C standard library and system calls

Question

Is there a way to find out which functions from C standard library make system calls? Some of them like open, close, and malloc are obvious, but is there some kind of a list one can look at? Like does for example strcpy make a system call, or any of the functions in time.h?

Answer 1

I'll assume you're asking from a standpoint of performance, since in many cases run time is dominated entirely by system calls.

Now, while this is implementation-dependent (it's even implementation-dependent whether "system calls" exist), a good way to go about reasoning and making an educated guess is to treat "system call" as meaning "user-to-kernel-to-user" privilege transition, since that's all a system call really is.

Consider your example of strcpy. It copies a string from one array (in your process's memory space) to another array (also in your memory space). Nothing it's doing involves any data except those strings, so it would be pretty pathological to enter kernel space as part of this operation.

On the other hand, consider the time function from time.h. It returns the current system time. This is a shared system resource, so you might expect that it needs to enter kernel space to read the kernel's record of the current time. And traditionally, you'd be right. However, modern versions of Linux, on some archs at least, map a page of kernel memory into every user process as read-only - the page containing certain information that only the kernel would be able to update, like system time, but which all processes can freely read from userspace without leaking any secret data. So this one is more ambiguous.

Finally, you have operations like open or unlink that must necessarily involve a user-to-kernel-to-user transition because they deal with shared resources (the filesystem) on which permissions must be enforced.

If you want a more empirical approach to answering your question, you could simply write a short program to call each function you're interested in and run it under strace.

Answer 2

A system call is made when your program needs to communicate with the kernel. It would be highly inefficient for strcpy to make a system call since this requires an interupt; your code stops running, there's a context switch, the execution mode of the CPU changes (to have more privilages), the interupt handler would run, and your code would continue. This is assuming the OS doesn't decide to run another process after the interupt or or hault your code altogether (such as while waiting on a read).

You can pretty much answer the question yourself by asking yourself this: can i write this function? (Can as in: is it physically possible?) You can write your own strcpy, but not open or read. You can write your own fopen, but it would have to call open.

There is a good list of catagories for system calls on Wikipedia. It'll give you a good idea of when a system call is required.

This shows how to call an interupt in assembly (which is the only place you'll be able to reach code that does so).