/* Copyright (C) 2007-2010 The Android Open Source Project ** ** This software is licensed under the terms of the GNU General Public ** License version 2, as published by the Free Software Foundation, and ** may be copied, distributed, and modified under those terms. ** ** This program is distributed in the hope that it will be useful, ** but WITHOUT ANY WARRANTY; without even the implied warranty of ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ** GNU General Public License for more details. */ /* * Contains implementation of routines related to process management in * memchecker framework. */ #include "elff/elff_api.h" #include "memcheck.h" #include "memcheck_proc_management.h" #include "memcheck_logging.h" #include "memcheck_util.h" /* Current thread id. * This value is updated with each call to memcheck_switch, saving here * ID of the thread that becomes current. */ static uint32_t current_tid = 0; /* Current thread descriptor. * This variable is used to cache current thread descriptor. This value gets * initialized on "as needed" basis, when descriptor for the current thread * is requested for the first time. * Note that every time memcheck_switch routine is called, this value gets * NULL'ed, since another thread becomes current. */ static ThreadDesc* current_thread = NULL; /* Current process descriptor. * This variable is used to cache current process descriptor. This value gets * initialized on "as needed" basis, when descriptor for the current process * is requested for the first time. * Note that every time memcheck_switch routine is called, this value gets * NULL'ed, since new thread becomes current, thus process switch may have * occurred as well. */ static ProcDesc* current_process = NULL; /* List of running processes. */ static QLIST_HEAD(proc_list, ProcDesc) proc_list; /* List of running threads. */ static QLIST_HEAD(thread_list, ThreadDesc) thread_list; // ============================================================================= // Static routines // ============================================================================= /* Creates and lists thread descriptor for a new thread. * This routine will allocate and initialize new thread descriptor. After that * this routine will insert the descriptor into the global list of running * threads, as well as thread list in the process descriptor of the process * in context of which this thread is created. * Param: * proc - Process descriptor of the process, in context of which new thread * is created. * tid - Thread ID of the thread that's being created. * Return: * New thread descriptor on success, or NULL on failure. */ static ThreadDesc* create_new_thread(ProcDesc* proc, uint32_t tid) { ThreadDesc* new_thread = (ThreadDesc*)qemu_malloc(sizeof(ThreadDesc)); if (new_thread == NULL) { ME("memcheck: Unable to allocate new thread descriptor."); return NULL; } new_thread->tid = tid; new_thread->process = proc; new_thread->call_stack = NULL; new_thread->call_stack_count = 0; new_thread->call_stack_max = 0; QLIST_INSERT_HEAD(&thread_list, new_thread, global_entry); QLIST_INSERT_HEAD(&proc->threads, new_thread, proc_entry); return new_thread; } /* Creates and lists process descriptor for a new process. * This routine will allocate and initialize new process descriptor. After that * this routine will create main thread descriptor for the process (with the * thread ID equal to the new process ID), and then new process descriptor will * be inserted into the global list of running processes. * Param: * pid - Process ID of the process that's being created. * parent_pid - Process ID of the parent process. * Return: * New process descriptor on success, or NULL on failure. */ static ProcDesc* create_new_process(uint32_t pid, uint32_t parent_pid) { // Create and init new process descriptor. ProcDesc* new_proc = (ProcDesc*)qemu_malloc(sizeof(ProcDesc)); if (new_proc == NULL) { ME("memcheck: Unable to allocate new process descriptor"); return NULL; } QLIST_INIT(&new_proc->threads); allocmap_init(&new_proc->alloc_map); mmrangemap_init(&new_proc->mmrange_map); new_proc->pid = pid; new_proc->parent_pid = parent_pid; new_proc->image_path = NULL; new_proc->flags = 0; if (parent_pid != 0) { /* If new process has been forked, it inherits a copy of parent's * process heap, as well as parent's mmaping of loaded modules. So, on * fork we're required to copy parent's allocation descriptors map, as * well as parent's mmapping map to the new process. */ int failed; ProcDesc* parent = get_process_from_pid(parent_pid); if (parent == NULL) { ME("memcheck: Unable to get parent process pid=%u for new process pid=%u", parent_pid, pid); qemu_free(new_proc); return NULL; } /* Copy parent's allocation map, setting "inherited" flag, and clearing * parent's "transition" flag in the copied entries. */ failed = allocmap_copy(&new_proc->alloc_map, &parent->alloc_map, MDESC_FLAG_INHERITED_ON_FORK, MDESC_FLAG_TRANSITION_ENTRY); if (failed) { ME("memcheck: Unable to copy process' %s[pid=%u] allocation map to new process pid=%u", parent->image_path, parent_pid, pid); allocmap_empty(&new_proc->alloc_map); qemu_free(new_proc); return NULL; } // Copy parent's memory mappings map. failed = mmrangemap_copy(&new_proc->mmrange_map, &parent->mmrange_map); if (failed) { ME("memcheck: Unable to copy process' %s[pid=%u] mmrange map to new process pid=%u", parent->image_path, parent_pid, pid); mmrangemap_empty(&new_proc->mmrange_map); allocmap_empty(&new_proc->alloc_map); qemu_free(new_proc); return NULL; } } // Create and register main thread descriptor for new process. if(create_new_thread(new_proc, pid) == NULL) { mmrangemap_empty(&new_proc->mmrange_map); allocmap_empty(&new_proc->alloc_map); qemu_free(new_proc); return NULL; } // List new process. QLIST_INSERT_HEAD(&proc_list, new_proc, global_entry); return new_proc; } /* Finds thread descriptor for a thread id in the global list of running * threads. * Param: * tid - Thread ID to look up thread descriptor for. * Return: * Found thread descriptor, or NULL if thread descriptor has not been found. */ static ThreadDesc* get_thread_from_tid(uint32_t tid) { ThreadDesc* thread; /* There is a pretty good chance that when this call is made, it's made * to get descriptor for the current thread. Lets see if it is so, so * we don't have to iterate through the entire list. */ if (tid == current_tid && current_thread != NULL) { return current_thread; } QLIST_FOREACH(thread, &thread_list, global_entry) { if (tid == thread->tid) { if (tid == current_tid) { current_thread = thread; } return thread; } } return NULL; } /* Gets thread descriptor for the current thread. * Return: * Found thread descriptor, or NULL if thread descriptor has not been found. */ ThreadDesc* get_current_thread(void) { // Lets see if current thread descriptor has been cached. if (current_thread == NULL) { /* Descriptor is not cached. Look it up in the list. Note that * get_thread_from_tid(current_tid) is not used here in order to * optimize this code for performance, as this routine is called from * the performance sensitive path. */ ThreadDesc* thread; QLIST_FOREACH(thread, &thread_list, global_entry) { if (current_tid == thread->tid) { current_thread = thread; return current_thread; } } } return current_thread; } /* Finds process descriptor for a thread id. * Param: * tid - Thread ID to look up process descriptor for. * Return: * Process descriptor for the thread, or NULL, if process descriptor * has not been found. */ static inline ProcDesc* get_process_from_tid(uint32_t tid) { const ThreadDesc* thread = get_thread_from_tid(tid); return (thread != NULL) ? thread->process : NULL; } /* Sets, or replaces process image path in process descriptor. * Generally, new process' image path is unknown untill we calculate it in * the handler for TRACE_DEV_REG_CMDLINE event. This routine is called from * TRACE_DEV_REG_CMDLINE event handler to set, or replace process image path. * Param: * proc - Descriptor of the process where to set, or replace image path. * image_path - Image path to the process, transmitted with * TRACE_DEV_REG_CMDLINE event. * set_flags_on_replace - Flags to be set when current image path for the * process has been actually replaced with the new one. * Return: * Zero on success, or -1 on failure. */ static int procdesc_set_image_path(ProcDesc* proc, const char* image_path, uint32_t set_flags_on_replace) { if (image_path == NULL || proc == NULL) { return 0; } if (proc->image_path != NULL) { /* Process could have been forked, and inherited image path of the * parent process. However, it seems that "fork" in terms of TRACE_XXX * is not necessarly a strict "fork", but rather new process creation * in general. So, if that's the case we need to override image path * inherited from the parent process. */ if (!strcmp(proc->image_path, image_path)) { // Paths are the same. Just bail out. return 0; } qemu_free(proc->image_path); proc->image_path = NULL; } // Save new image path into process' descriptor. proc->image_path = qemu_malloc(strlen(image_path) + 1); if (proc->image_path == NULL) { ME("memcheck: Unable to allocate %u bytes for image path %s to set it for pid=%u", strlen(image_path) + 1, image_path, proc->pid); return -1; } strcpy(proc->image_path, image_path); proc->flags |= set_flags_on_replace; return 0; } /* Frees thread descriptor. */ static void threaddesc_free(ThreadDesc* thread) { uint32_t indx; if (thread == NULL) { return; } if (thread->call_stack != NULL) { for (indx = 0; indx < thread->call_stack_count; indx++) { if (thread->call_stack[indx].module_path != NULL) { qemu_free(thread->call_stack[indx].module_path); } } qemu_free(thread->call_stack); } qemu_free(thread); } // ============================================================================= // Process management API // ============================================================================= void memcheck_init_proc_management(void) { QLIST_INIT(&proc_list); QLIST_INIT(&thread_list); } ProcDesc* get_process_from_pid(uint32_t pid) { ProcDesc* proc; /* Chances are that pid addresses the current process. Lets check this, * so we don't have to iterate through the entire project list. */ if (current_thread != NULL && current_thread->process->pid == pid) { current_process = current_thread->process; return current_process; } QLIST_FOREACH(proc, &proc_list, global_entry) { if (pid == proc->pid) { break; } } return proc; } ProcDesc* get_current_process(void) { if (current_process == NULL) { const ThreadDesc* cur_thread = get_current_thread(); if (cur_thread != NULL) { current_process = cur_thread->process; } } return current_process; } void memcheck_on_call(target_ulong from, target_ulong ret) { const uint32_t grow_by = 32; const uint32_t max_stack = grow_by; ThreadDesc* thread = get_current_thread(); if (thread == NULL) { return; } /* We're not saving call stack until process starts execution. */ if (!procdesc_is_executing(thread->process)) { return; } const MMRangeDesc* rdesc = procdesc_get_range_desc(thread->process, from); if (rdesc == NULL) { ME("memcheck: Unable to find mapping for guest PC 0x%08X in process %s[pid=%u]", from, thread->process->image_path, thread->process->pid); return; } /* Limit calling stack size. There are cases when calling stack can be * quite deep due to recursion (up to 4000 entries). */ if (thread->call_stack_count >= max_stack) { #if 0 /* This happens quite often. */ MD("memcheck: Thread stack for %s[pid=%u, tid=%u] is too big: %u", thread->process->image_path, thread->process->pid, thread->tid, thread->call_stack_count); #endif return; } if (thread->call_stack_count >= thread->call_stack_max) { /* Expand calling stack array buffer. */ thread->call_stack_max += grow_by; ThreadCallStackEntry* new_array = qemu_malloc(thread->call_stack_max * sizeof(ThreadCallStackEntry)); if (new_array == NULL) { ME("memcheck: Unable to allocate %u bytes for calling stack.", thread->call_stack_max * sizeof(ThreadCallStackEntry)); thread->call_stack_max -= grow_by; return; } if (thread->call_stack_count != 0) { memcpy(new_array, thread->call_stack, thread->call_stack_count * sizeof(ThreadCallStackEntry)); } if (thread->call_stack != NULL) { qemu_free(thread->call_stack); } thread->call_stack = new_array; } thread->call_stack[thread->call_stack_count].call_address = from; thread->call_stack[thread->call_stack_count].call_address_rel = mmrangedesc_get_module_offset(rdesc, from); thread->call_stack[thread->call_stack_count].ret_address = ret; thread->call_stack[thread->call_stack_count].ret_address_rel = mmrangedesc_get_module_offset(rdesc, ret); thread->call_stack[thread->call_stack_count].module_path = qemu_malloc(strlen(rdesc->path) + 1); if (thread->call_stack[thread->call_stack_count].module_path == NULL) { ME("memcheck: Unable to allocate %u bytes for module path in the thread calling stack.", strlen(rdesc->path) + 1); return; } strcpy(thread->call_stack[thread->call_stack_count].module_path, rdesc->path); thread->call_stack_count++; } void memcheck_on_ret(target_ulong ret) { ThreadDesc* thread = get_current_thread(); if (thread == NULL) { return; } /* We're not saving call stack until process starts execution. */ if (!procdesc_is_executing(thread->process)) { return; } if (thread->call_stack_count > 0) { int indx = (int)thread->call_stack_count - 1; for (; indx >= 0; indx--) { if (thread->call_stack[indx].ret_address == ret) { thread->call_stack_count = indx; return; } } } } // ============================================================================= // Handlers for events, generated by the kernel. // ============================================================================= void memcheck_init_pid(uint32_t new_pid) { create_new_process(new_pid, 0); T(PROC_NEW_PID, "memcheck: init_pid(pid=%u) in current thread tid=%u\n", new_pid, current_tid); } void memcheck_switch(uint32_t tid) { /* Since new thread became active, we have to invalidate cached * descriptors for current thread and process. */ current_thread = NULL; current_process = NULL; current_tid = tid; } void memcheck_fork(uint32_t tgid, uint32_t new_pid) { ProcDesc* parent_proc; ProcDesc* new_proc; /* tgid may match new_pid, in which case current process is the * one that's being forked, otherwise tgid identifies process * that's being forked. */ if (new_pid == tgid) { parent_proc = get_current_process(); } else { parent_proc = get_process_from_tid(tgid); } if (parent_proc == NULL) { ME("memcheck: FORK(%u, %u): Unable to look up parent process. Current tid=%u", tgid, new_pid, current_tid); return; } if (parent_proc->pid != get_current_process()->pid) { MD("memcheck: FORK(%u, %u): parent %s[pid=%u] is not the current process %s[pid=%u]", tgid, new_pid, parent_proc->image_path, parent_proc->pid, get_current_process()->image_path, get_current_process()->pid); } new_proc = create_new_process(new_pid, parent_proc->pid); if (new_proc == NULL) { return; } /* Since we're possibly forking parent process, we need to inherit * parent's image path in the forked process. */ procdesc_set_image_path(new_proc, parent_proc->image_path, 0); T(PROC_FORK, "memcheck: FORK(tgid=%u, new_pid=%u) by %s[pid=%u] (tid=%u)\n", tgid, new_pid, parent_proc->image_path, parent_proc->pid, current_tid); } void memcheck_clone(uint32_t tgid, uint32_t new_tid) { ProcDesc* parent_proc; /* tgid may match new_pid, in which case current process is the * one that creates thread, otherwise tgid identifies process * that creates thread. */ if (new_tid == tgid) { parent_proc = get_current_process(); } else { parent_proc = get_process_from_tid(tgid); } if (parent_proc == NULL) { ME("memcheck: CLONE(%u, %u) Unable to look up parent process. Current tid=%u", tgid, new_tid, current_tid); return; } if (parent_proc->pid != get_current_process()->pid) { ME("memcheck: CLONE(%u, %u): parent %s[pid=%u] is not the current process %s[pid=%u]", tgid, new_tid, parent_proc->image_path, parent_proc->pid, get_current_process()->image_path, get_current_process()->pid); } create_new_thread(parent_proc, new_tid); T(PROC_CLONE, "memcheck: CLONE(tgid=%u, new_tid=%u) by %s[pid=%u] (tid=%u)\n", tgid, new_tid, parent_proc->image_path, parent_proc->pid, current_tid); } void memcheck_set_cmd_line(const char* cmd_arg, unsigned cmdlen) { char parsed[4096]; int n; ProcDesc* current_proc = get_current_process(); if (current_proc == NULL) { ME("memcheck: CMDL(%s, %u): Unable to look up process for current tid=%3u", cmd_arg, cmdlen, current_tid); return; } /* Image path is the first agrument in cmd line. Note that due to * limitations of TRACE_XXX cmdlen can never exceed CLIENT_PAGE_SIZE */ memcpy(parsed, cmd_arg, cmdlen); // Cut first argument off the entire command line. for (n = 0; n < cmdlen; n++) { if (parsed[n] == ' ') { break; } } parsed[n] = '\0'; // Save process' image path into descriptor. procdesc_set_image_path(current_proc, parsed, PROC_FLAG_IMAGE_PATH_REPLACED); current_proc->flags |= PROC_FLAG_EXECUTING; /* At this point we need to discard memory mappings inherited from * the parent process, since this process has become "independent" from * its parent. */ mmrangemap_empty(¤t_proc->mmrange_map); T(PROC_START, "memcheck: Executing process %s[pid=%u]\n", current_proc->image_path, current_proc->pid); } void memcheck_exit(uint32_t exit_code) { ProcDesc* proc; int leaks_reported = 0; MallocDescEx leaked_alloc; // Exiting thread descriptor. ThreadDesc* thread = get_current_thread(); if (thread == NULL) { ME("memcheck: EXIT(%u): Unable to look up thread for current tid=%u", exit_code, current_tid); return; } proc = thread->process; // Since current thread is exiting, we need to NULL its cached descriptor. current_thread = NULL; // Unlist the thread from its process as well as global lists. QLIST_REMOVE(thread, proc_entry); QLIST_REMOVE(thread, global_entry); threaddesc_free(thread); /* Lets see if this was last process thread, which would indicate * process termination. */ if (!QLIST_EMPTY(&proc->threads)) { return; } // Process is terminating. Report leaks and free resources. proc->flags |= PROC_FLAG_EXITING; /* Empty allocation descriptors map for the exiting process, * reporting leaking blocks in the process. */ while (!allocmap_pull_first(&proc->alloc_map, &leaked_alloc)) { /* We should "forgive" blocks that were inherited from the * parent process on fork, or were allocated while process was * in "transition" state. */ if (!mallocdescex_is_inherited_on_fork(&leaked_alloc) && !mallocdescex_is_transition_entry(&leaked_alloc)) { if (!leaks_reported) { // First leak detected. Print report's header. T(CHECK_LEAK, "memcheck: Process %s[pid=%u] is exiting leaking allocated blocks:\n", proc->image_path, proc->pid); } if (trace_flags & TRACE_CHECK_LEAK_ENABLED) { // Dump leaked block information. printf(" Leaked block %u:\n", leaks_reported + 1); memcheck_dump_malloc_desc(&leaked_alloc, 0, 0); if (leaked_alloc.call_stack != NULL) { const int max_stack = 24; if (max_stack >= leaked_alloc.call_stack_count) { printf(" Call stack:\n"); } else { printf(" Call stack (first %u of %u entries):\n", max_stack, leaked_alloc.call_stack_count); } uint32_t stk; for (stk = 0; stk < leaked_alloc.call_stack_count && stk < max_stack; stk++) { const MMRangeDesc* rdesc = procdesc_find_mapentry(proc, leaked_alloc.call_stack[stk]); if (rdesc != NULL) { Elf_AddressInfo elff_info; ELFF_HANDLE elff_handle = NULL; uint32_t rel = mmrangedesc_get_module_offset(rdesc, leaked_alloc.call_stack[stk]); printf(" Frame %u: PC=0x%08X (relative 0x%08X) in module %s\n", stk, leaked_alloc.call_stack[stk], rel, rdesc->path); if (memcheck_get_address_info(leaked_alloc.call_stack[stk], rdesc, &elff_info, &elff_handle) == 0) { printf(" Routine %s @ %s/%s:%u\n", elff_info.routine_name, elff_info.dir_name, elff_info.file_name, elff_info.line_number); elff_free_pc_address_info(elff_handle, &elff_info); elff_close(elff_handle); } } else { printf(" Frame %u: PC=0x%08X in module \n", stk, leaked_alloc.call_stack[stk]); } } } } leaks_reported++; } } if (leaks_reported) { T(CHECK_LEAK, "memcheck: Process %s[pid=%u] is leaking %u allocated blocks.\n", proc->image_path, proc->pid, leaks_reported); } T(PROC_EXIT, "memcheck: Exiting process %s[pid=%u] in thread %u. Memory leaks detected: %u\n", proc->image_path, proc->pid, current_tid, leaks_reported); /* Since current process is exiting, we need to NULL its cached descriptor, * and unlist it from the list of running processes. */ current_process = NULL; QLIST_REMOVE(proc, global_entry); // Empty process' mmapings map. mmrangemap_empty(&proc->mmrange_map); if (proc->image_path != NULL) { qemu_free(proc->image_path); } qemu_free(proc); } void memcheck_mmap_exepath(target_ulong vstart, target_ulong vend, target_ulong exec_offset, const char* path) { MMRangeDesc desc; MMRangeDesc replaced; RBTMapResult ins_res; ProcDesc* proc = get_current_process(); if (proc == NULL) { ME("memcheck: MMAP(0x%08X, 0x%08X, 0x%08X, %s) Unable to look up current process. Current tid=%u", vstart, vend, exec_offset, path, current_tid); return; } /* First, unmap an overlapped section */ memcheck_unmap(vstart, vend); /* Add new mapping. */ desc.map_start = vstart; desc.map_end = vend; desc.exec_offset = exec_offset; desc.path = qemu_malloc(strlen(path) + 1); if (desc.path == NULL) { ME("memcheck: MMAP(0x%08X, 0x%08X, 0x%08X, %s) Unable to allocate path for the entry.", vstart, vend, exec_offset, path); return; } strcpy(desc.path, path); ins_res = mmrangemap_insert(&proc->mmrange_map, &desc, &replaced); if (ins_res == RBT_MAP_RESULT_ERROR) { ME("memcheck: %s[pid=%u] unable to insert memory mapping entry: 0x%08X - 0x%08X", proc->image_path, proc->pid, vstart, vend); qemu_free(desc.path); return; } if (ins_res == RBT_MAP_RESULT_ENTRY_REPLACED) { MD("memcheck: %s[pid=%u] MMRANGE %s[0x%08X - 0x%08X] is replaced with %s[0x%08X - 0x%08X]", proc->image_path, proc->pid, replaced.path, replaced.map_start, replaced.map_end, desc.path, desc.map_start, desc.map_end); qemu_free(replaced.path); } T(PROC_MMAP, "memcheck: %s[pid=%u] %s is mapped: 0x%08X - 0x%08X + 0x%08X\n", proc->image_path, proc->pid, path, vstart, vend, exec_offset); } void memcheck_unmap(target_ulong vstart, target_ulong vend) { MMRangeDesc desc; ProcDesc* proc = get_current_process(); if (proc == NULL) { ME("memcheck: UNMAP(0x%08X, 0x%08X) Unable to look up current process. Current tid=%u", vstart, vend, current_tid); return; } if (mmrangemap_pull(&proc->mmrange_map, vstart, vend, &desc)) { return; } if (desc.map_start >= vstart && desc.map_end <= vend) { /* Entire mapping has been deleted. */ T(PROC_MMAP, "memcheck: %s[pid=%u] %s is unmapped: [0x%08X - 0x%08X + 0x%08X]\n", proc->image_path, proc->pid, desc.path, vstart, vend, desc.exec_offset); qemu_free(desc.path); return; } /* This can be first stage of "remap" request, when part of the existing * mapping has been unmapped. If that's so, lets cut unmapped part from the * block that we just pulled, and add whatever's left back to the map. */ T(PROC_MMAP, "memcheck: REMAP(0x%08X, 0x%08X + 0x%08X) -> (0x%08X, 0x%08X)\n", desc.map_start, desc.map_end, desc.exec_offset, vstart, vend); if (desc.map_start == vstart) { /* We cut part from the beginning. Add the tail back. */ desc.exec_offset += vend - desc.map_start; desc.map_start = vend; mmrangemap_insert(&proc->mmrange_map, &desc, NULL); } else if (desc.map_end == vend) { /* We cut part from the tail. Add the beginning back. */ desc.map_end = vstart; mmrangemap_insert(&proc->mmrange_map, &desc, NULL); } else { /* We cut piece in the middle. */ MMRangeDesc tail; tail.map_start = vend; tail.map_end = desc.map_end; tail.exec_offset = vend - desc.map_start + desc.exec_offset; tail.path = qemu_malloc(strlen(desc.path) + 1); strcpy(tail.path, desc.path); mmrangemap_insert(&proc->mmrange_map, &tail, NULL); desc.map_end = vstart; mmrangemap_insert(&proc->mmrange_map, &desc, NULL); } }