readprofile

readprofile [OPTIONS] [profile_file]

-m
    Specifies an alternative kernel map file (e.g., System.map) for symbol resolution instead of /proc/kallsyms.

-p
    Prints the profile counts as percentages of the total.

-i
    Prints counts as intervals, showing the frequency of hits within ranges.

-n
    Suppresses symbol lookup, printing raw addresses instead of symbolic names.

-v
    Enables verbose output, displaying additional information like the profile buffer size and symbols used.

-a
    Shows all entries, including those with zero profile counts.

-b
    Shows basic block counts (if enabled in kernel profiling).

-s
    Sorts the output based on profile counts (descending by default).

-z
    Zeros the profile counters after reading them. Requires write access to /proc/profile.

-r
    Resets the entire profile buffer (equivalent to echo -1 > /proc/profile). Requires write access.

-f
    Prints the output in a format suitable for external plotting tools.

-M
    Prints addresses as module name + offset, making it easier to identify module-specific hot spots.

profile_file
    Optional: Specifies an alternative profile data file to read from instead of the default /proc/profile.

readprofile is a utility used to extract and interpret raw kernel profiling information. It reads data from the /proc/profile pseudo-filesystem entry, which is populated by the Linux kernel's built-in profiler. This profiler, when enabled (via CONFIG_PROFILING during kernel compilation), tracks execution counts at various kernel addresses.

The command translates these raw memory addresses into human-readable symbolic names (like function names or module offsets) by consulting the kernel's symbol table, typically found in /proc/kallsyms or an external System.map file. By analyzing the frequency of execution at different kernel locations, system administrators and developers can identify performance bottlenecks and understand where the kernel spends most of its processing time. While more sophisticated tools like perf and oprofile are now widely used, readprofile provides a direct and simple way to access the kernel's own profiling data for quick insights.

readprofile relies on the kernel's profiling feature being enabled (CONFIG_PROFILING compiled into the kernel). Without this, /proc/profile will not exist or contain useful data.

Symbol resolution requires access to /proc/kallsyms or a specified System.map file, which may require root privileges. For persistent and advanced profiling, modern tools like perf or oprofile are generally preferred over the basic /proc/profile interface.

For readprofile to function, the Linux kernel must be compiled with profiling support (CONFIG_PROFILING=y). Additionally, the profiling mechanism can often be controlled via sysctl parameters, such as kernel.perf_event_paranoid, although readprofile specifically interacts with the older /proc/profile interface.

The System.map file is a crucial component for readprofile to translate raw memory addresses into meaningful function names. It contains a list of kernel symbols and their corresponding memory addresses. If /proc/kallsyms is not available or incomplete, specifying the correct System.map file (often located in /boot/) with the -m option is essential for accurate symbol resolution.

readprofile has been a long-standing utility within the Linux ecosystem, typically distributed as part of the util-linux package. It emerged as a fundamental tool for basic kernel performance analysis, directly interacting with the kernel's internal profiling buffer via the /proc filesystem. Its usage predates the widespread adoption of more comprehensive and feature-rich profiling frameworks like perf, serving as an accessible initial point for understanding kernel execution patterns.

perf(1), oprofile(1), kallsyms(5), proc(5), sysctl(8)