System Calls

What is a syscall?

System calls allow the kernel to carefully expose certain key pieces of functionality to user programs, such as accessing the file system, creating and destroying processes, communicating with other processes, and allocating more memory.

A system call is a C procedure call, the change of mode is achieved by special instructions hidden inside:

• trap instruction: enter kernel mode.
• return-from-trap instruction: back to user program in user mode.

Commonly Used Syscalls

Early Unix systems exposed around twenty calls, but there are over 400+ system calls in the modern Linux kernel. The exact number varies by architecture (x86_64 has about 350).

Tier 1: The "Everyday" Calls (Highest Frequency)

These syscalls account for 90% of total system activity. Most are called thousands of times per second in nearly every application.

Category	High-Frequency Syscalls	Description
File I/O	read, write, close, fstat, lseek	The core of all data movement and file descriptor management.
Memory	mmap, munmap, mprotect, brk	Handling process memory, loading libraries, and heap allocation.
Polling	poll, select, epoll_wait, futex	Waiting for events on file descriptors or managing thread synchronization.
Signals	rt_sigprocmask, rt_sigaction, rt_sigreturn	Managing software interrupts and signal handling.
Info	getpid, gettimeofday, clock_gettime	Fetching basic process IDs and timestamps.

Note: gettimeofday and clock_gettime are often optimized via vDSO, allowing them to run in user-space without a full kernel transition.

Tier 2: The "Setup & Control" Calls (Medium Frequency)

These are called frequently but usually during initialization, periodic checks, or process transitions.

Category	Common Syscalls	Description
Process	execve, clone (fork), wait4, exit_group	Starting, managing, and terminating processes/threads.
File Meta	openat, stat, access, getdents64	Opening files and listing directory contents.
Network	socket, connect, sendto, recvfrom, bind	Standard BSD socket operations for internet/local communication.
Descriptor	fcntl, ioctl, dup2, pipe	Fine-tuning file descriptors and inter-process communication.
Permissions	getuid, geteuid, getgid, capget	Checking user identities and process capabilities.

Tier 3: The "Utility" Calls (Lower Frequency)

These are used by specific tools (like ls, chmod, or top) or during specific system events.

Category	Utility Syscalls	Description
FileSystem	mkdir, chdir, rename, unlink, chmod, mount	Altering the file system structure or permissions.
Time	nanosleep, alarm, setitimer	Putting processes to sleep for specific intervals.
System Info	uname, sysinfo, getrusage	Retrieving kernel versions and resource usage stats.
Identity	setuid, setgid, setpriority, setsid	Changing process priority or user ownership.

Tier 4: The "Niche" Calls (Rare Frequency)

These are highly specialized and rarely seen in standard application code.

Category	Specialized Syscalls	Description
Security	ptrace, seccomp, bpf, keyctl	Debugging (strace/gdb), sandboxing, and eBPF tracing.
Modules	init_module, delete_module, finit_module	Loading and unloading Linux kernel drivers.
System	reboot, swapon, kexec_load, quotactl	Low-level system maintenance and power management.
IPC	shmget, semop, msgget	Legacy System V Inter-Process Communication.

Summary: The Overall "Top 10" Ranking

While rankings fluctuate, research (e.g., SysPop) and profiling tools consistently show this top-heavy distribution for general-purpose computing:

1. read / write: (The absolute kings of syscalls)
2. futex: (Constant thread synchronization in modern apps)
3. mmap / munmap: (Memory allocation happens constantly)
4. fstat: (Apps check file sizes/types before doing anything)
5. poll / epoll_wait: (The heartbeat of all networked apps/web servers)
6. rt_sigprocmask: (Standard overhead for signal safety)
7. close: (Every open must eventually close)
8. getpid: (Extremely cheap, used for logging and identification)
9. ioctl: (The "junk drawer" for device-specific commands)
10. lseek: (Moving the cursor inside files)

How to see this on your own machine

You can see exactly which syscalls your system is using right now by running this command:

# Traces the entire system for 10 seconds and summarizes frequency
sudo perf stat -e 'syscalls:sys_enter_*' -a sleep 10

Or for a specific program:

# Count syscalls for the 'ls' command
strace -c ls

seccomp

Secure computing mode (seccomp): Any system calls not on the list are disallowed.

It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel.