1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 2
3 //! A wrapper for data protected by a lock tha 3 //! A wrapper for data protected by a lock that does not wrap it.
4 4
5 use super::{lock::Backend, lock::Lock}; 5 use super::{lock::Backend, lock::Lock};
6 use crate::build_assert; 6 use crate::build_assert;
7 use core::{cell::UnsafeCell, mem::size_of, ptr 7 use core::{cell::UnsafeCell, mem::size_of, ptr};
8 8
9 /// Allows access to some data to be serialise 9 /// Allows access to some data to be serialised by a lock that does not wrap it.
10 /// 10 ///
11 /// In most cases, data protected by a lock is 11 /// In most cases, data protected by a lock is wrapped by the appropriate lock type, e.g.,
12 /// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is 12 /// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is meant for cases when this is not possible.
13 /// For example, if a container has a lock and 13 /// For example, if a container has a lock and some data in the contained elements needs
14 /// to be protected by the same lock. 14 /// to be protected by the same lock.
15 /// 15 ///
16 /// [`LockedBy`] wraps the data in lieu of ano 16 /// [`LockedBy`] wraps the data in lieu of another locking primitive, and only allows access to it
17 /// when the caller shows evidence that the 'e 17 /// when the caller shows evidence that the 'external' lock is locked. It panics if the evidence
18 /// refers to the wrong instance of the lock. 18 /// refers to the wrong instance of the lock.
19 /// 19 ///
20 /// [`Mutex`]: super::Mutex 20 /// [`Mutex`]: super::Mutex
21 /// [`SpinLock`]: super::SpinLock 21 /// [`SpinLock`]: super::SpinLock
22 /// 22 ///
23 /// # Examples 23 /// # Examples
24 /// 24 ///
25 /// The following is an example for illustrati 25 /// The following is an example for illustrative purposes: `InnerDirectory::bytes_used` is an
26 /// aggregate of all `InnerFile::bytes_used` a 26 /// aggregate of all `InnerFile::bytes_used` and must be kept consistent; so we wrap `InnerFile` in
27 /// a `LockedBy` so that it shares a lock with 27 /// a `LockedBy` so that it shares a lock with `InnerDirectory`. This allows us to enforce at
28 /// compile-time that access to `InnerFile` is 28 /// compile-time that access to `InnerFile` is only granted when an `InnerDirectory` is also
29 /// locked; we enforce at run time that the ri 29 /// locked; we enforce at run time that the right `InnerDirectory` is locked.
30 /// 30 ///
31 /// ``` 31 /// ```
32 /// use kernel::sync::{LockedBy, Mutex}; 32 /// use kernel::sync::{LockedBy, Mutex};
33 /// 33 ///
34 /// struct InnerFile { 34 /// struct InnerFile {
35 /// bytes_used: u64, 35 /// bytes_used: u64,
36 /// } 36 /// }
37 /// 37 ///
38 /// struct File { 38 /// struct File {
39 /// _ino: u32, 39 /// _ino: u32,
40 /// inner: LockedBy<InnerFile, InnerDirect 40 /// inner: LockedBy<InnerFile, InnerDirectory>,
41 /// } 41 /// }
42 /// 42 ///
43 /// struct InnerDirectory { 43 /// struct InnerDirectory {
44 /// /// The sum of the bytes used by all f 44 /// /// The sum of the bytes used by all files.
45 /// bytes_used: u64, 45 /// bytes_used: u64,
46 /// _files: Vec<File>, 46 /// _files: Vec<File>,
47 /// } 47 /// }
48 /// 48 ///
49 /// struct Directory { 49 /// struct Directory {
50 /// _ino: u32, 50 /// _ino: u32,
51 /// inner: Mutex<InnerDirectory>, 51 /// inner: Mutex<InnerDirectory>,
52 /// } 52 /// }
53 /// 53 ///
54 /// /// Prints `bytes_used` from both the dire 54 /// /// Prints `bytes_used` from both the directory and file.
55 /// fn print_bytes_used(dir: &Directory, file: 55 /// fn print_bytes_used(dir: &Directory, file: &File) {
56 /// let guard = dir.inner.lock(); 56 /// let guard = dir.inner.lock();
57 /// let inner_file = file.inner.access(&gu 57 /// let inner_file = file.inner.access(&guard);
58 /// pr_info!("{} {}", guard.bytes_used, in 58 /// pr_info!("{} {}", guard.bytes_used, inner_file.bytes_used);
59 /// } 59 /// }
60 /// 60 ///
61 /// /// Increments `bytes_used` for both the d 61 /// /// Increments `bytes_used` for both the directory and file.
62 /// fn inc_bytes_used(dir: &Directory, file: & 62 /// fn inc_bytes_used(dir: &Directory, file: &File) {
63 /// let mut guard = dir.inner.lock(); 63 /// let mut guard = dir.inner.lock();
64 /// guard.bytes_used += 10; 64 /// guard.bytes_used += 10;
65 /// 65 ///
66 /// let file_inner = file.inner.access_mut 66 /// let file_inner = file.inner.access_mut(&mut guard);
67 /// file_inner.bytes_used += 10; 67 /// file_inner.bytes_used += 10;
68 /// } 68 /// }
69 /// 69 ///
70 /// /// Creates a new file. 70 /// /// Creates a new file.
71 /// fn new_file(ino: u32, dir: &Directory) -> 71 /// fn new_file(ino: u32, dir: &Directory) -> File {
72 /// File { 72 /// File {
73 /// _ino: ino, 73 /// _ino: ino,
74 /// inner: LockedBy::new(&dir.inner, I 74 /// inner: LockedBy::new(&dir.inner, InnerFile { bytes_used: 0 }),
75 /// } 75 /// }
76 /// } 76 /// }
77 /// ``` 77 /// ```
78 pub struct LockedBy<T: ?Sized, U: ?Sized> { 78 pub struct LockedBy<T: ?Sized, U: ?Sized> {
79 owner: *const U, 79 owner: *const U,
80 data: UnsafeCell<T>, 80 data: UnsafeCell<T>,
81 } 81 }
82 82
83 // SAFETY: `LockedBy` can be transferred acros 83 // SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.
84 unsafe impl<T: ?Sized + Send, U: ?Sized> Send 84 unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}
85 85
86 // SAFETY: If `T` is not `Sync`, then parallel !! 86 // SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the
87 // `access_mut` to hand out `&mut T` on one th !! 87 // data it protects is `Send`.
88 // sufficient to allow that. <<
89 // <<
90 // If `T` is `Sync`, then the `access` method <<
91 // several `&T` from several threads at once. <<
92 unsafe impl<T: ?Sized + Send, U: ?Sized> Sync 88 unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}
93 89
94 impl<T, U> LockedBy<T, U> { 90 impl<T, U> LockedBy<T, U> {
95 /// Constructs a new instance of [`LockedB 91 /// Constructs a new instance of [`LockedBy`].
96 /// 92 ///
97 /// It stores a raw pointer to the owner t 93 /// It stores a raw pointer to the owner that is never dereferenced. It is only used to ensure
98 /// that the right owner is being used to 94 /// that the right owner is being used to access the protected data. If the owner is freed, the
99 /// data becomes inaccessible; if another 95 /// data becomes inaccessible; if another instance of the owner is allocated *on the same
100 /// memory location*, the data becomes acc 96 /// memory location*, the data becomes accessible again: none of this affects memory safety
101 /// because in any case at most one thread 97 /// because in any case at most one thread (or CPU) can access the protected data at a time.
