kexec_load

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long kexec_load(unsigned long entry, unsigned long nr_segments, struct kexec_segment *segments, unsigned long flags);

Number (x86-64)	246
ABI	64
Kernel entry point	sys_kexec_load

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Loads a new kernel image, described by memory segments, to be started later with reboot.

Arguments

Name	Type	Meaning
entry (arg0)	unsigned long	Entry point address.
nr_segments (arg1)	unsigned long	Number of segments.
segments (arg2)	struct kexec_segment *	Pointer to an array of segments.
flags (arg3)	unsigned long	Option flags that change the behavior of the call.

Return value

On success: 0.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-22	EINVAL	An argument is invalid.
-1	EPERM	The operation is not permitted for this process.

Man page

kexec_load(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
entry (arg0)	Entry	raw scalar word	args.0, args.entry
nr_segments (arg1)	Entry	raw scalar word	args.1, args.nr_segments
segments (arg2)	Entry	the pointer itself, as a raw word	args.2, args.raw[2]
↳ pointee	Entry	array of kexec_segment (32 bytes each), count from nr_segments (arg1); “invalid extent” with no copy above 16	arg2.segments	always
↳ pointee	Entry	each segment’s buffer, bufsz bytes, capped like write	arg2.segments[i].buf	bufsz is not 0
flags (arg3)	Entry	raw scalar word; Syscall Trace also decodes it into flag names (kexec group), listing unknown bits separately	args.3, args.flags

Family notes

• Entry only: the segment array (arg2.segments, at most 16 segments) and each segment’s buffer (arg2.segments[i].buf), bounded like write.

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.entry (arg0), args.nr_segments (arg1), args.segments (arg2), args.flags (arg3); args.0 to args.5 by position.
• Structure kexec_segment[] behind segments (arg2): args.segments.<member> for buf, bufsz, mem, memsz.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.