4.1 Output Options

These options specify which of several output formats gprof should produce.

Many of these options take an optional symspec to specify functions to be included or excluded. These options can be specified multiple times, with different symspecs, to include or exclude sets of symbols. See Symspecs.

Specifying any of these options overrides the default (‘-p -q’), which prints a flat profile and call graph analysis for all functions.

-A[symspec]

--annotated-source[=symspec]

The ‘-A’ option causes gprof to print annotated source code. If symspec is specified, print output only for matching symbols. See The Annotated Source Listing.

-b

--brief

If the ‘-b’ option is given, gprof doesn’t print the verbose blurbs that try to explain the meaning of all of the fields in the tables. This is useful if you intend to print out the output, or are tired of seeing the blurbs.

-B

The ‘-B’ option causes gprof to print the call graph analysis.

-C[symspec]

--exec-counts[=symspec]

The ‘-C’ option causes gprof to print a tally of functions and the number of times each was called. If symspec is specified, print tally only for matching symbols.

If the profile data file contains basic-block count records, specifying the ‘-l’ option, along with ‘-C’, will cause basic-block execution counts to be tallied and displayed.

-i

--file-info

The ‘-i’ option causes gprof to display summary information about the profile data file(s) and then exit. The number of histogram, call graph, and basic-block count records is displayed.

-I dirs

--directory-path=dirs

The ‘-I’ option specifies a list of search directories in which to find source files. Environment variable GPROF_PATH can also be used to convey this information. Used mostly for annotated source output.

-J[symspec]

--no-annotated-source[=symspec]

The ‘-J’ option causes gprof not to print annotated source code. If symspec is specified, gprof prints annotated source, but excludes matching symbols.

-L

--print-path

Normally, source filenames are printed with the path component suppressed. The ‘-L’ option causes gprof to print the full pathname of source filenames, which is determined from symbolic debugging information in the image file and is relative to the directory in which the compiler was invoked.

-p[symspec]

--flat-profile[=symspec]

The ‘-p’ option causes gprof to print a flat profile. If symspec is specified, print flat profile only for matching symbols. See The Flat Profile.

-P[symspec]

--no-flat-profile[=symspec]

The ‘-P’ option causes gprof to suppress printing a flat profile. If symspec is specified, gprof prints a flat profile, but excludes matching symbols.

-q[symspec]

--graph[=symspec]

The ‘-q’ option causes gprof to print the call graph analysis. If symspec is specified, print call graph only for matching symbols and their children. See The Call Graph.

-Q[symspec]

--no-graph[=symspec]

The ‘-Q’ option causes gprof to suppress printing the call graph. If symspec is specified, gprof prints a call graph, but excludes matching symbols.

-t

--table-length=num

The ‘-t’ option causes the num most active source lines in each source file to be listed when source annotation is enabled. The default is 10.

-y

--separate-files

This option affects annotated source output only. Normally, gprof prints annotated source files to standard-output. If this option is specified, annotated source for a file named path/filename is generated in the file filename-ann. If the underlying file system would truncate filename-ann so that it overwrites the original filename, gprof generates annotated source in the file filename.ann instead (if the original file name has an extension, that extension is replaced with .ann).

-Z[symspec]

--no-exec-counts[=symspec]

The ‘-Z’ option causes gprof not to print a tally of functions and the number of times each was called. If symspec is specified, print tally, but exclude matching symbols.

-r

--function-ordering

The ‘--function-ordering’ option causes gprof to print a suggested function ordering for the program based on profiling data. This option suggests an ordering which may improve paging, tlb and cache behavior for the program on systems which support arbitrary ordering of functions in an executable.

The exact details of how to force the linker to place functions in a particular order is system dependent and out of the scope of this manual.

-R map_file

--file-ordering map_file

The ‘--file-ordering’ option causes gprof to print a suggested .o link line ordering for the program based on profiling data. This option suggests an ordering which may improve paging, tlb and cache behavior for the program on systems which do not support arbitrary ordering of functions in an executable.

Use of the ‘-a’ argument is highly recommended with this option.

The map_file argument is a pathname to a file which provides function name to object file mappings. The format of the file is similar to the output of the program nm.

c-parse.o:00000000 T yyparse
c-parse.o:00000004 C yyerrflag
c-lang.o:00000000 T maybe_objc_method_name
c-lang.o:00000000 T print_lang_statistics
c-lang.o:00000000 T recognize_objc_keyword
c-decl.o:00000000 T print_lang_identifier
c-decl.o:00000000 T print_lang_type
…

To create a map_file with GNU nm, type a command like nm --extern-only --defined-only -v --print-file-name program-name.

-T

--traditional

The ‘-T’ option causes gprof to print its output in “traditional” BSD style.

-w width

--width=width

Sets width of output lines to width. Currently only used when printing the function index at the bottom of the call graph.

-x

--all-lines

This option affects annotated source output only. By default, only the lines at the beginning of a basic-block are annotated. If this option is specified, every line in a basic-block is annotated by repeating the annotation for the first line. This behavior is similar to tcov’s ‘-a’.

--demangle[=style]

--no-demangle

These options control whether C++ symbol names should be demangled when printing output. The default is to demangle symbols. The --no-demangle option may be used to turn off demangling. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler.

