1 ftrace - Function Tracer
2 ========================
4 Copyright 2008 Red Hat Inc.
5 Author: Steven Rostedt <srostedt@redhat.com>
6 License: The GNU Free Documentation License, Version 1.2
7 (dual licensed under the GPL v2)
8 Reviewers: Elias Oltmanns, Randy Dunlap, Andrew Morton,
9 John Kacur, and David Teigland.
11 Written for: 2.6.28-rc2
16 Ftrace is an internal tracer designed to help out developers and
17 designers of systems to find what is going on inside the kernel.
18 It can be used for debugging or analyzing latencies and performance
19 issues that take place outside of user-space.
21 Although ftrace is the function tracer, it also includes an
22 infrastructure that allows for other types of tracing. Some of the
23 tracers that are currently in ftrace include a tracer to trace
24 context switches, the time it takes for a high priority task to
25 run after it was woken up, the time interrupts are disabled, and
26 more (ftrace allows for tracer plugins, which means that the list of
27 tracers can always grow).
33 Ftrace uses the debugfs file system to hold the control files as well
34 as the files to display output.
36 To mount the debugfs system:
39 # mount -t debugfs nodev /debug
41 (Note: it is more common to mount at /sys/kernel/debug, but for simplicity
42 this document will use /debug)
44 That's it! (assuming that you have ftrace configured into your kernel)
46 After mounting the debugfs, you can see a directory called
47 "tracing". This directory contains the control and output files
48 of ftrace. Here is a list of some of the key files:
51 Note: all time values are in microseconds.
53 current_tracer: This is used to set or display the current tracer
56 available_tracers: This holds the different types of tracers that
57 have been compiled into the kernel. The tracers
58 listed here can be configured by echoing their name
61 tracing_enabled: This sets or displays whether the current_tracer
62 is activated and tracing or not. Echo 0 into this
63 file to disable the tracer or 1 to enable it.
65 trace: This file holds the output of the trace in a human readable
66 format (described below).
68 latency_trace: This file shows the same trace but the information
69 is organized more to display possible latencies
70 in the system (described below).
72 trace_pipe: The output is the same as the "trace" file but this
73 file is meant to be streamed with live tracing.
74 Reads from this file will block until new data
75 is retrieved. Unlike the "trace" and "latency_trace"
76 files, this file is a consumer. This means reading
77 from this file causes sequential reads to display
78 more current data. Once data is read from this
79 file, it is consumed, and will not be read
80 again with a sequential read. The "trace" and
81 "latency_trace" files are static, and if the
82 tracer is not adding more data, they will display
83 the same information every time they are read.
85 trace_options: This file lets the user control the amount of data
86 that is displayed in one of the above output
89 trace_max_latency: Some of the tracers record the max latency.
90 For example, the time interrupts are disabled.
91 This time is saved in this file. The max trace
92 will also be stored, and displayed by either
93 "trace" or "latency_trace". A new max trace will
94 only be recorded if the latency is greater than
95 the value in this file. (in microseconds)
97 buffer_size_kb: This sets or displays the number of kilobytes each CPU
98 buffer can hold. The tracer buffers are the same size
99 for each CPU. The displayed number is the size of the
100 CPU buffer and not total size of all buffers. The
101 trace buffers are allocated in pages (blocks of memory
102 that the kernel uses for allocation, usually 4 KB in size).
103 If the last page allocated has room for more bytes
104 than requested, the rest of the page will be used,
105 making the actual allocation bigger than requested.
106 (Note, the size may not be a multiple of the page size due
107 to buffer managment overhead.)
109 This can only be updated when the current_tracer
112 tracing_cpumask: This is a mask that lets the user only trace
113 on specified CPUS. The format is a hex string
114 representing the CPUS.
116 set_ftrace_filter: When dynamic ftrace is configured in (see the
117 section below "dynamic ftrace"), the code is dynamically
118 modified (code text rewrite) to disable calling of the
119 function profiler (mcount). This lets tracing be configured
120 in with practically no overhead in performance. This also
121 has a side effect of enabling or disabling specific functions
122 to be traced. Echoing names of functions into this file
123 will limit the trace to only those functions.
125 set_ftrace_notrace: This has an effect opposite to that of
126 set_ftrace_filter. Any function that is added here will not
127 be traced. If a function exists in both set_ftrace_filter
128 and set_ftrace_notrace, the function will _not_ be traced.
130 set_ftrace_pid: Have the function tracer only trace a single thread.
132 available_filter_functions: This lists the functions that ftrace
133 has processed and can trace. These are the function
134 names that you can pass to "set_ftrace_filter" or
135 "set_ftrace_notrace". (See the section "dynamic ftrace"
136 below for more details.)
142 Here is the list of current tracers that may be configured.
144 function - function tracer that uses mcount to trace all functions.
146 sched_switch - traces the context switches between tasks.
148 irqsoff - traces the areas that disable interrupts and saves
149 the trace with the longest max latency.
150 See tracing_max_latency. When a new max is recorded,
151 it replaces the old trace. It is best to view this
152 trace via the latency_trace file.
154 preemptoff - Similar to irqsoff but traces and records the amount of
155 time for which preemption is disabled.
157 preemptirqsoff - Similar to irqsoff and preemptoff, but traces and
158 records the largest time for which irqs and/or preemption
161 wakeup - Traces and records the max latency that it takes for
162 the highest priority task to get scheduled after
163 it has been woken up.
165 nop - This is not a tracer. To remove all tracers from tracing
166 simply echo "nop" into current_tracer.
168 hw-branch-tracer - traces branches on all cpu's in a circular buffer.
171 Examples of using the tracer
172 ----------------------------
174 Here are typical examples of using the tracers when controlling them only
175 with the debugfs interface (without using any user-land utilities).
180 Here is an example of the output format of the file "trace"
185 # TASK-PID CPU# TIMESTAMP FUNCTION
187 bash-4251 [01] 10152.583854: path_put <-path_walk
188 bash-4251 [01] 10152.583855: dput <-path_put
189 bash-4251 [01] 10152.583855: _atomic_dec_and_lock <-dput
192 A header is printed with the tracer name that is represented by the trace.
193 In this case the tracer is "function". Then a header showing the format. Task
194 name "bash", the task PID "4251", the CPU that it was running on
195 "01", the timestamp in <secs>.<usecs> format, the function name that was
196 traced "path_put" and the parent function that called this function
197 "path_walk". The timestamp is the time at which the function was
200 The sched_switch tracer also includes tracing of task wakeups and
203 ksoftirqd/1-7 [01] 1453.070013: 7:115:R + 2916:115:S
204 ksoftirqd/1-7 [01] 1453.070013: 7:115:R + 10:115:S
205 ksoftirqd/1-7 [01] 1453.070013: 7:115:R ==> 10:115:R
206 events/1-10 [01] 1453.070013: 10:115:S ==> 2916:115:R
207 kondemand/1-2916 [01] 1453.070013: 2916:115:S ==> 7:115:R
208 ksoftirqd/1-7 [01] 1453.070013: 7:115:S ==> 0:140:R
210 Wake ups are represented by a "+" and the context switches are shown as
211 "==>". The format is:
215 Previous task Next Task
217 <pid>:<prio>:<state> ==> <pid>:<prio>:<state>
221 Current task Task waking up
223 <pid>:<prio>:<state> + <pid>:<prio>:<state>
225 The prio is the internal kernel priority, which is the inverse of the
226 priority that is usually displayed by user-space tools. Zero represents
227 the highest priority (99). Prio 100 starts the "nice" priorities with
228 100 being equal to nice -20 and 139 being nice 19. The prio "140" is
229 reserved for the idle task which is the lowest priority thread (pid 0).
