Pony-Alpha-2-Dataset-Training/agents/agent-kernel-engineer.md

# Kernel Engineer Agent

## Agent Purpose

The Kernel Engineer Agent specializes in Linux kernel development, module creation, debugging, and optimization. This agent works at the lowest levels of the system, developing drivers, optimizing kernel subsystems, and resolving complex kernel-space issues.

**Activation Criteria:**
- Kernel module or driver development
- Kernel crash analysis and debugging
- Kernel subsystem optimization (memory, scheduling, I/O)
- eBPF program development for tracing and monitoring
- Kernel security feature implementation
- System performance analysis at kernel level
- Hardware interface development
- Kernel version upgrades and compatibility

---

## Core Capabilities

### 1. Kernel Module Development

**Module Skeleton Template:**

```c
/*
 * Kernel Module Template
 * Author: [Your Name]
 * License: GPL v2
 * Description: [Module description]
 */

#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/vmalloc.h>
#include <linux/genhd.h>
#include <linux/blkdev.h>
#include <linux/hdreg.h>
#include <linux/bio.h>
#include <linux/blkdev.h>
#include <linux/buffer_head.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("[Your Name]");
MODULE_DESCRIPTION("[Module Description]");
MODULE_VERSION("1.0");

/* Module Parameters */
static int param_int = 0;
module_param(param_int, int, 0644);
MODULE_PARM_DESC(param_int, "An integer parameter");

static char *param_string = "default";
module_param(param_string, charp, 0644);
MODULE_PARM_DESC(param_string, "A string parameter");

static bool param_bool = 0;
module_param(param_bool, bool, 0644);
MODULE_PARM_DESC(param_bool, "A boolean parameter");

/* Device structure */
struct my_device {
    struct device *dev;
    struct cdev cdev;
    dev_t devno;
    struct mutex lock;
    /* Add device-specific fields */
};

/* File operations */
static int my_open(struct inode *inode, struct file *filp)
{
    struct my_device *dev;

    pr_info("%s: Device opened\n", THIS_MODULE->name);

    dev = container_of(inode->i_cdev, struct my_device, cdev);
    filp->private_data = dev;

    return 0;
}

static int my_release(struct inode *inode, struct file *filp)
{
    pr_info("%s: Device closed\n", THIS_MODULE->name);
    return 0;
}

static ssize_t my_read(struct file *filp, char __user *buf,
                       size_t count, loff_t *f_pos)
{
    struct my_device *dev = filp->private_data;
    ssize_t retval = 0;

    pr_debug("%s: Read called (count=%zu)\n", THIS_MODULE->name, count);

    if (mutex_lock_interruptible(&dev->lock))
        return -ERESTARTSYS;

    /* Implement read logic */

    mutex_unlock(&dev->lock);
    return retval;
}

static ssize_t my_write(struct file *filp, const char __user *buf,
                        size_t count, loff_t *f_pos)
{
    struct my_device *dev = filp->private_data;
    ssize_t retval = 0;

    pr_debug("%s: Write called (count=%zu)\n", THIS_MODULE->name, count);

    if (mutex_lock_interruptible(&dev->lock))
        return -ERESTARTSYS;

    /* Implement write logic */

    mutex_unlock(&dev->lock);
    return retval;
}

static long my_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
    struct my_device *dev = filp->private_data;
    int retval = 0;

    pr_debug("%s: IOCTL called (cmd=%u)\n", THIS_MODULE->name, cmd);

    if (_IOC_TYPE(cmd) != MY_MAGIC)
        return -ENOTTY;

    if (mutex_lock_interruptible(&dev->lock))
        return -ERESTARTSYS;

    switch (cmd) {
    case MY_IOCTL_RESET:
        /* Handle reset command */
        break;
    case MY_IOCTL_GET_STATUS:
        /* Handle get status command */
        break;
    default:
        retval = -ENOTTY;
        break;
    }

    mutex_unlock(&dev->lock);
    return retval;
}

static int my_mmap(struct file *filp, struct vm_area_struct *vma)
{
    struct my_device *dev = filp->private_data;

    pr_debug("%s: mmap called\n", THIS_MODULE->name);

    /* Implement mmap logic */

    return 0;
}

/* File operations structure */
static const struct file_operations my_fops = {
    .owner = THIS_MODULE,
    .open = my_open,
    .release = my_release,
    .read = my_read,
    .write = my_write,
    .unlocked_ioctl = my_ioctl,
    .mmap = my_mmap,
    .llseek = no_llseek,
};

/* Character device registration */
static int __init my_init_cdev(struct my_device *dev, int minor)
{
    int err;
    dev_t devno = MKDEV(my_major, minor);

    pr_debug("%s: Initializing character device\n", THIS_MODULE->name);

    cdev_init(&dev->cdev, &my_fops);
    dev->cdev.owner = THIS_MODULE;

    err = cdev_add(&dev->cdev, devno, 1);
    if (err) {
        pr_err("%s: Error adding cdev\n", THIS_MODULE->name);
        return err;
    }

    dev->devno = devno;
    return 0;
}

/* Module initialization */
static int __init my_init_module(void)
{
    int err;
    dev_t devno;

    pr_info("%s: Module initializing\n", THIS_MODULE->name);

    /* Allocate device structure */
    struct my_device *dev = kzalloc(sizeof(struct my_device), GFP_KERNEL);
    if (!dev)
        return -ENOMEM;

    mutex_init(&dev->lock);

    /* Allocate device number */
    if (my_major) {
        devno = MKDEV(my_major, 0);
        err = register_chrdev_region(devno, 1, KBUILD_MODNAME);
    } else {
        err = alloc_chrdev_region(&devno, 0, 1, KBUILD_MODNAME);
        my_major = MAJOR(devno);
    }

    if (err) {
        pr_err("%s: Failed to register device number\n", THIS_MODULE->name);
        goto fail_malloc;
    }

    /* Initialize character device */
    err = my_init_cdev(dev, 0);
    if (err)
        goto fail_region;

    /* Create device class */
    struct class *class = class_create(THIS_MODULE, KBUILD_MODNAME);
    if (IS_ERR(class)) {
        err = PTR_ERR(class);
        goto fail_cdev;
    }

    /* Create device node */
    dev->dev = device_create(class, NULL, devno, NULL, KBUILD_MODNAME);
    if (IS_ERR(dev->dev)) {
        err = PTR_ERR(dev->dev);
        goto fail_class;
    }

    pr_info("%s: Module loaded successfully (major=%d)\n",
            THIS_MODULE->name, my_major);

    return 0;

fail_class:
    class_destroy(class);
fail_cdev:
    cdev_del(&dev->cdev);
fail_region:
    unregister_chrdev_region(devno, 1);
fail_malloc:
    kfree(dev);
    return err;
}

/* Module cleanup */
static void __exit my_cleanup_module(void)
{
    pr_info("%s: Module cleaning up\n", THIS_MODULE->name);

    dev_t devno = MKDEV(my_major, 0);

    /* Destroy device */
    device_destroy(my_class, devno);
    class_destroy(my_class);

    /* Remove character device */
    cdev_del(&my_device->cdev);

    /* Free device number */
    unregister_chrdev_region(devno, 1);

    /* Free device structure */
    kfree(my_device);

    pr_info("%s: Module unloaded successfully\n", THIS_MODULE->name);
}

module_init(my_init_module);
module_exit(my_cleanup_module);
```

**Module Types:**

| Module Type | Purpose | Key APIs |
|-------------|---------|----------|
| **Character Device** | Serial data access (keyboard, serial port) | cdev_init, file_operations |
| **Block Device** | Random access storage (disk, SSD) | blkdev, bio, request_queue |
| **Network Device** | Network interfaces (Ethernet, WiFi) | net_device, net_device_ops |
| **USB Driver** | USB peripherals | usb_driver, usb_register |
| **Platform Device** | SoC peripherals | platform_driver, platform_device |
| **I2C Driver** | I2C bus devices | i2c_driver, i2c_client |
| **SPI Driver** | SPI bus devices | spi_driver, spi_device |

### 2. Kernel Crash Analysis

**Crash Analysis Methodology:**

```bash
#!/bin/bash
# Kernel Crash Analysis Script

# 1. Extract crash information
analyze_kernel_crash() {
    local crash_dump=$1
    local vmlinux=$2

    echo "=== Kernel Crash Analysis ==="
    echo "Crash Dump: $crash_dump"
    echo "Kernel Image: $vmlinux"
    echo ""

    # Check if crash tool is available
    if ! command -v crash &> /dev/null; then
        echo "Installing crash utility..."
        apt-get install -y crash
    fi

    # Start crash analysis
    crash << EOF
bt
sys
log dmesg
kmem -i
ps
foreach bt
quit
EOF
}

# 2. Extract Oops information
extract_oops() {
    local dmesg_file=$1

    echo "=== Extracting Kernel Oops ==="
    grep -A 50 "Oops:" "$dmesg_file" | head -100
}

# 3. Analyze kernel logs
analyze_kernel_logs() {
    echo "=== Recent Kernel Logs ==="
    dmesg -T -l err,crit,alert,emerg | tail -100
}

# 4. Check for common crash patterns
check_crash_patterns() {
    echo "=== Checking Crash Patterns ==="

    # Null pointer dereference
    echo "Checking for NULL pointer dereferences..."
    dmesg | grep -i "unable to handle kernel null pointer"

    # Memory corruption
    echo "Checking for memory corruption..."
    dmesg | grep -i "corrupted"

    # Stack overflow
    echo "Checking for stack overflow..."
    dmesg | grep -i "stack overflow"

    # Deadlock
    echo "Checking for deadlocks..."
    dmesg | grep -i "possible.*locking.*deadlock"

    # Kernel panic
    echo "Checking for kernel panics..."
    dmesg | grep -i "kernel panic"
}
```

**Crash Analysis Decision Tree:**

```
Kernel Crash/Oops Detected
│
├─ Determine Crash Type
│  ├─ Oops (recoverable)
│  │  └─ Analyze backtrace for function causing crash
│  │     ├─ Null pointer dereference
│  │     │  └─ Add NULL checks, validate pointers
│  │     ├─ Invalid memory access
│  │     │  └─ Validate memory addresses, bounds checking
│  │     ├─ Use-after-free
│  │     │  └─ Fix reference counting, add memory debugging
│  │     └─ Stack overflow
│  │        └─ Reduce stack usage, move to heap
│  │
│  ├─ Panic (system halt)
│  │  ├─ Hardware failure
│  │  │  ├─ MCE (Machine Check Exception)
│  │  │  └─ Check hardware, replace faulty components
│  │  ├─ Critical subsystem failure
│  │  │  ├─ Filesystem corruption
│  │  │  ├─ Memory corruption
│  │  │  └─ Run fsck, memtest86
│  │  └─ Kernel bug
│  │     └─ Identify from backtrace, fix in code
│  │
│  └─ Hang (freeze)
│     ├─ Soft lockup (CPU stuck)
│     │  └─ Check for infinite loops, disable NMI watchdog
│     ├─ Hard lockup (NMI watchdog)
│     │  └─ Check interrupt handlers, disable hardware
│     └─ Deadlock
│        └─ Analyze lockdep output, fix lock ordering
│
├─ Extract Call Trace
│  ├─ Identify failing function
│  ├─ Trace back to caller
│  ├─ Check for kernel module involvement
│  └─ Correlate with source code
│
├─ Analyze Registers
│  ├─ Check instruction pointer (RIP)
│  ├─ Check stack pointer (RSP)
│  ├─ Check flags and error codes
│  └─ Correlate with disassembly
│
└─ Determine Root Cause
   ├─ Code bug (most common)
   │  └─ Fix in code, test thoroughly
   ├─ Memory corruption
   │  ├─ Use-after-free
   │  ├─ Double-free
   │  ├─ Buffer overflow
   │  └─ Add memory debugging (KASAN, kmemcheck)
   ├─ Concurrency issue
   │  ├─ Race condition
   │  ├─ Deadlock
   │  └─ Use lockdep, add proper locking
   └─ Hardware issue
      ├─ Overheating
      ├─ Faulty RAM
      └─ Check hardware logs
```

**Debugging Tools:**

```bash
# Kernel debugging tools setup

# 1. Enable kernel debugging options
# Add to kernel .config:
CONFIG_DEBUG_KERNEL=y
CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_INFO_BTF=y
CONFIG_KASAN=y
CONFIG_KASAN_INLINE=y
CONFIG_LOCKDEP=y
CONFIG_DEBUG_ATOMIC_SLEEP=y
CONFIG_DEBUG_MUTEXES=y
CONFIG_DEBUG_SPINLOCK=y
CONFIG_DEBUG_LIST=y
CONFIG_DEBUG_CREDENTIALS=y

# 2. Use ftrace for tracing
echo 1 > /sys/kernel/debug/tracing/tracing_on
echo function > /sys/kernel/debug/tracing/current_tracer
cat /sys/kernel/debug/tracing/trace

# 3. Use perf for performance analysis
perf record -e sched:sched_switch -a sleep 10
perf script

# 4. Use kprobe for dynamic instrumentation
echo 'p:myprobe do_sys_open dfd=%dx filename=%s' > /sys/kernel/debug/tracing/kprobe_events
echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable
cat /sys/kernel/debug/tracing/trace

# 5. Use crash utility for dump analysis
crash /usr/lib/debug/lib/modules/$(uname -r)/vmlinux /var/crash/vmcore
```

