2

I made a system call and recompiled the kernel, however upon running the system call it returned Killed. So, to trace it, I used strace, which shows the following message: syscall_0x224(0x7ffda7199738, 0x7ffda7199748, 0x55743750a6d0, 0x7f9f20df7d80, 0x7f9f20df7d80, 0x7ffda7199730) = ?

What does this mean (not the hex, the question mark)?

2 Answers 2

5

It means that the system call was terminated, and didn't (couldn't) return a value. An example is given in the strace manual:

Interruption of a (restartable) system call by a signal delivery is
processed differently as kernel terminates the system call and also
arranges its immediate reexecution after the signal handler
completes.

   read(0, 0x7ffff72cf5cf, 1)     = ? ERESTARTSYS (To be restarted)

It seems, like your system call, read here was terminated, and has no return value. (Unlike your system call, read here was scheduled for re-execution.)

Other system calls, which don't return (e.g., exit_group), also show ?:

~ strace -e exit_group /bin/true
exit_group(0)                           = ?
+++ exited with 0 +++
3

This means that your strace doesn't know about syscall_0x224 (neither do I [1]), and doesn't know what kind of value returns and how to decode it.

You can have a look at the source here:

        if (sys_res & RVAL_NONE)
                tprints("= ?");

If you have compiled some module that adds another system call, do not expect strace to magically know about it.

[1] I wasn't able to find any syscall with nr = 0x224 / 548 (the x32 pwritev2 is the last = 547).

1
  • 3
    They said they "made a system call", so that's probably why no-one has heard about it :) Commented Jun 27, 2019 at 17:12

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.