audio: buffer: move dp_heap_user lifecycle to IPC and module adapter

The mod_heap_user (dp_heap_user) reference count management in
comp_buffer_free() does not belong there - a buffer's free method
should not be responsible for freeing a module's private heap.
Additionally, in CONFIG_SOF_USERSPACE_LL builds, comp_buffer_free()
may run in user-space context where rfree() of kernel-allocated
memory is not ok.

- Add dp_heap_put() helper to dp_schedule.h for reference-counted
  DP heap release
- Move buffer-side client_count decrements to IPC layer
  (ipc_comp_disconnect, ipc_pipeline_module_free, ipc_comp_connect
  error paths)
- Move raw data buffer client_count management to
  module_adapter_free/prepare with DP domain guard
- Fix module_adapter_mem_free() where CONFIG_SOF_USERSPACE_LL
  incorrectly reassigned mod_heap for DP modules
- Fix client_count increment guard in ipc_comp_connect() to check
  dp pointer rather than dp_heap

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>

Author: kv2019i

src/audio/buffers/comp_buffer.c

@@ -157,12 +157,6 @@ static void comp_buffer_free(struct sof_audio_buffer *audio_buffer)
 
 	sof_heap_free(heap, buffer->stream.addr);
 	sof_heap_free(heap, buffer);
-	if (heap) {
-		struct dp_heap_user *mod_heap_user = container_of(heap, struct dp_heap_user, heap);
-
-		if (!--mod_heap_user->client_count)
-			rfree(mod_heap_user);
-	}
 }
 
 APP_TASK_DATA static const struct source_ops comp_buffer_source_ops = {

src/audio/module_adapter/module_adapter.c

@@ -179,18 +179,15 @@ static void module_adapter_mem_free(struct processing_module *mod)
 	sof_heap_free(mod_heap, mod->dev);
 	LOG_INF("mod");
 #ifdef CONFIG_SOF_USERSPACE_LL
-	mod_heap = zephyr_ll_user_heap();
-	comp_cl_dbg(drv, "using ll user heap for module free");
+	if (domain != COMP_PROCESSING_DOMAIN_DP) {
+		mod_heap = zephyr_ll_user_heap();
+		comp_cl_dbg(drv, "using ll user heap for module free");
+	}
 #endif
 	comp_cl_info(drv, "free mod %p with heap %p", mod, mod_heap);
 	sof_heap_free(mod_heap, mod);
-	if (domain == COMP_PROCESSING_DOMAIN_DP) {
-		struct dp_heap_user *mod_heap_user = container_of(mod_heap, struct dp_heap_user,
-								  heap);
-
-		if (mod_heap && !--mod_heap_user->client_count)
-			rfree(mod_heap_user);
-	}
+	if (domain == COMP_PROCESSING_DOMAIN_DP && mod_heap)
+		dp_heap_put(mod_heap);
 }
 
 /*
@@ -641,7 +638,8 @@ int module_adapter_prepare(struct comp_dev *dev)
 				goto free;
 			}
 
-			if (md->resources.heap && md->resources.heap != dev->drv->user_heap) {
+			if (dev->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP &&
+			    md->resources.heap) {
 				struct dp_heap_user *dp_user = container_of(md->resources.heap,
 									    struct dp_heap_user,
 									    heap);
@@ -687,6 +685,9 @@ int module_adapter_prepare(struct comp_dev *dev)
 		list_item_del(&buffer->buffers_list);
 		irq_local_enable(flags);
 		buffer_free(buffer);
+		if (dev->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP &&
+		    md->resources.heap)
+			dp_heap_put(md->resources.heap);
 	}
 
 out_data_free:
@@ -1479,6 +1480,9 @@ void module_adapter_free(struct comp_dev *dev)
 		list_item_del(&buffer->buffers_list);
 		irq_local_enable(flags);
 		buffer_free(buffer);
+		if (dev->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP &&
+		    mod->priv.resources.heap)
+			dp_heap_put(mod->priv.resources.heap);
 	}
 
 	mod_free(mod, mod->stream_params);

src/include/sof/schedule/dp_schedule.h

@@ -8,6 +8,7 @@
 #ifndef __SOF_SCHEDULE_DP_SCHEDULE_H__
 #define __SOF_SCHEDULE_DP_SCHEDULE_H__
 
+#include <rtos/alloc.h>
 #include <rtos/task.h>
 #include <sof/trace/trace.h>
 #include <user/trace.h>
@@ -125,6 +126,22 @@ struct dp_heap_user {
 	unsigned int client_count;	/* devices and buffers */
 };
 
