Copyright © 2021-2025 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 3 or any later version published by the Free Software Foundation.  A copy of the license is included in the section entitled ``GNU General Public License''.

The CTF file format
*******************

This manual describes version 3 of the CTF file format, which is intended to model the C type system in a fashion that C programs can consume at runtime.

Overview
********

The CTF file format compactly describes C types and the association between function and data symbols and types: if embedded in ELF objects, it can exploit the ELF string table to reduce duplication further. There is no real concept of namespacing: only top-level types are described, not types scoped to within single functions.

CTF dictionaries can be children of other dictionaries, in a one-level hierarchy: child dictionaries can refer to types in the parent, but the opposite is not sensible (since if you refer to a child type in the parent, the actual type you cited would vary depending on what child was attached).  This parent/child definition is recorded in the child, but only as a recommendation: users of the API have to attach parents to children explicitly, and can choose to attach a child to any parent they like, or to none, though doing so might lead to unpleasant consequences like dangling references to types.  See Type indexes and type IDs.  Type lookups in child dicts that are not associated with a parent at all will fail with ECTF_NOPARENT if a parent type was needed.

The associated API to generate, merge together, and query this file format will be described in the accompanying libctf manual once it is written.  There is no API to modify dictionaries once they've been written out: CTF is a write-once file format.  (However, it is always possible to dynamically create a new child dictionary on the fly and attach it to a pre-existing, read-only parent.)

There are two major pieces to CTF: the archive and the dictionary.  Some relatives and ancestors of CTF call dictionaries containers: the archive format is unique to this variant of CTF. (Much of the source code still uses the old term.)

The archive file format is a very simple mmappable archive used to group multiple dictionaries together into groups: it is expected to slowly go away and be replaced by other mechanisms, but right now it is an important part of the file format, used to group dictionaries containing types with conflicting definitions in different TUs with the overarching dictionary used to store all other types.  (Even when archives go away, the libctf API used to access them will remain, and access the other mechanisms that replace it instead.)

The CTF dictionary consists of a preamble, which does not vary between versions of the CTF file format, and a header and some number of sections, which can vary between versions.

The rest of this specification describes the format of these sections, first for the latest version of CTF, then for all earlier versions supported by libctf: the earlier versions are defined in terms of their differences from the next later one.  We describe each part of the format first by reproducing the C structure which defines that part, then describing it at greater length in terms of file offsets.

The description of the file format ends with a description of relevant limits that apply to it.  These limits can vary between file format versions.

This document is quite young, so for now the C code in ctf.h should be presumed correct when this document conflicts with it.

CTF archives
************

The CTF archive format maps names to CTF dictionaries.  The names may contain any character other than \0, but for now archives containing slashes in the names may not extract correctly.  It is possible to insert multiple members with the same name, but these are quite hard to access reliably (you have to iterate through all the members rather than opening by name) so this is not recommended.

CTF archives are not themselves compressed: the constituent components, CTF dictionaries, can be compressed.  (see CTF header).

CTF archives usually contain a collection of related dictionaries, one parent and many children of that parent.  CTF archives can have a member with a default name, .ctf (which can be represented as NULL in the API).  If present, this member is usually the parent of all the children, but it is possible for CTF producers to emit parents with different names if they wish (usually for backward- compatibility purposes).

.ctf sections in ELF objects consist of a single CTF dictionary rather than an archive of dictionaries if and only if the section contains no types with identical names but conflicting definitions: if two conflicting definitions exist, the deduplicator will place the type most commonly referred to by other types in the parent and will place the other type in a child named after the translation unit it is found in, and will emit a CTF archive containing both dictionaries instead of a raw dictionary.  All types that refer to such conflicting types are also placed in the per-translation-unit child.

The definition of an archive in ctf.h is as follows:

struct ctf_archive
{
  uint64_t ctfa_magic;
  uint64_t ctfa_model;
  uint64_t ctfa_nfiles;
  uint64_t ctfa_names;
  uint64_t ctfa_ctfs;
};

typedef struct ctf_archive_modent
{
  uint64_t name_offset;
  uint64_t ctf_offset;
} ctf_archive_modent_t;

(Note one irregularity here: the ctf_archive_t is not a typedef to struct ctf_archive, but a different typedef, private to libctf, so that things that are not really archives can be made to appear as if they were.)

All the above items are always in little-endian byte order, regardless of the machine endianness.

The archive header has the following fields:

Offset   Name   Description
0x00
uint64_t ctfa_magic
The magic number for archives, CTFA_MAGIC: 0x8b47f2a4d7623eeb.

0x08
uint64_t ctfa_model
The data model for this archive: an arbitrary integer that serves no
purpose but to be handed back by the libctf API. See Data models.

0x10
uint64_t ctfa_nfiles
The number of CTF dictionaries in this archive.

0x18
uint64_t ctfa_names
Offset of the name table, in bytes from the start of the archive.
The name table is an array of struct ctf_archive_modent_t[ctfa_nfiles].

0x20
uint64_t ctfa_ctfs
Offset of the CTF table.  Each element starts with a uint64_t size,
followed by a CTF dictionary.

The array pointed to by ctfa_names is an array of entries of ctf_archive_modent:

Offset   Name   Description
0x00
uint64_t name_offset
Offset of this name, in bytes from the start of the archive.

