greybus-dev

greybus-dev@lists.linaro.org

17 participants
928 discussions

Re: [PATCH] staging: greybus: uart: replace IDR with XArray

by Greg KH

On Wed, Nov 11, 2026 at 08:23:30PM +0200, Aviv Levinson wrote: > Migrate the minor number allocation from the legacy IDR API to the > modern XArray API to take advantage of its built-in thread safety. But why? > As part of this migration, the global `table_lock` mutex has been > removed. Mutating operations now rely on XArray's internal spinlocks, > and the lookup logic in get_gb_by_minor() has been updated to use > rcu_read_lock() combined with kref_get_unless_zero() to safely > pin the device reference without blocking. How was this found and generated and tested? And kref_get_unless_zero() is almost always a call you never want to make. > Signed-off-by: Aviv Levinson <levinson.aviv(a)gmail.com> > --- > drivers/staging/greybus/uart.c | 37 ++++++++++++++++++---------------- > 1 file changed, 20 insertions(+), 17 deletions(-) So now there is more code? That feels like a step backwards, don't you think? thanks, greg k-h

1 hour, 35 minutes

[PATCH] staging: greybus: light: Use sysfs_emit() instead of sprintf()

by Platon Miller

Use sysfs_emit() instead of sprintf() in sysfs show attributes (fade_##__dir##_show and color_show). sysfs_emit() is specifically designed for sysfs attributes, is PAGE_SIZE-aware, and avoids potential buffer overflows. Signed-off-by: Platon Miller <platon.ksenzenkokk(a)gmail.com> --- drivers/staging/greybus/light.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da..2689f9a75 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -173,7 +173,7 @@ static ssize_t fade_##__dir##_show(struct device *dev, \ struct led_classdev *cdev = dev_get_drvdata(dev); \ struct gb_channel *channel = get_channel_from_cdev(cdev); \ \ - return sprintf(buf, "%u\n", channel->fade_##__dir); \ + return sysfs_emit(buf, "%u\n", channel->fade_##__dir); \ } \ \ static ssize_t fade_##__dir##_store(struct device *dev, \ @@ -220,7 +220,7 @@ static ssize_t color_show(struct device *dev, struct device_attribute *attr, struct led_classdev *cdev = dev_get_drvdata(dev); struct gb_channel *channel = get_channel_from_cdev(cdev); - return sprintf(buf, "0x%08x\n", channel->color); + return sysfs_emit(buf, "0x%08x\n", channel->color); } static ssize_t color_store(struct device *dev, struct device_attribute *attr, -- 2.56.0

2 days, 15 hours

[PATCH] greybus: reject messages with claimed size smaller than header

by Zhao Feng

gb_connection_recv() performs two sanity checks on received messages: the receive buffer must hold at least a full message header, and it must hold at least the message size claimed in the header. Neither check verifies that the claimed message size covers the header itself. A message claiming a size smaller than sizeof(struct gb_operation_msg_hdr) (e.g. 7) passes both checks when 8 or more bytes were received, and the claimed size is then used as the message size: - gb_operation_create_incoming() computes request_size = msg_size - sizeof(header), which underflows to SIZE_MAX. The request handler then reads payload from a message whose payload size is SIZE_MAX; syzbot reported this as a KASAN global-buffer-overflow read in gb_svc_request_handler(). - gb_connection_recv_response() similarly computes payload_size = size - sizeof(*header) for accepted short responses, which underflows the same way. Reject such messages up front in gb_connection_recv(). A claimed size equal to the header size is valid (header only, no payload), so the comparison must be strict. Reported-by: syzbot+693652ded53d3eb9cb91(a)syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=693652ded53d3eb9cb91 Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Feng <zhaofeng2(a)cmss.chinamobile.com> --- No Fixes tag: the missing validation dates back to the original greybus import; the introducing commit could not be verified with the trees available to me. Not runtime-tested (no greybus hardware). The affected function is identical in current upstream master, so the patch applies there as-is. This also answers the question raised on the syzbot thread about whether the underflow is reachable: it is, because the existing checks compare the *received* size against the claimed size, never the claimed size against the header size. drivers/greybus/operation.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c index 8459e9bc07..83b16c78f7 100644 --- a/drivers/greybus/operation.c +++ b/drivers/greybus/operation.c @@ -1046,6 +1046,12 @@ void gb_connection_recv(struct gb_connection *connection, /* Use memcpy as data may be unaligned */ memcpy(&header, data, sizeof(header)); msg_size = le16_to_cpu(header.size); + if (msg_size < sizeof(header)) { + dev_err_ratelimited(dev, + "%s: malformed message received (%zu < %zu)\n", + connection->name, msg_size, sizeof(header)); + return; + } if (size < msg_size) { dev_err_ratelimited(dev, "%s: incomplete message 0x%04x of type 0x%02x received (%zu < %zu)\n", -- 2.39.2

