Repository navigation
ASoC: SOF: Intel: hda: stop CORB/RIRB DMA in hda_dsp_remove() - #5976
Open
yifanli-intel wants to merge 1 commit into
Open
yifanli-intel wants to merge 1 commit into
yifanli-intel wants to merge 1 commit into
Conversation
If the deferred probe fails after hda_dsp_probe(), e.g. because the SOF firmware is not installed, the IOMMU reports a continuous stream of DMA write faults from the audio controller: [ 13.155983] sof-audio-pci-intel-nvl 0000:80:1f.3: error: sof_probe_work failed err: -2 [ 15.056446] DMAR: DRHD: handling fault status reg 2 [ 15.056457] DMAR: [DMA Write NO_PASID] Request device [0000:80:1f.3] fault addr 0xffffe000 [fault reason 0x71] SM: Present bit in first-level paging entry is clear hda_dsp_remove() frees the CORB/RIRB ring buffer in hda_dsp_stream_free() without stopping the controller, so RIRB DMA and unsolicited responses stay enabled. sof_pci_probe() has already returned success at this point, so the PCI device stays bound with bus mastering enabled, and every unsolicited response from the codec is written to the freed buffer. Without an IOMMU these writes would go to memory that may already have been reused. This was masked until commit 9e6966f ("ASoC: SOF: Intel: hda: Keep non-alt mlinks powered at probe on ACE2+"): hda_bus_ml_put_all() at the end of hda_init_caps() dropped the last link reference, and snd_hdac_ext_bus_link_put() then stopped CORB/RIRB DMA as a side effect. Call hda_codec_stop_cmd_io() before the buffers are freed, to disable CORB/RIRB DMA and unsolicited responses. Fixes: 9e6966f ("ASoC: SOF: Intel: hda: Keep non-alt mlinks powered at probe on ACE2+") Suggested-by: Bard Liao <yung-chuan.liao@linux.intel.com> Assisted-by: LLM Signed-off-by: Li Yifan <yifan2.li@intel.com>
Collaborator
|
Can one of the admins verify this patch?
|
There was a problem hiding this comment.
🟢 Approval recommended
The teardown ordering correctly prevents DMA access to freed ring buffers with no identified regressions.
0 open findings
What changed in this PR
Stops HDA CORB/RIRB DMA during device removal to prevent writes into freed ring buffers after SOF probe failure.
Changes:
- Stops codec command I/O before IRQ and DMA-buffer teardown.
- Prevents repeated DMAR faults and possible memory corruption.
| File | Description |
|---|---|
sound/soc/sof/intel/hda.c |
Stops CORB/RIRB DMA before freeing stream resources. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Collaborator
|
test this please |
bardliao
approved these changes
Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We found this issue when testing v7.3-rc3 based kernel with Ubuntu 26.04 on some new platform. Before we manually install the sof firmware package to the device, we saw DMAR error after the sof probe failure:
[ 13.155983] sof-audio-pci-intel-nvl 0000:80:1f.3: error: sof_probe_work failed err: -2
[ 15.056446] DMAR: DRHD: handling fault status reg 2
[ 15.056457] DMAR: [DMA Write NO_PASID] Request device [0000:80:1f.3] fault addr 0xffffe000 [fault reason 0x71] SM: Present bit in first-level paging entry is clear
The DMAR log keeps printing in dmesg, and we did a bisect with v7.2 kernel and found no issues on v7.2.
In debugging, we found hda_dsp_remove() frees the CORB/RIRB ring buffer in hda_dsp_stream_free() without stopping the controller, so RIRB DMA and unsolicited responses stay enabled. sof_pci_probe() has already returned success at this point, so the PCI device stays bound with bus mastering enabled, and every unsolicited response from the codec is written to the freed buffer. Without an IOMMU these writes would go to memory that may already have been reused.
This was masked until commit 9e6966f ("ASoC: SOF: Intel: hda: Keep non-alt mlinks powered at probe on ACE2+"): hda_bus_ml_put_all() at the end of hda_init_caps() dropped the last link reference, and snd_hdac_ext_bus_link_put() then stopped CORB/RIRB DMA as a side effect.
With suggestion from Bard, we add hda_codec_stop_cmd_io() before the buffers are freed, to disable CORB/RIRB DMA and unsolicited responses.
Test executed with this patch:
compile on our v7.3-rc3 kernel with make x86_64 allyes/allmod config, no issue.
compile on topic/sof-dev kernel branch(current) with make x86_64 def config, no issue.
tested with our issued platform(NVL) with the patched kernel, the DMAR logs disappeared when sof probe failure, also tested bind/unbind audio device on the platform, no issue found
-Yifan