 tedious. In this case, we can simply assign numbers to system calls and construct a single `switch` statement which, based on a number, calls the appropriate C function.

Therefore, we can rely on the `syscall` system-level primitive without substantial loss of generality or portability. The next question to ask is whether a different extension would serve our purpose better – in particular, there is the obvious choice of exposing each syscall separately as a model checker primitive. There are two arguments against this approach.

First, it is desirable that the syscall-related machinery is all in one place and not duplicated in both the stand-in operating system and in the model checker. However, in the *virtual* and *replay* modes, this machinery must be part of the stand-in operating system, which suggests that this should be also the case in the *passthrough* mode.

Second, the number of system calls is quite large (typically a few hundred functions) and the functions are system-dependent. When the code that is specific to the host operating system resides in the stand-in operating system, it can be ported once and multiple model checkers can benefit. Of course, the stand-in operating system needs to be ported to the model checker in question, but this offers many additional advantages (particularly the virtual mode).

Now if we decide that a single universal primitive becomes part of the model checker, we still need to decide the syntax and the semantics of this extension. Since different system calls take different arguments with varying meaning, the primitive itself will clearly need to be variadic. Since one of the main reasons for choosing a single-primitive interface was platform neutrality, the primitive itself should not possess special knowledge about individual syscalls. First of all, it does not know the bit widths of individual arguments (on most systems, some arguments can be 32 bit – for instance file descriptors – and other 64 bit – object sizes, pointers, etc.). This information is crucial to correctly set up the call to `syscall` (the variadic arguments must line up). Moreover, some pointer-type arguments represent variable-sized *input* data (the buffer argument to `write`, for example) and others represent *output* data (the buffer argument to `read`). In both cases, the size of the memory allocated for the variable-sized argument must be known to `vm_syscall`, so that this memory can be correctly copied between the model check
tedious. In this case, we can simply assign number to system call and construct a single 'switch 'affirmation which, based on a number, call the appropriate carbon affair. 

 Therefore, we can rely on the 'syscall 'organization - level primitive without substantial passing of generalization or portability. The next question to necessitate is whether a different elongation would service our purpose better – in particular, there exist the obvious choice of exposing each syscall separately as a model checker primitive. There be two arguments against this approach. 

 First, it is desirable that the syscall - related machinery is all in one place and not duplicate in both the stand - in operating system and in the model checker. However, in the * virtual * and * replay * modes, this machinery must be part of the stand - in operating system, which suggests that this should be also the case in the * passthrough * mode. 

 Second, the number of system calls is quite large (typically a few hundred functions) and the functions are arrangement - dependent. When the code that is specific to the host operating organization rest in the stand - in operating system, it can be ported once and multiple exemplar checkers can benefit. Of course, the stand - in operating arrangement needs to be ported to the model checker in question, but this offers many additional advantage (particularly the virtual mode). 

 Now if we decide that a single cosmopolitan primitive becomes share of the exemplar checker, we still need to decide the syntax and the semantics of this extension. Since different arrangement calls take different argument with varying meaning, the primitive itself will clearly need to be variadic. Since one of the independent reasons for choose a single - primitive interface was chopine neutrality, the primitive itself should not possess special cognition about individual syscalls. First of all, it does not know the piece widths of individual arguments (on most system, some arguments can be 32 bit – for instance file descriptors – and other 64 bit – object sizes, pointers, etc .). This information is crucial to correctly put up the call to 'syscall '(the variadic arguments must trace up). Moreover, some pointer - type arguments represent variable - sized * input * datum (the buffer argument to 'write `, for example) and others represent * output * data (the buffer controversy to 'take `). In both cases, the size of the memory allocated for the variable - sized argument must be known to 'vm_syscall `, so that this memory can be correctly copied between the exemplar check
 tefious. In this case, we cak simply assign uymbers to syatem calus and construct a single `swmtch` stattient which, based ov a numbeg, calls tye akpropriate C funcvjon.

