c - Why does the kretprobe of the _do_fork() only return once? -

when write small script fork, syscall returns twice processes (once per process):

#include <stdio.h> #include <unistd.h>  int main(int argc, char *argv[]) {     int pid = fork();      if (pid == 0) {         // child     } else if (pid > 0) {         // parent     } } 

if instrument systemtap, find 1 return value:

// fork() in libc calls clone on linux probe syscall.clone.return {     printf("return clone\n") } 

(systemtap installes probes on _do_fork instead of clone, shouldn't change anything.)

this confuses me. couple of related questions:

• why syscall return once?
• if understand _do_fork code correctly, process cloned in middle of function. (copy_process , wake_up_new_task). shouldn't subsequent code run in both processes?
• does kernel code after syscall run in same thread / process user code before syscall?

1. creation of child can fail, errors have detected , handled
2. the child has different return value , has handled
3. it may parent has clean ups / additional actions do

thus code have differentiate between executing parent , child. there no checks of sort, strong hint child not execute code in first place. 1 should dedicated place new children return to.

since code quite big , hairy, 1 can try cheat , 'fork' in arch-specific code, reveals ret_from_fork.

it set starting point -> do_fork -> copy_process -> copy_thread_tls http://lxr.free-electrons.com/source/arch/x86/kernel/process_64.c#l158

thus

why syscall return once?

it not return once. there 2 returning threads, except other 1 uses different code path. since probe installed on first one, don't see other one. see below.

if understand _do_fork code correctly, process cloned in middle of function. (copy_process , wake_up_new_task). shouldn't subsequent code run in both processes?

i noted earlier false. real question benefit of making child return in same place parent. don't see , troublesome (extra special casing, noted above). re-state: making child return elsehwere lets callers not have handle returning child. need check errors.

does kernel code after syscall run in same thread / process user code before syscall?

what 'kernel code after syscall'? if thread x , enter kernel, still thread x.