PROFIL(2) | System Calls Manual | PROFIL(2)

# NAME

`profil` — control process profiling

# SYNOPSIS

`#include <unistd.h>`

int
`profil`(void *buf, size_t buflen, size_t samplesize, u_long offset, u_int scale, int dirfd);

# DESCRIPTION

The `profil`() function is only available inside programs compiled with the `-pg` compiler / linker option. `-pg` selects the profiling version of the C-run-time code (gcrt0.o), which places an ELF note into the binary which enables the system call. The profiling subsystem only works with static binaries, so the `-static` link option is also required.

The first call to `profil`() happens at startup inside gcrt0.o and sets up a region of memory buf that is buflen bytes long to contain a struct gmonhdr, a samples buffer of size samplesize, and a sufficiently-sized arc-table.

dirfd can indicate the path for placing the output file (environment variable `PROFDIR` is the usual choice). Otherwise, -1 indicates the current (starting) directory location.

Program execution then continues with profiling operational. During execution, profiling can be selectively stopped and restarted using moncontrol(3).

While profiling is enabled, at every clock tick, the kernel updates an appropriate count in the samples buffer.

The samples buffer contains samplesize bytes and is divided into a series of 16-bit bins. Each bin counts the number of times the program counter was in a particular address range in the process when a clock tick occurred while profiling was enabled. For a given program counter address, the number of the corresponding bin is given by the relation:

    [(pc - offset) / 2] * scale / 65536

The offset parameter is the lowest address at which the kernel takes program counter samples. The scale parameter ranges from 1 to 65536 and can be used to change the span of the bins. A scale of 65536 maps each bin to 2 bytes of address range; a scale of 32768 gives 4 bytes, 16384 gives 8 bytes and so on. Intermediate values provide approximate intermediate ranges. A scale value of 0 disables profiling.

At normal program termination, the C-run-time completes the data in the buffer to final format, and proceeds into _exit(2). The kernel then constructs a pathname gmon.progname.pid.out and stores the data to the filesystem (either at the starting directory, or the optional directory indicated by the environment variable `PROFDIR`).

Further processing is then done using gprof(1).

# RETURN VALUES

Upon successful completion, the value 0 is returned; otherwise the value -1 is returned and the global variable errno is set to indicate the error.

# FILES

/usr/lib/gcrt0.o
  profiling C run-time startup file
gmon.progname.pid.out
  conventional name for profiling output file

# ERRORS

The following error may be reported:

[`EPERM`]
  The program was not linked with `-pg`.
[`EALREADY`]
  An attempt was made to change the profile buffer.
[`EBADF`]
  The dirfd argument is not a valid file descriptor.
[`ENOTDIR`]
  The dirfd argument does not refer to a directory.
[`EINVAL`]
  The scale value is too large.

# SEE ALSO

gprof(1)

# HISTORY

The `profil`() system call first appeared in Version 5 AT&T UNIX.

Historically, profile information was written to the file by the C-run-time exit processing code using open(2), write(2), and such — which is incompatible with modern privilege separation practices like chroot(2), pledge(2), setresuid(2), and unveil(2). This replacement `profil`() interface was redesigned so the kernel writes out the profiling information on behalf of the terminating process.

# BUGS

The samples argument should really be a vector of type unsigned short.

July 13, 2025 | Debian