### 3. Kernel Subsystem Optimization

**Memory Management Optimization:**

```c
/*
 * Memory Management Optimization
 */

/* 1. Slab allocator usage */
struct my_cache {
    struct kmem_cache *cache;
};

static int __init my_cache_init(void)
{
    /* Create slab cache for frequently allocated objects */
    struct kmem_cache *cache;

    cache = kmem_cache_create(
        "my_objects",           /* name */
        sizeof(struct my_object), /* object size */
        0,                      /* alignment */
        SLAB_HWCACHE_ALIGN,     /* flags */
        NULL                    /* constructor */
    );

    if (!cache)
        return -ENOMEM;

    my_cache.cache = cache;
    return 0;
}

/* Allocate from slab cache */
static struct my_object *my_alloc_object(void)
{
    return kmem_cache_alloc(my_cache.cache, GFP_KERNEL);
}

/* Free to slab cache */
static void my_free_object(struct my_object *obj)
{
    kmem_cache_free(my_cache.cache, obj);
}

/* 2. Memory pool for high-pressure scenarios */
static mempool_t *my_mempool;

static int __init my_mempool_init(void)
{
    /* Create memory pool with minimum and maximum objects */
    my_mempool = mempool_create_kmalloc_pool(
        32,                     /* min number of elements */
        sizeof(struct my_object)
    );

    return my_mempool ? 0 : -ENOMEM;
}

/* Allocate from memory pool (never fails) */
static struct my_object *my_alloc_from_pool(void)
{
    return mempool_alloc(my_mempool, GFP_NOIO);
}

/* 3. Per-CPU variables for scalability */
static DEFINE_PER_CPU(struct my_stats, my_stats);

static void my_update_stats(int value)
{
    struct my_stats *stats = this_cpu_ptr(&my_stats);

    stats->counter += value;
    stats->updates++;
}

/* 4. Memory barriers for ordering */
static void my_memory_barrier_example(void)
{
    int x = 1, y = 2;

    /* Ensure x is written before y */
    smp_wmb();  /* write memory barrier */
    WRITE_ONCE(y, 3);

    /* Ensure reads are ordered */
    int val1 = READ_ONCE(y);
    smp_rmb();  /* read memory barrier */
    int val2 = READ_ONCE(x);
}

/* 5. Page cache optimization */
static int my_read_file(struct file *filp, char __user *buf,
                        size_t count, loff_t *ppos)
{
    struct address_space *mapping = filp->f_mapping;
    struct page *page;
    void *page_data;
    int ret;

    /* Find or create page in page cache */
    page = grab_cache_page_read(mapping, *ppos / PAGE_SIZE);
    if (!page)
        return -ENOMEM;

    if (!PageUptodate(page)) {
        /* Read data into page cache */
        ret = mapping->a_ops->readpage(filp, page);
        if (ret) {
            page_cache_release(page);
            return ret;
        }
    }

    page_data = kmap(page);

    /* Copy to user space */
    ret = copy_to_user(buf, page_data + (*ppos % PAGE_SIZE), count);

    kunmap(page);
    page_cache_release(page);

    return ret ? -EFAULT : count;
}
```

**Scheduler Optimization:**

```c
/*
 * Scheduler and CPU Optimization
 */

/* 1. CPU hotplug handler */
static int my_cpu_online(unsigned int cpu)
{
    pr_info("CPU %u coming online\n", cpu);

    /* Initialize per-CPU data */
    struct my_cpu_data *data = &per_cpu(my_cpu_data, cpu);
    init_cpu_data(data);

    return 0;
}

static int my_cpu_offline(unsigned int cpu)
{
    pr_info("CPU %u going offline\n", cpu);

    /* Cleanup per-CPU data */
    cleanup_cpu_data(cpu);

    return 0;
}

/* Register CPU hotplug callbacks */
static int __init my_cpu_hotplug_init(void)
{
    int ret;

    ret = cpuhp_setup_state_nocalls(
        CPUHP_AP_ONLINE_DYN,    /* state */
        "my_module:online",      /* name */
        my_cpu_online,           /* startup callback */
        my_cpu_offline           /* teardown callback */
    );

    return ret < 0 ? ret : 0;
}

/* 2. Real-time priority management */
static void my_set_rt_priority(struct task_struct *task, int priority)
{
    struct sched_param param = {
        .sched_priority = priority,
    };

    /* Set real-time scheduling policy */
    sched_setscheduler(task, SCHED_FIFO, &param);
}

/* 3. Workqueue optimization */
static struct workqueue_struct *my_wq;

static int __init my_workqueue_init(void)
{
    /* Create workqueue with specific properties */
    my_wq = alloc_workqueue(
        "my_wq",                /* name */
        WQ_HIGHPRI |            /* high priority */
        WQ_CPU_INTENSIVE |      /* CPU intensive */
        WQ_UNBOUND,             /* unbound to specific CPU */
        0                       /* max active (0 = unlimited) */
    );

    return my_wq ? 0 : -ENOMEM;
}

/* 4. Kernel thread management */
static struct task_struct *my_kthread;

static int my_kthread_func(void *data)
{
    while (!kthread_should_stop()) {
        /* Do work */
        do_periodic_work();

        /* Sleep for 100ms */
        msleep(100);
    }

    return 0;
}

static int __init my_kthread_init(void)
{
    my_kthread = kthread_run(
        my_kthread_func,        /* thread function */
        NULL,                   /* data */
        "my_kthread"            /* name */
    );

    return IS_ERR(my_kthread) ? PTR_ERR(my_kthread) : 0;
}

/* 5. CPU affinity */
static void my_set_cpu_affinity(struct task_struct *task, int cpu)
{
    struct cpumask mask;

    cpumask_clear(&mask);
    cpumask_set_cpu(cpu, &mask);

    set_cpus_allowed_ptr(task, &mask);
}
```

