Method and system for compensating for output overhead in trace date using trace record information

[0002] This application is a continuation-in-part of the following copending and commonly assigned applications entitled “SYSTEM AND METHOD FOR PROVIDING TRACE INFORMATION REDUCTION”, U.S. application Ser. No. 08/989,725, filed on Dec. 12, 1997, now U.S. Pat. No. 6,055,492; “A METHOD AND APPARATUS FOR STRUCTURED PROFILING OF DATA PROCESSING SYSTEMS AND APPLICATIONS”, U.S. application Ser. No. 09/052,329, filed on Mar. 31, 1998, now U.S. Pat. No. 6,003,872; “METHOD AND APPARATUS FOR PROFILING PROCESSES IN A DATA PROCESSING SYSTEM”, U.S. application Ser. No. 09/177,031, filed on Oct. 22, 1998, now U.S. Pat. No. 6,311,325; “PROCESS AND SYSTEM FOR MERGING TRACE DATA FOR PRIMARILY INTERPRETED METHODS”, U.S. application Ser. No. 09/343,439, currently pending, filed on Jun. 30, 1999; and “METHOD AND SYSTEM FOR MERGING EVENT-BASED DATA AND SAMPLED DATA INTO POSTPROCESSED TRACE OUTPUT”, U.S. application Ser. No. 09/343,438, filed on Jun. 30, 1999.

[0003] The present invention is related to the following applications entitled “METHOD AND SYSTEM FOR COMPENSATING FOR INSTRUMENTATION OVERHEAD IN TRACE DATA BY COMPUTING AVERAGE MINIMUM EVENT TIMES”, U.S. application Ser. No. 09/393,088, filed on Sep. 9, 1999, now U.S. Pat. No. 6,349,406; “METHOD AND SYSTEM FOR COMPENSATING FOR INSTRUMENTATION OVERHEAD IN TRACE DATA BY DETECTING MINIMUM EVENT TIMES”, U.S. application Ser. No. 09/393,086, filed on Sep. 9, 1999; “METHOD AND SYSTEM FOR COMPENSATING FOR OUTPUT OVERHEAD IN TRACE DATA USING INITIAL CALIBRATION INFORMATION”, U.S. application Ser. No. 09/414,345, filed on Oct. 7, 1999; “METHOD AND SYSTEM FOR COMPENSATING FOR OUTPUT OVERHEAD IN TRACE DATA USING JOB-ORIENTED CALIBRATION INFORMATION”, U.S. application Ser. No. 09/414,346, filed on Oct. 7, 1999; all of which are assigned to the same assignee. The present application is also related to “A METHOD AND APPARATUS FOR STRUCTURED MEMORY ANALYSIS OF DATA PROCESSING SYSTEMS AND APPLICATIONS,” U.S. Pat. application Ser. No. 09/052,331, filed Mar. 31, 1998, now U.S. Pat. No. 6,158,024, which is hereby incorporated by reference.

[0004] 1. Technical Field

[0005] The present invention relates to an improved data processing system and, in particular, to a method and apparatus for optimizing performance in a data processing system. Still more particularly, the present invention provides a method and apparatus for a software program development tool for enhancing performance of a software program through software profiling.

[0006] 2. Description of Related Art

[0007] In analyzing and enhancing performance of a data processing system and the applications executing within the data processing system, it is helpful to know which software modules within a data processing system are using system resources. Effective management and enhancement of data processing systems requires knowing how and when various system resources are being used. Performance tools are used to monitor and examine a data processing system to determine resource consumption as various software applications are executing within the data processing system. For example, a performance tool may identify the most frequently executed modules and instructions in a data processing system, or may identify those modules which allocate the largest amount of memory or perform the most I/O requests. Hardware performance tools may be built into the system or added at a later point in time. Software performance tools also are useful in data processing systems, such as personal computer systems, which typically do not contain many, if any, built-in hardware performance tools.

[0008] One known software performance tool is a trace tool. A trace tool may use more than one technique to provide trace information that indicates execution flows for an executing program. One technique keeps track of particular sequences of instructions by logging certain events as they occur, so-called event-based profiling technique. For example, a trace tool may log every entry into, and every exit from, a module, subroutine, method, function, or system component. Alternately, a trace tool may log the requester and the amounts of memory allocated for each memory allocation request. Typically, a time-stamped record is produced for each such event. Corresponding pairs of records similar to entry-exit records also are used to trace execution of arbitrary code segments, starting and completing I/O or data transmission, and for many other events of interest.

[0009] In order to improve performance of code generated by various families of computers, it is often necessary to determine where time is being spent by the processor in executing code, such efforts being commonly known in the computer processing arts as locating “hot spots.” Ideally, one would like to isolate such hot spots at the instruction and/or source line of code level in order to focus attention on areas which might benefit most from improvements to the code.

[0010] Another trace technique involves program sampling to identify certain locations in programs in which the programs appear to spend large amounts of time. This technique is based on the idea of interrupting the application or data processing system execution at regular intervals, so-called sample-based profiling. At each interruption, the program counter of the currently executing thread, a process that is part of a larger process or program, is recorded. Typically, these tools capture values that are resolved against a load map and symbol table information for the data processing system at post-processing time, and a profile of where the time is being spent is obtained from this analysis.

[0011] For example, isolating such hot spots down to the instruction level permits compiler writers to find significant areas of suboptimal code generation, at which they may focus their efforts to improve code generation efficiency. Another potential use of instruction level detail is to provide guidance to the designer of future systems. Such designers employ profiling tools to find characteristic code sequences and/or single instructions that require optimization for the available software for a given type of hardware.

[0012] There are often costs associated with measuring a system in that the measurement itself perturbs the system. This effect is well understood in the study of elementary particle physics and is known as the Heisenberg uncertainty principle. With software tracing, the cost associated with the tracing can severely affect the system being profiled. The effect can range from disruption of the cache and the instruction pipeline to more mundane effects such as the overhead associated with the tracing.

[0013] Although the writing of a single trace record may require a relatively short amount of time, the profiling process may cause the writing of thousands of trace records. The total amount of time spent outputting the trace records may then grow to a significant percentage of the time that may be attributed to particular routines. If such output overhead time is not determined and the execution times of the routines are not compensated for this overhead time, then the profile of the execution of the program may contain significant distortion as to the time spent within various routines. If the overhead time is significant, as compared to the time spent within the routine being measured, a significant distortation in the results would be realized if not compensated.

[0014] Therefore, it would be particularly advantageous to provide a method and system for determining the amount of output overhead incurred during the profiling of a program and for compensating for the overhead during post-processing.

[0015] A method and system for compensating for output overhead in trace data is provided by analyzing and compensating for the overhead associated with outputting trace information to a trace buffer or a trace file in the form of trace records. A trace record represents an occurrence of some profiling event of interest. Each trace record contains a starting timestamp representing the time at which the generation of the trace record was commenced and an ending timestamp representing the time at which the generation of the trace record was completed. In order to compute the period of execution time attributable to the application program or system being profiled, a starting timestamp of a trace record is compared with the ending timestamp of a preceding trace record, and the difference between the timestamps is directly related to the execution time of the application program or system being profiled. The time period between the timestamps in a trace record is implicitly disregarded as attributable to overhead in the generation of trace records.

[0016] The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:

[0017] FIG. 1 depicts a distributed data processing system in which the present invention may be implemented;

[0018] FIG. 2A-2B are block diagrams depicting a data processing system in which the present invention may be implemented;

[0019] FIG. 3A is a block diagram depicting the relationship of software components operating within a computer system that may implement the present invention;

[0020] FIG. 3B is a block diagram depicting a Java virtual machine in accordance with a preferred embodiment of the present invention;

[0021] FIG. 4 is a block diagram depicting components used to profile processes in a data processing system;

[0022] FIG. 5 is an illustration depicting various phases in profiling the active processes in an operating system;

[0023] FIG. 6 is a flowchart depicting a process used by a trace program for generating trace records from processes executing on a data processing system;

[0024] FIG. 7 is a flowchart depicting a process used in a system interrupt handler trace hook;

[0025] FIG. 8 is a diagram depicting the call stack containing stack frames;

[0026] FIG. 9 is an illustration depicting a call stack sample;

[0027] FIG. 10A is a diagram depicting a program execution sequence along with the state of the call stack at each function entry/exit point;

[0028] FIG. 10B is a diagram depicting a particular timer based sampling of the execution flow depicted in FIG. 10A;

[0029] FIG. 10C-10D are time charts providing an example of the types of time for which the profiling tool accounts;

[0030] FIG. 11A is a diagram depicting a tree structure generated from trace data;

[0031] FIG. 11B is a diagram depicting a call stack tree which reflects call stacks observed during system execution;

[0032] FIG. 12 is a table depicting a call stack tree;

[0033] FIG. 13 is a flow chart depicting a method for building a call stack tree using a trace text file as input;