4.2 Analysis Options

-a

--no-static

The ‘-a’ option causes gprof to suppress the printing of statically declared (private) functions. (These are functions whose names are not listed as global, and which are not visible outside the file/function/block where they were defined.) Time spent in these functions, calls to/from them, etc., will all be attributed to the function that was loaded directly before it in the executable file. This option affects both the flat profile and the call graph.

-c

--static-call-graph

The ‘-c’ option causes the call graph of the program to be augmented by a heuristic which examines the text space of the object file and identifies function calls in the binary machine code. Since normal call graph records are only generated when functions are entered, this option identifies children that could have been called, but never were. Calls to functions that were not compiled with profiling enabled are also identified, but only if symbol table entries are present for them. Calls to dynamic library routines are typically not found by this option. Parents or children identified via this heuristic are indicated in the call graph with call counts of ‘0’.

-D

--ignore-non-functions

The ‘-D’ option causes gprof to ignore symbols which are not known to be functions. This option will give more accurate profile data on systems where it is supported (Solaris and HPUX for example).

-k from/to

The ‘-k’ option allows you to delete from the call graph any arcs from symbols matching symspec from to those matching symspec to.

-l

--line

The ‘-l’ option enables line-by-line profiling, which causes histogram hits to be charged to individual source code lines, instead of functions. This feature only works with programs compiled by older versions of the gcc compiler. Newer versions of gcc are designed to work with the gcov tool instead.

If the program was compiled with basic-block counting enabled, this option will also identify how many times each line of code was executed. While line-by-line profiling can help isolate where in a large function a program is spending its time, it also significantly increases the running time of gprof, and magnifies statistical inaccuracies. See Statistical Sampling Error.

--inline-file-names

This option causes gprof to print the source file after each symbol in both the flat profile and the call graph. The full path to the file is printed if used with the ‘-L’ option.

-m num

--min-count=num

This option affects execution count output only. Symbols that are executed less than num times are suppressed.

-nsymspec

--time=symspec

The ‘-n’ option causes gprof, in its call graph analysis, to only propagate times for symbols matching symspec.

-Nsymspec

--no-time=symspec

The ‘-n’ option causes gprof, in its call graph analysis, not to propagate times for symbols matching symspec.

-Sfilename

--external-symbol-table=filename

The ‘-S’ option causes gprof to read an external symbol table file, such as /proc/kallsyms, rather than read the symbol table from the given object file (the default is a.out). This is useful for profiling kernel modules.

-z

--display-unused-functions

If you give the ‘-z’ option, gprof will mention all functions in the flat profile, even those that were never called, and that had no time spent in them. This is useful in conjunction with the ‘-c’ option for discovering which routines were never called.

4.3 Miscellaneous Options

-d[num]

--debug[=num]

The ‘-d num’ option specifies debugging options. If num is not specified, enable all debugging. See Debugging gprof.

-h

--help

The ‘-h’ option prints command line usage.

-Oname

--file-format=name

Selects the format of the profile data files. Recognized formats are ‘auto’ (the default), ‘bsd’, ‘4.4bsd’, ‘magic’, and ‘prof’ (not yet supported).

-s

--sum

The ‘-s’ option causes gprof to summarize the information in the profile data files it read in, and write out a profile data file called gmon.sum, which contains all the information from the profile data files that gprof read in. The file gmon.sum may be one of the specified input files; the effect of this is to merge the data in the other input files into gmon.sum.

Eventually you can run gprof again without ‘-s’ to analyze the cumulative data in the file gmon.sum.

-v

--version

The ‘-v’ flag causes gprof to print the current version number, and then exit.

4.4 Deprecated Options

These options have been replaced with newer versions that use symspecs.

-e function_name

The ‘-e function’ option tells gprof to not print information about the function function_name (and its children…) in the call graph. The function will still be listed as a child of any functions that call it, but its index number will be shown as ‘[not printed]’. More than one ‘-e’ option may be given; only one function_name may be indicated with each ‘-e’ option.

-E function_name

The -E function option works like the -e option, but time spent in the function (and children who were not called from anywhere else), will not be used to compute the percentages-of-time for the call graph. More than one ‘-E’ option may be given; only one function_name may be indicated with each ‘-E’ option.

-f function_name

The ‘-f function’ option causes gprof to limit the call graph to the function function_name and its children (and their children…). More than one ‘-f’ option may be given; only one function_name may be indicated with each ‘-f’ option.

-F function_name

The ‘-F function’ option works like the -f option, but only time spent in the function and its children (and their children…) will be used to determine total-time and percentages-of-time for the call graph. More than one ‘-F’ option may be given; only one function_name may be indicated with each ‘-F’ option. The ‘-F’ option overrides the ‘-E’ option.

Note that only one function can be specified with each -e, -E, -f or -F option. To specify more than one function, use multiple options. For example, this command:

gprof -e boring -f foo -f bar myprogram > gprof.output

lists in the call graph all functions that were reached from either foo or bar and were not reachable from boring.

4.5 Symspecs

Many of the output options allow functions to be included or excluded using symspecs (symbol specifications), which observe the following syntax:

  filename_containing_a_dot
| funcname_not_containing_a_dot
| linenumber
| ( [ any_filename ] `:' ( any_funcname | linenumber ) )

Here are some sample symspecs:

‘main.c’

Selects everything in file main.c—the dot in the string tells gprof to interpret the string as a filename, rather than as a function name. To select a file whose name does not contain a dot, a trailing colon should be specified. For example, ‘odd:’ is interpreted as the file named odd.

