System Call Ontology

AI SEARCH

FLOW ALGEBRA — SYSTEM CALL ONTOLOGY
Semantic Library
Version: 4.0
Canonical Page:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/operating-systems/system-call-ontology.html

FLOW SYSTEM_CALL_ONTOLOGY {

  META {
    DOMAIN = "Computing Ontologies"
    SUBDOMAIN = "Operating Systems"
    ONTOLOGY = "System Call Ontology"
    PURPOSE = "Formalise system calls as controlled interfaces between user-space programs and kernel services, including invocation, dispatch, arguments, privilege transitions, resource access, results and errors."
    LOCALE = "en-GB"
  }

  ENTITY_TYPES {
    SYSTEM_CALL
    SYSTEM_CALL_INTERFACE
    SYSTEM_CALL_NUMBER
    SYSTEM_CALL_TABLE
    SYSTEM_CALL_HANDLER
    KERNEL_SERVICE
    USER_SPACE
    KERNEL_SPACE
    USER_MODE
    KERNEL_MODE
    PROCESS
    THREAD
    PROGRAM
    APPLICATION
    KERNEL
    OPERATING_SYSTEM
    CPU
    REGISTER
    STACK
    ARGUMENT
    PARAMETER
    RETURN_VALUE
    ERROR_CODE
    ERRNO
    TRAP
    SOFTWARE_INTERRUPT
    SYSCALL_INSTRUCTION
    PRIVILEGE_TRANSITION
    EXECUTION_CONTEXT
    FILE_OPERATION
    PROCESS_OPERATION
    MEMORY_OPERATION
    DEVICE_OPERATION
    NETWORK_OPERATION
    IPC_OPERATION
    SECURITY_OPERATION
    FILE
    FILE_DESCRIPTOR
    PROCESS_IDENTIFIER
    MEMORY_ADDRESS
    BUFFER
    DEVICE
    SOCKET
    PIPE
    SIGNAL
    PERMISSION
    PRIVILEGE
    CREDENTIAL
    RESOURCE
    REQUEST
    RESPONSE
    BLOCKING_CALL
    NONBLOCKING_CALL
    SYNCHRONOUS_CALL
    ASYNCHRONOUS_OPERATION
    INTERRUPTIBLE_CALL
    RESTARTABLE_CALL
    STATE
    EVENT
    TRACE
    LATENCY
    ERROR
    FAILURE
    CONFIGURATION
    ABI
    OS_VERSION
    KERNEL_VERSION
    ARCHITECTURE
    EVIDENCE
    CONFIDENCE_SCORE
    PROVENANCE_RECORD
  }

  RELATIONSHIPS {
    IS_A
    INSTANCE_OF
    PART_OF
    INVOKED_BY
    INVOKES
    DISPATCHES_TO
    HANDLED_BY
    PROVIDES_ACCESS_TO
    REQUESTS
    RETURNS
    HAS_NUMBER
    HAS_ARGUMENT
    HAS_PARAMETER
    HAS_RETURN_VALUE
    HAS_ERROR_CODE
    USES_REGISTER
    USES_STACK
    ENTERS
    RETURNS_TO
    TRANSITIONS_TO
    READS
    WRITES
    OPENS
    CLOSES
    CREATES
    TERMINATES
    ALLOCATES
    DEALLOCATES
    MAPS
    SENDS
    RECEIVES
    CONTROLS
    BLOCKS
    WAKES
    RESTARTS
    CHECKS
    REQUIRES_PERMISSION
    REQUIRES_PRIVILEGE
    USES_CREDENTIAL
    HAS_LATENCY
    HAS_STATE
    HAS_CONFIGURATION
    HAS_ABI
    HAS_OS_VERSION
    HAS_KERNEL_VERSION
    DEPENDS_ON
    PRECEDES
    FOLLOWS
    DERIVED_FROM
    INFERRED_FROM
    HAS_EVIDENCE
    HAS_CONFIDENCE
    HAS_PROVENANCE
    SEMANTICALLY_EQUIVALENT_TO
  }

  INPUTS {
    SYSTEM_CALL_SPECIFICATIONS
    SYSTEM_CALL_TABLES
    SYSTEM_CALL_NUMBERS
    ABI_DEFINITIONS
    ARCHITECTURE_DATA
    PROCESS_AND_THREAD_DATA
    SYSTEM_CALL_TRACES
    REGISTER_TRACES
    ARGUMENT_DATA
    RETURN_VALUE_DATA
    ERROR_CODE_DATA
    FILE_DESCRIPTOR_DATA
    MEMORY_MAPS
    DEVICE_DATA
    NETWORK_DATA
    IPC_DATA
    CREDENTIAL_DATA
    PERMISSION_DATA
    PERFORMANCE_METRICS
    CONFIGURATION_DATA
    OS_VERSION_DATA
    KERNEL_VERSION_DATA
    ONTOLOGY_TERMS
  }

  NORMALISE {
    STANDARDISE_SYSTEM_CALL_IDENTIFIERS
    NORMALISE_SYSTEM_CALL_NAMES
    NORMALISE_SYSTEM_CALL_NUMBERS
    NORMALISE_ABI_NAMES
    NORMALISE_ARCHITECTURE_NAMES
    NORMALISE_ARGUMENT_TYPES
    NORMALISE_RETURN_VALUES
    NORMALISE_ERROR_CODES
    NORMALISE_PROCESS_AND_THREAD_IDENTIFIERS
    NORMALISE_FILE_DESCRIPTORS
    NORMALISE_MEMORY_ADDRESSES
    NORMALISE_OS_AND_KERNEL_VERSIONS
    RESOLVE_SYSTEM_CALL_IDENTITIES
    ALIGN_ONTOLOGY_TERMS
    REMOVE_DUPLICATES
    VALIDATE_METADATA
    PRESERVE_PROVENANCE
  }

  PROCESS SYSTEM_CALL_PIPELINE {
    USER_SPACE_REQUEST
      -> ARGUMENT_PREPARATION
      -> SYSTEM_CALL_IDENTIFIER_OR_NUMBER
      -> SYSCALL_TRAP_OR_SOFTWARE_INTERRUPT
      -> PRIVILEGE_TRANSITION
      -> KERNEL_ENTRY
      -> SYSTEM_CALL_DISPATCH
      -> HANDLER_EXECUTION
      -> RESULT_OR_ERROR
      -> USER_SPACE_RETURN
  }

  PROCESS INVOCATION_REASONING {
    PROCESS_OR_THREAD
      -> SYSTEM_CALL_REQUEST

    SYSTEM_CALL_REQUEST
      -> ABI_ARGUMENT_MAPPING

    ABI_ARGUMENT_MAPPING
      -> REGISTER_OR_STACK_ARGUMENTS

    SYSTEM_CALL_INSTRUCTION
      -> KERNEL_ENTRY

    KERNEL_ENTRY
      -> DISPATCH_CONTEXT
  }

  PROCESS DISPATCH_REASONING {
    SYSTEM_CALL_NUMBER
      -> SYSTEM_CALL_TABLE_LOOKUP

    SYSTEM_CALL_TABLE_LOOKUP
      -> SYSTEM_CALL_HANDLER

    SYSTEM_CALL_HANDLER
      -> KERNEL_SERVICE

    KERNEL_SERVICE
      -> OPERATION_RESULT
  }

  PROCESS FILE_SYSTEM_CALL_REASONING {
    FILE_SYSTEM_CALL
      -> FILE_DESCRIPTOR_OR_PATH_CONTEXT

    FILE_DESCRIPTOR_OR_PATH_CONTEXT
      -> PERMISSION_CHECK

    PERMISSION_CHECK
      -> FILESYSTEM_OPERATION

    FILESYSTEM_OPERATION
      -> RETURN_VALUE_OR_ERROR
  }

  PROCESS MEMORY_SYSTEM_CALL_REASONING {
    MEMORY_SYSTEM_CALL
      -> ADDRESS_SPACE_CONTEXT

    ADDRESS_SPACE_CONTEXT
      -> REQUESTED_MEMORY_OPERATION

    REQUESTED_MEMORY_OPERATION
      -> VALIDATION_AND_PERMISSION_CHECK

    VALID_OPERATION
      -> MEMORY_MANAGER_ACTION

    MEMORY_MANAGER_ACTION
      -> UPDATED_MAPPING_OR_RESULT
  }

  PROCESS PROCESS_SYSTEM_CALL_REASONING {
    PROCESS_SYSTEM_CALL
      -> PROCESS_OR_THREAD_CONTEXT

    PROCESS_OR_THREAD_CONTEXT
      -> CREATE_OR_EXECUTE_OR_WAIT_OR_TERMINATE_OPERATION

    OPERATION
      -> KERNEL_PROCESS_MANAGER

    KERNEL_PROCESS_MANAGER
      -> PROCESS_STATE_OR_RELATIONSHIP_UPDATE
  }

  PROCESS BLOCKING_REASONING {
    SYSTEM_CALL_HANDLER
      -> RESOURCE_AVAILABILITY_CHECK

    RESOURCE_UNAVAILABLE
      -> CALLER_BLOCK

    CALLER_BLOCK
      -> WAIT_QUEUE

    COMPLETION_EVENT
      -> WAKE_CALLER

    WAKE_CALLER
      -> CONTINUE_OR_RETURN
  }

  PROCESS ERROR_REASONING {
    SYSTEM_CALL_REQUEST
      -> ARGUMENT_AND_CONTEXT_VALIDATION

    INVALID_REQUEST
      -> ERROR_CODE

    KERNEL_SERVICE_FAILURE
      -> ERROR_CODE

    ERROR_CODE
      -> USER_SPACE_RETURN
  }

  PROCESS SECURITY_REASONING {
    CALLER_CREDENTIALS + REQUESTED_OPERATION
      -> ACCESS_CONTROL_CHECK

    ACCESS_CONTROL_CHECK
      -> PERMISSION_OR_PRIVILEGE_EVALUATION

    ALLOWED
      -> HANDLER_CONTINUES

    DENIED
      -> ERROR_RETURN
  }

  RULES {
    IF SYSTEM_CALL_IS_INVOKED
    THEN REQUIRE {
      CALLING_PROCESS_OR_THREAD
      SYSTEM_CALL_IDENTITY
      ABI_CONTEXT
      ARGUMENT_CONTEXT
    }

    IF SYSTEM_CALL_NUMBER_IS_USED
    THEN PRESERVE ARCHITECTURE_ABI_OS_AND_KERNEL_VERSION_CONTEXT

    IF USER_TO_KERNEL_TRANSITION_OCCURS
    THEN DISTINGUISH USER_SPACE_CALLER_FROM_KERNEL_HANDLER

    IF SYSTEM_CALL_BLOCKS
    THEN PRESERVE BLOCKING_RESOURCE_OR_EVENT

    IF SYSTEM_CALL_RETURNS_ERROR
    THEN PRESERVE ERROR_CODE_AND_FAILURE_CONTEXT

    IF POINTER_OR_BUFFER_ARGUMENT_IS_USED
    THEN PRESERVE CALLER_ADDRESS_SPACE_AND_VALIDATION_CONTEXT

    IF SAME_SYSTEM_CALL_NAME_EXISTS_ACROSS_SYSTEMS
    THEN DO_NOT_ASSUME_IDENTICAL_NUMBER_ARGUMENTS_OR_SEMANTICS

    IF SEMANTIC_IDENTIFIERS_DIFFER
    AND SYSTEM_CALL_REFERENT_IS_SAME
    THEN APPLY SEMANTIC_EQUIVALENCE
  }

  CONFIDENCE {
    CONFIDENCE_SCORE =
      WEIGHT(
        SYSTEM_CALL_IDENTITY_CERTAINTY,
        ABI_CERTAINTY,
        ARCHITECTURE_CERTAINTY,
        OS_AND_KERNEL_VERSION_CERTAINTY,
        ARGUMENT_TRACE_COMPLETENESS,
        RETURN_AND_ERROR_TRACE_COMPLETENESS,
        EXECUTION_TRACE_QUALITY,
        PROVENANCE_COMPLETENESS
      )

    LEVELS {
      HIGH
      MODERATE
      LOW
      INSUFFICIENT
    }

    IF ABI_OR_ARCHITECTURE_IS_UNKNOWN
    THEN REDUCE_INVOCATION_INFERENCE_CONFIDENCE

    IF KERNEL_VERSION_IS_UNKNOWN
    THEN REDUCE_HANDLER_SEMANTICS_CONFIDENCE

    IF COMPLETE_TRACE_CONFIRMS_CALL_AND_RETURN
    THEN INCREASE CONFIDENCE_SCORE
  }

  SEMANTIC_EQUIVALENCE {
    EQUIVALENCE_KEY =
      NORMALISE(
        ENTITY_TYPE,
        SYSTEM_CALL_NAME,
        SYSTEM_CALL_NUMBER,
        ABI,
        ARCHITECTURE,
        OS_VERSION,
        KERNEL_VERSION
      )

    IF EQUIVALENCE_KEY(A) == EQUIVALENCE_KEY(B)
    THEN A SEMANTICALLY_EQUIVALENT_TO B

    ELSE PRESERVE_DISTINCT_ENTITIES
  }

  REASONING_CONSTRAINTS {
    SYSTEM_CALL != LIBRARY_FUNCTION
    SYSTEM_CALL != KERNEL_FUNCTION_IN_ALL_CONTEXTS
    SYSTEM_CALL_NAME != SYSTEM_CALL_NUMBER
    USER_SPACE != KERNEL_SPACE
    USER_MODE != KERNEL_MODE
    ARGUMENT_POINTER != KERNEL_POINTER_WITHOUT_VALIDATION_AND_MAPPING
    RETURN_VALUE != SUCCESS_WITHOUT_SEMANTIC_CONTEXT
    ERROR_CODE != ROOT_CAUSE
    BLOCKING_CALL != FAILED_CALL
    NONBLOCKING_CALL != ASYNCHRONOUS_OPERATION_IN_ALL_CASES
    SAME_CALL_NAME != SAME_ABI_OR_SEMANTICS_ACROSS_SYSTEMS
    SYSTEM_CALL_NUMBER_IS_ARCHITECTURE_AND_ABI_DEPENDENT
    OS_AND_KERNEL_VERSION_AFFECT_SYSTEM_CALL_BEHAVIOUR
    SECURITY_CONTEXT_AFFECTS_RESULT
    PROVENANCE_MUST_BE_PRESERVED
    UNCERTAINTY_MUST_NOT_BE_DISCARDED
  }

  VALIDATION {
    CHECK_ENTITY_TYPES
    CHECK_RELATION_DOMAINS_AND_RANGES
    CHECK_SYSTEM_CALL_IDENTITY
    CHECK_SYSTEM_CALL_NUMBER
    CHECK_ABI
    CHECK_ARCHITECTURE
    CHECK_ARGUMENT_TYPES
    CHECK_CALLER_CONTEXT
    CHECK_PRIVILEGE_TRANSITION
    CHECK_HANDLER_MAPPING
    CHECK_RETURN_VALUE
    CHECK_ERROR_CODE
    CHECK_BLOCKING_STATE
    CHECK_SECURITY_CONTEXT
    CHECK_OS_AND_KERNEL_VERSION
    CHECK_CONFIGURATION
    CHECK_TRACE_COMPLETENESS
    CHECK_PROVENANCE
    CHECK_CONFIDENCE
    CHECK_SEMANTIC_CONSISTENCY
  }

  OUTPUTS {
    NORMALISED_SYSTEM_CALL_ENTITIES
    SYSTEM_CALL_NUMBER_RELATIONS
    ABI_RELATIONS
    INVOCATION_RELATIONS
    PRIVILEGE_TRANSITION_RELATIONS
    DISPATCH_RELATIONS
    HANDLER_RELATIONS
    ARGUMENT_RELATIONS
    RESOURCE_ACCESS_RELATIONS
    BLOCKING_AND_WAKE_RELATIONS
    RETURN_VALUE_RELATIONS
    ERROR_CODE_RELATIONS
    SECURITY_RELATIONS
    SYSTEM_CALL_TRACES
    LATENCY_RELATIONS
    CONFIDENCE_SCORES
    EVIDENCE_LINKS
    PROVENANCE_RECORDS
    EXPLANATION_PATHS
  }

