From c2b75a5353aec990bbb8bd53737d39b497a7bdaa Mon Sep 17 00:00:00 2001 From: Jjian Zhou Date: Mon, 13 Oct 2025 14:31:35 +0800 Subject: [PATCH 01/34] dt-bindings: mailbox: mediatek,mt8196-vcp-mbox: add mtk vcp-mbox document The MTK VCP mailbox enables the SoC to communicate with the VCP by passing messages through 64 32-bit wide registers. It has 32 interrupt vectors in either direction for signalling purposes. This adds a binding for Mediatek VCP mailbox. Signed-off-by: Jjian Zhou Reviewed-by: Krzysztof Kozlowski Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar --- .../mailbox/mediatek,mt8196-vcp-mbox.yaml | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 Documentation/devicetree/bindings/mailbox/mediatek,mt8196-vcp-mbox.yaml diff --git a/Documentation/devicetree/bindings/mailbox/mediatek,mt8196-vcp-mbox.yaml b/Documentation/devicetree/bindings/mailbox/mediatek,mt8196-vcp-mbox.yaml new file mode 100644 index 000000000000..7b1c5165e64e --- /dev/null +++ b/Documentation/devicetree/bindings/mailbox/mediatek,mt8196-vcp-mbox.yaml @@ -0,0 +1,49 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/mailbox/mediatek,mt8196-vcp-mbox.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: MediaTek Video Companion Processor (VCP) mailbox + +maintainers: + - Jjian Zhou + +description: + The MTK VCP mailbox enables the SoC to communicate with the VCP by passing + messages through 64 32-bit wide registers. It has 32 interrupt vectors in + either direction for signalling purposes. + +properties: + compatible: + enum: + - mediatek,mt8196-vcp-mbox + + reg: + maxItems: 1 + + interrupts: + maxItems: 1 + + "#mbox-cells": + const: 0 + +required: + - compatible + - reg + - interrupts + - "#mbox-cells" + +additionalProperties: false + +examples: + - | + #include + #include + + mailbox@31b80000 { + compatible = "mediatek,mt8196-vcp-mbox"; + reg = <0x31b80000 0x1000>; + interrupts = ; + #mbox-cells = <0>; + }; From b562abd956726f57bb78813b4c77db51d28933a9 Mon Sep 17 00:00:00 2001 From: Jjian Zhou Date: Mon, 13 Oct 2025 14:31:36 +0800 Subject: [PATCH 02/34] mailbox: mediatek: Add mtk-vcp-mailbox driver Add mtk-vcp-mailbox driver to support the communication with VCP remote microprocessor. Signed-off-by: Jjian Zhou Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar --- drivers/mailbox/Kconfig | 9 ++ drivers/mailbox/Makefile | 2 + drivers/mailbox/mtk-vcp-mailbox.c | 170 ++++++++++++++++++++++++ include/linux/mailbox/mtk-vcp-mailbox.h | 32 +++++ 4 files changed, 213 insertions(+) create mode 100644 drivers/mailbox/mtk-vcp-mailbox.c create mode 100644 include/linux/mailbox/mtk-vcp-mailbox.h diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig index 29f16f220384..d7f8db25f3b3 100644 --- a/drivers/mailbox/Kconfig +++ b/drivers/mailbox/Kconfig @@ -304,6 +304,15 @@ config MTK_GPUEB_MBOX Say Y or m here if you want to support the MT8196 SoC in your kernel build. +config MTK_VCP_MBOX + tristate "MediaTek VCP Mailbox Support" + depends on ARCH_MEDIATEK || COMPILE_TEST + help + Say yes here to add support for the MediaTek VCP mailbox driver. + The mailbox implementation provides access from the application + processor to Video Companion Processor Unit. + If unsure say N. + config ZYNQMP_IPI_MBOX tristate "Xilinx ZynqMP IPI Mailbox" depends on ARCH_ZYNQMP && OF diff --git a/drivers/mailbox/Makefile b/drivers/mailbox/Makefile index 81820a4f5528..944d8ea39f34 100644 --- a/drivers/mailbox/Makefile +++ b/drivers/mailbox/Makefile @@ -65,6 +65,8 @@ obj-$(CONFIG_MTK_CMDQ_MBOX) += mtk-cmdq-mailbox.o obj-$(CONFIG_MTK_GPUEB_MBOX) += mtk-gpueb-mailbox.o +obj-$(CONFIG_MTK_VCP_MBOX) += mtk-vcp-mailbox.o + obj-$(CONFIG_ZYNQMP_IPI_MBOX) += zynqmp-ipi-mailbox.o obj-$(CONFIG_SUN6I_MSGBOX) += sun6i-msgbox.o diff --git a/drivers/mailbox/mtk-vcp-mailbox.c b/drivers/mailbox/mtk-vcp-mailbox.c new file mode 100644 index 000000000000..cedad575528f --- /dev/null +++ b/drivers/mailbox/mtk-vcp-mailbox.c @@ -0,0 +1,170 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2025 MediaTek Corporation. All rights reserved. + * Author: Jjian Zhou + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +struct mtk_vcp_mbox { + struct mbox_controller mbox; + void __iomem *base; + struct device *dev; + const struct mtk_vcp_mbox_cfg *cfg; + struct mtk_ipi_info ipi_recv; + struct mbox_chan chans; +}; + +struct mtk_vcp_mbox_cfg { + u16 set_in; + u16 clr_out; +}; + +static irqreturn_t mtk_vcp_mbox_irq_thread(int irq, void *data) +{ + struct mtk_vcp_mbox *priv = data; + + /* get irq status */ + priv->ipi_recv.irq_status = readl(priv->base + priv->cfg->clr_out); + + __ioread32_copy(priv->ipi_recv.msg, priv->base, + MTK_VCP_MBOX_SLOT_MAX_SIZE / 4); + + mbox_chan_received_data(&priv->chans, &priv->ipi_recv); + + /* clear irq status */ + writel(priv->ipi_recv.irq_status, priv->base + priv->cfg->clr_out); + + return IRQ_HANDLED; +} + +static struct mbox_chan *mtk_vcp_mbox_xlate(struct mbox_controller *mbox, + const struct of_phandle_args *sp) +{ + if (sp->args_count) + return NULL; + + return &mbox->chans[0]; +} + +static int mtk_vcp_mbox_send_data(struct mbox_chan *chan, void *data) +{ + struct mtk_vcp_mbox *priv = chan->con_priv; + struct mtk_ipi_info *ipi_info = data; + u32 status; + + if (!ipi_info->msg) { + dev_err(priv->dev, "msg buffer is NULL.\n"); + return -EINVAL; + } + + status = readl(priv->base + priv->cfg->set_in); + if (status & BIT(ipi_info->index)) { + dev_warn(priv->dev, "mailbox IPI %d is busy.\n", ipi_info->id); + return -EBUSY; + } + + if (ipi_info->slot_ofs + ipi_info->len > MTK_VCP_MBOX_SLOT_MAX_SIZE) + return -EINVAL; + __iowrite32_copy(priv->base + ipi_info->slot_ofs, ipi_info->msg, + ipi_info->len); + + writel(BIT(ipi_info->index), priv->base + priv->cfg->set_in); + + return 0; +} + +static bool mtk_vcp_mbox_last_tx_done(struct mbox_chan *chan) +{ + struct mtk_ipi_info *ipi_info = chan->active_req; + struct mtk_vcp_mbox *priv = chan->con_priv; + + return !(readl(priv->base + priv->cfg->set_in) & BIT(ipi_info->index)); +} + +static const struct mbox_chan_ops mtk_vcp_mbox_chan_ops = { + .send_data = mtk_vcp_mbox_send_data, + .last_tx_done = mtk_vcp_mbox_last_tx_done, +}; + +static int mtk_vcp_mbox_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct mtk_vcp_mbox *priv; + struct mbox_controller *mbox; + int ret, irq; + + priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + priv->dev = dev; + priv->chans.con_priv = priv; + mbox = &priv->mbox; + mbox->dev = dev; + mbox->ops = &mtk_vcp_mbox_chan_ops; + mbox->txdone_irq = false; + mbox->txdone_poll = true; + mbox->of_xlate = mtk_vcp_mbox_xlate; + mbox->num_chans = 1; + mbox->chans = &priv->chans; + + priv->ipi_recv.msg = devm_kzalloc(dev, MTK_VCP_MBOX_SLOT_MAX_SIZE, + GFP_KERNEL); + if (!priv->ipi_recv.msg) + return -ENOMEM; + + priv->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(priv->base)) + return PTR_ERR(priv->base); + + priv->cfg = of_device_get_match_data(dev); + if (!priv->cfg) + return -EINVAL; + + platform_set_drvdata(pdev, priv); + + irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + + ret = devm_request_threaded_irq(dev, irq, NULL, + mtk_vcp_mbox_irq_thread, IRQF_ONESHOT, + dev_name(dev), priv); + if (ret < 0) + return ret; + + return devm_mbox_controller_register(dev, &priv->mbox); +} + +static const struct mtk_vcp_mbox_cfg mt8196_cfg = { + .set_in = 0x100, + .clr_out = 0x10c, +}; + +static const struct of_device_id mtk_vcp_mbox_of_match[] = { + { .compatible = "mediatek,mt8196-vcp-mbox", .data = &mt8196_cfg }, + {}, +}; +MODULE_DEVICE_TABLE(of, mtk_vcp_mbox_of_match); + +static struct platform_driver mtk_vcp_mbox_driver = { + .probe = mtk_vcp_mbox_probe, + .driver = { + .name = "mtk_vcp_mbox", + .of_match_table = mtk_vcp_mbox_of_match, + }, +}; +module_platform_driver(mtk_vcp_mbox_driver); + +MODULE_AUTHOR("Jjian Zhou "); +MODULE_DESCRIPTION("MTK VCP Mailbox Controller"); +MODULE_LICENSE("GPL"); diff --git a/include/linux/mailbox/mtk-vcp-mailbox.h b/include/linux/mailbox/mtk-vcp-mailbox.h new file mode 100644 index 000000000000..16e59d6780a7 --- /dev/null +++ b/include/linux/mailbox/mtk-vcp-mailbox.h @@ -0,0 +1,32 @@ +/* SPDX-License-Identifier: (GPL-2.0 OR MIT) */ +/* + * Copyright (c) 2025 MediaTek Inc. + */ + +#ifndef __MTK_VCP_MAILBOX_H__ +#define __MTK_VCP_MAILBOX_H__ + +#define MTK_VCP_MBOX_SLOT_MAX_SIZE 0x100 /* mbox max slot size */ + +/** + * struct mtk_ipi_info - mailbox message info for mtk-vcp-mailbox + * @msg: The share buffer between IPC and mailbox driver + * @len: Message length + * @id: This is for identification purposes and not actually used + * by the mailbox hardware. + * @index: The signal number of the mailbox message. + * @slot_ofs: Data slot offset. + * @irq_status: Captures incoming signals for the RX path. + * + * It is used between IPC with mailbox driver. + */ +struct mtk_ipi_info { + void *msg; + u32 len; + u32 id; + u32 index; + u32 slot_ofs; + u32 irq_status; +}; + +#endif From fcd7f96c783626c07ee3ed75fa3739a8a2052310 Mon Sep 17 00:00:00 2001 From: Joonwon Kang Date: Wed, 26 Nov 2025 06:22:50 +0000 Subject: [PATCH 03/34] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable@vger.kernel.org Signed-off-by: Joonwon Kang Signed-off-by: Jassi Brar --- drivers/mailbox/mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c index 2acc6ec229a4..617ba505691d 100644 --- a/drivers/mailbox/mailbox.c +++ b/drivers/mailbox/mailbox.c @@ -489,12 +489,10 @@ EXPORT_SYMBOL_GPL(mbox_free_channel); static struct mbox_chan *fw_mbox_index_xlate(struct mbox_controller *mbox, const struct fwnode_reference_args *sp) { - int ind = sp->args[0]; - - if (ind >= mbox->num_chans) + if (sp->nargs < 1 || sp->args[0] >= mbox->num_chans) return ERR_PTR(-EINVAL); - return &mbox->chans[ind]; + return &mbox->chans[sp->args[0]]; } /** From da5eef6a5e941faf6bf5942696671aa15216cfbb Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Wed, 29 Oct 2025 23:38:40 +0000 Subject: [PATCH 04/34] mailbox: remove unneeded double quotation It makes Kconfig strange. fix it. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Signed-off-by: Jassi Brar --- drivers/mailbox/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig index d7f8db25f3b3..be6c95aba166 100644 --- a/drivers/mailbox/Kconfig +++ b/drivers/mailbox/Kconfig @@ -279,7 +279,7 @@ config MTK_ADSP_MBOX tristate "MediaTek ADSP Mailbox Controller" depends on ARCH_MEDIATEK || COMPILE_TEST help - Say yes here to add support for "MediaTek ADSP Mailbox Controller. + Say yes here to add support for MediaTek ADSP Mailbox Controller. This mailbox driver is used to send notification or short message between processors with ADSP. It will place the message to share buffer and will access the ipc control. From d96ebba37b7d08a4d7d5f4b992b4400e6e7b8fa1 Mon Sep 17 00:00:00 2001 From: Jingyi Wang Date: Tue, 21 Oct 2025 23:32:30 -0700 Subject: [PATCH 05/34] dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings for Kaanapali Document CPUSS Control Processor (CPUCP) mailbox controller for Qualcomm Kaanapali, which is compatible with X1E80100, use fallback to indicate this. Signed-off-by: Jingyi Wang Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar --- Documentation/devicetree/bindings/mailbox/qcom,cpucp-mbox.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/mailbox/qcom,cpucp-mbox.yaml b/Documentation/devicetree/bindings/mailbox/qcom,cpucp-mbox.yaml index 9122c3d2dc30..9e91247c521a 100644 --- a/Documentation/devicetree/bindings/mailbox/qcom,cpucp-mbox.yaml +++ b/Documentation/devicetree/bindings/mailbox/qcom,cpucp-mbox.yaml @@ -19,6 +19,7 @@ properties: - items: - enum: - qcom,glymur-cpucp-mbox + - qcom,kaanapali-cpucp-mbox - const: qcom,x1e80100-cpucp-mbox - enum: - qcom,x1e80100-cpucp-mbox From f7c330a8c83c9b0332fd524097eaf3e69148164d Mon Sep 17 00:00:00 2001 From: Valentina Fernandez Date: Thu, 13 Nov 2025 13:49:22 +0000 Subject: [PATCH 06/34] mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() The cluster_cfg array is dynamically allocated to hold per-CPU configuration structures, with its size based on the number of online CPUs. Previously, this array was indexed using hartid, which may be non-contiguous or exceed the bounds of the array, leading to out-of-bounds access. Switch to using cpuid as the index, as it is guaranteed to be within the valid range provided by for_each_online_cpu(). Signed-off-by: Valentina Fernandez Reviewed-by: Conor Dooley Signed-off-by: Jassi Brar --- drivers/mailbox/mailbox-mchp-ipc-sbi.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c index a6e52009a424..d444491a584e 100644 --- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c +++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c @@ -180,20 +180,20 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data) /* Find out the hart that originated the irq */ for_each_online_cpu(i) { hartid = cpuid_to_hartid_map(i); - if (irq == ipc->cluster_cfg[hartid].irq) + if (irq == ipc->cluster_cfg[i].irq) break; } status_msg.cluster = hartid; - memcpy(ipc->cluster_cfg[hartid].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); + memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); - ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[hartid].buf_base_addr); + ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr); if (ret < 0) { dev_err_ratelimited(ipc->dev, "could not get IHC irq status ret=%d\n", ret); return IRQ_HANDLED; } - memcpy(&status_msg, ipc->cluster_cfg[hartid].buf_base, sizeof(struct mchp_ipc_status)); + memcpy(&status_msg, ipc->cluster_cfg[i].buf_base, sizeof(struct mchp_ipc_status)); /* * Iterate over each bit set in the IHC interrupt status register (IRQ_STATUS) to identify @@ -385,21 +385,21 @@ static int mchp_ipc_get_cluster_aggr_irq(struct mchp_ipc_sbi_mbox *ipc) if (ret <= 0) continue; - ipc->cluster_cfg[hartid].irq = ret; - ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[hartid].irq, + ipc->cluster_cfg[cpuid].irq = ret; + ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[cpuid].irq, mchp_ipc_cluster_aggr_isr, IRQF_SHARED, "miv-ihc-irq", ipc); if (ret) return ret; - ipc->cluster_cfg[hartid].buf_base = devm_kmalloc(ipc->dev, - sizeof(struct mchp_ipc_status), - GFP_KERNEL); + ipc->cluster_cfg[cpuid].buf_base = devm_kmalloc(ipc->dev, + sizeof(struct mchp_ipc_status), + GFP_KERNEL); - if (!ipc->cluster_cfg[hartid].buf_base) + if (!ipc->cluster_cfg[cpuid].buf_base) return -ENOMEM; - ipc->cluster_cfg[hartid].buf_base_addr = __pa(ipc->cluster_cfg[hartid].buf_base); + ipc->cluster_cfg[cpuid].buf_base_addr = __pa(ipc->cluster_cfg[cpuid].buf_base); irq_found = true; } From 74ff7036589a8b7708b7cdad76d1aff1a842e5ba Mon Sep 17 00:00:00 2001 From: Pierre-Henry Moussay Date: Mon, 17 Nov 2025 15:46:54 +0000 Subject: [PATCH 07/34] dt-bindings: mbox: add pic64gx mailbox compatibility to mpfs mailbox pic64gx mailbox is compatible with mpfs mailbox, even if the mailbox consumer is not - the underlying communication mechanism is the same. Signed-off-by: Pierre-Henry Moussay Signed-off-by: Conor Dooley Reviewed-by: Rob Herring (Arm) Signed-off-by: Jassi Brar --- .../devicetree/bindings/mailbox/microchip,mpfs-mailbox.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Documentation/devicetree/bindings/mailbox/microchip,mpfs-mailbox.yaml b/Documentation/devicetree/bindings/mailbox/microchip,mpfs-mailbox.yaml index 1332aab9a888..5f2ec74c1b29 100644 --- a/Documentation/devicetree/bindings/mailbox/microchip,mpfs-mailbox.yaml +++ b/Documentation/devicetree/bindings/mailbox/microchip,mpfs-mailbox.yaml @@ -11,7 +11,11 @@ maintainers: properties: compatible: - const: microchip,mpfs-mailbox + oneOf: + - items: + - const: microchip,pic64gx-mailbox + - const: microchip,mpfs-mailbox + - const: microchip,mpfs-mailbox reg: oneOf: From b411f2109ec1fb47384c9596e34826eed8e7aaec Mon Sep 17 00:00:00 2001 From: Conor Dooley Date: Mon, 17 Nov 2025 15:46:56 +0000 Subject: [PATCH 08/34] mailbox: mpfs: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE The ARCH_MICROCHIP symbol has been defined for some time on RISCV, as a replacement for ARCH_MICROCHIP_POLARFIRE since there are now other Microchip RISC-V products. Drop the POLARFIRE from ARCH_MICROCHIP_POLARFIRE in the POLARFIRE_SOC_MAILBOX Kconfig entry since the newly added pic64gx also uses the mailbox and it is one of the few users of ARCH_MICROCHIP_POLARFIRE left in the tree. Signed-off-by: Conor Dooley Signed-off-by: Jassi Brar --- drivers/mailbox/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig index be6c95aba166..559fe32c5d5a 100644 --- a/drivers/mailbox/Kconfig +++ b/drivers/mailbox/Kconfig @@ -199,7 +199,7 @@ config POLARFIRE_SOC_MAILBOX tristate "PolarFire SoC (MPFS) Mailbox" depends on HAS_IOMEM depends on MFD_SYSCON - depends on ARCH_MICROCHIP_POLARFIRE || COMPILE_TEST + depends on ARCH_MICROCHIP || COMPILE_TEST help This driver adds support for the PolarFire SoC (MPFS) mailbox controller. From f82c3e62b6b8c31d8c56415bf38658f306fda4cb Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 16 Oct 2025 20:08:15 +0100 Subject: [PATCH 09/34] Revert "mailbox/pcc: support mailbox management of the shared buffer" This reverts commit 5378bdf6a611a32500fccf13d14156f219bb0c85. Commit 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") attempted to introduce generic helpers for managing the PCC shared memory, but it largely duplicates functionality already provided by the mailbox core and leaves gaps: 1. TX preparation: The mailbox framework already supports this via ->tx_prepare callback for mailbox clients. The patch adds pcc_write_to_buffer() and expects clients to toggle pchan->chan.manage_writes, but no drivers set manage_writes, so pcc_write_to_buffer() has no users. 2. RX handling: Data reception is already delivered through mbox_chan_received_data() and client ->rx_callback. The patch adds an optional pchan->chan.rx_alloc, which again has no users and duplicates the existing path. 3. Completion handling: While adding last_tx_done is directionally useful, the implementation only covers Type 3/4 and fails to handle the absence of a command_complete register, so it is incomplete for other types. Given the duplication and incomplete coverage, revert this change. Any new requirements should be addressed in focused follow-ups rather than bundling multiple behavioral changes together. Fixes: 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") Signed-off-by: Sudeep Holla Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 102 ++---------------------------------------- include/acpi/pcc.h | 29 ------------ 2 files changed, 4 insertions(+), 127 deletions(-) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index ff292b9e0be9..0e0a66359d4c 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -305,22 +305,6 @@ static void pcc_chan_acknowledge(struct pcc_chan_info *pchan) pcc_chan_reg_read_modify_write(&pchan->db); } -static void *write_response(struct pcc_chan_info *pchan) -{ - struct pcc_header pcc_header; - void *buffer; - int data_len; - - memcpy_fromio(&pcc_header, pchan->chan.shmem, - sizeof(pcc_header)); - data_len = pcc_header.length - sizeof(u32) + sizeof(struct pcc_header); - - buffer = pchan->chan.rx_alloc(pchan->chan.mchan->cl, data_len); - if (buffer != NULL) - memcpy_fromio(buffer, pchan->chan.shmem, data_len); - return buffer; -} - /** * pcc_mbox_irq - PCC mailbox interrupt handler * @irq: interrupt number @@ -332,8 +316,6 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) { struct pcc_chan_info *pchan; struct mbox_chan *chan = p; - struct pcc_header *pcc_header = chan->active_req; - void *handle = NULL; pchan = chan->con_priv; @@ -357,17 +339,7 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) * required to avoid any possible race in updatation of this flag. */ pchan->chan_in_use = false; - - if (pchan->chan.rx_alloc) - handle = write_response(pchan); - - if (chan->active_req) { - pcc_header = chan->active_req; - if (pcc_header->flags & PCC_CMD_COMPLETION_NOTIFY) - mbox_chan_txdone(chan, 0); - } - - mbox_chan_received_data(chan, handle); + mbox_chan_received_data(chan, NULL); pcc_chan_acknowledge(pchan); @@ -411,24 +383,9 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id) pcc_mchan = &pchan->chan; pcc_mchan->shmem = acpi_os_ioremap(pcc_mchan->shmem_base_addr, pcc_mchan->shmem_size); - if (!pcc_mchan->shmem) - goto err; + if (pcc_mchan->shmem) + return pcc_mchan; - pcc_mchan->manage_writes = false; - - /* This indicates that the channel is ready to accept messages. - * This needs to happen after the channel has registered - * its callback. There is no access point to do that in - * the mailbox API. That implies that the mailbox client must - * have set the allocate callback function prior to - * sending any messages. - */ - if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE) - pcc_chan_reg_read_modify_write(&pchan->cmd_update); - - return pcc_mchan; - -err: mbox_free_channel(chan); return ERR_PTR(-ENXIO); } @@ -459,38 +416,8 @@ void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan) } EXPORT_SYMBOL_GPL(pcc_mbox_free_channel); -static int pcc_write_to_buffer(struct mbox_chan *chan, void *data) -{ - struct pcc_chan_info *pchan = chan->con_priv; - struct pcc_mbox_chan *pcc_mbox_chan = &pchan->chan; - struct pcc_header *pcc_header = data; - - if (!pchan->chan.manage_writes) - return 0; - - /* The PCC header length includes the command field - * but not the other values from the header. - */ - int len = pcc_header->length - sizeof(u32) + sizeof(struct pcc_header); - u64 val; - - pcc_chan_reg_read(&pchan->cmd_complete, &val); - if (!val) { - pr_info("%s pchan->cmd_complete not set", __func__); - return -1; - } - memcpy_toio(pcc_mbox_chan->shmem, data, len); - return 0; -} - - /** - * pcc_send_data - Called from Mailbox Controller code. If - * pchan->chan.rx_alloc is set, then the command complete - * flag is checked and the data is written to the shared - * buffer io memory. - * - * If pchan->chan.rx_alloc is not set, then it is used + * pcc_send_data - Called from Mailbox Controller code. Used * here only to ring the channel doorbell. The PCC client * specific read/write is done in the client driver in * order to maintain atomicity over PCC channel once @@ -506,37 +433,17 @@ static int pcc_send_data(struct mbox_chan *chan, void *data) int ret; struct pcc_chan_info *pchan = chan->con_priv; - ret = pcc_write_to_buffer(chan, data); - if (ret) - return ret; - ret = pcc_chan_reg_read_modify_write(&pchan->cmd_update); if (ret) return ret; ret = pcc_chan_reg_read_modify_write(&pchan->db); - if (!ret && pchan->plat_irq > 0) pchan->chan_in_use = true; return ret; } - -static bool pcc_last_tx_done(struct mbox_chan *chan) -{ - struct pcc_chan_info *pchan = chan->con_priv; - u64 val; - - pcc_chan_reg_read(&pchan->cmd_complete, &val); - if (!val) - return false; - else - return true; -} - - - /** * pcc_startup - Called from Mailbox Controller code. Used here * to request the interrupt. @@ -582,7 +489,6 @@ static const struct mbox_chan_ops pcc_chan_ops = { .send_data = pcc_send_data, .startup = pcc_startup, .shutdown = pcc_shutdown, - .last_tx_done = pcc_last_tx_done, }; /** diff --git a/include/acpi/pcc.h b/include/acpi/pcc.h index 9af3b502f839..840bfc95bae3 100644 --- a/include/acpi/pcc.h +++ b/include/acpi/pcc.h @@ -17,35 +17,6 @@ struct pcc_mbox_chan { u32 latency; u32 max_access_rate; u16 min_turnaround_time; - - /* Set to true to indicate that the mailbox should manage - * writing the dat to the shared buffer. This differs from - * the case where the drivesr are writing to the buffer and - * using send_data only to ring the doorbell. If this flag - * is set, then the void * data parameter of send_data must - * point to a kernel-memory buffer formatted in accordance with - * the PCC specification. - * - * The active buffer management will include reading the - * notify_on_completion flag, and will then - * call mbox_chan_txdone when the acknowledgment interrupt is - * received. - */ - bool manage_writes; - - /* Optional callback that allows the driver - * to allocate the memory used for receiving - * messages. The return value is the location - * inside the buffer where the mailbox should write the data. - */ - void *(*rx_alloc)(struct mbox_client *cl, int size); -}; - -struct pcc_header { - u32 signature; - u32 flags; - u32 length; - u32 command; }; /* Generic Communications Channel Shared Memory Region */ From a5695dedb76684b85c7deb54bc81546dac2724ad Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 16 Oct 2025 20:08:16 +0100 Subject: [PATCH 10/34] mailbox: pcc: Wire up ->last_tx_done() for PCC channels MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some PCC users poll for completion between transfers and benefit from the knowledge of previous Tx completion check through the mailbox framework's ->last_tx_done() op. Hook up the last_tx_done callback in the PCC mailbox driver so the mailbox framework can correctly query the completion status of the last transmitted message. This aligns PCC with other controllers that already implement such last_tx_done status query. No functional change unless callers use ->last_tx_done(). Normal Tx and IRQ paths are unchanged. This change just improves synchronization and avoids unnecessary timeouts for non-interrupt driven channels by ensuring correct completion detection for PCC channels that don’t rely on interrupts. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index 0e0a66359d4c..8d9b967c7aac 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -444,6 +444,13 @@ static int pcc_send_data(struct mbox_chan *chan, void *data) return ret; } +static bool pcc_last_tx_done(struct mbox_chan *chan) +{ + struct pcc_chan_info *pchan = chan->con_priv; + + return pcc_mbox_cmd_complete_check(pchan); +} + /** * pcc_startup - Called from Mailbox Controller code. Used here * to request the interrupt. @@ -489,6 +496,7 @@ static const struct mbox_chan_ops pcc_chan_ops = { .send_data = pcc_send_data, .startup = pcc_startup, .shutdown = pcc_shutdown, + .last_tx_done = pcc_last_tx_done, }; /** From 3349f800609eadd396d1702da9d979f88770bad9 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 16 Oct 2025 20:08:17 +0100 Subject: [PATCH 11/34] mailbox: pcc: Set txdone_irq/txdone_poll based on PCCT flags The PCC controller currently enables txdone via IRQ if the PCCT exposes platform capability to generate command completion interrupt, but it leaves txdone_poll unchanged. Make the behaviour explicit: - If ACPI_PCCT_DOORBELL is present, use txdone_irq and disable polling. - Otherwise, disable txdone_irq and fall back to txdone_poll. Configure the PCC mailbox to use interrupt-based completion for PCC types that signal completion via IRQ using TXDONE_BY_IRQ, and fall back to polling for others using TXDONE_BY_POLL. This ensures the PCC driver uses the appropriate completion mechanism according to the PCCT table definition and makes the completion mode unambiguous avoiding mixed signalling when the platform lacks a doorbell flag set. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index 8d9b967c7aac..ed4bafdff838 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -791,8 +791,13 @@ static int pcc_mbox_probe(struct platform_device *pdev) (unsigned long) pcct_tbl + sizeof(struct acpi_table_pcct)); acpi_pcct_tbl = (struct acpi_table_pcct *) pcct_tbl; - if (acpi_pcct_tbl->flags & ACPI_PCCT_DOORBELL) + if (acpi_pcct_tbl->flags & ACPI_PCCT_DOORBELL) { pcc_mbox_ctrl->txdone_irq = true; + pcc_mbox_ctrl->txdone_poll = false; + } else { + pcc_mbox_ctrl->txdone_irq = false; + pcc_mbox_ctrl->txdone_poll = true; + } for (i = 0; i < count; i++) { struct pcc_chan_info *pchan = chan_info + i; From 9c753f7c953c0c564db677773e767b8cecaee960 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 16 Oct 2025 20:08:18 +0100 Subject: [PATCH 12/34] mailbox: pcc: Mark Tx as complete in PCC IRQ handler The PCC IRQ handler clears channel-in-use and notifies clients with mbox_chan_received_data(), but it does not explicitly mark the transmit as complete. In IRQ completion mode this could leave Tx complete waiters hanging or lead to generic timeouts in the mailbox core. Invoke mbox_chan_txdone() in the IRQ path once the platform has acknowledged the transfer so the core can wake any waiters and update state accordingly. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index ed4bafdff838..025c4cdd8d26 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -340,6 +340,7 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p) */ pchan->chan_in_use = false; mbox_chan_received_data(chan, NULL); + mbox_chan_txdone(chan, 0); pcc_chan_acknowledge(pchan); From 9f3bbbb72ad03378c45523b8045ac82d1ba28ae6 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 16 Oct 2025 20:08:19 +0100 Subject: [PATCH 13/34] mailbox: pcc: Initialize SHMEM before binding the channel with the client The PCC channel's shared memory region must be set up before the mailbox controller binds the channel with the client, as the binding process may trigger client operations like startup() that may rely on SHMEM being initialized. Reorder the setup sequence to ensure the shared memory is ready before binding. Initialize and map the PCC shared memory (SHMEM) prior to calling mbox_bind_client() so that clients never observe an uninitialized or NULL SHMEM during bind-time callbacks or early use in startup(). This makes the PCC mailbox channel bring-up order consistent and eliminates a race between SHMEM setup and client binding. This will be needed in channel startup to clear/acknowledge any pending interrupts before enabling them. Signed-off-by: Sudeep Holla Acked-by: lihuisong@huawei.com Tested-by: Adam Young Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index 025c4cdd8d26..d8739eca5ac0 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -377,18 +377,20 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id) return ERR_PTR(-EBUSY); } - rc = mbox_bind_client(chan, cl); - if (rc) - return ERR_PTR(rc); - pcc_mchan = &pchan->chan; pcc_mchan->shmem = acpi_os_ioremap(pcc_mchan->shmem_base_addr, pcc_mchan->shmem_size); - if (pcc_mchan->shmem) - return pcc_mchan; + if (!pcc_mchan->shmem) + return ERR_PTR(-ENXIO); - mbox_free_channel(chan); - return ERR_PTR(-ENXIO); + rc = mbox_bind_client(chan, cl); + if (rc) { + iounmap(pcc_mchan->shmem); + pcc_mchan->shmem = NULL; + return ERR_PTR(rc); + } + + return pcc_mchan; } EXPORT_SYMBOL_GPL(pcc_mbox_request_channel); From c2b69f71ffd05d494f706d067c8dbcdbb7e6b901 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 16 Oct 2025 20:08:20 +0100 Subject: [PATCH 14/34] mailbox: pcc: Clear any pending responder interrupts before enabling it Some platforms may leave a responder interrupt pending from earlier transactions. If a PCC responder channel has a pending interrupt when the controller starts up, enabling the IRQ line without first clearing the condition can lead to a spurious interrupt which could disrupt other transmissions if the IRQ is shared. Explicitly clear any pending responder interrupt before enabling the IRQ to ensure a clean start. Acknowledge the responder channel via pcc_chan_acknowledge() in startup before requesting/enablement of the IRQ. This ensures a clean baseline for the first transfer/receiption of the notification/response. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index d8739eca5ac0..967eb249f40d 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -467,6 +467,12 @@ static int pcc_startup(struct mbox_chan *chan) unsigned long irqflags; int rc; + /* + * Clear and acknowledge any pending interrupts on responder channel + * before enabling the interrupt + */ + pcc_chan_acknowledge(pchan); + if (pchan->plat_irq > 0) { irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? IRQF_SHARED | IRQF_ONESHOT : 0; From 7d834d5ce5cb780b926ea0484a80b47bafbb3b64 Mon Sep 17 00:00:00 2001 From: Jason-JH Lin Date: Fri, 31 Oct 2025 23:56:30 +0800 Subject: [PATCH 15/34] mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instruction Add the cmdq_mbox_priv structure to store the private data of GCE, such as the shift bits of the physical address. Then, include the cmdq_mbox_priv structure within the cmdq_pkt structure. This allows CMDQ users to utilize the private data in cmdq_pkt to generate GCE instructions when needed. Additionally, having cmdq_mbox_priv makes it easier to expand and reference other GCE private data in the future. Add cmdq_get_mbox_priv() for CMDQ users to get all the private data into the cmdq_mbox_priv of the cmdq_pkt. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar --- drivers/mailbox/mtk-cmdq-mailbox.c | 8 ++++++++ include/linux/mailbox/mtk-cmdq-mailbox.h | 18 ++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index 5791f80f995a..95e8a5331b7c 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -104,6 +104,14 @@ static inline dma_addr_t cmdq_revert_gce_addr(u32 addr, const struct gce_plat *p return (dma_addr_t)addr << pdata->shift; } +void cmdq_get_mbox_priv(struct mbox_chan *chan, struct cmdq_mbox_priv *priv) +{ + struct cmdq *cmdq = container_of(chan->mbox, struct cmdq, mbox); + + priv->shift_pa = cmdq->pdata->shift; +} +EXPORT_SYMBOL(cmdq_get_mbox_priv); + u8 cmdq_get_shift_pa(struct mbox_chan *chan) { struct cmdq *cmdq = container_of(chan->mbox, struct cmdq, mbox); diff --git a/include/linux/mailbox/mtk-cmdq-mailbox.h b/include/linux/mailbox/mtk-cmdq-mailbox.h index e1555e06e7e5..73b70be4a8a7 100644 --- a/include/linux/mailbox/mtk-cmdq-mailbox.h +++ b/include/linux/mailbox/mtk-cmdq-mailbox.h @@ -70,13 +70,31 @@ struct cmdq_cb_data { struct cmdq_pkt *pkt; }; +struct cmdq_mbox_priv { + u8 shift_pa; +}; + struct cmdq_pkt { void *va_base; dma_addr_t pa_base; size_t cmd_buf_size; /* command occupied size */ size_t buf_size; /* real buffer size */ + struct cmdq_mbox_priv priv; /* for generating instruction */ }; +/** + * cmdq_get_mbox_priv() - get the private data of mailbox channel + * @chan: mailbox channel + * @priv: pointer to store the private data of mailbox channel + * + * While generating the GCE instruction to command buffer, the private data + * of GCE hardware may need to be referenced, such as the shift bits of + * physical address. + * + * This function should be called before generating the GCE instruction. + */ +void cmdq_get_mbox_priv(struct mbox_chan *chan, struct cmdq_mbox_priv *priv); + /** * cmdq_get_shift_pa() - get the shift bits of physical address * @chan: mailbox channel From 7063a901fe1ae9c7b875917df5945806f04f6921 Mon Sep 17 00:00:00 2001 From: Jason-JH Lin Date: Fri, 31 Oct 2025 23:56:31 +0800 Subject: [PATCH 16/34] mailbox: mtk-cmdq: Add GCE hardware virtualization configuration The GCE hardware virtualization configuration supports the isolation of GCE hardware resources across different OS environments. Each OS is treated as a virtual machine (VM) for GCE purposes. There are 6 VMs and 1 host VM. The host VM has main control over the GCE virtualization settings for all VMs. To properly access the GCE thread registers, it is necessary to configure access permissions for specific GCE threads assigned to different VMs. Currently, since only the host VM is being used, it is required to enable access permissions for all GCE threads for the host VM. There are 2 VM configurations: 1. VM_ID_MAP There are 4 registers to allocate 32 GCE threads across different VMs: VM_ID_MAP0 for threads 0-9, VM_ID_MAP1 for threads 10-19, VM_ID_MAP2 for threads 20-29, and VM_ID_MAP3 for threads 30-31. Each thread has a 3-bit configuration, where setting all bits to 1 configures the thread for the host VM. 2. VM_CPR_GSIZE It is used to allocate the CPR SRAM size to each VM. Each VM has 4-bit configuration, where setting bit 0-3 to configures the size of host VM. This setting must be configured before the VM configuration to prevent resource leakage. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar --- drivers/mailbox/mtk-cmdq-mailbox.c | 48 ++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index 95e8a5331b7c..a544108ddae7 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -43,6 +43,13 @@ #define GCE_CTRL_BY_SW GENMASK(2, 0) #define GCE_DDR_EN GENMASK(18, 16) +#define GCE_VM_ID_MAP(n) (0x5018 + (n) / 10 * 4) +#define GCE_VM_ID_MAP_THR_FLD_SHIFT(n) ((n) % 10 * 3) +#define GCE_VM_ID_MAP_HOST_VM GENMASK(2, 0) +#define GCE_VM_CPR_GSIZE 0x50c4 +#define GCE_VM_CPR_GSIZE_FLD_SHIFT(vm_id) ((vm_id) * 4) +#define GCE_VM_CPR_GSIZE_MAX GENMASK(3, 0) + #define CMDQ_THR_ACTIVE_SLOT_CYCLES 0x3200 #define CMDQ_THR_ENABLED 0x1 #define CMDQ_THR_DISABLED 0x0 @@ -89,6 +96,7 @@ struct gce_plat { u8 shift; bool control_by_sw; bool sw_ddr_en; + bool gce_vm; u32 gce_num; }; @@ -120,6 +128,45 @@ u8 cmdq_get_shift_pa(struct mbox_chan *chan) } EXPORT_SYMBOL(cmdq_get_shift_pa); +static void cmdq_vm_init(struct cmdq *cmdq) +{ + int i; + u32 vm_cpr_gsize = 0, vm_id_map = 0; + u32 *vm_map = NULL; + + if (!cmdq->pdata->gce_vm) + return; + + vm_map = kcalloc(cmdq->pdata->thread_nr, sizeof(*vm_map), GFP_KERNEL); + if (!vm_map) + return; + + /* only configure the max CPR SRAM size to host vm (vm_id = 0) currently */ + vm_cpr_gsize = GCE_VM_CPR_GSIZE_MAX << GCE_VM_CPR_GSIZE_FLD_SHIFT(0); + + /* set all thread mapping to host vm currently */ + for (i = 0; i < cmdq->pdata->thread_nr; i++) + vm_map[i] = GCE_VM_ID_MAP_HOST_VM << GCE_VM_ID_MAP_THR_FLD_SHIFT(i); + + /* set the amount of CPR SRAM to allocate to each VM */ + writel(vm_cpr_gsize, cmdq->base + GCE_VM_CPR_GSIZE); + + /* config CPR_GSIZE before setting VM_ID_MAP to avoid data leakage */ + for (i = 0; i < cmdq->pdata->thread_nr; i++) { + vm_id_map |= vm_map[i]; + /* config every 10 threads, e.g., thread id=0~9, 10~19, ..., into one register */ + if ((i + 1) % 10 == 0) { + writel(vm_id_map, cmdq->base + GCE_VM_ID_MAP(i)); + vm_id_map = 0; + } + } + /* config remaining threads settings */ + if (cmdq->pdata->thread_nr % 10 != 0) + writel(vm_id_map, cmdq->base + GCE_VM_ID_MAP(cmdq->pdata->thread_nr - 1)); + + kfree(vm_map); +} + static void cmdq_gctl_value_toggle(struct cmdq *cmdq, bool ddr_enable) { u32 val = cmdq->pdata->control_by_sw ? GCE_CTRL_BY_SW : 0; @@ -164,6 +211,7 @@ static void cmdq_init(struct cmdq *cmdq) WARN_ON(clk_bulk_enable(cmdq->pdata->gce_num, cmdq->clocks)); + cmdq_vm_init(cmdq); cmdq_gctl_value_toggle(cmdq, true); writel(CMDQ_THR_ACTIVE_SLOT_CYCLES, cmdq->base + CMDQ_THR_SLOT_CYCLES); From ddb5d0c941c64b51b003f62df3596682a6591c35 Mon Sep 17 00:00:00 2001 From: Jason-JH Lin Date: Fri, 31 Oct 2025 23:56:32 +0800 Subject: [PATCH 17/34] mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction The GCE in MT8196 is placed in MMINFRA and requires all addresses in GCE instructions for DRAM transactions to be IOVA. Due to MMIO, if the GCE needs to access a hardware register at 0x1000_0000, but the SMMU is also mapping a DRAM block at 0x1000_0000, the MMINFRA will not know whether to write to the hardware register or the DRAM. To solve this, MMINFRA treats addresses greater than 2G as data paths and those less than 2G as config paths because the DRAM start address is currently at 2G (0x8000_0000). On the data path, MMINFRA remaps DRAM addresses by subtracting 2G, allowing SMMU to map DRAM addresses less than 2G. For example, if the DRAM start address 0x8000_0000 is mapped to IOVA=0x0, when GCE accesses IOVA=0x0, it must add a 2G offset to the address in the GCE instruction. MMINFRA will then see it as a data path (IOVA >= 2G) and subtract 2G, allowing GCE to access IOVA=0x0. Since the MMINFRA remap subtracting 2G is done in hardware and cannot be configured by software, the address of DRAM in GCE instruction must always add 2G to ensure proper access. After that, the shift functions do more than just shift addresses, so the APIs were renamed to cmdq_convert_gce_addr() and cmdq_revert_gce_addr(). This 2G adjustment is referred to as mminfra_offset in the CMDQ driver. CMDQ helper can get the mminfra_offset from the cmdq_mbox_priv of cmdq_pkt and add the mminfra_offset to the DRAM address in GCE instructions. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar --- drivers/mailbox/mtk-cmdq-mailbox.c | 6 ++++-- include/linux/mailbox/mtk-cmdq-mailbox.h | 1 + 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index a544108ddae7..a9c06e4bbad4 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -94,6 +94,7 @@ struct cmdq { struct gce_plat { u32 thread_nr; u8 shift; + dma_addr_t mminfra_offset; bool control_by_sw; bool sw_ddr_en; bool gce_vm; @@ -103,13 +104,13 @@ struct gce_plat { static inline u32 cmdq_convert_gce_addr(dma_addr_t addr, const struct gce_plat *pdata) { /* Convert DMA addr (PA or IOVA) to GCE readable addr */ - return addr >> pdata->shift; + return (addr + pdata->mminfra_offset) >> pdata->shift; } static inline dma_addr_t cmdq_revert_gce_addr(u32 addr, const struct gce_plat *pdata) { /* Revert GCE readable addr to DMA addr (PA or IOVA) */ - return (dma_addr_t)addr << pdata->shift; + return ((dma_addr_t)addr << pdata->shift) - pdata->mminfra_offset; } void cmdq_get_mbox_priv(struct mbox_chan *chan, struct cmdq_mbox_priv *priv) @@ -117,6 +118,7 @@ void cmdq_get_mbox_priv(struct mbox_chan *chan, struct cmdq_mbox_priv *priv) struct cmdq *cmdq = container_of(chan->mbox, struct cmdq, mbox); priv->shift_pa = cmdq->pdata->shift; + priv->mminfra_offset = cmdq->pdata->mminfra_offset; } EXPORT_SYMBOL(cmdq_get_mbox_priv); diff --git a/include/linux/mailbox/mtk-cmdq-mailbox.h b/include/linux/mailbox/mtk-cmdq-mailbox.h index 73b70be4a8a7..07c1bfbdb8c4 100644 --- a/include/linux/mailbox/mtk-cmdq-mailbox.h +++ b/include/linux/mailbox/mtk-cmdq-mailbox.h @@ -72,6 +72,7 @@ struct cmdq_cb_data { struct cmdq_mbox_priv { u8 shift_pa; + dma_addr_t mminfra_offset; }; struct cmdq_pkt { From 244d11ae7d12514089eb481589d5d7d2de4572ef Mon Sep 17 00:00:00 2001 From: Jason-JH Lin Date: Fri, 31 Oct 2025 23:56:33 +0800 Subject: [PATCH 18/34] mailbox: mtk-cmdq: Add driver data to support for MT8196 MT8196 has 2 new hardware configuration compared with the previous SoC, which correspond to the 2 new driver data: 1. mminfra_offset: For GCE data path control Since GCE has been moved into mminfra, GCE needs to append the mminfra offset to the DRAM address when accessing the DRAM. 2. gce_vm: For GCE hardware virtualization control Currently, the first version of the mt8196 mailbox controller only requires setting the VM-related registers to enable the permissions of a host VM. Signed-off-by: Jason-JH Lin Reviewed-by: CK Hu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar --- drivers/mailbox/mtk-cmdq-mailbox.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index a9c06e4bbad4..1bf6984948ef 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include @@ -840,6 +841,16 @@ static const struct gce_plat gce_plat_mt8195 = { .gce_num = 2 }; +static const struct gce_plat gce_plat_mt8196 = { + .thread_nr = 32, + .shift = 3, + .mminfra_offset = SZ_2G, + .control_by_sw = true, + .sw_ddr_en = true, + .gce_vm = true, + .gce_num = 2 +}; + static const struct of_device_id cmdq_of_ids[] = { {.compatible = "mediatek,mt6779-gce", .data = (void *)&gce_plat_mt6779}, {.compatible = "mediatek,mt8173-gce", .data = (void *)&gce_plat_mt8173}, @@ -848,6 +859,7 @@ static const struct of_device_id cmdq_of_ids[] = { {.compatible = "mediatek,mt8188-gce", .data = (void *)&gce_plat_mt8188}, {.compatible = "mediatek,mt8192-gce", .data = (void *)&gce_plat_mt8192}, {.compatible = "mediatek,mt8195-gce", .data = (void *)&gce_plat_mt8195}, + {.compatible = "mediatek,mt8196-gce", .data = (void *)&gce_plat_mt8196}, {} }; MODULE_DEVICE_TABLE(of, cmdq_of_ids); From 673327028cd61db68a1e0c708be2e302c082adf9 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Fri, 16 Jan 2026 14:07:40 +0000 Subject: [PATCH 19/34] mailbox: pcc: Remove spurious IRQF_ONESHOT usage The PCC code currently specifies IRQF_ONESHOT if the interrupt could potentially be shared but doesn't actually use request_threaded_irq() and the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is never relevant. Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler") specifying it has resulted in a WARN_ON(), fix this by removing IRQF_ONESHOT. Reported-by: Aishwarya TCV Signed-off-by: Mark Brown Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar --- drivers/mailbox/pcc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index 967eb249f40d..22e70af1ae5d 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -475,7 +475,7 @@ static int pcc_startup(struct mbox_chan *chan) if (pchan->plat_irq > 0) { irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ? - IRQF_SHARED | IRQF_ONESHOT : 0; + IRQF_SHARED : 0; rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq, irqflags, MBOX_IRQ_NAME, chan); if (unlikely(rc)) { From 6b0eadf69bd1b33e887f5f089e056739921ebe42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= Date: Mon, 5 Jan 2026 12:34:35 +0000 Subject: [PATCH 20/34] mailbox: exynos: drop unneeded runtime pointer (pclk) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pclk is not needed past probe(), just drop it. This saves a little bit of runtime memory. Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Reviewed-by: Tudor Ambarus Signed-off-by: Jassi Brar --- drivers/mailbox/exynos-mailbox.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/mailbox/exynos-mailbox.c b/drivers/mailbox/exynos-mailbox.c index 2320649bf60c..5f2d3b81c1db 100644 --- a/drivers/mailbox/exynos-mailbox.c +++ b/drivers/mailbox/exynos-mailbox.c @@ -35,12 +35,10 @@ * struct exynos_mbox - driver's private data. * @regs: mailbox registers base address. * @mbox: pointer to the mailbox controller. - * @pclk: pointer to the mailbox peripheral clock. */ struct exynos_mbox { void __iomem *regs; struct mbox_controller *mbox; - struct clk *pclk; }; static int exynos_mbox_send_data(struct mbox_chan *chan, void *data) @@ -100,6 +98,7 @@ static int exynos_mbox_probe(struct platform_device *pdev) struct exynos_mbox *exynos_mbox; struct mbox_controller *mbox; struct mbox_chan *chans; + struct clk *pclk; int i; exynos_mbox = devm_kzalloc(dev, sizeof(*exynos_mbox), GFP_KERNEL); @@ -119,9 +118,9 @@ static int exynos_mbox_probe(struct platform_device *pdev) if (IS_ERR(exynos_mbox->regs)) return PTR_ERR(exynos_mbox->regs); - exynos_mbox->pclk = devm_clk_get_enabled(dev, "pclk"); - if (IS_ERR(exynos_mbox->pclk)) - return dev_err_probe(dev, PTR_ERR(exynos_mbox->pclk), + pclk = devm_clk_get_enabled(dev, "pclk"); + if (IS_ERR(pclk)) + return dev_err_probe(dev, PTR_ERR(pclk), "Failed to enable clock.