rust: list: add cursor

The cursor is very similar to the list iterator, but it has one
important feature that the iterator doesn't: it can be used to remove
items from the linked list.

This feature cannot be added to the iterator because the references you
get from the iterator are considered borrows of the original list,
rather than borrows of the iterator. This means that there's no way to
prevent code like this:

let item = iter.next();
iter.remove();
use(item);

If `iter` was a cursor instead of an iterator, then `item` will be
considered a borrow of `iter`. Since `remove` destroys `iter`, this
means that the borrow-checker will prevent uses of `item` after the call
to `remove`.

So there is a trade-off between supporting use in traditional for loops,
and supporting removal of elements as you iterate. Iterators and cursors
represents two different choices on that spectrum.

Rust Binder needs cursors for the list of death notifications that a
process is currently handling. When userspace tells Binder that it has
finished processing the death notification, Binder will iterate the list
to search for the relevant item and remove it.

Reviewed-by: Benno Lossin <benno.lossin@proton.me>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240814-linked-list-v5-8-f5f5e8075da0@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>

authored by

Alice Ryhl and committed by

Miguel Ojeda 2 years ago 9078a4f9 deeecc9c

+82

1 changed file

expand all

rust

kernel

list.rs

+82

rust/kernel/list.rs

··· 440 440 other.first = ptr::null_mut(); 441 441 } 442 442 443 + /// Returns a cursor to the first element of the list. 444 + /// 445 + /// If the list is empty, this returns `None`. 446 + pub fn cursor_front(&mut self) -> Option<Cursor<'_, T, ID>> { 447 + if self.first.is_null() { 448 + None 449 + } else { 450 + Some(Cursor { 451 + current: self.first, 452 + list: self, 453 + }) 454 + } 455 + } 456 + 443 457 /// Creates an iterator over the list. 444 458 pub fn iter(&self) -> Iter<'_, T, ID> { 445 459 // INVARIANT: If the list is empty, both pointers are null. Otherwise, both pointers point ··· 525 511 // lifetime, and the list is immutably borrowed for that lifetime. 526 512 // * Values in a list never have a `UniqueArc` reference. 527 513 Some(unsafe { ArcBorrow::from_raw(item) }) 514 + } 515 + } 516 + 517 + /// A cursor into a [`List`]. 518 + /// 519 + /// # Invariants 520 + /// 521 + /// The `current` pointer points a value in `list`. 522 + pub struct Cursor<'a, T: ?Sized + ListItem<ID>, const ID: u64 = 0> { 523 + current: *mut ListLinksFields, 524 + list: &'a mut List<T, ID>, 525 + } 526 + 527 + impl<'a, T: ?Sized + ListItem<ID>, const ID: u64> Cursor<'a, T, ID> { 528 + /// Access the current element of this cursor. 529 + pub fn current(&self) -> ArcBorrow<'_, T> { 530 + // SAFETY: The `current` pointer points a value in the list. 531 + let me = unsafe { T::view_value(ListLinks::from_fields(self.current)) }; 532 + // SAFETY: 533 + // * All values in a list are stored in an `Arc`. 534 + // * The value cannot be removed from the list for the duration of the lifetime annotated 535 + // on the returned `ArcBorrow`, because removing it from the list would require mutable 536 + // access to the cursor or the list. However, the `ArcBorrow` holds an immutable borrow 537 + // on the cursor, which in turn holds a mutable borrow on the list, so any such 538 + // mutable access requires first releasing the immutable borrow on the cursor. 539 + // * Values in a list never have a `UniqueArc` reference, because the list has a `ListArc` 540 + // reference, and `UniqueArc` references must be unique. 541 + unsafe { ArcBorrow::from_raw(me) } 542 + } 543 + 544 + /// Move the cursor to the next element. 545 + pub fn next(self) -> Option<Cursor<'a, T, ID>> { 546 + // SAFETY: The `current` field is always in a list. 547 + let next = unsafe { (*self.current).next }; 548 + 549 + if next == self.list.first { 550 + None 551 + } else { 552 + // INVARIANT: Since `self.current` is in the `list`, its `next` pointer is also in the 553 + // `list`. 554 + Some(Cursor { 555 + current: next, 556 + list: self.list, 557 + }) 558 + } 559 + } 560 + 561 + /// Move the cursor to the previous element. 562 + pub fn prev(self) -> Option<Cursor<'a, T, ID>> { 563 + // SAFETY: The `current` field is always in a list. 564 + let prev = unsafe { (*self.current).prev }; 565 + 566 + if self.current == self.list.first { 567 + None 568 + } else { 569 + // INVARIANT: Since `self.current` is in the `list`, its `prev` pointer is also in the 570 + // `list`. 571 + Some(Cursor { 572 + current: prev, 573 + list: self.list, 574 + }) 575 + } 576 + } 577 + 578 + /// Remove the current element from the list. 579 + pub fn remove(self) -> ListArc<T, ID> { 580 + // SAFETY: The `current` pointer always points at a member of the list. 581 + unsafe { self.list.remove_internal(self.current) } 528 582 } 529 583 } 530 584

Configure Feed

Configure Feed