I'm trying to implement a syscall in Linux (RedHat Enterprise 8) and I'm a bit confused about the way it works. From what I understand, I implement a wrapper in user mode which puts the syscall number in eax and parameters in ebx, ecx, edx, etc, and then invokes int 0x80 which calls the appropriate syscall. My question is, since a syscall is written like a regular C function, how does it know what registers contain what parameters? Is it a convention, or is there a mechanism for it, and if so where and how does it do it?