php-ebpf/example/tracing/mallocstacks.php

<?php
if ($argc < 2) {
    echo "USAGE: mallocstacks PID [NUM_STACKS=1024]\n";
    exit(1);
}
$pid    = (int)$argv[1];
$stacks = ($argc == 3 && is_numeric($argv[2]) && (int)$argv[2] > 0) ? $argv[2] : "1024";

$bpf_text = <<<EOT
#include <uapi/linux/ptrace.h>

BPF_HASH(calls, int);
BPF_STACK_TRACE(stack_traces, {$stacks});

int alloc_enter(struct pt_regs *ctx, size_t size) {
    int key = stack_traces.get_stackid(ctx, BPF_F_USER_STACK);
    if (key < 0)
        return 0;

    u64 zero = 0, *val;
    val = calls.lookup_or_try_init(&key, &zero);
    if (val) {
      (*val) += size;
    }
    return 0;
};
EOT;

$ebpf = new Ebpf($bpf_text);
$ebpf->attach_uprobe("c", "malloc", "alloc_enter", ["pid" => $pid]);
echo "Attaching to malloc in pid {$pid}, Ctrl+C to quit.\n";

pcntl_signal(SIGINT, "signalHandler");

pcntl_async_signals(true);

# sleep until Ctrl-C
while (true) {
    sleep(99999999);
}

function signalHandler($signo)
{
    global $ebpf;
    global $pid;
    switch ($signo) {
        case SIGINT:
            $calls        = $ebpf->get_table("calls");
            $stack_traces = $ebpf->get_table("stack_traces");

            $calls_vals = $calls->values();
            arsort($calls_vals);

            foreach ($calls_vals as $key => $value) {
                printf("%d bytes allocated at:\n", $value);

                if ($key > 0) {
                    $a = $stack_traces->values($key, $pid);
                    foreach ($a as $addr) {
                        printf("\t%s\n", $addr);
                    }
                    printf("    %d\n\n", $value);
                }
            }
            exit(0);
    }
}