March 2026 - Sound-open-firmware - mailman.alsa-project.org

[PATCH] ASoC: SOF: Intel: hda: Place check before dereference
by Ethan Tidmore 31 Mar '26

31 Mar '26

The struct hext_stream is dereferenced before it is checked for NULL. Although it can never be NULL due to a check prior to hda_dsp_iccmax_stream_hw_params() being called, this change clears any confusion regarding hext_stream possibly being NULL. Check hext_stream for NULL and then assign its members. Detected by Smatch: sound/soc/sof/intel/hda-stream.c:488 hda_dsp_iccmax_stream_hw_params() warn: variable dereferenced before check 'hext_stream' (see line 486) Fixes: aca961f196e5d ("ASoC: SOF: Intel: hda: Add helper function to program ICCMAX stream") Signed-off-by: Ethan Tidmore <ethantidmore06(a)gmail.com> --- sound/soc/sof/intel/hda-stream.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c index 1c04b5d9c0d8..5c1f3b427cdb 100644 --- a/sound/soc/sof/intel/hda-stream.c +++ b/sound/soc/sof/intel/hda-stream.c @@ -480,16 +480,20 @@ int hda_dsp_iccmax_stream_hw_params(struct snd_sof_dev *sdev, struct hdac_ext_st struct snd_dma_buffer *dmab, struct snd_pcm_hw_params *params) { - struct hdac_stream *hstream = &hext_stream->hstream; - int sd_offset = SOF_STREAM_SD_OFFSET(hstream); + struct hdac_stream *hstream; + int sd_offset; int ret; - u32 mask = 0x1 << hstream->index; + u32 mask; if (!hext_stream) { dev_err(sdev->dev, "error: no stream available\n"); return -ENODEV; } + hstream = &hext_stream->hstream; + sd_offset = SOF_STREAM_SD_OFFSET(hstream); + mask = 0x1 << hstream->index; + if (!dmab) { dev_err(sdev->dev, "error: no dma buffer allocated!\n"); return -ENODEV; -- 2.53.0

2 1

Re: [PATCH] ASoC: SOF: Don't allow pointer operations on unconfigured streams
by Péter Ujfalusi 31 Mar '26

31 Mar '26

On 30/03/2026 23:11, Mark Brown wrote: > On Mon, Mar 30, 2026 at 02:50:15PM +0300, Péter Ujfalusi wrote: >> On 30/03/2026 14:05, Mark Brown wrote: > >>> We don't generally guard calls based on the state the stream is in, > >> compress does this quite much, just avail and tstamp is exempt for some >> reason. > > Actually already we have a guard preventing userspace from doing an > avail() when we're unconfigured but we do it after we've called down > into the driver which is less than ideal. I think that's because we > also check for XRUN and the availability check might cause us to notice > that we're in a bad state for that. I don't see how the avail path checks for XRUN and if the drivers supposed to do that, I'm not even sure if XRUN is possible with compress.. I did noted that the avail have the state check reversed, making it ineffective. The other point is that any return code from the driver's pointer callback is ignored by the core, the return value of stream->ops->pointer() is not even captured, it could be void. Looks like a design choice, but I cannot say. fwiw, the same check should be added to sound/soc/qcom/qdsp6/q6apm-dai.c as it does div with prtd->pcm_size (q6apm_dai_compr_pointer), which is only initialized in set_params. -- Péter

