linux-stable.git/drivers/soundwire, branch linux-rolling-stable

soundwire: intel_ace2x: release bpt_stream when close it

2026-07-24T14:20:01+00:00

[ Upstream commit 8a7fe10eec64bfb7cf4091bca540de4c55d56bfa ]

The BPT stream was allocated in intel_ace2x_bpt_open_stream(), we need
to free it in intel_ace2x_bpt_close_stream().

Fixes: 4c1ce9f37d8a8 ("soundwire: intel_ace2x: add BPT send_async/wait callbacks")
Signed-off-by: Bard Liao 
Reviewed-by: Simon Trimmer 
Reviewed-by: Pierre-Louis Bossart 
Link: https://patch.msgid.link/20260514141625.1834216-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul 
Signed-off-by: Sasha Levin

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

2026-07-24T14:19:58+00:00

[ Upstream commit f772ff5a0e6758fd412803c09e03ba3bca5f5878 ]

The original implementation caused an out-of-bounds memory access
in the sdw_add_element_group_count for-loop when i == num.

for (i = 0; i <= num; i++) {
    if (rate == group->rates[i] && lane == group->lanes[i])
        ...

To fix this error, the function now checks for existing rate/lane
entries in the group(a function parameter) using a for-loop before
adding them.

No functional changes apart from this fix.

Fixes: 9026118f20e2 ("soundwire: Add generic bandwidth allocation algorithm")
Reviewed-by: Bard Liao 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Baoli.Zhang 
Link: https://patch.msgid.link/20260506055039.3751028-2-baoli.zhang@linux.intel.com
Signed-off-by: Vinod Koul 
Signed-off-by: Sasha Levin

soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral

2026-07-24T14:19:58+00:00

[ Upstream commit c368dd5cbd61ffab2b6f8a89b0d5775e2e16cde6 ]

The SDW_SCP_BUSCLOCK_SCALE register will be programmed when the
Peripheral is attached. We can and should skip programming the
SDW_SCP_BUSCLOCK_SCALE register when the Peripheral is unattached.

Fixes: 645291cfe5e5 ("Soundwire: stream: program BUSCLOCK_SCALE")
Signed-off-by: Bard Liao 
Reviewed-by: Simon Trimmer 
Reviewed-by: Péter Ujfalusi 
Reviewed-by: Ranjani Sridharan 
Link: https://patch.msgid.link/20260428084612.322701-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul 
Signed-off-by: Sasha Levin

Merge tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

2026-04-17T17:16:53+00:00

Pull soundwire updates from Vinod Koul:

 - Core: DP prepare polling for avoiding interrupt deadlock

 - AMD clock init and bandwidth refactoring

 - Intel more codecs to wake list, clear message on before signaling
   waiting thread

* tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list
  soundwire: cadence: Clear message complete before signaling waiting thread
  soundwire: Intel: test bus.bpt_stream before assigning it
  soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
  soundwire: stream: Poll for DP prepare to avoid interrupt deadlock
  soundwire: amd: refactor bandwidth calculation logic
  soundwire: amd: add clock init control function
  soundwire: intel_auxdevice: Add CS47L47 to wake_capable_list
  soundwire: slave: Don't register devices that are disabled in ACPI
  soundwire: sdw.h: repair names and format of kernel-doc comments

soundwire: debugfs: initialize firmware_file to empty string

2026-04-02T14:15:23+00:00

Passing NULL to debugfs_create_str() causes a NULL pointer dereference,
and creating debugfs nodes with NULL string pointers is no longer
permitted.

Additionally, firmware_file is a global pointer. Previously, adding every
new slave blindly overwrote it with NULL.

Fix these issues by initializing firmware_file to an allocated empty
string once in the subsystem init path (sdw_debugfs_init), and freeing
it in the exit path. Existing driver code handles empty strings
correctly.

Fixes: fe46d2a4301d ("soundwire: debugfs: add interface to read/write commands")
Reported-by: yangshiguang 
Closes: https://lore.kernel.org/lkml/17647e4c.d461.19b46144a4e.Coremail.yangshiguang1011@163.com/
Signed-off-by: Gui-Dong Han 
Link: https://patch.msgid.link/20260323085930.88894-4-hanguidong02@gmail.com
Signed-off-by: Greg Kroah-Hartman

soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list

2026-03-17T09:51:57+00:00

The Cirrus Logic cs42l49 codec can generate Jack events so add it to
the wake-capable list.

Signed-off-by: Charles Keepax 
Link: https://patch.msgid.link/20260313155428.1934196-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul

soundwire: cadence: Clear message complete before signaling waiting thread

2026-03-13T07:07:08+00:00

Clear the CDNS_MCP_INT_RX_WL interrupt before signaling completion.

