CodeVetter · Repo Unpack · Behavior traces
torvalds/linux
Key flows traced end-to-end: (1) full boot from start_kernel through initcall levels to PID 1 exec of /sbin/init; (2) a syscall from entry_SYSCALL_64 through the generated dispatch switch to sys_openat and VFS path walk; (3) process creation via clone3->kernel_clone->copy_process->wake_up_new_task; (4) module load via finit_module->load_module->do_init_module; (5) scheduling via __schedule's pick_next_task/context_switch; (6) rootfs mounting via prepare_namespace->mount_root->init_mount.
- Boot trace (phase 1): start_kernel -> set_task_stack_end_magic -> smp_setup_processor_id -> boot_cpu_init -> setup_arch -> mm_core_init_early -> jump_label_init/static_call_init -> early_security_init -> setup_boot_config/setup_command_line -> parse_early_param/parse_args -> random_init_early -> trap_init -> mm_core_init -> sched_init -> early_irq_init -> init_IRQ -> timers_init -> hrtimers_init -> rest_init.
- Boot trace (phase 2): rest_init -> kernel_clone(kernel_init) creates PID 1 -> kernel_thread(kthreadd) creates PID 2 -> complete(&kthreadd_done) -> schedule_preempt_disabled -> cpu_startup_entry; the boot CPU becomes the idle loop while PID 1 continues initialization.
- Boot trace (phase 3): kernel_init -> init_userspace_fs -> wait_for_completion(kthreadd_done) -> kernel_init_freeable -> smp_prepare_cpus -> workqueue_init -> do_pre_smp_initcalls -> smp_init -> sched_init_smp -> do_basic_setup (cpuset_init_smp, ksysfs_init, driver_init, do_initcalls) -> kunit_run_all_tests -> wait_for_initramfs -> console_on_rootfs -> prepare_namespace.
- Boot trace (phase 4): after initcalls, kernel_init -> async_synchronize_full -> free_initmem -> mark_readonly (mark_rodata_ro + rodata_test under STRICT_KERNEL_RWX) -> pti_finalize -> system_state=SYSTEM_RUNNING -> run_init_process tries ramdisk_execute_command(/init), then execute_command (init= param), then CONFIG_DEFAULT_INIT, then /sbin/init, /etc/init, /bin/init, /bin/sh — panicking if none works.
- Rootfs mount trace: kernel_init_freeable -> prepare_namespace (init/do_mounts.c) -> mount_root -> mount_root_generic -> do_mount_root -> init_mount(name, "/root", fstype, flags, data) -> init_chdir("/root"); falls back through configured rootfstype list (ext4 etc.) or nfs/cifs for network roots.
- Syscall trace: userspace syscall instruction -> entry_SYSCALL_64 (entry_64.S) saves regs -> call do_syscall_64 -> syscall_enter_from_user_mode_randomize_stack -> do_syscall_x64 (nr < NR_syscalls, array_index_nospec) -> x64_sys_call switch case -> __x64_sys_* wrapper -> syscall_exit_to_user_mode; the return value of do_syscall_64 selects SYSRET vs IRET after validating cx/r11/cs/ss/ip/flags.
- openat trace: __x64_sys_openat -> do_sys_open -> do_sys_openat2 -> build_open_flags -> do_file_open -> set_nameidata -> path_openat(LOOKUP_RCU) -> path_init -> link_path_walk -> open_last_lookups -> do_open -> vfs_open -> may_open -> inode_permission -> f_op->open; retries drop LOOKUP_RCU on -ECHILD then add LOOKUP_REVAL on -ESTALE; FD_ADD installs the fd.
- clone3 trace: __x64_sys_clone3 -> clone3_args_valid (size/version checks, CSIGNAL rules, clone3_stack_valid) -> kernel_clone -> copy_process -> dup_task_struct -> sched_fork -> copy_thread -> wake_up_new_task -> returns child pid; vfork additionally blocks the parent on the vfork_done completion.
- Module-load trace: __x64_sys_finit_module -> may_init_module (CAP_SYS_MODULE) -> load_module -> module_sig_check -> elf_validity_ehdr -> layout_and_allocate -> check_modinfo (vermagic/livepatch/retpoline) -> do_init_module -> mod->init(); delete_module requires the module to be unused and !modules_disabled.
- Schedule trace: schedule() -> __schedule(SM_NONE) -> rq_lock -> update_rq_clock -> pick_next_task -> __pick_next_task iterates sched classes -> context_switch(rq, prev, next) switches address space and CPU state -> rq unlock; on the idle path cpu_startup_entry calls schedule() in a loop until a task wakes.