0x08
uint64_t ctf_offset
Offset of this CTF dictionary, in bytes from the start of the archive.

The ctfa_names array is sorted into ASCIIbetical order by name (i.e. by the result of dereferencing the name_offset).

The archive file also contains a name table and a table of CTF dictionaries: these are pointed to by the structures above.  The name table is a simple strtab which is not required to be sorted; the dictionary array is described above in the entry for ctfa_ctfs.

The relative order of these various parts is not defined, except that the header naturally always comes first.

CTF dictionaries
****************

CTF dictionaries consist of a header, starting with a premable, and a number of sections.

CTF Preamble
============

The preamble is the only part of the CTF dictionary whose format cannot vary between versions.  It is never compressed.  It is correspondingly simple:

typedef struct ctf_preamble
{
  unsigned short ctp_magic;
  unsigned char ctp_version;
  unsigned char ctp_flags;
} ctf_preamble_t;

#defines are provided under the names cth_magic, cth_version and cth_flags to make the fields of the ctf_preamble_t appear to be part of the ctf_header_t, so consuming programs rarely need to consider the existence of the preamble as a separate structure.

Offset   Name   Description
0x00
unsigned short ctp_magic
The magic number for CTF dictionaries, CTF_MAGIC: 0xdff2.

0x02
unsigned char ctp_version
The version number of this CTF dictionary.

0x03
ctp_flags
Flags for this CTF file. See CTF file-wide flags.

Every element of a dictionary must be naturally aligned unless otherwise specified.  (This restriction will be lifted in later versions.)

CTF dictionaries are stored in the native endianness of the system that generates them: the consumer (e.g., libctf) can detect whether to endian-flip a CTF dictionary by inspecting the ctp_magic. (If it appears as 0xf2df, endian-flipping is needed.)

The version of the CTF dictionary can be determined by inspecting ctp_version.  The following versions are currently valid, and libctf can read all of them:

Version   Number   Description
CTF_VERSION_1
1   First version, rare. Very similar to Solaris CTF.

CTF_VERSION_1_UPGRADED_3
2   First version, upgraded to v3 or higher and written out again.
Name may change. Very rare.

CTF_VERSION_2
3   Second version, with many range limits lifted.

CTF_VERSION_3
4    Third and current version, documented here.

This section documents CTF_VERSION_3.

CTF file-wide flags
-------------------

The preamble contains bitflags in its ctp_flags field that describe various file-wide properties.  Some of the flags are valid only for particular file-format versions, which means the flags can be used to fix file-format bugs.  Consumers that see unknown flags should accordingly assume that the dictionary is not comprehensible, and refuse to open them.

The following flags are currently defined.  Many are bug workarounds, valid only in CTFv3, and will not be valid in any future versions: the same values may be reused for other flags in v4+.

Flag   Versions   Value   Meaning
CTF_F_COMPRESS   All   0x1   Compressed with zlib
CTF_F_NEWFUNCINFO   3 only   0x2
``New-format'' func info section.
CTF_F_IDXSORTED   3+   0x4   The index section is
in sorted order
CTF_F_DYNSTR   3 only   0x8   The external strtab is
in .dynstr and the symtab used is .dynsym.
See The string section

CTF_F_NEWFUNCINFO and CTF_F_IDXSORTED relate to the function info and data object sections. See The symtypetab sections.

Further flags (and further compression methods) wil be added in future.

CTF header
==========

The CTF header is the first part of a CTF dictionary, including the preamble.  All parts of it other than the preamble (see CTF Preamble) can vary between CTF file versions and are never compressed.  It contains things that apply to the dictionary as a whole, and a table of the sections into which the rest of the dictionary is divided.  The sections tile the file: each section runs from the offset given until the start of the next section.  Only the last section cannot follow this rule, so the header has a length for it instead.

All section offsets, here and in the rest of the CTF file, are relative to the end of the header.  (This is annoyingly different to how offsets in CTF archives are handled.)

This is the first structure to include offsets into the string table, which are not straight references because CTF dictionaries can include references into the ELF string table to save space, as well as into the string table internal to the CTF dictionary.  See The string section for more on these.  Offset 0 is always the null string.

typedef struct ctf_header
{
  ctf_preamble_t cth_preamble;
  uint32_t cth_parlabel;
  uint32_t cth_parname;
  uint32_t cth_cuname;
  uint32_t cth_lbloff;
  uint32_t cth_objtoff;
  uint32_t cth_funcoff;
  uint32_t cth_objtidxoff;
  uint32_t cth_funcidxoff;
  uint32_t cth_varoff;
  uint32_t cth_typeoff;
  uint32_t cth_stroff;
  uint32_t cth_strlen;
} ctf_header_t;

In detail:

Offset   Name   Description
0x00
ctf_preamble_t cth_preamble
The preamble (conceptually embedded in the header). See CTF Preamble

0x04
uint32_t cth_parlabel
The parent label, if deduplication happened against a specific label: a
strtab offset. See The label section. Currently unused and always 0, but may
be used in future when semantics are attached to the label section.

0x08
uint32_t cth_parname
The name of the parent dictionary deduplicated against: a strtab offset.
Interpretation is up to the consumer (usually a CTF archive member name).  0
(the null string) if this is not a child dictionary.

