Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 1 | #!/usr/bin/env python |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 2 | # |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 3 | # memleak Trace and display outstanding allocations to detect |
| 4 | # memory leaks in user-mode processes and the kernel. |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 5 | # |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 6 | # USAGE: memleak [-h] [-p PID] [-t] [-a] [-o OLDER] [-c COMMAND] |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 7 | # [-s SAMPLE_RATE] [-d STACK_DEPTH] [-T TOP] [-z MIN_SIZE] |
| 8 | # [-Z MAX_SIZE] |
| 9 | # [interval] [count] |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 10 | # |
Sasha Goldshtein | 43fa041 | 2016-02-10 22:17:26 -0800 | [diff] [blame] | 11 | # Licensed under the Apache License, Version 2.0 (the "License") |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 12 | # Copyright (C) 2016 Sasha Goldshtein. |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 13 | |
Sasha Goldshtein | 8737c6e | 2016-03-21 10:05:29 -0700 | [diff] [blame] | 14 | from bcc import BPF, ProcessSymbols |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 15 | from time import sleep |
Sasha Goldshtein | c8148c8 | 2016-02-09 11:15:41 -0800 | [diff] [blame] | 16 | from datetime import datetime |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 17 | import argparse |
| 18 | import subprocess |
Sasha Goldshtein | cfce311 | 2016-02-07 11:09:36 -0800 | [diff] [blame] | 19 | import ctypes |
| 20 | import os |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 21 | |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 22 | class Time(object): |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 23 | # BPF timestamps come from the monotonic clock. To be able to filter |
| 24 | # and compare them from Python, we need to invoke clock_gettime. |
| 25 | # Adapted from http://stackoverflow.com/a/1205762 |
| 26 | CLOCK_MONOTONIC_RAW = 4 # see <linux/time.h> |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 27 | |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 28 | class timespec(ctypes.Structure): |
| 29 | _fields_ = [ |
| 30 | ('tv_sec', ctypes.c_long), |
| 31 | ('tv_nsec', ctypes.c_long) |
| 32 | ] |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 33 | |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 34 | librt = ctypes.CDLL('librt.so.1', use_errno=True) |
| 35 | clock_gettime = librt.clock_gettime |
| 36 | clock_gettime.argtypes = [ctypes.c_int, ctypes.POINTER(timespec)] |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 37 | |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 38 | @staticmethod |
| 39 | def monotonic_time(): |
| 40 | t = Time.timespec() |
| 41 | if Time.clock_gettime( |
| 42 | Time.CLOCK_MONOTONIC_RAW, ctypes.pointer(t)) != 0: |
| 43 | errno_ = ctypes.get_errno() |
| 44 | raise OSError(errno_, os.strerror(errno_)) |
| 45 | return t.tv_sec * 1e9 + t.tv_nsec |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 46 | |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 47 | class StackDecoder(object): |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 48 | def __init__(self, pid): |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 49 | self.pid = pid |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 50 | if pid != -1: |
Sasha Goldshtein | 8737c6e | 2016-03-21 10:05:29 -0700 | [diff] [blame] | 51 | self.proc_sym = ProcessSymbols(pid) |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 52 | |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 53 | def refresh(self): |
| 54 | if self.pid != -1: |
| 55 | self.proc_sym.refresh_code_ranges() |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 56 | |
| 57 | def decode_stack(self, info, is_kernel_trace): |
| 58 | stack = "" |
| 59 | if info.num_frames <= 0: |
| 60 | return "???" |
| 61 | for i in range(0, info.num_frames): |
| 62 | addr = info.callstack[i] |
| 63 | if is_kernel_trace: |
| 64 | stack += " %s [kernel] (%x) ;" % \ |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 65 | (BPF.ksym(addr), addr) |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 66 | else: |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 67 | stack += " %s (%x) ;" % \ |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 68 | (self.proc_sym.decode_addr(addr), addr) |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 69 | return stack |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 70 | |
Sasha Goldshtein | 751fce5 | 2016-02-08 02:57:02 -0800 | [diff] [blame] | 71 | def run_command_get_output(command): |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 72 | p = subprocess.Popen(command.split(), |
| 73 | stdout=subprocess.PIPE, stderr=subprocess.STDOUT) |
| 74 | return iter(p.stdout.readline, b'') |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 75 | |
Sasha Goldshtein | 751fce5 | 2016-02-08 02:57:02 -0800 | [diff] [blame] | 76 | def run_command_get_pid(command): |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 77 | p = subprocess.Popen(command.split()) |
| 78 | return p.pid |
Sasha Goldshtein | 751fce5 | 2016-02-08 02:57:02 -0800 | [diff] [blame] | 79 | |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 80 | examples = """ |
| 81 | EXAMPLES: |
| 82 | |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 83 | ./memleak -p $(pidof allocs) |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 84 | Trace allocations and display a summary of "leaked" (outstanding) |
| 85 | allocations every 5 seconds |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 86 | ./memleak -p $(pidof allocs) -t |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 87 | Trace allocations and display each individual call to malloc/free |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 88 | ./memleak -ap $(pidof allocs) 10 |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 89 | Trace allocations and display allocated addresses, sizes, and stacks |
| 90 | every 10 seconds for outstanding allocations |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 91 | ./memleak -c "./allocs" |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 92 | Run the specified command and trace its allocations |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 93 | ./memleak |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 94 | Trace allocations in kernel mode and display a summary of outstanding |
| 95 | allocations every 5 seconds |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 96 | ./memleak -o 60000 |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 97 | Trace allocations in kernel mode and display a summary of outstanding |
| 98 | allocations that are at least one minute (60 seconds) old |
Sasha Goldshtein | 29e37d9 | 2016-02-14 06:56:07 -0800 | [diff] [blame] | 99 | ./memleak -s 5 |
Sasha Goldshtein | 521ab4f | 2016-02-08 05:48:31 -0800 | [diff] [blame] | 100 | Trace roughly every 5th allocation, to reduce overhead |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 101 | """ |
| 102 | |
| 103 | description = """ |
| 104 | Trace outstanding memory allocations that weren't freed. |
| 105 | Supports both user-mode allocations made with malloc/free and kernel-mode |
| 106 | allocations made with kmalloc/kfree. |
| 107 | """ |
| 108 | |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 109 | parser = argparse.ArgumentParser(description=description, |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 110 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 111 | epilog=examples) |
Sasha Goldshtein | d2241f4 | 2016-02-09 06:23:10 -0800 | [diff] [blame] | 112 | parser.add_argument("-p", "--pid", type=int, default=-1, |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 113 | help="the PID to trace; if not specified, trace kernel allocs") |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 114 | parser.add_argument("-t", "--trace", action="store_true", |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 115 | help="print trace messages for each alloc/free call") |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 116 | parser.add_argument("interval", nargs="?", default=5, type=int, |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 117 | help="interval in seconds to print outstanding allocations") |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 118 | parser.add_argument("count", nargs="?", type=int, |
| 119 | help="number of times to print the report before exiting") |
Sasha Goldshtein | a7cc6c2 | 2016-02-07 12:03:54 -0800 | [diff] [blame] | 120 | parser.add_argument("-a", "--show-allocs", default=False, action="store_true", |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 121 | help="show allocation addresses and sizes as well as call stacks") |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 122 | parser.add_argument("-o", "--older", default=500, type=int, |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 123 | help="prune allocations younger than this age in milliseconds") |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 124 | parser.add_argument("-c", "--command", |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 125 | help="execute and trace the specified command") |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 126 | parser.add_argument("-s", "--sample-rate", default=1, type=int, |
Sasha Goldshtein | 521ab4f | 2016-02-08 05:48:31 -0800 | [diff] [blame] | 127 | help="sample every N-th allocation to decrease the overhead") |
Sasha Goldshtein | dcee30d | 2016-02-09 06:24:33 -0800 | [diff] [blame] | 128 | parser.add_argument("-d", "--stack-depth", default=10, type=int, |
Sasha Goldshtein | d2241f4 | 2016-02-09 06:23:10 -0800 | [diff] [blame] | 129 | help="maximum stack depth to capture") |
Sasha Goldshtein | c8148c8 | 2016-02-09 11:15:41 -0800 | [diff] [blame] | 130 | parser.add_argument("-T", "--top", type=int, default=10, |
| 131 | help="display only this many top allocating stacks (by size)") |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 132 | parser.add_argument("-z", "--min-size", type=int, |
| 133 | help="capture only allocations larger than this size") |
| 134 | parser.add_argument("-Z", "--max-size", type=int, |
| 135 | help="capture only allocations smaller than this size") |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 136 | |
| 137 | args = parser.parse_args() |
| 138 | |
Sasha Goldshtein | d2241f4 | 2016-02-09 06:23:10 -0800 | [diff] [blame] | 139 | pid = args.pid |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 140 | command = args.command |
| 141 | kernel_trace = (pid == -1 and command is None) |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 142 | trace_all = args.trace |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 143 | interval = args.interval |
| 144 | min_age_ns = 1e6 * args.older |
Sasha Goldshtein | 521ab4f | 2016-02-08 05:48:31 -0800 | [diff] [blame] | 145 | sample_every_n = args.sample_rate |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 146 | num_prints = args.count |
Sasha Goldshtein | d2241f4 | 2016-02-09 06:23:10 -0800 | [diff] [blame] | 147 | max_stack_size = args.stack_depth + 2 |
Sasha Goldshtein | c8148c8 | 2016-02-09 11:15:41 -0800 | [diff] [blame] | 148 | top_stacks = args.top |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 149 | min_size = args.min_size |
| 150 | max_size = args.max_size |
| 151 | |
| 152 | if min_size is not None and max_size is not None and min_size > max_size: |
| 153 | print("min_size (-z) can't be greater than max_size (-Z)") |
| 154 | exit(1) |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 155 | |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 156 | if command is not None: |
