[PATCH 0/5] rpmsg: Cleanup, fixes, and RX path optimization

[PATCH 0/5] rpmsg: Cleanup, fixes, and RX path optimization

[Zhongqiu Han]

This patch series introduces several improvements to the rpmsg subsystem,
including minor cleanups, correctness fixes and a performance optimization
in the virtio transport layer.

Summary:
- Cleanup and API usage improvements (sysfs_emit, comment fixes)
- Documentation corrections
- Proper error handling for dev_set_name()
- Performance optimization in virtio RX path using RCU

The last patch reduces lock contention in a read-heavy hot path by
replacing mutex-based endpoint lookup with RCU-based lookup. This is a
performance optimization only; no functional change.

Zhongqiu Han (5):
  rpmsg: Replace sprintf() with sysfs_emit() in sysfs show
  rpmsg: core: Fix incorrect return value documentation
  rpmsg: char: Fix typo in comment
  rpmsg: Handle dev_set_name() failures properly
  rpmsg: virtio: Optimize endpoint lookup in RX path with RCU

 Documentation/staging/rpmsg.rst  |  1 -
 drivers/rpmsg/qcom_glink_smem.c  |  8 +++++++-
 drivers/rpmsg/qcom_smd.c         | 10 ++++++++--
 drivers/rpmsg/rpmsg_char.c       | 13 ++++++++-----
 drivers/rpmsg/rpmsg_core.c       | 14 ++++++++------
 drivers/rpmsg/rpmsg_ctrl.c       |  5 ++++-
 drivers/rpmsg/virtio_rpmsg_bus.c | 11 +++++++++--
 7 files changed, 44 insertions(+), 18 deletions(-)


base-commit: 563c8dd425b59e44470e28519107b1efc99f4c7b
-- 
2.43.0

[PATCH 1/5] rpmsg: Replace sprintf() with sysfs_emit() in sysfs show

[Zhongqiu Han]

Use sysfs_emit() instead of sprintf() in sysfs attribute show functions.
sysfs_emit() is the recommended API for sysfs output as it provides buffer
overflow protection and proper formatting.

No functional changes.

Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
---
 drivers/rpmsg/qcom_smd.c   | 2 +-
 drivers/rpmsg/rpmsg_char.c | 6 +++---
 drivers/rpmsg/rpmsg_core.c | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 42594f5ee438..2793096aba45 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1458,7 +1458,7 @@ static ssize_t rpmsg_name_show(struct device *dev,
 {
 	struct qcom_smd_edge *edge = to_smd_edge(dev);
 
-	return sprintf(buf, "%s\n", edge->name);
+	return sysfs_emit(buf, "%s\n", edge->name);
 }
 static DEVICE_ATTR_RO(rpmsg_name);
 
diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 96fcdd2d7093..3287e7941c8c 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -365,7 +365,7 @@ static ssize_t name_show(struct device *dev, struct device_attribute *attr,
 {
 	struct rpmsg_eptdev *eptdev = dev_get_drvdata(dev);
 
-	return sprintf(buf, "%s\n", eptdev->chinfo.name);
+	return sysfs_emit(buf, "%s\n", eptdev->chinfo.name);
 }
 static DEVICE_ATTR_RO(name);
 
@@ -374,7 +374,7 @@ static ssize_t src_show(struct device *dev, struct device_attribute *attr,
 {
 	struct rpmsg_eptdev *eptdev = dev_get_drvdata(dev);
 
-	return sprintf(buf, "%d\n", eptdev->chinfo.src);
+	return sysfs_emit(buf, "%d\n", eptdev->chinfo.src);
 }
 static DEVICE_ATTR_RO(src);
 
@@ -383,7 +383,7 @@ static ssize_t dst_show(struct device *dev, struct device_attribute *attr,
 {
 	struct rpmsg_eptdev *eptdev = dev_get_drvdata(dev);
 
-	return sprintf(buf, "%d\n", eptdev->chinfo.dst);
+	return sysfs_emit(buf, "%d\n", eptdev->chinfo.dst);
 }
 static DEVICE_ATTR_RO(dst);
 
