dictionaries that have not had any other dictionary ctf_imported into it as a parent. Both completely standalone dictionaries and parent dictionaries with children hanging off them have types in this range. Types 2^31 and above are in the child range: only types in child dictionaries are in this range.

These IDs appear in ctf_type_t.ctt_type (see The type section), but the types themselves have no visible ID: quite intentionally, because adding an ID uses space, and every ID is different so they don’t compress well. The IDs are implicit: at open time, the consumer walks through the entire type section and counts the types in the type section. The type section is an array of variable-length elements, so each entry could be considered as having an index, starting from 1. We count these indexes and associate each with its corresponding ctf_type_t or ctf_stype_t.

Lookups of types with IDs in the parent space look in the parent dictionary if this dictionary has one associated with it; lookups of types with IDs in the child space error out if the dictionary does not have a parent, and otherwise convert the ID into an index by shaving off the top bit and look up the index in the child.

These properties mean that the same dictionary can be used as a parent of child dictionaries and can also be used directly with no children at all, but a dictionary created as a child dictionary must always be associated with a parent — usually, the same parent — because its references to its own types have the high bit turned on and this is only flipped off again if this is a child dictionary. (This is not a problem, because if you don’t associate the child with a parent, any references within it to its parent types will fail, and there are almost certain to be many such references, or why is it a child at all?)

This does mean that consumers should keep a close eye on the distinction between type IDs and type indexes: if you mix them up, everything will appear to work as long as you’re only using parent dictionaries or standalone dictionaries, but as soon as you start using children, everything will fail horribly.

Type index zero, and type ID zero, are used to indicate that this type cannot be represented in CTF as currently constituted: they are emitted by the compiler, but all type chains that terminate in the unknown type are erased at link time (structure fields that use them just vanish, etc). So you will probably never see a use of type zero outside the symtypetab sections, where they serve as sentinels of sorts, to indicate symbols with no associated type.

The macros CTF_V2_TYPE_TO_INDEX and CTF_V2_INDEX_TO_TYPE may help in translation between types and indexes: CTF_V2_TYPE_ISPARENT and CTF_V2_TYPE_ISCHILD can be used to tell whether a given ID is in the parent or child range.

It is quite possible and indeed common for type IDs to point forward in the dictionary, as well as backward.

2.3.3 Type kinds

Every type in CTF is of some kind. Each kind is some variety of C type: all structures are a single kind, as are all unions, all pointers, all arrays, all integers regardless of their bitfield width, etc. The kind of a type is given in the kind field of the ctt_info word (see The info word, ctt_info).

The space of type kinds is only a quarter full so far, so there is plenty of room for expansion. It is likely that in future versions of the file format, types with smaller kinds will be more efficiently encoded than types with larger kinds, so their numerical value will actually start to matter in future. (So these IDs will probably change their numerical values in a later release of this format, to move more frequently-used kinds like structures and cv-quals towards the top of the space, and move rarely-used kinds like integers downwards. Yes, integers are rare: how many kinds of int are there in a program? They’re just very frequently referenced.)

Here’s the set of kinds so far. Each kind has a #define associated with it, also given here.

Now we cover all type kinds in turn. Some are more complicated than others.

2.3.4 Integer types

Integral types are all represented as types of kind CTF_K_INTEGER. These types fill out ctt_size in the ctf_stype_t with the size in bytes of the integral type in question. They are always represented by ctf_stype_t, never ctf_type_t. Their variable-length data is one uint32_t in length: vlen in the info word should be disregarded and is always zero.

The variable-length data for integers has multiple items packed into it much like the info word does.

If you choose, bitfields can be represented using the things above as a sort of integral type with the isroot bit flipped off and the offset and bits values set in the vlen word: you can populate it with the CTF_INT_DATA macro. (But it may be more convenient to represent them using slices of a full-width integer: see Slices.)

Integers that are bitfields usually have a ctt_size rounded up to the nearest power of two in bytes, for natural alignment (e.g. a 17-bit integer would have a ctt_size of 4). However, not all types are naturally aligned on all architectures: packed structures may in theory use integral bitfields with different ctt_size, though this is rarely observed.

The encoding for integers is a bit-field comprised of the values below, which consumers can use to decide how to display values of this type:

The GCC “Complex int” and fixed-point extensions are not yet supported: references to such types will be emitted as type 0.

