Trace process specific kernel functions with ftrace

   In my previous blog, We have learnt  how to setup ftrace environment and function level tracing . In this post we will learn on how to trace the kernel function specific to a particular process and function filter.

1. trace kernel calls specific to process

As we know we have /sys/kernel/debug/tracing directory. In this we have set_ftrace_pid file.

•   First we need to make sure tracing_on is not enabled, by echoing 0 to tracing_on.
•   Disable all tracers by echoing 'nop' to current_tracer.
•   echo the pid of the process which we have to trace to set_ftrace_pid file. (say pid of ntpd, that is 2444)
•   Enable function or function_graph tracer by echoing corresponding tracing  in to current_tracer file.
•   Enable tracer by echoing 1 to tracing_on.
•   Now if you run the cat trace you will find the kernel function trace which are invoked by that process.

•  To disable this tracing  you need to do the reverse order. first disable tracing_on, then disable function tracing, and then at last echo nothing to set_ftrace_pid (to disable) as below.

             %echo > set_ftrace_pid

you can verify whether no pid has been written in to set_ftrace_pid file by opening the same.
I tried to echo -1 as documented, but it fails. Hence I found this workaround.

2. To trace specific functions:

    First we need to check whether the function which we are interested is in 'available_filter_functions'.

If not you can you can browse the kernel code to get which function is invoking the function, which you are interested in. So that you can search that function in this available_filter_functions list. 

Once you get that the function in the available_filter_functions file, echo that function to set_ftrace_filter file.  the process is very similar to the above one, except the instead of pid, we will echo the function to set_ftrace_filter. Make sure "no pid" phrase in set_ftrace_pid file.

 You can specify just one function or multiple functions in set_ftrace_filter file (one function per line).

Here in the below example I have selected ext4_write_inode and ext4_inode_table functions.
The below tracing filtered out  only those functions.

you can enable function graph  instead of function in the current_tracer.

To disable the  this tracing, we need to disable tracing_on,  current_tracer and then set_ftrace_filter in order. To disable set_ftrace_filter we can echo null to set_ftrace_filter.

            % echo > set_ftrace_filter

Thanks
Shivu