On Linux, the arguments are passed using ebx , ecx , edx , esi , and edi . On Windows, the arguments are copied from the stack. The handler then performs some sort of lookup (to find the address of the function) and executes the system call. After the system call is completed, the iret instruction returns to user-mode.

How does system call work in Linux?

A system call is implemented by a “software interrupt” that transfers control to kernel code; in Linux/i386 this is “interrupt 0x80”. … After the switch to kernel mode, the processor must save all of its registers and dispatch execution to the proper kernel function, after checking whether EAX is out of range.

How do you implement system calls?

A typical way to implement this is to use a software interrupt or trap. Interrupts transfer control to the operating system kernel, so software simply needs to set up some register with the system call number needed, and execute the software interrupt.