102 pub fn new<B: Backend>(owner: &Lock<U, B>, 98 pub fn new<B: Backend>(owner: &Lock<U, B>, data: T) -> Self {
103 build_assert!( 99 build_assert!(
104 size_of::<Lock<U, B>>() > 0, 100 size_of::<Lock<U, B>>() > 0,
105 "The lock type cannot be a ZST bec 101 "The lock type cannot be a ZST because it may be impossible to distinguish instances"
106 ); 102 );
107 Self { 103 Self {
108 owner: owner.data.get(), 104 owner: owner.data.get(),
109 data: UnsafeCell::new(data), 105 data: UnsafeCell::new(data),
110 } 106 }
111 } 107 }
112 } 108 }
113 109
114 impl<T: ?Sized, U> LockedBy<T, U> { 110 impl<T: ?Sized, U> LockedBy<T, U> {
115 /// Returns a reference to the protected d 111 /// Returns a reference to the protected data when the caller provides evidence (via a
116 /// reference) that the owner is locked. 112 /// reference) that the owner is locked.
117 /// 113 ///
118 /// `U` cannot be a zero-sized type (ZST) 114 /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&U` that matches
119 /// the data protected by the lock without 115 /// the data protected by the lock without actually holding it.
120 /// 116 ///
121 /// # Panics 117 /// # Panics
122 /// 118 ///
123 /// Panics if `owner` is different from th 119 /// Panics if `owner` is different from the data protected by the lock used in
124 /// [`new`](LockedBy::new). 120 /// [`new`](LockedBy::new).
125 pub fn access<'a>(&'a self, owner: &'a U) !! 121 pub fn access<'a>(&'a self, owner: &'a U) -> &'a T {
126 where <<
127 T: Sync, <<
128 { <<
129 build_assert!( 122 build_assert!(
130 size_of::<U>() > 0, 123 size_of::<U>() > 0,
131 "`U` cannot be a ZST because `owne 124 "`U` cannot be a ZST because `owner` wouldn't be unique"
132 ); 125 );
133 if !ptr::eq(owner, self.owner) { 126 if !ptr::eq(owner, self.owner) {
134 panic!("mismatched owners"); 127 panic!("mismatched owners");
135 } 128 }
136 129
137 // SAFETY: `owner` is evidence that th !! 130 // SAFETY: `owner` is evidence that the owner is locked.
138 // duration of 'a, so it's not possibl <<
139 // reference to the inner value that a <<
140 // so there are no other requirements. <<
141 unsafe { &*self.data.get() } 131 unsafe { &*self.data.get() }
142 } 132 }
143 133
144 /// Returns a mutable reference to the pro 134 /// Returns a mutable reference to the protected data when the caller provides evidence (via a
145 /// mutable owner) that the owner is locke 135 /// mutable owner) that the owner is locked mutably.
146 /// 136 ///
147 /// `U` cannot be a zero-sized type (ZST) 137 /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&mut U` that
148 /// matches the data protected by the lock 138 /// matches the data protected by the lock without actually holding it.
149 /// 139 ///
150 /// Showing a mutable reference to the own 140 /// Showing a mutable reference to the owner is sufficient because we know no other references
151 /// can exist to it. 141 /// can exist to it.
152 /// 142 ///
153 /// # Panics 143 /// # Panics
154 /// 144 ///
155 /// Panics if `owner` is different from th 145 /// Panics if `owner` is different from the data protected by the lock used in
156 /// [`new`](LockedBy::new). 146 /// [`new`](LockedBy::new).
157 pub fn access_mut<'a>(&'a self, owner: &'a 147 pub fn access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T {
158 build_assert!( 148 build_assert!(
159 size_of::<U>() > 0, 149 size_of::<U>() > 0,
160 "`U` cannot be a ZST because `owne 150 "`U` cannot be a ZST because `owner` wouldn't be unique"
161 ); 151 );
162 if !ptr::eq(owner, self.owner) { 152 if !ptr::eq(owner, self.owner) {
163 panic!("mismatched owners"); 153 panic!("mismatched owners");
164 } 154 }
165 155
166 // SAFETY: `owner` is evidence that th 156 // SAFETY: `owner` is evidence that there is only one reference to the owner.
167 unsafe { &mut *self.data.get() } 157 unsafe { &mut *self.data.get() }
168 } 158 }
169 } 159 }
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.