IPC Completion

Enumerate kernel-pointer shortcuts in IPC service syscalls. Why it matters: The safety comments at ipc_register_service (line 229) and ipc_lookup_service (line 254) explicitly state that name pointers are dereferenced as raw kernel addresses because all callers are kernel tasks — this assumption must be catalogued before it can be removed. Focus on `ipc_register_service` and `ipc_lookup_service` in `kernel/src/ipc/mod.rs` while you trace the snippet.

/// Syscall 9: register a named endpoint in the service registry.
///
/// `name_ptr` is a userspace virtual address pointing to `name_len` bytes of
/// UTF-8. The name is safely copied from the caller's address space via
/// `copy_from_user`. Invalid or unmapped pointers return an error.
fn ipc_register_service(ep_id: EndpointId, name_ptr: u64, name_len: u64) -> u64 {
    if name_ptr == 0 {
        return u64::MAX;
    }
    if name_len > 32 {
        return u64::MAX;
    }
    let name_len = name_len as usize;
    let mut name_buf = [0u8; 32];
    if crate::mm::user_mem::copy_from_user(&mut name_buf[..name_len], name_ptr).is_err() {
        return u64::MAX;
    }
    let name = match core::str::from_utf8(&name_buf[..name_len]) {
        Ok(s) => s,
        Err(_) => return u64::MAX,
    };
    match registry::register(name, ep_id) {
        Ok(()) => 0,
        Err(_) => u64::MAX,

View on GitHub

Write failing tests for capability grant through IPC messages. Why it matters: TDD requires failing tests before implementation — the grant path must verify that a capability can be atomically moved from one table to another without duplication or loss. Focus on `CapabilityTable::grant` and `kernel-core` in `kernel-core/src/ipc/capability.rs` while you trace the snippet.

    /// Atomically transfer a capability from `self[source_handle]` to `dest_table`.
    ///
    /// On success the source slot is cleared and the new handle in the
    /// destination table is returned.  On failure (invalid source handle or
    /// destination table full) the source retains its capability and an error
    /// is returned — no side effects.
    pub fn grant(
        &mut self,
        source_handle: CapHandle,
        dest_table: &mut CapabilityTable,
    ) -> Result<CapHandle, CapError> {
        // Validate source handle first, without removing yet.
        let cap = self.get(source_handle)?;

        // Try to insert into destination — if it fails, source keeps the cap.
        let dest_handle = dest_table.insert(cap)?;

        // Destination succeeded — now remove from source (infallible since we
        // already validated the handle above and hold &mut self).
        let _ = self.remove(source_handle);

        Ok(dest_handle)
    }

View on GitHub

Extend Message to carry a capability slot. Why it matters: The current Message struct has no field for capability transfer — services cannot exchange authorities through the existing message format. Focus on `Message` and `new` in `kernel-core/src/ipc/message.rs` while you trace the snippet.

/// A small, register-sized IPC message.
#[derive(Debug, Clone, Copy, Default)]
pub struct Message {
    /// Operation identifier, chosen by convention between sender and receiver.
    pub label: u64,
    /// Inline data payload — up to 4 machine words.
    pub data: [u64; 4],
    /// Optional capability transferred with this message.
    pub cap: Option<Capability>,
}

View on GitHub