linux-kernel-dev is a Linux kernel, driver & BSP development expert — it writes, reviews, debugs and maintains kernel code (modules, drivers, subsystem patches, Kconfig/Makefile, device trees), with the kernel's hard safety rules built in. And unlike a static cheat-sheet that cites APIs which don't exist and rots on the next release, it gets more accurate the more you use it: every answer is checked against a real source tree, and every trap becomes a regression-proven rule. linux-kernel-dev 是一个 Linux 内核 / 驱动 / BSP 开发专家——写、审、调、维护内核代码（模块、驱动、子系统补丁、Kconfig/Makefile、设备树），内核的硬性安全规则内建其中。和那种引用不存在 API、新版本一发就过期的静态速查表不同，它越用越准：每个答案都拿真源码树核对，每个踩过的坑都沉成带回归证明的规则。
Point it at any of these and you get an answer in kernel idiom, checkable against your tree — not generic C advice. The self-improving engine further down is what keeps those answers honest. 下面任何一类活儿交给它，拿到的是内核地道写法、能拿你的树核对的答案——不是泛泛的 C 建议。再往下那套自我改进引擎，是让这些答案不跑偏的保障。
platform_driver / char devices / module_init & exit / probe & remove, plus the build glue: Makefile, Kconfig, and device tree (.dts/.dtsi) bindings.
platform_driver / 字符设备 / module_init 与 exit / probe 与 remove，连带构建胶水：Makefile、Kconfig、设备树（.dts/.dtsi）绑定。
Held to coding-style.rst (tabs, K&R braces, /* */), not GNU/Google. Output is meant to come back checkpatch.pl-clean.
按 coding-style.rst（Tab、K&R 大括号、/* */）来，不是 GNU/Google。产出目标是过 checkpatch.pl 零告警。
spinlock vs mutex, atomic_t, GFP_ATOMIC in atomic context, memory barriers — the race-and-sleep traps that crash ring 0.
spinlock 还是 mutex、atomic_t、原子上下文里用 GFP_ATOMIC、内存屏障——那些会让 ring 0 崩掉的竞态与睡眠坑。
printk levels, ftrace, decoding an oops/panic backtrace, and the right kernel dev-tool for the symptom. printk 级别、ftrace、读懂 oops/panic 回溯，针对症状选对内核 dev-tool。
git format-patch, a clean checkpatch.pl run plus deeper static analysis (sparse / smatch / coccinelle), SPDX + DCO sign-off, and the kernel's rule that an AI never adds Signed-off-by (disclose with Assisted-by) — so it's LKML-ready, not just compiling.
git format-patch、过 checkpatch.pl 加更深的静态分析（sparse / smatch / coccinelle）、SPDX + DCO sign-off、以及内核那条"AI 绝不加 Signed-off-by"（用 Assisted-by 披露）的规矩——做到能发 LKML，而不只是能编过。
defconfig the native way (merge_config + savedefconfig), keep upstream code behind a vendor gate, read hardware bytes instead of inferring, analyse a change on all four dimensions, and port across kernel versions.
defconfig 走原生流程（merge_config + savedefconfig）、上游代码加 vendor gate 保留、硬件状态直接读字节而非推断、改动按四个维度分析、跨内核版本移植。
Beyond generic driver scaffolding, the hub routes each task to a per-subsystem expert module — loaded on demand, aligned to that subsystem's kernel Documentation/, verified against a real source tree, and carrying its own test cases and known-bug.
