Capture build-id in module load events on Linux (#116865)

MichalStrehovsky · web-flow · commit e2c99a9ad53c · 2025-06-25T02:48:20.000-07:00
Module load events on Windows carry a GUID of the matching PDB. This is used to verify the PDB that is used to analyze traces matches the one of the program.

On Linux, we don't have PDBs and PDB GUID. Instead, we have build-id. Build-id is a binary blob of an unspecified length that is stored both in .debug files and in the program binary. Typically, it is 20 bytes (SHA-1). Since 20 is more than 16, it unfortunately doesn't fit in the space we have. Emit a new version of the event that can fit it.
diff --git a/src/coreclr/nativeaot/Runtime/Pal.h b/src/coreclr/nativeaot/Runtime/Pal.h
@@ -161,7 +161,7 @@ bool PalInit();
 // Given the OS handle of a loaded module, compute the upper and lower virtual address bounds (inclusive).
 void PalGetModuleBounds(HANDLE hOsHandle, _Out_ uint8_t ** ppLowerBound, _Out_ uint8_t ** ppUpperBound);
 
-void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath);
+void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath, _Out_ uint32_t * pcbBuildId, _Out_ void ** ppBuildId);
 
 struct NATIVE_CONTEXT;
 
diff --git a/src/coreclr/nativeaot/Runtime/eventpipe/gen-eventing-event-inc.lst b/src/coreclr/nativeaot/Runtime/eventpipe/gen-eventing-event-inc.lst
@@ -83,8 +83,8 @@ GenAwareBegin
 GenAwareEnd
 IncreaseMemoryPressure
 LockCreated
-ModuleDCEnd_V2
-ModuleLoad_V2
+ModuleDCEnd_V3
+ModuleLoad_V3
 PinObjectAtGCTime
 PinPlugAtGCTime
 PrvDestroyGCHandle
diff --git a/src/coreclr/nativeaot/Runtime/eventtrace.cpp b/src/coreclr/nativeaot/Runtime/eventtrace.cpp
@@ -379,13 +379,32 @@ void ETW::LoaderLog::SendModuleEvent(HANDLE pModule, uint32_t dwEventOptions)
     GUID nativeGuid;
     uint32_t dwAge;
     WCHAR wszPath[1024];
-    PalGetPDBInfo(pModule, &nativeGuid, &dwAge, wszPath, ARRAY_SIZE(wszPath));
+    uint32_t cbBuildId;
+    void* pBuildId;
+    PalGetPDBInfo(pModule, &nativeGuid, &dwAge, wszPath, ARRAY_SIZE(wszPath), &cbBuildId, &pBuildId);
+
+    WCHAR wszBuildId[65];
+    size_t written = 0;
+    for (size_t i = 0; i < cbBuildId; i++)
+    {
+        if (written + 3 <= ARRAY_SIZE(wszBuildId)) { // 2 hex digits + 1 null terminator
+            const WCHAR* hexDigits = W("0123456789ABCDEF");
+            // Convert each byte to hex and append to the output string
+            uint8_t c = ((uint8_t*)pBuildId)[i];
+            wszBuildId[written++] = hexDigits[c >> 4];
+            wszBuildId[written++] = hexDigits[c & 0xF];
+        } else {
+            // If buffer not enough to fit, truncate 
+            break;
+        }
+    }
+    wszBuildId[written] = 0;
 
     GUID zeroGuid = { 0 };
 
