[PATCH v9] rust: transmute: Add methods for FromBytes trait

[PATCH v9] rust: transmute: Add methods for FromBytes trait

[Christian S. Lima]

The two methods added take a slice of bytes and return those bytes in a
specific type. These methods are useful when we need to transform the
stream of bytes into specific type.

The `Frombytessized` trait was added to make it easier to implement other
user defined types within the codebase. With the current implementation,
there's no way to interact without implementing `from_bytes` and
`from_mut_bytes` for every new type, and this would end up generating a lot
of duplicate code. By using FromBytesSized as a proxy trait, we can avoid
this without generating a direct dependency. If necessary, the user can
simply implement `FromBytes` if needed. For more context, please check the
[1] and [2].

[1] https://lore.kernel.org/rust-for-linux/DANSZ6Q476EC.3GY00K717QVUL@nvidia.com/
[2] https://lore.kernel.org/rust-for-linux/DAOESYD6F287.3U3M64X0S1WN5@nvidia.com/

Link: https://github.com/Rust-for-Linux/linux/issues/1119
Suggested-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Christian S. Lima <christiansantoslima21@gmail.com>
---
Changes in v2:
- Rollback the implementation for the macro in the repository and implement
  methods in trait
- Link to v2: https://lore.kernel.org/rust-for-linux/20241012070121.110481-1-christiansantoslima21@gmail.com/

Changes in v3:
- Fix grammar errors
- Remove repeated tests
- Fix alignment errors
- Fix tests not building
- Link to v3: https://lore.kernel.org/rust-for-linux/20241109055442.85190-1-christiansantoslima21@gmail.com/

Changes in v4:
- Removed core::simd::ToBytes
- Changed trait and methods to safe Add
- Result<&Self, Error> in order to make safe methods
- Link to v4: https://lore.kernel.org/rust-for-linux/20250314034910.134463-1-christiansantoslima21@gmail.com/

Changes in v5:
- Changed from Result to Option
- Removed commentaries
- Returned trait impl to unsafe
- Link to v5: https://lore.kernel.org/rust-for-linux/20250320014041.101470-1-christiansantoslima21@gmail.com/

Changes in v6:
- Add endianess check to doc test and use match to check
success case
- Reformulated safety comments
- Link to v6: https://lore.kernel.org/rust-for-linux/20250330234039.29814-1-christiansantoslima21@gmail.com/

Changes in v7:
- Add alignment check
- Link to v7: https://lore.kernel.org/rust-for-linux/20250615072042.133290-1-christiansantoslima21@gmail.com/

Changes in v8:
- Add the new FromBytesSized trait
- Change the implementation of FromBytes trait methods
- Move the cast to pointer earlier and use `is_aligned()` instead manual
alignment check
- Link to v8: https://lore.kernel.org/rust-for-linux/20250624042802.105623-1-christiansantoslima21@gmail.com/

Changes in v9:
- Improve code comments and remove confusing parts.
- Add a build_assert in the conversion of type `[T]` to check for elements
inside the slice.
- Count the elements in the `[T]` conversion instead of using byte count.
---
 rust/kernel/transmute.rs | 123 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 117 insertions(+), 6 deletions(-)

diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
index 1c7d43771a37..ba21fe49e4f0 100644
--- a/rust/kernel/transmute.rs
+++ b/rust/kernel/transmute.rs
@@ -2,6 +2,8 @@
 
 //! Traits for transmuting types.
 
+use crate::build_assert;
+
 /// Types for which any bit pattern is valid.
 ///
 /// Not all types are valid for all values. For example, a `bool` must be either zero or one, so
@@ -9,27 +11,136 @@
 ///
 /// It's okay for the type to have padding, as initializing those bytes has no effect.
 ///
+/// # Examples
+///
+/// ```
+/// use kernel::transmute::FromBytes;
+///
+/// let foo = [1, 2, 3, 4];
+///
+/// let result = u32::from_bytes(&foo)?;
+///
+/// #[cfg(target_endian = "little")]
+/// assert_eq!(*result, 0x4030201);
+///
+/// #[cfg(target_endian = "big")]
+/// assert_eq!(*result, 0x1020304);
+/// ```
+///
+/// # Safety
+///
+/// All bit-patterns must be valid for this type. This type must not have interior mutability.
+pub unsafe trait FromBytes {
+    /// Converts a slice of bytes to a reference to `Self` when the reference
+    /// is properly aligned and the size of slice is equal to that of `T`
+    /// and is different from zero. In another case, it will return
+    ///`None`.
+    fn from_bytes(bytes: &[u8]) -> Option<&Self>;
+
+    /// Converts a mutable slice of bytes to a reference to `Self`
+    /// when the reference is properly aligned and the size of slice
+    /// is equal to that of `T` and is different from zero. In another
+    /// case, it will return `None`.
+    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
+    where
+        Self: AsBytes;
+}
+
+/// Provide an auto-implementation of FromBytes's methods for all
+/// sized types, if you need an implementation for your type use this instead.
+///
 /// # Safety
 ///
 /// All bit-patterns must be valid for this type. This type must not have interior mutability.
-pub unsafe trait FromBytes {}
+pub unsafe trait FromBytesSized: Sized {}
 