不止通用驱动骨架——hub 按任务把你路由到对应子系统的专家模块：按需加载、对齐该子系统的内核 Documentation/、拿真源码树验证、各带自己的测试用例和踩坑记录。
request_irq / threaded IRQ, bottom-half choice (workqueue / tasklet / softirq), and what can sleep where.request_irq / threaded IRQ、下半部选型（workqueue / tasklet / softirq）、哪个上下文能睡。
Wait queues, completion, the manual-sleep ordering (lost wakeup), preemption, policy / affinity, CFS & EEVDF.等待队列、completion、手动睡眠顺序（丢唤醒）、抢占、策略 / 亲和性、CFS 与 EEVDF。
Allocator choice (kmalloc / kvmalloc / vmalloc / kmem_cache), GFP context, user-memory access, driver mmap.分配器选型（kmalloc / kvmalloc / vmalloc / kmem_cache）、GFP 上下文、访问用户内存、驱动 mmap。
VFS objects, implementing file_operations, exposing data via debugfs / procfs / seq_file, writing a filesystem.VFS 对象、实现 file_operations、用 debugfs / procfs / seq_file 导出数据、写文件系统。
spinlock vs mutex choice, the irqsave rule for locks shared with IRQ context (or same-core deadlock), no-sleep-in-atomic, RCU for read-mostly data.spinlock 与 mutex 选型、进程和中断共享的锁要 irqsave（否则同核死锁）、原子态禁睡眠、读多写少用 RCU。
pm_runtime enable + get/put balance — and the get_sync trap (it adds a ref even on failure), autosuspend, dev_pm_ops system-sleep callbacks.pm_runtime enable + get/put 配平——以及 get_sync 的坑（失败也加引用）、autosuspend、dev_pm_ops 系统睡眠回调。
The DMA API — coherent vs streaming, the mandatory dma_mapping_error check, DMA mask, cache sync. Not dmaengine.DMA API：coherent 与 streaming、必查 dma_mapping_error、DMA mask、缓存同步。注意不是 dmaengine 子系统。
compatible binding, of_* property reads, MMIO/IRQ/clock/GPIO resources, node iteration with refcounting.compatible 绑定、of_* 读属性、拿 MMIO/中断/时钟/GPIO、遍历节点的引用计数。
i2c_driver bind, SMBus / raw transfer / regmap-i2c, and the probe-signature change across versions.i2c_driver 绑定、SMBus / 原始传输 / regmap-i2c、跨版本的 probe 签名变更。
spi_driver bind, spi_sync multi-segment transfers, regmap-spi, DMA-able buffers.spi_driver 绑定、spi_sync 多段传输、regmap-spi、buffer 必须 DMA-able。
gpiod descriptor consumer, GPIO-as-IRQ, writing a gpiochip, and the active-low handling.gpiod 描述符消费、GPIO 当中断、写 gpiochip 控制器、active-low 处理。
host driver bind, control / bulk transfers, async URBs, and the completion-callback context rule.host 驱动绑定、控制 / 批量传输、URB 异步、完成回调的上下文规则。
USB / PCIe / MIPI phy — consume phy_init → phy_power_on (reverse to tear down), or write a provider. Not the MDIO network PHY.USB / PCIe / MIPI phy —— 消费 phy_init → phy_power_on（拆除反序），或写 provider。不是网络 MDIO PHY。
Inter-processor IPC — client mbox_send_message, or write a controller; the controller must signal TX completion (mbox_chan_txdone).核间 IPC —— client mbox_send_message，或写控制器；控制器必须上报 TX 完成（mbox_chan_txdone）。
Consumer clk_get / prepare+enable, the two-phase prepare-vs-enable context split (what can sleep), and writing a clk provider for device tree.消费 clk_get / prepare+enable、prepare 与 enable 两阶段的上下文区别（谁能睡）、写 clk provider 暴露给设备树。
Runtime state switching, the PM sleep / idle helpers, and the fact that the default state is auto-applied by the driver core.运行时切引脚状态、PM 的 sleep / idle 封装、default 态由 driver core 自动应用（不用手动选）。
Supply get / enable / set-voltage, the reference-counted enable/disable balance, and optional supply vs the dummy regulator.拿供电 / enable / 调压、enable·disable 引用计数配平、可选供电 vs dummy 稳压器。
Per-bus init, regmap_read / write / update_bits, the register cache across PM, and marking volatile registers.按总线 init、regmap_read / write / update_bits、跨 PM 的寄存器缓存、标 volatile 寄存器。
assert / deassert / self-reset a reset line, and the exclusive-vs-shared reference-counted choice by how the line is wired.assert / deassert / 自复位一条复位线、按硬件接线选 exclusive vs shared(引用计数)。
Atomic pwm_state apply (period+duty+enable in one shot), the pwm_apply_state → pwm_apply_might_sleep rename, and atomic vs sleeping apply.pwm_state 一次性原子应用(周期+占空比+使能)、pwm_apply_state → pwm_apply_might_sleep 改名、原子 vs 会睡的 apply。
Writing a clock controller — clk_hw / clk_ops, where .enable is atomic but .prepare may sleep, and exposing clocks to DT.写时钟控制器 —— clk_hw / clk_ops，.enable 原子而 .prepare 可睡，暴露给 DT。
Writing a pin controller — pinctrl_desc with the three ops, the DT dt_node_to_map, set_mux and pin_config_set.写 pin 控制器 —— pinctrl_desc + 三组 ops、DT dt_node_to_map、set_mux 和 pin_config_set。
Writing a PMIC regulator — the *_regmap helper ops driven by regulator_desc register fields, and list_voltage selector→µV mapping.写 PMIC 稳压器 —— *_regmap helper ops 配 regulator_desc 寄存器字段、list_voltage selector→µV 映射。
net_device registration, NAPI receive (budget / poll), ndo_start_xmit + queue control, sk_buff lifecycle.net_device 注册、NAPI 收包（budget/poll）、ndo_start_xmit 发包 + 队列控制、sk_buff 生命周期。
