process_vm_writev
Partial in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long process_vm_writev(pid_t pid, const struct iovec *lvec, unsigned long liovcnt, const struct iovec *rvec, unsigned long riovcnt, unsigned long flags);| Number (x86-64) | 311 |
| ABI | 64 |
| Kernel entry point | sys_process_vm_writev |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Copies memory from this process into another one, without ptrace stops.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
pid (arg0) |
pid_t |
Process or thread id. |
lvec (arg1) |
const struct iovec * |
Local iovec array. |
liovcnt (arg2) |
unsigned long |
Number of local iovec entries. |
rvec (arg3) |
const struct iovec * |
Remote iovec array, addresses in the other process. |
riovcnt (arg4) |
unsigned long |
Number of remote iovec entries. |
flags (arg5) |
unsigned long |
Option flags that change the behavior of the call. |
Return value
Section titled “Return value”On success: The number of bytes transferred (see the description for what 0 means).
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-14 |
EFAULT |
A pointer argument points outside the accessible address space. |
-1 |
EPERM |
The operation is not permitted for this process. |
-3 |
ESRCH |
No such process or thread. |
Man page
Section titled “Man page”process_vm_writev(2) on man7.org
Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Partial. The remote vector (addresses in the other process) is recorded as “address only”; the other process’s memory is never read.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
pid (arg0) |
Entry | raw scalar word | args.0, args.pid |
|
lvec (arg1) |
Entry | the pointer itself, as a raw word | args.1, args.raw[1] |
|
| ↳ pointee | Entry | local array of iovec, count from liovcnt (arg2) |
arg1.iov |
always |
| ↳ pointee | Entry | each local buffer | arg1.iov[i].data |
always |
liovcnt (arg2) |
Entry | raw scalar word | args.2, args.liovcnt |
|
rvec (arg3) |
Entry | the pointer itself, as a raw word | args.3, args.raw[3] |
|
| ↳ pointee | Entry | remote array of iovec (the array itself is in this process) |
arg3.remote_iov |
always |
| ↳ pointee | Entry | address and length only, status “address only” | arg3.remote_iov[i].data |
always |
riovcnt (arg4) |
Entry | raw scalar word | args.4, args.riovcnt |
|
flags (arg5) |
Entry | raw scalar word; Syscall Trace also decodes it into flag names (unknown group), listing unknown bits separately |
args.5, args.flags |
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.pid(arg0),args.lvec(arg1),args.liovcnt(arg2),args.rvec(arg3),args.riovcnt(arg4),args.flags(arg5);args.0toargs.5by position. - Structure
iovec[]behindlvec(arg1):args.lvec.<member>foriov_base,iov_len. - Structure
iovec[]behindrvec(arg3):args.rvec.<member>foriov_base,iov_len.
See Syscall Trace filter for the full syntax.
Known gaps
Section titled “Known gaps”- The other process’s memory is never read.
- See the coverage mark above for the code paths that record a gap.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.