Re: [PATCH 00/20] rust: pin-init: create self references safely

[Benno Lossin]

On Thu, 08 Oct 2026 14:23:47 +0200, Gary Guo <gary@xxxxxxxxxxx> wrote:
> This is a big series that add support for one field to reference a sibling
> field in a safe and ergnonomic way. Unlike many other crates in the
> userspace Rust ecosystem, no additional allocation is required, thus it
> requires the struct to be pinned, which is exactly what pin-init provides.
> 
> This is a very powerful feature, and thus can raise concerns about whether
> it is sound. I spent a lot of time studying the rules to make this sound,
> and presented durirng Kangrejos [1].
> 
> The simple use case looks like this:
> 
>     #[pin_data]
>     struct MyDriver<'bound> {
>         dev: &'bound Device,
>         #[pin]
>         irq: irq::Registration<'bound, MyIrqHandler<'bound, 'bar>>,
>         bar: Bar<'bound, BAR_SIZE>,
>     }
> 
> You simply need to mention a lifetime that shares the name with the field.
> There are more advanced use cases which require annotations like
> 
>     #[uses('bar: invariant)]
> 
> to explicitly declare that the lifetime is used in invariant manner, and
> also
> 
>     where
>         exists<'dev>: 'a
> 
> to create new existential lifetimes as a way to erase invariant lifetimes
> that would otherwise bubble up to users. More info can be seen in my
> Plumbers slide [2]. Note that the syntax for explicit variance annotation
> has changed following discussions during Plumbers.
> 
> The initial plan was to upstream the simple use case only and iron out the
> advanced features subsequently; however it turns out that DRM jobqueue
> would need the variance annotation feature, and Nova `Cmdq` would need to
> use the existential lifetime feature.
> 
> During Plumbers the upstream schedule is discussed, and instead it was
> agreed that all the features should be upstreamed at once, but the usage of
> the advanced feature usage limited to the pre-agreed users only to limit
> the blast radius in case the feature needs to be reworked.
> 
> Detailed documentation about the pin-init self-reference feature would be
> added the following cycle, when the usage of them become more clear.
> 
> The pull request on GitHub [3] has a bunch of test suites, which are not
> synchronized to kernel tree.
> 
> Link: https://kangrejos.com/2026/Self%20referential%20pin-init.pdf [1]
> Link: https://lpc.events/event/20/contributions/2498/attachments/2200/4855/presentation.pdf [2]
> Link: https://github.com/Rust-for-Linux/pin-init/pull/181 [3]
> Signed-off-by: Gary Guo <gary@xxxxxxxxxxx>
> ---
> Gary Guo (20):
>       kbuild: rust: allow `clippy::comparison_chain` globally
>       rust: pin-init: internal: pin_data: infer self-referential struct
>       rust: pin-init: internal: pin_data: rewrite fields that borrow others
>       rust: pin-init: internal: pin_data: pin borrowed fields with wrapper
>       rust: pin-init: internal: pin_data: teach drop check about generics that cannot dangle
>       rust: pin-init: internal: pin_data: self-referential drop order checks
>       rust: pin-init: internal: pin_data: check covariance of self-referential fields
>       rust: pin-init: internal: pin_data: implement initialization of borrowed structs
>       rust: pin-init: internal: pin_data: project self-referential fields
>       rust: pin-init: internal: pin_data: add `with_project` method
>       rust: pin-init: internal: pin_data: enable self-referential support
>       rust: pin-init: internal: pin_data: allow lifetime to be shortened per field drop order
>       rust: pin-init: internal: pin_data: parse explicit `#[borrowed]` annotation
>       rust: pin-init: internal: pin_data: support mutable borrows
>       rust: pin-init: internal: pin_data: parse explicit `#[uses]` annotation
>       rust: pin-init: internal: pin_data: make field lifetime invariance imply type invariance
>       rust: pin-init: internal: pin_data: complete invariant borrow support
>       rust: pin-init: internal: pin_data: perform AST lifetime replacement if possible
>       rust: pin-init: internal: pin_data: support shared projection
>       rust: pin-init: internal: pin_data: support existential lifetimes
> 
>  Makefile                               |    2 +
>  rust/pin-init/examples/selfref.rs      |   60 ++
>  rust/pin-init/internal/src/init.rs     |   42 +-
>  rust/pin-init/internal/src/pin_data.rs | 1556 +++++++++++++++++++++++++++++++-
>  rust/pin-init/internal/src/util.rs     |  268 +++++-
>  rust/pin-init/src/__internal.rs        |  357 +++++++-
>  rust/pin-init/src/lib.rs               |    1 +
>  7 files changed, 2238 insertions(+), 48 deletions(-)

incredible work, Gary! when you first told me about this, I didn't
imagine that it would look this clean from the user's side. I sadly am
unable to take a detailed look at all of the patches. but we've talked
extensively about the design; so I'm sure we'll be able to fix all bugs
that pop up:

Acked-by: Benno Lossin <lossin@xxxxxxxxxx>

just for the record: I think that users of this feature should come
gradually. that way, fixing any issues (if there are any :) will be much
less stressful, since there are fewer places to fix. we've discussed
this and also mentioned it to Miguel. additionally, it would be great if
users would take a careful stance when using this feature. I'm not
worried, just cautious, since an unsoundness hole here could end up
being extremely ugly to fix and require re-architecting the users.

once again, great work!

best,
Benno

> ---
> base-commit: 0d9aa4b994379c6e0099737221ed421deb7e1a31
> change-id: 20261006-dev-selfref-27c37abfa849
> 
> Best regards,
> --  
> Gary Guo <gary@xxxxxxxxxxx>