[PATCH v3 0/2] drm/tyr: safely write GpuInfo to userspace

[PATCH v3 0/2] drm/tyr: safely write GpuInfo to userspace

[Deborah Brouwer]

This series makes zerocopy and zerocopy_derive available to the UAPI crate
so that zerocopy derive attributes can be added to generated UAPI
bindings. It derives the zerocopy traits specifically for struct
drm_panthor_gpu_info, allowing Tyr to safely copy this struct byte-for-
byte into userspace memory.

Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
Changes in v3:
- split the commit into two to keep Tyr changes separate
- Link to v2: https://lore.kernel.org/r/20260924-b4-gpu_info_intobytes-v2-1-1b05e33df8a4@collabora.com

Changes in v2:
- use zerocopy_derive::most_traits
- Link to v1: https://lore.kernel.org/r/20260923-b4-gpu_info_intobytes-v1-1-bb2173f91e11@collabora.com

---
Deborah Brouwer (2):
      rust: uapi: add zerocopy/zerocopy_derive
      drm/tyr: safely write GpuInfo to userspace

 drivers/gpu/drm/tyr/file.rs |  2 +-
 drivers/gpu/drm/tyr/gpu.rs  | 12 ------------
 rust/Makefile               | 12 +++++++++---
 rust/bindgen_parameters     |  3 +++
 4 files changed, 13 insertions(+), 16 deletions(-)
---
base-commit: 896ed083362758b33c49a1b5e5a3423c5814d87e
change-id: 20260923-b4-gpu_info_intobytes-c2d45f2935c8

Best regards,
-- 
Deborah Brouwer <deborah.brouwer@collabora.com>

[PATCH v3 1/2] rust: uapi: add zerocopy/zerocopy_derive

[Deborah Brouwer]

Make the zerocopy and zerocopy_derive crates available for use when
building the UAPI crate and its tests. Then attempt to derive most of
the zerocopy traits for struct drm_panthor_gpu_info when generating its
binding. This will be used by the Tyr driver that needs the traits
IntoBytes and Immutable to safely copy the struct byte-for-byte to
userspace.

Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
 rust/Makefile           | 12 +++++++++---
 rust/bindgen_parameters |  3 +++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index da1a7409d984..bf02a1efd6f3 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -365,8 +365,11 @@ rusttestlib-bindings: private rustc_target_flags = --extern ffi --extern pin_ini
 rusttestlib-bindings: $(src)/bindings/lib.rs rusttestlib-ffi rusttestlib-pin_init FORCE
 	+$(call if_changed,rustc_test_library)
 
-rusttestlib-uapi: private rustc_target_flags = --extern ffi --extern pin_init
-rusttestlib-uapi: $(src)/uapi/lib.rs rusttestlib-ffi rusttestlib-pin_init FORCE
+rusttestlib-uapi: private rustc_target_flags = --extern ffi --extern pin_init \
+	--extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib \
+	--extern zerocopy_derive=$(objtree)/$(obj)/test/$(libzerocopy_derive_name)
+rusttestlib-uapi: $(src)/uapi/lib.rs rusttestlib-ffi rusttestlib-pin_init \
+	rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
 	+$(call if_changed,rustc_test_library)
 
 quiet_cmd_rustdoc_test = RUSTDOC T $<
@@ -782,11 +785,14 @@ $(obj)/bindings.o: $(src)/bindings/lib.rs \
     $(obj)/bindings/bindings_helpers_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
+	--extern zerocopy --extern zerocopy_derive
 $(obj)/uapi.o: private skip_gendwarfksyms = 1
 $(obj)/uapi.o: $(src)/uapi/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/zerocopy.o \
+    $(obj)/$(libzerocopy_derive_name) \
     $(obj)/uapi/uapi_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 8402b0c93545..332bc8d6a9f7 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -71,3 +71,6 @@
 # Structs should implement `Zeroable` when all of their fields do.
 --with-derive-custom-struct .*=MaybeZeroable
 --with-derive-custom-union .*=MaybeZeroable
+
+# `drm_panthor_gpu_info` is copied byte-for-byte to userspace.
+--with-derive-custom-struct '^drm_panthor_gpu_info$'=zerocopy_derive::most_traits

-- 
2.55.0

Re: [PATCH v3 1/2] rust: uapi: add zerocopy/zerocopy_derive

[Gary Guo]

On Sat Sep 26, 2026 at 1:26 AM BST, Deborah Brouwer wrote:
> Make the zerocopy and zerocopy_derive crates available for use when
> building the UAPI crate and its tests. Then attempt to derive most of
> the zerocopy traits for struct drm_panthor_gpu_info when generating its
> binding. This will be used by the Tyr driver that needs the traits
> IntoBytes and Immutable to safely copy the struct byte-for-byte to
> userspace.
>
> Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
> ---
>  rust/Makefile           | 12 +++++++++---
>  rust/bindgen_parameters |  3 +++
>  2 files changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/rust/Makefile b/rust/Makefile
> index da1a7409d984..bf02a1efd6f3 100644
> --- a/rust/Makefile
> +++ b/rust/Makefile
> @@ -365,8 +365,11 @@ rusttestlib-bindings: private rustc_target_flags = --extern ffi --extern pin_ini
>  rusttestlib-bindings: $(src)/bindings/lib.rs rusttestlib-ffi rusttestlib-pin_init FORCE
>  	+$(call if_changed,rustc_test_library)
>  
> -rusttestlib-uapi: private rustc_target_flags = --extern ffi --extern pin_init
> -rusttestlib-uapi: $(src)/uapi/lib.rs rusttestlib-ffi rusttestlib-pin_init FORCE
> +rusttestlib-uapi: private rustc_target_flags = --extern ffi --extern pin_init \
> +	--extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib \
> +	--extern zerocopy_derive=$(objtree)/$(obj)/test/$(libzerocopy_derive_name)
> +rusttestlib-uapi: $(src)/uapi/lib.rs rusttestlib-ffi rusttestlib-pin_init \
> +	rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
>  	+$(call if_changed,rustc_test_library)
>  
>  quiet_cmd_rustdoc_test = RUSTDOC T $<
> @@ -782,11 +785,14 @@ $(obj)/bindings.o: $(src)/bindings/lib.rs \
>      $(obj)/bindings/bindings_helpers_generated.rs FORCE
>  	+$(call if_changed_rule,rustc_library)
>  
> -$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
> +$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
> +	--extern zerocopy --extern zerocopy_derive
>  $(obj)/uapi.o: private skip_gendwarfksyms = 1
>  $(obj)/uapi.o: $(src)/uapi/lib.rs \
>      $(obj)/ffi.o \
>      $(obj)/pin_init.o \
> +    $(obj)/zerocopy.o \
> +    $(obj)/$(libzerocopy_derive_name) \

Please add these to `bindings` crate as well to avoid have it diverging with
`uapi`.

>      $(obj)/uapi/uapi_generated.rs FORCE
>  	+$(call if_changed_rule,rustc_library)
>  
> diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> index 8402b0c93545..332bc8d6a9f7 100644
> --- a/rust/bindgen_parameters
> +++ b/rust/bindgen_parameters
> @@ -71,3 +71,6 @@
>  # Structs should implement `Zeroable` when all of their fields do.
>  --with-derive-custom-struct .*=MaybeZeroable
>  --with-derive-custom-union .*=MaybeZeroable
> +
> +# `drm_panthor_gpu_info` is copied byte-for-byte to userspace.
> +--with-derive-custom-struct '^drm_panthor_gpu_info$'=zerocopy_derive::most_traits

This is Tyr specific change and should be in patch 2.

Best,
Gary

Re: [PATCH v3 1/2] rust: uapi: add zerocopy/zerocopy_derive

[Danilo Krummrich]

On Sat Sep 26, 2026 at 5:50 PM CEST, Gary Guo wrote:
> On Sat Sep 26, 2026 at 1:26 AM BST, Deborah Brouwer wrote:
>> @@ -71,3 +71,6 @@
>>  # Structs should implement `Zeroable` when all of their fields do.
>>  --with-derive-custom-struct .*=MaybeZeroable
>>  --with-derive-custom-union .*=MaybeZeroable
>> +
>> +# `drm_panthor_gpu_info` is copied byte-for-byte to userspace.
>> +--with-derive-custom-struct '^drm_panthor_gpu_info$'=zerocopy_derive::most_traits
>
> This is Tyr specific change and should be in patch 2.

Why list all of them separately? Can't we apply this to all uAPI structs?

Re: [PATCH v3 1/2] rust: uapi: add zerocopy/zerocopy_derive

[Gary Guo]

On Sat Sep 26, 2026 at 5:26 PM BST, Danilo Krummrich wrote:
> On Sat Sep 26, 2026 at 5:50 PM CEST, Gary Guo wrote:
>> On Sat Sep 26, 2026 at 1:26 AM BST, Deborah Brouwer wrote:
>>> @@ -71,3 +71,6 @@
>>>  # Structs should implement `Zeroable` when all of their fields do.
>>>  --with-derive-custom-struct .*=MaybeZeroable
>>>  --with-derive-custom-union .*=MaybeZeroable
>>> +
>>> +# `drm_panthor_gpu_info` is copied byte-for-byte to userspace.
>>> +--with-derive-custom-struct '^drm_panthor_gpu_info$'=zerocopy_derive::most_traits
>>
>> This is Tyr specific change and should be in patch 2.
>
> Why list all of them separately? Can't we apply this to all uAPI structs?

There are types with paddings which cannot derive `IntoBytes`.

Best,
Gary

Re: [PATCH v3 1/2] rust: uapi: add zerocopy/zerocopy_derive

[Danilo Krummrich]

On Sat Sep 26, 2026 at 10:59 PM CEST, Gary Guo wrote:
> On Sat Sep 26, 2026 at 5:26 PM BST, Danilo Krummrich wrote:
>> On Sat Sep 26, 2026 at 5:50 PM CEST, Gary Guo wrote:
>>> On Sat Sep 26, 2026 at 1:26 AM BST, Deborah Brouwer wrote:
>>>> @@ -71,3 +71,6 @@
>>>>  # Structs should implement `Zeroable` when all of their fields do.
>>>>  --with-derive-custom-struct .*=MaybeZeroable
>>>>  --with-derive-custom-union .*=MaybeZeroable
>>>> +
>>>> +# `drm_panthor_gpu_info` is copied byte-for-byte to userspace.
>>>> +--with-derive-custom-struct '^drm_panthor_gpu_info$'=zerocopy_derive::most_traits
>>>
>>> This is Tyr specific change and should be in patch 2.
>>
>> Why list all of them separately? Can't we apply this to all uAPI structs?
>
> There are types with paddings which cannot derive `IntoBytes`.

We have some existing uAPI structs without explicit padding; new ones should use
explicit padding though.

But isn’t most_traits intended to handle this through best-effort derivation,
leaving IntoBytes unavailable for types with implicit padding?

[PATCH v3 2/2] drm/tyr: safely write GpuInfo to userspace

[Deborah Brouwer]

Tyr creates the struct drm_panthor_gpu_info from the Panthor UAPI
bindings. It initializes this struct by querying the gpu and then writes
the struct into userspace memory faithfully byte-by-byte.

Currently, the struct drm_panthor_gpu_info does not have any implicit
padding, but if implicit padding were added in the future Rust does not
guarantee that it would be initialized. Then when Tyr writes the struct
back to userspace it could expose uninitialized kernel memory.

Tyr implements the unsafe trait AsBytes for GpuInfo whereby the developer
guarantees that struct drm_panthor_gpu_info does not include implicit
padding, pointers, or interior mutability. This allows Tyr to safely copy
the struct into userspace memory. However, relying on the unsafe trait
AsBytes is fragile because if the Panthor UAPI changes, the SAFETY
guarantees may no longer be accurate.

Instead, use the derive macro `zerocopy_derive::most_traits` for struct
drm_panthor_gpu_info. This macro will attempt to implement the zerocopy
traits for struct drm_panthor_gpu_info. If the Panthor UAPI changes so
that the traits IntoBytes or Immutable can no longer be implemented, Tyr
will no longer compile.

Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
 drivers/gpu/drm/tyr/file.rs |  2 +-
 drivers/gpu/drm/tyr/gpu.rs  | 12 ------------
 2 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/tyr/file.rs b/drivers/gpu/drm/tyr/file.rs
index 9f60a90d4948..ceadde976502 100644
--- a/drivers/gpu/drm/tyr/file.rs
+++ b/drivers/gpu/drm/tyr/file.rs
@@ -54,7 +54,7 @@ pub(crate) fn dev_query(
                     )
                     .writer();
 
-                    writer.write(&reg_data.gpu_info)?;
+                    writer.write_slice(reg_data.gpu_info.as_bytes())?;
 
                     Ok(0)
                 }
diff --git a/drivers/gpu/drm/tyr/gpu.rs b/drivers/gpu/drm/tyr/gpu.rs
index e1b04a0c5159..fde5bd0f87a1 100644
--- a/drivers/gpu/drm/tyr/gpu.rs
+++ b/drivers/gpu/drm/tyr/gpu.rs
@@ -16,7 +16,6 @@
     },
     prelude::*,
     time::Delta,
-    transmute::AsBytes,
     uapi, //
 };
 
@@ -134,17 +133,6 @@ fn deref_mut(&mut self) -> &mut Self::Target {
     }
 }
 
-// SAFETY: `GpuInfo`'s invariant guarantees that it is the same type that is
-// already exposed to userspace by the C driver. This implies that it fulfills
-// the requirements for `AsBytes`.
-//
-// This means:
-//
-// - No implicit padding,
-// - No kernel pointers,
-// - No interior mutability.
-unsafe impl AsBytes for GpuInfo {}
-
 struct GpuModels {
     name: &'static str,
     arch_major: u32,

-- 
2.55.0

Re: [PATCH v3 2/2] drm/tyr: safely write GpuInfo to userspace

[Daniel Almeida]

Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>

Re: [PATCH v3 2/2] drm/tyr: safely write GpuInfo to userspace

[Danilo Krummrich]

On Sat Sep 26, 2026 at 2:26 AM CEST, Deborah Brouwer wrote:
> @@ -54,7 +54,7 @@ pub(crate) fn dev_query(
>                      )
>                      .writer();
>  
> -                    writer.write(&reg_data.gpu_info)?;
> +                    writer.write_slice(reg_data.gpu_info.as_bytes())?;

I think we eventually want write() to require T: IntoBytes + Immutable, so I'm
not sure there is much value going back and forth with this.