making system call from 32-bit assembly in mac os x failed - macos

Question

I try to write a short 32-bit assembly program to test system calls in mac os x.
I write the first version which shows below, calling the write() function to print a string on the screen. it does work.
.data
str:
.ascii "Hello World\n"
.text
.globl _main
_main:
pushl $12
pushl $str
pushl $1
movl $4, %eax
subl $4, %esp
int $0x80
addl $16, %esp
pushl $0
movl $1, %eax
subl $12, %esp
int $0x80
After this, I decide to write another version uses mkdir() to make a new directory in "/tmp", but I failed. The system call number of mkdir() is 0x88 and my code shows below. Can anyone tell me where i am wrong. thanks very much.
.data
path:
.ascii "/tmp/new_dir"
.text
.globl _main
_main:
nop
pushl $path
pushl $0x1ff
movl $0x88, %eax
subl $8, %esp
int $0x80
addl $16, %esp
pushl $0
movl $1, %eax
subl $12, %esp
int $0x80

Answer 1

Here I found a simple guide for syscalls on MacOS. From what I read I assume that value of %eax register is the only one passed to syscall by register. The rest of registers must be pushed on the stack starting with EDX.
+----------+------------------------+--------------------------------+
| Register | Use | Location |
+----------+------------------------+--------------------------------+
| EAX | Unused, just a padding | [ESP] |
| EBX | Name of directory | [ESP+4] |
| ECX | Access | [ESP+8] |
| EDX | Unused | Unused, but let's say [ESP+12] |
+----------+------------------------+--------------------------------+
According to this table, your mkdir call should look like this:
pushl $0 /* for EDX, unused */
pushl $0x1FF /* for ECX */
pushl $path /* for EBX */
movl $0x88, %eax
pushl %eax /* for EAX but unused */
int $0x80
addl $16, %esp /* clean up */
Adding on, your exit call doesn't seem to be OK either (I'm not sure, I'm not very familiar with this way of syscall-ing)
subl %esp, $8 /* unused EDX and ECX */
pushl $0 /* for EBX */
movl $1, %eax
pushl %eax /* unused EAX */
int 0x80
EDIT:
After digging up some materials on the topic of BSD syscalls, I also found a source recommending having the stack 16-byte aligned. This means that when you call a syscall with less then 4 parameters, you should push additional doublewords, and when you call a syscall with 5 or full 6 parameters, you should also push some doublewords for (if free) ESI, EBP and ESP.