How do system calls (syscalls) work in Linux? What are userspace and kernelspace?

In Linux, system calls (syscalls) are mechanisms through which user-space programs request services from the operating system kernel (kernel space).

• Userspace is the memory and execution area where user applications run. Here, programs have limited rights and cannot directly access hardware or critical resources.

• Kernelspace is the memory area where the OS kernel operates with full access rights to hardware and resources.

When a program in userspace wants to perform an operation requiring privileges (e.g., reading a file, creating a process, network interaction), it invokes a system call. The process:

1. The program calls a special instruction (e.g., int 0x80 or syscall) that switches the processor to kernel mode.
2. Control is transferred to the system call handler in kernel space.
3. The kernel performs the requested operation with necessary security checks.
4. The result is returned back to userspace, and control is handed back to the program.

This separation ensures system security and stability, preventing applications from directly accessing critical resources.