Kernel probe not inserted for system_call function

Question

I can use kprobe mechanism to attach handlers using following example code:

#include <asm/uaccess.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/kallsyms.h>
#include <linux/slab.h>
#include <linux/init.h>
#include <linux/kprobes.h> 

static struct kprobe kp; 

int Pre_Handler(struct kprobe *p, struct pt_regs *regs){
    printk("pre_handler\n");
    return 0;
}

void Post_Handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags) {
    printk("post_handler\n");
} 

int __init init (void) {
    kp.pre_handler = Pre_Handler;
    kp.post_handler = Post_Handler;
    kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("sys_fork"); 
    printk("%d\n", register_kprobe(&kp)); 
    return 0;
}

void __exit cleanup(void) {
    unregister_kprobe(&kp); 
}

MODULE_LICENSE("GPL");   
module_init(init);
module_exit(cleanup);

However, it looks like not all kernel routines can be tracked this way. I've tried to attach handlers to system_call to have them called with any system call execution with following change:

kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("system_call");

And probes aren't inserted. dmesg shows that register_kprobe returns -22 which is -EINVAL. Why is this function impossible to trace? Is it possible to attach kprobe handler before dispatching any system call?

$ uname -r
3.8.0-29-generic

score 2 · Accepted Answer · answered Nov 25 '13 at 17:15

system_call is protected from kprobes, it is not possible to probe the system_call function. I think we don't have any useful information that you can get before any actual system call gets invoked. for example if you see the function system_call:

    RING0_INT_FRAME                 # can't unwind into user space anyway
    ASM_CLAC
    pushl_cfi %eax                  # save orig_eax
    SAVE_ALL
    GET_THREAD_INFO(%ebp)
                                    # system call tracing in operation / emulation
    testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
    jnz syscall_trace_entry
    cmpl $(NR_syscalls), %eax
    jae syscall_badsys
    syscall_call:
    call *sys_call_table(,%eax,4)

there are a few instructions before your actual system call is invoked. yeah, I am not sure if you need any information in these instructions.

Do you know about any working noninvasive way to execute some code before any system call? — Nykakin, Nov 26 '13 at 17:23
Look at the procmon project at https://github.com/alexandernst/procmon. It mey be helpful. CC: @alexandernst — Ilya Matveychikov, Nov 26 '13 at 18:43

Kernel probe not inserted for system_call function

1 Answers1