‘main’

Selects all functions named ‘main’.

Note that there may be multiple instances of the same function name because some of the definitions may be local (i.e., static). Unless a function name is unique in a program, you must use the colon notation explained below to specify a function from a specific source file.

Sometimes, function names contain dots. In such cases, it is necessary to add a leading colon to the name. For example, ‘:.mul’ selects function ‘.mul’.

In some object file formats, symbols have a leading underscore. gprof will normally not print these underscores. When you name a symbol in a symspec, you should type it exactly as gprof prints it in its output. For example, if the compiler produces a symbol ‘_main’ from your main function, gprof still prints it as ‘main’ in its output, so you should use ‘main’ in symspecs.

‘main.c:main’

Selects function ‘main’ in file main.c.

‘main.c:134’

Selects line 134 in file main.c.

5.1 The Flat Profile

The flat profile shows the total amount of time your program spent executing each function. Unless the ‘-z’ option is given, functions with no apparent time spent in them, and no apparent calls to them, are not mentioned. Note that if a function was not compiled for profiling, and didn’t run long enough to show up on the program counter histogram, it will be indistinguishable from a function that was never called.

This is part of a flat profile for a small program:

Flat profile:

Each sample counts as 0.01 seconds.
  %   cumulative   self              self     total
 time   seconds   seconds    calls  ms/call  ms/call  name
 33.34      0.02     0.02     7208     0.00     0.00  open
 16.67      0.03     0.01      244     0.04     0.12  offtime
 16.67      0.04     0.01        8     1.25     1.25  memccpy
 16.67      0.05     0.01        7     1.43     1.43  write
 16.67      0.06     0.01                             mcount
  0.00      0.06     0.00      236     0.00     0.00  tzset
  0.00      0.06     0.00      192     0.00     0.00  tolower
  0.00      0.06     0.00       47     0.00     0.00  strlen
  0.00      0.06     0.00       45     0.00     0.00  strchr
  0.00      0.06     0.00        1     0.00    50.00  main
  0.00      0.06     0.00        1     0.00     0.00  memcpy
  0.00      0.06     0.00        1     0.00    10.11  print
  0.00      0.06     0.00        1     0.00     0.00  profil
  0.00      0.06     0.00        1     0.00    50.00  report
…

The functions are sorted first by decreasing run-time spent in them, then by decreasing number of calls, then alphabetically by name. The functions ‘mcount’ and ‘profil’ are part of the profiling apparatus and appear in every flat profile; their time gives a measure of the amount of overhead due to profiling.

Just before the column headers, a statement appears indicating how much time each sample counted as. This sampling period estimates the margin of error in each of the time figures. A time figure that is not much larger than this is not reliable. In this example, each sample counted as 0.01 seconds, suggesting a 100 Hz sampling rate. The program’s total execution time was 0.06 seconds, as indicated by the ‘cumulative seconds’ field. Since each sample counted for 0.01 seconds, this means only six samples were taken during the run. Two of the samples occurred while the program was in the ‘open’ function, as indicated by the ‘self seconds’ field. Each of the other four samples occurred one each in ‘offtime’, ‘memccpy’, ‘write’, and ‘mcount’. Since only six samples were taken, none of these values can be regarded as particularly reliable. In another run, the ‘self seconds’ field for ‘mcount’ might well be ‘0.00’ or ‘0.02’. See Statistical Sampling Error, for a complete discussion.

The remaining functions in the listing (those whose ‘self seconds’ field is ‘0.00’) didn’t appear in the histogram samples at all. However, the call graph indicated that they were called, so therefore they are listed, sorted in decreasing order by the ‘calls’ field. Clearly some time was spent executing these functions, but the paucity of histogram samples prevents any determination of how much time each took.

Here is what the fields in each line mean:

% time

This is the percentage of the total execution time your program spent in this function. These should all add up to 100%.

cumulative seconds

This is the cumulative total number of seconds the computer spent executing this functions, plus the time spent in all the functions above this one in this table.

self seconds

This is the number of seconds accounted for by this function alone. The flat profile listing is sorted first by this number.

calls

This is the total number of times the function was called. If the function was never called, or the number of times it was called cannot be determined (probably because the function was not compiled with profiling enabled), the calls field is blank.

self ms/call

This represents the average number of milliseconds spent in this function per call, if this function is profiled. Otherwise, this field is blank for this function.

total ms/call

This represents the average number of milliseconds spent in this function and its descendants per call, if this function is profiled. Otherwise, this field is blank for this function. This is the only field in the flat profile that uses call graph analysis.

name

This is the name of the function. The flat profile is sorted by this field alphabetically after the self seconds and calls fields are sorted.

5.2 The Call Graph

The call graph shows how much time was spent in each function and its children. From this information, you can find functions that, while they themselves may not have used much time, called other functions that did use unusual amounts of time.

Here is a sample call from a small program. This call came from the same gprof run as the flat profile example in the previous section.

granularity: each sample hit covers 2 byte(s) for 20.00% of 0.05 seconds

index % time    self  children    called     name
                                                 <spontaneous>
[1]    100.0    0.00    0.05                 start [1]
                0.00    0.05       1/1           main [2]
                0.00    0.00       1/2           on_exit [28]
                0.00    0.00       1/1           exit [59]
-----------------------------------------------
                0.00    0.05       1/1           start [1]
[2]    100.0    0.00    0.05       1         main [2]
                0.00    0.05       1/1           report [3]
-----------------------------------------------
                0.00    0.05       1/1           main [2]
[3]    100.0    0.00    0.05       1         report [3]
                0.00    0.03       8/8           timelocal [6]
                0.00    0.01       1/1           print [9]
                0.00    0.01       9/9           fgets [12]
                0.00    0.00      12/34          strncmp <cycle 1> [40]
                0.00    0.00       8/8           lookup [20]
                0.00    0.00       1/1           fopen [21]
                0.00    0.00       8/8           chewtime [24]
                0.00    0.00       8/16          skipspace [44]
-----------------------------------------------
[4]     59.8    0.01        0.02       8+472     <cycle 2 as a whole> [4]
                0.01        0.02     244+260         offtime <cycle 2> [7]
                0.00        0.00     236+1           tzset <cycle 2> [26]
-----------------------------------------------

The lines full of dashes divide this table into entries, one for each function. Each entry has one or more lines.

In each entry, the primary line is the one that starts with an index number in square brackets. The end of this line says which function the entry is for. The preceding lines in the entry describe the callers of this function and the following lines describe its subroutines (also called children when we speak of the call graph).

The entries are sorted by time spent in the function and its subroutines.

The internal profiling function mcount (see The Flat Profile) is never mentioned in the call graph.

• The Primary Line
• Lines for a Function’s Callers
• Lines for a Function’s Subroutines
• How Mutually Recursive Functions Are Described

index  % time    self  children called     name
…
[3]    100.0    0.00    0.05       1         report [3]

index  % time    self  children called     name
…
                0.00    0.05       1/1           main [2]
[3]    100.0    0.00    0.05       1         report [3]

index  % time    self  children called     name
…
[2]    100.0    0.00    0.05       1         main [2]
                0.00    0.05       1/1           report [3]

index  % time    self  children called     name
----------------------------------------
                 1.77        0    1/1        main [2]
[3]     91.71    1.77        0    1+5    <cycle 1 as a whole> [3]
                 1.02        0    3          b <cycle 1> [4]
                 0.75        0    2          a <cycle 1> [5]
----------------------------------------
                                  3          a <cycle 1> [5]
[4]     52.85    1.02        0    0      b <cycle 1> [4]
                                  2          a <cycle 1> [5]
                    0        0    3/6        c [6]
----------------------------------------
                 1.77        0    1/1        main [2]
                                  2          b <cycle 1> [4]
[5]     38.86    0.75        0    1      a <cycle 1> [5]
                                  3          b <cycle 1> [4]
                    0        0    3/6        c [6]
----------------------------------------

index  % time    self  children called     name
                                             <spontaneous>
[1]    100.00       0     1.93    0      start [1]
                 0.16     1.77    1/1        main [2]
----------------------------------------
                 0.16     1.77    1/1        start [1]
[2]    100.00    0.16     1.77    1      main [2]
                 1.77        0    1/1        a <cycle 1> [5]
----------------------------------------
                 1.77        0    1/1        main [2]
[3]     91.71    1.77        0    1+5    <cycle 1 as a whole> [3]
                 1.02        0    3          b <cycle 1> [4]
                 0.75        0    2          a <cycle 1> [5]
                    0        0    6/6        c [6]
----------------------------------------
                                  3          a <cycle 1> [5]
[4]     52.85    1.02        0    0      b <cycle 1> [4]
                                  2          a <cycle 1> [5]
                    0        0    3/6        c [6]
----------------------------------------
                 1.77        0    1/1        main [2]
                                  2          b <cycle 1> [4]
[5]     38.86    0.75        0    1      a <cycle 1> [5]
                                  3          b <cycle 1> [4]
                    0        0    3/6        c [6]
----------------------------------------
                    0        0    3/6        b <cycle 1> [4]
                    0        0    3/6        a <cycle 1> [5]
[6]      0.00       0        0    6      c [6]
----------------------------------------

5.3 Line-by-line Profiling

gprof’s ‘-l’ option causes the program to perform line-by-line profiling. In this mode, histogram samples are assigned not to functions, but to individual lines of source code. This only works with programs compiled with older versions of the gcc compiler. Newer versions of gcc use a different program - gcov - to display line-by-line profiling information.

With the older versions of gcc the program usually has to be compiled with a ‘-g’ option, in addition to ‘-pg’, in order to generate debugging symbols for tracking source code lines. Note, in much older versions of gcc the program had to be compiled with the ‘-a’ command-line option as well.

The flat profile is the most useful output table in line-by-line mode. The call graph isn’t as useful as normal, since the current version of gprof does not propagate call graph arcs from source code lines to the enclosing function. The call graph does, however, show each line of code that called each function, along with a count.

Here is a section of gprof’s output, without line-by-line profiling. Note that ct_init accounted for four histogram hits, and 13327 calls to init_block.