1 0

[PATCH] ASoC: SOF: topology: use kzalloc_flex
by Rosen Penev 30 Mar '26

30 Mar '26

Simplify allocation by using a flexible array member. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp(a)gmail.com> --- sound/soc/sof/sof-audio.h | 2 +- sound/soc/sof/topology.c | 14 ++------------ 2 files changed, 3 insertions(+), 13 deletions(-) diff --git a/sound/soc/sof/sof-audio.h b/sound/soc/sof/sof-audio.h index 80b11625915d..138e5fcc2dd0 100644 --- a/sound/soc/sof/sof-audio.h +++ b/sound/soc/sof/sof-audio.h @@ -411,11 +411,11 @@ struct snd_sof_dai_link { struct snd_sof_tuple *tuples; int num_tuples; struct snd_soc_dai_link *link; - struct snd_soc_tplg_hw_config *hw_configs; int num_hw_configs; int default_hw_cfg_id; int type; struct list_head list; + struct snd_soc_tplg_hw_config hw_configs[] __counted_by(num_hw_configs); }; /* ASoC SOF DAPM widget */ diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c index 63d637db7053..413003e86f6c 100644 --- a/sound/soc/sof/topology.c +++ b/sound/soc/sof/topology.c @@ -1908,18 +1908,12 @@ static int sof_link_load(struct snd_soc_component *scomp, int index, struct snd_ return -EINVAL; } - slink = kzalloc_obj(*slink); + slink = kzalloc_flex(*slink, hw_configs, le32_to_cpu(cfg->num_hw_configs)); if (!slink) return -ENOMEM; slink->num_hw_configs = le32_to_cpu(cfg->num_hw_configs); - slink->hw_configs = kmemdup_array(cfg->hw_config, - slink->num_hw_configs, sizeof(*slink->hw_configs), - GFP_KERNEL); - if (!slink->hw_configs) { - kfree(slink); - return -ENOMEM; - } + memcpy(slink->hw_configs, cfg->hw_config, le32_to_cpu(cfg->num_hw_configs) * sizeof(*slink->hw_configs)); slink->default_hw_cfg_id = le32_to_cpu(cfg->default_hw_config_id); slink->link = link; @@ -1932,7 +1926,6 @@ static int sof_link_load(struct snd_soc_component *scomp, int index, struct snd_ private->array, le32_to_cpu(private->size)); if (ret < 0) { dev_err(scomp->dev, "Failed tp parse common DAI link tokens\n"); - kfree(slink->hw_configs); kfree(slink); return ret; } @@ -2003,7 +1996,6 @@ static int sof_link_load(struct snd_soc_component *scomp, int index, struct snd_ /* allocate memory for tuples array */ slink->tuples = kzalloc_objs(*slink->tuples, num_tuples); if (!slink->tuples) { - kfree(slink->hw_configs); kfree(slink); return -ENOMEM; } @@ -2061,7 +2053,6 @@ static int sof_link_load(struct snd_soc_component *scomp, int index, struct snd_ err: kfree(slink->tuples); - kfree(slink->hw_configs); kfree(slink); return ret; @@ -2078,7 +2069,6 @@ static int sof_link_unload(struct snd_soc_component *scomp, struct snd_soc_dobj kfree(slink->tuples); list_del(&slink->list); - kfree(slink->hw_configs); kfree(slink); dobj->private = NULL; -- 2.53.0

2 1

[PATCH AUTOSEL 6.19-5.10] ASoC: SOF: topology: reject invalid vendor array size in token parser
by Sasha Levin 30 Mar '26

30 Mar '26

From: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> [ Upstream commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d ] sof_parse_token_sets() accepts array->size values that can be invalid for a vendor tuple array header. In particular, a zero size does not advance the parser state and can lead to non-progress parsing on malformed topology data. Validate array->size against the minimum header size and reject values smaller than sizeof(*array) before parsing. This preserves behavior for valid topologies and hardens malformed-input handling. Signed-off-by: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Link: https://patch.msgid.link/20260319-sof-topology-array-size-fix-v1-1-f9191b16… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: Now I have all the information needed for a comprehensive analysis. =============================================================== ## PHASE 1: COMMIT MESSAGE FORENSICS =============================================================== **Step 1.1:** Record: [ASoC: SOF: topology] [reject] [reject invalid vendor array size in token parser to prevent non-progress parsing] **Step 1.2:** Record: Tags present: - Signed-off-by: Cássio Gabriel (author) - Acked-by: Peter Ujfalusi (confirmed listed SOF maintainer in MAINTAINERS) - Link: patch.msgid.link URL - Signed-off-by: Mark Brown (ASoC maintainer, merged the patch) - No Fixes:, Reported-by:, Tested-by:, Cc: stable tags (expected for manual review candidates) **Step 1.3:** Record: Bug: `sof_parse_token_sets()` accepts `array->size` values that are invalid — specifically, a zero size does not advance parser state. Symptom: non-progress parsing (infinite loop) on malformed topology data. Root cause: the validation only checked `asize < 0`, which cannot catch zero or small positive values. **Step 1.4:** Record: Yes, this is a real bug fix despite "hardens" language. The commit fixes a concrete infinite loop scenario where `asize == 0` causes the parser while-loop to never terminate. =============================================================== ## PHASE 2: DIFF ANALYSIS =============================================================== **Step 2.1:** Record: 1 file changed (`sound/soc/sof/topology.c`), 1 line modified. Function modified: `sof_parse_token_sets()`. Classification: single-file, single-line surgical fix. **Step 2.2:** Record: Before: `if (asize < 0)` — only rejects negative values. After: `if (asize < sizeof(*array))` — rejects any value smaller than the vendor array header size. The FIXME comment ("A zero-size array makes no sense") was already documenting this known deficiency. **Step 2.3:** Record: Bug category: logic/infinite loop. The while loop at line 735 uses `array_size -= asize` (line 746) and advances the pointer via `array = (u8*)array + asize` (line 784). When `asize == 0`: 1. `array_size -= 0` — no change, stays positive 2. `array = array + 0` — pointer doesn't advance 3. The while condition `array_size > 0 && total < count * token_instance_num` remains true 4. Result: **infinite loop / soft lockup** **Step 2.4:** Record: The fix is obviously correct. `struct snd_soc_tplg_vendor_array` has three `__le32` header fields (`size`, `type`, `num_elems`) = 12 bytes minimum, plus a flex array union. Any valid array must be at least `sizeof(*array)` bytes. Note on type promotion: `asize` is `int`, `sizeof(*)` is `size_t`. A negative `asize` promotes to a very large unsigned value, so `asize < sizeof(*)` would be false — but negative `asize` is still caught by the subsequent `array_size -= asize; if (array_size < 0)` check at line 747, so no regression. =============================================================== ## PHASE 3: GIT HISTORY INVESTIGATION =============================================================== **Step 3.1:** Record: `git blame` confirms the buggy `if (asize < 0)` check was introduced in commit `311ce4fe7637d9` ("ASoC: SOF: Add support for loading topologies") by Liam Girdwood, 2019-04-12. `git describe --contains` shows this is `v5.2-rc1`. The bug has been present since **v5.2** — all active stable trees contain it. **Step 3.2:** Record: No Fixes: tag present. The buggy commit is `311ce4fe7637d9`. **Step 3.3:** Record: `git log --oneline -20` shows active development but no related prerequisite or duplicate fix for this specific issue. **Step 3.4:** Record: Peter Ujfalusi (Acked-by) is a listed maintainer