From 1278abcb44e07c3507fef3507f3f6dda79fceee5 Mon Sep 17 00:00:00 2001 From: liutong Date: Sun, 23 Aug 2026 05:14:30 +0000 Subject: [PATCH] mailbox: riscv-sbi-mpxy: Fix inverted notification loop In mpxy_mbox_peek_rpmi_data(), the while loop condition checks: (events_data_len - pos) <= sizeof(*event) This is inverted. The loop should continue while there is enough remaining data to hold at least one event header, i.e. >=. With <= the loop body is entered only when the remaining data is smaller than one header, which is never useful. In practice, since events_data_len is always larger than sizeof(*event) (4 bytes), the condition is false on the first iteration and the loop is never entered. All RPMI notification events are silently dropped. Fix the condition from <= to >=. Fixes: bf3022a4eb11 ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver") Signed-off-by: liutong Signed-off-by: Linux RISC-V bot --- drivers/mailbox/riscv-sbi-mpxy-mbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/riscv-sbi-mpxy-mbox.c b/drivers/mailbox/riscv-sbi-mpxy-mbox.c index 7c9c006b7244a5..18da9efcce405e 100644 --- a/drivers/mailbox/riscv-sbi-mpxy-mbox.c +++ b/drivers/mailbox/riscv-sbi-mpxy-mbox.c @@ -480,7 +480,7 @@ static void mpxy_mbox_peek_rpmi_data(struct mbox_chan *chan, struct rpmi_mbox_message msg; unsigned long pos = 0; - while (pos < events_data_len && (events_data_len - pos) <= sizeof(*event)) { + while (pos < events_data_len && (events_data_len - pos) >= sizeof(*event)) { event = (struct rpmi_notification_event *)(notif->events_data + pos); msg.type = RPMI_MBOX_MSG_TYPE_NOTIFICATION_EVENT;