2.3.5 Floating-point types

Floating-point types are all represented as types of kind CTF_K_FLOAT. Like integers, These types fill out ctt_size in the ctf_stype_t with the size in bytes of the floating-point type in question. They are always represented by ctf_stype_t, never ctf_type_t.

This part of CTF shows many rough edges in the more obscure corners of floating-point handling, and is likely to change in format v4.

The variable-length data for floats has multiple items packed into it just like integers do:

The purpose of the floating-point offset and bit-width is somewhat opaque, since there are no such things as floating-point bitfields in C: the bit-width should be filled out with the full width of the type in bits, and the offset should always be zero. It is likely that these fields will go away in the future. As with integers, you can use CTF_FP_DATA to assemble one of these vlen items from its component parts.

The encoding for floats is not a bitfield but a simple value indicating the display representation. Many of these are unused, relate to Solaris-specific compiler extensions, and will be recycled in future: some are unused and will become used in future.

The use of the complex floating-point encodings is obscure: it is possible that CTF_FP_CPLX is meant to be used for only the real part of complex types, and CTF_FP_IMAGRY et al for the imaginary part – but for now, we are emitting CTF_FP_CPLX to cover the entire type, with no way to get at its constituent parts. There appear to be no uses of these encodings anywhere, so they are quite likely to change incompatibly in future.

2.3.6 Slices

Slices, with kind CTF_K_SLICE, are an unusual CTF construct: they do not directly correspond to any C type, but are a way to model other types in a more convenient fashion for CTF generators.

A slice is like a pointer or other reference type in that they are always represented by ctf_stype_t: but unlike pointers and other reference types, they populate the ctt_size field just like integral types do, and come with an attached encoding and transform the encoding of the underlying type. The underlying type is described in the variable-length data, similarly to structure and union fields: see below. Requests for the type size should also chase down to the referenced type.

Slices are always nameless: ctt_name is always zero for them.

(The libctf API behaviour is unusual as well, and justifies the existence of slices: ctf_type_kind never returns CTF_K_SLICE but always the underlying type kind, so that consumers never need to know about slices: they can tell if an apparent integer is actually a slice if they need to by calling ctf_type_reference, which will uniquely return the underlying integral type rather than erroring out with ECTF_NOTREF if this is actually a slice. So slices act just like an integer with an encoding, but more closely mirror DWARF and other debugging information formats by allowing CTF file creators to represent a bitfield as a slice of an underlying integral type.)

The vlen in the info word for a slice should be ignored and is always zero. The variable-length data for a slice is a single ctf_slice_t:

typedef struct ctf_slice
{
  uint32_t cts_type;
  unsigned short cts_offset;
  unsigned short cts_bits;
} ctf_slice_t;

2.3.7 Pointers, typedefs, and cvr-quals

Pointers, typedefs, and const, volatile and restrict qualifiers are represented identically except for their type kind (though they may be treated differently by consuming libraries like libctf, since pointers affect assignment-compatibility in ways cvr-quals do not, and they may have different alignment requirements, etc).

All of these are represented by ctf_stype_t, have no variable data at all, and populate ctt_type with the type ID of the type they point to. These types can stack: a CTF_K_RESTRICT can point to a CTF_K_CONST which can point to a CTF_K_POINTER etc.

They are all unnamed: ctt_name is 0.

The size of CTF_K_POINTER is derived from the data model (see Data models), i.e. in practice, from the target machine ABI, and is not explicitly represented. The size of other kinds in this set should be determined by chasing ctf_types as necessary until a non-typedef/const/volatile/restrict is found, and using that.

2.3.8 Arrays

Arrays are encoded as types of kind CTF_K_ARRAY in a ctf_stype_t. Both size and kind for arrays are zero. The variable-length data is a ctf_array_t: vlen in the info word should be disregarded and is always zero.

typedef struct ctf_array
{
  uint32_t cta_contents;
  uint32_t cta_index;
  uint32_t cta_nelems;
} ctf_array_t;

The size of an array can be computed by simple multiplication of the size of the cta_contents type by the cta_nelems.

2.3.9 Function pointers

Function pointers are explicitly represented in the CTF type section by a type of kind CTF_K_FUNCTION, always encoded with a ctf_stype_t. The ctt_type is the function return type ID. The vlen in the info word is the number of arguments, each of which is a type ID, a uint32_t: if the last argument is 0, this is a varargs function and the number of arguments is one less than indicated by the vlen.

