For questions like this, always read the source code.
From glibc's nptl/sysdeps/unix/sysv/linux/fork.c
(GitHub) (nptl
= native Posix threads for Linux) we can find the implementation of fork()
, which is definitely not a syscall, we can see that the magic happens inside the ARCH_FORK
macro, which is defined as an inline call to clone()
in nptl/sysdeps/unix/sysv/linux/x86_64/fork.c
(GitHub). But wait, no function or stack pointer is passed to this version of clone()
! So, what is going on here?
Let's look at the implementation of clone()
in glibc, then. It's in sysdeps/unix/sysv/linux/x86_64/clone.S
(GitHub). You can see that what it does is it saves the function pointer on the child's stack, calls the clone syscall, and then the new process will read pop the function off the stack and then call it.
So it works like this:
clone(void (*fn)(void *), void *stack_pointer)
{
push fn onto stack_pointer
syscall_clone()
if (child) {
pop fn off of stack
fn();
exit();
}
}
And fork()
is...
fork()
{
...
syscall_clone();
...
}
Summary
The actual clone()
syscall does not take a function argument, it just continues from the return point, just like fork()
. So both the clone()
and fork()
library functions are wrappers around the clone()
syscall.
Documentation
My copy of the manual is somewhat more upfront about the fact that clone()
is both a library function and a system call. However, I do find it somewhat misleading that clone()
is found in section 2, rather than both section 2 and section 3. From the man page:
#include <sched.h>
int clone(int (*fn)(void *), void *child_stack,
int flags, void *arg, ...
/* pid_t *ptid, struct user_desc *tls, pid_t *ctid */ );
/* Prototype for the raw system call */
long clone(unsigned long flags, void *child_stack,
void *ptid, void *ctid,
struct pt_regs *regs);
And,
This page describes both the glibc clone()
wrapper function and the
underlying system call on which it is based. The main text describes
the wrapper function; the differences for the raw system call are
described toward the end of this page.
Finally,
The raw clone()
system call corresponds more closely to fork(2)
in that
execution in the child continues from the point of the call. As such,
the fn and arg arguments of the clone()
wrapper function are omitted.
Furthermore, the argument order changes.
clone
documentation, the same as the page you link to from the “syntax” text. Perhaps you meant to link to thefork
documentation. That documentation says thatfork
callsclone
with flags set toSIGCHLD
. Presumably that tellsclone
to change its regular behavior and continue execution as a return from the call rather than calling a new routine. I would question whetherSIGCHLD
is correct; I would expect something more likeCLONE_CHILD
.clone()
uses function address (passed through say,pthread_create()
) when creating a thread and while creating process, it directly uses the return address from stack.call
, it automatically pushes to the stack the address of the instruction right after it. When the function you are calling perform aret
, it automatically pop this address back and jumps to it, so everything continues flowing. So when you callfork()
, the address of the instruction where it should continue executing after this call is already in the stack by default, you only have to read and use it.