System Calls: The User-Kernel Boundary
Applications run in user mode, where they cannot access hardware directly. To use a resource controlled by the kernel — a file, a network socket, memory, or the CPU itself — the application makes a system call.
The Mode Switch
Every system call triggers a mode switch — the CPU transitions from user mode (ring 3) to kernel mode (ring 0). This involves:
- Trap — the CPU switches to kernel mode and jumps to a fixed entry point (the trap handler).
- Dispatch — the kernel looks up the syscall number in a table and calls the corresponding handler function.
- Return — the kernel returns the result, restores the user-mode context, and switches back to user mode via an interrupt return instruction.
Each mode switch costs thousands of CPU cycles — saving and restoring registers, flushing the TLB, and invalidating caches. This is why minimizing syscalls is a common performance goal.
Common System Calls
| Syscall | Purpose | Layer |
|---|---|---|
fork() / clone() | Create a new process/thread | Process management |
exec() | Replace memory image with a new program | Process management |
exit() | Terminate the current process | Process management |
waitpid() | Wait for a child to terminate | Process management |
open() / close() | Open/close a file | File management |
read() / write() | Read/write file or socket | File management |
mmap() | Map a file or device into memory | Memory management |
brk() / sbrk() | Change the heap boundary | Memory management |
socket() / connect() / send() / recv() | Network communication | Network |
The File Descriptor Abstraction
On Unix, "everything is a file" — files, devices, pipes, and network sockets are all accessed through the same read() / write() interface. The kernel tracks each open resource with an integer file descriptor. This uniformity is why Unix tools compose so naturally: you can pipe output from one command into another because both use the same file descriptor interface.
Performance Implications
- Syscall overhead: ~1000–10000 cycles per call. High-frequency code should batch operations.
- Context switch overhead: ~10000–100000 cycles when switching between processes.
- Copy between user and kernel space: data copied for
read()/write()can be avoided with zero-copy syscalls likesendfile(),splice(), andmmap().
Review: What Is a Process? · Trace: Process Lifecycle
This article is part of the Operating Systems Intermediate learning path.