clone3

Partial in Antinomie 0.7.0 · Syscall list

Synopsis

long clone3(struct clone_args *uargs, size_t size);

Number (x86-64)	435
ABI	common
Kernel entry point	sys_clone3

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Creates a new thread or process like clone, with the arguments in an extensible structure.

Arguments

Name	Type	Meaning
uargs (arg0)	struct clone_args *	Pointer to a struct clone_args with the flags, stack, tid pointers and pidfd pointer.
size (arg1)	size_t	Size of that structure.

Return value

On success: the child’s thread id in the parent, 0 in the child.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-7	E2BIG	An argument list or structure is too large.
-22	EINVAL	An argument is invalid.
-11	EAGAIN	The call would block, or a resource is temporarily unavailable.

Man page

clone3(2) on man7.org

Captured by Antinomie

Coverage mark: Partial. The child tid words written for CLONE_CHILD_SETTID/CLONE_CHILD_CLEARTID are recorded with the “not observed asynchronously” status.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
uargs (arg0)	Entry	the pointer itself, as a raw word	args.0, args.raw[0]
↳ pointee	Entry	structure clone_args, size from size (arg1), versioned: bytes beyond the known size go to arg0.clone_args.extension	arg0.clone_args	always
↳ pointee	Entry	array of pid_t, count from set_tid_size in the structure, at most 32	arg0.clone_args.set_tid	set_tid or set_tid_size is non-zero
↳ pointee	Exit	int the kernel wrote	arg0.clone_args.pidfd	result is greater than 0 and CLONE_PIDFD is set
↳ pointee	Exit	pid_t the kernel wrote	arg0.clone_args.parent_tid	result is greater than 0 and CLONE_PARENT_SETTID is set
↳ pointee	Exit	4 bytes, status “not observed asynchronously”	arg0.clone_args.child_tid	result is greater than 0 and CLONE_CHILD_SETTID is set
↳ pointee	Exit	4 bytes, status “not observed asynchronously”	arg0.clone_args.clear_child_tid	result is greater than 0 and CLONE_CHILD_CLEARTID is set
size (arg1)	Entry	raw scalar word	args.1, args.size

Derived and lifecycle records

• A lifecycle.child_cookie, lifecycle.child_pid, lifecycle.child_tgid and lifecycle.child_start_boot_ns record is emitted for the new task when the kernel creates it (this is how Antinomie builds the process tree).

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.uargs (arg0), args.size (arg1); args.0 to args.5 by position.
• Structure clone_args behind uargs (arg0): args.uargs.<member> for cgroup, child_tid, exit_signal, flags, parent_tid, pidfd, set_tid, set_tid_size, stack, stack_size, tls.

See Syscall Trace filter for the full syntax.

Known gaps

• See the coverage mark above for the code paths that record a gap.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.