2 days, 23 hours

[syzbot] [greybus?] [usb?] KASAN: slab-out-of-bounds Read in gb_svc_request_handler

by syzbot

Hello, syzbot found the following issue on: HEAD commit: 6628e7d4c6b2 Linux 7.4-rc1 git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing console output: https://syzkaller.appspot.com/x/log.txt?x=1308eadd580000 kernel config: https://syzkaller.appspot.com/x/.config?x=f9bf69220d319004 dashboard link: https://syzkaller.appspot.com/bug?extid=693652ded53d3eb9cb91 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17bebe69580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12c1344e580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/d415be35d54e/disk-6628e7d4.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/69e49385122b/vmlinux-6628e7d4.… kernel image: https://storage.googleapis.com/syzbot-assets/51be81fff25f/bzImage-6628e7d4.… AI-generated root cause summary: In drivers/greybus/operation.c, gb_connection_recv() verifies that the received buffer length is at least sizeof(header) and that size >= msg_size, but fails to check whether msg_size (from header.size) is at least sizeof(header). When an incoming message has header.size < sizeof(struct gb_operation_msg_hdr), gb_operation_create_incoming() computes request_size = size - sizeof(struct gb_operation_msg_hdr), causing an unsigned size_t underflow to SIZE_MAX. While gb_operation_message_alloc() wraps the allocation size back to the short msg_size (allocating e.g. 7 bytes), gb_operation_message_init() sets payload_size to SIZE_MAX and sets payload to header + 1 (offset 8, past the end of the buffer). Consequently, request handlers like gb_svc_version_request() pass the payload_size validation and perform out-of-bounds heap reads on op->request->payload. full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=693652ded53d3eb9cb91 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+693652ded53d3eb9cb91(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: slab-out-of-bounds in gb_svc_version_request drivers/greybus/svc.c:658 [inline] BUG: KASAN: slab-out-of-bounds in gb_svc_request_handler+0x10de/0x1250 drivers/greybus/svc.c:1271 Read of size 1 at addr ffff888104ad2108 by task kworker/u8:0/12 CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: greybus1:0 gb_operation_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 gb_svc_version_request drivers/greybus/svc.c:658 [inline] gb_svc_request_handler+0x10de/0x1250 drivers/greybus/svc.c:1271 gb_operation_request_handle drivers/greybus/operation.c:243 [inline] gb_operation_work+0xb7/0x990 drivers/greybus/operation.c:280 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495 process_scheduled_works kernel/workqueue.c:3578 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 0: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5531 [inline] __kmalloc_noprof+0x315/0x7e0 mm/slub.c:5556 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] gb_operation_message_alloc+0x9b/0x2c0 drivers/greybus/operation.c:380 gb_operation_create_common+0x9f/0x710 drivers/greybus/operation.c:532 gb_operation_create_incoming drivers/greybus/operation.c:644 [inline] gb_connection_recv_request drivers/greybus/operation.c:926 [inline] gb_connection_recv+0x1dc/0x1050 drivers/greybus/operation.c:1063 greybus_data_rcvd+0x244/0x600 drivers/greybus/connection.c:89 cport_in_callback+0x1fb/0x280 drivers/greybus/es2.c:840 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xdb5/0x3840 drivers/usb/gadget/udc/dummy_hcd.c:2051 __run_hrtimer kernel/time/hrtimer.c:2079 [inline] __hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2136 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2153 handle_softirqs+0x209/0xa00 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0x17a/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 The buggy address belongs to the object at ffff888104ad2100 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes to the right of allocated 7-byte region [ffff888104ad2100, ffff888104ad2107) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888104ad2600 pfn:0x104ad2 flags: 0x200000000000200(workingset|node=0|zone=2) page_type: f5(slab) raw: 0200000000000200 ffff888100041500 ffffea00040eb410 ffffea000403ef50 raw: ffff888104ad2600 000000000080007a 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5446373684 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1856 prep_new_page mm/page_alloc.c:1864 [inline] get_page_from_freelist+0xf4b/0x3440 mm/page_alloc.c:3935 __alloc_frozen_pages_noprof+0x299/0x2d50 mm/page_alloc.c:5444 alloc_slab_page mm/slub.c:3384 [inline] allocate_slab mm/slub.c:3499 [inline] new_slab+0xb1/0x6d0 mm/slub.c:3550 refill_objects+0xe3/0x410 mm/slub.c:7539 refill_sheaf mm/slub.c:2917 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4811 alloc_from_pcs mm/slub.c:4887 [inline] slab_alloc_node mm/slub.c:5021 [inline] __do_kmalloc_node mm/slub.c:5530 [inline] __kmalloc_noprof+0x617/0x7e0 mm/slub.c:5556 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] acpi_ns_internalize_name+0x161/0x2e0 drivers/acpi/acpica/nsutils.c:331 acpi_ns_get_node_unlocked+0x18c/0x500 drivers/acpi/acpica/nsutils.c:666 acpi_ns_get_node+0x6c/0xf0 drivers/acpi/acpica/nsutils.c:726 acpi_ns_evaluate+0xb01/0x1670 drivers/acpi/acpica/nseval.c:62 acpi_ut_evaluate_object+0xf7/0x610 drivers/acpi/acpica/uteval.c:60 acpi_ut_execute_power_methods+0x1f9/0x3c0 drivers/acpi/acpica/uteval.c:288 acpi_get_object_info+0xa43/0xbe0 drivers/acpi/acpica/nsxfname.c:366 acpi_set_pnp_ids drivers/acpi/scan.c:1405 [inline] acpi_init_device_object+0xc12/0x1a90 drivers/acpi/scan.c:1827 acpi_add_single_object+0xe8/0x1a10 drivers/acpi/scan.c:1877 page last free pid 1 tgid 1 ts 5222696283 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1403 [inline] __free_frozen_pages+0x714/0xfc0 mm/page_alloc.c:2954 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_remove_cache+0x168/0x190 mm/kasan/quarantine.c:388 kmem_cache_shrink+0xd/0x20 mm/slab_common.c:620 acpi_os_purge_cache+0x15/0x20 drivers/acpi/osl.c:1622 acpi_purge_cached_objects+0xa3/0x140 drivers/acpi/acpica/utxface.c:239 acpi_initialize_objects+0x8b/0x100 drivers/acpi/acpica/utxfinit.c:250 acpi_bus_init drivers/acpi/bus.c:1381 [inline] acpi_init+0x1b0/0x840 drivers/acpi/bus.c:1471 do_one_initcall+0x11c/0x6f0 init/main.c:1419 do_initcall_level init/main.c:1481 [inline] do_initcalls init/main.c:1497 [inline] do_basic_setup init/main.c:1517 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1732 kernel_init+0x21/0x1e0 init/main.c:1622 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff888104ad2000: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888104ad2080: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc >ffff888104ad2100: 07 fc fc fc fa fc fc fc 06 fc fc fc 06 fc fc fc ^ ffff888104ad2180: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc ffff888104ad2200: 06 fc fc fc 06 fc fc fc fa fc fc fc fa fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

