godspeed_sdk/capability.rs
1// SPDX-License-Identifier: Apache-2.0
2//! Typed capability handles for service code - §7.
3//!
4//! Services never see raw `Capability` structs; the kernel manages the cap table.
5//! Services hold opaque `CapHandle` values (slot indices) and pass them to
6//! syscall wrappers. The kernel resolves them against the task's cap table.
7
8/// Opaque handle to a capability slot in the calling task's cap table.
9/// Not a raw pointer; the kernel does the resolution.
10#[derive(Debug, Clone, Copy, PartialEq, Eq)]
11pub struct CapHandle(pub u32);
12
13/// Capability right bits, mirroring the kernel `Rights` bitfield (§7.4). Used with the
14/// delegated-resource calls (`resource_mint`/`resource_invoke`, §7.10): a file cap minted
15/// `RIGHT_READ | RIGHT_WRITE | RIGHT_GRANT`, a read invoked with `RIGHT_READ`, a write with
16/// `RIGHT_WRITE` (a cap lacking the invoked right fails - the non-escalation check).
17pub const RIGHT_READ: u8 = 1 << 0;
18pub const RIGHT_WRITE: u8 = 1 << 1;
19pub const RIGHT_GRANT: u8 = 1 << 4;
20
21/// Errors mirrored from the kernel's CapError (§7.7).
22#[derive(Debug, Clone, Copy, PartialEq, Eq)]
23pub enum CapError {
24 CapNotHeld,
25 CapInsufficientRights,
26 CapNotGrantable,
27 CapWrongScope,
28 CapRevoked,
29 EndpointDead,
30}