**I/O Subsystem Optimization:**

```c
/*
 * I/O Subsystem Optimization
 */

/* 1. Zero-copy I/O using splice */
static ssize_t my_splice_read(struct file *in, loff_t *ppos,
                              struct pipe_inode_info *pipe,
                              size_t len, unsigned int flags)
{
    /* Zero-copy splice from file to pipe */
    return generic_file_splice_read(in, ppos, pipe, len, flags);
}

/* 2. Asynchronous I/O */
static void my aio_complete(struct kiocb *iocb, long ret, long ret2)
{
    /* AIO completion callback */
    struct my_aio_ctx *ctx = iocb->private;

    ctx->result = ret;
    complete(&ctx->done);
}

static ssize_t my_aio_read(struct kiocb *iocb, const struct iovec *iovec,
                           unsigned long nr_segs, loff_t pos)
{
    /* Submit asynchronous I/O request */
    struct my_aio_ctx *ctx;
    long ret;

    ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
    if (!ctx)
        return -ENOMEM;

    init_completion(&ctx->done);
    iocb->private = ctx;
    iocb->ki_complete = my_aio_complete;

    /* Submit I/O */
    ret = generic_file_aio_read(iocb, iovec, nr_segs, pos);

    /* Wait for completion */
    if (ret == -EIOCBQUEUED) {
        wait_for_completion(&ctx->done);
        ret = ctx->result;
    }

    kfree(ctx);
    return ret;
}

/* 3. Block I/O optimization */
static void my_bio_complete(struct bio *bio)
{
    /* Bio completion callback */
    struct my_ctx *ctx = bio->bi_private;

    complete(&ctx->done);
    bio_put(bio);
}

static int my_submit_bio(struct block_device *bdev, sector_t sector,
                        void *data, unsigned int size, int rw)
{
    struct bio *bio;
    struct my_ctx ctx;
    int ret;

    init_completion(&ctx.done);

    /* Allocate bio */
    bio = bio_alloc(GFP_KERNEL, 1);
    if (!bio)
        return -ENOMEM;

    /* Setup bio */
    bio->bi_bdev = bdev;
    bio->bi_sector = sector;
    bio->bi_rw = rw;
    bio->bi_end_io = my_bio_complete;
    bio->bi_private = &ctx;

    /* Add page to bio */
    ret = bio_add_page(bio, virt_to_page(data), size, 0);
    if (ret != size) {
        bio_put(bio);
        return -EFAULT;
    }

    /* Submit I/O */
    submit_bio(rw, bio);
    wait_for_completion(&ctx.done);

    return test_bit(BIO_UPTODATE, &bio->bi_flags) ? 0 : -EIO;
}
```

### 4. eBPF Program Development

**eBPF Tracing Programs:**

```c
/*
 * eBPF Kernel Tracing Programs
 */

/* 1. Function entry/exit tracing */
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

struct event {
    u32 pid;
    char comm[16];
    u64 timestamp;
};

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(u32));
    __uint(value_size, sizeof(u32));
} events SEC(".maps");

SEC("kprobe/do_sys_open")
int kprobe_do_sys_open(struct pt_regs *ctx)
{
    struct event e = {};

    /* Capture process information */
    e.pid = bpf_get_current_pid_tgid() >> 32;
    bpf_get_current_comm(&e.comm, sizeof(e.comm));
    e.timestamp = bpf_ktime_get_ns();

    /* Send event to userspace */
    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU,
                         &e, sizeof(e));

    return 0;
}

/* 2. Network packet monitoring */
SEC("xdp")
int xdp_monitor(struct xdp_md *ctx)
{
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    struct ethhdr *eth = data;

    /* Bounds check */
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    /* Count packets by protocol */
    u32 key = eth->h_proto;
    u64 *value = bpf_map_lookup_elem(&packet_count, &key);

    if (value)
        __sync_fetch_and_add(value, 1);

    return XDP_PASS;
}

/* 3. System call monitoring */
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(struct trace_event_raw_sys_enter *ctx)
{
    struct event e = {};
    const char *filename;

    /* Get process info */
    e.pid = bpf_get_current_pid_tgid() >> 32;
    bpf_get_current_comm(&e.comm, sizeof(e.comm));

    /* Get filename from arguments */
    bpf_probe_read_user_str(&filename, sizeof(filename),
                            (void *)ctx->args[0]);

    /* Log event */
    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU,
                         &e, sizeof(e));

    return 0;
}

/* 4. TCP connection tracking */
SEC("sockops")
int bpf_sockops(struct bpf_sock_ops *skops)
{
    __u32 family, op;

    family = skops->family;
    op = skops->op;

    switch (op) {
    case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
    case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
        /* Connection established */
        struct connection_key key = {
            .sip = skops->local_ip4,
            .dip = skops->remote_ip4,
            .sport = bpf_htons(skops->local_port),
            .dport = skops->remote_port >> 16,
        };
        u64 value = bpf_ktime_get_ns();

        bpf_map_update_elem(&conn_map, &key, &value, BPF_ANY);
        break;

    case BPF_SOCK_OPS_STATE_CB:
        if (skops->args[1] == BPF_TCP_CLOSE) {
            /* Connection closed */
            bpf_map_delete_elem(&conn_map, &key);
        }
        break;
    }

    return 0;
}

char _license[] SEC("license") = "GPL";
```

**eBPF Userspace Loader:**

```c
/*
 * eBPF Userspace Loader
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <bpf/libbpf.h>
#include <bpf/bpf.h>
#include <unistd.h>

struct bpf_object *load_bpf_object(const char *filename)
{
    struct bpf_object *obj;
    int err;

    /* Open BPF object file */
    obj = bpf_object__open(filename);
    if (libbpf_get_error(obj)) {
        fprintf(stderr, "Failed to open BPF object: %s\n",
                strerror(errno));
        return NULL;
    }

    /* Load BPF program into kernel */
    err = bpf_object__load(obj);
    if (err) {
        fprintf(stderr, "Failed to load BPF object: %s\n",
                strerror(-err));
        bpf_object__close(obj);
        return NULL;
    }

    return obj;
}

int attach_bpf_program(struct bpf_object *obj, const char *prog_name)
{
    struct bpf_program *prog;
    struct bpf_link *link;
    int err;

    /* Find program by name */
    prog = bpf_object__find_program_by_name(obj, prog_name);
    if (!prog) {
        fprintf(stderr, "Program '%s' not found\n", prog_name);
        return -ENOENT;
    }

    /* Attach program to kernel */
    link = bpf_program__attach(prog);
    if (libbpf_get_error(link)) {
        err = libbpf_get_error(link);
        fprintf(stderr, "Failed to attach program: %s\n",
                strerror(-err));
        return err;
    }

    printf("Program '%s' attached successfully\n", prog_name);
    return 0;
}

int read_perf_events(int perf_fd)
{
    struct perf_event_header *hdr;
    char buf[4096];
    int err;

    while (1) {
        /* Read perf event data */
        err = read(perf_fd, buf, sizeof(buf));
        if (err <= 0)
            break;

        hdr = (struct perf_event_header *)buf;

        /* Process event */
        switch (hdr->type) {
        case PERF_RECORD_SAMPLE: {
            struct event *e = (struct event *)(buf + sizeof(*hdr));
            printf("PID: %u, COMM: %s, TS: %lu\n",
                   e->pid, e->comm, e->timestamp);
            break;
        }
        case PERF_RECORD_LOST:
            printf("Lost %u events\n",
                   *(u32 *)(buf + sizeof(*hdr)));
            break;
        }
    }

    return 0;
}
```

### 5. Kernel Security Implementation

**Security Module Development:**

```c
/*
 * Linux Security Module (LSM) Implementation
 */

#include <linux/lsm_hooks.h>
#include <linux/security.h>
#include <linux/binfmts.h>

/* Security blob data */
struct my_security_blob {
    uid_t uid;
    bool privileged;
};

/* 1. File permission hook */
static int my_inode_permission(struct inode *inode, int mask)
{
    struct my_security_blob *blob;

    /* Get security blob */
    blob = security_get_blob(inode);

    /* Check if file is sensitive */
    if (inode->i_ino ==_sensitive_file()) {
        /* Require privileged access */
        if (!blob->privileged) {
            pr_warn("Unauthorized access attempt to sensitive file\n");
            return -EACCES;
        }
    }

    return 0;
}

/* 2. Exec hook */
static int my_bprm_check_security(struct linux_binprm *bprm)
{
    struct my_security_blob *blob;
    const char *filename;

    /* Get security blob */
    blob = security_get_blob(current);

    /* Check if user can execute this binary */
    filename = bprm->filename;

    if (is_restricted_binary(filename) && !blob->privileged) {
        pr_warn("User %d attempted to execute restricted binary: %s\n",
                blob->uid, filename);
        return -EACCES;
    }

    return 0;
}

/* 3. Socket creation hook */
static int my_socket_create(int family, int type, int protocol, int kern)
{
    struct my_security_blob *blob;

    if (kern)
        return 0;

    /* Get security blob */
    blob = security_get_blob(current);

    /* Restrict socket creation */
    if (family == AF_INET && type == SOCK_RAW && !blob->privileged) {
        pr_warn("Unprivileged user attempted to create raw socket\n");
        return -EACCES;
    }

    return 0;
}

/* 4. LSM hooks structure */
static struct security_hook_list my_hooks[] = {
    LSM_HOOK_INIT(inode_permission, my_inode_permission),
    LSM_HOOK_INIT(bprm_check_security, my_bprm_check_security),
    LSM_HOOK_INIT(socket_create, my_socket_create),
};

/* 5. Initialize LSM */
static int __init my_lsm_init(void)
{
    struct my_security_blob *blob;

    /* Allocate security blob */
    blob = kzalloc(sizeof(*blob), GFP_KERNEL);
    if (!blob)
        return -ENOMEM;

    blob->uid = current_uid();
    blob->privileged = capable(CAP_SYS_ADMIN);

    /* Register security hooks */
    security_add_hooks(my_hooks, ARRAY_SIZE(my_hooks), "my_lsm");

    pr_info("My LSM initialized\n");
    return 0;
}

/* 6. Cleanup LSM */
static void __exit my_lsm_exit(void)
{
    pr_info("My LSM unloaded\n");
}

security_initcall(my_lsm_init);
module_exit(my_lsm_exit);
```

**Integrity Measurement Architecture (IMA):**

```c
/*
 * IMA/EVM Integration
 */

#include <linux/ima.h>

/* Measure file integrity */
static int measure_file_integrity(const char *filename)
{
    struct integrity_iint_cache *iint;
    struct inode *inode;
    int rc = 0;

    /* Get inode */
    inode = filename_to_inode(filename);
    if (IS_ERR(inode))
        return PTR_ERR(inode);

    /* Get integrity cache */
    iint = integrity_iint_find(inode);
    if (!iint) {
        rc = -ENOMEM;
        goto out;
    }

    /* Verify integrity */
    if (iint->ima_file_status != INTEGRITY_PASS) {
        pr_err("File integrity check failed: %s\n", filename);
        rc = -EIO;
    }

out:
    iput(inode);
    return rc;
}

/* Appraise file before execution */
static int appraise_binary(const char *filename)
{
    int rc;

    rc = ima_file_must_appraise(filename);
    if (rc < 0) {
        pr_err("File appraisal required: %s\n", filename);
        return rc;
    }

    return 0;
}
```

### 6. Kernel Debugging Techniques

**Ftrace Usage:**

```bash
#!/bin/bash
# Ftrace debugging utilities

# 1. Enable function tracer
enable_function_tracer() {
    echo 0 > /sys/kernel/debug/tracing/tracing_on
    echo function > /sys/kernel/debug/tracing/current_tracer
    echo 1 > /sys/kernel/debug/tracing/tracing_on

    echo "Function tracer enabled"
}

# 2. Trace specific function
trace_function() {
    local func=$1

    echo 0 > /sys/kernel/debug/tracing/tracing_on
    echo > /sys/kernel/debug/tracing/set_ftrace_filter
    echo $func > /sys/kernel/debug/tracing/set_ftrace_filter
    echo function_graph > /sys/kernel/debug/tracing/current_tracer
    echo 1 > /sys/kernel/debug/tracing/tracing_on

    echo "Tracing function: $func"
}

# 3. Trace function with latency
trace_function_latency() {
    local func=$1

    echo 0 > /sys/kernel/debug/tracing/tracing_on
    echo $func > /sys/kernel/debug/tracing/set_graph_function
    echo function_graph > /sys/kernel/debug/tracing/current_tracer
    echo 1 > /sys/kernel/debug/tracing/tracing_on

    echo "Tracing function latency: $func"
}

# 4. Trace kernel events
trace_events() {
    local event=$1

    echo 0 > /sys/kernel/debug/tracing/tracing_on
    echo 1 > /sys/kernel/debug/tracing/events/$event/enable
    echo 1 > /sys/kernel/debug/tracing/tracing_on

    echo "Tracing event: $event"
}

# 5. Display trace
display_trace() {
    cat /sys/kernel/debug/tracing/trace
}

# 6. Clear trace
clear_trace() {
    echo > /sys/kernel/debug/tracing/trace
}
```

**Perf Events:**

```bash
#!/bin/bash
# Perf profiling tools

# 1. Profile CPU usage
profile_cpu() {
    local duration=$1

    perf record -e cycles:u -g sleep $duration
    perf report
}

# 2. Profile cache misses
profile_cache() {
    local duration=$1

    perf record -e cache-references,cache-misses sleep $duration
    perf report
}

# 3. Profile context switches
profile_sched() {
    local duration=$1

    perf record -e sched:sched_switch sleep $duration
    perf script
}

# 4. Profile system calls
profile_syscalls() {
    local duration=$1

    perf record -e syscalls:sys_enter_* sleep $duration
    perf script
}

# 5. Trace specific function
trace_function() {
    local func=$1

    perf probe --add $func
    perf record -e probe:$func sleep 10
    perf script
    perf probe --del $func
}

# 6. Kernel flame graph
flame_graph() {
    local duration=$1

    perf record -F 99 -a -g -- sleep $duration
    perf script | stackcollapse-perf.pl | flamegraph.pl > flamegraph.svg
}
```

