ipc: make IPC message allocation userspace-safe

Add an optional heap parameter to ipc_msg_w_ext_init() and
ipc_msg_init() so callers can direct allocations to a specific
heap. When the heap argument is NULL the existing rzalloc()
path is used; when non-NULL, sof_heap_alloc()/sof_heap_free()
are used instead. This allows IPC messages to be allocated from
userspace-accessible heaps.

For audio module contexts, introduce mod_ipc_msg_w_ext_init()
and mod_ipc_msg_init() in generic.h. These use mod_zalloc()/
mod_free() for allocations that are automatically tracked and
freed with the module lifecycle.

ipc_msg_w_ext_init() is moved from a static inline in msg.h to
a non-inline function in ipc-common.c due to the additional
sof_heap_alloc dependency.

Update all existing callers:
- Module context callers (cadence, sound_dose, tdfb, mfcc) use
  the new mod_ipc_msg_*() variants and mod_ipc_msg_free().
- host-zephyr.c uses hd->heap, pipeline-graph.c uses the heap
  parameter from pipeline_new().
- Remaining kernel-context callers pass NULL for the default
  heap.

Signed-off-by: Jyri Sarha <jyri.sarha@linux.intel.com>

Author: Jyri Sarha

src/audio/google/google_hotword_detect.c

@@ -111,7 +111,7 @@ static struct comp_dev *ghd_create(const struct comp_driver *drv,
 	cd->event.event_type = SOF_CTRL_EVENT_KD;
 	cd->event.num_elems = 0;
 
-	cd->msg = ipc_msg_init(cd->event.rhdr.hdr.cmd, cd->event.rhdr.hdr.size);
+	cd->msg = ipc_msg_init(NULL, cd->event.rhdr.hdr.cmd, cd->event.rhdr.hdr.size);
 	if (!cd->msg) {
 		comp_err(dev, "ipc_msg_init failed");
 		goto cd_fail;

src/audio/host-legacy.c

@@ -559,7 +559,7 @@ int host_common_new(struct host_data *hd, struct comp_dev *dev,
 	ipc_build_stream_posn(&hd->posn, SOF_IPC_STREAM_POSITION, config_id);
 
 #if CONFIG_HOST_DMA_IPC_POSITION_UPDATES
-	hd->msg = ipc_msg_init(hd->posn.rhdr.hdr.cmd, hd->posn.rhdr.hdr.size);
+	hd->msg = ipc_msg_init(NULL, hd->posn.rhdr.hdr.cmd, hd->posn.rhdr.hdr.size);
 	if (!hd->msg) {
 		comp_err(dev, "ipc_msg_init failed");
 		dma_put(hd->dma);

src/audio/host-zephyr.c

@@ -727,7 +727,7 @@ __cold int host_common_new(struct host_data *hd, struct comp_dev *dev,
 	ipc_build_stream_posn(&hd->posn, SOF_IPC_STREAM_POSITION, config_id);
 
 #if CONFIG_HOST_DMA_IPC_POSITION_UPDATES
-	hd->msg = ipc_msg_init(hd->posn.rhdr.hdr.cmd, sizeof(hd->posn));
+	hd->msg = ipc_msg_init(hd->heap, hd->posn.rhdr.hdr.cmd, sizeof(hd->posn));
 	if (!hd->msg) {
 		comp_err(dev, "ipc_msg_init failed");
 		sof_dma_put(hd->dma);

src/audio/mfcc/mfcc.c

@@ -129,7 +129,7 @@ static int mfcc_free(struct processing_module *mod)
 	struct mfcc_comp_data *cd = module_get_private_data(mod);
 
 	comp_info(mod->dev, "entry");
-	ipc_msg_free(cd->msg);
+	mod_ipc_msg_free(mod, cd->msg);
 	cd->msg = NULL;
 	mod_data_blob_handler_free(mod, cd->model_handler);
 	mfcc_free_buffers(mod);

src/audio/mfcc/mfcc_ipc4.c

@@ -49,10 +49,10 @@ int mfcc_ipc_notification_init(struct processing_module *mod)
 	primary->r.type = SOF_IPC4_GLB_NOTIFICATION;
 	primary->r.rsp = SOF_IPC4_MESSAGE_DIR_MSG_REQUEST;
 	primary->r.msg_tgt = SOF_IPC4_MESSAGE_TARGET_FW_GEN_MSG;
-	cd->msg = ipc_msg_w_ext_init(msg_proto.header, msg_proto.extension,
-				     sizeof(struct sof_ipc4_notify_module_data) +
-				     sizeof(struct sof_ipc4_control_msg_payload) +
-				     sizeof(struct sof_ipc4_ctrl_value_chan));
+	cd->msg = mod_ipc_msg_w_ext_init(mod, msg_proto.header, msg_proto.extension,
+					 sizeof(struct sof_ipc4_notify_module_data) +
+					 sizeof(struct sof_ipc4_control_msg_payload) +
+					 sizeof(struct sof_ipc4_ctrl_value_chan));
 	if (!cd->msg) {
 		comp_err(dev, "Failed to initialize VAD notification");
 		return -ENOMEM;

