Repository navigation
ipc4: helper: reject cross-core modules early when unsupported - #11375
Merged
kv2019i merged 1 commit intoOct 30, 2026
Merged
Conversation
ujfalusi
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
October 29, 2026 13:38
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
With CONFIG_SOF_USERSPACE_LL, the userspace constructor bypasses pipeline/core validation, allowing a cross-core module that exposes the privileged ipc_comp_free_remote() path during pipeline deletion.
1 open issue
What changed in this PR
This PR aims to prevent IPC4 cross-core module operations from crashing the DSP when user-space LL execution cannot issue privileged inter-core messages.
Changes:
- Adds a module/pipeline core check in
comp_new_ipc4()for user-space LL configurations without cross-core stream support. - Moves unsupported cross-core bind rejection ahead of remote attribute access, returning
IPC4_INVALID_REQUEST.
| File | Description |
|---|---|
src/ipc/ipc4/helper.c |
Adds constructor validation and rejects unsupported cross-core binds earlier. |
Review effort: Balanced
Comment on lines
+193
to
+194
| if (IS_ENABLED(CONFIG_SOF_USERSPACE_LL) && !IS_ENABLED(CONFIG_CROSS_CORE_STREAM) && | ||
| ppl->core != ipc_config.core) { |
Contributor
Author
There was a problem hiding this comment.
Valid, I'll move the check
PR 11375: test resultsRun date: 2026-10-30 13:49 UTC Tested commit: b38835fcd9213bd2315c9a4a7157e48d9b15e2e1
|
| /* The user-space IPC thread cannot issue the IDC calls needed to | ||
| * bind or free a module living on another core than its pipeline. | ||
| */ | ||
| if (IS_ENABLED(CONFIG_SOF_USERSPACE_LL) && !IS_ENABLED(CONFIG_CROSS_CORE_STREAM) && |
Member
There was a problem hiding this comment.
Why is this even limited to CONFIG_SOF_USERSPACE_LL?
If CONFIG_CROSS_CORE_STREAM is disabled, it's over anyway.
Contributor
Author
There was a problem hiding this comment.
true, I will drop the LL check
ujfalusi
force-pushed
the
peter/pr/ll-no-crosscore-fix
branch
from
October 30, 2026 08:58
5286bc7 to
b38835f
Compare
Without CONFIG_CROSS_CORE_STREAM a stream must be processed entirely on a single core, but a module created on a different core than its pipeline (e.g. the compress decoder pinned to core 1) was still accepted. With CONFIG_SOF_USERSPACE_LL the IPC4 module commands run in a user thread which cannot issue IDC messages, so CONFIG_CROSS_CORE_STREAM is disabled in that configuration and the first cross-core operation then panicked the DSP from user space instead of failing: - ipc4_comp_connect() called comp_get_attribute() on the remote sink before checking cross_core_bind, hitting the privileged IDC path (rzalloc/idc_send_msg) -> privileged instruction exception. - the host's error unwind deleted the pipeline, and ipc_pipeline_module_free() used ipc_comp_free_remote() for the remote module -> load error on the kernel-only IDC data. Reject such a module already at MOD_INIT_INSTANCE whenever cross-core streams are disabled. Do the check, together with the existing parent pipeline existence check, in ipc4_comp_new_config() so that it covers every module creation path: comp_new_ipc4() as well as the CONFIG_SOF_USERSPACE_LL specific ipc4_user_module_load() and comp_new_ipc4_user(), which skipped both checks so far. Also move the cross-core check in ipc4_comp_connect() before any remote access so the bind fails with IPC4_INVALID_REQUEST instead of crashing. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Changes since v1:
|
abonislawski
approved these changes
Oct 30, 2026
kv2019i
approved these changes
Oct 30, 2026
tmleman
approved these changes
Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With CONFIG_SOF_USERSPACE_LL the IPC4 module commands run in a user thread which cannot issue IDC messages. CONFIG_CROSS_CORE_STREAM is therefore disabled in that configuration, but a module created on a different core than its pipeline (e.g. the compress decoder pinned to core 1) was still accepted, and the first cross-core operation then panicked the DSP from user space instead of failing:
Reject such a module already at MOD_INIT_INSTANCE when user-space LL is enabled and cross-core streams are disabled, and move the cross-core check in ipc4_comp_connect() before any remote access so the bind fails with IPC4_INVALID_REQUEST instead of crashing.