[tracing] Add graphics memory dump provider for Android

components/tracing/graphics_memory_dump_provider_android.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/tracing/graphics_memory_dump_provider_android.h"
+
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/un.h>
+
+#include "base/trace_event/process_memory_dump.h"
+#include "base/trace_event/process_memory_totals.h"
+
+using base::trace_event::MemoryAllocatorDump;
+
+namespace tracing {
+
+// static
+GraphicsMemoryDumpProvider* GraphicsMemoryDumpProvider::GetInstance() {
+  return base::Singleton<
+      GraphicsMemoryDumpProvider,
+      base::LeakySingletonTraits<GraphicsMemoryDumpProvider>>::get();
+}
+
+bool GraphicsMemoryDumpProvider::OnMemoryDump(
+    const base::trace_event::MemoryDumpArgs& args,
+    base::trace_event::ProcessMemoryDump* pmd) {
+  const char kAbstractSocketName[] = "chrome_tracing_memtrack_helper";
+  int sock;
+  struct sockaddr_un addr;
+
+  sock = socket(AF_UNIX, SOCK_SEQPACKET, 0);
+  if (sock == -1)
+    return false;
+
+  // Set recv timeout to 250ms
+  struct timeval tv;
+  tv.tv_sec = 0;
+  tv.tv_usec = 250000;
+  setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+
+  // Connect to the UNIX abstract (i.e. no physical filesystem link) socket.
+  memset(&addr, 0, sizeof(addr));
+  addr.sun_family = AF_UNIX;
+  strncpy(&addr.sun_path[1], kAbstractSocketName, sizeof(addr.sun_path) - 2);
+
+  if (connect(sock, reinterpret_cast<struct sockaddr*>(&addr), sizeof(addr))) {
+    LOG(WARNING) << "Could not connect to the memtrack_helper daemon. Please "
+                    "build memtrack_helper, adb push to the device and run it "
+                    "before starting the trace to get graphics memory data.";
+    return false;
+  }
+
+  // Check that the socket is owned by root (the memtrack_helper) process and
+  // not an (untrusted) user process. Hard crash otherwise.

[ericrk, 2015/10/02 18:30:11]

Doesn't this let a user process masquerading as our memory tracker hard crash
the browser/gpu processes reliably on trace? Probably not a concern if trace is
dev only, as a dev would like to know there's something weird on their machine,
but if we ever run memory traces in an automated way on regular users chrome
instances, this seems like it could allow an evil non-root app to crash us?

[petrcermak, 2015/10/05 08:29:27]

+1. Why don't you just return false like in the rest of the cases?

[Primiano Tucci (use gerrit), 2015/10/05 14:24:25]

Makes sense. Done.

+  struct ucred cred;
+  socklen_t cred_len = sizeof(cred);
+  if (getsockopt(sock, SOL_SOCKET, SO_PEERCRED, &cred, &cred_len) < 0 ||
+      (static_cast<unsigned>(cred_len) < sizeof(cred)) ||
+      cred.uid != 0 /* root */) {
+    CHECK(0);
+  }
+
+  // Send the trace(PID) request.
+  char buf[4096];
+  snprintf(buf, sizeof(buf) - 1, "%d", getpid());
+  if (send(sock, buf, strlen(buf) + 1, 0) <= 0)
+    return false;
+
+  // The response consists of a few lines, each one with a key value pair. E.g.:
+  // graphics_total 10616832
+  // graphics_pss 10616832
+  // gl_total 17911808
+  // gl_pss 17911808
+  if (recv(sock, buf, sizeof(buf), 0) <= 0)
+    return false;
+
+  close(sock);
+
+  buf[sizeof(buf) - 1] = '\0';
+  std::stringstream ss(std::string(buf, sizeof(buf)));
+  std::string row_name;
+  std::string column_name;
+  uint64 value;
+  while ((ss >> row_name) && (ss >> value)) {
+    // Turn entries like graphics_total into a row named "graphics" and
+    // column named "total".
+    const char kDumpBaseName[] = "gpu/android_memtrack/";
+    size_t key_split_point = row_name.find_last_of('_');
+    if (key_split_point > 0 && key_split_point < row_name.size() - 1) {
+      column_name = row_name.substr(key_split_point + 1);
+      row_name = row_name.substr(0, key_split_point);
+    } else {
+      column_name = "unknown";
+    }
+    std::string dump_name = kDumpBaseName + row_name;
+    MemoryAllocatorDump* mad = pmd->GetOrCreateAllocatorDump(dump_name);
+    const auto& long_lived_column_name = key_names_.insert(column_name).first;
+    mad->AddScalar(long_lived_column_name->c_str(),
+                   MemoryAllocatorDump::kUnitsBytes, value);
+  }
+  return true;

[petrcermak, 2015/10/05 08:29:27]

Strictly speaking, shouldn't you check that at least one value was added? It
seems that a response " " would cause this method to return true.

[Primiano Tucci (use gerrit), 2015/10/05 14:24:25]

Yeah but this seems a problem with the helper daemon. In that case it would be
more useful to see an empty dump in the trace (Which suggests that the data
source is bad) than hiding that completely.
In essence: once I establish a socket connection I expect the helper daemon to
behave.

+}
+
+GraphicsMemoryDumpProvider::GraphicsMemoryDumpProvider() {}
+
+GraphicsMemoryDumpProvider::~GraphicsMemoryDumpProvider() {}
+
+}  // namespace tracing