0x1c
uint32_t cth_cuname
The name of the compilation unit, for consumers like GDB that want to
know the name of CUs associated with single CUs: a strtab offset.  0 if this
dictionary describes types from many CUs.

0x10
uint32_t cth_lbloff
The offset of the label section, which tiles the type space into
named regions.  See The label section.

0x14
uint32_t cth_objtoff
The offset of the data object symtypetab section, which maps ELF data symbols to
types.  See The symtypetab sections.

0x18
uint32_t cth_funcoff
The offset of the function info symtypetab section, which maps ELF function
symbols to a return type and arg types.  See The symtypetab sections.

0x1c
uint32_t cth_objtidxoff
The offset of the object index section, which maps ELF object symbols to
entries in the data object section.  See The symtypetab sections.

0x20
uint32_t cth_funcidxoff
The offset of the function info index section, which maps ELF function
symbols to entries in the function info section. See The symtypetab sections.

0x24
uint32_t cth_varoff
The offset of the variable section, which maps string names to types.
See The variable section.

0x28
uint32_t cth_typeoff
The offset of the type section, the core of CTF, which describes types
using variable-length array elements. See The type section.

0x2c
uint32_t cth_stroff
The offset of the string section. See The string section.

0x30
uint32_t cth_strlen
The length of the string section (not an offset!).  The CTF file ends
at this point.

Everything from this point on (until the end of the file at cth_stroff + cth_strlen) is compressed with zlib if CTF_F_COMPRESS is set in the preamble's ctp_flags.

The type section
================

This section is the most important section in CTF, describing all the top-level types in the program.  It consists of an array of type structures, each of which describes a type of some kind: each kind of type has some amount of variable-length data associated with it (some kinds have none).  The amount of variable-length data associated with a given type can be determined by inspecting the type, so the reading code can walk through the types in sequence at opening time.

Each type structure is one of a set of overlapping structures in a discriminated union of sorts: the variable-length data for each type immediately follows the type's type structure.  Here's the largest of the overlapping structures, which is only needed for huge types and so is very rarely seen:

typedef struct ctf_type
{
  uint32_t ctt_name;
  uint32_t ctt_info;
  __extension__
  union
  {
    uint32_t ctt_size;
    uint32_t ctt_type;
  };
  uint32_t ctt_lsizehi;
  uint32_t ctt_lsizelo;
} ctf_type_t;

Here's the much more common smaller form:

typedef struct ctf_stype
{
  uint32_t ctt_name;
  uint32_t ctt_info;
  __extension__
  union
  {
    uint32_t ctt_size;
    uint32_t ctt_type;
  };
} ctf_stype_t;

If ctt_size is the #define CTF_LSIZE_SENT, 0xffffffff, this type is described by a ctf_type_t: otherwise, a ctf_stype_t.

Here's what the fields mean:

Offset   Name   Description
0x00
uint32_t ctt_name
Strtab offset of the type name, if any (0 if none).

0x04
uint32_t ctt_info
The info word, containing information on the kind of this type, its
variable-length data and whether it is visible to name lookup. See The info word.

0x08
uint32_t ctt_size
The size of this type, if this type is of a kind for which a size needs
to be recorded (constant-size types don't need one).  If this is
CTF_LSIZE_SENT, this type is a huge type described by ctf_type_t.

0x08
uint32_t ctt_type
The type this type refers to, if this type is of a kind which refers to
other types (like a pointer).  All such types are fixed-size, and no types that
are variable-size refer to other types, so ctt_size and ctt_type
overlap.  All type kinds that use ctt_type are described by
ctf_stype_t, not ctf_type_t. See Type indexes and type IDs.

0x0c (ctf_type_t only)
uint32_t ctt_lsizehi
The high 32 bits of the size of a very large type. The CTF_TYPE_LSIZE macro
can be used to get a 64-bit size out of this field and the next one.
CTF_SIZE_TO_LSIZE_HI splits the ctt_lsizehi out of it again.

0x10 (ctf_type_t only)
uint32_t ctt_lsizelo
The low 32 bits of the size of a very large type.
CTF_SIZE_TO_LSIZE_LO splits the ctt_lsizelo out of a 64-bit size.

Two aspects of this need further explanation: the info word, and what exactly a type ID is and how you determine it.  (Information on the various type-kind- dependent things, like whether ctt_size or ctt_type is used, is described in the section devoted to each kind.)

The info word, ctt_info
-----------------------

The info word is a bitfield split into three parts.  From MSB to LSB:

Bit offset   Name   Description
26--31
kind
Type kind: see Type kinds.

25
isroot
1 if this type is visible to name lookup

0--24
vlen
Length of variable-length data for this type (some kinds only).
The variable-length data directly follows the ctf_type_t or
ctf_stype_t.  This is a kind-dependent array length value,
not a length in bytes.  Some kinds have no variable-length data, or
fixed-size variable-length data, and do not use this value.

The most mysterious of these is undoubtedly isroot.  This indicates whether types with names (nonzero ctt_name) are visible to name lookup: if zero, this type is considered a non-root type and you can't look it up by name at all.  Multiple types with the same name in the same C namespace (struct, union, enum, other) can exist in a single dictionary, but only one of them may have a nonzero value for isroot.  libctf validates this at open time and refuses to open dictionaries that violate this constraint.

Historically, this feature was introduced for the encoding of bitfields (see Integer types): for instance, int bitfields will all be named int with different widths or offsets, but only the full-width one at offset zero is wanted when you look up the type named int.  With the introduction of slices (see Slices) as a more general bitfield encoding mechanism, this is less important, but we still use non-root types to handle conflicts if the linker API is used to fuse multiple translation units into one dictionary and those translation units contain types with the same name and conflicting definitions.  (We do not discuss this further here, because the linker never does this: only specialized type mergers do, like that used for the Linux kernel.  The libctf documentation will describe this in more detail.)

The CTF_TYPE_INFO macro can be used to compose an info word from a kind, isroot, and vlen; CTF_V2_INFO_KIND, CTF_V2_INFO_ISROOT and CTF_V2_INFO_VLEN pick it apart again.

Type indexes and type IDs
-------------------------

Types are referred to within the CTF file via type IDs.  A type ID is a number from 0 to 2^32, from a space divided in half.  Types 2^31-1 and below are in the parent range: these IDs are used for dictionaries that have not had any other dictionary ctf_imported into it as a parent. Both completely standalone dictionaries and parent dictionaries with children hanging off them have types in this range.  Types 2^31 and above are in the child range: only types in child dictionaries are in this range.

These IDs appear in ctf_type_t.ctt_type (see The type section), but the types themselves have no visible ID: quite intentionally, because adding an ID uses space, and every ID is different so they don't compress well.  The IDs are implicit: at open time, the consumer walks through the entire type section and counts the types in the type section. The type section is an array of variable-length elements, so each entry could be considered as having an index, starting from 1. We count these indexes and associate each with its corresponding ctf_type_t or ctf_stype_t.

Lookups of types with IDs in the parent space look in the parent dictionary if this dictionary has one associated with it; lookups of types with IDs in the child space error out if the dictionary does not have a parent, and otherwise convert the ID into an index by shaving off the top bit and look up the index in the child.

These properties mean that the same dictionary can be used as a parent of child dictionaries and can also be used directly with no children at all, but a dictionary created as a child dictionary must always be associated with a parent --- usually, the same parent --- because its references to its own types have the high bit turned on and this is only flipped off again if this is a child dictionary.  (This is not a problem, because if you don't associate the child with a parent, any references within it to its parent types will fail, and there are almost certain to be many such references, or why is it a child at all?)

This does mean that consumers should keep a close eye on the distinction between type IDs and type indexes: if you mix them up, everything will appear to work as long as you're only using parent dictionaries or standalone dictionaries, but as soon as you start using children, everything will fail horribly.

Type index zero, and type ID zero, are used to indicate that this type cannot be represented in CTF as currently constituted: they are emitted by the compiler, but all type chains that terminate in the unknown type are erased at link time (structure fields that use them just vanish, etc).  So you will probably never see a use of type zero outside the symtypetab sections, where they serve as sentinels of sorts, to indicate symbols with no associated type.

The macros CTF_V2_TYPE_TO_INDEX and CTF_V2_INDEX_TO_TYPE may help in translation between types and indexes: CTF_V2_TYPE_ISPARENT and CTF_V2_TYPE_ISCHILD can be used to tell whether a given ID is in the parent or child range.

It is quite possible and indeed common for type IDs to point forward in the dictionary, as well as backward.

Type kinds
----------

Every type in CTF is of some kind. Each kind is some variety of C type: all structures are a single kind, as are all unions, all pointers, all arrays, all integers regardless of their bitfield width, etc.  The kind of a type is given in the kind field of the ctt_info word (see The info word).

The space of type kinds is only a quarter full so far, so there is plenty of room for expansion.  It is likely that in future versions of the file format, types with smaller kinds will be more efficiently encoded than types with larger kinds, so their numerical value will actually start to matter in future. (So these IDs will probably change their numerical values in a later release of this format, to move more frequently-used kinds like structures and cv-quals towards the top of the space, and move rarely-used kinds like integers downwards. Yes, integers are rare: how many kinds of int are there in a program? They're just very frequently referenced.)

Here's the set of kinds so far.  Each kind has a #define associated with it, also given here.

Kind   Macro   Purpose
0
CTF_K_UNKNOWN
Indicates a type that cannot be represented in CTF, or that is being skipped.
It is very similar to type ID 0, except that you can have multiple, distinct types
of kind CTF_K_UNKNOWN.

1
CTF_K_INTEGER
An integer type. See Integer types.

2
CTF_K_FLOAT
A floating-point type. See Floating-point types.

3
CTF_K_POINTER
A pointer. See Pointers typedefs and cvr-quals.

4
CTF_K_ARRAY
An array. See Arrays.

5
CTF_K_FUNCTION
A function pointer. See Function pointers.

6
CTF_K_STRUCT
A structure. See Structs and unions.

7
CTF_K_UNION
A union. See Structs and unions.

8
CTF_K_ENUM
An enumerated type. See Enums.

9
CTF_K_FORWARD
A forward. See Forward declarations.

10
CTF_K_TYPEDEF
A typedef. See Pointers typedefs and cvr-quals.

11
CTF_K_VOLATILE
A volatile-qualified type. See Pointers typedefs and cvr-quals.

12
CTF_K_CONST
A const-qualified type. See Pointers typedefs and cvr-quals.

13
CTF_K_RESTRICT
A restrict-qualified type. See Pointers typedefs and cvr-quals.

14
CTF_K_SLICE
A slice, a change of the bit-width or offset of some other type. See Slices.

Now we cover all type kinds in turn. Some are more complicated than others.

Integer types
-------------

Integral types are all represented as types of kind CTF_K_INTEGER.  These types fill out ctt_size in the ctf_stype_t with the size in bytes of the integral type in question.  They are always represented by ctf_stype_t, never ctf_type_t. Their variable-length data is one uint32_t in length: vlen in the info word should be disregarded and is always zero.

The variable-length data for integers has multiple items packed into it much like the info word does.

Bit offset   Name   Description
24--31
Encoding
The desired display representation of this integer. You can extract this
field with the CTF_INT_ENCODING macro.  See below.

16--23
Offset
The offset of this integral type in bits from the start of its enclosing
structure field, adjusted for endianness: see Structs and unions.  You can
extract this field with the CTF_INT_OFFSET macro.

0--15
Bit-width
The width of this integral type in bits.  You can extract this field with
the CTF_INT_BITS macro.

If you choose, bitfields can be represented using the things above as a sort of integral type with the isroot bit flipped off and the offset and bits values set in the vlen word: you can populate it with the CTF_INT_DATA macro.  (But it may be more convenient to represent them using slices of a full-width integer: see Slices.)

Integers that are bitfields usually have a ctt_size rounded up to the nearest power of two in bytes, for natural alignment (e.g. a 17-bit integer would have a ctt_size of 4).  However, not all types are naturally aligned on all architectures: packed structures may in theory use integral bitfields with different ctt_size, though this is rarely observed.

The encoding for integers is a bit-field comprised of the values below, which consumers can use to decide how to display values of this type:

Offset   Name   Description
0x01
CTF_INT_SIGNED
If set, this is a signed int: if false, unsigned.

0x02
CTF_INT_CHAR
If set, this is a char type.  It is platform-dependent whether unadorned
char is signed or not: the CTF_CHAR macro produces an integral
type suitable for the definition of char on this platform.

0x04
CTF_INT_BOOL
If set, this is a boolean type.  (It is theoretically possible to turn this
and CTF_INT_CHAR on at the same time, but it is not clear what this would
mean.)

0x08
CTF_INT_VARARGS
If set, this is a varargs-promoted value in a K&R function definition.
This is not currently produced or consumed by anything that we know of: it is set
aside for future use.

The GCC ``Complex int'' and fixed-point extensions are not yet supported: references to such types will be emitted as type 0.

Floating-point types
--------------------

Floating-point types are all represented as types of kind CTF_K_FLOAT. Like integers, These types fill out ctt_size in the ctf_stype_t with the size in bytes of the floating-point type in question.  They are always represented by ctf_stype_t, never ctf_type_t.

This part of CTF shows many rough edges in the more obscure corners of floating-point handling, and is likely to change in format v4.

The variable-length data for floats has multiple items packed into it just like integers do:

Bit offset   Name   Description
24--31
Encoding
The desired display representation of this float. You can extract this
field with the CTF_FP_ENCODING macro.  See below.

16--23
Offset
The offset of this floating-point type in bits from the start of its enclosing
structure field, adjusted for endianness: see Structs and unions.  You can
extract this field with the CTF_FP_OFFSET macro.

0--15
Bit-width
The width of this floating-point type in bits.  You can extract this field with
the CTF_FP_BITS macro.

The purpose of the floating-point offset and bit-width is somewhat opaque, since there are no such things as floating-point bitfields in C: the bit-width should be filled out with the full width of the type in bits, and the offset should always be zero.  It is likely that these fields will go away in the future.  As with integers, you can use CTF_FP_DATA to assemble one of these vlen items from its component parts.

The encoding for floats is not a bitfield but a simple value indicating the display representation.  Many of these are unused, relate to Solaris-specific compiler extensions, and will be recycled in future: some are unused and will become used in future.

Offset   Name   Description
1
CTF_FP_SINGLE
This is a single-precision IEEE 754 float.
2
CTF_FP_DOUBLE
This is a double-precision IEEE 754 double.
3
CTF_FP_CPLX
This is a Complex float.
4
CTF_FP_DCPLX
This is a Complex double.
5
CTF_FP_LDCPLX
This is a Complex long double.
6
CTF_FP_LDOUBLE
This is a long double.
7
CTF_FP_INTRVL
This is a float interval type, a Solaris-specific extension.
Unused: will be recycled.
8
CTF_FP_DINTRVL
This is a double interval type, a Solaris-specific extension.
Unused: will be recycled.
9
CTF_FP_LDINTRVL
This is a long double interval type, a Solaris-specific extension.
Unused: will be recycled.
10
CTF_FP_IMAGRY
This is a the imaginary part of a Complex float. Not currently
generated. May change.
11
CTF_FP_DIMAGRY
This is a the imaginary part of a Complex double. Not currently
generated. May change.
12
CTF_FP_LDIMAGRY
This is a the imaginary part of a Complex long double. Not currently
generated. May change.

The use of the complex floating-point encodings is obscure: it is possible that CTF_FP_CPLX is meant to be used for only the real part of complex types, and CTF_FP_IMAGRY et al for the imaginary part -- but for now, we are emitting CTF_FP_CPLX to cover the entire type, with no way to get at its constituent parts. There appear to be no uses of these encodings anywhere, so they are quite likely to change incompatibly in future.

Slices
------

Slices, with kind CTF_K_SLICE, are an unusual CTF construct: they do not directly correspond to any C type, but are a way to model other types in a more convenient fashion for CTF generators.

A slice is like a pointer or other reference type in that they are always represented by ctf_stype_t: but unlike pointers and other reference types, they populate the ctt_size field just like integral types do, and come with an attached encoding and transform the encoding of the underlying type.  The underlying type is described in the variable-length data, similarly to structure and union fields: see below.  Requests for the type size should also chase down to the referenced type.

Slices are always nameless: ctt_name is always zero for them.

(The libctf API behaviour is unusual as well, and justifies the existence of slices: ctf_type_kind never returns CTF_K_SLICE but always the underlying type kind, so that consumers never need to know about slices: they can tell if an apparent integer is actually a slice if they need to by calling ctf_type_reference, which will uniquely return the underlying integral type rather than erroring out with ECTF_NOTREF if this is actually a slice. So slices act just like an integer with an encoding, but more closely mirror DWARF and other debugging information formats by allowing CTF file creators to represent a bitfield as a slice of an underlying integral type.)

The vlen in the info word for a slice should be ignored and is always zero. The variable-length data for a slice is a single ctf_slice_t:

typedef struct ctf_slice
{
  uint32_t cts_type;
  unsigned short cts_offset;
  unsigned short cts_bits;
} ctf_slice_t;

Offset   Name   Description
0x0
uint32_t cts_type
The type this slice is a slice of.  Must be an integral type (or a
floating-point type, but this nonsensical option will go away in v4.)

0x4
unsigned short cts_offset
The offset of this integral type in bits from the start of its enclosing
structure field, adjusted for endianness: see Structs and unions. Identical
semantics to the CTF_INT_OFFSET field: see Integer types.  This field
is much too long, because the maximum possible offset of an integral type would
easily fit in a char: this field is bigger just for the sake of alignment.  This
will change in v4.

0x6
unsigned short cts_bits
The bit-width of this integral type. Identical semantics to the
CTF_INT_BITS field: see Integer types.  As above, this field is
really too large and will shrink in v4.

Pointers, typedefs, and cvr-quals
---------------------------------

Pointers, typedefs, and const, volatile and restrict qualifiers are represented identically except for their type kind (though they may be treated differently by consuming libraries like libctf, since pointers affect assignment-compatibility in ways cvr-quals do not, and they may have different alignment requirements, etc).

All of these are represented by ctf_stype_t, have no variable data at all, and populate ctt_type with the type ID of the type they point to. These types can stack: a CTF_K_RESTRICT can point to a CTF_K_CONST which can point to a CTF_K_POINTER etc.

They are all unnamed: ctt_name is 0.

The size of CTF_K_POINTER is derived from the data model (see Data models), i.e. in practice, from the target machine ABI, and is not explicitly represented.  The size of other kinds in this set should be determined by chasing ctf_types as necessary until a non-typedef/const/volatile/restrict is found, and using that.

Arrays
------

Arrays are encoded as types of kind CTF_K_ARRAY in a ctf_stype_t. Both size and kind for arrays are zero.  The variable-length data is a ctf_array_t: vlen in the info word should be disregarded and is always zero.

typedef struct ctf_array
{
  uint32_t cta_contents;
  uint32_t cta_index;
  uint32_t cta_nelems;
} ctf_array_t;

Offset   Name   Description
0x0
uint32_t cta_contents
The type of the array elements: a type ID.

0x4
uint32_t cta_index
The type of the array index: a type ID of an integral type.
If this is a variable-length array, the index type ID will be 0
(but the actual index type of this array is probably int).
Probably redundant and may be dropped in v4.

0x8
uint32_t cta_nelems
The number of array elements.  0 for VLAs, and also for
the historical variety of VLA which has explicit zero dimensions (which will
have a nonzero cta_index.)

The size of an array can be computed by simple multiplication of the size of the cta_contents type by the cta_nelems.

Function pointers
-----------------

Function pointers are explicitly represented in the CTF type section by a type of kind CTF_K_FUNCTION, always encoded with a ctf_stype_t.  The ctt_type is the function return type ID.  The vlen in the info word is the number of arguments, each of which is a type ID, a uint32_t: if the last argument is 0, this is a varargs function and the number of arguments is one less than indicated by the vlen.

If the number of arguments is odd, a single uint32_t of padding is inserted to maintain alignment.

Enums
-----

Enumerated types are represented as types of kind CTF_K_ENUM in a ctf_stype_t.  The ctt_size is always the size of an int from the data model (enum bitfields are implemented via slices).  The vlen is a count of enumerations, each of which is represented by a ctf_enum_t in the vlen:

typedef struct ctf_enum
{
  uint32_t cte_name;
  int32_t cte_value;
} ctf_enum_t;

Offset   Name   Description
0x0
uint32_t cte_name
Strtab offset of the enumeration name.  Must not be 0.

