346 lines · plain
1============================================2Remote Processor Messaging (rpmsg) Framework3============================================4 5.. note::6 7 This document describes the rpmsg bus and how to write rpmsg drivers.8 To learn how to add rpmsg support for new platforms, check out remoteproc.txt9 (also a resident of Documentation/).10 11Introduction12============13 14Modern SoCs typically employ heterogeneous remote processor devices in15asymmetric multiprocessing (AMP) configurations, which may be running16different instances of operating system, whether it's Linux or any other17flavor of real-time OS.18 19OMAP4, for example, has dual Cortex-A9, dual Cortex-M3 and a C64x+ DSP.20Typically, the dual cortex-A9 is running Linux in a SMP configuration,21and each of the other three cores (two M3 cores and a DSP) is running22its own instance of RTOS in an AMP configuration.23 24Typically AMP remote processors employ dedicated DSP codecs and multimedia25hardware accelerators, and therefore are often used to offload CPU-intensive26multimedia tasks from the main application processor.27 28These remote processors could also be used to control latency-sensitive29sensors, drive random hardware blocks, or just perform background tasks30while the main CPU is idling.31 32Users of those remote processors can either be userland apps (e.g. multimedia33frameworks talking with remote OMX components) or kernel drivers (controlling34hardware accessible only by the remote processor, reserving kernel-controlled35resources on behalf of the remote processor, etc..).36 37Rpmsg is a virtio-based messaging bus that allows kernel drivers to communicate38with remote processors available on the system. In turn, drivers could then39expose appropriate user space interfaces, if needed.40 41When writing a driver that exposes rpmsg communication to userland, please42keep in mind that remote processors might have direct access to the43system's physical memory and other sensitive hardware resources (e.g. on44OMAP4, remote cores and hardware accelerators may have direct access to the45physical memory, gpio banks, dma controllers, i2c bus, gptimers, mailbox46devices, hwspinlocks, etc..). Moreover, those remote processors might be47running RTOS where every task can access the entire memory/devices exposed48to the processor. To minimize the risks of rogue (or buggy) userland code49exploiting remote bugs, and by that taking over the system, it is often50desired to limit userland to specific rpmsg channels (see definition below)51it can send messages on, and if possible, minimize how much control52it has over the content of the messages.53 54Every rpmsg device is a communication channel with a remote processor (thus55rpmsg devices are called channels). Channels are identified by a textual name56and have a local ("source") rpmsg address, and remote ("destination") rpmsg57address.58 59When a driver starts listening on a channel, its rx callback is bound with60a unique rpmsg local address (a 32-bit integer). This way when inbound messages61arrive, the rpmsg core dispatches them to the appropriate driver according62to their destination address (this is done by invoking the driver's rx handler63with the payload of the inbound message).64 65 66User API67========68 69::70 71 int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len);72 73sends a message across to the remote processor from the given endpoint.74The caller should specify the endpoint, the data it wants to send,75and its length (in bytes). The message will be sent on the specified76endpoint's channel, i.e. its source and destination address fields will be77respectively set to the endpoint's src address and its parent channel78dst addresses.79 80In case there are no TX buffers available, the function will block until81one becomes available (i.e. until the remote processor consumes82a tx buffer and puts it back on virtio's used descriptor ring),83or a timeout of 15 seconds elapses. When the latter happens,84-ERESTARTSYS is returned.85 86The function can only be called from a process context (for now).87Returns 0 on success and an appropriate error value on failure.88 89::90 91 int rpmsg_sendto(struct rpmsg_endpoint *ept, void *data, int len, u32 dst);92 93sends a message across to the remote processor from a given endpoint,94to a destination address provided by the caller.95 96The caller should specify the endpoint, the data it wants to send,97its length (in bytes), and an explicit destination address.98 99The message will then be sent to the remote processor to which the100endpoints's channel belongs, using the endpoints's src address,101and the user-provided dst address (thus the channel's dst address102will be ignored).103 104In case there are no TX buffers available, the function will block until105one becomes available (i.e. until the remote processor consumes106a tx buffer and puts it back on virtio's used descriptor ring),107or a timeout of 15 seconds elapses. When the latter happens,108-ERESTARTSYS is returned.109 110The function can only be called from a process context (for now).111Returns 0 on success and an appropriate error value on failure.112 113::114 115 int rpmsg_send_offchannel(struct rpmsg_endpoint *ept, u32 src, u32 dst,116 void *data, int len);117 118 119sends a message across to the remote processor, using the src and dst120addresses provided by the user.121 122The caller should specify the endpoint, the data it wants to send,123its length (in bytes), and explicit source and destination addresses.124The message will then be sent to the remote processor to which the125endpoint's channel belongs, but the endpoint's src and channel dst126addresses will be ignored (and the user-provided addresses will127be used instead).128 129In case there are no TX buffers available, the function will block until130one becomes available (i.e. until the remote processor consumes131a tx buffer and puts it back on virtio's used descriptor ring),132or a timeout of 15 seconds elapses. When the latter happens,133-ERESTARTSYS is returned.134 135The function can only be called from a process context (for now).136Returns 0 on success and an appropriate error value on failure.137 138::139 140 int rpmsg_trysend(struct rpmsg_endpoint *ept, void *data, int len);141 142sends a message across to the remote processor from a given endpoint.143The caller should specify the endpoint, the data it wants to send,144and its length (in bytes). The message will be sent on the specified145endpoint's channel, i.e. its source and destination address fields will be146respectively set to the endpoint's src address and its parent channel147dst addresses.148 149In case there are no TX buffers available, the function will immediately150return -ENOMEM without waiting until one becomes available.151 152The function can only be called from a process context (for now).153Returns 0 on success and an appropriate error value on failure.154 155::156 157 int rpmsg_trysendto(struct rpmsg_endpoint *ept, void *data, int len, u32 dst)158 159 160sends a message across to the remote processor from a given endpoint,161to a destination address provided by the user.162 163The user should specify the channel, the data it wants to send,164its length (in bytes), and an explicit destination address.165 166The message will then be sent to the remote processor to which the167channel belongs, using the channel's src address, and the user-provided168dst address (thus the channel's dst address will be ignored).169 170In case there are no TX buffers available, the function will immediately171return -ENOMEM without waiting until one becomes available.172 173The function can only be called from a process context (for now).174Returns 0 on success and an appropriate error value on failure.175 176::177 178 int rpmsg_trysend_offchannel(struct rpmsg_endpoint *ept, u32 src, u32 dst,179 void *data, int len);180 181 182sends a message across to the remote processor, using source and183destination addresses provided by the user.184 185The user should specify the channel, the data it wants to send,186its length (in bytes), and explicit source and destination addresses.187The message will then be sent to the remote processor to which the188channel belongs, but the channel's src and dst addresses will be189ignored (and the user-provided addresses will be used instead).190 191In case there are no TX buffers available, the function will immediately192return -ENOMEM without waiting until one becomes available.193 194The function can only be called from a process context (for now).195Returns 0 on success and an appropriate error value on failure.196 197::198 199 struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev,200 rpmsg_rx_cb_t cb, void *priv,201 struct rpmsg_channel_info chinfo);202 203every rpmsg address in the system is bound to an rx callback (so when204inbound messages arrive, they are dispatched by the rpmsg bus using the205appropriate callback handler) by means of an rpmsg_endpoint struct.206 207This function allows drivers to create such an endpoint, and by that,208bind a callback, and possibly some private data too, to an rpmsg address209(either one that is known in advance, or one that will be dynamically210assigned for them).211 212Simple rpmsg drivers need not call rpmsg_create_ept, because an endpoint213is already created for them when they are probed by the rpmsg bus214(using the rx callback they provide when they registered to the rpmsg bus).215 216So things should just work for simple drivers: they already have an217endpoint, their rx callback is bound to their rpmsg address, and when218relevant inbound messages arrive (i.e. messages which their dst address219equals to the src address of their rpmsg channel), the driver's handler220is invoked to process it.221 222That said, more complicated drivers might do need to allocate223additional rpmsg addresses, and bind them to different rx callbacks.224To accomplish that, those drivers need to call this function.225Drivers should provide their channel (so the new endpoint would bind226to the same remote processor their channel belongs to), an rx callback227function, an optional private data (which is provided back when the228rx callback is invoked), and an address they want to bind with the229callback. If addr is RPMSG_ADDR_ANY, then rpmsg_create_ept will230dynamically assign them an available rpmsg address (drivers should have231a very good reason why not to always use RPMSG_ADDR_ANY here).232 233Returns a pointer to the endpoint on success, or NULL on error.234 235::236 237 void rpmsg_destroy_ept(struct rpmsg_endpoint *ept);238 239 240destroys an existing rpmsg endpoint. user should provide a pointer241to an rpmsg endpoint that was previously created with rpmsg_create_ept().242 243::244 245 int register_rpmsg_driver(struct rpmsg_driver *rpdrv);246 247 248registers an rpmsg driver with the rpmsg bus. user should provide249a pointer to an rpmsg_driver struct, which contains the driver's250->probe() and ->remove() functions, an rx callback, and an id_table251specifying the names of the channels this driver is interested to252be probed with.253 254::255 256 void unregister_rpmsg_driver(struct rpmsg_driver *rpdrv);257 258 259unregisters an rpmsg driver from the rpmsg bus. user should provide260a pointer to a previously-registered rpmsg_driver struct.261Returns 0 on success, and an appropriate error value on failure.262 263 264Typical usage265=============266 267The following is a simple rpmsg driver, that sends an "hello!" message268on probe(), and whenever it receives an incoming message, it dumps its269content to the console.270 271::272 273 #include <linux/kernel.h>274 #include <linux/module.h>275 #include <linux/rpmsg.h>276 277 static void rpmsg_sample_cb(struct rpmsg_channel *rpdev, void *data, int len,278 void *priv, u32 src)279 {280 print_hex_dump(KERN_INFO, "incoming message:", DUMP_PREFIX_NONE,281 16, 1, data, len, true);282 }283 284 static int rpmsg_sample_probe(struct rpmsg_channel *rpdev)285 {286 int err;287 288 dev_info(&rpdev->dev, "chnl: 0x%x -> 0x%x\n", rpdev->src, rpdev->dst);289 290 /* send a message on our channel */291 err = rpmsg_send(rpdev->ept, "hello!", 6);292 if (err) {293 pr_err("rpmsg_send failed: %d\n", err);294 return err;295 }296 297 return 0;298 }299 300 static void rpmsg_sample_remove(struct rpmsg_channel *rpdev)301 {302 dev_info(&rpdev->dev, "rpmsg sample client driver is removed\n");303 }304 305 static struct rpmsg_device_id rpmsg_driver_sample_id_table[] = {306 { .name = "rpmsg-client-sample" },307 { },308 };309 MODULE_DEVICE_TABLE(rpmsg, rpmsg_driver_sample_id_table);310 311 static struct rpmsg_driver rpmsg_sample_client = {312 .drv.name = KBUILD_MODNAME,313 .id_table = rpmsg_driver_sample_id_table,314 .probe = rpmsg_sample_probe,315 .callback = rpmsg_sample_cb,316 .remove = rpmsg_sample_remove,317 };318 module_rpmsg_driver(rpmsg_sample_client);319 320.. note::321 322 a similar sample which can be built and loaded can be found323 in samples/rpmsg/.324 325Allocations of rpmsg channels326=============================327 328At this point we only support dynamic allocations of rpmsg channels.329 330This is possible only with remote processors that have the VIRTIO_RPMSG_F_NS331virtio device feature set. This feature bit means that the remote332processor supports dynamic name service announcement messages.333 334When this feature is enabled, creation of rpmsg devices (i.e. channels)335is completely dynamic: the remote processor announces the existence of a336remote rpmsg service by sending a name service message (which contains337the name and rpmsg addr of the remote service, see struct rpmsg_ns_msg).338 339This message is then handled by the rpmsg bus, which in turn dynamically340creates and registers an rpmsg channel (which represents the remote service).341If/when a relevant rpmsg driver is registered, it will be immediately probed342by the bus, and can then start sending messages to the remote service.343 344The plan is also to add static creation of rpmsg channels via the virtio345config space, but it's not implemented yet.346