Generate module rundown events (#116338)

* Generate module rundown events

This is sufficient to get module information in `dotnet-gcdump collect`. The tool itself will need tweaks because it only looks at IL paths right now, but this should be all that's necessary to build on top.

* Put back GUID

* Fix linux

* More Linux fixing

* linux

* wow

* Feedback

* Maybe it works?

* Apply suggestions from code review

Co-authored-by: Jan Kotas <[email protected]>

* Build break

* Copilot commit

Prompt: The use of mbstowcs_s is incorrect here. The input buffer is UTF-8, output is UTF-16. Replace the incorrect use of mbstowcs_s with MultiByteToWideChar.

* Update issues.targets

---------

Co-authored-by: Jan Kotas <[email protected]>

Author: MichalStrehovsky

src/coreclr/nativeaot/Runtime/Pal.h

@@ -23,6 +23,8 @@
 #include <pthread.h>
 #endif
 
+#include <minipal/guid.h>
+
 #include "CommonTypes.h"
 #include "CommonMacros.h"
 #include "PalLimitedContext.h"
@@ -159,6 +161,8 @@ bool PalInit();
 // Given the OS handle of a loaded module, compute the upper and lower virtual address bounds (inclusive).
 void PalGetModuleBounds(HANDLE hOsHandle, _Out_ uint8_t ** ppLowerBound, _Out_ uint8_t ** ppUpperBound);
 
+void PalGetPDBInfo(HANDLE hOsHandle, GUID * pGuidSignature, _Out_ uint32_t * pdwAge, _Out_writes_z_(cchPath) WCHAR * wszPath, int32_t cchPath);
+
 struct NATIVE_CONTEXT;
 
 #if _WIN32

src/coreclr/nativeaot/Runtime/disabledeventtrace.cpp

@@ -9,6 +9,7 @@
 #include "common.h"
 
 #include "eventtrace.h"
+#include "eventtracebase.h"
 
 void EventTracing_Initialize() { }
 
@@ -18,6 +19,7 @@ bool IsRuntimeProviderEnabled(uint8_t level, uint64_t keyword)
 }
 
 void ETW::GCLog::FireGcStart(ETW_GC_INFO * pGcInfo) { }
+void ETW::LoaderLog::ModuleLoad(HANDLE pModule) { }
 
 #ifdef FEATURE_ETW
 BOOL ETW::GCLog::ShouldTrackMovementForEtw() { return FALSE; }

src/coreclr/nativeaot/Runtime/eventpipe/ep-rt-aot.cpp

@@ -25,6 +25,7 @@
 #include "threadstore.h"
 #include "threadstore.inl"
 #include "eventtrace_context.h"
+#include "eventtracebase.h"
 
 // Uses _rt_aot_lock_internal_t that has CrstStatic as a field
 // This is initialized at the beginning and EventPipe library requires the lock handle to be maintained by the runtime
@@ -75,7 +76,19 @@ bool
 ep_rt_aot_providers_validate_all_disabled (void)
 {
     return !MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_DOTNET_Context.EventPipeProvider.IsEnabled
-        && !MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_DOTNET_Context.EventPipeProvider.IsEnabled;
+        && !MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_DOTNET_Context.EventPipeProvider.IsEnabled
+        && !MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context.EventPipeProvider.IsEnabled;
+}
+
+void
+ep_rt_aot_provider_config_init (
+    EventPipeProviderConfiguration *provider_config)
+{
+    if (!ep_rt_utf8_string_compare (ep_config_get_rundown_provider_name_utf8 (), ep_provider_config_get_provider_name (provider_config))) {
+        MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context.EventPipeProvider.Level = (uint8_t) ep_provider_config_get_logging_level (provider_config);
+        MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context.EventPipeProvider.EnabledKeywordsBitmask = ep_provider_config_get_keywords (provider_config);
+        MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context.EventPipeProvider.IsEnabled = true;
+    }
 }
 
 void
@@ -194,6 +207,12 @@ ep_rt_aot_entrypoint_assembly_name_get_utf8 (void)
     return entrypoint_assembly_name;
 }
 
