Le Sun, 17 Aug 2008 21:44:40 -0400, "Sri Ram K Vemulpali" <vsriramksh@xxxxxxxxx> a écrit : > But when in the process of creation of new process (thread) fork is > called which creates only kernel level process, but how about user > level process. It's not clear what you mean by « user level process » and « kernel level process ». In the Linux kernel, a "struct task_struct" exists for every thread in the system. Most of these threads belong to a given address space: these are the normal userspace threads everybody is used to see. Some of these threads do not belong to a particular address space: these are the kernel threads. As you said, the normal userspace threads have a userspace stack, used when userspace code is executed, and a kernel stack, used when kernel code is executed. When a new thread is created inside a new address space using fork(), a new task_struct is created, with a new kernel stack. This new thread will start its execution in kernel mode, using its kernel stack. This thread is executing the fork() system call, as is its father. When the fork() system call returns in the child thread, then it returns in userspace to execute userspace code using the userspace stack. This stack is shared between the father and the child, but because it has been made read-only during the fork(), every write access to the stack will trigger a page fault, that the kernel will handle in order to create a new version of the part of the stack that is being used. Does that clarify your question ? Thomas -- Thomas Petazzoni, Free Electrons Kernel, drivers and embedded Linux development, consulting, training and support. http://free-electrons.com -- To unsubscribe from this list: send an email with "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx Please read the FAQ at http://kernelnewbies.org/FAQ