{"id":24517434,"url":"https://github.com/johannst/vdso-proxy-poc","last_synced_at":"2026-03-07T00:30:47.722Z","repository":{"id":132563805,"uuid":"393988266","full_name":"johannst/vdso-proxy-poc","owner":"johannst","description":"Proof-of-concept to proxy vdso calls.","archived":false,"fork":false,"pushed_at":"2025-05-10T20:05:02.000Z","size":19,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-04T19:28:25.152Z","etag":null,"topics":["checkpoint","kernel","linux","proxy","restore","vdso"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/johannst.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-08-08T14:49:26.000Z","updated_at":"2025-05-10T20:05:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"32fbd45b-3515-412c-b9bd-d3aa21630704","html_url":"https://github.com/johannst/vdso-proxy-poc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/johannst/vdso-proxy-poc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johannst%2Fvdso-proxy-poc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johannst%2Fvdso-proxy-poc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johannst%2Fvdso-proxy-poc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johannst%2Fvdso-proxy-poc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/johannst","download_url":"https://codeload.github.com/johannst/vdso-proxy-poc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johannst%2Fvdso-proxy-poc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30204154,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-06T19:07:06.838Z","status":"ssl_error","status_checked_at":"2026-03-06T18:57:34.882Z","response_time":250,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["checkpoint","kernel","linux","proxy","restore","vdso"],"created_at":"2025-01-22T01:33:58.047Z","updated_at":"2026-03-07T00:30:47.692Z","avatar_url":"https://github.com/johannst.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# `vdso` proxy proof-of-concept\n\n## Background\nSimply spoken, the `vdso` is an ELF file provided by the Linux Kernel and\nmapped into a process to provide the implementation of certain `syscalls` in\nuserspace. Userspace can call those `virtual` syscalls without invoking a\n_real_ syscall (eg on x86-64 `syscall` instruction).\n\nThe location where the Kernel mapped the `vdso` can be found in the `maps`\n(procfs) labeled with the `[vdso]` tag.\n```bash\n\u003e cat /proc/self/maps | grep vdso\n7ffeae5fb000-7ffeae5fd000 r-xp 00000000 00:00 0     [vdso]\n```\n\nMore details about the `vdso` can be found here:\n- https://man7.org/linux/man-pages/man7/vdso.7.html\n- https://www.kernel.org/doc/Documentation/ABI/stable/vdso\n\n## Why do this?\nThis is some toying around and proof-of-concept for `process-checkpoint`\nscenarios with `migration` in mind.\nTypically a process checkpoint contains a dump of the virtual memory regions of\na process which are then re-mapped when restoring the process at a later point\nin time. The vdso in this case needs some special treatment as the user code in\nthe checkpoint image might have some references into the vdso segment (usually\nthis is done behind the scenes by the `libc`) where it was when taking the\ncheckpoint .\nWhen restoring a checkpoint, the Kernel will map the `vdso` to a random virtual\naddress in the restoring process, therfore there are two cases to distinguish:\n1. Restoring the checkpoint with the same Kernel.\n1. Restoring the checkpoint with a different Kernel (`migration`).\n\nFor case `(1)` the `vdso` can be [`mremap(2)`][man-mremap]-ed to the virtual\naddress where the vdso resided when creating the checkpoint. This is fine\nbecause the _new_ and the _old_ `vdso` are compatible.\n\nFor case `(2)` however it is possible that the binary layout of the _new_\n`vdso` has changed (eg different offsets for a given symbol) and is therefore\nincompatible with the _old_ `vdso`. In that case a simple\n[`mremap(2)`][man-mremap] won't do the trick.\nThis case is explored in this repository with a `proxy` mechanism which is\ndescribed by the figure below.\n\n```text\n# Before checkpoint create.\n\n          VMA\n          +---------------------+\n          | libc:               |\n          | gettimeofday(...)   |\n          |   ..                |\n          |   call              | --+\n          |   ..                |   | User code binds to symbols in the vdso.\neg    +-- +---------------------+   |\n+0x10 |   | vdso:               |   |\n      +-\u003e | __vdso_gettimeofday | \u003c-+\n          |   ..                |\n          +---------------------+\n\n\n# After checkpoint restore.\n\n          VMA\n          +---------------------+\n          | libc:               |\n          | gettimeofday(...)   |\n          |   ..                |\n          |   call              | --+\n          |   ..                |   | After restoring the memory of the process checkpoint,\neg    +-- +---------------------+   | user code still binds to symbols in the _old_ vdso region.\n+0x10 |   | [old] vdso:         |   |\n      +-\u003e | __vdso_gettimeofday | \u003c-+\n          |   jmp               | --+\n          |   ..                |   | After restore, the functions in the _old_ vdso region\neg    +-- +---------------------+   | are patched with a trampoline forwarding to the\n+0x40 |   | [new] vdso:         |   | corresponding function in the _new_ vdso region.\n      +-\u003e | __vdso_gettimeofday | \u003c-+\n          |   ..                |\n          +---------------------+\n```\n\nThis approach introduces the need for a higher-level synchronization as it must\nbe ensured that no thread is in the middle of executing a `vdso` function when\ncreating the process checkpoint. This PoC doesn't take this into account as it\nmerely focuses on the mechanics described above.\n\n## License\nThis project is licensed under the [MIT](LICENSE) license.\n\n[man-mremap]: https://man7.org/linux/man-pages/man2/mremap.2.html\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjohannst%2Fvdso-proxy-poc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjohannst%2Fvdso-proxy-poc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjohannst%2Fvdso-proxy-poc/lists"}