| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
# Conflicts:
# sound/hda/codecs/side-codecs/cs35l41_hda.c
|
|
|
|
Couple the Host and Link DMA when the stream is put.
When the hda_dsp_stream_hw_free() is called the Link DMA might be still
locked and we would leave the DMAs decoupled.
hda_dsp_stream_hw_free() is not called for code loader use or in case of
probes or trace use for example.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20261009052942.17346-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Protect IPC RX and FW state handler list unregister/dispatch paths with
client_event_handler_mutex to match list registration and locking
comments.
Fixes: 5c19da34df02 ("ASoC: SOF: Use guard()/scoped_guard() for mutex locks where it makes sense")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20261008090143.15158-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono
capture stream, such as a SmartMic, aggregated across multiple SDW
links), step = ch_count / blob->alh_cfg.device_count truncates to 0.
The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to
UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds
exponent:
UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13
shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'
Treat ch_count < device_count the same way as the existing "channels
equal to output reference channels" case: apply the same ch_mask to
every aggregated device instead of trying to split channels that
can't be evenly divided.
Fixes: 0390a102cc18 ("ASoC: SOF: ipc4-topology: use different channel mask for each sdw amp feedback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20261008090130.15135-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
So far we've used snd_array infrastructure for managing the
hda_jack_tbl elements, but it turned out that this may lead to a UAF
when a different order of destruction procedure is applied; namely,
each hda_jack_tbl object creates a snd_jack object and sets the
private_data pointing to the hda_jack_tbl, and private_free to release
it. It looks harmless, but since snd_array may reallocate the whole
table at growing, the formerly referred jack pointer may become stale.
Fortunately, currently there is no call pattern that triggers this
issue, so it's only hypothetical, but we should address it in anyway.
There are several ways to address this, and at this time, we rather
redesign the hda_jack_tbl allocations: instead of snd_array(), do a
normal kmalloc() + linked list. There will be more kmalloc calls than
the original code, but as the number of jacks are usually at most
handful, it must not be a problem. This change allows us the
persistent jack pointer, so no stale pointer access can happen any
longer.
This also fixes another reported issue about the stale jack pointer
reference in snd_hda_jack_tbl_new(), too.
Fixes: 31ef22579302 ("ALSA: hda - Integrate input-jack stuff into kctl-jack")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261007171057.7462-1-tiwai@suse.de
|
|
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says:
This series adds compressed audio support for SOF with IPC4 firmware.
Supported formats are PCM, MP3, AAC and VORBIS, the feature set is
PAUSE_PUSH/RELEASE, DRAIN and position reporting.
Patches 1-5 are prerequisites in the ALSA compress core and in
soc-compress.c.
These are core fixes rather than driver level workarounds on purpose.
The other users of compressed DPCM have DSP internal ports on their
BEs, driven by code they own. An Intel/SOF BE ends at a third party
CODEC driver which is shared with the non DPCM case and has no reason
to know that the FE is compressed. That set of CODECs is open ended,
so teaching each of them to cope with a compressed FE does not scale.
The core has to hand a BE the same substream state whether the FE is
a PCM or a compressed one.
Two of these patches change behaviour for the existing users of
compressed DPCM, so they would need a look from Qualcomm and NXP:
- "ASoC: soc-compress: Implement trigger FE-BE sequencing as with
normal PCMs" makes the FE/BE trigger order follow
dai_link->trigger[], the way dpcm_fe_dai_do_trigger() does it.
Neither sound/soc/qcom/ nor sound/soc/fsl/ sets it, so both default
to SND_SOC_DPCM_TRIGGER_PRE: START keeps the current order, but
STOP, SUSPEND and PAUSE_PUSH now trigger the BE before the FE.
- "ASoC: soc-compress: Stop running dpcm on free" sends a STOP trigger
from soc_compr_free_fe() if the DPCM is still in START state, which
is the case when the last trigger the stream received was a DRAIN.
Patches 6-20 implement the IPC4 compressed support, patch 21 is a
Kconfig cleanup. The last two patches enable the feature, in Kconfig
for TGL and later and in the topology parser, so the compressed device
type only becomes usable once the code behind it is in place.
Testing:
- IPC4: Arrow Lake, compressed playback on speaker and headphone
(cs42l43), MP3, AAC and VORBIS.
- IPC3: tested by NXP. This does not cover the STOP on free path
above, as they do not implement DRAIN.
Link: https://patch.msgid.link/20261007084955.1256-1-peter.ujfalusi@linux.intel.com
|
|
Decoder and encoder modules fall under process modules in SOF.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Co-developed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-29-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Select SOF_COMPRESS for TGL and newer platforms, on Intel devices the
compressed support is available with IPC4 only.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-28-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
There is no need to select IPC3 and IPC4 along with INTEL_CNL as INTEL_CNL
selects both.
Similarly, INTEL_MTL selects IPC4, so there is no need to do that for LNL,
PTL and NVL.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-27-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The decoder module sends a drain done notification when the last chunk of
the stream after the EOS from host has been decoded.
The notification is a module notification with 0xc0c0 as magic number in
event_id upper 16 bit.
Call sof_ipc4_compr_drain_done() when the notification arrives to handle
it.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-26-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Set and define the compressed ops for IPC4.
The initial implementation supports basic features: PAUSE PUSH/RELEASE,
DRAIN and progress reporting.
Tested with PCM, MP3, AAC and VORBIS codec.
Co-developed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-25-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The page table describing the audio buffer for the firmware is a single
PAGE_SIZE allocation, but snd_sof_create_page_table() writes the
compressed PFNs into it without checking that they fit.
The PFNs are stored in 2.5 bytes each and the last one is written with a
32 bit access, so with 4K pages the table can hold 1638 PFNs, which is a
buffer of 6.4MB. A larger buffer corrupts memory past the end of the
page table.
The PCM path is not affected as the maximum buffer size is specified by
the topology, but the compressed streams can ask for larger buffers.
Pass the page table buffer to snd_sof_create_page_table() instead of only
its address and verify that the buffer can be described by it.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261007084955.1256-24-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Add new ops in the struct snd_sof_ops for platform-specific ops for
compresssed streams. Also, define and set them for the HDA platforms.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Co-developed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-23-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
FAST_MODE allows the host DMA to work in opportunistic, free running mode,
which matches with the bitstream nature of compressed devices.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-22-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The DRAIN trigger is received by a compr device when user space wrote all
the data to the buffer and it is waiting for the decoding to be completed.
Set the pipeline state to EOS in firmware so it can expect the stream to
be stopping anytime soon.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-21-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
SOF_INFO (id == 35) tuple holds tuple structured information about SOF
features.
The first entry in SOF_INFO is the SOF_CODEC_INFO (id == 0) which contains
information about the supported codecs for decode/encode in the booted
firmware.
If present in the fw_config payload, make a copy of it and store it
sof_ipc4_fw_data->codec_info to be used by the compressed code.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-20-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The support for compressed stream will also need to have access to the
same information which is used for delay reporting for DAI data
progression tracking.
Make the necessary struct and functions to be available and premare them to
be called without a valid substream.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-19-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Add support for handling init_ext_module_data for process modules, which is
going to be used by decoder and encoder type of process modules.
The support is generic and it can be extended to other type of process
modules or other module types than process with a small update of
sof_ipc4_add_init_ext_module_data() function.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-18-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
After the host DMA ID is released, reset the curr_pos to 0 for a clean
start for subsequent stream starts. This is not needed for PCM streams
but for compressed streams.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-16-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
In order to reuse the pipeline triggering logic for compressed support
with IPC4, modify the signature of the trigger and hw_free PCM IPC ops
so that they can be reused.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-15-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
These are common functions that will also be needed for the IPC4
compressed support.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-14-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
sof_widget_free_unlocked() dereferences swidget->spipe without checking
it for two things: swidget->spipe->complete for a scheduler widget, and
swidget->spipe->pipe_widget for the recursive free of the pipeline's
scheduler widget. Both can be reached with spipe or pipe_widget not
set, which oopses in the free path - where there is nothing left to
bail out to.
Check both before use and cache swidget->spipe in the local spipe
variable that is already there. A widget with no pipeline has nothing
to put or complete, and no scheduler widget to free, so skipping is the
correct behaviour.
No functional change for a widget that was successfully set up:
sof_widget_setup_unlocked() already rejects a dynamic pipeline widget
with no spipe or no spipe->pipe_widget with -EINVAL.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-13-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
sof_ipc4_pcm_free() frees the array of the pipelines to be triggered
without any serialization against sof_ipc4_trigger_pipelines(), which
walks the very same array. The trigger took the pipeline_state_mutex
only after it fetched the first pipeline from the list, so a PCM free
running in parallel - on unbind or topology removal - can free the array
from under it.
