Re: [PATCH v3 3/7] gpu: nova-core: transition booter_load to TLV images

["Alexandre Courbot" <acourbot@nvidia.com>]

On Thu Jul 9, 2026 at 5:46 AM JST, Timur Tabi wrote:
> On Mon, 2026-07-06 at 15:31 +0900, Alexandre Courbot wrote:
>> 
>> > +        let os_data_offset = tlv.get_u32(b"DAOF")?;
>> > +        let os_data_size = tlv.get_u32(b"DASZ")?;
>> > +        let os_code_offset = tlv.get_u32(b"CDOF")?;
>> > +        let os_code_size = tlv.get_u32(b"CDSZ")?;
>> > +        let patch_loc = tlv.get_u32(b"PLOC")?;
>> > +        let fuse_version = tlv.get_u32(b"FUSE")?;
>> > +        let engine_id = tlv.get_u32(b"ENID")?;
>> > +        let ucode_id = tlv.get_u32(b"UCID")?;
>> > +        let app0_code_offset = tlv.get_u32(b"A0CO")?;
>> > +        let app0_code_size = tlv.get_u32(b"A0CS")?;
>> > +        let num_sigs = tlv.get_u32(b"NSIG")?;
>> > +        let sig_bytes = tlv.get_bytes(b"SIGN")?;
>> > +
>> > +        // Booter is always signed
>> 
>> The `.rst` file mentions the non-signed case though - we should
>> reconcile the spec and the code one way or the other.
>
> The .rst does not mention that Booter is signed, only that if the firmware is unsigned, then NSIG is
> 0 and SIGN does not exist.  And since get_bytes() now returns Error if SIGN doesn't exist, we
> enforce that here.
>
> But you're right in that it does feel a little off.  That's one of the reasons I had get_nth() in v1
> -- to streamline getting the nth signature.  
>
> What do you think about adding a get_signature(index) method that combines parsing NSIG and SIGN,
> automatically calculating sig_size and returning Option<&[u8]> ?

That would make sense to me, yes. The current ad-hoc code is rather
messy and having it in a separate method would definitely help with that.

Do you mean to make it a method of `Tlv` or `BooterFirmware`? The latter
looks more adequate for the time being, as AFAIK Booter is the only user
of this signature.

>
>> 
>> >  
>> > +        // The size of one signature
>> > +        let sig_size = sig_bytes
>> > +            .len()
>> > +            .checked_div(num_sigs.into_safe_cast())
>> > +            .ok_or(EINVAL)?;
>> > +
>> > +        // Extract the nth signature
>> > +        let sig_chunk = sig_bytes
>> > +            .chunks_exact(sig_size)
>> 
>> As Sashiko pointed out, this will panic if `sig_size == 0`, so we need
>> to check that - and whether an unsigned Booter is valid at all.
>
> sig_size cannot be 0 because of this:
>
>         if !(1..=15).contains(&num_sigs) || sig_bytes.len() % num_sigs != 0 {
>
> Neither sig_bytes.len() nor num_sigs can be 0.
>
> But IMHO, this just reinforces the idea that I should add get_signature().

Yes, that would keep all the conditions we need to track local to a much
smaller code block. Please also check my other reply [1] for further
potential improvements.

[1] https://lore.kernel.org/all/DJTQAZCXYPN7.3Q0B4NH8EA8BO@nvidia.com/