================================================================================
K6 rootfs-model — upstream source-site snapshot
================================================================================

Generated by linux-wasm/tools/k6-rootfs-model-probe/snapshot-sources.sh
from Documentation/wasm/rootfs-model.rst §6.

Pinned at K6-A2 sub-phase close (per §13 K6-A2). Each named upstream
function lists its definition file:line (one entry per arch) plus
its call sites in the upstream tree paths K6 depends on
(`init/`, `fs/`, `usr/`). The list is the input for K6-B
implementation: any deviation between this snapshot and the
upstream tree at K6-B-time is either spec drift (refresh §6
and this file), or genuine upstream movement (note the diff and
refresh both).

Re-run the script after an upstream tag bump (e.g. v6.12 → v6.13)
and commit the regenerated file alongside the bump.

Section legend:
  [DEF]   the function definition (file:line + leading prose)
  [CALL]  call sites in the upstream tree
  [K6-B]  where K6-B will insert NEW calls into this function
          (annotation only; does not exist in upstream)

Snapshot taken against: v6.12
Generated: 2026-05-25 (UTC, deterministic stamp from `date -u`)
Note: snapshot file deliberately omits HH:MM:SS in the
      stamp so re-runs on the same day produce byte-identical
      output. Drift detection is at line-number granularity.

================================================================================
1. init/initramfs.c — cpio parser + rootfs population (K6-B R1, R2)
================================================================================

Module: parses the initramfs cpio archive embedded at
__initramfs_start..__initramfs_end (upstream-builtin) and at
initrd_start..initrd_end (bootloader-supplied) and creates the
corresponding files in the rootfs via vfs_mkdir/vfs_create/etc.

K6-A1 patches/0006 removes `static` from unpack_to_rootfs() so
arch probes can invoke it on arbitrary buffers; the rest of the
file is unchanged upstream.

[DEF] init/initramfs.c::unpack_to_rootfs(buf, len)
  init/initramfs.c:486  char * __init unpack_to_rootfs(char *buf, unsigned long len)

[CALL] unpack_to_rootfs call sites:
  init/initramfs.c:695  char *err = unpack_to_rootfs(__initramfs_start, __initramfs_size);
  init/initramfs.c:707  err = unpack_to_rootfs((char *)initrd_start, initrd_end - initrd_start);

[CALL] arch-side after K6-A1 (patches/0006 expose):
  arch/wasm32/configs/wasm32_defconfig:86  # boot. K6-A1 probe uses unpack_to_rootfs() directly on a kernel-
  arch/wasm32/kernel/init.c:58  #include <linux/initramfs.h>		/* unpack_to_rootfs (patch 0006) */
  arch/wasm32/kernel/init.c:216  err = unpack_to_rootfs((char *)initrd_start, len);
  arch/wasm32/kernel/k6_a1_probes.c:12  *        init/initramfs.c::unpack_to_rootfs (exposed via
  arch/wasm32/kernel/k6_a1_probes.c:93  err = unpack_to_rootfs(cpio_copy, K6_A1_PROBE_CPIO_SIZE);
  arch/wasm32/kernel/k6_b1_probes.c:14  * init/initramfs.c) has already invoked unpack_to_rootfs() on

[DEF] init/initramfs.c::populate_rootfs() — rootfs_initcall
  init/initramfs.c:756  static int __init populate_rootfs(void)

[CALL] populate_rootfs is registered via rootfs_initcall;
       no direct call sites in upstream (initcall infra runs
       it). Reference:
  init/initramfs.c:765:rootfs_initcall(populate_rootfs);

[DEF] init/initramfs.c::do_populate_rootfs() — async-scheduled by populate_rootfs
  init/initramfs.c:692  static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)

[CALL] do_populate_rootfs scheduling:
  init/initramfs.c:692:static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
  init/initramfs.c:758:	initramfs_cookie = async_schedule_domain(do_populate_rootfs, NULL,

[DEF] init/initramfs.c::write_buffer() — decompressor write path
  init/initramfs.c:449  static long __init write_buffer(char *buf, unsigned long len)

[DEF] init/initramfs.c::flush_buffer() — decompressor flush path
  init/initramfs.c:459  static long __init flush_buffer(void *bufv, unsigned long len)

================================================================================
2. init/main.c — kernel_init flow (K6-B R3, R4, R7 site)
================================================================================

The boot path from start_kernel through kernel_init to
run_init_process and the arch hook patches/0004 added at K5-C2.

K6-B reuses arch_kernel_init_pre_run_init as the fallback path
(when initramfs is empty / kernel_read_file fails) and lets
kernel_init's standard /init iteration succeed on the
HardwareJS-supplied initramfs.

[DEF] init/main.c::start_kernel()
  init/main.c:905  void start_kernel(void)

[DEF] init/main.c::kernel_init() — forward declaration + body
  init/main.c:117:static int kernel_init(void *);
  init/main.c:1462:static int __ref kernel_init(void *unused)

[DEF] init/main.c::kernel_init_freeable() — forward declaration + body
  init/main.c:1409:static noinline void __init kernel_init_freeable(void);
  init/main.c:1471:	kernel_init_freeable();
  init/main.c:1566:static noinline void __init kernel_init_freeable(void)

[DEF] init/main.c::run_init_process() — opens and execs a candidate /init
  init/main.c:1380  static int run_init_process(const char *init_filename)

[CALL] run_init_process invocations:
  init/main.c:1380:static int run_init_process(const char *init_filename)
  init/main.c:1395:static int try_to_run_init_process(const char *init_filename)
  init/main.c:1399:	ret = run_init_process(init_filename);
  init/main.c:1509:		ret = run_init_process(ramdisk_execute_command);
  init/main.c:1523:		ret = run_init_process(execute_command);
  init/main.c:1531:		ret = run_init_process(CONFIG_DEFAULT_INIT);
  init/main.c:1539:	if (!try_to_run_init_process("/sbin/init") ||
  init/main.c:1540:	    !try_to_run_init_process("/etc/init") ||
  init/main.c:1541:	    !try_to_run_init_process("/bin/init") ||
  init/main.c:1542:	    !try_to_run_init_process("/bin/sh"))

[CALL] arch_kernel_init_pre_run_init (patches/0004 K5-C2)
  init/main.c:119:void arch_kernel_init_pre_run_init(void);
  init/main.c:1494:	 * arch_kernel_init_pre_run_init - arch-specific hook called
  init/main.c:1504:	arch_kernel_init_pre_run_init();
  init/main.c:1549:void __weak arch_kernel_init_pre_run_init(void) { }

[K6-B] proposed insertion: nothing further in init/main.c.
       run_init_process's existing iteration over /sbin/init,
       /etc/init, /bin/init, /bin/sh is the K6 happy-path entry.

================================================================================
3. init/do_mounts.c — namespace preparation (K6-B D5 site)
================================================================================

Branch entered when init_eaccess(ramdisk_execute_command) fails
(i.e. ramdisk_execute_command isn't executable, the typical case
when initramfs sets up a real /init). Not on K6's happy path
(K6's /init IS executable), but reading it gives K6-B implementers
the picture of the alternate flow.

[DEF] init/do_mounts.c::prepare_namespace()
  init/do_mounts.c:464  void __init prepare_namespace(void)

[CALL] prepare_namespace callers:
  init/do_mounts.c:464:void __init prepare_namespace(void)
  init/main.c:1609:		prepare_namespace();

[DEF] init/do_mounts.c::mount_root() — backing-fs mount helper
  init/do_mounts.c:388  void __init mount_root(char *root_device_name)

================================================================================
4. fs/exec.c — execve flow (K6-B R2 + R7 site)
================================================================================

K6-B's binfmt_wasm.load_wasm_binary plugs into this flow via the
formats list. The site reference snapshot below identifies where
the patch 0005 arch_post_execve hook IS inserted (K6-B2 landed:
bprm_execve success-path tail) — see fs/exec.c hits below.

[DEF] fs/exec.c::open_exec(name)
  fs/exec.c:929  struct file *open_exec(const char *name)

[DEF] fs/exec.c::prepare_binprm(bprm) — pre-reads BINPRM_BUF_SIZE bytes
  fs/exec.c:1682  static int prepare_binprm(struct linux_binprm *bprm)

[DEF] fs/exec.c::begin_new_exec(bprm) — task state replacement
  fs/exec.c:1222  int begin_new_exec(struct linux_binprm * bprm)

[DEF] fs/exec.c::setup_new_exec(bprm) — post-begin_new_exec setup
  fs/exec.c:1427  void setup_new_exec(struct linux_binprm * bprm)

[DEF] fs/exec.c::search_binary_handler(bprm) — iterates formats
  fs/exec.c:1730  static int search_binary_handler(struct linux_binprm *bprm)

[CALL] search_binary_handler — fmt->load_binary callsite within:
  fs/exec.c:1752:		retval = fmt->load_binary(bprm);

[DEF] fs/exec.c::exec_binprm(bprm) — calls search_binary_handler in a loop
  fs/exec.c:1780  static int exec_binprm(struct linux_binprm *bprm)

[DEF] fs/exec.c::bprm_execve(bprm) — owns exec-success/exec-fail teardown
  fs/exec.c:1824  static int bprm_execve(struct linux_binprm *bprm)

[DEF] fs/exec.c::do_execveat_common() — execve entry
  fs/exec.c:549:	 * See do_execveat_common().
  fs/exec.c:1880:static int do_execveat_common(int fd, struct filename *filename,
  fs/exec.c:2030:	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
  fs/exec.c:2041:	return do_execveat_common(fd, filename, argv, envp, flags);
  fs/exec.c:2057:	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
  fs/exec.c:2073:	return do_execveat_common(fd, filename, argv, envp, flags);

[NOTE] §6 of the opener doc named this 'do_execve_common';
       upstream v6.12 spelling is 'do_execveat_common'. The
       opener doc should be amended on the next refresh (this
       file pins the actual upstream name).

[K6-B R7] proposed insertion site for arch_post_execve(bprm):
       fs/exec.c::bprm_execve, right after exec_binprm() returns
       success (line ~1850, between 'sched_mm_cid_after_execve'
       and 'current->fs->in_exec = 0'). Patch 0005 adds the
       weak default in this file; arch/wasm32/kernel/init.c
       provides the strong override.

================================================================================
5. fs/kernel_read_file.c — kernel_read_file (K6-B R2 site)
================================================================================

The function K6-B's binfmt_wasm.load_wasm_binary uses to slurp
the entire /init file into a kmalloc'd buffer for parser + spawn
ring submission. Earlier upstream versions had it inside
fs/exec.c; v6.12 has its own file.

[DEF] fs/kernel_read_file.c::kernel_read_file(file, ...)
  fs/kernel_read_file.c:35  ssize_t kernel_read_file(struct file *file, loff_t offset, void **buf,

[DEF] fs/kernel_read_file.c sibling helpers (callable variants)
  fs/kernel_read_file.c:35:ssize_t kernel_read_file(struct file *file, loff_t offset, void **buf,
  fs/kernel_read_file.c:127:ssize_t kernel_read_file_from_path(const char *path, loff_t offset, void **buf,
  fs/kernel_read_file.c:147:ssize_t kernel_read_file_from_path_initns(const char *path, loff_t offset,
  fs/kernel_read_file.c:174:ssize_t kernel_read_file_from_fd(int fd, loff_t offset, void **buf,

[CALL] kernel_read_file existing in-tree callers (sample):
  kernel/kexec_file.c:201:	ret = kernel_read_file_from_fd(kernel_fd, 0, &image->kernel_buf,
  kernel/kexec_file.c:224:		ret = kernel_read_file_from_fd(initrd_fd, 0, &image->initrd_buf,
  kernel/module/main.c:3179:	len = kernel_read_file(f, 0, &buf, INT_MAX, NULL, READING_MODULE);
  kernel/module/stats.c:37: *   a) memory allocated with kernel_read_file_from_fd()
  kernel/module/stats.c:39: *      kernel_read_file_from_fd(), and vmap() is used to map
  kernel/module/stats.c:42: *      from kernel_read_file_from_fd() is freed right away.
  kernel/module/stats.c:72: *   1) kernel_read_file_from_fd() call uses vmalloc()
  kernel/module/stats.c:121: *     happen due to the initial kernel_read_file_from_fd(). kernel_read_file_from_fd()

================================================================================
6. fs/binfmt_elf.c — shape template (K6-B R2 reference)
================================================================================

NOT depended upon at runtime (CONFIG_BINFMT_ELF=n on wasm32);
read at K6-B-time as the shape template for the binfmt_wasm
load_binary path. The §4 R2 path in the opener doc enumerates
the upstream steps; the lines below give precise sites.

[DEF] fs/binfmt_elf.c::load_elf_binary(bprm)
  fs/binfmt_elf.c:819  static int load_elf_binary(struct linux_binprm *bprm)

[NOTE] read fs/binfmt_elf.c lines ~700-900 at K6-B start to
       refresh the shape-template understanding before
       binfmt_wasm.load_wasm_binary's read-file path lands.

================================================================================
7. arch/wasm32 surface already in place (K5 + K6-A1 reference)
================================================================================

Arch hooks and weak overrides the K-series has landed so far,
listed for K6-B implementers who need to see how the wasm32 port
hooks into upstream.

