capability.h

 
#pragma once
 
#include <l4/sys/consts.h>
#include <l4/sys/types.h>
#include <l4/sys/task.h>
 
namespace L4 {
 
class Task;
class Kobject;
 
template< typename T > class L4_EXPORT Cap;

class L4_EXPORT Cap_base
{
public:
  enum No_init_type
  {
     No_init
  };

  enum Cap_type
  {
    Invalid = L4_INVALID_CAP 
  };

  l4_cap_idx_t cap() const noexcept { return _c; }

  bool is_valid() const noexcept { return !(_c & L4_INVALID_CAP_BIT); }

  int invalid_cap_error() const noexcept { return _c & ~L4_INVALID_CAP_BIT; }
 
  explicit operator bool () const noexcept
  { return !(_c & L4_INVALID_CAP_BIT); }

  l4_fpage_t fpage(unsigned rights = L4_CAP_FPAGE_RWS) const noexcept
  { return l4_obj_fpage(_c, 0, rights); }

  l4_umword_t snd_base(unsigned grant = L4_MAP_ITEM_MAP,
                       l4_cap_idx_t base = L4_INVALID_CAP) const noexcept
  {
    if (base == L4_INVALID_CAP)
      base = _c;
    return l4_map_obj_control(base, grant);
  }
 

  bool operator == (Cap_base const &o) const noexcept
  { return _c == o._c; }

  bool operator != (Cap_base const &o) const noexcept
  { return _c != o._c; }

  inline l4_msgtag_t validate(l4_utcb_t *u = l4_utcb()) const noexcept;

  inline l4_msgtag_t validate(Cap<Task> task,
                              l4_utcb_t *u = l4_utcb()) const noexcept;

  void invalidate() noexcept { _c = L4_INVALID_CAP; }
protected:
  explicit Cap_base(l4_cap_idx_t c) noexcept : _c(c) {}
  explicit Cap_base(Cap_type cap) noexcept : _c(cap) {}

  explicit Cap_base(l4_default_caps_t cap) noexcept : _c(cap) {}

  explicit Cap_base() noexcept {}

  void move(Cap_base const &src) const
  {
    if (!is_valid() || !src.is_valid())
      return;
 
    l4_task_map(L4_BASE_TASK_CAP, L4_BASE_TASK_CAP, src.fpage(L4_CAP_FPAGE_RWSD),
                snd_base(L4_MAP_ITEM_GRANT) | L4_FPAGE_C_OBJ_RIGHTS);
  }

  void copy(Cap_base const &src) const
  {
    if (!is_valid() || !src.is_valid())
      return;
 
    l4_task_map(L4_BASE_TASK_CAP, L4_BASE_TASK_CAP, src.fpage(L4_CAP_FPAGE_RWSD),
                snd_base() | L4_FPAGE_C_OBJ_RIGHTS);
  }

  l4_cap_idx_t _c;
};
 

template< typename T >
class L4_EXPORT Cap : public Cap_base
{
private:
  friend class L4::Kobject;

  explicit Cap(T const *p) noexcept
  : Cap_base(reinterpret_cast<l4_cap_idx_t>(p)) {}
 
public:

  template< typename From >
  static void check_convertible_from() noexcept
  {
    using To = T;
    [[maybe_unused]] To* t = static_cast<From*>(nullptr);
  }

  template< typename From >
  static void check_castable_from() noexcept
  {
    using To = T;
    [[maybe_unused]] To *t = static_cast<To *>(static_cast<From *>(nullptr));
  }

  template< typename O >
  Cap(Cap<O> const &o) noexcept : Cap_base(o.cap())
  { check_convertible_from<O>(); }

  Cap(Cap_type cap) noexcept : Cap_base(cap) {}

  Cap(l4_default_caps_t cap) noexcept : Cap_base(cap) {}

  explicit Cap(l4_cap_idx_t idx = L4_INVALID_CAP) noexcept : Cap_base(idx) {}

  explicit Cap(No_init_type) noexcept {}

  Cap move(Cap const &src) const
  {
    Cap_base::move(src);
    return *this;
  }

  Cap copy(Cap const &src) const
  {
    Cap_base::copy(src);
    return *this;
  }

  T *operator -> () const noexcept { return reinterpret_cast<T*>(_c); }
};
 

template<>
class L4_EXPORT Cap<void> : public Cap_base
{
public:
 
  explicit Cap(void const *p) noexcept
  : Cap_base(reinterpret_cast<l4_cap_idx_t>(p)) {}

  Cap(Cap_type cap) noexcept : Cap_base(cap) {}

  Cap(l4_default_caps_t cap) noexcept : Cap_base(cap) {}

  explicit Cap(l4_cap_idx_t idx = L4_INVALID_CAP) noexcept : Cap_base(idx) {}
  explicit Cap(No_init_type) noexcept {}
 
  template< typename From >
  static void check_convertible_from() noexcept {}
 
  template< typename From >
  static void check_castable_from() noexcept {}

  Cap move(Cap const &src) const
  {
    Cap_base::move(src);
    return *this;
  }

  Cap copy(Cap const &src) const
  {
    Cap_base::copy(src);
    return *this;
  }
 
  template< typename T >
  Cap(Cap<T> const &o) noexcept : Cap_base(o.cap()) {}
};

template< typename T, typename F >
inline
Cap<T> cap_cast(Cap<F> const &c) noexcept
{
  Cap<T>::template check_castable_from<F>();
  return Cap<T>(c.cap());
}
 
// gracefully deal with L4::Kobject ambiguity
template< typename T >
inline
Cap<T> cap_cast(Cap<L4::Kobject> const &c) noexcept
{
  return Cap<T>(c.cap());
}

template< typename T, typename F >
inline
Cap<T> cap_reinterpret_cast(Cap<F> const &c) noexcept
{
  return Cap<T>(c.cap());
}

class Reply_cap_idx
{
  l4_cap_idx_t _i;
 
public:
  constexpr explicit Reply_cap_idx() noexcept : _i(L4_INVALID_REPLY_CAP) {}
  constexpr explicit Reply_cap_idx(l4_cap_idx_t i) noexcept
  : _i(i | L4_REPLY_CAP_BIT) {}
 
  constexpr l4_cap_idx_t cap() const noexcept
  { return _i; }
 
  explicit constexpr operator l4_cap_idx_t() const noexcept
  { return _i; }
 
  explicit constexpr operator bool() const noexcept
  { return !(_i & L4_INVALID_CAP_BIT); }
 
  constexpr bool operator==(Reply_cap_idx o) const noexcept
  { return _i == o._i; }
 
  constexpr bool operator!=(Reply_cap_idx o) const noexcept
  { return _i != o._i; }
};
 
class Reply_cap;

class Reply_cap_alloc
{
  friend class Reply_cap;
 
public:
  constexpr Reply_cap_alloc() = default;
 
  // Attention: do *not* define a destructor! We must keep the class trivially
  // destructible so that no global destructor is created for
  // L4Re::Util::reply_cap_alloc.
  // virtual ~Reply_cap_alloc() = default;
 
  Reply_cap_alloc(Reply_cap_alloc const &) = delete;
  Reply_cap_alloc &operator = (Reply_cap_alloc const &) = delete;

  virtual Reply_cap alloc() noexcept = 0;
 
protected:
  virtual void free(Reply_cap_idx cap) noexcept = 0;
};

class Reply_cap
{
public:
  constexpr Reply_cap() noexcept = default;

  constexpr Reply_cap(Reply_cap_idx cap, Reply_cap_alloc *alloc) noexcept
  : _cap(cap), _alloc(alloc)
  {}

  ~Reply_cap()
  { reset(); }
 
  // not copyable
  Reply_cap(Reply_cap const &) = delete;
  Reply_cap &operator=(Reply_cap const &) = delete;
 
  constexpr Reply_cap(Reply_cap &&o) noexcept
  : _cap(o._cap), _alloc(o._alloc)
  {
    o._cap = Reply_cap_idx();
    o._alloc = nullptr;
  }
 
  Reply_cap &operator=(Reply_cap &&o) noexcept
  {
    reset(o._cap, o._alloc);
    o._cap = Reply_cap_idx();
    o._alloc = nullptr;
    return *this;
  }

  l4_ret_t reply(l4_msgtag_t tag, l4_utcb_t *utcb = l4_utcb()) noexcept
  {
    l4_umword_t err = L4_IPC_ENOT_EXISTENT;
    if (is_valid()) [[likely]]
      {
        err = l4_ipc_error(l4_ipc_reply(_cap.cap(), utcb, tag,
                                        L4_IPC_BOTH_TIMEOUT_0), utcb);
        _alloc->free(_cap);
        _cap = Reply_cap_idx();
      }
 
    if (err) [[unlikely]]
      return l4_ipc_to_errno(err);
    else
      return 0;
  }

  constexpr Reply_cap_idx get() const noexcept
  { return _cap; }
 
  constexpr bool is_valid() const noexcept
  { return static_cast<bool>(_cap); }
 
  explicit constexpr operator bool () const noexcept
  { return is_valid(); }
 
  constexpr bool operator==(Reply_cap const &o) const noexcept
  { return _cap == o._cap; }
 
  constexpr bool operator==(Reply_cap_idx o) const noexcept
  { return _cap == o; }
 
  constexpr bool operator!=(Reply_cap const &o) const noexcept
  { return _cap != o._cap; }
 
  constexpr bool operator!=(Reply_cap_idx o) const noexcept
  { return _cap != o; }

  void reset(Reply_cap_idx cap = Reply_cap_idx(),
             Reply_cap_alloc *alloc = nullptr) noexcept
  {
    if (is_valid()) [[unlikely]]
      {
        // If the reply cap is still valid, reply to the caller that we've
        // dropped the reply. Should not happen in a well behaved server.
        auto tag = l4_msgtag(-L4_EDROPREPLY, 0, 0, 0);
        l4_ipc_reply(_cap.cap(), l4_utcb(), tag, L4_IPC_BOTH_TIMEOUT_0);
        _alloc->free(_cap);
      }
 
    _cap = cap;
    _alloc = alloc;
  }
 
private:
  Reply_cap_idx _cap = Reply_cap_idx();
  Reply_cap_alloc *_alloc = nullptr;
};
 
}