// main.c
#include <stdio.h>

int main(int argc, char **argv) {
    printf("hello\n");
    return 0;
}

┌─────────────────────────┐
│  ELF Header             │  Magic number, entry point, section offsets
├─────────────────────────┤
│  Program Headers        │  How to load segments into memory
├─────────────────────────┤
│  .text (Code)           │  Machine instructions (read-only)
├─────────────────────────┤
│  .rodata (Constants)    │  "hello" string lives here
├─────────────────────────┤
│  .data (Initialized)    │  Initialized global variables
├─────────────────────────┤
│  .bss (Uninitialized)   │  Uninitialized globals (zero-filled by loader)
├─────────────────────────┤
│  Symbol Table           │  Function names, debugging info
├─────────────────────────┤
│  Section Headers        │  Metadata about each section
└─────────────────────────┘

$ ./main

// Inside bash or sh:
pid_t pid = fork();
if (pid == 0) {
    // Child process
    execve("./main", argv, envp);
} else {
    // Parent process
    wait(NULL);  // Wait for child to finish
}

High Address (0x7FFF...)
┌─────────────────────────┐
│  Kernel Space           │ ← Not accessible from user mode
├─────────────────────────┤
│  Stack (grows down ↓)   │ ← argc, argv, environment vars
│         ...             │
├─────────────────────────┤
│  Memory Mapped Region   │ ← Shared libraries (libc.so)
│  (libc, ld-linux.so)    │
├─────────────────────────┤
│  Heap (grows up ↑)      │ ← malloc() allocates here
│         ...             │
├─────────────────────────┤
│  .bss (uninitialized)   │ ← Zero-filled global variables
├─────────────────────────┤
│  .data (initialized)    │ ← Initialized global variables
├─────────────────────────┤
│  .text (code)           │ ← Your program's machine code
└─────────────────────────┘
Low Address (0x0000...)

User types "./main"
        ↓
Shell receives command (shell is a running process, PID 1000)
        ↓
Shell calls fork() ──────────┐
        ↓                     ↓
Parent (PID 1000)        Child (PID 1001)
calls wait()             calls execve("./main")
blocks...                     ↓
                         Kernel loads ELF binary
                         Sets up address space
                         Maps .text, .data, stack
                         Jumps to _start
                              ↓
                         C runtime initializes
                              ↓
                         main() executes
                         printf() → write syscall
                              ↓
                         main() returns 0
                              ↓
                         exit(0) → exit_group syscall
                              ↓
                         Kernel cleans up process
                              ↓
Parent's wait() returns
Shell prints next prompt

// If user space could do this:
asm("cli");  // Disable interrupts
while(1);    // Infinite loop
// The entire system would freeze!

// Or this:
void *kernel_memory = (void *)0xFFFF888000000000;
*kernel_memory = 0x90909090;  // Overwrite kernel code
// System compromised!

; Legacy 32-bit Linux syscall
mov eax, 4          ; syscall number (write)
mov ebx, 1          ; file descriptor (stdout)
mov ecx, msg        ; buffer
mov edx, 13         ; count
int 0x80            ; Trap to kernel

; Modern 64-bit Linux syscall
mov rax, 1          ; syscall number (write)
mov rdi, 1          ; arg1: file descriptor
mov rsi, msg        ; arg2: buffer
mov rdx, 13         ; arg3: count
syscall             ; Fast system call

; Entry point stored in LSTAR MSR
entry_SYSCALL_64:
    SWAPGS                  ; Switch to kernel GS (per-CPU area)
    mov    QWORD PTR gs:0x14, rsp   ; Save user stack
    mov    rsp, QWORD PTR gs:0x1c   ; Load kernel stack

    push   rax              ; Save registers
    push   rcx              ; (RCX = user RIP)
    push   r11              ; (R11 = user RFLAGS)
    ; ... save more registers

    call   do_syscall_64    ; C function dispatch

    ; ... restore registers
    pop    r11
    pop    rcx
    pop    rax

    mov    rsp, QWORD PTR gs:0x14   ; Restore user stack
    SWAPGS                  ; Switch back to user GS
    sysretq                 ; Return to user space

