Re: proposal: some pointer and arithmetic utilities

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

   Date: Thu, 21 Mar 2013 22:25:05 +0100
   From: Rhialto <rhialto%falu.nl@localhost>

   Even if you use your container_of macro, there is no proof that the
   pointer you receive is actually of the type you expect, only that you're
   using the correct offsets if by accident it is.

   What you should IMHO really do is convert the function pointer to
   physio_done() to the correct type as expected by workqueue_enqueue(),
   and at *that* point prove somehow that it is correct. Not inside
   physio_done().

We could also add a void * member to struct work:

        bp->b_work.wk_data = &bp;
        workqueue_enqueue(physio_workqueue, &bp->b_work, NULL);

        ...

        struct buf *bp = wk->wk_data;

Of course, you would have to prove that the pointer that got put into
wk->wk_data was actually a struct buf.  With any of these three
approaches -- container_of, function pointer conversion, extra void *
member -- you have to prove something, which in the case of workqueues
is provided by the semantics of the workqueue abstraction.  I'm only
proposing a safer way to express an idiom that we already use
extensively.