From 6c4fbf1ce49390aaa9db84cdaff5cf18cae46da8 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Wed, 29 Jul 2026 22:29:22 -0700 Subject: [PATCH 1/9] rpmsg: ctrl: use kernel-doc format for ioctl macros Convert the ioctl macros to kernel-doc format to avoid kernel-doc warnings: Warning: include/uapi/linux/rpmsg.h:26 This comment starts with '/**', but isn't a kernel-doc comment. * Instantiate a new rmpsg char device endpoint. Warning: include/uapi/linux/rpmsg.h:31 This comment starts with '/**', but isn't a kernel-doc comment. * Destroy a rpmsg char device endpoint created by the RPMSG_CREATE_EPT_IOCTL. Warning: include/uapi/linux/rpmsg.h:36 This comment starts with '/**', but isn't a kernel-doc comment. * Instantiate a new local rpmsg service device. Warning: include/uapi/linux/rpmsg.h:41 This comment starts with '/**', but isn't a kernel-doc comment. * Release a local rpmsg device. Warning: include/uapi/linux/rpmsg.h:46 This comment starts with '/**', but isn't a kernel-doc comment. * Get the flow control state of the remote rpmsg char device. Warning: include/uapi/linux/rpmsg.h:51 This comment starts with '/**', but isn't a kernel-doc comment. * Set the flow control state of the local rpmsg char device. Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20260730052922.1610116-1-rdunlap@infradead.org Signed-off-by: Bjorn Andersson --- include/uapi/linux/rpmsg.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/include/uapi/linux/rpmsg.h b/include/uapi/linux/rpmsg.h index f0c8da2b185b..d553ebac3181 100644 --- a/include/uapi/linux/rpmsg.h +++ b/include/uapi/linux/rpmsg.h @@ -24,32 +24,35 @@ struct rpmsg_endpoint_info { }; /** - * Instantiate a new rmpsg char device endpoint. + * RPMSG_CREATE_EPT_IOCTL - Instantiate a new rmpsg char device endpoint. */ #define RPMSG_CREATE_EPT_IOCTL _IOW(0xb5, 0x1, struct rpmsg_endpoint_info) /** - * Destroy a rpmsg char device endpoint created by the RPMSG_CREATE_EPT_IOCTL. + * RPMSG_DESTROY_EPT_IOCTL - Destroy a rpmsg char device endpoint created + * by the RPMSG_CREATE_EPT_IOCTL. */ #define RPMSG_DESTROY_EPT_IOCTL _IO(0xb5, 0x2) /** - * Instantiate a new local rpmsg service device. + * RPMSG_CREATE_DEV_IOCTL - Instantiate a new local rpmsg service device. */ #define RPMSG_CREATE_DEV_IOCTL _IOW(0xb5, 0x3, struct rpmsg_endpoint_info) /** - * Release a local rpmsg device. + * RPMSG_RELEASE_DEV_IOCTL - Release a local rpmsg device. */ #define RPMSG_RELEASE_DEV_IOCTL _IOW(0xb5, 0x4, struct rpmsg_endpoint_info) /** - * Get the flow control state of the remote rpmsg char device. + * RPMSG_GET_OUTGOING_FLOWCONTROL - Get the flow control state of the + * remote rpmsg char device. */ #define RPMSG_GET_OUTGOING_FLOWCONTROL _IOR(0xb5, 0x5, int) /** - * Set the flow control state of the local rpmsg char device. + * RPMSG_SET_INCOMING_FLOWCONTROL - Set the flow control state of the + * local rpmsg char device. */ #define RPMSG_SET_INCOMING_FLOWCONTROL _IOR(0xb5, 0x6, int) From 92619efc9285df5720221c5650139c332cdf228c Mon Sep 17 00:00:00 2001 From: Tanmay Shah Date: Fri, 28 Aug 2026 07:58:48 -0700 Subject: [PATCH 2/9] rpmsg: virtio_rpmsg_bus: Rename rbufs and sbufs rename variables with clear names. %s/rbufs/rx_bufs/ %s/sbufs/tx_bufs/ %s/last_sbuf/last_tx_buf/ Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-2-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier --- drivers/rpmsg/virtio_rpmsg_bus.