Take the pipeline_state_mutex in sof_ipc4_pcm_free() and move the guard
in sof_ipc4_trigger_pipelines() before the first access to the pipeline
list. Clear the count of the freed list as well, so that a trigger which
was waiting for the mutex sees an empty list and returns.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-12-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Two issues with the way sof_set_up_widgets_in_path() adds a pipeline to
the list of pipelines to be triggered:
The count is incremented before the array entry is written, so the last
entry of the list is NULL for a short window. A concurrent user of the
list, like sof_ipc4_trigger_pipelines(), can see the incremented count
with the entry still unset.
A widget which is not part of a pipeline has no spipe, but it is still
added to the list, resulting in a NULL entry within the count.
Store the entry before incrementing the count and skip the widgets
without a pipeline.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261007084955.1256-11-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
In preparation for adding support for compressed offload support for
IPC4, rename the current compress implementation with the IPC3 prefix
and rename the compress.c file to ipc3-compress.c
Introduce a new field in struct sof_ipc_pcm_ops to save the
IPC-specific compressed ops pointer, which is assigned to the component
driver ops during SOF device probe. As this now depends on the IPC ops,
move snd_sof_new_platform_drv() after the IPC ops are initialized.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-10-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The fragment elapsed handling and the page table creation in compress.c
are not tied to the IPC version, they will be used by both the IPC3 and
the upcoming IPC4 compressed implementation.
Move them to sof-audio.c and export create_page_table() as
snd_sof_compr_create_page_table().
No functional change.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20261007084955.1256-9-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Bard Liao <yung-chuan.liao@linux.intel.com> says:
Currently, function topology is only used by the SoundWire machines.
Extend the support to the I2S machines.
The only ALSA change is to lower the log level. Let's go through the
ASoC tree.
Link: https://patch.msgid.link/20260922092316.2296039-1-yung-chuan.liao@linux.intel.com
|
|
The existing code assumes there is only one NHLT blob either from BIOS
or topology. As function topologies are used and each function topology
contains a NHLT blob section, we need to search the matching NHLT blob
from all the NHLT blobs.
The commit suggests adding a list of NHLTs and search the NHLTs from the
list.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20260922092316.2296039-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
In preparation for converting the kmalloc family of allocators to the
type-aware kmalloc_obj family, we need to make sure that the returned
type from the allocation matches the type of the variable being
assigned. (The kmalloc family returns "void *", which can be implicitly
cast to any pointer type.)
The assigned type is "const char **", but the converted allocation type
would be "char **", which is the same type without the const qualifier.
As there is no general way to safely add const qualifiers, take the size
from the assignment target instead. No change in allocation size
results.
Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0:
sound/soc/sof/topology.o
Assisted-by: LLM coccinelle
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
Link: https://patch.msgid.link/20260917211117.i.991-kees@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Vijendar Mukunda <Vijendar.Mukunda@amd.com> says:
This series contains bug fixes for the existing AMD SOF SoundWire stack
that affect all ACP platforms, followed by new SoundWire support
specifically for ACP7.B and ACP7.F.
The existing stack has three bugs that are fixed here. First,
amd_sof_acp7x_suspend() silently falls through on an unrecognised PCI
revision instead of returning an error, leaving ACP_CONTROL with a stale
value; it now returns -EINVAL. Second, amd_sof_acp_remove() calls
amd_sof_sdw_exit() before free_irq(), so an IRQ that fires in that window
can dereference the freed SoundWire context; the teardown order is
corrected. Third, the same use-after-free hazard exists in the error
unwind of amd_sof_acp_probe() and is fixed in the same way.
On top of those fixes, the series brings SoundWire support to ACP7.B/7.F.
These platforms expose four SoundWire manager instances (SDW0-SDW3) rather
than the two found on ACP63/ACP70/ACP71/ACP72. The work covers ACPI DSDT
scanning for SoundWire endpoints, chip descriptor population so the SOF
core can enumerate all four managers, per-manager IRQ dispatch for data,
host-wake, PME and error events, selective host-wake interrupt arming based
on SW_WAKE_EN, and SoundWire-aware PM callbacks that take a clock-stop fast
path through suspend/resume to preserve SoundWire bus state across power
transitions.
ACP7.B/7.F also supports two PDM controllers (PDM0 and PDM1), but only
one is active at a time. The active controller is determined at probe time
by scanning the acp-audio-ep-port ACPI _DSD property of the PDM child
device in the DSDT. The selected controller is then propagated to the
machine driver via mach->pdata so that the correct SOF DMIC DAI link is
registered.