If the number of arguments is odd, a single uint32_t of padding is inserted to maintain alignment.

2.3.10 Enums

Enumerated types are represented as types of kind CTF_K_ENUM in a ctf_stype_t. The ctt_size is always the size of an int from the data model (enum bitfields are implemented via slices). The vlen is a count of enumerations, each of which is represented by a ctf_enum_t in the vlen:

typedef struct ctf_enum
{
  uint32_t cte_name;
  int32_t cte_value;
} ctf_enum_t;

Enumeration values larger than 2^32 are not yet supported and are omitted from the enumeration. (v4 will lift this restriction by encoding the value differently.)

Forward declarations of enums are not implemented with this kind: see Forward declarations.

Enumerated type names, as usual in C, go into their own namespace, and do not conflict with non-enums, structs, or unions with the same name.

2.3.11 Structs and unions

Structures and unions are represnted as types of kind CTF_K_STRUCT and CTF_K_UNION: their representation is otherwise identical, and it is perfectly allowed for “structs” to contain overlapping fields etc, so we will treat them together for the rest of this section.

They fill out ctt_size, and use ctf_type_t in preference to ctf_stype_t if the structure size is greater than CTF_MAX_SIZE (0xfffffffe).

The vlen for structures and unions is a count of structure fields, but the type used to represent a structure field (and thus the size of the variable-length array element representing the type) depends on the size of the structure: truly huge structures, greater than CTF_LSTRUCT_THRESH bytes in length, use a different type. (CTF_LSTRUCT_THRESH is 536870912, so such structures are vanishingly rare: in v4, this representation will change somewhat for greater compactness. It’s inherited from v1, where the limits were much lower.)

Most structures can get away with using ctf_member_t:

typedef struct ctf_member_v2
{
  uint32_t ctm_name;
  uint32_t ctm_offset;
  uint32_t ctm_type;
} ctf_member_t;

Huge structures that are represented by ctf_type_t rather than ctf_stype_t have to use ctf_lmember_t, which splits the offset as ctf_type_t splits the size:

typedef struct ctf_lmember_v2
{
  uint32_t ctlm_name;
  uint32_t ctlm_offsethi;
  uint32_t ctlm_type;
  uint32_t ctlm_offsetlo;
} ctf_lmember_t;

Here’s what the fields of ctf_member mean:

Here’s what the fields of the very similar ctf_lmember mean:

Macros CTF_LMEM_OFFSET, CTF_OFFSET_TO_LMEMHI and CTF_OFFSET_TO_LMEMLO serve to extract and install the values of the ctlm_offset fields, much as with the split size fields in ctf_type_t.

Unnamed structure and union fields are simply implemented by collapsing the unnamed field’s members into the containing structure or union: this does mean that a structure containing an unnamed union can end up being a “structure” with multiple members at the same offset. (A future format revision may collapse CTF_K_STRUCT and CTF_K_UNION into the same kind and decide among them based on whether their members do in fact overlap.)

Structure and union type names, as usual in C, go into their own namespace, just as enum type names do.

Forward declarations of structures and unions are not implemented with this kind: see Forward declarations.

2.3.12 Forward declarations

When the compiler encounters a forward declaration of a struct, union, or enum, it emits a type of kind CTF_K_FORWARD. If it later encounters a non- forward declaration of the same thing, it marks the forward as non-root-visible: before link time, therefore, non-root-visible forwards indicate that a non-forward is coming.

After link time, forwards are fused with their corresponding non-forwards by the deduplicator where possible. They are kept if there is no non-forward definition (maybe it’s not visible from any TU at all) or if multiple conflicting structures with the same name might match it. Otherwise, all other forwards are converted to structures, unions, or enums as appropriate, even across TUs if only one structure could correspond to the forward (after all, all types across all TUs land in the same dictionary unless they conflict, so promoting forwards to their concrete type seems most helpful).

A forward has a rather strange representation: it is encoded with a ctf_stype_t but the ctt_type is populated not with a type (if it’s a forward, we don’t have an underlying type yet: if we did, we’d have promoted it and this wouldn’t be a forward any more) but with the kind of the forward. This means that we can distinguish forwards to structs, enums and unions reliably and ensure they land in the appropriate namespace even before the actual struct, union or enum is found.