Before examining how a system call executes step by step, it is important to understand three fundamental properties that apply to all system calls on Linux:

On Linux, system call service routines follow a convention where a nonnegative return value indicates success. When an error occurs, the service routine returns a negative number that is the negated value of an errno constant.

The C library wrapper function then:

• Negates the negative return value (making it positive)
• Copies the result into the global errno variable
• Returns -1 to the calling program as the function result

The execve() system call is number 11 on Linux/x86-32 (__NR_execve = 11). Here is the complete call path:

Application program
    execve(path, argv, envp);           /* User calls standard function */
         |
         v
glibc wrapper function  (sysdeps/unix/sysv/linux/execve.c)
    execve(path, argv, envp) {
        /* Copy arguments to registers */
        /* Load system call number 11 into %eax */
        int 0x80                        /* Trap → switch to kernel mode */
        return;
    }
         |
         v
Kernel Trap Handler     (arch/x86/kernel/entry_32.S)
    system_call:
        /* Save registers to kernel stack */
        call sys_call_table[__NR_execve]  /* Index into table using number 11 */
         |
         v
Service Routine         (arch/x86/kernel/process_32.c)
    sys_execve() {
        /* Validate arguments */
        /* Execute the new program */
        return error_code;            /* 0 on success, negative on error */
    }
         |
         v
Back to wrapper → back to user mode → return value to application

Even for simple system calls, a significant amount of work must be performed during execution. Consider a benchmark using getppid(), which simply returns the process ID of the calling process’s parent.

The strace command can be used to trace the system calls made by a running program. This is invaluable for debugging or for understanding what a program is doing under the hood.

# Trace all system calls made by a program
strace ./myprogram

# Trace a specific system call (e.g., read)
strace -e trace=read ./myprogram

# Attach to a running process by PID
strace -p 1234

# Save output to a file
strace -o strace_output.txt ./myprogram

• A system call is a controlled entry point into the kernel, allowing processes to request OS services.
• System calls cause a processor mode switch from user mode to kernel mode and back.
• The Linux system call set is fixed; each call has a unique numeric identifier.
• Arguments pass from user space to kernel space via CPU registers.
• The int 0x80 trap instruction (or faster sysenter) triggers the kernel’s trap handler.
• The kernel uses a sys_call_table indexed by call number to dispatch to the correct service routine.
• System calls carry an overhead of approximately 0.3 microseconds per call on x86-32 hardware.
• Errors are reported via a negative return value, with the error code stored in errno.