linux/Documentation/rpmsg.txt
<<
>>
Prefs
   1Remote Processor Messaging (rpmsg) Framework
   2
   3Note: this document describes the rpmsg bus and how to write rpmsg drivers.
   4To learn how to add rpmsg support for new platforms, check out remoteproc.txt
   5(also a resident of Documentation/).
   6
   71. Introduction
   8
   9Modern SoCs typically employ heterogeneous remote processor devices in
  10asymmetric multiprocessing (AMP) configurations, which may be running
  11different instances of operating system, whether it's Linux or any other
  12flavor of real-time OS.
  13
  14OMAP4, for example, has dual Cortex-A9, dual Cortex-M3 and a C64x+ DSP.
  15Typically, the dual cortex-A9 is running Linux in a SMP configuration,
  16and each of the other three cores (two M3 cores and a DSP) is running
  17its own instance of RTOS in an AMP configuration.
  18
  19Typically AMP remote processors employ dedicated DSP codecs and multimedia
  20hardware accelerators, and therefore are often used to offload CPU-intensive
  21multimedia tasks from the main application processor.
  22
  23These remote processors could also be used to control latency-sensitive
  24sensors, drive random hardware blocks, or just perform background tasks
  25while the main CPU is idling.
  26
  27Users of those remote processors can either be userland apps (e.g. multimedia
  28frameworks talking with remote OMX components) or kernel drivers (controlling
  29hardware accessible only by the remote processor, reserving kernel-controlled
  30resources on behalf of the remote processor, etc..).
  31
  32Rpmsg is a virtio-based messaging bus that allows kernel drivers to communicate
  33with remote processors available on the system. In turn, drivers could then
  34expose appropriate user space interfaces, if needed.
  35
  36When writing a driver that exposes rpmsg communication to userland, please
  37keep in mind that remote processors might have direct access to the
  38system's physical memory and other sensitive hardware resources (e.g. on
  39OMAP4, remote cores and hardware accelerators may have direct access to the
  40physical memory, gpio banks, dma controllers, i2c bus, gptimers, mailbox
  41devices, hwspinlocks, etc..). Moreover, those remote processors might be
  42running RTOS where every task can access the entire memory/devices exposed
  43to the processor. To minimize the risks of rogue (or buggy) userland code
  44exploiting remote bugs, and by that taking over the system, it is often
  45desired to limit userland to specific rpmsg channels (see definition below)
  46it can send messages on, and if possible, minimize how much control
  47it has over the content of the messages.
  48
  49Every rpmsg device is a communication channel with a remote processor (thus
  50rpmsg devices are called channels). Channels are identified by a textual name
  51and have a local ("source") rpmsg address, and remote ("destination") rpmsg
  52address.
  53
  54When a driver starts listening on a channel, its rx callback is bound with
  55a unique rpmsg local address (a 32-bit integer). This way when inbound messages
  56arrive, the rpmsg core dispatches them to the appropriate driver according
  57to their destination address (this is done by invoking the driver's rx handler
  58with the payload of the inbound message).
  59
  60
  612. User API
  62
  63  int rpmsg_send(struct rpmsg_channel *rpdev, void *data, int len);
  64   - sends a message across to the remote processor on a given channel.
  65     The caller should specify the channel, the data it wants to send,
  66     and its length (in bytes). The message will be sent on the specified
  67     channel, i.e. its source and destination address fields will be
  68     set to the channel's src and dst addresses.
  69
  70     In case there are no TX buffers available, the function will block until
  71     one becomes available (i.e. until the remote processor consumes
  72     a tx buffer and puts it back on virtio's used descriptor ring),
  73     or a timeout of 15 seconds elapses. When the latter happens,
  74     -ERESTARTSYS is returned.
  75     The function can only be called from a process context (for now).
  76     Returns 0 on success and an appropriate error value on failure.
  77
  78  int rpmsg_sendto(struct rpmsg_channel *rpdev, void *data, int len, u32 dst);
  79   - sends a message across to the remote processor on a given channel,
  80     to a destination address provided by the caller.
  81     The caller should specify the channel, the data it wants to send,
  82     its length (in bytes), and an explicit destination address.
  83     The message will then be sent to the remote processor to which the
  84     channel belongs, using the channel's src address, and the user-provided
  85     dst address (thus the channel's dst address will be ignored).
  86
  87     In case there are no TX buffers available, the function will block until
  88     one becomes available (i.e. until the remote processor consumes
  89     a tx buffer and puts it back on virtio's used descriptor ring),
  90     or a timeout of 15 seconds elapses. When the latter happens,
  91     -ERESTARTSYS is returned.
  92     The function can only be called from a process context (for now).
  93     Returns 0 on success and an appropriate error value on failure.
  94
  95  int rpmsg_send_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
  96                                                        void *data, int len);
  97   - sends a message across to the remote processor, using the src and dst
  98     addresses provided by the user.
  99     The caller should specify the channel, the data it wants to send,
 100     its length (in bytes), and explicit source and destination addresses.
 101     The message will then be sent to the remote processor to which the
 102     channel belongs, but the channel's src and dst addresses will be
 103     ignored (and the user-provided addresses will be used instead).
 104
 105     In case there are no TX buffers available, the function will block until
 106     one becomes available (i.e. until the remote processor consumes
 107     a tx buffer and puts it back on virtio's used descriptor ring),
 108     or a timeout of 15 seconds elapses. When the latter happens,
 109     -ERESTARTSYS is returned.
 110     The function can only be called from a process context (for now).
 111     Returns 0 on success and an appropriate error value on failure.
 112
 113  int rpmsg_trysend(struct rpmsg_channel *rpdev, void *data, int len);
 114   - sends a message across to the remote processor on a given channel.
 115     The caller should specify the channel, the data it wants to send,
 116     and its length (in bytes). The message will be sent on the specified
 117     channel, i.e. its source and destination address fields will be
 118     set to the channel's src and dst addresses.
 119
 120     In case there are no TX buffers available, the function will immediately
 121     return -ENOMEM without waiting until one becomes available.
 122     The function can only be called from a process context (for now).
 123     Returns 0 on success and an appropriate error value on failure.
 124
 125  int rpmsg_trysendto(struct rpmsg_channel *rpdev, void *data, int len, u32 dst)
 126   - sends a message across to the remote processor on a given channel,
 127     to a destination address provided by the user.
 128     The user should specify the channel, the data it wants to send,
 129     its length (in bytes), and an explicit destination address.
 130     The message will then be sent to the remote processor to which the
 131     channel belongs, using the channel's src address, and the user-provided
 132     dst address (thus the channel's dst address will be ignored).
 133
 134     In case there are no TX buffers available, the function will immediately
 135     return -ENOMEM without waiting until one becomes available.
 136     The function can only be called from a process context (for now).
 137     Returns 0 on success and an appropriate error value on failure.
 138
 139  int rpmsg_trysend_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
 140                                                        void *data, int len);
 141   - sends a message across to the remote processor, using source and
 142     destination addresses provided by the user.
 143     The user should specify the channel, the data it wants to send,
 144     its length (in bytes), and explicit source and destination addresses.
 145     The message will then be sent to the remote processor to which the
 146     channel belongs, but the channel's src and dst addresses will be
 147     ignored (and the user-provided addresses will be used instead).
 148
 149     In case there are no TX buffers available, the function will immediately
 150     return -ENOMEM without waiting until one becomes available.
 151     The function can only be called from a process context (for now).
 152     Returns 0 on success and an appropriate error value on failure.
 153
 154  struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_channel *rpdev,
 155                void (*cb)(struct rpmsg_channel *, void *, int, void *, u32),
 156                void *priv, u32 addr);
 157   - every rpmsg address in the system is bound to an rx callback (so when
 158     inbound messages arrive, they are dispatched by the rpmsg bus using the
 159     appropriate callback handler) by means of an rpmsg_endpoint struct.
 160
 161     This function allows drivers to create such an endpoint, and by that,
 162     bind a callback, and possibly some private data too, to an rpmsg address
 163     (either one that is known in advance, or one that will be dynamically
 164     assigned for them).
 165
 166     Simple rpmsg drivers need not call rpmsg_create_ept, because an endpoint
 167     is already created for them when they are probed by the rpmsg bus
 168     (using the rx callback they provide when they registered to the rpmsg bus).
 169
 170     So things should just work for simple drivers: they already have an
 171     endpoint, their rx callback is bound to their rpmsg address, and when
 172     relevant inbound messages arrive (i.e. messages which their dst address
 173     equals to the src address of their rpmsg channel), the driver's handler
 174     is invoked to process it.
 175
 176     That said, more complicated drivers might do need to allocate
 177     additional rpmsg addresses, and bind them to different rx callbacks.
 178     To accomplish that, those drivers need to call this function.
 179     Drivers should provide their channel (so the new endpoint would bind
 180     to the same remote processor their channel belongs to), an rx callback
 181     function, an optional private data (which is provided back when the
 182     rx callback is invoked), and an address they want to bind with the
 183     callback. If addr is RPMSG_ADDR_ANY, then rpmsg_create_ept will
 184     dynamically assign them an available rpmsg address (drivers should have
 185     a very good reason why not to always use RPMSG_ADDR_ANY here).