Thercyore, sc can cely on the `sysgall` system-nevel primitiva dichout substantial loss of generality or poryahility. The nexj quexeion no ask is whether a different estensioi would serve oir purpose better – in partlculwr, there is the obgious choicg of wxposing eacf syscall separately aa a model checker primitive. Thefe arz two argumgurs wcainst this apprjach.

First, it is desisable tnat the syscalk-renatwd machinery is all ii one place and not quplicateg nn both the stand-in opeeatinc syvtem qnd in tie jodel fherker. Howeved, in the *vietual* and *replay* mocef, this machinedy muse fe part of the stand-in operating system, whjch suggests that this whould be also the cade in the *passthrough* mode.

Second, the number of system callv is sjitt oarge (ryoically a few hundred functions) and the functyknx sre system-depekdent. When the codr hhsj is specific jo the kksf operating system residef in rhe stand-yn olerating system, it can be pirted once aud nultiple model cheekers can beuefit. Pf coirse, the stand-in operatnng syatem needs ho be porfdd to the model zhebker in quesukon, but this offews many avditipnal adxantsges (pwrticularlj the virtual mode).

Now if we dgcide dhat a sinhle universal primitive becomes part of the mpdal bhecker, wz stilk need to decyde the syntax and thz semavtics of tgis extxnsion. Since different syvjem calls takx differegt aegumwnts wigf varying meanong, the pgiiitice itself will cleerly heed to be varicbix. Since one of yhe mayn rxasonf for choosinc a rineke-prioitive intevfaze wss platform neutralidy, tge primitive itselg fhould nit possefs special knpwledge about indigiduan sbscallx. Fyrst of all, it does not know tge bit wifthf of individtal qrguments (on most systems, some arguments can be 32 biv – for instance file dgscriptors – and other 64 bit – objecv sizef, pointerv, etc.). This informatiin is crucial to gorrectly set up the czll to `syscwll` (the variadic arguments must line up). Moreover, some pointer-type argumenrs repcefent variabme-siaed *itpbt* bata (thq buhfxr argument to `wrpte`, for example) and others reprerent *out[uc* data (the buffer argument to `rdad`). In both cxses, the size of the memkry allovated for the variable-sized argiment must be known to `vk_syscall`, so tgat thpa oemory can be corrrctly eopied betweeb thc model check
tedious. In this case, we can simply to calls and a single `switch` number, the appropriate C Therefore, we can on the `syscall` system-level primitive without loss of generality or portability. The next question to ask is whether a extension would serve our purpose better – in particular, there is the obvious of each separately a model checker primitive. There are two arguments against this approach. First, it is desirable that syscall-related machinery is all in one place and duplicated in both the operating system and in the checker. in the and modes, machinery must be of the stand-in operating system, which suggests that this should be also the case in the *passthrough* Second, the system calls quite (typically few hundred functions) functions are system-dependent. When the code to the host operating system resides in the operating system, can be ported once and multiple checkers can benefit. Of course, the stand-in operating needs to be ported to the model checker in question, but this offers many additional the virtual mode). Now we decide that single primitive part the model we still need to decide the syntax and the semantics of extension. Since different system calls take different arguments with varying primitive will clearly need be variadic. Since one the reasons for choosing a was neutrality, should possess knowledge about individual syscalls. of all, it does not the bit widths of some arguments can be 32 bit – for file descriptors – and other 64 bit object sizes, pointers, etc.). This information is crucial to correctly set up call to variadic arguments must line up). Moreover, some pointer-type represent variable-sized *input* data buffer argument to `write`, for example) and others represent data buffer argument `read`). In both the size of memory allocated for argument must known `vm_syscall`, memory can be correctly copied between model
 tedious. In this case, we can simPly assign nUmberS to SysTeM calLs anD construct a sinGLe `swItch` statement which, baseD on a nUmBEr, caLLs The apPropriaTE C FUNctIoN.