codec / component, cpu DAI, the machine sound card, DAI ops, and the atomic trigger-callback rule.codec / component、cpu DAI、machine 声卡、DAI ops、trigger 回调的原子上下文规则。
v4l2 / video device registration, videobuf2 queues, sensor subdev (async), the stop_streaming buffer-return rule.v4l2 / video device 注册、videobuf2 队列、sensor subdev（异步）、stop_streaming 归还 buffer 规则。
Sensor / ADC driver skeleton, private data via iio_priv, channels & info, and triggered-buffer capture.传感器 / ADC 驱动骨架、用 iio_priv 拿私有数据、channels 与 info、触发缓冲采集。
Kbuild Makefiles, the Kconfig language, the native config flow (no hand-edited defconfig), cross-compile, module essentials.Kbuild Makefile、Kconfig 语言、原生配置流程（不手改 defconfig）、交叉编译、模块要素。
Temperature-sensor zones (get_temp in milli-degrees C), cooling devices, the OF-register rename, and DT thermal-zones.温度传感器 zone（get_temp 回填毫摄氏度）、冷却设备、OF 注册改名、DT thermal-zones。
watchdog_ops start/stop/ping, the nowayout semantics, max_hw_heartbeat_ms auto-feed, and stop-on-reboot.watchdog_ops 启停喂狗、nowayout 语义、max_hw_heartbeat_ms 框架代喂、干净重启停狗。
rtc_class_ops read/set time, the struct tm conventions (tm_year since 1900, tm_mon 0-based), and allocate-then-register.rtc_class_ops 读写时间、struct tm 约定（tm_year 自 1900、tm_mon 0 起）、先 allocate 后 register。
power_supply_desc register, the fixed micro-unit properties (µV / µA / µAh / 0.1°C), and power_supply_changed on state change.power_supply_desc 注册、属性固定微单位（µV / µA / µAh / 0.1°C）、状态变化调 power_supply_changed。
devm_hwmon_device_register_with_info, and the fixed sysfs units — temperature in milli-°C, voltage in mV, fan in RPM.devm_hwmon_device_register_with_info、sysfs 固定单位 —— 温度毫摄氏度、电压 mV、风扇 RPM。
Writing a cpufreq_driver + frequency table, .target_index switching by index, and the transition_begin/end pairing for async frequency changes.写 cpufreq_driver + 频率表、.target_index 按索引切频、异步改频率要 transition_begin/end 成对（否则调频卡死）。
cpuidle_driver + idle states, the .enter atomic-context rule (return the state actually entered), and CPUIDLE_FLAG_TIMER_STOP for timer-stopping deep states.cpuidle_driver + idle states、.enter 原子上下文（返回实际进入的态）、停本地 timer 的深睡态标 CPUIDLE_FLAG_TIMER_STOP。
Non-CPU device DVFS (GPU / bus) — devfreq_dev_profile + .target snapping to a real OPP via devfreq_recommended_opp, with true utilization in get_dev_status.非-CPU 设备调频（GPU / 总线）—— devfreq_dev_profile + .target 用 devfreq_recommended_opp 取实际 OPP、get_dev_status 回填真实利用率。
led_classdev register, the atomic brightness_set vs brightness_set_blocking (for sleeping buses), and DT init data.led_classdev 注册、原子 brightness_set vs brightness_set_blocking（走会睡的总线）、DT init data。
input_dev register, declaring capabilities before register, reporting events, and the mandatory input_sync.input_dev 注册、注册前声明能力、上报事件、必须的 input_sync 帧同步。
Host controller driver — mmc_alloc_host / mmc_add_host, the mmc_host_ops, and the mandatory mmc_request_done on every completion path.主机控制器驱动 —— mmc_alloc_host / mmc_add_host、mmc_host_ops、每条完成路径都必须 mmc_request_done。
Slave DMA — the prep → submit → dma_async_issue_pending sequence (submit alone won't start it), channel lifecycle, dma-mapped buffers.slave DMA —— prep → submit → dma_async_issue_pending 序列（光 submit 不启动）、通道生命周期、dma-map 过的缓冲。
eeprom / efuse / otp — consume a cell (nvmem_cell_read buffer must be kfreed), or write a provider via nvmem_config.eeprom / efuse / otp —— 消费 cell（nvmem_cell_read 缓冲要 kfree），或用 nvmem_config 写 provider。
NAND / NOR / SPI flash — erase before write (aligned to erasesize), mtd_device_parse_register partitions, nand_scan.NAND / NOR / SPI flash —— 写前必擦（按 erasesize 对齐）、mtd_device_parse_register 分区、nand_scan。
Writing a DMA controller — dma_device with dma_cap_set, the virt-dma (vchan) layer, and completing the cookie + client callback.写 DMA 控制器 —— dma_device + dma_cap_set、virt-dma(vchan)层、完成 cookie + 触发 client 回调。
Writing an IOMMU driver — iommu_ops with map_pages/unmap_pages, and flushing the IOTLB after unmap before pages are reused.写 IOMMU 驱动 —— iommu_ops 的 map_pages/unmap_pages、unmap 后放页前必刷 IOTLB。
A wrong kernel answer doesn't throw an exception — it corrupts memory or ships a CVE. So a set of rules is non-negotiable, refused even when asked: 内核答错不是抛个异常——是踩内存、是出 CVE。所以有一组规则不容商量，哪怕被要求也拒绝：
When it kicks in: you touch kernel modules, device drivers, subsystems, Kconfig/Makefile, device tree (.dts/.dtsi), or C using kernel APIs (kmalloc, printk, platform_driver…). It stays out of plain userspace C/C++.
