Valgrind

Overview

Linux 프로그램 오류 검사기 valgrind 사용법 소개.

Basic

다음의 툴 모드를 지원한다.

• memcheck
• cachegrind,
• callgrind
• helgrind
• drd
• massif
• lackey
• none
• exp-sgcheck
• exp-bbv
• exp-dhat
• etc

Memcheck

다음의 명령어 입력시, 메모리 누수 검사를 수행한다. <source lang=bash> $ valgrind --tool=memcheck --leak-check=full </source>

Example

• Sample code

<source lang=c>

1. include <stdio.h>
2. include <stdlib.h>

int main(int argc, char** argv) {

   char* tmp;
   
   tmp = calloc(1024, sizeof(char));
   
   sprintf(tmp, "Hello, world\n");
   printf("%s", tmp);
   
   return 0;

} </source>

• Valgrind

pchero@mywork:~/workspace/study/program/memory/leak_sample$ valgrind --tool=memcheck --leak-check=full ./main
==12061== Memcheck, a memory error detector
==12061== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==12061== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==12061== Command: ./main
==12061== 
Hello, world
==12061== 
==12061== HEAP SUMMARY:
==12061==     in use at exit: 1,024 bytes in 1 blocks
==12061==   total heap usage: 1 allocs, 0 frees, 1,024 bytes allocated
==12061== 
==12061== 1,024 bytes in 1 blocks are definitely lost in loss record 1 of 1
==12061==    at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12061==    by 0x40059A: main (in /home/pchero/ownCloud/workspace/study/program/memory/leak_sample/main)
==12061== 
==12061== LEAK SUMMARY:
==12061==    definitely lost: 1,024 bytes in 1 blocks
==12061==    indirectly lost: 0 bytes in 0 blocks
==12061==      possibly lost: 0 bytes in 0 blocks
==12061==    still reachable: 0 bytes in 0 blocks
==12061==         suppressed: 0 bytes in 0 blocks
==12061== 
==12061== For counts of detected and suppressed errors, rerun with: -v
==12061== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

cachegrind

캐시 메모리 사용과 관련한 분석을 할 때 이용한다. 보통은 cg_annotate 라고 하는 프로그램을 같이 붙여서 사용한다.

$ valgrind --tool=cachegrind --cachegrind-out-file=test.cache ./main
==5449== Cachegrind, a cache and branch-prediction profiler
==5449== Copyright (C) 2002-2013, and GNU GPL'd, by Nicholas Nethercote et al.
==5449== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==5449== Command: ./main
==5449== 
--5449-- warning: L3 cache found, using its data for the LL simulation.
==5449== 
==5449== I   refs:      936,567,521
==5449== I1  misses:            794
==5449== LLi misses:            789
==5449== I1  miss rate:        0.00%
==5449== LLi miss rate:        0.00%
==5449== 
==5449== D   refs:      372,559,454  (255,043,966 rd   + 117,515,488 wr)
==5449== D1  misses:     18,125,618  ( 15,000,058 rd   +   3,125,560 wr)
==5449== LLd misses:     17,655,246  ( 14,529,718 rd   +   3,125,528 wr)
==5449== D1  miss rate:         4.8% (        5.8%     +         2.6%  )
==5449== LLd miss rate:         4.7% (        5.6%     +         2.6%  )
==5449== 
==5449== LL refs:        18,126,412  ( 15,000,852 rd   +   3,125,560 wr)
==5449== LL misses:      17,656,035  ( 14,530,507 rd   +   3,125,528 wr)
==5449== LL miss rate:          1.3% (        1.2%     +         2.6%  )


$ cg_annotate --auto=yes ./test.cache 
--------------------------------------------------------------------------------
I1 cache:         32768 B, 64 B, 8-way associative
D1 cache:         32768 B, 64 B, 8-way associative
LL cache:         6291456 B, 64 B, 12-way associative
Command:          ./main
Data file:        ./test.cache
Events recorded:  Ir I1mr ILmr Dr D1mr DLmr Dw D1mw DLmw
Events shown:     Ir I1mr ILmr Dr D1mr DLmr Dw D1mw DLmw
Event sort order: Ir I1mr ILmr Dr D1mr DLmr Dw D1mw DLmw
Thresholds:       0.1 100 100 100 100 100 100 100 100
Include dirs:     
User annotated:   
Auto-annotation:  on

--------------------------------------------------------------------------------
         Ir I1mr ILmr          Dr       D1mr       DLmr          Dw      D1mw      DLmw 
--------------------------------------------------------------------------------
936,567,521  794  789 255,043,966 15,000,174 14,530,056 117,515,488 3,125,560 3,125,528  PROGRAM TOTALS

