Messages in this thread | | | Date | Fri, 15 Feb 2008 20:42:28 +0200 | Subject | Linux i386 clone(): %ebx 'frobbing' ? | From | "Ahmed S. Darwish" <> |
| |
Hi all,
In the clone(int (*fn)(void *arg), void *child_stack, ..., void *arg, ...) Glibc library function defind in sysdeps/unix/sysv/linux/i386/:
`fn' is saved in 8(child_stack), and `arg' is stored in 12(child_stack):
movl STACK(%esp),%ecx movl ARG(%esp),%eax /* no negative argument counts */ movl %eax,12(%ecx) <---
/* Save the function pointer as the zeroth argument. It will be popped off in the child in the ebx frobbing below. */ movl FUNC(%esp),%eax movl %eax,8(%ecx) <---
But after the exectuion of `sys_clone' system call, `fn' is called in the child thread by the statement 'call *%ebx' as follows:
int $0x80 [...]
test %eax,%eax jz L(thread_start)
/* Parent */ L(pseudo_end): ret
/* Child */ L(thread_start): /* Note: %esi is zero. */ movl %esi,%ebp /* terminate the stack frame */ call *%ebx
I don't understand how the `fn' argument reached the child thread in the %ebx register. It's said in the comment that `fn' will be popped to child 'in the ebx frobbing below'. But what does that mean ?
Thanks in advance
-- Ahmed S. Darwish Homepage: http://darwish.07.googlepages.com Blog: http://darwish-07.blogspot.com
| |