In computing, a system call (commonly abbreviated to syscall) is the programmatic way in which a
computer program requests a service from the
operating system on which it is executed. This may include hardware-related services (for example, accessing a
hard disk drive or accessing the device's camera), creation and execution of new
processes, and communication with integral
kernel service
This glossary of computer software terms lists the general terms related to computer software, and related fields, as commonly used in Wikipedia articles.
Glossary
See also
* Outline of computer programming
* Outline of softw ...
s such as
process scheduling. System calls provide an essential interface between a process and the operating system.
In most systems, system calls can only be made from
userspace
A modern computer operating system usually segregates virtual memory into user space and kernel space. Primarily, this separation serves to provide memory protection and hardware protection from malicious or errant software behaviour.
Kerne ...
processes, while in some systems,
OS/360 and successors for example, privileged system code also issues system calls.
Privileges
The
architecture
Architecture is the art and technique of designing and building, as distinguished from the skills associated with construction. It is both the process and the product of sketching, conceiving, planning, designing, and constructing buildings ...
of most modern processors, with the exception of some embedded systems, involves a
security model. For example, the ''
rings'' model specifies multiple privilege levels under which software may be executed: a program is usually limited to its own
address space
In computing, an address space defines a range of discrete addresses, each of which may correspond to a network host, peripheral device, disk sector, a memory cell or other logical or physical entity.
For software programs to save and retrieve s ...
so that it cannot access or modify other running programs or the operating system itself, and is usually prevented from directly manipulating hardware devices (e.g. the
frame buffer or
network devices).
However, many applications need access to these components, so system calls are made available by the operating system to provide well-defined, safe implementations for such operations. The operating system executes at the highest level of privilege, and allows applications to request services via system calls, which are often initiated via
interrupts. An interrupt automatically puts the CPU into some elevated privilege level and then passes control to the kernel, which determines whether the calling program should be granted the requested service. If the service is granted, the kernel executes a specific set of instructions over which the calling program has no direct control, returns the privilege level to that of the calling program, and then returns control to the calling program.
The library as an intermediary
Generally, systems provide a
library or
API
An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how ...
that sits between normal programs and the operating system. On
Unix-like systems, that API is usually part of an implementation of the
C library
The C standard library or libc is the standard library for the C programming language, as specified in the ISO C standard.ISO/ IEC (2018). '' ISO/IEC 9899:2018(E): Programming Languages - C §7'' Starting from the original ANSI C standard, it wa ...
(libc), such as
glibc, that provides
wrapper function
A wrapper function is a function (another word for a ''subroutine'') in a software library or a computer program whose main purpose is to call a second subroutine or a system call with little or no additional computation. Wrapper functions are ...
s for the system calls, often named the same as the system calls they invoke. On
Windows NT, that API is part of the
Native API
The Native API is a lightweight application programming interface (API) used by Windows NT and user mode applications. This API is used in the early stages of Windows NT startup process, when other components and APIs are still unavailable. Ther ...
, in the library; this is an undocumented API used by implementations of the regular
Windows API
The Windows API, informally WinAPI, is Microsoft's core set of application programming interfaces (APIs) available in the Microsoft Windows operating systems. The name Windows API collectively refers to several different platform implementations th ...
and directly used by some system programs on Windows. The library's wrapper functions expose an ordinary function
calling convention
In computer science, a calling convention is an implementation-level (low-level) scheme for how subroutines or functions receive parameters from their caller and how they return a result. When some code calls a function, design choices have b ...
(a
subroutine call on the
assembly
Assembly may refer to:
Organisations and meetings
* Deliberative assembly, a gathering of members who use parliamentary procedure for making decisions
* General assembly, an official meeting of the members of an organization or of their representa ...
level) for using the system call, as well as making the system call more
modular. Here, the primary function of the wrapper is to place all the arguments to be passed to the system call in the appropriate
processor registers (and maybe on the
call stack
In computer science, a call stack is a stack data structure that stores information about the active subroutines of a computer program. This kind of stack is also known as an execution stack, program stack, control stack, run-time stack, or ...
as well), and also setting a unique system call number for the kernel to call. In this way the library, which exists between the OS and the application, increases
portability.
