Claude review: gpu: nova-core: use lifetime for Bar

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the key patch. It changes `NovaCore` to hold `pci::Bar<'bound, BAR0_SIZE>` directly instead of `Arc<Devres<Bar0>>`, and `Gpu` to borrow `&'gpu Bar0` (now aliased to `kernel::io::Mmio<BAR0_SIZE>`) instead of owning a clone of the Arc.

**The unsafe self-referential initialization:**

```rust
gpu <- Gpu::new(pdev, unsafe { &*core::ptr::from_ref(bar) }),
```

This is the most important part of the series. The safety comment explains:

```rust
// SAFETY: `bar` is initialized before this expression is evaluated
// (`try_pin_init!()` initializes fields in declaration order), lives at a pinned
// stable address, and is dropped after `gpu` (struct field drop order).
```

The safety argument has three parts:
1. **Declaration-order initialization** — `bar` is declared before `gpu` in the struct, so `try_pin_init!` initializes it first. This is correct per `pin_init` semantics.
2. **Pinned stable address** — The struct is `#[pin_data]` and the result is pinned, so `bar` won't move after initialization.
3. **Drop order** — Rust drops struct fields in declaration order, so `gpu` (declared after `bar`) is dropped before `bar`. This ensures the `&'gpu Bar0` reference in `Gpu` remains valid during `Gpu::drop`.

This reasoning is sound. The TODO comment about self-referential pin-init syntax is appropriate — this is a known pattern that lacks safe abstraction today.

**Type alias change:**

```rust
-pub(crate) type Bar0 = pci::Bar<'static, BAR0_SIZE>;
+pub(crate) type Bar0 = kernel::io::Mmio<BAR0_SIZE>;
```

This makes sense: `Gpu` and other consumers don't need the PCI bar metadata, just the MMIO mapping. The `pci::Bar<'bound>` is stored in `NovaCore`, and the borrowed `Bar0` (= `Mmio`) is what gets passed around.

**Gpu::unbind simplification:**

```rust
-    pub(crate) fn unbind(&self, dev: &device::Device<device::Core<'_>>) {
-        kernel::warn_on!(self
-            .bar
-            .access(dev)
-            .inspect(|bar| self.sysmem_flush.unregister(bar))
-            .is_err());
+    pub(crate) fn unbind(&self) {
+        self.sysmem_flush.unregister(self.bar);
     }
```

Good — the runtime `.access(dev)` check is no longer needed because the lifetime guarantees the bar is valid.

No issues found.

---
Generated by Claude Code Patch Reviewer