src/audio/module_adapter/module/cadence_ipc4.c

@@ -233,7 +233,7 @@ static struct ipc_msg *cadence_codec_notification_init(struct processing_module
 	primary.r.type = SOF_IPC4_GLB_NOTIFICATION;
 	primary.r.rsp = SOF_IPC4_MESSAGE_DIR_MSG_REQUEST;
 	primary.r.msg_tgt = SOF_IPC4_MESSAGE_TARGET_FW_GEN_MSG;
-	msg = ipc_msg_w_ext_init(primary.dat, 0, sizeof(*msg_module_data));
+	msg = mod_ipc_msg_w_ext_init(mod, primary.dat, 0, sizeof(*msg_module_data));
 	if (!msg)
 		return NULL;
 
@@ -366,7 +366,7 @@ static int cadence_codec_init(struct processing_module *mod)
 	if (setup_cfg)
 		mod_free(mod, setup_cfg->data);
 free_notification:
-	ipc_msg_free(cd->msg);
+	mod_ipc_msg_free(mod, cd->msg);
 free_cd:
 	mod_free(mod, cd);
 
@@ -568,7 +568,7 @@ static int ipc4_cadence_codec_free(struct processing_module *mod)
 {
 	struct cadence_codec_data *cd = module_get_private_data(mod);
 
-	ipc_msg_free(cd->msg);
+	mod_ipc_msg_free(mod, cd->msg);
 
 	return cadence_codec_free(mod);
 }

src/audio/pipeline/pipeline-graph.c

@@ -227,7 +227,7 @@ struct pipeline *pipeline_new(struct k_heap *heap, uint32_t pipeline_id, uint32_
 	ipc_build_stream_posn(&posn, SOF_IPC_STREAM_TRIG_XRUN, p->comp_id);
 
 	if (posn.rhdr.hdr.size) {
-		p->msg = ipc_msg_init(posn.rhdr.hdr.cmd, posn.rhdr.hdr.size);
+		p->msg = ipc_msg_init(heap, posn.rhdr.hdr.cmd, posn.rhdr.hdr.size);
 		if (!p->msg) {
 			pipe_err(p, "ipc_msg_init failed");
 			goto free;

src/audio/sound_dose/sound_dose-ipc4.c

@@ -32,9 +32,9 @@ static struct ipc_msg *sound_dose_notification_init(struct processing_module *mo
 	primary->r.type = SOF_IPC4_GLB_NOTIFICATION;
 	primary->r.rsp = SOF_IPC4_MESSAGE_DIR_MSG_REQUEST;
 	primary->r.msg_tgt = SOF_IPC4_MESSAGE_TARGET_FW_GEN_MSG;
-	msg = ipc_msg_w_ext_init(msg_proto.header, msg_proto.extension,
-				 sizeof(struct sof_ipc4_notify_module_data) +
-				 sizeof(struct sof_ipc4_control_msg_payload));
+	msg = mod_ipc_msg_w_ext_init(mod, msg_proto.header, msg_proto.extension,
+				     sizeof(struct sof_ipc4_notify_module_data) +
+				     sizeof(struct sof_ipc4_control_msg_payload));
 	if (!msg)
 		return NULL;
 

src/audio/sound_dose/sound_dose.c

@@ -327,7 +327,7 @@ __cold static int sound_dose_free(struct processing_module *mod)
 	comp_dbg(mod->dev, "entry");
 
 	sound_dose_filters_free(cd);
-	ipc_msg_free(cd->msg);
+	mod_ipc_msg_free(mod, cd->msg);
 	rfree(cd->abi);
 	rfree(cd);
 	return 0;

src/audio/tdfb/tdfb.c

@@ -676,7 +676,7 @@ static int tdfb_init(struct processing_module *mod)
 err:
 	/* These are null if not used for IPC version */
 	mod_free(mod, cd->ctrl_data);
-	ipc_msg_free(cd->msg);
+	mod_ipc_msg_free(mod, cd->msg);
 	mod_data_blob_handler_free(mod, cd->model_handler);
 
 err_free_cd:
@@ -691,7 +691,7 @@ static int tdfb_free(struct processing_module *mod)
 
 	comp_dbg(mod->dev, "entry");
 
-	ipc_msg_free(cd->msg);
+	mod_ipc_msg_free(mod, cd->msg);
 	tdfb_free_delaylines(mod);
 	mod_data_blob_handler_free(mod, cd->model_handler);
 	tdfb_direction_free(mod);