-macro_rules! impl_frombytes {
+macro_rules! impl_frombytessized {
     ($($({$($generics:tt)*})? $t:ty, )*) => {
         // SAFETY: Safety comments written in the macro invocation.
-        $(unsafe impl$($($generics)*)? FromBytes for $t {})*
+        $(unsafe impl$($($generics)*)? FromBytesSized for $t {})*
     };
 }
 
-impl_frombytes! {
+impl_frombytessized! {
     // SAFETY: All bit patterns are acceptable values of the types below.
     u8, u16, u32, u64, usize,
     i8, i16, i32, i64, isize,
 
     // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
     // patterns are also acceptable for arrays of that type.
-    {<T: FromBytes>} [T],
-    {<T: FromBytes, const N: usize>} [T; N],
+    {<T: FromBytesSized, const N: usize>} [T; N],
+}
+
+// SAFETY: The `FromBytesSized` implementation guarantees that all bit
+// patterns are acceptable values of the types and in array case if
+// all bit patterns are acceptable for individual values in an array,
+// then all bit patterns are also acceptable for arrays of that type.
+unsafe impl<T> FromBytes for T
+where
+    T: FromBytesSized,
+{
+    fn from_bytes(bytes: &[u8]) -> Option<&Self> {
+        let slice_ptr = bytes.as_ptr().cast::<T>();
+        let size = ::core::mem::size_of::<T>();
+        if bytes.len() == size && slice_ptr.is_aligned() {
+            // SAFETY: Since the code checks the size and alignment, the slice is valid.
+            unsafe { Some(&*slice_ptr) }
+        } else {
+            None
+        }
+    }
+
+    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
+    where
+        Self: AsBytes,
+    {
+        let slice_ptr = bytes.as_mut_ptr().cast::<T>();
+        let size = ::core::mem::size_of::<T>();
+        if bytes.len() == size && slice_ptr.is_aligned() {
+            // SAFETY: Since the code checks the size and alignment, the slice is valid.
+            unsafe { Some(&mut *slice_ptr) }
+        } else {
+            None
+        }
+    }
+}
+
+// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
+// patterns are also acceptable for arrays of that type.
+unsafe impl<T: FromBytes> FromBytes for [T] {
+    fn from_bytes(bytes: &[u8]) -> Option<&Self> {
+        let size = ::core::mem::size_of::<T>();
+        build_assert!(size == 0, "Can't create a slice with zero elements");
+        let slice_ptr = bytes.as_ptr().cast::<T>();
+        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
+            // SAFETY: Since the number of elements is different from
+            // zero and the pointer is aligned, the slice is valid.
+            unsafe { Some(::core::slice::from_raw_parts(slice_ptr, bytes.len() / size)) }
+        } else {
+            None
+        }
+    }
+
+    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
+    where
+        Self: AsBytes,
+    {
+        let size = ::core::mem::size_of::<T>();
+        build_assert!(size == 0, "Can't create a slice with zero elements");
+        let slice_ptr = bytes.as_mut_ptr().cast::<T>();
+        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
+            // SAFETY: Since the number of elements is different from
+            // zero and the pointer is aligned, the slice is valid.
+            unsafe {
+                Some(::core::slice::from_raw_parts_mut(
+                    slice_ptr,
+                    bytes.len() / size,
+                ))
+            }
+        } else {
+            None
+        }
+    }
 }
 
 /// Types that can be viewed as an immutable slice of initialized bytes.
-- 
2.43.0

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Alexandre Courbot]

On Tue Aug 12, 2025 at 6:38 AM JST, Christian S. Lima wrote:
> The two methods added take a slice of bytes and return those bytes in a
> specific type. These methods are useful when we need to transform the
> stream of bytes into specific type.
>
> The `Frombytessized` trait was added to make it easier to implement other

typo: FromBytesSized.