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 96964745065b..bcfd17e5309e 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -348,7 +348,7 @@ field##_show(struct device *dev,					\
 {									\
 	struct rpmsg_device *rpdev = to_rpmsg_device(dev);		\
 									\
-	return sprintf(buf, format_string, rpdev->path);		\
+	return sysfs_emit(buf, format_string, rpdev->path);		\
 }									\
 static DEVICE_ATTR_RO(field);
 
@@ -395,7 +395,7 @@ static ssize_t modalias_show(struct device *dev,
 	if (len != -ENODEV)
 		return len;
 
-	return sprintf(buf, RPMSG_DEVICE_MODALIAS_FMT "\n", rpdev->id.name);
+	return sysfs_emit(buf, RPMSG_DEVICE_MODALIAS_FMT "\n", rpdev->id.name);
 }
 static DEVICE_ATTR_RO(modalias);
 
-- 
2.43.0

Re: [PATCH 1/5] rpmsg: Replace sprintf() with sysfs_emit() in sysfs show

[Chris Lew]

On Wed, Dec 17, 2025 at 02:51:08PM +0800, Zhongqiu Han wrote:
> Use sysfs_emit() instead of sprintf() in sysfs attribute show functions.
> sysfs_emit() is the recommended API for sysfs output as it provides buffer
> overflow protection and proper formatting.
> 
> No functional changes.
> 
> Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> ---
>  drivers/rpmsg/qcom_smd.c   | 2 +-
>  drivers/rpmsg/rpmsg_char.c | 6 +++---
>  drivers/rpmsg/rpmsg_core.c | 4 ++--
>  3 files changed, 6 insertions(+), 6 deletions(-)
>

Reviewed-by: Chris Lew <christopher.lew@oss.qualcomm.com>

[PATCH 2/5] rpmsg: core: Fix incorrect return value documentation

[Zhongqiu Han]

The unregister_rpmsg_driver() function has a void return type but the
documentation incorrectly described a return value. Remove the incorrect
return value documentation to match the actual function signature.

Fixes: bcabbccabffe ("rpmsg: add virtio-based remote processor messaging bus")
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
---
 Documentation/staging/rpmsg.rst | 1 -
 drivers/rpmsg/rpmsg_core.c      | 2 --
 2 files changed, 3 deletions(-)

diff --git a/Documentation/staging/rpmsg.rst b/Documentation/staging/rpmsg.rst
index 40282cca86ca..11fc22f3736a 100644
--- a/Documentation/staging/rpmsg.rst
+++ b/Documentation/staging/rpmsg.rst
@@ -212,7 +212,6 @@ be probed with.
 
 unregisters an rpmsg driver from the rpmsg bus. user should provide
 a pointer to a previously-registered rpmsg_driver struct.
-Returns 0 on success, and an appropriate error value on failure.
 
 
 Typical usage
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index bcfd17e5309e..a5dd09f19b14 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -627,8 +627,6 @@ EXPORT_SYMBOL(__register_rpmsg_driver);
 /**
  * unregister_rpmsg_driver() - unregister an rpmsg driver from the rpmsg bus
  * @rpdrv: pointer to a struct rpmsg_driver
- *
- * Return: 0 on success, and an appropriate error value on failure.
  */
 void unregister_rpmsg_driver(struct rpmsg_driver *rpdrv)
 {
-- 
2.43.0

Re: [PATCH 2/5] rpmsg: core: Fix incorrect return value documentation

[Chris Lew]

On Wed, Dec 17, 2025 at 02:51:09PM +0800, Zhongqiu Han wrote:
> The unregister_rpmsg_driver() function has a void return type but the
> documentation incorrectly described a return value. Remove the incorrect
> return value documentation to match the actual function signature.
> 
> Fixes: bcabbccabffe ("rpmsg: add virtio-based remote processor messaging bus")
> Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> ---
>  Documentation/staging/rpmsg.rst | 1 -
>  drivers/rpmsg/rpmsg_core.c      | 2 --
>  2 files changed, 3 deletions(-)
> 

Reviewed-by: Chris Lew <christopher.lew@oss.qualcomm.com>

[PATCH 3/5] rpmsg: char: Fix typo in comment

[Zhongqiu Han]

Correct a spelling mistake in a comment: "Storedit" → "Stored it".

Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
---
 drivers/rpmsg/rpmsg_char.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 3287e7941c8c..073d56858b88 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -504,7 +504,7 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev)
 
 	/*
 	 * The rpmsg_ept_cb uses *priv parameter to get its rpmsg_eptdev context.
-	 * Storedit in default_ept *priv field.
+	 * Stored it in default_ept *priv field.
 	 */
 	eptdev->default_ept->priv = eptdev;
 
-- 
2.43.0

Re: [PATCH 3/5] rpmsg: char: Fix typo in comment

[Chris Lew]

On Wed, Dec 17, 2025 at 02:51:10PM +0800, Zhongqiu Han wrote:
> Correct a spelling mistake in a comment: "Storedit" → "Stored it".
> 
> Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> ---
>  drivers/rpmsg/rpmsg_char.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: Chris Lew <christopher.lew@oss.qualcomm.com>

[PATCH 4/5] rpmsg: Handle dev_set_name() failures properly

[Zhongqiu Han]

The dev_set_name() function can fail and return an error code. Ignoring
these failures leads to undefined behavior as the device lacks a proper
name, which may cause subsequent operations like device_register() or
sysfs interactions to crash or behave unpredictably.

Add error checking across all rpmsg drivers to ensure proper error
propagation and resource cleanup.

Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
---
 drivers/rpmsg/qcom_glink_smem.c | 8 +++++++-
 drivers/rpmsg/qcom_smd.c        | 8 +++++++-
 drivers/rpmsg/rpmsg_char.c      | 5 ++++-
 drivers/rpmsg/rpmsg_core.c      | 8 ++++++--
 drivers/rpmsg/rpmsg_ctrl.c      | 5 ++++-
 5 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c
index 7a982c60a8dd..843bf04eecb3 100644
--- a/drivers/rpmsg/qcom_glink_smem.c
+++ b/drivers/rpmsg/qcom_glink_smem.c
@@ -239,7 +239,13 @@ struct qcom_glink_smem *qcom_glink_smem_register(struct device *parent,
 	dev->parent = parent;
 	dev->of_node = node;
 	dev->release = qcom_glink_smem_release;
-	dev_set_name(dev, "%s:%pOFn", dev_name(parent->parent), node);
+	ret = dev_set_name(dev, "%s:%pOFn", dev_name(parent->parent), node);
+	if (ret) {
+		pr_err("failed to set device name\n");
+		put_device(dev);
+		return ERR_PTR(ret);
+	}
+
 	ret = device_register(dev);
 	if (ret) {
 		pr_err("failed to register glink edge\n");
diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 2793096aba45..61f580ee04ec 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1494,7 +1494,13 @@ struct qcom_smd_edge *qcom_smd_register_edge(struct device *parent,
 	edge->dev.release = qcom_smd_edge_release;
 	edge->dev.of_node = node;
 	edge->dev.groups = qcom_smd_edge_groups;
-	dev_set_name(&edge->dev, "%s:%pOFn", dev_name(parent), node);
+	ret = dev_set_name(&edge->dev, "%s:%pOFn", dev_name(parent), node);
+	if (ret) {
+		pr_err("failed to set device name\n");
+		put_device(&edge->dev);
+		return ERR_PTR(ret);
+	}
+
 	ret = device_register(&edge->dev);
 	if (ret) {
 		pr_err("failed to register smd edge\n");
diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 073d56858b88..89d232d80df2 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -450,7 +450,10 @@ static int rpmsg_chrdev_eptdev_add(struct rpmsg_eptdev *eptdev, struct rpmsg_cha
 	if (ret < 0)
 		goto free_minor_ida;
 	dev->id = ret;
-	dev_set_name(dev, "rpmsg%d", ret);
+
+	ret = dev_set_name(dev, "rpmsg%d", ret);
+	if (ret)
+		goto free_ept_ida;
 
 	ret = cdev_device_add(&eptdev->cdev, &eptdev->dev);
 	if (ret)
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index a5dd09f19b14..49737d69b44c 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -553,8 +553,12 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
 	if (driver_override)
 		strscpy_pad(rpdev->id.name, driver_override, RPMSG_NAME_SIZE);
 
