What is a system call, and what are user mode and kernel mode?

Question

IT Interview Practice · Accepted Answer

A **system call (syscall)** is the mechanism a user-space program uses to request a service from the kernel — opening a file, sending network data, allocating memory, creating a process. Because these actions touch hardware or affect other processes, only the **kernel** may perform them, so a syscall deliberately crosses the protection boundary.

## User mode vs kernel mode

The CPU runs in one of (at least) two privilege levels:

```text
 user mode   → restricted: no direct hardware access, no privileged instructions
 kernel mode → full access: hardware, all memory, privileged CPU instructions
```

A normal function call stays in user mode. A syscall performs a controlled **mode switch** into kernel mode, runs trusted kernel code, then returns:

```text
  user code            kernel
  ─────────            ──────
  read(fd, buf, n)
      │  trap (syscall instruction)
      └──────────────▶ enter kernel mode
                       validate args, do the I/O
      ◀────────────── return value, back to user mode
  continue
```

## How it works in practice

You rarely write the trap yourself — the C library wraps it. `fopen`/`fread` in your code eventually call the `open`/`read` syscalls:

```c
// glibc's read() places the syscall number + args in registers,
// then executes a trap instruction (e.g. `syscall` on x86-64).
ssize_t n = read(fd, buffer, 4096);   // → traps into the kernel
```

The trap (a software interrupt / dedicated instruction) is what changes the privilege level safely — user code can't just "jump into" the kernel; it can only enter at defined syscall entry points that validate their arguments.

## Why it matters

The user/kernel split is the foundation of OS security and stability: it's why one process can't scribble on hardware or another process's memory. Understanding syscalls also explains performance — each one costs a mode switch (hundreds of nanoseconds), which is why batching I/O or using `mmap`/`io_uring` to reduce syscall count matters, and why `strace` (which lists a program's syscalls) is such a powerful debugging tool.

User mode vs kernel mode

How it works in practice

Why it matters

Related questions