Flat profile:

Each sample counts as 0.01 seconds.
  %   cumulative   self              self     total
 time   seconds   seconds    calls  us/call  us/call  name
 30.77      0.13     0.04     6335     6.31     6.31  ct_init


		     Call graph (explanation follows)


granularity: each sample hit covers 4 byte(s) for 7.69% of 0.13 seconds

index % time    self  children    called     name

                0.00    0.00       1/13496       name_too_long
                0.00    0.00      40/13496       deflate
                0.00    0.00     128/13496       deflate_fast
                0.00    0.00   13327/13496       ct_init
[7]      0.0    0.00    0.00   13496         init_block

Now let’s look at some of gprof’s output from the same program run, this time with line-by-line profiling enabled. Note that ct_init’s four histogram hits are broken down into four lines of source code—one hit occurred on each of lines 349, 351, 382 and 385. In the call graph, note how ct_init’s 13327 calls to init_block are broken down into one call from line 396, 3071 calls from line 384, 3730 calls from line 385, and 6525 calls from 387.

Flat profile:

Each sample counts as 0.01 seconds.
  %   cumulative   self
 time   seconds   seconds    calls  name
  7.69      0.10     0.01           ct_init (trees.c:349)
  7.69      0.11     0.01           ct_init (trees.c:351)
  7.69      0.12     0.01           ct_init (trees.c:382)
  7.69      0.13     0.01           ct_init (trees.c:385)


		     Call graph (explanation follows)


granularity: each sample hit covers 4 byte(s) for 7.69% of 0.13 seconds

  % time    self  children    called     name

            0.00    0.00       1/13496       name_too_long (gzip.c:1440)
            0.00    0.00       1/13496       deflate (deflate.c:763)
            0.00    0.00       1/13496       ct_init (trees.c:396)
            0.00    0.00       2/13496       deflate (deflate.c:727)
            0.00    0.00       4/13496       deflate (deflate.c:686)
            0.00    0.00       5/13496       deflate (deflate.c:675)
            0.00    0.00      12/13496       deflate (deflate.c:679)
            0.00    0.00      16/13496       deflate (deflate.c:730)
            0.00    0.00     128/13496       deflate_fast (deflate.c:654)
            0.00    0.00    3071/13496       ct_init (trees.c:384)
            0.00    0.00    3730/13496       ct_init (trees.c:385)
            0.00    0.00    6525/13496       ct_init (trees.c:387)
[6]  0.0    0.00    0.00   13496         init_block (trees.c:408)

5.4 The Annotated Source Listing

gprof’s ‘-A’ option triggers an annotated source listing, which lists the program’s source code, each function labeled with the number of times it was called. You may also need to specify the ‘-I’ option, if gprof can’t find the source code files.

With older versions of gcc compiling with ‘gcc … -g -pg -a’ augments your program with basic-block counting code, in addition to function counting code. This enables gprof to determine how many times each line of code was executed. With newer versions of gcc support for displaying basic-block counts is provided by the gcov program.

For example, consider the following function, taken from gzip, with line numbers added:

 1 ulg updcrc(s, n)
 2     uch *s;
 3     unsigned n;
 4 {
 5     register ulg c;
 6
 7     static ulg crc = (ulg)0xffffffffL;
 8
 9     if (s == NULL) {
10         c = 0xffffffffL;
11     } else {
12         c = crc;
13         if (n) do {
14             c = crc_32_tab[...];
15         } while (--n);
16     }
17     crc = c;
18     return c ^ 0xffffffffL;
19 }

updcrc has at least five basic-blocks. One is the function itself. The if statement on line 9 generates two more basic-blocks, one for each branch of the if. A fourth basic-block results from the if on line 13, and the contents of the do loop form the fifth basic-block. The compiler may also generate additional basic-blocks to handle various special cases.

A program augmented for basic-block counting can be analyzed with ‘gprof -l -A’. The ‘-x’ option is also helpful, to ensure that each line of code is labeled at least once. Here is updcrc’s annotated source listing for a sample gzip run:

                ulg updcrc(s, n)
                    uch *s;
                    unsigned n;
            2 ->{
                    register ulg c;

                    static ulg crc = (ulg)0xffffffffL;

            2 ->    if (s == NULL) {
            1 ->        c = 0xffffffffL;
            1 ->    } else {
            1 ->        c = crc;
            1 ->        if (n) do {
        26312 ->            c = crc_32_tab[...];
26312,1,26311 ->        } while (--n);
                    }
            2 ->    crc = c;
            2 ->    return c ^ 0xffffffffL;
            2 ->}

In this example, the function was called twice, passing once through each branch of the if statement. The body of the do loop was executed a total of 26312 times. Note how the while statement is annotated. It began execution 26312 times, once for each iteration through the loop. One of those times (the last time) it exited, while it branched back to the beginning of the loop 26311 times.

6.1 Statistical Sampling Error

The run-time figures that gprof gives you are based on a sampling process, so they are subject to statistical inaccuracy. If a function runs only a small amount of time, so that on the average the sampling process ought to catch that function in the act only once, there is a pretty good chance it will actually find that function zero times, or twice.

By contrast, the number-of-calls and basic-block figures are derived by counting, not sampling. They are completely accurate and will not vary from run to run if your program is deterministic and single threaded. In multi-threaded applications, or single threaded applications that link with multi-threaded libraries, the counts are only deterministic if the counting function is thread-safe. (Note: beware that the mcount counting function in glibc is not thread-safe). See Implementation of Profiling.

