Re: [PATCH 1/4] gpu: nova-core: Add public driver API to nova-core

On Mon Jul 6, 2026 at 7:34 AM CEST, Alistair Popple wrote:
> @@ -86,15 +90,34 @@ fn probe<'bound>(
>                  // (`try_pin_init!()` initializes fields in declaration order), lives at a pinned
>                  // stable address, and is dropped after `gpu` (struct field drop order).
>                  gpu <- Gpu::new(pdev, unsafe { &*core::ptr::from_ref(bar) }),
> -                _reg: auxiliary::Registration::new(
> -                    pdev.as_ref(),
> -                    c"nova-drm",
> -                    // TODO[XARR]: Use XArray or perhaps IDA for proper ID allocation/recycling. For
> -                    // now, use a simple atomic counter that never recycles IDs.
> -                    AUXILIARY_ID_COUNTER.fetch_add(1, Relaxed),
> -                    crate::MODULE_NAME,
> -                    (),
> -                )?,
> +
> +                // SAFETY:
> +                // - `NovaCore` is dropped when the device is unbound; i.e.
> +                //   `mem::forget()` is never called on it.
> +                // - `gpu` is initialized above, lives at a pinned stable
> +                //   address, and is dropped after `_reg` (struct field drop
> +                //   order).
> +                _reg: unsafe {
> +                    auxiliary::Registration::new_with_lt(
> +                        pdev.as_ref(),
> +                        c"nova-drm",
> +                        // TODO[XARR]: Use XArray or perhaps IDA for proper ID allocation/recycling.
> +                        // For now, use a simple atomic counter that never recycles IDs.
> +                        AUXILIARY_ID_COUNTER.fetch_add(1, Relaxed),
> +                        crate::MODULE_NAME,
> +                        NovaCoreApi {
> +                            // TODO: Use `&gpu` self-referential pin-init syntax once available.
> +                            //
> +                            // SAFETY: `gpu` is initialized before this expression is evaluated
> +                            // (`try_pin_init!()` initializes fields in declaration order), lives at
> +                            // a pinned stable address, and is dropped after `_reg` (struct field
> +                            // drop order).
> +                            gpu: Pin::new_unchecked(
> +                                &*core::ptr::from_ref(gpu.as_ref().get_ref()),
> +                            ),

Hm...it's a bit messy to have this justified in two separate places. It would be
better to have separate unsafe blocks for this until pin-init solves this
properly. So, let's just do this.

+                _reg: {
+                    // SAFETY: `gpu` is initialized before this expression is evaluated
+                    // (`try_pin_init!()` initializes fields in declaration order), lives at
+                    // a pinned stable address, and is dropped after `_reg` (struct field
+                    // drop order).
+                    let gpu = unsafe {
+                        Pin::new_unchecked(
+                            &*core::ptr::from_ref(gpu.as_ref().get_ref()),
+                        )
+                    };
+
+                    // SAFETY: `NovaCore` is dropped when the device is unbound; i.e.
+                    // `mem::forget()` is never called on it.
+                    unsafe {
+                        auxiliary::Registration::new_with_lt(
+                            pdev.as_ref(),
+                            c"nova-drm",
+                            // TODO[XARR]: Use XArray or perhaps IDA for proper ID allocation/recycling.
+                            // For now, use a simple atomic counter that never recycles IDs.
+                            AUXILIARY_ID_COUNTER.fetch_add(1, Relaxed),
+                            crate::MODULE_NAME,
+                            NovaCoreApi { gpu },
+                        )?
+                    }
                 },