summaryrefslogtreecommitdiff
path: root/sound/soc/sof
AgeCommit message (Collapse)Author
4 daysASoC: SOF: amd: add missing blank line between Kconfig entriesVijendar Mukunda
Add a missing blank line between SND_SOC_SOF_AMD_ACP70 and SND_SOC_SOF_AMD_ACP7X config entries to conform to Kconfig formatting convention. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Link: https://patch.msgid.link/20260707060918.2535962-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
5 daysASoC: cs35l3x: drain threaded IRQs before runtime suspendMark Brown
Runyu Xiao <runyu.xiao@seu.edu.cn> says: Both cs35l33 and cs35l34 can enter runtime suspend while their threaded IRQ handlers are still reachable. The suspend path then switches the driver into regcache cache-only mode and powers the codec down, while the IRQ thread still expects live status-register access. This issue was found by our static analysis tool and manually audited on Linux v6.18.21. Directed QEMU no-device validation further showed that, after runtime_suspend() completed, the real threaded handlers could still be injected and would continue past volatile regmap read failures into their release/update paths. This series keeps the fix on the suspend actor and applies the same runtime-suspend/threaded-IRQ ordering repair boundary to both drivers: - track whether request_threaded_irq() actually succeeded - disable_irq() before cache_only/power-off in runtime suspend - enable_irq() only after regcache_sync() in runtime resume That drains any in-flight threaded handler and blocks new IRQ handling while the codec is suspended, without mixing in larger IRQ-thread defensive cleanups. Build-tested by compiling cs35l33.o and cs35l34.o. No cs35l33/cs35l34 hardware was available for end-to-end runtime testing. Link: https://patch.msgid.link/20260611161553.3378721-1-runyu.xiao@seu.edu.cn
6 daysMerge tag 'sound-7.2-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A standard set of driver-specific fixes and quirks accumulated since the merge window: ASoC: - SOF: Sanity check to prevent OOB reads - rsnd: Fix clock leak and double-disable issues with PM - tas675x: Misc fixes for register fields, etc - lpass-va-macro: Correct codec version for Qualcomm SC7280 - amd-yc: DMIC quirk for Alienware m15 R7 AMD Others: - us144mkii: Fix a UAF on disconnect and anchor list corruption - HD-audio: Realtek quirks for HP models" * tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume Documentation: sound: tas675x: Fix temperature range and impedance documentation ASoC: codecs: tas675x: Fix CHx temperature range register bit fields ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent ASoC: SOF: validate probe info element counts ALSA: usx2y: us144mkii: fix work UAF on disconnect ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
8 daysASoC: SOF: amd: add support for ACP7.B/7.F platformsMark Brown
Vijendar Mukunda <Vijendar.Mukunda@amd.com> says: This patch series adds Sound Open Firmware (SOF) enablement for AMD ACP7.B/ACP7.F platforms by introducing a dedicated ACP7x PCI driver/ops layer built on the existing ACP SOF infrastructure, plus required IPC3 topology/token extensions for ACP7x I2S/TDM. Changes: - Add new ACP7x PCI driver + DSP ops, including suspend/resume and IRQ handling paths. - Extend AMD ACP firmware loading logic for signed images and SRAM-based data loading on ACP7x. - Introduce a new SOF DAI type for AMD I2S/TDM and extend IPC3 topology tokens to carry an ACP TDM/I2S format field. Link: https://github.com/thesofproject/linux/pull/5813 Link: https://patch.msgid.link/20260701095759.1012929-1-Vijendar.Mukunda@amd.com
8 daysASoC: SOF: amd: add system and runtime PM ops for ACP7xVijendar Mukunda
Add amd_sof_acp7x_suspend() and amd_sof_acp7x_resume() for ACP7.B/7.F platforms power management. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-17-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: add ACP7x I2S DAI type and topology supportVijendar Mukunda
Add SOF_DAI_AMD_I2S DAI type for ACP7.B/7.F I2S/TDM interfaces. Register the ACPTDM topology DAI name and map it to SOF_DAI_AMD_I2S; IPC3 continues to parse ACP I2S link parameters through SOF_ACPI2S_TOKENS (including the format token from the prior commit), not a new token group named after ACPTDM. Add sof_link_acp_i2s_load() and the SOF_DAI_AMD_I2S PCM dai link fixup path. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-16-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: add ACP I2S format field and topology tokenVijendar Mukunda
Add format field to sof_ipc_dai_acp_params for ACP I2S format selection. Add SOF_TKN_AMD_ACPI2S_FORMAT (1703) to the existing SOF_ACPI2S_TOKENS tuple and wire it into acpi2s_tokens[] so integrators continue using the same ACPI2S token group as earlier ACP I2S topologies, not a separate ACPTDM-specific token set. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-15-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: load ACP7.B/7.F signed data firmware to SRAMVijendar Mukunda
ACP7.B and ACP7.F signed firmware data blocks must be written to SRAM instead of DRAM. Select SOF_FW_BLK_TYPE_SRAM for PCI revision 0x7B and above in acp_sof_load_signed_firmware(). Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-14-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: wire signed firmware load callback for ACP7x via ACPIVijendar Mukunda
Read ACPI property acp-sof-signed-firmware-image in sof_acp7x_ops_init() and register acp_sof_load_signed_firmware as the load_firmware callback only when the property is set. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-13-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: extend configure_and_run_sha_dma for ACPI signed FW flagVijendar Mukunda
Check adata->acp_sof_signed_firmware_image alongside the existing quirk flag so that ACP7.B/7.F platforms configured through ACPI also get the SHA DMA header included during signed firmware loading. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-12-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: add post-firmware-run delay for ACP7xVijendar Mukunda
Add sof_acp7x_post_fw_run_delay() to introduce a small delay after firmware boot completion on resume to avoid DSP entering an unrecoverable state. Register it as post_fw_run callback only when the ACPI property acp-sof-post_fw_run_delay is set, following the same pattern used by the Vangogh platform. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-11-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: validate SizeFWSigned before signed FW length on ACP7xVijendar Mukunda
The ACP7.B/7.F ACPI signed path already reads SizeFWSigned from the image header into size_fw. Before adding ACP_IMAGE_HEADER_SIZE for SHA DMA, reject payload size zero or any size_fw with size_fw > fw_bin_size - ACP_IMAGE_HEADER_SIZE, so size_fw + ACP_IMAGE_HEADER_SIZE cannot exceed the supplied firmware buffer. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-10-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: require full ACP header for ACP7 signed firmwareVijendar Mukunda
ACP7.B/7.F signed images read SizeFWSigned from a fixed offset inside the ACP header. Reject firmware buffers shorter than the header so we never read past the end of the supplied image. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-9-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: extend signed firmware pre-run for ACP7xVijendar Mukunda
Parse SizeFWSigned from the ACP image header when loading signed firmware on ACP7.B/7.F platforms. Keep the legacy ACP_FIRMWARE_SIGNATURE subtraction for pre-7B platforms using quirks. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-8-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: add ACP7x IRQ handler for DSP IPCVijendar Mukunda
Add acp7x_irq_handler() and register it from amd_sof_acp7x_probe() for DSP doorbell IPC interrupts on ACP7.B/7.F. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-7-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: add ACP7x probe and removeVijendar Mukunda
Add amd_sof_acp7x_probe() and amd_sof_acp7x_remove() for ACP7.B/7.F. Wire probe and remove into sof_acp7x_ops_init(). Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-6-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: refactor SW1 I2S error reason clear in acp_irq_handlerVijendar Mukunda
Replace the open-coded pci_rev comparison with a switch statement for clearing ACP_SW1_I2S_ERROR_REASON. This makes the per-platform control explicit and easier to extend. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-5-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: mask ACP7x PGFSM status pollVijendar Mukunda
For ACP7.B/7.F, poll only the PGFSM tile status bits (P0-P4) and consider the tiles powered on when the masked status becomes 0. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-4-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: SOF: amd: add base platform support for ACP7.B/7.FVijendar Mukunda
Add SOF support for ACP7.B and ACP7.F PCI revision based platforms. This covers Kconfig/Makefile entries, register offset definitions, DMA descriptor/channel/status paths, PGFSM power-on handling, PCI device driver, I2S/DMIC DAI definitions, and IPC SW interrupt trigger offset selection for ACP7.B/7.F. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260701095759.1012929-3-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: sof: nocodec: tidyup sof_nocodec_xxx_setup()Mark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: I will post DAI/Component/Card capsuling patch, but current code makes old style / new style conversion difficult. To make future conversions easier to understand, this patch clean up the code a little. but no functional change. Link: https://patch.msgid.link/87ik6zcu7g.wl-kuninori.morimoto.gx@renesas.com
8 daysASoC: sof: nocodec: tidyup sof_nocodec_setup()Kuninori Morimoto
We can get necessary info from mach. Let's cleanup sof_nocodec_setup(). Current code makes old style / new style conversion difficult. To make future conversions easier to understand, this patch clean up the code a little. but no functional change. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87fr23cu6w.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysASoC: sof: nocodec: tidyup sof_nocodec_bes_setup()Kuninori Morimoto
It has only 1 card (= sof_nocodec_card). No need to use parameter to get it. Current code makes old style / new style conversion difficult. To make future conversions easier to understand, this patch clean up the code a little. but no functional change. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87h5mjcu70.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysReplace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c ↵Uwe Kleine-König (The Capable Hub)
files) Replace the #include of <linux/mod_devicetable.h> by the more specific <linux/device-id/*.h> where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
10 daysASoC: sof: topology: use for_each_card_rtds()Kuninori Morimoto
We already have for_each_card_rtds(). Let's use it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87h5mpet2c.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
10 daysASoC: SOF: validate probe info element countsYousef Alhouseen
Probe information replies contain a firmware-provided element count. IPC3 uses that count to copy an array, then returns the unchecked count to its caller. A short reply can therefore make the caller walk beyond the copied array. IPC4 similarly uses the count both to allocate the destination array and to walk the reply. On 32-bit systems the allocation size can wrap, while on all systems an excessive count reads beyond the reply payload. Validate each count against the actual reply size before copying or allocating the array, and use kcalloc() for the IPC4 allocation. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Link: https://patch.msgid.link/20260628000329.18606-1-alhouseenyousef@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
12 daysASoC: SOF: topology: Use more common error handling code in sof_link_load()Markus Elfring
Use an additional label so that a bit of exception handling can be better reused at the end of this function implementation. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Link: https://patch.msgid.link/40b93192-68d2-4de1-845b-9c9ba994a75b@web.de Signed-off-by: Mark Brown <broonie@kernel.org>
12 daysASoC: SOF: ipc4-topology: Return error for invalid number of formatsMert Seftali
When the number of input or output formats is zero, sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label. At that point 'ret' is still 0, because the earlier sof_ipc4_get_audio_fmt() call succeeded, so the function returns success and the caller never finds out that the widget setup actually failed. Set ret to -EINVAL before the goto so the error gets reported. Fixes: 21a5adffad46 ("ASoC: SOF: ipc4-topology: Validate the number of in/out formats for src/asrc") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202606111431.Uky3T0tF-lkp@intel.com/ Signed-off-by: Mert Seftali <mertsftl@gmail.com> Link: https://patch.msgid.link/20260614124019.19259-1-mertsftl@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-11ASoC: SOF: topology: fix memory leak in snd_sof_load_topologyZhao Dongdong
When the topology filename contains "dummy" and tplg_cnt is 0, the function returns -EINVAL directly without freeing the tplg_files allocated by kcalloc() at line 2497. This leaks memory on every such topology load attempt. Fix this by setting ret = -EINVAL and jumping to the out: label, which already handles the kfree(tplg_files) cleanup. Fixes: 99c159279c6d ("ASoC: SOF: don't check the existence of dummy topology") Cc: stable@vger.kernel.org Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn> Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/tencent_3EED6D778DC52C3703A2D1EE8119372E8E08@qq.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-11ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properlyArnd Bergmann
When SND_SOC_SOF_INTEL_LNL is set, SND_SOF_SOF_HDA_SDW_BPT must also be enabled, in order to let the soundwire support call into it. However, there are configurations with SND_SOF_SOF_HDA_SDW_BPT=m and SND_SOF_SOF_HDA_SDW_BPT=m but SOUNDWIRE_INTEL=y, which still lead to a link failure: aarch64-linux-ld: drivers/soundwire/intel_ace2x.o: in function `intel_ace2x_bpt_wait': intel_ace2x.c:(.text+0xfc8): undefined reference to `hda_sdw_bpt_wait' aarch64-linux-ld: drivers/soundwire/intel_ace2x.o: in function `intel_ace2x_bpt_send_async': intel_ace2x.c:(.text+0x1ff8): undefined reference to `hda_sdw_bpt_get_buf_size_alignment' Address this by moving the 'select SND_SOF_SOF_HDA_SDW_BPT' into SND_SOC_SOF_HDA_GENERIC. Fixes: 614d416dd8ae ("ASoC: SOF: Intel: hda-sdw-bpt: fix SND_SOF_SOF_HDA_SDW_BPT dependencies") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260611132310.137688-2-arnd@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-11ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from SND_SOC_SOF_HDA_GENERIC=yArnd Bergmann
