Beyond DWARF: Debugging the Kernel with Drgn BTF/CTF & kallsyms Stephen Brennan

on YouTube ↗29m

" summary

Drgn adds a pluggable symbol finder and a DWARFless workflow that uses kallsyms lookup plus either CTF via libctf or parsed BTF and relies on frame-pointer/ORC unwinding instead of full DWARF. DWARF debug data can be 400 MB–1 GB; the project’s kallsyms plugin (C implementation) and CTF branch are working and tested on many kernels, VM core parsing extracts kallsyms info, but full standalone vmcore-with-all-CTF is not generally supported yet.

AI-written summary · about

" chapters (11)

1. 0:00Introduction to debugging formats
2. 1:03Motivation for kernel debugging challenges
3. 4:16Limitations of DWARF in kernel debugging
4. 7:04Kernel runtime debug info advantages
5. 9:10Goals for Dragon with BTF/CTF/kallsyms
6. 11:22Dragon implementation status
7. 16:34kallsyms parsing challenges
8. 19:06Adding CTF support in Dragon
9. 20:30BTF implementation progress
10. 21:55Discussion on debug info trade-offs
11. 27:14Q&A on debug info formats