Link: https://patch.msgid.link/20260910132251.1171943-1-Vijendar.Mukunda@amd.com
|
|
Add handle_amd_sof_acp7x_sdw_pme_event() to iterate over all four
SoundWire managers on runtime PM resume, clear PME status and
wake-enable bits (under acp_lock to prevent races with the IRQ path),
and request runtime resume for each active manager.
Extend amd_sof_acp7x_suspend() with a clock-stop fast path: when
SoundWire managers are in clock-stop mode, write ZSC_DSP_CTRL=1 and
call acp_dsp_reset() instead of the full acp_reset() to preserve
SoundWire bus state. Extend amd_sof_acp7x_resume() with a matching
clock-stop resume path that restores ZSC_DSP_CTRL and re-arms PME_EN.
Introduce amd_sof_acp7x_suspend_runtime() and
amd_sof_acp7x_resume_runtime() as separate runtime PM callbacks.
The runtime resume path calls handle_amd_sof_acp7x_sdw_pme_event()
after re-initialising hardware to clear any PME state that arrived
during the suspend window.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-12-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
During acp_init() for ACP7.B/7.F, read ACP7X_SW_WAKE_EN and enable the
corresponding host-wake interrupt mask in ACP7X_EXTERNAL_INTR_CNTL1 only
for managers that have wake-enable set (SW_WAKE_EN bit i enables
ACP7X_SW_HOST_WAKE_MASK << i in INTR_CNTL1). This ensures only the active
managers arm their host-wake interrupt when ACP enters D0.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-11-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
ACP7.B/7.F exposes four SoundWire managers (SDW0-SDW3), each with
dedicated interrupt, wake-enable, PME status and error registers.
Add acp7x_irq_handler() to dispatch:
- Per-manager data IRQs via sof_acp7x_handle_sdw_manager_irq()
- Host-wake and PME events via
sof_amd_check_and_handle_acp7x_sdw_wake_irq() which checks both
sources independently per manager so simultaneous host-wake and
PME events are not missed
- Error conditions via sof_amd_acp7x_clear_sdw_err_regs() which
writes back the updated error status to clear only the affected
manager bit
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-10-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
check_acp_sdw_enable_status
Extend check_acp_sdw_enable_status() with a pci_rev switch so that
ACP7.B/7.F, which has 4 SoundWire manager instances, reads all four
SW_EN registers to determine whether any manager is in clock-stop mode.
The existing two-manager read (ACP_SW0_EN, ACP_SW1_EN) is preserved for
ACP63/ACP70/ACP71/ACP72 platforms.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-9-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
In amd_sof_acp7x_probe(), scan DSDT for SoundWire peripherals via
acp_sof_scan_sdw_devices() and call amd_sof_sdw_probe() on success.
In the error unwind, call free_irq() before amd_sof_sdw_exit() so
the IRQ cannot fire after the SoundWire context is freed.
In amd_sof_acp7x_remove(), call amd_sof_sdw_exit() after free_irq()
to prevent a use-after-free: the IRQ handler dereferences pdev[] entries
freed by amd_sof_sdw_exit().
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-8-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Select SND_SOC_SOF_AMD_SOUNDWIRE_LINK_BASELINE in Kconfig for
SND_SOC_SOF_AMD_ACP7X so that the SoundWire stack is built
when ACP7.B/7.F SOF support is enabled.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-7-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Populate the SoundWire descriptor fields in acp7x_chip_info so the SOF
core can locate and enumerate the four SoundWire managers on ACP7.B/7.F
platforms.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-6-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Add acp_sof_scan_pdm_devices() to read the acp-audio-ep-port ACPI _DSD
property from the PDM child device on ACP7.B/7.F platforms. Value 4
selects PDM0 (ACP7X_PDM_DMIC0), value 5 selects PDM1 (ACP7X_PDM_DMIC1).
Unrecognized values are reported via dev_warn(). The selected controller
is stored in acp_dev_data.pdm_sel and propagated to the machine driver
via mach->pdata in amd_sof_machine_select() so the machine driver probe
can register the correct SOF DMIC DAI link.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-5-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Call amd_sof_sdw_exit() after free_irq() in the free_ipc_irq error
label of amd_sof_acp_probe(). Without this, an IRQ that fires between
sdw context teardown and free_irq() can dereference freed SoundWire
resources.