+/**
+ * dp_heap_put() - Release a reference to a DP module heap.
+ * @heap: The k_heap pointer belonging to a dp_heap_user.
+ *
+ * Decrements client_count and frees the dp_heap_user when it reaches zero.
+ * Must only be called for heaps that are part of a dp_heap_user, i.e. heaps
+ * allocated by module_adapter_dp_heap_new() for DP domain modules.
+ */
+static inline void dp_heap_put(struct k_heap *heap)
+{
+	struct dp_heap_user *mod_heap_user = container_of(heap, struct dp_heap_user, heap);
+
+	if (!--mod_heap_user->client_count)
+		rfree(mod_heap_user);
+}
+
 #if CONFIG_ZEPHYR_DP_SCHEDULER
 int scheduler_dp_thread_ipc(struct processing_module *pmod, unsigned int cmd,
 			    const union scheduler_dp_thread_ipc_param *param);

src/ipc/ipc4/helper.c

@@ -457,22 +457,51 @@ __cold static int ipc_pipeline_module_free(uint32_t pipeline_id)
 
 		/* free sink buffer allocated by current component in bind function */
 		comp_dev_for_each_consumer_safe(icd->cd, buffer, safe) {
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+			struct k_heap *buf_heap = buffer->audio_buffer.heap;
+			struct comp_dev *orig_sink = comp_buffer_get_sink_component(buffer);
+			bool buf_is_dp = buf_heap &&
+				(icd->cd->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP ||
+				 (orig_sink && orig_sink->ipc_config.proc_domain ==
+				  COMP_PROCESSING_DOMAIN_DP));
+#endif
+
 			pipeline_disconnect(icd->cd, buffer, PPL_CONN_DIR_COMP_TO_BUFFER);
 			struct comp_dev *sink = comp_buffer_get_sink_component(buffer);
 
 			/* free the buffer only when the sink module has also been disconnected */
-			if (!sink)
+			if (!sink) {
 				buffer_free(buffer);
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+				if (buf_is_dp)
+					dp_heap_put(buf_heap);
+#endif
+			}
 		}
 
 		/* free source buffer allocated by current component in bind function */
 		comp_dev_for_each_producer_safe(icd->cd, buffer, safe) {
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+			struct k_heap *buf_heap = buffer->audio_buffer.heap;
+			struct comp_dev *orig_source =
+				comp_buffer_get_source_component(buffer);
+			bool buf_is_dp = buf_heap &&
+				(icd->cd->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP ||
+				 (orig_source && orig_source->ipc_config.proc_domain ==
+				  COMP_PROCESSING_DOMAIN_DP));
+#endif
+
 			pipeline_disconnect(icd->cd, buffer, PPL_CONN_DIR_BUFFER_TO_COMP);
 			struct comp_dev *source = comp_buffer_get_source_component(buffer);
 
 			/* free the buffer only when the source module has also been disconnected */
-			if (!source)
+			if (!source) {
 				buffer_free(buffer);
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+				if (buf_is_dp)
+					dp_heap_put(buf_heap);
+#endif
+			}
 		}
 
 		if (!cpu_is_me(icd->core))
@@ -738,7 +767,7 @@ __cold int ipc_comp_connect(struct ipc *ipc, ipc_pipe_comp_connect *_connect)
 	}
 
 #if CONFIG_ZEPHYR_DP_SCHEDULER
-	if (dp_heap) {
+	if (dp) {
 		struct dp_heap_user *dp_user = container_of(dp_heap, struct dp_heap_user, heap);
 
 		dp_user->client_count++;
@@ -782,6 +811,8 @@ __cold int ipc_comp_connect(struct ipc *ipc, ipc_pipe_comp_connect *_connect)
 						 buf_get_id(buffer));
 		if (!ring_buffer) {
 			buffer_free(buffer);
+			if (dp)
+				dp_heap_put(dp_heap);
 			return IPC4_OUT_OF_MEMORY;
 		}
 
@@ -869,6 +900,10 @@ __cold int ipc_comp_connect(struct ipc *ipc, ipc_pipe_comp_connect *_connect)
 free:
 	ll_unblock(cross_core_bind, flags);
 	buffer_free(buffer);
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+	if (dp)
+		dp_heap_put(dp_heap);
+#endif
 	return IPC4_INVALID_RESOURCE_STATE;
 }
 
@@ -950,6 +985,13 @@ __cold int ipc_comp_disconnect(struct ipc *ipc, ipc_pipe_comp_connect *_connect)
 #endif
 	}
 
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+	struct k_heap *buf_heap = buffer->audio_buffer.heap;
+	bool buf_is_dp = buf_heap &&
+		(src->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP ||
+		 sink->ipc_config.proc_domain == COMP_PROCESSING_DOMAIN_DP);
+#endif
+
 	pipeline_disconnect(src, buffer, PPL_CONN_DIR_COMP_TO_BUFFER);
 	pipeline_disconnect(sink, buffer, PPL_CONN_DIR_BUFFER_TO_COMP);
 	/* these might call comp_ipc4_bind_remote() if necessary */
@@ -965,6 +1007,10 @@ __cold int ipc_comp_disconnect(struct ipc *ipc, ipc_pipe_comp_connect *_connect)
 	ll_unblock(cross_core_unbind, flags);
 
 	buffer_free(buffer);
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+	if (buf_is_dp)
+		dp_heap_put(buf_heap);
+#endif
 
 	if (ret || ret1)
 		return IPC4_INVALID_RESOURCE_ID;