[0034] FIG. 14 is a flow chart depicting a method for building a call stack tree dynamically as tracing is taking place during system execution;

[0035] FIG. 15 is a diagram depicting a structured profile obtained using the processes of the present invention;

[0036] FIG. 16 is a diagram depicting a record generated using the processes of present invention;

[0037] FIG. 17 is a diagram depicting another type of report that may be produced to show the calling structure between routines shown in FIG. 12;

[0038] FIG. 18 is a table depicting a report generated from a trace file containing both event-based profiling information (method entry/exits) and sample-based profiling information (stack unwinds);

[0039] FIG. 19A-19B are tables depicting major codes and minor codes that may be employed to instrument modules for profiling;

[0040] FIG. 20A is a flowchart depicting a summary of the manner in which elapsed time is attributed to various routines in an execution flow;

[0041] FIG. 20B is a timeline depicting demarcated time points with which the process in FIG. 20A is concerned;

[0042] FIGS. 21A-E are illustrations depicting a trace record format that contains information from which compensation information may be obtained for compensating for trace record generation overhead;

[0043] FIG. 22A is a flowchart depicting a process for generating a self-calibrating trace record;

[0044] FIG. 22B is a flowchart depicting a process for generating a self-calibrating trace record using a trace card;

[0045] FIG. 23A is a flowchart depicting a process for compensating for trace record generation overhead using self-calibrating trace records; and

[0046] FIG. 23B is a timeline depicting the time points with which the process within FIG. 23A is concerned.

[0047] With reference now to the figures, and in particular with reference to FIG. 1, a pictorial representation of a distributed data processing system in which the present invention may be implemented is depicted.

[0048] Distributed data processing system 100 is a network of computers in which the present invention may be implemented. Distributed data processing system 100 contains a network 102, which is the medium used to provide communications links between various devices and computers connected together within distributed data processing system 100. Network 102 may include permanent connections, such as wire or fiber optic cables, or temporary connections made through telephone connections.

[0049] In the depicted example, a server 104 is connected to network 102 along with storage unit 106. In addition, clients 108, 110, and 112 also are connected to a network 102. These clients 108, 110, and 112 may be, for example, personal computers or network computers. For purposes of this application, a network computer is any computer, coupled to a network, which receives a program or other application from another computer coupled to the network. In the depicted example, server 104 provides data, such as boot files, operating system images, and applications to clients 108-112. Clients 108, 110, and 112 are clients to server 104. Distributed data processing system 100 may include additional servers, clients, and other devices not shown. In the depicted example, distributed data processing system 100 is the Internet with network 102 representing a worldwide collection of networks and gateways that use the TCP/IP suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, consisting of thousands of commercial, government, educational, and other computer systems, that route data and messages. Of course, distributed data processing system 100 also may be implemented as a number of different types of networks, such as, for example, an Intranet or a local area network.

[0050] FIG. 1 is intended as an example, and not as an architectural limitation for the processes of the present invention.

[0051] With reference now to FIG. 2A, a block diagram of a data processing system which may be implemented as a server, such as server 104 in FIG. 1, is depicted in accordance to the present invention. Data processing system 200 may be a symmetric multiprocessor (SMP) system including a plurality of processors 202 and 204 connected to system bus 206. Alternatively, a single processor system may be employed. Also connected to system bus 206 is memory controller/cache 208, which provides an interface to local memory 209. I/O Bus Bridge 210 is connected to system bus 206 and provides an interface to I/O bus 212. Memory controller/cache 208 and I/O Bus Bridge 210 may be integrated as depicted.

[0052] Peripheral component interconnect (PCI) bus bridge 214 connected to I/O bus 212 provides an interface to PCI local bus 216. A modem 218 may be connected to PCI local bus 216. Typical PCI bus implementations will support four PCI expansion slots or add-in connectors. Communications links to network computers 108-112 in FIG. 1 may be provided through modem 218 and network adapter 220 connected to PCI local bus 216 through add-in boards.

[0053] Additional PCI bus bridges 222 and 224 provide interfaces for additional PCI buses 226 and 228, from which additional modems or network adapters may be supported. In this manner, server 200 allows connections to multiple network computers. A memory mapped graphics adapter 230 and hard disk 232 may also be connected to I/O bus 212 as depicted, either directly or indirectly.

[0054] Those of ordinary skill in the art will appreciate that the hardware depicted in FIG. 2A may vary. For example, other peripheral devices, such as optical disk drive and the like also may be used in addition or in place of the hardware depicted. The depicted example is not meant to imply architectural limitations with respect to the present invention.

[0055] The data processing system depicted in FIG. 2A may be, for example, an IBM RISC/System 6000 system, a product of International Business Machines Corporation in Armonk, N.Y., running the Advanced Interactive Executive (AIX) operating system.

[0056] With reference now to FIG. 2B, a block diagram of a data processing system in which the present invention may be implemented is illustrated. Data processing system 250 is an example of a client computer. Data processing system 250 employs a peripheral component interconnect (PCI) local bus architecture. Although the depicted example employs a PCI bus, other bus architectures such as Micro Channel and ISA may be used. Processor 252 and main memory 254 are connected to PCI local bus 256 through PCI Bridge 258. PCI Bridge 258 also may include an integrated memory controller and cache memory for processor 252. Additional connections to PCI local bus 256 may be made through direct component interconnection or through add-in boards. In the depicted example, local area network (LAN) adapter 260, SCSI host bus adapter 262, and expansion bus interface 264 are connected to PCI local bus 256 by direct component connection. In contrast, audio adapter 266, graphics adapter 268, and audio/video adapter (A/V) 269 are connected to PCI local bus 266 by add-in boards inserted into expansion slots. Expansion bus interface 264 provides a connection for a keyboard and mouse adapter 270, modem 272, and additional memory 274. SCSI host bus adapter 262 provides a connection for hard disk drive 276, tape drive 278, and CD-ROM 280 in the depicted example. Typical PCI local bus implementations will support three or four PCI expansion slots or add-in connectors.

[0057] An operating system runs on processor 252 and is used to coordinate and provide control of various components within data processing system 250 in FIG. 2B. The operating system may be a commercially available operating system such as JavaOS For Business™ or OS/2™, which are available from International Business Machines Corporation™. JavaOS is loaded from a server on a network to a network client and supports Java programs and applets. A couple of characteristics of JavaOS that are favorable for performing traces with stack unwinds, as described below, are that JavaOS does not support paging or virtual memory. An object oriented programming system such as Java may run in conjunction with the operating system and may provide calls to the operating system from Java programs or applications executing on data processing system 250. Instructions for the operating system, the object-oriented operating system, and applications or programs are located on storage devices, such as hard disk drive 276 and may be loaded into main memory 254 for execution by processor 252. Hard disk drives are often absent and memory is constrained when data processing system 250 is used as a network client.

[0058] Those of ordinary skill in the art will appreciate that the hardware in FIG. 2B may vary depending on the implementation. For example, other peripheral devices, such as optical disk drives and the like may be used in addition to or in place of the hardware depicted in FIG. 2B. The depicted example is not meant to imply architectural limitations with respect to the present invention. For example, the processes of the present invention may be applied to a multiprocessor data processing system.

[0059] The present invention provides a process and system for profiling software applications. Although the present invention may operate on a variety of computer platforms and operating systems, it may also operate within a Java runtime environment. Hence, the present invention may operate in conjunction with a Java virtual machine (JVM) yet within the boundaries of a JVM as defined by Java standard specifications. In order to provide a context for the present invention, portions of the operation of a JVM according to Java specifications are herein described.

[0060] With reference now to FIG. 3A, a block diagram illustrates the relationship of software components operating within a computer system that may implement the present invention. Java-based system 300 contains platform specific operating'system 302 that provides hardware and system support to software executing on a specific hardware platform. JVM 304 is one software application that may execute in conjunction with the operating system. JVM 304 provides a Java run-time environment with the ability to execute Java application or applet 306, which is a program, servlet, or software component written in the Java programming language. The computer system in which JVM 304 operates may be similar to data processing system 200 or computer 100 described above. However, JVM 304 may be implemented in dedicated hardware on a so-called Java chip, Java-on-silicon, or Java processor with an embedded picoJava core.

[0061] At the center of a Java run-time environment is the JVM, which supports all aspects of Java's environment, including its architecture, security features, mobility across networks, and platform independence.

[0062] The JVM is a virtual computer, i.e. a computer that is specified abstractly. The specification defines certain features that every JVM must implement, with some range of design choices that may depend upon the platform on which the JVM is designed to execute. For example, all JVMs must execute Java bytecodes and may use a range of techniques to execute the instructions represented by the bytecodes. A JVM may be implemented completely in software or somewhat in hardware. This flexibility allows different JVMs to be designed for mainframe computers and PDAS.

