rust: device: make lifetime on `Core` and `CoreInternal` invariant

From: Gary Guo <[email protected]>

Currently the lifetime on Core and CoreInternal is covariant. This means that they can be coerced into shorter living lifetimes. On probe function, signature has &'bound Device<Core<'a>>; the type's wellformness would imply 'a: 'bound and thus the type can be coerced &'bound Device<Core<'bound>>, defeating the purpose of having the lifetime bound to prevent users of the Core type to escape the function.

Fix this by making the lifetime invariant, so the coercion is impossible. The lifetime here only needs to be "branded" so it does not coerce or unify with other lifetimes, so we do not need to ensure 'bound: 'a.

This requires modifying nova-core which relies on this implied bound due to pre-2024 capture rule. The "use" bound can be removed if built with edition 2024.

Fixes 24799831d631 ("rust: device: make Core and CoreInternal lifetime-parameterized")

Signed-off-by Gary Guo <[email protected]>

---
 drivers/gpu/nova-core/gpu.rs |  6 +++---
 rust/kernel/device.rs        | 10 ++++++++--
 2 files changed, 11 insertions(+), 5 deletions(-)

drivers/gpu/nova-core/gpu.rs +3 -3

index b3c91731db45..b603b0bd2692 100644
@@ -285,10 +285,10 @@ pub(crate) struct Gpu<'gpu> {
 }
 
 impl<'gpu> Gpu<'gpu> {
-    pub(crate) fn new(
-        pdev: &'gpu pci::Device<device::Core<'_>>,
+    pub(crate) fn new<'a>(
+        pdev: &'gpu pci::Device<device::Core<'a>>,
         bar: Bar0<'gpu>,
-    ) -> impl PinInit<Self, Error> + 'gpu {
+    ) -> impl PinInit<Self, Error> + use<'gpu, 'a> {
         try_pin_init!(Self {
             device: pdev.as_ref(),
             spec: Spec::new(pdev.as_ref(), bar).inspect(|spec| {

rust/kernel/device.rs +8 -2

index 645afc49a27d..db25ed1ae8e5 100644
@@ -511,7 +511,11 @@ pub trait DeviceContext: private::Sealed {}
 /// callback it appears in. It is intended to be used for synchronization purposes. Bus device
 /// implementations can implement methods for [`Device<Core>`], such that they can only be called
 /// from bus callbacks.
-pub struct Core<'a>(PhantomData<&'a ()>);
+///
+/// The lifetime `'a` is for "lifetime branding" purpose. Callbacks need to polymorphic over this
+/// lifetime so the `&'bound Device<Core<'_>>` provided to them cannot outlive the scope of the
+/// function. For this reason, it needs to be invariant.
+pub struct Core<'a>(PhantomData<fn(&'a ()) -> &'a ()>);
 
 /// Semantically the same as [`Core`], but reserved for internal usage of the corresponding bus
 /// abstraction.

@@ -522,7 +526,9 @@ pub trait DeviceContext: private::Sealed {}
 ///
 /// This context mainly exists to share generic [`Device`] infrastructure that should only be called
 /// from bus callbacks with bus abstractions, but without making them accessible for drivers.
-pub struct CoreInternal<'a>(PhantomData<&'a ()>);
+///
+/// Lifetime `'a` is invariant for the same reason as [`Core`].
+pub struct CoreInternal<'a>(PhantomData<fn(&'a ()) -> &'a ()>);
 
 /// The [`Bound`] context is the [`DeviceContext`] of a bus specific device when it is guaranteed to
 /// be bound to a driver.

base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa

Actually, a more proper fix is to make Device invariant over their context. It would require touching all Device, though.

Danilo, let me know if you'd prefer that approach instead.

drivers/gpu/nova-core/gpu.rs +0 -0

index b3c91731db45..b603b0bd2692 100644

Quoted 7 lines · Gary Guo

drivers/gpu/nova-core/gpu.rs +0 -0

index b3c91731db45..b603b0bd2692 100644
@@ -285,10 +285,10 @@ pub(crate) struct Gpu<'gpu> {
 }
 

drivers/gpu/nova-core/gpu.rs pub(crate) struct Gpu<'gpu> { · line 291

Quoted 8 lines

drivers/gpu/nova-core/gpu.rs +3 -3

 impl<'gpu> Gpu<'gpu> {
-    pub(crate) fn new(
-        pdev: &'gpu pci::Device<device::Core<'_>>,
+    pub(crate) fn new<'a>(
+        pdev: &'gpu pci::Device<device::Core<'a>>,
         bar: Bar0<'gpu>,
-    ) -> impl PinInit<Self, Error> + 'gpu {
+    ) -> impl PinInit<Self, Error> + use<'gpu, 'a> {

Isn't that edition 2024 only?

drivers/gpu/nova-core/gpu.rs pub(crate) struct Gpu<'gpu> { · line 294

Quoted 4 lines

drivers/gpu/nova-core/gpu.rs +0 -0

         try_pin_init!(Self {
             device: pdev.as_ref(),
             spec: Spec::new(pdev.as_ref(), bar).inspect(|spec| {

I think you also need this hunk:

samples/rust/rust_debugfs.rs +0 -0

index 1f59e08aaa4b..6fe94a73c52a 100644

but use is stable in 1.82+ so we can just use it instead.

[PATCH] rust: device: make lifetime on Core and CoreInternal invariant