See http://sourceware.org/systemtap/wiki/utrace for other resources. See https://www.redhat.com/mailman/listinfo/utrace-devel for mailing list info. The utrace patch series is now in a period of transition. Some of the work is being merged upstream in the post-2.6.24 tree. Please check the mailing list archives for discussion about the current transition code. For now, the old patch series based on 2.6.24 is available. Other backports are not being actively updated right now. See README.backport for details on supporting older kernel versions. If you just want one big patch that gets you the new code, see 2.6.24/linux-2.6.24-utrace.patch for that. That patch combines the separate patches described individually. Patches in the 2.6.24/ subdirectory are against the 2.6.24 release kernel. The linux-2.6-utrace.patch here is what's used in the Fedora 8 kernel. They are provided as a quilt series (see the 2.6.24/series file). This separates the patch into the four GIT branches described below, and further subdivides three of those branch patches into the work I've done and the arch work written by other contributors. In each subdirectory linux-2.6-utrace.patch is a symlink to a file named linux-VERSION-utrace.patch for the specific vanilla kernel version the patch applies to. The 2.6.24-based tree is also available in GIT, though this GIT tree will no longer be the home of future development. Use repository git://git.kernel.org/pub/scm/linux/kernel/git/frob/utrace.git/ and pull the following branches. Each is the parent of its successor in the list: upstream utrace-tracehook utrace-regset utrace-core utrace-ptrace-compat You can put the following (sans indentation) in a file in .git/remotes/: URL: git://git.kernel.org/pub/scm/linux/kernel/git/frob/utrace.git/ Pull: upstream:upstream Pull: utrace-tracehook:utrace-tracehook Pull: utrace-regset:utrace-regset Pull: utrace-core:utrace-core Pull: utrace-ptrace-compat:utrace-ptrace-compat Please send any feedback about this code to the mailing list. The file crash-suspend.c is a simple example of a loadable kernel module using the new infrastructure. It implements the old GNU feature of doing a job suspend on crash, so you can attach a debugger right then instead of just looking at the core file afterwards. Try for example: $ sudo /sbin/insmod crash-suspend.ko pid=$$ to load the module and attach it to your shell. It then attaches to any children of your shell. Now run something that crashes and would ordinarily dump core--you can just run cat or sleep and hit ^\ to crash it with a SIGQUIT. See it suspend. Try "jobs -l" and see it stopped with a non-stop signal. If you resume it with "fg" it will go ahead and dump core. Or, you can attach a debugger like gdb first, and then debug it.