[Post] How does the INIT process switch from the kernel state to the user State?

From: http://www.chinaitpower.com/2005September/2005-09-13/205764.html

========================================================== ======
Everyone knows how to create a new process.
Use sys_fork and then call sys_execve
The first user-state process after the system starts (core State) is init.
This involves the transfer from the inner layer (high privilege level) to the outer layer (low privilege level.
In general, the kernel does not call user-Layer Code. To implement this reverse transfer, the general approach is to go to the Core stack of the user process (TSS-> esp0) the SS, ESP, eflags, Cs, and EIP pushed into the user State are disguised as user processes entering the core State through the trap gate, and then return the user State through iret.
In Linux 2.2.14, how does one implement the user-state process init?

First, in the kernel_thread (init...) function,
Use the system to call sys_clone fork to generate a kernel-level process (in this case, the process must be assigned a core stack <-esp0), then call the init function, the init function will start several more kernel_thread, then/sbin/init will be loaded (called through execve)
In sys_execve, the kernel state must be transferred to the user State.
The general process is sys_execve --> do_execve --> load_elf_binary ()
--> Do_load_elf_binary () --> do_mmap ()
Start_thread (Reg, newip, newsp) (processor. h)
It is important to pay attention to do_mmap () and start_thread ().
Do_mmap maps the virtual space from the file to the memory.
Start_thread is to fill in the XSS, ESP, XCS, and EIP of the Process User State in the corresponding position in the Process core stack.
Finally, the process returns from ret_from_sys_call, And the iret command pops out XCS from the core stack. The EIP completes the transfer of privileges and commands, and pops out XSS and ESP to complete stack switching.

I have just read the code above. If there is something wrong with it, I hope you can point it out.

Richard hesidu replied to: 04:15:33

In some cases, a new process is generally called through the sys_clone () system instead of sys_fork ().

Initx replied to: 08:53:00

[Quote: e9abe4c9f8 = "Richard dhesidu"] a new process is generally called through the sys_clone () system instead of sys_fork (). [/quote: e9abe4c9f8] Nonsense Fork () is used to generate sub-processes ~! Is it the process of applying for a memory address space to create a new process?

Richard hesidu replied to: 09:23:13

I don't know what you are talking about. Fork () is implemented through sys_clone (), rather than sys_fork ().