RPMsg Cortex-M and Cortex-A on Apalis iMX8 with Bao

[iorvrse]

I am trying to run RPMsg between a Cortex-A (Linux) and Cortex-M on an Apalis i.MX8 under Bao. I have successfully run this RPMsg setup without Bao using the standard NXP SDK example. I followed the exact same steps under Bao, but the communication endpoints aren't being created.

My current setup:

• Enabled RPMsg drivers in the Linux kernel config.
• Applied the necessary device tree nodes.
• Added the related Messaging Unit (MU) to my bao_config for pass-through.
• Running the standard SDK RPMsg example on the Cortex-M.

Linux brings up the bus and allocates the buffers, but I never get the actual endpoint devices.

# ls /dev/ | grep rpmsg
rpmsg_ctrl0
rpmsg_ctrl1
rpmsg_ctrl2
rpmsg_ctrl3
# dmesg | grep rpmsg
[    0.249975] imx rpmsg driver is registered.
[    0.978232] imx-rpmsg 90000000.rpmsg: assigned reserved memory node vdevbuffer@90400000
[    0.999771] virtio_rpmsg_bus virtio0: rpmsg host is online
[    1.021770] virtio_rpmsg_bus virtio1: rpmsg host is online
[    1.022706] imx-rpmsg 90100000.rpmsg: assigned reserved memory node vdevbuffer@90400000
[    1.023937] virtio_rpmsg_bus virtio2: rpmsg host is online
[    1.025196] virtio_rpmsg_bus virtio3: rpmsg host is online

Here is the bao configuration

#include <config.h>

VM_IMAGE(linux_image, XSTR(BAO_DEMOS_WRKDIR_IMGS/linux.bin))

struct config config = {
    
    CONFIG_HEADER

    .shmemlist_size = 1,
    .shmemlist = (struct shmem[]) {
        [0] = { .size = 0x00010000, }
    },
    
    .vmlist_size = 1,
    .vmlist = (struct vm_config[]) {
        {
            .image = {
                .base_addr = 0x80200000,
                .load_addr = VM_IMAGE_OFFSET(linux_image),
                .size = VM_IMAGE_SIZE(linux_image)
            },

            .entry = 0x80200000,
            .cpu_affinity = 0x03,

            .platform = {
                .cpu_num = 2,
                
                .region_num = 1,
                .regions =  (struct vm_mem_region[]) {
                    {
                        .base = 0x80200000,
                        .size = 0x40000000
                    }
                },

                .ipc_num = 1,
                .ipcs = (struct ipc[]) {
                    {
                        .base = 0xf0000000,
                        .size = 0x00010000,
                        .shmem_id = 0,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {52}
                    }
                },

                .dev_num = 11,
                .devs =  (struct vm_dev_region[]) {  
                    {   
                        /* Arch timer interrupt */
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {27}
                    },
                    {
                        /* lpuart1 */
                        .pa = 0x5a070000,
                        .va = 0x5a070000,
                        .size = 0x10000,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {378}
                    },
                    {
                        /* lpuart1 clock generator */
                        .pa = 0x5a470000,
                        .va = 0x5a470000,
                        .size = 0x10000,
                    },
                    {
                        /* usdhc1 - eMMC */
                        .pa = 0x5b010000,
                        .va = 0x5b010000,
                        .size = 0x10000,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {264},
                        .id = 0x3
                    },
                    {   
                        /* fec1 */
                        .pa = 0x5b040000,
                        .va = 0x5b040000,
                        .size = 0x10000,
                        .interrupt_num = 4,
                        .interrupts = (irqid_t[]) {288, 289, 290, 291},    
                        .id = 0x2,
                    },
                    {
                        /* usdhc1 clock generator */
                        .pa = 0x5b200000,
                        .va = 0x5b200000,
                        .size = 0x10000,
                    },
                    {   
                        /* enet0 clock generator */
                        .pa = 0x5b230000,
                        .va = 0x5b230000,
                        .size = 0x10000,
                    },
                    {
                        /* lsio_gpio1 (Ethernet PHY Reset & Interrupt) */
                        .pa = 0x5d090000,
                        .va = 0x5d090000,
                        .size = 0x10000,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {169}
                    },
                    {
                        /* lsio_mu1 message unit */
                        .pa = 0x5d1c0000,
                        .va = 0x5d1c0000,
                        .size = 0x10000,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {209},
                    },
                    {
                        /* lsio_mu5 message unit */
                        .pa = 0x5d200000,
                        .va = 0x5d200000,
                        .size = 0x10000,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {216},
                    },
                    {
                        /* lsio_mu6 message unit */
                        .pa = 0x5d210000,
                        .va = 0x5d210000,
                        .size = 0x10000,
                        .interrupt_num = 1,
                        .interrupts = (irqid_t[]) {217},
                    },
                },
                
                .arch = {
                    .gic = {
                       .gicd_addr = 0x51a00000,
                       .gicr_addr = 0x51b00000
                    },
                }
            },
        },
    },
};

And this is the linux device tree

/dts-v1/;

/ {   
    #size-cells = <0x2>;
    #address-cells = <0x2>;

    cpus {
        #size-cells = <0x0>;
        #address-cells = <0x1>;

        cpu@0 {
            compatible = "arm,armv8";
            device_type = "cpu";
            enable-method = "psci";
            reg = <0x0>;
        };

        cpu@1 {
            compatible = "arm,armv8";
            device_type = "cpu";
            enable-method = "psci";
            reg = <0x1>;
        };
    };

    psci {
        compatible = "arm,psci-0.2";
        method = "smc";
    };

    memory@80200000 {
        reg = <0x0 0x80200000 0x0 0x40000000>;
        device_type = "memory";
    };

    reserved-memory {
        #address-cells = <2>;
        #size-cells = <2>;
        ranges;

        /*
         * reserved-memory layout
         * 0x8800_0000 ~ 0x8FFF_FFFF is reserved for M4
         * Shouldn't be used at A core and Linux side.
         */
        m4_reserved: m4@88000000 {
            reg = <0 0x88000000 0 0x8000000>;
            no-map;
        };

        vdev0vring0: vdev0vring0@90000000 {
            reg = <0 0x90000000 0 0x8000>;
            no-map;
        };

        vdev0vring1: vdev0vring1@90008000 {
            reg = <0 0x90008000 0 0x8000>;
            no-map;
        };

        vdev1vring0: vdev1vring0@90010000 {
            reg = <0 0x90010000 0 0x8000>;
            no-map;
        };

        vdev1vring1: vdev1vring1@90018000 {
            reg = <0 0x90018000 0 0x8000>;
            no-map;
        };

        rsc_table0: rsc-table@900ff000 {
            reg = <0 0x900ff000 0 0x1000>;
            no-map;
        };

        vdev2vring0: vdev2vring0@90100000 {
            reg = <0 0x90100000 0 0x8000>;
            no-map;
        };

        vdev2vring1: vdev2vring1@90108000 {
            reg = <0 0x90108000 0 0x8000>;
            no-map;
        };

        vdev3vring0: vdev3vring0@90110000 {
            reg = <0 0x90110000 0 0x8000>;
            no-map;
        };

        vdev3vring1: vdev3vring1@90118000 {
            reg = <0 0x90118000 0 0x8000>;
            no-map;
        };

        rsc_table1: rsc-table@901ff000 {
            reg = <0 0x901ff000 0 0x1000>;
            no-map;
        };

        rpmsg_reserved: rpmsg@90200000 {
            reg = <0 0x90200000 0 0x200000>;
            no-map;
        };

        vdevbuffer: vdevbuffer@90400000 {
            compatible = "shared-dma-pool";
            reg = <0 0x90400000 0 0x100000>;
            no-map;
        };
    };

    rpmsg0: rpmsg@90000000 {
        compatible = "fsl,imx8qm-rpmsg";
        mbox-names = "tx", "rx", "rxdb";
        mboxes = <&lsio_mu5 0 1
                &lsio_mu5 1 1
                &lsio_mu5 3 1>;
        mub-partition = <3>;
        vdev-nums = <2>;
        reg = <0 0x90000000 0 0x20000>;
        memory-region = <&vdevbuffer>;
        status = "okay";
    };

    rpmsg1: rpmsg@90100000 {
        compatible = "fsl,imx8qm-rpmsg";
        mbox-names = "tx", "rx", "rxdb";
        mboxes = <&lsio_mu6 0 1
                &lsio_mu6 1 1
                &lsio_mu6 3 1>;
        mub-partition = <4>;
        vdev-nums = <2>;
        reg = <0 0x90100000 0 0x20000>;
        memory-region = <&vdevbuffer>;
        status = "okay";
    };