0x4
int32_t cte_value
The enumeration value.

Enumeration values larger than 2^32 are not yet supported and are omitted from the enumeration.  (v4 will lift this restriction by encoding the value differently.)

Forward declarations of enums are not implemented with this kind: see Forward declarations.

Enumerated type names, as usual in C, go into their own namespace, and do not conflict with non-enums, structs, or unions with the same name.

Structs and unions
------------------

Structures and unions are represnted as types of kind CTF_K_STRUCT and CTF_K_UNION: their representation is otherwise identical, and it is perfectly allowed for ``structs'' to contain overlapping fields etc, so we will treat them together for the rest of this section.

They fill out ctt_size, and use ctf_type_t in preference to ctf_stype_t if the structure size is greater than CTF_MAX_SIZE (0xfffffffe).

The vlen for structures and unions is a count of structure fields, but the type used to represent a structure field (and thus the size of the variable-length array element representing the type) depends on the size of the structure: truly huge structures, greater than CTF_LSTRUCT_THRESH bytes in length, use a different type.  (CTF_LSTRUCT_THRESH is 536870912, so such structures are vanishingly rare: in v4, this representation will change somewhat for greater compactness. It's inherited from v1, where the limits were much lower.)

Most structures can get away with using ctf_member_t:

typedef struct ctf_member_v2
{
  uint32_t ctm_name;
  uint32_t ctm_offset;
  uint32_t ctm_type;
} ctf_member_t;

Huge structures that are represented by ctf_type_t rather than ctf_stype_t have to use ctf_lmember_t, which splits the offset as ctf_type_t splits the size:

typedef struct ctf_lmember_v2
{
  uint32_t ctlm_name;
  uint32_t ctlm_offsethi;
  uint32_t ctlm_type;
  uint32_t ctlm_offsetlo;
} ctf_lmember_t;

Here's what the fields of ctf_member mean:

Offset   Name   Description
0x00
uint32_t ctm_name
Strtab offset of the field name.

0x04
uint32_t ctm_offset
The offset of this field in bits.  (Usually, for bitfields, this is
machine-word-aligned and the individual field has an offset in bits, but
the format allows for the offset to be encoded in bits here.)

0x08
uint32_t ctm_type
The type ID of the type of the field.

Here's what the fields of the very similar ctf_lmember mean:

Offset   Name   Description
0x00
uint32_t ctlm_name
Strtab offset of the field name.

0x04
uint32_t ctlm_offsethi
The high 32 bits of the offset of this field in bits.

0x08
uint32_t ctlm_type
The type ID of the type of the field.

0x0c
uint32_t ctlm_offsetlo
The low 32 bits of the offset of this field in bits.

Macros CTF_LMEM_OFFSET, CTF_OFFSET_TO_LMEMHI and CTF_OFFSET_TO_LMEMLO serve to extract and install the values of the ctlm_offset fields, much as with the split size fields in ctf_type_t.

Unnamed structure and union fields are simply implemented by collapsing the unnamed field's members into the containing structure or union: this does mean that a structure containing an unnamed union can end up being a ``structure'' with multiple members at the same offset.  (A future format revision may collapse CTF_K_STRUCT and CTF_K_UNION into the same kind and decide among them based on whether their members do in fact overlap.)

Structure and union type names, as usual in C, go into their own namespace, just as enum type names do.

Forward declarations of structures and unions are not implemented with this kind: see Forward declarations.

Forward declarations
--------------------

When the compiler encounters a forward declaration of a struct, union, or enum, it emits a type of kind CTF_K_FORWARD.  If it later encounters a non- forward declaration of the same thing, it marks the forward as non-root-visible: before link time, therefore, non-root-visible forwards indicate that a non-forward is coming.

After link time, forwards are fused with their corresponding non-forwards by the deduplicator where possible.  They are kept if there is no non-forward definition (maybe it's not visible from any TU at all) or if multiple conflicting structures with the same name might match it.  Otherwise, all other forwards are converted to structures, unions, or enums as appropriate, even across TUs if only one structure could correspond to the forward (after all, all types across all TUs land in the same dictionary unless they conflict, so promoting forwards to their concrete type seems most helpful).

A forward has a rather strange representation: it is encoded with a ctf_stype_t but the ctt_type is populated not with a type (if it's a forward, we don't have an underlying type yet: if we did, we'd have promoted it and this wouldn't be a forward any more) but with the kind of the forward.  This means that we can distinguish forwards to structs, enums and unions reliably and ensure they land in the appropriate namespace even before the actual struct, union or enum is found.

The symtypetab sections
=======================

These are two very simple sections with identical formats, used by consumers to map from ELF function and data symbols directly to their types. So they are usually populated only in CTF sections that are embedded in ELF objects.

Their format is very simple: an array of type IDs. Which symbol each type ID corresponds to depends on whether the optional index section associated with this symtypetab section has any content.

If the index section is nonempty, it is an array of uint32_t string table offsets, each giving the name of the symbol whose type is at the same offset in the corresponding non-index section: users can look up symbols in such a table by name.  The index section and corresponding symtypetab section is usually ASCIIbetically sorted (indicated by the CTF_F_IDXSORTED flag in the header): if it's sorted, it can be bsearched for a symbol name rather than having to use a slower linear search.

