From 2ea0119f72dba597aa8a98cbdb72c564bfc5cb38 Mon Sep 17 00:00:00 2001 From: Andreas Hindborg Date: Sun, 15 Feb 2026 21:36:04 +0100 Subject: [PATCH] rust: hrtimer: document handle based design rationale Add implementation notes explaining why the hrtimer abstraction uses a handle based approach. Reviewed-by: Alice Ryhl Reviewed-by: Boqun Feng Reviewed-by: FUJITA Tomonori Link: https://msgid.link/20260215-hrtimer-docs-v1-1-bff6a6c0d923@kernel.org Signed-off-by: Andreas Hindborg --- rust/kernel/time/hrtimer.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/rust/kernel/time/hrtimer.rs b/rust/kernel/time/hrtimer.rs index 87aafbee0ce9..c0180b8ca5d3 100644 --- a/rust/kernel/time/hrtimer.rs +++ b/rust/kernel/time/hrtimer.rs @@ -402,6 +402,17 @@ //! ``` //! //! [`Arc`]: kernel::sync::Arc +// Implementation details +// +// The reasoning for adopting a handle based approach: +// - If we explicitly drop the target of a timer callback in the timer callback, we +// may get a dangling reference. +// - If the callback owns the last reference to the target, target may be dropped +// in non-sleepable context when the callback is finished. +// - When dropping an object that is the target of an armed timer, we may drop +// fields accessed by the timer callback before we cancel the timer (drop order). +// +// By using a handle, we can make the handle own the callback target and avoid these problems. use super::{ClockId, Delta, Instant}; use crate::{prelude::*, types::Opaque};