  UPDATE_MODEL {
    ON SYSTEM_CALL_EVENT {
      NORMALISE
      RESOLVE_SYSTEM_CALL_IDENTITY
      UPDATE_CALLER_CONTEXT
      UPDATE_ARGUMENT_RELATIONS
      UPDATE_DISPATCH_AND_HANDLER_RELATIONS
      UPDATE_BLOCKING_STATE
      UPDATE_RETURN_OR_ERROR_RELATIONS
      RECOMPUTE_DEPENDENT_INFERENCES
      UPDATE_CONFIDENCE
    }

    ON ABI_OS_OR_KERNEL_CHANGE {
      REMAP_SYSTEM_CALL_NUMBERS
      UPDATE_HANDLER_MAPPINGS
      UPDATE_ARGUMENT_AND_RETURN_SEMANTICS
      RECHECK_SEMANTIC_EQUIVALENCE
      UPDATE_CONFIDENCE
      PRESERVE_VERSION_HISTORY
    }

    ON ONTOLOGY_REVISION {
      REMAP_TERMS
      CHECK_SEMANTIC_EQUIVALENCE
      IDENTIFY_DEPRECATED_TERMS
      MIGRATE_RELATIONSHIPS
      PRESERVE_PRIOR_VERSION_REFERENCES
    }
  }

  FLOW_HASH {
    HASH_INPUT =
      CANONICALISE(
        ENTITY_TYPES,
        RELATIONSHIPS,
        RULES,
        CONFIDENCE,
        SEMANTIC_EQUIVALENCE,
        REASONING_CONSTRAINTS,
        UPDATE_MODEL
      )

    FLOW_HASH = SHA256(HASH_INPUT)
  }

  AI_CONSUMPTION {
    INDEX {
      ONTOLOGY
      ENTITY_TYPES
      RELATIONSHIPS
      RULES
      OUTPUTS
    }

    RETRIEVE {
      BY_SYSTEM_CALL
      BY_SYSTEM_CALL_NUMBER
      BY_ABI
      BY_ARCHITECTURE
      BY_PROCESS
      BY_THREAD
      BY_HANDLER
      BY_ARGUMENT
      BY_RETURN_VALUE
      BY_ERROR_CODE
      BY_RESOURCE
      BY_SECURITY_CONTEXT
      BY_CONFIDENCE
    }

    REASON {
      APPLY_RELATIONSHIPS
      APPLY_RULES
      TRACE_SYSTEM_CALL_PIPELINE
      TRACE_INVOCATION
      TRACE_DISPATCH
      ANALYSE_FILE_SYSTEM_CALLS
      ANALYSE_MEMORY_SYSTEM_CALLS
      ANALYSE_PROCESS_SYSTEM_CALLS
      ANALYSE_BLOCKING
      ANALYSE_ERRORS
      ANALYSE_SECURITY
      CHECK_SEMANTIC_EQUIVALENCE
      PRESERVE_UNCERTAINTY
      TRACE_EVIDENCE
      TRACE_PROVENANCE
      GENERATE_EXPLANATION_PATH
    }

    RESPONSE_POLICY {
      DISTINGUISH_SYSTEM_CALL_FROM_LIBRARY_FUNCTION
      DISTINGUISH_USER_FROM_KERNEL_EXECUTION
      PRESERVE_ABI_ARCHITECTURE_OS_AND_KERNEL_CONTEXT
      PRESERVE_ARGUMENT_ADDRESS_SPACE_AND_SECURITY_CONTEXT
      DISTINGUISH_ERROR_CODE_FROM_ROOT_CAUSE
      RETURN_CONFIDENCE_WHEN_AVAILABLE
      RETURN_PROVENANCE_WHEN_AVAILABLE
      AVOID_UNSUPPORTED_SYSTEM_CALL_INFERENCE
    }
  }

  TERMINAL {
    RESULT =
      VALIDATED(
        SEMANTICALLY_NORMALISED(
          EVIDENCE_LINKED(
            CONFIDENCE_AWARE(
              SYSTEM_CALL_KNOWLEDGE
            )
          )
        )
      )
  }
}

END FLOW