235 For traces that display latency times, the latency_trace file gives
236 somewhat more information to see why a latency happened. Here is a typical
241 irqsoff latency trace v1.1.5 on 2.6.26-rc8
242 --------------------------------------------------------------------
243 latency: 97 us, #3/3, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
245 | task: swapper-0 (uid:0 nice:0 policy:0 rt_prio:0)
247 => started at: apic_timer_interrupt
248 => ended at: do_softirq
251 # / _-----=> irqs-off
252 # | / _----=> need-resched
253 # || / _---=> hardirq/softirq
254 # ||| / _--=> preempt-depth
257 # cmd pid ||||| time | caller
259 <idle>-0 0d..1 0us+: trace_hardirqs_off_thunk (apic_timer_interrupt)
260 <idle>-0 0d.s. 97us : __do_softirq (do_softirq)
261 <idle>-0 0d.s1 98us : trace_hardirqs_on (do_softirq)
265 This shows that the current tracer is "irqsoff" tracing the time for which
266 interrupts were disabled. It gives the trace version and the version
267 of the kernel upon which this was executed on (2.6.26-rc8). Then it displays
268 the max latency in microsecs (97 us). The number of trace entries displayed
269 and the total number recorded (both are three: #3/3). The type of
270 preemption that was used (PREEMPT). VP, KP, SP, and HP are always zero
271 and are reserved for later use. #P is the number of online CPUS (#P:2).
273 The task is the process that was running when the latency occurred.
276 The start and stop (the functions in which the interrupts were disabled and
277 enabled respectively) that caused the latencies:
279 apic_timer_interrupt is where the interrupts were disabled.
280 do_softirq is where they were enabled again.
282 The next lines after the header are the trace itself. The header
283 explains which is which.
285 cmd: The name of the process in the trace.
287 pid: The PID of that process.
289 CPU#: The CPU which the process was running on.
291 irqs-off: 'd' interrupts are disabled. '.' otherwise.
292 Note: If the architecture does not support a way to
293 read the irq flags variable, an 'X' will always
296 need-resched: 'N' task need_resched is set, '.' otherwise.
299 'H' - hard irq occurred inside a softirq.
300 'h' - hard irq is running
301 's' - soft irq is running
302 '.' - normal context.
304 preempt-depth: The level of preempt_disabled
306 The above is mostly meaningful for kernel developers.
308 time: This differs from the trace file output. The trace file output
309 includes an absolute timestamp. The timestamp used by the
310 latency_trace file is relative to the start of the trace.
312 delay: This is just to help catch your eye a bit better. And
313 needs to be fixed to be only relative to the same CPU.
314 The marks are determined by the difference between this
315 current trace and the next trace.
316 '!' - greater than preempt_mark_thresh (default 100)
317 '+' - greater than 1 microsecond
318 ' ' - less than or equal to 1 microsecond.
320 The rest is the same as the 'trace' file.
326 The trace_options file is used to control what gets printed in the trace
327 output. To see what is available, simply cat the file:
329 cat /debug/tracing/trace_options
330 print-parent nosym-offset nosym-addr noverbose noraw nohex nobin \
331 noblock nostacktrace nosched-tree nouserstacktrace nosym-userobj
333 To disable one of the options, echo in the option prepended with "no".
335 echo noprint-parent > /debug/tracing/trace_options
337 To enable an option, leave off the "no".
339 echo sym-offset > /debug/tracing/trace_options
341 Here are the available options:
343 print-parent - On function traces, display the calling function
344 as well as the function being traced.
347 bash-4000 [01] 1477.606694: simple_strtoul <-strict_strtoul
350 bash-4000 [01] 1477.606694: simple_strtoul
353 sym-offset - Display not only the function name, but also the offset
354 in the function. For example, instead of seeing just
355 "ktime_get", you will see "ktime_get+0xb/0x20".
358 bash-4000 [01] 1477.606694: simple_strtoul+0x6/0xa0
360 sym-addr - this will also display the function address as well as
364 bash-4000 [01] 1477.606694: simple_strtoul <c0339346>
366 verbose - This deals with the latency_trace file.
368 bash 4000 1 0 00000000 00010a95 [58127d26] 1720.415ms \
369 (+0.000ms): simple_strtoul (strict_strtoul)
371 raw - This will display raw numbers. This option is best for use with
372 user applications that can translate the raw numbers better than
373 having it done in the kernel.
375 hex - Similar to raw, but the numbers will be in a hexadecimal format.
377 bin - This will print out the formats in raw binary.
379 block - TBD (needs update)
381 stacktrace - This is one of the options that changes the trace itself.
382 When a trace is recorded, so is the stack of functions.
383 This allows for back traces of trace sites.
385 userstacktrace - This option changes the trace.
386 It records a stacktrace of the current userspace thread.
388 sym-userobj - when user stacktrace are enabled, look up which object the
389 address belongs to, and print a relative address
390 This is especially useful when ASLR is on, otherwise you don't
391 get a chance to resolve the address to object/file/line after the app is no
394 The lookup is performed when you read trace,trace_pipe,latency_trace. Example:
396 a.out-1623 [000] 40874.465068: /root/a.out[+0x480] <-/root/a.out[+0
397 x494] <- /root/a.out[+0x4a8] <- /lib/libc-2.7.so[+0x1e1a6]
399 sched-tree - TBD (any users??)
405 This tracer simply records schedule switches. Here is an example
408 # echo sched_switch > /debug/tracing/current_tracer
409 # echo 1 > /debug/tracing/tracing_enabled
411 # echo 0 > /debug/tracing/tracing_enabled
412 # cat /debug/tracing/trace
414 # tracer: sched_switch
416 # TASK-PID CPU# TIMESTAMP FUNCTION
418 bash-3997 [01] 240.132281: 3997:120:R + 4055:120:R
419 bash-3997 [01] 240.132284: 3997:120:R ==> 4055:120:R
420 sleep-4055 [01] 240.132371: 4055:120:S ==> 3997:120:R
421 bash-3997 [01] 240.132454: 3997:120:R + 4055:120:S
422 bash-3997 [01] 240.132457: 3997:120:R ==> 4055:120:R
423 sleep-4055 [01] 240.132460: 4055:120:D ==> 3997:120:R
424 bash-3997 [01] 240.132463: 3997:120:R + 4055:120:D
425 bash-3997 [01] 240.132465: 3997:120:R ==> 4055:120:R
426 <idle>-0 [00] 240.132589: 0:140:R + 4:115:S
427 <idle>-0 [00] 240.132591: 0:140:R ==> 4:115:R
428 ksoftirqd/0-4 [00] 240.132595: 4:115:S ==> 0:140:R
429 <idle>-0 [00] 240.132598: 0:140:R + 4:115:S
430 <idle>-0 [00] 240.132599: 0:140:R ==> 4:115:R
431 ksoftirqd/0-4 [00] 240.132603: 4:115:S ==> 0:140:R
432 sleep-4055 [01] 240.133058: 4055:120:S ==> 3997:120:R
436 As we have discussed previously about this format, the header shows
437 the name of the trace and points to the options. The "FUNCTION"
438 is a misnomer since here it represents the wake ups and context
441 The sched_switch file only lists the wake ups (represented with '+')
442 and context switches ('==>') with the previous task or current task
443 first followed by the next task or task waking up. The format for both
444 of these is PID:KERNEL-PRIO:TASK-STATE. Remember that the KERNEL-PRIO
445 is the inverse of the actual priority with zero (0) being the highest
446 priority and the nice values starting at 100 (nice -20). Below is
447 a quick chart to map the kernel priority to user land priorities.
