linux-stable.git/drivers/mailbox, branch v7.2.4

mailbox: qcom-ipcc: fix duplicate channel allocation across holes

2026-09-07T15:36:59+00:00

commit 66c7bcad72430a02c860521031350b84b31ad9a8 upstream.

The IPCC of_xlate() both scans for a free mailbox channel and checks
for duplicate references to the same underlying IPCC channel. When a
channel has been shutdown it might have left a hole in the channel
list, which would terminate the search without considering duplicates
later in the list.

Continue the traversal of the channel list to detect and reject
duplicates, while keeping track of the first free channel.

Fixes: d6fbfdbc1274 ("mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion")
Cc: stable@vger.kernel.org
Signed-off-by: Anup Vishwakarma 
Signed-off-by: Jassi Brar 
Signed-off-by: Greg Kroah-Hartman

mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()

2026-08-27T12:35:24+00:00

commit b37c4d0a2fd90c0c31223acd37f763eb8953ed1a upstream.

Add a check to see if devm_kasprintf() is not NULL in
mchp_ipc_get_cluster_aggr_irq(), returning -ENOMEM if the function
failed.

Assisted-by: gkh_clanker_t1000
CC: Jassi Brar 
Signed-off-by: Griffin Kroah-Hartman 
Signed-off-by: Jassi Brar 
Signed-off-by: Greg Kroah-Hartman

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of  by the more specific
 where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich 
Acked-by: Takashi Sakamoto 
Acked-by: Bjorn Helgaas 
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub)

mailbox: imx: Don't force-thread the primary handler

2026-06-21T02:18:39+00:00

The primary interrupt handler (imx_mu_isr()) no longer invokes any
callbacks it only masks the interrupt source and returns. In a
forced-threaded environment the IRQ-core will force-thread the primary
handler which can be avoided.

The primary handler uses a spinlock_t to protect the RMW operation in
imx_mu_xcr_rmw() - nothing that may introduce long latencies.

The lock can be turned into a raw_spinlock_t and then the primary
handler can run in hardirq context even on PREEMPT_RT skipping one
thread.

Make struct imx_mu_priv::xcr_lock a raw_spinlock_t and skip
force-threading the primrary handler by marking it IRQF_NO_THREAD.

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar

mailbox: imx: Move the RXDB part of the mailbox into the threaded handler

2026-06-21T02:18:39+00:00

Move RXDB callback handling into the threaded handler. This similar to
the RX side and since the imx_mu_dcfg::rxdb callback can return an error, the
interrupt is only enabled on success.

Move RXDB callback handling into the threaded handler.

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar

mailbox: imx: Move the RX part of the mailbox into the threaded handler

2026-06-21T02:18:39+00:00

Move RX callback handling into the threaded handler. This is similar to
the TX side except that we explicitly mask the source interrupt in the
primary handler and unmask it in the threaded handler again after
success. This was done automatically in the TX part.

The masking/ unmasking can be removed from imx_mu_specific_rx() since it
already happens in the primary/ threaded handler before invoking the
channel specific callback.

Move RX channel handling into threaded handler.

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar

mailbox: imx: Start splitting the IRQ handler in primary and threaded handler

2026-06-21T02:18:38+00:00

Split the mailbox irq handling into a primary handler (imx_mu_isr()) and
a threaded handler (imx_mu_isr_th()). The primary handler masks the
interrupt event so the threaded handler can run without raising the
interrupt again.

The goal here is to invoke the mailbox core functions (such as
mbox_chan_received_data(), mbox_chan_txdone()) in preemptible context which is
made possible by using an threaded interrupt handler. This in turn means that
mailbox's client callbacks are invoked in preemptible context, too. This then
allows the mailbox client callback to skip an indirection via a workqueue if
it requries preemptible callback.

As a first step, prepare the logic and move TX handling part.

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar

mailbox: imx: Use channel index instead of zero in imx_mu_specific_rx()

2026-06-21T02:18:38+00:00

imx_mu_specific_rx() masks channel 0 and unmasks it again at the end of
the function. Given that at startup the channel index got unmasked it
should do the right job.

This here either unmasks the actual channel or another one but should
have no impact given that it reverses its doing at the end.

Peng Fan commented here:
| For specific rx channel, whether it is i.MX8 SCU or i.MX ELE, actually there is
| only 1 channel as of now, but it seems better to use cp->idx in case more
| channels in future.

Use the channel index instead of zero.

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar

mailbox: imx: use devm_of_platform_populate()

2026-06-21T02:18:38+00:00

The driver uses of_platform_populate() but does not remove the added
devices on removal. This can lead to "double devices" on module removal
followed by adding the module again.

Use devm_of_platform_populate() to remove the populated devices once the
parent device is removed.

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar

mailbox: imx: Use devm_pm_runtime_enable()

2026-06-21T02:18:38+00:00

sashiko complained about early usage of the device while probe isn't
completed. This can be mitigated by delaying the pm_runtime_enable()
into the removal path instead doing it early. This ensures that in an
error case the device is removed (and imx_mu_shutdown()) before
pm_runtime_disable() so we don't have to do this manually.

For the order to work, lets move devm_mbox_controller_register() until
after the pm-runtime part. So the reverse order will be mbox-controller
removal followed by disabling pm runtime.

Use devm_pm_runtime_enable(), remove manual pm_runtime_disable()
invocations and move the pm_runtime handling in probe before
devm_mbox_controller_register().

Reviewed-by: Peng Fan 
Reviewed-by: Mathieu Poirier 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Jassi Brar