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 1b8bb05924af..55cd65b14f80 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -35,13 +35,13 @@ * @vdev: the virtio device * @rvq: rx virtqueue * @svq: tx virtqueue - * @rbufs: kernel address of rx buffers - * @sbufs: kernel address of tx buffers - * @num_bufs: total number of buffers for rx and tx + * @rx_bufs: kernel address of rx buffers + * @tx_bufs: kernel address of tx buffers + * @num_bufs: total number of buffers for rx and tx * @buf_size: size of one rx or tx buffer - * @last_sbuf: index of last tx buffer used + * @last_tx_buf: index of last tx buffer used * @bufs_dma: dma base addr of the buffers - * @tx_lock: protects svq and sbufs, to allow concurrent senders. + * @tx_lock: protects svq and tx_bufs, to allow concurrent senders. * sending a message might require waking up a dozing remote * processor, which involves sleeping, hence the mutex. * @endpoints: idr of local endpoints, allows fast retrieval @@ -55,10 +55,10 @@ struct virtproc_info { struct virtio_device *vdev; struct virtqueue *rvq, *svq; - void *rbufs, *sbufs; + void *rx_bufs, *tx_bufs; unsigned int num_bufs; unsigned int buf_size; - int last_sbuf; + int last_tx_buf; dma_addr_t bufs_dma; struct mutex tx_lock; struct idr endpoints; @@ -443,8 +443,8 @@ static void *get_a_tx_buf(struct virtproc_info *vrp) * either pick the next unused tx buffer * (half of our buffers are used for sending messages) */ - if (vrp->last_sbuf < vrp->num_bufs / 2) - ret = vrp->sbufs + vrp->buf_size * vrp->last_sbuf++; + if (vrp->last_tx_buf < vrp->num_bufs / 2) + ret = vrp->tx_bufs + vrp->buf_size * vrp->last_tx_buf++; /* or recycle a used one */ else ret = virtqueue_get_buf(vrp->svq, &len); @@ -634,7 +634,7 @@ static __poll_t virtio_rpmsg_poll(struct rpmsg_endpoint *ept, struct file *filp, * allocated buffers are used for transmit, hence num_bufs / 2), or, * - we ask the virtqueue if there's a buffer available */ - if (vrp->last_sbuf < vrp->num_bufs / 2 || + if (vrp->last_tx_buf < vrp->num_bufs / 2 || !virtqueue_enable_cb(vrp->svq)) mask |= EPOLLOUT; @@ -872,15 +872,15 @@ static int rpmsg_probe(struct virtio_device *vdev) bufs_va, &vrp->bufs_dma); /* half of the buffers is dedicated for RX */ - vrp->rbufs = bufs_va; + vrp->rx_bufs = bufs_va; /* and half is dedicated for TX */ - vrp->sbufs = bufs_va + total_buf_space / 2; + vrp->tx_bufs = bufs_va + total_buf_space / 2; /* set up the receive buffers */ for (i = 0; i < vrp->num_bufs / 2; i++) { struct scatterlist sg; - void *cpu_addr = vrp->rbufs + i * vrp->buf_size; + void *cpu_addr = vrp->rx_bufs + i * vrp->buf_size; rpmsg_sg_init(&sg, cpu_addr, vrp->buf_size); @@ -979,7 +979,7 @@ static void rpmsg_remove(struct virtio_device *vdev) vdev->config->del_vqs(vrp->vdev); dma_free_coherent(vdev->dev.parent, total_buf_space, - vrp->rbufs, vrp->bufs_dma); + vrp->rx_bufs, vrp->bufs_dma); kfree(vrp); } From 8727c3f3e24143a21c231bf64a375c44b949bdb0 Mon Sep 17 00:00:00 2001 From: Tanmay Shah Date: Fri, 28 Aug 2026 07:58:49 -0700 Subject: [PATCH 3/9] rpmsg: virtio_rpmsg_bus: Allow different size of tx and rx bufs Current design allocates memory for tx and rx buffers equally. The throughput can be increased if the user is allowed to configure number of tx and rx buffers as required. Hence, do not split number of tx & rx buffers into half, but decide based on respective vring size. Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-3-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier --- drivers/rpmsg/virtio_rpmsg_bus.c | 50 ++++++++++++++++---------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 55cd65b14f80..c84b6cec9caf 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -37,7 +37,8 @@ * @svq: tx virtqueue * @rx_bufs: kernel address of rx buffers * @tx_bufs: kernel address of tx buffers - * @num_bufs: total number of buffers for rx and tx + * @num_rx_buf: total number of rx buffers + * @num_tx_buf: total number of tx buffers * @buf_size: size of one rx or tx buffer * @last_tx_buf: index of last tx buffer used * @bufs_dma: dma base addr of the buffers @@ -56,7 +57,8 @@ struct virtproc_info { struct virtio_device *vdev; struct virtqueue *rvq, *svq; void *rx_bufs, *tx_bufs; - unsigned int num_bufs; + unsigned int num_rx_buf; + unsigned int num_tx_buf; unsigned int buf_size; int last_tx_buf; dma_addr_t bufs_dma; @@ -110,7 +112,7 @@ struct virtio_rpmsg_channel { /* * We're allocating buffers of 512 bytes each for communications. The * number of buffers will be computed from the number of buffers supported - * by the vring, upto a maximum of 512 buffers (256 in each direction). + * by the vring, up to a maximum of 256 in each direction. * * Each buffer will have 16 bytes for the msg header and 496 bytes for * the payload. @@ -125,7 +127,7 @@ struct virtio_rpmsg_channel { * can change this without changing anything in the firmware of the remote * processor. */ -#define MAX_RPMSG_NUM_BUFS (512) +#define MAX_RPMSG_NUM_BUFS (256) #define MAX_RPMSG_BUF_SIZE (512) /* @@ -439,11 +441,8 @@ static void *get_a_tx_buf(struct virtproc_info *vrp) mutex_lock(&vrp->tx_lock); - /* - * either pick the next unused tx buffer - * (half of our buffers are used for sending messages) - */ - if (vrp->last_tx_buf < vrp->num_bufs / 2) + /* either pick the next unused tx buffer */ + if (vrp->last_tx_buf < vrp->num_tx_buf) ret = vrp->tx_bufs + vrp->buf_size * vrp->last_tx_buf++; /* or recycle a used one */ else @@ -630,11 +629,10 @@ static __poll_t virtio_rpmsg_poll(struct rpmsg_endpoint *ept, struct file *filp, /* * check for a free buffer, either: - * - we haven't used all of the available transmit buffers (half of the - * allocated buffers are used for transmit, hence num_bufs / 2), or, + * - we haven't used all of the available transmit buffers or, * - we ask the virtqueue if there's a buffer available */ - if (vrp->last_tx_buf < vrp->num_bufs / 2 || + if (vrp->last_tx_buf < vrp->num_tx_buf || !virtqueue_enable_cb(vrp->svq)) mask |= EPOLLOUT; @@ -845,19 +843,20 @@ static int rpmsg_probe(struct virtio_device *vdev) vrp->rvq = vqs[0]; vrp->svq = vqs[1]; - /* we expect symmetric tx/rx vrings */ - WARN_ON(virtqueue_get_vring_size(vrp->rvq) != - virtqueue_get_vring_size(vrp->svq)); - /* we need less buffers if vrings are small */ - if (virtqueue_get_vring_size(vrp->rvq) < MAX_RPMSG_NUM_BUFS / 2) - vrp->num_bufs = virtqueue_get_vring_size(vrp->rvq) * 2; + if (virtqueue_get_vring_size(vrp->rvq) < MAX_RPMSG_NUM_BUFS) + vrp->num_rx_buf = virtqueue_get_vring_size(vrp->rvq); else - vrp->num_bufs = MAX_RPMSG_NUM_BUFS; + vrp->num_rx_buf = MAX_RPMSG_NUM_BUFS; + + if (virtqueue_get_vring_size(vrp->svq) < MAX_RPMSG_NUM_BUFS) + vrp->num_tx_buf = virtqueue_get_vring_size(vrp->svq); + else + vrp->num_tx_buf = MAX_RPMSG_NUM_BUFS; vrp->buf_size = MAX_RPMSG_BUF_SIZE; - total_buf_space = vrp->num_bufs * vrp->buf_size; + total_buf_space = (vrp->num_rx_buf + vrp->num_tx_buf) * vrp->buf_size; /* allocate coherent memory for the buffers */ bufs_va = dma_alloc_coherent(vdev->dev.parent, @@ -871,14 +870,14 @@ static int rpmsg_probe(struct virtio_device *vdev) dev_dbg(&vdev->dev, "buffers: va %p, dma %pad\n", bufs_va, &vrp->bufs_dma); - /* half of the buffers is dedicated for RX */ + /* first part of the buffers is dedicated for RX */ vrp->rx_bufs = bufs_va; - /* and half is dedicated for TX */ - vrp->tx_bufs = bufs_va + total_buf_space / 2; + /* and second part is dedicated for TX */ + vrp->tx_bufs = bufs_va + vrp->num_rx_buf * vrp->buf_size; /* set up the receive buffers */ - for (i = 0; i < vrp->num_bufs / 2; i++) { + for (i = 0; i < vrp->num_rx_buf; i++) { struct scatterlist sg; void *cpu_addr = vrp->rx_bufs + i * vrp->buf_size; @@ -965,7 +964,8 @@ static int rpmsg_remove_device(struct device *dev, void *data) static void rpmsg_remove(struct virtio_device *vdev) { struct virtproc_info *vrp = vdev->priv; - size_t total_buf_space = vrp->num_bufs * vrp->buf_size; + unsigned int num_bufs = vrp->num_rx_buf + vrp->num_tx_buf; + size_t total_buf_space = num_bufs * vrp->buf_size; int ret; virtio_reset_device(vdev); From ca96ea25e51aeae45b0c947feb432fc74e2d1928 Mon Sep 17 00:00:00 2001 From: Tanmay Shah Date: Fri, 28 Aug 2026 07:58:50 -0700 Subject: [PATCH 4/9] rpmsg: virtio_rpmsg_bus: Get buffer size from config space 512 bytes isn't always suitable for all the cases, let firmware maker decide the best value from the resource table. Enabled by VIRTIO_RPMSG_F_BUFSZ feature bit. Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-4-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier --- drivers/rpmsg/virtio_rpmsg_bus.c | 100 +++++++++++++++++++++++------ include/linux/rpmsg/virtio_rpmsg.h | 41 ++++++++++++ 2 files changed, 122 insertions(+), 19 deletions(-) create mode 100644 include/linux/rpmsg/virtio_rpmsg.h diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index c84b6cec9caf..40ec93fedde9 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include #include @@ -39,7 +40,8 @@ * @tx_bufs: kernel address of tx buffers * @num_rx_buf: total number of rx buffers * @num_tx_buf: total number of tx buffers - * @buf_size: size of one rx or tx buffer + * @rx_buf_size: size of one rx buffer + * @tx_buf_size: size of one tx buffer * @last_tx_buf: index of last tx buffer used * @bufs_dma: dma base addr of the buffers * @tx_lock: protects svq and tx_bufs, to allow concurrent senders. @@ -59,7 +61,8 @@ struct virtproc_info { void *rx_bufs, *tx_bufs; unsigned int num_rx_buf; unsigned int num_tx_buf; - unsigned int buf_size; + unsigned int rx_buf_size; + unsigned int tx_buf_size; int last_tx_buf; dma_addr_t bufs_dma; struct mutex tx_lock; @@ -68,9 +71,6 @@ struct virtproc_info { wait_queue_head_t sendq; }; -/* The feature bitmap for virtio rpmsg */ -#define VIRTIO_RPMSG_F_NS 0 /* RP supports name service notifications */ - /** * struct rpmsg_hdr - common header for all rpmsg messages * @src: source address @@ -128,7 +128,7 @@ struct virtio_rpmsg_channel { * processor. */ #define MAX_RPMSG_NUM_BUFS (256) -#define MAX_RPMSG_BUF_SIZE (512) +#define DEFAULT_RPMSG_BUF_SIZE (512) /* * Local addresses are dynamically allocated on-demand. @@ -443,7 +443,7 @@ static void *get_a_tx_buf(struct virtproc_info *vrp) /* either pick the next unused tx buffer */ if (vrp->last_tx_buf < vrp->num_tx_buf) - ret = vrp->tx_bufs + vrp->buf_size * vrp->last_tx_buf++; + ret = vrp->tx_bufs + vrp->tx_buf_size * vrp->last_tx_buf++; /* or recycle a used one */ else ret = virtqueue_get_buf(vrp->svq, &len); @@ -513,7 +513,7 @@ static int rpmsg_send_offchannel_raw(struct rpmsg_device *rpdev, * messaging), or to improve the buffer allocator, to support * variable-length buffer sizes. */ - if (len > vrp->buf_size - sizeof(struct rpmsg_hdr)) { + if (len > vrp->tx_buf_size - sizeof(struct rpmsg_hdr)) { dev_err(dev, "message is too big (%d)\n", len); return -EMSGSIZE; } @@ -646,7 +646,7 @@ static ssize_t virtio_rpmsg_get_mtu(struct rpmsg_endpoint *ept) struct rpmsg_device *rpdev = ept->rpdev; struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev); - return vch->vrp->buf_size - sizeof(struct rpmsg_hdr); + return vch->vrp->tx_buf_size - sizeof(struct rpmsg_hdr); } static int rpmsg_recv_single(struct virtproc_info *vrp, struct device *dev, @@ -672,7 +672,7 @@ static int rpmsg_recv_single(struct virtproc_info *vrp, struct device *dev, * We currently use fixed-sized buffers, so trivially sanitize * the reported payload length. */ - if (len > vrp->buf_size || + if (len > vrp->rx_buf_size || msg_len > (len - sizeof(struct rpmsg_hdr))) { dev_warn(dev, "inbound msg too big: (%d, %d)\n", len, msg_len); return -EINVAL; @@ -705,7 +705,7 @@ static int rpmsg_recv_single(struct virtproc_info *vrp, struct device *dev, dev_warn_ratelimited(dev, "msg received with no recipient\n"); /* publish the real size of the buffer */ - rpmsg_sg_init(&sg, msg, vrp->buf_size); + rpmsg_sg_init(&sg, msg, vrp->rx_buf_size); /* add the buffer back to the remote processor's virtqueue */ err = virtqueue_add_inbuf(vrp->rvq, &sg, 1, msg, GFP_KERNEL); @@ -809,6 +809,65 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl) device_unregister(&rpdev_ctrl->dev); } +static int rpmsg_virtio_get_buf_size(struct virtproc_info *vrp) +{ + struct virtio_device *vdev; + u8 version; + u16 size; + + vdev = vrp->vdev; + + /* + * If VIRTIO_RPMSG_F_BUFSZ feature is supported, then configure buf + * size from virtio device config space from the resource table. + * If the feature is not supported, then assign default buf size. + */ + if (virtio_has_feature(vdev, VIRTIO_RPMSG_F_BUFSZ)) { + virtio_cread(vdev, struct virtio_rpmsg_config, + version, &version); + + /* for now we support only v1 */ + if (version != RPMSG_VDEV_CONFIG_V1) { + dev_err(&vdev->dev, + "unsupported vdev config version %u\n", version); + return -EINVAL; + } + + /* size of the config space must match */ + virtio_cread(vdev, struct virtio_rpmsg_config, + size, &size); + if (size != sizeof(struct virtio_rpmsg_config)) { + dev_err(&vdev->dev, "invalid size of vdev config %u\n", + size); + return -EINVAL; + } + + /* note: tx and rx are defined from remote view */ + virtio_cread(vdev, struct virtio_rpmsg_config, + txbuf_size, &vrp->rx_buf_size); + virtio_cread(vdev, struct virtio_rpmsg_config, + rxbuf_size, &vrp->tx_buf_size); + + /* The buffers must hold at least the rpmsg header */ + if (vrp->rx_buf_size < sizeof(struct rpmsg_hdr) || + vrp->tx_buf_size < sizeof(struct rpmsg_hdr)) { + dev_err(&vdev->dev, + "bad vdev config: rx buf sz = %u, tx buf sz = %u\n", + vrp->rx_buf_size, vrp->tx_buf_size); + return -EINVAL; + } + + dev_dbg(&vdev->dev, + "vdev config: ver=%u, rx sz = 0x%x, tx sz = 0x%x\n", + version, vrp->rx_buf_size, vrp->tx_buf_size); + } else { + vrp->rx_buf_size = DEFAULT_RPMSG_BUF_SIZE; + vrp->tx_buf_size = DEFAULT_RPMSG_BUF_SIZE; + } + + return 0; +} + static int rpmsg_probe(struct virtio_device *vdev) { struct virtqueue_info vqs_info[] = { @@ -854,9 +913,12 @@ static int rpmsg_probe(struct virtio_device *vdev) else vrp->num_tx_buf = MAX_RPMSG_NUM_BUFS; - vrp->buf_size = MAX_RPMSG_BUF_SIZE; + err = rpmsg_virtio_get_buf_size(vrp); + if (err) + goto vqs_del; - total_buf_space = (vrp->num_rx_buf + vrp->num_tx_buf) * vrp->buf_size; + total_buf_space = (vrp->num_rx_buf * vrp->rx_buf_size) + + (vrp->num_tx_buf * vrp->tx_buf_size); /* allocate coherent memory for the buffers */ bufs_va = dma_alloc_coherent(vdev->dev.parent, @@ -873,15 +935,14 @@ static int rpmsg_probe(struct virtio_device *vdev) /* first part of the buffers is dedicated for RX */ vrp->rx_bufs = bufs_va; - /* and second part is dedicated for TX */ - vrp->tx_bufs = bufs_va + vrp->num_rx_buf * vrp->buf_size; + vrp->tx_bufs = bufs_va + (vrp->num_rx_buf * vrp->rx_buf_size); /* set up the receive buffers */ for (i = 0; i < vrp->num_rx_buf; i++) { struct scatterlist sg; - void *cpu_addr = vrp->rx_bufs + i * vrp->buf_size; + void *cpu_addr = vrp->rx_bufs + i * vrp->rx_buf_size; - rpmsg_sg_init(&sg, cpu_addr, vrp->buf_size); + rpmsg_sg_init(&sg, cpu_addr, vrp->rx_buf_size); err = virtqueue_add_inbuf(vrp->rvq, &sg, 1, cpu_addr, GFP_KERNEL); @@ -964,8 +1025,8 @@ static int rpmsg_remove_device(struct device *dev, void *data) static void rpmsg_remove(struct virtio_device *vdev) { struct virtproc_info *vrp = vdev->priv; - unsigned int num_bufs = vrp->num_rx_buf + vrp->num_tx_buf; - size_t total_buf_space = num_bufs * vrp->buf_size; + size_t total_buf_space = (vrp->num_rx_buf * vrp->rx_buf_size) + + (vrp->num_tx_buf * vrp->tx_buf_size); int ret; virtio_reset_device(vdev); @@ -991,6 +1052,7 @@ static struct virtio_device_id id_table[] = { static unsigned int features[] = { VIRTIO_RPMSG_F_NS, + VIRTIO_RPMSG_F_BUFSZ, }; static struct virtio_driver virtio_ipc_driver = { diff --git a/include/linux/rpmsg/virtio_rpmsg.h b/include/linux/rpmsg/virtio_rpmsg.h new file mode 100644 index 000000000000..0872cbca4593 --- /dev/null +++ b/include/linux/rpmsg/virtio_rpmsg.h @@ -0,0 +1,41 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) Pinecone Inc. 2019 + * Copyright (C) Xiang Xiao + * Copyright (C) Advanced Micro Devices, Inc. 2026 + */ + +#ifndef _LINUX_VIRTIO_RPMSG_H +#define _LINUX_VIRTIO_RPMSG_H + +#include +#include + +/* The feature bitmap for virtio rpmsg */ +#define VIRTIO_RPMSG_F_NS 0 /* RP supports name service notifications */ +#define VIRTIO_RPMSG_F_BUFSZ 1 /* RP advertises RX/TX buffer sizes from config space */ + +/* Version of struct virtio_rpmsg_config understood by this driver */ +#define RPMSG_VDEV_CONFIG_V1 1 + +/** + * struct virtio_rpmsg_config - config space for rpmsg virtio device + * + * @version: version of this structure, currently %RPMSG_VDEV_CONFIG_V1. + * @size: size of this structure in bytes. + * @txbuf_size: Tx buf size from remote's view. For Linux this is rx buf size. + * @rxbuf_size: Rx buf size from remote's view. For Linux this is tx buf size. + * + * This is the configuration structure shared by the device and the driver, + * read when %VIRTIO_RPMSG_F_BUFSZ is negotiated. The fields are laid out so + * the structure is naturally 32-bit aligned. + */ +struct virtio_rpmsg_config { + u8 version; + __virtio16 size; + /* The tx/rx individual buffer size (if VIRTIO_RPMSG_F_BUFSZ) */ + __virtio32 txbuf_size; + __virtio32 rxbuf_size; +} __packed; + +#endif /* _LINUX_VIRTIO_RPMSG_H */ From 079844f735f7a3917bc05a78ce33e1ab3901e8d2 Mon Sep 17 00:00:00 2001 From: Tanmay Shah Date: Fri, 28 Aug 2026 07:58:51 -0700 Subject: [PATCH 5/9] docs: rpmsg: Add virtio config space details The virtio config space can provide single rpmsg buffer size in each direction. Document details of the configurable buffer size via virtio config space. Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-5-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier --- Documentation/staging/rpmsg.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/Documentation/staging/rpmsg.rst b/Documentation/staging/rpmsg.rst index 63612b7ee120..017867383fd9 100644 --- a/Documentation/staging/rpmsg.rst +++ b/Documentation/staging/rpmsg.rst @@ -299,3 +299,20 @@ by the bus, and can then start sending messages to the remote service. The plan is also to add static creation of rpmsg channels via the virtio config space, but it's not implemented yet. + +Configurable buffer sizes +========================= + +By default each rpmsg buffer is 512 bytes, and the same size is used for both +the receive and transmit directions. Remote processors that need a different +size (for example a larger MTU, or different RX and TX queue sizes) can +advertise it through the virtio device config space by setting the +VIRTIO_RPMSG_F_BUFSZ feature bit. + +When this feature is negotiated, the driver reads struct virtio_rpmsg_config +from the config space. This structure provides the size of a single buffer for +each direction (TX and RX). The device should advertise TX/RX buffer sizes +that already satisfy the alignment constraints of its buffers. + +If the feature is not negotiated, the default 512-byte buffers are used for +both directions. From 1029c89bafc714c1b987f29e3bc124a7b63d28d5 Mon Sep 17 00:00:00 2001 From: Tanmay Shah Date: Fri, 28 Aug 2026 07:58:52 -0700 Subject: [PATCH 6/9] samples: rpmsg: Add MTU size info RPMsg MTU size can be variable now and no longer hardcoded to 512 bytes. Add log to the sample driver that prints current MTU size of the rpmsg buffer. Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-6-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier --- samples/rpmsg/rpmsg_client_sample.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/samples/rpmsg/rpmsg_client_sample.c b/samples/rpmsg/rpmsg_client_sample.c index ae5081662283..4c43436aadb6 100644 --- a/samples/rpmsg/rpmsg_client_sample.c +++ b/samples/rpmsg/rpmsg_client_sample.c @@ -52,6 +52,7 @@ static int rpmsg_sample_probe(struct rpmsg_device *rpdev) { int ret; struct instance_data *idata; + ssize_t mtu, msg_len; dev_info(&rpdev->dev, "new channel: 0x%x -> 0x%x!\n", rpdev->src, rpdev->dst); @@ -62,8 +63,25 @@ static int rpmsg_sample_probe(struct rpmsg_device *rpdev) dev_set_drvdata(&rpdev->dev, idata); + mtu = rpmsg_get_mtu(rpdev->ept); + if (mtu < 0) { + dev_warn(&rpdev->dev, "invalid rpmsg MTU size = %ld\n", mtu); + return mtu; + } + + dev_info(&rpdev->dev, "rpmsg MTU size = %ld\n", mtu); + + msg_len = strlen(MSG); + /* make sure our message fits in a single rpmsg buffer */ + if (msg_len > mtu) { + dev_err(&rpdev->dev, + "message size %zu exceeds rpmsg MTU size %ld\n", + strlen(MSG), mtu); + return -EMSGSIZE; + } + /* send a message to our remote processor */ - ret = rpmsg_send(rpdev->ept, MSG, strlen(MSG)); + ret = rpmsg_send(rpdev->ept, MSG, msg_len); if (ret) { dev_err(&rpdev->dev, "rpmsg_send failed: %d\n", ret); return ret; From c39c2cdbde1f2ad9e2886167e55ad6b4c4907d7f Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Tue, 8 Sep 2026 15:10:06 -0700 Subject: [PATCH 7/9] samples: rpmsg: Fix mtu printk specifiers When building rpmsg_client_sample.c for a 32-bit platform, such as during arm allmodconfig, there are a few warnings due to using an incorrect specifier for mtu: samples/rpmsg/rpmsg_client_sample.c:68:59: error: format specifies type 'long' but the argument has type 'ssize_t' (aka 'int') [-Werror,-Wformat] 68 | dev_warn(&rpdev->dev, "invalid rpmsg MTU size = %ld\n", mtu); | ~~~ ^~~ | %zd ... samples/rpmsg/rpmsg_client_sample.c:72:50: error: format specifies type 'long' but the argument has type 'ssize_t' (aka 'int') [-Werror,-Wformat] 72 | dev_info(&rpdev->dev, "rpmsg MTU size = %ld\n", mtu); | ~~~ ^~~ | %zd ... samples/rpmsg/rpmsg_client_sample.c:79:17: error: format specifies type 'long' but the argument has type 'ssize_t' (aka 'int') [-Werror,-Wformat] 78 | "message size %zu exceeds rpmsg MTU size %ld\n", | ~~~ | %zd 79 | strlen(MSG), mtu); | ^~~ Use '%zd', the proper specifier for a 'ssize_t' variable, to clear up the warning. Additionally, modify the last dev_err() call in rpmsg_sample_probe() to reuse msg_len instead of calling strlen(MSG) again and use '%zd' throughout the string consistently. Fixes: 1029c89bafc7 ("samples: rpmsg: Add MTU size info") Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20260908-samples-rpmsg-fix-mtu-print-v1-1-f995518f0a46@kernel.org Signed-off-by: Mathieu Poirier --- samples/rpmsg/rpmsg_client_sample.