Re: [PATCH] gpu: nova-core: use pin-init self-referential support

["Gary Guo" <gary@garyguo.net>]

On Tue Nov 10, 2026 at 3:27 PM GMT, Danilo Krummrich wrote:
> Express all self-referential borrows through pin-init's self-referential
> support [1], replacing unsafely derived references.
>
> Cc: Gary Guo <gary@garyguo.net>
> Link: https://lore.kernel.org/all/20261008-dev-selfref-v2-0-e280b3c8fba5@garyguo.net/ [1]
> Signed-off-by: Danilo Krummrich <dakr@kernel.org>
> ---
>  drivers/gpu/nova-core/api.rs     | 24 ++++++++++++---
>  drivers/gpu/nova-core/driver.rs  | 53 +++++++++++---------------------
>  drivers/gpu/nova-core/gpu.rs     | 32 ++++++++-----------
>  drivers/gpu/nova-core/irq/gsp.rs | 17 +++++-----
>  4 files changed, 59 insertions(+), 67 deletions(-)
>
> diff --git a/drivers/gpu/nova-core/gpu.rs b/drivers/gpu/nova-core/gpu.rs
> index d185e927233f..cbd720a4d11f 100644
> --- a/drivers/gpu/nova-core/gpu.rs
> +++ b/drivers/gpu/nova-core/gpu.rs
> @@ -342,15 +342,15 @@ struct GspResources<'gpu> {
>  /// The two drop as a unit, the handler first, on the drop of [`Gpu`] and on the error path of
>  /// its constructor alike, so that the subtree is disabled only after the handler is freed.
>  #[pin_data]
> -struct GspSubtree<'a> {
> +struct GspSubtree<'a, 'gpu> {
>      #[pin]
> -    irq: GspIrq<'a>,
> +    irq: GspIrq<'a, 'gpu>,
>      /// Must be kept declared *after* `irq`. A handler still in flight enables the subtree again
>      /// through its rearm.
>      _top: TopEnableGuard<'a>,
>  }
>  
> -impl<'a> GspSubtree<'a> {
> +impl<'a, 'gpu: 'a> GspSubtree<'a, 'gpu> {
>      /// Returns an initializer that registers the GSP event handler and then enables its subtree at
>      /// `TOP`.
>      ///
> @@ -362,7 +362,7 @@ unsafe fn new(
>          pdev: &'a pci::Device<device::Bound>,
>          tree: &'a Tree<'a>,
>          falcon: &'a Falcon<'a, GspFalcon>,
> -        cmdq: &'a Cmdq<'a>,
> +        cmdq: &'a Cmdq<'gpu>,

From the changes made related to GspSubtree and other types I think I'm more
inclined to just make `Cmdq` lifetime covariant using existential lifetimes.

Best,
Gary

>      ) -> impl PinInit<Self, Error> + 'a {
>          try_pin_init!(Self {
>              // SAFETY: this function's caller must not leak the `GspSubtree` that owns this
> @@ -383,7 +383,8 @@ pub(crate) struct Gpu<'gpu> {
>      /// any in-flight run of it has finished, before the command queue that it drains and the
>      /// falcon that it reads are freed, and before the GSP is unloaded.
>      #[pin]
> -    _gsp_subtree: GspSubtree<'gpu>,
> +    #[uses('tree)]
> +    _gsp_subtree: GspSubtree<'gsp_resources, 'gpu>,
>      /// Static GPU information as provided by the GSP.
>      pub(crate) gsp_static_info: GetGspStaticInfoReply,
>      /// GPU memory manager owning memory management resources.
> @@ -403,9 +404,6 @@ pub(crate) struct Gpu<'gpu> {
>      /// Must be kept declared *after* `gsp_resources`, as the latter's `PinnedDrop` implementation
>      /// requires the sysmem flush page to be in place.
>      sysmem_flush: SysmemFlush<'gpu>,
> -    /// Borrow of `tree` that `_gsp_subtree` holds. A field that borrows a sibling field is
> -    /// self-referential, which `pin_init` cannot express, so the borrow is taken by hand.
> -    tree_ref: &'gpu Tree<'gpu>,
>      /// The GIN CPU interrupt tree and the PCI vectors that deliver it.
>      ///
>      /// Must be kept declared *after* `_gsp_subtree`, which holds a borrow of it.