Next: F-returns (failure-return)
Up: ECS SYSTEM ARCHITECTURE
Previous: Capability-creating-authorization
Viewed as a virtual computer, the ECS system had only one virtual
instruction. This instruction accepted a list of parameters, the first
of which was interpreted as a pointer to an operation. A basic
operation contained two parts; a specification of the actual action to
be performed and a list of specifications for the parameters to that
action.
Two kinds of actions could be specified by an operation: a built in
ECS system action, or a call on a named subprocess. The possible
parameter specifications included:
- datum,
- capability of given type with certain option bits,
- fixed datum,
- fixed capability,
- block capability and
- block datum.
(The last two were only used for subprocess calls.)
The fixed datum and capability specifications carried a value for that
parameter in the operation itself. The user calling such an operation
never saw these parameters. One intended use for fixed parameters,
particularly fixed datum, was to distinguish between different kinds
of calls on a single subprocess. In general, the fixed parameters
allow projection of an operation.
During either a built in ECS action, or for a call on a subprocess,
all capability parameters were automatically checked for correct type,
and at least the specified option bits. If the check failed, an
immediate error was generated. For a call on a subprocess, all
parameters were then copied into the address space of the called
subprocess, the data into its memory and the capabilities into its
local C-list.
An immediate consequence of specifying an action by pointing to an
object was the ability to control what actions were available to each
subprocess. This was a generalization of one aspect of the usual
monitor-user mode facility on actual computers, that of a restricted
instruction set under user mode.
Next: F-returns (failure-return)
Up: ECS SYSTEM ARCHITECTURE
Previous: Capability-creating-authorization
Paul McJones
1998-06-22