# Behavior traces — torvalds/linux

> Canonical page: https://codevetter.com/unpack/linux/behavior-traces

# Behavior traces — torvalds/linux

Scanned commit f0100363d8c374bd8e9ea7c9ba02744f0b802ca4 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Key flows traced end-to-end: (1) full boot from start_kernel through initcall levels to PID 1 exec of /sbin/init; (2) a syscall from entry_SYSCALL_64 through the generated dispatch switch to sys_openat and VFS path walk; (3) process creation via clone3->kernel_clone->copy_process->wake_up_new_task; (4) module load via finit_module->load_module->do_init_module; (5) scheduling via __schedule's pick_next_task/context_switch; (6) rootfs mounting via prepare_namespace->mount_root->init_mount.
- Boot trace (phase 1): start_kernel -> set_task_stack_end_magic -> smp_setup_processor_id -> boot_cpu_init -> setup_arch -> mm_core_init_early -> jump_label_init/static_call_init -> early_security_init -> setup_boot_config/setup_command_line -> parse_early_param/parse_args -> random_init_early -> trap_init -> mm_core_init -> sched_init -> early_irq_init -> init_IRQ -> timers_init -> hrtimers_init -> rest_init. — [init/main.c#L986-1100](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L986-L1100)
- Boot trace (phase 2): rest_init -> kernel_clone(kernel_init) creates PID 1 -> kernel_thread(kthreadd) creates PID 2 -> complete(&kthreadd_done) -> schedule_preempt_disabled -> cpu_startup_entry; the boot CPU becomes the idle loop while PID 1 continues initialization. — [init/main.c#L681-732](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L681-L732)
- Boot trace (phase 3): kernel_init -> init_userspace_fs -> wait_for_completion(kthreadd_done) -> kernel_init_freeable -> smp_prepare_cpus -> workqueue_init -> do_pre_smp_initcalls -> smp_init -> sched_init_smp -> do_basic_setup (cpuset_init_smp, ksysfs_init, driver_init, do_initcalls) -> kunit_run_all_tests -> wait_for_initramfs -> console_on_rootfs -> prepare_namespace. — [init/main.c#L1554-1565](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L1554-L1565) [init/main.c#L1646-1706](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L1646-L1706)
- Boot trace (phase 4): after initcalls, kernel_init -> async_synchronize_full -> free_initmem -> mark_readonly (mark_rodata_ro + rodata_test under STRICT_KERNEL_RWX) -> pti_finalize -> system_state=SYSTEM_RUNNING -> run_init_process tries ramdisk_execute_command(/init), then execute_command (init= param), then CONFIG_DEFAULT_INIT, then /sbin/init, /etc/init, /bin/init, /bin/sh — panicking if none works. — [init/main.c#L1565-1628](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L1565-L1628) [init/main.c#L1503-1547](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L1503-L1547)
- Rootfs mount trace: kernel_init_freeable -> prepare_namespace (init/do_mounts.c) -> mount_root -> mount_root_generic -> do_mount_root -> init_mount(name, "/root", fstype, flags, data) -> init_chdir("/root"); falls back through configured rootfstype list (ext4 etc.) or nfs/cifs for network roots. — [init/do_mounts.c#L142-200](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/do_mounts.c#L142-L200) [init/do_mounts.c#L356-483](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/do_mounts.c#L356-L483) [init/main.c#L1693](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L1693)
- Syscall trace: userspace syscall instruction -> entry_SYSCALL_64 (entry_64.S) saves regs -> call do_syscall_64 -> syscall_enter_from_user_mode_randomize_stack -> do_syscall_x64 (nr < NR_syscalls, array_index_nospec) -> x64_sys_call switch case -> __x64_sys_* wrapper -> syscall_exit_to_user_mode; the return value of do_syscall_64 selects SYSRET vs IRET after validating cx/r11/cs/ss/ip/flags. — [arch/x86/entry/entry_64.S#L87-170](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/arch/x86/entry/entry_64.S#L87-L170) [arch/x86/entry/syscall_64.c#L57-130](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/arch/x86/entry/syscall_64.c#L57-L130) [include/linux/entry-common.h#L179-199](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/include/linux/entry-common.h#L179-L199)
- openat trace: __x64_sys_openat -> do_sys_open -> do_sys_openat2 -> build_open_flags -> do_file_open -> set_nameidata -> path_openat(LOOKUP_RCU) -> path_init -> link_path_walk -> open_last_lookups -> do_open -> vfs_open -> may_open -> inode_permission -> f_op->open; retries drop LOOKUP_RCU on -ECHILD then add LOOKUP_REVAL on -ESTALE; FD_ADD installs the fd. — [fs/open.c#L1408-1440](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/open.c#L1408-L1440) [fs/namei.c#L4980-5060](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/namei.c#L4980-L5060) [fs/namei.c#L4231-4252](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/namei.c#L4231-L4252)
- clone3 trace: __x64_sys_clone3 -> clone3_args_valid (size/version checks, CSIGNAL rules, clone3_stack_valid) -> kernel_clone -> copy_process -> dup_task_struct -> sched_fork -> copy_thread -> wake_up_new_task -> returns child pid; vfork additionally blocks the parent on the vfork_done completion. — [kernel/fork.c#L2983-3051](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/fork.c#L2983-L3051) [kernel/fork.c#L2715-2813](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/fork.c#L2715-L2813) [kernel/fork.c#L2133-2320](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/fork.c#L2133-L2320)
- Module-load trace: __x64_sys_finit_module -> may_init_module (CAP_SYS_MODULE) -> load_module -> module_sig_check -> elf_validity_ehdr -> layout_and_allocate -> check_modinfo (vermagic/livepatch/retpoline) -> do_init_module -> mod->init(); delete_module requires the module to be unused and !modules_disabled. — [kernel/module/main.c#L1882-1931](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L1882-L1931) [kernel/module/main.c#L3088](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L3088) [kernel/module/main.c#L3418-3820](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L3418-L3820) [kernel/module/main.c#L804](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L804)
- Schedule trace: schedule() -> __schedule(SM_NONE) -> rq_lock -> update_rq_clock -> pick_next_task -> __pick_next_task iterates sched classes -> context_switch(rq, prev, next) switches address space and CPU state -> rq unlock; on the idle path cpu_startup_entry calls schedule() in a loop until a task wakes. — [kernel/sched/core.c#L7111-7302](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/core.c#L7111-L7302) [kernel/sched/core.c#L7395-7433](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/core.c#L7395-L7433) [init/main.c#L726-732](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L726-L732)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)