1 /*
2 * Copyright (c) 2016 GitHub, Inc.
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "bcc_proc.h"
18
19 #include <ctype.h>
20 #include <dirent.h>
21 #include <fcntl.h>
22 #include <limits.h>
23 #include <math.h>
24 #include <stdbool.h>
25 #include <stdint.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <sys/mman.h>
30 #include <sys/stat.h>
31 #include <sys/types.h>
32 #include <unistd.h>
33
34 #include "bcc_elf.h"
35 #include "bcc_perf_map.h"
36 #include "bcc_zip.h"
37
38 #ifdef __x86_64__
39 // https://www.kernel.org/doc/Documentation/x86/x86_64/mm.txt
40 const unsigned long long kernelAddrSpace = 0x00ffffffffffffff;
41 #else
42 const unsigned long long kernelAddrSpace = 0x0;
43 #endif
44
bcc_procutils_which(const char * binpath)45 char *bcc_procutils_which(const char *binpath) {
46 char buffer[4096];
47 const char *PATH;
48
49 if (strchr(binpath, '/'))
50 return bcc_elf_is_exe(binpath) ? strdup(binpath) : 0;
51
52 if (!(PATH = getenv("PATH")))
53 return 0;
54
55 while (PATH) {
56 const char *next = strchr(PATH, ':') ?: strchr(PATH, '\0');
57 const size_t path_len = next - PATH;
58
59 if (path_len) {
60 int ret = snprintf(buffer, sizeof(buffer), "%.*s/%s",
61 (int)path_len, PATH, binpath);
62 if (ret < 0 || ret >= sizeof(buffer))
63 return 0;
64
65 if (bcc_elf_is_exe(buffer))
66 return strdup(buffer);
67 }
68
69 PATH = *next ? (next + 1) : 0;
70 }
71
72 return 0;
73 }
74
75 #define STARTS_WITH(mapname, prefix) (!strncmp(mapname, prefix, sizeof(prefix)-1))
76
bcc_mapping_is_file_backed(const char * mapname)77 int bcc_mapping_is_file_backed(const char *mapname) {
78 return mapname[0] && !(
79 STARTS_WITH(mapname, "//anon") ||
80 STARTS_WITH(mapname, "/dev/zero") ||
81 STARTS_WITH(mapname, "/anon_hugepage") ||
82 STARTS_WITH(mapname, "[stack") ||
83 STARTS_WITH(mapname, "/SYSV") ||
84 STARTS_WITH(mapname, "[heap]") ||
85 STARTS_WITH(mapname, "[vsyscall]"));
86 }
87
88 /*
89 Finds a file descriptor for a given inode if it's a memory-backed fd.
90 */
_procutils_memfd_path(const int pid,const uint64_t inum)91 static char *_procutils_memfd_path(const int pid, const uint64_t inum) {
92 char path_buffer[PATH_MAX + 1];
93 char *path = NULL;
94 char *dirstr;
95 DIR *dirstream;
96 struct stat sb;
97 struct dirent *dent;
98
99 snprintf(path_buffer, (PATH_MAX + 1), "/proc/%d/fd", pid);
100 dirstr = malloc(strlen(path_buffer) + 1);
101 strcpy(dirstr, path_buffer);
102 dirstream = opendir(dirstr);
103
104 if (dirstream == NULL) {
105 free(dirstr);
106 return NULL;
107 }
108
109 while (path == NULL && (dent = readdir(dirstream)) != NULL) {
110 snprintf(path_buffer, (PATH_MAX + 1), "%s/%s", dirstr, dent->d_name);
111 if (stat(path_buffer, &sb) == -1)
112 continue;
113
114 if (sb.st_ino == inum) {
115 char *pid_fd_path = malloc(strlen(path_buffer) + 1);
116 strcpy(pid_fd_path, path_buffer);
117 path = pid_fd_path;
118 }
119 }
120 closedir(dirstream);
121 free(dirstr);
122
123 return path;
124 }
125
_procfs_might_be_zip_path(const char * path)126 static int _procfs_might_be_zip_path(const char *path) {
127 return strstr(path, ".zip") || strstr(path, ".apk");
128 }
129
_procfs_find_zip_entry(const char * path,int pid,uint32_t * offset)130 static char *_procfs_find_zip_entry(const char *path, int pid,
131 uint32_t *offset) {
132 char ns_relative_path[PATH_MAX];
133 int rc = snprintf(ns_relative_path, sizeof(ns_relative_path),
134 "/proc/%d/root%s", pid, path);
135 if (rc < 0 || rc >= sizeof(ns_relative_path)) {
