[Bug 2158818] [NEW] SOF IPC4 topology ABI mismatch causes DSP crash (EHOSTDOWN) — regression in 7.0.0-22

Public bug reported: On ASUS Zenbook UX3405MA (Intel Core Ultra 7 155H / Meteor Lake-P), kernel versions 7.0.0-22 and 7.0.0-27 crash the SOF DSP on first audio playback attempt, making all wired audio (headphones, speakers) permanently silent until reboot. Bluetooth audio is unaffected. Hardware is confirmed good (Windows works; Ubuntu 26.04 live CD with kernel 7.0.0-14 works). Root cause: The installed firmware-sof-signed 2025.12.2-1 provides IPC4 topology files with ABI version 3:29:1. The kernel SOF driver reports its supported ABI as 3:23:1 and logs: sof-audio-pci-intel-mtl 0000:00:1f.3: Topology: ABI 3:29:1 Kernel ABI 3:23:1 On kernel 7.0.0-14 (confirmed from live CD) this mismatch is handled gracefully and audio works. Starting with 7.0.0-22, the kernel's IPC4 topology parser sends malformed pipeline configuration to the DSP firmware when it encounters the newer ABI, causing the DSP to crash. All subsequent playback returns -EHOSTDOWN. The DSP crash is confirmed via debugfs: - /sys/kernel/debug/sof/fw_state — empty (cleared after crash) - /sys/kernel/debug/sof/fw_version — empty - /sys/kernel/debug/sof/exception — non-zero binary crash dump - /sys/kernel/debug/sof/fw_regs — first dword = 0x05 (exception state) Steps to reproduce: 1. Install Ubuntu 26.04 with firmware-sof-signed 2025.12.2-1 (default) 2. Boot kernel 7.0.0-22 or 7.0.0-27 on affected hardware 3. Attempt any audio playback 4. Observe: Playback open error: -112, Host is down; all subsequent playback attempts also fail with EHOSTDOWN until reboot Expected behaviour: The SOF driver should handle a topology file with a newer minor ABI version gracefully — parsing only the fields it understands (as done in 7.0.0-14) — without crashing the DSP. Workaround: Patching the 2-byte minor version field in /lib/firmware/intel/sof-ipc4-tplg/sof-hda-generic-2ch.tplg at offset 0x96 from 0x1d 0x00 (29) to 0x17 0x00 (23) causes the kernel to apply the 3:23:1 parsing path and audio works correctly on both 7.0.0-22 and 7.0.0-27. Hardware: ASUS Zenbook UX3405MA, Intel Core Ultra 7 155H (Meteor Lake-P), ALC294 HDA codec (SSID 1043:1A63), CS35L41 speaker amps (SPI, SSID 10431A63) Affected kernels: 7.0.0-22-generic, 7.0.0-27-generic Working kernel: 7.0.0-14-generic (via live CD) firmware-sof-signed: 2025.12.2-1 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-27-generic 7.0.0-27.27 ProcVersionSignature: Ubuntu 7.0.0-27.27-generic 7.0.6 Uname: Linux 7.0.0-27-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: jens 10150 F.... pipewire jens 10170 F.... wireplumber /dev/snd/seq: jens 10150 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Tue Jun 30 22:31:56 2026 InstallationDate: Installed on 2026-02-04 (146 days ago) InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007) MachineType: ASUSTeK COMPUTER INC. ASUS Zenbook 14 UX3405MA ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-27-generic root=UUID=5adc1058-8261-4c9f-877c-899756f0d609 ro quiet splash acpi_enforce_resources=lax crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-05-16 (45 days ago) dmi.bios.date: 06/06/2025 dmi.bios.release: 5.32 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: UX3405MA.311 dmi.board.asset.tag: ATN12345678901234567 dmi.board.name: UX3405MA dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: 1.0 dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: ASUSTeK COMPUTER INC. dmi.chassis.version: 1.0 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrUX3405MA.311:bd06/06/2025:br5.32:svnASUSTeKCOMPUTERINC.:pnASUSZenbook14UX3405MA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnUX3405MA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaASUSZenbook14: dmi.product.family: ASUS Zenbook 14 dmi.product.name: ASUS Zenbook 14 UX3405MA dmi.product.version: 1.0 dmi.sys.vendor: ASUSTeK COMPUTER INC. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2158818 Title: SOF IPC4 topology ABI mismatch causes DSP crash (EHOSTDOWN) — regression in 7.0.0-22 Status in linux package in Ubuntu: New Bug description: On ASUS Zenbook UX3405MA (Intel Core Ultra 7 155H / Meteor Lake-P), kernel versions 7.0.0-22 and 7.0.0-27 crash the SOF DSP on first audio playback attempt, making all wired audio (headphones, speakers) permanently silent until reboot. Bluetooth audio is unaffected. Hardware is confirmed good (Windows works; Ubuntu 26.04 live CD with kernel 7.0.0-14 works). Root cause: The installed firmware-sof-signed 2025.12.2-1 provides IPC4 topology files with ABI version 3:29:1. The kernel SOF driver reports its supported ABI as 3:23:1 and logs: sof-audio-pci-intel-mtl 0000:00:1f.3: Topology: ABI 3:29:1 Kernel ABI 3:23:1 On kernel 7.0.0-14 (confirmed from live CD) this mismatch is handled gracefully and audio works. Starting with 7.0.0-22, the kernel's IPC4 topology parser sends malformed pipeline configuration to the DSP firmware when it encounters the newer ABI, causing the DSP to crash. All subsequent playback returns -EHOSTDOWN. The DSP crash is confirmed via debugfs: - /sys/kernel/debug/sof/fw_state — empty (cleared after crash) - /sys/kernel/debug/sof/fw_version — empty - /sys/kernel/debug/sof/exception — non-zero binary crash dump - /sys/kernel/debug/sof/fw_regs — first dword = 0x05 (exception state) Steps to reproduce: 1. Install Ubuntu 26.04 with firmware-sof-signed 2025.12.2-1 (default) 2. Boot kernel 7.0.0-22 or 7.0.0-27 on affected hardware 3. Attempt any audio playback 4. Observe: Playback open error: -112, Host is down; all subsequent playback attempts also fail with EHOSTDOWN until reboot Expected behaviour: The SOF driver should handle a topology file with a newer minor ABI version gracefully — parsing only the fields it understands (as done in 7.0.0-14) — without crashing the DSP. Workaround: Patching the 2-byte minor version field in /lib/firmware/intel/sof-ipc4-tplg/sof-hda-generic-2ch.tplg at offset 0x96 from 0x1d 0x00 (29) to 0x17 0x00 (23) causes the kernel to apply the 3:23:1 parsing path and audio works correctly on both 7.0.0-22 and 7.0.0-27. Hardware: ASUS Zenbook UX3405MA, Intel Core Ultra 7 155H (Meteor Lake-P), ALC294 HDA codec (SSID 1043:1A63), CS35L41 speaker amps (SPI, SSID 10431A63) Affected kernels: 7.0.0-22-generic, 7.0.0-27-generic Working kernel: 7.0.0-14-generic (via live CD) firmware-sof-signed: 2025.12.2-1 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-27-generic 7.0.0-27.27 ProcVersionSignature: Ubuntu 7.0.0-27.27-generic 7.0.6 Uname: Linux 7.0.0-27-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: jens 10150 F.... pipewire jens 10170 F.... wireplumber /dev/snd/seq: jens 10150 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Tue Jun 30 22:31:56 2026 InstallationDate: Installed on 2026-02-04 (146 days ago) InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007) MachineType: ASUSTeK COMPUTER INC. ASUS Zenbook 14 UX3405MA ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-27-generic root=UUID=5adc1058-8261-4c9f-877c-899756f0d609 ro quiet splash acpi_enforce_resources=lax crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-05-16 (45 days ago) dmi.bios.date: 06/06/2025 dmi.bios.release: 5.32 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: UX3405MA.311 dmi.board.asset.tag: ATN12345678901234567 dmi.board.name: UX3405MA dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: 1.0 dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: ASUSTeK COMPUTER INC. dmi.chassis.version: 1.0 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrUX3405MA.311:bd06/06/2025:br5.32:svnASUSTeKCOMPUTERINC.:pnASUSZenbook14UX3405MA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnUX3405MA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaASUSZenbook14: dmi.product.family: ASUS Zenbook 14 dmi.product.name: ASUS Zenbook 14 UX3405MA dmi.product.version: 1.0 dmi.sys.vendor: ASUSTeK COMPUTER INC. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2158818/+subscriptions