write
Implemented in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long write(unsigned int fd, const char *buf, size_t count);| Number (x86-64) | 1 |
| ABI | common |
| Kernel entry point | sys_write |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Writes up to a given number of bytes from a buffer to an open file descriptor. The return value can be smaller than the requested count.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
fd (arg0) |
unsigned int |
File descriptor to write to. |
buf (arg1) |
const char * |
Buffer holding the bytes to write. |
count (arg2) |
size_t |
Number of bytes to write. |
Return value
Section titled “Return value”On success: The number of bytes transferred (see the description for what 0 means).
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-11 |
EAGAIN |
The call would block, or a resource is temporarily unavailable. |
-9 |
EBADF |
A file descriptor is not valid for this operation. |
-14 |
EFAULT |
A pointer argument points outside the accessible address space. |
-4 |
EINTR |
The call was interrupted by a signal. |
-28 |
ENOSPC |
There is no space left on the device. |
-32 |
EPIPE |
The other end of a pipe or socket is closed. |
Man page
Section titled “Man page”Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
fd (arg0) |
Entry | raw scalar word | args.0, args.fd |
|
buf (arg1) |
Entry | the pointer itself, as a raw word | args.1, args.raw[1] |
|
| ↳ pointee | Entry | buffer; length min(count, MAX_RW_COUNT), taken from count (arg2) |
arg1.data |
always |
count (arg2) |
Entry | raw scalar word | args.2, args.count |
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.fd(arg0),args.buf(arg1),args.count(arg2);args.0toargs.5by position.
See Syscall Trace filter for the full syntax.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.