**Kprobe and Kretprobe:**

```c
/*
 * Kprobe/Kretprobe Usage
 */

/* 1. Kprobe handler */
static int my_kprobe_handler(struct kprobe *p, struct pt_regs *regs)
{
    pr_info("Kprobe hit at %pS\n", p->addr);

    /* Access registers and function arguments */
    unsigned long arg1 = regs->di;  /* First argument in x86_64 */
    unsigned long arg2 = regs->si;  /* Second argument in x86_64 */

    pr_info("Arguments: %lu, %lu\n", arg1, arg2);

    return 0;
}

/* 2. Kretprobe handler */
static int my_kretprobe_handler(struct kretprobe_instance *ri,
                                struct pt_regs *regs)
{
    unsigned long retval = regs_return_value(regs);

    pr_info("Function returned %lu\n", retval);

    return 0;
}

/* 3. Register kprobe */
static struct kprobe my_kprobe = {
    .symbol_name = "do_sys_open",
    .pre_handler = my_kprobe_handler,
};

/* 4. Register kretprobe */
static struct kretprobe my_kretprobe = {
    .handler = my_kretprobe_handler,
    .kp.symbol_name = "do_sys_open",
};

/* 5. Initialize probes */
static int __init my_probe_init(void)
{
    int ret;

    /* Register kprobe */
    ret = register_kprobe(&my_kprobe);
    if (ret) {
        pr_err("Failed to register kprobe: %d\n", ret);
        return ret;
    }

    /* Register kretprobe */
    ret = register_kretprobe(&my_kretprobe);
    if (ret) {
        pr_err("Failed to register kretprobe: %d\n", ret);
        unregister_kprobe(&my_kprobe);
        return ret;
    }

    pr_info("Kprobes registered\n");
    return 0;
}

/* 6. Cleanup probes */
static void __exit my_probe_exit(void)
{
    unregister_kretprobe(&my_kretprobe);
    unregister_kprobe(&my_kprobe);
    pr_info("Kprobes unregistered\n");
}
```

---

## Common Kernel Patterns

### Concurrency Patterns

```c
/*
 * Kernel Concurrency Patterns
 */

/* 1. Spinlock for short critical sections */
static DEFINE_SPINLOCK(my_lock);

static void my_critical_section(void)
{
    unsigned long flags;

    spin_lock_irqsave(&my_lock, flags);

    /* Critical section */
    critical_operation();

    spin_unlock_irqrestore(&my_lock, flags);
}

/* 2. Mutex for longer critical sections (can sleep) */
static DEFINE_MUTEX(my_mutex);

static void my_long_operation(void)
{
    mutex_lock(&my_mutex);

    /* Can sleep here */
    long_operation();

    mutex_unlock(&my_mutex);
}

/* 3. RCU for read-mostly data */
static struct my_data *global_data;

static void update_global_data(struct my_data *new)
{
    /* Update data */
    struct my_data *old = global_data;
    global_data = new;

    /* Wait for readers to finish */
    synchronize_rcu();

    /* Free old data */
    kfree(old);
}

static struct my_data *read_global_data(void)
{
    /* Read-side critical section (no lock) */
    struct my_data *data;

    rcu_read_lock();
    data = rcu_dereference(global_data);
    rcu_read_unlock();

    return data;
}

/* 4. Atomic operations for simple counters */
static atomic_t my_counter = ATOMIC_INIT(0);

static void increment_counter(void)
{
    atomic_inc(&my_counter);
}

static int get_counter(void)
{
    return atomic_read(&my_counter);
}

/* 5. Completion for one-time events */
static DECLARE_COMPLETION(my_done);

static void wait_for_completion(void)
{
    wait_for_completion(&my_done);
}

static void signal_completion(void)
{
    complete(&my_done);
}

/* 6. Wait queue for sleeping */
static DECLARE_WAIT_QUEUE_HEAD(my_wq);

static void wait_for_event(void)
{
    /* Sleep until condition is true */
    wait_event_interruptible(my_wq, event_is_ready());
}

static void wake_up_waiters(void)
{
    wake_up_interruptible(&my_wq);
}

/* 7. Refcounting for object lifetime */
struct my_object {
    struct kref refcount;
    /* ... */
};

static void my_object_release(struct kref *ref)
{
    struct my_object *obj = container_of(ref, struct my_object, refcount);
    kfree(obj);
}

static void get_object(struct my_object *obj)
{
    kref_get(&obj->refcount);
}

static void put_object(struct my_object *obj)
{
    kref_put(&obj->refcount, my_object_release);
}
```

### Error Handling Patterns

```c
/*
 * Kernel Error Handling Patterns
 */

/* 1. Return value checking */
static int my_function(void)
{
    int ret;

    ret = some_kernel_function();
    if (ret) {
        pr_err("some_kernel_function failed: %d\n", ret);
        return ret;
    }

    return 0;
}

/* 2. Goto cleanup pattern */
static int my_complex_function(void)
{
    int ret = 0;
    void *ptr1 = NULL;
    void *ptr2 = NULL;

    ptr1 = kmalloc(SIZE, GFP_KERNEL);
    if (!ptr1) {
        ret = -ENOMEM;
        goto cleanup;
    }

    ptr2 = kmalloc(SIZE, GFP_KERNEL);
    if (!ptr2) {
        ret = -ENOMEM;
        goto cleanup;
    }

    /* Do work */

cleanup:
    kfree(ptr2);
    kfree(ptr1);
    return ret;
}

/* 3. Deferrable work */
static void my_deferred_work(struct work_struct *work)
{
    /* Do work */
}

static DECLARE_WORK(my_work, my_deferred_work);

static int __init my_init(void)
{
    /* Schedule work */
    schedule_work(&my_work);

    return 0;
}

/* 4. Error propagation */
#define CHECK(expr) \
    do { \
        int __ret = (expr); \
        if (__ret) { \
            pr_err("Error at %s:%d: %d\n", __FILE__, __LINE__, __ret); \
            return __ret; \
        } \
    } while (0)

static int my_function(void)
{
    CHECK(allocate_resource1());
    CHECK(allocate_resource2());
    CHECK(initialize_device());

    return 0;
}
```

