0001 ============================================
0002 Remote Processor Messaging (rpmsg) Framework
0003 ============================================
0004
0005 .. note::
0006
0007 This document describes the rpmsg bus and how to write rpmsg drivers.
0008 To learn how to add rpmsg support for new platforms, check out remoteproc.txt
0009 (also a resident of Documentation/).
0010
0011 Introduction
0012 ============
0013
0014 Modern SoCs typically employ heterogeneous remote processor devices in
0015 asymmetric multiprocessing (AMP) configurations, which may be running
0016 different instances of operating system, whether it's Linux or any other
0017 flavor of real-time OS.
0018
0019 OMAP4, for example, has dual Cortex-A9, dual Cortex-M3 and a C64x+ DSP.
0020 Typically, the dual cortex-A9 is running Linux in a SMP configuration,
0021 and each of the other three cores (two M3 cores and a DSP) is running
0022 its own instance of RTOS in an AMP configuration.
0023
0024 Typically AMP remote processors employ dedicated DSP codecs and multimedia
0025 hardware accelerators, and therefore are often used to offload CPU-intensive
0026 multimedia tasks from the main application processor.
0027
0028 These remote processors could also be used to control latency-sensitive
0029 sensors, drive random hardware blocks, or just perform background tasks
0030 while the main CPU is idling.
0031
0032 Users of those remote processors can either be userland apps (e.g. multimedia
0033 frameworks talking with remote OMX components) or kernel drivers (controlling
0034 hardware accessible only by the remote processor, reserving kernel-controlled
0035 resources on behalf of the remote processor, etc..).
0036
0037 Rpmsg is a virtio-based messaging bus that allows kernel drivers to communicate
0038 with remote processors available on the system. In turn, drivers could then
0039 expose appropriate user space interfaces, if needed.
0040
0041 When writing a driver that exposes rpmsg communication to userland, please
0042 keep in mind that remote processors might have direct access to the
0043 system's physical memory and other sensitive hardware resources (e.g. on
0044 OMAP4, remote cores and hardware accelerators may have direct access to the
0045 physical memory, gpio banks, dma controllers, i2c bus, gptimers, mailbox
0046 devices, hwspinlocks, etc..). Moreover, those remote processors might be
0047 running RTOS where every task can access the entire memory/devices exposed
0048 to the processor. To minimize the risks of rogue (or buggy) userland code
0049 exploiting remote bugs, and by that taking over the system, it is often
0050 desired to limit userland to specific rpmsg channels (see definition below)
0051 it can send messages on, and if possible, minimize how much control
0052 it has over the content of the messages.
0053
0054 Every rpmsg device is a communication channel with a remote processor (thus
0055 rpmsg devices are called channels). Channels are identified by a textual name
0056 and have a local ("source") rpmsg address, and remote ("destination") rpmsg
0057 address.
0058
0059 When a driver starts listening on a channel, its rx callback is bound with
0060 a unique rpmsg local address (a 32-bit integer). This way when inbound messages
0061 arrive, the rpmsg core dispatches them to the appropriate driver according
0062 to their destination address (this is done by invoking the driver's rx handler
0063 with the payload of the inbound message).
0064
0065
0066 User API
0067 ========
0068
0069 ::
0070
0071 int rpmsg_send(struct rpmsg_channel *rpdev, void *data, int len);
0072
0073 sends a message across to the remote processor on a given channel.
0074 The caller should specify the channel, the data it wants to send,
0075 and its length (in bytes). The message will be sent on the specified
0076 channel, i.e. its source and destination address fields will be
0077 set to the channel's src and dst addresses.
0078
0079 In case there are no TX buffers available, the function will block until
0080 one becomes available (i.e. until the remote processor consumes
0081 a tx buffer and puts it back on virtio's used descriptor ring),
0082 or a timeout of 15 seconds elapses. When the latter happens,
0083 -ERESTARTSYS is returned.
0084
0085 The function can only be called from a process context (for now).
0086 Returns 0 on success and an appropriate error value on failure.
0087
0088 ::
0089
0090 int rpmsg_sendto(struct rpmsg_channel *rpdev, void *data, int len, u32 dst);
0091
0092 sends a message across to the remote processor on a given channel,
0093 to a destination address provided by the caller.
0094
0095 The caller should specify the channel, the data it wants to send,
0096 its length (in bytes), and an explicit destination address.
0097
0098 The message will then be sent to the remote processor to which the
0099 channel belongs, using the channel's src address, and the user-provided
0100 dst address (thus the channel's dst address will be ignored).
0101
0102 In case there are no TX buffers available, the function will block until
0103 one becomes available (i.e. until the remote processor consumes
0104 a tx buffer and puts it back on virtio's used descriptor ring),
0105 or a timeout of 15 seconds elapses. When the latter happens,
0106 -ERESTARTSYS is returned.
0107
0108 The function can only be called from a process context (for now).
0109 Returns 0 on success and an appropriate error value on failure.
0110
0111 ::
0112
0113 int rpmsg_send_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
0114 void *data, int len);
0115
0116
0117 sends a message across to the remote processor, using the src and dst
0118 addresses provided by the user.
0119
0120 The caller should specify the channel, the data it wants to send,
0121 its length (in bytes), and explicit source and destination addresses.
0122 The message will then be sent to the remote processor to which the
0123 channel belongs, but the channel's src and dst addresses will be
0124 ignored (and the user-provided addresses will be used instead).
0125
0126 In case there are no TX buffers available, the function will block until
0127 one becomes available (i.e. until the remote processor consumes
0128 a tx buffer and puts it back on virtio's used descriptor ring),
0129 or a timeout of 15 seconds elapses. When the latter happens,
0130 -ERESTARTSYS is returned.
0131
0132 The function can only be called from a process context (for now).
0133 Returns 0 on success and an appropriate error value on failure.
0134
0135 ::
0136
0137 int rpmsg_trysend(struct rpmsg_channel *rpdev, void *data, int len);
0138
0139 sends a message across to the remote processor on a given channel.
0140 The caller should specify the channel, the data it wants to send,
0141 and its length (in bytes). The message will be sent on the specified
0142 channel, i.e. its source and destination address fields will be
0143 set to the channel's src and dst addresses.
0144
0145 In case there are no TX buffers available, the function will immediately
0146 return -ENOMEM without waiting until one becomes available.
0147
0148 The function can only be called from a process context (for now).
0149 Returns 0 on success and an appropriate error value on failure.
0150
0151 ::
0152
0153 int rpmsg_trysendto(struct rpmsg_channel *rpdev, void *data, int len, u32 dst)
0154
0155
0156 sends a message across to the remote processor on a given channel,
0157 to a destination address provided by the user.
0158
0159 The user should specify the channel, the data it wants to send,
0160 its length (in bytes), and an explicit destination address.
0161
0162 The message will then be sent to the remote processor to which the
0163 channel belongs, using the channel's src address, and the user-provided
0164 dst address (thus the channel's dst address will be ignored).
0165
0166 In case there are no TX buffers available, the function will immediately
0167 return -ENOMEM without waiting until one becomes available.
0168
0169 The function can only be called from a process context (for now).
0170 Returns 0 on success and an appropriate error value on failure.
0171
0172 ::
0173
0174 int rpmsg_trysend_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
0175 void *data, int len);
0176
0177
0178 sends a message across to the remote processor, using source and
0179 destination addresses provided by the user.
0180
0181 The user should specify the channel, the data it wants to send,
0182 its length (in bytes), and explicit source and destination addresses.
0183 The message will then be sent to the remote processor to which the
0184 channel belongs, but the channel's src and dst addresses will be
0185 ignored (and the user-provided addresses will be used instead).
0186
0187 In case there are no TX buffers available, the function will immediately
0188 return -ENOMEM without waiting until one becomes available.
0189
0190 The function can only be called from a process context (for now).
0191 Returns 0 on success and an appropriate error value on failure.
0192
0193 ::
0194
0195 struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev,
0196 rpmsg_rx_cb_t cb, void *priv,
0197 struct rpmsg_channel_info chinfo);
0198
0199 every rpmsg address in the system is bound to an rx callback (so when
0200 inbound messages arrive, they are dispatched by the rpmsg bus using the
0201 appropriate callback handler) by means of an rpmsg_endpoint struct.
0202
0203 This function allows drivers to create such an endpoint, and by that,
0204 bind a callback, and possibly some private data too, to an rpmsg address
0205 (either one that is known in advance, or one that will be dynamically
0206 assigned for them).
0207
0208 Simple rpmsg drivers need not call rpmsg_create_ept, because an endpoint
0209 is already created for them when they are probed by the rpmsg bus
0210 (using the rx callback they provide when they registered to the rpmsg bus).
0211
0212 So things should just work for simple drivers: they already have an
0213 endpoint, their rx callback is bound to their rpmsg address, and when
0214 relevant inbound messages arrive (i.e. messages which their dst address
0215 equals to the src address of their rpmsg channel), the driver's handler
0216 is invoked to process it.
0217
0218 That said, more complicated drivers might do need to allocate
0219 additional rpmsg addresses, and bind them to different rx callbacks.
0220 To accomplish that, those drivers need to call this function.
0221 Drivers should provide their channel (so the new endpoint would bind
0222 to the same remote processor their channel belongs to), an rx callback
0223 function, an optional private data (which is provided back when the
0224 rx callback is invoked), and an address they want to bind with the
0225 callback. If addr is RPMSG_ADDR_ANY, then rpmsg_create_ept will
0226 dynamically assign them an available rpmsg address (drivers should have
0227 a very good reason why not to always use RPMSG_ADDR_ANY here).
0228
0229 Returns a pointer to the endpoint on success, or NULL on error.
0230
0231 ::
0232
0233 void rpmsg_destroy_ept(struct rpmsg_endpoint *ept);
0234
0235
0236 destroys an existing rpmsg endpoint. user should provide a pointer
0237 to an rpmsg endpoint that was previously created with rpmsg_create_ept().
0238
0239 ::
0240
0241 int register_rpmsg_driver(struct rpmsg_driver *rpdrv);
0242
0243
0244 registers an rpmsg driver with the rpmsg bus. user should provide
0245 a pointer to an rpmsg_driver struct, which contains the driver's
0246 ->probe() and ->remove() functions, an rx callback, and an id_table
0247 specifying the names of the channels this driver is interested to
0248 be probed with.
0249
0250 ::
0251
0252 void unregister_rpmsg_driver(struct rpmsg_driver *rpdrv);
0253
0254
0255 unregisters an rpmsg driver from the rpmsg bus. user should provide
0256 a pointer to a previously-registered rpmsg_driver struct.
0257 Returns 0 on success, and an appropriate error value on failure.
0258
0259
0260 Typical usage
0261 =============
0262
0263 The following is a simple rpmsg driver, that sends an "hello!" message
0264 on probe(), and whenever it receives an incoming message, it dumps its
0265 content to the console.
0266
0267 ::
0268
0269 #include <linux/kernel.h>
0270 #include <linux/module.h>
0271 #include <linux/rpmsg.h>
0272
0273 static void rpmsg_sample_cb(struct rpmsg_channel *rpdev, void *data, int len,
0274 void *priv, u32 src)
0275 {
0276 print_hex_dump(KERN_INFO, "incoming message:", DUMP_PREFIX_NONE,
0277 16, 1, data, len, true);
0278 }
0279
0280 static int rpmsg_sample_probe(struct rpmsg_channel *rpdev)
0281 {
0282 int err;
0283
0284 dev_info(&rpdev->dev, "chnl: 0x%x -> 0x%x\n", rpdev->src, rpdev->dst);
0285
0286 /* send a message on our channel */
0287 err = rpmsg_send(rpdev, "hello!", 6);
0288 if (err) {
0289 pr_err("rpmsg_send failed: %d\n", err);
0290 return err;
0291 }
0292
0293 return 0;
0294 }
0295
0296 static void rpmsg_sample_remove(struct rpmsg_channel *rpdev)
0297 {
0298 dev_info(&rpdev->dev, "rpmsg sample client driver is removed\n");
0299 }
0300
0301 static struct rpmsg_device_id rpmsg_driver_sample_id_table[] = {
0302 { .name = "rpmsg-client-sample" },
0303 { },
0304 };
0305 MODULE_DEVICE_TABLE(rpmsg, rpmsg_driver_sample_id_table);
0306
0307 static struct rpmsg_driver rpmsg_sample_client = {
0308 .drv.name = KBUILD_MODNAME,
0309 .id_table = rpmsg_driver_sample_id_table,
0310 .probe = rpmsg_sample_probe,
0311 .callback = rpmsg_sample_cb,
0312 .remove = rpmsg_sample_remove,
0313 };
0314 module_rpmsg_driver(rpmsg_sample_client);
0315
0316 .. note::
0317
0318 a similar sample which can be built and loaded can be found
0319 in samples/rpmsg/.
0320
0321 Allocations of rpmsg channels
0322 =============================
0323
0324 At this point we only support dynamic allocations of rpmsg channels.
0325
0326 This is possible only with remote processors that have the VIRTIO_RPMSG_F_NS
0327 virtio device feature set. This feature bit means that the remote
0328 processor supports dynamic name service announcement messages.
0329
0330 When this feature is enabled, creation of rpmsg devices (i.e. channels)
0331 is completely dynamic: the remote processor announces the existence of a
0332 remote rpmsg service by sending a name service message (which contains
0333 the name and rpmsg addr of the remote service, see struct rpmsg_ns_msg).
0334
0335 This message is then handled by the rpmsg bus, which in turn dynamically
0336 creates and registers an rpmsg channel (which represents the remote service).
0337 If/when a relevant rpmsg driver is registered, it will be immediately probed
0338 by the bus, and can then start sending messages to the remote service.
0339
0340 The plan is also to add static creation of rpmsg channels via the virtio
0341 config space, but it's not implemented yet.