Hi,

I'm a little bit confused by how Fiasco.OC sending capabilities through IPC. Particularly, it seems that one has to pack the capability in message register, rather than buffer register.

Here is a code sending some capability to the client, which works with Fiasco.OC:

l4_utcb_t * u = l4_utcb();
l4_utcb_mr_u(u)->mr[0] = ipc_id;
l4_utcb_mr_u(u)->mr[1] = L4_ITEM_MAP;
l4_utcb_mr_u(u)->mr[2] = l4_obj_fpage(cap, 0, L4_FPAGE_RWX).raw;
l4_utcb_br_u(u)->bdr = 0;
tag = l4_msgtag(label, 1, 1, 0);
ipc_call(...);

Notice that the capability is assigned into mr[1] and mr[2], but not br[1] and br[2].

It seems that this behavior is controlled by the constructor of L4_snd_item_iter, at kern/l4_buf_iter.cpp:52

  explicit L4_snd_item_iter(Utcb const *utcb, unsigned offset)
  : _buf(&utcb->values[offset]),
    _max(&utcb->values[Utcb::Max_words]) {}

My question is that whether this is the desired behavior? I didn't find any specification on this.

~Haohui