Re: [PATCH RFC 13/18] accel/qda: Add initial FastRPC attach and release support

[Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>]

On Tue, Feb 24, 2026 at 12:39:07AM +0530, Ekansh Gupta wrote:
> Add the initial FastRPC invocation plumbing to the QDA accelerator
> driver to support attaching to and releasing a DSP process. A new
> fastrpc_invoke_context structure tracks the state of a single remote

So, why does it embed kref?

> procedure call, including arguments, overlap handling, completion and
> GEM-based message buffers. Contexts are indexed through an xarray in
> qda_dev so that RPMsg callbacks can match responses back to the
> originating invocation.

Again, IDR? Or not?

> 
> The new qda_fastrpc implementation provides helpers to prepare
> FastRPC scalars and arguments, pack them into a QDA message backed by
> a GEM buffer and unpack responses. The FastRPC INIT_ATTACH and
> INIT_RELEASE methods are wired up via a new QDA_INIT_ATTACH ioctl and
> a postclose hook that sends a release request when a client file
> descriptor is closed. On the transport side qda_rpmsg_send_msg()
> builds and sends a fastrpc_msg over RPMsg, while qda_rpmsg_cb()
> decodes qda_invoke_rsp messages, looks up the context by its id and
> completes the corresponding wait.
> 
> This lays the foundation for QDA FastRPC method support on top of the
> existing GEM and RPMsg infrastructure, starting with the attach and
> release control flows for DSP sessions.

I think the FastRPC backing code should be a separate commit,
INIT_ATTACH another, separate commit.

> 
> Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
> ---
>  drivers/accel/qda/Makefile      |   1 +
>  drivers/accel/qda/qda_drv.c     |   5 +
>  drivers/accel/qda/qda_drv.h     |   2 +
>  drivers/accel/qda/qda_fastrpc.c | 548 ++++++++++++++++++++++++++++++++++++++++
>  drivers/accel/qda/qda_fastrpc.h | 303 ++++++++++++++++++++++
>  drivers/accel/qda/qda_ioctl.c   | 107 ++++++++
>  drivers/accel/qda/qda_ioctl.h   |  25 ++
>  drivers/accel/qda/qda_rpmsg.c   | 164 +++++++++++-
>  drivers/accel/qda/qda_rpmsg.h   |  40 +++
>  include/uapi/drm/qda_accel.h    |  19 ++
>  10 files changed, 1212 insertions(+), 2 deletions(-)
> 
> diff --git a/include/uapi/drm/qda_accel.h b/include/uapi/drm/qda_accel.h
> index ed24a7f5637e..4d3666c5b998 100644
> --- a/include/uapi/drm/qda_accel.h
> +++ b/include/uapi/drm/qda_accel.h

[moved this file to the beginning of the patch to ease reviewing]

> @@ -21,6 +21,7 @@ extern "C" {
>  #define DRM_QDA_QUERY	0x00
>  #define DRM_QDA_GEM_CREATE		0x01
>  #define DRM_QDA_GEM_MMAP_OFFSET	0x02
> +#define DRM_QDA_INIT_ATTACH		0x03
>  /*
>   * QDA IOCTL definitions
>   *
> @@ -33,6 +34,7 @@ extern "C" {
>  						 struct drm_qda_gem_create)
>  #define DRM_IOCTL_QDA_GEM_MMAP_OFFSET	DRM_IOWR(DRM_COMMAND_BASE + DRM_QDA_GEM_MMAP_OFFSET, \
>  						 struct drm_qda_gem_mmap_offset)
> +#define DRM_IOCTL_QDA_INIT_ATTACH	DRM_IO(DRM_COMMAND_BASE + DRM_QDA_INIT_ATTACH)
>  
>  /**
>   * struct drm_qda_query - Device information query structure
> @@ -76,6 +78,23 @@ struct drm_qda_gem_mmap_offset {
>  	__u64 offset;
>  };
>  
> +/**
> + * struct fastrpc_invoke_args - FastRPC invocation argument descriptor
> + * @ptr: Pointer to argument data (user virtual address)
> + * @length: Length of the argument data in bytes

And the data is defined... where?

> + * @fd: File descriptor for buffer arguments, -1 for scalar arguments
> + * @attr: Argument attributes and flags

Which attributes and flags?

> + *
> + * This structure describes a single argument passed to a FastRPC invocation.
> + * Arguments can be either scalar values or buffer references (via file descriptor).

Can't it just be GEM handle + offset inside the handle?

> + */
> +struct fastrpc_invoke_args {
> +	__u64 ptr;
> +	__u64 length;
> +	__s32 fd;
> +	__u32 attr;
> +};
> +
>  #if defined(__cplusplus)
>  }
>  #endif
> 
> diff --git a/drivers/accel/qda/Makefile b/drivers/accel/qda/Makefile
> index 8286f5279748..82d40e452fa9 100644
> --- a/drivers/accel/qda/Makefile
> +++ b/drivers/accel/qda/Makefile
> @@ -14,5 +14,6 @@ qda-y := \
>  	qda_gem.o \
>  	qda_memory_dma.o \
>  	qda_prime.o \
> +	qda_fastrpc.o \
>  
>  obj-$(CONFIG_DRM_ACCEL_QDA_COMPUTE_BUS) += qda_compute_bus.o
> diff --git a/drivers/accel/qda/qda_drv.c b/drivers/accel/qda/qda_drv.c
> index 4adee00b1f2c..3034ea660924 100644
> --- a/drivers/accel/qda/qda_drv.c
> +++ b/drivers/accel/qda/qda_drv.c
> @@ -120,6 +120,8 @@ static void qda_postclose(struct drm_device *dev, struct drm_file *file)
>  		return;
>  	}
>  
> +	fastrpc_release_current_dsp_process(qdev, file);

No, this is not the fastrpc driver.

> +
>  	qda_file_priv = (struct qda_file_priv *)file->driver_priv;
>  	if (qda_file_priv) {
>  		if (qda_file_priv->assigned_iommu_dev) {
> @@ -159,6 +161,7 @@ static const struct drm_ioctl_desc qda_ioctls[] = {
>  	DRM_IOCTL_DEF_DRV(QDA_QUERY, qda_ioctl_query, 0),
>  	DRM_IOCTL_DEF_DRV(QDA_GEM_CREATE, qda_ioctl_gem_create, 0),
>  	DRM_IOCTL_DEF_DRV(QDA_GEM_MMAP_OFFSET, qda_ioctl_gem_mmap_offset, 0),
> +	DRM_IOCTL_DEF_DRV(QDA_INIT_ATTACH, qda_ioctl_attach, 0),
>  };
>  
>  static struct drm_driver qda_drm_driver = {
> @@ -195,6 +198,7 @@ static void cleanup_iommu_manager(struct qda_dev *qdev)
>  
>  static void cleanup_device_resources(struct qda_dev *qdev)
>  {
> +	xa_destroy(&qdev->ctx_xa);

I thought xarray was in some other patch. What is this ctx_xa?

