System Calls and Kernel Mode

Protection rings, the syscall trap, table dispatch, argument validation — and why fewer crossings is always faster

1 / 24

steps

Act 1 of 8·Two Rings

step 1

Speednormal

Your program does not run on the hardware. It runs on top of an operating system that never lets it touch the hardware directly, and the CPU enforces that separation in silicon. x86 defines four privilege levels, called rings. Your code — every program you have ever written — lives in ring 3, the least privileged one.

x86-64 Linux convention

Privilegering 3 → ring 0

raxsyscall number

rdi rsi rdxargs 1–3

LSTARkernel entry point

copy_from_uservalidate pointers

rax (out)result or -errno

Cost~50–200 ns

Active Recall

Question 1 / 3

Why does the syscall instruction jump to an address the kernel registered, instead of one the caller supplies?

Under the Hood

Loading visualizer…

DNSresolving host

TCPconnecting

TLShandshake

HTTPrequesting

DSAverse

System Calls and Kernel Mode

System Calls and Kernel Mode