[PATCH] mailbox: riscv-sbi-mpxy: Fix inverted notification loop
From: liutong
Date: Sun Aug 23 2026 - 01:15:00 EST
In mpxy_mbox_peek_rpmi_data(), the while loop condition checks:
(events_data_len - pos) <= sizeof(*event)
This is inverted. The loop should continue while there is enough
remaining data to hold at least one event header, i.e. >=. With <=
the loop body is entered only when the remaining data is smaller than
one header, which is never useful. In practice, since events_data_len
is always larger than sizeof(*event) (4 bytes), the condition is false
on the first iteration and the loop is never entered.
All RPMI notification events are silently dropped.
Fix the condition from <= to >=.
Fixes: bf3022a4eb11 ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver")
Signed-off-by: liutong <liutong@xxxxxxxxxxx>
---
drivers/mailbox/riscv-sbi-mpxy-mbox.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/riscv-sbi-mpxy-mbox.c b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
index 7c9c006b7..18da9efcc 100644
--- a/drivers/mailbox/riscv-sbi-mpxy-mbox.c
+++ b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
@@ -480,7 +480,7 @@ static void mpxy_mbox_peek_rpmi_data(struct mbox_chan *chan,
struct rpmi_mbox_message msg;
unsigned long pos = 0;
- while (pos < events_data_len && (events_data_len - pos) <= sizeof(*event)) {
+ while (pos < events_data_len && (events_data_len - pos) >= sizeof(*event)) {
event = (struct rpmi_notification_event *)(notif->events_data + pos);
msg.type = RPMI_MBOX_MSG_TYPE_NOTIFICATION_EVENT;
--
2.34.1