136 return NULL;
137 }
138
139 struct bcc_zip_archive *archive = bcc_zip_archive_open(ns_relative_path);
140 if (archive == NULL) {
141 return NULL;
142 }
143
144 struct bcc_zip_entry entry;
145 if (bcc_zip_archive_find_entry_at_offset(archive, *offset, &entry) ||
146 entry.compression) {
147 bcc_zip_archive_close(archive);
148 return NULL;
149 }
150
151 char *result = malloc(strlen(path) + entry.name_length + 3);
152 if (result == NULL) {
153 bcc_zip_archive_close(archive);
154 return NULL;
155 }
156
157 sprintf(result, "%s!/%.*s", path, entry.name_length, entry.name);
158 *offset -= entry.data_offset;
159 bcc_zip_archive_close(archive);
160 return result;
161 }
162
163 // return: 0 -> callback returned < 0, stopped iterating
164 // -1 -> callback never indicated to stop
_procfs_maps_each_module(FILE * procmap,int pid,bcc_procutils_modulecb callback,void * payload)165 int _procfs_maps_each_module(FILE *procmap, int pid,
166 bcc_procutils_modulecb callback, void *payload) {
167 char buf[PATH_MAX + 1], perm[5];
168 char *name, *resolved_name;
169 mod_info mod;
170 uint8_t enter_ns;
171 while (true) {
172 enter_ns = 1;
173 buf[0] = '\0';
174 // From fs/proc/task_mmu.c:show_map_vma
175 if (fscanf(procmap, "%lx-%lx %4s %llx %lx:%lx %lu%[^\n]",
176 &mod.start_addr, &mod.end_addr, perm, &mod.file_offset,
177 &mod.dev_major, &mod.dev_minor, &mod.inode, buf) != 8)
178 break;
179
180 if (perm[2] != 'x')
181 continue;
182
183 name = buf;
184 while (isspace(*name))
185 name++;
186 mod.name = name;
187 if (!bcc_mapping_is_file_backed(name))
188 continue;
189
190 resolved_name = NULL;
191 if (strstr(name, "/memfd:")) {
192 resolved_name = _procutils_memfd_path(pid, mod.inode);
193 if (resolved_name != NULL) {
194 enter_ns = 0;
195 }
196 } else if (_procfs_might_be_zip_path(mod.name)) {
197 uint32_t zip_entry_offset = mod.file_offset;
198 resolved_name = _procfs_find_zip_entry(mod.name, pid, &zip_entry_offset);
199 if (resolved_name != NULL) {
200 mod.file_offset = zip_entry_offset;
201 }
202 }
203
204 if (resolved_name != NULL) {
205 strncpy(buf, resolved_name, PATH_MAX);
206 buf[PATH_MAX] = 0;
207 free(resolved_name);
208 mod.name = buf;
209 }
210
211 if (callback(&mod, enter_ns, payload) < 0)
212 return 0;
213 }
214
215 return -1;
216 }
217
bcc_procutils_each_module(int pid,bcc_procutils_modulecb callback,void * payload)218 int bcc_procutils_each_module(int pid, bcc_procutils_modulecb callback,
219 void *payload) {
220 char procmap_filename[128];
221 FILE *procmap;
222 snprintf(procmap_filename, sizeof(procmap_filename), "/proc/%ld/maps",
223 (long)pid);
224 procmap = fopen(procmap_filename, "r");
225 if (!procmap)
226 return -1;
227
228 _procfs_maps_each_module(procmap, pid, callback, payload);
229
230 // Address mapping for the entire address space maybe in /tmp/perf-<PID>.map
231 // This will be used if symbols aren't resolved in an earlier mapping.
232 char map_path[4096];
233 // Try perf-<PID>.map path with process's mount namespace, chroot and NSPID,
234 // in case it is generated by the process itself.
235 mod_info mod;
236 memset(&mod, 0, sizeof(mod_info));
237 if (bcc_perf_map_path(map_path, sizeof(map_path), pid)) {
238 mod.name = map_path;
239 mod.end_addr = -1;
240 if (callback(&mod, 1, payload) < 0)
241 goto done;
242 }
243 // Try perf-<PID>.map path with global root and PID, in case it is generated
244 // by other Process. Avoid checking mount namespace for this.
