Understanding System Calls, APIs, and Their Relationship in Linux

In a computer, a system call (also called a system service) is a request made by a user‑space program to the operating‑system kernel for services that require higher privileges. System calls form the interface between user programs and the OS, handling tasks such as device I/O and inter‑process communication.

1. Introduction

Why can't user programs directly access kernel services?

Linux separates execution space into kernel space and user space (kernel mode and user mode). They are logically isolated, so user programs cannot access kernel data or functions. When a user process needs kernel services, it must use a system call, which is the only way for user space to reach kernel space.

What is a system call?

A system call is a special interface that allows a user process to enter the kernel. It specifies the entry point for the process, and the kernel then dispatches the appropriate service routine (e.g., sys_getpid() for the getpid call). The typical flow is: user process → system call → kernel → return to user space.

The steps are:

Program execution moves from user space to kernel space.

After handling, control returns to user space.

What is an API?

An Application Programming Interface (API) is a set of functions that programmers can call directly from user space, such as read() , malloc() , free() , etc. APIs describe how to obtain a service but are not necessarily tied to the kernel.

Difference between API and system call

An API is a function definition that may or may not involve the kernel, while a system call is a kernel‑level request triggered via a software interrupt. Some APIs wrap system calls; others are purely user‑space utilities.

例如: 在内核中实现了write系统调用。

In the C library, the write API is implemented by mapping to the underlying kernel system call.

2. System Calls

The OS manages all computer resources and provides system calls as a special interface for applications to request services such as memory allocation, process creation, and inter‑process communication.

Linux system calls are the API that lets user‑level programs enter the kernel. They enable operations like opening files, reading/writing data, and controlling hardware.

Why can’t user programs directly access kernel services? Because it would be unsafe and would break the isolation between user and kernel modes.

In embedded systems without an OS, code can manipulate hardware registers directly, but when an OS is present, resource management is delegated to the kernel, requiring system calls for safe access.

Linux provides roughly 250 system calls, grouped into categories such as process control, IPC, file system, memory management, networking, sockets, and user management.

3. User Programming Interface (API) – C Library

Application code typically uses the C library (libc) rather than invoking system calls directly. Library functions may wrap one or more system calls or perform entirely user‑space work.

Examples:

fopen internally calls the open system call.

fread uses the read system call.

fwrite uses the write system call.

Library functions provide better portability, caching, and convenience compared to raw system calls.

3.1 System Commands

Each system command is an executable program that ultimately invokes system calls. Commands for regular users reside in /bin , while administrative commands are in /sbin .

3.2 Kernel Functions

Kernel functions implement the actual work of a system call. They follow kernel‑specific conventions (e.g., names prefixed with sys_ and the asmlinkage qualifier).

4. Example of a Standard C Program

Typical flow:

The C program calls the API function printf .

printf triggers the write system call.

The return value from write is passed back to the user program.

4.1 Operating‑System Modes

(1) Dual Mode

Modern computers have at least two execution modes:

User mode : runs user code.

Kernel mode : runs OS code.

The purpose is to ensure correct OS operation, typically indicated by a hardware mode bit (0 = kernel, 1 = user).

(2) Mode Switching

When a system call occurs, the CPU switches from user mode to kernel mode via a trap mechanism.

4.2 Implementation Mechanism of System Calls

System calls are invoked through a software interrupt (trap) that saves the user context, jumps to a kernel entry point, executes the corresponding kernel function, and then restores the user context before returning.

Overall, both system calls and library functions are C functions from the programmer's perspective; the distinction lies in where they execute and how they are implemented.