I did not tried the glibc approach. But to answer how the specific transition from fork() to sys_fork() (in kernel) is made: In /lib/libc.so.6: objdump -t libc.so.6 | grep fork show that fork() API is implemented inside this file. Then objdump -d to disassemble the file, and search for fork: 44153710 <__fork>: 44153710: 55 push %ebp 44153711: 89 e5 mov %esp,%ebp 44153713: 57 push %edi 44153714: 56 push %esi 44153715: 53 push %ebx 44153937: b8 f0 00 00 00 mov $0xf0,%eax ========> for sys_fork(). 4415393c: 89 f7 mov %esi,%edi 4415393e: 87 fb xchg %edi,%ebx 44153940: cd 80 int $0x80 ====> transition to kernel. Inside the above jungle is a "int 0x80" which will make the transition to ring0. And at ring0, sys_fork() is registered as 0xf0. In kernel it will call do_fork(): asmlinkage int sys_fork(struct pt_regs regs) { return do_fork(SIGCHLD, regs.sp, ®s, 0, NULL, NULL); } Alternatively, use gdb, bp on fork, and step through till u get to the int 0x80. For the glibc approach, glibc is JUST ONE path into sys_fork(), there are POSIX fork, then there is pthread fork()....many path at the userspace level which can end up in the same kernel syscall. Sorry....i am also not sure if glibc's fork() is the same as POSIX fork()......google's codesearch utility shows too much sources calling fork(). Use that tool. On Tue, Apr 22, 2008 at 3:20 AM, Robert P. J. Day <rpjday@xxxxxxxxxxxxxx> wrote: > > in robert love's "linux kernel development" book (p. 31), i read: > > "The fork(), vfork() and __clone() library calls all invoke the > clone() system call with the requisite flags." assuming that, > nowadays, it would be __clone2() and not __clone(), where in the > source for glibc-2.7 could i see the implementation of those calls? > > if i just look in the glibc source tree for files with the name > fork*, i get: > > ./nptl/sysdeps/unix/sysv/linux/s390/fork.c > ./nptl/sysdeps/unix/sysv/linux/fork.h > ./nptl/sysdeps/unix/sysv/linux/ia64/fork.c > ./nptl/sysdeps/unix/sysv/linux/i386/fork.c > ./nptl/sysdeps/unix/sysv/linux/x86_64/fork.c > ./nptl/sysdeps/unix/sysv/linux/alpha/fork.c > ./nptl/sysdeps/unix/sysv/linux/sh/fork.c > ./nptl/sysdeps/unix/sysv/linux/powerpc/fork.c > ./nptl/sysdeps/unix/sysv/linux/sparc/fork.c > ./nptl/sysdeps/unix/sysv/linux/fork.c > ./sysdeps/mach/hurd/fork.c > ./sysdeps/generic/fork.h > ./sysdeps/unix/sysv/linux/ia64/fork.S > ./sysdeps/unix/sysv/linux/sparc/fork.S > ./sysdeps/unix/i386/fork.S > ./sysdeps/unix/fork.S > ./sysdeps/unix/sparc/fork.S > ./posix/fork.c > ./login/forkpty.c > > so how would i follow the logic from the initial call to fork() to > the underlying sys_clone system call? or am i looking in the wrong > place? > > rday > -- > > ======================================================================== > Robert P. J. Day > Linux Consulting, Training and Annoying Kernel Pedantry: > Have classroom, will lecture. > > http://crashcourse.ca Waterloo, Ontario, CANADA > ======================================================================== > > -- > To unsubscribe from this list: send an email with > "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx > Please read the FAQ at http://kernelnewbies.org/FAQ > > -- Regards, Peter Teoh -- To unsubscribe from this list: send an email with "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx Please read the FAQ at http://kernelnewbies.org/FAQ