{"id":17465498,"url":"https://github.com/0xdeafbeef/jeprofl","last_synced_at":"2025-10-31T10:50:49.378Z","repository":{"id":258221458,"uuid":"861425302","full_name":"0xdeafbeef/jeprofl","owner":"0xdeafbeef","description":"Allocations profiler built using ebpf","archived":false,"fork":false,"pushed_at":"2025-04-10T14:38:36.000Z","size":388,"stargazers_count":91,"open_issues_count":2,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-20T02:58:40.836Z","etag":null,"topics":["ebpf","jemalloc","profiler"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xdeafbeef.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-09-22T21:12:08.000Z","updated_at":"2025-07-19T02:18:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"c26f34ee-7378-45e7-a536-3e638caf71a5","html_url":"https://github.com/0xdeafbeef/jeprofl","commit_stats":null,"previous_names":["0xdeafbeef/jeprofl"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/0xdeafbeef/jeprofl","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdeafbeef%2Fjeprofl","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdeafbeef%2Fjeprofl/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdeafbeef%2Fjeprofl/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdeafbeef%2Fjeprofl/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xdeafbeef","download_url":"https://codeload.github.com/0xdeafbeef/jeprofl/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdeafbeef%2Fjeprofl/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":281976634,"owners_count":26592972,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-31T02:00:07.401Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","jemalloc","profiler"],"created_at":"2024-10-18T12:05:30.868Z","updated_at":"2025-10-31T10:50:49.327Z","avatar_url":"https://github.com/0xdeafbeef.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# jeprofl\n\njeprofl is a memory allocation profiling tool that uses eBPF technology to\nanalyze jemalloc allocations in your program. It may work with other\nallocators, but this has not been tested.\n\n[![colorized flamegraph output](assets/flamegraph.png)](assets/flamegraph.svg)\n\nIt can be used with already running program without recompilation.\nOverhead with 1000x sampling is 80 ns per call under 2.5M allocations / sec.\n![bpftop.png](assets/bpftop.png)\n\n## Features\n\n- Attach to a specific process or program\n- Support for various jemalloc allocation functions (malloc, calloc, realloc,\n  etc.)\n- Order results by allocation count or total memory traffic\n- Set minimum and maximum allocation sizes to track\n- Configurable event sampling\n- Generate CSV output and flame graphs\n- Tracks allocation histograms per stack trace (rounded to power of 2)\n\n```\n6ae5a0 - malloc\n4e54b0 - uu_ls::enter_directory\n4e54b0 - uu_ls::enter_directory\n4e54b0 - uu_ls::enter_directory\n4e54b0 - uu_ls::enter_directory\n4db790 - uu_ls::list\n23b070 - uu_ls::uumain\nbb560  - coreutils::main\n1c9e60 - std::sys::backtrace::__rust_begin_short_backtrace\nbdf00  - main\n2a010  - __libc_start_call_main\n2a0c0  - __libc_start_main_alias_2\na7f00  - _start\n\n-----------+-----------+------------+--------------------------------------------------\nSize       | Count     | Percentage | Distribution\n-----------+-----------+------------+--------------------------------------------------\n1 B        |     16870 |      4.23% | #######\n2 B        |     21716 |      5.44% | #########\n4 B        |     38150 |      9.56% | ################\n8 B        |    120776 |     30.27% | ##################################################\n16 B       |    103586 |     25.97% | ###########################################\n32 B       |     58988 |     14.79% | ########################\n64 B       |      7444 |      1.87% | ###\n128 B      |     14768 |      3.70% | ######\n512 B      |     16638 |      4.17% | #######\nTotal allocations: 18.4 MiB in 398936 allocations\n```\n\n- Minimal overhead\n\n## Limitations\n\n- Only works with statically linked programs(for now). Can work with dynamically\n  linked programs, but you should provide the path to the dylib.