kernel/git/next/linux-next.git/drivers/rpmsg, branch master

rpmsg: virtio_rpmsg_bus: Get buffer size from config space

2026-09-04T20:13:09+00:00

512 bytes isn't always suitable for all the cases, let firmware maker decide the best value from the resource table. Enabled by VIRTIO_RPMSG_F_BUFSZ feature bit. Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-4-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier

rpmsg: virtio_rpmsg_bus: Allow different size of tx and rx bufs

2026-09-04T19:27:55+00:00

Current design allocates memory for tx and rx buffers equally. The throughput can be increased if the user is allowed to configure number of tx and rx buffers as required. Hence, do not split number of tx & rx buffers into half, but decide based on respective vring size. Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-3-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier

rpmsg: virtio_rpmsg_bus: Rename rbufs and sbufs

2026-09-04T19:27:23+00:00

rename variables with clear names. %s/rbufs/rx_bufs/ %s/sbufs/tx_bufs/ %s/last_sbuf/last_tx_buf/ Signed-off-by: Tanmay Shah Acked-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20260828145853.2843486-2-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier

rpmsg: glink: smem: order FIFO read after availability check

2026-07-14T03:11:52+00:00

glink_smem_rx_peek() reads the RX FIFO payload after the caller has determined data is available via glink_smem_rx_avail(), which reads the remote-updated head index. A control dependency between the head read and the subsequent payload read does not order the two loads, so the CPU may speculatively read the FIFO before observing the head update and consume stale data the remote has not yet published. Add rmb() in glink_smem_rx_peek() before the memcpy_fromio() so the availability (head) read is ordered ahead of the FIFO payload read, matching the consumer pattern in Documentation/core-api/circular-buffers.rst. Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport") Cc: stable@vger.kernel.org Signed-off-by: Chunkai Deng Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260618-rpmsg-glink-smem-mb-v1-1-68a026453a69@oss.qualcomm.com Signed-off-by: Bjorn Andersson

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

2026-07-14T02:55:29+00:00

During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414 <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock. Co-developed-by: Deepak Kumar Singh Signed-off-by: Deepak Kumar Singh Signed-off-by: Vishnu Santhosh Tested-by: Bjorn Andersson Fixes: a53e356df548 ("rpmsg: glink: fix rpmsg device leak") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260604-rpmsg-glink-fix-deadlock-destroy-ept-v1-1-b8a54ad1e4fd@oss.qualcomm.com Signed-off-by: Bjorn Andersson

rpmsg: char: Check for ongoing chrdev destroy

2026-07-09T20:11:17+00:00

A null pointer panic is observed when stopping a remoteproc and closing a character device using the RPMSG_DESTROY_EPT_IOCTL. There is a race where each context calls rpmsg_chrdev_eptdev_destroy(). The thread that runs second will call cdev_device_del() for a second time, which fails because the first call already removed the device from sysfs. Add a check at the beginning of destroy and exit early if the destroy call has already been done. [ 26.654130] Call trace [ 26.656658] kernfs_find_and_get_ns+0x28/0x8 [ 26.661140] sysfs_unmerge_group+0x2c/0x7 [ 26.665357] dpm_sysfs_remove+0x38/0x8 [ 26.669305] device_del+0xa4/0x3e [ 26.672811] cdev_device_del+0x28/0x7 [ 26.676675] rpmsg_chrdev_eptdev_destroy+0x68/0x98 [ 26.682765] rpmsg_eptdev_ioctl+0x130/0x11c8 [ 26.688318] __arm64_sys_ioctl+0xb4/0x10 [ 26.692448] invoke_syscall+0x50/0x12 [ 26.696312] el0_svc_common.constprop.0+0xc8/0xf [ 26.701151] do_el0_svc+0x24/0x3 [ 26.704570] el0_svc+0x40/0x17 [ 26.707810] el0t_64_sync_handler+0x120/0x13 [ 26.712288] el0t_64_sync+0x1a0/0x1a Signed-off-by: Chris Lew Signed-off-by: Vishnu Santhosh Link: https://lore.kernel.org/r/20260406-rpmsg-char-fix-chrdev-destroy-race-v1-1-7317434fa246@oss.qualcomm.com Signed-off-by: Bjorn Andersson

rpmsg: glink: Replace strcpy() with strscpy()

2026-07-09T19:46:45+00:00

Replace strcpy() with the safer strscpy() to address unsafe API usage warnings[1] from static analysis tools, as strcpy() performs no bounds checking on the destination buffer. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Sudeepgoud Patil Signed-off-by: Vishnu Santhosh Reviewed-by: Chris Lew Link: https://lore.kernel.org/r/20251211-rpmsg-glink-strcpy-replace-v1-1-be06308e5724@oss.qualcomm.com Signed-off-by: Bjorn Andersson

rpmsg: core: Fix incorrect return value documentation

2026-07-09T19:45:37+00:00

The unregister_rpmsg_driver() function has a void return type but the documentation incorrectly described a return value. Remove the incorrect return value documentation to match the actual function signature. Fixes: bcabbccabffe ("rpmsg: add virtio-based remote processor messaging bus") Signed-off-by: Zhongqiu Han Reviewed-by: Chris Lew Link: https://lore.kernel.org/r/20251217065112.18392-3-zhongqiu.han@oss.qualcomm.com Signed-off-by: Bjorn Andersson

rpmsg: Replace sprintf() with sysfs_emit() in sysfs show

2026-07-09T19:45:34+00:00

Use sysfs_emit() instead of sprintf() in sysfs attribute show functions. sysfs_emit() is the recommended API for sysfs output as it provides buffer overflow protection and proper formatting. No functional changes. Signed-off-by: Zhongqiu Han Reviewed-by: Chris Lew Link: https://lore.kernel.org/r/20251217065112.18392-2-zhongqiu.han@oss.qualcomm.com Signed-off-by: Bjorn Andersson

Merge tag 'rpmsg-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

2026-06-21T06:31:15+00:00

Pull rpmsg update from Bjorn Andersson: - Fix use-after-free in rpmsg-char driver * tag 'rpmsg-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: char: Fix use-after-free on probe error path