Repository navigation
Conversation
ujfalusi
requested review from
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
October 29, 2026 13:38
With CONFIG_SOF_USERSPACE_LL the IPC4 module commands run in a user thread which cannot issue IDC messages. CONFIG_CROSS_CORE_STREAM is therefore disabled in that configuration, but a module created on a different core than its pipeline (e.g. the compress decoder pinned to core 1) was still accepted, and the first cross-core operation then panicked the DSP from user space instead of failing: - ipc4_comp_connect() called comp_get_attribute() on the remote sink before checking cross_core_bind, hitting the privileged IDC path (rzalloc/idc_send_msg) -> privileged instruction exception. - the host's error unwind deleted the pipeline, and ipc_pipeline_module_free() used ipc_comp_free_remote() for the remote module -> load error on the kernel-only IDC data. Reject such a module already at MOD_INIT_INSTANCE when user-space LL is enabled and cross-core streams are disabled, and move the cross-core check in ipc4_comp_connect() before any remote access so the bind fails with IPC4_INVALID_REQUEST instead of crashing. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
With CONFIG_SOF_USERSPACE_LL, the userspace constructor bypasses pipeline/core validation, allowing a cross-core module that exposes the privileged ipc_comp_free_remote() path during pipeline deletion.
1 open issue
What changed in this PR
This PR aims to prevent IPC4 cross-core module operations from crashing the DSP when user-space LL execution cannot issue privileged inter-core messages.
Changes:
- Adds a module/pipeline core check in
comp_new_ipc4()for user-space LL configurations without cross-core stream support. - Moves unsupported cross-core bind rejection ahead of remote attribute access, returning
IPC4_INVALID_REQUEST.
| File | Description |
|---|---|
src/ipc/ipc4/helper.c |
Adds constructor validation and rejects unsupported cross-core binds earlier. |
Review effort: Balanced
Comment on lines
+193
to
+194
| if (IS_ENABLED(CONFIG_SOF_USERSPACE_LL) && !IS_ENABLED(CONFIG_CROSS_CORE_STREAM) && | ||
| ppl->core != ipc_config.core) { |
PR 11375: test resultsRun date: 2026-10-29 16:40 UTC Tested commit: 5286bc7f2d25aca35d0f773d2cc7adf213f15730
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With CONFIG_SOF_USERSPACE_LL the IPC4 module commands run in a user thread which cannot issue IDC messages. CONFIG_CROSS_CORE_STREAM is therefore disabled in that configuration, but a module created on a different core than its pipeline (e.g. the compress decoder pinned to core 1) was still accepted, and the first cross-core operation then panicked the DSP from user space instead of failing:
Reject such a module already at MOD_INIT_INSTANCE when user-space LL is enabled and cross-core streams are disabled, and move the cross-core check in ipc4_comp_connect() before any remote access so the bind fails with IPC4_INVALID_REQUEST instead of crashing.