- Sound-open-firmware - mailman.alsa-project.org

Re: [PATCH v2 4/4] ASoC: codecs: Implement 64-bit pointer operation
by Richard Fitzgerald 11 Jul '25

11 Jul '25

On 11/7/25 10:36, Joris Verhaegen wrote: > Implement the new .pointer64 compress operation for the various ASoC > drivers that support compress offload. > > For drivers with complex but similar 32-bit and 64-bit logic > (wm_adsp, sof, uniphier), a shared internal function is used to handle > both requests, minimizing code duplication and improving maintainability. > > For other drivers, internal counters and related variables are updated > to u64 to ensure the source of the timestamp data is overflow-safe. > The legacy .pointer operation is retained in all drivers to ensure > full backward compatibility. > > Signed-off-by: Joris Verhaegen <verhaegen(a)google.com> > Tested-by: Joris Verhaegen <verhaegen(a)google.com> > Reviewed-by: David Li <dvdli(a)google.com> > Reviewed-by: Miller Liang <millerliang(a)google.com> > --- > sound/soc/codecs/cs47l15.c | 1 + > sound/soc/codecs/cs47l24.c | 1 + > sound/soc/codecs/cs47l35.c | 1 + > sound/soc/codecs/cs47l85.c | 1 + > sound/soc/codecs/cs47l90.c | 1 + > sound/soc/codecs/cs47l92.c | 1 + > sound/soc/codecs/wm5102.c | 1 + > sound/soc/codecs/wm5110.c | 1 + > sound/soc/codecs/wm_adsp.c | 53 +++++++++++++++---- > sound/soc/codecs/wm_adsp.h | 3 ++ For these 10 files: Reviewed-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>

1 0

[PATCH] ASoC: Use of_reserved_mem_region_to_resource() for "memory-region"
by Rob Herring (Arm) 07 Jul '25

