CTF Frame in the Linux kernel
summary
A compact unwind format that encodes CFA FP and RA offsets directly rather than using a DWARF bytecode so unwinding is simple and fast, with direct offset encoding and three size variants (8/16/32‑bit address ranges) to save space. Toolchain emits a new .ctf_frame section, linker merges entries and libctf_frame decodes them, and support exists for generating PLT entries (x86) and basic ARM64 cases. Size ends up comparable to eh_frame, but ARM64 is only almost asynchronous on ARM64 because BLR and pointer authentication bits are not fully represented.
AI-written summary · about
chapters (11)
- 0:00Introduction to CTF frame
- 1:04Key ideas behind CTF frame
- 3:13CTF frame vs ORC frame
- 6:04CTF frame implementation
- 8:11Unwind formats comparison
- 12:25CTF frame requirements
- 13:49Asynchronous unwinding on ARM64
- 16:20CTF frame limitations
- 17:44User space stack unwinding
- 20:55PLT handling in CTF frame
- 23:04Q&A and future work
related talks
41mSFrame: The Simple Frame Stack Trace Format
37mThe BTF file format, more than just debugging
35mControl Flow Integrity on RISC-V Linux
35mRethinking Linux tools with Compact Debuginfo Formats
47mBPF: The Status of BTF, producers, consumers.
34mEvolving the BPF Type Format
45mSupporting BPF in the GNU Toolchain
45mControl Flow Integrity in the Linux Kernel