This note is about doing this pattern in Keykos. The 6 programs there limit access to the counter to the routine cc. To simplify we omit that limitation here where the caller of cc and the logic of cc are in the same protection domain. The authority given to P and Q are the same here and there.

The native language of Keykos is machine code and compilers are merely a means of producing machine code, at least for this exercise. Keykos does not adhere to any concept of lexical scoping which is strategic to each of the six solutions described above. (I admire lexical scoping in languages.)

You have start keys to two domains P and Q and you need to endow P with the ability it increment a counter without being able to read it, and Q with the ability to read the same counter without the ability to increment it. Other pairs such as P and Q are expected to arise. Your program is obeyed by a domain that holds these keys:

Two Domain Solution

Your program includes code that: Some domain will spend its life obeying just that code. Other code will: You now invoke the domain creator twice, each time passing the space bank and accepting the returned domain key to a new domain. With each of the returned domain keys: Invoke the domain key to install: Then you order each of the domain keys to return a start key for that domain. These two start keys are delivered to P and Q who can the perform their duties.

One Domain Solution

Put code in a page that does the following: In either case the content of R1 becomes the return code to the invoker of the domain. Now create one domain and install the RO page key to the page with code as the address space of the new domain. Invoke the domain key twice asking for start keys to the domain with data bytes 0 and 1 respectively. Send the first to P and the second to Q.

Note that this domain performs no store operations and indeed has no valid addresses that are writable. This is a rare situation in Keykos; it happened a few times.

Abstracting the count

As we said in the introduction the count is kept in the address space of the creator of the pair of keys for P and Q. A more faithful implementation would hide that counter from the requestor. A Counter Pair Creator would probably adopt the one domain solution and a single domain would perform just the function of cc and return two keys. If the two domain solution were adopted then a page shared by those two domains would be required for the sole purpose of holding the count.