System calls

• https://en.wikipedia.org/wiki/System_call
• Programmatic way in which a computer program requests a service from the OS on which it is executed
• Acts as the interface between user space (where applications run) and kernel space (where the OS has full hardware access)
• It temporarily elevates privilege from user mode to kernel mode
• Number of System calls depends on:
  • Kernel Version (OS version)
  • Hardware Architecture (x86, x86_64, ARM)
• For Linux x86_64/AMD64, ~450 system calls defined
• The CPU provides the mechanism for transitioning from user mode to a more privileged mode
• The OS/kernel provides
  • syscall numbers
  • syscall table
  • syscall implementations
• The syscall ABI/table can differ between CPU architectures

System Call Table

• Maps syscall numbers to syscall implementation
• With CPU instructions
  • place syscall number in an architecture dependent register
  • execute transition from user space to kernel space
• Linux: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/entry/syscalls/syscall_64.tbl
• macOS: https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/syscalls.master
• Windows: No official stable table
• Example: Linux x86_64

mov rax, 1      ; syscall number
                ; Linux: 1 = write
syscall         ; CPU enters kernel

Standard C Library

• It provides wrapper functions for system calls
• Not all functions in standard library map to syscall or call syscalls at all
• The library can be compiled for different architecture
• Windows ISO also needs to be downloaded based on architecture (x86_64 vs ARM)
• Linux
  • Library: glibc
  • URL: https://sourceware.org/git/?p=glibc.git;a=tree
  • Man page: https://man7.org/linux/man-pages/man2/syscalls.2.html
• MacOS
  • Library: Libc
  • URL: https://github.com/apple-open-source-mirror/Libc
• Windows
  • Library:
    • UCRT (Universal C Runtime)
    • .NET Runtime (C#)
  • These Libraries internally call Win32 API
  • No public source code available
  • Can be found in Windows SDK

Windows and Unix System interfaces

Process Control	Windows	Unix	Comment
	CreateProcess	fork, exec	Not syscalls
	ExitProcess	exit
	WaitForSingleObject	wait, waitpid
	WaitForMultipleObjects
		kill
File Management
	CreateFile	open
	ReadFile	read
	WriteFile	write
	CloseHandle	close
Communication
	CreatePipe	pipe	Not syscalls
	CreateFileMapping	shm_open	Not syscalls
	MapViewOfFile	mmap
	CreateNamedPipe	mkfifo	Windows is more richer compared to Unix
	socket (Winsock)	socket
Protection
	SetFileSecurity	chmod	Not equivalent
	InitializeSecurityDescriptor	umask	Not equivalent
	SetSecurityDescriptorGroup	chown	Not equivalent
Device Manipulation
	SetConsoleMode	ioctl
	ReadConsole	read
	WriteConsole	write

Event I/O Multiplexing

• Libraries:
  • libevent
  • libuv
• Linux
  • select(), poll() — I/O multiplexing
  • epoll() — scalable I/O multiplexing
  • io_uring() — asynchronous I/O
• macOS
  • select(), poll() — I/O multiplexing
  • kqueue() — scalable event notification
• Windows
  • IOCP (I/O Completion Ports) APIs — asynchronous I/O
  • Not syscalls

strace

• used in Linux
• It can be used to print system calls getting called internally

strace ls -al