2 days, 23 hours

[PATCH] staging: greybus: add missing newline in sysfs_emit

by Priyanshu Singh

Add newline '\n' to sysfs_emit() format strings to resolve checkpatch.pl warnings. Signed-off-by: Priyanshu Singh <singhpriyanshu9838(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..5737f2a32f5a 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.53.0

3 days, 8 hours

[PATCH] greybus: operation: fix OOB Read in gb_svc_request_handler

by Chandradhar Kumar

gb_connection_recv() verifies that the received buffer length is at least sizeof(header) and size >= msg_size but it does not check the msg_size (from header.size) which can be less than sizeof(header), that can cause an out-of-bound Read in gb_svc_request_handler(). Check msg_size < sizeof(header) before proceeding with header type. Fixes: 564c72b1c6f7 ("greybus: operation: fix unaligned memory accesses in receive path") Reported-by: syzbot+693652ded53d3eb9cb91(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=693652ded53d3eb9cb91 Signed-off-by: Chandradhar Kumar <chandradhar.2003(a)gmail.com> --- drivers/greybus/operation.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c index 7e12ffb2dd60..9afe97731ad8 100644 --- a/drivers/greybus/operation.c +++ b/drivers/greybus/operation.c @@ -1056,6 +1056,12 @@ void gb_connection_recv(struct gb_connection *connection, return; /* XXX Should still complete operation */ } + if (msg_size < sizeof(header)) { + dev_err_ratelimited(dev, "%s: header size is too short\n", + connection->name); + return; + } + if (header.type & GB_MESSAGE_TYPE_RESPONSE) { gb_connection_recv_response(connection, &header, data, msg_size); -- 2.56.0