[0063] The JVM is the name of a virtual computer component that actually executes Java programs. Java programs are not run directly by the central processor but instead by the JVM, which is itself a piece of software running on the processor. The JVM allows Java programs to be executed on a different platform as opposed to only the one platform for which the code was compiled. Java programs are compiled for the JVM. In this manner, Java is able to support applications for many types of data processing systems, which may contain a variety of central processing units and operating systems architectures. To enable a Java application to execute on different types of data processing systems, a compiler typically generates an architecture-neutral file format—the compiled code is executable on many processors, given the presence of the Java run-time system. The Java compiler generates bytecode instructions that are nonspecific to a particular computer architecture. A bytecode is a machine independent code generated by the Java compiler and executed by a Java interpreter. A Java interpreter is part of the JVM that alternately decodes and interprets a bytecode or bytecodes. These bytecode instructions are designed to be easy to interpret on any computer and easily translated on the fly into native machine code. Byte codes are may be translated into native code by a just-in-time compiler or JIT.

[0064] A JVM must load class files and execute the bytecodes within them. The JVM contains a class loader, which loads class files from an application and the class files from the Java application programming interfaces (APIs) which are needed by the application. The execution engine that executes the bytecodes may vary across platforms and implementations.

[0065] One type of software-based execution engine is a just-in-time compiler. With this type of execution, the bytecodes of a method are compiled to native machine code upon successful fulfillment of some type of criteria for jitting a method. The native machine code for the method is then cached and reused upon the next invocation of the method. The execution engine may also be implemented in hardware and embedded on a chip so that the Java bytecodes are executed natively. JVMs usually interpret bytecodes, but JVMs may also use other techniques, such as just-in-time compiling, to execute bytecodes.

[0066] Interpreting code provides an additional benefit. Rather than instrumenting the Java source code, the interpreter may be instrumented. Trace data may be generated via selected events and timers through the instrumented interpreter without modifying the source code. Profile instrumentation is discussed in more detail further below.

[0067] When an application is executed on a JVM that is implemented in software on a platform-specific operating system, a Java application may interact with the host operating system by invoking native methods. A Java method is written in the Java language, compiled to bytecodes, and stored in class files. A native method is written in some other language and compiled to the native machine code of a particular processor. Native methods are stored in a dynamically linked library whose exact form is platform specific.

[0068] With reference now to FIG. 3B, a block diagram of a JVM is depicted in accordance with a preferred embodiment of the present invention. JVM 350 includes a class loader subsystem 352, which is a mechanism for loading types, such as classes and interfaces, given fully qualified names. JVM 350 also contains runtime data areas 354, execution engine 356, native method interface 358, and memory management 374. Execution engine 356 is a mechanism for executing instructions contained in the methods of classes loaded by class loader subsystem 352. Execution engine 356 may be, for example, Java interpreter 362 or just-in-time compiler 360. Native method interface 358 allows access to resources in the underlying operating system. Native method interface 358 may be, for example, a Java native interface.

[0069] Runtime data areas 354 contain native method stacks 364, Java stacks 366, PC registers 368, method area 370, and heap 372. These different data areas represent the organization of memory needed by JVM 350 to execute a program.

[0070] Java stacks 366 are used to store the state of Java method invocations. When a new thread is launched, the JVM creates a new Java stack for the thread. The JVM performs only two operations directly on Java stacks: it pushes and pops frames. A thread's Java stack stores the state of Java method invocations for the thread. The state of a Java method invocation includes its local variables, the parameters with which it was invoked, its return value, if any, and intermediate calculations. Java stacks are composed of stack frames. A stack frame contains the state of a single Java method invocation. When a thread invokes a method, the JVM pushes a new frame onto the Java stack of the thread. When the method completes, the JVM pops the frame for that method and discards it. The JVM does not have any registers for holding intermediate values; any Java instruction that requires or produces an intermediate value uses the stack for holding the intermediate values. In this manner, the Java instruction set is well-defined for a variety of platform architectures.

[0071] PC registers 368 are used to indicate the next instruction to be executed. Each instantiated thread gets its own pc register (program counter) and Java stack. If the thread is executing a JVM method, the value of the pc register indicates the next instruction to execute. If the thread is executing a native method, then the contents of the pc register are undefined.

[0072] Native method stacks 364 store the state of invocations of native methods. The state of native method invocations is stored in an implementation-dependent way in native method stacks, registers, or other implementation-dependent memory areas. In some JVM implementations, native method stacks 364 and Java stacks 366 are combined.

[0073] Method area 370 contains class data while heap 372 contains all instantiated objects. The JVM specification strictly defines data types and operations. Most JVMs choose to have one method area and one heap, each of which are shared by all threads running inside the JVM. When the JVM loads a class file, it parses information about a type from the binary data contained in the class file. It places this type information into the method area. Each time a class instance or array is created, the memory for the new object is allocated from heap 372. JVM 350 includes an instruction that allocates memory space within the memory for heap 372 but includes no instruction for freeing that space within the memory. Memory management 374 in the depicted example manages memory space within the memory allocated to heap 370. Memory management 374 may include a garbage collector which automatically reclaims memory used by objects that are no longer referenced. Additionally, a garbage collector also may move objects to reduce heap fragmentation.

[0074] The processes within the following figures provide an overall perspective of the many processes employed within the present invention: processes that generate event-based profiling information in the form of specific types of records in a trace file; processes that generate sample-based profiling information in the form of specific types of records in a trace file; processes that read the trace records to generate more useful information to be placed into profile reports; and processes that generate the profile reports for the user of the profiling utility.

[0075] With reference now to FIG. 4, a block diagram depicts components used to profile processes in a data processing system. A trace program 400 is used to profile processes 402. Trace program 400 may be used to record data upon the execution of a hook, which is a specialized piece of code at a specific location in a routine or program in which other routines may be connected. Trace hooks are typically inserted for the purpose of debugging, performance analysis, or enhancing functionality. These trace hooks are employed to send trace data to trace program 400, which stores the trace data in buffer 404. The trace data in buffer 404 may be stored in a file for post-processing. With Java operating systems, the present invention employs trace hooks that aid in identifying methods that may be used in processes 402. In addition, since classes may be loaded and unloaded, these changes may also be identified using trace data. This is especially relevant with “network client” data processing systems, such as those that may operate under JavaOS, since classes and jitted methods may be loaded and unloaded more frequently due to the constrained memory and role as a network client.

[0076] With reference now to FIG. 5, a diagram depicts various phases in profiling the processes active in an operating system. Subject to memory constraints, the generated trace output may be as long and as detailed as the analyst requires for the purpose of profiling a particular program.

[0077] An initialization phase 500 is used to capture the state of the client machine at the time tracing is initiated. This trace initialization data includes trace records that identify all existing threads, all loaded classes, and all methods for the loaded classes. Records from trace data captured from hooks are written to indicate thread switches, interrupts, and loading and unloading of classes and jitted methods. Any class which is loaded has trace records that indicate the name of the class and its methods. In the depicted example, four byte IDs are used as identifiers for threads, classes, and methods. These IDs are associated with names output in the records. A record is written to indicate when all of the start up information has been written.

[0078] Next, during the profiling phase 502, trace records are written to a trace buffer or file. Trace records may originate from two types of profiling actions—event-based profiling and sample-based profiling. In the present invention, the trace file may have a combination of event-based records, such as those that may originate from a trace hook executed in response to a particular type of event, e.g., a method entry or method exit, and sample-based records, such as those that may originate from a stack walking function executed in response to a timer interrupt, e.g., a stack unwind record, also called a call stack record.

[0079] For example, the following process may occur during the profiling phase if the user of the profiling utility has requested sample-based profiling information. Each time a particular type of timer interrupt occurs, a trace record is written, which indicates the system program counter. This system program counter may be used to identify the routine that is interrupted. In the depicted example, a timer interrupt is used to initiate gathering of trace data. Of course, other types of interrupts may be used other than timer interrupts. Interrupts based on a programmed performance monitor event or other types of periodic events may be employed.

[0080] In the post-processing phase 504, the data collected in the buffer is sent to a file for post-processing. In one configuration, the file may be sent to a server, which determines the profile for the processes on the client machine. Of course, depending on available resources, the post-processing also may be performed on the client machine. In post-processing phase 504, B-trees and/or hash tables may be employed to maintain names associated the records in the trace file to be processed. A hash table employs hashing to convert an identifier or a key, meaningful to a user, into a value for the location of the corresponding data in the table. While processing trace records, the B-trees and/or hash tables are updated to reflect the current state of the client machine, including newly loaded jitted code or unloaded code. Also, in the post-processing phase 504, each trace record is processed in a serial manner. As soon as the indicator is encountered that all of the startup information has been processed, event-based trace records from trace hooks and sample-based trace records from timer interrupts are then processed. Timer interrupt information from the timer interrupt records are resolved with existing hash tables. In addition, this information identifies the thread and function being executed. The data is stored in hash tables with a count identifying the number of timer tick occurrences associated with each way of looking at the data. After all of the trace records are processed, the information is formatted for output in the form of a report.

[0081] Alternatively, trace information may be processed on-the-fly so that trace data structures are maintained during the profiling phase. In other words, while a profiling function, such as a timer interrupt, is executing, rather than (or in addition to) writing trace records to a buffer or file, the trace record information is processed to construct and maintain any appropriate data structures.

[0082] For example, during the processing of a timer interrupt during the profiling phase, a determination could be made as to whether the code being interrupted is being interpreted by the Java interpreter. If the code being interrupted is interpreted, the method ID of the method being interpreted may be placed in the trace record. In addition, the name of the method may be obtained and placed in the appropriate B-tree. Once the profiling phase has completed, the data structures may contain all the information necessary for generating a profile report without the need for post-processing of the trace file.

[0083] With reference now to FIG. 6, a flowchart depicts a process used by a trace program for generating trace records from processes executing on a data processing system. FIG. 6 provides further detail concerning the generation of trace records that were not described with respect to FIG. 5.

[0084] Trace records may be produced by the execution of small pieces of code called “hooks”. Hooks may be inserted in various ways into the code executed by processes, including statically (source code) and dynamically (through modification of a loaded executable). This process is employed after trace hooks have already been inserted into the process or processes of interest. The process begins by allocating a buffer (step 600), such as buffer 404 in FIG. 4. Next, in the depicted example, trace hooks are turned on (step 602), and tracing of the processes on the system begins (step 604). Trace data is received from the processes of interest (step 606). This type of tracing may be performed during phases 500 and/or 502. This trace data is stored as trace records in the buffer (step 608). A determination is made as to whether tracing has finished (step 610). Tracing finishes when the trace buffer has been filled or the user stops tracing via a command and requests that the buffer contents be sent to file. If tracing has not finished, the process returns to step 606 as described above.

[0085] Otherwise, when tracing is finished, the buffer contents are sent to a file for post-processing (step 612). A report is then generated in post-processing (step 614) with the process terminating thereafter.

[0086] Although the depicted example uses post-processing to analyze the trace records, the processes of the present invention may be used to process trace information in real-time depending on the implementation.

[0087] With reference now to FIG. 7, a flowchart depicts a process that may be used during an interrupt handler trace hook.

[0088] The process begins by obtaining a program counter (step 700). Typically, the program counter is available in one of the saved program stack areas. Thereafter, a determination is made as to whether the code being interrupted is interpreted code (step 702). This determination may be made by determining whether the program counter is within an address range for the interpreter used to interpret bytecodes. If the code being interrupted is interpreted, a method block address is obtained for the code being interpreted. A trace record is then written (step 706). The trace record is written by sending the trace information to a trace program, such as trace program 400, which generates trace records for post-processing in the depicted example. This trace record is referred to as an interrupt record, or an interrupt hook.

[0089] This type of trace may be performed during phase 502. Alternatively, a similar process, i.e. determining whether code that was interrupted is interpreted code, may occur during post-processing of a trace file.

[0090] In addition to event-based profiling, a set of processes may be employed to obtain sample-based profiling information. As applications execute, the applications may be periodically interrupted in order to obtain information about the current runtime environment. This information may be written to a buffer or file for post-processing, or the information may be processed on-the-fly into data structures representing an ongoing history of the runtime environment. FIGS. 8 and 9 describe sample-based profiling in more detail.

[0091] A sample-based profiler obtains information from the stack of an interrupted thread. The thread is interrupted by a timer interrupt presently available in many operating systems. The user of the trace facility selects either the program counter option or the stack unwind option, which may be accomplished by enabling one major code or another major code, as described further below. This timer interrupt is employed to sample information from a call stack. By walking back up the call stack, a complete call stack can be obtained for analysis. A “stack walk” may also be described as a “stack unwind”, and the process of “walking the stack” may also be described as “unwinding the stack.” Each of these terms illustrates a different metaphor for the process. The process can be described as “walking” as the process must obtain and process the stack frames step-by-step. The process may also be described as “unwinding” as the process must obtain and process the stack frames that point to one another, and these pointers and their information must be “unwound” through many pointer dereferences.

[0092] The stack unwind follows the sequence of functions/method calls at the time of the interrupt. A call stack is an ordered list of routines plus offsets within routines (i.e. modules, functions, methods, etc.) that have been entered during execution of a program. For example, if routine A calls routine B, and then routine B calls routine C, while the processor is executing instructions in routine C, the call stack is ABC. When control returns from routine C back to routine B, the call stack is AB. For more compact presentation and ease of interpretation within a generated report, the names of the routines are presented without any information about offsets. Offsets could be used for more detailed analysis of the execution of a program, however, offsets are not considered further herein.

[0093] Thus, during timer interrupt processing or at post-processing, the generated sample-based profile information reflects a sampling of call stacks, not just leaves of the possible call stacks, as in some program counter sampling techniques. A leaf is a node at the end of a branch, i.e. a node that has no descendants. A descendant is a child of a parent node, and a leaf is a node that has no children.

[0094] With reference now FIG. 8, a diagram depicts the call stack containing stack frames. A “stack” is a region of reserved memory in which a program or programs store status data, such as procedure and function call addresses, passed parameters, and sometimes local variables. A “stack frame” is a portion of a thread's stack that represents local storage (arguments, return addresses, return values, and local variables) for a single function invocation. Every active thread of execution has a portion of system memory allocated for its stack space. A thread's stack consists of sequences of stack frames. The set of frames on a thread's stack represent the state of execution of that thread at any time. Since stack frames are typically interlinked (e.g., each stack frame points to the previous stack frame), it is often possible to trace back up the sequence of stack frames and develop the “call stack”. A call stack represents all not-yet-completed function calls—in other words, it reflects the function invocation sequence at any point in time.

[0095] Call stack 800 includes information identifying the routine that is currently running, the routine that invoked it, and so on all the way up to the main program. Call stack 800 includes a number of stack frames 802, 804, 806, and 808. In the depicted example, stack frame 802 is at the top of call stack 800, while stack frame 808 is located at the bottom of call stack 800. The top of the call stack is also referred to as the “root”. The timer interrupt (found in most operating systems) is modified to obtain the program counter value (pcv) of the interrupted thread, together with the pointer to the currently active stack frame for that thread. In the Intel architecture, this is typically represented by the contents of registers: EIP (program counter) and EBP (pointer to stack frame). By accessing the currently active stack frame, it is possible to take advantage of the (typical) stack frame linkage convention in order to chain all of the frames together. Part of the standard linkage convention also dictates that the function return address be placed just above the invoked-function's stack frame; this can be used to ascertain the address for the invoked function. While this discussion employs an Intel-based architecture, this example is not a restriction. Most architectures employ linkage conventions that can be similarly navigated by a modified profiling interrupt handler.

[0096] When a timer interrupt occurs, the first parameter acquired is the program counter value. The next value is the pointer to the top of the current stack frame for the interrupted thread. In the depicted example, this value would point to EBP 808ain stack frame 808. In turn, EBP 808 points to EBP 806ain stack frame 806, which in turn points to EBP 804ain stack frame 804. In turn, this EBP points to EBP 802ain stack frame 802. Within stack frames 802-808 are EIPs 802b-808b, which identify the calling routine's return address. The routines may be identified from these addresses. Thus, routines are defined by collecting all of the return addresses by walking up or backwards through the stack.

[0097] With reference now to the FIG. 9, an illustration of a call stack is depicted. A call stack, such as call stack 900 is obtained by walking the call stack. A call stack is obtained each time a periodic event, such as, for example, a timer interrupt occurs. These call stacks may be stored as call stack unwind trace records within the trace file for post-processing or may be processed on-the-fly while the program continues to execute.

[0098] In the depicted example, call stack 900 contains a pid 902, which is the process identifier, and a tid 904, which is the thread identifier. Call stack 900 also contains addresses addr1906, addr2908 . . . addrN 910. In this example, addr1906 represents the value of the program counter at the time of the interrupt. This address occurs somewhere within the scope of the interrupted function. addr2908 represents an address within the process that called the function that was interrupted. For Intel-processor-based data processing systems, it represents the return address for that call; decrementing that value by 4 results in the address of the actual call, also known as the call-site. This corresponds with EIP 808bin FIG. 8; addrN 910 is the top of the call stack ( EIP 802b). The call stack that would be returned if the timer interrupt interrupted the thread whose call stack state is depicted in FIG. 8 would consist of: a pid, which is the process id of the interrupted thread; a tid, which is the thread id for the interrupted thread; a pcv, which is a program counter value (not shown on FIG. 8) for the interrupted thread; EIP 808b; EIP 806b; EIP 804b; and EIP 802b. In terms of FIG. 9, pcv=addr1, EIP 808b=addr2, EIP 806b=addr3, EIP 804b=addr4, EIP 802b=addr5.

[0099] With reference now to FIG. 10A, a diagram of a program execution sequence along with the state of the call stack at each function entry/exit point is provided. The illustration shows entries and exits occurring at regular time intervals, but this is only a simplification for the illustration. If each function (A, B, C, and X in the figure) were instrumented with entry/exit event hooks, then complete accounting of the time spent within and below each function would be readily obtained. Note in FIG. 10A that at time 0, the executing thread is in routine C. The call stack at time 0 is C. At time 1, routine C calls routine A, and the call stack becomes CA and so on. It should be noted that the call stack in FIG. 10A is a reconstructed call stack that is generated by processing the event-based trace records in a trace file to follow such events as method entries and method exits.

[0100] The accounting technique and data structure are described in more detail further below. Unfortunately, this type of instrumentation can be expensive, can introduce bias, and in some cases, can be hard to apply. Sample-based profiling, by sampling the program's call stack, helps to alleviate the performance bias (and other complications) that entry/exit hooks produce.

[0101] Consider FIG. 10B, in which the same program is executed but is being sampled on a regular basis (in the example, the interrupt occurs at a frequency equivalent to two timestamp values). Each sample includes a snapshot of the interrupted thread's call stack. Not all call stack combinations are seen with this technique (note that routine X does not show up at all in the set of call stack samples in FIG. 10B). This is an acceptable limitation of sampling. The idea is that with an appropriate sampling rate (e.g., 30-1000 times per second), the call stacks in which most of the time is spent will be identified. Although some call stacks are omitted, it is a minor issue provided these call stacks are combinations for which little time is consumed.

[0102] In the event-based traces, there is a fundamental assumption that the traces contain information about routine entries and matching routine exits. Often, entry-exit pairs are nested in the traces because routines call other routines. Time spent (or memory consumed) between entry into a routine and exit from the same routine is attributed to that routine, but a user of a profiling tool may want to distinguish between time spent directly in a routine and time spent in other routines that it calls.

[0103] FIG. 10C shows an example of the manner in which time may be expended by two routines: a program's “main” calls routine A at time “t” equal to zero; routine A computes for 1 ms and then calls routine B; routine B computes for 8 ms and then returns to routine A; routine A computes for 1 ms and then returns to “main”. From the point of view of “main”, routine A took 10 ms to execute, but most of that time was spent executing instructions in routine B and was not spent executing instructions within routine A. This is a useful piece of information for a person attempting to optimize the example program. In addition, if routine B is called from many places in the program, it might be useful to know how much of the time spent in routine B was on behalf of (or when called by) routine A and how much of the time was on behalf of other routines.

[0104] A fundamental concept in the output provided by the methods described herein is the call stack. The call stack consists of the routine that is currently running, the routine that invoked it, and so on all the way up to main. A profiler may add a higher, thread level with the pid/tid (the process IDs and thread IDs). In any case, an attempt is made to follow the trace event records, such as method entries and exits, as shown in FIG. 10A, to reconstruct the structure of the call stack frames while the program was executing at various times during the trace.

[0105] The post-processing of a trace file may result in a report consisting of three kinds of time spent in a routine, such as routine A: (1) base time—the time spent executing code in routine A itself; (2) cumulative time (or “cum time” for short)—the time spent executing in routine A plus all the time spent executing every routine that routine A calls (and all the routines they call, etc.); and (3) wall-clock time or elapsed time. This type of timing information may be obtained from event-based trace records as these records have timestamp information for each record.

[0106] A routine's cum time is the sum of all the time spent executing the routine plus the time spent executing any other routine while that routine is below it on the call stack. In the example above in FIG. 10C, routine A's base time is 2 ms, and its cum time is 10 ms. Routine B's base time is 8 ms, and its cum time is also 8 ms because it does not call any other routines. It should be noted that cum time may not be generated if a call stack tree is being generated on-the-fly—cum time may only be computed after the fact during the post-processing phase of a profile utility.

[0107] For wall-clock or elapsed time, if while routine B was running, the system fielded an interrupt or suspended this thread to run another thread, or if routine B blocked waiting on a lock or I/O, then routine B and all the entries above routine B on the call stack accumulate elapsed time but not base or cum time. Base and cum time are unaffected by interrupts, dispatching, or blocking. Base time only increases while a routine is running, and cum time only increases while the routine or a routine below it on the call stack is running.

[0108] In the example in FIG. 10C, routine A's elapsed time is the same as its cum time—10 ms. Changing the example slightly, suppose there was a 1 ms interrupt in the middle of B, as shown in FIG. 10D. Routine A's base and cum time are unchanged at 2 ms and 10 ms, but its elapsed time is now 11 ms.

[0109] Although base time, cum time and elapsed time were defined in terms of processor time spent in routines, sample based profiling is useful for attributing consumption of almost any system resource to a set of routines, as described in more detail below with respect to FIG. 11B. Referring to FIG. 10C again, if routine A initiated two disk I/O's, and then routine B initiated three more I/O's when called by routine A, routine A's “base I/O's” are two and routine A's “cum I/O's” are five. “Elapsed I/O's” would be all I/O's, including those by other threads and processes, that occurred between entry to routine A and exit from routine A. More general definitions for the accounting concepts during profiling would be the following: base—the amount of the tracked system resource consumed directly by this routine; cum—the amount of the tracked system resource consumed by this routine and all routines below it on the call stack; elapsed—the total amount of the tracked system resource consumed (by any routine) between entry to this routine and exit from the routine.

[0110] As noted above, FIGS. 10A-10D describe the process by which a reconstructed call stack may be generated by processing the event-based trace records in a trace file by following such events as method entries and method exits. Hence, although FIGS. 11A-14 describe call stack trees that may be applicable to processing sample-based trace records, the description below for generating or reconstructing call stacks and call stack trees in FIGS. 11A-14 is mainly directed to the processing of event-based trace records.

[0111] With reference now to FIG. 11A, a diagram depicts a tree structure generated from trace data. This figure illustrates a call stack tree 1100 in which each node in tree structure 1100 represents a function entry point.

[0112] Additionally, in each node in tree structure 1100, a number of statistics are recorded. In the depicted example, each node, nodes 1102-1108, contains an address (addr), a base time (BASE), cumulative time (CUM) and parent and children pointers. As noted above, this type of timing information may be obtained from event-based trace records as these records have timestamp information for each record. The address represents a function entry point. The base time represents the amount of time consumed directly by this thread executing this function. The cumulative time is the amount of time consumed by this thread executing this function and all functions below it on the call stack. In the depicted example, pointers are included for each node. One pointer is a parent pointer, a pointer to the node's parent. Each node also contains a pointer to each child of the node.

[0113] Those of ordinary skill in the art will appreciate that tree structure 1100 may be implemented in a variety of ways and that many different types of statistics may be maintained at the nodes other than those in the depicted example.

[0114] The call stack is developed from looking back at all return addresses. These return addresses will resolve within the bodies of those functions. This information allows for accounting discrimination between distinct invocations of the same function. In other words, if function X has 2 distinct calls to function A, the time associated with those calls can be accounted for separately. However, most reports would not make this distinction.

[0115] With reference now to FIG. 11B, a call stack tree which reflects call stacks observed during a specific example of system execution will now be described. At each node in the tree, several statistics are recorded. In the example shown in FIG. 11B, the statistics are time-based statistics. The particular statistics shown include the number of distinct times the call stack is produced, the sum of the time spent in the call stack, the total time spent in the call stack plus the time in those call stacks invoked from this call stack (referred to as cumulative time), and the number of instances of this routine above this instance (indicating depth of recursion).

[0116] For example, at node 1152 in FIG. 11B, the call stack is CAB, and the statistics kept for this node are 2:3:4:1. Note that call stack CAB is first produced at time 2 in FIG. 10A, and is exited at time 3. Call stack CAB is produced again at time 4, and is exited at time 7. Thus, the first statistic indicates that this particular call stack, CAB, is produced twice in the trace. The second statistic indicates that call stack CAB exists for three units of time (at time 2, time 4, and time 6). The third statistic indicates the cumulative amount of time spent in call stack CAB and those call stacks invoked from call stack CAB (i.e., those call stacks having CAB as a prefix, in this case CABB). The cumulative time in the example shown in FIG. 11B is four units of time. Finally, the recursion depth of call stack CAB is one, as none of the three routines presenting the call stack have been recursively entered.

[0117] Those skilled in the art will appreciate that the tree structure depicted in FIG. 11B may be implemented in a variety of ways, and a variety of different types of statistics may be maintained at each node. In the described embodiment, each node in the tree contains data and pointers. The data include the name of the routine at that node, and the four statistics discussed above. Of course, many other types of statistical information may be stored at each node. In the described embodiment, the pointers for each node include a pointer to the node's parent, a pointer to the first child of the node (i.e. the left-most child), a pointer to the next sibling of the node, and a pointer to the next instance of a given routine in the tree. For example, in FIG. 11B, node 1154 would contain a parent pointer to node 1156, a first child pointer to node 1158, a next sibling pointer equal to NULL (note that node 1154 does not have a next sibling), and a next instance pointer to node 1162. Those skilled in the art will appreciate that other pointers may be stored to make subsequent analysis more efficient. In addition, other structural elements, such as tables for the properties of a routine that are invariant across instances (e.g., the routine's name), may also be stored.

