summaryrefslogtreecommitdiffstats
path: root/drivers/mailbox
AgeCommit message (Collapse)AuthorLines
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook-2/+2
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-01mailbox: sprd: mask interrupts that are not handledOtto Pflüger-6/+4
To reduce the amount of spurious interrupts, disable the interrupts that are not handled in this driver. Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-02-01mailbox: sprd: add support for mailbox revision 2Otto Pflüger-21/+82
Newer Unisoc SoCs such as UMS9230 include a new revision of the mailbox IP with support for up to 16 channels. Since the new revision has a similar register layout and many parts have remained unchanged, make the driver support both revisions. Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-02-01mailbox: sprd: clear delivery flag before handling TX doneOtto Pflüger-5/+5
If there are any pending messages in the mailbox queue, they are sent as soon as a TX done event arrives from the driver. This may trigger a new delivery interrupt while the previous one is still being handled. If the delivery status is cleared after this, the interrupt is lost. To prevent this from happening, clear the delivery status immediately after checking it and before any new messages are sent. Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-02-01mailbox: bcm-ferxrm-mailbox: Use default primary handlerSebastian Andrzej Siewior-12/+2
request_threaded_irq() is invoked with a primary and a secondary handler and no flags are passed. The primary handler is the same as irq_default_primary_handler() so there is no need to have an identical copy. The lack of the IRQF_ONESHOT can be dangerous because the interrupt source is not masked while the threaded handler is active. This means, especially on LEVEL typed interrupt lines, the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-02-01mailbox: Remove mailbox_client.h from controller driversPeng Fan-3/+0
mailbox_client.h should be used by mailbox consumer drivers, not mailbox controller (provider) drivers. The affected drivers do not use any mailbox client APIs, so the include can be safely removed. Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: zynqmp-ipi: Simplify with scoped for each OF child loopKrzysztof Kozlowski-3/+2
Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: mtk-cmdq: Simplify with scoped for each OF child loopKrzysztof Kozlowski-8/+4
Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: Improve RISCV_SBI_MPXY_MBOX guidanceGeert Uytterhoeven-2/+2
RISC-V SBI Message Proxy (MPXY) Mailbox support defaults to enabled, but the help text states "If unsure say N". Recommend enabling this driver, as it is a very critical RISC-V driver providing mailbox channels to other drivers such as clock, system MSIs, etc. Fixes: bf3022a4eb119c6b ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver") Suggested-by: Anup Patel <anup@brainfault.org> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Anup Patel <anup@brainfault.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warningsValentina Fernandez-12/+9
Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr() by introducing a 'found' flag to track whether the IRQ matches any online hart. If no match is found, return IRQ_NONE. Also fix other smatch warnings by removing dead code in mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the Microchip SBI extension is not found. Fixes below smatch warnings: drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'. drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code. drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe' Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/ Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: arm_mhuv3: fix typo in commentLakshmi S-1/+1
Fix typo "channnels"-> "channels" in struct documentation. Signed-off-by: Lakshmi S <lakshmicar.2023@gmail.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: cix: fix typo in error messageLakshmi S-1/+1
Fix typo "overlow" -> "overflow" in FIFO overflow error message. Signed-off-by: Lakshmi S <lakshmicar.2023@gmail.com> Reviewed-by: Peter Chen <peter.chen@cixtech.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: imx: Skip the suspend flag for i.MX7ULPJacky Bai-2/+6
In current imx-mailbox driver, the MU IRQ is configured with 'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: fix wakeup failure from freeze mode"), if the MU IRQ is triggered after the priv->suspended flag has been set, the system suspend will be aborted. On i.MX7ULP platform, certain drivers that depend on rpmsg may need to send rpmsg request and receive an acknowledgment from the remote core during the late_suspend stage. Early suspend abort is not expected, and the i.MX7ULP already has additional hardware and software to make sure the system can be wakeup from freeze mode correctly when MU IRQ is trigger. Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the early abort when doing suspend. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: exynos: drop unneeded runtime pointer (pclk)André Draszik-5/+4
