KeyKOS Principles of Operation

Domains

Domains are the actors of the system. Any change in the system is the direct result of some domain action.

Domains can send messages to other domains by invoking gate keys, or to the kernel by invoking primary keys. These messages can be sent upon explicit instruction of the program, or implicitly upon exceptional circumstances called traps or faults. These exceptional circumstances include invalid instructions in the program or reference to invalid portions of a segment.

The most common action of a domain is to execute the instructions found in the domain's segment. In the absence of traps, faults, or key invocations, these actions only change the domain and the domain's addressing segment.

Three types of keys, domain, start, and resume, cause the kernel to view the node they designate as a domain root.

A well-formed domain root contains node keys that designate two other nodes. Together, these three nodes form the domain. Nothing in the nodes specifically identifies them as part of a domain; when describing them as a domain, they are presumed to be well-formed.

Nomenclature

The names C0 through C15 refer to the 16 slots of the root node of a domain. The names C16 through C31 refer to the slots of the node designated by the node key in C14. C16 through C31 are frequently referred to as slots 0 through 15 of the domain (since they act as the key registers of the domain).

Domain Components

Figure 2-2

C0 holds the domain's brand. It is used with the domain tool key for rights amplification and is inaccessible through a domain key. It does not influence the execution of the domain.

C1 holds a meter key that indicates authority to expend resources. The domain is said to depend on the meter.

C2 holds a key to the domain keeper.

C3 defines the root of the addressing segment. It holds a memory key.

C4 is a data key whose right 6 bytes hold the domain PSW. Parts of the domain PSW correspond to parts of the S/370 PSW described in the IBM System/370 Principles of Operation. Some parts of the S/370 PSW are inaccessible to domains. The format of the domain PSW is (each character designates a bit):

Figure 2-3

If P is 1, C7 through C9 will control the PER hardware.

CC is the condition code and MMMM is the program mask.

LL is 11 if SVC 253, 254, and 255 are to be interpreted as key invocations, and 00 otherwise.

AAAA AAAA AAAA AAAA AAAA AAAA is the instruction address.

C5 holds a data key which defines the trap code. It must be DK(0) for the domain to run.

C6 holds a data key which controls the monitor call trap. See the section in this chapter entitled "Program Surveillance".

C7 through C9 hold data keys which control the Program Event Recording hardware. PER traps will not occur unless the P bit of C4 is one. See the section in this chapter entitled "Program Surveillance".

C10 and C11 do not influence the process in the domain. They may be used for the convenience of the domain key holder.

C12 holds a data key which contains the priority of the domain. It is maintained by the kernel when the process-running bit of the domain root is TRUE. C12 is inaccessible through a domain key.

C13 is the busy flag. It holds DK(0) while the domain is available and holds DK(1) while it is busy. It is maintained by the kernel when the process-running bit of the domain root is TRUE. C13 is inaccessible through a domain key.

C13 will receive a DK(0) when the domain becomes available and may receive DK(0) at times after it becomes available until it is entered again with a start key or the node is severed. The kernel will not place anything except DK(0) or DK(1) in C13. If something else is placed in this slot the domain may not run. C13 will receive DK(1) any time the domain's process-running bit is one.

C14 holds a node key to the keys node. It is used with the domain tool key and is inaccessible through a domain key.

C15 holds a node key to the registers node. It is used with the domain tool key and is inaccessible through a domain key.

Programming note: C10 is frequently used to hold a segment key to the symbol table for the domain's keeper.

Key Registers

C16 through C31 are the key registers. These slots can supply keys to be invoked by the domain or passed as key parameters, or can be used to receive key parameters.

If the domain is allowed to invoke keys (determined by the "LL" bits in C4), the key registers are controlled directly by the program in the domain. If the domain is not allowed to invoke keys, the key registers are inaccessible to the program.

General Purpose and Floating Point Registers

The registers node contains 16 data keys that define the contents of the general and floating registers of the domain. Each of these keys contributes its low 6 bytes as shown in Figure 2-2.

As the process in the domain changes the general and floating registers, these data key values change. This operation may be optimized (the values cached) so the domain executes instructions that change registers at the full execution speed of the underlying hardware.

Bytes in these data key values, other than the right 6 bytes, do not affect the registers and vice versa.

Well-Formed Domains

A node that is a domain root is said to be well-formed. A node that the kernel attempts to interpret as a domain root and is not a domain root is said to be malformed. In general, a node is well-formed if it conforms to the specifications of the object which it is supposed to represent by virtue of the type of key which leads to it. That is, a node may act as a root node of a domain, a segment node, or a meter, depending upon the key referencing it. If the node does not meet the specifications, it is malformed with respect to functioning as that particular type of object. Thus a node may be well-formed as a meter, but at the same time malformed as a domain root node.

A process in a malformed domain will not issue instructions or take other actions; it may vanish (with no trace) or cause a trap. The following circumstances cause a domain root node to be considered malformed:

C4, C5, C6, and C12 do not hold data keys.
PER in C4 is on and C7 through C9 are not data keys.
C14 and C15 of the node do not hold node keys.
The node itself and the two nodes designated by the node keys in C14 and C15 (the domain components) are not distinct.
Some slot in the registers node (the node designated by the key in C15 of the node) does not hold a data key.
C13 of the node holds other than DK(0) or DK(1).
Bit 0 or bits 16 through 23 of the data body of C4 (the PSW) are not all zero.
Bits 8 through 17 of C4 are neither 00 nor 03.
The high order bit of the 7 bytes of data in the data key in C12 is not zero.

Programming note: Some versions of KeyKOS may redefine as well-formed some domains that are defined here as malformed. Programs should not depend on the effects generated by malformed domains.

Programming note: This document describes domains as if they are not primitive. This means that programs outside the kernel build domains from nodes. The system was designed to allow only one program, the domain creator, to hold the domain tool key and thus be the only program that depends on the particular way domains are built from nodes.

Some implementations may have domains as a primitive object. In these implementations, there would be no domain tool. The domain creator, which will return a domain key to a new domain, would instead be a part of the kernel. Programs should not depend on this difference.

Domain States

A domain is in exactly one of three states: available, running, or waiting:

A domain is available if its C13 holds DK(0). There can be no process in an available domain (the process-running bit is FALSE). A domain is. busy if C13 holds DK(1). A busy domain is either running or waiting.
A domain is running if its process-running bit is TRUE. (Its C13 is always DK(1).)
A busy domain with the process-running bit FALSE is said to be waiting. (There will usually be resume keys to the waiting domain.)

Every action in KeyKOS takes place as a result of some action by a running domain. The kernel allows (one or more at a time) domains in the running state to execute. The order, and for how long, is up to the kernel.

A domain in the running state will take the following actions.

If either the domain's C1 contains a valid meter key, or its trap code begins with X'0500000001' (the code for meter traps) then:

If the trap code of the domain is zero, the domain is eligible to have a CPU execute instructions. When this happens the following is in effect:
- The general purpose and floating point registers are defined by the registers node.
- The addresses available are a subset of those defined by C3 (the addressing segment key).
- The condition code, program mask, and instruction address are those defined by C4.
- If the PER bit in C4 is 1, C7 and C8 control the program event recording hardware.
Otherwise (the trap code of the domain is not zero), the trap action will occur as defined in the section in this chapter entitled "Trapping".

Otherwise (the meter key is not valid and the trap code is not TC0 = 5, class = 1), then a trap code is stored with TC0 = 5, class = 1, and a subcode as defined in the section on traps. (Since the domain's process-running bit remains on, the trap action will then occur as described above).