07 Jul '25

Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> --- sound/soc/codecs/cros_ec_codec.c | 30 ++++++++++----------- sound/soc/sof/imx/imx-common.c | 36 +++++--------------------- sound/soc/sof/mediatek/mt8186/mt8186.c | 11 +------- sound/soc/sof/mediatek/mt8195/mt8195.c | 11 +------- 4 files changed, 22 insertions(+), 66 deletions(-) diff --git a/sound/soc/codecs/cros_ec_codec.c b/sound/soc/codecs/cros_ec_codec.c index 571222ec520c..937c8cec682a 100644 --- a/sound/soc/codecs/cros_ec_codec.c +++ b/sound/soc/codecs/cros_ec_codec.c @@ -18,6 +18,7 @@ #include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/platform_data/cros_ec_commands.h> #include <linux/platform_data/cros_ec_proto.h> #include <linux/platform_device.h> @@ -961,7 +962,6 @@ static int cros_ec_codec_platform_probe(struct platform_device *pdev) struct ec_response_ec_codec_get_capabilities r; int ret; #ifdef CONFIG_OF - struct device_node *node; struct resource res; u64 ec_shm_size; const __be32 *regaddr_p; @@ -981,22 +981,18 @@ static int cros_ec_codec_platform_probe(struct platform_device *pdev) priv->ec_shm_addr, priv->ec_shm_len); } - node = of_parse_phandle(dev->of_node, "memory-region", 0); - if (node) { - ret = of_address_to_resource(node, 0, &res); - if (!ret) { - priv->ap_shm_phys_addr = res.start; - priv->ap_shm_len = resource_size(&res); - priv->ap_shm_addr = - (uint64_t)(uintptr_t)devm_ioremap_wc( - dev, priv->ap_shm_phys_addr, - priv->ap_shm_len); - priv->ap_shm_last_alloc = priv->ap_shm_phys_addr; - - dev_dbg(dev, "ap_shm_phys_addr=%#llx len=%#x\n", - priv->ap_shm_phys_addr, priv->ap_shm_len); - } - of_node_put(node); + ret = of_reserved_mem_region_to_resource(dev->of_node, 0, &res); + if (!ret) { + priv->ap_shm_phys_addr = res.start; + priv->ap_shm_len = resource_size(&res); + priv->ap_shm_addr = + (uint64_t)(uintptr_t)devm_ioremap_wc( + dev, priv->ap_shm_phys_addr, + priv->ap_shm_len); + priv->ap_shm_last_alloc = priv->ap_shm_phys_addr; + + dev_dbg(dev, "ap_shm_phys_addr=%#llx len=%#x\n", + priv->ap_shm_phys_addr, priv->ap_shm_len); } #endif diff --git a/sound/soc/sof/imx/imx-common.c b/sound/soc/sof/imx/imx-common.c index 62bf707aa909..f00b381cec3b 100644 --- a/sound/soc/sof/imx/imx-common.c +++ b/sound/soc/sof/imx/imx-common.c @@ -282,11 +282,8 @@ static int imx_region_name_to_blk_type(const char *region_name) static int imx_parse_ioremap_memory(struct snd_sof_dev *sdev) { const struct imx_chip_info *chip_info; - struct reserved_mem *reserved; struct platform_device *pdev; - struct device_node *res_np; - phys_addr_t base, size; - struct resource *res; + struct resource *res, _res; int i, blk_type, ret; pdev = to_platform_device(sdev->dev); @@ -307,37 +304,18 @@ static int imx_parse_ioremap_memory(struct snd_sof_dev *sdev) "failed to fetch %s resource\n", chip_info->memory[i].name); - base = res->start; - size = resource_size(res); } else { - ret = of_property_match_string(pdev->dev.of_node, - "memory-region-names", - chip_info->memory[i].name); + ret = of_reserved_mem_region_to_resource_byname(pdev->dev.of_node, + chip_info->memory[i].name, + &_res); if (ret < 0) return dev_err_probe(sdev->dev, ret, - "no valid index for %s\n", + "no valid entry for %s\n", chip_info->memory[i].name); - - res_np = of_parse_phandle(pdev->dev.of_node, - "memory-region", - ret); - if (!res_np) - return dev_err_probe(sdev->dev, -ENODEV, - "failed to parse phandle %s\n", - chip_info->memory[i].name); - - reserved = of_reserved_mem_lookup(res_np); - of_node_put(res_np); - if (!reserved) - return dev_err_probe(sdev->dev, -ENODEV, - "failed to get %s reserved\n", - chip_info->memory[i].name); - - base = reserved->base; - size = reserved->size; + res = &_res; } - sdev->bar[blk_type] = devm_ioremap(sdev->dev, base, size); + sdev->bar[blk_type] = devm_ioremap_resource(sdev->dev, res); if (!sdev->bar[blk_type]) return dev_err_probe(sdev->dev, -ENOMEM, diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.c b/sound/soc/sof/mediatek/mt8186/mt8186.c index 7ff080452cbe..c1bea967737d 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186.c @@ -12,7 +12,6 @@ #include <linux/delay.h> #include <linux/firmware.h> #include <linux/io.h> -#include <linux/of_address.h> #include <linux/of_irq.h> #include <linux/of_platform.h> #include <linux/of_reserved_mem.h> @@ -46,7 +45,6 @@ static int platform_parse_resource(struct platform_device *pdev, void *data) { struct resource *mmio; struct resource res; - struct device_node *mem_region; struct device *dev = &pdev->dev; struct mtk_adsp_chip_info *adsp = data; int ret; @@ -57,14 +55,7 @@ static int platform_parse_resource(struct platform_device *pdev, void *data) return ret; } - mem_region = of_parse_phandle(dev->of_node, "memory-region", 1); - if (!mem_region) { - dev_err(dev, "no memory-region sysmem phandle\n"); - return -ENODEV; - } - - ret = of_address_to_resource(mem_region, 0, &res); - of_node_put(mem_region); + ret = of_reserved_mem_region_to_resource(dev->of_node, 1, &res); if (ret) { dev_err(dev, "of_address_to_resource sysmem failed\n"); return ret; diff --git a/sound/soc/sof/mediatek/mt8195/mt8195.c b/sound/soc/sof/mediatek/mt8195/mt8195.c index 3b3582d74510..4d6e9300a9c0 100644 --- a/sound/soc/sof/mediatek/mt8195/mt8195.c +++ b/sound/soc/sof/mediatek/mt8195/mt8195.c @@ -12,7 +12,6 @@ #include <linux/delay.h> #include <linux/firmware.h> #include <linux/io.h> -#include <linux/of_address.h> #include <linux/of_irq.h> #include <linux/of_platform.h> #include <linux/of_reserved_mem.h> @@ -46,7 +45,6 @@ static int platform_parse_resource(struct platform_device *pdev, void *data) { struct resource *mmio; struct resource res; - struct device_node *mem_region; struct device *dev = &pdev->dev; struct mtk_adsp_chip_info *adsp = data; int ret; @@ -57,14 +55,7 @@ static int platform_parse_resource(struct platform_device *pdev, void *data) return ret; } - mem_region = of_parse_phandle(dev->of_node, "memory-region", 1); - if (!mem_region) { - dev_err(dev, "no memory-region sysmem phandle\n"); - return -ENODEV; - } - - ret = of_address_to_resource(mem_region, 0, &res); - of_node_put(mem_region); + ret = of_reserved_mem_region_to_resource(dev->of_node, 1, &res); if (ret) { dev_err(dev, "of_address_to_resource sysmem failed\n"); return ret; -- 2.47.2

3 2

Re: [PATCH 74/80] ASoC: SOF: Remove redundant pm_runtime_mark_last_busy() calls
by Péter Ujfalusi 04 Jul '25

04 Jul '25

On 04/07/2025 10:54, Sakari Ailus wrote: > pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), > pm_runtime_autosuspend() and pm_request_autosuspend() now include a call > to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to > pm_runtime_mark_last_busy(). Acked-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> > Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> > --- > The cover letter of the set can be found here > <URL:https://lore.kernel.org/linux-pm/20250704075225.3212486-1-sakari.ailus@…>. > > In brief, this patch depends on PM runtime patches adding marking the last > busy timestamp in autosuspend related functions. The patches are here, on > rc2: > > git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git \ > pm-runtime-6.17-rc1 > > sound/soc/sof/control.c | 1 - > sound/soc/sof/debug.c | 1 - > sound/soc/sof/ipc3-dtrace.c | 1 - > sound/soc/sof/ipc4-loader.c | 1 - > sound/soc/sof/pcm.c | 1 - > sound/soc/sof/sof-client-ipc-flood-test.c | 1 - > sound/soc/sof/sof-client-ipc-kernel-injector.c | 1 - > sound/soc/sof/sof-client-ipc-msg-injector.c | 1 - > sound/soc/sof/sof-client-probes.c | 3 --- > 9 files changed, 11 deletions(-) > > diff --git a/sound/soc/sof/control.c b/sound/soc/sof/control.c > index 463d418e7200..a3fd1d523c09 100644 > --- a/sound/soc/sof/control.c > +++ b/sound/soc/sof/control.c > @@ -196,7 +196,6 @@ int snd_sof_bytes_ext_volatile_get(struct snd_kcontrol *kcontrol, unsigned int _ > if (tplg_ops && tplg_ops->control && tplg_ops->control->bytes_ext_volatile_get) > ret = tplg_ops->control->bytes_ext_volatile_get(scontrol, binary_data, size); > > - pm_runtime_mark_last_busy(scomp->dev); > err = pm_runtime_put_autosuspend(scomp->dev); > if (err < 0) > dev_err_ratelimited(scomp->dev, "%s: failed to idle %d\n", __func__, err); > diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c > index d0ffa1d71145..b24943a65c89 100644 > --- a/sound/soc/sof/debug.c > +++ b/sound/soc/sof/debug.c > @@ -217,7 +217,6 @@ static int memory_info_update(struct snd_sof_dev *sdev, char *buf, size_t buff_s > } > > ret = sof_ipc_tx_message(sdev->ipc, &msg, msg.size, reply, SOF_IPC_MSG_MAX_SIZE); > - pm_runtime_mark_last_busy(sdev->dev); > pm_runtime_put_autosuspend(sdev->dev); > if (ret < 0 || reply->rhdr.error < 0) { > ret = min(ret, reply->rhdr.error); > diff --git a/sound/soc/sof/ipc3-dtrace.c b/sound/soc/sof/ipc3-dtrace.c > index 744a91a150bc..e5c8fec173c4 100644 > --- a/sound/soc/sof/ipc3-dtrace.c > +++ b/sound/soc/sof/ipc3-dtrace.c > @@ -172,7 +172,6 @@ static int ipc3_trace_update_filter(struct snd_sof_dev *sdev, int num_elems, > goto error; > } > ret = sof_ipc_tx_message_no_reply(sdev->ipc, msg, msg->hdr.size); > - pm_runtime_mark_last_busy(sdev->dev); > pm_runtime_put_autosuspend(sdev->dev); > > error: > diff --git a/sound/soc/sof/ipc4-loader.c b/sound/soc/sof/ipc4-loader.c > index ee61394e73d7..b0d293f62d1c 100644 > --- a/sound/soc/sof/ipc4-loader.c > +++ b/sound/soc/sof/ipc4-loader.c > @@ -236,7 +236,6 @@ static int sof_ipc4_load_library(struct snd_sof_dev *sdev, unsigned long lib_id, > > ret = ipc4_data->load_library(sdev, fw_lib, false); > > - pm_runtime_mark_last_busy(sdev->dev); > err = pm_runtime_put_autosuspend(sdev->dev); > if (err < 0) > dev_err_ratelimited(sdev->dev, "%s: pm_runtime idle failed: %d\n", > diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c > index 090ea3a76892..fe43de1fe96c 100644 > --- a/sound/soc/sof/pcm.c > +++ b/sound/soc/sof/pcm.c > @@ -712,7 +712,6 @@ static int sof_pcm_probe(struct snd_soc_component *component) > ret); > > pm_error: > - pm_runtime_mark_last_busy(component->dev); > pm_runtime_put_autosuspend(component->dev); > > return ret; > diff --git a/sound/soc/sof/sof-client-ipc-flood-test.c b/sound/soc/sof/sof-client-ipc-flood-test.c > index 11b6f7da2882..373f3a125372 100644 > --- a/sound/soc/sof/sof-client-ipc-flood-test.c > +++ b/sound/soc/sof/sof-client-ipc-flood-test.c > @@ -223,7 +223,6 @@ static ssize_t sof_ipc_flood_dfs_write(struct file *file, const char __user *buf > ret = sof_debug_ipc_flood_test(cdev, flood_duration_test, > ipc_duration_ms, ipc_count); > > - pm_runtime_mark_last_busy(dev); > err = pm_runtime_put_autosuspend(dev); > if (err < 0) > dev_err_ratelimited(dev, "debugfs write failed to idle %d\n", err); > diff --git a/sound/soc/sof/sof-client-ipc-kernel-injector.c b/sound/soc/sof/sof-client-ipc-kernel-injector.c > index 8b28c3dc920c..249bd2d6c8d2 100644 > --- a/sound/soc/sof/sof-client-ipc-kernel-injector.c > +++ b/sound/soc/sof/sof-client-ipc-kernel-injector.c > @@ -65,7 +65,6 @@ static ssize_t sof_kernel_msg_inject_dfs_write(struct file *file, const char __u > > sof_client_ipc_rx_message(cdev, hdr, priv->kernel_buffer); > > - pm_runtime_mark_last_busy(dev); > ret = pm_runtime_put_autosuspend(dev); > if (ret < 0) > dev_err_ratelimited(dev, "debugfs write failed to idle %d\n", ret); > diff --git a/sound/soc/sof/sof-client-ipc-msg-injector.c b/sound/soc/sof/sof-client-ipc-msg-injector.c > index ba7ca1c5027f..9c8a0fbfb8df 100644 > --- a/sound/soc/sof/sof-client-ipc-msg-injector.c > +++ b/sound/soc/sof/sof-client-ipc-msg-injector.c > @@ -137,7 +137,6 @@ static int sof_msg_inject_send_message(struct sof_client_dev *cdev) > if (ret) > dev_err(dev, "IPC message send failed: %d\n", ret); > > - pm_runtime_mark_last_busy(dev); > err = pm_runtime_put_autosuspend(dev); > if (err < 0) > dev_err_ratelimited(dev, "debugfs write failed to idle %d\n", err); > diff --git a/sound/soc/sof/sof-client-probes.c b/sound/soc/sof/sof-client-probes.c > index aff9ce980429..663c0d3c314c 100644 > --- a/sound/soc/sof/sof-client-probes.c > +++ b/sound/soc/sof/sof-client-probes.c > @@ -238,7 +238,6 @@ static ssize_t sof_probes_dfs_points_read(struct file *file, char __user *to, > kfree(desc); > > pm_error: > - pm_runtime_mark_last_busy(dev); > err = pm_runtime_put_autosuspend(dev); > if (err < 0) > dev_err_ratelimited(dev, "debugfs read failed to idle %d\n", err); > @@ -289,7 +288,6 @@ sof_probes_dfs_points_write(struct file *file, const char __user *from, > if (!ret) > ret = count; > > - pm_runtime_mark_last_busy(dev); > err = pm_runtime_put_autosuspend(dev); > if (err < 0) > dev_err_ratelimited(dev, "debugfs write failed to idle %d\n", err); > @@ -337,7 +335,6 @@ sof_probes_dfs_points_remove_write(struct file *file, const char __user *from, > if (!ret) > ret = count; > > - pm_runtime_mark_last_busy(dev); > err = pm_runtime_put_autosuspend(dev); > if (err < 0) > dev_err_ratelimited(dev, "debugfs write failed to idle %d\n", err); -- Péter

1 0

Re: [PATCH v2 1/2] dt-bindings: dsp: mediatek: add mt8196 dsp document
by Rob Herring (Arm) 03 Jul '25

03 Jul '25

On Thu, 03 Jul 2025 15:56:23 +0800, hailong.fan wrote: > From: Hailong Fan <hailong.fan(a)mediatek.com> > > This patch adds mt8196 dsp document. The dsp is used for Sound Open > Firmware driver node. It includes registers, clocks, memory regions, > and mailbox for dsp. > > Signed-off-by: Hailong Fan <hailong.fan(a)mediatek.com> > --- > .../bindings/sound/mediatek,mt8196-dsp.yaml | 95 +++++++++++++++++++ > 1 file changed, 95 insertions(+) > create mode 100644 Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.yaml > My bot found errors running 'make dt_binding_check' on your patch: yamllint warnings/errors: dtschema/dtc warnings/errors: Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.example.dts:18:18: fatal error: dt-bindings/clock/mt8196-clk.h: No such file or directory 18 | #include <dt-bindings/clock/mt8196-clk.h> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ compilation terminated. make[2]: *** [scripts/Makefile.dtbs:131: Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.example.dtb] Error 1 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/builds/robherring/dt-review-ci/linux/Makefile:1525: dt_binding_check] Error 2 make: *** [Makefile:248: __sub-make] Error 2 doc reference errors (make refcheckdocs): See https://patchwork.ozlabs.org/project/devicetree-bindings/patch/202507030756… The base for the series is generally the latest rc1. A different dependency should be noted in *this* patch. If you already ran 'make dt_binding_check' and didn't see the above error(s), then make sure 'yamllint' is installed and dt-schema is up to date: pip3 install dtschema --upgrade Please check and re-submit after running the above command yourself. Note that DT_SCHEMA_FILES can be set to your schema file to speed up checking your schema. However, it must be unset to test all examples with your schema.

1 0

Re: [PATCH v2 1/2] dt-bindings: dsp: mediatek: add mt8196 dsp document
by AngeloGioacchino Del Regno 03 Jul '25

03 Jul '25

Il 03/07/25 10:08, Krzysztof Kozlowski ha scritto: > On 03/07/2025 09:56, hailong.fan wrote: >> From: Hailong Fan <hailong.fan(a)mediatek.com> >> >> This patch adds mt8196 dsp document. The dsp is used for Sound Open > > Please do not use "This commit/patch/change", but imperative mood. See > longer explanation here: > https://elixir.bootlin.com/linux/v5.17.1/source/Documentation/process/submi… > >> Firmware driver node. It includes registers, clocks, memory regions, >> and mailbox for dsp. >> >> Signed-off-by: Hailong Fan <hailong.fan(a)mediatek.com> >> --- >> .../bindings/sound/mediatek,mt8196-dsp.yaml | 95 +++++++++++++++++++ >> 1 file changed, 95 insertions(+) >> create mode 100644 Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.yaml >> >> diff --git a/Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.yaml b/Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.yaml >> new file mode 100644 >> index 000000000000..68f594f476e8 >> --- /dev/null >> +++ b/Documentation/devicetree/bindings/sound/mediatek,mt8196-dsp.yaml Wrong folder; this should go to dsp/mediatek,mt8196-dsp.yaml .... ...but then I don't get why MT8196 wasn't simply added to mediatek,mt8186-dsp.yaml. >> @@ -0,0 +1,95 @@ >> +# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) >> +%YAML 1.2 >> +--- >> +$id: http://devicetree.org/schemas/sound/mediatek,mt8196-dsp.yaml# >> +$schema: http://devicetree.org/meta-schemas/core.yaml# >> + >> +title: MediaTek mt8196 DSP core >> + >> +maintainers: >> + - Hailong Fan <hailong.fan(a)mediatek.com> >> + >> +description: The MediaTek mt8196 SoC mt8196 contain a DSP core used for advanced > > Missing blank line. Look at other bindings. Also does not look wrapped > at 80 (see Linux coding style doc). > There's also a typo, "mt8196 SoC mt8196" > >> + pre- and post- audio processing. >> + >> +properties: >> + compatible: >> + const: mediatek,mt8196-dsp >> + >> + reg: >> + items: >> + - description: DSP configuration registers >> + - description: DSP SRAM >> + - description: DSP secure registers >> + - description: DSP bus registers >> + >> + reg-names: >> + items: >> + - const: cfg >> + - const: sram >> + - const: sec >> + - const: bus >> + >> + clocks: >> + items: >> + - description: mux for dsp clock >> + - description: 26M clock >> + - description: ADSP PLL clock >> + >> + clock-names: >> + items: >> + - const: adsp_sel > > Isn't this called audiodsp in other bindings? > >> + - const: clk26m > > Don't use frequencies. How is the pin or input called in datasheet? How > other devices call it? In the datasheet, this is called.... CLK26M (really). Cheers, Angelo > >> + - const: adsppll >> + >> + power-domains: >> + maxItems: 1 >> + > Best regards, > Krzysztof