+void
+ep_rt_aot_execute_rundown (dn_vector_ptr_t* execution_checkpoints)
+{
+    ETW::EnumerationLog::EndRundown();
+}
+
 const ep_char8_t *
 ep_rt_aot_diagnostics_command_line_get (void)
 {

src/coreclr/nativeaot/Runtime/eventpipe/ep-rt-aot.h

@@ -346,6 +346,8 @@ void
 ep_rt_provider_config_init (EventPipeProviderConfiguration *provider_config)
 {
     STATIC_CONTRACT_NOTHROW;
+    extern void ep_rt_aot_provider_config_init (EventPipeProviderConfiguration *provider_config);
+    ep_rt_aot_provider_config_init(provider_config);
 }
 
 // This function is auto-generated from /src/scripts/genEventPipe.py
@@ -707,7 +709,9 @@ ep_rt_execute_rundown (dn_vector_ptr_t *execution_checkpoints)
 {
     STATIC_CONTRACT_NOTHROW;
 
-    // NativeAOT does not currently support rundown
+    extern void
+    ep_rt_aot_execute_rundown (dn_vector_ptr_t *execution_checkpoints);
+    ep_rt_aot_execute_rundown (execution_checkpoints);
 }
 
 /*
@@ -1445,8 +1449,8 @@ void
 ep_rt_thread_setup (void)
 {
     STATIC_CONTRACT_NOTHROW;
-
-    // Likely not needed and do nothing until testing shows to be required
+    extern ep_rt_thread_handle_t ep_rt_aot_setup_thread (void);
+    ep_rt_aot_setup_thread ();
 }
 
 static

src/coreclr/nativeaot/Runtime/eventpipe/gen-eventing-event-inc.lst

@@ -21,6 +21,8 @@ Contention
 ContentionLockCreated
 ContentionStart_V2
 ContentionStop_V1
+DCEndComplete_V1
+DCEndInit_V1
 DecreaseMemoryPressure
 DestroyGCHandle
 ExceptionCatchStart
@@ -81,6 +83,7 @@ GenAwareBegin
 GenAwareEnd
 IncreaseMemoryPressure
 LockCreated
+ModuleDCEnd_V2
 ModuleLoad_V2
 PinObjectAtGCTime
 PinPlugAtGCTime

src/coreclr/nativeaot/Runtime/eventtrace.cpp

@@ -21,6 +21,8 @@
 #include "threadstore.h"
 #include "threadstore.inl"
 
+#include <minipal/utf8.h>
+
 EVENTPIPE_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_EVENTPIPE_Context = { W("Microsoft-Windows-DotNETRuntime"), 0, false, 0 };
 DOTNET_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_DOTNET_Context = {
 #ifdef FEATURE_ETW
@@ -29,6 +31,14 @@ DOTNET_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_DOTNET_Context = {
     MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_EVENTPIPE_Context
 };
 
+EVENTPIPE_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_EVENTPIPE_Context = { W("Microsoft-Windows-DotNETRuntimeRundown"), 0, false, 0 };
+DOTNET_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context = {
+#ifdef FEATURE_ETW
+    &MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_Context,
+#endif
+    MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_EVENTPIPE_Context
+};
+
 EVENTPIPE_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_EVENTPIPE_Context = { W("Microsoft-Windows-DotNETRuntimePrivate"), 0, false, 0 };
 DOTNET_TRACE_CONTEXT MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_DOTNET_Context = {
 #ifdef FEATURE_ETW
@@ -42,6 +52,11 @@ bool IsRuntimeProviderEnabled(uint8_t level, uint64_t keyword)
     return RUNTIME_PROVIDER_CATEGORY_ENABLED(level, keyword);
 }
 
+bool IsRuntimeRundownProviderEnabled(uint8_t level, uint64_t keyword)
+{
+    return RUNTIME_RUNDOWN_PROVIDER_CATEGORY_ENABLED(level, keyword);
+}
+
 volatile LONGLONG ETW::GCLog::s_l64LastClientSequenceNumber = 0;
 
 //---------------------------------------------------------------------------------------
@@ -81,13 +96,16 @@ void EventTracing_Initialize()
 #ifdef FEATURE_ETW
     MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_Context.IsEnabled = FALSE;
     MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_Context.IsEnabled = FALSE;
+    MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_Context.IsEnabled = FALSE;
 
     // Register the ETW providers with the system.
     EventRegisterMicrosoft_Windows_DotNETRuntimePrivate();
     EventRegisterMicrosoft_Windows_DotNETRuntime();
+    EventRegisterMicrosoft_Windows_DotNETRuntimeRundown();
 
     MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_Context.RegistrationHandle = Microsoft_Windows_DotNETRuntimePrivateHandle;
     MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_Context.RegistrationHandle = Microsoft_Windows_DotNETRuntimeHandle;
+    MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_Context.RegistrationHandle = Microsoft_Windows_DotNETRuntimeRundownHandle;
 #endif // FEATURE_ETW
 }
 
@@ -187,9 +205,13 @@ void EtwCallbackCommon(
     case DotNETRuntime:
         ctxToUpdate = &MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_DOTNET_Context;
         break;
+    case DotNETRuntimeRundown:
+        ctxToUpdate = &MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context;
+        break;
     case DotNETRuntimePrivate:
         ctxToUpdate = &MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_DOTNET_Context;
         break;
+
     default:
         _ASSERTE(!"EtwCallbackCommon was called with invalid context");
         return;
@@ -261,7 +283,7 @@ void EtwCallbackCommon(
 
 void EtwCallback(
     const GUID * /*SourceId*/,
-    uint32_t IsEnabled,
+    uint32_t ControlCode,
     uint8_t Level,
     uint64_t MatchAnyKeyword,
     uint64_t MatchAllKeyword,
@@ -272,16 +294,27 @@ void EtwCallback(
     if (context == NULL)
         return;
 
+    // A manifest based provider can be enabled to multiple event tracing sessions
+    // As long as there is atleast 1 enabled session, IsEnabled will be TRUE
+    // Since classic providers can be enabled to only a single session,
+    // IsEnabled will be TRUE when it is enabled and FALSE when disabled
+    BOOL bEnabled =
+        ((ControlCode == EVENT_CONTROL_CODE_ENABLE_PROVIDER) ||
+            (ControlCode == EVENT_CONTROL_CODE_CAPTURE_STATE));
+
     context->Level = Level;
     context->MatchAnyKeyword = MatchAnyKeyword;
     context->MatchAllKeyword = MatchAllKeyword;
-    context->IsEnabled = IsEnabled;
+    context->IsEnabled = bEnabled;
 
     CallbackProviderIndex providerIndex = DotNETRuntime;
     DOTNET_TRACE_CONTEXT providerContext = MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_DOTNET_Context;
     if (context->RegistrationHandle == Microsoft_Windows_DotNETRuntimeHandle) {
         providerIndex = DotNETRuntime;
         providerContext = MICROSOFT_WINDOWS_DOTNETRUNTIME_PROVIDER_DOTNET_Context;
+    } else if (context->RegistrationHandle == Microsoft_Windows_DotNETRuntimeRundownHandle) {
+        providerIndex = DotNETRuntimeRundown;
+        providerContext = MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context;
     } else if (context->RegistrationHandle == Microsoft_Windows_DotNETRuntimePrivateHandle) {
         providerIndex = DotNETRuntimePrivate;
         providerContext = MICROSOFT_WINDOWS_DOTNETRUNTIME_PRIVATE_PROVIDER_DOTNET_Context;
@@ -290,20 +323,128 @@ void EtwCallback(
         return;
     }
 
-    EtwCallbackCommon(providerIndex, IsEnabled, Level, MatchAnyKeyword, FilterData, EtwSessionChangeUnknown);
+    EtwCallbackCommon(providerIndex, ControlCode, Level, MatchAnyKeyword, FilterData, EtwSessionChangeUnknown);
 
-    if (IsEnabled &&
-        (context->RegistrationHandle == Microsoft_Windows_DotNETRuntimePrivateHandle) &&
-        GCHeapUtilities::IsGCHeapInitialized())
+    if (bEnabled)
     {
-        FireEtwGCSettings_V1(GCHeapUtilities::GetGCHeap()->GetValidSegmentSize(FALSE),
-                          GCHeapUtilities::GetGCHeap()->GetValidSegmentSize(TRUE),
-                          GCHeapUtilities::IsServerHeap(), GetClrInstanceId());
-        GCHeapUtilities::GetGCHeap()->DiagTraceGCSegments();
+        if (context->RegistrationHandle == Microsoft_Windows_DotNETRuntimePrivateHandle &&
+            GCHeapUtilities::IsGCHeapInitialized())
+        {
+            FireEtwGCSettings_V1(GCHeapUtilities::GetGCHeap()->GetValidSegmentSize(FALSE),
+                              GCHeapUtilities::GetGCHeap()->GetValidSegmentSize(TRUE),
+                              GCHeapUtilities::IsServerHeap(), GetClrInstanceId());
+            GCHeapUtilities::GetGCHeap()->DiagTraceGCSegments();
+        }
+
+        if (context->RegistrationHandle == Microsoft_Windows_DotNETRuntimeRundownHandle)
+        {
+            if (IsRuntimeRundownProviderEnabled(TRACE_LEVEL_INFORMATION, CLR_RUNDOWNEND_KEYWORD))
+                ETW::EnumerationLog::EndRundown();
+        }
     }
 }
+
 #endif // FEATURE_ETW
 