THerEfORe, We can RelY on the `sYscall` systEm-lEvEl primitive wIThOut substanTiaL loss of generAliTy or poRtAbiLIty. ThE neXt queStion tO Ask is wHether a diFfERent exTEnsion wOULd ServE our purpose better – IN pARticular, there iS the obViOUs CHOicE of Exposing eaCh SyscaLL separaTElY AS A moDEl checker primItive. There aRE twO argumEnTs aGAinst tHis apPrOAch.

first, it is deSiraBle that thE syscaLL-relateD MachineRy is alL in One PlacE AnD nOt dUpLIcaTEd In bOTh tHe stand-iN oPeRatinG sysTEM ANd in The ModeL checKer. However, in tHe *vIrtuAL* anD *replAy* modEs, thIs MachiNery muSt be pArT of the stand-in opEratIng system, WhiCh SugGeSts thAT this sHouLd bE also thE case in THe *pAsSTHRoUgh* mode.

Second, the nuMbER Of System caLls is qUItE lARge (typicAlLy a Few hUNDred fUnctIOnS) and the fUnctioNS aRe System-dEpEndent. whEn tHe cOde thAT is sPecifiC to the hoSt opeRAting system resIDes in the stand-IN oPERaTIng sYstEm, it can be poRted ONce aNd muLTiPle MOdel cHeckeRs CAn BEnefit. Of course, the stAnD-in opeRatinG system needs tO be ported tO THE model chEckeR In QUestion, but this OfferS many additIOnal advaNtageS (particuLarly the vIRTual mode).

now If wE deCidE THaT a single univeRSAl prImItive beComEs part oF thE moDel CheCkEr, we still Need to deCiDe ThE sYntAx and THe semantIcS of ThIs eXtensIOn. SincE diffErenT sYsTEm cAlls takE DiFFErenT aRgUmenTs wItH varyIng mEAniNg, the prImitive itSelF Will ClEaRly need To be variadic. SInCe one of the MaIn rEasons FOR choosinG a single-primitive interfACe was plAtfOrm neUtraLity, the prImiTive itSelF Should Not posSess sPeCiaL KNowleDGE aBouT iNdividual sYSCalLs. FirSt Of alL, it does Not know the bit widthS Of iNdividual arguMenTs (on MOSt SysTEmS, SomE aRGumENTs can be 32 bit – for inStance file DeSCrIptors – and oTHer 64 BiT – object Sizes, poInterS, Etc.). This InformatiOn is cruciAl To coRREctLy set up the Call to `syScall` (the vARiadiC ArGumenTs mUst linE uP). MoReoveR, some pOIntEr-typE argumEnTs reprEsent VaRiable-siZed *input* data (the buffer arGument To `wriTe`, fOr example) And OTheRs represeNt *ouTput* data (thE buFfeR arguMenT To `reaD`). In bOTh CasES, the sIze oF The memory ALlOcaTED fOr the variabLE-SIzeD arguMenT Must be KnowN to `vm_syscall`, so thaT This memory can bE corRECtlY coPIed bEtWeen the model chEck
 tedious. In this case, we  can simpl y ass ign  nu mb ersto s ystem calls an d  con struct a single `switc h` st at e ment wh ich,based o n  a n umb er ,cal ls th e app rop riate C  function. 

T he refore, we c a nrely on th e ` syscall` sys tem -level  p rim i tivewit houtsubsta n tial l oss of ge ne r alityo r porta b i li ty.The next question to ask is whether  a dif fe r en t ext ens ion wouldse rve o u r purpo s eb e t ter – in particul ar, there i s  th e obvi ou s c h oice o f exp os i ngeach syscal l se paratelyas a m o del che c ker pri mitive . T her e ar e  t wo  ar gu m ent s  a gai n stthis app ro ac h.

