[PATCH v2 3/5] drm/nova: use `zerocopy` in fwsec.rs

[PATCH v2 3/5] drm/nova: use `zerocopy` in fwsec.rs

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>

In firmware/fwsec.rs, replace the following `transmute` traits with
their `zerocopy` equivalents:

- `transmute::FromBytes` -> `zerocopy::FromBytes`
- `transmute::AsBytes` -> `zerocopy::IntoBytes`
- add `zerocopy::KnownLayout` where necessary

Update call sites accordingly.

Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
---
 drivers/gpu/nova-core/firmware/fwsec.rs | 49 ++++++-------------------
 1 file changed, 12 insertions(+), 37 deletions(-)

diff --git a/drivers/gpu/nova-core/firmware/fwsec.rs b/drivers/gpu/nova-core/firmware/fwsec.rs
index 95e0dd77746b..1b75cdc02256 100644
--- a/drivers/gpu/nova-core/firmware/fwsec.rs
+++ b/drivers/gpu/nova-core/firmware/fwsec.rs
@@ -19,11 +19,7 @@
         self,
         Device, //
     },
-    prelude::*,
-    transmute::{
-        AsBytes,
-        FromBytes, //
-    },
+    prelude::*, //
 };
 
 use crate::{
@@ -49,26 +45,22 @@
 const NVFW_FALCON_APPIF_ID_DMEMMAPPER: u32 = 0x4;
 
 #[repr(C)]
-#[derive(Debug)]
+#[derive(Debug, FromBytes)]
 struct FalconAppifHdrV1 {
     version: u8,
     header_size: u8,
     entry_size: u8,
     entry_count: u8,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FalconAppifHdrV1 {}
 
 #[repr(C, packed)]
-#[derive(Debug)]
+#[derive(Debug, FromBytes)]
 struct FalconAppifV1 {
     id: u32,
     dmem_base: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FalconAppifV1 {}
 
-#[derive(Debug)]
+#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 #[repr(C, packed)]
 struct FalconAppifDmemmapperV3 {
     signature: u32,
@@ -89,12 +81,8 @@ struct FalconAppifDmemmapperV3 {
     ucode_cmd_mask1: u32,
     multi_tgt_tbl: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FalconAppifDmemmapperV3 {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for FalconAppifDmemmapperV3 {}
 
-#[derive(Debug)]
+#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 #[repr(C, packed)]
 struct ReadVbios {
     ver: u32,
@@ -103,12 +91,8 @@ struct ReadVbios {
     size: u32,
     flags: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for ReadVbios {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for ReadVbios {}
 
-#[derive(Debug)]
+#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 #[repr(C, packed)]
 struct FrtsRegion {
     ver: u32,
@@ -117,22 +101,15 @@ struct FrtsRegion {
     size: u32,
     ftype: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FrtsRegion {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for FrtsRegion {}
 
 const NVFW_FRTS_CMD_REGION_TYPE_FB: u32 = 2;
 
 #[repr(C, packed)]
+#[derive(FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 struct FrtsCmd {
     read_vbios: ReadVbios,
     frts_region: FrtsRegion,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FrtsCmd {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for FrtsCmd {}
 
 const NVFW_FALCON_APPIF_DMEMMAPPER_CMD_FRTS: u32 = 0x15;
 const NVFW_FALCON_APPIF_DMEMMAPPER_CMD_SB: u32 = 0x19;
@@ -151,11 +128,9 @@ pub(crate) enum FwsecCommand {
 
 /// A single signature that can be patched into a FWSEC image.
 #[repr(transparent)]
+#[derive(FromBytes)]
 pub(crate) struct Bcrt30Rsa3kSignature([u8; BCRT30_RSA3K_SIG_SIZE]);
 
-/// SAFETY: A signature is just an array of bytes.
-unsafe impl FromBytes for Bcrt30Rsa3kSignature {}
-
 impl From<[u8; BCRT30_RSA3K_SIG_SIZE]> for Bcrt30Rsa3kSignature {
     fn from(sig: [u8; BCRT30_RSA3K_SIG_SIZE]) -> Self {
         Self(sig)
@@ -228,7 +203,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
         let hdr = ucode
             .get(hdr_offset..)
-            .and_then(FalconAppifHdrV1::from_bytes_prefix)
+            .and_then(|b| FalconAppifHdrV1::read_from_prefix(b).ok())
             .ok_or(EINVAL)?
             .0;
 
@@ -246,7 +221,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
             let app = ucode
                 .get(entry_offset..)
-                .and_then(FalconAppifV1::from_bytes_prefix)
+                .and_then(|b| FalconAppifV1::read_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0;
 
@@ -263,7 +238,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
             let dmem_mapper = ucode
                 .get_mut(dmem_mapper_offset..)
-                .and_then(FalconAppifDmemmapperV3::from_bytes_mut_prefix)
+                .and_then(|b| FalconAppifDmemmapperV3::mut_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0;
 
@@ -281,7 +256,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
             let frts_cmd = ucode
                 .get_mut(frts_cmd_offset..)
-                .and_then(FrtsCmd::from_bytes_mut_prefix)
+                .and_then(|b| FrtsCmd::mut_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0;
 
-- 
2.34.1

[RESEND PATCH v2 0/5] drm/nova: replace `transmute` with `zerocopy`

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>


This series follows the introduction of `zerocopy` to rust-next and
replaces `transmute` traits with `zerocopy` traits. These changes are
mechanical and don't alter functionality.

This series is built upon Nicolás' recent patch, and does not touch
gsp bindings.

Specifically, the trait `transmute::FromBytes` is replaced by
`zerocopy::FromBytes` and the trait `transmute::AsBytes` is replaced
by `zerocopy::IntoBytes`. Additional traits such as
`zerocopy::Immutable` and `zerocopy::KnownLayout` are implemented as
necessary.