>  	mutex_destroy(&qdev->lock);
>  }
>  
> @@ -213,6 +217,7 @@ static void init_device_resources(struct qda_dev *qdev)
>  	mutex_init(&qdev->lock);
>  	atomic_set(&qdev->removing, 0);
>  	atomic_set(&qdev->client_id_counter, 0);
> +	xa_init_flags(&qdev->ctx_xa, XA_FLAGS_ALLOC1);
>  }
>  
>  static int init_memory_manager(struct qda_dev *qdev)
> diff --git a/drivers/accel/qda/qda_drv.h b/drivers/accel/qda/qda_drv.h
> index bb0dd7e284c6..bb1d1e82036a 100644
> --- a/drivers/accel/qda/qda_drv.h
> +++ b/drivers/accel/qda/qda_drv.h
> @@ -92,6 +92,8 @@ struct qda_dev {
>  	char dsp_name[16];
>  	/* Compute context-bank (CB) child devices */
>  	struct list_head cb_devs;
> +	/* XArray for context management */
> +	struct xarray ctx_xa;
>  };
>  
>  /**
> diff --git a/drivers/accel/qda/qda_fastrpc.c b/drivers/accel/qda/qda_fastrpc.c
> new file mode 100644
> index 000000000000..eda7c90070ee
> --- /dev/null
> +++ b/drivers/accel/qda/qda_fastrpc.c
> @@ -0,0 +1,548 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +// Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
> +#include <linux/slab.h>
> +#include <linux/uaccess.h>
> +#include <linux/sort.h>
> +#include <linux/completion.h>
> +#include <linux/dma-buf.h>
> +#include <drm/drm_gem.h>
> +#include <drm/qda_accel.h>
> +#include "qda_fastrpc.h"
> +#include "qda_drv.h"
> +#include "qda_gem.h"
> +#include "qda_memory_manager.h"
> +
> +static int copy_to_user_or_kernel(void __user *dst, const void *src, size_t size)
> +{
> +	if ((unsigned long)dst >= PAGE_OFFSET) {
> +		memcpy(dst, src, size);
> +		return 0;
> +	} else {
> +		return copy_to_user(dst, src, size) ? -EFAULT : 0;

Huh?

> +	}
> +}
> +
> +static int get_gem_obj_from_handle(struct drm_file *file_priv, u32 handle,
> +				   struct drm_gem_object **gem_obj)
> +{
> +	if (handle == 0)
> +		return -EINVAL;

Let the system do its job.

> +
> +	if (!file_priv)
> +		return -EINVAL;

Can it be NULL?

> +
> +	*gem_obj = drm_gem_object_lookup(file_priv, handle);
> +	if (*gem_obj)
> +		return 0;
> +
> +	return -ENOENT;
> +}
> +
> +static void setup_pages_from_gem_obj(struct qda_gem_obj *qda_gem_obj,
> +				     struct fastrpc_phy_page *pages)
> +{
> +	if (qda_gem_obj->is_imported)
> +		pages->addr = qda_gem_obj->imported_dma_addr;
> +	else
> +		pages->addr = qda_gem_obj->dma_addr;

Why do you need tow kinds of addresses?

> +
> +	pages->size = qda_gem_obj->size;
> +}
> +
> +static u64 calculate_vma_offset(u64 user_ptr)
> +{
> +	struct vm_area_struct *vma;
> +	u64 user_ptr_page_mask = user_ptr & PAGE_MASK;
> +	u64 vma_offset = 0;
> +
> +	mmap_read_lock(current->mm);
> +	vma = find_vma(current->mm, user_ptr);
> +	if (vma)
> +		vma_offset = user_ptr_page_mask - vma->vm_start;
> +	mmap_read_unlock(current->mm);
> +
> +	return vma_offset;
> +}
> +
> +static u64 calculate_page_aligned_size(u64 ptr, u64 len)
> +{
> +	u64 pg_start = (ptr & PAGE_MASK) >> PAGE_SHIFT;
> +	u64 pg_end = ((ptr + len - 1) & PAGE_MASK) >> PAGE_SHIFT;
> +	u64 aligned_size = (pg_end - pg_start + 1) * PAGE_SIZE;
> +
> +	return aligned_size;
> +}
> +
> +static void setup_single_arg(struct fastrpc_invoke_args *args, void *ptr, size_t size)
> +{
> +	args[0].ptr = (u64)(uintptr_t)ptr;

What kind of address is it? If ptr is on the DSP side, then it should
not be void* here.

> +	args[0].length = size;
> +	args[0].fd = -1;
> +}
> +
> +static struct fastrpc_invoke_buf *fastrpc_invoke_buf_start(union fastrpc_remote_arg *pra, int len)
> +{
> +	struct fastrpc_invoke_buf *buf = (struct fastrpc_invoke_buf *)(&pra[len]);
> +	return buf;
> +}
> +
> +static struct fastrpc_phy_page *fastrpc_phy_page_start(struct fastrpc_invoke_buf *buf, int len)
> +{
> +	struct fastrpc_phy_page *pages = (struct fastrpc_phy_page *)(&buf[len]);
> +	return pages;
> +}
> +
> +static int fastrpc_get_meta_size(struct fastrpc_invoke_context *ctx)
> +{
> +	int size = 0;
> +
> +	size = (sizeof(struct fastrpc_remote_buf) +
> +		sizeof(struct fastrpc_invoke_buf) +
> +		sizeof(struct fastrpc_phy_page)) * ctx->nscalars +
> +		sizeof(u64) * FASTRPC_MAX_FDLIST +
> +		sizeof(u32) * FASTRPC_MAX_CRCLIST;
> +
> +	return size;
> +}
> +
> +static u64 fastrpc_get_payload_size(struct fastrpc_invoke_context *ctx, int metalen)
> +{
> +	u64 size = 0;
> +	int oix;
> +
> +	size = ALIGN(metalen, FASTRPC_ALIGN);
> +
> +	for (oix = 0; oix < ctx->nbufs; oix++) {
> +		int i = ctx->olaps[oix].raix;

whts olaps?

Why do you need to specially track it?


> +
> +		if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1) {
> +			if (ctx->olaps[oix].offset == 0)
> +				size = ALIGN(size, FASTRPC_ALIGN);
> +
> +			size += (ctx->olaps[oix].mend - ctx->olaps[oix].mstart);
> +		}
> +	}
> +
> +	return size;
> +}
> +
> +void fastrpc_context_free(struct kref *ref)
> +{
> +	struct fastrpc_invoke_context *ctx;
> +	int i;
> +
> +	ctx = container_of(ref, struct fastrpc_invoke_context, refcount);
> +	if (ctx->gem_objs) {
> +		for (i = 0; i < ctx->nscalars; ++i) {
> +			if (ctx->gem_objs[i]) {
> +				drm_gem_object_put(ctx->gem_objs[i]);
> +				ctx->gem_objs[i] = NULL;
> +			}
> +		}
> +		kfree(ctx->gem_objs);
> +		ctx->gem_objs = NULL;

You are going to kfree ctx. Why do you need to zero the field?

> +	}
> +
> +	if (ctx->msg_gem_obj) {
> +		drm_gem_object_put(&ctx->msg_gem_obj->base);
> +		ctx->msg_gem_obj = NULL;
> +	}
> +
> +	kfree(ctx->olaps);
> +	ctx->olaps = NULL;

> +
> +	kfree(ctx->args);
> +	kfree(ctx->req);
> +	kfree(ctx->rsp);
> +	kfree(ctx->input_pages);
> +	kfree(ctx->inbuf);

Generally it feels like there are too many allocations and frees for a
single RPC call. Can all these buffers be embedded into the context
instead?

> +
> +	kfree(ctx);
> +}
> +
> +#define CMP(aa, bb) ((aa) == (bb) ? 0 : (aa) < (bb) ? -1 : 1)



> +
> +static int olaps_cmp(const void *a, const void *b)
> +{
> +	struct fastrpc_buf_overlap *pa = (struct fastrpc_buf_overlap *)a;
> +	struct fastrpc_buf_overlap *pb = (struct fastrpc_buf_overlap *)b;
> +	int st = CMP(pa->start, pb->start);
> +	int ed = CMP(pb->end, pa->end);
> +
> +	return st == 0 ? ed : st;

wist?

> +}
> +
> +static void fastrpc_get_buff_overlaps(struct fastrpc_invoke_context *ctx)
> +{
> +	u64 max_end = 0;
> +	int i;
> +
> +	for (i = 0; i < ctx->nbufs; ++i) {
> +		ctx->olaps[i].start = ctx->args[i].ptr;
> +		ctx->olaps[i].end = ctx->olaps[i].start + ctx->args[i].length;
> +		ctx->olaps[i].raix = i;
> +	}
> +
> +	sort(ctx->olaps, ctx->nbufs, sizeof(*ctx->olaps), olaps_cmp, NULL);
> +
> +	for (i = 0; i < ctx->nbufs; ++i) {
> +		if (ctx->olaps[i].start < max_end) {
> +			ctx->olaps[i].mstart = max_end;
> +			ctx->olaps[i].mend = ctx->olaps[i].end;
> +			ctx->olaps[i].offset = max_end - ctx->olaps[i].start;
> +
> +			if (ctx->olaps[i].end > max_end) {
> +				max_end = ctx->olaps[i].end;
> +			} else {
> +				ctx->olaps[i].mend = 0;
> +				ctx->olaps[i].mstart = 0;
> +			}
> +		} else {
> +			ctx->olaps[i].mend = ctx->olaps[i].end;
> +			ctx->olaps[i].mstart = ctx->olaps[i].start;
> +			ctx->olaps[i].offset = 0;
> +			max_end = ctx->olaps[i].end;
> +		}
> +	}
> +}
> +
> +struct fastrpc_invoke_context *fastrpc_context_alloc(void)
> +{
> +	struct fastrpc_invoke_context *ctx = NULL;
> +
> +	ctx = kzalloc_obj(*ctx, GFP_KERNEL);
> +	if (!ctx)
> +		return ERR_PTR(-ENOMEM);
> +
> +	INIT_LIST_HEAD(&ctx->node);
> +
> +	ctx->retval = -1;
> +	ctx->pid = current->pid;
> +	init_completion(&ctx->work);
> +	ctx->msg_gem_obj = NULL;
> +	kref_init(&ctx->refcount);
> +
> +	return ctx;
> +}
> +
> +static int process_fd_buffer(struct fastrpc_invoke_context *ctx, int i,
> +			     union fastrpc_remote_arg *rpra, struct fastrpc_phy_page *pages)
> +{
> +	struct drm_gem_object *gem_obj;
> +	struct qda_gem_obj *qda_gem_obj;
> +	int err;
> +	u64 len = ctx->args[i].length;
> +	u64 vma_offset;
> +
> +	err = get_gem_obj_from_handle(ctx->file_priv, ctx->args[i].fd, &gem_obj);
> +	if (err)
> +		return err;
> +
> +	ctx->gem_objs[i] = gem_obj;
> +	qda_gem_obj = to_qda_gem_obj(gem_obj);
> +
> +	rpra[i].buf.pv = (u64)ctx->args[i].ptr;
> +
> +	if (qda_gem_obj->is_imported)
> +		pages[i].addr = qda_gem_obj->imported_dma_addr;
> +	else
> +		pages[i].addr = qda_gem_obj->dma_addr;
> +
> +	vma_offset = calculate_vma_offset(ctx->args[i].ptr);
> +	pages[i].addr += vma_offset;
> +	pages[i].size = calculate_page_aligned_size(ctx->args[i].ptr, len);
> +
> +	return 0;
> +}
> +
> +static int process_direct_buffer(struct fastrpc_invoke_context *ctx, int i, int oix,
> +				 union fastrpc_remote_arg *rpra, struct fastrpc_phy_page *pages,
> +				 uintptr_t *args, u64 *rlen, u64 pkt_size)

What is direct buffer?

> +{
> +	int mlen;
> +	u64 len = ctx->args[i].length;
> +	int inbufs = ctx->inbufs;
> +
> +	if (ctx->olaps[oix].offset == 0) {
> +		*rlen -= ALIGN(*args, FASTRPC_ALIGN) - *args;
> +		*args = ALIGN(*args, FASTRPC_ALIGN);
> +	}
> +
> +	mlen = ctx->olaps[oix].mend - ctx->olaps[oix].mstart;
> +
> +	if (*rlen < mlen)
> +		return -ENOSPC;
> +
> +	rpra[i].buf.pv = *args - ctx->olaps[oix].offset;
> +
> +	pages[i].addr = ctx->msg->phys - ctx->olaps[oix].offset + (pkt_size - *rlen);
> +	pages[i].addr = pages[i].addr & PAGE_MASK;
> +	pages[i].size = calculate_page_aligned_size(rpra[i].buf.pv, len);
> +
> +	*args = *args + mlen;
> +	*rlen -= mlen;
> +
> +	if (i < inbufs) {
> +		void *dst = (void *)(uintptr_t)rpra[i].buf.pv;
> +		void *src = (void *)(uintptr_t)ctx->args[i].ptr;

Huh?

> +
> +		if ((unsigned long)src >= PAGE_OFFSET) {
> +			memcpy(dst, src, len);
> +		} else {
> +			if (copy_from_user(dst, (void __user *)src, len))
> +				return -EFAULT;
> +		}
> +	}
> +
> +	return 0;
> +}
> +
> +static int process_dma_handle(struct fastrpc_invoke_context *ctx, int i,
> +			      union fastrpc_remote_arg *rpra, struct fastrpc_phy_page *pages)
> +{
> +	if (ctx->args[i].fd > 0) {
> +		struct drm_gem_object *gem_obj;
> +		struct qda_gem_obj *qda_gem_obj;
> +		int err;
> +
> +		err = get_gem_obj_from_handle(ctx->file_priv, ctx->args[i].fd, &gem_obj);
> +		if (err)
> +			return err;
> +
> +		ctx->gem_objs[i] = gem_obj;
> +		qda_gem_obj = to_qda_gem_obj(gem_obj);
> +
> +		setup_pages_from_gem_obj(qda_gem_obj, &pages[i]);
> +
> +		rpra[i].dma.fd = ctx->args[i].fd;
> +		rpra[i].dma.len = ctx->args[i].length;
> +		rpra[i].dma.offset = (u64)ctx->args[i].ptr;
> +	} else {
> +		rpra[i].buf.pv = ctx->args[i].ptr;
> +		rpra[i].buf.len = ctx->args[i].length;
> +	}
> +
> +	return 0;
> +}
> +
> +int fastrpc_get_header_size(struct fastrpc_invoke_context *ctx, size_t *out_size)
> +{
> +	ctx->inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
> +	ctx->metalen = fastrpc_get_meta_size(ctx);
> +	ctx->pkt_size = fastrpc_get_payload_size(ctx, ctx->metalen);
> +
> +	ctx->aligned_pkt_size = PAGE_ALIGN(ctx->pkt_size);
> +	if (ctx->aligned_pkt_size == 0)
> +		return -EINVAL;
> +
> +	*out_size = ctx->aligned_pkt_size;
> +	return 0;
> +}
> +
> +static int fastrpc_get_args(struct fastrpc_invoke_context *ctx)
> +{
> +	union fastrpc_remote_arg *rpra;
> +	struct fastrpc_invoke_buf *list;
> +	struct fastrpc_phy_page *pages;
> +	int i, oix, err = 0;
> +	u64 rlen;
> +	uintptr_t args;
> +	size_t hdr_size;
> +
> +	ctx->inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
> +	err = fastrpc_get_header_size(ctx, &hdr_size);
> +	if (err)
> +		return err;
> +
> +	ctx->msg->buf = ctx->msg_gem_obj->virt;
> +	ctx->msg->phys = ctx->msg_gem_obj->dma_addr;
> +
> +	memset(ctx->msg->buf, 0, ctx->aligned_pkt_size);
> +
> +	rpra = (union fastrpc_remote_arg *)ctx->msg->buf;
> +	ctx->list = fastrpc_invoke_buf_start(rpra, ctx->nscalars);
> +	ctx->pages = fastrpc_phy_page_start(ctx->list, ctx->nscalars);
> +	list = ctx->list;
> +	pages = ctx->pages;
> +	args = (uintptr_t)ctx->msg->buf + ctx->metalen;
> +	rlen = ctx->pkt_size - ctx->metalen;
> +	ctx->rpra = rpra;
> +
> +	for (oix = 0; oix < ctx->nbufs; ++oix) {
> +		i = ctx->olaps[oix].raix;
> +
> +		rpra[i].buf.pv = 0;
> +		rpra[i].buf.len = ctx->args[i].length;
> +		list[i].num = ctx->args[i].length ? 1 : 0;
> +		list[i].pgidx = i;
> +
> +		if (!ctx->args[i].length)
> +			continue;
> +
> +		if (ctx->args[i].fd > 0)
> +			err = process_fd_buffer(ctx, i, rpra, pages);
> +		else
> +			err = process_direct_buffer(ctx, i, oix, rpra, pages, &args, &rlen,
> +						    ctx->pkt_size);
> +
> +		if (err)
> +			goto bail_gem;
> +	}
> +
> +	for (i = ctx->nbufs; i < ctx->nscalars; ++i) {
> +		list[i].num = ctx->args[i].length ? 1 : 0;
> +		list[i].pgidx = i;
> +
> +		err = process_dma_handle(ctx, i, rpra, pages);
> +		if (err)
> +			goto bail_gem;
> +	}
> +
> +	return 0;
> +
> +bail_gem:
> +	if (ctx->msg_gem_obj) {
> +		drm_gem_object_put(&ctx->msg_gem_obj->base);
> +		ctx->msg_gem_obj = NULL;
> +	}
> +
> +	return err;
> +}
> +
> +static int fastrpc_put_args(struct fastrpc_invoke_context *ctx, struct qda_msg *msg)
> +{
> +	union fastrpc_remote_arg *rpra = ctx->rpra;
> +	int i, err = 0;
> +
> +	if (!ctx || !rpra)
> +		return -EINVAL;
> +
> +	for (i = ctx->inbufs; i < ctx->nbufs; ++i) {
> +		if (ctx->args[i].fd <= 0) {
> +			void *src = (void *)(uintptr_t)rpra[i].buf.pv;
> +			void *dst = (void *)(uintptr_t)ctx->args[i].ptr;
> +			u64 len = rpra[i].buf.len;
> +
> +			err = copy_to_user_or_kernel(dst, src, len);
> +			if (err)
> +				break;
> +		}
> +	}
> +
> +	return err;
> +}
> +
> +int fastrpc_internal_invoke_pack(struct fastrpc_invoke_context *ctx,
> +				 struct qda_msg *msg)
> +{
> +	int err = 0;
> +
> +	if (ctx->handle == FASTRPC_INIT_HANDLE)
> +		msg->client_id = 0;
> +	else
> +		msg->client_id = ctx->client_id;
> +
> +	ctx->msg = msg;
> +
> +	err = fastrpc_get_args(ctx);
> +	if (err)
> +		return err;
> +
> +	dma_wmb();
> +
> +	msg->tid = ctx->pid;
> +	msg->ctx = ctx->ctxid | ctx->pd;
> +	msg->handle = ctx->handle;
> +	msg->sc = ctx->sc;
> +	msg->addr = ctx->msg->phys;
> +	msg->size = roundup(ctx->pkt_size, PAGE_SIZE);
> +	msg->fastrpc_ctx = ctx;
> +	msg->file_priv = ctx->file_priv;
> +
> +	return 0;
> +}
> +
> +int fastrpc_internal_invoke_unpack(struct fastrpc_invoke_context *ctx,
> +				   struct qda_msg *msg)
> +{
> +	int err;
> +
> +	dma_rmb();
> +
> +	err = fastrpc_put_args(ctx, msg);
> +	if (err)
> +		return err;
> +
> +	err = ctx->retval;
> +	return err;
> +}
> +
> +static int fastrpc_prepare_args_init_attach(struct fastrpc_invoke_context *ctx)
> +{
> +	struct fastrpc_invoke_args *args;
> +
> +	args = kzalloc_obj(*args, GFP_KERNEL);
> +	if (!args)
> +		return -ENOMEM;
> +
> +	setup_single_arg(args, &ctx->client_id, sizeof(ctx->client_id));
> +	ctx->sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_ATTACH, 1, 0);
> +	ctx->args = args;
> +	ctx->handle = FASTRPC_INIT_HANDLE;
> +
> +	return 0;
> +}
> +
> +static int fastrpc_prepare_args_release_process(struct fastrpc_invoke_context *ctx)
> +{
> +	struct fastrpc_invoke_args *args;
> +
> +	args = kzalloc_obj(*args, GFP_KERNEL);
> +	if (!args)
> +		return -ENOMEM;
> +
> +	setup_single_arg(args, &ctx->client_id, sizeof(ctx->client_id));
> +	ctx->sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_RELEASE, 1, 0);
> +	ctx->args = args;
> +	ctx->handle = FASTRPC_INIT_HANDLE;
> +
> +	return 0;
> +}
> +
> +int fastrpc_prepare_args(struct fastrpc_invoke_context *ctx, char __user *argp)
> +{
> +	int err;
> +
> +	switch (ctx->type) {
> +	case FASTRPC_RMID_INIT_ATTACH:
> +		ctx->pd = ROOT_PD;
> +		err = fastrpc_prepare_args_init_attach(ctx);
> +		break;
> +	case FASTRPC_RMID_INIT_RELEASE:
> +		err = fastrpc_prepare_args_release_process(ctx);
> +		break;
> +	default:
> +		return -EINVAL;
> +	}
> +
> +	if (err)
> +		return err;
> +
> +	ctx->nscalars = REMOTE_SCALARS_LENGTH(ctx->sc);
> +	ctx->nbufs = REMOTE_SCALARS_INBUFS(ctx->sc) + REMOTE_SCALARS_OUTBUFS(ctx->sc);
> +
> +	if (ctx->nscalars) {
> +		ctx->gem_objs = kcalloc(ctx->nscalars, sizeof(*ctx->gem_objs), GFP_KERNEL);
> +		if (!ctx->gem_objs)
> +			return -ENOMEM;
> +		ctx->olaps = kcalloc(ctx->nscalars, sizeof(*ctx->olaps), GFP_KERNEL);
> +		if (!ctx->olaps) {
> +			kfree(ctx->gem_objs);
> +			ctx->gem_objs = NULL;
> +			return -ENOMEM;
> +		}
> +		fastrpc_get_buff_overlaps(ctx);
> +	}
> +
> +	return err;
> +}
> diff --git a/drivers/accel/qda/qda_fastrpc.h b/drivers/accel/qda/qda_fastrpc.h
> new file mode 100644
> index 000000000000..744421382079
> --- /dev/null
> +++ b/drivers/accel/qda/qda_fastrpc.h
> @@ -0,0 +1,303 @@
> +/* SPDX-License-Identifier: GPL-2.0-only */
> +/*
> + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
> + */
> +
> +#ifndef __QDA_FASTRPC_H__
> +#define __QDA_FASTRPC_H__
> +
> +#include <linux/completion.h>
> +#include <linux/list.h>
> +#include <linux/types.h>
> +#include <drm/drm_drv.h>
> +#include <drm/drm_file.h>
> +
> +/*
> + * FastRPC scalar extraction macros
> + *
> + * These macros extract different fields from the scalar value that describes
> + * the arguments passed in a FastRPC invocation.
> + */
> +#define REMOTE_SCALARS_INBUFS(sc)	(((sc) >> 16) & 0x0ff)
> +#define REMOTE_SCALARS_OUTBUFS(sc)	(((sc) >> 8) & 0x0ff)
> +#define REMOTE_SCALARS_INHANDLES(sc)	(((sc) >> 4) & 0x0f)
> +#define REMOTE_SCALARS_OUTHANDLES(sc)	((sc) & 0x0f)
> +#define REMOTE_SCALARS_LENGTH(sc)	(REMOTE_SCALARS_INBUFS(sc) +   \
> +					 REMOTE_SCALARS_OUTBUFS(sc) +  \
> +					 REMOTE_SCALARS_INHANDLES(sc) + \
> +					 REMOTE_SCALARS_OUTHANDLES(sc))
> +
> +/* FastRPC configuration constants */
> +#define FASTRPC_ALIGN		128		/* Alignment requirement */
> +#define FASTRPC_MAX_FDLIST	16		/* Maximum file descriptors */
> +#define FASTRPC_MAX_CRCLIST	64		/* Maximum CRC list entries */
> +
> +/*
> + * FastRPC scalar construction macros
> + *
> + * These macros build the scalar value that describes the arguments
> + * for a FastRPC invocation.
> + */
> +#define FASTRPC_BUILD_SCALARS(attr, method, in, out, oin, oout)  \
> +				(((attr & 0x07) << 29) |		\
> +				((method & 0x1f) << 24) |	\
> +				((in & 0xff) << 16) |		\
> +				((out & 0xff) <<  8) |		\
> +				((oin & 0x0f) <<  4) |		\
> +				(oout & 0x0f))
> +
> +#define FASTRPC_SCALARS(method, in, out) \
> +		FASTRPC_BUILD_SCALARS(0, method, in, out, 0, 0)
> +
> +/**
> + * struct fastrpc_buf_overlap - Buffer overlap tracking structure
> + *
> + * This structure tracks overlapping buffer regions to optimize memory
> + * mapping and avoid redundant mappings of the same physical memory.

I think you are spending much more efforts on optimizing it than the
actual cost of mapping the same region twice. Or is there something more
than the optimization?

> + */
> +struct fastrpc_buf_overlap {
> +	/* Start address of the buffer in user virtual address space */
> +	u64 start;
> +	/* End address of the buffer in user virtual address space */
> +	u64 end;
> +	/* Remote argument index associated with this overlap */
> +	int raix;
> +	/* Start address of the mapped region */
> +	u64 mstart;
> +	/* End address of the mapped region */
> +	u64 mend;
> +	/* Offset within the mapped region */
> +	u64 offset;
> +};
> +
> +/**
> + * struct fastrpc_remote_dmahandle - Structure to represent a remote DMA handle
> + */
> +struct fastrpc_remote_dmahandle {
> +	/* DMA handle file descriptor */
> +	s32 fd;
> +	/* DMA handle offset */
> +	u32 offset;
> +	/* DMA handle length */
> +	u32 len;
> +};
> +
> +/**
> + * struct fastrpc_remote_buf - Structure to represent a remote buffer
> + */
> +struct fastrpc_remote_buf {
> +	/* Buffer pointer */
> +	u64 pv;
> +	/* Length of buffer */
> +	u64 len;
> +};
> +
> +/**
> + * union fastrpc_remote_arg - Union to represent remote arguments
> + */
> +union fastrpc_remote_arg {
> +	/* Remote buffer */
> +	struct fastrpc_remote_buf buf;
> +	/* Remote DMA handle */
> +	struct fastrpc_remote_dmahandle dma;
> +};
> +
> +/**
> + * struct fastrpc_phy_page - Structure to represent a physical page
> + */
> +struct fastrpc_phy_page {
> +	/* Physical address */
> +	u64 addr;
> +	/* Size of contiguous region */
> +	u64 size;
> +};
> +
> +/**
> + * struct fastrpc_invoke_buf - Structure to represent an invoke buffer
> + */
> +struct fastrpc_invoke_buf {
> +	/* Number of contiguous regions */
> +	u32 num;
> +	/* Page index */
> +	u32 pgidx;
> +};
> +
> +/**
> + * struct qda_msg - Message structure for FastRPC communication
> + *
> + * This structure represents a message sent to or received from the remote
> + * processor via FastRPC protocol.
> + */
> +struct qda_msg {
> +	/* Process client ID */
> +	int client_id;
> +	/* Thread ID */
> +	int tid;
> +	/* Context identifier for matching responses */
> +	u64 ctx;
> +	/* Handle to invoke on remote processor */
> +	u32 handle;
> +	/* Scalars structure describing the data layout */
> +	u32 sc;
> +	/* Physical address of the message buffer */
> +	u64 addr;
> +	/* Size of contiguous region */
> +	u64 size;
> +	/* Kernel virtual address of the buffer */
> +	void *buf;
> +	/* Physical/DMA address of the buffer */
> +	u64 phys;
> +	/* Return value from remote processor */
> +	int ret;
> +	/* Pointer to qda_dev for context management */
> +	struct qda_dev *qdev;
> +	/* Back-pointer to FastRPC context */
> +	struct fastrpc_invoke_context *fastrpc_ctx;
> +	/* File private data for GEM object lookup */
> +	struct drm_file *file_priv;
> +};
> +
> +/**
> + * struct fastrpc_invoke_context - Remote procedure call invocation context
> + *
> + * This structure maintains all state for a single remote procedure call,
> + * including buffer management, synchronization, and result handling.
> + */
> +struct fastrpc_invoke_context {
> +	/* Unique context identifier for this invocation */
> +	u64 ctxid;
> +	/* Number of input buffers */
> +	int inbufs;
> +	/* Number of output buffers */
> +	int outbufs;
> +	/* Number of file descriptor handles */
> +	int handles;
> +	/* Number of scalar parameters */
> +	int nscalars;
> +	/* Total number of buffers (input + output) */
> +	int nbufs;
> +	/* Process ID of the calling process */
> +	int pid;
> +	/* Return value from the remote invocation */
> +	int retval;
> +	/* Length of metadata */
> +	int metalen;
> +	/* Client identifier for this session */
> +	int client_id;
> +	/* Protection domain identifier */
> +	int pd;
> +	/* Type of invocation request */
> +	int type;
> +	/* Scalars parameter encoding buffer information */
> +	u32 sc;
> +	/* Handle to the remote method being invoked */
> +	u32 handle;
> +	/* Pointer to CRC values for data integrity */
> +	u32 *crc;
> +	/* Pointer to array of file descriptors */
> +	u64 *fdlist;
> +	/* Size of the packet */
> +	u64 pkt_size;
> +	/* Aligned packet size for DMA transfers */
> +	u64 aligned_pkt_size;
> +	/* Array of invoke buffer descriptors */
> +	struct fastrpc_invoke_buf *list;
> +	/* Array of physical page descriptors for buffers */
> +	struct fastrpc_phy_page *pages;
> +	/* Array of physical page descriptors for input buffers */
> +	struct fastrpc_phy_page *input_pages;
> +	/* List node for linking contexts in a queue */
> +	struct list_head node;
> +	/* Completion object for synchronizing invocation */
> +	struct completion work;
> +	/* Pointer to the QDA message structure */
> +	struct qda_msg *msg;
> +	/* Array of remote procedure arguments */
> +	union fastrpc_remote_arg *rpra;
> +	/* Array of GEM objects for argument buffers */
> +	struct drm_gem_object **gem_objs;
> +	/* Pointer to user-space invoke arguments */
> +	struct fastrpc_invoke_args *args;
> +	/* Array of buffer overlap descriptors */
> +	struct fastrpc_buf_overlap *olaps;
> +	/* Reference counter for context lifetime management */
> +	struct kref refcount;
> +	/* GEM object for the main message buffer */
> +	struct qda_gem_obj *msg_gem_obj;
> +	/* DRM file private data */
> +	struct drm_file *file_priv;
> +	/* Pointer to request buffer */
> +	void *req;
> +	/* Pointer to response buffer */
> +	void *rsp;
> +	/* Pointer to input buffer */
> +	void *inbuf;
> +};
> +
> +/* Remote Method ID table - identifies initialization and control operations */
> +#define FASTRPC_RMID_INIT_ATTACH	0	/* Attach to DSP session */
> +#define FASTRPC_RMID_INIT_RELEASE	1	/* Release DSP session */
> +
> +/* Common handle for initialization operations */
> +#define FASTRPC_INIT_HANDLE		0x1
> +
> +/* Protection Domain(PD) ids */
> +#define ROOT_PD		(0)
> +
> +/**
> + * fastrpc_context_free - Free an invocation context
> + * @ref: Reference counter for the context
> + *
> + * This function is called when the reference count reaches zero,
> + * releasing all resources associated with the invocation context.
> + */
> +void fastrpc_context_free(struct kref *ref);
> +
> +/*
> + * FastRPC context and invocation management functions
> + */
> +
> +/**
> + * fastrpc_context_alloc - Allocate a new FastRPC invocation context
> + *
> + * Returns: Pointer to allocated context, or NULL on failure
> + */
> +struct fastrpc_invoke_context *fastrpc_context_alloc(void);
> +
> +/**
> + * fastrpc_prepare_args - Prepare arguments for FastRPC invocation
> + * @ctx: FastRPC invocation context
> + * @argp: User-space pointer to invocation arguments
> + *
> + * Returns: 0 on success, negative error code on failure
> + */
> +int fastrpc_prepare_args(struct fastrpc_invoke_context *ctx, char __user *argp);
> +
> +/**
> + * fastrpc_get_header_size - Get the size of the FastRPC message header
> + * @ctx: FastRPC invocation context
> + * @out_size: Pointer to store the header size in bytes
> + *
> + * Returns: 0 on success, negative error code on failure
> + */
> +int fastrpc_get_header_size(struct fastrpc_invoke_context *ctx, size_t *out_size);
> +
> +/**
> + * fastrpc_internal_invoke_pack - Pack invocation context into message
> + * @ctx: FastRPC invocation context
> + * @msg: QDA message structure to pack into
> + *
> + * Returns: 0 on success, negative error code on failure
> + */
> +int fastrpc_internal_invoke_pack(struct fastrpc_invoke_context *ctx, struct qda_msg *msg);
> +
> +/**
> + * fastrpc_internal_invoke_unpack - Unpack response message into context
> + * @ctx: FastRPC invocation context
> + * @msg: QDA message structure to unpack from
> + *
> + * Returns: 0 on success, negative error code on failure
> + */
> +int fastrpc_internal_invoke_unpack(struct fastrpc_invoke_context *ctx, struct qda_msg *msg);
> +
> +#endif /* __QDA_FASTRPC_H__ */
> diff --git a/drivers/accel/qda/qda_ioctl.c b/drivers/accel/qda/qda_ioctl.c
> index d91983048d6c..1066ab6ddc7b 100644
> --- a/drivers/accel/qda/qda_ioctl.c
> +++ b/drivers/accel/qda/qda_ioctl.c
> @@ -6,6 +6,8 @@
>  #include "qda_drv.h"
>  #include "qda_ioctl.h"
>  #include "qda_prime.h"
> +#include "qda_fastrpc.h"
> +#include "qda_rpmsg.h"
>  
>  static int qda_validate_and_get_context(struct drm_device *dev, struct drm_file *file_priv,
>  					struct qda_dev **qdev, struct qda_user **qda_user)
> @@ -85,3 +87,108 @@ int qda_ioctl_prime_fd_to_handle(struct drm_device *dev, struct drm_file *file_p
>  {
>  	return qda_prime_fd_to_handle(dev, file_priv, prime_fd, handle);
>  }
> +
> +static int fastrpc_context_get_id(struct fastrpc_invoke_context *ctx, struct qda_dev *qdev)
> +{
> +	int ret;
> +	u32 id;
> +
> +	if (!qdev)
> +		return -EINVAL;
> +
> +	if (atomic_read(&qdev->removing))
> +		return -ENODEV;
> +
> +	ret = xa_alloc(&qdev->ctx_xa, &id, ctx, xa_limit_32b, GFP_KERNEL);
> +	if (ret)
> +		return ret;
> +
> +	ctx->ctxid = id << 4;
> +	return 0;
> +}
> +
> +static void fastrpc_context_put_id(struct fastrpc_invoke_context *ctx, struct qda_dev *qdev)
> +{
> +	if (qdev)
> +		xa_erase(&qdev->ctx_xa, ctx->ctxid >> 4);
> +}
> +
> +static int fastrpc_invoke(int type, struct drm_device *dev, void *data,
> +			  struct drm_file *file_priv)
> +{
> +	struct qda_dev *qdev;
> +	struct qda_user *qda_user;
> +	struct qda_msg msg;
> +	struct fastrpc_invoke_context *ctx;
> +	struct drm_gem_object *gem_obj;
> +	int err;
> +	size_t hdr_size;
> +
> +	err = qda_validate_and_get_context(dev, file_priv, &qdev, &qda_user);
> +	if (err)
> +		return err;
> +
> +	ctx = fastrpc_context_alloc();
> +	if (IS_ERR(ctx))
> +		return PTR_ERR(ctx);
> +
> +	err = fastrpc_context_get_id(ctx, qdev);
> +	if (err) {
> +		kref_put(&ctx->refcount, fastrpc_context_free);
> +		return err;
> +	}
> +
> +	ctx->type = type;
> +	ctx->file_priv = file_priv;
> +	ctx->client_id = qda_user->client_id;
> +
> +	err = fastrpc_prepare_args(ctx, (char __user *)data);
> +	if (err)
> +		goto err_context_free;
> +
> +	err = fastrpc_get_header_size(ctx, &hdr_size);
> +	if (err)
> +		goto err_context_free;
> +
> +	gem_obj = qda_gem_create_object(qdev->drm_dev,
> +					qdev->drm_priv->iommu_mgr,
> +					hdr_size, file_priv);
> +	if (IS_ERR(gem_obj)) {
> +		err = PTR_ERR(gem_obj);
> +		goto err_context_free;
> +	}
> +
> +	ctx->msg_gem_obj = to_qda_gem_obj(gem_obj);
> +
> +	err = fastrpc_internal_invoke_pack(ctx, &msg);
> +	if (err)
> +		goto err_context_free;
> +
> +	err = qda_rpmsg_send_msg(qdev, &msg);
> +	if (err)
> +		goto err_context_free;
> +
> +	err = qda_rpmsg_wait_for_rsp(ctx);
> +	if (err)
> +		goto err_context_free;
> +
> +	err = fastrpc_internal_invoke_unpack(ctx, &msg);
> +	if (err)
> +		goto err_context_free;
> +
> +err_context_free:
> +	fastrpc_context_put_id(ctx, qdev);
> +	kref_put(&ctx->refcount, fastrpc_context_free);
> +
> +	return err;
> +}
> +
> +int qda_ioctl_attach(struct drm_device *dev, void *data, struct drm_file *file_priv)
> +{
> +	return fastrpc_invoke(FASTRPC_RMID_INIT_ATTACH, dev, data, file_priv);
> +}
> +
> +int fastrpc_release_current_dsp_process(struct qda_dev *qdev, struct drm_file *file_priv)
> +{
> +	return fastrpc_invoke(FASTRPC_RMID_INIT_RELEASE, qdev->drm_dev, NULL, file_priv);
> +}
> diff --git a/drivers/accel/qda/qda_ioctl.h b/drivers/accel/qda/qda_ioctl.h
> index d454256f5fc5..044c616a51c6 100644
> --- a/drivers/accel/qda/qda_ioctl.h
> +++ b/drivers/accel/qda/qda_ioctl.h
> @@ -38,4 +38,29 @@ int qda_ioctl_query(struct drm_device *dev, void *data, struct drm_file *file_pr
>  int qda_ioctl_prime_fd_to_handle(struct drm_device *dev, struct drm_file *file_priv,
>  				 int prime_fd, u32 *handle);
>  
> +/**
> + * qda_ioctl_attach - Attach to DSP root protection domain
> + * @dev: DRM device structure
> + * @data: User-space data for the attach operation
> + * @file_priv: DRM file private data
> + *
> + * This IOCTL handler attaches to the DSP root PD (Protection Domain)
> + * to enable communication between the host and DSP.
> + *
> + * Return: 0 on success, negative error code on failure
> + */
> +int qda_ioctl_attach(struct drm_device *dev, void *data, struct drm_file *file_priv);
> +
> +/**
> + * fastrpc_release_current_dsp_process - Release DSP process resources
> + * @qdev: QDA device structure
> + * @file_priv: DRM file private data
> + *
> + * This function releases all resources associated with a DSP process
> + * when a user-space client closes its file descriptor.
> + *
> + * Return: 0 on success, negative error code on failure
> + */
> +int fastrpc_release_current_dsp_process(struct qda_dev *qdev, struct drm_file *file_priv);
> +
>  #endif /* _QDA_IOCTL_H */
> diff --git a/drivers/accel/qda/qda_rpmsg.c b/drivers/accel/qda/qda_rpmsg.c
> index b2b44b4d3ca8..96a08d753271 100644
> --- a/drivers/accel/qda/qda_rpmsg.c
> +++ b/drivers/accel/qda/qda_rpmsg.c
> @@ -5,7 +5,11 @@
>  #include <linux/of_platform.h>
>  #include <linux/of.h>
>  #include <linux/of_device.h>
> +#include <linux/completion.h>
> +#include <linux/wait.h>
> +#include <linux/sched.h>
>  #include "qda_drv.h"
> +#include "qda_fastrpc.h"
>  #include "qda_rpmsg.h"
>  #include "qda_cb.h"
>  
> @@ -15,7 +19,104 @@ static int qda_rpmsg_init(struct qda_dev *qdev)
>  	return 0;
>  }
>  
> -/* Utility function to allocate and initialize qda_dev */
> +static int validate_device_availability(struct qda_dev *qdev)
> +{
> +	struct rpmsg_device *rpdev;
> +
> +	if (!qdev)
> +		return -ENODEV;
> +
> +	if (atomic_read(&qdev->removing)) {
> +		qda_dbg(qdev, "RPMsg device unavailable: removing\n");
> +		return -ENODEV;
> +	}
> +
> +	mutex_lock(&qdev->lock);
> +	rpdev = qdev->rpdev;
> +	mutex_unlock(&qdev->lock);
> +
> +	if (!rpdev) {
> +		qda_dbg(qdev, "RPMsg device unavailable: rpdev is NULL\n");
> +		return -ENODEV;
> +	}
> +
> +	return 0;
> +}
> +
> +static struct fastrpc_invoke_context *get_and_validate_context(struct qda_msg *msg,
> +							       struct qda_dev *qdev)
> +{
> +	struct fastrpc_invoke_context *ctx = msg->fastrpc_ctx;
> +
> +	if (!ctx) {
> +		qda_dbg(qdev, "FastRPC context not found in message\n");
> +		return ERR_PTR(-EINVAL);
> +	}
> +
> +	kref_get(&ctx->refcount);
> +	return ctx;
> +}
> +
> +static void populate_fastrpc_msg(struct fastrpc_msg *dst, struct qda_msg *src)
> +{
> +	dst->client_id = src->client_id;
> +	dst->tid = src->tid;
> +	dst->ctx = src->ctx;
> +	dst->handle = src->handle;
> +	dst->sc = src->sc;
> +	dst->addr = src->addr;
> +	dst->size = src->size;
> +}
> +
> +static int validate_callback_params(struct qda_dev *qdev, void *data, int len)
> +{
> +	if (!qdev)
> +		return -ENODEV;
> +
> +	if (atomic_read(&qdev->removing))
> +		return -ENODEV;
> +
> +	if (len < sizeof(struct qda_invoke_rsp)) {
> +		qda_dbg(qdev, "Invalid message size from remote: %d\n", len);
> +		return -EINVAL;
> +	}
> +
> +	return 0;
> +}
> +
> +static unsigned long extract_context_id(struct qda_invoke_rsp *resp_msg)
> +{
> +	return (resp_msg->ctx & 0xFF0) >> 4;
> +}
> +
> +static struct fastrpc_invoke_context *find_context_by_id(struct qda_dev *qdev,
> +							 unsigned long ctxid)
> +{
> +	struct fastrpc_invoke_context *ctx;
> +
> +	{
> +		unsigned long flags;
> +
> +		xa_lock_irqsave(&qdev->ctx_xa, flags);
> +		ctx = xa_load(&qdev->ctx_xa, ctxid);
> +		xa_unlock_irqrestore(&qdev->ctx_xa, flags);
> +	}
> +
> +	if (!ctx) {
> +		qda_dbg(qdev, "FastRPC context not found for ctxid: %lu\n", ctxid);
> +		return ERR_PTR(-ENOENT);
> +	}
> +
> +	return ctx;
> +}
> +
> +static void complete_context_processing(struct fastrpc_invoke_context *ctx, int retval)
> +{
> +	ctx->retval = retval;
> +	complete(&ctx->work);
> +	kref_put(&ctx->refcount, fastrpc_context_free);
> +}
> +
>  static struct qda_dev *alloc_and_init_qdev(struct rpmsg_device *rpdev)
>  {
>  	struct qda_dev *qdev;
> @@ -62,9 +163,68 @@ static int qda_populate_child_devices(struct qda_dev *qdev, struct device_node *
>  	return success > 0 ? 0 : (count > 0 ? -ENODEV : 0);
>  }
>  
> +int qda_rpmsg_send_msg(struct qda_dev *qdev, struct qda_msg *msg)
> +{
> +	int ret;
> +	struct fastrpc_invoke_context *ctx;
> +	struct fastrpc_msg msg1;
> +	struct rpmsg_device *rpdev;
> +
> +	ret = validate_device_availability(qdev);
> +	if (ret)
> +		return ret;
> +
> +	ctx = get_and_validate_context(msg, qdev);
> +	if (IS_ERR(ctx))
> +		return PTR_ERR(ctx);
> +
> +	populate_fastrpc_msg(&msg1, msg);
> +
> +	mutex_lock(&qdev->lock);
> +	rpdev = qdev->rpdev;
> +	if (!rpdev) {
> +		mutex_unlock(&qdev->lock);
> +		kref_put(&ctx->refcount, fastrpc_context_free);
> +		return -ENODEV;
> +	}
> +
> +	ret = rpmsg_send(rpdev->ept, (void *)&msg1, sizeof(msg1));
> +	mutex_unlock(&qdev->lock);
> +
> +	if (ret) {
> +		qda_err(qdev, "rpmsg_send failed: %d\n", ret);
> +		kref_put(&ctx->refcount, fastrpc_context_free);
> +		return ret;
> +	}
> +
> +	return 0;
> +}
> +
> +int qda_rpmsg_wait_for_rsp(struct fastrpc_invoke_context *ctx)
> +{
> +	return wait_for_completion_interruptible(&ctx->work);
> +}
> +
>  static int qda_rpmsg_cb(struct rpmsg_device *rpdev, void *data, int len, void *priv, u32 src)
>  {
> -	/* Dummy function for rpmsg driver */
> +	struct qda_dev *qdev = dev_get_drvdata(&rpdev->dev);
> +	struct qda_invoke_rsp *resp_msg = (struct qda_invoke_rsp *)data;
> +	struct fastrpc_invoke_context *ctx;
> +	unsigned long ctxid;
> +	int ret;
> +
> +	ret = validate_callback_params(qdev, data, len);
> +	if (ret)
> +		return ret;
> +
> +	ctxid = extract_context_id(resp_msg);
> +
> +	ctx = find_context_by_id(qdev, ctxid);
> +	if (IS_ERR(ctx))
> +		return PTR_ERR(ctx);
> +
> +	complete_context_processing(ctx, resp_msg->retval);
> +
>  	return 0;
>  }
>  
> diff --git a/drivers/accel/qda/qda_rpmsg.h b/drivers/accel/qda/qda_rpmsg.h
> index 348827bff255..b3e76e44f4cd 100644
> --- a/drivers/accel/qda/qda_rpmsg.h
> +++ b/drivers/accel/qda/qda_rpmsg.h
> @@ -7,6 +7,46 @@
>  #define __QDA_RPMSG_H__
>  
>  #include "qda_drv.h"
> +#include "qda_fastrpc.h"
> +
> +/**
> + * struct fastrpc_msg - FastRPC message structure for remote invocations
> + *
> + * This structure represents a FastRPC message sent to the remote processor
> + * via RPMsg transport layer.
> + */
> +struct fastrpc_msg {
> +	/* Process client ID */
> +	int client_id;
> +	/* Thread ID */
> +	int tid;
> +	/* Context identifier for matching request/response */
> +	u64 ctx;
> +	/* Handle to invoke on remote processor */
> +	u32 handle;
> +	/* Scalars structure describing the data layout */
> +	u32 sc;
> +	/* Physical address of the message buffer */
> +	u64 addr;
> +	/* Size of contiguous region */
> +	u64 size;
> +};
> +
> +/**
> + * struct qda_invoke_rsp - Response structure for FastRPC invocations
> + */
> +struct qda_invoke_rsp {
> +	/* Invoke caller context for matching request/response */
> +	u64 ctx;
> +	/* Return value from the remote invocation */
> +	int retval;
> +};
> +
> +/*
> + * RPMsg transport layer functions
> + */
> +int qda_rpmsg_send_msg(struct qda_dev *qdev, struct qda_msg *msg);
> +int qda_rpmsg_wait_for_rsp(struct fastrpc_invoke_context *ctx);
>  
>  /*
>   * Transport layer registration
> -- 
> 2.34.1
> 

-- 
With best wishes
Dmitry