for SOF in MAINTAINERS. Mark Brown signed off as ASoC subsystem maintainer. Strong maintainer endorsement. **Step 3.5:** Record: No dependencies. The fix changes one condition in an existing function with no new types, helpers, or APIs needed. =============================================================== ## PHASE 4: MAILING LIST RESEARCH =============================================================== Record: The patch.msgid.link and lore.kernel.org URLs are blocked by Anubis bot protection in this environment. However, the patch was Acked by a listed SOF maintainer (Peter Ujfalusi) and merged by the ASoC maintainer (Mark Brown), providing strong review signal. =============================================================== ## PHASE 5: CODE SEMANTIC ANALYSIS =============================================================== **Step 5.1:** Record: Modified function: `sof_parse_token_sets()` **Step 5.2:** Record: `sof_parse_token_sets()` is called from: 1. `sof_parse_tokens()` — a wrapper called from ~9 locations throughout topology.c (control load, widget parsing, DAI load, link load, DSPless widget paths) 2. `sof_parse_pin_binding()` — direct call for pin binding token parsing This is a heavily-used core parsing function in the SOF topology loader. **Step 5.3-5.4:** Record: The call chain is: `sof_pcm_probe()` → `snd_sof_load_topology()` → `snd_soc_tplg_component_load()` → SOF callbacks (widget_ready, dai_load, link_load, control_load) → `sof_parse_tokens()` → `sof_parse_token_sets()`. This is triggered during SOF audio component probe when topology firmware blobs are loaded. **Step 5.5:** Record: The **same weak check** (`if (asize < 0)`) exists in `sof_copy_tuples()` at line 544, with identical loop structure and pointer advancement at line 610. This sibling function has the same vulnerability but is NOT fixed by this commit. This means the patch is not a complete fix across all SOF topology parsing paths, but it does fix the specific path through `sof_parse_token_sets()`. =============================================================== ## PHASE 6: STABLE TREE ANALYSIS =============================================================== **Step 6.1:** Record: The buggy code was introduced in v5.2. All active stable trees (5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y) contain this vulnerable code. **Step 6.2:** Record: Expected clean or trivial backport — the `if (asize < 0)` line with the FIXME comment hasn't changed since introduction. **Step 6.3:** Record: No duplicate or alternative fix found for this exact issue in git history. =============================================================== ## PHASE 7: SUBSYSTEM CONTEXT =============================================================== **Step 7.1:** Record: Subsystem: sound/soc/sof (Sound Open Firmware). Criticality: IMPORTANT — SOF is used on most modern Intel laptops for audio hardware. **Step 7.2:** Record: Active subsystem with regular commits. =============================================================== ## PHASE 8: IMPACT AND RISK ASSESSMENT =============================================================== **Step 8.1:** Record: Affected users: SOF audio hardware users (very common on Intel-based laptops/desktops). **Step 8.2:** Record: Trigger: malformed/corrupt SOF topology blob with `array->size == 0` (or < header size). Topology files are loaded from firmware path during driver probe. Trigger requires corrupt or maliciously crafted topology data — uncommon in normal operation but possible from disk corruption or adversarial input. **Step 8.3:** Record: Failure mode: infinite loop in kernel context → soft lockup → system hang during audio driver probe. Severity: HIGH (system hang, unavailability). **Step 8.4:** Record: - **Benefit:** Prevents a real infinite loop / system hang. The FIXME comment proves the developer knew this was broken. Low-medium benefit (real hang, but only on malformed input). - **Risk:** Very low. Single condition change; valid topologies always have `asize >= sizeof(*array)`. No regression for valid data. Acked by subsystem maintainer. - **Ratio:** Favorable — high confidence in correctness, near-zero regression risk, fixes real hang. =============================================================== ## PHASE 9: FINAL SYNTHESIS =============================================================== **Step 9.1: Evidence compilation** FOR backporting: - Fixes a concrete infinite loop (system hang) — the FIXME comment proves this was a known deficiency - Single-line, obviously correct fix - Acked by listed SOF subsystem maintainer (Peter Ujfalusi) - Merged by ASoC maintainer (Mark Brown) - Bug present since v5.2 — exists in all active stable trees - Near-zero regression risk for valid topologies - `sof_parse_token_sets()` is called from ~10 locations — well-used code path AGAINST backporting: - Trigger requires malformed topology data (not normal operation) - No user/syzbot crash report — found by code inspection - The parallel `sof_copy_tuples()` function retains the same weak check (incomplete coverage) - SOF is important but not core kernel — affects hardware-specific users **Step 9.2: Stable rules checklist** 1. Obviously correct and tested? **YES** — maintainer acked, trivially verifiable from code 2. Fixes a real bug? **YES** — infinite loop on malformed input (acknowledged by FIXME comment) 3. Important issue? **YES** — system hang (soft lockup), HIGH severity 4. Small and contained? **YES** — 1 line changed, 1 function, 1 file 5. No new features or APIs? **YES** 6. Can apply to stable trees? **YES** — identical code in all stable trees **Step 9.3:** Record: No exception category — standard bug fix. **Step 9.4: Decision** This commit fixes a real, documented infinite loop bug (the original code even had a FIXME acknowledging the problem). The fix is a single- line minimum-size validation, acked by the subsystem maintainer, with near-zero regression risk. While the trigger requires malformed topology data, a system hang is a serious failure mode — stable kernels should handle invalid input gracefully without hanging. The incomplete coverage of the sibling function `sof_copy_tuples()` does not diminish the value of fixing this specific path. The fix meets all stable kernel criteria. ## Verification - [Phase 1] Parsed all tags from supplied commit message: Acked-by Peter Ujfalusi, Signed-off-by Mark Brown, Link to patch.msgid.link - [Phase 1] Verified Peter Ujfalusi is listed as maintainer in MAINTAINERS under "SOUND - SOUND OPEN FIRMWARE (SOF) DRIVERS" - [Phase 2] Read `sof_parse_token_sets()` (lines 724-793): confirmed while loop at line 735, `array_size -= asize` at line 746, pointer advance `(u8*)array + asize` at line 784 — `asize == 0` causes infinite loop - [Phase 2] Verified `struct snd_soc_tplg_vendor_array` in `include/uapi/sound/asoc.h` (line 220): three `__le32` fields (`size`, `type`, `num_elems`) + flex array union — `sizeof(*array)` is the correct minimum header size - [Phase 2] Verified type safety: `int asize` compared against `size_t sizeof(*)` — negative values promote to large unsigned (caught by subsequent `array_size < 0` check at line 747) - [Phase 3] git blame: buggy `if (asize < 0)` line attributed to commit `311ce4fe7637d9` (Liam Girdwood, 2019-04-12) - [Phase 3] git describe: `311ce4fe7637d9` first appeared in `v5.2-rc1` — bug present in all active stable trees - [Phase 3] git log -20: no prerequisites or duplicate fixes found - [Phase 5] grep callers: `sof_parse_token_sets()` called from `sof_parse_tokens()` (~9 call sites) and `sof_parse_pin_binding()` (1 call site) - [Phase 5] grep: found same weak `if (asize < 0)` check in sibling `sof_copy_tuples()` at line 544, with identical loop/advance pattern at line 610 — NOT fixed by this commit - [Phase 6] Buggy code unchanged since v5.2 — clean backport expected to all active stable trees - [Phase 8] Failure mode: infinite loop in kernel context → soft lockup/system hang during topology load. Severity: HIGH - UNVERIFIED: Lore discussion content (blocked by Anubis protection) - UNVERIFIED: Whether unprivileged users can trigger topology loading on specific distributions - UNVERIFIED: Exact runtime `sizeof(struct snd_soc_tplg_vendor_array)` (struct is `__packed` with flex array — compile-time verification not performed) **YES** sound/soc/sof/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c index 9bf8ab610a7ea..8880ac5d8d6ff 100644 --- a/sound/soc/sof/topology.c +++ b/sound/soc/sof/topology.c @@ -736,7 +736,7 @@ static int sof_parse_token_sets(struct snd_soc_component *scomp, asize = le32_to_cpu(array->size); /* validate asize */ - if (asize < 0) { /* FIXME: A zero-size array makes no sense */ + if (asize < sizeof(*array)) { dev_err(scomp->dev, "error: invalid array size 0x%x\n", asize); return -EINVAL; -- 2.53.0