> user defined types within the codebase. With the current implementation,
> there's no way to interact without implementing `from_bytes` and
> `from_mut_bytes` for every new type, and this would end up generating a lot
> of duplicate code. By using FromBytesSized as a proxy trait, we can avoid
> this without generating a direct dependency. If necessary, the user can
> simply implement `FromBytes` if needed. For more context, please check the
> [1] and [2].
>
> [1] https://lore.kernel.org/rust-for-linux/DANSZ6Q476EC.3GY00K717QVUL@nvidia.com/
> [2] https://lore.kernel.org/rust-for-linux/DAOESYD6F287.3U3M64X0S1WN5@nvidia.com/
>
> Link: https://github.com/Rust-for-Linux/linux/issues/1119
> Suggested-by: Alexandre Courbot <acourbot@nvidia.com>
> Signed-off-by: Christian S. Lima <christiansantoslima21@gmail.com>

I mentioned it on v8 [1] and v7 [2], but the tests that break due to
this change need to be updated by this patch as well. This includes:

* The doctests in `rust/kernel/dma.rs`,
* The `samples/rust/rust_dma.rs` sample,
* The example for `FromBytes` introduced by this patch which uses `?` without
defining a function.

Please make sure to compile with `CONFIG_RUST_KERNEL_DOCTESTS` and
`CONFIG_SAMPLE_RUST_DMA` to see the failures.

Also, now that we are on 6.17-rc1, the types in `nova-core` that implement
`FromBytes` will also fail to build unless they are switched to
`FromBytesSized`. Which I guess speaks in favor of taking this into the Nova
tree if there are not other planned user for this cycle?

[1]
https://lore.kernel.org/rust-for-linux/DB5KEWX9EJ2Q.3CX5EGS66OVHH@nvidia.com/
[2]
https://lore.kernel.org/rust-for-linux/DANSZ6Q476EC.3GY00K717QVUL@nvidia.com/

In case this helps, here is the diff I needed to apply to get the tests
to build:

diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
index 1801836f31455..3797c70c13040 100644
--- a/rust/kernel/dma.rs
+++ b/rust/kernel/dma.rs
@@ -597,7 +597,7 @@ unsafe impl<T: AsBytes + FromBytes + Send> Send for CoherentAllocation<T> {}
 /// struct MyStruct { field: u32, }
 ///
 /// // SAFETY: All bit patterns are acceptable values for `MyStruct`.
-/// unsafe impl kernel::transmute::FromBytes for MyStruct{};
+/// unsafe impl kernel::transmute::FromBytesSized for MyStruct{};
 /// // SAFETY: Instances of `MyStruct` have no uninitialized portions.
 /// unsafe impl kernel::transmute::AsBytes for MyStruct{};
 ///
@@ -641,7 +641,7 @@ macro_rules! dma_read {
 /// struct MyStruct { member: u32, }
 ///
 /// // SAFETY: All bit patterns are acceptable values for `MyStruct`.
-/// unsafe impl kernel::transmute::FromBytes for MyStruct{};
+/// unsafe impl kernel::transmute::FromBytesSized for MyStruct{};
 /// // SAFETY: Instances of `MyStruct` have no uninitialized portions.
 /// unsafe impl kernel::transmute::AsBytes for MyStruct{};
 ///
diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
index ba21fe49e4f07..e7bd698ec99cd 100644
--- a/rust/kernel/transmute.rs
+++ b/rust/kernel/transmute.rs
@@ -16,6 +16,7 @@
 /// ```
 /// use kernel::transmute::FromBytes;
 ///
+/// # fn test() -> Option<()> {
 /// let foo = [1, 2, 3, 4];
 ///
 /// let result = u32::from_bytes(&foo)?;
@@ -25,6 +26,7 @@
 ///
 /// #[cfg(target_endian = "big")]
 /// assert_eq!(*result, 0x1020304);
+/// # Some(()) }
 /// ```
 ///
 /// # Safety
diff --git a/samples/rust/rust_dma.rs b/samples/rust/rust_dma.rs
index 9fb3ae1dd8587..36ad877d4804d 100644
--- a/samples/rust/rust_dma.rs
+++ b/samples/rust/rust_dma.rs
@@ -65,7 +65,7 @@ fn new(h: u32, b: u32) -> Self {
 // SAFETY: All bit patterns are acceptable values for `MyStruct`.
 unsafe impl kernel::transmute::AsBytes for MyStruct {}
 // SAFETY: Instances of `MyStruct` have no uninitialized portions.
-unsafe impl kernel::transmute::FromBytes for MyStruct {}
+unsafe impl kernel::transmute::FromBytesSized for MyStruct {}

 kernel::pci_device_table!(
     PCI_TABLE,

-- end of diff --

Otherwise the patch in itself looks good to me. It is used in nova-core (and a
critical dependency for this cycle :)), so although I cannot give my
Reviewed-by until the tests are fixed, it is at least

Tested-by: Alexandre Courbot <acourbot@nvidia.com>

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Christian]

Hi, Alexandre.

