Struct CapSlot 

pub struct CapSlot {
    pub token: CapToken,
    pub generation: u32,
    pub owner: PartitionId,
    pub depth: u8,
    pub parent_index: u32,
    pub badge: u64,
}

A slot in the capability table.

Each slot holds either a valid capability or is marked as free for reuse. Generation counters prevent stale handle access after deallocation.

Fields

token: CapToken

The capability token (valid when generation != 0).

generation: u32

Generation counter for stale handle detection.

Generation 0 is the invalid sentinel: a slot with generation == 0 is empty/free. Live slots always have generation >= 1, and the counter skips 0 on wrap-around (see invalidate).

Security note

This is a u32, giving a 2^32 cycle forgery window: if an attacker can cause exactly 2^32 allocate/free cycles on a single slot, a stale handle could alias a new capability. In practice this is infeasible (would require ~4 billion operations on one slot), and widening to u64 would double CapSlot size and break the memory layout. Accepted as a low-severity residual risk.

owner: PartitionId

The partition that owns this capability.

depth: u8

Delegation depth (0 = root capability).

parent_index: u32

Parent slot index (u32::MAX if root).

badge: u64

Badge value for identifying the granting chain.

Implementations

impl CapSlot

pub const fn is_valid(&self) -> bool

Returns true if this slot is currently valid (in use).

pub const fn matches(&self, generation: u32) -> bool

Returns true if this slot matches the given generation.

pub fn invalidate(&mut self)

Invalidates this slot, bumping the generation counter for the next allocation and then clearing it to 0 (the free sentinel).

The bumped generation is stored in parent_index (unused while the slot is free) so that the next insert_* call can recover it.

Security

Generation 0 is the invalid sentinel. The counter skips 0 on wrap-around so that a re-allocated slot never gets generation 0.

Trait Implementations

impl Clone for CapSlot

fn clone(&self) -> CapSlot

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for CapSlot

impl Debug for CapSlot

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CapSlot

impl PartialEq for CapSlot

fn eq(&self, other: &CapSlot) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CapSlot