ASoC: qcom: add Surface Pro 11 Golden v33 protected playback

[ooaklee]

Summary

• add the opt-in Surface Pro 11 Denali WSA8845 VI/CPS feedback paths required by FullIO protected speaker playback
• teach SoundWire and AudioReach to consume the FullIO v19c protected-render topology through graph-scoped state and configuration
• contain the new DAIs, transport metadata, 2S/4-ohm amplifier profile, and protection-clock coordination to Denali and explicitly opted-in amplifiers
• harden command correlation, teardown, PA completion, and the confirmed DSP bypass path so uncertain state is not reused

Series, base, and dependencies

This PR targets jg/ubuntu-qcom-x1e-7.2.y directly and follows the ordered SP11 release-line topics:

• arm64: dts: qcom: x1-denali: add volume keys #82 — Denali volume keys
• SP11: add protocol-9 QSPI and OF-only MSHW0485 touch #83 — protocol-9 QSPI and direct-touch core
• Input: mshw0485: add opt-in pen userspace interfaces #84 — default-off pen userspace ABI
• media: i2c: add Sony IMX681 sensor support #85 — Sony IMX681 sensor
• media: qcom: add X1E80100 C-PHY camera receive support #86 — X1E80100 C-PHY camera receive support
• arm64: dts: qcom: x1e80100-denali-oled: enable front camera #87 — Denali OLED front-camera graph
• ASoC: qcom: add Surface Pro 11 TX DMIC capture #88 — TX DMIC capture

#88 is the immediate prerequisite. This branch is based directly on the release branch; it does not merge any prerequisite head, the broad -sp11 staging branch, or the staging correction merged through #81.

• base: 032e174490d2ede881771cb368e86540b3a8818b
• head: 766f34d63900cf897ed9902005c5a5bac1b1ec5b
• final tree: b2c7e8c5f1c5be3b9cd5b72db3622fd305c0ec75
• range: 19 linear commits, 22 files, 4,265 insertions, 365 deletions

The bindings and providers precede their consumers, and the two Denali DTS activation commits are last. Reordering changed commit hashes only: the final tree is byte-identical to the reviewed pre-reorder combined head d803e8c2c9173d494420fd5773858f513bf67843.

This PR is intentionally a draft. It must not be marked ready until its dependencies, personal author attestation, exact package build, paired userspace policy, and SP11/non-SP11 hardware gates below are complete.

FullIO v19c userspace pairing and volume safety

Protected playback must be tested with the immutable FullIO v19c UCM source and the sp11-audio-v19c release, whose target commit is 2f97c3d672c7c28acfe39173679a9924489b3c69.

Release asset	SHA-256
X1E80100-Microsoft-Surface-Pro-11-tplg.bin	e7bb06a03e7bd9b869825a51775355a6743477d1579d78eb09fad5881cfb20f0
MICROSOFT-Surface-Pro-11in.conf	225976f925624f156d9fab84e15a5126a60a236783cfcb82d43d2a2aec028d7b
SP11-HiFi.conf	9d36df8570b85f1dcecc385a8f85fa2d1e1058ef8efedee6ae2ce49dc259a06a

The topology contains protected/vendor-derived data and remains an external userspace artifact; it is not copied into this kernel PR.

There is one deliberate safety difference that must remain visible during review. The v19c UCM requests PA volume 24, while this focused kernel retains the release-line limit of 6 (0 dB). With alsa-lib 1.2.14, UCM cset is passed through snd_ctl_ascii_value_parse(), whose integer parser clamps values to the control's advertised range; the request should therefore resolve to 6 rather than program 24. Hardware testing must verify that behavior instead of assuming it.

For the first hardware pass, use a separately pinned test copy of SP11-HiFi.conf that changes only its four PA-volume requests from 24 to 6, record its digest, and confirm with amixer cget that both controls advertise a maximum of 6 and hold an effective value of 6. This validates protected playback at the retained cap; it does not establish acoustic or production-volume parity with v19c. Any proposal to expose 24 belongs in a later Denali-only safety change, must retain the limit of 6 for other devices, and needs its own acoustic, thermal, fault, and bypass review.

Containment and failure behavior

• the board graph is selected by microsoft,denali-sndcard; only the common Denali description adds WSA VI/CPS links
• only the two Denali WSA8845 nodes opt into CPS, transport metadata, and qcom,speaker-load-ohms = <4>
• the 4-ohm profile is selected only after a fresh 2S VPHX classification; absent or mismatched properties retain the existing 8-ohm/default profile
• Qualcomm companion feedback DAIs are limited to the Denali root compatible, WSA controller, and DAI IDs 9 and 10; generic SoundWire transport fields default to zero
• the WSA macro adds its feedback graph only on Denali, and WSA8845 exposes feedback DAIs only for explicitly opted-in codec nodes
• PA accounting, protection clocks, OOB state, VI/CPS readiness, and protected-render state are owned by the relevant macro or AudioReach graph, not global module state
• ordinary and protected modes are immutable for the lifetime of a shared graph; an incompatible reuse attempt fails with -EBUSY
• malformed or partial protected topology profiles fail closed
• a complete protected profile may use only its topology-derived SP/SPVI bypass when protected setup, calibration, VI, or CPS is unavailable; playback start is refused if the DSP does not confirm that bypass
• uncertain map, SET_CFG, unmap, stop, or close ownership quarantines the affected callback/client/DMA state rather than allowing reuse before reboot or a future proven reset hook
• compressed and non-Denali paths retain the ordinary behavior when the protected tokens and Denali markers are absent

The extraction deliberately omits global readiness statics, diagnostic module parameters, hard-coded diagnostic or volume module-instance IDs, soft-pause support, and wholesale driver-file replay.

PA completion hardening

For an opted-in protected amplifier, feedback startup now requires a freshly confirmed 2S/4-ohm profile. PA unmute checks both register writes, waits 1–1.1 ms, reads PA_FSM_STA1, and publishes the macro PA event only when the status read succeeds without an error bit. A failure rolls back DRE and global PA enable and does not advance paired-PA clock state.

The ASoC core may ignore a codec mute_stream return value, so an ALSA start call can still appear successful while this path has correctly left the hardware disabled. The hardware gate must therefore inspect playback, mixer state, and kernel logs rather than treating the start syscall alone as proof of PA readiness.

Provenance and DCO

The focused history preserves authorship according to the substantive source:

• 13 commits retain geoca <272055834+geocausa@users.noreply.github.com> and their verified source author dates
• 6 containment/integration commits retain Leon Silcott <leon@boasi.io>
• each derived commit links to immutable source and integration revisions and includes a factual [Leon: ...] note where the extraction changed structure or containment

The reordered history preserves every author identity, author date, commit body, stable patch ID, and all 48 immutable Link: trailers from the reviewed pre-reorder series.

Every rewritten commit carries exactly one authorized Signed-off-by: Leon Silcott <leon@boasi.io> from the submitter. No personal geoca sign-off exists in the immutable source commits, so none has been invented. Raw strict checkpatch consequently reports NO_AUTHOR_SIGN_OFF for the 13 geoca-authored commits. I will ask @geocausa to attest to the rewritten commits personally before this draft is marked ready.

Validation completed at the exact head

• git diff --check 032e174490d2ede881771cb368e86540b3a8818b..766f34d63900cf897ed9902005c5a5bac1b1ec5b: pass
• 19 per-commit strict checkpatch runs with only NO_AUTHOR_SIGN_OFF excluded: 0 errors, 0 warnings, 0 checks; raw strict output contains only the 13 documented nominal-author findings
• independent history audit: 19 linear commits, no merges, direct merge base, 13/6 author split, exactly one Leon sign-off per commit, no other sign-off, all 48 links preserved, and final tree identical to the pre-reorder tree
• ARM64 ubuntu_x1e_defconfig W=1 builds of APR, SoundWire bus/controller/stream, WSA macro, WSA8845, AudioReach, Q6APM, LPASS port, topology, and X1E80100 machine-driver objects: pass
• built-in/module compile coverage for all six WSA8845/WSA-macro y, m, and disabled combinations: pass
• modified qcom,sm8250.yaml and qcom,wsa8840.yaml binding/schema checks: pass, apart from unrelated pre-existing warnings
• x1e80100-microsoft-denali-oled.dtb, x1p64100-microsoft-denali.dtb, and non-SP11 x1e80100-dell-xps13-9345.dtb: pass
• lifecycle/source audit of command correlation, teardown, graph-mode immutability, OOB ownership, confirmed bypass, 2S/default restoration, PA rollback, duplicate events, and per-macro clock ordering: pass
• source audit confirming that non-Denali devices retain existing DAI, transport, amplifier-profile, and PA defaults: pass
• public commit/body leakage scans: pass

A focused partial-module build cannot provide meaningful final modpost coverage without the complete kernel's vmlinux and Module.symvers; no full exact-head package or full modpost result is claimed here.

Remaining draft gates

• merge or otherwise resolve the ordered prerequisite PRs through ASoC: qcom: add Surface Pro 11 TX DMIC capture #88
• obtain @geocausa's personal attestation for the 13 rewritten commits attributed to geoca
• pin and hash the PA-volume-6 test UCM described above
• build the complete exact-head kernel package set and retain its provenance and hashes
• complete full-tree linkage/modpost validation
• complete the SP11 and non-SP11 hardware matrices below and attach relevant logs

SP11 hardware gates

• boot packages built from exact head 766f34d63900cf897ed9902005c5a5bac1b1ec5b with the pinned FullIO topology and PA-volume-6 test UCM
• verify both PA controls advertise and retain maximum/effective value 6 before any acoustic test; begin at low user-facing volume
• verify normal left/right speaker playback, balance, volume changes, mute/unmute, and clean open/close
• confirm VI and CPS become ready for the same AudioReach graph before protected setup, with no graph-calibration, OOB-map, SoundWire, underrun, or -ENODEV error
• confirm both amplifiers report 2S before the 4-ohm profile is selected, and both PA completion events precede protection-clock enable
• verify clocks stop before the first PA is torn down and remain balanced over repeated Speaker enable/disable and playback start/stop cycles
• in controlled low-volume negative tests, make each protection prerequisite unavailable in turn and confirm only a DSP-confirmed bypass can start; an unconfirmed bypass must leave the PA disabled
• exercise amplifier fault/recovery, suspend/resume, DSP PDR/recovery, driver reprobe where safe, and reboot; check for pops, stuck clocks, channel loss, stale graph state, leaks, thermal warnings, or unbounded retries
• repeat the playback smoke test on each supported SP11 variant for which hardware is available

Non-SP11 hardware gates

• boot the exact head on at least one non-Denali X1E device exercising the touched AudioReach and Qualcomm SoundWire paths
• verify ordinary topology loading plus playback/capture open, close, suspend, resume, DSP PDR/recovery, and safe reprobe remain unchanged when FullIO protected tokens are absent
• exercise compressed/offload playback as well as ordinary PCM so the protected graph-mode changes cannot silently capture those paths
• verify no Denali VI/CPS backend, companion DAI, protection OOB setup, 4-ohm profile, or paired-PA clock coordination activates
• verify a WSA884x device without the opt-in properties retains its existing DAI table, SoundWire ports, 8-ohm/default profile, and PA lifecycle; use a second device if the X1E cross-check does not contain WSA884x

[ooaklee]

Follow-up validation for the SP11 7.2.2 retrospective:

• This PR head is now 61c0ef0695da.
• The follow-up accepts valid AudioReach modules with more than eight input ports while retaining the fixed-array output-port bound. This matches the SP11 FullIO v19c sp11.sal.4001 topology, which declares ten inputs.
• The combined demonstration target (sp11/ubuntu-qcom-x1e-7.2.y-target, b807d9e52ac9) and retrospective branch (sp11/ubuntu-qcom-x1e-7.2.y-target-fix-pt-2, dd928de48c03) include this change.
• A clean Lexr container build from the pushed retrospective branch completed successfully as 7.2.2-jg-0sp11v2-qcom-x1e; snd-q6apm.ko.zst and snd-soc-x1e80100.ko.zst are present in the resulting bundle.

The microphone did not need a separate route patch: the reported failure occurs because the whole card aborts topology loading at sp11.sal.4001; the target already retains its TX/VA capture paths. This is build/package validation, so playback and capture still require a physical boot test.