Questions: System Calls and User/Kernel Mode

Question 1

A C program calls printf("Hello"). At what point does execution cross from user mode into kernel mode?

• A. Immediately when printf() is called, since printf() is a system call
• B. When the C standard library internally calls the write() system call to send bytes to the terminal
• C. Never — modern CPUs execute printf() directly without involving the kernel
• D. When the program is compiled, since the compiler inserts kernel calls at compile time

Answer: (B)

printf() is a library function that runs entirely in user mode. It formats the string, buffers output, and eventually calls write() — the actual system call — which triggers the trap instruction to switch into kernel mode. The user/kernel boundary is crossed at write(), not at printf(). This layering means most of the work happens in user space; the kernel is invoked only for the final privileged operation of writing bytes to the file descriptor.

Question 2

Why are system calls significantly more expensive than ordinary function calls within a program?

• A. System calls require network access to communicate with the OS server
• B. The kernel must validate that the requested operation is legal before executing it
• C. Mode-switching saves all user-mode register state, flushes CPU pipeline state, and reverses the entire process on return — multiplying the cost of a simple function call many times over
• D. System calls use interpreted code rather than compiled machine instructions

Answer: (C)

A regular function call takes a few nanoseconds (push arguments, jump, return). A system call involves saving all user-mode register state, switching privilege levels, potentially flushing CPU pipeline and cache state, executing kernel code, then reversing the entire sequence. This is why well-designed programs batch small operations into fewer, larger system calls — e.g., buffering many writes into one large write() — rather than making many small calls. Option B (validation) is part of what the kernel does but is not the primary source of overhead.

Question 3

Calling the C standard library function printf() is itself a system call that directly transitions the CPU into kernel mode.

• T. True
• F. False

Answer: False

printf() is a user-space library function. It runs entirely in user mode, performing string formatting and output buffering, before eventually calling write() — the actual system call — which triggers the mode switch. The distinction matters architecturally: the C standard library sits between application code and the kernel, providing a higher-level interface that often batches and buffers operations before making the privileged kernel call. You can observe this layering directly with strace, which shows only the actual system calls, not library function calls.

Question 4

The separation between user mode and kernel mode exists to prevent buggy or malicious programs from crashing the entire system by directly accessing hardware or modifying other processes' memory.

• T. True
• F. False

Answer: True

This is the fundamental purpose of the privilege boundary. In user mode, programs can execute arithmetic and logic but cannot directly access hardware, modify page tables, or touch another process's memory. Only kernel mode has unrestricted hardware access. Without this boundary, a single buffer overflow in a web browser could corrupt the filesystem — the kernel's protection prevents any user-space bug or attack from directly harming the whole system.

Question 5

What mechanism allows a user-space program to request a privileged operation from the kernel without compromising the user/kernel protection boundary, and how does the CPU ensure the transition is controlled?

Model answer: The user-space program places the system call number and arguments into specific CPU registers, then executes a trap instruction (such as syscall on x86-64 or svc on ARM). This instruction simultaneously switches the CPU into kernel mode and jumps to a fixed, predefined entry point in the kernel — not to an arbitrary address supplied by the user program. The kernel validates the arguments, performs the privileged operation, puts the result in a register, then switches back to user mode. The key security property is that the trap always enters the kernel at a known address, so user code cannot redirect kernel execution to arbitrary locations.

The trap instruction is the controlled gateway that makes the boundary meaningful. If user programs could switch to kernel mode and jump anywhere, the protection would be illusory. By forcing all mode transitions through a single kernel entry point, the OS can validate every request and prevent privilege escalation. This is why system calls must pass through a predefined interface (POSIX: read, write, fork, exec, etc.) rather than calling arbitrary kernel functions directly.