1 0

[PATCH 0/2] Add SoundWire machines for ACP7.0/ACP7.1 sof stack
by Vijendar Mukunda 25 Jun '25

25 Jun '25

Add SoundWire machines as alternate machines for ACP7.0 & ACP7.1 platforms with the below machine configuration. Link 0: RT722 codec with three endpoints: Headset, Speaker, and DMIC. Vijendar Mukunda (2): ASoC: amd: acp: add soundwire machine for ACP7.0 and ACP7.1 sof stack ASoC: SOF: amd: add alternate machines for ACP7.0 and ACP7.1 platforms sound/soc/amd/acp/Kconfig | 1 + sound/soc/amd/acp/amd-acp70-acpi-match.c | 12 ++++++++++++ sound/soc/amd/mach-config.h | 1 + sound/soc/sof/amd/pci-acp70.c | 1 + 4 files changed, 15 insertions(+) -- 2.45.2

2 3

Re: [PATCH] ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
by Mark Brown 24 Jun '25

24 Jun '25

On Mon, 16 Jun 2025 08:55:48 +0900, Tamura Dai wrote: > sof_pdata->tplg_filename can have address allocated by kstrdup() > and can be overwritten. Memory leak was detected with kmemleak: > > unreferenced object 0xffff88812391ff60 (size 16): > comm "kworker/4:1", pid 161, jiffies 4294802931 > hex dump (first 16 bytes): > 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. > backtrace (crc 4bf1675c): > __kmalloc_node_track_caller_noprof+0x49c/0x6b0 > kstrdup+0x46/0xc0 > hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] > sof_init_environment+0x16f/0xb50 [snd_sof] > sof_probe_continue+0x45/0x7c0 [snd_sof] > sof_probe_work+0x1e/0x40 [snd_sof] > process_one_work+0x894/0x14b0 > worker_thread+0x5e5/0xfb0 > kthread+0x39d/0x760 > ret_from_fork+0x31/0x70 > ret_from_fork_asm+0x1a/0x30 > > [...] Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [1/1] ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. commit: 6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

Re: [PATCH RESEND v2] ASoC: SOF: Intel: hda: Fix UAF when reloading module
by Péter Ujfalusi 04 Jun '25

