170 lines · rust
1// SPDX-License-Identifier: GPL-2.02 3//! A wrapper for data protected by a lock that does not wrap it.4 5use super::{lock::Backend, lock::Lock};6use crate::build_assert;7use core::{cell::UnsafeCell, mem::size_of, ptr};8 9/// Allows access to some data to be serialised by a lock that does not wrap it.10///11/// In most cases, data protected by a lock is wrapped by the appropriate lock type, e.g.,12/// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is meant for cases when this is not possible.13/// For example, if a container has a lock and some data in the contained elements needs14/// to be protected by the same lock.15///16/// [`LockedBy`] wraps the data in lieu of another locking primitive, and only allows access to it17/// when the caller shows evidence that the 'external' lock is locked. It panics if the evidence18/// refers to the wrong instance of the lock.19///20/// [`Mutex`]: super::Mutex21/// [`SpinLock`]: super::SpinLock22///23/// # Examples24///25/// The following is an example for illustrative purposes: `InnerDirectory::bytes_used` is an26/// aggregate of all `InnerFile::bytes_used` and must be kept consistent; so we wrap `InnerFile` in27/// a `LockedBy` so that it shares a lock with `InnerDirectory`. This allows us to enforce at28/// compile-time that access to `InnerFile` is only granted when an `InnerDirectory` is also29/// locked; we enforce at run time that the right `InnerDirectory` is locked.30///31/// ```32/// use kernel::sync::{LockedBy, Mutex};33///34/// struct InnerFile {35/// bytes_used: u64,36/// }37///38/// struct File {39/// _ino: u32,40/// inner: LockedBy<InnerFile, InnerDirectory>,41/// }42///43/// struct InnerDirectory {44/// /// The sum of the bytes used by all files.45/// bytes_used: u64,46/// _files: Vec<File>,47/// }48///49/// struct Directory {50/// _ino: u32,51/// inner: Mutex<InnerDirectory>,52/// }53///54/// /// Prints `bytes_used` from both the directory and file.55/// fn print_bytes_used(dir: &Directory, file: &File) {56/// let guard = dir.inner.lock();57/// let inner_file = file.inner.access(&guard);58/// pr_info!("{} {}", guard.bytes_used, inner_file.bytes_used);59/// }60///61/// /// Increments `bytes_used` for both the directory and file.62/// fn inc_bytes_used(dir: &Directory, file: &File) {63/// let mut guard = dir.inner.lock();64/// guard.bytes_used += 10;65///66/// let file_inner = file.inner.access_mut(&mut guard);67/// file_inner.bytes_used += 10;68/// }69///70/// /// Creates a new file.71/// fn new_file(ino: u32, dir: &Directory) -> File {72/// File {73/// _ino: ino,74/// inner: LockedBy::new(&dir.inner, InnerFile { bytes_used: 0 }),75/// }76/// }77/// ```78pub struct LockedBy<T: ?Sized, U: ?Sized> {79 owner: *const U,80 data: UnsafeCell<T>,81}82 83// SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.84unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}85 86// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use87// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is88// sufficient to allow that.89//90// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain91// several `&T` from several threads at once. However, this is okay as `T` is `Sync`.92unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}93 94impl<T, U> LockedBy<T, U> {95 /// Constructs a new instance of [`LockedBy`].96 ///97 /// It stores a raw pointer to the owner that is never dereferenced. It is only used to ensure98 /// that the right owner is being used to access the protected data. If the owner is freed, the99 /// data becomes inaccessible; if another instance of the owner is allocated *on the same100 /// memory location*, the data becomes accessible again: none of this affects memory safety101 /// because in any case at most one thread (or CPU) can access the protected data at a time.102 pub fn new<B: Backend>(owner: &Lock<U, B>, data: T) -> Self {103 build_assert!(104 size_of::<Lock<U, B>>() > 0,105 "The lock type cannot be a ZST because it may be impossible to distinguish instances"106 );107 Self {108 owner: owner.data.get(),109 data: UnsafeCell::new(data),110 }111 }112}113 114impl<T: ?Sized, U> LockedBy<T, U> {115 /// Returns a reference to the protected data when the caller provides evidence (via a116 /// reference) that the owner is locked.117 ///118 /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&U` that matches119 /// the data protected by the lock without actually holding it.120 ///121 /// # Panics122 ///123 /// Panics if `owner` is different from the data protected by the lock used in124 /// [`new`](LockedBy::new).125 pub fn access<'a>(&'a self, owner: &'a U) -> &'a T126 where127 T: Sync,128 {129 build_assert!(130 size_of::<U>() > 0,131 "`U` cannot be a ZST because `owner` wouldn't be unique"132 );133 if !ptr::eq(owner, self.owner) {134 panic!("mismatched owners");135 }136 137 // SAFETY: `owner` is evidence that there are only shared references to the owner for the138 // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable139 // reference to the inner value that aliases with this shared reference. The type is `Sync`140 // so there are no other requirements.141 unsafe { &*self.data.get() }142 }143 144 /// Returns a mutable reference to the protected data when the caller provides evidence (via a145 /// mutable owner) that the owner is locked mutably.146 ///147 /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&mut U` that148 /// matches the data protected by the lock without actually holding it.149 ///150 /// Showing a mutable reference to the owner is sufficient because we know no other references151 /// can exist to it.152 ///153 /// # Panics154 ///155 /// Panics if `owner` is different from the data protected by the lock used in156 /// [`new`](LockedBy::new).157 pub fn access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T {158 build_assert!(159 size_of::<U>() > 0,160 "`U` cannot be a ZST because `owner` wouldn't be unique"161 );162 if !ptr::eq(owner, self.owner) {163 panic!("mismatched owners");164 }165 166 // SAFETY: `owner` is evidence that there is only one reference to the owner.167 unsafe { &mut *self.data.get() }168 }169}170