1// SPDX-License-Identifier: GPL-2.0 2 3//! A wrapper for data protected by a lock that does not wrap it. 4 5use super::{lock::Backend, lock::Lock}; 6use crate::build_assert; 7use core::{cell::UnsafeCell, mem::size_of, ptr}; 8 9/// Allows access to some data to be serialised by a lock that does not wrap it. 10/// 11/// In most cases, data protected by a lock is wrapped by the appropriate lock type, e.g., 12/// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is meant for cases when this is not possible. 13/// For example, if a container has a lock and some data in the contained elements needs 14/// to be protected by the same lock. 15/// 16/// [`LockedBy`] wraps the data in lieu of another locking primitive, and only allows access to it 17/// when the caller shows evidence that the 'external' lock is locked. It panics if the evidence 18/// refers to the wrong instance of the lock. 19/// 20/// [`Mutex`]: super::Mutex 21/// [`SpinLock`]: super::SpinLock 22/// 23/// # Examples 24/// 25/// The following is an example for illustrative purposes: `InnerDirectory::bytes_used` is an 26/// aggregate of all `InnerFile::bytes_used` and must be kept consistent; so we wrap `InnerFile` in 27/// a `LockedBy` so that it shares a lock with `InnerDirectory`. This allows us to enforce at 28/// compile-time that access to `InnerFile` is only granted when an `InnerDirectory` is also 29/// locked; we enforce at run time that the right `InnerDirectory` is locked. 30/// 31/// ``` 32/// use kernel::sync::{LockedBy, Mutex}; 33/// 34/// struct InnerFile { 35/// bytes_used: u64, 36/// } 37/// 38/// struct File { 39/// _ino: u32, 40/// inner: LockedBy<InnerFile, InnerDirectory>, 41/// } 42/// 43/// struct InnerDirectory { 44/// /// The sum of the bytes used by all files. 45/// bytes_used: u64, 46/// _files: Vec<File>, 47/// } 48/// 49/// struct Directory { 50/// _ino: u32, 51/// inner: Mutex<InnerDirectory>, 52/// } 53/// 54/// /// Prints `bytes_used` from both the directory and file. 55/// fn print_bytes_used(dir: &Directory, file: &File) { 56/// let guard = dir.inner.lock(); 57/// let inner_file = file.inner.access(&guard); 58/// pr_info!("{} {}", guard.bytes_used, inner_file.bytes_used); 59/// } 60/// 61/// /// Increments `bytes_used` for both the directory and file. 62/// fn inc_bytes_used(dir: &Directory, file: &File) { 63/// let mut guard = dir.inner.lock(); 64/// guard.bytes_used += 10; 65/// 66/// let file_inner = file.inner.access_mut(&mut guard); 67/// file_inner.bytes_used += 10; 68/// } 69/// 70/// /// Creates a new file. 71/// fn new_file(ino: u32, dir: &Directory) -> File { 72/// File { 73/// _ino: ino, 74/// inner: LockedBy::new(&dir.inner, InnerFile { bytes_used: 0 }), 75/// } 76/// } 77/// ``` 78pub struct LockedBy<T: ?Sized, U: ?Sized> { 79 owner: *const U, 80 data: UnsafeCell<T>, 81} 82 83// SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can. 84unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {} 85 86// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the 87// data it protects is `Send`. 88unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {} 89 90impl<T, U> LockedBy<T, U> { 91 /// Constructs a new instance of [`LockedBy`]. 92 /// 93 /// It stores a raw pointer to the owner that is never dereferenced. It is only used to ensure 94 /// that the right owner is being used to access the protected data. If the owner is freed, the 95 /// data becomes inaccessible; if another instance of the owner is allocated *on the same 96 /// memory location*, the data becomes accessible again: none of this affects memory safety 97 /// because in any case at most one thread (or CPU) can access the protected data at a time. 98 pub fn new<B: Backend>(owner: &Lock<U, B>, data: T) -> Self { 99 build_assert!( 100 size_of::<Lock<U, B>>() > 0, 101 "The lock type cannot be a ZST because it may be impossible to distinguish instances" 102 ); 103 Self { 104 owner: owner.data.get(), 105 data: UnsafeCell::new(data), 106 } 107 } 108} 109 110impl<T: ?Sized, U> LockedBy<T, U> { 111 /// Returns a reference to the protected data when the caller provides evidence (via a 112 /// reference) that the owner is locked. 113 /// 114 /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&U` that matches 115 /// the data protected by the lock without actually holding it. 116 /// 117 /// # Panics 118 /// 119 /// Panics if `owner` is different from the data protected by the lock used in 120 /// [`new`](LockedBy::new). 121 pub fn access<'a>(&'a self, owner: &'a U) -> &'a T { 122 build_assert!( 123 size_of::<U>() > 0, 124 "`U` cannot be a ZST because `owner` wouldn't be unique" 125 ); 126 if !ptr::eq(owner, self.owner) { 127 panic!("mismatched owners"); 128 } 129 130 // SAFETY: `owner` is evidence that the owner is locked. 131 unsafe { &*self.data.get() } 132 } 133 134 /// Returns a mutable reference to the protected data when the caller provides evidence (via a 135 /// mutable owner) that the owner is locked mutably. 136 /// 137 /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&mut U` that 138 /// matches the data protected by the lock without actually holding it. 139 /// 140 /// Showing a mutable reference to the owner is sufficient because we know no other references 141 /// can exist to it. 142 /// 143 /// # Panics 144 /// 145 /// Panics if `owner` is different from the data protected by the lock used in 146 /// [`new`](LockedBy::new). 147 pub fn access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T { 148 build_assert!( 149 size_of::<U>() > 0, 150 "`U` cannot be a ZST because `owner` wouldn't be unique" 151 ); 152 if !ptr::eq(owner, self.owner) { 153 panic!("mismatched owners"); 154 } 155 156 // SAFETY: `owner` is evidence that there is only one reference to the owner. 157 unsafe { &mut *self.data.get() } 158 } 159} 160