[libc] Prevent changing ownership of the port once opened

The Port type has stipuations that the same exact mask used to open it
needs to close it. This can currently be violated by calling its move
constructor to put it somewhere else. We still need the move constructor
to handle the open and closing functions. So, we simply make these
constructors private and only allow a few classes to have move
priviledges on it.

Reviewed By: JonChesterfield, lntue

Differential Revision: https://reviews.llvm.org/D150118

1 files changed, 8 insertions, 2 deletions

diff --git a/libc/src/__support/RPC/rpc.h b/libc/src/__support/RPC/rpc.h
index 55ce6700380f..ae905bccbc65 100644
--- a/libc/src/__support/RPC/rpc.h
+++ b/libc/src/__support/RPC/rpc.h
@@ -250,16 +250,22 @@ template <bool InvertInbox> struct Process {
 /// processes. A port is conceptually an index into the memory provided by the
 /// underlying process that is guarded by a lock bit.
 template <bool T> struct Port {
-  // TODO: This should be move-only.
   LIBC_INLINE Port(Process<T> &process, uint64_t lane_mask, uint64_t index,
                    uint32_t out)
       : process(process), lane_mask(lane_mask), index(index), out(out) {}
+  LIBC_INLINE ~Port() = default;
+
+private:
   LIBC_INLINE Port(const Port &) = delete;
   LIBC_INLINE Port &operator=(const Port &) = delete;
   LIBC_INLINE Port(Port &&) = default;
   LIBC_INLINE Port &operator=(Port &&) = default;
-  LIBC_INLINE ~Port() = default;
 
+  friend struct Client;
+  friend struct Server;
+  friend class cpp::optional<Port<T>>;
+
+public:
   template <typename U> LIBC_INLINE void recv(U use);
   template <typename F> LIBC_INLINE void send(F fill);
   template <typename F, typename U>