kernel/rv1106: HPMCU mailbox 100% VERIFIED + open NPU driver VERIFIED

MAILBOX (fully open A7<->RISC-V SCR1 round-trip, 5/5 exact echoes on c8a3):
- rockchip-mailbox.c: rv1106 has 1 shared IRQ, not 4/channel -> added
  rv1106_drv_data{num_chans=1} + compatible (rk3368 fallback assumed 4 -> probe
  failed 'IRQ index 1 not found').
- clk-rv1106.c: CLK_CORE_MCU (SCR1 core clock) marked CLK_IGNORE_UNUSED -
  6.18's clk_disable_unused() was switching off the coprocessor clock so a
  loaded firmware never ran (5.10 left it on).
- Open SCR1 echo firmware (scr1-echo/, 154B RV32IMC) + load/test scripts;
  A2B_INTEN on the MCU side + CMD-then-DAT (DAT=doorbell) order. Loaded via the
  proven hpmcu.rs SRAM path; do NOT kill warden-flared (dw-wdt). mailbox/VERIFIED.md.

NPU (open GPL rknpu 0.9.2 kernel driver on 6.18):
- DT fix: base npu node lacks interrupt-names, driver requests IRQ byname
  'npu_irq' -> probe bailed -ENXIO. Added interrupt-names='npu_irq'.
- Verified: [drm] Initialized rknpu 0.9.2 on minor 1; /dev/dri/card1;
  rknpu_version_test PASS (0.9.2 + hw version, full power/clock/reset path).
- Honest ceiling: open compute (regcmd compiler) is a from-scratch ~person-year
  RE project, no RV1106 prior art; ship the driver, no blob. npu/VERIFIED.md.

DRIVER-PARITY + CAPABILITIES-AUDIT updated; dts snapshot refreshed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

kernel/rv1106-enablement/mailbox/VERIFIED.md

@@ -0,0 +1,53 @@
+# HPMCU mailbox — ✅ 100% VERIFIED on warden-c8a3 (2026-08-25)
+
+A fully-open A7 ↔ HPMCU (RISC-V SCR1) hardware-mailbox round-trip on our self-built
+Linux 6.18.46. Open kernel driver + open SCR1 firmware, **zero blobs**.
+
+## Evidence (serial, _b slot = our 6.18)
+SCR1 echo firmware running: `DBG_STATE = 0x584F424D` ("MBOX"). Five round-trips,
+Linux → mailbox → SCR1 → mailbox → Linux, **all exact**:
+```
+sent 0x0000beef/0x600df00d -> B2A 0x0000BEEF/0x600DF00D  e=4  ✓
+sent 0x0000c0de/0x12345678 -> B2A 0x0000C0DE/0x12345678  e=5  ✓
+sent 0x0000face/0xdeadbeef -> B2A 0x0000FACE/0xDEADBEEF  e=6  ✓
+sent 0x00001234/0xcafef00d -> B2A 0x00001234/0xCAFEF00D  e=7  ✓
+sent 0x0000aa55/0x55aa55aa -> B2A 0x0000AA55/0x55AA55AA  e=8  ✓
+```
+Echo counter increments 1:1 with sends; both CMD and DAT echo back verbatim.
+
+## The three fixes it took (none in the research plan — found on hardware)
+1. **Controller IRQ count** (`rockchip-mailbox.c`): the rv1106 mailbox has ONE
+   shared IRQ (GIC_SPI 1), but the rk3368 driver-data assumes one IRQ per channel
+   (num_chans=4) and probe failed `IRQ index 1 not found`. Added an
+   `rv1106_drv_data { .num_chans = 1 }` + a `rockchip,rv1106-mailbox` match entry
+   (ahead of the rk3368 fallback). Channel 0 is all the doorbell needs. Controller
+   then probes clean and clocks the mailbox (pclk_mailbox on).
+2. **SCR1 core clock** (`clk-rv1106.c`): `clk_core_mcu` (the coprocessor's 297 MHz
+   core clock) had flags 0, so 6.18's `clk_disable_unused()` switched it off and the
+   released core never executed (DBG_STATE stayed 0). Marked it `CLK_IGNORE_UNUSED`.
+   (5.10 happened to leave it on.)
+3. **A2B doorbell semantics** (SCR1 firmware + send order): the MCU-side receiver
+   must set `A2B_INTEN` or an A7 write to A2B_CMD never raises A2B_STATUS — the echo
+   firmware now sets `A2B_INTEN` at init. And the A2B_DAT write is the doorbell, so
+   the sender writes CMD first, then DAT (the mainline order), so both are current
+   when the SCR1 reads them.
+
+## Loading the firmware (no reflash, no brick)
+The SCR1 echo firmware (`scr1-echo/`, 154 B) is loaded at runtime into hpmcu_sram
+(0xFF6FE000) via the proven `flared/hpmcu.rs` sequence (`load-echo-fw.sh`): GRF
+uncached peripheral window (0xff040024/28) → CORECRU hold → firmware to SRAM →
+SGRF boot addr → CORECRU release. **Do NOT kill warden-flared** (it one-shot-loads
+at boot then just beats + pets the dw-wdt; killing it resets the board). We reset
++ reload the SCR1; flared does not re-load. The SRAM-load path avoids the 0x40000
+boot-load brick hazard entirely.
+
+## Config / DT
+`CONFIG_ROCKCHIP_MBOX=y`; board DTS `&mailbox { status = "okay"; }` (the @ff5c0000
+HPMCU-connected instance). The existing /dev/mem SRAM watchdog is untouched (a
+separate dead-man's-switch); the mailbox is the general open IPC channel.
+
+## Files
+- `scr1-echo/main.c` + `start.S` + `link.lds` + `Makefile` — the open SCR1 echo fw.
+- `scr1-echo/load-echo-fw.sh`, `mbox-roundtrip.sh`, `echo-fw-words.txt` — load + test.
+- Kernel deltas: `rockchip-mailbox.c` (rv1106 num_chans=1), `clk-rv1106.c`
+  (CLK_CORE_MCU IGNORE_UNUSED), `rv1106-warden.dts` (&mailbox okay).