I made a system call and recompiled the kernel, however upon running the system call it returned Killed. So, to trace it, I used strace, which shows the following message: syscall_0x224(0x7ffda7199738, 0x7ffda7199748, 0x55743750a6d0, 0x7f9f20df7d80, 0x7f9f20df7d80, 0x7ffda7199730) = ?

What does this mean (not the hex, the question mark)?


It means that the system call was terminated, and didn't (couldn't) return a value. An example is given in the strace manual:

Interruption of a (restartable) system call by a signal delivery is
processed differently as kernel terminates the system call and also
arranges its immediate reexecution after the signal handler

   read(0, 0x7ffff72cf5cf, 1)     = ? ERESTARTSYS (To be restarted)

It seems, like your system call, read here was terminated, and has no return value. (Unlike your system call, read here was scheduled for re-execution.)

Other system calls, which don't return (e.g., exit_group), also show ?:

~ strace -e exit_group /bin/true
exit_group(0)                           = ?
+++ exited with 0 +++

This means that your strace doesn't know about syscall_0x224 (neither do I [1]), and doesn't know what kind of value returns and how to decode it.

You can have a look at the source here:

        if (sys_res & RVAL_NONE)
                tprints("= ?");

If you have compiled some module that adds another system call, do not expect strace to magically know about it.

[1] I wasn't able to find any syscall with nr = 0x224 / 548 (the x32 pwritev2 is the last = 547).

  • 2
    They said they "made a system call", so that's probably why no-one has heard about it :) – ilkkachu Jun 27 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.