# Extension points — torvalds/linux

> Canonical page: https://codevetter.com/unpack/linux/extension-points

# Extension points — torvalds/linux

Scanned commit f0100363d8c374bd8e9ea7c9ba02744f0b802ca4 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The kernel is extension-by-design: initcall levels order boot-time registration, LSM hook tables add security policies, file_operations/inode_operations/super_operations vtables plug filesystems, struct device_driver + bus match functions plug drivers, register_filesystem adds filesystems, the syscall .tbl files add syscalls, module_init/module_exit wrap loadable code, eBPF program types (including sched_ext and bpf_struct_ops) let userspace extend behavior at runtime, and io_uring opcodes extend async I/O. Rust extensions go through the kernel crate + #[module] proc-macro.
- initcall levels are the primary boot-time extension mechanism: __define_initcall emits entries into named linker sections (early, core, postcore, arch, subsys, fs, device, late, plus *_sync variants) consumed by do_initcalls in order. — [include/linux/init.h#L200-311](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/include/linux/init.h#L200-L311) [init/main.c#L1427-1470](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/main.c#L1427-L1470)
- New security modules plug in via the LSM framework: hook implementations are registered into lists declared in include/linux/lsm_hook_defs.h, dispatched by call_int_hook/call_void_hook in security/security.c, and initialized through the staged security_initcall_* initcalls in security/lsm_init.c. — [include/linux/lsm_hook_defs.h](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/include/linux/lsm_hook_defs.h) [security/security.c#L90-515](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/security/security.c#L90-L515) [security/lsm_init.c#L497-544](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/security/lsm_init.c#L497-L544)
- Filesystems extend via struct file_system_type registered with register_filesystem()/unregister_filesystem() in fs/filesystems.c, then implement super_operations/inode_operations/file_operations that VFS calls through f_op->read/write_iter/open. — [fs/filesystems.c#L88-120](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/filesystems.c#L88-L120) [fs/read_write.c#L571-574](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/read_write.c#L571-L574) [fs/open.c#L1096-1124](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/open.c#L1096-L1124)
- Drivers plug into the driver model: bus_type match functions pair devices with device_driver structs, and driver_probe_device -> really_probe invokes drv->probe plus sysfs integration (driver_sysfs_add). — [drivers/base/dd.c#L483-900](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/drivers/base/dd.c#L483-L900) [drivers/base/bus.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/drivers/base/bus.c) [drivers/base/core.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/drivers/base/core.c)
- Loadable modules extend the kernel at runtime: module_init maps to device_initcall for built-ins or runs in do_init_module for loaded modules; check_modinfo enforces vermagic/license/livepatch metadata compatibility. — [kernel/module/main.c#L2478-2663](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L2478-L2663) [kernel/module/main.c#L3088](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/module/main.c#L3088) [include/linux/init.h#L306-311](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/include/linux/init.h#L306-L311)
- eBPF is the runtime extension fabric: bpf(2) loads verified programs/maps (kernel/bpf/syscall.c), attachable to kprobes/tracepoints/LSM (bpf_lsm.c), and sched_ext (kernel/sched/ext/) exposes the CPU scheduler itself to BPF policies. — [kernel/bpf/syscall.c#L2917-3133](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/bpf/syscall.c#L2917-L3133) [kernel/bpf/bpf_lsm.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/bpf/bpf_lsm.c) [kernel/sched/ext/ext.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sched/ext/ext.c)
- New syscalls are added by a row in the per-arch .tbl files (e.g. arch/x86/entry/syscalls/syscall_64.tbl) plus a SYSCALL_DEFINE body; generated asm/syscalls_64.h feeds both the x64_sys_call switch and sys_call_table[]. — [arch/x86/entry/syscalls/syscall_64.tbl](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/arch/x86/entry/syscalls/syscall_64.tbl) [arch/x86/entry/syscall_64.c#L23-43](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/arch/x86/entry/syscall_64.c#L23-L43) [fs/open.c#L1427](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/open.c#L1427)
- io_uring opcodes extend through the io_issue_defs[] table in io_uring/opdef.c: each IORING_OP_* entry declares prep/issue handlers and capability flags, with BUILD_BUG_ON/early-init validation that every opcode has both handlers. — [io_uring/opdef.c#L54-79](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/io_uring/opdef.c#L54-L79) [io_uring/opdef.c#L864-879](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/io_uring/opdef.c#L864-L879)
- Rust modules are wired by the kernel crate + macros: rust/kernel/ exposes safe wrappers (driver.rs, device.rs, fs.rs) and rust/macros/module.rs generates module metadata; samples/rust/*.rs (rust_minimal.rs, rust_driver_i2c.rs, rust_driver_pci.rs, ...) are the canonical examples. — [rust/kernel/lib.rs#L1-60](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/rust/kernel/lib.rs#L1-L60) [rust/macros/module.rs](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/rust/macros/module.rs) [samples/rust/rust_minimal.rs](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/samples/rust/rust_minimal.rs) [samples/rust/rust_driver_i2c.rs](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/samples/rust/rust_driver_i2c.rs)
- Kconfig + Kbuild wiring is the build-time extension pattern: add a config FOO to a subsystem Kconfig (sourced via the top-level Kconfig chain) and gate objects with obj-$(CONFIG_FOO) in the directory Makefile. — [Kconfig#L7-35](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/Kconfig#L7-L35) [init/Makefile#L7-20](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/Makefile#L7-L20) [init/Kconfig](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/init/Kconfig)
- sysctl knobs are registered through kernel/sysctl.c tables, with subsystem-specific registrations such as mm/hugetlb_sysctl.c exposing runtime-tunable parameters under /proc/sys. — [kernel/sysctl.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/kernel/sysctl.c) [mm/hugetlb_sysctl.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/mm/hugetlb_sysctl.c) [fs/proc/root.c](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/fs/proc/root.c)
- kselftest suites extend by adding a directory under tools/testing/selftests and a TARGETS += entry in the top Makefile; each suite emits KTAP via kselftest/ktap_helpers.sh/ksft.py. — [tools/testing/selftests/Makefile#L1-30](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/tools/testing/selftests/Makefile#L1-L30) [tools/testing/selftests/kselftest/ktap_helpers.sh](https://github.com/torvalds/linux/blob/f0100363d8c374bd8e9ea7c9ba02744f0b802ca4/tools/testing/selftests/kselftest/ktap_helpers.sh)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)