pclk is not needed past probe(), just drop it. This saves a little bit of runtime memory. Signed-off-by: André Draszik <andre.draszik@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-24mailbox: pcc: Remove spurious IRQF_ONESHOT usageMark Brown-1/+1
The PCC code currently specifies IRQF_ONESHOT if the interrupt could potentially be shared but doesn't actually use request_threaded_irq() and the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is never relevant. Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler") specifying it has resulted in a WARN_ON(), fix this by removing IRQF_ONESHOT. Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com> Signed-off-by: Mark Brown <broonie@kernel.org> Reviewed-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add driver data to support for MT8196Jason-JH Lin-0/+12
MT8196 has 2 new hardware configuration compared with the previous SoC, which correspond to the 2 new driver data: 1. mminfra_offset: For GCE data path control Since GCE has been moved into mminfra, GCE needs to append the mminfra offset to the DRAM address when accessing the DRAM. 2. gce_vm: For GCE hardware virtualization control Currently, the first version of the mt8196 mailbox controller only requires setting the VM-related registers to enable the permissions of a host VM. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: CK Hu <ck.hu@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transactionJason-JH Lin-2/+4
The GCE in MT8196 is placed in MMINFRA and requires all addresses in GCE instructions for DRAM transactions to be IOVA. Due to MMIO, if the GCE needs to access a hardware register at 0x1000_0000, but the SMMU is also mapping a DRAM block at 0x1000_0000, the MMINFRA will not know whether to write to the hardware register or the DRAM. To solve this, MMINFRA treats addresses greater than 2G as data paths and those less than 2G as config paths because the DRAM start address is currently at 2G (0x8000_0000). On the data path, MMINFRA remaps DRAM addresses by subtracting 2G, allowing SMMU to map DRAM addresses less than 2G. For example, if the DRAM start address 0x8000_0000 is mapped to IOVA=0x0, when GCE accesses IOVA=0x0, it must add a 2G offset to the address in the GCE instruction. MMINFRA will then see it as a data path (IOVA >= 2G) and subtract 2G, allowing GCE to access IOVA=0x0. Since the MMINFRA remap subtracting 2G is done in hardware and cannot be configured by software, the address of DRAM in GCE instruction must always add 2G to ensure proper access. After that, the shift functions do more than just shift addresses, so the APIs were renamed to cmdq_convert_gce_addr() and cmdq_revert_gce_addr(). This 2G adjustment is referred to as mminfra_offset in the CMDQ driver. CMDQ helper can get the mminfra_offset from the cmdq_mbox_priv of cmdq_pkt and add the mminfra_offset to the DRAM address in GCE instructions. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add GCE hardware virtualization configurationJason-JH Lin-0/+48
The GCE hardware virtualization configuration supports the isolation of GCE hardware resources across different OS environments. Each OS is treated as a virtual machine (VM) for GCE purposes. There are 6 VMs and 1 host VM. The host VM has main control over the GCE virtualization settings for all VMs. To properly access the GCE thread registers, it is necessary to configure access permissions for specific GCE threads assigned to different VMs. Currently, since only the host VM is being used, it is required to enable access permissions for all GCE threads for the host VM. There are 2 VM configurations: 1. VM_ID_MAP There are 4 registers to allocate 32 GCE threads across different VMs: VM_ID_MAP0 for threads 0-9, VM_ID_MAP1 for threads 10-19, VM_ID_MAP2 for threads 20-29, and VM_ID_MAP3 for threads 30-31. Each thread has a 3-bit configuration, where setting all bits to 1 configures the thread for the host VM. 2. VM_CPR_GSIZE It is used to allocate the CPR SRAM size to each VM. Each VM has 4-bit configuration, where setting bit 0-3 to configures the size of host VM. This setting must be configured before the VM configuration to prevent resource leakage. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instructionJason-JH Lin-0/+8
Add the cmdq_mbox_priv structure to store the private data of GCE, such as the shift bits of the physical address. Then, include the cmdq_mbox_priv structure within the cmdq_pkt structure. This allows CMDQ users to utilize the private data in cmdq_pkt to generate GCE instructions when needed. Additionally, having cmdq_mbox_priv makes it easier to expand and reference other GCE private data in the future. Add cmdq_get_mbox_priv() for CMDQ users to get all the private data into the cmdq_mbox_priv of the cmdq_pkt. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Clear any pending responder interrupts before enabling itSudeep Holla-0/+6
Some platforms may leave a responder interrupt pending from earlier transactions. If a PCC responder channel has a pending interrupt when the controller starts up, enabling the IRQ line without first clearing the condition can lead to a spurious interrupt which could disrupt other transmissions if the IRQ is shared. Explicitly clear any pending responder interrupt before enabling the IRQ to ensure a clean start. Acknowledge the responder channel via pcc_chan_acknowledge() in startup before requesting/enablement of the IRQ. This ensures a clean baseline for the first transfer/receiption of the notification/response. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Initialize SHMEM before binding the channel with the clientSudeep Holla-8/+10
The PCC channel's shared memory region must be set up before the mailbox controller binds the channel with the client, as the binding process may trigger client operations like startup() that may rely on SHMEM being initialized. Reorder the setup sequence to ensure the shared memory is ready before binding. Initialize and map the PCC shared memory (SHMEM) prior to calling mbox_bind_client() so that clients never observe an uninitialized or NULL SHMEM during bind-time callbacks or early use in startup(). This makes the PCC mailbox channel bring-up order consistent and eliminates a race between SHMEM setup and client binding. This will be needed in channel startup to clear/acknowledge any pending interrupts before enabling them. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Acked-by: lihuisong@huawei.com Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Mark Tx as complete in PCC IRQ handlerSudeep Holla-0/+1
The PCC IRQ handler clears channel-in-use and notifies clients with mbox_chan_received_data(), but it does not explicitly mark the transmit as complete. In IRQ completion mode this could leave Tx complete waiters hanging or lead to generic timeouts in the mailbox core. Invoke mbox_chan_txdone() in the IRQ path once the platform has acknowledged the transfer so the core can wake any waiters and update state accordingly. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Set txdone_irq/txdone_poll based on PCCT flagsSudeep Holla-1/+6
The PCC controller currently enables txdone via IRQ if the PCCT exposes platform capability to generate command completion interrupt, but it leaves txdone_poll unchanged. Make the behaviour explicit: - If ACPI_PCCT_DOORBELL is present, use txdone_irq and disable polling. - Otherwise, disable txdone_irq and fall back to txdone_poll. Configure the PCC mailbox to use interrupt-based completion for PCC types that signal completion via IRQ using TXDONE_BY_IRQ, and fall back to polling for others using TXDONE_BY_POLL. This ensures the PCC driver uses the appropriate completion mechanism according to the PCCT table definition and makes the completion mode unambiguous avoiding mixed signalling when the platform lacks a doorbell flag set. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Wire up ->last_tx_done() for PCC channelsSudeep Holla-0/+8
Some PCC users poll for completion between transfers and benefit from the knowledge of previous Tx completion check through the mailbox framework's ->last_tx_done() op. Hook up the last_tx_done callback in the PCC mailbox driver so the mailbox framework can correctly query the completion status of the last transmitted message. This aligns PCC with other controllers that already implement such last_tx_done status query. No functional change unless callers use ->last_tx_done(). Normal Tx and IRQ paths are unchanged. This change just improves synchronization and avoids unnecessary timeouts for non-interrupt driven channels by ensuring correct completion detection for PCC channels that don’t rely on interrupts. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18Revert "mailbox/pcc: support mailbox management of the shared buffer"Sudeep Holla-98/+4
This reverts commit 5378bdf6a611a32500fccf13d14156f219bb0c85. Commit 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") attempted to introduce generic helpers for managing the PCC shared memory, but it largely duplicates functionality already provided by the mailbox core and leaves gaps: 1. TX preparation: The mailbox framework already supports this via ->tx_prepare callback for mailbox clients. The patch adds pcc_write_to_buffer() and expects clients to toggle pchan->chan.manage_writes, but no drivers set manage_writes, so pcc_write_to_buffer() has no users. 2. RX handling: Data reception is already delivered through mbox_chan_received_data() and client ->rx_callback. The patch adds an optional pchan->chan.rx_alloc, which again has no users and duplicates the existing path. 3. Completion handling: While adding last_tx_done is directionally useful, the implementation only covers Type 3/4 and fails to handle the absence of a command_complete register, so it is incomplete for other types. Given the duplication and incomplete coverage, revert this change. Any new requirements should be addressed in focused follow-ups rather than bundling multiple behavioral changes together. Fixes: 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mpfs: drop POLARFIRE from ARCH_MICROCHIP_POLARFIREConor Dooley-1/+1
The ARCH_MICROCHIP symbol has been defined for some time on RISCV, as a replacement for ARCH_MICROCHIP_POLARFIRE since there are now other Microchip RISC-V products. Drop the POLARFIRE from ARCH_MICROCHIP_POLARFIRE in the POLARFIRE_SOC_MAILBOX Kconfig entry since the newly added pic64gx also uses the mailbox and it is one of the few users of ARCH_MICROCHIP_POLARFIRE left in the tree. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mchp-ipc-sbi: fix out-of-bounds access in ↵Valentina Fernandez-11/+11
mchp_ipc_get_cluster_aggr_irq() The cluster_cfg array is dynamically allocated to hold per-CPU configuration structures, with its size based on the number of online CPUs. Previously, this array was indexed using hartid, which may be non-contiguous or exceed the bounds of the array, leading to out-of-bounds access. Switch to using cpuid as the index, as it is guaranteed to be within the valid range provided by for_each_online_cpu(). Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: remove unneeded double quotationKuninori Morimoto-1/+1
It makes Kconfig strange. fix it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()Joonwon Kang-4/+2
Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable@vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang@google.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mediatek: Add mtk-vcp-mailbox driverJjian Zhou-0/+181
Add mtk-vcp-mailbox driver to support the communication with VCP remote microprocessor. Signed-off-by: Jjian Zhou <jjian.zhou@mediatek.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28mailbox: th1520: fix clock imbalance on probe failureJohan Hovold-3/+1
The purpose of the devm_add_action_or_reset() helper is to call the action function in case adding an action ever fails so drop the clock disable from the error path to avoid disabling the clocks twice. Fixes: 5d4d263e1c6b ("mailbox: Introduce support for T-head TH1520 Mailbox driver") Cc: Michal Wilczynski <m.wilczynski@samsung.com> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Michal Wilczynski <m.wilczynski@samsung.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28mailbox: pcc: don't zero error registerJamie Iles-4/+4
The error status mask for a type 3/4 subspace is used for reading the error status, and the bitwise inverse is used for clearing the error with the intent being to preserve any of the non-error bits. However, we were previously applying the mask to extract the status and then applying the inverse to the result which ended up clearing all bits. Instead, store the inverse mask in the preserve mask and then use that on the original value read from the error status so that only the error is cleared. Fixes: c45ded7e1135 ("mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)") Signed-off-by: Jamie Iles <jamie.iles@oss.qualcomm.com> Signed-off-by: Punit Agrawal <punit.agrawal@oss.qualcomm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28mailbox: mtk-gpueb: Add missing 'static' to mailbox ops structNicolas Frattaroli-1/+1
mtk_gpueb_mbox_ops should be declared static. However, due to its const nature, this specifier was missed, as it compiled fine without it and with no warning by the compiler. arc-linux-gcc (GCC) 12.5.0 doesn't seem to like it however, so add the static to fix that. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202510100629.3nGvrhEU-lkp@intel.com/ Fixes: dbca0eabb821 ("mailbox: add MediaTek GPUEB IPI mailbox") Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28mailbox: mtk-cmdq: Refine DMA address handling for the command bufferJason-JH Lin-14/+31
