People throw the phrase "syscall overhead" around as if it's a fixed tax, and then quote a number they read once in 2009. I wanted my own figure, on my own hardware, so I sat down and measured it properly.
The cheapest syscall to benchmark is one that does almost nothing useful. getpid() after the first call is cached by glibc, so that's no good. The honest minimal-work syscalls are things like a read from a closed fd, or getppid, which always traps into the kernel. I went with a tight loop of getppid through the raw syscall() interface to avoid any libc caching.
#include <unistd.h>
#include <sys/syscall.h>
int main(void) {
for (long i = 0; i < 100000000L; i++)
syscall(SYS_getppid);
return 0;
}
The number
On a Zen 3 desktop, current kernel, that comes out at roughly 230ns per call once you divide through. The textbook "a syscall is about 50ns" number is from a kinder era. Two things blew it up.
The first is mitigations. With the various Spectre and Meltdown countermeasures active, every kernel entry and exit pays for retpolines, IBRS, and the page-table isolation dance. Boot with mitigations=off (do not do this on anything that matters) and the same loop drops to nearer 70ns. That gap is the price of not trusting your own CPU, and it is real.
The second is that syscall proper isn't free even on paper. The CPU saves state, switches stacks, the kernel does its entry bookkeeping, runs your trivial handler, then unwinds all of it. None of that shows up in a flat "it's just a context switch" mental model.
Why it matters
For most code, it doesn't. If you make a syscall and then do real work, 230ns disappears into the noise. The trouble is the hot loop that crosses the boundary far more than it needs to: one write per line, one clock_gettime per iteration, one tiny recv per packet.
That's the whole reason io_uring exists, and why batching, writev, and buffered I/O keep earning their keep. The fix is rarely "make the syscall faster", it's "make fewer of them". Measure first, though. I have watched people rewrite a loop to avoid a syscall that was being called twelve times an hour. The overhead is only overhead when there's a lot of it.
The headline for me: know the real number for your box, and remember it's a moving target that the security people keep nudging upwards.