What Makes System Calls Expensive: A Linux Internals Deep Dive

System calls are expensive operations that go beyond their kernel code execution cost. When transitioning between user and kernel space on Linux x86-64, the CPU must drain instruction pipelines, switch page tables and stacks, clear branch predictor buffers, and apply security mitigations against speculative execution attacks like Spectre. These microarchitectural disruptions force the CPU to rebuild its optimization state, making system calls significantly more costly than they appear. The article explores the Linux kernel's syscall handler, measures direct overhead using clock_gettime benchmarks, and explains indirect costs from pipeline draining and branch predictor clearing. Practical optimization strategies include using vDSO, caching values, batching I/O operations, leveraging io_uring, and utilizing eBPF to reduce kernel crossings.