6 days, 4 hours

[syzbot] Monthly greybus report (Nov 2026)

by syzbot

Hello greybus maintainers/developers, This is a 31-day syzbot report for the greybus subsystem. All related reports/information can be found at: https://syzkaller.appspot.com/upstream/s/greybus During the period, 3 new issues were detected and 0 were fixed. In total, 4 issues are still open. Some of the still happening issues: Ref Crashes Repro Title <1> 233 Yes KASAN: slab-out-of-bounds Write in gb_operation_message_alloc https://syzkaller.appspot.com/bug?extid=2fd6aefc361af86911d5 <2> 119 Yes WARNING: ODEBUG bug in gb_operation_put https://syzkaller.appspot.com/bug?extid=61464b62b688791cc24c <3> 40 Yes WARNING: ODEBUG bug in gb_operation_sync_timeout https://syzkaller.appspot.com/bug?extid=a2e50fb40695811c2dab --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. To disable reminders for individual bugs, reply with the following command: #syz set <Ref> no-reminders To change bug's subsystems, reply with: #syz set <Ref> subsystems: new-subsystem You may send multiple commands in a single email message.

6 days, 17 hours

[PATCH] staging: greybus: Add newlines to sysfs output

by Daniel West

From 6376e59cb4d0fa2d57ff7f4fb2ce6cdb8bb1d03a Mon Sep 17 00:00:00 2001 From: Daniel West <daniel.west.dev(a)gmail.com> Date: Tue, 27 Oct 2026 15:53:19 -0400 Subject: [PATCH] staging: greybus: Add newlines to sysfs output Add terminating newlines to the sysfs_emit attributes in the Greybus audio manager per warnings from checkpatch. WARNING: return sysfs_emit(...) formats should include a terminating newline Signed-off-by: Daniel West <daniel.west.dev(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..5737f2a32f5a 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.51.0

1 week

[PATCH] staging: greybus: light: use sysfs_emit() instead of sprintf()

by Jacopo Di Lauro

Replace sprintf() with sysfs_emit() in sysfs attribute show functions. sysfs_emit() is preferred in sysfs show methods as it is aware of the PAGE_SIZE buffer limit and prevents potential buffer overflow. Signed-off-by: Jacopo Di Lauro <jacopo.dilauro04(a)gmail.com> --- drivers/staging/greybus/light.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da867..2689f9a7524a 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -173,7 +173,7 @@ static ssize_t fade_##__dir##_show(struct device *dev, \ struct led_classdev *cdev = dev_get_drvdata(dev); \ struct gb_channel *channel = get_channel_from_cdev(cdev); \ \ - return sprintf(buf, "%u\n", channel->fade_##__dir); \ + return sysfs_emit(buf, "%u\n", channel->fade_##__dir); \ } \ \ static ssize_t fade_##__dir##_store(struct device *dev, \ @@ -220,7 +220,7 @@ static ssize_t color_show(struct device *dev, struct device_attribute *attr, struct led_classdev *cdev = dev_get_drvdata(dev); struct gb_channel *channel = get_channel_from_cdev(cdev); - return sprintf(buf, "0x%08x\n", channel->color); + return sysfs_emit(buf, "0x%08x\n", channel->color); } static ssize_t color_store(struct device *dev, struct device_attribute *attr, -- 2.43.0

