Home/Learn/Operating Systems/System Calls & Kernel Mode

System Calls & Kernel Mode

Intermediate

I/O & Kernel

System calls are the controlled interface through which user-space programs request privileged kernel services, requiring a CPU mode switch from user mode to kernel mode.

Overview

Modern CPUs operate in privilege rings (Ring 0 = kernel, Ring 3 = user on x86). User processes cannot directly access hardware, modify page tables, or call kernel functions — they must use system calls. A system call triggers a software interrupt (INT 0x80 on older x86) or the syscall instruction, which atomically switches the CPU to kernel mode, saves user registers, and jumps to the kernel's system call handler. The handler validates arguments, performs the operation, and returns to user space. This mode switch costs ~100–1000 ns. Java's I/O, memory allocation, thread creation, and networking all ultimately invoke system calls. Understanding this is key to diagnosing performance bottlenecks in Java applications.

System Call Categories and Java Mapping

System calls are grouped into five categories: process control (fork, exec, exit, wait), file management (open, read, write, close, stat), device management (ioctl, read, write on device files), information maintenance (getpid, alarm, sleep), and inter-process communication (pipe, shmget, socket, send, recv).

Java — System call mappings for common Java operations

// Java I/O ultimately triggers OS system calls
// Every FileInputStream.read() call eventually invokes sys_read

// You can observe this with strace on Linux:
//   strace -e trace=read,write,open java MyProgram

import java.io.*;
import java.nio.file.*;

// FileInputStream.read() → native method → sys_read(fd, buf, count)
try (var fis = new FileInputStream("/tmp/data.txt")) {
    byte[] buf = new byte[1024];
    int n = fis.read(buf);  // → JNI → sys_read() system call
    System.out.println("Read " + n + " bytes");
}

// Files.createFile() → sys_open(path, O_CREAT | O_WRONLY, mode)
Path p = Path.of("/tmp/newfile.txt");
Files.createFile(p);  // → sys_open / sys_creat system call

// Thread.start() → eventually → sys_clone() (Linux) / CreateThread (Windows)
Thread t = new Thread(() -> System.out.println("PID: " +
    ProcessHandle.current().pid())); // getpid() system call
t.start();

// InetSocketAddress / ServerSocket → sys_socket, sys_bind, sys_listen
// Socket.connect() → sys_connect
// Socket.accept() → sys_accept

// ProcessHandle.current().pid() → sys_getpid()
long pid = ProcessHandle.current().pid();
System.out.println("JVM PID: " + pid);

// System.currentTimeMillis() → sys_gettimeofday / clock_gettime
long now = System.currentTimeMillis();

Mode Switch Overhead and Profiling

Each system call incurs a mode switch (~100-1000 ns), TLB flush on some architectures, and kernel stack setup. Batching I/O (BufferedInputStream, writev) reduces system call frequency. Java's async-profiler and JFR can identify hot system calls. On Linux, perf stat shows syscall counts.

Java — System call overhead and buffered I/O comparison

import java.io.*;
import java.nio.*;
import java.nio.channels.*;
import java.nio.file.*;

// SLOW: unbuffered — one sys_read() per byte
try (var raw = new FileInputStream("/tmp/bigfile.txt")) {
    int b;
    long count = 0;
    while ((b = raw.read()) != -1) count++; // thousands of syscalls!
    System.out.println("Bytes (slow): " + count);
}

// FAST: buffered — one sys_read() per 8KB buffer
try (var buf = new BufferedInputStream(new FileInputStream("/tmp/bigfile.txt"), 8192)) {
    int b;
    long count = 0;
    while ((b = buf.read()) != -1) count++; // far fewer syscalls
    System.out.println("Bytes (fast): " + count);
}

// FASTEST for large files: NIO FileChannel with direct buffer
try (FileChannel fc = FileChannel.open(Path.of("/tmp/bigfile.txt"))) {
    ByteBuffer direct = ByteBuffer.allocateDirect(65536); // off-heap, no copy
    long total = 0;
    while (fc.read(direct) > 0) {  // sys_read with large buffer
        total += direct.position();
        direct.clear();
    }
    System.out.println("Bytes (NIO): " + total);
}

// Profiling tip: count syscalls on Linux
// $ strace -c -p <JVM_PID>   → syscall counts and time
// $ perf stat -e syscalls:sys_enter_read java MyProgram
// async-profiler: ./profiler.sh -e syscall -d 10 -f flame.html <pid>

Key Points to Remember

1System calls are the only legal way for user-space programs to request kernel services; direct kernel access is forbidden.
2A mode switch (user → kernel → user) costs ~100–1000 ns; minimising unnecessary system calls improves performance.
3Buffered I/O (BufferedInputStream) reduces system call frequency by batching reads into large kernel buffer requests.
4Java's FileInputStream, Thread.start(), and Socket operations all eventually invoke OS system calls via JNI.
5ProcessHandle.current().pid() maps to getpid(); Files.createFile() maps to open() with O_CREAT.
6strace on Linux and dtrace on macOS reveal exactly which system calls a Java application makes.

Interview Questions

What is the difference between user mode and kernel mode?

EasyAmazon

Why is a system call more expensive than a regular function call?

MediumGoogle

How does Java's BufferedInputStream reduce system call overhead?

MediumFlipkart

Trace the path of a Java FileInputStream.read() call all the way down to the disk hardware.

HardNetflix

Ask Aria about System Calls & Kernel Mode

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

Disk Scheduling Algorithms

Memory-Mapped I/O & Files