A Greybus network needs an SVC (Supervisory Controller) to bring
interfaces up, assign device IDs and connect CPorts to the AP. On a
UniPro network the SVC is a real entity on the bus. On transports that
merely carry Greybus messages - a UART, an I2C bus, a network link -
nothing on the wire plays that role, so the SVC has to be emulated
somewhere: in a user-space bridge (gbridge), in coprocessor firmware
(cc1352p7 in gb-beagleplay), or open-coded inside the host driver itself.
This series moves the emulation into the kernel and makes it shared.
This was discussed in a prior RFC as well [2], but to keep things short,
removing the need for an external SVC greatly simplifies the greybus
network setup when nodes are directly connected over common transports
such as UART, I2C etc.
gb-uart-node gb-softsvc greybus core
(transport, serdev) <-> (SVC + host device) <-> (bundles, protocols)
NodeOps module_insert()
submit_message() module_remove()
gb-softsvc registers itself as a Greybus host device and answers the
SVC-side operations the core expects during interface bring-up and
teardown. A host driver implements the NodeOps trait to push data
towards its node, calls module_insert() to announce a new node,
submit_message() to hand incoming Greybus messages back to the core,
and module_remove() on disconnect.
The first user is gb-uart-node, a driver for Greybus nodes attached over
a plain serial port. Framing is HDLC, with a one-byte address (0x01 for
Greybus) and control byte, followed by the 16-bit CPort ID and the
Greybus message. No SVC firmware is required on the far end, so the node
can be a bare microcontroller speaking Greybus - a BeagleConnect Freedom
over its serial link, in this case. The testing is performed with
greybus-zephyr [0] implementation.
Both drivers are written in Rust, which is why the middle of the series
is abstractions rather than drivers. Only the APIs these two drivers
need are covered: protocols.rs abstracts the SVC-facing parts of
greybus_protocols.h, and types such as Greybus Interface do not
implement AlwaysRefCounted yet. The intent is to grow this as more Rust
host drivers appear rather than to abstract the whole subsystem up
front.
Patches 1 and 2 are small C-side preparations to the Greybus core:
exporting gb_connection_get()/gb_connection_put() and adding
gb_connection_hd_find_by_intf(), a lookup by remote interface and CPort
id for callers that only know the far end of a connection. Patch 3 adds
a CRC-CCITT abstraction, needed for HDLC frame checks. Patch 4 adds the
Greybus abstractions, patches 5 and 6 the two drivers, and patch 7 the
device tree binding for BeagleConnect Freedom.
Open questions
***************
- gb-uart-node imports types from gb-softsvc, so the series carries the
Rust-to-Rust cross-module calling setup from nova-core [1]:
gb_softsvc_exports.c plus the Makefile plumbing that emits crate
metadata and generates the export list. This is a workaround for the
build system not supporting Rust cross-module dependencies natively,
and it should go away once that lands.
- Connection create/destroy and interface activate/resume in gb-softsvc
currently just acknowledge the request. Callbacks into NodeOps can be
added when a transport actually needs to act on them; I did not want
to invent an interface without a user.
- Zerocopy is currently not being used in grebeybus/protocols.rs. They
cannot be derived yet since types generated by bindgen do not have
them, and it seems explicitly forbindden to manually impl the traits.
So using old traits from transmute.
- The bindings are supposed to be created for actual device, but any MCU
that supports Zephyr, can run the greybus-zephyr firmware with UART
transport. So not sure if adding a beagle,beagleconnect-freedom
compatible is the correct choice here.
- The individual patches can be spun off into independent patch series
if required. The reason for this single patch series is to provide a
complete picture of usage.
- Since gb-softsvc currently is not being used from a C driver, no C API
is provided. However, if required, it can be added.
- Writing to UART from gb-uart-node is currently a bit broken. I am not
quite sure what the safe way is to go from a non-bound device to a
bound device. Any suggestions on this front are welcome.
- I am not sure if Rust abstractions should have a seperate entry in
MAINTAINERS with me as the maintainer, or if they should just be added
to the respective subsystem entries.
[0]: https://github.com/beagleboard/greybus-zephyr
[1]: https://lore.kernel.org/all/20260622-nova-exports-v5-0-6191773fc977@nvidia.…
[2]: https://lore.kernel.org/all/ecca8eb2-8e5a-4770-bcf6-3fb49773088b@beagleboar…
Signed-off-by: Ayush Singh <ayush(a)beagleboard.org>
---
Changes in v3:
- Fix incorrect email in MAINTAINERS.
- Make CONFIG_RUST_GREYBUS_ABSTRACTIONS depend on sysfs like
CONFIG_GREYBUS.
- Fix cleanup in hd::Registration::new in case of errors.
- Fix comments.
- Fix Msg AsBytes impl as suggested by sashiko-bot.
- Use SpinLock for intf_map. This should be fine since we need locking
only for getting the interface. We do not hold locks across operations.
- Properly drop message in case of buffer overflow in gb_uart_node.
- Link to v2: https://lore.kernel.org/r/20260827-gb-uart-transport-v2-0-a03bb1f5fbd1@beag…
Changes in v2:
- Fix possible null pointer dereference in
gb_connection_hd_find_by_intf. Flagged by sashiko-bot.
- Remove prompt CONFIG_RUST_CRC_CCITT_ABSTRACTIONS Kconfig symbol.
- Add CONFIG_RUST_GREYBUS_ABSTRACTIONS to ensure that greybus is
built-in for rust abstractions to work.
- Use gfp_mask in message_send callback.
- Only provide a Message reference in message_cancel callback.
- Add invariant comment for Registration.
- Call Registration->add directly in new, before constructing
Registration.
- Add Send and Sync bounds to T in Registration<T>
- Set endo_id as 0. Is not used anywhere.
- Fix module_insert intf_count. Was hardcoded to 1 by mistake. Flagged by
sashiko-bot.
- Check for empty intfs slice in Module::new.
- Remove module in serdev::Driver::unbind instead of on drop.
- Make gb_uart_node write atomic. Using temp buffer to build frame.
- Fix import style.
- Reorder beagleconnect-freedom dtbinding patch to be before gb_uart_node.
- Add vbat-supply and reg properties to beagleconnect-freedom dtbinding.
- Reference spi-peripheral-props in beagleconnect-freedom dtbinding.
- Link to v1: https://lore.kernel.org/r/20260820-gb-uart-transport-v1-0-282da14ab7b7@beag…
---
Ayush Singh (7):
greybus: connection: Export gb_connection_get() and gb_connection_put()
greybus: connection: Add gb_connection_hd_find_by_intf()
rust: crc_ccitt: add CRC-CCITT abstraction
rust: kernel: Add greybus abstractions
drivers: greybus: Add software SVC implementation
dt-bindings: beagle: Add BeagleConnect Freedom
greybus: Add Rust UART node driver
.../beagle/beagle,beagleconnect-freedom.yaml | 39 ++
MAINTAINERS | 15 +
drivers/greybus/.gitignore | 1 +
drivers/greybus/Kconfig | 35 ++
drivers/greybus/Makefile | 50 ++
drivers/greybus/connection.c | 29 +-
drivers/greybus/gb_softsvc.rs | 517 +++++++++++++++++++++
drivers/greybus/gb_softsvc_exports.c | 15 +
drivers/greybus/gb_uart_node.rs | 253 ++++++++++
include/linux/greybus/connection.h | 6 +
lib/crc/Kconfig | 7 +
rust/bindings/bindings_helper.h | 2 +
rust/kernel/alloc.rs | 5 +
rust/kernel/crc_ccitt.rs | 26 ++
rust/kernel/greybus/hd.rs | 342 ++++++++++++++
rust/kernel/greybus/mod.rs | 232 +++++++++
rust/kernel/greybus/protocols.rs | 444 ++++++++++++++++++
rust/kernel/lib.rs | 4 +
18 files changed, 2020 insertions(+), 2 deletions(-)
---
base-commit: becb95e45ef0dda9ffb35156d909d3da7a2789c3
change-id: 20260810-gb-uart-transport-9255d6557c4c
Best regards,
--
Ayush Singh <ayush(a)beagleboard.org>
Similar to this effort:
Subject: [PATCH v1 00/23] PM: runtime: Convert pm_runtime_put() to a void function
https://lore.kernel.org/all/6245770.lOV4Wx5bFT@rafael.j.wysocki/
i.e., commit 3afd8df02433 ("PM: runtime: Change pm_runtime_put() return
type to void") and friends.
As with pm_runtime_put(), there is very little value in return-code
checking for any of the other async __pm_runtime_suspend() and
__pm_runtime_idle() APIs:
pm_runtime_put_autosuspend()
pm_request_idle()
pm_request_autosuspend()
Checking the return code is more likely to
produce a race condition (fighting with user space writing "on" to the
"control" attribute) than to tell a consumer useful info.
Nobody outside KUnit tests checks pm_request_idle() or
pm_request_autosuspend() return codes, but there are a number of
pm_runtime_put_autosuspend() callers that check its return code. Thus,
this series largely deals with pm_runtime_put_autosuspend().
Patches 1-11 are independent of each other, and similarly to the last
series, I expect the respective maintainers can pick them up. We can
apply patch 12 later. Patch 13 is also independent, but included in this
topic for completeness. It can be applied any time.
This touches a lot of trees/maintainers, so I tried to keep CC's only
for the relevant patch(es), plus the cover letter. I hope that's not too
noisy.
- Brian
Brian Norris (13):
hwrng: cctrng: Discard pm_runtime_put_autosuspend() return value
drm: Discard pm_runtime_put_autosuspend() return values
iio: Discard pm_runtime_put_autosuspend() return values
media: venus: Discard pm_runtime_put_autosuspend() return values
pinctrl: qcom: lpass-lpi: Discard pm_runtime_put_autosuspend() return
values
spi: ti-qspi: Discard pm_runtime_put_autosuspend() return value
greybus: Discard pm_runtime_put_autosuspend() return value
ALSA: hda: Discard pm_runtime_put_autosuspend() return value
ASoC: codecs: lpass: Discard pm_runtime_put_autosuspend() return
values
ASoC: intel: atom: Discard pm_runtime_put_autosuspend() return value
ASoC: SOF: Discard pm_runtime_put_autosuspend() return values
PM: runtime: Drop pm_runtime_put_autosuspend() return code
PM: runtime: Drop pm_request_{idle,autosuspend}() return codes
drivers/base/power/runtime-test.c | 8 ---
drivers/char/hw_random/cctrng.c | 6 +-
drivers/gpu/drm/panel/panel-simple.c | 8 +--
drivers/gpu/drm/tidss/tidss_drv.c | 7 +--
drivers/gpu/drm/v3d/v3d_drv.h | 4 +-
drivers/iio/accel/bmc150-accel-core.c | 14 ++---
drivers/iio/accel/fxls8962af-core.c | 11 +---
drivers/iio/accel/kxcjk-1013.c | 15 ++---
drivers/iio/accel/mma8452.c | 15 +++--
drivers/iio/accel/mma9551_core.c | 15 +++--
drivers/iio/adc/rcar-gyroadc.c | 4 +-
drivers/iio/adc/ti-ads1015.c | 8 +--
drivers/iio/chemical/atlas-sensor.c | 4 +-
.../common/hid-sensors/hid-sensor-trigger.c | 14 ++---
drivers/iio/gyro/bmg160_core.c | 17 +++--
drivers/iio/gyro/fxas21002c_core.c | 12 ++--
drivers/iio/imu/kmx61.c | 17 +++--
drivers/iio/light/apds9960.c | 2 +-
drivers/iio/light/isl29028.c | 15 +----
drivers/iio/light/pa12203001.c | 3 +-
drivers/iio/light/rpr0521.c | 15 +++--
drivers/iio/light/tsl2583.c | 27 ++------
drivers/iio/light/us5182d.c | 3 +-
drivers/media/platform/qcom/venus/vdec.c | 10 ++-
drivers/media/platform/qcom/venus/venc.c | 10 ++-
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 16 +++--
drivers/spi/spi-ti-qspi.c | 6 +-
drivers/staging/greybus/power_supply.c | 8 +--
include/linux/greybus/bundle.h | 12 +---
include/linux/pm_runtime.h | 63 +++----------------
include/sound/hdaudio.h | 8 +--
sound/hda/core/device.c | 13 ++--
sound/soc/codecs/lpass-rx-macro.c | 4 +-
sound/soc/codecs/lpass-tx-macro.c | 4 +-
sound/soc/codecs/lpass-va-macro.c | 17 ++---
sound/soc/codecs/lpass-wsa-macro.c | 8 +--
sound/soc/intel/atom/sst/sst.h | 2 +-
sound/soc/intel/atom/sst/sst_drv_interface.c | 4 +-
sound/soc/intel/atom/sst/sst_pvt.c | 9 +--
sound/soc/sof/control.c | 6 +-
sound/soc/sof/sof-client-ipc-flood-test.c | 5 +-
.../soc/sof/sof-client-ipc-kernel-injector.c | 4 +-
sound/soc/sof/sof-client-ipc-msg-injector.c | 6 +-
sound/soc/sof/sof-client-probes.c | 18 ++----
44 files changed, 152 insertions(+), 325 deletions(-)
--
2.56.0.360.g66cac248cb-goog
Automated semantic analysis via Coccinelle uncovered a use-after-free
vulnerability in gbcodec_hw_params() caused by accessing a list
iterator variable outside the loop boundary.
The routine walks through the codec module list using
'list_for_each_entry' to locate a matching data connection.
After the loop exits, the iterator pointer 'module' becomes
out-of-bounds. Attempting to pass this unmapped reference into
'to_gb_bundle()' down the line triggers a critical kernel panic.
Fix this flaw by introducing a dedicated copy 'allocated_module'.
Cache the matched pointer inside the loop block only when
'find_data()' returns a valid reference, and route the subsequent
power management execution steps safely through this verified object
tracking reference.
Assisted-by: Gemini
Signed-off-by: Marinela Tatiana Selseth <marinela.selseth(a)firmwaredesign.org>
---
drivers/staging/greybus/audio_codec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
index 6daa4e706792..a0645bf83097 100644
--- a/drivers/staging/greybus/audio_codec.c
+++ b/drivers/staging/greybus/audio_codec.c
@@ -396,6 +396,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
u8 sig_bits, channels;
u32 format, rate;
struct gbaudio_module_info *module;
+ struct gbaudio_module_info *allocated_module = NULL;
struct gbaudio_data_connection *data;
struct gb_bundle *bundle;
struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev);
@@ -439,8 +440,10 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
/* find the data connection */
list_for_each_entry(module, &codec->module_list, list) {
data = find_data(module, dai->id);
- if (data)
+ if (data) {
+ allocated_module = module;
break;
+ }
}
if (!data) {
@@ -456,7 +459,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
return -EINVAL;
}
- bundle = to_gb_bundle(module->dev);
+ bundle = to_gb_bundle(allocated_module->dev);
ret = gb_pm_runtime_get_sync(bundle);
if (ret) {
mutex_unlock(&codec->lock);
--
2.43.0