; ARM64 syscall
mov x8, #64         ; syscall number (write)
mov x0, #1          ; arg1: fd
ldr x1, =msg        ; arg2: buffer
mov x2, #13         ; arg3: count
svc #0              ; SuperVisor Call

; RISC-V syscall
li a7, 64           ; syscall number (write)
li a0, 1            ; arg1: fd
la a1, msg          ; arg2: buffer
li a2, 13           ; arg3: count
ecall               ; Environment call

Process Address Space:
┌─────────────────────────┐
│  Kernel Space           │
├─────────────────────────┤
│  Stack                  │
├─────────────────────────┤
│  [vdso] ← Magic page!   │ ← Kernel-provided, user-executable
│    - gettimeofday()     │
│    - clock_gettime()    │
│    - getcpu()           │
├─────────────────────────┤
│  Shared Libraries       │
│  (libc.so)              │
├─────────────────────────┤
│  Heap                   │
├─────────────────────────┤
│  .text                  │
└─────────────────────────┘

// Slow path: requires syscall
struct timeval tv;
gettimeofday(&tv, NULL);
// → syscall → kernel mode → read kernel clock → return
// Cost: ~200 cycles

// Fast path: executes in user mode
struct timeval tv;
gettimeofday(&tv, NULL);
// → calls vDSO function → reads shared memory → returns
// Cost: ~20 cycles (no mode switch!)

// In arch/x86/entry/vdso/vdso.c
static int __init init_vdso(void) {
    // Map vDSO page into every process
    vdso_pages[0] = alloc_page(GFP_KERNEL);
    copy_vdso_to_page(vdso_pages[0]);
    return 0;
}

// Kernel periodically updates shared time data
void update_vsyscall(struct timekeeper *tk) {
    vdso_data->wall_time_sec = tk->wall_time.tv_sec;
    vdso_data->wall_time_nsec = tk->wall_time.tv_nsec;
}

// Inside vDSO (simplified)
notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts) {
    // Read from shared memory (no syscall!)
    ts->tv_sec = vdso_data->wall_time_sec;
    ts->tv_nsec = vdso_data->wall_time_nsec;
    return 0;
}

// Benchmark: 10 million calls
clock_gettime(CLOCK_REALTIME, &ts);

// With vDSO:     ~200 ms (20 ns per call)
// Without vDSO:  ~2000 ms (200 ns per call)
// Speedup: 10x

# View process mappings
$ cat /proc/self/maps | grep vdso
7ffd1a3fe000-7ffd1a400000 r-xp 00000000 00:00 0    [vdso]

# Dump vDSO symbols
$ objdump -T /lib/x86_64-linux-gnu/libc.so.6 | grep vdso
# (libc wraps vDSO calls)

# Using LD_SHOW_AUXV
$ LD_SHOW_AUXV=1 ./program 2>&1 | grep SYSINFO
AT_SYSINFO_EHDR: 0x7ffd1a3fe000  ← vDSO base address

Fixed virtual address: 0xffffffffff600000

Every process had:
┌───────────────────────────┐
│ 0xffffffffff600000:       │
│   gettimeofday code       │ ← Same address in EVERY process
│   time code               │
│   getcpu code             │
└───────────────────────────┘

// Exploit code
return_address = 0xffffffffff600000 + offset;
// Execute attacker-controlled syscalls

// In arch/x86/entry/vsyscall/vsyscall_64.c
static bool is_vsyscall_vaddr(unsigned long vaddr) {
    return vaddr >= VSYSCALL_ADDR && vaddr < VSYSCALL_ADDR + PAGE_SIZE;
}

// Trap and emulate
do_page_fault() {
    if (is_vsyscall_vaddr(address)) {
        // Emulate the syscall (SLOW!)
        emulate_vsyscall();
        return;
    }
}

; arch/x86/entry/entry_64.S

ENTRY(entry_SYSCALL_64)
    /*
     * Interrupts are off on entry.
     * We are in kernel mode, but need to switch stacks.
     */

    /* 1. SWAPGS: Switch GS register to kernel per-CPU area */
    SWAPGS

    /* 2. Save user stack pointer */
    movq    %rsp, PER_CPU_VAR(rsp_scratch)

