Re: [PATCH] rust: device: make lifetime on `Core` and `CoreInternal` invariant

On Mon Jul 13, 2026 at 9:14 PM BST, Gary Guo wrote:
> From: Gary Guo <[email protected]>
>
> Currently the lifetime on `Core` and `CoreInternal` is covariant. This
> means that they can be coerced into shorter living lifetimes. On `probe`
> function, signature has `&'bound Device<Core<'a>>`; the type's wellformness
> would imply `'a: 'bound` and thus the type can be coerced `&'bound
> Device<Core<'bound>>`, defeating the purpose of having the lifetime bound
> to prevent users of the `Core` type to escape the function.
>
> Fix this by making the lifetime invariant, so the coercion is impossible.
> The lifetime here only needs to be "branded" so it does not coerce or unify
> with other lifetimes, so we do not need to ensure `'bound: 'a`.
>
> This requires modifying `nova-core` which relies on this implied bound due
> to pre-2024 capture rule. The "use" bound can be removed if built with
> edition 2024.

Actually, a more proper fix is to make `Device` invariant over their
context. It would require touching all `Device`, though.

Danilo, let me know if you'd prefer that approach instead.

Best,
Gary

>
> Fixes: 24799831d631 ("rust: device: make Core and CoreInternal lifetime-parameterized")
> Signed-off-by: Gary Guo <[email protected]>
> ---
>  drivers/gpu/nova-core/gpu.rs |  6 +++---
>  rust/kernel/device.rs        | 10 ++++++++--
>  2 files changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/nova-core/gpu.rs b/drivers/gpu/nova-core/gpu.rs
> index b3c91731db45..b603b0bd2692 100644
> --- a/drivers/gpu/nova-core/gpu.rs
> +++ b/drivers/gpu/nova-core/gpu.rs
> @@ -285,10 +285,10 @@ pub(crate) struct Gpu<'gpu> {
>  }
>  
>  impl<'gpu> Gpu<'gpu> {
> -    pub(crate) fn new(
> -        pdev: &'gpu pci::Device<device::Core<'_>>,
> +    pub(crate) fn new<'a>(
> +        pdev: &'gpu pci::Device<device::Core<'a>>,
>          bar: Bar0<'gpu>,
> -    ) -> impl PinInit<Self, Error> + 'gpu {
> +    ) -> impl PinInit<Self, Error> + use<'gpu, 'a> {
>          try_pin_init!(Self {
>              device: pdev.as_ref(),
>              spec: Spec::new(pdev.as_ref(), bar).inspect(|spec| {
> diff --git a/rust/kernel/device.rs b/rust/kernel/device.rs
> index 645afc49a27d..db25ed1ae8e5 100644
> --- a/rust/kernel/device.rs
> +++ b/rust/kernel/device.rs
> @@ -511,7 +511,11 @@ pub trait DeviceContext: private::Sealed {}
>  /// callback it appears in. It is intended to be used for synchronization purposes. Bus device
>  /// implementations can implement methods for [`Device<Core>`], such that they can only be called
>  /// from bus callbacks.
> -pub struct Core<'a>(PhantomData<&'a ()>);
> +///
> +/// The lifetime `'a` is for "lifetime branding" purpose. Callbacks need to polymorphic over this
> +/// lifetime so the `&'bound Device<Core<'_>>` provided to them cannot outlive the scope of the
> +/// function. For this reason, it needs to be invariant.
> +pub struct Core<'a>(PhantomData<fn(&'a ()) -> &'a ()>);
>  
>  /// Semantically the same as [`Core`], but reserved for internal usage of the corresponding bus
>  /// abstraction.
> @@ -522,7 +526,9 @@ pub trait DeviceContext: private::Sealed {}
>  ///
>  /// This context mainly exists to share generic [`Device`] infrastructure that should only be called
>  /// from bus callbacks with bus abstractions, but without making them accessible for drivers.
> -pub struct CoreInternal<'a>(PhantomData<&'a ()>);
> +///
> +/// Lifetime `'a` is invariant for the same reason as [`Core`].
> +pub struct CoreInternal<'a>(PhantomData<fn(&'a ()) -> &'a ()>);
>  
>  /// The [`Bound`] context is the [`DeviceContext`] of a bus specific device when it is guaranteed to
>  /// be bound to a driver.
>
> base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa