Struct WritableCapability 

pub struct WritableCapability<T> { /* private fields */ }

Read+Write bounds-checked capability. NOT Copy/Clone so the borrow checker prevents aliasing the unique-writer status.

Constructed from &mut [T] or an owned Box<T> (via OwnedWritableCapability::from_box). The &mut borrow IS the unique-writer guarantee; without it, multiple WritableCapability instances could simultaneously write the same region.

Implementations

impl<T> WritableCapability<T>

pub const SIGNATURE: AxisMask

Direction signature of WritableCapability<T>. Engages the K_bounds axis (runtime base / length / permissions stored at slot for CHERI-style bounds enforcement on every deref).

pub unsafe fn new( ptr: *mut T, base: usize, length: u32, perms: u32, ) -> Result<Self, CapabilityError>

Safety

Caller guarantees [base, base + length) is valid memory and no other writer accesses the region while this capability is alive.

pub fn from_slice_mut(slice: &mut [T]) -> (WritableCapability<T>, &mut [T])

Safe constructor: build a writable capability over a mutable slice borrow. Grants Read + Write permissions.

pub fn has_permission(&self, p: CapabilityPermission) -> bool

pub fn is_sealed(&self) -> bool

pub fn sealed(self) -> Self

pub fn unsealed(self) -> Self

pub fn read(&self) -> Result<T, CapabilityError>

where T: Copy,

Read through the capability.

pub fn write(&mut self, value: T) -> Result<(), CapabilityError>

Write through the capability. The &mut self receiver + the constructor’s &mut [T] / Box-consuming nature provide the unique-writer guarantee.

pub fn narrow( &self, sub_base: usize, sub_length: u32, sub_perms: u32, ) -> Result<Self, CapabilityError>

Narrow to a sub-range, returning a new WritableCapability. To narrow to a read-only view, use narrow_readable.

pub fn narrow_readable( &self, sub_base: usize, sub_length: u32, sub_perms: u32, ) -> Result<ReadableCapability<T>, CapabilityError>

Narrow to a read-only view. Returned ReadableCapability does NOT have Write perm regardless of what sub_perms contains.

pub fn as_readable(&self) -> ReadableCapability<T>

Borrow this WritableCapability as a ReadableCapability view (no Write perm, no transfer of ownership). The borrow checker prevents the writable cap from being used while the readable view is alive.

Trait Implementations

impl<T: Debug> Debug for WritableCapability<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.