什么时候触发：你碰内核模块、设备驱动、子系统、Kconfig/Makefile、设备树（.dts/.dtsi），或用内核 API 的 C（kmalloc、printk、platform_driver……）。纯用户态 C/C++ 它不掺和。
A kernel answer flows through objective checks and a scoring panel; a trap becomes a measured rule; a regression test guards it; a drift detector keeps it honest across versions. The corpus pass-rate over commits is the one number that says whether it is actually compounding. 一个内核答案先过客观检查和打分面板；踩到的坑沉成被度量的规则；回归测试守住它；版本变了由漂移检测兜底。测试通过率随 commit 的曲线，是判断它到底有没有在累积变强的唯一数字。
All built and verified against a real 6.1 source tree. The kernel has an edge the design harness lacks: checkpatch.pl, compilation, and symbol existence are deterministic — harder gates than any heuristic.
全部已建，并对一棵真实 6.1 源码树验证过。内核这边有设计架构没有的优势：checkpatch.pl、编译、符号实存都是确定性的——比任何启发式都硬的检查。
scripts/fact_gate.mjs · checkpatch_gate.sh · kernel-tree.mjs
Model weakness对应弱点
Models invent plausible APIs and config symbols. The answer ends with a [CLAIMS] block; fact_gate greps every cited API / CONFIG / symbol / compatible against a real tree (--tree, no path baked in). A made-up CONFIG_* fails on the spot. checkpatch enforces coding style.
模型会编造看似合理的 API 和 config 符号。答案末尾带 [CLAIMS] 块；fact_gate 把引用的每个 API / CONFIG / 符号 / compatible 拿真树 grep(--tree，不内置路径)。编造的 CONFIG_* 当场 fail。checkpatch 守代码风格。
scripts/regression_test.mjs · tests/eval/cases/*.json
Model weakness对应弱点
A content change can quietly break what used to work. A frozen case set carries a known-good answer (gold) plus deliberate corruptions; the runner asserts gold resolves and every corruption is caught — a self-degradation check that proves the gate can tell good from bad. 改内容可能悄悄弄坏原本好的。一组冻结用例各带正确答案(gold)+ 故意改坏的版本；runner 断言 gold 全过、每个坏版本被抓——自降解校准，证明检查真能分好坏。
.claude/agents/kernel-*-critic.md · scripts/kernel-critic.mjs
Model weakness对应弱点
One reviewer scoring its own work praises uniformly. Seven fresh-context specialists score one axis each — correctness (0.28), safety (0.22), design (0.13), testing (0.12), complexity (0.09), coding-style (0.08), completeness (0.08), aligned with Google's review dimensions. Safety is weighted high and an error there fails the answer outright; a sleep-in-spinlock can brick a board. 一个评审评自己的活会一律说好。七个 fresh-context 专家各守一轴——correctness(0.28)、safety(0.22)、design(0.13)、testing(0.12)、complexity(0.09)、coding-style(0.08)、completeness(0.08)，对齐 Google 的 review 维度。safety 权重高，这一轴出 error 直接判 fail；持 spinlock 睡眠能把板子搞砖。
.claude/commands/kernel-learn.md · scripts/kernel_learn_validate.mjs
Model weakness对应弱点
A lesson written as prose is never verified, so the same trap recurs. Every learned rule ships as an atomic triple — a rule with an embedded [CLAIMS] check, a frozen case that fails before / passes after, and a registration. No executable check, no rule: the validator rejects it.