449 Kernel priority: 0 to 99 ==> user RT priority 99 to 0
450 Kernel priority: 100 to 139 ==> user nice -20 to 19
451 Kernel priority: 140 ==> idle task priority
455 R - running : wants to run, may not actually be running
456 S - sleep : process is waiting to be woken up (handles signals)
457 D - disk sleep (uninterruptible sleep) : process must be woken up
459 T - stopped : process suspended
460 t - traced : process is being traced (with something like gdb)
461 Z - zombie : process waiting to be cleaned up
468 The following tracers (listed below) give different output depending
469 on whether or not the sysctl ftrace_enabled is set. To set ftrace_enabled,
470 one can either use the sysctl function or set it via the proc
471 file system interface.
473 sysctl kernel.ftrace_enabled=1
477 echo 1 > /proc/sys/kernel/ftrace_enabled
479 To disable ftrace_enabled simply replace the '1' with '0' in
482 When ftrace_enabled is set the tracers will also record the functions
483 that are within the trace. The descriptions of the tracers
484 will also show an example with ftrace enabled.
490 When interrupts are disabled, the CPU can not react to any other
491 external event (besides NMIs and SMIs). This prevents the timer
492 interrupt from triggering or the mouse interrupt from letting the
493 kernel know of a new mouse event. The result is a latency with the
496 The irqsoff tracer tracks the time for which interrupts are disabled.
497 When a new maximum latency is hit, the tracer saves the trace leading up
498 to that latency point so that every time a new maximum is reached, the old
499 saved trace is discarded and the new trace is saved.
501 To reset the maximum, echo 0 into tracing_max_latency. Here is an
504 # echo irqsoff > /debug/tracing/current_tracer
505 # echo 0 > /debug/tracing/tracing_max_latency
506 # echo 1 > /debug/tracing/tracing_enabled
509 # echo 0 > /debug/tracing/tracing_enabled
510 # cat /debug/tracing/latency_trace
513 irqsoff latency trace v1.1.5 on 2.6.26
514 --------------------------------------------------------------------
515 latency: 12 us, #3/3, CPU#1 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
517 | task: bash-3730 (uid:0 nice:0 policy:0 rt_prio:0)
519 => started at: sys_setpgid
520 => ended at: sys_setpgid
523 # / _-----=> irqs-off
524 # | / _----=> need-resched
525 # || / _---=> hardirq/softirq
526 # ||| / _--=> preempt-depth
529 # cmd pid ||||| time | caller
531 bash-3730 1d... 0us : _write_lock_irq (sys_setpgid)
532 bash-3730 1d..1 1us+: _write_unlock_irq (sys_setpgid)
533 bash-3730 1d..2 14us : trace_hardirqs_on (sys_setpgid)
536 Here we see that that we had a latency of 12 microsecs (which is
537 very good). The _write_lock_irq in sys_setpgid disabled interrupts.
538 The difference between the 12 and the displayed timestamp 14us occurred
539 because the clock was incremented between the time of recording the max
540 latency and the time of recording the function that had that latency.
542 Note the above example had ftrace_enabled not set. If we set the
543 ftrace_enabled, we get a much larger output:
547 irqsoff latency trace v1.1.5 on 2.6.26-rc8
548 --------------------------------------------------------------------
549 latency: 50 us, #101/101, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
551 | task: ls-4339 (uid:0 nice:0 policy:0 rt_prio:0)
553 => started at: __alloc_pages_internal
554 => ended at: __alloc_pages_internal
557 # / _-----=> irqs-off
558 # | / _----=> need-resched
559 # || / _---=> hardirq/softirq
560 # ||| / _--=> preempt-depth
563 # cmd pid ||||| time | caller
565 ls-4339 0...1 0us+: get_page_from_freelist (__alloc_pages_internal)
566 ls-4339 0d..1 3us : rmqueue_bulk (get_page_from_freelist)
567 ls-4339 0d..1 3us : _spin_lock (rmqueue_bulk)
568 ls-4339 0d..1 4us : add_preempt_count (_spin_lock)
569 ls-4339 0d..2 4us : __rmqueue (rmqueue_bulk)
570 ls-4339 0d..2 5us : __rmqueue_smallest (__rmqueue)
571 ls-4339 0d..2 5us : __mod_zone_page_state (__rmqueue_smallest)
572 ls-4339 0d..2 6us : __rmqueue (rmqueue_bulk)
573 ls-4339 0d..2 6us : __rmqueue_smallest (__rmqueue)
574 ls-4339 0d..2 7us : __mod_zone_page_state (__rmqueue_smallest)
575 ls-4339 0d..2 7us : __rmqueue (rmqueue_bulk)
576 ls-4339 0d..2 8us : __rmqueue_smallest (__rmqueue)
578 ls-4339 0d..2 46us : __rmqueue_smallest (__rmqueue)
579 ls-4339 0d..2 47us : __mod_zone_page_state (__rmqueue_smallest)
580 ls-4339 0d..2 47us : __rmqueue (rmqueue_bulk)
581 ls-4339 0d..2 48us : __rmqueue_smallest (__rmqueue)
582 ls-4339 0d..2 48us : __mod_zone_page_state (__rmqueue_smallest)
583 ls-4339 0d..2 49us : _spin_unlock (rmqueue_bulk)
584 ls-4339 0d..2 49us : sub_preempt_count (_spin_unlock)
585 ls-4339 0d..1 50us : get_page_from_freelist (__alloc_pages_internal)
586 ls-4339 0d..2 51us : trace_hardirqs_on (__alloc_pages_internal)
590 Here we traced a 50 microsecond latency. But we also see all the
591 functions that were called during that time. Note that by enabling
592 function tracing, we incur an added overhead. This overhead may
593 extend the latency times. But nevertheless, this trace has provided
594 some very helpful debugging information.
600 When preemption is disabled, we may be able to receive interrupts but
601 the task cannot be preempted and a higher priority task must wait
602 for preemption to be enabled again before it can preempt a lower
605 The preemptoff tracer traces the places that disable preemption.
606 Like the irqsoff tracer, it records the maximum latency for which preemption
607 was disabled. The control of preemptoff tracer is much like the irqsoff
610 # echo preemptoff > /debug/tracing/current_tracer
611 # echo 0 > /debug/tracing/tracing_max_latency
612 # echo 1 > /debug/tracing/tracing_enabled
615 # echo 0 > /debug/tracing/tracing_enabled
616 # cat /debug/tracing/latency_trace
619 preemptoff latency trace v1.1.5 on 2.6.26-rc8
620 --------------------------------------------------------------------
621 latency: 29 us, #3/3, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
623 | task: sshd-4261 (uid:0 nice:0 policy:0 rt_prio:0)
625 => started at: do_IRQ
626 => ended at: __do_softirq
629 # / _-----=> irqs-off
630 # | / _----=> need-resched
631 # || / _---=> hardirq/softirq
632 # ||| / _--=> preempt-depth
635 # cmd pid ||||| time | caller
637 sshd-4261 0d.h. 0us+: irq_enter (do_IRQ)
638 sshd-4261 0d.s. 29us : _local_bh_enable (__do_softirq)
639 sshd-4261 0d.s1 30us : trace_preempt_on (__do_softirq)
642 This has some more changes. Preemption was disabled when an interrupt
643 came in (notice the 'h'), and was enabled while doing a softirq.
644 (notice the 's'). But we also see that interrupts have been disabled
645 when entering the preempt off section and leaving it (the 'd').
