---
name: "proc_readmem"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/proc_readmem"
---

# proc\_readmem(9)

read from or write to a process address space

## NAME

**proc\_rwmem**, **proc\_readmem**, **proc\_writemem** – read from or write to a process address space

## SYNOPSIS

**#include \<sys/types.h\>**

**#include \<sys/ptrace.h\>**

*int*\

**proc\_rwmem**(*struct proc \*p*, *struct uio \*uio*);

*ssize\_t*\

**proc\_readmem**(*struct thread \*td*, *struct proc \*p*, *vm\_offset\_t va*, *void \*buf*, *size\_t len*);

*ssize\_t*\

**proc\_writemem**(*struct thread \*td*, *struct proc \*p*, *vm\_offset\_t va*, *void \*buf*, *size\_t len*);

## DESCRIPTION

These functions are used to read to or write from the address space of the process *p*. The **proc\_rwmem**() function requires the caller to specify the I/O parameters using a *struct uio*, described in [uio(9)](/uio/9.md). The **proc\_readmem**() and **proc\_writemem**() functions provide a simpler, less general interface which allows the caller to read into or write the kernel buffer *buf* of size *len* from or to the memory at offset *va* in the address space of *p*. The operation is performed on behalf of thread *td*, which will most often be the current thread.

These functions may sleep and thus may not be called with any non-sleepable locks held. The process *p* must be held by the caller using [PHOLD(9)](/PHOLD/9.md).

## RETURN VALUES

The **proc\_rwmem**() function returns 0 on success. EFAULT is returned if the specified user address is invalid, and ENOMEM is returned if the target pages could not be faulted in due to a resource shortage.

The **proc\_readmem**() and **proc\_writemem**() functions return the number of bytes read or written, respectively. This may be smaller than the number of bytes requested, for example if the request spans multiple pages in the process address space and one of them after the first is not mapped. Otherwise, -1 is returned.

## SEE ALSO

[copyin(9)](/copyin/9.md), [locking(9)](/locking/9.md), [PHOLD(9)](/PHOLD/9.md), [uio(9)](/uio/9.md)

## AUTHORS

This manual page was written by Mark Johnston ⟨*markj@FreeBSD.org*⟩.