It is not possible because system call table (called
sys_call_table) is a static size array. And its size is determined at compile time by the number of registered syscalls. This means there is no space for another one.
You can check implementation for example for x86 architecture in
arch/x86/kernel/syscall_64.c file, where
sys_call_table is defined. Its size is exactly
__NR_syscall_max is defined in
sizeof(syscalls) - 1 (it's the number of last syscall), where
syscall is a table with all the syscalls.
One possible solution is to reuse some existing (or deprecated one if your architecture has one, see
sys_setaltroot for example) syscall number with yours as this won't require more space in memory. Some architectures may also have holes in the syscall table (like 64 bit version of x86) so you can use this too.
You can use this technique if you are developing new syscall and just want to avoid rebooting while experimenting. You will have to define your new system call, find existing entry in syscall table and then replace it from your module.
Doing this from kernel module is not trivial as kernel does not export
sys_call_table to modules as of version 2.6 (the last kernel version that had this symbol exported was
One way to work around this is to change your kernel to export
sys_call_table symbol to modules. To do this, you have to add following two lines to
kernel/kallsyms.c (don't do this on production machines):
extern void *sys_call_table;
Another technique is to find syscall table dynamically. You iterate over kernel memory, comparing each word with a pointer to known system call function. Since you know the offset of this know syscall in the table, you can compute table beginning address.