写成散文的经验没人验证，同一个坑会反复犯。每条学到的规则都是原子三件套——带 [CLAIMS] 检查的规则、一条建前 fail/建后 pass 的冻结用例、一次注册。没有可执行检查就不建：验证器直接拒。
evolution/{ledger.tsv, rules.json} · evolve-ledger / evolve-rules
Model weakness对应弱点
A rules folder only grows; dead rules nag without catching anything. Each rule scores s = (catches+1)/(fires+2) — fires a lot, catches nothing means prune. The design harness scripts are reused directly: ledger as-is, rules with a one-flag patch.
规则文件夹只增不减；死规则光报警不抓东西。每条规则评 s = (catches+1)/(fires+2)——老触发、零抓到就 prune。设计架构的脚本直接复用：记录表原样用，规则表加一个开关。
scripts/version_drift.mjs · references/kernel_version_deltas.md
Model weakness对应弱点
Kernel knowledge rots: an API real in 6.1 is gone by 7.0. The detector runs the gold claims against several version trees and reports what changed. A live run over 6.1 → 7.0 flagged ion_alloc as removed — machine-found, not hand-maintained.
内核知识会过期：6.1 里真的 API 到 7.0 没了。检测器拿 gold 断言在多棵版本树上跑，报出变化。一次 6.1 → 7.0 实跑标出 ion_alloc 被删——机器找出来的，不靠手维护。
Separate what stays the same across kernels from what changes between them. The unchanging part is taught directly. The changing part is labelled with the kernel versions it applies to, and re-checked against the actual source tree — so a kernel update can never quietly make stable knowledge wrong. 把"每个内核都一样的"和"内核之间会变的"分开。不变的那部分直接教；会变的那部分注明它适用哪些内核版本、并对真实源码树重新核对——这样内核升级永远不会悄悄把稳定的知识弄错。
version_drift.mjs ran 6.1 → 7.0 and flagged ion_alloc as removed — a right-side fact that got labelled with the versions it applies to, while the left side was not affected.
这个分法就是核心：version_drift.mjs 跑 6.1 → 7.0 标出 ion_alloc 被删——一条右边的事实被注明了适用版本，左边不受影响。
sky-skills already had a design harness that makes design skills get smarter. This is the same machinery, with the gates swapped from rendered-pixels to kernel facts. Where it can, it reuses the exact scripts. sky-skills 本来就有一套让设计 skill 变聪明的架构。这是同一套机器，只把检查从"渲染像素"换成"内核事实"。能复用的地方，直接用同一份脚本。
| Design harness设计架构 | Kernel harness内核架构 |
|---|---|
| visual-audit (rendered, heuristic)visual-audit(渲染，启发式) | → fact_gate.mjs (symbol exists in tree)(符号在树里实存) |
| verify.py (structural)verify.py(结构) | → checkpatch_gate.sh (kernel's own tool)(内核自带工具) |
| multi-critic (weighted LLM panel)multi-critic(加权 LLM 面板) | → 7 kernel critics7 个内核打分员 |
| design-learnerdesign-learner | → /kernel-learn (atomic triple)(原子三件套) |
| evolve-ledger / evolve-rulesevolve-ledger / evolve-rules | → reused as-is / one-flag patch原样复用 / 加一个开关 |
Separating the agent doing the work from the agent evaluating it is a powerful lever. The kernel just gives the evaluator harder ground to stand on — a real source tree. 把做事的 agent 和评判的 agent 分开，是一个真正的杠杆。内核只是给了评判者更硬的立足点——一棵真源码树。
The skill ships tree-agnostic — no path is baked in. Most kernel and BSP engineers already have a source tree; the gate finds it by walking up from the working directory, an env var, or a one-line config. No tree? It degrades honestly: answers are marked [unverified] rather than asserted, and it prints how to bind or shallow-clone one.
这个 skill 发布时是树无关的——不内置任何路径。多数内核/BSP 工程师本来就有源码树；检查脚本会从工作目录往上找、读环境变量、或读一行配置。没有树?它诚实降级：答案标 [未验证] 而不是直接断言，并打印怎么绑定或浅克隆一棵。
Bind it once and the payoff is real: answers are verified against your exact kernel version, checkpatch runs with your tree's own rules, and version drift is measured between the trees you actually ship.
绑定一次，回报实在：答案对着你的确切内核版本验证，checkpatch 用你树里自己的规则跑，版本漂移是在你真正发布的那些树之间度量的。
The full engine design lives next to the skill; the scripts are a few hundred lines each. 完整引擎设计就在 skill 旁边；脚本各几百行。