[0118] The type of performance information and statistics maintained at each node are not constrained to time-based performance statistics. The present invention may be used to present many types of trace information in a compact manner which supports performance queries. For example, rather than keeping statistics regarding time, tracing may be used to track the number of Java bytecodes executed in each method (i.e., routine) called. The tree structure of the present invention would then contain statistics regarding bytecodes executed rather than time. In particular, the quantities recorded in the second and third categories would reflect the number of bytecodes executed rather than the amount of time spent in each method.

[0119] Tracing may also be used to track memory allocation and deallocation. Every time a routine creates an object, a trace record could be generated. The tree structure of the present invention would then be used to efficiently store and retrieve information regarding memory allocation. Each node would represent the number of method calls, the amount of memory allocated within a method, the amount of memory allocated by methods called by the method, and the number of methods above this instance (i.e., the measure of recursion). Those skilled in the art will appreciate that the tree structure of the present invention may be used to represent a variety of performance data in a manner which is very compact, and allows a wide variety of performance queries to be performed.

[0120] The tree structure shown in FIG. 11B depicts one way in which data may be pictorially presented to a user. The same data may also be presented to a user in tabular form as shown in FIG. 12.

[0121] With reference now to FIG. 12, a call stack tree presented as a table will now be described. Note that FIG. 12 contains a routine, pt_pidtid, which is the main process/thread which calls routine C. Table 12 includes columns of data for Level 1230, RL 1232, Calls 1234, Base 1236, Cum 1238, and Indent 1240. Level 1230 is the tree level (counting from the root as level 0) of the node. RL 1232 is the recursion level. Calls 1234 is the number of occurrences of this particular call stack, i.e., the number of times this distinct call stack configuration occurs. Base 1236 is the total observed time in the particular call stack, i.e., the total time that the stack had exactly these routines on the stack. Cum 1238 is the total time in the particular call stack plus deeper levels below it. Indent 1240 depicts the level of the tree in an indented manner. From this type of call stack configuration information, it is possible to infer each unique call stack configuration, how many times the call stack configuration occurred, and how long it persisted on the stack. This type of information also provides the dynamic structure of a program, as it is possible to see which routine called which other routine. However, there is no notion of time-order in the call stack tree. It cannot be inferred that routines at a certain level were called before or after other routines on the same level.

[0122] The pictorial view of the call stack tree, as illustrated in FIG. 11B, may be built dynamically or built statically using a trace text file or binary file as input. FIG. 13 depicts a flow chart of a method for building a call stack tree using a trace text file as input. In FIG. 13, the call stack tree is built to illustrate module entry and exit points.

[0123] With reference now to FIG. 13, it is first determined if there are more trace records in the trace text file (step 1350). If so, several pieces of data are obtained from the trace record, including the time, whether the event is an enter or an exit, and the module name (step 1352). Next, the last time increment is attributed to the current node in the tree (step 1354). A check is made to determine if the trace record is an enter or an exit record (step 1356). If it is an exit record, the tree is traversed to the parent (using the parent pointer), and the current tree node is set equal to the parent node (step 1358). If the trace record is an enter record, a check is made to determine if the module is already a child node of the current tree node (step 1360). If not, a new node is created for the module and it is attached to the tree below the current tree node (step 1362). The tree is then traversed to the module's node, and the current tree node is set equal to the module node (step 1364). The number of calls to the current tree node is then incremented (step 1366). This process is repeated for each trace record in the trace output file, until there are no more trace records to parse (step 1368).

[0124] With reference now to FIG. 14, a flow chart depicts a method for building a call stack tree dynamically as tracing is taking place during system execution. In FIG. 14, as an event is logged, it is added to the tree in real time. Preferably, a call stack tree is maintained for each thread. The call stack tree reflects the call stacks recorded to date, and a current tree node field indicates the current location in a particular tree. When an event occurs (step 1470), the thread ID is obtained (step 1471). The time, type of event (i.e., in this case, whether the event is a method entry or exit), the name of the module (i.e., method), location of the thread's call stack, and location of the thread's “current tree node” are then obtained (step 1472). The last time increment is attributed to the current tree node (step 1474). A check is made to determine if the trace event is an enter or an exit event (step 1476). If it is an exit event, the tree is traversed to the parent (using the parent pointer), and the current tree node is set equal to the parent node (step 1478). At this point, the tree can be dynamically pruned in order to reduce the amount of memory dedicated to its maintenance (step 1479). Pruning is discussed in more detail below. If the trace event is an enter event, a check is made to determine if the module is already a child node of the current tree node (step 1480). If not, a new node is created for the module, and it is attached to the tree below the current tree node (step 1482). The tree is then traversed to the module's node, and the current tree node is set equal to the module node (step 1484). The number of calls to the current tree node is then incremented (step 1486). Control is then passed back to the executing module, and the dynamic tracing/reduction program waits for the next event to occur (step 1488).

[0125] One of the advantages of using the dynamic tracing/reduction technique described in FIG. 14 is its enablement of long-term system trace collection with a finite memory buffer. Very detailed performance profiles may be obtained without the expense of an “infinite” trace buffer. Coupled with dynamic pruning, the method depicted in FIG. 14 can support a fixed-buffer-size trace mechanism.

[0126] The use of dynamic tracing and reduction (and dynamic pruning in some cases) is especially useful in profiling the performance characteristics of long running programs. In the case of long running programs, a finite trace buffer can severely impact the amount of useful trace information that may be collected and analyzed. By using dynamic tracing and reduction (and perhaps dynamic pruning), an accurate and informative performance profile may be obtained for a long running program.

[0127] Many long-running applications reach a type of steady-state, where every possible routine and call stack is present in the tree and updating statistics. Thus, trace data can be recorded and stored for such applications indefinitely within the constraints of a bounded memory requirement using dynamic pruning. Pruning has value in reducing the memory requirement for those situations in which the call stacks are actually unbounded. For example, unbounded call stacks are produced by applications that load and run other applications.

[0128] Pruning can be performed in many ways, and a variety of pruning criteria is possible. For example, pruning decisions may be based on the amount of cumulative time attributed to a subtree. Note that pruning may be disabled unless the amount of memory dedicated to maintaining the call stack exceeds some limit. As an exit event is encountered (such as step 1478 in FIG. 14), the cumulative time associated with the current node is compared with the cumulative time associated with the parent node. If the ratio of these two cumulative times does not exceed a pruning threshold (e.g., 0.1), then the current node and all of its descendants are removed from the tree. The algorithm to build the tree proceeds as before by traversing to the parent, and changing the current node to the parent.

[0129] Many variations of the above pruning mechanism are possible. For example, the pruning threshold can be raised or lowered to regulate the level of pruning from very aggressive to none. More global techniques are also possible, including a periodic sweep of the entire call stack tree, removing all subtrees whose individual cumulative times are not a significant fraction of their parent node's cumulative times.

[0130] Data reduction allows analysis programs to easily and quickly answer many questions regarding how computing time was spent within the traced program. This information may be gathered by “walking the tree” and accumulating the data stored at various nodes within the call stack tree, from which it can be determined the amount of time spent strictly within routine A, the total amount of time spent in routine A and in the routines called by routine A either directly or indirectly, etc.

[0131] With reference now to the FIG. 15, a diagram of a structured profile obtained using the processes of the present invention is illustrated. Profile 1500 shows sample numbers in column 1502. Column 1504 shows the call stack with an identification of the functions present within the call stack at different sample times.

[0132] With reference now to FIG. 16, a diagram of a record generated using the processes of present invention is depicted. Each routine in record 1600 is listed separately, along with information regarding the routine in FIG. 16. For example, calls column 1604 lists the number of times each routine has been called. BASE column 1606 contains the total time spent in the routine, while CUM column 1608 includes the cumulative time spent in the routine and all routines called by the routine. Name column 1612 contains the name of the routine.

[0133] With reference now to FIG. 17, a diagram of another type of report that may be produced is depicted. The report depicted in FIG. 17 illustrates much of the same information found in FIG. 16, but in a slightly different format. As with FIG. 16, diagram 1700 includes information on calls, base time, and cumulative time.

[0134] FIG. 17 shows a sample-based trace output containing times spent within various routines as measured in microseconds. FIG. 17 contains one stanza (delimited by horizontal lines) for each routine that appears in the sample-based trace output. The stanza contains information about the routine itself on the line labeled “Self”, about who called it on lines labeled “Parent”, and about who the routine called on lines labeled “Child”. The stanzas are in order of cum time. The third stanza is about routine A, as indicated by the line beginning with “Self.” The numbers on the “Self” line of this stanza show that routine A was called three times in this trace, once by routine C and twice by routine B. In the profile terminology, routines C and B are (immediate) parents of routine A. Routine A is a child of routines C and B. All the numbers on the “Parent” rows of the second stanza are breakdowns of routine A's corresponding numbers. Three microseconds of the seven microsecond total base time spent in A was when it was called by routine C, and three microseconds when it was first called by routine B, and another one microsecond when it was called by routine B for a second time. Likewise, in this example, half of routine A's fourteen microsecond cum time was spent on behalf of each parent.

