Re: [PATCH v6 3/3] rust: sync: Add SpinLockIrq

[Andreas Hindborg <a.hindborg@kernel.org>]

Boqun Feng <boqun.feng@gmail.com> writes:

> On Sat, Oct 05, 2024 at 02:19:38PM -0400, Lyude Paul wrote:
>> On Fri, 2024-10-04 at 14:48 -0400, Lyude Paul wrote:
>> > 
>> > FWIW: I agree we want things to map C closely wherever we can, but part of the
>> > reason of having rust in the kernel at all is to take advantage of the
>> > features it provides us that aren't in C - so there's always going to be
>> > differences in some places. This being said though, I'm more then happy to
>> > minimize those as much as possible and explore ways to figure out how to make
>> > it so that correctly using these interfaces is as obvious and not-error prone
>> > as possible. The last thing I want is to encourage bad patterns in drivers
>> > that maintainers have to deal with the headaches of for ages to come,
>> > especially when rust should be able to help with this as opposed to harm :).
>> 
>> I was thinking about this a bit more today and I realized I might actually
>> have a better solution that I think would actually map a lot closer to the C
>> primitives and I feel a bit silly it didn't occur to me before.
>> 
>> What if instead of with_interrupts_disabled, we extended Lock so that types
>> like SpinLockIrq that require a context like IrqDisabled can require the use
>> of two new methods:
>> 
>> * first_lock<R>(&self, cb: impl for<'a> FnOnce(Guard<'a, T, B>, B::Context<'a>) -> R) -> R
>
> I think you really want to use a `&mut T` instead of `Guard<'a, T, B>`,
> otherwise people can do:
>
> 	let g = lock1.first_lock(|guard, _ctx| { guard });
> 	// here the lock is held, but the interrupts might be enabled.

Is it impossible to limit the lifetime of the guard such that it cannot
be returned from `first_lock`?

BR Andreas