The Operating-System Interface

a system call

/ syscall: SIS-call /

Imagine you are a guest in a hotel and you want something only the staff can do for you - get into the locked supply room, charge something to the building's account, open the rooftop door. You do not break in; you pick up the phone and dial the front desk, which has the authority you lack. A system call is your program dialing the kernel's front desk to request an operation it is not allowed to perform itself.

Precisely: a system call is the mechanism by which a user-mode program asks the kernel to perform a privileged operation on its behalf. Reading a file, allocating more memory from the OS, creating a new process, sending data over the network - all of these touch hardware or shared resources, so the program cannot do them in user mode. Instead it sets up its request (a number identifying which service it wants, plus arguments) and executes a special instruction that traps into the kernel. The kernel checks that the request is allowed, does the work in kernel mode, places a result where the program can read it, and returns control to user mode. From the program's side it looks almost like an ordinary function call - read(fd, buf, n) - but underneath, a controlled mode switch happened.

Why it matters: the system call is the single doorway between every program and the operating system. Almost everything a program ultimately does with the outside world goes through one. Knowing this lets you reason about cost (each call crosses the user/kernel boundary, which is not free), about security (the kernel validates every request), and about portability (the exact set of system calls is part of what defines a platform). When people say a program 'talks to the OS,' they almost always mean it makes system calls.

To read a file, a program performs the open() system call (get a file descriptor), then the read() system call (copy bytes from the kernel into the program's buffer), then close(). Each of those is a separate trip into the kernel.

open / read / close are three distinct system calls - three boundary crossings.

Not every C function is a system call. printf() and malloc() are library functions that may make zero, one, or several system calls under the hood; many library calls do their work entirely in user mode without ever entering the kernel.

Also called
syscallkernel call系統調用