A system call is a controlled entry point from a program into the operating-system kernel. It lets an application request work that requires kernel privileges, such as reading a file. The transition and the kernel’s handling add overhead, but there is no universal time cost: it depends on the processor, operating system, configuration, and the operation being requested.
What is a system call?
Linux’s system-call introduction describes a system call as “an entry point into the Linux kernel.” It is an interface between an application and the kernel, not simply an ordinary function call.
As an Amazon Associate I earn from qualifying purchases.
Applications typically use a library function such as read(). A C library wrapper prepares the request according to the system’s application binary interface (ABI), enters the kernel, and returns a result to the program. The wrapper may also translate a kernel error into the familiar return value of -1 and set errno. The Linux system-call reference describes system calls as the fundamental interface between applications and the kernel.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A library function does not always correspond to exactly one system call: a wrapper can do preprocessing or postprocessing, and an API’s behavior depends on its implementation. Nor does calling a system call necessarily mean the program will wait for a device or file operation to finish; that depends on the request and its circumstances.
#1 Best Overall
What happens when a program makes one?
- The program requests an operation. It usually calls a library function, passing arguments such as a file descriptor and a buffer.
- The wrapper prepares the request. It supplies the system-call number and arguments in the locations required by the relevant ABI.
- The processor enters the kernel. An architecture-specific mechanism transfers control from user mode to privileged kernel code.
- The kernel handles the request. It dispatches the system call and performs the requested work, subject to permissions and the operation’s state.
- The kernel returns control. It prepares the return path, hands back a result or error, and resumes user code.
The precise entry and return sequence varies with architecture and kernel configuration. Linux’s entry and exit documentation notes that transitions between execution domains require ordered state updates; the documented paths can also include tracing, auditing, signal handling, or task work.
Why does a system call take time?
The protected boundary has work on both sides
The transition is more involved than executing an ordinary function call within the same program. The processor transfers control through a protected mechanism, and the kernel establishes or preserves state needed to handle the request safely. The return path must also restore the appropriate state and resume user execution. The instruction, registers, and argument layout depend on the architecture and ABI; the syscall(2) manual documents those differences.
The requested operation may cost more than entering the kernel
After entry, the kernel still has to perform the requested work. A small operation may be dominated by boundary overhead; a call that blocks or waits for filesystem or device activity can take much longer. Those are distinct costs: a minimal entry/exit benchmark measures the boundary, while a real operation includes its own kernel work and any waiting.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteConfiguration and security mitigations can change the path
Kernel build options, tracing, auditing, processor features, and security mitigations all affect the path. Linux’s Page Table Isolation (PTI) documentation explains that, where PTI applies, page-table register changes are needed on syscall, interrupt, and exception entry and exit. It also describes how PCID support can reduce the cost of page-table switching. These are PTI-specific implementation details, not a fixed surcharge for every system call.
How much overhead does a system call add?
There is no reliable universal time-per-call figure in the cited evidence. A useful comparison comes from a paper presented at the USENIX Annual Technical Conference in 2022: in its evaluation, standard system-call invocation entry and exit took 28 times as long as a function call and return; with PTI enabled in that comparison, it took 52 times as long. These are ratios from that paper’s setup, not nanosecond measurements that can be applied to every processor, kernel, or operation. See “Reducing system call overhead,” USENIX ATC 2022.
For a meaningful measurement, identify the processor and architecture, kernel version and configuration, mitigation state, measurement method, and exact operation. State whether the result isolates entry and exit or includes the work performed by the call. A blocking operation can also involve scheduling or external I/O latency, so its total time should not be presented as the cost of crossing the boundary alone.
Is every system call a process context switch?
No. A system call crosses from user execution into privileged kernel execution and back; that alone does not mean the scheduler switched the CPU to a different process. A task may be scheduled out if an operation blocks or another scheduling event occurs, but that is separate from the basic syscall boundary.
Can an application reduce system-call overhead?
First look at the workload: if an application makes many small, repetitive requests, reducing unnecessary calls or combining work may lower the number of boundary crossings. For I/O-heavy applications, batching or asynchronous interfaces can help amortize overhead when their semantics fit the task. The USENIX paper discusses batched calls and io_uring, while noting that specialized approaches are not general replacements for arbitrary synchronous system calls.
Calling the raw system-call interface is not automatically a speed fix. The ABI is architecture-specific, and bypassing a library wrapper means handling its details and error conventions directly. The Linux syscall(2) documentation outlines these differences. Choose a specialized or lower-level interface only when it supports the operation and ordering behavior the application actually needs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
