On Tue Aug 25, 2026 at 1:16 PM BST, Andreas Hindborg wrote: > From: FUJITA Tomonori <[email protected]> > > HrTimerCallbackContext acquires a &HrTimer<T> from a > NonNull<HrTimer<T>> while a &mut HrTimer<T> can exist at the same > time. This is sound only because HrTimer's sole field is > Opaque<bindings::hrtimer>, which puts every byte behind an UnsafeCell. > Adding a field to HrTimer that is not Opaque would make acquiring that > shared reference unsound.
HrTimerCallbackContext is removed in patch 4, though? Still worh preferring `#[repr(transparent)]` over `#[repr(C)]`, but the motivation should be reworded and the comment on `HrTimer` should be removed. Best, Gary > > Make HrTimer repr(transparent), which prevents multiple fields, so that > such a refactor fails to compile instead of silently introducing > unsoundness. This does not guarantee the remaining field stays behind > Opaque, but it rules out the likely way of getting there. > > repr(transparent) cannot be combined with repr(C), so drop the latter. > > Suggested-by: Miguel Ojeda <[email protected]> > Reviewed-by: Andreas Hindborg <[email protected]> > Signed-off-by: FUJITA Tomonori <[email protected]> > Link: https://msgid.link/[email protected] > Signed-off-by: Andreas Hindborg <[email protected]> > --- > rust/kernel/time/hrtimer.rs | 6 +++++- > rust/kernel/time/hrtimer/arc.rs | 2 +- > rust/kernel/time/hrtimer/pin.rs | 2 +- > rust/kernel/time/hrtimer/pin_mut.rs | 2 +- > rust/kernel/time/hrtimer/tbox.rs | 2 +- > 5 files changed, 9 insertions(+), 5 deletions(-) > > diff --git a/rust/kernel/time/hrtimer.rs b/rust/kernel/time/hrtimer.rs > index 2a9abc9f5d8c..ab7c568b8855 100644 > --- a/rust/kernel/time/hrtimer.rs > +++ b/rust/kernel/time/hrtimer.rs > @@ -427,8 +427,12 @@ > /// # Invariants > /// > /// * `self.timer` is initialized by `bindings::hrtimer_setup_ext`. > +// `repr(transparent)` is not merely about layout. `HrTimerCallbackContext` > acquires a > +// `&HrTimer<T>` while a `&mut HrTimer<T>` may exist, which is sound only > because every byte of > +// this type sits inside `Opaque`. Being transparent rejects a second field > at compile time, > +// but it does not enforce that the remaining field stays `Opaque`. > #[pin_data] > -#[repr(C)] > +#[repr(transparent)] > pub struct HrTimer<T> { > #[pin] > timer: Opaque<bindings::hrtimer>,