| 157 | print("Executing '%s' and tracing the resulting process." % command) |
| 158 | pid = run_command_get_pid(command) |
Sasha Goldshtein | 2922861 | 2016-02-07 12:20:19 -0800 | [diff] [blame] | 159 | |
Sasha Goldshtein | 43fa041 | 2016-02-10 22:17:26 -0800 | [diff] [blame] | 160 | bpf_source = """ |
| 161 | #include <uapi/linux/ptrace.h> |
| 162 | |
| 163 | struct alloc_info_t { |
| 164 | u64 size; |
| 165 | u64 timestamp_ns; |
| 166 | int num_frames; |
| 167 | u64 callstack[MAX_STACK_SIZE]; |
| 168 | }; |
| 169 | |
| 170 | BPF_HASH(sizes, u64); |
| 171 | BPF_HASH(allocs, u64, struct alloc_info_t); |
| 172 | |
| 173 | // Adapted from https://github.com/iovisor/bcc/tools/offcputime.py |
| 174 | static u64 get_frame(u64 *bp) { |
| 175 | if (*bp) { |
| 176 | // The following stack walker is x86_64 specific |
| 177 | u64 ret = 0; |
| 178 | if (bpf_probe_read(&ret, sizeof(ret), (void *)(*bp+8))) |
| 179 | return 0; |
| 180 | if (bpf_probe_read(bp, sizeof(*bp), (void *)*bp)) |
| 181 | *bp = 0; |
| 182 | return ret; |
| 183 | } |
| 184 | return 0; |
| 185 | } |
| 186 | static int grab_stack(struct pt_regs *ctx, struct alloc_info_t *info) |
| 187 | { |
| 188 | int depth = 0; |
| 189 | u64 bp = ctx->bp; |
| 190 | GRAB_ONE_FRAME |
| 191 | return depth; |
| 192 | } |
| 193 | |
| 194 | int alloc_enter(struct pt_regs *ctx, size_t size) |
| 195 | { |
| 196 | SIZE_FILTER |
| 197 | if (SAMPLE_EVERY_N > 1) { |
| 198 | u64 ts = bpf_ktime_get_ns(); |
| 199 | if (ts % SAMPLE_EVERY_N != 0) |
| 200 | return 0; |
| 201 | } |
| 202 | |
| 203 | u64 pid = bpf_get_current_pid_tgid(); |
| 204 | u64 size64 = size; |
| 205 | sizes.update(&pid, &size64); |
| 206 | |
| 207 | if (SHOULD_PRINT) |
| 208 | bpf_trace_printk("alloc entered, size = %u\\n", size); |
| 209 | return 0; |
| 210 | } |
| 211 | |
| 212 | int alloc_exit(struct pt_regs *ctx) |
| 213 | { |
| 214 | u64 address = ctx->ax; |
| 215 | u64 pid = bpf_get_current_pid_tgid(); |
| 216 | u64* size64 = sizes.lookup(&pid); |
| 217 | struct alloc_info_t info = {0}; |
| 218 | |
| 219 | if (size64 == 0) |
| 220 | return 0; // missed alloc entry |
| 221 | |
| 222 | info.size = *size64; |
| 223 | sizes.delete(&pid); |
| 224 | |
| 225 | info.timestamp_ns = bpf_ktime_get_ns(); |
| 226 | info.num_frames = grab_stack(ctx, &info) - 2; |
| 227 | allocs.update(&address, &info); |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 228 | |
Sasha Goldshtein | 43fa041 | 2016-02-10 22:17:26 -0800 | [diff] [blame] | 229 | if (SHOULD_PRINT) { |
| 230 | bpf_trace_printk("alloc exited, size = %lu, result = %lx, frames = %d\\n", |
| 231 | info.size, address, info.num_frames); |
| 232 | } |
| 233 | return 0; |
| 234 | } |
| 235 | |
| 236 | int free_enter(struct pt_regs *ctx, void *address) |
| 237 | { |
| 238 | u64 addr = (u64)address; |
| 239 | struct alloc_info_t *info = allocs.lookup(&addr); |
| 240 | if (info == 0) |
| 241 | return 0; |
| 242 | |
| 243 | allocs.delete(&addr); |
| 244 | |
| 245 | if (SHOULD_PRINT) { |
| 246 | bpf_trace_printk("free entered, address = %lx, size = %lu\\n", |
| 247 | address, info->size); |
| 248 | } |
| 249 | return 0; |
| 250 | } |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 251 | """ |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 252 | bpf_source = bpf_source.replace("SHOULD_PRINT", "1" if trace_all else "0") |
Sasha Goldshtein | 521ab4f | 2016-02-08 05:48:31 -0800 | [diff] [blame] | 253 | bpf_source = bpf_source.replace("SAMPLE_EVERY_N", str(sample_every_n)) |
Sasha Goldshtein | d2241f4 | 2016-02-09 06:23:10 -0800 | [diff] [blame] | 254 | bpf_source = bpf_source.replace("GRAB_ONE_FRAME", max_stack_size * |
| 255 | "\tif (!(info->callstack[depth++] = get_frame(&bp))) return depth;\n") |
| 256 | bpf_source = bpf_source.replace("MAX_STACK_SIZE", str(max_stack_size)) |
Sasha Goldshtein | 5045964 | 2016-02-10 08:35:20 -0800 | [diff] [blame] | 257 | |
| 258 | size_filter = "" |
| 259 | if min_size is not None and max_size is not None: |
| 260 | size_filter = "if (size < %d || size > %d) return 0;" % \ |
| 261 | (min_size, max_size) |
| 262 | elif min_size is not None: |
| 263 | size_filter = "if (size < %d) return 0;" % min_size |
| 264 | elif max_size is not None: |
| 265 | size_filter = "if (size > %d) return 0;" % max_size |
| 266 | bpf_source = bpf_source.replace("SIZE_FILTER", size_filter) |
| 267 | |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 268 | bpf_program = BPF(text=bpf_source) |
| 269 | |
| 270 | if not kernel_trace: |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 271 | print("Attaching to malloc and free in pid %d, Ctrl+C to quit." % pid) |
| 272 | bpf_program.attach_uprobe(name="c", sym="malloc", |
| 273 | fn_name="alloc_enter", pid=pid) |
| 274 | bpf_program.attach_uretprobe(name="c", sym="malloc", |
| 275 | fn_name="alloc_exit", pid=pid) |
| 276 | bpf_program.attach_uprobe(name="c", sym="free", |
| 277 | fn_name="free_enter", pid=pid) |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 278 | else: |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 279 | print("Attaching to kmalloc and kfree, Ctrl+C to quit.") |
| 280 | bpf_program.attach_kprobe(event="__kmalloc", fn_name="alloc_enter") |
| 281 | bpf_program.attach_kretprobe(event="__kmalloc", fn_name="alloc_exit") |
| 282 | bpf_program.attach_kprobe(event="kfree", fn_name="free_enter") |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 283 | |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 284 | decoder = StackDecoder(pid) |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 285 | |
| 286 | def print_outstanding(): |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 287 | stacks = {} |
Sasha Goldshtein | c8148c8 | 2016-02-09 11:15:41 -0800 | [diff] [blame] | 288 | print("[%s] Top %d stacks with outstanding allocations:" % |
| 289 | (datetime.now().strftime("%H:%M:%S"), top_stacks)) |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 290 | allocs = bpf_program.get_table("allocs") |
| 291 | for address, info in sorted(allocs.items(), key=lambda a: a[1].size): |
| 292 | if Time.monotonic_time() - min_age_ns < info.timestamp_ns: |
| 293 | continue |
| 294 | stack = decoder.decode_stack(info, kernel_trace) |
| 295 | if stack in stacks: |
| 296 | stacks[stack] = (stacks[stack][0] + 1, |
| 297 | stacks[stack][1] + info.size) |
| 298 | else: |
| 299 | stacks[stack] = (1, info.size) |
| 300 | if args.show_allocs: |
| 301 | print("\taddr = %x size = %s" % |
| 302 | (address.value, info.size)) |
Sasha Goldshtein | c8148c8 | 2016-02-09 11:15:41 -0800 | [diff] [blame] | 303 | to_show = sorted(stacks.items(), key=lambda s: s[1][1])[-top_stacks:] |
| 304 | for stack, (count, size) in to_show: |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 305 | print("\t%d bytes in %d allocations from stack\n\t\t%s" % |
| 306 | (size, count, stack.replace(";", "\n\t\t"))) |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 307 | |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 308 | count_so_far = 0 |
Sasha Goldshtein | 4f1ea67 | 2016-02-07 01:57:42 -0800 | [diff] [blame] | 309 | while True: |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 310 | if trace_all: |
Brenden Blanco | c94ab7a | 2016-03-11 15:34:29 -0800 | [diff] [blame] | 311 | print(bpf_program.trace_fields()) |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 312 | else: |
| 313 | try: |
| 314 | sleep(interval) |
| 315 | except KeyboardInterrupt: |
| 316 | exit() |
Sasha Goldshtein | 0e856f4 | 2016-03-21 07:26:52 -0700 | [diff] [blame] | 317 | decoder.refresh() |
Sasha Goldshtein | 33522d7 | 2016-02-08 03:39:44 -0800 | [diff] [blame] | 318 | print_outstanding() |
Sasha Goldshtein | 40e55ba | 2016-02-09 05:53:48 -0800 | [diff] [blame] | 319 | count_so_far += 1 |
| 320 | if num_prints is not None and count_so_far >= num_prints: |
| 321 | exit() |