Message passing

[LANDAU_CHARLES@Tandem.COM]

  >Under traditional Mach IPC ... there is a single "primary" message
  >buffer that ... may contain pointers to out-of-line memory regions
  >that always get virtual-copied (using COW).

Because an out-of-line memory region might not begin and end on a page
boundary, extra data (in the same page) will be mapped into the
receiver's address space. I don't know what security assertions Mach
claims to guarantee in this regard, or whether in Mach it is possible to
securely pass out-of-line data without knowing the page size.

  >You haven't defined what "atomic" [message passing] means.

In KeyKOS it means that at every point in time observable by any
process, either all the effects of a message pass have happened or none
have happened.

I don't think there are many places in KeyKOS where processes depend on
the atomicity, and I think they could be done differently if atomicity
weren't guaranteed. The atomicity is mainly a help for the kernel
because it means the kernel doesn't need any intermediate storage.

  >if neither side of an IPC connection needs [scatter/gather], then you
  >don't pay the price for it.

I'd bet the code has an "if" corresponding to the "if" quoted above.
"If"s aren't free even if the "then" clause isn't executed.