Ashok G

Kernel, Traced

The map

One line per function: file : function — what it does [ch]. Add your own as you go; this is the version at the end of the series. Pinned to 6.12 LTS.

arch/x86/entry/entry_64.S     : entry_SYSCALL_64          — syscall entry; saves pt_regs                      [1]
arch/x86/entry/common.c       : do_syscall_64             — seccomp/ptrace/tracepoint, then x64_sys_call        [1]
kernel/entry/common.c         : exit_to_user_mode_loop    — resched, signals, task_work before returning        [1,12]
fs/open.c                     : do_sys_openat2            — flags, fd allocation, do_filp_open                   [2]
fs/namei.c                    : path_openat               — RCU-walk then ref-walk                               [2]
fs/namei.c                    : link_path_walk            — component loop                                       [2]
fs/namei.c                    : lookup_fast / lookup_slow — dcache hit / filesystem lookup                       [2]
fs/dcache.c                   : __d_lookup_rcu            — the hash lookup                                      [2]
fs/open.c                     : do_dentry_open            — f_op->open; the file is live                         [2]
kernel/fork.c                 : kernel_clone              — fork/clone entry                                     [3]
kernel/fork.c                 : copy_process              — build the child task                                 [3]
kernel/fork.c                 : dup_mmap                  — copy VMAs; PTEs made read-only for COW               [3,5]
fs/exec.c                     : bprm_execve / exec_binprm — find the handler                                     [3]
fs/exec.c                     : begin_new_exec            — point of no return                                   [3]
fs/binfmt_elf.c               : load_elf_binary           — map segments, interp, auxv; start_thread             [3]
kernel/sched/core.c           : __schedule                — pick and switch                                      [4]
kernel/sched/fair.c           : update_curr               — charge weighted vruntime                             [4]
kernel/sched/fair.c           : pick_eevdf                — eligible + earliest deadline                         [4]
kernel/sched/fair.c           : place_entity              — vruntime on wakeup, lag preserved                    [4]
kernel/sched/core.c           : context_switch            — switch_mm, switch_to                                 [4]
arch/x86/mm/fault.c           : exc_page_fault            — #PF entry; CR2                                        [5]
arch/x86/mm/fault.c           : do_user_addr_fault        — VMA lookup, permission, handle_mm_fault              [5]
mm/memory.c                   : __handle_mm_fault         — page-table walk/alloc                                [5]
mm/memory.c                   : handle_pte_fault          — anon / file / COW / swap dispatch                     [5]
mm/memory.c                   : do_anonymous_page         — zero page or new folio                               [5]
mm/memory.c                   : do_wp_page                — copy-on-write or reuse                               [5]
mm/filemap.c                  : filemap_fault             — page cache from the fault side                       [5]
mm/filemap.c                  : filemap_read              — read(): folio batch, copy to user                    [6]
mm/readahead.c                : page_cache_ra_unbounded   — the readahead window                                 [6]
block/blk-core.c              : submit_bio                — into the block layer                                 [6]
net/socket.c                  : __sys_connect_file        — security_socket_connect; ops->connect                [7]
net/ipv4/af_inet.c            : __inet_stream_connect     — pre_connect (cgroup BPF), connect, wait              [7]
net/ipv4/tcp_ipv4.c           : tcp_v4_pre_connect        — BPF_CGROUP_RUN_PROG_INET4_CONNECT                   [7]
kernel/bpf/cgroup.c           : __cgroup_bpf_run_filter_sock_addr — run effective programs; may rewrite         [7,11]
net/ipv4/tcp_ipv4.c           : tcp_v4_connect            — route (commit), port, state SYN_SENT                 [7]
net/ipv4/tcp_output.c         : tcp_connect               — build and send the SYN; arm retransmit               [7]
net/ipv4/tcp_output.c         : __tcp_transmit_skb        — TCP header; queue_xmit                               [7,8]
net/ipv4/ip_output.c          : __ip_local_out            — NF_INET_LOCAL_OUT                                    [7,8]
net/ipv4/ip_output.c          : ip_finish_output          — BPF_CGROUP_RUN_PROG_INET_EGRESS                      [7,8]
net/core/dev.c                : __dev_queue_xmit          — TC egress, qdisc, driver                              [8]
net/ipv4/tcp.c                : tcp_sendmsg_locked        — user data into skbs; push                            [8]
net/ipv4/tcp_output.c         : tcp_write_xmit            — cwnd, rwnd, pacing, TSQ                              [8]
net/core/dev.c                : net_rx_action             — NAPI poll loop                                       [9]
net/core/dev.c                : __netif_receive_skb_core  — taps, TC ingress, protocol demux                     [9]
net/ipv4/ip_input.c           : ip_rcv / ip_local_deliver — PRE_ROUTING, route, LOCAL_IN                         [9]
net/ipv4/tcp_ipv4.c           : tcp_v4_rcv                — socket lookup; backlog or do_rcv                     [9]
net/ipv4/tcp_input.c          : tcp_rcv_established       — the fast path                                        [9]
net/ipv4/tcp.c                : tcp_recvmsg_locked        — copy to user; window update                          [9]
kernel/bpf/syscall.c          : bpf_prog_load             — load; bpf_check; select_runtime                       [10]
kernel/bpf/verifier.c         : do_check                  — symbolic execution over all paths                    [10]
kernel/bpf/verifier.c         : is_state_visited          — pruning                                              [10]
arch/x86/net/bpf_jit_comp.c   : bpf_int_jit_compile       — the JIT                                              [10]
security/security.c           : call_int_hook (security_*) — static-call slots per LSM                           [11]
kernel/cgroup/cgroup.c        : cgroup_migrate_execute    — swap css_set; controllers' attach                     [11]
kernel/bpf/cgroup.c           : update_effective_progs    — ancestors' programs for every descendant             [11]
kernel/signal.c               : __send_signal_locked      — queue; complete_signal                               [12]
kernel/signal.c               : get_signal / handle_signal — dequeue; set up the user frame                      [12]
kernel/time/hrtimer.c         : hrtimer_interrupt         — expiry; callbacks; wakeups                           [12]
kernel/time/timer.c           : run_timer_softirq         — the timer wheel                                      [12]
kernel/rcu/tree.c             : synchronize_rcu           — wait a grace period                                  [12]