1 // SPDX-License-Identifier: GPL-2.0
2 
3 //! A wrapper for data protected by a lock that does not wrap it.
4 
5 use super::{lock::Backend, lock::Lock};
6 use crate::build_assert;
7 use core::{cell::UnsafeCell, mem::size_of, ptr};
8 
9 /// Allows access to some data to be serialised by a lock that does not wrap it.
10 ///
11 /// In most cases, data protected by a lock is wrapped by the appropriate lock type, e.g.,
12 /// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is meant for cases when this is not possible.
13 /// For example, if a container has a lock and some data in the contained elements needs
14 /// to be protected by the same lock.
15 ///
16 /// [`LockedBy`] wraps the data in lieu of another locking primitive, and only allows access to it
17 /// when the caller shows evidence that the 'external' lock is locked. It panics if the evidence
18 /// refers to the wrong instance of the lock.
19 ///
20 /// [`Mutex`]: super::Mutex
21 /// [`SpinLock`]: super::SpinLock
22 ///
23 /// # Examples
24 ///
25 /// The following is an example for illustrative purposes: `InnerDirectory::bytes_used` is an
26 /// aggregate of all `InnerFile::bytes_used` and must be kept consistent; so we wrap `InnerFile` in
27 /// a `LockedBy` so that it shares a lock with `InnerDirectory`. This allows us to enforce at
28 /// compile-time that access to `InnerFile` is only granted when an `InnerDirectory` is also
29 /// locked; we enforce at run time that the right `InnerDirectory` is locked.
30 ///
31 /// ```
32 /// use kernel::sync::{LockedBy, Mutex};
33 ///
34 /// struct InnerFile {
35 ///     bytes_used: u64,
36 /// }
37 ///
38 /// struct File {
39 ///     _ino: u32,
40 ///     inner: LockedBy<InnerFile, InnerDirectory>,
41 /// }
42 ///
43 /// struct InnerDirectory {
44 ///     /// The sum of the bytes used by all files.
45 ///     bytes_used: u64,
46 ///     _files: Vec<File>,
47 /// }
48 ///
49 /// struct Directory {
50 ///     _ino: u32,
51 ///     inner: Mutex<InnerDirectory>,
52 /// }
53 ///
54 /// /// Prints `bytes_used` from both the directory and file.
55 /// fn print_bytes_used(dir: &Directory, file: &File) {
56 ///     let guard = dir.inner.lock();
57 ///     let inner_file = file.inner.access(&guard);
58 ///     pr_info!("{} {}", guard.bytes_used, inner_file.bytes_used);
59 /// }
60 ///
61 /// /// Increments `bytes_used` for both the directory and file.
62 /// fn inc_bytes_used(dir: &Directory, file: &File) {
63 ///     let mut guard = dir.inner.lock();
64 ///     guard.bytes_used += 10;
65 ///
66 ///     let file_inner = file.inner.access_mut(&mut guard);
67 ///     file_inner.bytes_used += 10;
68 /// }
69 ///
70 /// /// Creates a new file.
71 /// fn new_file(ino: u32, dir: &Directory) -> File {
72 ///     File {
73 ///         _ino: ino,
74 ///         inner: LockedBy::new(&dir.inner, InnerFile { bytes_used: 0 }),
75 ///     }
76 /// }
77 /// ```
78 pub struct LockedBy<T: ?Sized, U: ?Sized> {
79     owner: *const U,
80     data: UnsafeCell<T>,
81 }
82 
83 // SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.
84 unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}
85 
86 // SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use
87 // `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is
88 // sufficient to allow that.
89 //
90 // If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain
91 // several `&T` from several threads at once. However, this is okay as `T` is `Sync`.
92 unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}
93 
94 impl<T, U> LockedBy<T, U> {
95     /// Constructs a new instance of [`LockedBy`].
96     ///
97     /// It stores a raw pointer to the owner that is never dereferenced. It is only used to ensure
98     /// that the right owner is being used to access the protected data. If the owner is freed, the
99     /// data becomes inaccessible; if another instance of the owner is allocated *on the same
100     /// memory location*, the data becomes accessible again: none of this affects memory safety
101     /// because in any case at most one thread (or CPU) can access the protected data at a time.
new<B: Backend>(owner: &Lock<U, B>, data: T) -> Self102     pub fn new<B: Backend>(owner: &Lock<U, B>, data: T) -> Self {
103         build_assert!(
104             size_of::<Lock<U, B>>() > 0,
105             "The lock type cannot be a ZST because it may be impossible to distinguish instances"
106         );
107         Self {
108             owner: owner.data.get(),
109             data: UnsafeCell::new(data),
110         }
111     }
112 }
113 
114 impl<T: ?Sized, U> LockedBy<T, U> {
115     /// Returns a reference to the protected data when the caller provides evidence (via a
116     /// reference) that the owner is locked.
117     ///
118     /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&U` that matches
119     /// the data protected by the lock without actually holding it.
120     ///
121     /// # Panics
122     ///
123     /// Panics if `owner` is different from the data protected by the lock used in
124     /// [`new`](LockedBy::new).
access<'a>(&'a self, owner: &'a U) -> &'a T where T: Sync,125     pub fn access<'a>(&'a self, owner: &'a U) -> &'a T
126     where
127         T: Sync,
128     {
129         build_assert!(
130             size_of::<U>() > 0,
131             "`U` cannot be a ZST because `owner` wouldn't be unique"
132         );
133         if !ptr::eq(owner, self.owner) {
134             panic!("mismatched owners");
135         }
136 
137         // SAFETY: `owner` is evidence that there are only shared references to the owner for the
138         // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable
139         // reference to the inner value that aliases with this shared reference. The type is `Sync`
140         // so there are no other requirements.
141         unsafe { &*self.data.get() }
142     }
143 
144     /// Returns a mutable reference to the protected data when the caller provides evidence (via a
145     /// mutable owner) that the owner is locked mutably.
146     ///
147     /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&mut U` that
148     /// matches the data protected by the lock without actually holding it.
149     ///
150     /// Showing a mutable reference to the owner is sufficient because we know no other references
151     /// can exist to it.
152     ///
153     /// # Panics
154     ///
155     /// Panics if `owner` is different from the data protected by the lock used in
156     /// [`new`](LockedBy::new).
access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T157     pub fn access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T {
158         build_assert!(
159             size_of::<U>() > 0,
160             "`U` cannot be a ZST because `owner` wouldn't be unique"
161         );
162         if !ptr::eq(owner, self.owner) {
163             panic!("mismatched owners");
164         }
165 
166         // SAFETY: `owner` is evidence that there is only one reference to the owner.
167         unsafe { &mut *self.data.get() }
168     }
169 }
170