I need to get into more detail about memory used for the rpmsg communication:
The memory used to transmit messages between M4 and A7 is split into two regions:
A linked list VRING, which contains (in a simplified view) only a list of pointers. Each pointer points to an actual message.
- To be a bit more precise, there are two such lists VRING0 and VRING1, one for the communication A7 → M4, and one for the communication M4 → A7.
The actual storage (virtual queue) for the messages themselves.
First Region: VRING0 and VRING1
The VRING0 and VRING1 storage is located at 0xbfff0000, as you found it in the device tree.
VRING0 and VRING1 each occupy roughly 26 bytes for every entry, so for 256 buffers this would be 6.6kB. Due to alignment requirements it is 10.1kB for each VRING0 and VRING1.
Second Region: Virtual Queue
This memory region is not at a fixed position. Instead Linux allocates it dynamically from the shared-dma-pool.