Messages in this thread | | | Date | Sat, 09 Mar 2024 13:02:07 +0000 | From | Benno Lossin <> | Subject | Re: [PATCH v2 2/2] rust: sync: add `Arc::into_unique_or_drop` |
| |
On 2/28/24 14:00, Alice Ryhl wrote: > Decrement the refcount of an `Arc`, but handle the case where it hits > zero by taking ownership of the now-unique `Arc`, instead of destroying > and deallocating it. > > This is a dependency of the linked list that Rust Binder uses. The > linked list uses this method as part of its `ListArc` abstraction. > > Signed-off-by: Alice Ryhl <aliceryhl@google.com> > --- > rust/kernel/sync/arc.rs | 31 +++++++++++++++++++++++++++++++ > 1 file changed, 31 insertions(+) > > diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs > index 53addb8876c2..df2dfe0de83c 100644 > --- a/rust/kernel/sync/arc.rs > +++ b/rust/kernel/sync/arc.rs > @@ -290,6 +290,37 @@ pub fn as_arc_borrow(&self) -> ArcBorrow<'_, T> { > pub fn ptr_eq(this: &Self, other: &Self) -> bool { > core::ptr::eq(this.ptr.as_ptr(), other.ptr.as_ptr()) > } > + > + /// Converts this [`Arc`] into a [`UniqueArc`], or destroys it if it is not unique. > + /// > + /// When this destroys the `Arc`, it does so while properly avoiding races. This means that > + /// this method will never call the destructor of the value. > + pub fn into_unique_or_drop(self) -> Option<Pin<UniqueArc<T>>> { > + // We will manually manage the refcount in this method, so we disable the destructor. > + let me = ManuallyDrop::new(self); > + // SAFETY: We own a refcount, so the pointer is still valid. > + let refcount = unsafe { me.ptr.as_ref() }.refcount.get(); > + > + // SAFETY: If the refcount reaches a non-zero value, then we have destroyed this `Arc` and > + // will return without further touching the `Arc`. If the refcount reaches zero, then there > + // are no other arcs, and we can create a `UniqueArc`.
This comment is not explaining why it is safe to call `refcount_dec_and_test` on `refcount`. It dose however explain what you are going to do, so please keep it, but not as a SAFETY comment.
> + let is_zero = unsafe { bindings::refcount_dec_and_test(refcount) }; > + if is_zero { > + // SAFETY: We have exclusive access to the arc, so we can perform unsynchronized > + // accesses to the refcount. > + unsafe { core::ptr::write(refcount, bindings::REFCOUNT_INIT(1)) }; > + > + // SAFETY: We own one refcount, so we can create a `UniqueArc`. It needs to be pinned, > + // since an `Arc` is pinned.
The `unsafe` block is only needed due to the `new_unchecked` call, which you could avoid by using `.into()`. The `SAFETY` should also be an `INVARIANT` comment instead.
-- Cheers, Benno
> + unsafe { > + Some(Pin::new_unchecked(UniqueArc { > + inner: Arc::from_inner(me.ptr), > + })) > + } > + } else { > + None > + } > + } > } > > impl<T: 'static> ForeignOwnable for Arc<T> { > > -- > 2.44.0.rc1.240.g4c46232300-goog >
| |