Linux Process Creation : User mode stack

fork() duplicates the entire memory map allocated to the forking processes (the parent). It creates an identical process which then proceeds independently of the parent process.

The two start with identical heap and stack. The x86 register pointing to the current stack position points to the same memory address for both the parent and the child processes (since their memory map is identical).

1. Usually, a program get a new user mode stack when you call exec() or create a new tread. If you want to do this manually, use the mmap() syscall. Note: a process can have multiple stack (green threads or signal stack).

2. When you make a syscall, your register are saved -- this include the stack address.

3. Most of the kernel function cannot access the user mode stack directly. But, of course, being in ring-0, the kernel can adjust the permission and assess it when it want to. In an unmodified kernel, this is restricted to a few selected function. (search copy_to_user and copy_from_user in your kernel source)

My answers are:

1. The entire virtual memory is duplicated for the new process, including any stacks. The kernel treats it no differently than any other pages
2. The kernel doesn't need to know where the user-mode stack is to achieve this, it just duplicates the whole address space.
3. It does not need to access the user-mode stack to do this.

The only difference is the return value that the kernel gives to the parent and child.

When the fork() system call returns, it will go back to the same address in the parent and child but with a different return value (child always gets 0, parent gets child's pid). As they each have their own copy (it would be copy-on-write, but will get written to very soon) of the stack, this is no problem.