 186
 187     Returns a pointer to the endpoint on success, or NULL on error.
 188
 189  void rpmsg_destroy_ept(struct rpmsg_endpoint *ept);
 190   - destroys an existing rpmsg endpoint. user should provide a pointer
 191     to an rpmsg endpoint that was previously created with rpmsg_create_ept().
 192
 193  int register_rpmsg_driver(struct rpmsg_driver *rpdrv);
 194   - registers an rpmsg driver with the rpmsg bus. user should provide
 195     a pointer to an rpmsg_driver struct, which contains the driver's
 196     ->probe() and ->remove() functions, an rx callback, and an id_table
 197     specifying the names of the channels this driver is interested to
 198     be probed with.
 199
 200  void unregister_rpmsg_driver(struct rpmsg_driver *rpdrv);
 201   - unregisters an rpmsg driver from the rpmsg bus. user should provide
 202     a pointer to a previously-registered rpmsg_driver struct.
 203     Returns 0 on success, and an appropriate error value on failure.
 204
 205
 2063. Typical usage
 207
 208The following is a simple rpmsg driver, that sends an "hello!" message
 209on probe(), and whenever it receives an incoming message, it dumps its
 210content to the console.
 211
 212#include <linux/kernel.h>
 213#include <linux/module.h>
 214#include <linux/rpmsg.h>
 215
 216static void rpmsg_sample_cb(struct rpmsg_channel *rpdev, void *data, int len,
 217                                                void *priv, u32 src)
 218{
 219        print_hex_dump(KERN_INFO, "incoming message:", DUMP_PREFIX_NONE,
 220                                                16, 1, data, len, true);
 221}
 222
 223static int rpmsg_sample_probe(struct rpmsg_channel *rpdev)
 224{
 225        int err;
 226
 227        dev_info(&rpdev->dev, "chnl: 0x%x -> 0x%x\n", rpdev->src, rpdev->dst);
 228
 229        /* send a message on our channel */
 230        err = rpmsg_send(rpdev, "hello!", 6);
 231        if (err) {
 232                pr_err("rpmsg_send failed: %d\n", err);
 233                return err;
 234        }
 235
 236        return 0;
 237}
 238
 239static void rpmsg_sample_remove(struct rpmsg_channel *rpdev)
 240{
 241        dev_info(&rpdev->dev, "rpmsg sample client driver is removed\n");
 242}
 243
 244static struct rpmsg_device_id rpmsg_driver_sample_id_table[] = {
 245        { .name = "rpmsg-client-sample" },
 246        { },
 247};
 248MODULE_DEVICE_TABLE(rpmsg, rpmsg_driver_sample_id_table);
 249
 250static struct rpmsg_driver rpmsg_sample_client = {
 251        .drv.name       = KBUILD_MODNAME,
 252        .drv.owner      = THIS_MODULE,
 253        .id_table       = rpmsg_driver_sample_id_table,
 254        .probe          = rpmsg_sample_probe,
 255        .callback       = rpmsg_sample_cb,
 256        .remove         = rpmsg_sample_remove,
 257};
 258
 259static int __init init(void)
 260{
 261        return register_rpmsg_driver(&rpmsg_sample_client);
 262}
 263module_init(init);
 264
 265static void __exit fini(void)
 266{
 267        unregister_rpmsg_driver(&rpmsg_sample_client);
 268}
 269module_exit(fini);
 270
 271Note: a similar sample which can be built and loaded can be found
 272in samples/rpmsg/.
 273
 2744. Allocations of rpmsg channels:
 275
 276At this point we only support dynamic allocations of rpmsg channels.
 277
 278This is possible only with remote processors that have the VIRTIO_RPMSG_F_NS
 279virtio device feature set. This feature bit means that the remote
 280processor supports dynamic name service announcement messages.
 281
 282When this feature is enabled, creation of rpmsg devices (i.e. channels)
 283is completely dynamic: the remote processor announces the existence of a
 284remote rpmsg service by sending a name service message (which contains
 285the name and rpmsg addr of the remote service, see struct rpmsg_ns_msg).
 286
 287This message is then handled by the rpmsg bus, which in turn dynamically
 288creates and registers an rpmsg channel (which represents the remote service).
 289If/when a relevant rpmsg driver is registered, it will be immediately probed
 290by the bus, and can then start sending messages to the remote service.
 291
 292The plan is also to add static creation of rpmsg channels via the virtio
 293config space, but it's not implemented yet.
 294
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.