\n"); mbox->num_chans = EXYNOS_MBOX_CHAN_COUNT; From 673b570825ace0dcb2ac0c676080559d505c6f40 Mon Sep 17 00:00:00 2001 From: Jacky Bai Date: Tue, 16 Dec 2025 16:00:54 +0800 Subject: [PATCH 21/34] mailbox: imx: Skip the suspend flag for i.MX7ULP In current imx-mailbox driver, the MU IRQ is configured with 'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: fix wakeup failure from freeze mode"), if the MU IRQ is triggered after the priv->suspended flag has been set, the system suspend will be aborted. On i.MX7ULP platform, certain drivers that depend on rpmsg may need to send rpmsg request and receive an acknowledgment from the remote core during the late_suspend stage. Early suspend abort is not expected, and the i.MX7ULP already has additional hardware and software to make sure the system can be wakeup from freeze mode correctly when MU IRQ is trigger. Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the early abort when doing suspend. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Signed-off-by: Jassi Brar --- drivers/mailbox/imx-mailbox.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c index 6778afc64a04..003f9236c35e 100644 --- a/drivers/mailbox/imx-mailbox.c +++ b/drivers/mailbox/imx-mailbox.c @@ -122,6 +122,7 @@ struct imx_mu_dcfg { u32 xRR; /* Receive Register0 */ u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */ u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */ + bool skip_suspend_flag; }; #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x)))) @@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = { .xRR = 0x40, .xSR = {0x60, 0x60, 0x60, 0x60}, .xCR = {0x64, 0x64, 0x64, 0x64, 0x64}, + .skip_suspend_flag = true, }; static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = { @@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev) priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]); } - priv->suspend = true; + if (!priv->dcfg->skip_suspend_flag) + priv->suspend = true; return 0; } @@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev) imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]); } - priv->suspend = false; + if (!priv->dcfg->skip_suspend_flag) + priv->suspend = false; return 0; } From dfd997b1e24cef79528856205df96dc6dfd3d753 Mon Sep 17 00:00:00 2001 From: Lakshmi S Date: Tue, 23 Dec 2025 17:36:22 +0530 Subject: [PATCH 22/34] mailbox: cix: fix typo in error message Fix typo "overlow" -> "overflow" in FIFO overflow error message. Signed-off-by: Lakshmi S Reviewed-by: Peter Chen Signed-off-by: Jassi Brar --- drivers/mailbox/cix-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/cix-mailbox.c b/drivers/mailbox/cix-mailbox.c index 5bb1416c26a5..443620e8ae37 100644 --- a/drivers/mailbox/cix-mailbox.c +++ b/drivers/mailbox/cix-mailbox.c @@ -346,7 +346,7 @@ static void cix_mbox_isr_fifo(struct mbox_chan *chan) /* FIFO overflow is generated */ if (int_status & CIX_FIFO_OFLOW_INT) { status = cix_mbox_read(priv, CIX_FIFO_STAS); - dev_err(priv->dev, "fifo overlow: int_stats %d\n", status); + dev_err(priv->dev, "fifo overflow: int_stats %d\n", status); cix_mbox_write(priv, CIX_FIFO_OFLOW_INT, CIX_INT_CLEAR); } } From 9cf4d3f10260c37ec48c642f2f74daf9561ac3df Mon Sep 17 00:00:00 2001 From: Lakshmi S Date: Tue, 23 Dec 2025 14:48:07 +0530 Subject: [PATCH 23/34] mailbox: arm_mhuv3: fix typo in comment Fix typo "channnels"-> "channels" in struct documentation. Signed-off-by: Lakshmi S Signed-off-by: Jassi Brar --- drivers/mailbox/arm_mhuv3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/arm_mhuv3.c b/drivers/mailbox/arm_mhuv3.c index 0910da67f8a1..a1c528be47f3 100644 --- a/drivers/mailbox/arm_mhuv3.c +++ b/drivers/mailbox/arm_mhuv3.c @@ -333,7 +333,7 @@ struct mhuv3_extension { * @rev: MHUv3 controller IIDR revision. * @var: MHUv3 controller IIDR variant. * @prod_id: MHUv3 controller IIDR product_id. - * @num_chans: The total number of channnels discovered across all extensions. + * @num_chans: The total number of channels discovered across all extensions. * @cmb_irq: Combined IRQ number if any found defined. * @ctrl: A reference to the MHUv3 control page for this block. * @pbx: Base address of the PBX register mapping region. From bc4d17e495cd3b02bcb2e10f575763a5ff31f80b Mon Sep 17 00:00:00 2001 From: Valentina Fernandez Date: Thu, 18 Dec 2025 10:33:59 +0000 Subject: [PATCH 24/34] mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warnings Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr() by introducing a 'found' flag to track whether the IRQ matches any online hart. If no match is found, return IRQ_NONE. Also fix other smatch warnings by removing dead code in mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the Microchip SBI extension is not found. Fixes below smatch warnings: drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'. drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code. drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe' Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/ Signed-off-by: Valentina Fernandez Signed-off-by: Jassi Brar --- drivers/mailbox/mailbox-mchp-ipc-sbi.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c index d444491a584e..b87bf2fb4b9b 100644 --- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c +++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c @@ -174,17 +174,21 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data) struct mchp_ipc_msg ipc_msg; struct mchp_ipc_status status_msg; int ret; - unsigned long hartid; u32 i, chan_index, chan_id; + bool found = false; /* Find out the hart that originated the irq */ for_each_online_cpu(i) { - hartid = cpuid_to_hartid_map(i); - if (irq == ipc->cluster_cfg[i].irq) + if (irq == ipc->cluster_cfg[i].irq) { + found = true; break; + } } - status_msg.cluster = hartid; + if (unlikely(!found)) + return IRQ_NONE; + + status_msg.cluster = cpuid_to_hartid_map(i); memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status)); ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr); @@ -321,13 +325,6 @@ static int mchp_ipc_startup(struct mbox_chan *chan) goto fail_free_buf_msg_rx; } - if (ret) { - dev_err(ipc->dev, "failed to register interrupt(s)\n"); - goto fail_free_buf_msg_rx; - } - - return ret; - fail_free_buf_msg_rx: kfree(chan_info->msg_buf_rx); fail_free_buf_msg_tx: @@ -419,7 +416,7 @@ static int mchp_ipc_probe(struct platform_device *pdev) ret = sbi_probe_extension(SBI_EXT_MICROCHIP_TECHNOLOGY); if (ret <= 0) - return dev_err_probe(dev, ret, "Microchip SBI extension not detected\n"); + return dev_err_probe(dev, -ENODEV, "Microchip SBI extension not detected\n"); ipc = devm_kzalloc(dev, sizeof(*ipc), GFP_KERNEL); if (!ipc) From 6acf50c7f0ba4fcc048bd9018080fa53844c5705 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Thu, 15 Jan 2026 15:19:11 +0100 Subject: [PATCH 25/34] mailbox: Improve RISCV_SBI_MPXY_MBOX guidance RISC-V SBI Message Proxy (MPXY) Mailbox support defaults to enabled, but the help text states "If unsure say N". Recommend enabling this driver, as it is a very critical RISC-V driver providing mailbox channels to other drivers such as clock, system MSIs, etc. Fixes: bf3022a4eb119c6b ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver") Suggested-by: Anup Patel Signed-off-by: Geert Uytterhoeven Reviewed-by: Anup Patel Signed-off-by: Jassi Brar --- drivers/mailbox/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig index 559fe32c5d5a..5bf4155b090a 100644 --- a/drivers/mailbox/Kconfig +++ b/drivers/mailbox/Kconfig @@ -396,7 +396,7 @@ config RISCV_SBI_MPXY_MBOX Mailbox driver implementation for RISC-V SBI Message Proxy (MPXY) extension. This mailbox driver is used to send messages to the remote processor through the SBI implementation (M-mode firmware - or HS-mode hypervisor). Say Y here if you want to have this support. - If unsure say N. + or HS-mode hypervisor). Say Y here, unless you are sure you do not + need this. endif From dac2b98ede6c29f01dec95e88fef59e5138bd3a4 Mon Sep 17 00:00:00 2001 From: Harini T Date: Fri, 9 Jan 2026 11:52:59 +0530 Subject: [PATCH 26/34] dt-bindings: mailbox: xlnx,zynqmp-ipi-mailbox: Document msg region requirement Add description clarifying that for Versal IPI mailboxes, both host and remote agents must have the "msg" register region defined for successful message passing. Without both, only notification-based communication works. Signed-off-by: Harini T Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar --- .../bindings/mailbox/xlnx,zynqmp-ipi-mailbox.