646 We do not know if interrupts were enabled in the mean time.
650 preemptoff latency trace v1.1.5 on 2.6.26-rc8
651 --------------------------------------------------------------------
652 latency: 63 us, #87/87, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
654 | task: sshd-4261 (uid:0 nice:0 policy:0 rt_prio:0)
656 => started at: remove_wait_queue
657 => ended at: __do_softirq
660 # / _-----=> irqs-off
661 # | / _----=> need-resched
662 # || / _---=> hardirq/softirq
663 # ||| / _--=> preempt-depth
666 # cmd pid ||||| time | caller
668 sshd-4261 0d..1 0us : _spin_lock_irqsave (remove_wait_queue)
669 sshd-4261 0d..1 1us : _spin_unlock_irqrestore (remove_wait_queue)
670 sshd-4261 0d..1 2us : do_IRQ (common_interrupt)
671 sshd-4261 0d..1 2us : irq_enter (do_IRQ)
672 sshd-4261 0d..1 2us : idle_cpu (irq_enter)
673 sshd-4261 0d..1 3us : add_preempt_count (irq_enter)
674 sshd-4261 0d.h1 3us : idle_cpu (irq_enter)
675 sshd-4261 0d.h. 4us : handle_fasteoi_irq (do_IRQ)
677 sshd-4261 0d.h. 12us : add_preempt_count (_spin_lock)
678 sshd-4261 0d.h1 12us : ack_ioapic_quirk_irq (handle_fasteoi_irq)
679 sshd-4261 0d.h1 13us : move_native_irq (ack_ioapic_quirk_irq)
680 sshd-4261 0d.h1 13us : _spin_unlock (handle_fasteoi_irq)
681 sshd-4261 0d.h1 14us : sub_preempt_count (_spin_unlock)
682 sshd-4261 0d.h1 14us : irq_exit (do_IRQ)
683 sshd-4261 0d.h1 15us : sub_preempt_count (irq_exit)
684 sshd-4261 0d..2 15us : do_softirq (irq_exit)
685 sshd-4261 0d... 15us : __do_softirq (do_softirq)
686 sshd-4261 0d... 16us : __local_bh_disable (__do_softirq)
687 sshd-4261 0d... 16us+: add_preempt_count (__local_bh_disable)
688 sshd-4261 0d.s4 20us : add_preempt_count (__local_bh_disable)
689 sshd-4261 0d.s4 21us : sub_preempt_count (local_bh_enable)
690 sshd-4261 0d.s5 21us : sub_preempt_count (local_bh_enable)
692 sshd-4261 0d.s6 41us : add_preempt_count (__local_bh_disable)
693 sshd-4261 0d.s6 42us : sub_preempt_count (local_bh_enable)
694 sshd-4261 0d.s7 42us : sub_preempt_count (local_bh_enable)
695 sshd-4261 0d.s5 43us : add_preempt_count (__local_bh_disable)
696 sshd-4261 0d.s5 43us : sub_preempt_count (local_bh_enable_ip)
697 sshd-4261 0d.s6 44us : sub_preempt_count (local_bh_enable_ip)
698 sshd-4261 0d.s5 44us : add_preempt_count (__local_bh_disable)
699 sshd-4261 0d.s5 45us : sub_preempt_count (local_bh_enable)
701 sshd-4261 0d.s. 63us : _local_bh_enable (__do_softirq)
702 sshd-4261 0d.s1 64us : trace_preempt_on (__do_softirq)
705 The above is an example of the preemptoff trace with ftrace_enabled
706 set. Here we see that interrupts were disabled the entire time.
707 The irq_enter code lets us know that we entered an interrupt 'h'.
708 Before that, the functions being traced still show that it is not
709 in an interrupt, but we can see from the functions themselves that
710 this is not the case.
712 Notice that __do_softirq when called does not have a preempt_count.
713 It may seem that we missed a preempt enabling. What really happened
714 is that the preempt count is held on the thread's stack and we
715 switched to the softirq stack (4K stacks in effect). The code
716 does not copy the preempt count, but because interrupts are disabled,
717 we do not need to worry about it. Having a tracer like this is good
718 for letting people know what really happens inside the kernel.
724 Knowing the locations that have interrupts disabled or preemption
725 disabled for the longest times is helpful. But sometimes we would
726 like to know when either preemption and/or interrupts are disabled.
728 Consider the following code:
731 call_function_with_irqs_off();
733 call_function_with_irqs_and_preemption_off();
735 call_function_with_preemption_off();
738 The irqsoff tracer will record the total length of
739 call_function_with_irqs_off() and
740 call_function_with_irqs_and_preemption_off().
742 The preemptoff tracer will record the total length of
743 call_function_with_irqs_and_preemption_off() and
744 call_function_with_preemption_off().
746 But neither will trace the time that interrupts and/or preemption
747 is disabled. This total time is the time that we can not schedule.
748 To record this time, use the preemptirqsoff tracer.
750 Again, using this trace is much like the irqsoff and preemptoff tracers.
752 # echo preemptirqsoff > /debug/tracing/current_tracer
753 # echo 0 > /debug/tracing/tracing_max_latency
754 # echo 1 > /debug/tracing/tracing_enabled
757 # echo 0 > /debug/tracing/tracing_enabled
758 # cat /debug/tracing/latency_trace
759 # tracer: preemptirqsoff
761 preemptirqsoff latency trace v1.1.5 on 2.6.26-rc8
762 --------------------------------------------------------------------
763 latency: 293 us, #3/3, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
765 | task: ls-4860 (uid:0 nice:0 policy:0 rt_prio:0)
767 => started at: apic_timer_interrupt
768 => ended at: __do_softirq
771 # / _-----=> irqs-off
772 # | / _----=> need-resched
773 # || / _---=> hardirq/softirq
774 # ||| / _--=> preempt-depth
777 # cmd pid ||||| time | caller
779 ls-4860 0d... 0us!: trace_hardirqs_off_thunk (apic_timer_interrupt)
780 ls-4860 0d.s. 294us : _local_bh_enable (__do_softirq)
781 ls-4860 0d.s1 294us : trace_preempt_on (__do_softirq)
785 The trace_hardirqs_off_thunk is called from assembly on x86 when
786 interrupts are disabled in the assembly code. Without the function
787 tracing, we do not know if interrupts were enabled within the preemption
788 points. We do see that it started with preemption enabled.
790 Here is a trace with ftrace_enabled set:
793 # tracer: preemptirqsoff
795 preemptirqsoff latency trace v1.1.5 on 2.6.26-rc8
796 --------------------------------------------------------------------
797 latency: 105 us, #183/183, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
799 | task: sshd-4261 (uid:0 nice:0 policy:0 rt_prio:0)
801 => started at: write_chan
802 => ended at: __do_softirq
805 # / _-----=> irqs-off
806 # | / _----=> need-resched
807 # || / _---=> hardirq/softirq
808 # ||| / _--=> preempt-depth
811 # cmd pid ||||| time | caller
813 ls-4473 0.N.. 0us : preempt_schedule (write_chan)
814 ls-4473 0dN.1 1us : _spin_lock (schedule)
815 ls-4473 0dN.1 2us : add_preempt_count (_spin_lock)
816 ls-4473 0d..2 2us : put_prev_task_fair (schedule)
818 ls-4473 0d..2 13us : set_normalized_timespec (ktime_get_ts)
819 ls-4473 0d..2 13us : __switch_to (schedule)
820 sshd-4261 0d..2 14us : finish_task_switch (schedule)
821 sshd-4261 0d..2 14us : _spin_unlock_irq (finish_task_switch)
822 sshd-4261 0d..1 15us : add_preempt_count (_spin_lock_irqsave)
823 sshd-4261 0d..2 16us : _spin_unlock_irqrestore (hrtick_set)
824 sshd-4261 0d..2 16us : do_IRQ (common_interrupt)
825 sshd-4261 0d..2 17us : irq_enter (do_IRQ)
826 sshd-4261 0d..2 17us : idle_cpu (irq_enter)
827 sshd-4261 0d..2 18us : add_preempt_count (irq_enter)
828 sshd-4261 0d.h2 18us : idle_cpu (irq_enter)
829 sshd-4261 0d.h. 18us : handle_fasteoi_irq (do_IRQ)
830 sshd-4261 0d.h. 19us : _spin_lock (handle_fasteoi_irq)
831 sshd-4261 0d.h. 19us : add_preempt_count (_spin_lock)
832 sshd-4261 0d.h1 20us : _spin_unlock (handle_fasteoi_irq)
833 sshd-4261 0d.h1 20us : sub_preempt_count (_spin_unlock)
835 sshd-4261 0d.h1 28us : _spin_unlock (handle_fasteoi_irq)
836 sshd-4261 0d.h1 29us : sub_preempt_count (_spin_unlock)
837 sshd-4261 0d.h2 29us : irq_exit (do_IRQ)
838 sshd-4261 0d.h2 29us : sub_preempt_count (irq_exit)
839 sshd-4261 0d..3 30us : do_softirq (irq_exit)
840 sshd-4261 0d... 30us : __do_softirq (do_softirq)
841 sshd-4261 0d... 31us : __local_bh_disable (__do_softirq)
842 sshd-4261 0d... 31us+: add_preempt_count (__local_bh_disable)
843 sshd-4261 0d.s4 34us : add_preempt_count (__local_bh_disable)
845 sshd-4261 0d.s3 43us : sub_preempt_count (local_bh_enable_ip)
846 sshd-4261 0d.s4 44us : sub_preempt_count (local_bh_enable_ip)
847 sshd-4261 0d.s3 44us : smp_apic_timer_interrupt (apic_timer_interrupt)
848 sshd-4261 0d.s3 45us : irq_enter (smp_apic_timer_interrupt)
849 sshd-4261 0d.s3 45us : idle_cpu (irq_enter)
850 sshd-4261 0d.s3 46us : add_preempt_count (irq_enter)
851 sshd-4261 0d.H3 46us : idle_cpu (irq_enter)
852 sshd-4261 0d.H3 47us : hrtimer_interrupt (smp_apic_timer_interrupt)
853 sshd-4261 0d.H3 47us : ktime_get (hrtimer_interrupt)
855 sshd-4261 0d.H3 81us : tick_program_event (hrtimer_interrupt)
856 sshd-4261 0d.H3 82us : ktime_get (tick_program_event)
857 sshd-4261 0d.H3 82us : ktime_get_ts (ktime_get)
858 sshd-4261 0d.H3 83us : getnstimeofday (ktime_get_ts)
859 sshd-4261 0d.H3 83us : set_normalized_timespec (ktime_get_ts)
860 sshd-4261 0d.H3 84us : clockevents_program_event (tick_program_event)
861 sshd-4261 0d.H3 84us : lapic_next_event (clockevents_program_event)
862 sshd-4261 0d.H3 85us : irq_exit (smp_apic_timer_interrupt)
863 sshd-4261 0d.H3 85us : sub_preempt_count (irq_exit)
864 sshd-4261 0d.s4 86us : sub_preempt_count (irq_exit)
865 sshd-4261 0d.s3 86us : add_preempt_count (__local_bh_disable)
867 sshd-4261 0d.s1 98us : sub_preempt_count (net_rx_action)
868 sshd-4261 0d.s. 99us : add_preempt_count (_spin_lock_irq)
869 sshd-4261 0d.s1 99us+: _spin_unlock_irq (run_timer_softirq)
870 sshd-4261 0d.s. 104us : _local_bh_enable (__do_softirq)
871 sshd-4261 0d.s. 104us : sub_preempt_count (_local_bh_enable)
872 sshd-4261 0d.s. 105us : _local_bh_enable (__do_softirq)
873 sshd-4261 0d.s1 105us : trace_preempt_on (__do_softirq)
876 This is a very interesting trace. It started with the preemption of
877 the ls task. We see that the task had the "need_resched" bit set
878 via the 'N' in the trace. Interrupts were disabled before the spin_lock
879 at the beginning of the trace. We see that a schedule took place to run
880 sshd. When the interrupts were enabled, we took an interrupt.
881 On return from the interrupt handler, the softirq ran. We took another
882 interrupt while running the softirq as we see from the capital 'H'.
888 In a Real-Time environment it is very important to know the wakeup
889 time it takes for the highest priority task that is woken up to the
890 time that it executes. This is also known as "schedule latency".
891 I stress the point that this is about RT tasks. It is also important
892 to know the scheduling latency of non-RT tasks, but the average
893 schedule latency is better for non-RT tasks. Tools like
894 LatencyTop are more appropriate for such measurements.
896 Real-Time environments are interested in the worst case latency.
897 That is the longest latency it takes for something to happen, and
898 not the average. We can have a very fast scheduler that may only
899 have a large latency once in a while, but that would not work well
900 with Real-Time tasks. The wakeup tracer was designed to record
901 the worst case wakeups of RT tasks. Non-RT tasks are not recorded
902 because the tracer only records one worst case and tracing non-RT
903 tasks that are unpredictable will overwrite the worst case latency
906 Since this tracer only deals with RT tasks, we will run this slightly
907 differently than we did with the previous tracers. Instead of performing
908 an 'ls', we will run 'sleep 1' under 'chrt' which changes the
909 priority of the task.
911 # echo wakeup > /debug/tracing/current_tracer
912 # echo 0 > /debug/tracing/tracing_max_latency
913 # echo 1 > /debug/tracing/tracing_enabled
915 # echo 0 > /debug/tracing/tracing_enabled
916 # cat /debug/tracing/latency_trace
919 wakeup latency trace v1.1.5 on 2.6.26-rc8
920 --------------------------------------------------------------------
921 latency: 4 us, #2/2, CPU#1 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
923 | task: sleep-4901 (uid:0 nice:0 policy:1 rt_prio:5)
927 # / _-----=> irqs-off
928 # | / _----=> need-resched
929 # || / _---=> hardirq/softirq
930 # ||| / _--=> preempt-depth
933 # cmd pid ||||| time | caller
935 <idle>-0 1d.h4 0us+: try_to_wake_up (wake_up_process)
936 <idle>-0 1d..4 4us : schedule (cpu_idle)
940 Running this on an idle system, we see that it only took 4 microseconds
941 to perform the task switch. Note, since the trace marker in the
942 schedule is before the actual "switch", we stop the tracing when
943 the recorded task is about to schedule in. This may change if
944 we add a new marker at the end of the scheduler.
946 Notice that the recorded task is 'sleep' with the PID of 4901 and it
947 has an rt_prio of 5. This priority is user-space priority and not
948 the internal kernel priority. The policy is 1 for SCHED_FIFO and 2
951 Doing the same with chrt -r 5 and ftrace_enabled set.
955 wakeup latency trace v1.1.5 on 2.6.26-rc8
956 --------------------------------------------------------------------
957 latency: 50 us, #60/60, CPU#1 | (M:preempt VP:0, KP:0, SP:0 HP:0 #P:2)
959 | task: sleep-4068 (uid:0 nice:0 policy:2 rt_prio:5)
963 # / _-----=> irqs-off
964 # | / _----=> need-resched
965 # || / _---=> hardirq/softirq
966 # ||| / _--=> preempt-depth
969 # cmd pid ||||| time | caller
971 ksoftirq-7 1d.H3 0us : try_to_wake_up (wake_up_process)
972 ksoftirq-7 1d.H4 1us : sub_preempt_count (marker_probe_cb)
973 ksoftirq-7 1d.H3 2us : check_preempt_wakeup (try_to_wake_up)
974 ksoftirq-7 1d.H3 3us : update_curr (check_preempt_wakeup)
975 ksoftirq-7 1d.H3 4us : calc_delta_mine (update_curr)
976 ksoftirq-7 1d.H3 5us : __resched_task (check_preempt_wakeup)
977 ksoftirq-7 1d.H3 6us : task_wake_up_rt (try_to_wake_up)
978 ksoftirq-7 1d.H3 7us : _spin_unlock_irqrestore (try_to_wake_up)
980 ksoftirq-7 1d.H2 17us : irq_exit (smp_apic_timer_interrupt)
981 ksoftirq-7 1d.H2 18us : sub_preempt_count (irq_exit)
982 ksoftirq-7 1d.s3 19us : sub_preempt_count (irq_exit)
983 ksoftirq-7 1..s2 20us : rcu_process_callbacks (__do_softirq)
985 ksoftirq-7 1..s2 26us : __rcu_process_callbacks (rcu_process_callbacks)
986 ksoftirq-7 1d.s2 27us : _local_bh_enable (__do_softirq)
987 ksoftirq-7 1d.s2 28us : sub_preempt_count (_local_bh_enable)
988 ksoftirq-7 1.N.3 29us : sub_preempt_count (ksoftirqd)
989 ksoftirq-7 1.N.2 30us : _cond_resched (ksoftirqd)
990 ksoftirq-7 1.N.2 31us : __cond_resched (_cond_resched)
991 ksoftirq-7 1.N.2 32us : add_preempt_count (__cond_resched)
992 ksoftirq-7 1.N.2 33us : schedule (__cond_resched)
993 ksoftirq-7 1.N.2 33us : add_preempt_count (schedule)
994 ksoftirq-7 1.N.3 34us : hrtick_clear (schedule)
995 ksoftirq-7 1dN.3 35us : _spin_lock (schedule)
996 ksoftirq-7 1dN.3 36us : add_preempt_count (_spin_lock)
997 ksoftirq-7 1d..4 37us : put_prev_task_fair (schedule)
998 ksoftirq-7 1d..4 38us : update_curr (put_prev_task_fair)
1000 ksoftirq-7 1d..5 47us : _spin_trylock (tracing_record_cmdline)
1001 ksoftirq-7 1d..5 48us : add_preempt_count (_spin_trylock)
1002 ksoftirq-7 1d..6 49us : _spin_unlock (tracing_record_cmdline)
1003 ksoftirq-7 1d..6 49us : sub_preempt_count (_spin_unlock)
1004 ksoftirq-7 1d..4 50us : schedule (__cond_resched)
1006 The interrupt went off while running ksoftirqd. This task runs at
1007 SCHED_OTHER. Why did not we see the 'N' set early? This may be
1008 a harmless bug with x86_32 and 4K stacks. On x86_32 with 4K stacks
1009 configured, the interrupt and softirq run with their own stack.
1010 Some information is held on the top of the task's stack (need_resched
1011 and preempt_count are both stored there). The setting of the NEED_RESCHED
1012 bit is done directly to the task's stack, but the reading of the
1013 NEED_RESCHED is done by looking at the current stack, which in this case
1014 is the stack for the hard interrupt. This hides the fact that NEED_RESCHED
1015 has been set. We do not see the 'N' until we switch back to the task's
1021 This tracer is the function tracer. Enabling the function tracer
1022 can be done from the debug file system. Make sure the ftrace_enabled is
1023 set; otherwise this tracer is a nop.
1025 # sysctl kernel.ftrace_enabled=1
1026 # echo function > /debug/tracing/current_tracer
1027 # echo 1 > /debug/tracing/tracing_enabled
1029 # echo 0 > /debug/tracing/tracing_enabled
1030 # cat /debug/tracing/trace
1033 # TASK-PID CPU# TIMESTAMP FUNCTION
1035 bash-4003 [00] 123.638713: finish_task_switch <-schedule
1036 bash-4003 [00] 123.638714: _spin_unlock_irq <-finish_task_switch
1037 bash-4003 [00] 123.638714: sub_preempt_count <-_spin_unlock_irq
1038 bash-4003 [00] 123.638715: hrtick_set <-schedule
1039 bash-4003 [00] 123.638715: _spin_lock_irqsave <-hrtick_set
1040 bash-4003 [00] 123.638716: add_preempt_count <-_spin_lock_irqsave
1041 bash-4003 [00] 123.638716: _spin_unlock_irqrestore <-hrtick_set
1042 bash-4003 [00] 123.638717: sub_preempt_count <-_spin_unlock_irqrestore
1043 bash-4003 [00] 123.638717: hrtick_clear <-hrtick_set
1044 bash-4003 [00] 123.638718: sub_preempt_count <-schedule
1045 bash-4003 [00] 123.638718: sub_preempt_count <-preempt_schedule
1046 bash-4003 [00] 123.638719: wait_for_completion <-__stop_machine_run
1047 bash-4003 [00] 123.638719: wait_for_common <-wait_for_completion
1048 bash-4003 [00] 123.638720: _spin_lock_irq <-wait_for_common
1049 bash-4003 [00] 123.638720: add_preempt_count <-_spin_lock_irq
1053 Note: function tracer uses ring buffers to store the above entries.
1054 The newest data may overwrite the oldest data. Sometimes using echo to
1055 stop the trace is not sufficient because the tracing could have overwritten
1056 the data that you wanted to record. For this reason, it is sometimes better to
1057 disable tracing directly from a program. This allows you to stop the
1058 tracing at the point that you hit the part that you are interested in.
1059 To disable the tracing directly from a C program, something like following
1060 code snippet can be used:
1064 int main(int argc, char *argv[]) {
1066 trace_fd = open("/debug/tracing/tracing_enabled", O_WRONLY);
1068 if (condition_hit()) {
1069 write(trace_fd, "0", 1);
1074 Note: Here we hard coded the path name. The debugfs mount is not
1075 guaranteed to be at /debug (and is more commonly at /sys/kernel/debug).
1076 For simple one time traces, the above is sufficent. For anything else,
1077 a search through /proc/mounts may be needed to find where the debugfs
1078 file-system is mounted.
1081 Single thread tracing
1082 ---------------------
1084 By writing into /debug/tracing/set_ftrace_pid you can trace a
1085 single thread. For example:
1087 # cat /debug/tracing/set_ftrace_pid
1089 # echo 3111 > /debug/tracing/set_ftrace_pid
1090 # cat /debug/tracing/set_ftrace_pid
1092 # echo function > /debug/tracing/current_tracer
1093 # cat /debug/tracing/trace | head
1096 # TASK-PID CPU# TIMESTAMP FUNCTION
1098 yum-updatesd-3111 [003] 1637.254676: finish_task_switch <-thread_return
1099 yum-updatesd-3111 [003] 1637.254681: hrtimer_cancel <-schedule_hrtimeout_range
1100 yum-updatesd-3111 [003] 1637.254682: hrtimer_try_to_cancel <-hrtimer_cancel
1101 yum-updatesd-3111 [003] 1637.254683: lock_hrtimer_base <-hrtimer_try_to_cancel
1102 yum-updatesd-3111 [003] 1637.254685: fget_light <-do_sys_poll
1103 yum-updatesd-3111 [003] 1637.254686: pipe_poll <-do_sys_poll
1104 # echo -1 > /debug/tracing/set_ftrace_pid
1105 # cat /debug/tracing/trace |head
1108 # TASK-PID CPU# TIMESTAMP FUNCTION
1110 ##### CPU 3 buffer started ####
1111 yum-updatesd-3111 [003] 1701.957688: free_poll_entry <-poll_freewait
1112 yum-updatesd-3111 [003] 1701.957689: remove_wait_queue <-free_poll_entry
1113 yum-updatesd-3111 [003] 1701.957691: fput <-free_poll_entry
1114 yum-updatesd-3111 [003] 1701.957692: audit_syscall_exit <-sysret_audit
1115 yum-updatesd-3111 [003] 1701.957693: path_put <-audit_syscall_exit
1117 If you want to trace a function when executing, you could use
1118 something like this simple program:
1122 #include <sys/types.h>
1123 #include <sys/stat.h>
1127 int main (int argc, char **argv)
1137 ffd = open("/debug/tracing/current_tracer", O_WRONLY);
1140 write(ffd, "nop", 3);
1142 fd = open("/debug/tracing/set_ftrace_pid", O_WRONLY);
1143 s = sprintf(line, "%d\n", getpid());
1146 write(ffd, "function", 8);
1151 execvp(argv[1], argv+1);
1158 hw-branch-tracer (x86 only)
1159 ---------------------------
1161 This tracer uses the x86 last branch tracing hardware feature to
1162 collect a branch trace on all cpus with relatively low overhead.
1164 The tracer uses a fixed-size circular buffer per cpu and only
1165 traces ring 0 branches. The trace file dumps that buffer in the
1168 # tracer: hw-branch-tracer
1171 0 scheduler_tick+0xb5/0x1bf <- task_tick_idle+0x5/0x6
1172 2 run_posix_cpu_timers+0x2b/0x72a <- run_posix_cpu_timers+0x25/0x72a
1173 0 scheduler_tick+0x139/0x1bf <- scheduler_tick+0xed/0x1bf
1174 0 scheduler_tick+0x17c/0x1bf <- scheduler_tick+0x148/0x1bf
1175 2 run_posix_cpu_timers+0x9e/0x72a <- run_posix_cpu_timers+0x5e/0x72a
1176 0 scheduler_tick+0x1b6/0x1bf <- scheduler_tick+0x1aa/0x1bf
1179 The tracer may be used to dump the trace for the oops'ing cpu on a
1180 kernel oops into the system log. To enable this, ftrace_dump_on_oops
1181 must be set. To set ftrace_dump_on_oops, one can either use the sysctl
1182 function or set it via the proc system interface.
1184 sysctl kernel.ftrace_dump_on_oops=1
1188 echo 1 > /proc/sys/kernel/ftrace_dump_on_oops
1191 Here's an example of such a dump after a null pointer dereference in a
1194 [57848.105921] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
1195 [57848.106019] IP: [<ffffffffa0000006>] open+0x6/0x14 [oops]
1196 [57848.106019] PGD 2354e9067 PUD 2375e7067 PMD 0
1197 [57848.106019] Oops: 0002 [#1] SMP
1198 [57848.106019] last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:20:05.0/local_cpus
1199 [57848.106019] Dumping ftrace buffer:
1200 [57848.106019] ---------------------------------
1202 [57848.106019] 0 chrdev_open+0xe6/0x165 <- cdev_put+0x23/0x24
1203 [57848.106019] 0 chrdev_open+0x117/0x165 <- chrdev_open+0xfa/0x165
1204 [57848.106019] 0 chrdev_open+0x120/0x165 <- chrdev_open+0x11c/0x165
1205 [57848.106019] 0 chrdev_open+0x134/0x165 <- chrdev_open+0x12b/0x165
1206 [57848.106019] 0 open+0x0/0x14 [oops] <- chrdev_open+0x144/0x165
1207 [57848.106019] 0 page_fault+0x0/0x30 <- open+0x6/0x14 [oops]
1208 [57848.106019] 0 error_entry+0x0/0x5b <- page_fault+0x4/0x30
1209 [57848.106019] 0 error_kernelspace+0x0/0x31 <- error_entry+0x59/0x5b
1210 [57848.106019] 0 error_sti+0x0/0x1 <- error_kernelspace+0x2d/0x31
1211 [57848.106019] 0 page_fault+0x9/0x30 <- error_sti+0x0/0x1
1212 [57848.106019] 0 do_page_fault+0x0/0x881 <- page_fault+0x1a/0x30
1214 [57848.106019] 0 do_page_fault+0x66b/0x881 <- is_prefetch+0x1ee/0x1f2
1215 [57848.106019] 0 do_page_fault+0x6e0/0x881 <- do_page_fault+0x67a/0x881
1216 [57848.106019] 0 oops_begin+0x0/0x96 <- do_page_fault+0x6e0/0x881
1217 [57848.106019] 0 trace_hw_branch_oops+0x0/0x2d <- oops_begin+0x9/0x96
1219 [57848.106019] 0 ds_suspend_bts+0x2a/0xe3 <- ds_suspend_bts+0x1a/0xe3
1220 [57848.106019] ---------------------------------
1221 [57848.106019] CPU 0
1222 [57848.106019] Modules linked in: oops
1223 [57848.106019] Pid: 5542, comm: cat Tainted: G W 2.6.28 #23
1224 [57848.106019] RIP: 0010:[<ffffffffa0000006>] [<ffffffffa0000006>] open+0x6/0x14 [oops]
1225 [57848.106019] RSP: 0018:ffff880235457d48 EFLAGS: 00010246
1232 If CONFIG_DYNAMIC_FTRACE is set, the system will run with
1233 virtually no overhead when function tracing is disabled. The way
1234 this works is the mcount function call (placed at the start of
1235 every kernel function, produced by the -pg switch in gcc), starts
1236 of pointing to a simple return. (Enabling FTRACE will include the
1237 -pg switch in the compiling of the kernel.)
1239 At compile time every C file object is run through the
1240 recordmcount.pl script (located in the scripts directory). This
1241 script will process the C object using objdump to find all the
1242 locations in the .text section that call mcount. (Note, only
1243 the .text section is processed, since processing other sections
1244 like .init.text may cause races due to those sections being freed).
1246 A new section called "__mcount_loc" is created that holds references
1247 to all the mcount call sites in the .text section. This section is
1248 compiled back into the original object. The final linker will add
1249 all these references into a single table.
1251 On boot up, before SMP is initialized, the dynamic ftrace code
1252 scans this table and updates all the locations into nops. It also
1253 records the locations, which are added to the available_filter_functions
1254 list. Modules are processed as they are loaded and before they are
1255 executed. When a module is unloaded, it also removes its functions from
1256 the ftrace function list. This is automatic in the module unload
1257 code, and the module author does not need to worry about it.
1259 When tracing is enabled, kstop_machine is called to prevent races
1260 with the CPUS executing code being modified (which can cause the
1261 CPU to do undesireable things), and the nops are patched back
1262 to calls. But this time, they do not call mcount (which is just
1263 a function stub). They now call into the ftrace infrastructure.