This is to prevent the potential race where:
- The main thread is scheduled immediately the completion is signaled,
   and starts a new message
- The RX_WL IRQ for this new message happens before sdw_cdns_irq() has
  been re-scheduled.
- When sdw_cdns_irq() is re-scheduled it clears the new RX_WL interrupt.

MAIN THREAD                        |  IRQ THREAD
                                   |
  _cdns_xfer_msg()                 |
  {                                |
     write data to FIFO            |
     wait_for_completion_timeout() |
                          |                       <---- RX_WL IRQ
                                   | sdw_cdns_irq()
                                   | {
                                   |    signal completion
                          <== RESCHEDULE <==
  Handle message completion        |
  }                                |
                                   |
Start new message                  |
  _cdns_xfer_msg()                 |
  {                                |
     write data to FIFO            |
     wait_for_completion_timeout() |
                          |                       <---- RX_WL IRQ
                          ==> RESCHEDULE ==>
                                   |    // New RX_WL IRQ is cleared before
                                   |    // it has been handled.
                                   |    clear CDNS_MCP_INTSTAT

                                   |    return IRQ_HANDLED;
                                   | }

Before this change, this error message was sometimes seen on kernels
that have large amounts of debugging enabled:

   SCP Msg trf timed out

This error indicates that the completion has not been signalled after
500ms.

Signed-off-by: Richard Fitzgerald 
Fixes: 956baa1992f9 ("soundwire: cdns: Add sdw_master_ops and IO transfer support")
Reported-by: Norman Bintang 
Closes: https://issuetracker.google.com/issues/477099834
Reviewed-by: Pierre-Louis Bossart 
Link: https://patch.msgid.link/20260310113133.1707288-1-rf@opensource.cirrus.com
Signed-off-by: Vinod Koul

soundwire: Intel: test bus.bpt_stream before assigning it

2026-03-09T07:04:07+00:00

We only allow up to 1 bpt stream running on a SoundWire bus.
bus.bpt_stream will be assigned when it is opened and will be set to
NULL when it is closed. We do check bus->bpt_stream_refcount if the
stream type is SDW_STREAM_BPT in sdw_master_rt_alloc(), but at that
moment the bpt stream is allocated and set to bus.bpt_stream. It will
lead to the original bus.bpt_stream be changed to the new and not used
bpt stream. And it will be released and set to NULL when
sdw_slave_bpt_stream_add() return error as it supposed to. Then the
original stream will try to use the NULL bus.bpt_stream.

Fixes: 4c1ce9f37d8a ("soundwire: intel_ace2x: add BPT send_async/wait callbacks")
Reported-by: Simon Trimmer 
Signed-off-by: Bard Liao 
Reviewed-by: Simon Trimmer 
Reviewed-by: Ranjani Sridharan 
Link: https://patch.msgid.link/20260126054045.2504103-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul

soundwire: bus: demote UNATTACHED state warnings to dev_dbg()

2026-03-09T07:03:20+00:00

The dev_warn() messages in sdw_handle_slave_status() for UNATTACHED
transitions were added in commit d1b328557058 ("soundwire: bus: add
dev_warn() messages to track UNATTACHED devices") to debug attachment
failures with dynamic debug enabled.

These warnings fire during normal operation -- for example when a codec
driver triggers a hardware reset after firmware download, causing the
device to momentarily go UNATTACHED before re-attaching -- producing
misleading noise on every boot.

Demote the messages to dev_dbg() so they remain available via dynamic
debug for diagnosing real attachment failures without alarming users
during expected initialization sequences.

Fixes: d1b328557058 ("soundwire: bus: add dev_warn() messages to track UNATTACHED devices")
Signed-off-by: Cole Leavitt 
Reviewed-by: Richard Fitzgerald 
Link: https://patch.msgid.link/20260218180210.9263-1-cole@unwrap.rs
Signed-off-by: Vinod Koul

soundwire: stream: Poll for DP prepare to avoid interrupt deadlock

2026-03-09T07:02:38+00:00

Replace the wait_for_completion_timeout() in sdw_prep_deprep_slave_ports()
with a read_poll_timeout().

The original intent of the wait_for_completion_timeout() was to wait for
the port prepare interrupt. But at this time the code is holding the
bus_lock, which prevents the interrupt handler from running. Because of
this, the port_prep completion will not be signaled and the
wait_for_completion_timeout() will always timeout.

Rewriting the code to avoid taking the bus_lock carries risks, and
needs careful consideration of the consequences. It is safer and simpler
to replace the completion with a simple register poll.

As the code is holding the bus_lock, it is already blocking other activity
so consuming control channel bandwidth for polling isn't really a concern.

Signed-off-by: Richard Fitzgerald 
Link: https://patch.msgid.link/20260227111648.175548-1-rf@opensource.cirrus.com
Signed-off-by: Vinod Koul