What is a System Call?
System calls explained — the user-to-kernel mode switch, categories, and a real file I/O code example for OS interview prep.
Expected Interview Answer
A system call is the controlled interface a user-space program uses to request a privileged service from the operating system kernel, such as reading a file, allocating memory, or creating a process.
Applications run in unprivileged user mode and cannot directly touch hardware or protected kernel data structures, so whenever a program needs something only the kernel can safely do, it executes a special trap instruction that switches the CPU into kernel mode and jumps to a fixed entry point in the kernel. The kernel validates the request, performs the privileged work such as talking to a disk driver or updating a process table, and then returns control and a result back to user mode. Common categories include process control (fork, exec, exit), file management (open, read, write, close), device management, information maintenance, and communication (pipes, sockets). Libraries like glibc wrap raw system calls in friendlier functions, but the underlying mechanism is always this controlled mode switch.
- Provides a safe, controlled boundary between user programs and hardware
- Lets the kernel enforce permissions and resource limits
- Standardizes access to files, processes, memory, and devices
- Enables portability since programs call a stable interface, not raw hardware
AI Mentor Explanation
A player cannot walk into the umpires’ room and change the scoreboard themselves; they must formally appeal to the umpire, who alone has the authority to make that change. The appeal is like a system call — the player (user program) cannot act directly, so it requests the umpire (kernel) to perform the privileged action on its behalf. Once the umpire rules, control returns to play with the result applied.
Step-by-Step Explanation
Step 1
User-mode request
A program calls a library function (like read()) that wraps a system call and prepares the arguments.
Step 2
Trap into kernel mode
A special instruction (e.g. syscall/int 0x80) switches the CPU from user mode to kernel mode.
Step 3
Kernel handles the request
The kernel validates arguments and permissions, then performs the privileged operation such as disk I/O.
Step 4
Return to user mode
The kernel places a result/error code, switches back to user mode, and execution resumes after the call.
What Interviewer Expects
- Clear explanation of the user mode to kernel mode switch
- At least one concrete example (open, read, fork, exec)
- Understanding that libraries like glibc wrap raw syscalls
- Awareness that syscalls are the boundary the kernel uses to enforce security and permissions
Common Mistakes
- Confusing a system call with a regular function call
- Not mentioning the user-mode-to-kernel-mode privilege switch
- Thinking every library function is itself a system call
- Forgetting that system calls have overhead due to the mode switch
Best Answer (HR Friendly)
“A system call is how a normal program asks the operating system to do something it is not allowed to do on its own, like reading a file or creating a new process. The program hands off the request, the kernel does the privileged work safely, and then control comes back to the program with the result.”
Code Example
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
int main(void) {
/* open(), write(), and close() are thin wrappers around
real system calls: each one traps into the kernel. */
int fd = open("greeting.txt", O_CREAT | O_WRONLY | O_TRUNC, 0644);
if (fd < 0) { perror("open"); return 1; }
const char *msg = "Hello from a system call\n";
ssize_t written = write(fd, msg, 25); /* kernel writes to disk */
if (written < 0) { perror("write"); }
close(fd); /* kernel releases the file descriptor */
printf("Wrote %zd bytes via system calls\n", written);
return 0;
}Follow-up Questions
- What is the difference between user mode and kernel mode?
- How does a library function like printf relate to underlying system calls?
- What is the overhead cost of a system call and why does it matter for performance?
- What is the difference between a system call and a software interrupt?
MCQ Practice
1. A system call causes the CPU to switch from?
A system call traps the CPU from unprivileged user mode into privileged kernel mode to perform the request.
2. Which of these is a classic system call category?
Process control (fork, exec, exit) is one of the standard system call categories alongside file and device management.
3. Why do system calls have overhead compared to normal function calls?
Trapping into the kernel and back involves a costly mode switch that a regular user-space function call does not need.
Flash Cards
What is a system call? — The controlled interface user programs use to request privileged kernel services.
What triggers the kernel mode switch? — A special trap instruction, like syscall or int 0x80.
Name two system call categories. — Process control (fork/exec) and file management (open/read/write/close).
Why do system calls cost more than function calls? — They require a privilege-level mode switch between user and kernel mode.