Re: [PATCH v2 3/3] rust: use `UnsafePinned` in the implementation of `Opaque`

[Boqun Feng <boqun.feng@gmail.com>]

[Cc Ralf]

On Wed, Apr 30, 2025 at 10:36:13AM +0200, Christian Schrefl wrote:
> This change makes the semantics of the `Opaque` implementation
> clearer and prepares for the switch to the upstream rust UnsafePinned`
> type in the future.
> 
> `Opaque` still uses `UnsafeCell` even though the kernel implementation
> of `UnsafePinned` already includes it, since the current upstream
> version does not.
> 
> Reviewed-by: Gerald Wisböck <gerald.wisboeck@feather.ink>
> Signed-off-by: Christian Schrefl <chrisi.schrefl@gmail.com>
> ---
>  rust/kernel/types.rs | 29 ++++++++++++-----------------
>  1 file changed, 12 insertions(+), 17 deletions(-)
> 
> diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
> index f06e8720e012102e5c41e79fd97b0607e927d71c..44d96423a8a6c358bb7ebf12c24fad98e5c2cb61 100644
> --- a/rust/kernel/types.rs
> +++ b/rust/kernel/types.rs
> @@ -4,12 +4,12 @@
>  
>  use core::{
>      cell::UnsafeCell,
> -    marker::{PhantomData, PhantomPinned},
> +    marker::PhantomData,
>      mem::{ManuallyDrop, MaybeUninit},
>      ops::{Deref, DerefMut},
>      ptr::NonNull,
>  };
> -use pin_init::{PinInit, Wrapper, Zeroable};
> +use pin_init::{cast_pin_init, PinInit, Wrapper, Zeroable};
>  
>  /// Used to transfer ownership to and from foreign (non-Rust) languages.
>  ///
> @@ -308,8 +308,7 @@ fn drop(&mut self) {
>  /// ```
>  #[repr(transparent)]
>  pub struct Opaque<T> {
> -    value: UnsafeCell<MaybeUninit<T>>,
> -    _pin: PhantomPinned,
> +    value: UnsafePinned<UnsafeCell<MaybeUninit<T>>>,

What's the Rust upstream opinion on `&UnsafePinned` vs `&UnsafeCell`?
Does `&UnsafePinned` provide the same noalias behavior as `&UnsafeCell`?

I'm wondering whether we should just do:

    pub struct Opaque<T> {
        value: UnsafePinned<MaybeUninit<T>>,
        _not_sync: PhantomData<UnsafeCell<()>>,
    }

, instead.

Regards,
Boqun

>  }
>  
>  // SAFETY: `Opaque<T>` allows the inner value to be any bit pattern, including all zeros.
> @@ -319,16 +318,14 @@ impl<T> Opaque<T> {
>      /// Creates a new opaque value.
>      pub const fn new(value: T) -> Self {
>          Self {
> -            value: UnsafeCell::new(MaybeUninit::new(value)),
> -            _pin: PhantomPinned,
> +            value: UnsafePinned::new(UnsafeCell::new(MaybeUninit::new(value))),
>          }
>      }
>  
>      /// Creates an uninitialised value.
>      pub const fn uninit() -> Self {
>          Self {
> -            value: UnsafeCell::new(MaybeUninit::uninit()),
> -            _pin: PhantomPinned,
> +            value: UnsafePinned::new(UnsafeCell::new(MaybeUninit::uninit())),
>          }
>      }
>  
> @@ -371,7 +368,7 @@ pub fn try_ffi_init<E>(
>  
>      /// Returns a raw pointer to the opaque data.
>      pub const fn get(&self) -> *mut T {
> -        UnsafeCell::get(&self.value).cast::<T>()
> +        UnsafeCell::raw_get(self.value.get()).cast::<T>()
>      }
>  
>      /// Gets the value behind `this`.
> @@ -384,14 +381,12 @@ pub const fn raw_get(this: *const Self) -> *mut T {
>  }
>  impl<T> Wrapper<T> for Opaque<T> {
>      /// Create an opaque pin-initializer from the given pin-initializer.
> -    fn pin_init<E>(slot: impl PinInit<T, E>) -> impl PinInit<Self, E> {
> -        Self::try_ffi_init(|ptr: *mut T| {
> -            // SAFETY:
> -            //   - `ptr` is a valid pointer to uninitialized memory,
> -            //   - `slot` is not accessed on error; the call is infallible,
> -            //   - `slot` is pinned in memory.
> -            unsafe { PinInit::<T, E>::__pinned_init(slot, ptr) }
> -        })
> +    fn pin_init<E>(value_init: impl PinInit<T, E>) -> impl PinInit<Self, E> {
> +        let value_init =
> +            UnsafePinned::pin_init(UnsafeCell::pin_init(MaybeUninit::pin_init(value_init)));
> +        // SAFETY: `Opaque<T>` is a `repr(transparent)` wrapper around
> +        // `UnsafePinned<UnsafeCell<MabeUninit<T>>>` so the memory representation is compatible.
> +        unsafe { cast_pin_init(value_init) }
>      }
>  }
>  
> 
> -- 
> 2.49.0
> 
>