04 Jun '25

On 06/05/2025 18:12, Tavian Barnes wrote: > hda_generic_machine_select() appends -idisp to the tplg filename by > allocating a new string with devm_kasprintf(), then stores the string > right back into the global variable snd_soc_acpi_intel_hda_machines. > When the module is unloaded, this memory is freed, resulting in a global > variable pointing to freed memory. Reloading the modules then triggers > a use-after-free: > > BUG: KFENCE: use-after-free read in string+0x48/0xe0 > > Use-after-free read at 0x00000000967e0109 (in kfence-#99): > string+0x48/0xe0 > vsnprintf+0x329/0x6e0 > devm_kvasprintf+0x54/0xb0 > devm_kasprintf+0x58/0x80 > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] > sof_probe_work+0x7f/0x600 [snd_sof] > process_one_work+0x17b/0x330 > worker_thread+0x2ce/0x3f0 > kthread+0xcf/0x100 > ret_from_fork+0x31/0x50 > ret_from_fork_asm+0x1a/0x30 > > kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64 > > allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago): > devm_kmalloc+0x52/0x120 > devm_kvasprintf+0x66/0xb0 > devm_kasprintf+0x58/0x80 > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] > sof_probe_work+0x7f/0x600 [snd_sof] > process_one_work+0x17b/0x330 > worker_thread+0x2ce/0x3f0 > kthread+0xcf/0x100 > ret_from_fork+0x31/0x50 > ret_from_fork_asm+0x1a/0x30 > > freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago): > release_nodes+0x43/0xb0 > devres_release_all+0x90/0xf0 > device_unbind_cleanup+0xe/0x70 > device_release_driver_internal+0x1c1/0x200 > driver_detach+0x48/0x90 > bus_remove_driver+0x6d/0xf0 > pci_unregister_driver+0x42/0xb0 > __do_sys_delete_module+0x1d1/0x310 > do_syscall_64+0x82/0x190 > entry_SYSCALL_64_after_hwframe+0x76/0x7e > > Fix it by saving the filename in pdata->tplg_filename instead, just like > every other code path that appends to the tplg filename. > > Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach") > Signed-off-by: Tavian Barnes <tavianator(a)tavianator.com> > --- > v2: Fix typo > > sound/soc/sof/intel/hda.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c > index b34e5fdf10f1..1767977e7cff 100644 > --- a/sound/soc/sof/intel/hda.c > +++ b/sound/soc/sof/intel/hda.c > @@ -1069,7 +1069,7 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev, > if (!tplg_filename) > return; > > - hda_mach->sof_tplg_filename = tplg_filename; > + pdata->tplg_filename = tplg_filename; Did you sent this as a mistake? The v5 patch looks to be the correct one, this is not. > } > > if (codec_num == 2 || -- Péter

2 2

[PATCH v5] ASoC: SOF: Intel: hda: Fix UAF when reloading module
by Tavian Barnes 15 May '25

15 May '25

hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with devm_kasprintf(), then stores the string right back into the global variable snd_soc_acpi_intel_hda_machines. When the module is unloaded, this memory is freed, resulting in a global variable pointing to freed memory. Reloading the module then triggers a use-after-free: BUG: KFENCE: use-after-free read in string+0x48/0xe0 Use-after-free read at 0x00000000967e0109 (in kfence-#99): string+0x48/0xe0 vsnprintf+0x329/0x6e0 devm_kvasprintf+0x54/0xb0 devm_kasprintf+0x58/0x80 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] sof_probe_work+0x7f/0x600 [snd_sof] process_one_work+0x17b/0x330 worker_thread+0x2ce/0x3f0 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64 allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago): devm_kmalloc+0x52/0x120 devm_kvasprintf+0x66/0xb0 devm_kasprintf+0x58/0x80 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] sof_probe_work+0x7f/0x600 [snd_sof] process_one_work+0x17b/0x330 worker_thread+0x2ce/0x3f0 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago): release_nodes+0x43/0xb0 devres_release_all+0x90/0xf0 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c1/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x6d/0xf0 pci_unregister_driver+0x42/0xb0 __do_sys_delete_module+0x1d1/0x310 do_syscall_64+0x82/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix it by copying the match array with devm_kmemdup_array() before we modify it. Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach") Suggested-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Signed-off-by: Tavian Barnes <tavianator(a)tavianator.com> --- v5: Formatting fix. v4: Copy the whole array, including the sentinel. v3: Copy the whole machine struct instead so we can safely modify it (instead of storing the name in pdata->tplg_filename, breaking other fixups). The problem with v2 was pointed out by Bard Liao, with the alternative fix suggested by Péter Ujfalusi. v2: Typo fix. sound/soc/sof/intel/hda.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c index b34e5fdf10f1..6a3932d90b43 100644 --- a/sound/soc/sof/intel/hda.c +++ b/sound/soc/sof/intel/hda.c @@ -1049,7 +1049,21 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev, if (!*mach && codec_num <= 2) { bool tplg_fixup = false; - hda_mach = snd_soc_acpi_intel_hda_machines; + /* + * make a local copy of the match array since we might + * be modifying it + */ + hda_mach = devm_kmemdup_array(sdev->dev, + snd_soc_acpi_intel_hda_machines, + 2, /* we have one entry + sentinel in the array */ + sizeof(snd_soc_acpi_intel_hda_machines[0]), + GFP_KERNEL); + if (!hda_mach) { + dev_err(bus->dev, + "%s: failed to duplicate the HDA match table\n", + __func__); + return; + } dev_info(bus->dev, "using HDA machine driver %s now\n", hda_mach->drv_name); -- 2.49.0

2 1

Re: [PATCH v4] ASoC: SOF: Intel: hda: Fix UAF when reloading module
by Péter Ujfalusi 08 May '25

08 May '25

On 08/05/2025 18:21, Tavian Barnes wrote: > hda_generic_machine_select() appends -idisp to the tplg filename by > allocating a new string with devm_kasprintf(), then stores the string > right back into the global variable snd_soc_acpi_intel_hda_machines. > When the module is unloaded, this memory is freed, resulting in a global > variable pointing to freed memory. Reloading the module then triggers > a use-after-free: > > BUG: KFENCE: use-after-free read in string+0x48/0xe0 > > Use-after-free read at 0x00000000967e0109 (in kfence-#99): > string+0x48/0xe0 > vsnprintf+0x329/0x6e0 > devm_kvasprintf+0x54/0xb0 > devm_kasprintf+0x58/0x80 > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] > sof_probe_work+0x7f/0x600 [snd_sof] > process_one_work+0x17b/0x330 > worker_thread+0x2ce/0x3f0 > kthread+0xcf/0x100 > ret_from_fork+0x31/0x50 > ret_from_fork_asm+0x1a/0x30 > > kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64 > > allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago): > devm_kmalloc+0x52/0x120 > devm_kvasprintf+0x66/0xb0 > devm_kasprintf+0x58/0x80 > hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] > sof_probe_work+0x7f/0x600 [snd_sof] > process_one_work+0x17b/0x330 > worker_thread+0x2ce/0x3f0 > kthread+0xcf/0x100 > ret_from_fork+0x31/0x50 > ret_from_fork_asm+0x1a/0x30 > > freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago): > release_nodes+0x43/0xb0 > devres_release_all+0x90/0xf0 > device_unbind_cleanup+0xe/0x70 > device_release_driver_internal+0x1c1/0x200 > driver_detach+0x48/0x90 > bus_remove_driver+0x6d/0xf0 > pci_unregister_driver+0x42/0xb0 > __do_sys_delete_module+0x1d1/0x310 > do_syscall_64+0x82/0x190 > entry_SYSCALL_64_after_hwframe+0x76/0x7e > > Fix it by copying the match array with devm_kmemdup_array() before we > modify it. > > Fixes: 5458411d7594 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach") > Suggested-by: Péter Ujfalusi" <peter.ujfalusi(a)linux.intel.com> > Signed-off-by: Tavian Barnes <tavianator(a)tavianator.com> > --- > v4: Copy the whole array, including the sentinel. > > v3: Copy the whole machine struct instead so we can safely modify it > (instead of storing the name in pdata->tplg_filename, breaking other > fixups). The problem with v2 was pointed out by Bard Liao, with the > alternative fix suggested by Péter Ujfalusi. > > v2: Typo fix. > > sound/soc/sof/intel/hda.c | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c > index b34e5fdf10f1..13ecb9473eb6 100644 > --- a/sound/soc/sof/intel/hda.c > +++ b/sound/soc/sof/intel/hda.c > @@ -1049,7 +1049,21 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev, > if (!*mach && codec_num <= 2) { > bool tplg_fixup = false; > > - hda_mach = snd_soc_acpi_intel_hda_machines; > + /* > + * make a local copy of the match array since we might > + * be modifying it > + */ > + hda_mach = devm_kmemdup_array(sdev->dev, > + snd_soc_acpi_intel_hda_machines, > + 2 /* we have one entry + sentinel in the array */, I would prefer the comment after the comma. and I just noticed that my suggestion had it wrong as well, sorry. With that you can add my: Acked-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> > + sizeof(snd_soc_acpi_intel_hda_machines[0]), > + GFP_KERNEL); > + if (!hda_mach) { > + dev_err(bus->dev, > + "%s: failed to duplicate the HDA match table\n", > + __func__); > + return; > + } > > dev_info(bus->dev, "using HDA machine driver %s now\n", > hda_mach->drv_name); -- Péter

1 0