[0135] Looking now at the second stanza, we see that routine C called routine B and routine A once each. All the numbers on “Child” rows are subsets of numbers from the child's profile. For example, of the three calls to routine A in this trace, one was by routine C; of routine A's seven microsecond total base time, three microseconds were while it was called directly by routine C; of routine A's fourteen microsecond cum time, seven microseconds was on behalf of routine C. Notice that these same numbers are the first row of the third stanza, where routine C is listed as one of routine A's parents.

[0136] The four relationships that are true of each stanza are summarized at the top of FIG. 17. First, the sum of the numbers in the Calls column for parents equals the number of calls on the self row. Second, the sum of the numbers in the Base column for parents equals Self's base. Third, the sum of the numbers in the Cum column for parents equals Self's Cum. These first three invariants are true because these characteristics are the definition of Parent; collectively they are supposed to account for all of Self's activities. Fourth, the Cum in the Child rows accounts for all of Self's Cum except for its own Base.

[0137] Program sampling contains information from the call stack and provides a profile, reflecting the sampling of an entire call stack, not just the leaves. Furthermore, the sample-based profiling technique may also be applied to other types of stacks. For example, with Java programs, a large amount of time is spent in a routine called the “interpreter”. If only the call stack was examined, the profile would not reveal much useful information. Since the interpreter also tracks information in its own stack, e.g., a Java stack (with its own linkage conventions), the process can be used to walk up the Java stack to obtain the calling sequence from the perspective of the interpreted Java program.

[0138] With reference now to FIG. 18, a figure depicts a report generated from a trace file containing both event-based profiling information (method entry/exits) and sample-based profiling information (stack unwinds). FIG. 18 is similar to FIG. 12, in which a call stack tree is presented as a report, except that FIG. 18 contains embedded stack walking information. Call stack tree 1800 contains two stack unwinds generated within the time period represented by the total of 342 ticks. Stack unwind identifier 1802 denotes the beginning of stack unwind information 1806, with the names of routines that are indented to the right containing the stack information that the stack walking process was able to discern. Stack unwind identifier 1804 denotes the beginning of stack unwind information 1808. In this example, “J:” identifies an interpreted Java method and “F:” identifies a native function, such as a native function within JavaOS. A call from a Java method to a native method is via “ExecuteJava.” Hence, at the point at which the stack walking process reaches a stack frame for an “ExecuteJava,” it cannot proceed any further up the stack as the stack frames are discontinued. The process for creating a tree containing both event-based nodes and sample-based nodes is described in more detail further below. In this case, identifiers 1802 and 1804 also denote the major code associated with the stack unwind.

[0139] With reference now to FIGS. 19A-19B tables depict major codes and minor codes that may be employed to instrument software modules for profiling. In order to facilitate the merging of event-based profiling information and sample-based profiling information, a set of codes may be used to turn on and off various types of profiling functions.

[0140] For example, as shown in FIGS. 19A-19B, the minor code for a stack unwind is designated as 0×7fffffff, which may be used for two different purposes. The first purpose, denoted with a major code of 0×40, is for a stack unwind during a timer interrupt. When this information is output into a trace file, the stack information that appears within the file will have been coded so that the stack information is analyzed as sample-based profiling information. The second purpose, denoted with a major code of 0×41, is for a stack unwind in an instrumented routine. This stack information could then be post-processed as event-based profiling information.

[0141] Other examples in the table show a profile or major code purpose of tracing jitted methods with a major code value of 0×50. Tracing of jitted methods may be distinguished based on the minor code that indicates method invocation or method exit. In contrast, a major code of 0×30 indicates a profiling purpose of instrumenting interpreted methods, while the minor code again indicates, with the same values, method invocation or method exit.

[0142] Referring back to FIG. 18, the connection can be made between the use of major and minor codes, the instrumentation of code, and the post-processing of profile information. In the generated report shown in FIG. 18, the stack unwind identifiers can be seen to be equal to 0×40, which, according to the tables in FIGS. 19A-19B, is a stack unwind generated in response to a timer interrupt. This type of stack unwind may have occurred in response to a regular interrupt that was created in order to generate a profile of executing software.

[0143] As noted in the last column of the tables in FIGS. 19A-19B, by using a utility that places a hook into a software module to be profiled, a stack unwind may be instrumented into a routine. If so, the output for this type of stack unwind will be designated with a major code of 0×41.

[0144] As noted previously, profiling the execution of a program may introduce disruptive effects and costs associated with the profiling mechanism itself. One of the costs is the temporal overhead associated with generating and recording trace records that contain information obtained during profiling. The present invention is directed to a process for analyzing and compensating for the temporal overhead associated with generating and recording trace information.

[0145] With reference now to FIG. 20A, a flowchart depicts a summary of the manner in which elapsed time is attributed to various routines in an execution flow. FIG. 11B depicts a call stack tree representation that shows the number of times that a routine has been called, the base time associated with the routine, the cumulative time associated with the routine, and its relative position within a call stack sequence or execution flow. The process for constructing this type of call stack tree representation is depicted within the flowchart shown in FIG. 13. FIG. 20A is merely a summary of processes previously described for determining how to interpret timestamps generated during a trace and attribute the captured times among routines within execution flows.

[0146] Although the processes are described in terms of event times, it should be noted that the processes are generally applicable to any timestamp that appears within trace data related to the execution of profiled routines.

[0147] The present invention generally describes the manipulation of event times and the computation of event time differences. An event time is the system-relative point in time at which an event related to the execution of a program is said to have occurred. These events may be method entry events, method exit events, class loading events, class unloading events, etc. The source of a particular time value is usually a timestamp value returned by invoking a system function that determines the system time as kept by the operating system, the system hardware, or some combination of the hardware and operating system. These timestamps may used in real-time or may be recorded within event records in a memory buffer or an output file and then post-processed.

[0148] The process begins with the retrieval of the event time for a previous event (step 2002). If the trace information associated with events is being processed during a post-processing phase, the previous event time may have been previously stored as a variable at some point in time, e.g., after processing a record containing timestamps of the previous event, which may have been previously retrieved from a trace file or trace buffer. If the trace information is being processed in real-time, then the previous event time may have been temporarily stored in anticipation of subsequent processing of the next event. The previous event time may be initialized to zero when the profiler is first invoked.

[0149] The next trace record in the trace file is then retrieved and parsed (step 2004), and the current event time is obtained from the timestamp information in the current trace record (step 2006). The last time increment, or delta event time, is computed as the difference between the current event time and the previous event time (step 2008). The delta event time is then attributed to the current routine (step 2010) in some manner, such as adding the delta event time to the base time stored in the node associated with the routine within a call stack tree. The process is then complete with respect to computing a delta event time and attributing it to a routine.

[0150] With reference now to FIG. 20B, a timeline depicts demarcated time points with which the process in FIG. 20A is concerned. The previous event time is the time point at which a first event (previous event) has occurred, such as an entry event or an exit event. The current event time is the time point at which a second event (current event) subsequent to the first event has been recorded as occurring, such as the next entry event or exit event. The difference between the previous event time and the current event time is shown as the delta event time, also described as the last time increment. Again, it should be noted that the “event” time may be generically replaced by any relevant “profile” time or “trace” time that denotes a point in time at which some action of interest to the profiler has occurred.

[0151] The present invention is directed towards determining whether the delta event time contains identifiable overhead. If so, the present invention attempts to identify the quantity of overhead, and if the present invention may compensate for the identified overhead, the present invention attempts to adjust recorded event times, computed based times, etc.

[0152] With reference now to FIGS. 21A-21E, a trace record format is depicted that contains information from which compensation information may be obtained for compensating for trace record generation overhead. Trace record 2100 contains various fields, such as record length, major code, minor code, start time, other trace record data, and end time. Trace record 2100 may be generated by a profiler routine at the application level or at the system level, such as by a routine within a device driver or a routine within the kernel or a kernel extension. Preferably, the trace record is generated at the system level with interrupts inhibited so that the routine that is generating the trace record is not interrupted; otherwise, if interrupts occur, the timestamps that are recorded within the event record would capture the execution time for processing an interrupt in addition to the execution time for processing the event. However, depending upon the purpose of the user for profiling the executing program or system, the user may desire to capture certain execution flows that include the captured timestamps that contain time periods with interrupt processing.