1 0

Re: [PATCH] ASoC: SOF: Don't allow pointer operations on unconfigured streams
by Péter Ujfalusi 30 Mar '26

30 Mar '26

On 30/03/2026 14:05, Mark Brown wrote: > On Mon, Mar 30, 2026 at 10:01:59AM +0300, Péter Ujfalusi wrote: > >> Should this be fixed in core level to avoid repeating the same check in >> every driver? > > I did wonder about that but wasn't sure if there might be some viable > use case, especially for things proxying through to a DSP or something. I see, but proxying or not, if there were no configuration set (the state is OPEN) then asking for avail or tstamp do not have any validity. > We don't generally guard calls based on the state the stream is in, compress does this quite much, just avail and tstamp is exempt for some reason. > and not every implementation is going to try to do the division. yeah, the SOF IPC4 compress which is under review for example is not doing this. -- Péter

1 0

Re: [PATCH] ASoC: SOF: Don't allow pointer operations on unconfigured streams
by Péter Ujfalusi 30 Mar '26

30 Mar '26

On 27/03/2026 18:52, Mark Brown wrote: > On Fri, Mar 27, 2026 at 11:49:41AM +0200, Péter Ujfalusi wrote: >> On 26/03/2026 16:52, Mark Brown wrote: > >>> + if (!sstream->channels || !sstream->sample_container_bytes) >>> + return -EBUSY; >>> + > >> Is this a theoretical fix? >> I don't think this can happen in real world as set_params would need to >> fail and if that failed then applications would not ask for a pointer as >> the compress stream cannot be even started. > > Yes, it's not something that would happen in the real world with a non > buggy (or hostile) userspace. Still, we shouldn't leave this stuff > open. Yes, hostile user space is a valid concern, in theory it can ask for TSTAMP or AVAIL before it would be meaningful (a configuration is set - buffer config is known). For avail the state sanity check is in wrong place in snd_compr_ioctl_avail(), it should be before calling snd_compr_calc_avail(). tstamp does not even have a sanity validity check in sound/cor/comrpess_offload.c, which it should as well - snd_compr_tstamp() Should this be fixed in core level to avoid repeating the same check in every driver? -- Péter

1 0

RE: [PATCH] ASoC: SOF: Don't allow pointer operations on unconfigured streams
by Liao, Bard 30 Mar '26

30 Mar '26

> -----Original Message----- > From: Mark Brown <broonie(a)kernel.org> > Sent: Saturday, March 28, 2026 12:48 AM > To: Liao, Bard <bard.liao(a)intel.com> > Cc: Liam Girdwood <lgirdwood(a)gmail.com>; Peter Ujfalusi > <peter.ujfalusi(a)linux.intel.com>; Bard Liao <yung- > chuan.liao(a)linux.intel.com>; Ranjani Sridharan > <ranjani.sridharan(a)linux.intel.com>; Daniel Baluta <daniel.baluta(a)nxp.com>; > Kai Vehmanen <kai.vehmanen(a)linux.intel.com>; Pierre-Louis Bossart <pierre- > louis.bossart(a)linux.dev>; Jaroslav Kysela <perex(a)perex.cz>; Takashi Iwai > <tiwai(a)suse.com>; Paul Olaru <paul.olaru(a)oss.nxp.com>; Laurentiu Mihalcea > <laurentiu.mihalcea(a)nxp.com>; sound-open-firmware(a)alsa-project.org; > linux-sound(a)vger.kernel.org; linux-kernel(a)vger.kernel.org; > stable(a)vger.kernel.org > Subject: Re: [PATCH] ASoC: SOF: Don't allow pointer operations on > unconfigured streams > > On Fri, Mar 27, 2026 at 02:09:40AM +0000, Liao, Bard wrote: > > > > + if (!sstream->channels || !sstream->sample_container_bytes) > > > + return -EBUSY; > > > Sorry, but why it is BUSY in this case? > > -EBUSY is often "wrong state". Could also be -EINVAL, it doesn't super > make a difference I think - nobody should actually be doing this. Thanks Mark for the explanation, it makes sense.

1 0

[PATCH] ASoC: SOF: Don't allow pointer operations on unconfigured streams
by Mark Brown 27 Mar '26

27 Mar '26

When reporting the pointer for a compressed stream we report the current I/O frame position by dividing the position by the number of channels multiplied by the number of container bytes. These values default to 0 and are only configured as part of setting the stream parameters so this allows a divide by zero to be configured. Validate that they are non zero, returning an error if not Fixes: c1a731c71359 ("ASoC: SOF: compress: Add support for computing timestamps") Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org --- sound/soc/sof/compress.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/soc/sof/compress.c b/sound/soc/sof/compress.c index 96570121aae0..90f056eae1c3 100644 --- a/sound/soc/sof/compress.c +++ b/sound/soc/sof/compress.c @@ -379,6 +379,9 @@ static int sof_compr_pointer(struct snd_soc_component *component, if (!spcm) return -EINVAL; + if (!sstream->channels || !sstream->sample_container_bytes) + return -EBUSY; + tstamp->sampling_rate = sstream->sampling_rate; tstamp->copied_total = sstream->copied_total; tstamp->pcm_io_frames = div_u64(spcm->stream[cstream->direction].posn.dai_posn, --- base-commit: c369299895a591d96745d6492d4888259b004a9e change-id: 20260326-asoc-compress-tstamp-params-296f38f15217 Best regards, -- Mark Brown <broonie(a)kernel.org>

3 2

[PATCH] ASoC: SOF: compress: return the configured codec from get_params
by Cássio Gabriel 25 Mar '26

25 Mar '26

The SOF compressed offload path accepts codec parameters in sof_compr_set_params() and forwards them to firmware as extended data in the SOF IPC stream params message. However, sof_compr_get_params() still returns success without filling the snd_codec structure. Since the compress core allocates that structure zeroed and copies it back to userspace on success, SNDRV_COMPRESS_GET_PARAMS returns an all-zero codec description even after the stream has been configured successfully. The stale TODO in this callback conflates get_params() with capability discovery. Supported codec enumeration belongs in get_caps() and get_codec_caps(). get_params() should report the current codec settings. Cache the codec accepted by sof_compr_set_params() in the per-stream SOF compress state and return it from sof_compr_get_params(). Fixes: 6324cf901e14 ("ASoC: SOF: compr: Add compress ops implementation") Signed-off-by: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> --- sound/soc/sof/compress.c | 8 +++++--- sound/soc/sof/sof-priv.h | 2 ++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/sound/soc/sof/compress.c b/sound/soc/sof/compress.c index 3dbc05bf3b79..f4c3e10e6344 100644 --- a/sound/soc/sof/compress.c +++ b/sound/soc/sof/compress.c @@ -255,6 +255,7 @@ static int sof_compr_set_params(struct snd_soc_component *component, sstream->sampling_rate = params->codec.sample_rate; sstream->channels = params->codec.ch_out; sstream->sample_container_bytes = pcm->params.sample_container_bytes; + sstream->codec_params = params->codec; spcm->prepared[cstream->direction] = true; @@ -267,9 +268,10 @@ static int sof_compr_set_params(struct snd_soc_component *component, static int sof_compr_get_params(struct snd_soc_component *component, struct snd_compr_stream *cstream, struct snd_codec *params) { - /* TODO: we don't query the supported codecs for now, if the - * application asks for an unsupported codec the set_params() will fail. - */ + struct sof_compr_stream *sstream = cstream->runtime->private_data; + + *params = sstream->codec_params; + return 0; } diff --git a/sound/soc/sof/sof-priv.h b/sound/soc/sof/sof-priv.h index 693d063830fa..38753b088fc1 100644 --- a/sound/soc/sof/sof-priv.h +++ b/sound/soc/sof/sof-priv.h @@ -17,6 +17,7 @@ #include <sound/sof/info.h> #include <sound/sof/pm.h> #include <sound/sof/trace.h> +#include <sound/compress_params.h> #include <uapi/sound/sof/fw.h> #include <sound/sof/ext_manifest.h> @@ -111,6 +112,7 @@ struct sof_compr_stream { u32 sampling_rate; u16 channels; u16 sample_container_bytes; + struct snd_codec codec_params; size_t posn_offset; }; --- base-commit: 5c3743212c70461c076cb11c83c899695a1528f8 change-id: 20260325-sof-compr-get-params-660c3350e173 Best regards, -- Cássio Gabriel <cassiogabrielcontato(a)gmail.com>

1 0

[PATCH v5] ASoC: SOF: sof-audio: pcm_id is __le32
by Ben Dooks 24 Mar '26

24 Mar '26

The pcm_id value is __le32 so convert it before passing to the dev_dbg function to be printed. Also fixup some other uses of __le32 data and a couple of places where %u should have been used instead of %d Picked up by sparse prototype for variadic and printf function checking. Fixes a large number of sparse warnings, such as: sound/soc/sof/pcm.c:84:25: warning: incorrect type in argument 4 (different base types) sound/soc/sof/pcm.c:84:25: expected unsigned int sound/soc/sof/pcm.c:84:25: got restricted __le32 [usertype] pcm_id Signed-off-by: Ben Dooks <ben.dooks(a)codethink.co.uk> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> --- v2: fix missing __le32 conversions v3: further __le32 fixes for other header values v4: fix signed-ness of printf formatting --- sound/soc/sof/compress.c | 2 +- sound/soc/sof/pcm.c | 2 +- sound/soc/sof/topology.c | 12 ++++++------ 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/sound/soc/sof/compress.c b/sound/soc/sof/compress.c index c6c19df29035..3dbc05bf3b79 100644 --- a/sound/soc/sof/compress.c +++ b/sound/soc/sof/compress.c @@ -247,7 +247,7 @@ static int sof_compr_set_params(struct snd_soc_component *component, ret = snd_sof_set_stream_data_offset(sdev, &spcm->stream[cstream->direction], ipc_params_reply.posn_offset); if (ret < 0) { - dev_err(component->dev, "Invalid stream data offset for Compr %d\n", + dev_err(component->dev, "Invalid stream data offset for Compr %u\n", le32_to_cpu(spcm->pcm.pcm_id)); goto out; } diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c index d3af30398305..b2071edeaea6 100644 --- a/sound/soc/sof/pcm.c +++ b/sound/soc/sof/pcm.c @@ -360,7 +360,7 @@ static int sof_pcm_prepare(struct snd_soc_component *component, platform_params = &spcm->platform_params[substream->stream]; ret = sof_widget_list_setup(sdev, spcm, params, platform_params, dir); if (ret < 0) { - dev_err(sdev->dev, "failed widget list set up for pcm %d dir %d\n", + dev_err(sdev->dev, "failed widget list set up for pcm %d dir %u\n", le32_to_cpu(spcm->pcm.pcm_id), dir); spcm->stream[dir].list = NULL; snd_soc_dapm_dai_free_widgets(&list); diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c index 63d637db7053..907f9b1e9d1b 100644 --- a/sound/soc/sof/topology.c +++ b/sound/soc/sof/topology.c @@ -775,7 +775,7 @@ static int sof_parse_token_sets(struct snd_soc_component *scomp, array); break; default: - dev_err(scomp->dev, "error: unknown token type %d\n", + dev_err(scomp->dev, "error: unknown token type %u\n", le32_to_cpu(array->type)); return -EINVAL; } @@ -880,7 +880,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp, ARRAY_SIZE(led_tokens), mc->priv.array, le32_to_cpu(mc->priv.size)); if (ret != 0) { - dev_err(scomp->dev, "error: parse led tokens failed %d\n", + dev_err(scomp->dev, "error: parse led tokens failed %u\n", le32_to_cpu(mc->priv.size)); goto err; } @@ -970,7 +970,7 @@ static int sof_control_load(struct snd_soc_component *scomp, int index, struct snd_sof_control *scontrol; int ret; - dev_dbg(scomp->dev, "tplg: load control type %d name : %s\n", + dev_dbg(scomp->dev, "tplg: load control type %u name : %s\n", le32_to_cpu(hdr->type), hdr->name); scontrol = kzalloc_obj(*scontrol); @@ -1015,7 +1015,7 @@ static int sof_control_load(struct snd_soc_component *scomp, int index, case SND_SOC_TPLG_DAPM_CTL_ENUM_VALUE: case SND_SOC_TPLG_DAPM_CTL_PIN: default: - dev_warn(scomp->dev, "control type not supported %d:%d:%d\n", + dev_warn(scomp->dev, "control type not supported %u:%u:%u\n", le32_to_cpu(hdr->ops.get), le32_to_cpu(hdr->ops.put), le32_to_cpu(hdr->ops.info)); @@ -1525,7 +1525,7 @@ static int sof_widget_ready(struct snd_soc_component *scomp, int index, break; case snd_soc_dapm_pga: if (!le32_to_cpu(tw->num_kcontrols)) { - dev_err(scomp->dev, "invalid kcontrol count %d for volume\n", + dev_err(scomp->dev, "invalid kcontrol count %u for volume\n", le32_to_cpu(tw->num_kcontrols)); ret = -EINVAL; break; @@ -1774,7 +1774,7 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, ARRAY_SIZE(stream_tokens), private->array, le32_to_cpu(private->size)); if (ret) { - dev_err(scomp->dev, "error: parse stream tokens failed %d\n", + dev_err(scomp->dev, "error: parse stream tokens failed %u\n", le32_to_cpu(private->size)); return ret; } -- 2.37.2.352.g3c44437643

2 1