1 week

[PATCH v5 0/9] Add Greybus Sotfsvc and UART Node drivers

by Ayush Singh

A Greybus network needs an SVC (Supervisory Controller) to bring interfaces up, assign device IDs and connect CPorts to the AP. On a UniPro network the SVC is a real entity on the bus. On transports that merely carry Greybus messages - a UART, an I2C bus, a network link - nothing on the wire plays that role, so the SVC has to be emulated somewhere: in a user-space bridge (gbridge), in coprocessor firmware (cc1352p7 in gb-beagleplay), or open-coded inside the host driver itself. This series moves the emulation into the kernel and makes it shared. This was discussed in a prior RFC as well [2], but to keep things short, removing the need for an external SVC greatly simplifies the greybus network setup when nodes are directly connected over common transports such as UART, I2C etc. gb-uart-node gb-softsvc greybus core (transport, serdev) <-> (SVC + host device) <-> (bundles, protocols) NodeOps module_insert() submit_message() module_remove() gb-softsvc registers itself as a Greybus host device and answers the SVC-side operations the core expects during interface bring-up and teardown. A host driver implements the NodeOps trait to push data towards its node, calls module_insert() to announce a new node, submit_message() to hand incoming Greybus messages back to the core, and module_remove() on disconnect. The first user is gb-uart-node, a driver for Greybus nodes attached over a plain serial port. Framing is HDLC, with a one-byte address (0x01 for Greybus) and control byte, followed by the 16-bit CPort ID and the Greybus message. No SVC firmware is required on the far end, so the node can be a bare microcontroller speaking Greybus - a BeagleConnect Freedom over its serial link, in this case. The testing is performed with greybus-zephyr [0] implementation. Both drivers are written in Rust, which is why the middle of the series is abstractions rather than drivers. Only the APIs these two drivers need are covered: protocols.rs abstracts the SVC-facing parts of greybus_protocols.h, and types such as Greybus Interface do not implement AlwaysRefCounted yet. The intent is to grow this as more Rust host drivers appear rather than to abstract the whole subsystem up front. Patches 1 and 2 are small C-side preparations to the Greybus core: exporting gb_connection_get()/gb_connection_put() and adding gb_connection_hd_find_by_intf(), a lookup by remote interface and CPort id for callers that only know the far end of a connection. Patch 3 adds a CRC-CCITT abstraction, needed for HDLC frame checks. Patch 4 adds the Greybus abstractions, patches 5 and 6 the two drivers, and patch 7 the device tree binding for BeagleConnect Freedom. Open questions *************** - gb-uart-node imports types from gb-softsvc, so the series carries the Rust-to-Rust cross-module calling setup from nova-core [1]: gb_softsvc_exports.c plus the Makefile plumbing that emits crate metadata and generates the export list. This is a workaround for the build system not supporting Rust cross-module dependencies natively, and it should go away once that lands. - Connection create/destroy and interface activate/resume in gb-softsvc currently just acknowledge the request. Callbacks into NodeOps can be added when a transport actually needs to act on them; I did not want to invent an interface without a user. - Zerocopy is currently not being used in grebeybus/protocols.rs. They cannot be derived yet since types generated by bindgen do not have them, and it seems explicitly forbindden to manually impl the traits. So using old traits from transmute. - The bindings are supposed to be created for actual device, but any MCU that supports Zephyr, can run the greybus-zephyr firmware with UART transport. So not sure if adding a beagle,beagleconnect-freedom compatible is the correct choice here. - The individual patches can be spun off into independent patch series if required. The reason for this single patch series is to provide a complete picture of usage. - Since gb-softsvc currently is not being used from a C driver, no C API is provided. However, if required, it can be added. - Writing to UART from gb-uart-node is currently a bit broken. I am not quite sure what the safe way is to go from a non-bound device to a bound device. Any suggestions on this front are welcome. - I am not sure if Rust abstractions should have a seperate entry in MAINTAINERS with me as the maintainer, or if they should just be added to the respective subsystem entries. As mentioned by Miguel Ojeda [3], this is upto greybus maintainers. So waiting on their inputs. I am available to be maintainer for the Rust abstractions for greybus if required. [0]: https://github.com/beagleboard/greybus-zephyr [1]: https://lore.kernel.org/all/20260622-nova-exports-v5-0-6191773fc977@nvidia.