The sampling period that is printed at the beginning of the flat profile says how often samples are taken. The rule of thumb is that a run-time figure is accurate if it is considerably bigger than the sampling period.

The actual amount of error can be predicted. For n samples, the expected error is the square-root of n. For example, if the sampling period is 0.01 seconds and foo’s run-time is 1 second, n is 100 samples (1 second/0.01 seconds), sqrt(n) is 10 samples, so the expected error in foo’s run-time is 0.1 seconds (10*0.01 seconds), or ten percent of the observed value. Again, if the sampling period is 0.01 seconds and bar’s run-time is 100 seconds, n is 10000 samples, sqrt(n) is 100 samples, so the expected error in bar’s run-time is 1 second, or one percent of the observed value. It is likely to vary this much on the average from one profiling run to the next. (Sometimes it will vary more.)

This does not mean that a small run-time figure is devoid of information. If the program’s total run-time is large, a small run-time for one function does tell you that that function used an insignificant fraction of the whole program’s time. Usually this means it is not worth optimizing.

One way to get more accuracy is to give your program more (but similar) input data so it will take longer. Another way is to combine the data from several runs, using the ‘-s’ option of gprof. Here is how:

1. Run your program once.
2. Issue the command ‘mv gmon.out gmon.sum’.
3. Run your program again, the same as before.
4. Merge the new data in gmon.out into gmon.sum with this command:

   gprof -s executable-file gmon.out gmon.sum
   

5. Repeat the last two steps as often as you wish.
6. Analyze the cumulative data using this command:

   gprof executable-file gmon.sum > output-file
   

6.2 Estimating children Times

Some of the figures in the call graph are estimates—for example, the children time values and all the time figures in caller and subroutine lines.

There is no direct information about these measurements in the profile data itself. Instead, gprof estimates them by making an assumption about your program that might or might not be true.

The assumption made is that the average time spent in each call to any function foo is not correlated with who called foo. If foo used 5 seconds in all, and 2/5 of the calls to foo came from a, then foo contributes 2 seconds to a’s children time, by assumption.

This assumption is usually true enough, but for some programs it is far from true. Suppose that foo returns very quickly when its argument is zero; suppose that a always passes zero as an argument, while other callers of foo pass other arguments. In this program, all the time spent in foo is in the calls from callers other than a. But gprof has no way of knowing this; it will blindly and incorrectly charge 2 seconds of time in foo to the children of a.

We hope some day to put more complete data into gmon.out, so that this assumption is no longer needed, if we can figure out how. For the novice, the estimated figures are usually more useful than misleading.

9.1 Implementation of Profiling

Profiling works by changing how every function in your program is compiled so that when it is called, it will stash away some information about where it was called from. From this, the profiler can figure out what function called it, and can count how many times it was called. This change is made by the compiler when your program is compiled with the ‘-pg’ option, which causes every function to call mcount (or _mcount, or __mcount, depending on the OS and compiler) as one of its first operations.

The mcount routine, included in the profiling library, is responsible for recording in an in-memory call graph table both its parent routine (the child) and its parent’s parent. This is typically done by examining the stack frame to find both the address of the child, and the return address in the original parent. Since this is a very machine-dependent operation, mcount itself is typically a short assembly-language stub routine that extracts the required information, and then calls __mcount_internal (a normal C function) with two arguments—frompc and selfpc. __mcount_internal is responsible for maintaining the in-memory call graph, which records frompc, selfpc, and the number of times each of these call arcs was traversed.

GCC Version 2 provides a magical function (__builtin_return_address), which allows a generic mcount function to extract the required information from the stack frame. However, on some architectures, most notably the SPARC, using this builtin can be very computationally expensive, and an assembly language version of mcount is used for performance reasons.

Number-of-calls information for library routines is collected by using a special version of the C library. The programs in it are the same as in the usual C library, but they were compiled with ‘-pg’. If you link your program with ‘gcc … -pg’, it automatically uses the profiling version of the library.

Profiling also involves watching your program as it runs, and keeping a histogram of where the program counter happens to be every now and then. Typically the program counter is looked at around 100 times per second of run time, but the exact frequency may vary from system to system.

This is done is one of two ways. Most UNIX-like operating systems provide a profil() system call, which registers a memory array with the kernel, along with a scale factor that determines how the program’s address space maps into the array. Typical scaling values cause every 2 to 8 bytes of address space to map into a single array slot. On every tick of the system clock (assuming the profiled program is running), the value of the program counter is examined and the corresponding slot in the memory array is incremented. Since this is done in the kernel, which had to interrupt the process anyway to handle the clock interrupt, very little additional system overhead is required.

However, some operating systems, most notably Linux 2.0 (and earlier), do not provide a profil() system call. On such a system, arrangements are made for the kernel to periodically deliver a signal to the process (typically via setitimer()), which then performs the same operation of examining the program counter and incrementing a slot in the memory array. Since this method requires a signal to be delivered to user space every time a sample is taken, it uses considerably more overhead than kernel-based profiling. Also, due to the added delay required to deliver the signal, this method is less accurate as well.

A special startup routine allocates memory for the histogram and either calls profil() or sets up a clock signal handler. This routine (monstartup) can be invoked in several ways. On Linux systems, a special profiling startup file gcrt0.o, which invokes monstartup before main, is used instead of the default crt0.o. Use of this special startup file is one of the effects of using ‘gcc … -pg’ to link. On SPARC systems, no special startup files are used. Rather, the mcount routine, when it is invoked for the first time (typically when main is called), calls monstartup.

If the compiler’s ‘-a’ option was used, basic-block counting is also enabled. Each object file is then compiled with a static array of counts, initially zero. In the executable code, every time a new basic-block begins (i.e., when an if statement appears), an extra instruction is inserted to increment the corresponding count in the array. At compile time, a paired array was constructed that recorded the starting address of each basic-block. Taken together, the two arrays record the starting address of every basic-block, along with the number of times it was executed.

The profiling library also includes a function (mcleanup) which is typically registered using atexit() to be called as the program exits, and is responsible for writing the file gmon.out. Profiling is turned off, various headers are output, and the histogram is written, followed by the call-graph arcs and the basic-block counts.

The output from gprof gives no indication of parts of your program that are limited by I/O or swapping bandwidth. This is because samples of the program counter are taken at fixed intervals of the program’s run time. Therefore, the time measurements in gprof output say nothing about time that your program was not running. For example, a part of the program that creates so much data that it cannot all fit in physical memory at once may run very slowly due to thrashing, but gprof will say it uses little time. On the other hand, sampling by run time has the advantage that the amount of load due to other users won’t directly affect the output you get.

9.2 Profiling Data File Format

The old BSD-derived file format used for profile data does not contain a magic cookie that allows one to check whether a data file really is a gprof file. Furthermore, it does not provide a version number, thus rendering changes to the file format almost impossible. GNU gprof uses a new file format that provides these features. For backward compatibility, GNU gprof continues to support the old BSD-derived format, but not all features are supported with it. For example, basic-block execution counts cannot be accommodated by the old file format.

The new file format is defined in header file gmon_out.h. It consists of a header containing the magic cookie and a version number, as well as some spare bytes available for future extensions. All data in a profile data file is in the native format of the target for which the profile was collected. GNU gprof adapts automatically to the byte-order in use.

In the new file format, the header is followed by a sequence of records. Currently, there are three different record types: histogram records, call-graph arc records, and basic-block execution count records. Each file can contain any number of each record type. When reading a file, GNU gprof will ensure records of the same type are compatible with each other and compute the union of all records. For example, for basic-block execution counts, the union is simply the sum of all execution counts for each basic-block.

• Histogram Records
• Call-Graph Records
• Basic-Block Execution Count Records

9.3 gprof’s Internal Operation

Like most programs, gprof begins by processing its options. During this stage, it may building its symspec list (sym_ids.c:sym_id_add), if options are specified which use symspecs. gprof maintains a single linked list of symspecs, which will eventually get turned into 12 symbol tables, organized into six include/exclude pairs—one pair each for the flat profile (INCL_FLAT/EXCL_FLAT), the call graph arcs (INCL_ARCS/EXCL_ARCS), printing in the call graph (INCL_GRAPH/EXCL_GRAPH), timing propagation in the call graph (INCL_TIME/EXCL_TIME), the annotated source listing (INCL_ANNO/EXCL_ANNO), and the execution count listing (INCL_EXEC/EXCL_EXEC).

After option processing, gprof finishes building the symspec list by adding all the symspecs in default_excluded_list to the exclude lists EXCL_TIME and EXCL_GRAPH, and if line-by-line profiling is specified, EXCL_FLAT as well. These default excludes are not added to EXCL_ANNO, EXCL_ARCS, and EXCL_EXEC.

Next, the BFD library is called to open the object file, verify that it is an object file, and read its symbol table (core.c:core_init), using bfd_canonicalize_symtab after mallocing an appropriately sized array of symbols. At this point, function mappings are read (if the ‘--file-ordering’ option has been specified), and the core text space is read into memory (if the ‘-c’ option was given).

gprof’s own symbol table, an array of Sym structures, is now built. This is done in one of two ways, by one of two routines, depending on whether line-by-line profiling (‘-l’ option) has been enabled. For normal profiling, the BFD canonical symbol table is scanned. For line-by-line profiling, every text space address is examined, and a new symbol table entry gets created every time the line number changes. In either case, two passes are made through the symbol table—one to count the size of the symbol table required, and the other to actually read the symbols. In between the two passes, a single array of type Sym is created of the appropriate length. Finally, symtab.c:symtab_finalize is called to sort the symbol table and remove duplicate entries (entries with the same memory address).

The symbol table must be a contiguous array for two reasons. First, the qsort library function (which sorts an array) will be used to sort the symbol table. Also, the symbol lookup routine (symtab.c:sym_lookup), which finds symbols based on memory address, uses a binary search algorithm which requires the symbol table to be a sorted array. Function symbols are indicated with an is_func flag. Line number symbols have no special flags set. Additionally, a symbol can have an is_static flag to indicate that it is a local symbol.

With the symbol table read, the symspecs can now be translated into Syms (sym_ids.c:sym_id_parse). Remember that a single symspec can match multiple symbols. An array of symbol tables (syms) is created, each entry of which is a symbol table of Syms to be included or excluded from a particular listing. The master symbol table and the symspecs are examined by nested loops, and every symbol that matches a symspec is inserted into the appropriate syms table. This is done twice, once to count the size of each required symbol table, and again to build the tables, which have been malloced between passes. From now on, to determine whether a symbol is on an include or exclude symspec list, gprof simply uses its standard symbol lookup routine on the appropriate table in the syms array.