Resent because of wrong target list and wrong email in "From:".

Pedro Yudi Honda (5):
  drm/nova: use `zerocopy` in firmware.rs
  drm/nova: use `zerocopy` in booter.rs
  drm/nova: use `zerocopy` in fwsec.rs
  drm/nova: use `zerocopy` in bootloader.rs
  drm/nova: use `zerocopy` in riscv.rs

 drivers/gpu/nova-core/firmware.rs             | 10 ++--
 drivers/gpu/nova-core/firmware/booter.rs      | 26 +++-------
 drivers/gpu/nova-core/firmware/fwsec.rs       | 49 +++++--------------
 .../nova-core/firmware/fwsec/bootloader.rs    | 18 ++-----
 drivers/gpu/nova-core/firmware/riscv.rs       | 10 ++--
 5 files changed, 30 insertions(+), 83 deletions(-)

-- 
2.34.1

[PATCH v2 1/5] drm/nova: use `zerocopy` in firmware.rs

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>

In firmware.rs, replace the following `transmute` traits with their
`zerocopy` equivalents:

- `transmute::FromBytes` -> `zerocopy::FromBytes`

Update call sites accordingly.

Note that the module `elf` is untouched, as the bindings generated by
bindgen do not implement `FromBytes` for the structs.

Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
---
 drivers/gpu/nova-core/firmware.rs                  | 10 +++-------
 drivers/gpu/nova-core/firmware/fwsec/bootloader.rs |  4 +++-
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/nova-core/firmware.rs b/drivers/gpu/nova-core/firmware.rs
index a94820a3b335..80ce0df244a8 100644
--- a/drivers/gpu/nova-core/firmware.rs
+++ b/drivers/gpu/nova-core/firmware.rs
@@ -11,8 +11,7 @@
     device,
     firmware,
     prelude::*,
-    str::CString,
-    transmute::FromBytes, //
+    str::CString, //
 };
 
 use crate::{
@@ -347,7 +346,7 @@ fn no_patch_signature(self) -> FirmwareObject<F, Signed> {
 
 /// Header common to most firmware files.
 #[repr(C)]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, FromBytes)]
 struct BinHdr {
     /// Magic number, must be `0x10de`.
     bin_magic: u32,
@@ -363,9 +362,6 @@ struct BinHdr {
     data_size: u32,
 }
 
-// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
-unsafe impl FromBytes for BinHdr {}
-
 // A firmware blob starting with a `BinHdr`.
 struct BinFirmware<'a> {
     hdr: BinHdr,
@@ -381,7 +377,7 @@ fn new(fw: &'a firmware::Firmware) -> Result<Self> {
 
         fw.get(0..size_of::<BinHdr>())
             // Extract header.
-            .and_then(BinHdr::from_bytes_copy)
+            .and_then(|b| BinHdr::read_from_bytes(b).ok())
             // Validate header.
             .filter(|hdr| hdr.bin_magic == BIN_MAGIC)
             .map(|hdr| Self { hdr, fw })
diff --git a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
index d9fafd2eea5b..66b9f4d1b41c 100644
--- a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
+++ b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
@@ -25,6 +25,8 @@
     },
 };
 
+use zerocopy::FromBytes as _;
+
 use crate::{
     driver::Bar0,
     falcon::{
@@ -150,7 +152,7 @@ pub(crate) fn new(
         let hdr = fw
             .data()
             .get(0..size_of::<BinHdr>())
-            .and_then(BinHdr::from_bytes_copy)
+            .and_then(|b| BinHdr::read_from_bytes(b).ok())
             .ok_or(EINVAL)?;
 
         let desc = {
-- 
2.34.1

[PATCH v2 2/5] drm/nova: use `zerocopy` in booter.rs

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>

In firmware/booter.rs, replace the following `transmute` traits with
their `zerocopy` equivalents:

- `transmute::FromBytes` -> `zerocopy::FromBytes`

Update call sites accordingly.

Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
---
 drivers/gpu/nova-core/firmware/booter.rs | 26 +++++++-----------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/nova-core/firmware/booter.rs b/drivers/gpu/nova-core/firmware/booter.rs
index acb7f4d8a532..fe9389b84b90 100644
--- a/drivers/gpu/nova-core/firmware/booter.rs
+++ b/drivers/gpu/nova-core/firmware/booter.rs
@@ -10,8 +10,7 @@
 use kernel::{
     device,
     dma::Coherent,
-    prelude::*,
-    transmute::FromBytes, //
+    prelude::*, //
 };
 
 use crate::{
@@ -43,7 +42,7 @@ fn frombytes_at<S: FromBytes + Sized>(slice: &[u8], offset: usize) -> Result<S>
     let end = offset.checked_add(size_of::<S>()).ok_or(EINVAL)?;
     slice
         .get(offset..end)
-        .and_then(S::from_bytes_copy)
+        .and_then(|b| S::read_from_bytes(b).ok())
         .ok_or(EINVAL)
 }
 
@@ -52,7 +51,7 @@ fn frombytes_at<S: FromBytes + Sized>(slice: &[u8], offset: usize) -> Result<S>
 /// Such firmwares have an application-specific payload that needs to be patched with a given
 /// signature.
 #[repr(C)]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, FromBytes)]
 struct HsHeaderV2 {
     /// Offset to the start of the signatures.
     sig_prod_offset: u32,
@@ -75,9 +74,6 @@ struct HsHeaderV2 {
     header_size: u32,
 }
 
-// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
-unsafe impl FromBytes for HsHeaderV2 {}
-
 /// Heavy-Secured Firmware image container.
 ///
 /// This provides convenient access to the fields of [`HsHeaderV2`] that are actually indices to
@@ -144,6 +140,7 @@ fn signatures_iter(&'a self) -> Result<impl Iterator<Item = BooterSignature<'a>>
 