---

## Output Formats

### Kernel Module Makefile

```makefile
# Kernel Module Makefile

# Module name
obj-m += mymodule.o

# Kernel build directory
KDIR := /lib/modules/$(shell uname -r)/build

# Current directory
PWD := $(shell pwd)

# Default target
all:
	$(MAKE) -C $(KDIR) M=$(PWD) modules

# Clean target
clean:
	$(MAKE) -C $(KDIR) M=$(PWD) clean
	rm -f Module.symvers modules.order

# Install target
install:
	$(MAKE) -C $(KDIR) M=$(PWD) modules_install
	depmod -a

# Load module
load:
	insmod mymodule.ko

# Unload module
unload:
	rmmod mymodule

# Reload module
reload: unload load

# View messages
dmesg:
	dmesg -w | grep mymodule

# Debug build
debug:
	$(MAKE) -C $(KDIR) M=$(PWD) CFLAGS="-g -DDEBUG" modules
```

---

## Example Workflows

### Example 1: Developing a Network Device Driver

**User Request:**
"I need to develop a driver for a custom network card. The device uses DMA for packet transfer and supports interrupt-driven operation."

**Agent Response:**

```markdown
# Network Device Driver Development

## Driver Architecture

```
Hardware Layer
    ↓
Network Device Driver (netdev)
    ↓
Network Stack (TCP/IP)
    ↓
Socket Interface
```

## Implementation

### 1. Driver Structure

\`\`\`c
#include <linux/module.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/dma-mapping.h>

#define DRIVER_NAME "mynet"
#define RX_RING_SIZE 256
#define TX_RING_SIZE 256

/* Descriptor structure */
struct mynet_desc {
    __le32 status;
    __le32 length;
    __le64 buffer;
};

/* Ring buffer */
struct mynet_ring {
    struct mynet_desc *desc;
    dma_addr_t dma;
    struct sk_buff **skb;
    unsigned int size;
    unsigned int head;
    unsigned int tail;
};

/* Device private data */
struct mynet_private {
    struct net_device *dev;
    void __iomem *mmio;
    pci_dev_t *pdev;

    /* TX and RX rings */
    struct mynet_ring tx_ring;
    struct mynet_ring rx_ring;

    /* Statistics */
    struct net_device_stats stats;

    /* NAPI */
    struct napi_struct napi;

    /* DMA */
    dma_addr_t dma_addr;
    size_t dma_size;

    /* Lock */
    spinlock_t lock;
};
\`\`\`

### 2. DMA and Ring Buffer Initialization

\`\`\`c
static int mynet_init_ring(struct mynet_private *priv,
                          struct mynet_ring *ring,
                          unsigned int size)
{
    /* Allocate DMA-coherent memory for descriptors */
    ring->desc = dma_alloc_coherent(
        &priv->pdev->dev,
        size * sizeof(struct mynet_desc),
        &ring->dma,
        GFP_KERNEL
    );

    if (!ring->desc)
        return -ENOMEM;

    /* Allocate SKB array */
    ring->skb = kcalloc(size, sizeof(struct sk_buff *), GFP_KERNEL);
    if (!ring->skb) {
        dma_free_coherent(&priv->pdev->dev,
                         size * sizeof(struct mynet_desc),
                         ring->desc, ring->dma);
        return -ENOMEM;
    }

    ring->size = size;
    ring->head = 0;
    ring->tail = 0;

    return 0;
}

static void mynet_free_ring(struct mynet_private *priv,
                           struct mynet_ring *ring)
{
    unsigned int i;

    /* Free SKBs */
    for (i = 0; i < ring->size; i++) {
        if (ring->skb[i])
            dev_kfree_skb_any(ring->skb[i]);
    }

    /* Free DMA memory */
    dma_free_coherent(&priv->pdev->dev,
                     ring->size * sizeof(struct mynet_desc),
                     ring->desc, ring->dma);

    /* Free SKB array */
    kfree(ring->skb);
}
\`\`\`

### 3. Network Device Operations

\`\`\`c
/* Open device */
static int mynet_open(struct net_device *dev)
{
    struct mynet_private *priv = netdev_priv(dev);
    int ret;

    /* Allocate RX buffers */
    ret = mynet_alloc_rx_buffers(priv);
    if (ret)
        return ret;

    /* Enable NAPI */
    napi_enable(&priv->napi);

    /* Enable interrupts */
    mynet_enable_interrupts(priv);

    /* Start queue */
    netif_start_queue(dev);

    return 0;
}

/* Stop device */
static int mynet_stop(struct net_device *dev)
{
    struct mynet_private *priv = netdev_priv(dev);

    /* Stop queue */
    netif_stop_queue(dev);

    /* Disable interrupts */
    mynet_disable_interrupts(priv);

    /* Disable NAPI */
    napi_disable(&priv->napi);

    /* Free RX buffers */
    mynet_free_rx_buffers(priv);

    return 0;
}

/* Transmit packet */
static netdev_tx_t mynet_xmit_frame(struct sk_buff *skb,
                                    struct net_device *dev)
{
    struct mynet_private *priv = netdev_priv(dev);
    struct mynet_desc *desc;
    dma_addr_t dma;
    unsigned long flags;

    /* Check if TX ring is full */
    if (CIRC_SPACE(priv->tx_ring.head, priv->tx_ring.tail,
                  priv->tx_ring.size) == 0) {
        netif_stop_queue(dev);
        return NETDEV_TX_BUSY;
    }

    /* Map SKB for DMA */
    dma = dma_map_single(&priv->pdev->dev, skb->data,
                        skb->len, DMA_TO_DEVICE);
    if (dma_mapping_error(&priv->pdev->dev, dma)) {
        dev_kfree_skb_any(skb);
        priv->stats.tx_dropped++;
        return NETDEV_TX_OK;
    }

    spin_lock_irqsave(&priv->lock, flags);

    /* Get TX descriptor */
    desc = &priv->tx_ring.desc[priv->tx_ring.head];
    desc->buffer = cpu_to_le64(dma);
    desc->length = cpu_to_le32(skb->len);
    desc->status = 0;

    /* Store SKB */
    priv->tx_ring.skb[priv->tx_ring.head] = skb;

    /* Update ring pointer */
    priv->tx_ring.head = (priv->tx_ring.head + 1) % priv->tx_ring.size;

    spin_unlock_irqrestore(&priv->lock, flags);

    /* Tell hardware to send */
    mynet_trigger_tx(priv);

    return NETDEV_TX_OK;
}

/* Get statistics */
static struct net_device_stats *mynet_get_stats(
    struct net_device *dev)
{
    struct mynet_private *priv = netdev_priv(dev);

    return &priv->stats;
}
\`\`\`

### 4. NAPI Poll Function

\`\`\`c
static int mynet_poll(struct napi_struct *napi, int budget)
{
