Inline hook tracepoint

[5ec1cff]

Intended to avoid running code in preempt disable context.

[Copilot]

Pull request overview

This pull request introduces inline hooking for the syscall tracepoint mechanism to avoid running code in preempt-disabled context. The implementation adds ARM64-specific assembly trampolines and inline hook infrastructure to intercept syscall_trace_enter calls directly, rather than relying solely on the kernel's tracepoint mechanism.

Changes:

• Adds ARM64 inline hook infrastructure with instruction relocation and trampoline generation
• Implements assembly trampoline for syscall interception with register preservation
• Modifies syscall hook manager to use inline hooks alongside tracepoint registration

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 21 comments.

Show a summary per file

File	Description
kernel/trampoline.S	ARM64 assembly trampoline that preserves registers and calls ksu_trace_sys_enter
kernel/inline_hook.c	Core inline hook implementation with ARM64 instruction relocation logic
kernel/hook.h	Header defining hook structures, error codes, and API
kernel/patch.c	Hook installation code that finds and patches syscall_trace_enter jump table entry
kernel/syscall_hook_manager.c	Integration changes to install inline hook and use no-op tracepoint handler
kernel/syscall_hook_manager.h	Added declarations for inline hook functions
kernel/Kbuild	Added new object files to build system
kernel/.gitignore	Generalized pattern to ignore all .cmd files
.github/workflows/build-lkm.yml	Added fail-fast: false for better CI behavior

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.