kernel/linux.git/drivers/mailbox/mailbox.c, branch v6.18.35

mailbox: Fix NULL message support in mbox_send_message()

2026-06-09T10:28:52+00:00

commit c58e9456e30c7098cbcd9f04571992be8a2e4e63 upstream. The active_req field serves double duty as both the "is a TX in flight" flag (NULL means idle) and the storage for the in-flight message pointer. When a client sends NULL via mbox_send_message(), active_req is set to NULL, which the framework misinterprets as "no active request". This breaks the TX state machine by: - tx_tick() short-circuits on (!mssg), skipping the tx_done callback and the tx_complete completion - txdone_hrtimer() skips the channel entirely since active_req is NULL, so poll-based TX-done detection never fires. Fix this by introducing a MBOX_NO_MSG sentinel value that means "no active request," freeing NULL to be valid message data. The sentinel is defined in the subsystem-internal mailbox.h so that controller drivers within drivers/mailbox/ can reference it, but it is not exposed to clients outside the subsystem. Fifteen in-tree callers send NULL (doorbell-style IPCs on Qualcomm, Tegra, TI, Xilinx, i.MX, SCMI, and PCC platforms). All were audited for regression: - Most already work around the bug via knows_txdone=true with a manual mbox_client_txdone() call, making the framework's tracking irrelevant. These are unaffected. - Poll-based callers (Xilinx zynqmp/r5) are strictly better off: the poll timer now correctly detects NULL-active channels instead of silently skipping them. - irq-qcom-mpm.c was a pre-existing bug -- the only Qualcomm caller that omitted the knows_txdone + mbox_client_txdone() pattern. Fixed in a companion commit ("irqchip/qcom-mpm: Fix missing mailbox TX done acknowledgment"). - No caller sets both a tx_done callback and sends NULL, nor combines tx_block=true with NULL sends, so the newly reachable callback/completion paths are never exercised. Also update tegra-hsp's flush callback, which directly inspects active_req to wait for the channel to drain: the old "!= NULL" check becomes "!= MBOX_NO_MSG", otherwise flush spins until timeout since the sentinel is non-NULL. The only tradeoff is that 'MBOX_NO_MSG' can not be used as a message by clients. Reported-by: Joonwon Kang Reviewed-by: Douglas Anderson Signed-off-by: Jassi Brar Signed-off-by: Joonwon Kang Signed-off-by: Greg Kroah-Hartman

mailbox: add sanity check for channel array

2026-05-23T11:07:06+00:00

[ Upstream commit c1aad75595fb67edc7fda8af249d3b886efa1be9 ] Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers might instantiate very early. Remove the comment explaining the obvious while here. Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox") Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

2026-03-04T12:21:07+00:00

[ Upstream commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 ] Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable@vger.kernel.org Signed-off-by: Joonwon Kang Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: Allow controller specific mapping using fwnode

2025-09-25T01:32:00+00:00

Introduce optional fw_node() callback which allows a mailbox controller driver to provide controller specific mapping using fwnode. The Linux OF framework already implements fwnode operations for the Linux DD framework so the fw_xlate() callback works fine with device tree as well. Acked-by: Jassi Brar Reviewed-by: Andy Shevchenko Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-6-apatel@ventanamicro.com Signed-off-by: Paul Walmsley

mailbox: Use guard/scoped_guard for spinlock

2025-05-26T21:23:39+00:00

Use guard and scoped_guard for chan->lock and mbox->poll_hrt_lock to simplify code. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar

mailbox: Use guard/scoped_guard for con_mutex

2025-05-26T21:23:39+00:00

Use guard and scoped_guard for con_mutex to simplify code. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar

mailbox: Remove devm_mbox_controller_unregister

2025-05-26T21:23:39+00:00

Commit e898d9cdd3a9("mailbox: Add device-managed registration functions") introduced device-managed API for mailbox, but in the past 7 years, there is no user for devm_mbox_controller_unregister. So remove it. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar

mailbox: Propagate correct error return value

2025-05-26T21:23:39+00:00

In case of_property_match_string fails, it makes more sense to return its error value to caller, not force the value to ERR_PTR(-EINVAL). Signed-off-by: Peng Fan Signed-off-by: Jassi Brar

mailbox: Not protect module_put with spin_lock_irqsave

2025-05-26T21:23:39+00:00

&chan->lock is not supposed to protect 'chan->mbox'. And in __mbox_bind_client, try_module_get is also not protected by &chan->lock. So move module_put out of the lock protected region. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar

mailbox: Use dev_err when there is error

2025-05-26T21:23:39+00:00

Use dev_err to show the error log instead of using dev_dbg. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar