System call

A system call, often called a syscall, is a programmatic request for service. It is how a computer program asks the operating system to perform specific tasks. Programs cannot always do everything on their own. They may need to access hardware like a hard disk drive or a camera. They might need to create new processes or communicate with the kernel. The kernel is the core part of the operating system that manages everything. System calls provide the essential interface between a running process and this kernel.

To keep computers safe, most modern processors use a security model. This model often uses levels of privilege known as rings. A normal program runs in a restricted area called userspace. In userspace, a program is limited to its own address space. This prevents it from modifying other programs or the operating system itself. It also stops the program from directly manipulating hardware devices like network cards. The operating system runs at the highest level of privilege. To perform a task, a program must trigger a system call to move control to the kernel. This is often done via an interrupt. An interrupt is a signal that tells the CPU to stop its current task. The CPU then enters an elevated privilege level and passes control to the kernel. The kernel decides if the request is safe. If it is, the kernel runs a specific set of instructions. Once finished, it returns the privilege level and control back to the original program.

Writing these requests directly is very difficult for programmers. Most systems use a library or an API to act as an intermediary. On Unix-like systems, this is usually the C library, also known as libc. On Windows NT, the API is part of the Native API. These libraries provide wrapper functions for the system calls. A wrapper function makes the system call more modular and easier to use. It follows a standard function calling convention. The primary job of the wrapper is to place arguments into the correct processor registers. It also sets a unique system call number for the kernel to recognize. Using a library increases portability across different systems. Without these libraries, a programmer would need to use complex assembly code. They would also need to know the low-level binary interface, which can change over time.

System calls can be organized into six major functional categories. Process control handles creating, executing, or terminating processes. File management includes tasks like creating, deleting, opening, or closing files. Device management allows a program to request or release hardware devices. Information maintenance involves getting or setting system data like the time or date. Communication calls allow processes to send and receive messages or connect to remote devices. Finally, protection calls manage file permissions. These categories ensure that every type of interaction with the computer is organized and controlled.

Different operating systems provide different numbers of system calls. The scale of these interfaces can vary greatly. For example, the Plan 9 operating system has only 54 system calls. Linux and OpenBSD each provide over 300 different calls. NetBSD has close to 500, while FreeBSD has over 500. Windows is much larger, with about 2000 system calls. These Windows calls are divided between the win32k graphical calls and the ntdll core calls. To study these calls, developers use special tools. Programs like strace, ftrace, and truss can report every system call a process makes. These tools can even attach to a running process to intercept its calls.

History shows how these mechanisms have evolved alongside hardware. In the early days of IBM's OS/360, system calls were implemented through assembly language macros. This was because programming in high-level languages was less common then. Modern systems have moved toward faster methods. On x86 architectures, Linux 2.5 began using fast instructions like SYSCALL and SYSRET. These were created by AMD and Intel to transfer control quickly. They avoid the extra overhead caused by traditional interrupts. Older methods included the "call gate," which allowed direct calls to kernel functions. However, this was less popular because it was harder to move code between different types of computers.

Finally, the way a system handles multiple tasks depends on its threading model. In a many-to-one model, one kernel thread handles all system calls for a process. This can be a problem because one slow call can freeze all other threads. The one-to-one model is more common in modern systems like macOS and Linux. In this model, every user thread gets its own kernel-level thread. This prevents one blocking call from stopping everything else. Some systems use a many-to-many model, which maps a pool of user threads to a pool of kernel threads. Other systems use a hybrid model that combines these different approaches.