Received-SPF: pass (google.com: domain of linux-kernel+bounces-97893-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Sat, 09 Mar 2024 13:02:07 +0000
To: Alice Ryhl <aliceryhl@google.com>, Miguel Ojeda <ojeda@kernel.org>, Alex Gaynor <alex.gaynor@gmail.com>, Wedson Almeida Filho <wedsonaf@gmail.com>, Boqun Feng <boqun.feng@gmail.com>, Gary Guo <gary@garyguo.net>, =?utf-8?Q?Bj=C3=B6rn_Roy_Baron?= <bjorn3_gh@protonmail.com>, Andreas Hindborg <a.hindborg@samsung.com>
From: Benno Lossin <benno.lossin@proton.me>
Cc: rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 2/2] rust: sync: add `Arc::into_unique_or_drop`
Message-ID: <d52c5d95-99cd-4bd4-864f-b704299d3b1b@proton.me>
In-Reply-To: <20240228-arc-for-list-v2-2-ae93201426b4@google.com>
References: <20240228-arc-for-list-v2-0-ae93201426b4@google.com> <20240228-arc-for-list-v2-2-ae93201426b4@google.com>
Feedback-ID: 71780778:user:proton
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 2/28/24 14:00, Alice Ryhl wrote:
> Decrement the refcount of an `Arc`, but handle the case where it hits
> zero by taking ownership of the now-unique `Arc`, instead of destroying
> and deallocating it.
>=20
> This is a dependency of the linked list that Rust Binder uses. The
> linked list uses this method as part of its `ListArc` abstraction.
>=20
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
>   rust/kernel/sync/arc.rs | 31 +++++++++++++++++++++++++++++++
>   1 file changed, 31 insertions(+)
>=20
> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
> index 53addb8876c2..df2dfe0de83c 100644
> --- a/rust/kernel/sync/arc.rs
> +++ b/rust/kernel/sync/arc.rs
> @@ -290,6 +290,37 @@ pub fn as_arc_borrow(&self) -> ArcBorrow<'_, T> {
>       pub fn ptr_eq(this: &Self, other: &Self) -> bool {
>           core::ptr::eq(this.ptr.as_ptr(), other.ptr.as_ptr())
>       }
> +
> +    /// Converts this [`Arc`] into a [`UniqueArc`], or destroys it if it=
 is not unique.
> +    ///
> +    /// When this destroys the `Arc`, it does so while properly avoiding=
 races. This means that
> +    /// this method will never call the destructor of the value.
> +    pub fn into_unique_or_drop(self) -> Option<Pin<UniqueArc<T>>> {
> +        // We will manually manage the refcount in this method, so we di=
sable the destructor.
> +        let me =3D ManuallyDrop::new(self);
> +        // SAFETY: We own a refcount, so the pointer is still valid.
> +        let refcount =3D unsafe { me.ptr.as_ref() }.refcount.get();
> +
> +        // SAFETY: If the refcount reaches a non-zero value, then we hav=
e destroyed this `Arc` and
> +        // will return without further touching the `Arc`. If the refcou=
nt reaches zero, then there
> +        // are no other arcs, and we can create a `UniqueArc`.

This comment is not explaining why it is safe to call
`refcount_dec_and_test` on `refcount`.
It dose however explain what you are going to do, so please keep it, but
not as a SAFETY comment.

> +        let is_zero =3D unsafe { bindings::refcount_dec_and_test(refcoun=
t) };
> +        if is_zero {
> +            // SAFETY: We have exclusive access to the arc, so we can pe=
rform unsynchronized
> +            // accesses to the refcount.
> +            unsafe { core::ptr::write(refcount, bindings::REFCOUNT_INIT(=
1)) };
> +
> +            // SAFETY: We own one refcount, so we can create a `UniqueAr=
c`. It needs to be pinned,
> +            // since an `Arc` is pinned.

The `unsafe` block is only needed due to the `new_unchecked` call, which
you could avoid by using `.into()`. The `SAFETY` should also be an
`INVARIANT` comment instead.

--=20
Cheers,
Benno

> +            unsafe {
> +                Some(Pin::new_unchecked(UniqueArc {
> +                    inner: Arc::from_inner(me.ptr),
> +                }))
> +            }
> +        } else {
> +            None
> +        }
> +    }
>   }
>=20
>   impl<T: 'static> ForeignOwnable for Arc<T> {
>=20
> --
> 2.44.0.rc1.240.g4c46232300-goog
>=20