Assembly Syscall Question

[Ryan Sommers]

When making a system call to the kernel why is it necessary to push the 
syscall value onto the stack when you don't call another function? 

Example: 

access.the.bsd.kernel:
 int 80h
 ret 

func:
 mov eax, 4    ; Write
 call access.the.bsd.kernel
; End 

Works. However:
func:
 mov eax, 4    ; Write
 int 80h
; End 

Doesn't. 

Now, if you change it to: 

func:
 mov eax, 4    ; Write
 push eax
 int 80h
; End 

It does work. I was able to find, "By default, the FreeBSD kernel uses the C 
calling convention. Further, although the kernel is accessed using int 80h, 
it is assumed the program will call a function that issues int 80h, rather 
than issuing int 80h directly," in the developer's handbook. But I can't 
figure out why the second example doesn't work. Is the call instruction 
pushing the value onto the stack in addition to pushing the instruction 
pointer on? 

Thank you in advance.
PS I'm not on the list. 

 

 --
Ryan "leadZERO" Sommers
Gamer's Impact President
ryans at gamersimpact.com
ICQ: 1019590
AIM/MSN: leadZERO 

 -= http://www.gamersimpact.com =-