 /// Signature parameters, as defined in the firmware.
 #[repr(C)]
+#[derive(FromBytes)]
 struct HsSignatureParams {
     /// Fuse version to use.
     fuse_ver: u32,
@@ -153,9 +150,6 @@ struct HsSignatureParams {
     ucode_id: u32,
 }
 
-// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
-unsafe impl FromBytes for HsSignatureParams {}
-
 impl HsSignatureParams {
     /// Returns the signature parameters contained in `hs_fw`.
     ///
@@ -170,14 +164,14 @@ fn new(hs_fw: &HsFirmwareV2<'_>) -> Result<Self> {
         hs_fw
             .fw
             .get(start..end)
-            .and_then(Self::from_bytes_copy)
+            .and_then(|b| Self::read_from_bytes(b).ok())
             .ok_or(EINVAL)
     }
 }
 
 /// Header for code and data load offsets.
 #[repr(C)]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, FromBytes)]
 struct HsLoadHeaderV2 {
     // Offset at which the code starts.
     os_code_offset: u32,
@@ -191,9 +185,6 @@ struct HsLoadHeaderV2 {
     num_apps: u32,
 }
 
-// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
-unsafe impl FromBytes for HsLoadHeaderV2 {}
-
 impl HsLoadHeaderV2 {
     /// Returns the load header contained in `hs_fw`.
     ///
@@ -205,7 +196,7 @@ fn new(hs_fw: &HsFirmwareV2<'_>) -> Result<Self> {
 
 /// Header for app code loader.
 #[repr(C)]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, FromBytes)]
 struct HsLoadHeaderV2App {
     /// Offset at which to load the app code.
     offset: u32,
@@ -213,9 +204,6 @@ struct HsLoadHeaderV2App {
     len: u32,
 }
 
-// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
-unsafe impl FromBytes for HsLoadHeaderV2App {}
-
 impl HsLoadHeaderV2App {
     /// Returns the [`HsLoadHeaderV2App`] for app `idx` of `hs_fw`.
     ///
-- 
2.34.1

[PATCH v2 3/5] drm/nova: use `zerocopy` in fwsec.rs

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>

In firmware/fwsec.rs, replace the following `transmute` traits with
their `zerocopy` equivalents:

- `transmute::FromBytes` -> `zerocopy::FromBytes`
- `transmute::AsBytes` -> `zerocopy::IntoBytes`
- add `zerocopy::KnownLayout` where necessary

Update call sites accordingly.

Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
---
 drivers/gpu/nova-core/firmware/fwsec.rs | 49 ++++++-------------------
 1 file changed, 12 insertions(+), 37 deletions(-)

diff --git a/drivers/gpu/nova-core/firmware/fwsec.rs b/drivers/gpu/nova-core/firmware/fwsec.rs
index 95e0dd77746b..1b75cdc02256 100644
--- a/drivers/gpu/nova-core/firmware/fwsec.rs
+++ b/drivers/gpu/nova-core/firmware/fwsec.rs
@@ -19,11 +19,7 @@
         self,
         Device, //
     },
-    prelude::*,
-    transmute::{
-        AsBytes,
-        FromBytes, //
-    },
+    prelude::*, //
 };
 
 use crate::{
@@ -49,26 +45,22 @@
 const NVFW_FALCON_APPIF_ID_DMEMMAPPER: u32 = 0x4;
 
 #[repr(C)]
-#[derive(Debug)]
+#[derive(Debug, FromBytes)]
 struct FalconAppifHdrV1 {
     version: u8,
     header_size: u8,
     entry_size: u8,
     entry_count: u8,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FalconAppifHdrV1 {}
 
 #[repr(C, packed)]
-#[derive(Debug)]
+#[derive(Debug, FromBytes)]
 struct FalconAppifV1 {
     id: u32,
     dmem_base: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FalconAppifV1 {}
 
-#[derive(Debug)]
+#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 #[repr(C, packed)]
 struct FalconAppifDmemmapperV3 {
     signature: u32,
@@ -89,12 +81,8 @@ struct FalconAppifDmemmapperV3 {
     ucode_cmd_mask1: u32,
     multi_tgt_tbl: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FalconAppifDmemmapperV3 {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for FalconAppifDmemmapperV3 {}
 
-#[derive(Debug)]
+#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 #[repr(C, packed)]
 struct ReadVbios {
     ver: u32,
@@ -103,12 +91,8 @@ struct ReadVbios {
     size: u32,
     flags: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for ReadVbios {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for ReadVbios {}
 
-#[derive(Debug)]
+#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 #[repr(C, packed)]
 struct FrtsRegion {
     ver: u32,
@@ -117,22 +101,15 @@ struct FrtsRegion {
     size: u32,
     ftype: u32,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FrtsRegion {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for FrtsRegion {}
 
 const NVFW_FRTS_CMD_REGION_TYPE_FB: u32 = 2;
 
 #[repr(C, packed)]
+#[derive(FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
 struct FrtsCmd {
     read_vbios: ReadVbios,
     frts_region: FrtsRegion,
 }
-// SAFETY: Any byte sequence is valid for this struct.
-unsafe impl FromBytes for FrtsCmd {}
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for FrtsCmd {}
 
 const NVFW_FALCON_APPIF_DMEMMAPPER_CMD_FRTS: u32 = 0x15;
 const NVFW_FALCON_APPIF_DMEMMAPPER_CMD_SB: u32 = 0x19;
@@ -151,11 +128,9 @@ pub(crate) enum FwsecCommand {
 
 /// A single signature that can be patched into a FWSEC image.
 #[repr(transparent)]
+#[derive(FromBytes)]
 pub(crate) struct Bcrt30Rsa3kSignature([u8; BCRT30_RSA3K_SIG_SIZE]);
 