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.yaml b/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.yaml index 04d6473d666f..a5205ee5ad0f 100644 --- a/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.yaml +++ b/Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.yaml @@ -11,6 +11,17 @@ description: | messaging between two Xilinx Zynq UltraScale+ MPSoC IPI agents. Each IPI agent owns registers used for notification and buffers for message. + For Versal devices, there are two types of IPI channels: + - Buffered channels: Support message passing and require the "msg" + register region to be present on both the host and remote IPI agents. + - Buffer-less channels: Support notification only and do not require the + "msg" register region. For these channels, the "msg" region should be + omitted. + + For message passing, both the host and remote IPI agents must define the "msg" + register region. If either agent omits the "msg" region, only notification + based communication is possible. + +-------------------------------------+ | Xilinx ZynqMP IPI Controller | +-------------------------------------+ From 7271bcadf6038a79c84aa6830816fc555d17888c Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Wed, 24 Dec 2025 12:44:53 +0100 Subject: [PATCH 27/34] mailbox: mtk-cmdq: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar --- drivers/mailbox/mtk-cmdq-mailbox.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index 1bf6984948ef..9da16b30eb41 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -636,7 +636,7 @@ static struct mbox_chan *cmdq_xlate(struct mbox_controller *mbox, static int cmdq_get_clocks(struct device *dev, struct cmdq *cmdq) { static const char * const gce_name = "gce"; - struct device_node *node, *parent = dev->of_node->parent; + struct device_node *parent = dev->of_node->parent; struct clk_bulk_data *clks; cmdq->clocks = devm_kcalloc(dev, cmdq->pdata->gce_num, @@ -661,7 +661,7 @@ static int cmdq_get_clocks(struct device *dev, struct cmdq *cmdq) * as the clock of the main GCE must be enabled for additional IPs * to be reachable. */ - for_each_child_of_node(parent, node) { + for_each_child_of_node_scoped(parent, node) { int alias_id = of_alias_get_id(node, gce_name); if (alias_id < 0 || alias_id >= cmdq->pdata->gce_num) @@ -670,17 +670,13 @@ static int cmdq_get_clocks(struct device *dev, struct cmdq *cmdq) clks = &cmdq->clocks[alias_id]; clks->id = devm_kasprintf(dev, GFP_KERNEL, "gce%d", alias_id); - if (!clks->id) { - of_node_put(node); + if (!clks->id) return -ENOMEM; - } clks->clk = of_clk_get(node, 0); - if (IS_ERR(clks->clk)) { - of_node_put(node); + if (IS_ERR(clks->clk)) return dev_err_probe(dev, PTR_ERR(clks->clk), "failed to get gce%d clock\n", alias_id); - } } return 0; From 66e4442966172ed0eaec9b95a72d570e8f6aadc7 Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Wed, 24 Dec 2025 12:44:54 +0100 Subject: [PATCH 28/34] mailbox: zynqmp-ipi: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar --- drivers/mailbox/zynqmp-ipi-mailbox.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c index 967967b2b8a9..42d2583e44ca 100644 --- a/drivers/mailbox/zynqmp-ipi-mailbox.c +++ b/drivers/mailbox/zynqmp-ipi-mailbox.c @@ -904,7 +904,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) static int zynqmp_ipi_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; - struct device_node *nc, *np = pdev->dev.of_node; + struct device_node *np = pdev->dev.of_node; struct zynqmp_ipi_pdata *pdata; struct of_phandle_args out_irq; struct zynqmp_ipi_mbox *mbox; @@ -940,13 +940,12 @@ static int zynqmp_ipi_probe(struct platform_device *pdev) pdata->num_mboxes = num_mboxes; mbox = pdata->ipi_mboxes; - for_each_available_child_of_node(np, nc) { + for_each_available_child_of_node_scoped(np, nc) { mbox->pdata = pdata; mbox->setup_ipi_fn = ipi_fn; ret = zynqmp_ipi_mbox_probe(mbox, nc); if (ret) { - of_node_put(nc); dev_err(dev, "failed to probe subdev.\n"); ret = -EINVAL; goto free_mbox_dev; From 60436eb0d618717c7f51eae2e4e9245abeae349c Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Wed, 28 Jan 2026 20:32:10 +0800 Subject: [PATCH 29/34] mailbox: Remove mailbox_client.h from controller drivers mailbox_client.h should be used by mailbox consumer drivers, not mailbox controller (provider) drivers. The affected drivers do not use any mailbox client APIs, so the include can be safely removed. Signed-off-by: Peng Fan Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar --- drivers/mailbox/bcm-flexrm-mailbox.c | 1 - drivers/mailbox/cv1800-mailbox.c | 1 - drivers/mailbox/omap-mailbox.c | 1 - 3 files changed, 3 deletions(-) diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c index 41f79e51d9e5..5d278bb5a4c0 100644 --- a/drivers/mailbox/bcm-flexrm-mailbox.c +++ b/drivers/mailbox/bcm-flexrm-mailbox.c @@ -26,7 +26,6 @@ #include #include #include -#include #include #include #include diff --git a/drivers/mailbox/cv1800-mailbox.c b/drivers/mailbox/cv1800-mailbox.c index 4761191acf78..4bca9d8be4ba 100644 --- a/drivers/mailbox/cv1800-mailbox.c +++ b/drivers/mailbox/cv1800-mailbox.c @@ -11,7 +11,6 @@ #include #include #include -#include #include #include #include diff --git a/drivers/mailbox/omap-mailbox.c b/drivers/mailbox/omap-mailbox.c index 17fe6545875d..d9f100c18895 100644 --- a/drivers/mailbox/omap-mailbox.c +++ b/drivers/mailbox/omap-mailbox.c @@ -21,7 +21,6 @@ #include #include #include -#include #include "mailbox.h" From fa84883d44422208b45869a67c0265234fdce1f0 Mon Sep 17 00:00:00 2001 From: Sebastian Andrzej Siewior Date: Wed, 28 Jan 2026 10:55:24 +0100 Subject: [PATCH 30/34] mailbox: bcm-ferxrm-mailbox: Use default primary handler request_threaded_irq() is invoked with a primary and a secondary handler and no flags are passed. The primary handler is the same as irq_default_primary_handler() so there is no need to have an identical copy. The lack of the IRQF_ONESHOT can be dangerous because the interrupt source is not masked while the threaded handler is active. This means, especially on LEVEL typed interrupt lines, the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jassi Brar --- drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c index 5d278bb5a4c0..04c47eadf950 100644 --- a/drivers/mailbox/bcm-flexrm-mailbox.c +++ b/drivers/mailbox/bcm-flexrm-mailbox.c @@ -1172,14 +1172,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset) /* ====== FlexRM interrupt handler ===== */ -static irqreturn_t flexrm_irq_event(int irq, void *dev_id) -{ - /* We only have MSI for completions so just wakeup IRQ thread */ - /* Ring related errors will be informed via completion descriptors */ - - return IRQ_WAKE_THREAD; -} - static irqreturn_t flexrm_irq_thread(int irq, void *dev_id) { flexrm_process_completions(dev_id); @@ -1270,10 +1262,8 @@ static int flexrm_startup(struct mbox_chan *chan) ret = -ENODEV; goto fail_free_cmpl_memory; } - ret = request_threaded_irq(ring->irq, - flexrm_irq_event, - flexrm_irq_thread, - 0, dev_name(ring->mbox->dev), ring); + ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread, + IRQF_ONESHOT, dev_name(ring->mbox->dev), ring); if (ret) { dev_err(ring->mbox->dev, "failed to request ring%d IRQ\n", ring->num); From 0856aed508878c6208cf17c75361317287101b3d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Otto=20Pfl=C3=BCger?= Date: Sat, 10 Jan 2026 16:43:35 +0100 Subject: [PATCH 31/34] dt-bindings: mailbox: sprd: add compatible for UMS9230 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a compatible string for the mailbox controller found in the UMS9230 SoC. Signed-off-by: Otto Pflüger Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar --- Documentation/devicetree/bindings/mailbox/sprd-mailbox.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/mailbox/sprd-mailbox.yaml b/Documentation/devicetree/bindings/mailbox/sprd-mailbox.yaml index b526f9c0c272..bf6ab4e7050c 100644 --- a/Documentation/devicetree/bindings/mailbox/sprd-mailbox.yaml +++ b/Documentation/devicetree/bindings/mailbox/sprd-mailbox.yaml @@ -16,6 +16,7 @@ properties: enum: - sprd,sc9860-mailbox - sprd,sc9863a-mailbox + - sprd,ums9230-mailbox reg: items: From c77661d60d4223bf2ff10d409beb0c3b2021183b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Otto=20Pfl=C3=BCger?= Date: Sat, 10 Jan 2026 16:43:36 +0100 Subject: [PATCH 32/34] mailbox: sprd: clear delivery flag before handling TX done MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If there are any pending messages in the mailbox queue, they are sent as soon as a TX done event arrives from the driver. This may trigger a new delivery interrupt while the previous one is still being handled. If the delivery status is cleared after this, the interrupt is lost. To prevent this from happening, clear the delivery status immediately after checking it and before any new messages are sent. Signed-off-by: Otto Pflüger Signed-off-by: Jassi Brar --- drivers/mailbox/sprd-mailbox.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c index ee8539dfcef5..9a3d388f76b7 100644 --- a/drivers/mailbox/sprd-mailbox.c +++ b/drivers/mailbox/sprd-mailbox.c @@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) return IRQ_NONE; } + /* Clear FIFO delivery and overflow status first */ + writel(fifo_sts & + (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), + priv->inbox_base + SPRD_MBOX_FIFO_RST); + while (send_sts) { id = __ffs(send_sts); send_sts &= (send_sts - 1); @@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) mbox_chan_txdone(chan, 0); } - /* Clear FIFO delivery and overflow status */ - writel(fifo_sts & - (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), - priv->inbox_base + SPRD_MBOX_FIFO_RST); - /* Clear irq status */ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS); From c6ff944003cf1b7be9ef5c9d868a42114bc6e867 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Otto=20Pfl=C3=BCger?= Date: Sat, 10 Jan 2026 16:43:37 +0100 Subject: [PATCH 33/34] mailbox: sprd: add support for mailbox revision 2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Newer Unisoc SoCs such as UMS9230 include a new revision of the mailbox IP with support for up to 16 channels. Since the new revision has a similar register layout and many parts have remained unchanged, make the driver support both revisions. Signed-off-by: Otto Pflüger Signed-off-by: Jassi Brar --- drivers/mailbox/sprd-mailbox.c | 103 ++++++++++++++++++++++++++------- 1 file changed, 82 insertions(+), 21 deletions(-) diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c index 9a3d388f76b7..26256581a76a 100644 --- a/drivers/mailbox/sprd-mailbox.c +++ b/drivers/mailbox/sprd-mailbox.c @@ -24,7 +24,8 @@ #define SPRD_MBOX_IRQ_STS 0x18 #define SPRD_MBOX_IRQ_MSK 0x1c #define SPRD_MBOX_LOCK 0x20 -#define SPRD_MBOX_FIFO_DEPTH 0x24 +#define SPRD_MBOX_FIFO_DEPTH 0x24 /* outbox only */ +#define SPRD_MBOX_IN_FIFO_STS2 0x24 /* inbox only, revision 2 */ /* Bit and mask definition for inbox's SPRD_MBOX_FIFO_STS register */ #define SPRD_INBOX_FIFO_DELIVER_MASK GENMASK(23, 16) @@ -32,8 +33,18 @@ #define SPRD_INBOX_FIFO_DELIVER_SHIFT 16 #define SPRD_INBOX_FIFO_BUSY_MASK GENMASK(7, 0) +/* Bit and mask definition for R2 inbox's SPRD_MBOX_FIFO_RST register */ +#define SPRD_INBOX_R2_FIFO_OVERFLOW_DELIVER_RST GENMASK(31, 0) + +/* Bit and mask definition for R2 inbox's SPRD_MBOX_FIFO_STS register */ +#define SPRD_INBOX_R2_FIFO_DELIVER_MASK GENMASK(15, 0) + +/* Bit and mask definition for SPRD_MBOX_IN_FIFO_STS2 register */ +#define SPRD_INBOX_R2_FIFO_OVERFLOW_MASK GENMASK(31, 16) +#define SPRD_INBOX_R2_FIFO_BUSY_MASK GENMASK(15, 0) + /* Bit and mask definition for SPRD_MBOX_IRQ_STS register */ -#define SPRD_MBOX_IRQ_CLR BIT(0) +#define SPRD_MBOX_IRQ_CLR GENMASK(31, 0) /* Bit and mask definition for outbox's SPRD_MBOX_FIFO_STS register */ #define SPRD_OUTBOX_FIFO_FULL BIT(2) @@ -52,8 +63,18 @@ #define SPRD_OUTBOX_FIFO_IRQ_MASK GENMASK(4, 0) #define SPRD_OUTBOX_BASE_SPAN 0x1000 -#define SPRD_MBOX_CHAN_MAX 8 -#define SPRD_SUPP_INBOX_ID_SC9863A 7 +#define SPRD_MBOX_R1_CHAN_MAX 8 +#define SPRD_MBOX_R2_CHAN_MAX 16 + +enum sprd_mbox_version { + SPRD_MBOX_R1, + SPRD_MBOX_R2, +}; + +struct sprd_mbox_info { + enum sprd_mbox_version version; + unsigned long supp_id; +}; struct sprd_mbox_priv { struct mbox_controller mbox; @@ -64,9 +85,11 @@ struct sprd_mbox_priv { void __iomem *supp_base; u32 outbox_fifo_depth; + const struct sprd_mbox_info *info; + struct mutex lock; u32 refcnt; - struct mbox_chan chan[SPRD_MBOX_CHAN_MAX]; + struct mbox_chan chan[SPRD_MBOX_R2_CHAN_MAX]; }; static struct sprd_mbox_priv *to_sprd_mbox_priv(struct mbox_controller *mbox) @@ -154,22 +177,34 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) { struct sprd_mbox_priv *priv = data; struct mbox_chan *chan; - u32 fifo_sts, send_sts, busy, id; + u32 fifo_sts, fifo_sts2, send_sts, busy, id; fifo_sts = readl(priv->inbox_base + SPRD_MBOX_FIFO_STS); + if (priv->info->version == SPRD_MBOX_R2) + fifo_sts2 = readl(priv->inbox_base + SPRD_MBOX_IN_FIFO_STS2); + /* Get the inbox data delivery status */ - send_sts = (fifo_sts & SPRD_INBOX_FIFO_DELIVER_MASK) >> - SPRD_INBOX_FIFO_DELIVER_SHIFT; + if (priv->info->version == SPRD_MBOX_R2) { + send_sts = fifo_sts & SPRD_INBOX_R2_FIFO_DELIVER_MASK; + } else { + send_sts = (fifo_sts & SPRD_INBOX_FIFO_DELIVER_MASK) >> + SPRD_INBOX_FIFO_DELIVER_SHIFT; + } + if (!send_sts) { dev_warn_ratelimited(priv->dev, "spurious inbox interrupt\n"); return IRQ_NONE; } /* Clear FIFO delivery and overflow status first */ - writel(fifo_sts & - (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), - priv->inbox_base + SPRD_MBOX_FIFO_RST); + if (priv->info->version == SPRD_MBOX_R2) { + writel(SPRD_INBOX_R2_FIFO_OVERFLOW_DELIVER_RST, + priv->inbox_base + SPRD_MBOX_FIFO_RST); + } else { + writel(fifo_sts & (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK), + priv->inbox_base + SPRD_MBOX_FIFO_RST); + } while (send_sts) { id = __ffs(send_sts); @@ -181,7 +216,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data) * Check if the message was fetched by remote target, if yes, * that means the transmission has been completed. */ - busy = fifo_sts & SPRD_INBOX_FIFO_BUSY_MASK; + if (priv->info->version == SPRD_MBOX_R2) + busy = fifo_sts2 & SPRD_INBOX_R2_FIFO_BUSY_MASK; + else + busy = fifo_sts & SPRD_INBOX_FIFO_BUSY_MASK; + if (!(busy & BIT(id))) mbox_chan_txdone(chan, 0); } @@ -295,7 +334,7 @@ static int sprd_mbox_probe(struct platform_device *pdev) struct device *dev = &pdev->dev; struct sprd_mbox_priv *priv; int ret, inbox_irq, outbox_irq, supp_irq; - unsigned long id, supp; + unsigned long id; struct clk *clk; priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); @@ -305,6 +344,10 @@ static int sprd_mbox_probe(struct platform_device *pdev) priv->dev = dev; mutex_init(&priv->lock); + priv->info = of_device_get_match_data(dev); + if (!priv->info) + return -EINVAL; + /* * Unisoc mailbox uses an inbox to send messages to the target * core, and uses (an) outbox(es) to receive messages from other @@ -362,12 +405,12 @@ static int sprd_mbox_probe(struct platform_device *pdev) return ret; } - supp = (unsigned long) of_device_get_match_data(dev); - if (!supp) { + if (!priv->info->supp_id) { dev_err(dev, "no supplementary outbox specified\n"); return -ENODEV; } - priv->supp_base = priv->outbox_base + (SPRD_OUTBOX_BASE_SPAN * supp); + priv->supp_base = priv->outbox_base + + (SPRD_OUTBOX_BASE_SPAN * priv->info->supp_id); } /* Get the default outbox FIFO depth */ @@ -375,11 +418,15 @@ static int sprd_mbox_probe(struct platform_device *pdev) readl(priv->outbox_base + SPRD_MBOX_FIFO_DEPTH) + 1; priv->mbox.dev = dev; priv->mbox.chans = &priv->chan[0]; - priv->mbox.num_chans = SPRD_MBOX_CHAN_MAX; priv->mbox.ops = &sprd_mbox_ops; priv->mbox.txdone_irq = true; - for (id = 0; id < SPRD_MBOX_CHAN_MAX; id++) + if (priv->info->version == SPRD_MBOX_R2) + priv->mbox.num_chans = SPRD_MBOX_R2_CHAN_MAX; + else + priv->mbox.num_chans = SPRD_MBOX_R1_CHAN_MAX; + + for (id = 0; id < priv->mbox.num_chans; id++) priv->chan[id].con_priv = (void *)id; ret = devm_mbox_controller_register(dev, &priv->mbox); @@ -391,10 +438,24 @@ static int sprd_mbox_probe(struct platform_device *pdev) return 0; } +static const struct sprd_mbox_info sc9860_mbox_info = { + .version = SPRD_MBOX_R1, +}; + +static const struct sprd_mbox_info sc9863a_mbox_info = { + .version = SPRD_MBOX_R1, + .supp_id = 7, +}; + +static const struct sprd_mbox_info ums9230_mbox_info = { + .version = SPRD_MBOX_R2, + .supp_id = 6, +}; + static const struct of_device_id sprd_mbox_of_match[] = { - { .compatible = "sprd,sc9860-mailbox" }, - { .compatible = "sprd,sc9863a-mailbox", - .data = (void *)SPRD_SUPP_INBOX_ID_SC9863A }, + { .compatible = "sprd,sc9860-mailbox", .data = &sc9860_mbox_info }, + { .compatible = "sprd,sc9863a-mailbox", .data = &sc9863a_mbox_info }, + { .compatible = "sprd,ums9230-mailbox", .data = &ums9230_mbox_info }, { }, }; MODULE_DEVICE_TABLE(of, sprd_mbox_of_match); From 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Otto=20Pfl=C3=BCger?= Date: Sat, 10 Jan 2026 16:43:38 +0100 Subject: [PATCH 34/34] mailbox: sprd: mask interrupts that are not handled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit To reduce the amount of spurious interrupts, disable the interrupts that are not handled in this driver. Signed-off-by: Otto Pflüger Signed-off-by: Jassi Brar --- drivers/mailbox/sprd-mailbox.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c index 26256581a76a..565502904e1f 100644 --- a/drivers/mailbox/sprd-mailbox.c +++ b/drivers/mailbox/sprd-mailbox.c @@ -282,21 +282,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan) /* Select outbox FIFO mode and reset the outbox FIFO status */ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); - /* Enable inbox FIFO overflow and delivery interrupt */ - val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); - val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); + /* Enable inbox FIFO delivery interrupt */ + val = SPRD_INBOX_FIFO_IRQ_MASK; + val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ; writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); /* Enable outbox FIFO not empty interrupt */ - val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); + val = SPRD_OUTBOX_FIFO_IRQ_MASK; val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); /* Enable supplementary outbox as the fundamental one */ if (priv->supp_base) { writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST); - val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK); - val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK); } }