    /* 3. Load kernel stack */
    movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp

    /* 4. Build pt_regs structure on kernel stack */
    pushq   $__USER_DS              /* User data segment */
    pushq   PER_CPU_VAR(rsp_scratch)  /* User RSP */
    pushq   %r11                    /* User RFLAGS (saved by SYSCALL) */
    pushq   $__USER_CS              /* User code segment */
    pushq   %rcx                    /* User RIP (saved by SYSCALL) */

    pushq   %rax    /* Syscall number */
    pushq   %rdi    /* Arg 1 */
    pushq   %rsi    /* Arg 2 */
    pushq   %rdx    /* Arg 3 */
    pushq   %r10    /* Arg 4 (RCX was overwritten) */
    pushq   %r8     /* Arg 5 */
    pushq   %r9     /* Arg 6 */

    /* 5. Call the C dispatcher */
    call    do_syscall_64

    /* 6. Restore user registers from pt_regs */
    popq    %r9
    popq    %r8
    popq    %r10
    popq    %rdx
    popq    %rsi
    popq    %rdi
    popq    %rax    /* Return value */

    popq    %rcx    /* User RIP */
    popq    %r11    /* Skip CS */
    popq    %r11    /* User RFLAGS */
    popq    %rsp    /* Skip DS */
    popq    %rsp    /* User RSP */

    /* 7. SWAPGS back to user GS */
    SWAPGS

    /* 8. SYSRETQ: Return to user space */
    sysretq
END(entry_SYSCALL_64)

// In arch/x86/entry/common.c

__visible noinstr void do_syscall_64(struct pt_regs *regs, int nr) {
    // Security checks
    nr = syscall_enter_from_user_mode(regs, nr);

    // Validate syscall number
    if (likely(nr < NR_syscalls)) {
        // Look up in syscall table and call
        regs->ax = sys_call_table[nr](regs);
    }

    syscall_exit_to_user_mode(regs);
}

// In arch/x86/entry/syscall_64.c

const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = {
    [0] = __x64_sys_read,
    [1] = __x64_sys_write,
    [2] = __x64_sys_open,
    [3] = __x64_sys_close,
    [4] = __x64_sys_stat,
    // ... 300+ more syscalls
    [39] = __x64_sys_getpid,
    [57] = __x64_sys_fork,
    [59] = __x64_sys_execve,
    // ...
};

User Program                  CPU Hardware              Kernel
─────────────────────────────────────────────────────────────
mov rax, 1
mov rdi, 1
mov rsi, buffer
mov rdx, 13
syscall ──────────────────>  SYSCALL instruction
                             - Save RIP → RCX
                             - Save RFLAGS → R11
                             - Load RIP from LSTAR MSR ───────> entry_SYSCALL_64:
                             - Switch to Ring 0                   SWAPGS
                                                                  Save user RSP
                                                                  Load kernel stack
                                                                  Push registers (pt_regs)
                                                                  call do_syscall_64
                                                                     ↓
                                                                  sys_call_table[1]
                                                                     ↓
                                                                  __x64_sys_write()
                                                                     ↓
                                                                  ksys_write()
                                                                     ↓
                                                                  vfs_write()
                                                                     ↓
                                                                  [... kernel work ...]
                                                                     ↓
                                                                  return bytes_written
                                                                     ↓
                                                                  Pop registers
                                                                  Restore user RSP
                                                                  SWAPGS
                             SYSRETQ <────────────────────────── sysretq
                             - Restore RIP from RCX
                             - Restore RFLAGS from R11
                             - Switch to Ring 3
RAX = bytes_written <───────
continue program...

Process = House
├── Address Space = House structure (walls, roof)
├── Resources
│   ├── File Descriptors = Shared utilities (kitchen, bathroom)
│   ├── Signal Handlers = House rules (fire alarm protocol)
│   └── Current Directory = Current room the house is in
└── Threads = People inside
    ├── Thread 1
    │   ├── Stack = Private bedroom
    │   └── Registers = Personal belongings
    ├── Thread 2
    │   ├── Stack = Private bedroom
    │   └── Registers = Personal belongings
    └── ...

