First page Back Continue Last page Overview Graphics

System call interception : Background

Notes:

This is a diagram of a UML system call interception. When a UML process executes a int 0x80 instruction, the host kernel notifies the tracing thread, which nullifies the call, saves the process state in the process thread structure, and queues a signal to the process in order to force it onto its kernel stack.
On the kernel stack and in kernel mode, the process executes the system call. When it's done, it notifies the tracing thread by sending itself a signal.
The tracing thread restores the process state, except for the system call return value, and continues the process.
As far as the process was concerned, it executed an int 0x80 instruction, found itself on a kernel stack, executed the system call, and returned. This is identical to what happens on the host, which allows processes to execute inside UML exactly as they do on the host.