System and method for trapping system calls for remote execution

1. A method for executing system calls in a virtualized environment, wherein the method comprises:

executing a guest process within a virtual machine and having an associated guest-process virtual address space;

executing, on a host, a host process corresponding to the guest process and having an associated host-process virtual address space;

mapping the host-process virtual address space and the guest-process virtual address space to a same host physical memory;

trapping a system call invoked by the guest process;

determining whether to perform the trapped system call using the guest process or the host process based on a type of the trapped system call;

performing the trapped system call using the host process, wherein state changes in the host-process virtual address space caused by the trapped system call are reflected in the guest-process virtual address space; and

resuming execution of the guest process in response to completing execution of the trapped system call.

2. The method of claim 1 , wherein trapping the system call invoked by the guest process further comprises:

protecting a model-specific register associated with a system-call target address from at least one of read access and write access;

catching a general protection exception caused by the guest process attempting to read the protected model-specific register associated with the system-call target address.

3. The method of claim 2 , further comprising:

responsive to determining the general protection exception is associated with an emulated system call, extracting a system call number and one or more system-call arguments associated with the trapped system call.

4. The method of claim 1 , wherein mapping the host-process virtual address space and the guest-process virtual address space to the same host physical memory further comprises:

intercepting a memory-management system call to modify a memory mapping of the guest-process virtual address space;

performing the modification of the memory mapping on both the guest-process virtual address space and the host-process virtual address space.

5. The method of claim 1 , wherein mapping the host-process virtual address space and the guest-process virtual address space to the same host physical memory further comprises:

invoking a memory mapping API call to map at least a portion of a guest virtual address space range to a context of the host process.

6. The method of claim 1 , wherein performing the trapped system call using the host process further comprises:

modifying access protection of the host-process virtual address space to protect the host-process virtual address space from access; and

in responsive to a protection fault caused by the system call attempting to access a portion of the host-process virtual address space, mapping a new guest page to the accessed portion and release protection of the accessed portion.

7. The method of claim 1 , wherein performing the trapped system call using the host process further comprises:

responsive to determining that the trapped system call includes a guest data pointer referencing a portion of the guest-process virtual address space, substituting the guest data pointer with a host data pointer referencing the same portion of the guest-process virtual address space.

8. The method of claim 1 , further comprising:

responsive to determining that the trapped system call is suitable for the guest process, forwarding the trapped system call through a virtualization stack of the virtual machine for handling.

9. A system for executing system calls in a virtualized environment, wherein the system comprises:

a physical memory device; and

a processor configured to:

execute a guest process within a virtual machine and having an associated guest-process virtual address space;

execute a host process corresponding to the guest process and having an associated host-process virtual address space;

map the host-process virtual address space and the guest-process virtual address space to a same host physical memory of the physical memory device;

trap a system call invoked by the guest process;

determine whether to perform the trapped system call using the guest process or the host process based on a type of the trapped system call;

perform the trapped system call using the host process, wherein state changes in the host-process virtual address space caused by the trapped system call are reflected in the guest-process virtual address space; and

resume execution of the guest process in response to completing execution of the trapped system call.

10. The system of claim 9 , wherein the processor configured to trap the system call invoked by the guest process is further configured to:

protect a model-specific register associated with a system-call target address from at least one of read access and write access; and

catch a general protection exception caused by the guest process attempting to read the protected model-specific register associated with the system-call target address.

11. The system of claim 10 , wherein the processor is further configured to:

responsive to determining the general protection exception is associated with an emulated system call, extract a system call number and one or more system-call arguments associated with the trapped system call.

12. The system of claim 9 , wherein the processor configured to map the host-process virtual address space and the guest-process virtual address space to the same host physical memory is further configured to:

intercept a memory-management system call to modify a memory mapping of the guest-process virtual address space;

perform the modification of the memory mapping on both the guest-process virtual address space and the host-process virtual address space.

13. The system of claim 9 , wherein the processor configured to map the host-process virtual address space and the guest-process virtual address space to the same host physical memory is further configured to:

invoke a memory mapping API call to map at least a portion of a guest virtual address space range to a context of the host process.

14. The system of claim 9 , wherein the processor configured to perform the trapped system call using the host process is further configured to:

modify access protection of the host-process virtual address space to protect the host-process virtual address space from access; and

in responsive to a protection fault caused by the system call attempting to access a portion of the host-process virtual address space, map a new guest page to the accessed portion and release protection of the accessed portion.

15. The system of claim 9 , wherein the processor configured to perform the trapped system call using the host process is further configured to:

responsive to determining that the trapped system call includes a guest data pointer referencing a portion of the guest-process virtual address space, substitute the guest data pointer with a host data pointer referencing the same portion of the guest-process virtual address space.

16. The system of claim 9 , wherein the processor is further configured to:

responsive to determining that the trapped system call is suitable for the guest process, forward the trapped system call through a virtualization stack of the virtual machine for handling.

17. A non-transitory computer readable medium comprising computer executable instructions for executing system calls in a virtualized environment, including instructions for:

executing a guest process within a virtual machine and having an associated guest-process virtual address space;

executing, on a host, a host process corresponding to the guest process and having an associated host-process virtual address space;

mapping the host-process virtual address space and the guest-process virtual address space to a same host physical memory;

trapping a system call invoked by the guest process;

determining whether to perform the trapped system call using the guest process or the host process based on a type of the trapped system call;

performing the trapped system call using the host process, wherein state changes in the host-process virtual address space caused by the trapped system call are reflected in the guest-process virtual address space; and

resuming execution of the guest process in response to completing execution of the trapped system call.

18. The non-transitory computer readable medium of claim 17 , wherein the instructions for trapping the system call invoked by the guest process further comprises instructions for:

protecting a model-specific register associated with a system-call target address from at least one of read access and write access;

catching a general protection exception caused by the guest process attempting to read the protected model-specific register associated with the system-call target address; and

responsive to determining the general protection exception is associated with an emulated system call, extracting a system call number and one or more system-call arguments associated with the trapped system call.

19. The non-transitory computer readable medium of claim 17 , wherein the instructions for mapping the host-process virtual address space and the guest-process virtual address space to the same host physical memory further comprises instructions for:

intercepting a memory-management system call to modify a memory mapping of the guest-process virtual address space;

performing the modification of the memory mapping on both the guest-process virtual address space and the host-process virtual address space.

20. The non-transitory computer readable medium of claim 17 , wherein the instructions for performing the trapped system call using the host process further comprises instructions for:

modifying access protection of the host-process virtual address space to protect the host-process virtual address space from access; and

in responsive to a protection fault caused by the system call attempting to access a portion of the host-process virtual address space, mapping a new guest page to the accessed portion and release protection of the accessed portion.