What is a System Call?

A system call is the gateway from user mode into the kernel. It is implemented via a special CPU instruction (syscall on x86-64) that transfers control to a fixed kernel entry point with a number identifying the requested service.

fork()

Creates a new process by duplicating the calling process. Returns:

• child PID (>0) in the parent.
• 0 in the child.
• -1 on failure.

Memory is copied lazily via copy-on-write — pages are shared until either side writes them, then a private copy is made.

exec family (execl, execv, execve, ...)

Replaces the current process image with a new program. Same PID, new code/data/stack/heap. On success, exec does not return; on failure it returns -1.

execve(path, argv, envp) is the underlying system call; the others are libc wrappers that build the argument arrays for you.

wait() and waitpid()

A parent collects the exit status of a finished child. wait(&status) blocks until any child exits; waitpid(pid, &status, opts) targets a specific child or uses non-blocking mode (WNOHANG).

Macros:

• WIFEXITED(status) — child terminated normally.
• WEXITSTATUS(status) — exit code passed to exit.
• WIFSIGNALED(status) — child killed by signal.
• WTERMSIG(status) — that signal number.

exit()

_exit(status) is the bare system call; exit(status) (libc) flushes stdio buffers, runs atexit handlers, then calls _exit. The status is masked to 8 bits so it ranges 0–255.

Putting it all Together — A Mini Shell

Comparison

Common Pitfalls

• Forgetting wait() — produces zombies that pile up until the parent dies.
• Calling exit() in child after exec() — irrelevant; exec replaces everything including this code.
• Sharing file descriptors — children inherit fds; use close() to prevent leaks (or set O_CLOEXEC).

Summary

• fork / exec / wait / exit are the four pillars of Unix process control.
• The shell, daemons, and the entire Linux user space rely on this quartet.