drivers/rpmsg_router: multiple fixes and improvements for multi-core stability #18085
+73
−57
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It should return 0 if there are edge that have not been established or have been destroyed at unbind Signed-off-by: yintao <yintao@xiaomi.com>
to avoid rpmsg_send() blocked when rpmsg channel is not ready Signed-off-by: ligd <liguiding1@xiaomi.com>
github-actions
bot
added
Area: Drivers
added 7 commits
January 21, 2026 21:46
when edge_ept received NS_DESTROY message to sync the behavior with
other rpmsg transport
if (ns_msg.flags == RPMSG_NS_DESTROY) {
if (_ept)
_ept->dest_addr = RPMSG_ADDR_ANY;
...
Signed-off-by: yintao <yintao@xiaomi.com>
Use rpmsg_send_offchannel_raw to fix stuck issue avoid getting stuck when remote destroy ept. When send messages from ap to android in Rptun thread, Android may have sent NS_DESTROY through rpmsg_port and changed ept->dst to RPMSG_ADDR_ANY in rpmsg_port_ns_callback; So rptun thread may be stuck at this time because rpmsg_send detected dst_ept's dst_addr is RPMSG_ADDR_ANY. rpmsg_virtio_thread(rptun audio): rpmsg_virtio_rx_callback -> rpmsg_router_cb -> rpmsg_send(dst_ept) send to android rpmsg_port_thread (android send NS_DESTROY): rpmsg_port_ns_callback -> dst_ept->dest_addr = RPMSG_ADDR_ANY Signed-off-by: yintao <yintao@xiaomi.com>
fist free when rpmsg_port_unregister at rpmsg spi thread <free+12> <rpmsg_router_hub_ept_release+6> <rpmsg_ept_decref+28> <rpmsg_unregister_endpoint+120> <rpmsg_destroy_ept+40> <rpmsg_router_hub_unbind+22> <rpmsg_device_destory+172> <rpmsg_port_unregister+26> this thread will free r:droid and r:audio at last; But in this process, rpmsg_destroy_ept "r:droid" will send NS_destroy to audio; audio will response NS_destroy to ap; if r:droid has not been removed from the ept list yet, the rptun_audio thread on ap will occur as follows: 3 0x103016fa in kasan_check_report 4 0x103018b6 in __asan_store4_noabort 5 0x106ca352 in metal_list_del 6 in rpmsg_unregister_endpoint 7 0x106ca77a in rpmsg_destroy_ept 8 0x102db232 in rpmsg_router_hub_unbind 9 0x106cabb2 in rpmsg_virtio_ns_callback 10 0x106cad5c in rpmsg_virtio_rx_callback 11 0x106cc190 in virtqueue_notification 12 0x106ca064 in rproc_virtio_notified 13 0x106c9ad0 in remoteproc_get_notification 14 0x102dd4ba in rptun_worker at rptun/rptun.c:334 15 rptun_worker (arg=<optimized out>) at rptun/rptun.c:328 16 0x102dd974 in rptun_thread rptun/rptun.c:353 17 0x102cd558 in nxtask_start () at task/task_start.c:1 this will lead to r:audio be freed again. Signed-off-by: yintao <yintao@xiaomi.com>
…r_edge If ns_msg->flags == RPMSG_NS_CREATE_ACK, means already know peer's address so direclty use usr_ept->dest_addr Signed-off-by: yintao <yintao@xiaomi.com>
nxsig_clockwait /home/work/data/miui_codes/build_home_rom/nuttx/sched/signal/sig_timedwait.c:329 (discriminator 1) nxsig_clockwait /home/work/data/miui_codes/build_home_rom/nuttx/sched/signal/sig_timedwait.c:320 nxsig_nanosleep /home/work/data/miui_codes/build_home_rom/nuttx/sched/signal/sig_nanosleep.c:96 nxsig_usleep /home/work/data/miui_codes/build_home_rom/nuttx/sched/signal/sig_usleep.c:84 __metal_sleep_usec /home/work/data/miui_codes/build_home_rom/nuttx/drivers/../include/metal/system/nuttx/sleep.h:27 rpmsg_device_destory /home/work/data/miui_codes/build_home_rom/nuttx/drivers/rpmsg/rpmsg.c:473 rpmsg_port_unregister /home/work/data/miui_codes/build_home_rom/nuttx/drivers/rpmsg/rpmsg_port.c:751 rpmsg_port_spi_process_packet /home/work/data/miui_codes/build_home_rom/nuttx/drivers/rpmsg/rpmsg_port_spi.c:572 nxtask_start /home/work/data/miui_codes/build_home_rom/nuttx/sched/task/task_start.c:111 Signed-off-by: yintao <yintao@xiaomi.com>
Should only destroy one side endpoint when receive one side
NS destroy message.
Before:
edge1 hub edge2
destroy --> edge1 destroy
edge2 destroy
(used-after-free)
edge2 destroy <-- destroy
edge1 destory
After
edge1 hub edge2
destroy --> edge1 destroy
edge2 destroy <-- destroy
Signed-off-by: yintao <yintao@xiaomi.com>
peer_ept is a better name than dst_ept Signed-off-by: yintao <yintao@xiaomi.com>
CV-Bowen
force-pushed
the
rpmsg-router-part2
branch
from
e2cd1fe to
c99d7ab
Compare
acassis
reviewed
Jan 21, 2026
| edge = ept->priv; | ||
| if (edge == NULL) | ||
|
|
||
| if (edge) |
Contributor
There was a problem hiding this comment.
Suggested change
| if (edge) | |
| if (edge != NULL) |
| /* Retransmit data to dest edge core */ | ||
|
|
||
| if (!dst_ept) | ||
| if (!peer_ept) |
Contributor
There was a problem hiding this comment.
Suggested change
| if (!peer_ept) | |
| if (peer_ept == NULL) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR includes a series of critical fixes and improvements for the rpmsg_router driver to enhance multi-core communication stability and reliability. The changes address several race conditions, memory management issues, and edge cases that could cause system crashes or hangs in production environments.
Key Changes
rpmsg_router_hub_unbindrpmsg_send_offchannel_rawto prevent deadlock scenariosdst_addrtoRPMSG_ADDR_ANYwhen receiving NS_DESTROYdst_epttopeer_eptfor better clarityThese fixes have been validated in production environments and resolve critical stability issues in multi-core communication scenarios.
Impact
Stability
Compatibility
Code Quality
Testing
Test Environment
Test Steps
Build the system:
Run: