In mpxy_mbox_peek_rpmi_data(), the while loop condition checks:

  (events_data_len - pos) <= sizeof(*event)

This is inverted. The loop should continue while there is enough
remaining data to hold at least one event header, i.e. >=. With <=
the loop body is entered only when the remaining data is smaller than
one header, which is never useful. In practice, since events_data_len
is always larger than sizeof(*event) (4 bytes), the condition is false
on the first iteration and the loop is never entered.

All RPMI notification events are silently dropped.

Fix the condition from <= to >=.

Fixes: bf3022a4eb11 ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver")
Signed-off-by: liutong <liutong@iscas.ac.cn>
---
 drivers/mailbox/riscv-sbi-mpxy-mbox.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/riscv-sbi-mpxy-mbox.c b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
index 7c9c006b7..18da9efcc 100644
--- a/drivers/mailbox/riscv-sbi-mpxy-mbox.c
+++ b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
@@ -480,7 +480,7 @@ static void mpxy_mbox_peek_rpmi_data(struct mbox_chan *chan,
 	struct rpmi_mbox_message msg;
 	unsigned long pos = 0;
 
-	while (pos < events_data_len && (events_data_len - pos) <= sizeof(*event)) {
+	while (pos < events_data_len && (events_data_len - pos) >= sizeof(*event)) {
 		event = (struct rpmi_notification_event *)(notif->events_data + pos);
 
 		msg.type = RPMI_MBOX_MSG_TYPE_NOTIFICATION_EVENT;
-- 
2.34.1

On Sat, Aug 22, 2026 at 10:14 PM liutong <liutong@iscas.ac.cn> wrote:
>
> In mpxy_mbox_peek_rpmi_data(), the while loop condition checks:
>
>   (events_data_len - pos) <= sizeof(*event)
>
> This is inverted. The loop should continue while there is enough
> remaining data to hold at least one event header, i.e. >=. With <=
> the loop body is entered only when the remaining data is smaller than
> one header, which is never useful. In practice, since events_data_len
> is always larger than sizeof(*event) (4 bytes), the condition is false
> on the first iteration and the loop is never entered.
>
> All RPMI notification events are silently dropped.
>
> Fix the condition from <= to >=.
>
> Fixes: bf3022a4eb11 ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver")
> Signed-off-by: liutong <liutong@iscas.ac.cn>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Thanks,
Anup

> ---
>  drivers/mailbox/riscv-sbi-mpxy-mbox.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mailbox/riscv-sbi-mpxy-mbox.c b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
> index 7c9c006b7..18da9efcc 100644
> --- a/drivers/mailbox/riscv-sbi-mpxy-mbox.c
> +++ b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
> @@ -480,7 +480,7 @@ static void mpxy_mbox_peek_rpmi_data(struct mbox_chan *chan,
>         struct rpmi_mbox_message msg;
>         unsigned long pos = 0;
>
> -       while (pos < events_data_len && (events_data_len - pos) <= sizeof(*event)) {
> +       while (pos < events_data_len && (events_data_len - pos) >= sizeof(*event)) {
>                 event = (struct rpmi_notification_event *)(notif->events_data + pos);
>
>                 msg.type = RPMI_MBOX_MSG_TYPE_NOTIFICATION_EVENT;
> --
> 2.34.1
>