The call to the library function itself does not cause a switch to
kernel mode and is usually a normal
subroutine call
In computer programming, a function or subroutine is a sequence of program instructions that performs a specific task, packaged as a unit. This unit can then be used in programs wherever that particular task should be performed.
Functions may ...
(using, for example, a "CALL" assembly instruction in some
Instruction set architecture
In computer science, an instruction set architecture (ISA), also called computer architecture, is an abstract model of a computer. A device that executes instructions described by that ISA, such as a central processing unit (CPU), is called an ' ...
s (ISAs)). The actual system call does transfer control to the kernel (and is more implementation-dependent and platform-dependent than the library call abstracting it). For example, in
Unix-like systems,
fork
and
execve
are C library functions that in turn execute instructions that invoke the
fork
and
exec
system calls. Making the system call directly in the
application code is more complicated and may require embedded assembly code to be used (in
C and
C++
C, or c, is the third letter in the Latin alphabet, used in the modern English alphabet, the alphabets of other western European languages and others worldwide. Its name in English is ''cee'' (pronounced ), plural ''cees''.
History
"C" ...
), as well as requiring knowledge of the low-level binary interface for the system call operation, which may be subject to change over time and thus not be part of the
application binary interface
In computer software, an application binary interface (ABI) is an interface between two binary program modules. Often, one of these modules is a library or operating system facility, and the other is a program that is being run by a user.
An ' ...
; the library functions are meant to abstract this away.
On
exokernel based systems, the library is especially important as an intermediary. On exokernels, libraries shield user applications from the very low level kernel
API
An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how ...
, and provide
abstractions
Abstraction in its main sense is a conceptual process wherein general rules and concepts are derived from the usage and classification of specific examples, literal ("real" or "concrete") signifiers, first principles, or other methods.
"An abs ...
and
resource
Resource refers to all the materials available in our environment which are technologically accessible, economically feasible and culturally sustainable and help us to satisfy our needs and wants. Resources can broadly be classified upon their ...
management.
IBM's
OS/360,
DOS/360 and
TSS/360
The IBM Time Sharing System TSS/360 is a discontinued early time-sharing operating system designed exclusively for a special model of the System/360 line of mainframes, the Model 67. Made available on a trial basis to a limited set of cust ...
implement most system calls through a library of assembly language
macros, although there are a few services with a call linkage. This reflects their origin at a time when programming in assembly language was more common than
high-level language usage. IBM system calls were therefore not directly executable by high-level language programs, but required a callable assembly language wrapper subroutine. Since then, IBM has added many services that can be called from high level languages in, e.g.,
z/OS and
z/VSE. In more recent release of
MVS/SP and in all later MVS versions, some system call macros generate Program Call (PC).
Examples and tools
On
Unix,
Unix-like and other
POSIX-compliant operating systems, popular system calls are
open
,
read
,
write
,
close
,
wait
,
exec
,
fork
,
exit
Exit(s) may refer to:
Architecture and engineering
* Door
* Portal (architecture), an opening in the walls of a structure
* Emergency exit
* Overwing exit, a type of emergency exit on an airplane
* Exit ramp, a feature of a road interchange
A ...
, and
kill
. Many modern operating systems have hundreds of system calls. For example,
Linux and
OpenBSD each have over 300 different calls,
NetBSD has close to 500,
FreeBSD has over 500, Windows has close to 2000, divided between win32k (graphical) and ntdll (core) system calls while
Plan 9 has 51.
Tools such as
strace,
ftrace
ftrace (Function Tracer) is a tracing framework for the Linux kernel. Although its original name, Function Tracer, came from ftrace's ability to record information related to various function calls performed while the kernel is running, ftra ...
and
truss allow a process to execute from start and report all system calls the process invokes, or can attach to an already running process and intercept any system call made by the said process if the operation does not violate the permissions of the user. This special ability of the program is usually also implemented with system calls such as
ptrace or system calls on files in
procfs.
Typical implementations
Implementing system calls requires a transfer of control from user space to kernel space, which involves some sort of architecture-specific feature. A typical way to implement this is to use a
software interrupt
In digital computers, an interrupt (sometimes referred to as a trap) is a request for the processor to ''interrupt'' currently executing code (when permitted), so that the event can be processed in a timely manner. If the request is accepted, ...
or
trap. Interrupts transfer control to the operating system
kernel
Kernel may refer to:
Computing
* Kernel (operating system), the central component of most operating systems
* Kernel (image processing), a matrix used for image convolution
* Compute kernel, in GPGPU programming
* Kernel method, in machine learni ...
, so software simply needs to set up some register with the system call number needed, and execute the software interrupt.
This is the only technique provided for many
RISC processors, but
CISC architectures such as
x86 support additional techniques. For example, the x86
instruction set contains the instructions
SYSCALL
/
SYSRET
and
SYSENTER
/
SYSEXIT
(these two mechanisms were independently created by
AMD
Advanced Micro Devices, Inc. (AMD) is an American multinational semiconductor company based in Santa Clara, California, that develops computer processors and related technologies for business and consumer markets. While it initially manufact ...
and
Intel, respectively, but in essence they do the same thing). These are "fast" control transfer instructions that are designed to quickly transfer control to the kernel for a system call without the overhead of an interrupt.
Linux 2.5 began using this on the
x86, where available; formerly it used the
INT
instruction, where the system call number was placed in the
EAX
register before
interrupt 0x80 was executed.
An older mechanism is the
call gate
A call gate is a mechanism in Intel's x86 architecture for changing the privilege level of a process when it executes a predefined function call using a CALL FAR instruction.
Overview
Call gates are intended to allow less privileged code to cal ...
; originally used in
Multics
Multics ("Multiplexed Information and Computing Service") is an influential early time-sharing operating system based on the concept of a single-level memory.Dennis M. Ritchie, "The Evolution of the Unix Time-sharing System", Communications of t ...
and later, for example, see
call gate
A call gate is a mechanism in Intel's x86 architecture for changing the privilege level of a process when it executes a predefined function call using a CALL FAR instruction.
Overview
Call gates are intended to allow less privileged code to cal ...
on the Intel
x86. It allows a program to call a kernel function directly using a safe control transfer mechanism, which the operating system sets up in advance. This approach has been unpopular on x86, presumably due to the requirement of a far call (a call to a procedure located in a different segment than the current code segment) which uses
x86 memory segmentation and the resulting lack of
portability it causes, and the existence of the faster instructions mentioned above.
For
IA-64 architecture,
EPC
(Enter Privileged Code) instruction is used. The first eight system call arguments are passed in registers, and the rest are passed on the stack.
In the
IBM System/360
The IBM System/360 (S/360) is a family of mainframe computer systems that was announced by IBM on April 7, 1964, and delivered between 1965 and 1978. It was the first family of computers designed to cover both commercial and scientific applica ...
mainframe family, and its successors, a
Supervisor Call instruction (), with the number in the instruction rather than in a register, implements a system call for legacy facilities in most of IBM's own operating systems, and for all system calls in Linux. In later versions of MVS, IBM uses the Program Call (PC) instruction for many newer facilities. In particular, PC is used when the caller might be in
Service Request Block (SRB) mode.
The
PDP-11
The PDP-11 is a series of 16-bit minicomputers sold by Digital Equipment Corporation (DEC) from 1970 into the 1990s, one of a set of products in the Programmed Data Processor (PDP) series. In total, around 600,000 PDP-11s of all models were sold ...
minicomputer used the and instructions, which, similar to the IBM System/360 and x86 , put the code in the instruction; they generate interrupts to specific addresses, transferring control to the operating system. The
VAX 32-bit successor to the PDP-11 series used the , , and instructions to make system calls to privileged code at various levels; the code is an argument to the instruction.
Categories of system calls
System calls can be grouped roughly into six major categories:
:
# Process control
#* create process (for example,
fork
on Unix-like systems, or
NtCreateProcess
in the
Windows NT Native API
The Native API is a lightweight application programming interface (API) used by Windows NT and user mode applications. This API is used in the early stages of Windows NT startup process, when other components and APIs are still unavailable. Ther ...
)
#*
terminate process
#*
load
Load or LOAD may refer to:
Aeronautics and transportation
*Load factor (aeronautics), the ratio of the lift of an aircraft to its weight
*Passenger load factor, the ratio of revenue passenger miles to available seat miles of a particular transpo ...