When SND_SOC_SOF_HDA_GENERIC=y but SND_SOC_SOF_INTEL_SOUNDWIRE=m, the SND_SOC_SDW_UTILS is also set to =m even though there is a direct link dependency from the hda.c: aarch64-linux-ld: sound/soc/sof/intel/hda.o: in function `hda_machine_select': hda.c:(.text+0x21ac): undefined reference to `codec_info_list' hda.c:(.text+0x241c): undefined reference to `asoc_sdw_get_dai_type' hda.c:(.text+0x25b4): undefined reference to `asoc_sdw_get_codec_info_list_count' hda.c:(.text+0x25d8): undefined reference to `asoc_sdw_get_codec_info_list_count' Change this the same way as the other related 'select' statements to allow linking against it. Fixes: 2b4d53eb5cf3 ("ASoC: SOF: Intel: select SND_SOC_SDW_UTILS in SND_SOC_SOF_HDA_GENERIC") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Tested-by: Julian Braha <julianbraha@gmail.com> Link: https://patch.msgid.link/20260611132310.137688-1-arnd@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: SOF: topology: validate vendor array size before parsingCássio Gabriel
sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code. Link: https://lore.kernel.org/stable/CANiDSCsjR5NHqu_Ui5cOqWdJgFqmYsQ9WR8O7m0WOhngaYXFpw@mail.gmail.com/t/#m9b3be379221e79327cc13fd71009287368ef4f23 Fixes: 215e5fe75881 ("ASoC: SOF: topology: reject invalid vendor array size in token parser") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260603-sof-topology-array-size-signed-v1-1-84f97879a4ef@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: Use codec_info_list.is_amp directly in find_acpi_adr_device()Mark Brown
Bard Liao <yung-chuan.liao@linux.intel.com> says: This series sets is_amp to all amp type codecs in codec_info_list[]. So that we can use the flag directly instead of using a local flag to check if the codec is an AMP type. The flag will be used to set different name_prefix for amp and non-amp codecs. Link: https://patch.msgid.link/20260605101805.121428-1-yung-chuan.liao@linux.intel.com
2026-06-10ASoC: SOF: Intel: Use codec_info_list.is_amp directlyBard Liao
Now we set is_amp to all amp type codecs. We can use the flag directly instead of using a local flag to check if the codec is an AMP type. Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260605101805.121428-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: cs35l56: Fix some cleanup memory leaksMark Brown
Richard Fitzgerald <rf@opensource.cirrus.com> says: These are for-next. They are not urgent because it only leaks memory if the driver failed to component_probe or is removed, which wouldn't happen in normal use. This series fixes some memory leaks: - The memory allocated by wm_adsp/cs_dsp was not freed. - If component_probe() failed it didn't clean up. The addition of this cleanup in patch #3 exposes an existing possible double-free of the debugfs, which is fixed in patch #2. Link: https://patch.msgid.link/20260610093432.557375-1-rf@opensource.cirrus.com
2026-06-09ASoC: SOF: amd: honor machine_check in SoundWire machine selectVijendar Mukunda
Only accept an ACPI machine table entry when machine_check is absent or returns true, matching other AMD SoundWire machine select paths. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Link: https://patch.msgid.link/20260609144146.3311301-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/getPeter Ujfalusi
The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path. Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow. Fixes: 67ec2a091630 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260609083458.31193-7-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_getPeter Ujfalusi
In sof_ipc3_bytes_put(), the size used for the memcpy is derived from the old data->size already in the buffer, not the incoming new data's size field. If the new data has a different size, the copy length is wrong: it may truncate valid data or copy stale bytes. Similarly, sof_ipc3_bytes_get() checks data->size against max_size without accounting for the sizeof(struct sof_ipc_ctrl_data) offset of the flex array within the allocation. Fix bytes_put to validate and use the incoming data's sof_abi_hdr.size from ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata) from the bounds check to match the actual available space. Fixes: 544ac8858f24 ("ASoC: SOF: Add bytes_get/put control IPC ops for IPC3") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260609083458.31193-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: ipc3-control: Validate size in snd_sof_update_controlPeter Ujfalusi
In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying. Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260609083458.31193-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: ipc3-control: Use overflow checks in control_update size calcPeter Ujfalusi
In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations. Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260609083458.31193-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: ipc4-control: Validate notification payload sizePeter Ujfalusi
Validate MODULE_NOTIFICATION payload length before reading bytes/channel data in control update handling. Fixes: 2a28b5240f2b ("ASoC: SOF: ipc4-control: Add support for generic bytes control") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260609083458.31193-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_putPeter Ujfalusi
In sof_ipc4_bytes_put(), the copy size is derived from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a different size, the copy uses the wrong length: it may truncate valid data or copy stale bytes. Fix by validating and using the incoming data's sof_abi_hdr.size from ucontrol before copying. Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260609083458.31193-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: amd: set ipc flags to zeroVijendar Mukunda
As per design, set IPC conf structure flags to zero during acp init sequence. Link: https://github.com/thesofproject/linux/pull/5642 Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Tested-by: Umang Jain <uajain@igalia.com> Link: https://patch.msgid.link/20260609160938.3717513-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-09ASoC: SOF: amd: fix for ipc flags checkVijendar Mukunda
Firmware will set dsp_ack to 1 when firmware sends response for the IPC command issued by host. Similarly dsp_msg flag will be updated to 1. During ACP D0 entry, the value read from the sof_dsp_ack_write scratch flag can be uninitialized. A non-zero garbage value is treated as a pending DSP IPC ack before SOF_FW_BOOT_COMPLETE, causing a spurious "IPC reply before FW_BOOT_COMPLETE" log. Fix the condition checks for ipc flags. Fixes: 738a2b5e2cc9 ("ASoC: SOF: amd: Add IPC support for ACP IP block") Link: https://github.com/thesofproject/linux/pull/5642 Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Tested-by: Umang Jain <uajain@igalia.com> Link: https://patch.msgid.link/20260609160938.3717513-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-28ASoC: soc-card: add snd_soc_card_set_topology_name()Kuninori Morimoto
Some drivers want to use topology name, but currently each drivers are setting it by own method. This patch adds new snd_soc_card_set_topology_name() and do it by same method. Almost all driver doesn't set topology name, let's remove fixed name array, and use devm_kasprintf() instead. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/878q942wce.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-26ASoC: SOF: ipc4-topology: Support for multiple src output formatsMark Brown
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says: SRC can only change the rate, we can still allow different bit depth and channels to be handled, the only restriction is that the input and output must have matching bit depth and channel format. In a separate patch do a sanity check for the number of formats on the input and output side as SRC/ASRC must have at least one of them. Link: https://patch.msgid.link/20260526105748.26149-1-peter.ujfalusi@linux.intel.com
2026-05-26ASoC: SOF: ipc4-topology: Allow the use of multiple formats for src outputPeter Ujfalusi
The SRC module can only change the rate, it keeps the format and channels intact, but this does not mean the num_output_formats must be 0: The SRC module can support different formats/channels, we just need to check if the output format lists the correct combination of out rate and the input format/channels. Change the logic to prioritize the sink_rate of the module as target rate, then the rate of the FE in case of capture or in case of playback check the single rate specified in the output formats. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> Link: https://patch.msgid.link/20260526105748.26149-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-26ASoC: SOF: ipc4-topology: Validate the number of in/out formats for src/asrcPeter Ujfalusi
SRC and ASRC modules must have at least one input and on one output formats to be usable. Do a sanity check during setup type and fail if either the number of input or output formats are 0. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20260526105748.26149-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-22ASoC: SOF: ipc4-topology: Enable deep buffer captureSeppo Ingalsuo
This patch lets a capture PCM to operate with deep buffer by taking dsp_max_burst_size_in_ms from topology if it is defined. Earlier the value from topology was omitted for capture. If not defined, the maximum burst size for capture is set similarly as before to one millisecond. The dma_buffer_size is set similarly as for playback from largest of deep_buffer_dma_ms or SOF_IPC4_MIN_DMA_BUFFER_SIZE times OBS. Signed-off-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20260522075659.2645-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-22ASoC: SOF: ipc4-topology: Print for format type in dbg_audio_formatPeter Ujfalusi
8 and 32 bit formats can have different types, print them in debug information to have complete view of the supported formats. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260520150204.18303-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-22ASoC: SOF: Intel: Enable offload for UAOL for LNL+Mark Brown
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says: The USB Audio Offload (UAOL) can only be used from the DSP side and on Lunar Lake (ACE2) and newer platforms the access to it's register space must be granted by the host, just like for SSP or DMIC. This series enable the offload for UAOL for LNL or newer devices. Link: https://patch.msgid.link/20260520150639.25301-1-peter.ujfalusi@linux.intel.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-11 16:40:16 +0000