// SPDX-License-Identifier: GPL-2.0 //! A wrapper for data protected by a lock that does not wrap it. use super::{lock::Backend, lock::Lock}; use crate::build_assert; use core::{cell::UnsafeCell, mem::size_of, ptr}; /// Allows access to some data to be serialised by a lock that does not wrap it. /// /// In most cases, data protected by a lock is wrapped by the appropriate lock type, e.g., /// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is meant for cases when this is not possible. /// For example, if a container has a lock and some data in the contained elements needs /// to be protected by the same lock. /// /// [`LockedBy`] wraps the data in lieu of another locking primitive, and only allows access to it /// when the caller shows evidence that the 'external' lock is locked. It panics if the evidence /// refers to the wrong instance of the lock. /// /// [`Mutex`]: super::Mutex /// [`SpinLock`]: super::SpinLock /// /// # Examples /// /// The following is an example for illustrative purposes: `InnerDirectory::bytes_used` is an /// aggregate of all `InnerFile::bytes_used` and must be kept consistent; so we wrap `InnerFile` in /// a `LockedBy` so that it shares a lock with `InnerDirectory`. This allows us to enforce at /// compile-time that access to `InnerFile` is only granted when an `InnerDirectory` is also /// locked; we enforce at run time that the right `InnerDirectory` is locked. /// /// ``` /// use kernel::sync::{LockedBy, Mutex}; /// /// struct InnerFile { /// bytes_used: u64, /// } /// /// struct File { /// _ino: u32, /// inner: LockedBy, /// } /// /// struct InnerDirectory { /// /// The sum of the bytes used by all files. /// bytes_used: u64, /// _files: KVec, /// } /// /// struct Directory { /// _ino: u32, /// inner: Mutex, /// } /// /// /// Prints `bytes_used` from both the directory and file. /// fn print_bytes_used(dir: &Directory, file: &File) { /// let guard = dir.inner.lock(); /// let inner_file = file.inner.access(&guard); /// pr_info!("{} {}", guard.bytes_used, inner_file.bytes_used); /// } /// /// /// Increments `bytes_used` for both the directory and file. /// fn inc_bytes_used(dir: &Directory, file: &File) { /// let mut guard = dir.inner.lock(); /// guard.bytes_used += 10; /// /// let file_inner = file.inner.access_mut(&mut guard); /// file_inner.bytes_used += 10; /// } /// /// /// Creates a new file. /// fn new_file(ino: u32, dir: &Directory) -> File { /// File { /// _ino: ino, /// inner: LockedBy::new(&dir.inner, InnerFile { bytes_used: 0 }), /// } /// } /// ``` pub struct LockedBy { owner: *const U, data: UnsafeCell, } // SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can. unsafe impl Send for LockedBy {} // SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use // `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is // sufficient to allow that. // // If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain // several `&T` from several threads at once. However, this is okay as `T` is `Sync`. unsafe impl Sync for LockedBy {} impl LockedBy { /// Constructs a new instance of [`LockedBy`]. /// /// It stores a raw pointer to the owner that is never dereferenced. It is only used to ensure /// that the right owner is being used to access the protected data. If the owner is freed, the /// data becomes inaccessible; if another instance of the owner is allocated *on the same /// memory location*, the data becomes accessible again: none of this affects memory safety /// because in any case at most one thread (or CPU) can access the protected data at a time. pub fn new(owner: &Lock, data: T) -> Self { build_assert!( size_of::>() > 0, "The lock type cannot be a ZST because it may be impossible to distinguish instances" ); Self { owner: owner.data.get(), data: UnsafeCell::new(data), } } } impl LockedBy { /// Returns a reference to the protected data when the caller provides evidence (via a /// reference) that the owner is locked. /// /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&U` that matches /// the data protected by the lock without actually holding it. /// /// # Panics /// /// Panics if `owner` is different from the data protected by the lock used in /// [`new`](LockedBy::new). pub fn access<'a>(&'a self, owner: &'a U) -> &'a T where T: Sync, { build_assert!( size_of::() > 0, "`U` cannot be a ZST because `owner` wouldn't be unique" ); if !ptr::eq(owner, self.owner) { panic!("mismatched owners"); } // SAFETY: `owner` is evidence that there are only shared references to the owner for the // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable // reference to the inner value that aliases with this shared reference. The type is `Sync` // so there are no other requirements. unsafe { &*self.data.get() } } /// Returns a mutable reference to the protected data when the caller provides evidence (via a /// mutable owner) that the owner is locked mutably. /// /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&mut U` that /// matches the data protected by the lock without actually holding it. /// /// Showing a mutable reference to the owner is sufficient because we know no other references /// can exist to it. /// /// # Panics /// /// Panics if `owner` is different from the data protected by the lock used in /// [`new`](LockedBy::new). pub fn access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T { build_assert!( size_of::() > 0, "`U` cannot be a ZST because `owner` wouldn't be unique" ); if !ptr::eq(owner, self.owner) { panic!("mismatched owners"); } // SAFETY: `owner` is evidence that there is only one reference to the owner. unsafe { &mut *self.data.get() } } }