ipc: protect kernel IPC state in user LL/DP builds - #11439

The IPC processing task is run by the kernel EDF or TWB scheduler,
which calls through its ops and reads its scheduling state. With
CONFIG_SOF_USERSPACE_LL it is embedded in struct ipc, which LL and IPC
user threads can write, so a user thread could redirect kernel
execution through it.

Move it to struct ipc_kstate when CONFIG_SOF_USERSPACE_LL is set.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>

With CONFIG_SOF_USERSPACE_LL, ipc->comp_data is in user-writable struct
ipc. Kernel code builds replies from this buffer and passes it to
ipc_msg_send(), which copies it into the reply message when the two
pointers differ, so a user thread could redirect a kernel memory copy
or make the kernel send other memory to the host. The reply to a
forwarded LARGE_CONFIG_GET also took its payload pointer and size from
struct ipc_user, which user threads can write.

Keep a copy of the buffer pointer in struct ipc_kstate and use it in
the kernel paths. For forwarded LARGE_CONFIG_GET replies, always reply
from this buffer, where the IPC user thread writes the reply, and check
the size read from struct ipc_user once against the message and mailbox
limits.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>

The ipc_msg_send system call linked the struct ipc_msg of the calling
user thread into the kernel send queue. The send work queue then called
msg->callback in supervisor mode and read the header, size and payload
pointer from user memory, all of which the thread can change at any
time. A DP module thread could use this to run any kernel code or to
corrupt the kernel queue. The validator also faulted a thread that sent
a message again while it was still queued, which modules such as tdfb
and mfcc do.

Copy the header and payload once into a kernel-owned slot instead and
queue the slot. The slot is found again by the address of the user
message and the memory domain of the sender, neither of which is
dereferenced. Sending a message that is still queued updates the
queued copy, which matches the in-place update done for kernel
messages. ipc_msg_list_remove now removes the matching slot, and does
nothing if there is none. User messages are limited to
CONFIG_SOF_IPC_USER_MSG_MAX_SIZE bytes, and a message is dropped if all
CONFIG_SOF_IPC_USER_MSG_SLOTS slots are in use.

Add ipc_user_msg_purge() for dropping the queued messages of a memory
domain before it is reused.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>

DP memory domains and userspace proxy domains are reused for new
modules. Drop the messages that the threads of a freed domain still
have queued, so that they are not sent on behalf of a module that no
longer exists, and not matched to messages of the next module using
the domain.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>

Check that the kernel queues its own copy of a message sent by a user
thread: changing the user message after sending it, or forging its
list pointers and callback, has no effect on the queued message, a
message sent again while queued is updated in place, and messages are
removed only by their own memory domain. Also check that oversized
messages and kernel payload addresses are rejected, and that the
number of queued messages is limited to the number of slots.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>

Describe how messages sent by user threads are copied to kernel-owned
slots, how they are matched for re-send and removal, and that the IPC
send queue state is kernel-only with CONFIG_SOF_USERSPACE_LL.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>