1265 One special side-effect to the recording of the functions being
1266 traced is that we can now selectively choose which functions we
1267 wish to trace and which ones we want the mcount calls to remain as
1270 Two files are used, one for enabling and one for disabling the tracing
1271 of specified functions. They are:
1279 A list of available functions that you can add to these files is listed
1282 available_filter_functions
1284 # cat /debug/tracing/available_filter_functions
1293 If I am only interested in sys_nanosleep and hrtimer_interrupt:
1295 # echo sys_nanosleep hrtimer_interrupt \
1296 > /debug/tracing/set_ftrace_filter
1297 # echo ftrace > /debug/tracing/current_tracer
1298 # echo 1 > /debug/tracing/tracing_enabled
1300 # echo 0 > /debug/tracing/tracing_enabled
1301 # cat /debug/tracing/trace
1304 # TASK-PID CPU# TIMESTAMP FUNCTION
1306 usleep-4134 [00] 1317.070017: hrtimer_interrupt <-smp_apic_timer_interrupt
1307 usleep-4134 [00] 1317.070111: sys_nanosleep <-syscall_call
1308 <idle>-0 [00] 1317.070115: hrtimer_interrupt <-smp_apic_timer_interrupt
1310 To see which functions are being traced, you can cat the file:
1312 # cat /debug/tracing/set_ftrace_filter
1317 Perhaps this is not enough. The filters also allow simple wild cards.
1318 Only the following are currently available
1320 <match>* - will match functions that begin with <match>
1321 *<match> - will match functions that end with <match>
1322 *<match>* - will match functions that have <match> in it
1324 These are the only wild cards which are supported.
1326 <match>*<match> will not work.
1328 Note: It is better to use quotes to enclose the wild cards, otherwise
1329 the shell may expand the parameters into names of files in the local
1332 # echo 'hrtimer_*' > /debug/tracing/set_ftrace_filter
1338 # TASK-PID CPU# TIMESTAMP FUNCTION
1340 bash-4003 [00] 1480.611794: hrtimer_init <-copy_process
1341 bash-4003 [00] 1480.611941: hrtimer_start <-hrtick_set
1342 bash-4003 [00] 1480.611956: hrtimer_cancel <-hrtick_clear
1343 bash-4003 [00] 1480.611956: hrtimer_try_to_cancel <-hrtimer_cancel
1344 <idle>-0 [00] 1480.612019: hrtimer_get_next_event <-get_next_timer_interrupt
1345 <idle>-0 [00] 1480.612025: hrtimer_get_next_event <-get_next_timer_interrupt
1346 <idle>-0 [00] 1480.612032: hrtimer_get_next_event <-get_next_timer_interrupt
1347 <idle>-0 [00] 1480.612037: hrtimer_get_next_event <-get_next_timer_interrupt
1348 <idle>-0 [00] 1480.612382: hrtimer_get_next_event <-get_next_timer_interrupt
1351 Notice that we lost the sys_nanosleep.
1353 # cat /debug/tracing/set_ftrace_filter
1358 hrtimer_try_to_cancel
1362 hrtimer_force_reprogram
1363 hrtimer_get_next_event
1367 hrtimer_get_remaining
1369 hrtimer_init_sleeper
1372 This is because the '>' and '>>' act just like they do in bash.
1373 To rewrite the filters, use '>'
1374 To append to the filters, use '>>'
1376 To clear out a filter so that all functions will be recorded again:
1378 # echo > /debug/tracing/set_ftrace_filter
1379 # cat /debug/tracing/set_ftrace_filter
1382 Again, now we want to append.
1384 # echo sys_nanosleep > /debug/tracing/set_ftrace_filter
1385 # cat /debug/tracing/set_ftrace_filter
1387 # echo 'hrtimer_*' >> /debug/tracing/set_ftrace_filter
1388 # cat /debug/tracing/set_ftrace_filter
1393 hrtimer_try_to_cancel
1397 hrtimer_force_reprogram
1398 hrtimer_get_next_event
1403 hrtimer_get_remaining
1405 hrtimer_init_sleeper
1408 The set_ftrace_notrace prevents those functions from being traced.
1410 # echo '*preempt*' '*lock*' > /debug/tracing/set_ftrace_notrace
1416 # TASK-PID CPU# TIMESTAMP FUNCTION
1418 bash-4043 [01] 115.281644: finish_task_switch <-schedule
1419 bash-4043 [01] 115.281645: hrtick_set <-schedule
1420 bash-4043 [01] 115.281645: hrtick_clear <-hrtick_set
1421 bash-4043 [01] 115.281646: wait_for_completion <-__stop_machine_run
1422 bash-4043 [01] 115.281647: wait_for_common <-wait_for_completion
1423 bash-4043 [01] 115.281647: kthread_stop <-stop_machine_run
1424 bash-4043 [01] 115.281648: init_waitqueue_head <-kthread_stop
1425 bash-4043 [01] 115.281648: wake_up_process <-kthread_stop
1426 bash-4043 [01] 115.281649: try_to_wake_up <-wake_up_process
1428 We can see that there's no more lock or preempt tracing.
1433 The trace_pipe outputs the same content as the trace file, but the effect
1434 on the tracing is different. Every read from trace_pipe is consumed.
1435 This means that subsequent reads will be different. The trace
1438 # echo function > /debug/tracing/current_tracer
1439 # cat /debug/tracing/trace_pipe > /tmp/trace.out &
1441 # echo 1 > /debug/tracing/tracing_enabled
1443 # echo 0 > /debug/tracing/tracing_enabled
1444 # cat /debug/tracing/trace
1447 # TASK-PID CPU# TIMESTAMP FUNCTION
1451 # cat /tmp/trace.out
1452 bash-4043 [00] 41.267106: finish_task_switch <-schedule
1453 bash-4043 [00] 41.267106: hrtick_set <-schedule
1454 bash-4043 [00] 41.267107: hrtick_clear <-hrtick_set
1455 bash-4043 [00] 41.267108: wait_for_completion <-__stop_machine_run
1456 bash-4043 [00] 41.267108: wait_for_common <-wait_for_completion
1457 bash-4043 [00] 41.267109: kthread_stop <-stop_machine_run
1458 bash-4043 [00] 41.267109: init_waitqueue_head <-kthread_stop
1459 bash-4043 [00] 41.267110: wake_up_process <-kthread_stop
1460 bash-4043 [00] 41.267110: try_to_wake_up <-wake_up_process
1461 bash-4043 [00] 41.267111: select_task_rq_rt <-try_to_wake_up
1464 Note, reading the trace_pipe file will block until more input is added.
1465 By changing the tracer, trace_pipe will issue an EOF. We needed
1466 to set the function tracer _before_ we "cat" the trace_pipe file.
1472 Having too much or not enough data can be troublesome in diagnosing
1473 an issue in the kernel. The file buffer_size_kb is used to modify
1474 the size of the internal trace buffers. The number listed
1475 is the number of entries that can be recorded per CPU. To know
1476 the full size, multiply the number of possible CPUS with the
1479 # cat /debug/tracing/buffer_size_kb
1480 1408 (units kilobytes)
1482 Note, to modify this, you must have tracing completely disabled. To do that,
1483 echo "nop" into the current_tracer. If the current_tracer is not set
1484 to "nop", an EINVAL error will be returned.
1486 # echo nop > /debug/tracing/current_tracer
1487 # echo 10000 > /debug/tracing/buffer_size_kb
1488 # cat /debug/tracing/buffer_size_kb
1489 10000 (units kilobytes)
1491 The number of pages which will be allocated is limited to a percentage
1492 of available memory. Allocating too much will produce an error.
1494 # echo 1000000000000 > /debug/tracing/buffer_size_kb
1495 -bash: echo: write error: Cannot allocate memory
1496 # cat /debug/tracing/buffer_size_kb