stat

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long stat(const char *filename, struct stat *statbuf);

Number (x86-64)	4
ABI	common
Kernel entry point	sys_newstat

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Reads metadata about the file at a path (type, size, owner, times) following symbolic links, and writes it to a stat structure.

Arguments

Name	Type	Meaning
filename (arg0)	const char *	Path of the file, as a NUL-terminated string in user memory.
statbuf (arg1)	struct stat *	Pointer to a structure the kernel fills with file metadata.

Return value

On success: 0.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-13	EACCES	Permission denied.
-14	EFAULT	A pointer argument points outside the accessible address space.
-2	ENOENT	A path component or the named object does not exist.
-20	ENOTDIR	A path component is not a directory.

Man page

stat(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
filename (arg0)	Entry	the pointer itself, as a raw word	args.0, args.raw[0]
↳ pointee	Entry	NUL-terminated string, up to 4,096 bytes (PATH_MAX)	arg0.path	always
statbuf (arg1)	Entry	the pointer itself, as a raw word	args.1, args.raw[1]
↳ pointee	Exit	structure stat (144 bytes)	arg1.stat	result is 0

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.filename (arg0), args.statbuf (arg1); args.0 to args.5 by position.
• Captured strings: the args.<name> field of a path argument, and args.path, give the captured text instead of the pointer.
• Structure stat behind statbuf (arg1): args.statbuf.<member> for __pad0, st_atime, st_atime_nsec, st_blksize, st_blocks, st_ctime, st_ctime_nsec, st_dev, st_gid, st_ino, st_mode, st_mtime, st_mtime_nsec, st_nlink, st_rdev, st_size, st_uid.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.