System call simulator: one file copy, every call

Choose how the program copies in.dat to out.dat, the file size and, for read and write, the buffer size. The terminal shows the calls as strace prints them, with long runs of identical calls folded into one line and a count; the table beside it is what strace -c would summarise. Click a line to see the registers the program fills before the syscall instruction. The time estimate uses your own figures for the cost of one call and for memory copy speed, since both depend on the machine; it leaves out the disk.

Programs run in user mode, where the CPU refuses instructions that touch hardware or other programs' memory. To open a file, read a socket or start a process, a program makes a system call: it puts a number identifying the call and up to six arguments in fixed registers and executes a special instruction that switches the CPU to kernel mode at an entry point the kernel chose. The kernel checks the arguments, does the work and returns to the program with a result.

On x86-64 Linux the number goes in rax, the arguments in rdi, rsi, rdx, r10, r8 and r9, and the instruction is syscall, which overwrites rcx and r11. The result returns in rax; a value between −4095 and −1 is an error number, which the C library turns into −1 and errno. Programs rarely do this directly: functions such as read() in the C library are thin wrappers around it.

strace runs a program and prints each system call as it returns: the name, the arguments decoded as far as strace understands them (flags by name, structures by field, buffers as quoted strings), and after = the return value. openat(AT_FDCWD, "in.dat", O_RDONLY) = 3 opened a file relative to the current directory and got descriptor 3. A failure shows as = -1 ENOENT (No such file or directory). strace -c counts calls instead of listing them, and strace -f follows child processes. Current C libraries implement fstat() with the newer newfstatat call and an empty path, which is why it appears in the trace.

A read-and-write loop makes one read and one write per buffer-full, plus a final read that returns 0 at the end of the file. Copying 1 GiB:

A read copies data from the kernel's page cache into the program's buffer, and the write copies it back into the kernel: two copies of every byte. mmap maps the source file into the program's address space, so a single write from the mapping copies each byte once; the pages are brought in by page faults as the kernel reads the mapping, which the system call trace does not show. That takes 9 calls for 1 GiB. sendfile asks the kernel to move the data between the two descriptors itself, with no copy through user space and 7 calls in all. Web servers use it to send static files to sockets, and copy_file_range does the same for file-to-file copies and can let the file system share or offload the copy.

A read or write may move fewer bytes than asked: a read near the end of a file, from a pipe or socket with less data waiting, or a write interrupted by a signal. The return value says how many, and correct code loops until it is done. Linux also caps a single read, write or sendfile at 0x7ffff000 bytes, 2,147,479,552, even on 64-bit systems, so copying a 5 GB file with sendfile takes 3 calls; try a size above 2 GiB to see it.

The traces show the calls a small copy program makes itself; a real dynamically linked program also makes a few dozen calls at start-up to load the C library, which strace would show first. Pointers and addresses are illustrative. The number of system calls, the bytes moved and the call limit follow the Linux manual pages; the time estimate is only as good as the two figures you enter.