How are system calls handled in a virtual machine?

Quoting wikipedia, a system call is:


In computing, a system call is how a program requests a service from
an operating system's kernel. This may include hardware related
services (e.g. accessing the hard disk), creating and executing new
processes, and communicating with integral kernel services (like
scheduling). System calls provide an essential interface between a
process and the operating system.

In ordinary operating systems, when a system call is made the operating system enters kernel mode and performs the requested operation.

What happens to a system call made by a process in a virtual machine? Is it handled by the virtual machine only, or is it delegated to the outer kernel to be operated by the hardware-facing kernel?

There are 3 common strategies to handle this:

1. Hypervisor traps system calls from guest: The hypervisor checks whether the privileged instruction(effectively system call) came from the guest OS itself, or from a user-space program within the guest OS. If it's the former case, then the hypervisor will actually forward the call to the hardware, although through the virtualization instructions. If it's the latter, the hypervisor will redirect the call to the guest OS, and then proceed.

1. Binary translation: Here the hypervisor checks the code from the guest OS in what are called as "basic blocks", scanning for privileged instructions. Wherever it finds them, it replaces them with calls to it's own procedures to system calls. It then proceeds to cache these blocks & eventually builds a whole set of such blocks.

1. Paravirtualization: Here the guest OS itself is modified so that instead of making calls to the hardware, it has APIs to invoke the hypervisor to get its hardware I/O done.

Source: Modern Operating Systems by Andrew Tanenbaum

StackExchange Computer Science Q#29878, answer score: 7