2

I made a system call and recompiled the kernel, however upon running the system call it returned Killed. So, to trace it, I used strace, which shows the following message: syscall_0x224(0x7ffda7199738, 0x7ffda7199748, 0x55743750a6d0, 0x7f9f20df7d80, 0x7f9f20df7d80, 0x7ffda7199730) = ?

What does this mean (not the hex, the question mark)?

2 Answers 2

5

It means that the system call was terminated, and didn't (couldn't) return a value. An example is given in the strace manual:

Interruption of a (restartable) system call by a signal delivery is
processed differently as kernel terminates the system call and also
arranges its immediate reexecution after the signal handler
completes.

   read(0, 0x7ffff72cf5cf, 1)     = ? ERESTARTSYS (To be restarted)

It seems, like your system call, read here was terminated, and has no return value. (Unlike your system call, read here was scheduled for re-execution.)

Other system calls, which don't return (e.g., exit_group), also show ?:

~ strace -e exit_group /bin/true
exit_group(0)                           = ?
+++ exited with 0 +++
3

This means that your strace doesn't know about syscall_0x224 (neither do I [1]), and doesn't know what kind of value returns and how to decode it.

You can have a look at the source here:

        if (sys_res & RVAL_NONE)
                tprints("= ?");

If you have compiled some module that adds another system call, do not expect strace to magically know about it.

[1] I wasn't able to find any syscall with nr = 0x224 / 548 (the x32 pwritev2 is the last = 547).

1
  • 3
    They said they "made a system call", so that's probably why no-one has heard about it :)
    – ilkkachu
    Jun 27, 2019 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .