title: What happens internally when `ls *.c` is executed?
body: <p>I've got very interested in Linux internals recently, and currently trying to understand how things work.</p>
  
  <p>I knew that when I type <code>ls</code></p>
  
  <ul>
  <li><code>opendir()</code> - function is called;</li>
  <li><code>readdir()</code> - function called for each directory entry in directory data store;</li>
  <li><code>stat()</code> - function can be called to get additional information on files, if required.</li>
  </ul>
  
  <p>Please correct me if I'm missing something or if it's wrong.</p>
  
  <p>The part which is mystery to me is filename expansion(globbing).</p>
  
  <p>I've compared the output of <code>strace ls</code></p>
  
  <pre><code>open(".", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
  fstat(3, {st_mode=S_IFDIR|0755, st_size=270336, ...}) = 0
  getdents(3, /* 14 entries */, 32768)    = 440
  getdents(3, /* 0 entries */, 32768)     = 0
  close(3)                                = 0
  fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0
  write(1, "2q.c  ds.c  fglob  fnoglob\n", 272q.c  ds.c  fglob  fnoglob
  </code></pre>
  
  <p>and <code>strace ls *.c</code>, </p>
  
  <pre><code>stat("2q.c", {st_mode=S_IFREG|0664, st_size=0, ...}) = 0
  lstat("2q.c", {st_mode=S_IFREG|0664, st_size=0, ...}) = 0
  stat("ds.c", {st_mode=S_IFREG|0664, st_size=0, ...}) = 0
  lstat("ds.c", {st_mode=S_IFREG|0664, st_size=0, ...}) = 0
  fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
  write(1, "2q.c  ds.c\n", 112q.c  ds.c
  )            = 11
  </code></pre>
  
  <p>and from my limited knowledge can tell that in the first case, it indeed behaves as I expected <code>open, stat</code> followed by <code>getdents</code>.</p>
  
  <p>But the later one, with shell globbing isn't clear to me, because it there's already a list of files, which match the pattern. Where does this list came from?</p>
  
  <p>Thanks!</p>