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samples/rpmsg/rpmsg_client_sample.c b/samples/rpmsg/rpmsg_client_sample.c index 4c43436aadb6..8c629065c64c 100644 --- a/samples/rpmsg/rpmsg_client_sample.c +++ b/samples/rpmsg/rpmsg_client_sample.c @@ -65,18 +65,18 @@ static int rpmsg_sample_probe(struct rpmsg_device *rpdev) mtu = rpmsg_get_mtu(rpdev->ept); if (mtu < 0) { - dev_warn(&rpdev->dev, "invalid rpmsg MTU size = %ld\n", mtu); + dev_warn(&rpdev->dev, "invalid rpmsg MTU size = %zd\n", mtu); return mtu; } - dev_info(&rpdev->dev, "rpmsg MTU size = %ld\n", mtu); + dev_info(&rpdev->dev, "rpmsg MTU size = %zd\n", mtu); msg_len = strlen(MSG); /* make sure our message fits in a single rpmsg buffer */ if (msg_len > mtu) { dev_err(&rpdev->dev, - "message size %zu exceeds rpmsg MTU size %ld\n", - strlen(MSG), mtu); + "message size %zd exceeds rpmsg MTU size %zd\n", + msg_len, mtu); return -EMSGSIZE; } From 00e100cfbf7bc159e462df16832cddeaf2cab770 Mon Sep 17 00:00:00 2001 From: Avi Weiss Date: Tue, 13 Oct 2026 10:47:44 +0300 Subject: [PATCH 8/9] rpmsg: mtk: release channel OF node on device teardown mtk_rpmsg_match_device_subnode() returns a referenced OF child node, which is stored in rpdev->dev.of_node. mtk_rpmsg_release_device() later frees the containing allocation without dropping that ref. Release the OF node when the RPMsg device is destroyed. Fixes: 7017996951fd ("rpmsg: add rpmsg support for mt8183 SCP.") Signed-off-by: Avi Weiss Link: https://lore.kernel.org/r/20261013074744.942560-1-thnkslprpt@gmail.com Signed-off-by: Mathieu Poirier --- drivers/rpmsg/mtk_rpmsg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rpmsg/mtk_rpmsg.c b/drivers/rpmsg/mtk_rpmsg.c index 1b670ed54cfa..430a9b2aa7bb 100644 --- a/drivers/rpmsg/mtk_rpmsg.c +++ b/drivers/rpmsg/mtk_rpmsg.c @@ -168,6 +168,7 @@ static void mtk_rpmsg_release_device(struct device *dev) struct rpmsg_device *rpdev = to_rpmsg_device(dev); struct mtk_rpmsg_device *mdev = to_mtk_rpmsg_device(rpdev); + of_node_put(dev->of_node); kfree(mdev); } From 7dd4cffdf4c2a496ccf783303a03d687a2127baf Mon Sep 17 00:00:00 2001 From: Atul Akella Date: Tue, 13 Oct 2026 21:30:55 +0530 Subject: [PATCH 9/9] rpmsg: virtio: fix error handling in TX buffer wait The TX buffer wait loop in rpmsg_send_offchannel_raw() ignores the possibility of wait_event_interruptible_timeout() returning a negative value, which happens when the wait is interrupted by a signal. In that case the loop spins back around and re-arms the wait instead of propagating the signal, which can stall a task that is trying to be killed. Separately, on a genuine timeout (return value 0) the function returns -ERESTARTSYS, which is reserved for signal-interrupted syscalls that the kernel may restart. A timeout is not a signal and should not be treated as restartable; return -ETIMEDOUT instead. Handle both cases explicitly: return err directly when negative, and return -ETIMEDOUT on timeout. Fixes: bcabbccabffe ("rpmsg: add virtio-based remote processor messaging bus") Signed-off-by: Atul Akella Link: https://lore.kernel.org/r/20261013160055.1362-1-atul.akella@gmail.com Signed-off-by: Mathieu Poirier --- drivers/rpmsg/virtio_rpmsg_bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 40ec93fedde9..23ff6c8b7a20 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -535,10 +535,13 @@ static int rpmsg_send_offchannel_raw(struct rpmsg_device *rpdev, (msg = get_a_tx_buf(vrp)), msecs_to_jiffies(15000)); + if (err < 0) + return err; + /* timeout ? */ if (!err) { dev_err(dev, "timeout waiting for a tx buffer\n"); - return -ERESTARTSYS; + return -ETIMEDOUT; } }