-	dev_set_name(dev, "%s.%s.%d.%d", dev_name(dev->parent),
-		     rpdev->id.name, rpdev->src, rpdev->dst);
+	ret = dev_set_name(dev, "%s.%s.%d.%d", dev_name(dev->parent),
+			   rpdev->id.name, rpdev->src, rpdev->dst);
+	if (ret) {
+		pr_err("failed to set device name\n");
+		return ret;
+	}
 
 	dev->bus = &rpmsg_bus;
 
diff --git a/drivers/rpmsg/rpmsg_ctrl.c b/drivers/rpmsg/rpmsg_ctrl.c
index 28f57945ccd9..3e2cfd16df6a 100644
--- a/drivers/rpmsg/rpmsg_ctrl.c
+++ b/drivers/rpmsg/rpmsg_ctrl.c
@@ -165,7 +165,10 @@ static int rpmsg_ctrldev_probe(struct rpmsg_device *rpdev)
 	if (ret < 0)
 		goto free_minor_ida;
 	dev->id = ret;
-	dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret);
+
+	ret = dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret);
+	if (ret)
+		goto free_ctrl_ida;
 
 	ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev);
 	if (ret)
-- 
2.43.0

[RFC PATCH 5/5] rpmsg: virtio: Optimize endpoint lookup in RX path with RCU

[Zhongqiu Han]

Endpoint lookup in the receive path acts as a demultiplexer routing
incoming messages to the appropriate endpoint. This is a read-heavy
operation (frequent message receives) with infrequent writes
(endpoint creation/destruction). Since idr_find() is safe under RCU
read-side protection, RCU can be used to optimize this path.

Convert endpoint lookup to use RCU:
- Read path: Use rcu_read_lock/unlock for lockless lookup
- Destroy path: Add synchronize_rcu() after endpoint removal

This reduces lock contention in the hot receive path.

RCU safety note:
When idr_alloc() returns, the endpoint becomes immediately visible to
idr_find(), but ept->addr might not yet be set. This creates a theoretical
window where RX could find an endpoint with uninitialized addr.

This is safe because:
1) When endpoints are created via rpmsg core callbacks, initialization
   completes before announce_create() is sent. Remote processors only
   send messages after receiving the announcement.
2) For manually created endpoints, drivers control timing and typically
   do not announce until ready.

Thus, messages only arrive after ept->addr is initialized, making this
RCU optimization safe.

No functional change except reduced contention.

Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
---
 drivers/rpmsg/virtio_rpmsg_bus.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 79d983055b4d..4cbb8a8aaec5 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/rcupdate.h>
 #include <linux/rpmsg.h>
 #include <linux/rpmsg/byteorder.h>
 #include <linux/rpmsg/ns.h>
@@ -297,6 +298,12 @@ __rpmsg_destroy_ept(struct virtproc_info *vrp, struct rpmsg_endpoint *ept)
 	idr_remove(&vrp->endpoints, ept->addr);
 	mutex_unlock(&vrp->endpoints_lock);
 
+	/*
+	 * Wait for any ongoing RCU read-side critical sections to complete.
+	 * This ensures no one is accessing the endpoint after removal.
+	 */
+	synchronize_rcu();
+
 	/* make sure in-flight inbound messages won't invoke cb anymore */
 	mutex_lock(&ept->cb_lock);
 	ept->cb = NULL;
@@ -680,7 +687,7 @@ static int rpmsg_recv_single(struct virtproc_info *vrp, struct device *dev,
 	}
 
 	/* use the dst addr to fetch the callback of the appropriate user */
-	mutex_lock(&vrp->endpoints_lock);
+	rcu_read_lock();
 
 	ept = idr_find(&vrp->endpoints, __rpmsg32_to_cpu(little_endian, msg->dst));
 
@@ -688,7 +695,7 @@ static int rpmsg_recv_single(struct virtproc_info *vrp, struct device *dev,
 	if (ept)
 		kref_get(&ept->refcount);
 
-	mutex_unlock(&vrp->endpoints_lock);
+	rcu_read_unlock();
 
 	if (ept) {
 		/* make sure ept->cb doesn't go away while we use it */
-- 
2.43.0