Fixes: d948218424bf ("ASoC: SOF: amd: add code for invoking soundwire manager helper functions")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-4-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Call free_irq() before amd_sof_sdw_exit() in amd_sof_acp_remove().
amd_sof_sdw_exit() sets adata->sdw to NULL; if an IRQ fires between
that point and the subsequent free_irq(), acp_irq_handler() may
dereference the now-NULL pdev[] pointer, causing a use-after-free.
Fixes: d948218424bf ("ASoC: SOF: amd: add code for invoking soundwire manager helper functions")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-3-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
amd_sof_acp7x_suspend() is registered only for ACP7.B and ACP7.F
platforms. If an unexpected PCI revision reaches the switch statement
the default case previously fell through, leaving ACP_CONTROL
with a stale value (enable=false) before writing ZSC_DSP_CTRL=1.
Return -EINVAL instead to surface the programming error immediately.
Fixes: 1c9646f3180e ("ASoC: SOF: amd: add system and runtime PM ops for ACP7x")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260910132251.1171943-2-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Commit 58bb5081cba1 ("ASoC: SOF: Xtensa: dump ar registers to restore
call stack") added a shared Xtensa helper that iterates over a flexible
array of AR registers (`ar[]`) controlled by `plat_hdr.numaregs`.
While Intel IPC4 allocates dynamic storage for the AR block, the i.MX
IPC3 path reads the oops message into a stack-allocated struct without
backing storage for `ar[]`, while leaving `numaregs` unvalidated. This
causes a stack out-of-bounds read when printing a DSP panic.
Clear `numaregs` to 0 on i.MX since the AR block is not fetched or
supported on this platform, preventing unsafe out-of-bounds memory
accesses in the shared Xtensa helper.
Fixes: 58bb5081cba1 ("ASoC: SOF: Xtensa: dump ar registers to restore call stack")
Signed-off-by: Ștefan Ghețu <stefanghetu9@gmail.com>
Link: https://patch.msgid.link/20260908170740.276800-1-stefanghetu9@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> says:
Several ASoC drivers manually manage reserved memory lifetime by calling
of_reserved_mem_device_init() in probe and of_reserved_mem_device_release()
in remove. This pattern is fragile: any error path between the two that
skips the release leaks the reserved memory region for the lifetime of the
driver.
devm_of_reserved_mem_device_init() was recently introduced to tie the
release to the device's devres lifetime automatically. Convert the affected
ASoC drivers to use it, removing the manual release calls and any wrapper
devres actions.
Link: https://patch.msgid.link/20260902194712.2003414-1-mukesh.ojha@oss.qualcomm.com
|
|
Use the devres-managed devm_of_reserved_mem_device_init() to ensure
the reserved memory region is released on device removal, fixing a
missing cleanup in the original code.
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260902194712.2003414-12-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Use the devres-managed devm_of_reserved_mem_device_init() to ensure
the reserved memory region is released on device removal, fixing a
missing cleanup in the original code.
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260902194712.2003414-11-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> says:
These two patches were originally part of
https://lore.kernel.org/all/20260907083727.733705-1-srinivas.kandagatla@oss.qualcomm.com/
As Suggested by Charles and Pierre am sending them as independent
of the rest of that series and can be picked up on their own.
Patch 1 adds SDCA_FUNCTION_TYPE_SIMPLE_JACK to the class function
driver's auxiliary id table so a SimpleJack auxdev is bound and
enumerated as an ASoC component, and wires set_jack for this
function type so the machine driver can register an ASoC jack
against it.
Patch 2 is a small cleanup: find_sdca_control_reset() only ever
returns 0, so convert it to void and drop the dead error check in
the caller. No functional change.
Both patches already carry Reviewed-by tags from Charles and
Pierre-Louis from the original posting.
Link: https://patch.msgid.link/20260908063644.463819-1-srinivas.kandagatla@oss.qualcomm.com
|
|
imx8_run(), imx8x_run() and imx8_shutdown() check the return value of
every imx_sc_misc_set_control() call but ignore the one from
imx_sc_pm_cpu_start(), which propagates errors from imx_scu_call_rpc()
and can fail with -ETIMEDOUT, -EINVAL or -EPERM.
Reporting success after a failed start leaves the caller loading
firmware onto a core that is not running, and a failed shutdown is
similarly hidden from imx_chip_core_shutdown() callers, which do act on
the return value.
Propagate the error, matching imx95_core_shutdown() in imx9.c.
Signed-off-by: Ștefan Ghețu <stefanghetu9@gmail.com>
Link: https://patch.msgid.link/20260902175517.209406-1-stefanghetu9@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci
This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.
Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.
Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
|