[DEF] arch/wasm32/kernel/init.c::arch_kernel_init_pre_run_init() — K5-C2 strong override
  arch/wasm32/include/asm/boot.h:80:					 * arch_kernel_init_pre_run_init
  arch/wasm32/kernel/binfmt_wasm.c:28: *     fallback path (arch_kernel_init_pre_run_init dispatching
  arch/wasm32/kernel/builtin_init_image.h:10: * The wasm32 arch_kernel_init_pre_run_init override (in
  arch/wasm32/kernel/init.c:4: * arch_kernel_init_pre_run_init.
  arch/wasm32/kernel/init.c:14: * arch_kernel_init_pre_run_init hook.
  arch/wasm32/kernel/init.c:22: *   3. kernel_init calls arch_kernel_init_pre_run_init() — this
  arch/wasm32/kernel/init.c:35: *   6. On failure, we return from arch_kernel_init_pre_run_init.
  arch/wasm32/kernel/init.c:48: * arch_kernel_init_pre_run_init hook itself stays — it's the
  arch/wasm32/kernel/init.c:166: * arch_kernel_init_pre_run_init — wasm32 override.
  arch/wasm32/kernel/init.c:169: * patches/0004-init-add-arch_kernel_init_pre_run_init-hook.patch)
  arch/wasm32/kernel/init.c:197: * Runs at arch_kernel_init_pre_run_init time, which is inside
  arch/wasm32/kernel/init.c:223:void arch_kernel_init_pre_run_init(void)
  arch/wasm32/kernel/init.c:321:	 * That check runs BEFORE arch_kernel_init_pre_run_init,
  arch/wasm32/kernel/init.c:335:	 * arch_kernel_init_pre_run_init taking the relevant action
  arch/wasm32/kernel/k6_a1_probes.c:28: * present, arch_kernel_init_pre_run_init() in init.c dispatches to
  arch/wasm32/kernel/k6_b1_probes.c:15: * initrd_start..initrd_end. By the time arch_kernel_init_pre_run_init
  arch/wasm32/kernel/k6_b2_probes.c:63: * mirrors the patch 0004 convention for arch_kernel_init_pre_run_init.
  arch/wasm32/kernel/setup.c:183:	 * arch_kernel_init_pre_run_init fallback), or both are
  arch/wasm32/kernel/setup.c:435:	 * boot then falls through to arch_kernel_init_pre_run_init's
  arch/wasm32/kernel/setup.c:463:		pr_info("wasm32: no initrd supplied (initrd_size=0); kernel_init will fall through to arch_kernel_init_pre_run_init\n");

[DEF] arch/wasm32/kernel/binfmt_wasm.c — current K5-B3 stub state
  arch/wasm32/kernel/binfmt_wasm.c:67:long wasm32_exec_image(const u8 *image, size_t size, const char *name);
  arch/wasm32/kernel/binfmt_wasm.c:158:static int load_wasm_binary(struct linux_binprm *bprm)
  arch/wasm32/kernel/binfmt_wasm.c:334:long wasm32_exec_image(const u8 *image, size_t size, const char *name)

[DEF] arch/wasm32/kernel/spawn.c::wasm32_spawn_ring + host_spawn_process_worker — K5-B2
  arch/wasm32/kernel/spawn.c:87:struct wasm_spawn_request_ring wasm32_spawn_ring __attribute__((aligned(8))) = {
  arch/wasm32/kernel/spawn.c:199:long host_spawn_process_worker(struct wasm_spawn_request *req)

[DEF] arch/wasm32/kernel/k6_a1_probes.c::wasm32_run_k6_a1_probes — K6-A1
  arch/wasm32/kernel/k6_a1_probes.c:29: * wasm32_run_k6_a1_probes() (this file) INSTEAD of the K5-C2
  arch/wasm32/kernel/k6_a1_probes.c:152:void __init wasm32_run_k6_a1_probes(void)

================================================================================
8. ABI bumps planned at K6-B (forward reference)
================================================================================

Annotations only — these are not present in any upstream file
yet; they describe the K6-B1 plumbing changes the next sub-phase
will land.

  [K6-B1] wasm_boot_info v1 → v2 (rootfs-model.rst §15):
          add initrd_offset + initrd_size, shrink reserved[6]
          to reserved[4]. C struct in
          arch/wasm32/include/asm/boot.h, JS mirror in
          hardwarejs/src/kernelWorker.mjs's wasm_boot_info
          construction block (currently lines 240-258).

  [K6-B3] arch/wasm32/kernel/setup.c reads boot_info.initrd_offset
          and boot_info.initrd_size, sets the global
          initrd_start = (unsigned long)kernel_memory_base +
          initrd_offset, initrd_end = initrd_start + initrd_size.

  [K6-B2] patches/0005-fs-add-arch_post_execve-hook.patch adds
          weak void arch_post_execve(struct linux_binprm *bprm)
          to fs/exec.c right before do_execveat_common, calls it
          from bprm_execve after exec_binprm returns success.

================================================================================
END OF SNAPSHOT
================================================================================