[PATCH v5 0/2] drm/tyr: safely write GpuInfo to userspace

[PATCH v5 0/2] drm/tyr: safely write GpuInfo to userspace

[Deborah Brouwer]

This series makes zerocopy and zerocopy_derive available to both the UAPI
and bindings crates.

It derives the zerocopy traits specifically for struct
drm_panthor_gpu_info, allowing Tyr to safely copy this struct byte-for-
byte into userspace memory.

Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
Changes in v5:
- broaden subject line of first patch
- make zerocopy and zerocopy_derive available to rust-analyzer
- use 4 spaces instead of tab in make file
- re-order imports so external crates are grouped together
- remove unnecessary invariant comment
- pick up Reviewed-by tag
- Link to v4: https://lore.kernel.org/r/20261019-b4-gpu_info_intobytes-v4-0-0bc04df46549@collabora.com

Changes in v4:
- add zerocopy and zerocopy_derive to bindings crate
- move derivation for drm_panthor_gpu_info to tyr patch
- use kernel prelude to import IntoBytes
- pick up Reviewed-by tag
- Link to v3: https://lore.kernel.org/r/20260925-b4-gpu_info_intobytes-v3-0-e19bcb71980d@collabora.com

Changes in v3:
- split the commit into two to keep Tyr changes separate
- Link to v2: https://lore.kernel.org/r/20260924-b4-gpu_info_intobytes-v2-1-1b05e33df8a4@collabora.com

Changes in v2:
- use zerocopy_derive::most_traits
- Link to v1: https://lore.kernel.org/r/20260923-b4-gpu_info_intobytes-v1-1-bb2173f91e11@collabora.com

---
Deborah Brouwer (2):
      rust: add zerocopy to bindings and uapi
      drm/tyr: safely write GpuInfo to userspace

 drivers/gpu/drm/tyr/file.rs       |  2 +-
 drivers/gpu/drm/tyr/gpu.rs        | 19 ++-----------------
 rust/Makefile                     | 24 ++++++++++++++++++------
 rust/bindgen_parameters           |  3 +++
 scripts/generate_rust_analyzer.py |  4 ++--
 5 files changed, 26 insertions(+), 26 deletions(-)
---
base-commit: 3497a403264b094ebd61b8b755165d56e7d9dc37
change-id: 20260923-b4-gpu_info_intobytes-c2d45f2935c8

Best regards,
-- 
Deborah Brouwer <deborah.brouwer@collabora.com>

[PATCH v5 1/2] rust: add zerocopy to bindings and uapi

[Deborah Brouwer]

Make the zerocopy and zerocopy_derive crates available to use when
building the bindings and uapi crates and their tests. Also make the
zerocopy and zerocopy_derive crates available to rust-analyzer when it
runs on the bindings and uapi crates.

This will be used by the Tyr driver that needs the traits IntoBytes and
Immutable to safely copy the struct byte-for-byte to userspace.

Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
 rust/Makefile                     | 24 ++++++++++++++++++------
 scripts/generate_rust_analyzer.py |  4 ++--
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index da1a7409d984..a182c0e96974 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -361,12 +361,18 @@ rusttestlib-kernel: $(src)/kernel/lib.rs rusttestlib-bindings rusttestlib-uapi \
     $(obj)/bindings.o rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
 	+$(call if_changed,rustc_test_library)
 
-rusttestlib-bindings: private rustc_target_flags = --extern ffi --extern pin_init
-rusttestlib-bindings: $(src)/bindings/lib.rs rusttestlib-ffi rusttestlib-pin_init FORCE
+rusttestlib-bindings: private rustc_target_flags = --extern ffi --extern pin_init \
+    --extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib \
+    --extern zerocopy_derive=$(objtree)/$(obj)/test/$(libzerocopy_derive_name)
+rusttestlib-bindings: $(src)/bindings/lib.rs rusttestlib-ffi rusttestlib-pin_init \
+    rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
 	+$(call if_changed,rustc_test_library)
 
-rusttestlib-uapi: private rustc_target_flags = --extern ffi --extern pin_init
-rusttestlib-uapi: $(src)/uapi/lib.rs rusttestlib-ffi rusttestlib-pin_init FORCE
+rusttestlib-uapi: private rustc_target_flags = --extern ffi --extern pin_init \
+    --extern zerocopy=$(objtree)/$(obj)/test/libzerocopy.rlib \
+    --extern zerocopy_derive=$(objtree)/$(obj)/test/$(libzerocopy_derive_name)
+rusttestlib-uapi: $(src)/uapi/lib.rs rusttestlib-ffi rusttestlib-pin_init \
+    rusttestlib-zerocopy rusttestlib-zerocopy_derive FORCE
 	+$(call if_changed,rustc_test_library)
 
 quiet_cmd_rustdoc_test = RUSTDOC T $<
@@ -774,19 +780,25 @@ $(obj)/ffi.o: private skip_gendwarfksyms = 1
 $(obj)/ffi.o: $(src)/ffi.rs $(obj)/compiler_builtins.o FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init \
+    --extern zerocopy --extern zerocopy_derive
 $(obj)/bindings.o: $(src)/bindings/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/zerocopy.o \
+    $(obj)/$(libzerocopy_derive_name) \
     $(obj)/bindings/bindings_generated.rs \
     $(obj)/bindings/bindings_helpers_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
+    --extern zerocopy --extern zerocopy_derive
 $(obj)/uapi.o: private skip_gendwarfksyms = 1
 $(obj)/uapi.o: $(src)/uapi/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/zerocopy.o \
+    $(obj)/$(libzerocopy_derive_name) \
     $(obj)/uapi/uapi_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
index dc1219736f77..6255a81591eb 100755
--- a/scripts/generate_rust_analyzer.py
+++ b/scripts/generate_rust_analyzer.py
@@ -313,8 +313,8 @@ def generate_crates(
         }
         return register_crate(crate_with_generated)
 
-    bindings = append_crate_with_generated("bindings", [core, ffi, pin_init])
-    uapi = append_crate_with_generated("uapi", [core, ffi, pin_init])
+    bindings = append_crate_with_generated("bindings", [core, ffi, pin_init, zerocopy, zerocopy_derive])
+    uapi = append_crate_with_generated("uapi", [core, ffi, pin_init, zerocopy, zerocopy_derive])
     kernel = append_crate_with_generated(
         "kernel", [core, macros, build_error, pin_init, ffi, bindings, uapi, zerocopy, zerocopy_derive]
     )

-- 
2.56.0

[PATCH v5 2/2] drm/tyr: safely write GpuInfo to userspace

[Deborah Brouwer]

Tyr creates the struct drm_panthor_gpu_info from the Panthor UAPI
bindings. It initializes this struct by querying the gpu and then writes
the struct into userspace memory faithfully byte-by-byte.

Currently, the struct drm_panthor_gpu_info does not have any implicit
padding, but if implicit padding were added in the future Rust does not
guarantee that it would be initialized. Then when Tyr writes the struct
back to userspace it could expose uninitialized kernel memory.

Tyr implements the unsafe trait AsBytes for GpuInfo whereby the developer
guarantees that struct drm_panthor_gpu_info does not include implicit
padding, pointers, or interior mutability. This allows Tyr to safely copy
the struct into userspace memory. However, relying on the unsafe trait
AsBytes is fragile because if the Panthor UAPI changes, the SAFETY
guarantees may no longer be accurate.

Instead, use the derive macro `zerocopy_derive::most_traits` for struct
drm_panthor_gpu_info. This macro will attempt to implement the zerocopy
traits for struct drm_panthor_gpu_info. If the Panthor UAPI changes so
that the traits IntoBytes or Immutable can no longer be implemented, Tyr
will no longer compile.

Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
 drivers/gpu/drm/tyr/file.rs |  2 +-
 drivers/gpu/drm/tyr/gpu.rs  | 19 ++-----------------
 rust/bindgen_parameters     |  3 +++
 3 files changed, 6 insertions(+), 18 deletions(-)

diff --git a/drivers/gpu/drm/tyr/file.rs b/drivers/gpu/drm/tyr/file.rs
index 9f60a90d4948..ceadde976502 100644
--- a/drivers/gpu/drm/tyr/file.rs
+++ b/drivers/gpu/drm/tyr/file.rs
@@ -54,7 +54,7 @@ pub(crate) fn dev_query(
                     )
                     .writer();
 
-                    writer.write(&reg_data.gpu_info)?;
+                    writer.write_slice(reg_data.gpu_info.as_bytes())?;
 
                     Ok(0)
                 }
diff --git a/drivers/gpu/drm/tyr/gpu.rs b/drivers/gpu/drm/tyr/gpu.rs
index e1b04a0c5159..820de9d60c19 100644
--- a/drivers/gpu/drm/tyr/gpu.rs
+++ b/drivers/gpu/drm/tyr/gpu.rs
@@ -16,9 +16,9 @@
     },
     prelude::*,
     time::Delta,
-    transmute::AsBytes,
     uapi, //
 };
+use zerocopy_derive::Immutable;
 
 use crate::{
     driver::IoMem,
@@ -30,12 +30,8 @@
 
 /// Struct containing information that can be queried by userspace. This is read from
 /// the GPU's registers.
-///
-/// # Invariants
-///
-/// - The layout of this struct is identical to the C `struct drm_panthor_gpu_info`.
 #[repr(transparent)]
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, IntoBytes, Immutable)]
 pub(crate) struct GpuInfo(pub(crate) uapi::drm_panthor_gpu_info);
 
 impl GpuInfo {
@@ -134,17 +130,6 @@ fn deref_mut(&mut self) -> &mut Self::Target {
     }
 }
 
-// SAFETY: `GpuInfo`'s invariant guarantees that it is the same type that is
-// already exposed to userspace by the C driver. This implies that it fulfills
-// the requirements for `AsBytes`.
-//
-// This means:
-//
-// - No implicit padding,
-// - No kernel pointers,
-// - No interior mutability.
-unsafe impl AsBytes for GpuInfo {}
-
 struct GpuModels {
     name: &'static str,
     arch_major: u32,
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 8402b0c93545..332bc8d6a9f7 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -71,3 +71,6 @@
 # Structs should implement `Zeroable` when all of their fields do.
 --with-derive-custom-struct .*=MaybeZeroable
 --with-derive-custom-union .*=MaybeZeroable
+
+# `drm_panthor_gpu_info` is copied byte-for-byte to userspace.
+--with-derive-custom-struct '^drm_panthor_gpu_info$'=zerocopy_derive::most_traits

-- 
2.56.0

Re: [PATCH v5 1/2] rust: add zerocopy to bindings and uapi

[Alice Ryhl]

On Tue, Oct 20, 2026 at 04:47:48PM -0700, Deborah Brouwer wrote:
> Make the zerocopy and zerocopy_derive crates available to use when
> building the bindings and uapi crates and their tests. Also make the
> zerocopy and zerocopy_derive crates available to rust-analyzer when it
> runs on the bindings and uapi crates.
> 
> This will be used by the Tyr driver that needs the traits IntoBytes and
> Immutable to safely copy the struct byte-for-byte to userspace.
> 
> Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>

Reviewed-by: Alice Ryhl <aliceryhl@google.com>

Miguel, is this something we can take through drm-rust-next? Or perhaps
you want to take both through rust-next? Let me know what you prefer.

Alice

Re: [PATCH v5 1/2] rust: add zerocopy to bindings and uapi

[Miguel Ojeda]

On Wed, Oct 21, 2026 at 7:54 AM Alice Ryhl <aliceryhl@google.com> wrote:
>
> Miguel, is this something we can take through drm-rust-next? Or perhaps
> you want to take both through rust-next? Let me know what you prefer.

Both sounds reasonable, so whatever it is easier -- do you think there
will be lots of movement in the Tyr side?

Cheers,
Miguel

Re: [PATCH v5 1/2] rust: add zerocopy to bindings and uapi

[Alice Ryhl]

On Wed, Oct 21, 2026 at 1:37 PM Miguel Ojeda
<miguel.ojeda.sandonis@gmail.com> wrote:
>
> On Wed, Oct 21, 2026 at 7:54 AM Alice Ryhl <aliceryhl@google.com> wrote:
> >
> > Miguel, is this something we can take through drm-rust-next? Or perhaps
> > you want to take both through rust-next? Let me know what you prefer.
>
> Both sounds reasonable, so whatever it is easier -- do you think there
> will be lots of movement in the Tyr side?

If we're able to land JobQueue soon, then yes, otherwise no. But I
think we've aligned on how to get it merged at LPC, so probably yes.

Alice