Now the profile data file(s) themselves are read (gmon_io.c:gmon_out_read), first by checking for a new-style ‘gmon.out’ header, then assuming this is an old-style BSD ‘gmon.out’ if the magic number test failed.

New-style histogram records are read by hist.c:hist_read_rec. For the first histogram record, allocate a memory array to hold all the bins, and read them in. When multiple profile data files (or files with multiple histogram records) are read, the memory ranges of each pair of histogram records must be either equal, or non-overlapping. For each pair of histogram records, the resolution (memory region size divided by the number of bins) must be the same. The time unit must be the same for all histogram records. If the above containts are met, all histograms for the same memory range are merged.

As each call graph record is read (call_graph.c:cg_read_rec), the parent and child addresses are matched to symbol table entries, and a call graph arc is created by cg_arcs.c:arc_add, unless the arc fails a symspec check against INCL_ARCS/EXCL_ARCS. As each arc is added, a linked list is maintained of the parent’s child arcs, and of the child’s parent arcs. Both the child’s call count and the arc’s call count are incremented by the record’s call count.

Basic-block records are read (basic_blocks.c:bb_read_rec), but only if line-by-line profiling has been selected. Each basic-block address is matched to a corresponding line symbol in the symbol table, and an entry made in the symbol’s bb_addr and bb_calls arrays. Again, if multiple basic-block records are present for the same address, the call counts are cumulative.

A gmon.sum file is dumped, if requested (gmon_io.c:gmon_out_write).

If histograms were present in the data files, assign them to symbols (hist.c:hist_assign_samples) by iterating over all the sample bins and assigning them to symbols. Since the symbol table is sorted in order of ascending memory addresses, we can simple follow along in the symbol table as we make our pass over the sample bins. This step includes a symspec check against INCL_FLAT/EXCL_FLAT. Depending on the histogram scale factor, a sample bin may span multiple symbols, in which case a fraction of the sample count is allocated to each symbol, proportional to the degree of overlap. This effect is rare for normal profiling, but overlaps are more common during line-by-line profiling, and can cause each of two adjacent lines to be credited with half a hit, for example.

If call graph data is present, cg_arcs.c:cg_assemble is called. First, if ‘-c’ was specified, a machine-dependent routine (find_call) scans through each symbol’s machine code, looking for subroutine call instructions, and adding them to the call graph with a zero call count. A topological sort is performed by depth-first numbering all the symbols (cg_dfn.c:cg_dfn), so that children are always numbered less than their parents, then making a array of pointers into the symbol table and sorting it into numerical order, which is reverse topological order (children appear before parents). Cycles are also detected at this point, all members of which are assigned the same topological number. Two passes are now made through this sorted array of symbol pointers. The first pass, from end to beginning (parents to children), computes the fraction of child time to propagate to each parent and a print flag. The print flag reflects symspec handling of INCL_GRAPH/EXCL_GRAPH, with a parent’s include or exclude (print or no print) property being propagated to its children, unless they themselves explicitly appear in INCL_GRAPH or EXCL_GRAPH. A second pass, from beginning to end (children to parents) actually propagates the timings along the call graph, subject to a check against INCL_TIME/EXCL_TIME. With the print flag, fractions, and timings now stored in the symbol structures, the topological sort array is now discarded, and a new array of pointers is assembled, this time sorted by propagated time.

Finally, print the various outputs the user requested, which is now fairly straightforward. The call graph (cg_print.c:cg_print) and flat profile (hist.c:hist_print) are regurgitations of values already computed. The annotated source listing (basic_blocks.c:print_annotated_source) uses basic-block information, if present, to label each line of code with call counts, otherwise only the function call counts are presented.

The function ordering code is marginally well documented in the source code itself (cg_print.c). Basically, the functions with the most use and the most parents are placed first, followed by other functions with the most use, followed by lower use functions, followed by unused functions at the end.

9.4 Debugging gprof

If gprof was compiled with debugging enabled, the ‘-d’ option triggers debugging output (to stdout) which can be helpful in understanding its operation. The debugging number specified is interpreted as a sum of the following options:

2 - Topological sort

Monitor depth-first numbering of symbols during call graph analysis

4 - Cycles

Shows symbols as they are identified as cycle heads

16 - Tallying

As the call graph arcs are read, show each arc and how the total calls to each function are tallied

32 - Call graph arc sorting

Details sorting individual parents/children within each call graph entry

64 - Reading histogram and call graph records

Shows address ranges of histograms as they are read, and each call graph arc

128 - Symbol table

Reading, classifying, and sorting the symbol table from the object file. For line-by-line profiling (‘-l’ option), also shows line numbers being assigned to memory addresses.

256 - Static call graph

Trace operation of ‘-c’ option

512 - Symbol table and arc table lookups

Detail operation of lookup routines

1024 - Call graph propagation

Shows how function times are propagated along the call graph

2048 - Basic-blocks

Shows basic-block records as they are read from profile data (only meaningful with ‘-l’ option)

4096 - Symspecs

Shows symspec-to-symbol pattern matching operation

8192 - Annotate source

Tracks operation of ‘-A’ option