l4_task_cap_equal broken?

Dear Fiasco.OC developers,

while working with Genode on top of Fiasco.OC, I've encountered the
following problem. When I transfer ipc-gates via ipc between tasks, it
comes to the point where a task receives a gate it already owns. These
duplicates are detected due to an additional identifier that is
transfered together with the gate. To detect fraud (whether somebody has
send an invalid gate/id combination) the received gate gets compared
with the locally available one via "l4_task_cap_equal". Now, the problem
is "l4_task_cap_equal" often fails even when both capabilities point to
the same ipc-gate. The following code-snippet demonstrates this issue:

...
tag = l4_task_cap_equal(L4_BASE_TASK_CAP, i->kcap(), rcv_cap);
if (!l4_msgtag_label(tag)) {
   unsigned long id1 = l4_debugger_global_id(i->kcap()),
                 id2 = l4_debugger_global_id(rcv_cap);
   printf("my_cap=%lx (id=%lx) rcv_cap=%lx (id=%lx)",
          i->kcap(), id1, rcv_cap, id2);
   if (id1 == id2)
     enter_kdebug("FAIL");
}
...

This snippet is executed after a thread in the roottask received from
another thread of the same task a capability via IPC. Thereby rcv_cap is
the cap that was received via ipc and i->kcap() is the cap that was
retrieved via the additional transfered identifier.
When executed I get the following output:

...
my_cap=20f000 (id=12) rcv_cap=205000 (id=12)
  ---------------------------------------------------------------------
    CPU 0 [00145e81]: FAIL
[      entrypoint] jdb:

The debugger's global id (here: 12) indicates that both capabilities
reference the same object. Nevertheless, the equality test fails.
Can you confirm that this is undesired syscall's behaviour, or do I miss
something important?

The attached kernel patch fixes the problem for me, but may introduce
other problems (e.g.: not sure whether obj() returns always valid pointers).

Regards
Stefan

_______________________________________________
l4-hackers mailing list
[email protected]
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

Index: src/kern/task.cpp
===================================================================
--- src/kern/task.cpp	(revision 38)
+++ src/kern/task.cpp	(working copy)
@@ -511,7 +511,8 @@
   Obj_space::Capability c_a = obj_space()->lookup(obj_a.cap());
   Obj_space::Capability c_b = obj_space()->lookup(obj_b.cap());
 
-  return commit_result(c_a == c_b);
+  return commit_result(c_a.obj()->kobject_start_addr() ==
+                       c_b.obj()->kobject_start_addr());
 }
 
 PRIVATE inline NOEXPORT