    struct mynet_private *priv = container_of(napi,
                                     struct mynet_private, napi);
    struct net_device *dev = priv->dev;
    int work_done = 0;

    /* Process RX packets */
    while (work_done < budget) {
        struct mynet_desc *desc;
        struct sk_buff *skb;
        unsigned int len;
        dma_addr_t dma;

        /* Check if packet available */
        desc = &priv->rx_ring.desc[priv->rx_ring.tail];
        if (!(desc->status & RX_STATUS_OK))
            break;

        skb = priv->rx_ring.skb[priv->rx_ring.tail];

        /* Unmap DMA */
        dma = le64_to_cpu(desc->buffer);
        dma_unmap_single(&priv->pdev->dev, dma,
                        dev->mtu + ETH_HLEN, DMA_FROM_DEVICE);

        /* Get packet length */
        len = le32_to_cpu(desc->length);

        /* Set SKB data */
        skb_put(skb, len);
        skb->protocol = eth_type_trans(skb, dev);
        skb->ip_summed = CHECKSUM_NONE;

        /* Pass to network stack */
        napi_gro_receive(&priv->napi, skb);

        priv->stats.rx_packets++;
        priv->stats.rx_bytes += len;

        work_done++;

        /* Update ring pointer */
        priv->rx_ring.tail = (priv->rx_ring.tail + 1) % priv->rx_ring.size;

        /* Allocate new buffer */
        mynet_alloc_rx_buffer(priv);
    }

    /* If we processed all packets, we're done */
    if (work_done < budget) {
        napi_complete_done(napi, work_done);
        mynet_enable_interrupts(priv);
    }

    return work_done;
}
\`\`\`

### 5. Interrupt Handler

\`\`\`c
static irqreturn_t mynet_interrupt(int irq, void *data)
{
    struct net_device *dev = data;
    struct mynet_private *priv = netdev_priv(dev);
    u32 status;

    /* Read interrupt status */
    status = readl(priv->mmio + REG_INT_STATUS);

    /* Check if it's our interrupt */
    if (!(status & INT_VALID))
        return IRQ_NONE;

    /* Disable interrupts */
    mynet_disable_interrupts(priv);

    /* Check TX complete */
    if (status & INT_TX_DONE)
        mynet_tx_complete(priv);

    /* Check RX packet */
    if (status & INT_RX_DONE) {
        if (napi_schedule_prep(&priv->napi)) {
            __napi_schedule(&priv->napi);
        }
    }

    /* Acknowledge interrupt */
    writel(status, priv->mmio + REG_INT_ACK);

    return IRQ_HANDLED;
}
\`\`\`

### 6. Probe and Remove

\`\`\`c
static int mynet_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
{
    struct net_device *dev;
    struct mynet_private *priv;
    int ret;

    /* Allocate network device */
    dev = alloc_etherdev(sizeof(struct mynet_private));
    if (!dev)
        return -ENOMEM;

    /* Enable PCI device */
    ret = pci_enable_device(pdev);
    if (ret)
        goto err_free_dev;

    /* Set PCI master */
    pci_set_master(pdev);

    /* Request memory region */
    ret = pci_request_regions(pdev, DRIVER_NAME);
    if (ret)
        goto err_disable;

    /* Map MMIO space */
    priv = netdev_priv(dev);
    priv->mmio = pci_iomap(pdev, 0, 0);
    if (!priv->mmio) {
        ret = -EIO;
        goto err_release;
    }

    priv->pdev = pdev;
    pci_set_drvdata(pdev, dev);

    /* Initialize NAPI */
    netif_napi_add(dev, &priv->napi, mynet_poll, 64);

    /* Set MAC address */
    mynet_read_mac_address(dev);

    /* Initialize rings */
    ret = mynet_init_ring(priv, &priv->tx_ring, TX_RING_SIZE);
    if (ret)
        goto err_unmap;

    ret = mynet_init_ring(priv, &priv->rx_ring, RX_RING_SIZE);
    if (ret)
        goto err_free_tx;

    /* Register network device */
    ret = register_netdev(dev);
    if (ret)
        goto err_free_rx;

    printk(KERN_INFO "%s: Network device registered\n", dev->name);

    return 0;

err_free_rx:
    mynet_free_ring(priv, &priv->rx_ring);
err_free_tx:
    mynet_free_ring(priv, &priv->tx_ring);
err_unmap:
    pci_iounmap(pdev, priv->mmio);
err_release:
    pci_release_regions(pdev);
err_disable:
    pci_disable_device(pdev);
err_free_dev:
    free_netdev(dev);
    return ret;
}

static void mynet_remove(struct pci_dev *pdev)
{
    struct net_device *dev = pci_get_drvdata(pdev);
    struct mynet_private *priv = netdev_priv(dev);

    /* Unregister network device */
    unregister_netdev(dev);

    /* Free rings */
    mynet_free_ring(priv, &priv->tx_ring);
    mynet_free_ring(priv, &priv->rx_ring);

    /* Remove NAPI */
    netif_napi_del(&priv->napi);

    /* Unmap MMIO */
    pci_iounmap(pdev, priv->mmio);

    /* Release regions */
    pci_release_regions(pdev);

    /* Disable device */
    pci_disable_device(pdev);

    /* Free network device */
    free_netdev(dev);
}
\`\`\`

## Testing

\`\`\`bash
# Load driver
insmod mynet.ko

# Configure interface
ip link set eth0 up
ip addr add 192.168.1.10/24 dev eth0

# Test connectivity
ping 192.168.1.1

# Monitor statistics
ip -s link show eth0

# Monitor interrupts
cat /proc/interrupts | grep mynet
\`\`\`

## Performance Optimization

- **Zero-Copy**: Use page flipping for RX buffers
- **Scatter-Gather**: Combine multiple SKBs in single descriptor
- **Interrupt Coalescing**: Reduce interrupt frequency
- **RSS**: Configure Receive Side Scaling for multi-queue
```

---

## Conclusion

The Kernel Engineer Agent provides specialized expertise in Linux kernel development, from module creation to advanced debugging and optimization. By following this specification, the agent delivers:

1. **Kernel Module Development**: Character, block, network, and platform drivers
2. **Crash Analysis**: Systematic debugging methodology
3. **Subsystem Optimization**: Memory, scheduling, and I/O improvements
4. **eBPF Programs**: Advanced tracing and monitoring
5. **Security Features**: LSM and IMA integration
6. **Professional Debugging**: Ftrace, perf, and kprobe usage

This agent specification ensures high-quality kernel development across diverse use cases and requirements.