245 memset(&mod, 0, sizeof(mod_info));
246 int res = snprintf(map_path, 4096, "/tmp/perf-%d.map", pid);
247 if (res > 0 && res < 4096) {
248 mod.name = map_path;
249 mod.end_addr = -1;
250 if (callback(&mod, 0, payload) < 0)
251 goto done;
252 }
253
254 done:
255 fclose(procmap);
256 return 0;
257 }
258
bcc_procutils_each_ksym(bcc_procutils_ksymcb callback,void * payload)259 int bcc_procutils_each_ksym(bcc_procutils_ksymcb callback, void *payload) {
260 char line[2048];
261 char *symname, *endsym, *modname, *endmod = NULL;
262 FILE *kallsyms;
263 unsigned long long addr;
264
265 kallsyms = fopen("/proc/kallsyms", "r");
266 if (!kallsyms)
267 return -1;
268
269 while (fgets(line, sizeof(line), kallsyms)) {
270 addr = strtoull(line, &symname, 16);
271 if (addr == 0 || addr == ULLONG_MAX)
272 continue;
273 if (addr < kernelAddrSpace)
274 continue;
275
276 symname++;
277 // Ignore data symbols
278 if (*symname == 'b' || *symname == 'B' || *symname == 'd' ||
279 *symname == 'D' || *symname == 'r' || *symname =='R')
280 continue;
281
282 endsym = (symname = symname + 2);
283 while (*endsym && !isspace(*endsym)) endsym++;
284 *endsym = '\0';
285
286 // Parse module name if it's available
287 modname = endsym + 1;
288 while (*modname && isspace(*endsym)) modname++;
289
290 if (*modname && *modname == '[') {
291 endmod = ++modname;
292 while (*endmod && *endmod != ']') endmod++;
293 if (*endmod)
294 *(endmod) = '\0';
295 else
296 endmod = NULL;
297 }
298
299 if (!endmod)
300 modname = "kernel";
301
302 callback(symname, modname, addr, payload);
303 }
304
305 fclose(kallsyms);
306 return 0;
307 }
308
309 #define CACHE1_HEADER "ld.so-1.7.0"
310 #define CACHE1_HEADER_LEN (sizeof(CACHE1_HEADER) - 1)
311
312 #define CACHE2_HEADER "glibc-ld.so.cache"
313 #define CACHE2_HEADER_LEN (sizeof(CACHE2_HEADER) - 1)
314 #define CACHE2_VERSION "1.1"
315
316 struct ld_cache1_entry {
317 int32_t flags;
318 uint32_t key;
319 uint32_t value;
320 };
321
322 struct ld_cache1 {
323 char header[CACHE1_HEADER_LEN];
324 uint32_t entry_count;
325 struct ld_cache1_entry entries[0];
326 };
327
328 struct ld_cache2_entry {
329 int32_t flags;
330 uint32_t key;
331 uint32_t value;
332 uint32_t pad1_;
333 uint64_t pad2_;
334 };
335
336 struct ld_cache2 {
337 char header[CACHE2_HEADER_LEN];
338 char version[3];
339 uint32_t entry_count;
340 uint32_t string_table_len;
341 uint32_t pad_[5];
342 struct ld_cache2_entry entries[0];
343 };
344
345 static int lib_cache_count;
346 static struct ld_lib {
347 char *libname;
348 char *path;
349 int flags;
350 } * lib_cache;
351
read_cache1(const char * ld_map)352 static int read_cache1(const char *ld_map) {
353 struct ld_cache1 *ldcache = (struct ld_cache1 *)ld_map;
354 const char *ldstrings =
355 (const char *)(ldcache->entries + ldcache->entry_count);
356 uint32_t i;
357
358 lib_cache =
359 (struct ld_lib *)malloc(ldcache->entry_count * sizeof(struct ld_lib));
360 lib_cache_count = (int)ldcache->entry_count;
361
362 for (i = 0; i < ldcache->entry_count; ++i) {
363 const char *key = ldstrings + ldcache->entries[i].key;
364 const char *val = ldstrings + ldcache->entries[i].value;
365 const int flags = ldcache->entries[i].flags;
366
367 lib_cache[i].libname = strdup(key);
368 lib_cache[i].path = strdup(val);
369 lib_cache[i].flags = flags;
370 }
