"Kernel Panic" run 'soft/kmod_scripts/sof_bootone.sh' cause kernel panic on BYT, CNL and APL

[ghost]

System Environment:
Kernel repo: topic/sof-dev: 7481f7a
tried on the BYT and APL

Reproduce step:
run the "soft/kmod_scripts/sof_bootone.sh" script, that means do the module reload one time.
the panic will be hit

the log:
dmesg.txt

[ghost]

I add the unmerged PR #72 , which can solve another panic issue (it is under review right now).
on the kernel v4.18. it seems still has the panic issue. I did the test on the APL and BYT.
it has the same panic info. I will work on this issue later.

[ZhendanYang]

This issue also exists on CNL. And it has been existing for a long time.
the logs:
dmesg-bootone.log
rmbox-t-bootone.log

[ghost]

Based on the objdump's result, it seems the panic issue is happened when do this operation:
struct snd_card *card = comp->card->snd_card;
maybe the card->snd_card pointer is null already when we use it.
according to the call-stack: the snd_card_free() function is called by multi functions.
I will do more debug on this later.

[keqiaozhang]

This issue also can be reproduced with latest sof-master + sof-dev on UP^2 and CNL
sof-dev: bafb590.
sof-master: 9944905
soft-master: 41861aa

[ghost]

the comp->card->snd_card pointer is freed already before we call the function remove_widget().
Base on experiment of the GP board, the tdf8532 driver will do the module remove, it seems ahead of
the topology free process.

So the snd_card{} instance is freed first. then in the topology free stage,
we will use this pointer in remove_widget() function. the oops will be hit.
this is the root cause.
But I have no idea how to adjust the free logical.

[ghost]

maybe I can try to adjust the module uninstall sequence in the script to do the test.
to make sure whether it has effect or not.

[ghost]

@lgirdwood
this is the location we free the snd_card{} instance:

static int soc_cleanup_card_resources(struct snd_soc_card *card)
{
...
	/* free the ALSA card at first; this syncs with pending operations */
	snd_card_free(card->snd_card);
...
}

this is the location we do the topology free, then we hit oops's location:

static void remove_widget(struct snd_soc_component *comp,
	struct snd_soc_dobj *dobj, int pass)
{
	struct snd_card *card = comp->card->snd_card;
...
}

[lgirdwood]

@zhigang-wu ok so soc_cleanup_card_resources() should also free any topology and call snd_soc_tplg_component_remove() for each component in the sound card.

[ghost]

@lgirdwood
Good!
I will go through the card->component_dev_list to process each component in the
snd_soc_tplg_component_remove() function.

[wenqingfu]

why this is a problem for SOF, not to other ASoC drivers?

[lgirdwood]

@wenqingfu it's a problem for any driver who want s to modify topology at runtime. SOF is the only driver that supports this. The rest just load a static topology.

[ghost]

@lgirdwood
I add the patch as below:

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 71fdac067a47..49e82131141f 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2168,11 +2168,21 @@ static int soc_probe(struct platform_device *pdev)
 static int soc_cleanup_card_resources(struct snd_soc_card *card)
 {
        struct snd_soc_pcm_runtime *rtd;
+       struct snd_soc_component *component;
+       int ret;
 
        /* make sure any delayed work runs */
        list_for_each_entry(rtd, &card->rtd_list, list)
                flush_delayed_work(&rtd->delayed_work);
 
+       /* remove dynamic controls for all component driver */
+       list_for_each_entry(component, &card->component_dev_list, card_list) {
+               ret = snd_soc_tplg_component_remove(component, SND_SOC_TPLG_INDEX_ALL);
+               if (ret < 0)
+                       dev_err(component->dev,
+                               "error: component free failed %d\n", ret);
+       }
+
        /* free the ALSA card at first; this syncs with pending operations */
        snd_card_free(card->snd_card);
......
}

But it still has this kind of panic.
I add the log into the soc_cleanup_card_resources(), this patch has effects.
but there still has some widgets' mixer controls need to be processed after card unregister.
I need more debug for this panic issue.

[ghost]

the PR #119 can fix this issue.

[ghost]

@ZhendanYang @keqiaozhang
the PR #119 is merged already. please check it.

[ZhendanYang]

No more "kernel Panic" when running 'soft/kmod_scripts/sof_bootone.sh' on each platform, but it will cause firmware load failure after unloading and reloading driver. There is a new issue #124 tracking this.