    gic: intc@8000000 {
        interrupts = <0x01 0x09 0x04>;
        reg = <0x00 0x51a00000 0x00 0x10000 0x00 0x51b00000 0x00 0xf60000>;
        #redistributor-regions = <0x01>;
        compatible = "arm,gic-v3";
        interrupt-controller;
        #interrupt-cells = <0x03>;
        interrupt-parent = <&gic>;
    };

    timer {
        compatible = "arm,armv8-timer";
        interrupt-parent = <&gic>;
        interrupts = <0x1 0xd 0xf08 0x1 0xe 0xf08 0x1 0xb 0xf08 0x1 0xa 0xf08>;
    };

    conn_axi_clk: clock-conn-axi {
        compatible = "fixed-clock";
        #clock-cells = <0>;
        clock-frequency = <333333333>;
        clock-output-names = "conn_axi_clk";
    };

    conn_ipg_clk: clock-conn-ipg {
        compatible = "fixed-clock";
        #clock-cells = <0>;
        clock-frequency = <83333333>;
        clock-output-names = "conn_ipg_clk";
    };

    dma_ipg_clk: clock-dma-ipg {
        compatible = "fixed-clock";
        #clock-cells = <0>;
        clock-frequency = <120000000>;
        clock-output-names = "dma_ipg_clk";
    };

    xtal32k: clock-xtal32k {
        compatible = "fixed-clock";
        #clock-cells = <0>;
        clock-frequency = <32768>;
        clock-output-names = "xtal_32KHz";
    };

    xtal24m: clock-xtal24m {
        compatible = "fixed-clock";
        #clock-cells = <0>;
        clock-frequency = <24000000>;
        clock-output-names = "xtal_24MHz";
    };

    lsio_mu1: mailbox@5d1c0000 {
        compatible = "fsl,imx8qm-mu", "fsl,imx6sx-mu";
        reg = <0x0 0x5d1c0000 0x0 0x10000>;
        interrupt-parent = <&gic>;
        interrupts = <0 177 4>;
        #mbox-cells = <2>;
        status = "okay";
    };

    lsio_mu5: mailbox@5d200000 {
        compatible = "fsl,imx8qm-mu", "fsl,imx6sx-mu";
        reg = <0x0 0x5d200000 0x0 0x10000>;
        interrupt-parent = <&gic>;
        interrupts = <0 184 4>;
        #mbox-cells = <2>;
        power-domains = <&pd 218>;
        status = "okay";
    };

    lsio_mu6: mailbox@5d210000 {
        compatible = "fsl,imx8qm-mu", "fsl,imx6sx-mu";
        reg = <0x0 0x5d210000 0x0 0x10000>;
        interrupt-parent = <&gic>;
        interrupts = <0 185 4>;
        #mbox-cells = <2>;
        power-domains = <&pd 219>;
        status = "okay";
    };

    lsio_gpio1: gpio@5d090000 {
        compatible = "fsl,imx8qm-gpio", "fsl,imx35-gpio";
        reg = <0x0 0x5d090000 0x0 0x10000>;
        interrupt-parent = <&gic>;
        interrupts = <0 137 4>;
        gpio-controller;
        #gpio-cells = <2>;
        interrupt-controller;
        #interrupt-cells = <2>;
        power-domains = <&pd 200>;

        gpio-line-names = "",
              "",
              "",
              "",
              "MXM3_286",
              "",
              "MXM3_87",
              "MXM3_99",
              "MXM3_138",
              "MXM3_140",
              "MXM3_239",
              "",
              "MXM3_281",
              "MXM3_283",
              "MXM3_126",
              "MXM3_132",
              "",
              "",
              "",
              "",
              "MXM3_173",
              "MXM3_175",
              "MXM3_123";
    };

    scu {
        compatible = "fsl,imx-scu";

        mbox-names = "tx0", "tx1", "tx2", "tx3",
                 "rx0", "rx1", "rx2", "rx3",
                 "gip3";

        mboxes = <&lsio_mu1 0 0
              &lsio_mu1 0 1
              &lsio_mu1 0 2
              &lsio_mu1 0 3
              &lsio_mu1 1 0
              &lsio_mu1 1 1
              &lsio_mu1 1 2
              &lsio_mu1 1 3
              &lsio_mu1 3 3>;

        pd: imx8qx-pd {
            compatible = "fsl,imx8qm-scu-pd", "fsl,scu-pd";
            #power-domain-cells = <1>;
        };

        clk: clock-controller {
            compatible = "fsl,imx8qm-clk", "fsl,scu-clk";
            #clock-cells = <2>;
            clocks = <&xtal32k &xtal24m>;
            clock-names = "xtal_32KHz", "xtal_24Mhz";
        };

        iomuxc: pinctrl {
            compatible = "fsl,imx8qm-iomuxc";
            pinctrl-names = "default";
            
            pinctrl_fec1: fec1grp {
                fsl,pins = <0xff 0x00 0x14a0>,
                    <0xa6 0x00 0x6000020>, 
                    <0xa5 0x00 0x6000020>, 
                    <0xf4 0x00 0x6000020>, 
                    <0xf3 0x00 0x6000020>, 
                    <0xf5 0x00 0x6000020>, 
                    <0xf6 0x00 0x6000020>, 
                    <0xf7 0x00 0x6000020>, 
                    <0xf8 0x00 0x6000020>, 
                    <0xf9 0x00 0x6000020>, 
                    <0xfa 0x00 0x6000020>, 
                    <0xfb 0x00 0x6000020>, 
                    <0xfc 0x00 0x6000020>, 
                    <0xfd 0x00 0x6000020>, 
                    <0xfe 0x00 0x6000020>,
                    <0xa7 0x00 0x6000020>,
                    /* On-module ETH_RESET# */
                    <0x39 0x03 0x6000020>,
                    /* On-module ETH_INT# */
                    <0x4d 0x03 0x4000060>;
            };

            pinctrl_fec1_sleep: fec1-sleepgrp {
                fsl,pins = <0xff 0x00 0x000014a0>,
                    <0xa6 0x03 0x04000040>,
                    <0xa5 0x03 0x04000040>,
                    <0xf4 0x03 0x04000040>,
                    <0xf3 0x03 0x04000040>,
                    <0xf5 0x03 0x04000040>,
                    <0xf6 0x03 0x04000040>,
                    <0xf7 0x03 0x04000040>,
                    <0xf8 0x03 0x04000040>,
                    <0xf9 0x03 0x04000040>,
                    <0xfa 0x03 0x04000040>,
                    <0xfb 0x03 0x04000040>,
                    <0xfc 0x03 0x04000040>,
                    <0xfd 0x03 0x04000040>,
                    <0xfe 0x03 0x04000040>,
                    <0xa7 0x03 0x04000040>,
                    <0x39 0x03 0x06000020>,
                    <0x4d 0x03 0x04000040>;
            };

            /* On-module eMMC */
            pinctrl_usdhc1: usdhc1grp {
                fsl,pins = <0xd1 0x00 0x06000041>,
                    <0xd2 0x00 0x00000021>,
                    <0xd3 0x00 0x00000021>,
                    <0xd4 0x00 0x00000021>,
                    <0xd5 0x00 0x00000021>,
                    <0xd6 0x00 0x00000021>,
                    <0xd7 0x00 0x00000021>,
                    <0xd8 0x00 0x00000021>,
                    <0xd9 0x00 0x00000021>,
                    <0xda 0x00 0x00000021>,
                    <0xdb 0x00 0x06000041>,
                    <0xdc 0x00 0x00000021>;
            };

            pinctrl_usdhc1_100mhz: usdhc1-100mhzgrp {
                fsl,pins = <0xd1 0x00 0x06000040>,
                    <0xd2 0x00 0x00000020>,
                    <0xd3 0x00 0x00000020>,
                    <0xd4 0x00 0x00000020>,
                    <0xd5 0x00 0x00000020>,
                    <0xd6 0x00 0x00000020>,
                    <0xd7 0x00 0x00000020>,
                    <0xd8 0x00 0x00000020>,
                    <0xd9 0x00 0x00000020>,
                    <0xda 0x00 0x00000020>,
                    <0xdb 0x00 0x06000040>,
                    <0xdc 0x00 0x00000020>;
            };

            pinctrl_usdhc1_200mhz: usdhc1-200mhzgrp {
                fsl,pins = <0xd1 0x00 0x06000040>,
                    <0xd2 0x00 0x00000020>,
                    <0xd3 0x00 0x00000020>,
                    <0xd4 0x00 0x00000020>,
                    <0xd5 0x00 0x00000020>,
                    <0xd6 0x00 0x00000020>,
                    <0xd7 0x00 0x00000020>,
                    <0xd8 0x00 0x00000020>,
                    <0xd9 0x00 0x00000020>,
                    <0xda 0x00 0x00000020>,
                    <0xdb 0x00 0x06000040>,
                    <0xdc 0x00 0x00000020>;
            };
        };

        ocotp: imx8qm-ocotp {
            compatible = "fsl,imx8qm-scu-ocotp";
            #address-cells = <1>;
            #size-cells = <1>;
            read-only;

            fec_mac0: mac@1c4 {
                reg = <0x1c4 6>;
            };

            fec_mac1: mac@1c6 {
                reg = <0x1c6 6>;
            };
        };
    };

    enet0_lpcg: clock-controller@5b230000 {
        compatible = "fsl,imx8qxp-lpcg";
        reg = <0x0 0x5b230000 0x0 0x10000>;
        #clock-cells = <1>;
        clocks = <&clk 251 2>,
             <&clk 251 2>,
             <&conn_axi_clk>,
             <&clk 251 24>,
             <&conn_ipg_clk>,
             <&conn_ipg_clk>;
        bit-offset = <0 4 8 12 16 20>;
        clock-output-names = "enet0_lpcg_timer_clk",
                     "enet0_lpcg_txc_sampling_clk",
                     "enet0_lpcg_ahb_clk",
                     "enet0_lpcg_rgmii_txc_clk",
                     "enet0_lpcg_ipg_clk",
                     "enet0_lpcg_ipg_s_clk";
        power-domains = <&pd 251>;
    };

    lpuart1_lpcg: clock-controller@5a470000 {
        compatible = "fsl,imx8qxp-lpcg";
        reg = <0x0 0x5a470000 0x0 0x10000>;
        #clock-cells = <1>;
        clocks = <&clk 58 2>, <&dma_ipg_clk>;
        bit-offset = <0 16>;
        clock-output-names = "lpuart1_lpcg_ipg_clk", "lpuart1_lpcg_baud_clk";
        power-domains = <&pd 58>;
    };

    sdhc0_lpcg: clock-controller@5b200000 {
        compatible = "fsl,imx8qxp-lpcg";
        reg = <0x0 0x5b200000 0x0 0x10000>;
        #clock-cells = <1>;
        clocks = <&clk 248 2>, <&conn_ipg_clk>, <&conn_axi_clk>;
        bit-offset = <0 16 20>;
        clock-output-names = "sdhc0_lpcg_per_clk",
                     "sdhc0_lpcg_ipg_clk",
                     "sdhc0_lpcg_ahb_clk";
        power-domains = <&pd 248>;
    };

    fec1: ethernet@5b040000 {
        compatible = "fsl,imx8qm-fec", "fsl,imx6sx-fec";
        reg = <0x0 0x5b040000 0x0 0x10000>;
        interrupt-parent = <&gic>;
        interrupts = <0 258 4>,
                 <0 256 4>,
                 <0 257 4>,
                 <0 259 4>;
        clocks = <&enet0_lpcg 4>,
             <&enet0_lpcg 2>,
             <&enet0_lpcg 3>,
             <&enet0_lpcg 0>,
             <&enet0_lpcg 1>;
        clock-names = "ipg", "ahb", "enet_clk_ref", "ptp", "enet_2x_txclk";
        status = "okay";

        assigned-clocks = <&clk 251 2>,
                  <&clk 251 25>;
        assigned-clock-rates = <250000000>, <125000000>;
        fsl,num-tx-queues=<3>;
        fsl,num-rx-queues=<3>;
        power-domains = <&pd 251>;

        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_fec1>;
        pinctrl-1 = <&pinctrl_fec1_sleep>;
        phy-mode = "rgmii-id";
        phy-handle = <&ethphy0>;
        fsl,magic-packet;
        fsl,mii-exclusive;
        
        mdio {
            #address-cells = <1>;
            #size-cells = <0>;

            ethphy0: ethernet-phy@0 {
                compatible = "ethernet-phy-ieee802.3-c22";
                reg = <7>;
                interrupt-parent = <&lsio_gpio1>;
                interrupts = <29 8>;
                micrel,led-mode = <0>;
                reset-assert-us = <2>;
                reset-deassert-us = <2>;
                reset-gpios = <&lsio_gpio1 11 1>;
                reset-names = "phy-reset";
            };
        };
    };

    lpuart1: serial@5a070000 {
        compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart", "fsl,imx7ulp-lpuart";
        reg = <0x0 0x5a070000 0x0 0x1000>;
        interrupts = <0 346 4>;
        interrupt-parent = <&gic>;
        clocks = <&lpuart1_lpcg 1>, <&lpuart1_lpcg 0>;
        clock-names = "ipg", "baud";
        assigned-clocks = <&clk 58 2>;
        assigned-clock-rates = <80000000>;
        power-domains = <&pd 58>;
        status = "okay";
    };

    usdhc1: mmc@5b010000 {
        compatible = "fsl,imx8qm-usdhc", "fsl,imx8qxp-usdhc";
        reg = <0x0 0x5b010000 0x0 0x10000>;
        interrupts = <0 232 4>;
        interrupt-parent = <&gic>;
        clocks = <&sdhc0_lpcg 1>, <&sdhc0_lpcg 2>, <&sdhc0_lpcg 0>;
        clock-names = "ipg", "ahb", "per";
        assigned-clocks = <&clk 248 2>;
        assigned-clock-rates = <400000000>;
        power-domains = <&pd 248>;
        fsl,tuning-start-tap = <20>;
        fsl,tuning-step = <2>;

        pinctrl-names = "default", "state_100mhz", "state_200mhz";
        pinctrl-0 = <&pinctrl_usdhc1>;
        pinctrl-1 = <&pinctrl_usdhc1_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc1_200mhz>;

        bus-width = <8>;
        non-removable;
        status = "okay";
    };

    bao-ipc@f0000000 {
        compatible = "bao,ipcshmem";
        reg = <0x0 0xf0000000 0x0 0x00010000>;
        read-channel = <0x0 0x2000>;
        write-channel = <0x2000 0x2000>;
        interrupts = <0 52 1>;
        interrupt-parent = <&gic>;
        id = <0>;
    };

    aliases {
        ethernet0 = &fec1;
        mmc0 = &usdhc1;
        serial1 = &lpuart1;
        mu1 = &lsio_mu1;
    };

    chosen {
        bootargs = "clk_ignore_unused ip=10.252.62.70::10.252.62.1:255.255.255.0::eth0:off carrier_timeout=0 console=ttyLP1,115200 earlycon fw_devlink=permissive root=/dev/mmcblk0p2 rootwait rw random.trust_cpu=1";
        stdout-path = &lpuart1;
    };
};

[DavidMCerdeira]

Greetings @iorvrse,

We have limited experience with RPMsg, but looking at your config we spotted something that's likely the root cause.

Your Bao VM memory region is:

.regions =  (struct vm_mem_region[]) {
    {
        .base = 0x80200000,
        .size = 0x40000000
    }
},

Without .place_phys = true, Bao is free to map that guest physical address (GPA) range to a different host physical address (HPA). Linux writes to the vrings and buffers at what it believes is physical address 0x90000000, but the actual hardware RAM backing that GPA may be somewhere else entirely. Meanwhile, the M4 accesses 0x90000000 in real physical memory directly, so the two cores are reading and writing completely different memory. This explains why no endpoint handshake ever completes.
The fix is to add .place_phys = true and .phys to your region so Bao enforces an identity mapping (GPA == HPA):

.regions = (struct vm_mem_region[]) {
    {
        .base = 0x80200000,
        .size = 0x40000000,
        .place_phys = true,
        .phys = 0x80200000,
    }
},

Let me know if this helps.

[iorvrse]

Sorry for the late reply.

I tried that but didn't get any log output from Bao until I tried changing the Bao load address. Did using .phys=0x80200000 cause Bao to overwrite itself with the 1GB Linux image? Shifting Bao to 0xe5000000 fixed it, and RPMsg finally works!

Thanks.

[DavidMCerdeira]

RPMsg finally works!

I'm glad to hear it!

Did using .phys=0x80200000 cause Bao to overwrite itself with the 1GB Linux image?

Bao detects the conflict during early memory initialization and stops execution. However, console is only initialized afterwards, so there's no output. It's a quirk we are aware of, but still need to set aside some time to figure out the ideal solution.