System Calls & the Kernel
The problem
A program needs to do privileged things — read a file, open a network socket, allocate memory — that it cannot be trusted to do directly, because a bug or malicious program could otherwise damage other processes or the machine itself. There has to be a controlled gate between untrusted programs and the hardware they run on.
Why now
File systems and I/O, and virtual memory, both quietly assumed 'the OS mediates access' without explaining the actual mechanism. System calls are that mechanism: the one narrow, controlled doorway through which a normal program requests anything privileged from the kernel.
Mental model
Ordinary code runs in user mode with restricted privileges; the kernel runs in privileged mode with full hardware access. A system call is a deliberate, controlled jump from user mode into the kernel to ask it to do something on your behalf — open a file, send a packet — after which control returns to user mode. Every 'privileged' action in a program is secretly one of these controlled jumps.
Requires
- Processes & ThreadsOperating Systems
System calls are made by a process to request kernel services on its behalf; the process/kernel boundary they cross is only meaningful once processes and their isolation are already understood.
Helps
- File Systems & I/OOperating Systems
File I/O is one of the clearest, most common examples of a system call in action — open, read, and write are all system calls — making it a natural concrete anchor for the abstract concept.
Unlocks
Used in
- Every file, network, and process operation a program performs, under the hood
- strace/dtrace tools that let you observe exactly which system calls a program makes
- Container technology (namespaces, cgroups) which works by intercepting and restricting system calls
- Understanding the performance cost of a 'context switch' into kernel mode
Projects
- Use strace (Linux) or an equivalent tool to trace the system calls made by a simple program (e.g. cat a file) and identify open/read/write/close
- Explain, from the system call trace, exactly what a one-line file-reading program actually does at the OS level
Examples
- console.log ultimately triggers a write() system call to output a file descriptor
- Opening a network connection is a socket() system call followed by connect()
Resources
- System Calls — MIT 6.033course
Mastery checklist
- I can explain the difference between user mode and kernel mode
- I can explain what a system call is and why it's necessary
- I can use a tracing tool to observe the system calls a simple program makes
- I can name three common system calls and what each is used for