// Thread 1
ssize_t n = read(fd, buf1, size);  // May block

// Process with 5 threads calls fork()
pid_t pid = fork();

// Linux doesn't distinguish! Everything is a task_struct

// Thread vs Process determined by clone() flags:
clone(CLONE_VM | CLONE_FS | CLONE_FILES);  // = Thread
clone(SIGCHLD);                             // = Process

#include <unistd.h>
ssize_t n = write(1, "Hello\n", 6);

ssize_t __write(int fd, const void *buf, size_t count) {
    return INLINE_SYSCALL_CALL(write, fd, buf, count);
}

mov rax, 1      ; __NR_write
mov rdi, 1      ; fd
mov rsi, buf    ; buffer
mov rdx, 6      ; count
syscall

sys_call_table[1] = __x64_sys_write;

SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf, size_t, count) {
    return ksys_write(fd, buf, count);
}

ssize_t ksys_write(unsigned int fd, const char __user *buf, size_t count) {
    struct fd f = fdget_pos(fd);
    if (!f.file)
        return -EBADF;

    ssize_t ret = vfs_write(f.file, buf, count, &pos);
    fdput_pos(f);
    return ret;
}

ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) {
    // Check permissions
    if (!(file->f_mode & FMODE_WRITE))
        return -EBADF;

    // Check file operations
    if (!file->f_op->write && !file->f_op->write_iter)
        return -EINVAL;

    // Call filesystem-specific write
    if (file->f_op->write)
        ret = file->f_op->write(file, buf, count, pos);
    else
        ret = new_sync_write(file, buf, count, pos);

    return ret;
}

// fs/ext4/file.c
static ssize_t ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from) {
    // Allocate disk blocks
    // Update inode metadata
    // Write to page cache
    // Mark pages dirty
    return generic_file_write_iter(iocb, from);
}

User Application: write(1, "Hello\n", 6)
        ↓
Libc Wrapper: __write()
        ↓
Assembly: syscall instruction
        ↓
entry_SYSCALL_64
        ↓
do_syscall_64
        ↓
sys_call_table[1] → __x64_sys_write
        ↓
ksys_write(fd, buf, count)
        ↓
vfs_write(file, buf, count, pos)
        ↓
ext4_file_write_iter() [if file is on ext4]
        ↓
generic_file_write_iter()
        ↓
Page Cache operations
        ↓
Return bytes written
        ↓
sysretq back to user space

pid_t pid = getpid();

// glibc calls:
pid_t getpid(void) {
    // Check if vDSO provides getpid
    if (GLRO(dl_vdso_getpid))
        return GLRO(dl_vdso_getpid)();

    // Fallback to syscall
    return INLINE_SYSCALL_CALL(getpid);
}

// In vDSO
notrace static int __vdso_getpid(void) {
    // Read from per-thread cached value
    return current->tgid;  // Thread Group ID
}

int fd = open("/home/user/file.txt", O_RDWR | O_CREAT, 0644);

// fs/open.c
SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) {
    return do_sys_open(AT_FDCWD, filename, flags, mode);
}

long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) {
    // 1. Allocate file descriptor
    int fd = get_unused_fd_flags(flags);

    // 2. Path lookup
    struct file *f = do_filp_open(dfd, filename, flags, mode);

    // 3. Install in FD table
    fd_install(fd, f);

    return fd;
}

struct file *do_filp_open(int dfd, struct filename *pathname, const struct open_flags *op) {
    // RCU-walk: lockless path walk
    // Falls back to ref-walk if needed
    struct nameidata nd;
    int error = path_openat(&nd, op, flags);

    // Creates/opens inode
    // Allocates struct file
    // Links to dentry cache

    return file;
}

#include <stdio.h>
#include <unistd.h>
#include <time.h>

#define ITERATIONS 10000000

int main() {
    struct timespec start, end;

    // Benchmark getpid() (vDSO)
    clock_gettime(CLOCK_MONOTONIC, &start);
    for (int i = 0; i < ITERATIONS; i++) {
        getpid();
    }
    clock_gettime(CLOCK_MONOTONIC, &end);

    long ns = (end.tv_sec - start.tv_sec) * 1000000000L +
              (end.tv_nsec - start.tv_nsec);
    printf("getpid: %ld ns per call\n", ns / ITERATIONS);

    // Benchmark write() to /dev/null
    int fd = open("/dev/null", O_WRONLY);
    char buf[1] = {0};

    clock_gettime(CLOCK_MONOTONIC, &start);
    for (int i = 0; i < ITERATIONS; i++) {
        write(fd, buf, 1);
    }
    clock_gettime(CLOCK_MONOTONIC, &end);

    ns = (end.tv_sec - start.tv_sec) * 1000000000L +
         (end.tv_nsec - start.tv_nsec);
    printf("write: %ld ns per call\n", ns / ITERATIONS);

    return 0;
}

getpid: 15 ns per call      ← vDSO, no syscall
write:  200 ns per call     ← Real syscall

# Count syscalls
perf stat -e syscalls:sys_enter_* ./program

# Trace individual syscalls
strace -c ./program
strace -T ./program  # With timing

# Profile syscall overhead
perf record -e raw_syscalls:sys_enter,raw_syscalls:sys_exit ./program
perf report

// DON'T DO THIS
for (int i = 0; i < 1000; i++) {
    write(fd, &data[i], 1);  // 1000 syscalls!
}

// DO THIS
write(fd, data, 1000);  // 1 syscall

struct iovec iov[10];
for (int i = 0; i < 10; i++) {
    iov[i].iov_base = buffers[i];
    iov[i].iov_len = sizes[i];
}
writev(fd, iov, 10);  // 1 syscall for multiple buffers

// Submit many operations with zero syscalls
io_uring_prep_write(sqe1, fd, buf1, len1, offset1);
io_uring_prep_write(sqe2, fd, buf2, len2, offset2);
io_uring_prep_write(sqe3, fd, buf3, len3, offset3);
io_uring_submit(ring);  // One syscall for all 3!

// Attack code
char *kernel_addr = (char *)0xFFFF888000000000;
char value = *kernel_addr;  // Would normally fault

// But CPU speculatively loads it!
// Side channel timing attack can extract value

User process page tables included kernel mappings
→ Fast syscalls (no CR3 switch)
→ Vulnerable to Meltdown

User process page tables: User space only
Kernel page tables: Kernel + user space
→ CR3 switch on every syscall/interrupt
→ Immune to Meltdown
→ 5-30% performance hit (mitigated by PCID)

Instead of flushing TLB on CR3 switch:
Tag TLB entries with PCID
→ User TLB entries coexist with kernel TLB entries
→ Much lower performance impact

#include <linux/seccomp.h>
#include <linux/filter.h>
#include <linux/bpf.h>

// Allow only read, write, exit
struct sock_filter filter[] = {
    // Load syscall number
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),

    // Allow read (0)
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),

    // Allow write (1)
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),

    // Allow exit (60)
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_exit, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),

    // Kill process for anything else
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
};

struct sock_fprog prog = {
    .len = sizeof(filter) / sizeof(filter[0]),
    .filter = filter,
};

prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);

// Now can only use read, write, exit

# Trace all syscalls
strace ./program

# Count syscalls by type
strace -c ./program

# Trace only open/read/write
strace -e trace=open,read,write ./program

# Show timing per syscall
strace -T ./program

# Attach to running process
strace -p <pid>

// syscall_raw.c - Direct syscall without libc
#define _GNU_SOURCE
#include <unistd.h>
#include <sys/syscall.h>

// Don't use printf (it uses syscalls internally)
static inline long my_write(int fd, const void *buf, size_t count) {
    long ret;
    __asm__ volatile (
        "syscall"
        : "=a" (ret)
        : "0"(__NR_write), "D"(fd), "S"(buf), "d"(count)
        : "rcx", "r11", "memory"
    );
    return ret;
}

void _start() {
    const char msg[] = "Hello from raw syscall!\n";
    my_write(1, msg, sizeof(msg) - 1);

    __asm__ volatile (
        "mov $60, %%rax\n"  // __NR_exit
        "xor %%rdi, %%rdi\n"
        "syscall"
        ::: "rax", "rdi"
    );
}