title: Why does the kretprobe of the _do_fork() only return once?
body: <p>When I write a small script with fork, the syscall returns twice processes (once per process):</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;unistd.h&gt;
  
  int main(int argc, char *argv[]) {
      int pid = fork();
  
      if (pid == 0) {
          // child
      } else if (pid &gt; 0) {
          // parent
      }
  }
  </code></pre>
  
  <p>If I instrument that with systemtap, I only find one return value:</p>
  
  <pre><code>// fork() in libc calls clone on Linux
  probe syscall.clone.return {
      printf("Return from clone\n")
  }
  </code></pre>
  
  <p>(<a href="https://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=blob;f=tapset/linux/sysc_clone.stp" rel="nofollow noreferrer">SystemTap installes probes on <code>_do_fork</code></a> instead of clone, but that shouldn't change anything.)</p>
  
  <p>This confuses me. A couple of related questions:</p>
  
  <ul>
  <li>Why does the syscall only return once?</li>
  <li>If I understand the <a href="http://lxr.free-electrons.com/source/kernel/fork.c#L1913" rel="nofollow noreferrer"><code>_do_fork</code> code</a> correctly, the process is cloned in the middle of the function. (<code>copy_process</code> and <code>wake_up_new_task</code>). Shouldn't the subsequent code run in both processes?</li>
  <li>Does the kernel code after a syscall run in the same thread / process as the user code before the syscall?</li>
  </ul>