--------------------------------------------------------------------------------
         Ir I1mr ILmr          Dr       D1mr       DLmr         Dw      D1mw      DLmw  file:function
--------------------------------------------------------------------------------
389,524,179    2    2 120,002,480          0          0 60,001,240         0         0  /build/eglibc-3GlaMS/eglibc-2.19/stdlib/random_r.c:random_r
255,000,000    3    3  90,000,000          0          0 15,000,000         0         0  /build/eglibc-3GlaMS/eglibc-2.19/stdlib/random.c:random
195,000,021    1    1  15,000,004 14,997,687 14,527,948 15,000,006         0         0  ???:main
 60,000,000    1    1  15,000,000          0          0 15,000,000         0         0  /build/eglibc-3GlaMS/eglibc-2.19/stdlib/rand.c:rand
 21,875,016    4    4           1          1          1 12,500,004 3,125,001 3,125,001  /build/eglibc-3GlaMS/eglibc-2.19/string/../sysdeps/x86_64/memset.S:memset
 15,000,220   21   18  15,000,114          6          5         33         1         1  ???:???

--------------------------------------------------------------------------------
The following files chosen for auto-annotation could not be found:
--------------------------------------------------------------------------------
  /build/eglibc-3GlaMS/eglibc-2.19/stdlib/rand.c
  /build/eglibc-3GlaMS/eglibc-2.19/stdlib/random.c
  /build/eglibc-3GlaMS/eglibc-2.19/string/../sysdeps/x86_64/memset.S
  /build/eglibc-3GlaMS/eglibc-2.19/stdlib/random_r.c

Options

--log-file

valgrind result output 을 입력한 파일로 지정한다. 즉, 결과를 파일에 저장하는 옵션이다.

Help

--help 입력시 도움말을 확인할 수 있다.

pchero@mywork:~$ valgrind --help
usage: valgrind [options] prog-and-args

  tool-selection option, with default in [ ]:
    --tool=<name>             use the Valgrind tool named <name> [memcheck]

  basic user options for all Valgrind tools, with defaults in [ ]:
    -h --help                 show this message
    --help-debug              show this message, plus debugging options
    --version                 show version
    -q --quiet                run silently; only print error msgs
    -v --verbose              be more verbose -- show misc extra info
    --trace-children=no|yes   Valgrind-ise child processes (follow execve)? [no]
    --trace-children-skip=patt1,patt2,...    specifies a list of executables
                              that --trace-children=yes should not trace into
    --trace-children-skip-by-arg=patt1,patt2,...   same as --trace-children-skip=
                              but check the argv[] entries for children, rather
                              than the exe name, to make a follow/no-follow decision
    --child-silent-after-fork=no|yes omit child output between fork & exec? [no]
    --vgdb=no|yes|full        activate gdbserver? [yes]
                              full is slower but provides precise watchpoint/step
    --vgdb-error=<number>     invoke gdbserver after <number> errors [999999999]
                              to get started quickly, use --vgdb-error=0
                              and follow the on-screen directions
    --track-fds=no|yes        track open file descriptors? [no]
    --time-stamp=no|yes       add timestamps to log messages? [no]
    --log-fd=<number>         log messages to file descriptor [2=stderr]
    --log-file=<file>         log messages to <file>
    --log-socket=ipaddr:port  log messages to socket ipaddr:port

  user options for Valgrind tools that report errors:
    --xml=yes                 emit error output in XML (some tools only)
    --xml-fd=<number>         XML output to file descriptor
    --xml-file=<file>         XML output to <file>
    --xml-socket=ipaddr:port  XML output to socket ipaddr:port
    --xml-user-comment=STR    copy STR verbatim into XML output
    --demangle=no|yes         automatically demangle C++ names? [yes]
    --num-callers=<number>    show <number> callers in stack traces [12]
    --error-limit=no|yes      stop showing new errors if too many? [yes]
    --error-exitcode=<number> exit code to return if errors found [0=disable]
    --show-below-main=no|yes  continue stack traces below main() [no]
    --suppressions=<filename> suppress errors described in <filename>
    --gen-suppressions=no|yes|all    print suppressions for errors? [no]
    --db-attach=no|yes        start debugger when errors detected? [no]
    --db-command=<command>    command to start debugger [/usr/bin/gdb -nw %f %p]
    --input-fd=<number>       file descriptor for input [0=stdin]
    --dsymutil=no|yes         run dsymutil on Mac OS X when helpful? [no]
    --max-stackframe=<number> assume stack switch for SP changes larger
                              than <number> bytes [2000000]
    --main-stacksize=<number> set size of main thread's stack (in bytes)
                              [min(max(current 'ulimit' value,1MB),16MB)]

  user options for Valgrind tools that replace malloc:
    --alignment=<number>      set minimum alignment of heap allocations [16]
    --redzone-size=<number>   set minimum size of redzones added before/after
                              heap blocks (in bytes). [16]

