How can I use ftrace to get the in-kernel call graph called by a system call?

I've tried these, but all of them produce "empty" output files:

trace-cmd record -p function_graph -g munmap -F ls
trace-cmd record -p function_graph -g sys_enter_munmap -F ls
trace-cmd record -p function_graph -g开发者_运维知识库 sys_enter -F ls

First you need to get the function name right - e.g. the function name to use for tracing open syscalls is sys_open.

To do this the "proper" way, it's necessary to have function_graph support in the kernel. On the x86 architecture this depends on CC_OPTIMIZE_FOR_SIZE being disabled, but on x86_64 it doesn't.

In my case I didn't bother to compile a custom kernel to disable CC_OPTIMIZE_FOR_SIZE, I just did

trace-cmd record -p function --func-stack

and included various functions that looked like they might be called by adding several -l options. This was enough to figure out what I wanted to know.