System call

A computer has a boss.

This boss is the system. A program needs help sometimes. It might want to use a camera. It might want to save a file. The program asks the boss for help. This ask is a system call. The boss decides if it is safe. The boss does the work for the program. Then the boss gives control back. This keeps the computer working well. It keeps all the parts safe too.

A computer program often needs help from the system. This help is called a system call.

Most computers have a security model. This model uses privilege levels. A normal program has low privilege. It cannot touch the hardware directly. It cannot change other running programs. This keeps the computer safe.

To get help, a program makes a system call. This acts like an interrupt. An interrupt is a signal that changes how the CPU works. It moves control to the kernel. The kernel is the core part of the system. It has the highest privilege. The kernel checks if the request is safe. If it is, the kernel does the work. Then it gives control back to the program.

Programs often use a library to make these calls. A library is a set of tools. It sits between the program and the system. It uses wrapper functions to help. These functions make the work easier and safer.

There are many types of calls. Some manage files. Some manage memory. Some help programs talk to each other. Windows has about 2000 different calls. Linux has over 300 calls.

A computer program often needs to do things it cannot do alone. It might need to use a camera or save a file to a disk. To do this, the program makes a system call. This is a special request sent to the operating system. The operating system is the main software that runs the computer.

System calls act as a bridge. They allow a program to ask for services from the core part of the computer, called the kernel. Without these calls, a program would be stuck in its own small world.

Most modern computers use a security model to stay safe. This model uses different levels of privilege, often called rings. A normal program runs at a low privilege level. This means it cannot touch the hardware or change other programs. If a program wants to use a device, it must use a system call. This often happens through an interrupt. An interrupt is a signal that tells the CPU to stop what it is doing. The CPU then moves control to the kernel. The kernel checks if the request is safe before it does the work.

Writing these calls can be very hard for a programmer. To make it easier, most systems use a library. A library is a collection of helpful tools that sits between the program and the operating system. On Unix-like systems, this is often the C library, or libc. On Windows, it is part of the Native API. These libraries use wrapper functions to help. A wrapper function takes the program's request and puts the right information into the processor. This makes the code much easier to write and move to different computers.

History shows how these tools have changed over time. In the past, many people wrote code in assembly language. IBM's OS/360 used a library of assembly language macros for its system calls. Today, many systems use high-level languages instead. Linux 2.5 began using fast instructions on x86 computers to make calls quicker. These instructions are called SYSCALL and SYSRET. They allow the computer to switch control to the kernel without the extra work of a standard interrupt.

There are many different kinds of system calls. They can be grouped into six main categories. Some manage processes, which are running programs. Others manage files, like opening or deleting them. Some handle devices, like a mouse or a printer. Other calls manage memory or help programs talk to each other. Different systems have different amounts of calls. Windows has about 2000 calls. Linux and OpenBSD each have over 300. NetBSD and FreeBSD have close to or over 500 calls.

A system call, often called a syscall, is a programmatic request for service. It is how a computer program asks the operating system to perform specific tasks. Programs cannot always do everything on their own. They may need to access hardware like a hard disk drive or a camera. They might need to create new processes or communicate with the kernel. The kernel is the core part of the operating system that manages everything. System calls provide the essential interface between a running process and this kernel.

To keep computers safe, most modern processors use a security model. This model often uses levels of privilege known as rings. A normal program runs in a restricted area called userspace. In userspace, a program is limited to its own address space. This prevents it from modifying other programs or the operating system itself. It also stops the program from directly manipulating hardware devices like network cards. The operating system runs at the highest level of privilege. To perform a task, a program must trigger a system call to move control to the kernel. This is often done via an interrupt. An interrupt is a signal that tells the CPU to stop its current task. The CPU then enters an elevated privilege level and passes control to the kernel. The kernel decides if the request is safe. If it is, the kernel runs a specific set of instructions. Once finished, it returns the privilege level and control back to the original program.

Writing these requests directly is very difficult for programmers. Most systems use a library or an API to act as an intermediary. On Unix-like systems, this is usually the C library, also known as libc. On Windows NT, the API is part of the Native API. These libraries provide wrapper functions for the system calls. A wrapper function makes the system call more modular and easier to use. It follows a standard function calling convention. The primary job of the wrapper is to place arguments into the correct processor registers. It also sets a unique system call number for the kernel to recognize. Using a library increases portability across different systems. Without these libraries, a programmer would need to use complex assembly code. They would also need to know the low-level binary interface, which can change over time.

System calls can be organized into six major functional categories. Process control handles creating, executing, or terminating processes. File management includes tasks like creating, deleting, opening, or closing files. Device management allows a program to request or release hardware devices. Information maintenance involves getting or setting system data like the time or date. Communication calls allow processes to send and receive messages or connect to remote devices. Finally, protection calls manage file permissions. These categories ensure that every type of interaction with the computer is organized and controlled.

Different operating systems provide different numbers of system calls. The scale of these interfaces can vary greatly. For example, the Plan 9 operating system has only 54 system calls. Linux and OpenBSD each provide over 300 different calls. NetBSD has close to 500, while FreeBSD has over 500. Windows is much larger, with about 2000 system calls. These Windows calls are divided between the win32k graphical calls and the ntdll core calls. To study these calls, developers use special tools. Programs like strace, ftrace, and truss can report every system call a process makes. These tools can even attach to a running process to intercept its calls.

History shows how these mechanisms have evolved alongside hardware. In the early days of IBM's OS/360, system calls were implemented through assembly language macros. This was because programming in high-level languages was less common then. Modern systems have moved toward faster methods. On x86 architectures, Linux 2.5 began using fast instructions like SYSCALL and SYSRET. These were created by AMD and Intel to transfer control quickly. They avoid the extra overhead caused by traditional interrupts. Older methods included the "call gate," which allowed direct calls to kernel functions. However, this was less popular because it was harder to move code between different types of computers.

Finally, the way a system handles multiple tasks depends on its threading model. In a many-to-one model, one kernel thread handles all system calls for a process. This can be a problem because one slow call can freeze all other threads. The one-to-one model is more common in modern systems like macOS and Linux. In this model, every user thread gets its own kernel-level thread. This prevents one blocking call from stopping everything else. Some systems use a many-to-many model, which maps a pool of user threads to a pool of kernel threads. Other systems use a hybrid model that combines these different approaches.