If the data object index section is empty, the entries in the data object and function info sections are associated 1:1 with ELF symbols of type STT_OBJECT (for data object) or STT_FUNC (for function info) with a nonzero value: the linker shuffles the symtypetab sections to correspond with the order of the symbols in the ELF file.  Symbols with no name, undefined symbols and symbols named ``_START_'' and ``_END_'' are skipped and never appear in either section.  Symbols that have no corresponding type are represented by type ID 0. The section may have fewer entries than the symbol table, in which case no later entries have associated types.  This format is more compact than an indexed form if most entries have types (since there is no need to record any symbol names), but if the producer and consumer disagree even slightly about which symbols are omitted, the types of all further symbols will be wrong!

The compiler always emits indexed symtypetab tables, because there is no symbol table yet. The linker will always have to read them all in and always works through them from start to end, so there is no benefit having the compiler sort them either. The linker (actually, libctf's linking machinery) will automatically sort unsorted indexed sections, and convert indexed sections that contain a lot of pads into the more compact, unindexed form.

If child dicts are in use, only symbols that use types actually mentioned in the child appear in the child's symtypetab: symbols that use only types in the parent appear in the parent's symtypetab instead. So the child's symtypetab will almost always be very sparse, and thus will usually use the indexed form even in fully linked objects. (It is, of course, impossible for symbols to exist that use types from multiple child dicts at once, since it's impossible to declare a function in C that uses types that are only visible in two different, disjoint translation units.)

The variable section
====================

The variable section is a simple array mapping names (strtab entries) to type IDs, intended to provide a replacement for the data object section in dynamic situations in which there is no static ELF strtab but the consumer instead hands back names.  The section is sorted into ASCIIbetical order by name for rapid lookup, like the CTF archive name table.

The section is an array of these structures:

typedef struct ctf_varent
{
  uint32_t ctv_name;
  uint32_t ctv_type;
} ctf_varent_t;

Offset   Name   Description
0x00
uint32_t ctv_name
Strtab offset of the name

0x04
uint32_t ctv_type
Type ID of this type

There is no analogue of the function info section yet: v4 will probably drop this section in favour of a way to put both indexed (thus, named) and nonindexed symbols into the symtypetab sections at the same time.

The label section
=================

The label section is a currently-unused facility allowing the tiling of the type space with names taken from the strtab.  The section is an array of these structures:

typedef struct ctf_lblent
{
  uint32_t ctl_label;
  uint32_t ctl_type;
} ctf_lblent_t;

Offset   Name   Description
0x00
uint32_t ctl_label
Strtab offset of the label

0x04
uint32_t ctl_type
Type ID of the last type covered by this label

Semantics will be attached to labels soon, probably in v4 (the plan is to use them to allow multiple disjoint namespaces in a single CTF file, removing many uses of CTF archives, in particular in the .ctf section in ELF objects).

The string section
==================

This section is a simple ELF-format strtab, starting with a zero byte (thus ensuring that the string with offset 0 is the null string, as assumed elsewhere in this spec).  The strtab is usually ASCIIbetically sorted to somewhat improve compression efficiency.

Where the strtab is unusual is the references to it.  CTF has two string tables, the internal strtab and an external strtab associated with the CTF dictionary at open time: usually, this is the ELF dynamic strtab (.dynstr) of a CTF dictionary embedded in an ELF file.  We distinguish between these strtabs by the most significant bit, bit 31, of the 32-bit strtab references: if it is 0, the offset is in the internal strtab: if 1, the offset is in the external strtab.

There is a bug workaround in this area: in format v3 (the first version to have working support for external strtabs), the external strtab is .strtab unless the CTF_F_DYNSTR flag is set on the dictionary (see CTF file-wide flags).  Format v4 will introduce a header field that explicitly names the external strtab, making this flag unnecessary.

Data models
===========

The data model is a simple integer which indicates the ABI in use on this platform. Right now, it is very simple, distinguishing only between 32- and 64-bit types: a model of 1 indicates ILP32, 2 indicats LP64. The mapping from ABI integer to type sizes is hardwired into libctf: currently, we use this to hardwire the size of pointers, function pointers, and enumerated types,

This is a very kludgy corner of CTF and will probably be replaced with explicit header fields to record this sort of thing in future.

Limits of CTF
=============

The following limits are imposed by various aspects of CTF version 3:

CTF_MAX_TYPE
     Maximum type identifier (maximum number of types accessible with parent and child containers in use): 0xfffffffe

CTF_MAX_PTYPE
     Maximum type identifier in a parent dictioanry: maximum number of types in any one dictionary: 0x7fffffff

CTF_MAX_NAME
     Maximum offset into a string table: 0x7fffffff

CTF_MAX_VLEN
     Maximum number of members in a struct, union, or enum: maximum number of function args: 0xffffff

CTF_MAX_SIZE
     Maximum size of a ctf_stype_t in bytes before we fall back to ctf_type_t: 0xfffffffe bytes

Other maxima without associated macros:

  * Maximum value of an enumerated type: 2^32

  * Maximum size of an array element: 2^32

These maxima are generally considered to be too low, because C programs can and do exceed them: they will be lifted in format v4.