\n\n## Prerequisites\n\n1. Install bpf-linker: `cargo install bpf-linker`\n2. Linux kernel with eBPF support\n3. Root privileges (for attaching to processes)\n\n## Usage\n\nOptions:\n\n- `--pid \u003cPID\u003e`: Attach to a specific process ID\n- `--function \u003cFUNCTION\u003e`: Specify the jemalloc function to trace (default:\n  malloc)\n- `--order-by \u003cORDER\u003e`: Order results by 'count' or 'traffic' (default: traffic)\n  Traffic is the total allocated size, count is the number of malloc calls.\n- `--max-alloc-size \u003cSIZE\u003e`: Maximum allocation size to track\n- `--min-alloc-size \u003cSIZE\u003e`: Minimum allocation size to track\n- `--sample-every \u003cN\u003e`: Sample every Nth event\n- `--skip-size \u003cSIZE\u003e`: Skip allocations with total allocated \u003c SIZE bytes\n- `--skip-count \u003cCOUNT\u003e`: Skip stack traces with total allocations count \u003c COUNT\n- `--csv \u003cPATH\u003e`: Generate CSV output: pid, stack_id, total allocations in\n  bytes, count, histogram\n  \"stacktrace\"\n- `--flame \u003cPATH\u003e`: Generate flame graph\n\nExample:\n\n```bash\nRUST_LOG=info cargo xtask run --release -- --program ~/dev/oss/coreutils/target/release/coreutils --order-by count --sample-every 100  --skip-count 100 --csv malocs.csv -f malloc --flame malocs.svg\n```\n\nThis will profile malloc calls in ls program, order results by total allocated\ncount, generate a CSV output, and create a flame graph.\n\n# How it works\n\nEbpf program is attached to malloc function in the target program.\nFor every nth call it tracks stacktrace and size of allocation and store it to\ncpu-local hashmap.\n\nUserspace program polls these maps and resolves stacktraces to symbols.\nOn ctrl+c signal it aggregates all data and prints it.\n\n## Todo\n\n- [x] Aggregate histogram in kernel space. For now, we're just dumping all the\n  data to userspace, which gives 1us overhead per call which is unacceptable.\n  Pure uprobe uses 20ns per call.\n- [ ] Find which malloc is used (now we assume that target is statically linked)\n- [ ] Add ratatui based TUI\n- [x] Produce flamegraphs\n- [x] Add docs and examples\n- [ ] somehow proof to ebpf verifier that number [0,1] is valid index for\n  function call. For now, it gives amazing errors like:\n\n```\nError: the BPF_PROG_LOAD syscall failed. Verifier output: 0: R1=ctx() R10=fp0\n0: (bf) r6 = r1                       ; R1=ctx() R6_w=ctx()\n1: (b7) r1 = 4                        ; R1_w=4\n2: (63) *(u32 *)(r10 -280) = r1       ; R1_w=4 R10=fp0 fp-280=????4\n3: (bf) r2 = r10                      ; R2_w=fp0 R10=fp0\n4: (07) r2 += -280                    ; R2_w=fp-280\n5: (18) r1 = 0xffff9f84a9a0dc00       ; R1_w=map_ptr(map=CONFIG,ks=4,vs=8)\n7: (85) call bpf_map_lookup_elem#1    ; R0_w=map_value_or_null(id=1,map=CONFIG,ks=4,vs=8)\n8: (15) if r0 == 0x0 goto pc+152      ; R0_w=map_value(map=CONFIG,ks=4,vs=8)\n9: (79) r2 = *(u64 *)(r0 +0)          ; R0=map_value(map=CONFIG,ks=4,vs=8) R2=scalar()\n10: (65) if r2 s\u003e 0x2 goto pc+7       ; R2=scalar(smax=2)\n11: (b7) r1 = 112                     ; R1_w=112\n12: (15) if r2 == 0x0 goto pc+16      ; R2=scalar(smax=2,umin=1)\n13: (15) if r2 == 0x1 goto pc+12      ; R2=scalar(smax=2,umin=2)\n14: (15) if r2 == 0x2 goto pc+1 16: R0=map_value(map=CONFIG,ks=4,vs=8) R1=112 R2=2 R6=ctx() R10=fp0 fp-280=????mmmm\n16: (b7) r1 = 96                      ; R1_w=96\n17: (05) goto pc+11\n29: (bf) r2 = r6                      ; R2_w=ctx() R6=ctx()\n30: (0f) r2 += r1                     ; R1_w=96 R2_w=ctx(off=96)\n31: (79) r8 = *(u64 *)(r2 +0)\ndereference of modified ctx ptr R2 off=96 disallowed\nverification time 73 usec\nstack depth 280+0\nprocessed 22 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 2\n```\n\n## License\n\nApache 2.0 or MIT\n\n## Contributing\n\nContributions are welcome! Please feel free to submit a Pull Request.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xdeafbeef%2Fjeprofl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xdeafbeef%2Fjeprofl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xdeafbeef%2Fjeprofl/lists"}