+void ETW::LoaderLog::ModuleLoad(HANDLE pModule)
+{
+    if (IsRuntimeProviderEnabled(TRACE_LEVEL_INFORMATION, KEYWORDZERO))
+    {
+        SendModuleEvent(pModule, ETW::EnumerationLog::EnumerationStructs::DomainAssemblyModuleLoad);
+    }
+}
+
+//---------------------------------------------------------------------------------------
+//
+// send a module load/unload or rundown event and domainmodule load and rundown event
+//
+// Arguments:
+//      * pModule - Module loading or unloading
+//      * dwEventOptions - Bitmask of which events to fire
+//
+void ETW::LoaderLog::SendModuleEvent(HANDLE pModule, uint32_t dwEventOptions)
+{
+    const WCHAR * wszModuleFileName = NULL;
+    const WCHAR * wszModuleILFileName = W("");
+
+#if TARGET_WINDOWS
+    PalGetModuleFileName(&wszModuleFileName, pModule);
+#else
+    const char * wszModuleFileNameUtf8 = NULL;
+    uint32_t moduleFileNameCharCount = PalGetModuleFileName(&wszModuleFileNameUtf8, pModule);
+    CHAR16_T wszModuleFileNameUnicode[1024];
+    minipal_convert_utf8_to_utf16(wszModuleFileNameUtf8, moduleFileNameCharCount, &wszModuleFileNameUnicode[0], ARRAY_SIZE(wszModuleFileNameUnicode), MINIPAL_MB_NO_REPLACE_INVALID_CHARS);
+    wszModuleFileName = (const WCHAR *)&wszModuleFileNameUnicode[0];
+#endif
+
+    GUID nativeGuid;
+    uint32_t dwAge;
+    WCHAR wszPath[1024];
+    PalGetPDBInfo(pModule, &nativeGuid, &dwAge, wszPath, ARRAY_SIZE(wszPath));
+
+    GUID zeroGuid = { 0 };
+
+    if (dwEventOptions & ETW::EnumerationLog::EnumerationStructs::DomainAssemblyModuleLoad)
+    {
+        FireEtwModuleLoad_V2(
+            ULONGLONG(pModule),
+            0,                      // AssemblyID
+            ETW::LoaderLog::LoaderStructs::NativeModule, // Module Flags
+            0,                      // Reserved1, 
+            wszModuleILFileName,    // ModuleILPath, 
+            wszModuleFileName,      // ModuleNativePath, 
+            GetClrInstanceId(),
+            &zeroGuid,              // ManagedPdbSignature,
+            0,                      // ManagedPdbAge, 
+            NULL,                   // ManagedPdbBuildPath, 
+            &nativeGuid,            // NativePdbSignature,
+            dwAge,                  // NativePdbAge, 
+            wszPath                 // NativePdbBuildPath, 
+            );
+    }
+    else if (dwEventOptions & ETW::EnumerationLog::EnumerationStructs::DomainAssemblyModuleDCEnd)
+    {
+        FireEtwModuleDCEnd_V2(
+            ULONGLONG(pModule),
+            0,                      // AssemblyID
+            ETW::LoaderLog::LoaderStructs::NativeModule, // Module Flags
+            0,                      // Reserved1, 
+            wszModuleILFileName,    // ModuleILPath, 
+            wszModuleFileName,      // ModuleNativePath, 
+            GetClrInstanceId(),
+            &zeroGuid,              // ManagedPdbSignature,
+            0,                      // ManagedPdbAge, 
+            NULL,                   // ManagedPdbBuildPath, 
+            &nativeGuid,            // NativePdbSignature,
+            dwAge,                  // NativePdbAge, 
+            wszPath                 // NativePdbBuildPath, 
+            );
+    }
+    else
+    {
+        ASSERT(0);
+    }
+}
+
+/**************************************************************************************/
+/* Called when ETW is turned OFF on an existing process .Will be used by the controller for end rundown*/
+/**************************************************************************************/
+void ETW::EnumerationLog::EndRundown()
+{
+    if (IsRuntimeRundownProviderEnabled(TRACE_LEVEL_INFORMATION, CLR_RUNDOWNLOADER_KEYWORD))
+    {
+        // begin marker event will go to the rundown provider
+        FireEtwDCEndInit_V1(GetClrInstanceId());
+
+        HANDLE pModule = PalGetModuleHandleFromPointer((void*)&EndRundown);
+
+        LoaderLog::SendModuleEvent(pModule, EnumerationLog::EnumerationStructs::DomainAssemblyModuleDCEnd);
+
+        // end marker event will go to the rundown provider
+        FireEtwDCEndComplete_V1(GetClrInstanceId());
+    }
+}
+
 void EventPipeEtwCallbackDotNETRuntime(
     _In_ GUID * SourceId,
     _In_ ULONG ControlCode,
@@ -318,6 +459,20 @@ void EventPipeEtwCallbackDotNETRuntime(
     EtwCallbackCommon(DotNETRuntime, ControlCode, Level, MatchAnyKeyword, FilterData, change);
 }
 
+void EventPipeEtwCallbackDotNETRuntimeRundown(
+    _In_ GUID * SourceId,
+    _In_ ULONG ControlCode,
+    _In_ unsigned char Level,
+    _In_ ULONGLONG MatchAnyKeyword,
+    _In_ ULONGLONG MatchAllKeyword,
+    _In_opt_ EventFilterDescriptor* FilterData,
+    _Inout_opt_ PVOID CallbackContext)
+{
+    SessionChange change = SourceId == NULL ? EventPipeSessionDisable : EventPipeSessionEnable;
+
+    EtwCallbackCommon(DotNETRuntimeRundown, ControlCode, Level, MatchAnyKeyword, FilterData, change);
+}
+
 void EventPipeEtwCallbackDotNETRuntimePrivate(
     _In_ GUID * SourceId,
     _In_ ULONG ControlCode,