[0153] Similarly, the trace records are preferably written to a pinned buffer for a variety of reasons. For example, by placing the trace records in a pinned buffer, the system does not swap out the memory containing the trace records; otherwise, the timestamps that are recorded within the event record would capture the execution time required for the data to be rolled back into memory in addition to the execution time for processing the event. However, depending upon the desire of the user for profiling the executing program or system, e.g., if the user was interested in analyzing the performance characteristics of the entire profiling system including memory performance, the user may desire to capture execution flows that include the captured timestamps that contain time periods with memory swapping. Another example in which a pinned buffer may be useful is for events that are placed in sensitive areas, e.g. system dispatch logic—a pinned buffer might be used because it may be unsafe for a page fault to occur during the execution of such code.

[0154] Alternatively, the trace records may be written by a specialized piece of hardware which accepts data and provides its own timestamps. This hardware, or trace card, could be implemented as a PCI card. With this approach, the system can send the type of trace record and the trace record data to the card, and the card generates the trace record including the timestamps and relevant control information.

[0155] With this type of trace record format, two times are recorded for each event that is output in a single trace record. After a call has been made to the system to inhibit interrupts during the trace record output procedure, but before the first data word of the trace record is written, the start time is obtained from the system. The end time is obtained from the system after all other record data has been written as part of the trace record, and this end time is also written while interrupts are still inhibited for the trace record procedure.

[0156] In this manner, the start time and end time provide time points for accounting for the actual output overhead associated with writing the trace record. Hence, each trace record is “self-calibrating”—an additional assessment of the time required for generating the trace record does not need to be made. Each trace record contains the information necessary for an output overhead adjustment value that may be applied against a previous time to compensate for the output associated with writing this particular trace record. It should be noted that the start time, end time, and the various other times within the processes of the present invention can be any monotonically increasing measure, such as cycles, cache misses, microseconds, milliseconds, etc.

[0157] With reference now to FIG. 22A, a flowchart depicts a process for generating a self-calibrating trace record. The process begins with the detection of an event to be traced during the profiling of a program (step 2202). In response, a trace record generation routine is invoked (step 2204). Interrupts are inhibited (step 2206), and a system call is made to obtain a starting timestamp (step 2208), which is then written to the trace record (step 2210).

[0158] Rather than obtaining the timestamp from the system and then writing the timestamp to the trace record by the trace record generation routine, the system routine may write the timestamp directly to the trace buffer. The system call may include a parameter for a reference pointer to the location in the trace record at which the timestamp is to be stored. This type of operation reduces the amount of time required to generate the trace record. Given that many thousands of trace records may be generated during the execution of a profiled program, a significant amount of time may be saved during the execution of the program by trimming the amount of time required to process each event in addition to capturing application processing times more accurately.

[0159] After the start time for the event is written to the trace record, other information may be written to the trace record, such as the record length, major code, minor code, etc. (step 2212). When all other event-related data has been written to the trace record, a system call is made to obtain an ending timestamp (step 2214), which is then written to the trace record (step 2216). Interrupts are then reenabled (step 2217). The trace record generation routine then returns control (step 2218), and the process for generating a self-calibrating trace record is then complete. The timestamps within the trace record may be subsequently used during a post-processing phase of a profiling process.

[0160] With reference now to FIG. 22B, a flowchart depicts a process for generating a self-calibrating trace record using a trace card. The process begins with the detection of an event to be traced during the profiling of a program (step 2252). In response, the trace information is sent to a trace card (step 2254). A call is made to obtain a starting timestamp from hardware on the trace card itself (step 2258), which is then written to the trace record (step 2260).

[0161] After the start time for the event is written to the trace record, other information may be written to the trace record, such as the record length, major code, minor code, etc. (step 2262). When all other event-related data has been written to the trace record, a call is made to obtain an ending timestamp from hardware on the trace card itself (step 2264), which is then written to the trace record (step 2266). The trace card may then prepare to receive more trace information (step 2268), and the process for generating a self-calibrating trace record on a trace card is then complete. The timestamps within the trace record may be subsequently used during a post-processing phase of a profiling process. In this manner, the trace card may obtain timestamps and generate trace records on specialized hardware in parallel with the execution of the application program being profiled and executed on the main processor.

[0162] Referring again to FIGS. 21B-21E, the arrangement of the information in the trace record may vary, and the order in which the information is placed into the trace record may vary. The offsets for each type of information to be placed into the trace record may be based upon the type of event that is being recorded in the trace record. By obtaining and storing starting time 2102 into the trace record as an initial step, an attempt is made to get a starting time that is as accurate as possible. Information 2104 for identifying and post-processing the trace event, such as the record length and major and minor code, may be stored, followed by other trace record data 2106. The ending timestamp 2108 is obtained and stored as late as possible in the processing of the event so as to capture as much execution time as is possible within the time period attributable to the processing of the trace event.

[0163] With reference now to FIG. 23A, a flowchart depicts a process for compensating for trace record generation overhead using self-calibrating trace records. FIG. 23A is similar to FIG. 20A in that both figures depict processes for determining an amount of execution time to be attributed to a routine that is being profiled. However, the process depicted in FIG. 21A includes an approach for compensating for the trace record generation overhead caused by the profiling process. FIG. 23A shows a process to be used during the post-processing phase of a profiling process.

[0164] The process begins by retrieving the previous event time that was saved after processing the previous trace record (step 2302). The next trace record is retrieved from the trace file (step 2304) and parsed to get the starting timestamp and ending timestamp of a current event, i.e. an event represented by the trace record that is currently being processed (step 2306). The delta event time is computed as the difference between the starting time of the current event record and the previous event time (step 2308). Alternatively, the delta time may be computed as a difference between one of the timestamps in the previous trace record and one of the timestamps in the current trace record.

[0165] The computed delta event time is then attributed to the current routine (step 2312). The ending timestamp of the current trace record is then saved as the previous event time (step 2314). The previous event time may be optionally adjusted by adding a compensation value equal to the amount of time required to obtain a single timestamp (step 2316). The process is then complete with respect to computing a delta event time and attributing it to the proper routine.

[0166] By assuming that half of the time required to obtain a timestamp may have passed from the moment at which a call is made to get the timestamp to the moment at which the system time is actually read, one may also assume that a small amount of time that should be attributed to the trace record generation overhead, i.e. the time required to obtain a timestamp, has not been captured within the time period demarcated by the starting timestamp and the ending timestamp stored within a trace record. By optionally adding to the previous event time the amount of time necessary to make a call to obtain a timestamp, the amount of time that would be attributed to the execution of the routine is adjusted. Alternatively, the unadjusted ending timestamp of the previous event may be stored as the previous event time, and the delta event time may be adjusted by subtracting the amount of overhead time necessary to make a call to obtain a timestamp.

[0167] With reference now to FIG. 23B, a timeline depicts the time points with which the process within FIG. 23A is concerned. The timeline depicted in FIG. 23B is similar to the timeline depicted in FIG. 20B except that the timeline in FIG. 23B also includes an indication of the trace record generation overhead time for which the present invention attempts to compensate.

[0168] As described above, time point 2352 demarcates the previous event time, i.e. the end of the recording of a previous event. Time point 2350 demarcates the ending timestamp that was stored within the trace record of the previous event. The time between the two points represents the overhead required to obtain a single timestamp, and timestamp overhead time period 2354 has been used to adjust the stored ending time of the previous event.

[0169] Time period 2356 represents the delta event time, i.e. the amount of time attributable to the execution of the current routine, i.e. the routine associated with the trace record that is currently being processed. Time point 2358 is the starting timestamp stored within the trace record of the current event, i.e. the event currently being processed, and time point 2360 is the ending timestamp stored within the trace record of the current event. Hence, time period 2362 represents the amount of overhead time required to generate a trace record.

[0170] The delta event time is, ideally, the amount of time between the recording of two events. However, because the generation of a trace record requires a certain amount of time, the entire delta event time is not consumed by the execution of the current routine—some of the time is consumed by the execution of the profiler. Although the generation of a single trace record may consist of a relatively short amount of time, the profiler may process trace events and could also generate thousands of trace records from the trace events. In a typical case, the trace events and/or records are generated via an instrumented application or operating system. The total amount of time spent generating the trace records may then grow to a significant percentage of the overall execution time. If this profiling overhead time is not determined and the base time of the profiled routines are not compensated for this overhead time, then the profile of the execution of the program may contain significant distortion as to the time spent within various routines.

[0171] The advantages of the present invention should be apparent in view of the detailed description of the invention provided above. Trace records of some form are necessary as external evidence of the internal operations of a program that is being profiled. However, the generation of the trace records introduces some distortion in the execution flows of the profiled program. With the present invention, one can attempt to determine the amount of trace record generation overhead caused by creating the trace records necessary for providing profile information. The base times of the routines within the execution flows of the profiled program are then computed without this trace record generation overhead.

[0172] It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include recordable-type media such a floppy disc, a hard disk drive, a RAM, and CD-ROMs and transmission-type media such as digital and analog communications links.

[0173] The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.