Repository navigation
ASoC: SOF: Intel: hda: stop CORB/RIRB DMA in hda_dsp_remove() - #5976
yifanli-intel wants to merge 1 commit into
Conversation
If the deferred probe fails after hda_dsp_probe(), e.g. because the SOF firmware is not installed, the IOMMU reports a continuous stream of DMA write faults from the audio controller: [ 13.155983] sof-audio-pci-intel-nvl 0000:80:1f.3: error: sof_probe_work failed err: -2 [ 15.056446] DMAR: DRHD: handling fault status reg 2 [ 15.056457] DMAR: [DMA Write NO_PASID] Request device [0000:80:1f.3] fault addr 0xffffe000 [fault reason 0x71] SM: Present bit in first-level paging entry is clear hda_dsp_remove() frees the CORB/RIRB ring buffer in hda_dsp_stream_free() without stopping the controller, so RIRB DMA and unsolicited responses stay enabled. sof_pci_probe() has already returned success at this point, so the PCI device stays bound with bus mastering enabled, and every unsolicited response from the codec is written to the freed buffer. Without an IOMMU these writes would go to memory that may already have been reused. This was masked until commit 9e6966f ("ASoC: SOF: Intel: hda: Keep non-alt mlinks powered at probe on ACE2+"): hda_bus_ml_put_all() at the end of hda_init_caps() dropped the last link reference, and snd_hdac_ext_bus_link_put() then stopped CORB/RIRB DMA as a side effect. Call hda_codec_stop_cmd_io() before the buffers are freed, to disable CORB/RIRB DMA and unsolicited responses. Fixes: 9e6966f ("ASoC: SOF: Intel: hda: Keep non-alt mlinks powered at probe on ACE2+") Suggested-by: Bard Liao <yung-chuan.liao@linux.intel.com> Assisted-by: LLM Signed-off-by: Li Yifan <yifan2.li@intel.com>
|
Can one of the admins verify this patch?
|
There was a problem hiding this comment.
🟢 Approval recommended
The teardown ordering correctly prevents DMA access to freed ring buffers with no identified regressions.
0 open findings
What changed in this PR
Stops HDA CORB/RIRB DMA during device removal to prevent writes into freed ring buffers after SOF probe failure.
Changes:
- Stops codec command I/O before IRQ and DMA-buffer teardown.
- Prevents repeated DMAR faults and possible memory corruption.
| File | Description |
|---|---|
sound/soc/sof/intel/hda.c |
Stops CORB/RIRB DMA before freeing stream resources. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
test this please |
|
Hi @bardliao , Please let me know if any work required from my side for get it upstreamed. Thanks, |
|
@yifanli-intel I would like to wait for @kv2019i's review as he is the HDA expert. However, he is on leave now. |
Noted and thanks a lot for your quick reply :) -Yifan |
We found this issue when testing v7.3-rc3 based kernel with Ubuntu 26.04 on some new platform. Before we manually install the sof firmware package to the device, we saw DMAR error after the sof probe failure:
[ 13.155983] sof-audio-pci-intel-nvl 0000:80:1f.3: error: sof_probe_work failed err: -2
[ 15.056446] DMAR: DRHD: handling fault status reg 2
[ 15.056457] DMAR: [DMA Write NO_PASID] Request device [0000:80:1f.3] fault addr 0xffffe000 [fault reason 0x71] SM: Present bit in first-level paging entry is clear
The DMAR log keeps printing in dmesg, and we did a bisect with v7.2 kernel and found no issues on v7.2.
In debugging, we found hda_dsp_remove() frees the CORB/RIRB ring buffer in hda_dsp_stream_free() without stopping the controller, so RIRB DMA and unsolicited responses stay enabled. sof_pci_probe() has already returned success at this point, so the PCI device stays bound with bus mastering enabled, and every unsolicited response from the codec is written to the freed buffer. Without an IOMMU these writes would go to memory that may already have been reused.
This was masked until commit 9e6966f ("ASoC: SOF: Intel: hda: Keep non-alt mlinks powered at probe on ACE2+"): hda_bus_ml_put_all() at the end of hda_init_caps() dropped the last link reference, and snd_hdac_ext_bus_link_put() then stopped CORB/RIRB DMA as a side effect.
With suggestion from Bard, we add hda_codec_stop_cmd_io() before the buffers are freed, to disable CORB/RIRB DMA and unsolicited responses.
Test executed with this patch:
compile on our v7.3-rc3 kernel with make x86_64 allyes/allmod config, no issue.
compile on topic/sof-dev kernel branch(current) with make x86_64 def config, no issue.
tested with our issued platform(NVL) with the patched kernel, the DMAR logs disappeared when sof probe failure, also tested bind/unbind audio device on the platform, no issue found
-Yifan