Book 13 · Operating SystemsPage 31 of 37

System Call

Q: How can I see which system calls a program makes?

On Linux you can run a program under strace, for example strace ls, to print every system call it makes along with its arguments and results. Other operating systems offer similar tracing tools.

In Turkish: sistem çağrısı

Updated September 30, 20262 min read

In short

A system call is a request from a program to the operating system kernel to perform a privileged action, such as reading a file or starting a process.

What is a system call?

A system call, often shortened to syscall, is the official doorway between an application and the kernel. Programs run in a restricted user mode and cannot touch hardware or other programs' memory directly, so whenever they need to open a file, send data over the network, start a process, or get more memory, they make a system call and let the kernel do the work.

To make a system call, a program places a syscall number and its arguments in CPU registers and runs a special instruction, such as syscall on x86-64, that switches the CPU into kernel mode. The kernel validates the request, performs the action, and returns a result or error code before switching back to user mode. Common system calls on Unix-like systems include open, read, write, fork, execve, and mmap.

Think of a bank teller window. Customers cannot walk into the vault, but they can hand a request to the teller, who checks it and handles the money for them. Most developers rarely write system calls by hand; functions like printf in C, open() in Python, or fs.readFile in Node.js make them for you behind the scenes.

A system call is not the same as a regular function call or a library API. A normal function call stays inside your program in user mode, while a system call crosses into the kernel, which makes it noticeably slower. That cost is why libraries often buffer data and make fewer, larger system calls instead of many small ones.

Key takeaways

A system call is how a user-mode program asks the kernel for a privileged service.
Each system call switches the CPU from user mode to kernel mode and back.
Examples include open, read, write, fork, and mmap.
Standard libraries wrap system calls, so developers rarely call them directly.
System calls cost more than normal function calls, so programs try to batch them.

Example

Making system calls through Python's os modulepython

import os

# os.open, os.write and os.close are thin wrappers
# around the open, write and close system calls
fd = os.open("hello.txt", os.O_WRONLY | os.O_CREAT, 0o644)
os.write(fd, b"Hello from a system call\n")
os.close(fd)

# Ask the kernel for this process's ID (the getpid system call)
print(os.getpid())

Readers ask

What is the difference between a system call and an API?

An API is any defined interface for using software, while a system call is the specific low-level interface the kernel provides. Library APIs such as the C standard library wrap system calls to make them easier and more portable to use.

How can I see which system calls a program makes?

On Linux you can run a program under strace, for example strace ls, to print every system call it makes along with its arguments and results. Other operating systems offer similar tracing tools.

Why are system calls slow?

Each system call switches the CPU from user mode to kernel mode and back, and the kernel must validate the request. The overhead is tiny for one call but adds up when a program makes millions of small calls.