Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Implementing Linux System Call using LKM

I was trying to add a new System Call to linux kernel 3.2.x. While searching for useful reference material over the internet i had an impression that implementing system call as a loadable module is not possible as in SO question Is it possible to add a system call via a LKM?

I found another link which says this "There is a way to add system calls without recompiling the kernel using modules as a wrapper, but that is beyond the scope of this document". source http://hekimian-williams.com/?p=20

I know implementing system call statically will require me to compile the kernel code each time i make any changes. Is there a way as specified in the above mentioned blog that i can implement it as a module.

Any suggestions or pointers in the direction are much appreciated.

like image 309
abhi Avatar asked Sep 27 '12 13:09

abhi


People also ask

How system calls are implemented in Linux?

A system call is implemented by a ``software interrupt'' that transfers control to kernel code; in Linux/i386 this is ``interrupt 0x80''. The specific system call being invoked is stored in the EAX register, abd its arguments are held in the other processor registers.

Which system call is called in Linux to create a process?

System call fork() is used to create processes. It takes no arguments and returns a process ID. The purpose of fork() is to create a new process, which becomes the child process of the caller. After a new child process is created, both processes will execute the next instruction following the fork() system call.

How system calls are called by number and name in Linux?

System calls are identified by their numbers. The number of the call foo is __NR_foo . For example, the number of _llseek used above is __NR__llseek , defined as 140 in /usr/include/asm-i386/unistd.


1 Answers

  1. Locate sys_call_table/ia32_sys_call_table
  2. Make a copy and modify it as you wish (let it be my_sys_call_table)
  3. Locate system_call entry (this one and others)
  4. Modify NR_syscalls compare instruction in case of table size has changed
  5. Modify sys_call_table reference at system_call to point to my_sys_call_table:

    500        call *sys_call_table(,%eax,4)
          ->
    500        call *my_sys_call_table(,%eax,4)
    
  6. Profit?

Have fun :)

like image 173
Ilya Matveychikov Avatar answered Oct 23 '22 07:10

Ilya Matveychikov