6 files changed, 645 insertions, 0 deletions

diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index 81c7f2bb7daf..08244bea5048 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -321,6 +321,7 @@ Code  Seq#(hex)	Include File		Comments
 0xB1    00-1F   PPPoX                   <mailto:mostrows@styx.uwaterloo.ca>
 0xB3    00      linux/mmc/ioctl.h
 0xB4    00-0F   linux/gpio.h            <mailto:linux-gpio@vger.kernel.org>
+0xB5    00-0F   uapi/linux/rpmsg.h      <mailto:linux-remoteproc@vger.kernel.org>
 0xC0    00-0F   linux/usb/iowarrior.h
 0xCA    00-0F   uapi/misc/cxl.h
 0xCA    80-8F   uapi/scsi/cxlflash_ioctl.h
diff --git a/drivers/rpmsg/Kconfig b/drivers/rpmsg/Kconfig
index de31c5f14dd9..fa0d582efb3d 100644
--- a/drivers/rpmsg/Kconfig
+++ b/drivers/rpmsg/Kconfig
@@ -4,6 +4,14 @@ menu "Rpmsg drivers"
 config RPMSG
         tristate
 
+config RPMSG_CHAR
+        tristate "RPMSG device interface"
+        depends on RPMSG
+        help
+          Say Y here to export rpmsg endpoints as device files, usually found
+          in /dev. They make it possible for user-space programs to send and
+          receive rpmsg packets.
+
 config RPMSG_QCOM_SMD
         tristate "Qualcomm Shared Memory Driver (SMD)"
         depends on QCOM_SMEM
diff --git a/drivers/rpmsg/Makefile b/drivers/rpmsg/Makefile
index ae9c9132cf76..fae9a6d548fb 100644
--- a/drivers/rpmsg/Makefile
+++ b/drivers/rpmsg/Makefile
@@ -1,3 +1,4 @@
 obj-$(CONFIG_RPMSG)             += rpmsg_core.o
+obj-$(CONFIG_RPMSG_CHAR)        += rpmsg_char.o
 obj-$(CONFIG_RPMSG_QCOM_SMD)    += qcom_smd.o
 obj-$(CONFIG_RPMSG_VIRTIO)      += virtio_rpmsg_bus.o
diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
new file mode 100644
index 000000000000..a78b6b79cea4
--- /dev/null
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -0,0 +1,585 @@
+/*
+ * Copyright (c) 2016, Linaro Ltd.
+ * Copyright (c) 2012, Michal Simek <monstr@monstr.eu>
+ * Copyright (c) 2012, PetaLogix
+ * Copyright (c) 2011, Texas Instruments, Inc.
+ * Copyright (c) 2011, Google, Inc.
+ *
+ * Based on rpmsg performance statistics driver by Michal Simek, which in turn
+ * was based on TI & Google OMX rpmsg driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/idr.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/poll.h>
+#include <linux/rpmsg.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <uapi/linux/rpmsg.h>
+
+#include "rpmsg_internal.h"
+
+#define RPMSG_DEV_MAX   (MINORMASK + 1)
+
+static dev_t rpmsg_major;
+static struct class *rpmsg_class;
+
+static DEFINE_IDA(rpmsg_ctrl_ida);
+static DEFINE_IDA(rpmsg_ept_ida);
+static DEFINE_IDA(rpmsg_minor_ida);
+
+#define dev_to_eptdev(dev) container_of(dev, struct rpmsg_eptdev, dev)
+#define cdev_to_eptdev(i_cdev) container_of(i_cdev, struct rpmsg_eptdev, cdev)
+
+#define dev_to_ctrldev(dev) container_of(dev, struct rpmsg_ctrldev, dev)
+#define cdev_to_ctrldev(i_cdev) container_of(i_cdev, struct rpmsg_ctrldev, cdev)
+
+/**
+ * struct rpmsg_ctrldev - control device for instantiating endpoint devices
+ * @rpdev:      underlaying rpmsg device
+ * @cdev:       cdev for the ctrl device
+ * @dev:        device for the ctrl device
+ */
+struct rpmsg_ctrldev {
+        struct rpmsg_device *rpdev;
+        struct cdev cdev;
+        struct device dev;
+};
+
+/**
+ * struct rpmsg_eptdev - endpoint device context
+ * @dev:        endpoint device
+ * @cdev:       cdev for the endpoint device
+ * @rpdev:      underlaying rpmsg device
+ * @chinfo:     info used to open the endpoint
+ * @ept_lock:   synchronization of @ept modifications
+ * @ept:        rpmsg endpoint reference, when open
+ * @queue_lock: synchronization of @queue operations
+ * @queue:      incoming message queue
+ * @readq:      wait object for incoming queue
+ */
+struct rpmsg_eptdev {
+        struct device dev;
+        struct cdev cdev;
+
+        struct rpmsg_device *rpdev;
+        struct rpmsg_channel_info chinfo;
+
+        struct mutex ept_lock;
+        struct rpmsg_endpoint *ept;
+
+        spinlock_t queue_lock;
+        struct sk_buff_head queue;
+        wait_queue_head_t readq;
+};
+
+static int rpmsg_eptdev_destroy(struct device *dev, void *data)
+{
+        struct rpmsg_eptdev *eptdev = dev_to_eptdev(dev);
+
+        mutex_lock(&eptdev->ept_lock);
+        if (eptdev->ept) {
+                rpmsg_destroy_ept(eptdev->ept);
+                eptdev->ept = NULL;
+        }
+        mutex_unlock(&eptdev->ept_lock);
+
+        /* wake up any blocked readers */
+        wake_up_interruptible(&eptdev->readq);
+
+        device_del(&eptdev->dev);
+        put_device(&eptdev->dev);
+
+        return 0;
+}
+
+static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len,
+                        void *priv, u32 addr)
+{
+        struct rpmsg_eptdev *eptdev = priv;
+        struct sk_buff *skb;
+
+        skb = alloc_skb(len, GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        memcpy(skb_put(skb, len), buf, len);
+
+        spin_lock(&eptdev->queue_lock);
+        skb_queue_tail(&eptdev->queue, skb);
+        spin_unlock(&eptdev->queue_lock);
+
+        /* wake up any blocking processes, waiting for new data */
+        wake_up_interruptible(&eptdev->readq);
+
+        return 0;
+}
+
+static int rpmsg_eptdev_open(struct inode *inode, struct file *filp)
+{
+        struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev);
+        struct rpmsg_endpoint *ept;
+        struct rpmsg_device *rpdev = eptdev->rpdev;
+        struct device *dev = &eptdev->dev;
+
+        get_device(dev);
+
+        ept = rpmsg_create_ept(rpdev, rpmsg_ept_cb, eptdev, eptdev->chinfo);
+        if (!ept) {
+                dev_err(dev, "failed to open %s\n", eptdev->chinfo.name);
+                put_device(dev);
+                return -EINVAL;
+        }
+
+        eptdev->ept = ept;
+        filp->private_data = eptdev;
+
+        return 0;
+}
+
+static int rpmsg_eptdev_release(struct inode *inode, struct file *filp)
+{
+        struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev);
+        struct device *dev = &eptdev->dev;
+        struct sk_buff *skb;
+
+        /* Close the endpoint, if it's not already destroyed by the parent */
+        mutex_lock(&eptdev->ept_lock);
+        if (eptdev->ept) {
+                rpmsg_destroy_ept(eptdev->ept);
+                eptdev->ept = NULL;
+        }
+        mutex_unlock(&eptdev->ept_lock);
+
+        /* Discard all SKBs */
+        while (!skb_queue_empty(&eptdev->queue)) {
+                skb = skb_dequeue(&eptdev->queue);