mohitmishra786/kernel-debugging-advanced
skills/kernel-dev/kernel-debugging-advanced/SKILL.md
Advanced kernel debugging skill for ftrace, trace-cmd, perf, kprobes, kgdb, and crash analysis. Use when tracing kernel functions, profiling syscalls in kernel, dynamic instrumentation, or analyzing vmcore. Activates on queries about ftrace, trace-cmd, kprobe, kgdb, kernel crash dump, or dyndbg.
$ install --global
skillsauthnpx skillsauth add mohitmishra786/low-level-dev-skills kernel-debugging-advancedInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 28, 2026, 6:41 AM116.3s1 file scanned
SKILL.md
- name:
- kernel-debugging-advanced
- description:
- Advanced kernel debugging skill for ftrace, trace-cmd, perf, kprobes, kgdb, and crash analysis. Use when tracing kernel functions, profiling syscalls in kernel, dynamic instrumentation, or analyzing vmcore. Activates on queries about ftrace, trace-cmd, kprobe, kgdb, kernel crash dump, or dyndbg.
Advanced Kernel Debugging
Purpose
Extend skills/kernel/kernel-debugging with production-grade tracing: ftrace, trace-cmd, kernel perf, kprobes/kretprobes, kgdb, crash dump analysis, and printk discipline. Not merged with kernel-debugging — that skill covers baseline kgdb/dyndbg; this one focuses on trace-cmd, function_graph, and live/post-mortem production workflows.
When to Use
- Latency spikes in kernel driver without obvious bug
- Tracing function call graph in kernel
- Live inspection without recompiling (kprobes, bpf)
- Post-mortem
vmcoreafter panic
Workflow
1. ftrace function graph
# Enable function graph tracer
echo function_graph > /sys/kernel/debug/tracing/current_tracer
echo my_driver_probe > /sys/kernel/debug/tracing/set_graph_function
echo 1 > /sys/kernel/debug/tracing/tracing_on
# reproduce issue
cat /sys/kernel/debug/tracing/trace
echo 0 > /sys/kernel/debug/tracing/tracing_on
Requires CONFIG_FUNCTION_GRAPH_TRACER and debugfs mounted.
2. trace-cmd record
trace-cmd record -p function_graph -F my_probe
trace-cmd report
trace-cmd stat
Portable capture for sharing with others.
3. perf in kernel context
perf record -a -g -- sleep 10
perf report --stdio
perf probe --add my_driver:probe
See skills/profilers/linux-perf for userspace overlap.
4. kprobes (dynamic)
#include <linux/kprobes.h>
static struct kprobe kp = {
.symbol_name = "do_sys_open",
.pre_handler = handler,
};
register_kprobe(&kp);
Use sparingly in production; prefer static tracepoints when available.
5. dyndbg and printk discipline
echo 'module mydriver +p' > /sys/kernel/debug/dynamic_debug/control
echo 'file drivers/foo/*.c +p' > /sys/kernel/debug/dynamic_debug/control
pr_debug("state=%d\n", s); /* compile-time optional */
printk_ratelimited(KERN_WARNING "hw fault\n");
6. kgdb / kdb
# kernel cmdline: kgdboc=ttyS0,115200 kgdbwait
echo g > /proc/sysrq-trigger # break into debugger (when configured)
7. Crash dump (vmcore)
# after kdump capture
crash /usr/lib/debug/vmlinux vmcore
crash> bt
crash> dev -s
8. Agent usage
/kernel-debugging-advanced Trace my_driver_ioctl latency with ftrace function_graph
Common Problems
| Symptom | Cause | Fix |
|---------|-------|-----|
| Empty trace | Tracer not enabled | tracing_on; check current_tracer |
| ftrace overhead | Graph all functions | Filter with set_graph_function |
| kprobe fail | Inlined symbol | Try nearby symbol or static key |
| kgdb no connect | Wrong kgdboc tty | Match serial/USB gadget |
| crash no symbols | Missing debuginfo | Install linux-image-dbg / vmlinux |
Related Skills
skills/kernel/kernel-debugging— baseline kgdb, dyndbgskills/profilers/linux-perf— perf record/reportskills/observability/ebpf— BPF kprobe alternativeskills/kernel-dev/writing-char-drivers— ioctl trace targetsskills/debuggers/core-dumps— userspace core parallels
Related Skills
mohitmishra786/qemu-kvm
development
VerifiedTrustedCommunity
QEMU/KVM skill for virtualization and kernel development. Use when running qemu-system-x86_64 with KVM, configuring virtio devices, VFIO passthrough, QMP monitor, libvirt, or booting custom kernels. Activates on queries about QEMU, KVM, virtio, VFIO, virsh, virt-install, or -kernel -append.
117SKILL.mdUpdated Jun 28, 2026
mohitmishra786/hypervisor-internals
development
VerifiedTrustedCommunity
Hardware virtualization internals skill for Intel VT-x and AMD-V. Use when studying VMCS/VMCB, EPT/NPT page tables, VMEXIT handling, APIC virtualization, or building minimal hypervisors. Activates on queries about VMX, SVM, VMCS, EPT, NPT, VMEXIT, or type-1 hypervisor.
117SKILL.mdUpdated Jun 28, 2026
mohitmishra786/containers-internals
testing
VerifiedTrustedCommunity
Linux containers internals skill for namespaces, cgroups, and OCI. Use when understanding clone/unshare namespaces, cgroups v2 limits, overlayfs, runc, seccomp profiles, capabilities, or escape mitigations. Activates on queries about namespaces, cgroups, overlayfs, runc, seccomp-bpf, OCI spec, or container escape.
117SKILL.mdUpdated Jun 28, 2026
mohitmishra786/reverse-engineering
tools
VerifiedTrustedCommunity
Reverse engineering skill for binary analysis. Use when decompiling with Ghidra, analyzing with radare2, scripting RE tools, triaging with strings/file/xxd, or diffing binaries. Activates on queries about Ghidra, radare2, r2, decompiler, Binary Ninja, Diaphora, or stripped binary analysis.
117SKILL.mdUpdated Jun 28, 2026