1// SPDX-License-Identifier: GPL-2.0
  2
  3//! A wrapper for data protected by a lock that does not wrap it.
  4
  5use super::{lock::Backend, lock::Lock};
  6use crate::build_assert;
  7use core::{cell::UnsafeCell, mem::size_of, ptr};
  8
  9/// Allows access to some data to be serialised by a lock that does not wrap it.
 10///
 11/// In most cases, data protected by a lock is wrapped by the appropriate lock type, e.g.,
 12/// [`Mutex`] or [`SpinLock`]. [`LockedBy`] is meant for cases when this is not possible.
 13/// For example, if a container has a lock and some data in the contained elements needs
 14/// to be protected by the same lock.
 15///
 16/// [`LockedBy`] wraps the data in lieu of another locking primitive, and only allows access to it
 17/// when the caller shows evidence that the 'external' lock is locked. It panics if the evidence
 18/// refers to the wrong instance of the lock.
 19///
 20/// [`Mutex`]: super::Mutex
 21/// [`SpinLock`]: super::SpinLock
 22///
 23/// # Examples
 24///
 25/// The following is an example for illustrative purposes: `InnerDirectory::bytes_used` is an
 26/// aggregate of all `InnerFile::bytes_used` and must be kept consistent; so we wrap `InnerFile` in
 27/// a `LockedBy` so that it shares a lock with `InnerDirectory`. This allows us to enforce at
 28/// compile-time that access to `InnerFile` is only granted when an `InnerDirectory` is also
 29/// locked; we enforce at run time that the right `InnerDirectory` is locked.
 30///
 31/// ```
 32/// use kernel::sync::{LockedBy, Mutex};
 33///
 34/// struct InnerFile {
 35///     bytes_used: u64,
 36/// }
 37///
 38/// struct File {
 39///     _ino: u32,
 40///     inner: LockedBy<InnerFile, InnerDirectory>,
 41/// }
 42///
 43/// struct InnerDirectory {
 44///     /// The sum of the bytes used by all files.
 45///     bytes_used: u64,
 46///     _files: KVec<File>,
 47/// }
 48///
 49/// struct Directory {
 50///     _ino: u32,
 51///     inner: Mutex<InnerDirectory>,
 52/// }
 53///
 54/// /// Prints `bytes_used` from both the directory and file.
 55/// fn print_bytes_used(dir: &Directory, file: &File) {
 56///     let guard = dir.inner.lock();
 57///     let inner_file = file.inner.access(&guard);
 58///     pr_info!("{} {}", guard.bytes_used, inner_file.bytes_used);
 59/// }
 60///
 61/// /// Increments `bytes_used` for both the directory and file.
 62/// fn inc_bytes_used(dir: &Directory, file: &File) {
 63///     let mut guard = dir.inner.lock();
 64///     guard.bytes_used += 10;
 65///
 66///     let file_inner = file.inner.access_mut(&mut guard);
 67///     file_inner.bytes_used += 10;
 68/// }
 69///
 70/// /// Creates a new file.
 71/// fn new_file(ino: u32, dir: &Directory) -> File {
 72///     File {
 73///         _ino: ino,
 74///         inner: LockedBy::new(&dir.inner, InnerFile { bytes_used: 0 }),
 75///     }
 76/// }
 77/// ```
 78pub struct LockedBy<T: ?Sized, U: ?Sized> {
 79    owner: *const U,
 80    data: UnsafeCell<T>,
 81}
 82
 83// SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.
 84unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}
 85
 86// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use
 87// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is
 88// sufficient to allow that.
 89//
 90// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain
 91// several `&T` from several threads at once. However, this is okay as `T` is `Sync`.
 92unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}
 93
 94impl<T, U> LockedBy<T, U> {
 95    /// Constructs a new instance of [`LockedBy`].
 96    ///
 97    /// It stores a raw pointer to the owner that is never dereferenced. It is only used to ensure
 98    /// that the right owner is being used to access the protected data. If the owner is freed, the
 99    /// data becomes inaccessible; if another instance of the owner is allocated *on the same
100    /// memory location*, the data becomes accessible again: none of this affects memory safety
101    /// because in any case at most one thread (or CPU) can access the protected data at a time.
102    pub fn new<B: Backend>(owner: &Lock<U, B>, data: T) -> Self {
103        build_assert!(
104            size_of::<Lock<U, B>>() > 0,
105            "The lock type cannot be a ZST because it may be impossible to distinguish instances"
106        );
107        Self {
108            owner: owner.data.get(),
109            data: UnsafeCell::new(data),
110        }
111    }
112}
113
114impl<T: ?Sized, U> LockedBy<T, U> {
115    /// Returns a reference to the protected data when the caller provides evidence (via a
116    /// reference) that the owner is locked.
117    ///
118    /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&U` that matches
119    /// the data protected by the lock without actually holding it.
120    ///
121    /// # Panics
122    ///
123    /// Panics if `owner` is different from the data protected by the lock used in
124    /// [`new`](LockedBy::new).
125    pub fn access<'a>(&'a self, owner: &'a U) -> &'a T
126    where
127        T: Sync,
128    {
129        build_assert!(
130            size_of::<U>() > 0,
131            "`U` cannot be a ZST because `owner` wouldn't be unique"
132        );
133        if !ptr::eq(owner, self.owner) {
134            panic!("mismatched owners");
135        }
136
137        // SAFETY: `owner` is evidence that there are only shared references to the owner for the
138        // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable
139        // reference to the inner value that aliases with this shared reference. The type is `Sync`
140        // so there are no other requirements.
141        unsafe { &*self.data.get() }
142    }
143
144    /// Returns a mutable reference to the protected data when the caller provides evidence (via a
145    /// mutable owner) that the owner is locked mutably.
146    ///
147    /// `U` cannot be a zero-sized type (ZST) because there are ways to get an `&mut U` that
148    /// matches the data protected by the lock without actually holding it.
149    ///
150    /// Showing a mutable reference to the owner is sufficient because we know no other references
151    /// can exist to it.
152    ///
153    /// # Panics
154    ///
155    /// Panics if `owner` is different from the data protected by the lock used in
156    /// [`new`](LockedBy::new).
157    pub fn access_mut<'a>(&'a self, owner: &'a mut U) -> &'a mut T {
158        build_assert!(
159            size_of::<U>() > 0,
160            "`U` cannot be a ZST because `owner` wouldn't be unique"
161        );
162        if !ptr::eq(owner, self.owner) {
163            panic!("mismatched owners");
164        }
165
166        // SAFETY: `owner` is evidence that there is only one reference to the owner.
167        unsafe { &mut *self.data.get() }
168    }
169}