ptrace_report_syscall_exit(9)

✨ NAME ✨

okay bestie, this page is ptrace_report_syscall_exit(9) from the Kernel API Manual — it's literally about the exact moment a task has just finished a system call. 💅

ptrace_report_syscall_exit — task has just finished a system call. periodt. 💖

🌸 SYNOPSIS 🌸

the whole signature, no cap:

void ptrace_report_syscall_exit (struct pt_regs *regs , int step );

🎀 ARGUMENTS 🎀

• regs — user register state of current task. like, the current task's whole register situation 🫶
• step — nonzero if simulating single-step or block-step. iykyk ⭐

💜 DESCRIPTION 💜

okay so This will be called if SYSCALL_WORK_SYSCALL_TRACE has been set, when the current task has just finished an attempted system call. Full user register state is available here — yes, all of it, bestie. ✨

It is safe to block here, preventing signals from being processed. that's a big deal, okay? 💅

If step is nonzero, this report is also in lieu of the normal trap that would follow the system call instruction because user_enable_block_step or user_enable_single_step was used. In this case, SYSCALL_WORK_SYSCALL_TRACE might not be set. 👀 noted.

Called without locks, just before checking for pending signals. that's the timing, no cap. 🎀

🌈 SEE ALSO 🌈

Kernel file ./include/linux/ptrace.h is right there, and the whole squad is:

• ptrace_may_access(9)
• ptrace_parent(9)
• ptrace_event_enabled(9)
• ptrace_event(9)
• ptrace_event_pid(9)
• ptrace_init_task(9)
• ptrace_release_task(9)
• arch_has_single_step(9)
• user_enable_single_step(9)
• user_disable_single_step(9)
• arch_has_block_step(9)
• user_enable_block_step(9)
• arch_ptrace_stop_needed(9)
• arch_ptrace_stop(9)
• ptrace_report_syscall_permit_entry(9)

source/version: ./include/linux · date: October 2026 · mwah, bye bestie 💖🦋✨