Merge pull request iovisor#1358 from palmtenor/load_exe

Use ELF load sections in address -> symbol resolution

src/cc/bcc_syms.cc

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <algorithm>
 #include <cxxabi.h>
 #include <cstring>
 #include <fcntl.h>
@@ -28,9 +29,10 @@
 #include "bcc_perf_map.h"
 #include "bcc_proc.h"
 #include "bcc_syms.h"
+#include "common.h"
+#include "vendor/tinyformat.hpp"
 
 #include "syms.h"
-#include "vendor/tinyformat.hpp"
 
 ino_t ProcStat::getinode_() {
  struct stat s;
@@ -109,8 +111,33 @@ ProcSyms::ProcSyms(int pid, struct bcc_symbol_option *option)
  load_modules();
 }
 
-bool ProcSyms::load_modules() {
- return bcc_procutils_each_module(pid_, _add_module, this) == 0;
+int ProcSyms::_add_load_sections(uint64_t v_addr, uint64_t mem_sz,
+ uint64_t file_offset, void *payload) {
+ auto module = static_cast<Module *>(payload);
+ module->add_range(v_addr, v_addr + mem_sz);
+ return 0;
+}
+
+void ProcSyms::load_exe() {
+ std::string exe = ebpf::get_pid_exe(pid_);
+ Module module(exe.c_str(), mount_ns_instance_.get(), &symbol_option_);
+
+ if (!module.init())
+ return;
+ if (module.type_ != ModuleType::EXEC)
+ return;
+
+ ProcMountNSGuard g(mount_ns_instance_.get());
+
+ bcc_elf_foreach_load_section(exe.c_str(), &_add_load_sections, &module);
+
+ if (!module.ranges_.empty())
+ modules_.emplace_back(std::move(module));
+}
+
+void ProcSyms::load_modules() {
+ load_exe();
+ bcc_procutils_each_module(pid_, _add_module, this);
 }
 
 void ProcSyms::refresh() {
@@ -135,7 +162,7 @@ int ProcSyms::_add_module(const char *modname, uint64_t start, uint64_t end,
  else
  return 0;
  }
- it->ranges_.emplace_back(start, end);
+ it->add_range(start, end);
 
  return 0;
 }
@@ -248,6 +275,17 @@ void ProcSyms::Module::load_sym_table() {
  std::sort(syms_.begin(), syms_.end());
 }
 
+void ProcSyms::Module::add_range(uint64_t st, uint64_t en) {
+ if (!ranges_.empty()) {
+ Range &last = ranges_.back();
+ if (st >= last.start && st <= last.end) {
+ last.end = std::max(en, last.end);
+ return;
+ }
+ }
+ ranges_.emplace_back(st, en);
+}
+
 bool ProcSyms::Module::contains(uint64_t addr, uint64_t &offset) const {
  for (const auto &range : ranges_)
  if (addr >= range.start && addr < range.end) {

src/cc/common.cc

@@ -17,6 +17,7 @@
 #include <sstream>
 
 #include "common.h"
+#include "vendor/tinyformat.hpp"
 
 namespace ebpf {
 
@@ -48,4 +49,16 @@ std::vector<int> get_possible_cpus() {
  return read_cpu_range("/sys/devices/system/cpu/possible");
 }
 
+std::string get_pid_exe(pid_t pid) {
+ char exe_path[4096];
+ int res;
+
+ std::string exe_link = tfm::format("/proc/%d/exe", pid);
+ res = readlink(exe_link.c_str(), exe_path, sizeof(exe_path));
+ if (res == -1)
+ return "";
+ exe_path[res] = '\0';
+ return std::string(exe_path);
+}
+
 } // namespace ebpf

src/cc/common.h

@@ -17,6 +17,8 @@
 #pragma once
 
 #include <memory>
+#include <string>
+#include <unistd.h>
 #include <vector>
 
 namespace ebpf {
@@ -31,4 +33,6 @@ std::vector<int> get_online_cpus();
 
 std::vector<int> get_possible_cpus();
 
+std::string get_pid_exe(pid_t pid);
+
 } // namespace ebpf

src/cc/syms.h

@@ -110,8 +110,11 @@ class ProcSyms : SymbolCache {
  std::vector<Symbol> syms_;
 
  void load_sym_table();
+
+ void add_range(uint64_t st, uint64_t en);
  bool contains(uint64_t addr, uint64_t &offset) const;
  uint64_t start() const { return ranges_.begin()->start; }
+
  bool find_addr(uint64_t offset, struct bcc_symbol *sym);
  bool find_name(const char *symname, uint64_t *addr);
 
@@ -125,8 +128,11 @@ class ProcSyms : SymbolCache {
  std::unique_ptr<ProcMountNS> mount_ns_instance_;
  bcc_symbol_option symbol_option_;
 
+ static int _add_load_sections(uint64_t v_addr, uint64_t mem_sz,
+ uint64_t file_offset, void *payload);
  static int _add_module(const char *, uint64_t, uint64_t, bool, void *);
- bool load_modules();
+ void load_exe();
+ void load_modules();
 
 public:
  ProcSyms(int pid, struct bcc_symbol_option *option = nullptr);

src/cc/usdt/usdt.cc

@@ -24,6 +24,7 @@
 
 #include "bcc_elf.h"
 #include "bcc_proc.h"
+#include "common.h"
 #include "usdt.h"
 #include "vendor/tinyformat.hpp"
 #include "bcc_usdt.h"
@@ -314,17 +315,9 @@ Context::Context(const std::string &bin_path)
 Context::Context(int pid) : pid_(pid), pid_stat_(pid),
  mount_ns_instance_(new ProcMountNS(pid)), loaded_(false) {
  if (bcc_procutils_each_module(pid, _each_module, this) == 0) {
- // get exe command from /proc/<pid>/exe
- // assume the maximum path length 4096, which should be
- // sufficiently large to cover all use cases
- char source[64];
- char cmd_buf[4096];
- snprintf(source, sizeof(source), "/proc/%d/exe", pid);
- ssize_t cmd_len = readlink(source, cmd_buf, sizeof(cmd_buf) - 1);
- if (cmd_len == -1)
+ cmd_bin_path_ = ebpf::get_pid_exe(pid);
+ if (cmd_bin_path_.empty())
  return;
- cmd_buf[cmd_len] = '\0';
- cmd_bin_path_.assign(cmd_buf, cmd_len + 1);
 
  loaded_ = true;
  }