How Linux Init Switches from Kernel to User Mode: Inside kernel_execve

In Linux, the init process (pid = 1) is the first user‑space program created by the kernel after the idle process (pid = 0). It is spawned by kernel_thread in kernel mode and then execs /sbin/init in user space.

The kernel can launch user‑space programs from kernel space via two mechanisms:

1. call_usermodehelper 2. kernel_execve

Both ultimately invoke a software interrupt int $0x80, which triggers the sys_execve system call. The article investigates whether the program executed by this system call runs in kernel mode or user mode, and how the CPU’s CS register changes from __KERNEL_CS to __USER_CS.

During boot, start_kernel calls rest_init, which creates a kernel thread that runs kernel_init. kernel_init eventually calls run_init_process, whose core operation is kernel_execve:

The implementation contains inline assembly; the essential instruction is int $0x80, which places the syscall number __NR_execve in AX and the program path in BX.

The interrupt transfers control to the system_call assembly routine:

system_call

saves registers, builds a struct pt_regs stack frame, and finally calls the C function sys_execve via the system‑call table:

sys_execve

(shown below) delegates to do_execve, which calls do_execve_common to load the ELF binary, locate its entry point, and set up a new user‑space stack.

The ELF loader eventually calls start_thread, which modifies regs->cs to __USER_CS (0x33 on x86‑64) and regs->ip to the program’s entry address:

When the interrupt returns via iret, the CPU pops the saved CS and IP from the stack, now containing __USER_CS and the ELF entry point, so execution resumes in user mode.

To verify this, the author used call_usermodehelper to run a small program that prints the CS register. After inserting a USB drive, the syslog showed:

Mar 10 14:20:23 build-server main: ucs = 0x33

Thus the first kernel process (pid = 1) indeed switches to user mode by changing CS from __KERNEL_CS to __USER_CS during the iret return.