     if (dwEventOptions & ETW::EnumerationLog::EnumerationStructs::DomainAssemblyModuleLoad)
     {
-        FireEtwModuleLoad_V2(
+        FireEtwModuleLoad_V3(
             ULONGLONG(pModule),
             0,                      // AssemblyID
             ETW::LoaderLog::LoaderStructs::NativeModule, // Module Flags
@@ -398,12 +417,13 @@ void ETW::LoaderLog::SendModuleEvent(HANDLE pModule, uint32_t dwEventOptions)
             NULL,                   // ManagedPdbBuildPath, 
             &nativeGuid,            // NativePdbSignature,
             dwAge,                  // NativePdbAge, 
-            wszPath                 // NativePdbBuildPath, 
+            wszPath,                // NativePdbBuildPath,
+            wszBuildId              // NativeBuildId,
             );
     }
     else if (dwEventOptions & ETW::EnumerationLog::EnumerationStructs::DomainAssemblyModuleDCEnd)
     {
-        FireEtwModuleDCEnd_V2(
+        FireEtwModuleDCEnd_V3(
             ULONGLONG(pModule),
             0,                      // AssemblyID
             ETW::LoaderLog::LoaderStructs::NativeModule, // Module Flags
@@ -416,7 +436,8 @@ void ETW::LoaderLog::SendModuleEvent(HANDLE pModule, uint32_t dwEventOptions)
             NULL,                   // ManagedPdbBuildPath, 
             &nativeGuid,            // NativePdbSignature,
             dwAge,                  // NativePdbAge, 
-            wszPath                 // NativePdbBuildPath, 
+            wszPath,                // NativePdbBuildPath, 
+            wszBuildId              // NativeBuildId,
             );
     }
     else
diff --git a/src/coreclr/nativeaot/Runtime/unix/PalUnix.cpp b/src/coreclr/nativeaot/Runtime/unix/PalUnix.cpp
@@ -44,6 +44,8 @@
 
 #ifdef TARGET_LINUX
 #include <sys/syscall.h>
+#include <link.h>
+#include <elf.h>
 #endif
 
 #if HAVE_PTHREAD_GETTHREADID_NP
@@ -95,13 +97,96 @@ void RhFailFast()
     abort();
 }
 
-void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath)
+#if TARGET_LINUX
+
+struct PalGetPDBInfoPhdrCallbackData
+{
+    void* Base;
+    void* BuildID;
+    uint32_t BuildIDLength;
+};
+
+static int PalGetPDBInfoPhdrCallback(struct dl_phdr_info *info, size_t size, void* pData)
+{
+    struct PalGetPDBInfoPhdrCallbackData* pCallbackData = (struct PalGetPDBInfoPhdrCallbackData*)pData;
+
+    // Find the module of interest
+    void* loadAddress = NULL;
+    for (ElfW(Half) i = 0; i < info->dlpi_phnum; i++)
+    {
+        if (info->dlpi_phdr[i].p_type == PT_LOAD)
+        {
+            loadAddress = (void*)(info->dlpi_addr + info->dlpi_phdr[i].p_vaddr);
+            if (loadAddress == pCallbackData->Base)
+                break;
+        }
+    }
+
+    if (loadAddress != pCallbackData->Base)
+    {
+        return 0;
+    }
+
+    // Got the module of interest. Now iterate program headers and try to find the GNU build ID note
+    for (ElfW(Half) i = 0; i < info->dlpi_phnum; i++)
+    {
+        // Must be a note section. We don't check the name because while there's a convention for the name,
+        // the convention is not mandatory.
+        if (info->dlpi_phdr[i].p_type != PT_NOTE)
+            continue;
+
+        // Got a note section, iterate over the contents and find the GNU build id one
+        ElfW(Nhdr) *note = (ElfW(Nhdr)*)(info->dlpi_addr + info->dlpi_phdr[i].p_vaddr);
+        ElfW(Addr) align = info->dlpi_phdr[i].p_align;
+        ElfW(Addr) size = info->dlpi_phdr[i].p_memsz;
+        ElfW(Addr) start = (ElfW(Addr))note;
+
+        while ((ElfW(Addr)) (note + 1) - start < size)
+        {
+            if (note->n_namesz == 4
+                && note->n_type == NT_GNU_BUILD_ID
+                && memcmp(note + 1, "GNU", 4) == 0)
+            {
+                // Got the note, fill out the callback data and return.
+                pCallbackData->BuildID = (uint8_t*)note + sizeof(ElfW(Nhdr)) + ALIGN_UP(note->n_namesz, align);
+                pCallbackData->BuildIDLength = note->n_descsz;
+                return 1;
+            }
+
+            // Skip over the note. Size of the note is determined by the header and payload (aligned)
+            size_t offset = sizeof(ElfW(Nhdr))
+                + ALIGN_UP(note->n_namesz, align)
+                + ALIGN_UP(note->n_descsz, align);
+            note = (ElfW(Nhdr)*)((uint8_t*)note + offset);
+        }
+    }
+
+    return 0;
+}
+#endif
+
+void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath, _Out_ uint32_t * pcbBuildId, _Out_ void ** ppBuildId)
 {
     memset(pGuidSignature, 0, sizeof(*pGuidSignature));
     *pdwAge = 0;
+    *ppBuildId = NULL;
+    *pcbBuildId = 0;
     if (cchPath <= 0)
         return;
     wszPath[0] = L'\0';
+
+#if TARGET_LINUX
+    struct PalGetPDBInfoPhdrCallbackData data;
+    data.Base = hOsHandle;
+
+    if (!dl_iterate_phdr(&PalGetPDBInfoPhdrCallback, &data))
+    {
+        return;
+    }
+
+    *pcbBuildId = data.BuildIDLength;
+    *ppBuildId = data.BuildID;
+#endif
 }
 
 static void UnmaskActivationSignal()
diff --git a/src/coreclr/nativeaot/Runtime/windows/PalCommon.cpp b/src/coreclr/nativeaot/Runtime/windows/PalCommon.cpp
@@ -50,10 +50,12 @@ void PalGetModuleBounds(HANDLE hOsHandle, _Out_ uint8_t ** ppLowerBound, _Out_ u
 //
 // This is a simplification of similar code in CLR's GetCodeViewInfo
 // in eventtrace.cpp.
-void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath)
+void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath, _Out_ uint32_t * pcbBuildId, _Out_ void ** ppBuildId)
 {
     // Zero-init [out]-params
     ZeroMemory(pGuidSignature, sizeof(*pGuidSignature));
+    *ppBuildId = NULL;
+    *pcbBuildId = 0;
     *pdwAge = 0;
     if (cchPath <= 0)
         return;
diff --git a/src/coreclr/vm/ClrEtwAll.man b/src/coreclr/vm/ClrEtwAll.man
@@ -1932,6 +1932,40 @@
                       </UserData>
                   </template>
 
+                  <template tid="ModuleLoadUnload_V3">
+                      <data name="ModuleID" inType="win:UInt64" outType="win:HexInt64" />
+                      <data name="AssemblyID" inType="win:UInt64" outType="win:HexInt64" />
+                      <data name="ModuleFlags" inType="win:UInt32" map="ModuleFlagsMap" />
+                      <data name="Reserved1"   inType="win:UInt32" />
+                      <data name="ModuleILPath" inType="win:UnicodeString" />
+                      <data name="ModuleNativePath" inType="win:UnicodeString" />
+                      <data name="ClrInstanceID" inType="win:UInt16" />
+                      <data name="ManagedPdbSignature" inType="win:GUID" />
+                      <data name="ManagedPdbAge" inType="win:UInt32" />
+                      <data name="ManagedPdbBuildPath" inType="win:UnicodeString" />
+                      <data name="NativePdbSignature" inType="win:GUID" />
+                      <data name="NativePdbAge" inType="win:UInt32" />
+                      <data name="NativePdbBuildPath" inType="win:UnicodeString" />
+                      <data name="NativeBuildID" inType="win:UnicodeString" />
+                    <UserData>
+                          <ModuleLoadUnload_V3 xmlns="myNs">
+                              <ModuleID> %1 </ModuleID>
+                              <AssemblyID> %2 </AssemblyID>
+                              <ModuleFlags> %3 </ModuleFlags>
+                              <ModuleILPath> %4 </ModuleILPath>
+                              <ModuleNativePath> %5 </ModuleNativePath>
+                              <ClrInstanceID> %6 </ClrInstanceID>
+                              <ManagedPdbSignature> %7 </ManagedPdbSignature>
+                              <ManagedPdbAge> %8 </ManagedPdbAge>
+                              <ManagedPdbBuildPath> %9 </ManagedPdbBuildPath>
+                              <NativePdbSignature> %10 </NativePdbSignature>
+                              <NativePdbAge> %11 </NativePdbAge>
+                              <NativePdbBuildPath> %12 </NativePdbBuildPath>
+                              <NativeBuildID> %13 </NativeBuildID>
+                          </ModuleLoadUnload_V3>
+                      </UserData>
+                  </template>
+
                     <template tid="AssemblyLoadUnload">
                         <data name="AssemblyID" inType="win:UInt64" outType="win:HexInt64" />
                         <data name="AppDomainID" inType="win:UInt64" outType="win:HexInt64" />
@@ -4008,6 +4042,11 @@
                            task="CLRLoader"
                            symbol="ModuleLoad_V2" message="$(string.RuntimePublisher.ModuleLoad_V2EventMessage)"/>
 
+                    <event value="152" version="3" level="win:Informational"  template="ModuleLoadUnload_V3"
+                           keywords ="LoaderKeyword PerfTrackKeyword" opcode="ModuleLoad"
+                           task="CLRLoader"
+                           symbol="ModuleLoad_V3" message="$(string.RuntimePublisher.ModuleLoad_V3EventMessage)"/>
+
                     <event value="153" version="0" level="win:Informational"  template="ModuleLoadUnload"
                            keywords ="LoaderKeyword" opcode="ModuleUnload"
                            task="CLRLoader"
@@ -4676,6 +4715,41 @@
                         </UserData>
                     </template>
 
+                    <template tid="ModuleLoadUnloadRundown_V3">
+                      <data name="ModuleID" inType="win:UInt64" outType="win:HexInt64" />
+                      <data name="AssemblyID" inType="win:UInt64" outType="win:HexInt64" />
+                      <data name="ModuleFlags" inType="win:UInt32" map="ModuleFlagsMap" />
+                      <data name="Reserved1"   inType="win:UInt32" />
+                      <data name="ModuleILPath" inType="win:UnicodeString" />
+                      <data name="ModuleNativePath" inType="win:UnicodeString" />
+                      <data name="ClrInstanceID" inType="win:UInt16" />
+                      <data name="ManagedPdbSignature" inType="win:GUID" />
+                      <data name="ManagedPdbAge" inType="win:UInt32" />
+                      <data name="ManagedPdbBuildPath" inType="win:UnicodeString" />
+                      <data name="NativePdbSignature" inType="win:GUID" />
+                      <data name="NativePdbAge" inType="win:UInt32" />
+                      <data name="NativePdbBuildPath" inType="win:UnicodeString" />
+                      <data name="NativeBuildID" inType="win:UnicodeString" />
+
+                      <UserData>
+                          <ModuleLoadUnloadRundown_V3 xmlns="myNs">
+                              <ModuleID> %1 </ModuleID>
+                              <AssemblyID> %2 </AssemblyID>
+                              <ModuleFlags> %3 </ModuleFlags>
+                              <ModuleILPath> %4 </ModuleILPath>
+                              <ModuleNativePath> %5 </ModuleNativePath>
+                              <ClrInstanceID> %6 </ClrInstanceID>
+                              <ManagedPdbSignature> %7 </ManagedPdbSignature>
+                              <ManagedPdbAge> %8 </ManagedPdbAge>
+                              <ManagedPdbBuildPath> %9 </ManagedPdbBuildPath>
+                              <NativePdbSignature> %10 </NativePdbSignature>
+                              <NativePdbAge> %11 </NativePdbAge>
+                              <NativePdbBuildPath> %12 </NativePdbBuildPath>
+                              <NativeBuildID> %13 </NativeBuildID>
+                          </ModuleLoadUnloadRundown_V3>
+                        </UserData>
+                    </template>
+
                     <template tid="AssemblyLoadUnloadRundown">
                         <data name="AssemblyID" inType="win:UInt64" outType="win:HexInt64" />
                         <data name="AppDomainID" inType="win:UInt64" outType="win:HexInt64" />
@@ -5200,6 +5274,11 @@
                            task="CLRLoaderRundown"
                            symbol="ModuleDCEnd_V2" message="$(string.RundownPublisher.ModuleDCEnd_V2EventMessage)"/>
 
+                    <event value="154" version="3" level="win:Informational"  template="ModuleLoadUnloadRundown_V3"
+                           keywords ="LoaderRundownKeyword PerfTrackRundownKeyword" opcode="ModuleDCEnd"
+                           task="CLRLoaderRundown"
+                           symbol="ModuleDCEnd_V3" message="$(string.RundownPublisher.ModuleDCEnd_V3EventMessage)"/>
+
                     <event value="155" version="0" level="win:Informational"  template="AssemblyLoadUnloadRundown"
                            keywords ="LoaderRundownKeyword" opcode="AssemblyDCStart"
                            task="CLRLoaderRundown"
@@ -8597,6 +8676,7 @@
                 <string id="RuntimePublisher.ModuleLoadEventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;ModuleILPath=%4;%nModuleNativePath=%5" />
                 <string id="RuntimePublisher.ModuleLoad_V1EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6" />
                 <string id="RuntimePublisher.ModuleLoad_V2EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6;%nManagedPdbSignature=%7;%nManagedPdbAge=%8;%nManagedPdbBuildPath=%9;%nNativePdbSignature=%10;%nNativePdbAge=%11;%nNativePdbBuildPath=%12" />
+                <string id="RuntimePublisher.ModuleLoad_V3EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6;%nManagedPdbSignature=%7;%nManagedPdbAge=%8;%nManagedPdbBuildPath=%9;%nNativePdbSignature=%10;%nNativePdbAge=%11;%nNativePdbBuildPath=%12;%nNativeBuildID=%13" />
                 <string id="RuntimePublisher.ModuleUnloadEventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;ModuleILPath=%4;%nModuleNativePath=%5" />
                 <string id="RuntimePublisher.ModuleUnload_V1EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6" />
                 <string id="RuntimePublisher.ModuleUnload_V2EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6;%nManagedPdbSignature=%7;%nManagedPdbAge=%8;%nManagedPdbBuildPath=%9;%nNativePdbSignature=%10;%nNativePdbAge=%11;%nNativePdbBuildPath=%12" />
@@ -8680,6 +8760,7 @@
                 <string id="RundownPublisher.ModuleDCEndEventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;ModuleILPath=%4;ModuleNativePath=%5" />
                 <string id="RundownPublisher.ModuleDCEnd_V1EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;ModuleILPath=%4;ModuleNativePath=%5;%nClrInstanceID=%6" />
                 <string id="RundownPublisher.ModuleDCEnd_V2EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6;%nManagedPdbSignature=%7;%nManagedPdbAge=%8;%nManagedPdbBuildPath=%9;%nNativePdbSignature=%10;%nNativePdbAge=%11;%nNativePdbBuildPath=%12" />
+                <string id="RundownPublisher.ModuleDCEnd_V3EventMessage" value="ModuleID=%1;%nAssemblyID=%2;%nModuleFlags=%3;%nModuleILPath=%4;%nModuleNativePath=%5;%nClrInstanceID=%6;%nManagedPdbSignature=%7;%nManagedPdbAge=%8;%nManagedPdbBuildPath=%9;%nNativePdbSignature=%10;%nNativePdbAge=%11;%nNativePdbBuildPath=%12;%nNativeBuildID=%13" />
                 <string id="RundownPublisher.AssemblyDCStartEventMessage" value="AssemblyID=%1;%nAppDomainID=%2;%nAssemblyFlags=%3;FullyQualifiedAssemblyName=%4" />
                 <string id="RundownPublisher.AssemblyDCStart_V1EventMessage" value="AssemblyID=%1;%nAppDomainID=%2;%nAssemblyFlags=%3;FullyQualifiedAssemblyName=%4;%nClrInstanceID=%5" />
                 <string id="RundownPublisher.AssemblyDCEndEventMessage" value="AssemblyID=%1;%nAppDomainID=%2;%nAssemblyFlags=%3;FullyQualifiedAssemblyName=%4" />
