Re: [PATCH v8 02/14] rust: hrtimer: introduce hrtimer support

[Tamir Duberstein]

On Fri, Feb 21, 2025 at 9:40 AM Boqun Feng <boqun.feng@xxxxxxxxx> wrote:
>
> Hmm... if you mean:
>
> trait HasHrTimer {
>     unsafe fn start(&self, expires: Ktime) {
>         ...
>     }
> }
>
> Then it'll be problematic because the pointer derived from `&self`
> doesn't have write provenance, therefore in a timer callback, the
> pointer cannot be used for write, which means for example you cannot
> convert the pointer back into a `Pin<Box<HasTimer>>`.
>
> To answer Tamir's question, pointers are heavily used here because we
> need to preserve the provenance.

Wouldn't the natural implication be that &mut self is needed? Maybe
you can help me understand why pointers can express a contract that
references can't?