… [2]: https://lore.kernel.org/all/ecca8eb2-8e5a-4770-bcf6-3fb49773088b@beagleboar… [3]: https://lore.kernel.org/all/CANiq72mA6pTmPJUk8g7y3Z=wetFMXdzHLiPEPChpY4OTg3… Signed-off-by: Ayush Singh <ayush(a)beagleboard.org> --- Changes in v5: - Remove AlwaysRefCounted impl from Interface. No longer required. - Fix invalid comments. - Fix interface drop in spinlock. - Impl AlwaysRefCounted for hd::Device only in normal context. - Match the bus device struct defination in device.rs docs. - Return GB_OP_PROTOCOL_BAD instead of ENOTSUP when encountering an unknown message. - Fix possible race condition in SVC module removed. Flagged by sashiko-bot. Involved, ensuring that operation_cancel cannot drop an in-flight message. - Fix timer leak in a greybus operation. - Check write_all return. - Return E2BIG when frame lenght is exceeded in uart node driver. - Link to v4: https://lore.kernel.org/r/20261021-gb-uart-transport-v4-0-c308ce821d45@beag… Changes in v4: - Remove gb_uard_node::GbUartNode::unbind. Suggested by Markus Probst, since write is still valid after unbind. - Add inline attribute where suggested. - Remove patch 1. No longer required with modifications to the old patch 2. - Increse hdlc max buffer size to 512 bytes. - Send module_removed request before removing from map. - Also do not hold lock across interface drop. - Link to v3: https://lore.kernel.org/r/20261013-gb-uart-transport-v3-0-81d0a8a1acf7@beag… Changes in v3: - Fix incorrect email in MAINTAINERS. - Make CONFIG_RUST_GREYBUS_ABSTRACTIONS depend on sysfs like CONFIG_GREYBUS. - Fix cleanup in hd::Registration::new in case of errors. - Fix comments. - Fix Msg AsBytes impl as suggested by sashiko-bot. - Use SpinLock for intf_map. This should be fine since we need locking only for getting the interface. We do not hold locks across operations. - Properly drop message in case of buffer overflow in gb_uart_node. - Link to v2: https://lore.kernel.org/r/20260827-gb-uart-transport-v2-0-a03bb1f5fbd1@beag… Changes in v2: - Fix possible null pointer dereference in gb_connection_hd_find_by_intf. Flagged by sashiko-bot. - Remove prompt CONFIG_RUST_CRC_CCITT_ABSTRACTIONS Kconfig symbol. - Add CONFIG_RUST_GREYBUS_ABSTRACTIONS to ensure that greybus is built-in for rust abstractions to work. - Use gfp_mask in message_send callback. - Only provide a Message reference in message_cancel callback. - Add invariant comment for Registration. - Call Registration->add directly in new, before constructing Registration. - Add Send and Sync bounds to T in Registration<T> - Set endo_id as 0. Is not used anywhere. - Fix module_insert intf_count. Was hardcoded to 1 by mistake. Flagged by sashiko-bot. - Check for empty intfs slice in Module::new. - Remove module in serdev::Driver::unbind instead of on drop. - Make gb_uart_node write atomic. Using temp buffer to build frame. - Fix import style. - Reorder beagleconnect-freedom dtbinding patch to be before gb_uart_node. - Add vbat-supply and reg properties to beagleconnect-freedom dtbinding. - Reference spi-peripheral-props in beagleconnect-freedom dtbinding. - Link to v1: https://lore.kernel.org/r/20260820-gb-uart-transport-v1-0-282da14ab7b7@beag… --- Ayush Singh (9): greybus: operation: keep request active across message_send greybus: svc: add gb_svc_flush() greybus: operation: arm request timeout before sending greybus: connection: Add greybus_data_rcvd_by_intf() rust: crc_ccitt: add CRC-CCITT abstraction rust: kernel: Add greybus abstractions drivers: greybus: Add software SVC implementation dt-bindings: beagle: Add BeagleConnect Freedom greybus: Add Rust UART node driver .../beagle/beagle,beagleconnect-freedom.yaml | 62 +++ MAINTAINERS | 15 + drivers/greybus/.gitignore | 1 + drivers/greybus/Kconfig | 35 ++ drivers/greybus/Makefile | 50 ++ drivers/greybus/connection.c | 47 ++ drivers/greybus/gb_softsvc.rs | 533 +++++++++++++++++++++ drivers/greybus/gb_softsvc_exports.c | 15 + drivers/greybus/gb_uart_node.rs | 270 +++++++++++ drivers/greybus/operation.c | 29 +- drivers/greybus/svc.c | 14 + include/linux/greybus/connection.h | 2 + include/linux/greybus/svc.h | 1 + lib/crc/Kconfig | 7 + rust/bindings/bindings_helper.h | 2 + rust/kernel/alloc.rs | 6 + rust/kernel/crc_ccitt.rs | 26 + rust/kernel/greybus/hd.rs | 391 +++++++++++++++ rust/kernel/greybus/mod.rs | 200 ++++++++ rust/kernel/greybus/protocols.rs | 445 +++++++++++++++++ rust/kernel/lib.rs | 4 + 21 files changed, 2152 insertions(+), 3 deletions(-) --- base-commit: becb95e45ef0dda9ffb35156d909d3da7a2789c3 change-id: 20260810-gb-uart-transport-9255d6557c4c Best regards, -- Ayush Singh <ayush(a)beagleboard.org>

1 week, 1 day

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev