kernel-debugging-advanced

name	kernel-debugging-advanced
description	Advanced kernel debugging skill for ftrace, trace-cmd, perf, kprobes, kgdb, and crash analysis. Use when tracing kernel functions, profiling syscalls in kernel, dynamic instrumentation, or analyzing vmcore. Activates on queries about ftrace, trace-cmd, kprobe, kgdb, kernel crash dump, or dyndbg.

Advanced Kernel Debugging

Purpose

Extend skills/kernel/kernel-debugging with production-grade tracing: ftrace, trace-cmd, kernel perf, kprobes/kretprobes, kgdb, crash dump analysis, and printk discipline. Not merged with kernel-debugging — that skill covers baseline kgdb/dyndbg; this one focuses on trace-cmd, function_graph, and live/post-mortem production workflows.

When to Use

• Latency spikes in kernel driver without obvious bug
• Tracing function call graph in kernel
• Live inspection without recompiling (kprobes, bpf)
• Post-mortem vmcore after panic

Workflow

1. ftrace function graph

# Enable function graph tracer
echo function_graph > /sys/kernel/debug/tracing/current_tracer
echo my_driver_probe > /sys/kernel/debug/tracing/set_graph_function
echo 1 > /sys/kernel/debug/tracing/tracing_on
# reproduce issue
cat /sys/kernel/debug/tracing/trace
echo 0 > /sys/kernel/debug/tracing/tracing_on

Requires CONFIG_FUNCTION_GRAPH_TRACER and debugfs mounted.

2. trace-cmd record

trace-cmd record -p function_graph -F my_probe
trace-cmd report
trace-cmd stat

Portable capture for sharing with others.

3. perf in kernel context

perf record -a -g -- sleep 10
perf report --stdio
perf probe --add my_driver:probe

See skills/profilers/linux-perf for userspace overlap.

4. kprobes (dynamic)

#include <linux/kprobes.h>

static struct kprobe kp = {
    .symbol_name = "do_sys_open",
    .pre_handler = handler,
};
register_kprobe(&kp);

Use sparingly in production; prefer static tracepoints when available.

5. dyndbg and printk discipline

echo 'module mydriver +p' > /sys/kernel/debug/dynamic_debug/control
echo 'file drivers/foo/*.c +p' > /sys/kernel/debug/dynamic_debug/control

pr_debug("state=%d\n", s);           /* compile-time optional */
printk_ratelimited(KERN_WARNING "hw fault\n");

6. kgdb / kdb

# kernel cmdline: kgdboc=ttyS0,115200 kgdbwait
echo g > /proc/sysrq-trigger   # break into debugger (when configured)

7. Crash dump (vmcore)

# after kdump capture
crash /usr/lib/debug/vmlinux vmcore
crash> bt
crash> dev -s

8. Agent usage

/kernel-debugging-advanced Trace my_driver_ioctl latency with ftrace function_graph

Common Problems

Symptom	Cause	Fix
Empty trace	Tracer not enabled	tracing_on; check current_tracer
ftrace overhead	Graph all functions	Filter with set_graph_function
kprobe fail	Inlined symbol	Try nearby symbol or static key
kgdb no connect	Wrong kgdboc tty	Match serial/USB gadget
crash no symbols	Missing debuginfo	Install linux-image-dbg / vmlinux

Related Skills

• skills/kernel/kernel-debugging — baseline kgdb, dyndbg
• skills/profilers/linux-perf — perf record/report
• skills/observability/ebpf — BPF kprobe alternative
• skills/kernel-dev/writing-char-drivers — ioctl trace targets
• skills/debuggers/core-dumps — userspace core parallels