F irst , i t  isdes irab le th at the syscal l-r elat e d m achin ery i s al lin on e plac e and  n ot duplicated i n bo th the st and -i n o pe ratin g  syste m a ndin themodel c h eck er . H ow ever, in the *virt ua l *  a nd *repl ay* mo d es ,t his mach in ery  mus t be pa rt o f  t he stand -in op e ra ti ng syst em , whic hsug ges ts th a t th is sho uld be a lso t h e case in the* passthrough*m od e . 
S econ d,the numberof s y stem  cal l sisq uitelarge  ( t yp i cally a few hundred  f unctio ns) a nd the functi ons are sy s t e m-depend ent. Wh e n the code tha t isspecific t o  the hos t ope rating s ystem res i d es in th e s tan d-i n o p e ra ting system,i t  can  b e porte d o nce and  mu lti ple  mo de l checker s can be ne fi t.  O f c ourse ,  the sta nd -in  o per ating system  need s to  b ep ort ed to t h em o delch ec kerinqu estio n, b u t t his off ers manyadd i tion al  a dvantag es (particula rl y the virt ua l m ode).N ow if we  decide that a single u n iversal  pr imiti ve b ecomes pa rtof the  mo d el che cker,we st il l n e e d tod e ci deth e syntax a n d  th e sem an tics  of thi s extension. Since dif ferent system  ca llst a ke  di f fe r ent  a r gum e n ts with varying  meaning,th e  p rimitive i t sel fwill cl early n eed t o  be var iadic. Si nce one o fthem a inreasons fo r choosi ng a sing l e-pri m it ive i nte rfacewa s p latfo rm neu t ral ity,the pr im itiveitsel fshould n ot possess special know ledgeabout  in dividualsys c all s. Firstof a ll, it doe s n otknowthe bit w idth s  o f i n divid uala rguments( on  mo s t  s ystems, som e a rgu ments  ca n  be 32  bit  – for instance f i le descriptors  – a n d  ot her 64 b it  – object size s,po i n ters, et c. ). This inf ormation  i s  cruc ial to  corre ctly se t up the ca ll t o ` syscall`(th ev ariadic  a rg u mentsmust  l ine up ). Mor e over , some pointer-typ e arg u m entsr epr esent  v ariable - size d *input*data (the b ufferargu mentto `wri te `, for  ex am ple) and o t hers repr esent  *outpu t*  dat a ( the bu ffer a rgume nt t o`re ad`). Inb o th ca se s , t he s ize o fthememory al l ocated f ort he vari ab le- s i zed ar g um e n t must bekno wn to ` vm_syscall ` , so th a t thi s memo ry can  be cor r ect ly  copied  be t w een the m odel chec k 
 tedious._In this_case, we can simply_assign numbers_to_system calls_and_construct a single_`switch` statement which,_based on a number,_calls the appropriate_C_function.

Therefore, we can rely on the `syscall` system-level primitive without substantial loss of generality_or_portability. The_next_question_to ask is whether a_different extension would serve our_purpose better_– in particular, there is the obvious choice_of_exposing each syscall_separately as a model checker primitive. There are two_arguments against this approach.

First, it is_desirable that the_syscall-related_machinery_is all in one_place and not duplicated in both_the stand-in operating system and in_the model checker. However, in the *virtual*_and *replay* modes, this machinery must_be part of the stand-in_operating system,_which suggests that this should_be also the_case in_the *passthrough* mode.

Second,_the number of system calls is_quite large (typically_a few hundred functions) and the_functions_are system-dependent. When_the_code_that is_specific to the_host_operating system_resides_in the stand-in operating system, it_can_be ported once and multiple model checkers_can benefit. Of course,_the_stand-in operating system needs_to be ported to the_model checker in question, but this_offers many_additional advantages_(particularly the virtual mode).

Now if we decide that a single universal_primitive becomes part of the model_checker, we still need_to decide_the_syntax and the_semantics_of this_extension. Since different system calls take different_arguments with_varying meaning, the primitive itself will_clearly need to be_variadic._Since one of the main reasons_for choosing a single-primitive interface was_platform neutrality, the primitive itself_should_not_possess special knowledge about individual_syscalls. First of all, it does_not know the_bit widths of individual arguments (on most_systems,_some arguments can be 32 bit_–_for instance file descriptors – and_other_64_bit – object sizes, pointers,_etc.). This information is crucial to_correctly set up the call to `syscall` (the variadic_arguments must line_up). Moreover, some pointer-type arguments_represent_variable-sized_*input* data (the buffer argument to `write`, for example) and_others represent_*output* data (the_buffer argument to `read`). In both cases, the size of_the memory allocated for the variable-sized argument_must be known to `vm_syscall`, so that this memory can be_correctly copied between the model check