> I mentioned it on v8 [1] and v7 [2], but the tests that break due to
> this change need to be updated by this patch as well. This includes:
>
> * The doctests in `rust/kernel/dma.rs`,
> * The `samples/rust/rust_dma.rs` sample,
> * The example for `FromBytes` introduced by this patch which uses `?` without
> defining a function.

Sorry for my inattention, I'll fix this in the next version.

> Please make sure to compile with `CONFIG_RUST_KERNEL_DOCTESTS` and
> `CONFIG_SAMPLE_RUST_DMA` to see the failures.
>
> Also, now that we are on 6.17-rc1, the types in `nova-core` that implement
> `FromBytes` will also fail to build unless they are switched to
> `FromBytesSized`. Which I guess speaks in favor of taking this into the Nova
> tree if there are not other planned user for this cycle?
>
> [1]
> https://lore.kernel.org/rust-for-linux/DB5KEWX9EJ2Q.3CX5EGS66OVHH@nvidia.com/
> [2]
> https://lore.kernel.org/rust-for-linux/DANSZ6Q476EC.3GY00K717QVUL@nvidia.com/
>
> In case this helps, here is the diff I needed to apply to get the tests
> to build:
>
> diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
> index 1801836f31455..3797c70c13040 100644
> --- a/rust/kernel/dma.rs
> +++ b/rust/kernel/dma.rs
> @@ -597,7 +597,7 @@ unsafe impl<T: AsBytes + FromBytes + Send> Send for CoherentAllocation<T> {}
>   /// struct MyStruct { field: u32, }
>   ///
>   /// // SAFETY: All bit patterns are acceptable values for `MyStruct`.
> -/// unsafe impl kernel::transmute::FromBytes for MyStruct{};
> +/// unsafe impl kernel::transmute::FromBytesSized for MyStruct{};
>   /// // SAFETY: Instances of `MyStruct` have no uninitialized portions.
>   /// unsafe impl kernel::transmute::AsBytes for MyStruct{};
>   ///
> @@ -641,7 +641,7 @@ macro_rules! dma_read {
>   /// struct MyStruct { member: u32, }
>   ///
>   /// // SAFETY: All bit patterns are acceptable values for `MyStruct`.
> -/// unsafe impl kernel::transmute::FromBytes for MyStruct{};
> +/// unsafe impl kernel::transmute::FromBytesSized for MyStruct{};
>   /// // SAFETY: Instances of `MyStruct` have no uninitialized portions.
>   /// unsafe impl kernel::transmute::AsBytes for MyStruct{};
>   ///
> diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
> index ba21fe49e4f07..e7bd698ec99cd 100644
> --- a/rust/kernel/transmute.rs
> +++ b/rust/kernel/transmute.rs
> @@ -16,6 +16,7 @@
>   /// ```
>   /// use kernel::transmute::FromBytes;
>   ///
> +/// # fn test() -> Option<()> {
>   /// let foo = [1, 2, 3, 4];
>   ///
>   /// let result = u32::from_bytes(&foo)?;
> @@ -25,6 +26,7 @@
>   ///
>   /// #[cfg(target_endian = "big")]
>   /// assert_eq!(*result, 0x1020304);
> +/// # Some(()) }
>   /// ```
>   ///
>   /// # Safety
> diff --git a/samples/rust/rust_dma.rs b/samples/rust/rust_dma.rs
> index 9fb3ae1dd8587..36ad877d4804d 100644
> --- a/samples/rust/rust_dma.rs
> +++ b/samples/rust/rust_dma.rs
> @@ -65,7 +65,7 @@ fn new(h: u32, b: u32) -> Self {
>   // SAFETY: All bit patterns are acceptable values for `MyStruct`.
>   unsafe impl kernel::transmute::AsBytes for MyStruct {}
>   // SAFETY: Instances of `MyStruct` have no uninitialized portions.
> -unsafe impl kernel::transmute::FromBytes for MyStruct {}
> +unsafe impl kernel::transmute::FromBytesSized for MyStruct {}
>
>   kernel::pci_device_table!(
>       PCI_TABLE,
>
> -- end of diff --

Thanks for your diffs, it'll help a lot.

And sorry for the delay. I'll send a new version as soon as possible.

