System Calls

What is it: The mechanism by which user-space processes request privileged operations from the kernel: file I/O, network I/O, memory allocation, process creation.

Why not allow direct hardware access: User processes run in CPU ring 3 (unprivileged). Direct hardware access would be a security and stability violation — a buggy process could corrupt other processes' data or crash the machine. The kernel runs in ring 0. A syscall is the controlled gate: process issues syscall instruction → CPU switches to kernel mode → kernel validates and executes → result returned → CPU switches back to user mode.

sequenceDiagram participant U as User space (ring 3) participant K as Kernel space (ring 0) U->>K: syscall instruction (mode switch) Note over K: validate args, execute privileged operation K->>U: return result (mode switch back)

Cost: mode switch + argument validation + possible data copy from user to kernel buffer: ~100–500ns per syscall. Significant if called millions of times per second. Strategy: batch — one 64KB read() is faster than 64 × 1KB read().

Common syscalls: open/close (fd), read/write (I/O), mmap (memory), fork/execve (process), socket/connect/accept (network), epoll_* (event polling), futex (mutex), clone (thread creation).

Real-world usage: Go's runtime batches I/O via epoll — net.Conn.Read() doesn't call read() on every invocation; the netpoller coalesces many goroutines' I/O onto a small number of syscalls.

Worked example — why batching matters: copying a 64KB file one byte at a time means 65,536 read() calls; at ~300ns per syscall (mode switch + validation) that's about 20ms spent purely crossing the user/kernel boundary, before counting any actual disk or copy time — and each call also risks a full context switch if the scheduler decides to run something else while the calling thread is in kernel mode, which costs microseconds, not nanoseconds, and can dominate the total. Reading the same 64KB in one read() call pays that fixed cost exactly once. This is the concrete reason buffered I/O libraries (libc's fread, Go's bufio.Reader) exist: they accumulate data in a user-space buffer and only cross into the kernel when the buffer is empty or full, trading a small amount of extra copying for orders of magnitude fewer mode switches.