371 return 0;
372 }
373
read_cache2(const char * ld_map)374 static int read_cache2(const char *ld_map) {
375 struct ld_cache2 *ldcache = (struct ld_cache2 *)ld_map;
376 uint32_t i;
377
378 if (memcmp(ld_map, CACHE2_HEADER, CACHE2_HEADER_LEN))
379 return -1;
380
381 lib_cache =
382 (struct ld_lib *)malloc(ldcache->entry_count * sizeof(struct ld_lib));
383 lib_cache_count = (int)ldcache->entry_count;
384
385 for (i = 0; i < ldcache->entry_count; ++i) {
386 const char *key = ld_map + ldcache->entries[i].key;
387 const char *val = ld_map + ldcache->entries[i].value;
388 const int flags = ldcache->entries[i].flags;
389
390 lib_cache[i].libname = strdup(key);
391 lib_cache[i].path = strdup(val);
392 lib_cache[i].flags = flags;
393 }
394 return 0;
395 }
396
load_ld_cache(const char * cache_path)397 static int load_ld_cache(const char *cache_path) {
398 struct stat st;
399 size_t ld_size;
400 const char *ld_map;
401 int ret, fd = open(cache_path, O_RDONLY);
402
403 if (fd < 0)
404 return -1;
405
406 if (fstat(fd, &st) < 0 || st.st_size < sizeof(struct ld_cache1)) {
407 close(fd);
408 return -1;
409 }
410
411 ld_size = st.st_size;
412 ld_map = (const char *)mmap(NULL, ld_size, PROT_READ, MAP_PRIVATE, fd, 0);
413 if (ld_map == MAP_FAILED) {
414 close(fd);
415 return -1;
416 }
417
418 if (memcmp(ld_map, CACHE1_HEADER, CACHE1_HEADER_LEN) == 0) {
419 const struct ld_cache1 *cache1 = (struct ld_cache1 *)ld_map;
420 size_t cache1_len = sizeof(struct ld_cache1) +
421 (cache1->entry_count * sizeof(struct ld_cache1_entry));
422 cache1_len = (cache1_len + 0x7) & ~0x7ULL;
423
424 if (ld_size > (cache1_len + sizeof(struct ld_cache2)))
425 ret = read_cache2(ld_map + cache1_len);
426 else
427 ret = read_cache1(ld_map);
428 } else {
429 ret = read_cache2(ld_map);
430 }
431
432 munmap((void *)ld_map, ld_size);
433 close(fd);
434 return ret;
435 }
436
437 #define LD_SO_CACHE "/etc/ld.so.cache"
438 #define FLAG_TYPE_MASK 0x00ff
439 #define TYPE_ELF_LIBC6 0x0003
440 #define FLAG_ABI_MASK 0xff00
441 #define ABI_SPARC_LIB64 0x0100
442 #define ABI_IA64_LIB64 0x0200
443 #define ABI_X8664_LIB64 0x0300
444 #define ABI_S390_LIB64 0x0400
445 #define ABI_POWERPC_LIB64 0x0500
446 #define ABI_AARCH64_LIB64 0x0a00
447
match_so_flags(int flags)448 static bool match_so_flags(int flags) {
449 if ((flags & FLAG_TYPE_MASK) != TYPE_ELF_LIBC6)
450 return false;
451
452 switch (flags & FLAG_ABI_MASK) {
453 case ABI_SPARC_LIB64:
454 case ABI_IA64_LIB64:
455 case ABI_X8664_LIB64:
456 case ABI_S390_LIB64:
457 case ABI_POWERPC_LIB64:
458 case ABI_AARCH64_LIB64:
459 return (sizeof(void *) == 8);
460 }
461
462 return sizeof(void *) == 4;
463 }
464
which_so_in_process(const char * libname,int pid,char * libpath)465 static bool which_so_in_process(const char* libname, int pid, char* libpath) {
466 int ret, found = false;
467 char endline[4096], *mapname = NULL, *newline;
468 char mappings_file[128];
469 const size_t search_len = strlen(libname) + strlen("/lib.");
470 char search1[search_len + 1];
471 char search2[search_len + 1];
472
473 snprintf(mappings_file, sizeof(mappings_file), "/proc/%ld/maps", (long)pid);
474 FILE *fp = fopen(mappings_file, "r");
475 if (!fp)
476 return NULL;
477
478 snprintf(search1, search_len + 1, "/lib%s.", libname);
479 snprintf(search2, search_len + 1, "/lib%s-", libname);
480
481 do {
482 ret = fscanf(fp, "%*x-%*x %*s %*x %*s %*d");
483 if (!fgets(endline, sizeof(endline), fp))
484 break;
485
486 mapname = endline;
487 newline = strchr(endline, '\n');
488 if (newline)
489 newline[0] = '\0';
490
491 while (isspace(mapname[0])) mapname++;
492
493 if (strstr(mapname, ".so") && (strstr(mapname, search1) ||
494 strstr(mapname, search2))) {
495 found = true;
496 memcpy(libpath, mapname, strlen(mapname) + 1);
497 break;
498 }
499 } while (ret != EOF);
500
501 fclose(fp);
502 return found;
503 }
504
bcc_procutils_which_so(const char * libname,int pid)505 char *bcc_procutils_which_so(const char *libname, int pid) {
506 const size_t soname_len = strlen(libname) + strlen("lib.so");
507 char soname[soname_len + 1];
508 char libpath[4096];
509 int i;
510
511 if (strchr(libname, '/'))
512 return strdup(libname);
513
514 if (pid && which_so_in_process(libname, pid, libpath))
515 return strdup(libpath);
516
517 if (lib_cache_count < 0)
518 return NULL;
519
520 if (!lib_cache_count && load_ld_cache(LD_SO_CACHE) < 0) {
521 lib_cache_count = -1;
522 return NULL;
523 }
524
525 snprintf(soname, soname_len + 1, "lib%s.so", libname);
526
527 for (i = 0; i < lib_cache_count; ++i) {
528 if (!strncmp(lib_cache[i].libname, soname, soname_len) &&
529 match_so_flags(lib_cache[i].flags)) {
530 return strdup(lib_cache[i].path);
531 }
532 }
533 return NULL;
534 }
535
bcc_procutils_free(const char * ptr)536 void bcc_procutils_free(const char *ptr) {
537 free((void *)ptr);
538 }
539
540 /* Detects the following languages + C. */
541 const char *languages[] = {"java", "node", "perl", "php", "python", "ruby"};
542 const char *language_c = "c";
543 const int nb_languages = 6;
544
bcc_procutils_language(int pid)545 const char *bcc_procutils_language(int pid) {
546 char procfilename[24], line[4096], pathname[32], *str;
547 FILE *procfile;
548 int i, ret;
549
550 /* Look for clues in the absolute path to the executable. */
551 snprintf(procfilename, sizeof(procfilename), "/proc/%ld/exe", (long)pid);
552 if (realpath(procfilename, line)) {
553 for (i = 0; i < nb_languages; i++)
554 if (strstr(line, languages[i]))
555 return languages[i];
556 }
557
558
559 snprintf(procfilename, sizeof(procfilename), "/proc/%ld/maps", (long)pid);
560 procfile = fopen(procfilename, "r");
561 if (!procfile)
562 return NULL;
563
564 /* Look for clues in memory mappings. */
565 bool libc = false;
566 do {
567 char perm[8], dev[8];
568 long long begin, end, size, inode;
569 ret = fscanf(procfile, "%llx-%llx %s %llx %s %lld", &begin, &end, perm,
570 &size, dev, &inode);
571 if (!fgets(line, sizeof(line), procfile))
572 break;
573 if (ret == 6) {
574 char *mapname = line;
575 char *newline = strchr(line, '\n');
576 if (newline)
577 newline[0] = '\0';
578 while (isspace(mapname[0])) mapname++;
579 for (i = 0; i < nb_languages; i++) {
580 snprintf(pathname, sizeof(pathname), "/lib%s", languages[i]);
581 if (strstr(mapname, pathname)) {
582 fclose(procfile);
583 return languages[i];
584 }
585 if ((str = strstr(mapname, "libc")) &&
586 (str[4] == '-' || str[4] == '.'))
587 libc = true;
588 }
589 }
590 } while (ret && ret != EOF);
591
592 fclose(procfile);
593
594 /* Return C as the language if libc was found and nothing else. */
595 return libc ? language_c : NULL;
596 }
597