-/// SAFETY: A signature is just an array of bytes.
-unsafe impl FromBytes for Bcrt30Rsa3kSignature {}
-
 impl From<[u8; BCRT30_RSA3K_SIG_SIZE]> for Bcrt30Rsa3kSignature {
     fn from(sig: [u8; BCRT30_RSA3K_SIG_SIZE]) -> Self {
         Self(sig)
@@ -228,7 +203,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
         let hdr = ucode
             .get(hdr_offset..)
-            .and_then(FalconAppifHdrV1::from_bytes_prefix)
+            .and_then(|b| FalconAppifHdrV1::read_from_prefix(b).ok())
             .ok_or(EINVAL)?
             .0;
 
@@ -246,7 +221,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
             let app = ucode
                 .get(entry_offset..)
-                .and_then(FalconAppifV1::from_bytes_prefix)
+                .and_then(|b| FalconAppifV1::read_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0;
 
@@ -263,7 +238,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
             let dmem_mapper = ucode
                 .get_mut(dmem_mapper_offset..)
-                .and_then(FalconAppifDmemmapperV3::from_bytes_mut_prefix)
+                .and_then(|b| FalconAppifDmemmapperV3::mut_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0;
 
@@ -281,7 +256,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
 
             let frts_cmd = ucode
                 .get_mut(frts_cmd_offset..)
-                .and_then(FrtsCmd::from_bytes_mut_prefix)
+                .and_then(|b| FrtsCmd::mut_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0;
 
-- 
2.34.1

[PATCH v2 4/5] drm/nova: use `zerocopy` in bootloader.rs

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>

In firmware/fwsec/bootloader.rs, replace the following `transmute`
traits with their `zerocopy` equivalents:

- `transmute::FromBytes` -> `zerocopy::FromBytes`
- `transmute::AsBytes` -> `zerocopy::IntoBytes`
- add `zerocopy::Immutable` where necessary

Update call sites accordingly.

Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
---
 .../gpu/nova-core/firmware/fwsec/bootloader.rs | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
index 66b9f4d1b41c..03d3090bd9ef 100644
--- a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
+++ b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
@@ -18,15 +18,9 @@
         Alignable,
         Alignment, //
     },
-    sizes,
-    transmute::{
-        AsBytes,
-        FromBytes, //
-    },
+    sizes, //
 };
 
-use zerocopy::FromBytes as _;
-
 use crate::{
     driver::Bar0,
     falcon::{
@@ -57,7 +51,7 @@
 ///
 /// Most of its fields appear to be legacy and carry incorrect values, so they are left unused.
 #[repr(C)]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, FromBytes)]
 struct BootloaderDesc {
     /// Starting tag of bootloader.
     start_tag: u32,
@@ -73,15 +67,13 @@ struct BootloaderDesc {
     /// Size of data section in the image. Unused as we build the data section ourselves.
     _data_size: u32,
 }
-// SAFETY: any byte sequence is valid for this struct.
-unsafe impl FromBytes for BootloaderDesc {}
 
 /// Structure used by the boot-loader to load the rest of the code.
 ///
 /// This has to be filled by the GPU driver and copied into DMEM at offset
 /// [`BootloaderDesc.dmem_load_off`].
 #[repr(C, packed)]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, IntoBytes, zerocopy_derive::Immutable)]
 struct BootloaderDmemDescV2 {
     /// Reserved, should always be first element.
     reserved: [u32; 4],
@@ -120,8 +112,6 @@ struct BootloaderDmemDescV2 {
     /// Arguments to be passed to the target firmware being loaded.
     argv: u32,
 }
-// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
-unsafe impl AsBytes for BootloaderDmemDescV2 {}
 
 /// Wrapper for [`FwsecFirmware`] that includes the bootloader performing the actual load
 /// operation.
@@ -160,7 +150,7 @@ pub(crate) fn new(
 
             fw.data()
                 .get(desc_offset..)
-                .and_then(BootloaderDesc::from_bytes_copy_prefix)
+                .and_then(|b| BootloaderDesc::read_from_prefix(b).ok())
                 .ok_or(EINVAL)?
                 .0
         };
-- 
2.34.1

[PATCH v2 5/5] drm/nova: use `zerocopy` in riscv.rs

[Pedro Yudi Honda]

From: Pedro Yudi Honda <niyudi.honda@usp.br>

In riscv.rs, replave the following `transmute` traits with their
`zerocopy` equivalents:

- `transmute::FromBytes` -> `zerocopy::FromBytes`

Update call sites accordingly.

Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
---
 drivers/gpu/nova-core/firmware/riscv.rs | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/nova-core/firmware/riscv.rs b/drivers/gpu/nova-core/firmware/riscv.rs
index 2afa7f36404e..ba56bc7d4188 100644
--- a/drivers/gpu/nova-core/firmware/riscv.rs
+++ b/drivers/gpu/nova-core/firmware/riscv.rs
@@ -7,8 +7,7 @@
     device,
     dma::Coherent,
     firmware::Firmware,
-    prelude::*,
-    transmute::FromBytes, //
+    prelude::*, //
 };
 
 use crate::{
@@ -18,7 +17,7 @@
 
 /// Descriptor for microcode running on a RISC-V core.
 #[repr(C)]
-#[derive(Debug)]
+#[derive(Debug, FromBytes)]
 struct RmRiscvUCodeDesc {
     version: u32,
     bootloader_offset: u32,
@@ -36,9 +35,6 @@ struct RmRiscvUCodeDesc {
     monitor_code_size: u32,
 }
 
-// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
-unsafe impl FromBytes for RmRiscvUCodeDesc {}
-
 impl RmRiscvUCodeDesc {
     /// Interprets the header of `bin_fw` as a [`RmRiscvUCodeDesc`] and returns it.
     ///
@@ -50,7 +46,7 @@ fn new(bin_fw: &BinFirmware<'_>) -> Result<Self> {
         bin_fw
             .fw
             .get(offset..end)
-            .and_then(Self::from_bytes_copy)
+            .and_then(|b| Self::read_from_bytes(b).ok())
             .ok_or(EINVAL)
     }
 }
-- 
2.34.1

Re: [RESEND PATCH v2 0/5] drm/nova: replace `transmute` with `zerocopy`

[Miguel Ojeda]

On Thu, Jul 2, 2026 at 2:05 PM Pedro Yudi Honda <niyudi.honda@usp.br> wrote:
>
> Resent because of wrong target list and wrong email in "From:".

It is good that you mention this, thanks!

For future series, please also include a changelog between versions,
i.e. so that reviewers know what changed :)

Cheers,
Miguel

Re: [PATCH v2 1/5] drm/nova: use `zerocopy` in firmware.rs

[Alistair Popple]

On 2026-07-02 at 22:03 +1000, Pedro Yudi Honda <niyudi.honda@usp.br> wrote...
> From: Pedro Yudi Honda <niyudi.honda@usp.br>
> 
> In firmware.rs, replace the following `transmute` traits with their
> `zerocopy` equivalents:
> 
> - `transmute::FromBytes` -> `zerocopy::FromBytes`
> 
> Update call sites accordingly.
> 
> Note that the module `elf` is untouched, as the bindings generated by
> bindgen do not implement `FromBytes` for the structs.

Also I believe this module is pretty temporary and going to go away.

Everything here is pretty mechanical though, and looks good to me so:

Reviewed-by: Alistair Popple <apopple@nvidia.com>

> Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
> ---
>  drivers/gpu/nova-core/firmware.rs                  | 10 +++-------
>  drivers/gpu/nova-core/firmware/fwsec/bootloader.rs |  4 +++-
>  2 files changed, 6 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/gpu/nova-core/firmware.rs b/drivers/gpu/nova-core/firmware.rs
> index a94820a3b335..80ce0df244a8 100644
> --- a/drivers/gpu/nova-core/firmware.rs
> +++ b/drivers/gpu/nova-core/firmware.rs
> @@ -11,8 +11,7 @@
>      device,
>      firmware,
>      prelude::*,
> -    str::CString,
> -    transmute::FromBytes, //
> +    str::CString, //
>  };
>  
>  use crate::{
> @@ -347,7 +346,7 @@ fn no_patch_signature(self) -> FirmwareObject<F, Signed> {
>  
>  /// Header common to most firmware files.
>  #[repr(C)]
> -#[derive(Debug, Clone)]
> +#[derive(Debug, Clone, FromBytes)]
>  struct BinHdr {
>      /// Magic number, must be `0x10de`.
>      bin_magic: u32,
> @@ -363,9 +362,6 @@ struct BinHdr {
>      data_size: u32,
>  }
>  
> -// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
> -unsafe impl FromBytes for BinHdr {}
> -
>  // A firmware blob starting with a `BinHdr`.
>  struct BinFirmware<'a> {
>      hdr: BinHdr,
> @@ -381,7 +377,7 @@ fn new(fw: &'a firmware::Firmware) -> Result<Self> {
>  
>          fw.get(0..size_of::<BinHdr>())
>              // Extract header.
> -            .and_then(BinHdr::from_bytes_copy)
> +            .and_then(|b| BinHdr::read_from_bytes(b).ok())
>              // Validate header.
>              .filter(|hdr| hdr.bin_magic == BIN_MAGIC)
>              .map(|hdr| Self { hdr, fw })
> diff --git a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
> index d9fafd2eea5b..66b9f4d1b41c 100644
> --- a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
> +++ b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
> @@ -25,6 +25,8 @@
>      },
>  };
>  
> +use zerocopy::FromBytes as _;
> +
>  use crate::{
>      driver::Bar0,
>      falcon::{
> @@ -150,7 +152,7 @@ pub(crate) fn new(
>          let hdr = fw
>              .data()
>              .get(0..size_of::<BinHdr>())
> -            .and_then(BinHdr::from_bytes_copy)
> +            .and_then(|b| BinHdr::read_from_bytes(b).ok())
>              .ok_or(EINVAL)?;
>  
>          let desc = {
> -- 
> 2.34.1
> 

Re: [PATCH v2 2/5] drm/nova: use `zerocopy` in booter.rs

[Alistair Popple]

On 2026-07-02 at 22:03 +1000, Pedro Yudi Honda <niyudi.honda@usp.br> wrote...
> From: Pedro Yudi Honda <niyudi.honda@usp.br>
> 
> In firmware/booter.rs, replace the following `transmute` traits with
> their `zerocopy` equivalents:
> 
> - `transmute::FromBytes` -> `zerocopy::FromBytes`

Having a single item list reads a bit strange to me. I'd just say "replace
`transmute::FromBytes` with `zerocopy::FromBytes`" and if you want to list the
types it's replaced for you could. But that's a bit superfluous as it's clear
from the patch anyway.