  uncommon user options for all Valgrind tools:
    --fullpath-after=         (with nothing after the '=')
                              show full source paths in call stacks
    --fullpath-after=string   like --fullpath-after=, but only show the
                              part of the path after 'string'.  Allows removal
                              of path prefixes.  Use this flag multiple times
                              to specify a set of prefixes to remove.
    --extra-debuginfo-path=path    absolute path to search for additional
                              debug symbols, in addition to existing default
                              well known search paths.
    --debuginfo-server=ipaddr:port    also query this server
                              (valgrind-di-server) for debug symbols
    --allow-mismatched-debuginfo=no|yes  [no]
                              for the above two flags only, accept debuginfo
                              objects that don't "match" the main object
    --smc-check=none|stack|all|all-non-file [stack]
                              checks for self-modifying code: none, only for
                              code found in stacks, for all code, or for all
                              code except that from file-backed mappings
    --read-var-info=yes|no    read debug info on stack and global variables
                              and use it to print better error messages in
                              tools that make use of it (Memcheck, Helgrind,
                              DRD) [no]
    --vgdb-poll=<number>      gdbserver poll max every <number> basic blocks [5000] 
    --vgdb-shadow-registers=no|yes   let gdb see the shadow registers [no]
    --vgdb-prefix=<prefix>    prefix for vgdb FIFOs [/tmp/vgdb-pipe]
    --run-libc-freeres=no|yes free up glibc memory at exit on Linux? [yes]
    --sim-hints=hint1,hint2,...  known hints:
                                 lax-ioctls, enable-outer, fuse-compatible [none]
    --fair-sched=no|yes|try   schedule threads fairly on multicore systems [no]
    --kernel-variant=variant1,variant2,...  known variants: bproc [none]
                              handle non-standard kernel variants
    --merge-recursive-frames=<number>  merge frames between identical
           program counters in max <number> frames) [0]
    --num-transtab-sectors=<number> size of translated code cache [16]
           more sectors may increase performance, but use more memory.
    --show-emwarns=no|yes     show warnings about emulation limits? [no]
    --require-text-symbol=:sonamepattern:symbolpattern    abort run if the
                              stated shared object doesn't have the stated
                              text symbol.  Patterns can contain ? and *.
    --soname-synonyms=syn1=pattern1,syn2=pattern2,... synonym soname
              specify patterns for function wrapping or replacement.
              To use a non-libc malloc library that is
                  in the main exe:  --soname-synonyms=somalloc=NONE
                  in libxyzzy.so:   --soname-synonyms=somalloc=libxyzzy.so
    --sigill-diagnostics=yes|no  warn about illegal instructions? [yes]
    --unw-stack-scan-thresh=<number>   Enable stack-scan unwind if fewer
                  than <number> good frames found  [0, meaning "disabled"]
                  NOTE: stack scanning is only available on arm-linux.
    --unw-stack-scan-frames=<number>   Max number of frames that can be
                  recovered by stack scanning [5]

  user options for Memcheck:
    --leak-check=no|summary|full     search for memory leaks at exit?  [summary]
    --leak-resolution=low|med|high   differentiation of leak stack traces [high]
    --show-leak-kinds=kind1,kind2,.. which leak kinds to show?
                                            [definite,possible]
    --errors-for-leak-kinds=kind1,kind2,..  which leak kinds are errors?
                                            [definite,possible]
        where kind is one of definite indirect possible reachable all none
    --leak-check-heuristics=heur1,heur2,... which heuristics to use for
        improving leak search false positive [none]
        where heur is one of stdstring newarray multipleinheritance all none
    --show-reachable=yes             same as --show-leak-kinds=all
    --show-reachable=no --show-possibly-lost=yes
                                     same as --show-leak-kinds=definite,possible
    --show-reachable=no --show-possibly-lost=no
                                     same as --show-leak-kinds=definite
    --undef-value-errors=no|yes      check for undefined value errors [yes]
    --track-origins=no|yes           show origins of undefined values? [no]
    --partial-loads-ok=no|yes        too hard to explain here; see manual [no]
    --freelist-vol=<number>          volume of freed blocks queue     [20000000]
    --freelist-big-blocks=<number>   releases first blocks with size>= [1000000]
    --workaround-gcc296-bugs=no|yes  self explanatory [no]
    --ignore-ranges=0xPP-0xQQ[,0xRR-0xSS]   assume given addresses are OK
    --malloc-fill=<hexnumber>        fill malloc'd areas with given value
    --free-fill=<hexnumber>          fill free'd areas with given value
    --keep-stacktraces=alloc|free|alloc-and-free|alloc-then-free|none
        stack trace(s) to keep for malloc'd/free'd areas       [alloc-then-free]

  Extra options read from ~/.valgrindrc, $VALGRIND_OPTS, ./.valgrindrc

  Memcheck is Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
  Valgrind is Copyright (C) 2000-2013, and GNU GPL'd, by Julian Seward et al.
  LibVEX is Copyright (C) 2004-2013, and GNU GPL'd, by OpenWorks LLP et al.

  Bug reports, feedback, admiration, abuse, etc, to: www.valgrind.org.

See also

• http://valgrind.org/docs/manual/cg-manual.html - Cachegrind: a cache and branch-prediction profiler