Re: [PATCH] rust: time: Seal the ClockSource trait

[Andreas Hindborg <a.hindborg@kernel.org>]

"FUJITA Tomonori" <fujita.tomonori@gmail.com> writes:

> On Thu, 19 Jun 2025 11:31:08 +0200
> Andreas Hindborg <a.hindborg@kernel.org> wrote:
>
>> "FUJITA Tomonori" <fujita.tomonori@gmail.com> writes:
>>
>>> On Wed, 18 Jun 2025 21:13:07 +0200
>>> Andreas Hindborg <a.hindborg@kernel.org> wrote:
>>>
>>>> "Boqun Feng" <boqun.feng@gmail.com> writes:
>>>>
>>>>> On Tue, Jun 17, 2025 at 05:10:42PM -0700, Boqun Feng wrote:
>>>>>> On Wed, Jun 18, 2025 at 08:20:53AM +0900, FUJITA Tomonori wrote:
>>>>>> > Prevent downstream crates or drivers from implementing `ClockSource`
>>>>>> > for arbitrary types, which could otherwise leads to unsupported
>>>>>> > behavior.
>>>>>> >
>>>>>>
>>>>>> Hmm.. I don't think other impl of `ClockSource` is a problem, IIUC, as
>>>>>> long as the ktime_get() can return a value in [0, i64::MAX). Also this
>>>>>> means ClockSource should be an `unsafe` trait, because the correct
>>>>>> implementaion relies on ktime_get() returns the correct value. This is
>>>>>> needed even if you sealed ClockSource trait.
>>>>>>
>>>>>> Could you drop this and fix that the ClockSource trait instead? Thanks!
>>>>>>
>>>>>
>>>>> For example:
>>>>>
>>>>>     /// Trait for clock sources.
>>>>>     ///
>>>>>     /// ...
>>>>>     /// # Safety
>>>>>     ///
>>>>>     /// Implementers must ensure `ktime_get()` return a value in [0,
>>>>>     //  KTIME_MAX (i.e. i64::MAX)).
>>>>>     pub unsafe trait ClockSource {
>>>>>         ...
>>>>>     }
>>>>
>>>> Nice catch, it definitely needs to be unsafe. We should also require
>>>> correlation between ID and the value fetched by `ktime_get`.
>>>
>>> What's ID?
>>
>>
>>   pub trait ClockSource {
>>       /// The kernel clock ID associated with this clock source.
>>       ///
>>       /// This constant corresponds to the C side `clockid_t` value.
>>       const ID: bindings::clockid_t;
>>
>> The constant used to identify the clock source when calling into C APIs.
>
> Ah, I see. Sorry to ask another question, but can we require
> correlation between ID and the value fetched by `ktime_get`?

Yes, I think we should. As in, `ClockSource::ktime_get` must return the
time associated with the clock specified by `ClockSource::ID`.

>The value
> fetched by ktime_get is opaque, isn't it?

It is, but the implementation must still fetch the correct counter, right?
Not sure if it could lead to UB if it did not though 🤷


Best regards,
Andreas Hindborg