But that's a small nit really, everything looks ok to me so feel free to add:

Reviewed-by: Alistair Popple <apopple@nvidia.com>

> Update call sites accordingly.
>
> Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
> ---
>  drivers/gpu/nova-core/firmware/booter.rs | 26 +++++++-----------------
>  1 file changed, 7 insertions(+), 19 deletions(-)
> 
> diff --git a/drivers/gpu/nova-core/firmware/booter.rs b/drivers/gpu/nova-core/firmware/booter.rs
> index acb7f4d8a532..fe9389b84b90 100644
> --- a/drivers/gpu/nova-core/firmware/booter.rs
> +++ b/drivers/gpu/nova-core/firmware/booter.rs
> @@ -10,8 +10,7 @@
>  use kernel::{
>      device,
>      dma::Coherent,
> -    prelude::*,
> -    transmute::FromBytes, //
> +    prelude::*, //
>  };
>  
>  use crate::{
> @@ -43,7 +42,7 @@ fn frombytes_at<S: FromBytes + Sized>(slice: &[u8], offset: usize) -> Result<S>
>      let end = offset.checked_add(size_of::<S>()).ok_or(EINVAL)?;
>      slice
>          .get(offset..end)
> -        .and_then(S::from_bytes_copy)
> +        .and_then(|b| S::read_from_bytes(b).ok())
>          .ok_or(EINVAL)
>  }
>  
> @@ -52,7 +51,7 @@ fn frombytes_at<S: FromBytes + Sized>(slice: &[u8], offset: usize) -> Result<S>
>  /// Such firmwares have an application-specific payload that needs to be patched with a given
>  /// signature.
>  #[repr(C)]
> -#[derive(Debug, Clone)]
> +#[derive(Debug, Clone, FromBytes)]
>  struct HsHeaderV2 {
>      /// Offset to the start of the signatures.
>      sig_prod_offset: u32,
> @@ -75,9 +74,6 @@ struct HsHeaderV2 {
>      header_size: u32,
>  }
>  
> -// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
> -unsafe impl FromBytes for HsHeaderV2 {}
> -
>  /// Heavy-Secured Firmware image container.
>  ///
>  /// This provides convenient access to the fields of [`HsHeaderV2`] that are actually indices to
> @@ -144,6 +140,7 @@ fn signatures_iter(&'a self) -> Result<impl Iterator<Item = BooterSignature<'a>>
>  
>  /// Signature parameters, as defined in the firmware.
>  #[repr(C)]
> +#[derive(FromBytes)]
>  struct HsSignatureParams {
>      /// Fuse version to use.
>      fuse_ver: u32,
> @@ -153,9 +150,6 @@ struct HsSignatureParams {
>      ucode_id: u32,
>  }
>  
> -// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
> -unsafe impl FromBytes for HsSignatureParams {}
> -
>  impl HsSignatureParams {
>      /// Returns the signature parameters contained in `hs_fw`.
>      ///
> @@ -170,14 +164,14 @@ fn new(hs_fw: &HsFirmwareV2<'_>) -> Result<Self> {
>          hs_fw
>              .fw
>              .get(start..end)
> -            .and_then(Self::from_bytes_copy)
> +            .and_then(|b| Self::read_from_bytes(b).ok())
>              .ok_or(EINVAL)
>      }
>  }
>  
>  /// Header for code and data load offsets.
>  #[repr(C)]
> -#[derive(Debug, Clone)]
> +#[derive(Debug, Clone, FromBytes)]
>  struct HsLoadHeaderV2 {
>      // Offset at which the code starts.
>      os_code_offset: u32,
> @@ -191,9 +185,6 @@ struct HsLoadHeaderV2 {
>      num_apps: u32,
>  }
>  
> -// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
> -unsafe impl FromBytes for HsLoadHeaderV2 {}
> -
>  impl HsLoadHeaderV2 {
>      /// Returns the load header contained in `hs_fw`.
>      ///
> @@ -205,7 +196,7 @@ fn new(hs_fw: &HsFirmwareV2<'_>) -> Result<Self> {
>  
>  /// Header for app code loader.
>  #[repr(C)]
> -#[derive(Debug, Clone)]
> +#[derive(Debug, Clone, FromBytes)]
>  struct HsLoadHeaderV2App {
>      /// Offset at which to load the app code.
>      offset: u32,
> @@ -213,9 +204,6 @@ struct HsLoadHeaderV2App {
>      len: u32,
>  }
>  
> -// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
> -unsafe impl FromBytes for HsLoadHeaderV2App {}
> -
>  impl HsLoadHeaderV2App {
>      /// Returns the [`HsLoadHeaderV2App`] for app `idx` of `hs_fw`.
>      ///
> -- 
> 2.34.1
> 

Re: [PATCH v2 3/5] drm/nova: use `zerocopy` in fwsec.rs

[Alistair Popple]

On 2026-07-02 at 22:03 +1000, Pedro Yudi Honda <niyudi.honda@usp.br> wrote...
> From: Pedro Yudi Honda <niyudi.honda@usp.br>
> 
> In firmware/fwsec.rs, replace the following `transmute` traits with
> their `zerocopy` equivalents:
> 
> - `transmute::FromBytes` -> `zerocopy::FromBytes`
> - `transmute::AsBytes` -> `zerocopy::IntoBytes`
> - add `zerocopy::KnownLayout` where necessary

Argh, ok. It makes more sense when there are more things in the list :-) That
said I'd also be ok without, but either is fine.

Reviewed-by: Alistair Popple <apopple@nvidia.com>

> Update call sites accordingly.
> 
> Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
> ---
>  drivers/gpu/nova-core/firmware/fwsec.rs | 49 ++++++-------------------
>  1 file changed, 12 insertions(+), 37 deletions(-)
> 
> diff --git a/drivers/gpu/nova-core/firmware/fwsec.rs b/drivers/gpu/nova-core/firmware/fwsec.rs
> index 95e0dd77746b..1b75cdc02256 100644
> --- a/drivers/gpu/nova-core/firmware/fwsec.rs
> +++ b/drivers/gpu/nova-core/firmware/fwsec.rs
> @@ -19,11 +19,7 @@
>          self,
>          Device, //
>      },
> -    prelude::*,
> -    transmute::{
> -        AsBytes,
> -        FromBytes, //
> -    },
> +    prelude::*, //
>  };
>  
>  use crate::{
> @@ -49,26 +45,22 @@
>  const NVFW_FALCON_APPIF_ID_DMEMMAPPER: u32 = 0x4;
>  
>  #[repr(C)]
> -#[derive(Debug)]
> +#[derive(Debug, FromBytes)]
>  struct FalconAppifHdrV1 {
>      version: u8,
>      header_size: u8,
>      entry_size: u8,
>      entry_count: u8,
>  }
> -// SAFETY: Any byte sequence is valid for this struct.
> -unsafe impl FromBytes for FalconAppifHdrV1 {}
>  
>  #[repr(C, packed)]
> -#[derive(Debug)]
> +#[derive(Debug, FromBytes)]
>  struct FalconAppifV1 {
>      id: u32,
>      dmem_base: u32,
>  }
> -// SAFETY: Any byte sequence is valid for this struct.
> -unsafe impl FromBytes for FalconAppifV1 {}
>  
> -#[derive(Debug)]
> +#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
>  #[repr(C, packed)]
>  struct FalconAppifDmemmapperV3 {
>      signature: u32,
> @@ -89,12 +81,8 @@ struct FalconAppifDmemmapperV3 {
>      ucode_cmd_mask1: u32,
>      multi_tgt_tbl: u32,
>  }
> -// SAFETY: Any byte sequence is valid for this struct.
> -unsafe impl FromBytes for FalconAppifDmemmapperV3 {}
> -// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
> -unsafe impl AsBytes for FalconAppifDmemmapperV3 {}
>  
> -#[derive(Debug)]
> +#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
>  #[repr(C, packed)]
>  struct ReadVbios {
>      ver: u32,
> @@ -103,12 +91,8 @@ struct ReadVbios {
>      size: u32,
>      flags: u32,
>  }
> -// SAFETY: Any byte sequence is valid for this struct.
> -unsafe impl FromBytes for ReadVbios {}
> -// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
> -unsafe impl AsBytes for ReadVbios {}
>  
> -#[derive(Debug)]
> +#[derive(Debug, FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
>  #[repr(C, packed)]
>  struct FrtsRegion {
>      ver: u32,
> @@ -117,22 +101,15 @@ struct FrtsRegion {
>      size: u32,
>      ftype: u32,
>  }
> -// SAFETY: Any byte sequence is valid for this struct.
> -unsafe impl FromBytes for FrtsRegion {}
> -// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
> -unsafe impl AsBytes for FrtsRegion {}
>  
>  const NVFW_FRTS_CMD_REGION_TYPE_FB: u32 = 2;
>  
>  #[repr(C, packed)]
> +#[derive(FromBytes, IntoBytes, zerocopy_derive::KnownLayout)]
>  struct FrtsCmd {
>      read_vbios: ReadVbios,
>      frts_region: FrtsRegion,
>  }
> -// SAFETY: Any byte sequence is valid for this struct.
> -unsafe impl FromBytes for FrtsCmd {}
> -// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
> -unsafe impl AsBytes for FrtsCmd {}
>  
>  const NVFW_FALCON_APPIF_DMEMMAPPER_CMD_FRTS: u32 = 0x15;
>  const NVFW_FALCON_APPIF_DMEMMAPPER_CMD_SB: u32 = 0x19;
> @@ -151,11 +128,9 @@ pub(crate) enum FwsecCommand {
>  
>  /// A single signature that can be patched into a FWSEC image.
>  #[repr(transparent)]
> +#[derive(FromBytes)]
>  pub(crate) struct Bcrt30Rsa3kSignature([u8; BCRT30_RSA3K_SIG_SIZE]);
>  
> -/// SAFETY: A signature is just an array of bytes.
> -unsafe impl FromBytes for Bcrt30Rsa3kSignature {}
> -
>  impl From<[u8; BCRT30_RSA3K_SIG_SIZE]> for Bcrt30Rsa3kSignature {
>      fn from(sig: [u8; BCRT30_RSA3K_SIG_SIZE]) -> Self {
>          Self(sig)
> @@ -228,7 +203,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
>  
>          let hdr = ucode
>              .get(hdr_offset..)
> -            .and_then(FalconAppifHdrV1::from_bytes_prefix)
> +            .and_then(|b| FalconAppifHdrV1::read_from_prefix(b).ok())
>              .ok_or(EINVAL)?
>              .0;
>  
> @@ -246,7 +221,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
>  
>              let app = ucode
>                  .get(entry_offset..)
> -                .and_then(FalconAppifV1::from_bytes_prefix)
> +                .and_then(|b| FalconAppifV1::read_from_prefix(b).ok())
>                  .ok_or(EINVAL)?
>                  .0;
>  
> @@ -263,7 +238,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
>  
>              let dmem_mapper = ucode
>                  .get_mut(dmem_mapper_offset..)
> -                .and_then(FalconAppifDmemmapperV3::from_bytes_mut_prefix)
> +                .and_then(|b| FalconAppifDmemmapperV3::mut_from_prefix(b).ok())
>                  .ok_or(EINVAL)?
>                  .0;
>  
> @@ -281,7 +256,7 @@ fn new_fwsec(bios: &Vbios, cmd: FwsecCommand) -> Result<Self> {
>  
>              let frts_cmd = ucode
>                  .get_mut(frts_cmd_offset..)
> -                .and_then(FrtsCmd::from_bytes_mut_prefix)
> +                .and_then(|b| FrtsCmd::mut_from_prefix(b).ok())
>                  .ok_or(EINVAL)?
>                  .0;
>  
> -- 
> 2.34.1
> 

Re: [PATCH v2 4/5] drm/nova: use `zerocopy` in bootloader.rs

[Alistair Popple]

On 2026-07-02 at 22:03 +1000, Pedro Yudi Honda <niyudi.honda@usp.br> wrote...
> From: Pedro Yudi Honda <niyudi.honda@usp.br>
> 
> In firmware/fwsec/bootloader.rs, replace the following `transmute`
> traits with their `zerocopy` equivalents:
> 
> - `transmute::FromBytes` -> `zerocopy::FromBytes`
> - `transmute::AsBytes` -> `zerocopy::IntoBytes`
> - add `zerocopy::Immutable` where necessary
> 
> Update call sites accordingly.

Reviewed-by: Alistair Popple <apopple@nvidia.com>

> 
> Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
> ---
>  .../gpu/nova-core/firmware/fwsec/bootloader.rs | 18 ++++--------------
>  1 file changed, 4 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
> index 66b9f4d1b41c..03d3090bd9ef 100644
> --- a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
> +++ b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
> @@ -18,15 +18,9 @@
>          Alignable,
>          Alignment, //
>      },
> -    sizes,
> -    transmute::{
> -        AsBytes,
> -        FromBytes, //
> -    },
> +    sizes, //
>  };
>  
> -use zerocopy::FromBytes as _;
> -
>  use crate::{
>      driver::Bar0,
>      falcon::{
> @@ -57,7 +51,7 @@
>  ///
>  /// Most of its fields appear to be legacy and carry incorrect values, so they are left unused.
>  #[repr(C)]
> -#[derive(Debug, Clone)]
> +#[derive(Debug, Clone, FromBytes)]
>  struct BootloaderDesc {
>      /// Starting tag of bootloader.
>      start_tag: u32,
> @@ -73,15 +67,13 @@ struct BootloaderDesc {
>      /// Size of data section in the image. Unused as we build the data section ourselves.
>      _data_size: u32,
>  }
> -// SAFETY: any byte sequence is valid for this struct.
> -unsafe impl FromBytes for BootloaderDesc {}
>  
>  /// Structure used by the boot-loader to load the rest of the code.
>  ///
>  /// This has to be filled by the GPU driver and copied into DMEM at offset
>  /// [`BootloaderDesc.dmem_load_off`].
>  #[repr(C, packed)]
> -#[derive(Debug, Clone)]
> +#[derive(Debug, Clone, IntoBytes, zerocopy_derive::Immutable)]
>  struct BootloaderDmemDescV2 {
>      /// Reserved, should always be first element.
>      reserved: [u32; 4],
> @@ -120,8 +112,6 @@ struct BootloaderDmemDescV2 {
>      /// Arguments to be passed to the target firmware being loaded.
>      argv: u32,
>  }
> -// SAFETY: This struct doesn't contain uninitialized bytes and doesn't have interior mutability.
> -unsafe impl AsBytes for BootloaderDmemDescV2 {}
>  
>  /// Wrapper for [`FwsecFirmware`] that includes the bootloader performing the actual load
>  /// operation.
> @@ -160,7 +150,7 @@ pub(crate) fn new(
>  
>              fw.data()
>                  .get(desc_offset..)
> -                .and_then(BootloaderDesc::from_bytes_copy_prefix)
> +                .and_then(|b| BootloaderDesc::read_from_prefix(b).ok())
>                  .ok_or(EINVAL)?
>                  .0
>          };
> -- 
> 2.34.1
> 

Re: [PATCH v2 5/5] drm/nova: use `zerocopy` in riscv.rs

[Alistair Popple]

On 2026-07-02 at 22:03 +1000, Pedro Yudi Honda <niyudi.honda@usp.br> wrote...
> From: Pedro Yudi Honda <niyudi.honda@usp.br>
> 
> In riscv.rs, replave the following `transmute` traits with their
> `zerocopy` equivalents:
> 
> - `transmute::FromBytes` -> `zerocopy::FromBytes`
> 
> Update call sites accordingly.

Thanks for the clean-ups.

Reviewed-by: Alistair Popple <apopple@nvidia.com>

> Signed-off-by: Pedro Yudi Honda <niyudi.honda@usp.br>
> ---
>  drivers/gpu/nova-core/firmware/riscv.rs | 10 +++-------
>  1 file changed, 3 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/nova-core/firmware/riscv.rs b/drivers/gpu/nova-core/firmware/riscv.rs
> index 2afa7f36404e..ba56bc7d4188 100644
> --- a/drivers/gpu/nova-core/firmware/riscv.rs
> +++ b/drivers/gpu/nova-core/firmware/riscv.rs
> @@ -7,8 +7,7 @@
>      device,
>      dma::Coherent,
>      firmware::Firmware,
> -    prelude::*,
> -    transmute::FromBytes, //
> +    prelude::*, //
>  };
>  
>  use crate::{
> @@ -18,7 +17,7 @@
>  
>  /// Descriptor for microcode running on a RISC-V core.
>  #[repr(C)]
> -#[derive(Debug)]
> +#[derive(Debug, FromBytes)]
>  struct RmRiscvUCodeDesc {
>      version: u32,
>      bootloader_offset: u32,
> @@ -36,9 +35,6 @@ struct RmRiscvUCodeDesc {
>      monitor_code_size: u32,
>  }
>  
> -// SAFETY: all bit patterns are valid for this type, and it doesn't use interior mutability.
> -unsafe impl FromBytes for RmRiscvUCodeDesc {}
> -
>  impl RmRiscvUCodeDesc {
>      /// Interprets the header of `bin_fw` as a [`RmRiscvUCodeDesc`] and returns it.
>      ///
> @@ -50,7 +46,7 @@ fn new(bin_fw: &BinFirmware<'_>) -> Result<Self> {
>          bin_fw
>              .fw
>              .get(offset..end)
> -            .and_then(Self::from_bytes_copy)
> +            .and_then(|b| Self::read_from_bytes(b).ok())
>              .ok_or(EINVAL)
>      }
>  }
> -- 
> 2.34.1
>