,
execute
#* get/set process attributes
#*
wait for time, wait event,
signal event
#*
allocate and
free memory
# File management
#* create file, delete file
#* open, close
#* read, write, reposition
#* get/set file attributes
# Device management
#* request device, release device
#* read, write, reposition
#* get/set device attributes
#* logically attach or detach devices
# Information maintenance
#* get/set total system information (including time, date, computer name, enterprise etc.)
#* get/set process, file, or device metadata (including author, opener, creation time and date, etc.)
# Communication
#* create, delete communication connection
#* send, receive messages
#* transfer status information
#* attach or detach remote devices
#Protection
#*get/set file permissions
Processor mode and context switching
System calls in most
Unix-like systems are processed in
kernel mode, which is accomplished by changing the processor execution mode to a more privileged one, but no ''process''
context switch
In computing, a context switch is the process of storing the state of a process or thread, so that it can be restored and resume execution at a later point, and then restoring a different, previously saved, state. This allows multiple processes ...
is necessary although a ''privilege'' context switch does occur. The hardware sees the world in terms of the execution mode according to the processor
status register, and processes are an abstraction provided by the operating system. A system call does not generally require a context switch to another process; instead, it is processed in the context of whichever process invoked it.
[Bach, Maurice J. (1986), ''The Design of the UNIX Operating System'', Prentice Hall, pp. 15–16.]
In a
multithreaded process, system calls can be made from multiple
threads. The handling of such calls is dependent on the design of the specific operating system kernel and the application runtime environment. The following list shows typical models followed by operating systems:
* ''Many-to-one'' model: All system calls from any user thread in a process are handled by a single kernel-level thread. This model has a serious drawback any blocking system call (like awaiting input from the user) can freeze all the other threads. Also, since only one thread can access the kernel at a time, this model cannot utilize multiple cores of processors.
* ''One-to-one'' model: Every user thread gets attached to a distinct kernel-level thread during a system call. This model solves the above problem of blocking system calls. It is found in all major
Linux distribution
A Linux distribution (often abbreviated as distro) is an operating system made from a software collection that includes the Linux kernel and, often, a package management system. Linux users usually obtain their operating system by downloading one ...
s,
macOS,
iOS
iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that powers many of the company's mobile devices, including the iPhone; the term also includes ...
, recent
Windows and
Solaris versions.
* ''Many-to-many'' model: In this model, a pool of user threads is mapped to a pool of kernel threads. All system calls from a user thread pool are handled by the threads in their corresponding kernel
thread pool.
* ''Hybrid'' model: This model implements both many to many and one to one models depending upon the choice made by the kernel. This is found in old versions of
IRIX,
HP-UX and
Solaris.
See also
*
Linux kernel API
*
VDSO
vDSO (virtual dynamic shared object) is a kernel mechanism for exporting a carefully selected set of kernel space routines to user space applications so that applications can call these kernel space routines in-process, without incurring the per ...
Notes
References
External links
A list of modern Unix-like system callsInteractive Linux kernel mapwith main API functions and structures
PDFversion
system calls for
Linux kernel 2.2, with
IA-32 calling convention
In computer science, a calling convention is an implementation-level (low-level) scheme for how subroutines or functions receive parameters from their caller and how they return a result. When some code calls a function, design choices have b ...
s
How System Calls Work on Linux/i86(1996, based on the 1993 0.99.2 kernel)
(2006)
''Kernel command using Linux system calls'' IBM developerWorks
* Choudhary, Amit
HOWTO for Implementing a System Call on Linux 2.6* Jorrit N. Herder, Herbert Bos, Ben Gras, Philip Homburg, and Andrew S. Tanenbaum
Modular system programming on Minix 3 '';login:'' 31, no. 2 (April 2006); 19–28, accessed 5 March 2018
A simple open Unix Shell in C languageexamples on System Calls under Unix
Windows NT Native API
The Native API is a lightweight application programming interface (API) used by Windows NT and user mode applications. This API is used in the early stages of Windows NT startup process, when other components and APIs are still unavailable. Ther ...
, including system calls
* Gulbrandsen, John
''System Call Optimization with the SYSENTER Instruction'' CodeGuru.com, 8 October 2004
{{DEFAULTSORT:System Call
Operating system technology
Application programming interfaces