Thanks, Christian

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[kernel test robot]

Hi Christian,

kernel test robot noticed the following build errors:

[auto build test ERROR on rust/rust-next]
[also build test ERROR on linus/master v6.17-rc1 next-20250812]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Christian-S-Lima/rust-transmute-Add-methods-for-FromBytes-trait/20250812-054010
base:   https://github.com/Rust-for-Linux/linux rust-next
patch link:    https://lore.kernel.org/r/20250811213851.65644-1-christiansantoslima21%40gmail.com
patch subject: [PATCH v9] rust: transmute: Add methods for FromBytes trait
config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250813/202508130702.MtRUndHU-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
rustc: rustc 1.88.0 (6b00bc388 2025-06-23)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250813/202508130702.MtRUndHU-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202508130702.MtRUndHU-lkp@intel.com/

All errors (new ones prefixed by >>):

>> error[E0046]: not all trait items implemented, missing: `from_bytes`, `from_bytes_mut`
   --> rust/doctests_kernel_generated.rs:4749:1
   |
   4749 | unsafe impl kernel::transmute::FromBytes for MyStruct{};
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing `from_bytes`, `from_bytes_mut` in implementation
   |
   = help: implement the missing item: `fn from_bytes(_: &[u8]) -> Option<&Self> { todo!() }`
   = help: implement the missing item: `fn from_bytes_mut<Self>(_: &mut [u8]) -> Option<&mut Self> where Self: AsBytes { todo!() }`
--
>> error[E0046]: not all trait items implemented, missing: `from_bytes`, `from_bytes_mut`
   --> rust/doctests_kernel_generated.rs:4814:1
   |
   4814 | unsafe impl kernel::transmute::FromBytes for MyStruct{};
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing `from_bytes`, `from_bytes_mut` in implementation
   |
   = help: implement the missing item: `fn from_bytes(_: &[u8]) -> Option<&Self> { todo!() }`
   = help: implement the missing item: `fn from_bytes_mut<Self>(_: &mut [u8]) -> Option<&mut Self> where Self: AsBytes { todo!() }`
--
>> error[E0046]: not all trait items implemented, missing: `from_bytes`, `from_bytes_mut`
   --> samples/rust/rust_dma.rs:42:1
   |
   42 | unsafe impl kernel::transmute::FromBytes for MyStruct {}
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing `from_bytes`, `from_bytes_mut` in implementation
   |
   = help: implement the missing item: `fn from_bytes(_: &[u8]) -> Option<&Self> { todo!() }`
   = help: implement the missing item: `fn from_bytes_mut<Self>(_: &mut [u8]) -> Option<&mut Self> where Self: AsBytes { todo!() }`

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Benno Lossin]

On Mon Aug 11, 2025 at 11:38 PM CEST, Christian S. Lima wrote:
> @@ -9,27 +11,136 @@
>  ///
>  /// It's okay for the type to have padding, as initializing those bytes has no effect.
>  ///
> +/// # Examples
> +///
> +/// ```
> +/// use kernel::transmute::FromBytes;
> +///
> +/// let foo = [1, 2, 3, 4];
> +///
> +/// let result = u32::from_bytes(&foo)?;
> +///
> +/// #[cfg(target_endian = "little")]
> +/// assert_eq!(*result, 0x4030201);
> +///
> +/// #[cfg(target_endian = "big")]
> +/// assert_eq!(*result, 0x1020304);
> +/// ```
> +///
> +/// # Safety
> +///
> +/// All bit-patterns must be valid for this type. This type must not have interior mutability.
> +pub unsafe trait FromBytes {
> +    /// Converts a slice of bytes to a reference to `Self` when the reference
> +    /// is properly aligned and the size of slice is equal to that of `T`
> +    /// and is different from zero. In another case, it will return
> +    ///`None`.

The first line in any documentation should be a single, short sentence.
Also separate it from the contents by a newline, otherwise markdown will
render it as a single paragraph.

> +    fn from_bytes(bytes: &[u8]) -> Option<&Self>;
> +
> +    /// Converts a mutable slice of bytes to a reference to `Self`
> +    /// when the reference is properly aligned and the size of slice
> +    /// is equal to that of `T` and is different from zero. In another
> +    /// case, it will return `None`.
> +    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> +    where
> +        Self: AsBytes;
> +}

> +
> +// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> +// patterns are also acceptable for arrays of that type.
> +unsafe impl<T: FromBytes> FromBytes for [T] {
> +    fn from_bytes(bytes: &[u8]) -> Option<&Self> {
> +        let size = ::core::mem::size_of::<T>();
> +        build_assert!(size == 0, "Can't create a slice with zero elements");

This message is wrong, it sounds as if the size of `bytes` was zero and
you can definitely create a slice with zero elements.

> +        let slice_ptr = bytes.as_ptr().cast::<T>();
> +        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
> +            // SAFETY: Since the number of elements is different from
> +            // zero and the pointer is aligned, the slice is valid.

Please take a look at the documentation of `from_raw_parts`, there are
several bullet points of safety requirements. Please provide a
justification for each one and also place them in a bullet point list.

---
Cheers,
Benno

> +            unsafe { Some(::core::slice::from_raw_parts(slice_ptr, bytes.len() / size)) }
> +        } else {
> +            None
> +        }
> +    }
> +
> +    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> +    where
> +        Self: AsBytes,
> +    {
> +        let size = ::core::mem::size_of::<T>();
> +        build_assert!(size == 0, "Can't create a slice with zero elements");
> +        let slice_ptr = bytes.as_mut_ptr().cast::<T>();
> +        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
> +            // SAFETY: Since the number of elements is different from
> +            // zero and the pointer is aligned, the slice is valid.
> +            unsafe {
> +                Some(::core::slice::from_raw_parts_mut(
> +                    slice_ptr,
> +                    bytes.len() / size,
> +                ))
> +            }
> +        } else {
> +            None
> +        }
> +    }
>  }
>  
>  /// Types that can be viewed as an immutable slice of initialized bytes.

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Alexandre Courbot]

On Wed Aug 13, 2025 at 3:00 AM JST, Christian wrote:
> Hi, Alexandre.
>
>> I mentioned it on v8 [1] and v7 [2], but the tests that break due to
>> this change need to be updated by this patch as well. This includes:
>>
>> * The doctests in `rust/kernel/dma.rs`,
>> * The `samples/rust/rust_dma.rs` sample,
>> * The example for `FromBytes` introduced by this patch which uses `?` without
>> defining a function.
>
> Sorry for my inattention, I'll fix this in the next version.

Ah, as it turns out you might not need to.

We discussed this patch a bit during the DRM sync, and the consensus was
that it would probably be better to keep things a bit simpler for the
first version. The `FromBytesSized` trait in particular was not very
popular; a better long-term way to provide implementations for
`FromBytes` would be to use a derive macro, but that's out of scope for
now.

Instead, we agreed that the following would make a good first version:

- Make the `FromBytes` trait depend on `Sized`,
- Provide default implementations for `from_bytes` and `from_bytes_mut`
  directly in the `FromBytes` trait,
- No implementation for slices for now,
- Consequently, no user code will break due to the addition of the
  methods, which is a big plus.

The simpler version that would result from this covers all the immediate
use-cases and would be easier to merge, which will give us some time to
think about how to handle the non-sized use cases (probably via a derive
macro).

Do you think you could write the next version along these lines?

I feel like I misdirected you with the `FromBytesSized` trait, so please
accept my apologies for that.

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Alice Ryhl]

On Mon, Aug 18, 2025 at 08:28:18PM +0900, Alexandre Courbot wrote:
> On Wed Aug 13, 2025 at 3:00 AM JST, Christian wrote:
> > Hi, Alexandre.
> >
> >> I mentioned it on v8 [1] and v7 [2], but the tests that break due to
> >> this change need to be updated by this patch as well. This includes:
> >>
> >> * The doctests in `rust/kernel/dma.rs`,
> >> * The `samples/rust/rust_dma.rs` sample,
> >> * The example for `FromBytes` introduced by this patch which uses `?` without
> >> defining a function.
> >
> > Sorry for my inattention, I'll fix this in the next version.
> 
> Ah, as it turns out you might not need to.
> 
> We discussed this patch a bit during the DRM sync, and the consensus was
> that it would probably be better to keep things a bit simpler for the
> first version. The `FromBytesSized` trait in particular was not very
> popular; a better long-term way to provide implementations for
> `FromBytes` would be to use a derive macro, but that's out of scope for
> now.
> 
> Instead, we agreed that the following would make a good first version:
> 
> - Make the `FromBytes` trait depend on `Sized`,
> - Provide default implementations for `from_bytes` and `from_bytes_mut`
>   directly in the `FromBytes` trait,

You can put the Sized requirement on the methods, rather than on the
trait.

trait FromBytes {
    fn from_bytes(bytes: &[u8]) -> Option<&Self>
    where
        Self: Sized,
    {
        ...
    }
}

> - No implementation for slices for now,
> - Consequently, no user code will break due to the addition of the
>   methods, which is a big plus.
> 
> The simpler version that would result from this covers all the immediate
> use-cases and would be easier to merge, which will give us some time to
> think about how to handle the non-sized use cases (probably via a derive
> macro).
> 
> Do you think you could write the next version along these lines?
> 
> I feel like I misdirected you with the `FromBytesSized` trait, so please
> accept my apologies for that.

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Christian]

Hi, Alexandre.

On Mon, Aug 18, 2025 at 8:28 AM Alexandre Courbot <acourbot@nvidia.com> wrote:
>
> On Wed Aug 13, 2025 at 3:00 AM JST, Christian wrote:
> > Hi, Alexandre.
> >
> >> I mentioned it on v8 [1] and v7 [2], but the tests that break due to
> >> this change need to be updated by this patch as well. This includes:
> >>
> >> * The doctests in `rust/kernel/dma.rs`,
> >> * The `samples/rust/rust_dma.rs` sample,
> >> * The example for `FromBytes` introduced by this patch which uses `?` without
> >> defining a function.
> >
> > Sorry for my inattention, I'll fix this in the next version.
>
> Ah, as it turns out you might not need to.
>
> We discussed this patch a bit during the DRM sync, and the consensus was
> that it would probably be better to keep things a bit simpler for the
> first version. The `FromBytesSized` trait in particular was not very
> popular; a better long-term way to provide implementations for
> `FromBytes` would be to use a derive macro, but that's out of scope for
> now.
>
> Instead, we agreed that the following would make a good first version:
>
> - Make the `FromBytes` trait depend on `Sized`,
> - Provide default implementations for `from_bytes` and `from_bytes_mut`
>   directly in the `FromBytes` trait,
> - No implementation for slices for now,
> - Consequently, no user code will break due to the addition of the
>   methods, which is a big plus.
>
> The simpler version that would result from this covers all the immediate
> use-cases and would be easier to merge, which will give us some time to
> think about how to handle the non-sized use cases (probably via a derive
> macro).
>
> Do you think you could write the next version along these lines?

Yes, no problem.

> I feel like I misdirected you with the `FromBytesSized` trait, so please
> accept my apologies for that.

Don't worry, your guidance was really helpful during this time, no
need for excuses.

Thanks,
Christian

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Alexandre Courbot]

Hi Christian,

On Tue Aug 19, 2025 at 4:04 AM JST, Christian wrote:
> Hi, Alexandre.
>
> On Mon, Aug 18, 2025 at 8:28 AM Alexandre Courbot <acourbot@nvidia.com> wrote:
>>
>> On Wed Aug 13, 2025 at 3:00 AM JST, Christian wrote:
>> > Hi, Alexandre.
>> >
>> >> I mentioned it on v8 [1] and v7 [2], but the tests that break due to
>> >> this change need to be updated by this patch as well. This includes:
>> >>
>> >> * The doctests in `rust/kernel/dma.rs`,
>> >> * The `samples/rust/rust_dma.rs` sample,
>> >> * The example for `FromBytes` introduced by this patch which uses `?` without
>> >> defining a function.
>> >
>> > Sorry for my inattention, I'll fix this in the next version.
>>
>> Ah, as it turns out you might not need to.
>>
>> We discussed this patch a bit during the DRM sync, and the consensus was
>> that it would probably be better to keep things a bit simpler for the
>> first version. The `FromBytesSized` trait in particular was not very
>> popular; a better long-term way to provide implementations for
>> `FromBytes` would be to use a derive macro, but that's out of scope for
>> now.
>>
>> Instead, we agreed that the following would make a good first version:
>>
>> - Make the `FromBytes` trait depend on `Sized`,
>> - Provide default implementations for `from_bytes` and `from_bytes_mut`
>>   directly in the `FromBytes` trait,
>> - No implementation for slices for now,
>> - Consequently, no user code will break due to the addition of the
>>   methods, which is a big plus.
>>
>> The simpler version that would result from this covers all the immediate
>> use-cases and would be easier to merge, which will give us some time to
>> think about how to handle the non-sized use cases (probably via a derive
>> macro).
>>
>> Do you think you could write the next version along these lines?
>
> Yes, no problem.

Thanks - I also noticed a few other things while building with rustc
1.78 and clippy enabled:

- The `is_aligned` method for pointer types has only been stabilized
  with 1.79, meaning we need to explicitly enable the feature in
  `rust/kernel/lib.rs`:

diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
index ed53169e795c0..c859a8984bae1 100644
--- a/rust/kernel/lib.rs
+++ b/rust/kernel/lib.rs
@@ -18,6 +18,7 @@
 //
 // Stable since Rust 1.79.0.
 #![feature(inline_const)]
+#![feature(pointer_is_aligned)]
 //
 // Stable since Rust 1.81.0.
 #![feature(lint_reasons)]

(adding Miguel as a heads-up, and in case enabling a feature is not as easy as
I think :))

- Clippy was no happy with our use of `foo` in the doctest. This is easy to
fix:

diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
index 9bb707aabdc9a..9e4413fe9c32a 100644
--- a/rust/kernel/transmute.rs
+++ b/rust/kernel/transmute.rs
@@ -14,9 +14,9 @@
 /// ```
 /// use kernel::transmute::FromBytes;
 ///
-/// let foo = [1, 2, 3, 4];
+/// let raw = [1, 2, 3, 4];
 ///
-/// let result = u32::from_bytes(&foo).unwrap();
+/// let result = u32::from_bytes(&raw).unwrap();
 ///
 /// #[cfg(target_endian = "little")]
 /// assert_eq!(*result, 0x4030201);

- The patch adding `size_of*` to the prelude is not available yet, so for
safety we should probably import them:

diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
index 9e4413fe9c32a..3320e9e95057f 100644
--- a/rust/kernel/transmute.rs
+++ b/rust/kernel/transmute.rs
@@ -2,6 +2,8 @@

 //! Traits for transmuting types.

+use core::mem::{size_of, size_of_val};
+
 /// Types for which any bit pattern is valid.
 ///
 /// Not all types are valid for all values. For example, a `bool` must be either zero or one, so

With that, and the simplification discussed above, everything should be ok.

Do you think you can send the next iteration soonish? We have a consequent
patch series on nova-core that I would like to send which depends on this, and
since it is also very handy to have generally speaking it would be nice to have
it secured for the next merge window.

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Miguel Ojeda]

On Thu, Aug 21, 2025 at 1:13 PM Alexandre Courbot <acourbot@nvidia.com> wrote:
>
> (adding Miguel as a heads-up, and in case enabling a feature is not as easy as
> I think :))

Thanks! If it is internal to the crate, i.e. not something generated
by an exported macro that others can call, then that should be enough.

Cheers,
Miguel

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Alexandre Courbot]

On Thu Aug 21, 2025 at 10:50 PM JST, Miguel Ojeda wrote:
> On Thu, Aug 21, 2025 at 1:13 PM Alexandre Courbot <acourbot@nvidia.com> wrote:
>>
>> (adding Miguel as a heads-up, and in case enabling a feature is not as easy as
>> I think :))
>
> Thanks! If it is internal to the crate, i.e. not something generated
> by an exported macro that others can call, then that should be enough.

The methods making use of this feature are definitely usable by other
crates, and can also be inlined by the compiler. Would that be a
problem?

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Miguel Ojeda]

On Fri, Aug 22, 2025 at 5:10 AM Alexandre Courbot <acourbot@nvidia.com> wrote:
>
> The methods making use of this feature are definitely usable by other
> crates, and can also be inlined by the compiler. Would that be a
> problem?

No, that is fine.

Cheers,
Miguel

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Alexandre Courbot]

On Fri Aug 22, 2025 at 5:07 PM JST, Miguel Ojeda wrote:
> On Fri, Aug 22, 2025 at 5:10 AM Alexandre Courbot <acourbot@nvidia.com> wrote:
>>
>> The methods making use of this feature are definitely usable by other
>> crates, and can also be inlined by the compiler. Would that be a
>> problem?
>
> No, that is fine.

Strangely though, even after enabling the feature, I am still occasionally getting this warning:

  CLIPPY L rust/kernel.o
warning: current MSRV (Minimum Supported Rust Version) is `1.78.0` but this item is stable since `1.79.0`
  --> rust/kernel/transmute.rs:39:45
   |
39 |         if bytes.len() == size && slice_ptr.is_aligned() {
   |                                             ^^^^^^^^^^^^
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#incompatible_msrv
   = note: `-W clippy::incompatible-msrv` implied by `-W clippy::all`
   = help: to override `-W clippy::all` add `#[allow(clippy::incompatible_msrv)]`

warning: current MSRV (Minimum Supported Rust Version) is `1.78.0` but this item is stable since `1.79.0`
  --> rust/kernel/transmute.rs:57:45
   |
57 |         if bytes.len() == size && slice_ptr.is_aligned() {
   |                                             ^^^^^^^^^^^^
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#incompatible_msrv

warning: 2 warnings emitted

Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

[Miguel Ojeda]

On Fri, Aug 22, 2025 at 3:50 PM Alexandre Courbot <acourbot@nvidia.com> wrote:
>
> Strangely though, even after enabling the feature, I am still occasionally getting this warning:
>
>   CLIPPY L rust/kernel.o
> warning: current MSRV (Minimum Supported Rust Version) is `1.78.0` but this item is stable since `1.79.0`

Yeah, that one is a downside of the MSRV config -- please just allow it locally.

I hope we don't need more than a couple of those (we only had a case
elsewhere so far), and we will increase the minimum in the coming
months, so e.g. this one would go away. If it becomes too painful, I
will just disable it temporarily.

Thanks!

Cheers,
Miguel