GCE can only fetch the command buffer address from a 32-bit register. Some SoCs support a 35-bit command buffer address for GCE, which requires a right shift of 3 bits before setting the address into the 32-bit register. A comment has been added to the header of cmdq_get_shift_pa() to explain this requirement. To prevent the GCE command buffer address from being DMA mapped beyond its supported bit range, the DMA bit mask for the device is set during initialization. Additionally, to ensure the correct shift is applied when setting or reading the register that stores the GCE command buffer address, new APIs, cmdq_convert_gce_addr() and cmdq_revert_gce_addr(), have been introduced for consistent operations on this register. The variable type for the command buffer address has been standardized to dma_addr_t to prevent handling issues caused by type mismatches. Fixes: 0858fde496f8 ("mailbox: cmdq: variablize address shift in platform") Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28mailbox: mailbox-test: Fix debugfs_create_dir error checkingHaotian Zhang-1/+1
The debugfs_create_dir() function returns ERR_PTR() on error, not NULL. The current null-check fails to catch errors. Use IS_ERR() to correctly check for errors. Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusiveBeleswar Padhi-15/+20
On TI K3 devices, the mailbox resides in the Always-On power domain (LPSC_main_alwayson) and is shared among multiple processors. The mailbox is not solely exclusive to Linux. Currently, the suspend path checks all FIFO queues for pending messages and blocks suspend if any are present. This behavior is unnecessary for K3 devices, since some of the FIFOs are used for RTOS<->RTOS communication and are independent of Linux. For FIFOs used in Linux<->RTOS communication, any pending message would trigger an interrupt, which naturally prevents suspend from completing. Hence, there is no need for the mailbox driver to explicitly check for pending messages on K3 platforms. Introduce a device match flag to indicate whether the mailbox instance is exclusive to Linux, and skip the pending message check for non-exclusive instances (such as in K3). Fixes: a49f991e740f ("arm64: dts: ti: k3-am62-verdin: Add missing cfg for TI IPC Firmware") Closes: https://lore.kernel.org/all/sid7gtg5vay5qgicsl6smnzwg5mnneoa35cempt5ddwjvedaio@hzsgcx6oo74l/ Signed-off-by: Beleswar Padhi <b-padhi@ti.com> Tested-by: Hiago De Franco <hiago.franco@toradex.com> Reviewed-by: Andrew Davis <afd@ti.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-08Merge tag 'mailbox-v6.18' of ↵Linus Torvalds-24/+346
git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - Qualcomm: add Glymur CPUCP mailbox binding - Xilinx Zynq: misc cleanup - MediaTek: - add new GPUEB mailbox driver - cmdq: remove pm_runtime calls from send_data - gce: make clock-names optional - misc: - change mailbox-altera maintainer - remove redundant 'fast_io' in regmap_config - mhuv3: Remove no_free_ptr * tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() mailbox: add MediaTek GPUEB IPI mailbox dt-bindings: mailbox: Add MT8196 GPUEB Mailbox mailbox: zynqmp-ipi: Fix SGI cleanup on unbind mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call mailbox: remove unneeded 'fast_io' parameter in regmap_config dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional dt-bindings: mailbox: qcom: Document Glymur CPUCP mailbox controller binding MAINTAINERS: Change mailbox-altera maintainer mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of the pointer
2025-10-07mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()Jason-JH Lin-11/+1
pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() (mailbox.c). This caused lockdep warnings such as "sleeping function called from invalid context" when running with lockdebug enabled. The BUG report: BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1 Hardware name: Google Ciri sku0/unprovisioned board (DT) Workqueue: imgsys_runner imgsys_runner_func Call trace: dump_backtrace+0x100/0x120 show_stack+0x20/0x2c dump_stack_lvl+0x84/0xb4 dump_stack+0x18/0x48 __might_resched+0x354/0x4c0 __might_sleep+0x98/0xe4 __pm_runtime_resume+0x70/0x124 cmdq_mbox_send_data+0xe4/0xb1c msg_submit+0x194/0x2dc mbox_send_message+0x190/0x330 imgsys_cmdq_sendtask+0x1618/0x2224 imgsys_runner_func+0xac/0x11c process_one_work+0x638/0xf84 worker_thread+0x808/0xcd0 kthread+0x24c/0x324 ret_from_fork+0x10/0x20 Additionally, pm_runtime_put_autosuspend() should be invoked from the GCE IRQ handler to ensure the hardware has actually completed its work. To resolve these issues, remove the pm_runtime calls from cmdq_mbox_send_data() and delegate power management responsibilities to the client driver. Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: add MediaTek GPUEB IPI mailboxNicolas Frattaroli-0/+331
