Re: [PATCH v3 1/3] rust: clk: use the type-state pattern

Maxime Ripard
2026-02-12T13:38:23Z

[-- Attachment #1: Type: text/plain, Size: 9257 bytes --]

Hi Alice,

On Thu, Feb 12, 2026 at 09:16:51AM +0100, Alice Ryhl wrote:
> On Wed, Feb 11, 2026 at 5:37 PM Maxime Ripard <mripard@kernel.org> wrote:
> > On Mon, Feb 09, 2026 at 10:50:47AM +0100, Boris Brezillon wrote:
> > > On Wed, 4 Feb 2026 15:34:29 +0100
> > > Maxime Ripard <mripard@kernel.org> wrote:
> > >
> > > > On Wed, Feb 04, 2026 at 09:43:55AM -0300, Daniel Almeida wrote:
> > > > > > I'm probably missing something then, but let's assume you have a driver
> > > > > > that wants its clock prepared and enabled in an hypothetical enable()
> > > > > > callback, and disabled / unprepared in a disable() callback.
> > > > > >
> > > > > > From a PM management perspective, this usecase makes total sense, is a
> > > > > > valid usecase, is widely used in the kernel, and is currently supported
> > > > > > by both the C and Rust clk APIs.
> > > > > >
> > > > > > The only solution to this you suggested so far (I think?) to implement
> > > > > > this on top of the new clk API you propose is to have a driver specific
> > > > > > enum that would store each of the possible state transition.
> > > > >
> > > > > Yes, you need an enum _if_ you want to model transitions at runtime. IIUC you
> > > > > only need two variants to implement the pattern you described. I do not
> > > > > consider this “boilerplate”, but rather a small cost to pay.
> > > >
> > > > A maintenance cost to pay by every driver is kind of the textbook
> > > > definition of boilerplate to me.
> > > >
> > > > > I would understand if this was some elaborate pattern that had to be
> > > > > implemented by all drivers, but a two-variant enum is as
> > > > > straightforward as it gets.
> > > >
> > > > And yet, that framework has dozens of helpers that do not remove
> > > > anything from drivers but a couple of lines. So surely its users must
> > > > find value in reducing that boilerplate as much as possible. And you do
> > > > implement some of them, so you must find value in that too.
> > > >
> > > > > > That's the boilerplate I'm talking about. If every driver wanting to
> > > > > > implement that pattern has to make such an enum, with all the relevant
> > > > > > traits implementation that might come with it, we go from an API where
> > > > > > everything works at no-cost from a code-size perspective to a situation
> > > > > > where every driver has to develop and maintain that enum.
> > > > >
> > > > > There are no "traits that come with it". It's just an enum, with two
> > > > > variants.
> > > > >
> > > > > > API where everything works at no-cost
> > > > >
> > > > > The previous API was far from “everything works”. It was fundamentally
> > > > > broken by design in multiple ways, i.e.:
> > > >
> > > > Out of context and not what I meant, but ok.
> > > >
> > > > > > a) It only keeps track of a count to clk_get(), which means that users have
> > > > > > to manually call disable() and unprepare(), or a variation of those, like
> > > > > > disable_unprepare().
> > > > > >
> > > > > > b) It allows repeated calls to prepare() or enable(), but it keeps no track
> > > > > > of how often these were called, i.e., it's currently legal to write the
> > > > > > following:
> > > > > >
> > > > > > clk.prepare();
> > > > > > clk.prepare();
> > > > > > clk.enable();
> > > > > > clk.enable();
> > > > > >
> > > > > > And nothing gets undone on drop().
> > > > >
> > > > > IMHO, what we have here is an improvement that has been long overdue.
> > > >
> > > > Nothing is absolute. It is indeed an improvement on the refcounting side
> > > > of things and general safety of the API for the general case. I don't
> > > > think I ever questionned that.
> > > >
> > > > However, for the use-cases we've been discussing (and dozens of drivers
> > > > implementing it), it also comes with a regression in the amount of code
> > > > to create and maintain. They used to be able to only deal with the Clk
> > > > structure, and now they can't anymore.
> > > >
> > > > You might find that neglible, you might have a plan to address that in
> > > > the future, etc. and that's fine, but if you can't acknowledge that it's
> > > > indeed happening, there's no point in me raising the issue and
> > > > continuing the discussion.
> > >
> > >
> > > Okay, let's see if I can sum-up the use case you'd like to support. You
> > > have some PM hooks, which I'm assuming are (or will be) written in
> > > rust. It will probably take the form of some Device{Rpm,Pm} trait to
> > > implement for your XxxDeviceData (Xxx being the bus under which is
> > > device is) object (since I've only recently joined the R4L effort, I
> > > wouldn't be surprised if what I'm describing already exists or is
> > > currently being proposed/reviewed somewhere, so please excuse my
> > > ignorance if that's the case :-)).
> > >
> > > The way I see it, rather than having one enum per clk/regulator/xxx
> > > where we keep track of each state individually, what we could have is a
> > >
> > > trait DevicePm {
> > > type ResumedState;
> > > type SuspendedState;
> > >
> > > fn resume(&self, state: SuspendedState) -> Result<ResumedState, Error<SuspendedState>>;
> > > fn suspend(&self, state: SuspendedState) -> Result<SuspendedState, Error<ResumedState>>;
> > > };
> > >
> > > enum DeviceState<T: DevicePm> {
> > > Resumed(T::ResumedState),
> > > Suspended(T::SuspendedState),
> > > };
> > >
> > > and then in your driver:
> > >
> > > MySuspendedDeviceResources {
> > > xxx_clk: Clk<Unprepared>,
> > > };
> > >
> > > MyResumedDeviceResources {
> > > xxx_clk: Clk<Enabled>,
> > > };
> > >
> > > implem DevicePm for MyDevice {
> > > type ResumedState = MyResumedDeviceResources;
> > > type SuspendedState = MySuspendedDeviceResources;
> > >
> > > fn resume(&self, state: SuspendedState) -> Result<ResumedState, Error<SuspendedState>> {
> > > // FIXME: error propagation not handled
> > > let enabled_clk = state.xxx_clk.clone().prepare()?.enable()?;
> > >
> > > Ok(ResumedState {
> > > xxx_clk: enabled_clk,
> > > });
> > > }
> > >
> > > fn suspend(&self, state: ResumedState) -> Result<SuspendedState, Error<ResumedState>> {
> > > // FIXME: error propagation not handled
> > > let unprep_clk = state.xxx_clk.clone().disable().unprepare();
> > >
> > > Ok(SuspendedState {
> > > xxx_clk: unprep_clk,
> > > });
> > > }
> > > };
> >
> > I'm not sure we need to associate this with the suspend/resume state either.
> >
> > > With this model, I don't think Daniel's refactor goes in the way of more
> > > generalization at the core level, it's just expressed differently than
> > > it would be if it was written in C. And I say that as someone who struggles
> > > with his C developer bias every time I'm looking at or trying to write
> > > rust code.
> > >
> > > As others have said in this thread (Danilo and Gary), and after having
> > > played myself with both approaches in Tyr, I do see this shift from manual
> > > prepare/enable to an RAII approach as an improvement, so I hope we can
> > > find a middle-ground where every one is happy.
> >
> > I do think we can find a compromise though. Miguel suggested for example
> > to make the current enable/prepare/disable/unprepare function unsafe,
> > and that's totally reasonable to me.
> >
> > Then we can implement the "managed" clock version on that unsafe API,
> > and we would end up with a "raw", unsafe, version kind of equivalent to
> > the one we have today, and where callers would have to justify why their
> > usage of the API is actually safe, or the new, managed, variant that is
> > safe and can be easily used by most drivers.
> >
> > And we can call these RawClk vs Clk, or Clk vs ManagedClk, or whatever.
> >
> > How does that sound?
>
> If you make the raw API unsafe, then that's okay but any use of an
> unsafe API from a driver will receive very hard scrutiny.

And that's totally fair to me. If drivers want to have a more optimal
but potentially unsafe use of the API, then it should be flagged,
documented and scrutinized.

> Yes, there are occasionally good reasons to use unsafe from drivers,
> but the entire point of this Rust exercise is to isolate unsafe code
> outside of drivers as much as possible.

So, aside from the risk of fuckups, are you concerned about something
here? Do you expect that scrutiny to be constly on the maintenance side
of things?

I guess what I'm asking is: except for the obvious "review" cost
associated with it, why would that be a probleme if we have, say, a few
dozen drivers using that unsafe API?

> If Daniel's proposal is inconvenient for some drivers, it would be far
> better to have a third API that is both safe and convenient for those
> drivers.

Yeah, I guess I was expecting that one to come after we have a few
unsafe drivers using it and we do need to consolidate / make it safe.

Anyway, thanks for your answer,
Maxime

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 273 bytes --]