The MT8196 SoC uses an embedded MCU to control frequencies and power of the GPU. This controller is referred to as "GPUEB". It communicates to the application processor, among other ways, through a mailbox. The mailbox exposes one interrupt, which appears to only be fired when a response is received, rather than a transaction is completed. For us, this means we unfortunately need to poll for txdone. The mailbox also requires the EB clock to be on when touching any of the mailbox registers. Add a simple driver for it based on the common mailbox framework. Reviewed-by: Chia-I Wu <olvaffe@gmail.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: zynqmp-ipi: Fix SGI cleanup on unbindHarini T-5/+10
The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to kernel crash. Add explicit irq_type field to pdata for reliable identification of SGI interrupts (type-2) and only clean up SGI resources when appropriate. Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI") Signed-off-by: Harini T <harini.t@amd.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loopHarini T-1/+1
The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T <harini.t@amd.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxesHarini T-4/+2
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes. device_is_registered() is the canonical and robust method to verify the registration status. Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T <harini.t@amd.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() callHarini T-1/+0
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary. Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T <harini.t@amd.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: remove unneeded 'fast_io' parameter in regmap_configWolfram Sang-1/+0
When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-10-06mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of ↵Liao Yuanhong-1/+1
the pointer Remove no_free_ptr() to ensure PTR_ERR() consistently retrieves the correct error code. Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Acked-by: Cristian Marussi <cristian.marussi@arm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-09-25mailbox/riscv-sbi-mpxy: Add ACPI supportSunil V L-1/+26
Add ACPI support for the RISC-V SBI message proxy (MPXY) based mailbox driver. Acked-by: Jassi Brar <jassisinghbrar@gmail.com> Signed-off-by: Sunil V L <sunilvl@ventanamicro.com> Signed-off-by: Anup Patel <apatel@ventanamicro.com> Link: https://lore.kernel.org/r/20250818040920.272664-22-apatel@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-24mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driverAnup Patel-0/+1007
Add a mailbox controller driver for the new SBI message proxy extension which is part of the SBI v3.0 specification. Acked-by: Jassi Brar <jassisinghbrar@gmail.com> Co-developed-by: Rahul Pathak <rpathak@ventanamicro.com> Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com> Signed-off-by: Anup Patel <apatel@ventanamicro.com> Link: https://lore.kernel.org/r/20250818040920.272664-8-apatel@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-24mailbox: Allow controller specific mapping using fwnodeAnup Patel-25/+40
Introduce optional fw_node() callback which allows a mailbox controller driver to provide controller specific mapping using fwnode. The Linux OF framework already implements fwnode operations for the Linux DD framework so the fw_xlate() callback works fine with device tree as well. Acked-by: Jassi Brar <jassisinghbrar@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Anup Patel <apatel@ventanamicro.com> Link: https://lore.kernel.org/r/20250818040920.272664-6-apatel@ventanamicro.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-08-07mailbox/pcc: support mailbox management of the shared bufferAdam Young-4/+98
Define a new, optional, callback that allows the driver to specify how the return data buffer is allocated. If that callback is set, mailbox/pcc.c is now responsible for reading from and writing to the PCC shared buffer. This also allows for proper checks of the Commnand complete flag between the PCC sender and receiver. For Type 4 channels, initialize the command complete flag prior to accepting messages. Since the mailbox does not know what memory allocation scheme to use for response messages, the client now has an optional callback that allows it to allocate the buffer for a response message. When an outbound message is written to the buffer, the mailbox checks for the flag indicating the client wants an tx complete notification via IRQ. Upon receipt of the interrupt It will pair it with the outgoing message. The expected use is to free the kernel memory buffer for the previous outgoing message. Signed-off-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-08-06mailbox: bcm74110: Fix spelling mistakeColin Ian King-1/+1
There is a spelling mistake in the author's email address. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Justin Chen <justin.chen@broadcom.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>