From 2298bbfdb32cd88cfe08e6a80d565c9c77e5f3dd Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 12:11:54 +0300
Subject: [PATCH 01/13] ipc: place global IPC context in user-accessible memory
 for user-space LL

When CONFIG_SOF_USERSPACE_LL is enabled the IPC context must live in
user-accessible application memory rather than being allocated from the
kernel heap and reached via sof->ipc. Place struct ipc in a dedicated
K_APP_BMEM partition and provide an out-of-line ipc_get() returning it;
drop the sof->ipc pointer in this configuration.

Add the generic ll_alloc allocation context to struct ipc and set it up
in ipc_init() from the LL user heap, so LL components (host, dai,
chain_dma) can allocate their buffers from a user-accessible heap. IPC
objects (the context itself and comp_data) are allocated accordingly.
A no-op ipc_user_init() stub is added here and implemented later.

No IPC-major-specific knowledge is added here.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/sof/ipc/common.h | 12 ++++++
 src/ipc/ipc-common.c         | 84 ++++++++++++++++++++++++++++--------
 zephyr/include/rtos/sof.h    |  2 +
 3 files changed, 81 insertions(+), 17 deletions(-)

diff --git a/src/include/sof/ipc/common.h b/src/include/sof/ipc/common.h
index e46fc10b9521..a562e960b705 100644
--- a/src/include/sof/ipc/common.h
+++ b/src/include/sof/ipc/common.h
@@ -74,6 +74,10 @@ struct ipc {
 	struct task ipc_task;
 #endif
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+	struct mod_alloc_ctx *ll_alloc;
+#endif
+
 #ifdef CONFIG_SOF_TELEMETRY_IO_PERFORMANCE_MEASUREMENTS
 	/* io performance measurement */
 	struct io_perf_data_item *io_perf_in_msg_count;
@@ -95,6 +99,12 @@ struct ipc {
 
 extern struct task_ops ipc_task_ops;
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+
+struct ipc *ipc_get(void);
+
+#else
+
 /**
  * \brief Get the IPC global context.
  * @return The global IPC context.
@@ -104,6 +114,8 @@ static inline struct ipc *ipc_get(void)
 	return sof_get()->ipc;
 }
 
+#endif /* CONFIG_SOF_USERSPACE_LL */
+
 /**
  * \brief Initialise global IPC context.
  * @param[in,out] sof Global SOF context.
diff --git a/src/ipc/ipc-common.c b/src/ipc/ipc-common.c
index d0d248c9ec77..908e6e9cdbfd 100644
--- a/src/ipc/ipc-common.c
+++ b/src/ipc/ipc-common.c
@@ -24,6 +24,8 @@
 #include <sof/lib/memory.h>
 #include <sof/list.h>
 #include <sof/platform.h>
+#include <sof/schedule/ll_schedule.h>
+#include <sof/schedule/ll_schedule_domain.h>
 #include <rtos/sof.h>
 #include <rtos/spinlock.h>
 #include <ipc/dai.h>
@@ -35,6 +37,14 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#ifdef __ZEPHYR__
+#include <zephyr/kernel.h>
+#endif
+
+#ifdef CONFIG_SOF_USERSPACE_LL
+#include <rtos/userspace_helper.h>
+#endif
+
 #include <sof/debug/telemetry/performance_monitor.h>
 
 LOG_MODULE_REGISTER(ipc, CONFIG_SOF_LOG_LEVEL);
@@ -43,6 +53,17 @@ SOF_DEFINE_REG_UUID(ipc);
 
 DECLARE_TR_CTX(ipc_tr, SOF_UUID(ipc_uuid), LOG_LEVEL_INFO);
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+K_APPMEM_PARTITION_DEFINE(ipc_context_part);
+
+K_APP_BMEM(ipc_context_part) static struct ipc ipc_context;
+
+struct ipc *ipc_get(void)
+{
+	return &ipc_context;
+}
+#endif
+
 int ipc_process_on_core(uint32_t core, bool blocking)
 {
 	struct ipc *ipc = ipc_get();
@@ -288,34 +309,60 @@ void ipc_schedule_process(struct ipc *ipc)
 #endif
 }
 
+static void ipc_user_init(void)
+{
+}
+
 __cold int ipc_init(struct sof *sof)
 {
+	struct k_heap *heap;
+	struct ipc *ipc;
+
 	assert_can_be_cold();
 
 	tr_dbg(&ipc_tr, "entry");
 
 #if CONFIG_SOF_BOOT_TEST_STANDALONE
-	LOG_INF("SOF_BOOT_TEST_STANDALONE, disabling IPC.");
+	LOG_INF("SOF_BOOT_TEST_STANDALONE, skipping platform IPC init.");
 	return 0;
 #endif
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+	heap = zephyr_ll_user_heap();
+
+	ipc = ipc_get();
+	memset(ipc, 0, sizeof(*ipc));
+	ipc->ll_alloc = sof_heap_alloc(heap, SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
+				       sizeof(*ipc->ll_alloc), 0);
+	if (!ipc->ll_alloc) {
+		tr_err(&ipc_tr, "Unable to allocate IPC ll_alloc");
+		sof_panic(SOF_IPC_PANIC_IPC);
+	}
+	ipc->ll_alloc->heap = heap;
+	ipc->ll_alloc->vreg = NULL;
+#else
+	heap = NULL;
+
 	/* init ipc data */
-	sof->ipc = rzalloc(SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT, sizeof(*sof->ipc));
-	if (!sof->ipc) {
+	ipc = rzalloc(SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT, sizeof(*ipc));
+	if (!ipc) {
 		tr_err(&ipc_tr, "Unable to allocate IPC data");
 		return -ENOMEM;
 	}
-	sof->ipc->comp_data = rzalloc(SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
-				      SOF_IPC_MSG_MAX_SIZE);
-	if (!sof->ipc->comp_data) {
+	sof->ipc = ipc;
+#endif
+
+	ipc->comp_data = sof_heap_alloc(heap, SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
+					SOF_IPC_MSG_MAX_SIZE, 0);
+	if (!ipc->comp_data) {
 		tr_err(&ipc_tr, "Unable to allocate IPC component data");
-		rfree(sof->ipc);
-		return -ENOMEM;
+		sof_panic(SOF_IPC_PANIC_IPC);
 	}
+	memset(ipc->comp_data, 0, SOF_IPC_MSG_MAX_SIZE);
 
-	k_spinlock_init(&sof->ipc->lock);
-	list_init(&sof->ipc->msg_list);
-	list_init(&sof->ipc->comp_list);
+	k_spinlock_init(&ipc->lock);
+	list_init(&ipc->msg_list);
+	list_init(&ipc->comp_list);
 
 #ifdef CONFIG_SOF_TELEMETRY_IO_PERFORMANCE_MEASUREMENTS
 	struct io_perf_data_item init_data = {IO_PERF_IPC_ID,
@@ -324,15 +371,16 @@ __cold int ipc_init(struct sof *sof)
 					      IO_PERF_POWERED_UP_ENABLED,
 					      IO_PERF_D0IX_POWER_MODE,
 					      0, 0, 0 };
-	io_perf_monitor_init_data(&sof->ipc->io_perf_in_msg_count, &init_data);
+	io_perf_monitor_init_data(&ipc->io_perf_in_msg_count, &init_data);
 	init_data.direction = IO_PERF_OUTPUT_DIRECTION;
-	io_perf_monitor_init_data(&sof->ipc->io_perf_out_msg_count, &init_data);
+	io_perf_monitor_init_data(&ipc->io_perf_out_msg_count, &init_data);
 #endif
 
 #ifdef __ZEPHYR__
-	struct k_thread *thread = &sof->ipc->ipc_send_wq.thread;
+	struct k_thread *thread = &ipc->ipc_send_wq.thread;
 
-	k_work_queue_start(&sof->ipc->ipc_send_wq, ipc_send_wq_stack,
+	k_work_queue_init(&ipc->ipc_send_wq);
+	k_work_queue_start(&ipc->ipc_send_wq, ipc_send_wq_stack,
 			   K_THREAD_STACK_SIZEOF(ipc_send_wq_stack), 1, NULL);
 
 	k_thread_suspend(thread);
@@ -344,10 +392,12 @@ __cold int ipc_init(struct sof *sof)
 
 	k_thread_resume(thread);
 
-	k_work_init_delayable(&sof->ipc->z_delayed_work, ipc_work_handler);
+	k_work_init_delayable(&ipc->z_delayed_work, ipc_work_handler);
 #endif
 
-	return platform_ipc_init(sof->ipc);
+	ipc_user_init();
+
+	return platform_ipc_init(ipc);
 }
 
 /* Locking: call with ipc->lock held and interrupts disabled */
diff --git a/zephyr/include/rtos/sof.h b/zephyr/include/rtos/sof.h
index 573e6ac63d77..efe0c1e6acab 100644
--- a/zephyr/include/rtos/sof.h
+++ b/zephyr/include/rtos/sof.h
@@ -46,8 +46,10 @@ struct sof {
 	int argc;
 	char **argv;
 
+#ifndef CONFIG_SOF_USERSPACE_LL
 	/* ipc */
 	struct ipc *ipc;
+#endif
 
 	/* system agent */
 	struct sa *sa;

From 91385cafff3625e179d9d74ede20c9b06ed66809 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 12:14:57 +0300
Subject: [PATCH 02/13] ipc4: add user-space command-forwarding context

Add the struct ipc_user descriptor (and its ipc_user_pdata slot in struct
ipc) that the IPC4 kernel handler uses to forward commands to the
user-space IPC thread: the two IPC4 message words, the reply fields, and
a user-readable copy of the resolved comp_driver + tr_ctx used by
user-space component creation.

In ipc4 helper, allow component buffers to be allocated from the LL user
heap (ipc->ll_alloc) and create them on the component's configured core
rather than the current CPU, so buffer creation works from the user
thread when CONFIG_SOF_USERSPACE_LL is enabled.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/sof/ipc/common.h | 33 +++++++++++++++++++++++++++++++++
 src/ipc/ipc4/helper.c        | 10 +++++++++-
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/src/include/sof/ipc/common.h b/src/include/sof/ipc/common.h
index a562e960b705..74b75d7ac232 100644
--- a/src/include/sof/ipc/common.h
+++ b/src/include/sof/ipc/common.h
@@ -22,6 +22,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 
+struct comp_driver;
 struct dma_sg_elem_array;
 struct ipc_msg;
 
@@ -53,6 +54,37 @@ extern struct tr_ctx ipc_tr;
 #define IPC_TASK_SECONDARY_CORE	BIT(2)
 #define IPC_TASK_POWERDOWN      BIT(3)
 
+struct ipc_user {
+	struct k_thread *thread;
+	struct k_sem *sem;
+	struct k_event *event;
+	/** @brief Copy of IPC4 message primary word forwarded to user thread */
+	uint32_t ipc_msg_pri;
+	/** @brief Copy of IPC4 message extension word forwarded to user thread */
+	uint32_t ipc_msg_ext;
+	/** @brief Result code from user thread processing */
+	int result;
+	/** @brief Reply extension word from user thread (e.g. CONFIG_GET result) */
+	uint32_t reply_ext;
+	/** @brief Reply TX data size from user thread (e.g. LARGE_CONFIG_GET result) */
+	uint32_t reply_tx_size;
+	/** @brief Reply TX data pointer from user thread (e.g. LARGE_CONFIG_GET result) */
+	void *reply_tx_data;
+	struct ipc *ipc;
+	struct k_thread *audio_thread;
+	/** @brief Original kernel driver pointer for restoring dev->drv after create */
+	const struct comp_driver *init_drv;
+	/**
+	 * @brief User-accessible copy of comp_driver + tr_ctx for create().
+	 *
+	 * The comp_driver and tr_ctx structs reside in kernel memory
+	 * (.rodata/.data) which is not user-readable. The kernel handler
+	 * copies them here before forwarding to the user thread.
+	 * Size verified by BUILD_ASSERT in handler-user.c.
+	 */
+	uint8_t init_drv_data[160] __aligned(4);
+};
+
 struct ipc {
 	struct k_spinlock lock;	/* locking mechanism */
 	void *comp_data;
@@ -75,6 +107,7 @@ struct ipc {
 #endif
 
 #ifdef CONFIG_SOF_USERSPACE_LL
+	struct ipc_user *ipc_user_pdata;
 	struct mod_alloc_ctx *ll_alloc;
 #endif
 
diff --git a/src/ipc/ipc4/helper.c b/src/ipc/ipc4/helper.c
index 5881fbbfb0b5..d09755c240e6 100644
--- a/src/ipc/ipc4/helper.c
+++ b/src/ipc/ipc4/helper.c
@@ -558,7 +558,10 @@ __cold static struct comp_buffer *ipc4_create_buffer(struct comp_dev *src, bool
 	ipc_buf.size = buf_size;
 	ipc_buf.comp.id = IPC4_COMP_ID(src_queue, dst_queue);
 	ipc_buf.comp.pipeline_id = src->ipc_config.pipeline_id;
-	ipc_buf.comp.core = cpu_get_id();
+
+	assert(IS_ENABLED(CONFIG_SOF_USERSPACE_LL) || src->ipc_config.core == cpu_get_id());
+	ipc_buf.comp.core = src->ipc_config.core;
+
 	return buffer_new(alloc, &ipc_buf, is_shared);
 }
 
@@ -701,6 +704,11 @@ __cold int ipc_comp_connect(struct ipc *ipc, ipc_pipe_comp_connect *_connect)
 #else
 	alloc = NULL;
 #endif /* CONFIG_ZEPHYR_DP_SCHEDULER */
+
+#ifdef CONFIG_SOF_USERSPACE_LL
+	if (!alloc)
+		alloc = ipc->ll_alloc;
+#endif
 	bool cross_core_bind = source->ipc_config.core != sink->ipc_config.core;
 
 	/* If both components are on same core -- process IPC on that core,

From 2df6197009b837390d580b74921c8e0fd24cff26 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Thu, 18 Jun 2026 14:03:44 +0300
Subject: [PATCH 03/13] ipc4: handler: make config and pipeline-state
 processing context-agnostic

Extract the per-message processing logic for module CONFIG_GET/SET and
LARGE_CONFIG_GET/SET into standalone functions that return their results
via output parameters instead of writing the global msg_reply directly,
and give SET_PIPELINE_STATE external linkage.

This is a pure refactor with no functional change. The new
ipc4_process_module_config(), ipc4_process_large_config_get(),
ipc4_process_large_config_set() and ipc4_set_pipeline_state() can be
called from any execution context, which is needed to later dispatch
these messages from a separate IPC user-space thread.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/ipc4/handler.h  |  37 +++++++
 src/ipc/ipc4/handler-user.c | 213 +++++++++++++++++++++++++++++++++++-
 2 files changed, 246 insertions(+), 4 deletions(-)

diff --git a/src/include/ipc4/handler.h b/src/include/ipc4/handler.h
index b25cb98e9427..340a3a2908ea 100644
--- a/src/include/ipc4/handler.h
+++ b/src/include/ipc4/handler.h
@@ -16,6 +16,36 @@ struct ipc4_message_request;
  */
 int ipc4_user_process_module_message(struct ipc4_message_request *ipc4, struct ipc_msg *reply);
 
+/**
+ * @brief Process MOD_CONFIG_GET or MOD_CONFIG_SET in any execution context.
+ * @param[in] ipc4 IPC4 message request.
+ * @param[in] set true for CONFIG_SET, false for CONFIG_GET.
+ * @param[out] reply_ext Receives extension value for CONFIG_GET (may be NULL).
+ * @return IPC4 status code (0 on success).
+ */
+int ipc4_process_module_config(struct ipc4_message_request *ipc4,
+			       bool set, uint32_t *reply_ext);
+
+/**
+ * @brief Process MOD_LARGE_CONFIG_GET in any execution context.
+ * @param[in] ipc4 IPC4 message request.
+ * @param[out] reply_ext Receives extension value for reply.
+ * @param[out] reply_tx_size Receives TX data size for reply.
+ * @param[out] reply_tx_data Receives TX data pointer for reply.
+ * @return IPC4 status code (0 on success).
+ */
+int ipc4_process_large_config_get(struct ipc4_message_request *ipc4,
+				  uint32_t *reply_ext,
+				  uint32_t *reply_tx_size,
+				  void **reply_tx_data);
+
+/**
+ * @brief Process MOD_LARGE_CONFIG_SET in any execution context.
+ * @param[in] ipc4 IPC4 message request.
+ * @return IPC4 status code (0 on success).
+ */
+int ipc4_process_large_config_set(struct ipc4_message_request *ipc4);
+
 /**
  * \brief Processes IPC4 userspace global message.
  * @param[in] ipc4 IPC4 message request.
@@ -24,6 +54,13 @@ int ipc4_user_process_module_message(struct ipc4_message_request *ipc4, struct i
  */
 int ipc4_user_process_glb_message(struct ipc4_message_request *ipc4, struct ipc_msg *reply);
 
+/**
+ * \brief Process SET_PIPELINE_STATE IPC4 message (prepare + trigger phases).
+ * @param[in] ipc4 IPC4 message request.
+ * @return 0 on success, IPC4 error code otherwise.
+ */
+int ipc4_set_pipeline_state(struct ipc4_message_request *ipc4);
+
 /**
  * \brief Increment the IPC compound message pre-start counter.
  * @param[in] msg_id IPC message ID.
diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c
index 48131f2f6aae..f877094e5ad7 100644
--- a/src/ipc/ipc4/handler-user.c
+++ b/src/ipc/ipc4/handler-user.c
@@ -424,8 +424,12 @@ __cold const struct ipc4_pipeline_set_state_data *ipc4_get_pipeline_data_wrapper
 	return ipc4_get_pipeline_data();
 }
 
-/* Entry point for ipc4_pipeline_trigger(), therefore cannot be cold */
-static int ipc4_set_pipeline_state(struct ipc4_message_request *ipc4)
+/**
+ * \brief Process SET_PIPELINE_STATE IPC4 message (prepare + trigger phases).
+ * @param[in] ipc4 IPC4 message request.
+ * @return 0 on success, IPC4 error code otherwise.
+ */
+int ipc4_set_pipeline_state(struct ipc4_message_request *ipc4)
 {
 	const struct ipc4_pipeline_set_state_data *ppl_data;
 	struct ipc4_pipeline_set_state state;
@@ -809,7 +813,22 @@ __cold static int ipc4_unbind_module_instance(struct ipc4_message_request *ipc4)
 	return ipc_comp_disconnect(ipc, (ipc_pipe_comp_connect *)&bu);
 }
 
-static int ipc4_set_get_config_module_instance(struct ipc4_message_request *ipc4, bool set)
+/**
+ * @brief Process MOD_CONFIG_GET or MOD_CONFIG_SET in any execution context.
+ *
+ * Looks up the target component by module_id:instance_id, verifies the
+ * driver supports get_attribute/set_attribute, and dispatches the
+ * operation. For GET, the retrieved value is written to @p reply_ext.
+ *
+ * Callable from both the IPC kernel task and the IPC user thread.
+ *
+ * @param ipc4      Pointer to the IPC4 message request (primary + extension)
+ * @param set       true for CONFIG_SET, false for CONFIG_GET
+ * @param reply_ext Output: receives the extension value for CONFIG_GET (may be NULL for SET)
+ * @return IPC4 status code (0 on success)
+ */
+__cold int ipc4_process_module_config(struct ipc4_message_request *ipc4,
+				      bool set, uint32_t *reply_ext)
 {
 	struct ipc4_module_config *config = (struct ipc4_module_config *)ipc4;
 	int (*function)(struct comp_dev *dev, uint32_t type, void *value);
@@ -859,8 +878,21 @@ static int ipc4_set_get_config_module_instance(struct ipc4_message_request *ipc4
 		ret = IPC4_INVALID_CONFIG_PARAM_ID;
 	}
 
+	if (!set && reply_ext)
+		*reply_ext = config->extension.dat;
+
+	return ret;
+}
+
+static int ipc4_set_get_config_module_instance(struct ipc4_message_request *ipc4, bool set)
+{
+	uint32_t reply_ext;
+	int ret;
+
+	ret = ipc4_process_module_config(ipc4, set, &reply_ext);
+
 	if (!set)
-		msg_reply->extension = config->extension.dat;
+		msg_reply->extension = reply_ext;
 
 	return ret;
 }
@@ -990,6 +1022,108 @@ __cold static int ipc4_get_vendor_config_module_instance(struct comp_dev *dev,
 	return IPC4_SUCCESS;
 }
 
+__cold int ipc4_process_large_config_get(struct ipc4_message_request *ipc4,
+					uint32_t *reply_ext,
+					uint32_t *reply_tx_size,
+					void **reply_tx_data)
+{
+	struct ipc4_module_large_config_reply reply;
+	struct ipc4_module_large_config config;
+	char *data = ipc_get()->comp_data;
+	const struct comp_driver *drv;
+	struct comp_dev *dev = NULL;
+	uint32_t data_offset;
+
+	assert_can_be_cold();
+
+	int ret = memcpy_s(&config, sizeof(config), ipc4, sizeof(*ipc4));
+
+	if (ret < 0)
+		return IPC4_FAILURE;
+
+	tr_dbg(&ipc_tr, "%x : %x",
+	       (uint32_t)config.primary.r.module_id, (uint32_t)config.primary.r.instance_id);
+
+	/* get component dev for non-basefw since there is no
+	 * component dev for basefw
+	 */
+	if (config.primary.r.module_id) {
+		uint32_t comp_id;
+
+		comp_id = IPC4_COMP_ID(config.primary.r.module_id,
+				       config.primary.r.instance_id);
+		dev = ipc4_get_comp_dev(comp_id);
+		if (!dev)
+			return IPC4_MOD_INVALID_ID;
+
+		drv = dev->drv;
+
+		/* Multicore disabled for userspace forwarding;
+		 * non-userspace path retains ipc4_process_on_core()
+		 */
+	} else {
+		drv = ipc4_get_comp_drv(config.primary.r.module_id);
+	}
+
+	if (!drv)
+		return IPC4_MOD_INVALID_ID;
+
+	if (!drv->ops.get_large_config)
+		return IPC4_INVALID_REQUEST;
+
+	data_offset = config.extension.r.data_off_size;
+
+	/* check for vendor param first */
+	if (config.extension.r.large_param_id == VENDOR_CONFIG_PARAM) {
+		/* For now only vendor_config case uses payload from hostbox */
+		dcache_invalidate_region((__sparse_force void __sparse_cache *)MAILBOX_HOSTBOX_BASE,
+					 config.extension.r.data_off_size);
+		ret = ipc4_get_vendor_config_module_instance(dev, drv,
+							     config.extension.r.init_block,
+							     config.extension.r.final_block,
+							     &data_offset,
+							     data,
+							     (const char *)MAILBOX_HOSTBOX_BASE);
+	} else {
+#if CONFIG_LIBRARY
+		data += sizeof(reply);
+#endif
+		ipc4_prepare_for_kcontrol_get(dev, config.extension.r.large_param_id,
+					      data, data_offset);
+
+		ret = drv->ops.get_large_config(dev, config.extension.r.large_param_id,
+						config.extension.r.init_block,
+						config.extension.r.final_block,
+						&data_offset, data);
+	}
+
+	/* set up ipc4 error code for reply data */
+	if (ret < 0)
+		ret = IPC4_MOD_INVALID_ID;
+
+	/* Copy host config and overwrite */
+	reply.extension.dat = config.extension.dat;
+	reply.extension.r.data_off_size = data_offset;
+
+	/* The last block, no more data */
+	if (!config.extension.r.final_block && data_offset < SOF_IPC_MSG_MAX_SIZE)
+		reply.extension.r.final_block = 1;
+
+	/* Indicate last block if error occurs */
+	if (ret)
+		reply.extension.r.final_block = 1;
+
+	/* no need to allocate memory for reply msg */
+	if (ret)
+		return ret;
+
+	/* Output via parameters instead of msg_reply */
+	*reply_ext = reply.extension.dat;
+	*reply_tx_size = data_offset;
+	*reply_tx_data = data;
+	return ret;
+}
+
 __cold static int ipc4_get_large_config_module_instance(struct ipc4_message_request *ipc4)
 {
 	struct ipc4_module_large_config_reply reply;
@@ -1182,6 +1316,77 @@ __cold static int ipc4_set_vendor_config_module_instance(struct comp_dev *dev,
 					 data_off_size, data);
 }
 
+__cold int ipc4_process_large_config_set(struct ipc4_message_request *ipc4)
+{
+	struct ipc4_module_large_config config;
+	struct comp_dev *dev = NULL;
+	const struct comp_driver *drv;
+
+	assert_can_be_cold();
+
+	int ret = memcpy_s(&config, sizeof(config), ipc4, sizeof(*ipc4));
+
+	if (ret < 0)
+		return IPC4_FAILURE;
+
+	dcache_invalidate_region((__sparse_force void __sparse_cache *)MAILBOX_HOSTBOX_BASE,
+				 config.extension.r.data_off_size);
+	tr_dbg(&ipc_tr, "%x : %x",
+	       (uint32_t)config.primary.r.module_id, (uint32_t)config.primary.r.instance_id);
+
+	if (config.primary.r.module_id) {
+		uint32_t comp_id;
+
+		comp_id = IPC4_COMP_ID(config.primary.r.module_id, config.primary.r.instance_id);
+		dev = ipc4_get_comp_dev(comp_id);
+		if (!dev)
+			return IPC4_MOD_INVALID_ID;
+
+		drv = dev->drv;
+
+		/* Multicore disabled for userspace forwarding;
+		 * non-userspace path retains ipc4_process_on_core()
+		 */
+	} else {
+		drv = ipc4_get_comp_drv(config.primary.r.module_id);
+	}
+
+	if (!drv)
+		return IPC4_MOD_INVALID_ID;
+
+	if (!drv->ops.set_large_config)
+		return IPC4_INVALID_REQUEST;
+
+	/* check for vendor param first */
+	if (config.extension.r.large_param_id == VENDOR_CONFIG_PARAM) {
+		ret = ipc4_set_vendor_config_module_instance(dev, drv,
+							     (uint32_t)config.primary.r.module_id,
+							     (uint32_t)config.primary.r.instance_id,
+							     config.extension.r.init_block,
+							     config.extension.r.final_block,
+							     config.extension.r.data_off_size,
+							     (const char *)MAILBOX_HOSTBOX_BASE);
+	} else {
+#if CONFIG_LIBRARY
+		struct ipc *ipc = ipc_get();
+		const char *data = (const char *)ipc->comp_data + sizeof(config);
+#else
+		const char *data = (const char *)MAILBOX_HOSTBOX_BASE;
+#endif
+		ret = drv->ops.set_large_config(dev, config.extension.r.large_param_id,
+			config.extension.r.init_block, config.extension.r.final_block,
+			config.extension.r.data_off_size, data);
+		if (ret < 0) {
+			ipc_cmd_err(&ipc_tr, "failed to set large_config_module_instance %x : %x",
+				    (uint32_t)config.primary.r.module_id,
+				    (uint32_t)config.primary.r.instance_id);
+			ret = IPC4_INVALID_RESOURCE_ID;
+		}
+	}
+
+	return ret;
+}
+
 __cold static int ipc4_set_large_config_module_instance(struct ipc4_message_request *ipc4)
 {
 	struct ipc4_module_large_config config;

From f68e7774e4f4783e326c72e02f92ba6ae9af2f5d Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Thu, 18 Jun 2026 14:07:24 +0300
Subject: [PATCH 04/13] ipc: make ipc_msg_reply and compound-message handlers
 syscalls

The IPC reply and compound-message completion entry points need to be
callable from the IPC user-space thread. Declare ipc_msg_reply(),
ipc_compound_pre_start(), ipc_compound_post_start() and
ipc_wait_for_compound_msg() as Zephyr syscalls when
CONFIG_SOF_USERSPACE_LL is enabled, renaming the implementations to
z_impl_* and adding z_vrfy_* verification wrappers. A new ipc_reply.h
carries the ipc_msg_reply declaration so it can be pulled in as a
syscall header.

Register the new syscall headers in CMakeLists.txt. No functional change
for non-userspace builds, where the functions keep direct external
linkage via z_impl_* defines.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Co-developed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
---
 src/include/ipc4/handler.h      | 31 +++++++++-----
 src/include/sof/ipc/common.h    | 26 +++++++++++-
 src/include/sof/ipc/ipc_reply.h | 26 ++++++++++++
 src/ipc/ipc3/helper.c           |  2 +-
 src/ipc/ipc4/handler-kernel.c   | 74 ++++++++++++++++++++++++++++++---
 zephyr/CMakeLists.txt           |  2 +
 6 files changed, 144 insertions(+), 17 deletions(-)
 create mode 100644 src/include/sof/ipc/ipc_reply.h

diff --git a/src/include/ipc4/handler.h b/src/include/ipc4/handler.h
index 340a3a2908ea..0ed298dd9ad1 100644
--- a/src/include/ipc4/handler.h
+++ b/src/include/ipc4/handler.h
@@ -62,30 +62,41 @@ int ipc4_user_process_glb_message(struct ipc4_message_request *ipc4, struct ipc_
 int ipc4_set_pipeline_state(struct ipc4_message_request *ipc4);
 
 /**
- * \brief Increment the IPC compound message pre-start counter.
+ * \brief Complete the IPC compound message.
  * @param[in] msg_id IPC message ID.
+ * @param[in] error Error code of the IPC command.
  */
-void ipc_compound_pre_start(int msg_id);
+void ipc_compound_msg_done(uint32_t msg_id, int error);
 
+#if defined(__ZEPHYR__) && defined(CONFIG_SOF_FULL_ZEPHYR_APPLICATION)
 /**
- * \brief Decrement the IPC compound message pre-start counter on return value status.
+ * \brief Increment the IPC compound message pre-start counter.
  * @param[in] msg_id IPC message ID.
- * @param[in] ret Return value of the IPC command.
- * @param[in] delayed True if the reply is delayed.
  */
-void ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed);
+__syscall void ipc_compound_pre_start(int msg_id);
 
 /**
- * \brief Complete the IPC compound message.
+ * \brief Decrement the IPC compound message pre-start counter on return value status.
  * @param[in] msg_id IPC message ID.
- * @param[in] error Error code of the IPC command.
+ * @param[in] ret Return value of the IPC command.
+ * @param[in] delayed True if the reply is delayed.
  */
-void ipc_compound_msg_done(uint32_t msg_id, int error);
+__syscall void ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed);
 
 /**
  * \brief Wait for the IPC compound message to complete.
  * @return 0 on success, error code otherwise on timeout.
  */
-int ipc_wait_for_compound_msg(void);
+__syscall int ipc_wait_for_compound_msg(void);
+
+#include <zephyr/syscalls/handler.h>
+#else
+void z_impl_ipc_compound_pre_start(int msg_id);
+#define ipc_compound_pre_start z_impl_ipc_compound_pre_start
+void z_impl_ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed);
+#define ipc_compound_post_start z_impl_ipc_compound_post_start
+int z_impl_ipc_wait_for_compound_msg(void);
+#define ipc_wait_for_compound_msg z_impl_ipc_wait_for_compound_msg
+#endif
 
 #endif /* __SOF_IPC4_HANDLER_H__ */
diff --git a/src/include/sof/ipc/common.h b/src/include/sof/ipc/common.h
index 74b75d7ac232..8f34a53594dd 100644
--- a/src/include/sof/ipc/common.h
+++ b/src/include/sof/ipc/common.h
@@ -25,6 +25,7 @@
 struct comp_driver;
 struct dma_sg_elem_array;
 struct ipc_msg;
+struct ipc4_message_request;
 
 /* validates internal non tail structures within IPC command structure */
 #define IPC_IS_SIZE_INVALID(object)					\
@@ -211,6 +212,29 @@ struct dai_data;
  */
 int ipc_dai_data_config(struct dai_data *dd, struct comp_dev *dev);
 
+/**
+ * \brief Processes IPC4 userspace module message.
+ * @param[in] ipc4 IPC4 message request.
+ * @param[in] reply IPC message reply structure.
+ * @return IPC4_SUCCESS on success, error code otherwise.
+ */
+int ipc4_user_process_module_message(struct ipc4_message_request *ipc4, struct ipc_msg *reply);
+
+/**
+ * \brief Processes IPC4 userspace global message.
+ * @param[in] ipc4 IPC4 message request.
+ * @param[in] reply IPC message reply structure.
+ * @return IPC4_SUCCESS on success, error code otherwise.
+ */
+int ipc4_user_process_glb_message(struct ipc4_message_request *ipc4, struct ipc_msg *reply);
+
+/**
+ * \brief Complete the IPC compound message.
+ * @param[in] msg_id IPC message ID.
+ * @param[in] error Error code of the IPC command.
+ */
+void ipc_compound_msg_done(uint32_t msg_id, int error);
+
 /**
  * \brief create a IPC boot complete message.
  * @param[in] header header.
@@ -285,7 +309,7 @@ int ipc_process_on_core(uint32_t core, bool blocking);
  * \brief reply to an IPC message.
  * @param[in] reply pointer to the reply structure.
  */
-void ipc_msg_reply(struct sof_ipc_reply *reply);
+#include <sof/ipc/ipc_reply.h>
 
 /**
  * \brief Call platform-specific IPC completion function.
diff --git a/src/include/sof/ipc/ipc_reply.h b/src/include/sof/ipc/ipc_reply.h
new file mode 100644
index 000000000000..915b6261c6bd
--- /dev/null
+++ b/src/include/sof/ipc/ipc_reply.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright(c) 2026 Intel Corporation. All rights reserved.
+ */
+
+#ifndef __SOF_IPC_IPC_REPLY_H__
+#define __SOF_IPC_IPC_REPLY_H__
+
+#include <ipc/header.h>
+
+struct sof_ipc_reply;
+
+/**
+ * \brief reply to an IPC message.
+ * @param[in] reply pointer to the reply structure.
+ */
+#if defined(__ZEPHYR__) && defined(CONFIG_SOF_FULL_ZEPHYR_APPLICATION)
+__syscall void ipc_msg_reply(struct sof_ipc_reply *reply);
+
+#include <zephyr/syscalls/ipc_reply.h>
+#else
+void z_impl_ipc_msg_reply(struct sof_ipc_reply *reply);
+#define ipc_msg_reply z_impl_ipc_msg_reply
+#endif
+
+#endif /* __SOF_IPC_IPC_REPLY_H__ */
diff --git a/src/ipc/ipc3/helper.c b/src/ipc/ipc3/helper.c
index e962a3670a86..7fa66228942f 100644
--- a/src/ipc/ipc3/helper.c
+++ b/src/ipc/ipc3/helper.c
@@ -727,7 +727,7 @@ int ipc_comp_new(struct ipc *ipc, ipc_comp *_comp)
 	return 0;
 }
 
-void ipc_msg_reply(struct sof_ipc_reply *reply)
+void z_impl_ipc_msg_reply(struct sof_ipc_reply *reply)
 {
 	struct ipc *ipc = ipc_get();
 	k_spinlock_key_t key;
diff --git a/src/ipc/ipc4/handler-kernel.c b/src/ipc/ipc4/handler-kernel.c
index d7d9f417806a..f58bf3787229 100644
--- a/src/ipc/ipc4/handler-kernel.c
+++ b/src/ipc/ipc4/handler-kernel.c
@@ -40,6 +40,11 @@
 #include <rtos/string.h>
 #include <sof/lib_manager.h>
 
+#ifdef __ZEPHYR__
+#include <zephyr/kernel.h>
+#include <zephyr/internal/syscall_handler.h>
+#endif
+
 #include <errno.h>
 #include <stdbool.h>
 #include <stddef.h>
@@ -128,7 +133,7 @@ __cold static bool is_any_ppl_active(void)
 	return false;
 }
 
-void ipc_compound_pre_start(int msg_id)
+void z_impl_ipc_compound_pre_start(int msg_id)
 {
 	/* ipc thread will wait for all scheduled tasks to be complete
 	 * Use a reference count to check status of these tasks.
@@ -136,7 +141,23 @@ void ipc_compound_pre_start(int msg_id)
 	atomic_add(&msg_data.delayed_reply, 1);
 }
 
-void ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed)
+#ifdef CONFIG_USERSPACE
+/**
+ * \brief Userspace verification wrapper for ipc_compound_pre_start().
+ *
+ * Forwards the call to z_impl_ipc_compound_pre_start(). No pointer
+ * validation is needed as only primitive types are passed.
+ *
+ * @param[in] msg_id IPC message ID.
+ */
+void z_vrfy_ipc_compound_pre_start(int msg_id)
+{
+	z_impl_ipc_compound_pre_start(msg_id);
+}
+#include <zephyr/syscalls/ipc_compound_pre_start_mrsh.c>
+#endif
+
+void z_impl_ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed)
 {
 	if (ret) {
 		ipc_cmd_err(&ipc_tr, "failed to process msg %d status %d", msg_id, ret);
@@ -149,6 +170,24 @@ void ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed)
 		atomic_sub(&msg_data.delayed_reply, 1);
 }
 
+#ifdef CONFIG_USERSPACE
+/**
+ * \brief Userspace verification wrapper for ipc_compound_post_start().
+ *
+ * Forwards the call to z_impl_ipc_compound_post_start(). No pointer
+ * validation is needed as only primitive types are passed.
+ *
+ * @param[in] msg_id IPC message ID.
+ * @param[in] ret Return value of the IPC command.
+ * @param[in] delayed True if the reply is delayed.
+ */
+void z_vrfy_ipc_compound_post_start(uint32_t msg_id, int ret, bool delayed)
+{
+	z_impl_ipc_compound_post_start(msg_id, ret, delayed);
+}
+#include <zephyr/syscalls/ipc_compound_post_start_mrsh.c>
+#endif
+
 void ipc_compound_msg_done(uint32_t msg_id, int error)
 {
 	if (!atomic_read(&msg_data.delayed_reply)) {
@@ -170,13 +209,13 @@ void ipc_compound_msg_done(uint32_t msg_id, int error)
  * be always IPC4_FAILURE. Therefore the compound messages handling is simplified. The pipeline
  * triggers will require an explicit scheduler call to get the components to desired state.
  */
-int ipc_wait_for_compound_msg(void)
+int z_impl_ipc_wait_for_compound_msg(void)
 {
 	atomic_set(&msg_data.delayed_reply, 0);
 	return IPC4_SUCCESS;
 }
 #else
-int ipc_wait_for_compound_msg(void)
+int z_impl_ipc_wait_for_compound_msg(void)
 {
 	int try_count = 30;
 
@@ -192,6 +231,22 @@ int ipc_wait_for_compound_msg(void)
 
 	return IPC4_SUCCESS;
 }
+
+#ifdef CONFIG_USERSPACE
+/**
+ * \brief Userspace verification wrapper for ipc_wait_for_compound_msg().
+ *
+ * Forwards the call to z_impl_ipc_wait_for_compound_msg(). No pointer
+ * validation is needed as no pointers are passed.
+ *
+ * @return IPC4_SUCCESS on success, IPC4_FAILURE on timeout.
+ */
+int z_vrfy_ipc_wait_for_compound_msg(void)
+{
+	return z_impl_ipc_wait_for_compound_msg();
+}
+#include <zephyr/syscalls/ipc_wait_for_compound_msg_mrsh.c>
+#endif
 #endif
 
 #if CONFIG_LIBRARY_MANAGER
@@ -509,7 +564,7 @@ void ipc_send_buffer_status_notify(void)
 }
 #endif
 
-void ipc_msg_reply(struct sof_ipc_reply *reply)
+void z_impl_ipc_msg_reply(struct sof_ipc_reply *reply)
 {
 	struct ipc4_message_request in;
 
@@ -517,6 +572,15 @@ void ipc_msg_reply(struct sof_ipc_reply *reply)
 	ipc_compound_msg_done(in.primary.r.type, reply->error);
 }
 
+#ifdef CONFIG_USERSPACE
+void z_vrfy_ipc_msg_reply(struct sof_ipc_reply *reply)
+{
+	K_OOPS(K_SYSCALL_MEMORY_READ(reply, sizeof(*reply)));
+	z_impl_ipc_msg_reply(reply);
+}
+#include <zephyr/syscalls/ipc_msg_reply_mrsh.c>
+#endif
+
 void ipc_cmd(struct ipc_cmd_hdr *_hdr)
 {
 	struct ipc4_message_request *in = ipc4_get_message_request();
diff --git a/zephyr/CMakeLists.txt b/zephyr/CMakeLists.txt
index 3b3386fc8a77..4b61a9517d46 100644
--- a/zephyr/CMakeLists.txt
+++ b/zephyr/CMakeLists.txt
@@ -622,6 +622,8 @@ zephyr_library_sources_ifdef(CONFIG_SHELL
 
 zephyr_syscall_header(${SOF_SRC_PATH}/include/sof/audio/module_adapter/module/generic.h)
 zephyr_syscall_header(${SOF_SRC_PATH}/include/sof/lib/fast-get.h)
+zephyr_syscall_header(${SOF_SRC_PATH}/include/sof/ipc/ipc_reply.h)
+zephyr_syscall_header(${SOF_SRC_PATH}/include/ipc4/handler.h)
 zephyr_syscall_header(include/rtos/alloc.h)
 zephyr_library_sources_ifdef(CONFIG_SOF_USERSPACE_INTERFACE_ALLOC syscall/alloc.c)
 zephyr_syscall_header(${SOF_SRC_PATH}/include/sof/lib/dai-zephyr.h)

From c66765ac30178cdd3341f9470598f76c503dcc38 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Thu, 18 Jun 2026 14:13:25 +0300
Subject: [PATCH 05/13] ipc: allocate IPC objects from the user-accessible
 system heap

The pipeline, component and chain-DMA bookkeeping objects must be
reachable from the user-space IPC thread, so allocate them from the
system user heap via sof_heap_alloc()/sof_heap_free() instead of the
generic rzalloc()/rfree(). As sof_heap_alloc() does not zero the
allocation, add an explicit memset() to preserve the previous behaviour.

Give ipc4_add_comp_dev() external linkage (declared in topology.h) so the
user thread can register a created component, and skip the buffer tr_ctx
copy for user-space LL builds where the kernel tr_ctx is not mapped.

No functional change for non-userspace builds.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/sof/ipc/topology.h |  1 +
 src/ipc/ipc-helper.c           |  4 +++-
 src/ipc/ipc4/helper.c          | 20 +++++++++++---------
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/include/sof/ipc/topology.h b/src/include/sof/ipc/topology.h
index 84df84abb069..6bfad1cdb49a 100644
--- a/src/include/sof/ipc/topology.h
+++ b/src/include/sof/ipc/topology.h
@@ -49,6 +49,7 @@ typedef uint32_t ipc_comp;
 struct ipc_comp_dev;
 const struct comp_driver *ipc4_get_comp_drv(uint32_t module_id);
 struct comp_dev *ipc4_get_comp_dev(uint32_t comp_id);
+int ipc4_add_comp_dev(struct comp_dev *dev);
 int ipc4_chain_manager_create(struct ipc4_chain_dma *cdma);
 int ipc4_chain_dma_state(struct comp_dev *dev, struct ipc4_chain_dma *cdma);
 int ipc4_create_chain_dma(struct ipc *ipc, struct ipc4_chain_dma *cdma);
diff --git a/src/ipc/ipc-helper.c b/src/ipc/ipc-helper.c
index 1a2fcef4194e..cbd17d00da4c 100644
--- a/src/ipc/ipc-helper.c
+++ b/src/ipc/ipc-helper.c
@@ -89,8 +89,10 @@ __cold struct comp_buffer *buffer_new(struct mod_alloc_ctx *alloc,
 		buffer->stream.runtime_stream_params.pipeline_id = desc->comp.pipeline_id;
 		buffer->core = desc->comp.core;
 
+#if !defined(CONFIG_SOF_USERSPACE_LL)
 		memcpy_s(&buffer->tctx, sizeof(struct tr_ctx),
 			 &buffer_tr, sizeof(struct tr_ctx));
+#endif
 	}
 
 	return buffer;
@@ -388,7 +390,7 @@ __cold int ipc_comp_free(struct ipc *ipc, uint32_t comp_id)
 	icd->cd = NULL;
 
 	list_item_del(&icd->list);
-	rfree(icd);
+	sof_heap_free(sof_sys_user_heap_get(), icd);
 
 	return 0;
 }
diff --git a/src/ipc/ipc4/helper.c b/src/ipc/ipc4/helper.c
index d09755c240e6..68a5f92a80ae 100644
--- a/src/ipc/ipc4/helper.c
+++ b/src/ipc/ipc4/helper.c
@@ -64,7 +64,6 @@ LOG_MODULE_DECLARE(ipc, CONFIG_SOF_LOG_LEVEL);
 extern struct tr_ctx comp_tr;
 
 static const struct comp_driver *ipc4_get_drv(const void *uuid);
-static int ipc4_add_comp_dev(struct comp_dev *dev);
 
 void ipc_build_stream_posn(struct sof_ipc_stream_posn *posn, uint32_t type,
 			   uint32_t id)
@@ -341,6 +340,7 @@ __cold static int ipc4_create_pipeline(struct ipc4_pipeline_create *pipe_desc,
 	struct ipc_comp_dev *ipc_pipe;
 	struct pipeline *pipe;
 	struct ipc *ipc = ipc_get();
+	struct k_heap *heap = sof_sys_user_heap_get();
 
 	assert_can_be_cold();
 
@@ -353,7 +353,7 @@ __cold static int ipc4_create_pipeline(struct ipc4_pipeline_create *pipe_desc,
 	}
 
 	/* create the pipeline */
-	pipe = pipeline_new(NULL, pipe_desc->primary.r.instance_id,
+	pipe = pipeline_new(heap, pipe_desc->primary.r.instance_id,
 			    pipe_desc->primary.r.ppl_priority, 0, pparams);
 	if (!pipe) {
 		tr_err(&ipc_tr, "ipc: pipeline_new() failed");
@@ -369,12 +369,13 @@ __cold static int ipc4_create_pipeline(struct ipc4_pipeline_create *pipe_desc,
 	pipe->core = pipe_desc->extension.r.core_id;
 
 	/* allocate the IPC pipeline container */
-	ipc_pipe = rzalloc(SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
-			   sizeof(struct ipc_comp_dev));
+	ipc_pipe = sof_heap_alloc(heap, SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
+				  sizeof(struct ipc_comp_dev), 0);
 	if (!ipc_pipe) {
 		pipeline_free(pipe);
 		return IPC4_OUT_OF_MEMORY;
 	}
+	memset(ipc_pipe, 0, sizeof(*ipc_pipe));
 
 	ipc_pipe->pipeline = pipe;
 	ipc_pipe->type = COMP_TYPE_PIPELINE;
@@ -541,7 +542,7 @@ __cold int ipc_pipeline_free(struct ipc *ipc, uint32_t comp_id)
 
 	ipc_pipe->pipeline = NULL;
 	list_item_del(&ipc_pipe->list);
-	rfree(ipc_pipe);
+	sof_heap_free(sof_sys_user_heap_get(), ipc_pipe);
 
 	return IPC4_SUCCESS;
 }
@@ -1089,7 +1090,7 @@ __cold int ipc4_chain_dma_state(struct comp_dev *dev, struct ipc4_chain_dma *cdm
 			if (icd->cd != dev)
 				continue;
 			list_item_del(&icd->list);
-			rfree(icd);
+			sof_heap_free(sof_sys_user_heap_get(), icd);
 			break;
 		}
 		comp_free(dev);
@@ -1305,7 +1306,7 @@ struct comp_dev *ipc4_get_comp_dev(uint32_t comp_id)
 }
 EXPORT_SYMBOL(ipc4_get_comp_dev);
 
-__cold static int ipc4_add_comp_dev(struct comp_dev *dev)
+__cold int ipc4_add_comp_dev(struct comp_dev *dev)
 {
 	struct ipc *ipc = ipc_get();
 	struct ipc_comp_dev *icd;
@@ -1320,12 +1321,13 @@ __cold static int ipc4_add_comp_dev(struct comp_dev *dev)
 	}
 
 	/* allocate the IPC component container */
-	icd = rzalloc(SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
-		      sizeof(struct ipc_comp_dev));
+	icd = sof_heap_alloc(sof_sys_user_heap_get(), SOF_MEM_FLAG_USER | SOF_MEM_FLAG_COHERENT,
+			     sizeof(struct ipc_comp_dev), 0);
 	if (!icd) {
 		tr_err(&ipc_tr, "alloc failed");
 		return IPC4_OUT_OF_MEMORY;
 	}
+	memset(icd, 0, sizeof(*icd));
 
 	icd->cd = dev;
 	icd->type = COMP_TYPE_COMPONENT;

From 298670bd09118f2d9f30f5c9b923e300f02524cf Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 08:34:10 +0300
Subject: [PATCH 06/13] zephyr: map IPC4 HOSTBOX partitions into user LL memory
 domain

The user-space IPC thread reads the IPC4 module init parameter block
directly from MAILBOX_HOSTBOX_BASE (comp_new_ipc4() / comp_new_ipc4_user()),
so the HOSTBOX region must be reachable from the user LL memory domain.

Map two partitions when CONFIG_SOF_USERSPACE_LL && CONFIG_IPC_MAJOR_4:
an uncached read-only view for the parameter reads, and a cached RW view
because the sys_cache_data_invd_range() syscall verifier requires write
access to the invalidated range.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 zephyr/lib/userspace_helper.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/zephyr/lib/userspace_helper.c b/zephyr/lib/userspace_helper.c
index ce4368adc077..ea9db4181b9d 100644
--- a/zephyr/lib/userspace_helper.c
+++ b/zephyr/lib/userspace_helper.c
@@ -110,6 +110,39 @@ int user_access_to_mailbox(struct k_mem_domain *domain, k_tid_t thread_id)
 	if (ret < 0)
 		return ret;
 
+#if defined(CONFIG_SOF_USERSPACE_LL) && defined(CONFIG_IPC_MAJOR_4)
+	/* HOSTBOX partitions for IPC4 module init parameter block reads.
+	 * comp_new_ipc4() accesses MAILBOX_HOSTBOX_BASE directly to get
+	 * the module configuration data sent by the host.
+	 */
+	struct k_mem_partition hostbox_partition;
+
+	/* Uncached HOSTBOX partition */
+	hostbox_partition.start =
+		(uintptr_t)sys_cache_uncached_ptr_get((void __sparse_cache *)MAILBOX_HOSTBOX_BASE);
+	hostbox_partition.size = ALIGN_UP(MAILBOX_HOSTBOX_SIZE,
+					  CONFIG_MMU_PAGE_SIZE);
+	hostbox_partition.attr = K_MEM_PARTITION_P_RO_U_RO;
+
+	ret = k_mem_domain_add_partition(domain, &hostbox_partition);
+	if (ret < 0)
+		return ret;
+
+	/* Cached HOSTBOX partition for cache invalidation path.
+	 * sys_cache_data_invd_range() syscall verification requires
+	 * write access to the region, so use RW instead of RO.
+	 */
+	hostbox_partition.start =
+		(uintptr_t)sys_cache_cached_ptr_get((void *)MAILBOX_HOSTBOX_BASE);
+	hostbox_partition.size = ALIGN_UP(MAILBOX_HOSTBOX_SIZE,
+					  CONFIG_MMU_PAGE_SIZE);
+	hostbox_partition.attr = K_MEM_PARTITION_P_RW_U_RW;
+
+	ret = k_mem_domain_add_partition(domain, &hostbox_partition);
+	if (ret < 0)
+		return ret;
+#endif /* CONFIG_IPC_MAJOR_4 */
+
 #ifndef CONFIG_IPC_MAJOR_4
 	/*
 	 * Next mailbox_stream (not available in IPC4). Stream access is cached,

From 635c3e584baf51804c79f401d11e57f1beffab8c Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Fri, 26 Jun 2026 18:41:43 +0300
Subject: [PATCH 07/13] schedule: zephyr_ll: add user_ll_grant_access()

Add function user_ll_grant_access() to allow other threads
to access the scheduler mutex. This is needed if work is submitted
from other threads to the scheduler.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/sof/schedule/ll_schedule_domain.h | 1 +
 src/schedule/zephyr_ll.c                      | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/src/include/sof/schedule/ll_schedule_domain.h b/src/include/sof/schedule/ll_schedule_domain.h
index 9b0fd46b371e..f356566ca0aa 100644
--- a/src/include/sof/schedule/ll_schedule_domain.h
+++ b/src/include/sof/schedule/ll_schedule_domain.h
@@ -120,6 +120,7 @@ struct task *zephyr_ll_task_alloc(void);
 struct k_heap *zephyr_ll_user_heap(void);
 bool zephyr_ll_user_heap_verify(struct k_heap *heap);
 void zephyr_ll_user_resources_init(void);
+void user_ll_grant_access(struct k_thread *thread, int core);
 void user_ll_lock_sched(int core);
 void user_ll_unlock_sched(int core);
 #ifdef CONFIG_ASSERT
diff --git a/src/schedule/zephyr_ll.c b/src/schedule/zephyr_ll.c
index 33d2d76014bd..e0fbba0781c8 100644
--- a/src/schedule/zephyr_ll.c
+++ b/src/schedule/zephyr_ll.c
@@ -625,6 +625,13 @@ struct task *zephyr_ll_task_alloc(void)
 	return task;
 }
 
+void user_ll_grant_access(struct k_thread *thread, int core)
+{
+	assert(core < CONFIG_CORE_COUNT && zephyr_ll_locks[core] != NULL);
+
+	k_thread_access_grant(thread, zephyr_ll_locks[core]);
+}
+
 /**
  * Lock the LL scheduler to prevent it from processing tasks.
  *

From 0aba48b7c780bcf324398f2240680bbbb09ff00b Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 20:04:28 +0300
Subject: [PATCH 08/13] ipc: add generic user-space IPC handling thread

Add a dedicated user-space thread for handling IPC commands that operate
on audio pipelines when CONFIG_SOF_USERSPACE_LL is enabled. This provides
only the protocol-agnostic infrastructure:

 - ipc_user_init() creates the K_USER thread, allocates its k_sem/k_event
   handshake objects, sets up the memory domain and access grants, and
   spins up the LL scheduler context.
 - ipc_user_forward_cmd() forwards the two raw IPC message words from the
   kernel IPC handler to the user thread via k_event signaling, sets
   IPC_TASK_IN_THREAD so the host is not signaled until the user thread
   completes, and collects the result through a k_sem handshake.
 - ipc_user_thread_fn() runs the wait loop and delegates the actual
   command interpretation to ipc_user_thread_dispatch(), a __weak hook
   overridden by the active IPC major.

No IPC-major-specific knowledge lives here; the IPC4 dispatch is added in
a following commit. The generic infra can be extended to cover other IPC
protocol variants.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/sof/ipc/common.h |  26 +++++
 src/ipc/ipc-common.c         | 184 +++++++++++++++++++++++++++++++++++
 zephyr/Kconfig               |   8 ++
 3 files changed, 218 insertions(+)

diff --git a/src/include/sof/ipc/common.h b/src/include/sof/ipc/common.h
index 8f34a53594dd..80754e8301ee 100644
--- a/src/include/sof/ipc/common.h
+++ b/src/include/sof/ipc/common.h
@@ -319,4 +319,30 @@ void ipc_complete_cmd(struct ipc *ipc);
 /* GDB stub: should enter GDB after completing the IPC processing */
 extern bool ipc_enter_gdb;
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+/**
+ * @brief Forward an IPC command to the user-space thread and wait for it.
+ *
+ * Protocol-agnostic: only the two raw message words are handed across the
+ * kernel/user boundary. The active IPC major's ipc_user_thread_dispatch()
+ * interprets them in the user thread.
+ *
+ * @param primary   Primary message word
+ * @param extension Extension message word
+ * @return Result code from user thread processing
+ */
+int ipc_user_forward_cmd(uint32_t primary, uint32_t extension);
+
+/**
+ * @brief Protocol-specific dispatch of a forwarded IPC command.
+ *
+ * Runs in the user-space IPC thread. A __weak default returns -ENOSYS;
+ * the active IPC major (e.g. IPC4) provides the real implementation.
+ *
+ * @param ipc_user User IPC context holding the forwarded message words
+ * @return Result code to report back to the host
+ */
+int ipc_user_thread_dispatch(struct ipc_user *ipc_user);
+#endif
+
 #endif /* __SOF_DRIVERS_IPC_H__ */
diff --git a/src/ipc/ipc-common.c b/src/ipc/ipc-common.c
index 908e6e9cdbfd..6ed6c41a55d4 100644
--- a/src/ipc/ipc-common.c
+++ b/src/ipc/ipc-common.c
@@ -309,9 +309,193 @@ void ipc_schedule_process(struct ipc *ipc)
 #endif
 }
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+/* Generic user-space IPC handling thread infrastructure. Protocol-specific
+ * command interpretation lives in ipc_user_thread_dispatch(), implemented by
+ * the active IPC major (see src/ipc/ipc4/).
+ */
+
+#define IPC_USER_EVENT_CMD      BIT(0)
+#define IPC_USER_EVENT_STOP     BIT(1)
+
+static struct k_thread ipc_user_thread;
+static K_THREAD_STACK_DEFINE(ipc_user_stack, CONFIG_SOF_IPC_USER_THREAD_STACK_SIZE);
+
+/**
+ * @brief Forward an IPC command to the user-space thread.
+ *
+ * Called from kernel context (IPC EDF task) to forward the message words
+ * to the user-space thread for processing. Sets IPC_TASK_IN_THREAD in
+ * task_mask so the host is not signaled until the user thread completes.
+ * Blocks until the user thread finishes processing and returns the result.
+ *
+ * @param primary   Primary message word
+ * @param extension Extension message word
+ * @return Result from user thread processing
+ */
+int ipc_user_forward_cmd(uint32_t primary, uint32_t extension)
+{
+	struct ipc *ipc = ipc_get();
+	struct ipc_user *pdata = ipc->ipc_user_pdata;
+	k_spinlock_key_t key;
+	int ret;
+
+	LOG_DBG("IPC: forward cmd %08x", primary);
+
+	/* Copy message words — original buffer may be reused */
+	pdata->ipc_msg_pri = primary;
+	pdata->ipc_msg_ext = extension;
+	pdata->ipc = ipc;
+
+	/* Prevent host completion until user thread finishes */
+	key = k_spin_lock(&ipc->lock);
+	ipc->task_mask |= IPC_TASK_IN_THREAD;
+	k_spin_unlock(&ipc->lock, key);
+
+	/* Wake the user thread */
+	k_event_set(pdata->event, IPC_USER_EVENT_CMD);
+
+	/* Wait for user thread to complete */
+	ret = k_sem_take(pdata->sem, K_MSEC(10));
+	if (ret) {
+		LOG_ERR("IPC user: sem error %d\n", ret);
+		/* fall through to complete the cmd */
+	}
+
+	/* Clear the task mask bit and check for completion */
+	key = k_spin_lock(&ipc->lock);
+	ipc->task_mask &= ~IPC_TASK_IN_THREAD;
+	ipc_complete_cmd(ipc);
+	k_spin_unlock(&ipc->lock, key);
+
+	return !ret ? pdata->result : ret;
+}
+
+/**
+ * @brief Protocol-specific dispatch of a forwarded IPC command.
+ *
+ * Weak default; the active IPC major overrides this. Runs in the user
+ * thread context with the forwarded message words in @p ipc_user.
+ */
+__weak int ipc_user_thread_dispatch(struct ipc_user *ipc_user)
+{
+	ARG_UNUSED(ipc_user);
+	return -ENOSYS;
+}
+
+/**
+ * User-space IPC thread entry point. p1 points to the ipc_user context
+ * shared with the kernel launcher.
+ */
+static void ipc_user_thread_fn(void *p1, void *p2, void *p3)
+{
+	struct ipc_user *ipc_user = p1;
+
+	ARG_UNUSED(p2);
+	ARG_UNUSED(p3);
+
+	__ASSERT(k_is_user_context(), "expected user context");
+
+	/* Signal startup complete — unblocks init waiting on semaphore */
+	k_sem_give(ipc_user->sem);
+	LOG_INF("IPC user-space thread started");
+
+	for (;;) {
+		uint32_t mask = k_event_wait_safe(ipc_user->event,
+						  IPC_USER_EVENT_CMD | IPC_USER_EVENT_STOP,
+						  false, K_FOREVER);
+
+		LOG_DBG("IPC user wake, mask %u", mask);
+
+		if (mask & IPC_USER_EVENT_CMD) {
+			ipc_user->result = ipc_user_thread_dispatch(ipc_user);
+
+			/* Signal completion — kernel side will finish IPC */
+			k_sem_give(ipc_user->sem);
+		}
+
+		if (mask & IPC_USER_EVENT_STOP)
+			break;
+	}
+}
+
+__cold void ipc_user_init(void)
+{
+	struct ipc *ipc = ipc_get();
+	struct ipc_user *ipc_user = sof_heap_alloc(sof_sys_user_heap_get(), SOF_MEM_FLAG_USER,
+						   sizeof(*ipc_user), 0);
+	int ret;
+
+	if (!ipc_user) {
+		LOG_ERR("user IPC pdata alloc failed");
+		sof_panic(SOF_IPC_PANIC_IPC);
+	}
+
+	ipc_user->sem = k_object_alloc(K_OBJ_SEM);
+	if (!ipc_user->sem) {
+		LOG_ERR("user IPC sem alloc failed");
+		k_panic();
+	}
+
+	ret = k_mem_domain_add_partition(zephyr_ll_mem_domain(), &ipc_context_part);
+	if (ret < 0)
+		LOG_WRN("ipc context partition add failed: %d", ret);
+
+	k_sem_init(ipc_user->sem, 0, 1);
+
+	/* Allocate kernel objects for the user-space thread */
+	ipc_user->event = k_object_alloc(K_OBJ_EVENT);
+	if (!ipc_user->event) {
+		LOG_ERR("user IPC event alloc failed");
+		sof_panic(SOF_IPC_PANIC_IPC);
+	}
+	k_event_init(ipc_user->event);
+
+	k_thread_create(&ipc_user_thread, ipc_user_stack,
+			CONFIG_SOF_IPC_USER_THREAD_STACK_SIZE,
+			ipc_user_thread_fn, ipc_user, NULL, NULL,
+			-1, K_USER, K_FOREVER);
+
+	ipc_user->thread = &ipc_user_thread;
+	k_thread_access_grant(&ipc_user_thread, ipc_user->sem, ipc_user->event);
+	user_grant_dai_access_all(&ipc_user_thread);
+	user_grant_dma_access_all(&ipc_user_thread);
+	ret = user_access_to_mailbox(zephyr_ll_mem_domain(), &ipc_user_thread);
+	if (ret < 0) {
+		LOG_ERR("ipc user: mailbox access grant failed: %d", ret);
+		sof_panic(SOF_IPC_PANIC_IPC);
+	}
+	user_ll_grant_access(&ipc_user_thread, PLATFORM_PRIMARY_CORE_ID);
+	k_mem_domain_add_thread(zephyr_ll_mem_domain(), &ipc_user_thread);
+
+	k_thread_cpu_pin(&ipc_user_thread, PLATFORM_PRIMARY_CORE_ID);
+	k_thread_name_set(&ipc_user_thread, "ipc_user");
+
+	/* Store references in ipc struct so kernel handler can forward commands */
+	ipc->ipc_user_pdata = ipc_user;
+
+	k_thread_start(&ipc_user_thread);
+
+	struct task *task = zephyr_ll_task_alloc();
+
+	schedule_task_init_ll(task, SOF_UUID(ipc_uuid), SOF_SCHEDULE_LL_TIMER,
+			0, NULL, NULL, cpu_get_id(), 0);
+	ipc_user->audio_thread = scheduler_init_context(task);
+
+	/* Grant ipc_user thread permission on the audio thread object.
+	 * Needed so user-space dai_common_new() can call
+	 * k_thread_access_grant(audio_thread, dai_mutex) from user context.
+	 */
+	k_thread_access_grant(&ipc_user_thread, ipc_user->audio_thread);
+
+	/* Wait for user thread startup — consumes the initial k_sem_give from thread */
+	k_sem_take(ipc->ipc_user_pdata->sem, K_FOREVER);
+}
+#else
 static void ipc_user_init(void)
 {
 }
+#endif /* CONFIG_SOF_USERSPACE_LL */
 
 __cold int ipc_init(struct sof *sof)
 {
diff --git a/zephyr/Kconfig b/zephyr/Kconfig
index 9ff220efdc55..ab88efcb9a6a 100644
--- a/zephyr/Kconfig
+++ b/zephyr/Kconfig
@@ -327,3 +327,11 @@ config STACK_SIZE_IPC_TX
 	default 2048
 	help
 	  IPC sender work-queue thread stack size. Keep a power of 2.
+
+config SOF_IPC_USER_THREAD_STACK_SIZE
+	int "IPC user thread stack size"
+	default 8192
+	depends on SOF_USERSPACE_LL
+	help
+	  Stack size for the userspace IPC thread.
+	  Keep a power of 2.

From 2fd601fa2d0b6bbd1bb078c082c8d4e6d3d2de01 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 09:25:41 +0300
Subject: [PATCH 09/13] ipc4: create components in user-space thread context

Add comp_new_ipc4_user(), called from the user-space IPC thread to create
a component from user context. It receives a pre-resolved driver pointer
from the kernel handler (which does the privileged IMR manifest / driver
list lookup), parses the IPC4 init-instance message, reads the module
init parameter block from the HOSTBOX, and calls drv->ops.create() so
untrusted module init code does not execute with kernel privileges.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/include/sof/ipc/topology.h |  6 +++
 src/ipc/ipc4/helper.c          | 99 ++++++++++++++++++++++++++++++++++
 2 files changed, 105 insertions(+)

diff --git a/src/include/sof/ipc/topology.h b/src/include/sof/ipc/topology.h
index 6bfad1cdb49a..a76c299aa60e 100644
--- a/src/include/sof/ipc/topology.h
+++ b/src/include/sof/ipc/topology.h
@@ -50,6 +50,12 @@ struct ipc_comp_dev;
 const struct comp_driver *ipc4_get_comp_drv(uint32_t module_id);
 struct comp_dev *ipc4_get_comp_dev(uint32_t comp_id);
 int ipc4_add_comp_dev(struct comp_dev *dev);
+#ifdef CONFIG_SOF_USERSPACE_LL
+struct ipc4_message_request;
+struct comp_driver;
+struct comp_dev *comp_new_ipc4_user(struct ipc4_message_request *ipc4,
+				    const struct comp_driver *drv);
+#endif
 int ipc4_chain_manager_create(struct ipc4_chain_dma *cdma);
 int ipc4_chain_dma_state(struct comp_dev *dev, struct ipc4_chain_dma *cdma);
 int ipc4_create_chain_dma(struct ipc *ipc, struct ipc4_chain_dma *cdma);
diff --git a/src/ipc/ipc4/helper.c b/src/ipc/ipc4/helper.c
index 68a5f92a80ae..30601f5cd291 100644
--- a/src/ipc/ipc4/helper.c
+++ b/src/ipc/ipc4/helper.c
@@ -208,6 +208,105 @@ __cold struct comp_dev *comp_new_ipc4(struct ipc4_module_init_instance *module_i
 	return dev;
 }
 
+#ifdef CONFIG_SOF_USERSPACE_LL
+/**
+ * comp_new_ipc4_user - Create component in user-space IPC thread context.
+ *
+ * Called from the user-space IPC thread. Receives a pre-resolved driver
+ * pointer from the kernel handler. Performs IPC4 message parsing, HOSTBOX
+ * data read, and calls drv->ops.create() in user-space context.
+ *
+ * @param ipc4 IPC4 message request (reconstructed from ipc_user pri/ext words)
+ * @param drv  Component driver resolved by kernel via ipc4_get_comp_drv()
+ * @return Created component device, or NULL on failure
+ */
+__cold struct comp_dev *comp_new_ipc4_user(struct ipc4_message_request *ipc4,
+					   const struct comp_driver *drv)
+{
+	struct ipc4_module_init_instance module_init;
+	struct comp_ipc_config ipc_config;
+	struct comp_dev *dev;
+	uint32_t comp_id;
+	char *data;
+	int ret;
+
+	assert_can_be_cold();
+
+	ret = memcpy_s(&module_init, sizeof(module_init), ipc4, sizeof(*ipc4));
+	if (ret < 0)
+		return NULL;
+
+	comp_id = IPC4_COMP_ID(module_init.primary.r.module_id,
+			       module_init.primary.r.instance_id);
+
+	if (ipc4_get_comp_dev(comp_id)) {
+		tr_err(&ipc_tr, "comp 0x%x exists", comp_id);
+		return NULL;
+	}
+
+	if (module_init.extension.r.core_id >= CONFIG_CORE_COUNT) {
+		tr_err(&ipc_tr, "ipc: comp->core = %u",
+		       (uint32_t)module_init.extension.r.core_id);
+		return NULL;
+	}
+
+	memset(&ipc_config, 0, sizeof(ipc_config));
+	ipc_config.id = comp_id;
+	ipc_config.pipeline_id = module_init.extension.r.ppl_instance_id;
+	ipc_config.core = module_init.extension.r.core_id;
+	ipc_config.ipc_config_size =
+		module_init.extension.r.param_block_size * sizeof(uint32_t);
+	ipc_config.ipc_extended_init = module_init.extension.r.extended_init;
+	if (ipc_config.ipc_config_size > MAILBOX_HOSTBOX_SIZE) {
+		tr_err(&ipc_tr,
+		       "IPC payload size %u too big for the message window",
+		       ipc_config.ipc_config_size);
+		return NULL;
+	}
+#ifdef CONFIG_DCACHE_LINE_SIZE
+	if (!IS_ENABLED(CONFIG_LIBRARY))
+		sys_cache_data_invd_range(
+			(__sparse_force void __sparse_cache *)MAILBOX_HOSTBOX_BASE,
+			ALIGN_UP(ipc_config.ipc_config_size,
+				 CONFIG_DCACHE_LINE_SIZE));
+#endif
+	data = ipc4_get_comp_new_data();
+
+#if CONFIG_ZEPHYR_DP_SCHEDULER
+	if (module_init.extension.r.proc_domain)
+		ipc_config.proc_domain = COMP_PROCESSING_DOMAIN_DP;
+	else
+		ipc_config.proc_domain = COMP_PROCESSING_DOMAIN_LL;
+#else
+	if (module_init.extension.r.proc_domain) {
+		tr_err(&ipc_tr,
+		       "ipc: DP scheduling is disabled, cannot create comp 0x%x",
+		       comp_id);
+		return NULL;
+	}
+	ipc_config.proc_domain = COMP_PROCESSING_DOMAIN_LL;
+#endif
+
+	if (drv->type == SOF_COMP_MODULE_ADAPTER) {
+		const struct ipc_config_process spec = {
+			.data = (const unsigned char *)data,
+			.size = ipc_config.ipc_config_size,
+		};
+
+		dev = drv->ops.create(drv, &ipc_config, (const void *)&spec);
+	} else {
+		dev = drv->ops.create(drv, &ipc_config, (const void *)data);
+	}
+	if (!dev)
+		return NULL;
+
+	list_init(&dev->bsource_list);
+	list_init(&dev->bsink_list);
+
+	return dev;
+}
+#endif /* CONFIG_SOF_USERSPACE_LL */
+
 /* Called from ipc4_set_pipeline_state(), so cannot be cold */
 struct ipc_comp_dev *ipc_get_comp_by_ppl_id(struct ipc *ipc, uint16_t type,
 					    uint32_t ppl_id,

From 207880e55a72f6d54240a83b08a34a44217e0420 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 09:34:08 +0300
Subject: [PATCH 10/13] ipc4: dispatch forwarded IPC commands in the user
 thread

Provide the IPC4 implementation of ipc_user_thread_dispatch(), the
protocol-specific hook called from the generic user-space IPC thread. It
reconstructs the IPC4 message from the forwarded primary/extension words
and runs the privilege-separated portion of each supported command:
pipeline create/delete/set-state, module config get/set, large-config
get/set, bind/unbind, and init/delete instance. Component creation goes
through comp_new_ipc4_user() so module code runs in user context.

This moves the IPC4 command switch out of the protocol-agnostic
ipc-common.c into the IPC4 handler where it belongs.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/ipc/ipc4/handler-user.c | 145 ++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)

diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c
index f877094e5ad7..2fcab93575c6 100644
--- a/src/ipc/ipc4/handler-user.c
+++ b/src/ipc/ipc4/handler-user.c
@@ -1537,3 +1537,148 @@ __cold int ipc4_user_process_module_message(struct ipc4_message_request *ipc4,
 
 	return ret;
 }
+
+#ifdef CONFIG_SOF_USERSPACE_LL
+/*
+ * IPC4 implementation of the user-thread dispatch hook. Runs in the
+ * user-space IPC thread; reconstructs the IPC4 message from the forwarded
+ * words and executes the privilege-separated part of each command.
+ */
+int ipc_user_thread_dispatch(struct ipc_user *ipc_user)
+{
+	struct ipc4_message_request msg;
+	int result = -EINVAL;
+
+	/* Reconstruct the IPC4 message from copied words */
+	msg.primary.dat = ipc_user->ipc_msg_pri;
+	msg.extension.dat = ipc_user->ipc_msg_ext;
+
+	ipc_user->reply_ext = 0;
+
+	if (msg.primary.r.msg_tgt == SOF_IPC4_MESSAGE_TARGET_MODULE_MSG) {
+		/* Module message dispatch */
+		switch (msg.primary.r.type) {
+		case SOF_IPC4_MOD_CONFIG_GET:
+			result = ipc4_process_module_config(&msg, false,
+							    &ipc_user->reply_ext);
+			break;
+		case SOF_IPC4_MOD_CONFIG_SET:
+			result = ipc4_process_module_config(&msg, true, NULL);
+			break;
+		case SOF_IPC4_MOD_BIND: {
+			struct ipc4_module_bind_unbind bu;
+
+			result = memcpy_s(&bu, sizeof(bu), &msg, sizeof(msg));
+			if (result < 0)
+				break;
+
+			result = ipc_comp_connect(ipc_user->ipc,
+						  (ipc_pipe_comp_connect *)&bu);
+			break;
+		}
+		case SOF_IPC4_MOD_UNBIND: {
+			struct ipc4_module_bind_unbind bu;
+
+			result = memcpy_s(&bu, sizeof(bu), &msg, sizeof(msg));
+			if (result < 0)
+				break;
+
+			result = ipc_comp_disconnect(ipc_user->ipc,
+						     (ipc_pipe_comp_connect *)&bu);
+			break;
+		}
+		case SOF_IPC4_MOD_INIT_INSTANCE: {
+			/* User thread creates the component —
+			 * drv->ops.create() runs in user-space so untrusted
+			 * module code does not execute with kernel privileges.
+			 *
+			 * init_drv = original kernel pointer
+			 * init_drv_data = user-accessible copy
+			 */
+			const struct comp_driver *orig_drv = ipc_user->init_drv;
+			const struct comp_driver *drv_copy =
+				(const struct comp_driver *)ipc_user->init_drv_data;
+			struct comp_dev *dev;
+
+			ipc_user->init_drv = NULL;
+			if (!orig_drv) {
+				result = IPC4_MOD_NOT_INITIALIZED;
+				break;
+			}
+
+			dev = comp_new_ipc4_user(&msg, drv_copy);
+			if (!dev) {
+				result = IPC4_MOD_NOT_INITIALIZED;
+				break;
+			}
+
+			/* Restore original kernel driver pointer. comp_init()
+			 * set dev->drv to the copy; runtime code expects the
+			 * canonical kernel address.
+			 */
+			dev->drv = orig_drv;
+
+			result = ipc4_add_comp_dev(dev);
+			if (result != IPC4_SUCCESS)
+				break;
+
+			comp_update_ibs_obs_cpc(dev);
+			result = 0;
+			break;
+		}
+		case SOF_IPC4_MOD_DELETE_INSTANCE: {
+			struct ipc4_module_delete_instance module;
+			uint32_t comp_id;
+
+			memcpy_s(&module, sizeof(module), &msg, sizeof(msg));
+			comp_id = IPC4_COMP_ID(module.primary.r.module_id,
+					       module.primary.r.instance_id);
+			result = ipc_comp_free(ipc_user->ipc, comp_id);
+			if (result < 0)
+				result = IPC4_INVALID_RESOURCE_ID;
+			break;
+		}
+		case SOF_IPC4_MOD_LARGE_CONFIG_GET:
+			result = ipc4_process_large_config_get(&msg,
+							       &ipc_user->reply_ext,
+							       &ipc_user->reply_tx_size,
+							       &ipc_user->reply_tx_data);
+			break;
+		case SOF_IPC4_MOD_LARGE_CONFIG_SET:
+			result = ipc4_process_large_config_set(&msg);
+			break;
+		default:
+			LOG_ERR("IPC user: unsupported module cmd type %d",
+				msg.primary.r.type);
+			result = -EINVAL;
+			break;
+		}
+	} else {
+		/* Global message dispatch */
+		switch (msg.primary.r.type) {
+		case SOF_IPC4_GLB_CREATE_PIPELINE:
+			result = ipc_pipeline_new(ipc_user->ipc,
+						  (ipc_pipe_new *)&msg);
+			break;
+		case SOF_IPC4_GLB_DELETE_PIPELINE: {
+			struct ipc4_pipeline_delete *pipe =
+				(struct ipc4_pipeline_delete *)&msg;
+
+			result = ipc_pipeline_free(ipc_user->ipc,
+						   pipe->primary.r.instance_id);
+			break;
+		}
+		case SOF_IPC4_GLB_SET_PIPELINE_STATE:
+			result = ipc4_set_pipeline_state(&msg);
+			break;
+		default:
+			LOG_ERR("IPC user: unsupported glb cmd type %d",
+				msg.primary.r.type);
+			result = -EINVAL;
+			break;
+		}
+	}
+
+	return result;
+}
+#endif /* CONFIG_SOF_USERSPACE_LL */

From 04f7e205694597b9f7bcb47a03f647176c1a29e3 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 10:25:46 +0300
Subject: [PATCH 11/13] ipc4: forward pipeline and module commands to the user
 thread

Route the IPC4 commands that operate on audio pipelines to the user-space
IPC thread via ipc_user_forward_cmd() when CONFIG_SOF_USERSPACE_LL is
enabled: create/delete/set-state pipeline, config get/set, large-config
get/set, bind/unbind and init/delete instance.

For MOD_INIT_INSTANCE the kernel still resolves the driver (needs IMR
manifest access) and copies comp_driver + tr_ctx into the user-readable
ipc_user buffer before forwarding; cross-core creation stays in kernel.
LARGE_CONFIG get/set for base firmware (module_id 0) also stay in kernel
because they touch the IMR manifest. CONFIG_GET / LARGE_CONFIG_GET copy
the reply extension (and tx payload) back from the user thread.

The now-unused ipc4_new_pipeline()/ipc4_delete_pipeline() kernel helpers
are compiled out in the user-space configuration.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/ipc/ipc4/handler-user.c | 146 ++++++++++++++++++++++++++++++++++++
 1 file changed, 146 insertions(+)

diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c
index 2fcab93575c6..019e95f9d9a5 100644
--- a/src/ipc/ipc4/handler-user.c
+++ b/src/ipc/ipc4/handler-user.c
@@ -90,6 +90,7 @@ static inline const struct ipc4_pipeline_set_state_data *ipc4_get_pipeline_data(
 /*
  * Global IPC Operations.
  */
+#ifndef CONFIG_SOF_USERSPACE_LL
 __cold static int ipc4_new_pipeline(struct ipc4_message_request *ipc4)
 {
 	struct ipc *ipc = ipc_get();
@@ -98,7 +99,9 @@ __cold static int ipc4_new_pipeline(struct ipc4_message_request *ipc4)
 
 	return ipc_pipeline_new(ipc, (ipc_pipe_new *)ipc4);
 }
+#endif
 
+#ifndef CONFIG_SOF_USERSPACE_LL
 __cold static int ipc4_delete_pipeline(struct ipc4_message_request *ipc4)
 {
 	struct ipc4_pipeline_delete *pipe;
@@ -111,6 +114,7 @@ __cold static int ipc4_delete_pipeline(struct ipc4_message_request *ipc4)
 
 	return ipc_pipeline_free(ipc, pipe->primary.r.instance_id);
 }
+#endif
 
 static int ipc4_pcm_params(struct ipc_comp_dev *pcm_dev)
 {
@@ -689,13 +693,25 @@ int ipc4_user_process_glb_message(struct ipc4_message_request *ipc4,
 
 	/* pipeline settings */
 	case SOF_IPC4_GLB_CREATE_PIPELINE:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_new_pipeline(ipc4);
+#endif
 		break;
 	case SOF_IPC4_GLB_DELETE_PIPELINE:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_delete_pipeline(ipc4);
+#endif
 		break;
 	case SOF_IPC4_GLB_SET_PIPELINE_STATE:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_set_pipeline_state(ipc4);
+#endif
 		break;
 
 	case SOF_IPC4_GLB_GET_PIPELINE_STATE:
@@ -1503,28 +1519,158 @@ __cold int ipc4_user_process_module_message(struct ipc4_message_request *ipc4,
 
 	switch (type) {
 	case SOF_IPC4_MOD_INIT_INSTANCE:
+#ifdef CONFIG_SOF_USERSPACE_LL
+	{
+		/* User-space init: kernel does driver lookup only (requires
+		 * access to IMR manifest and driver list in kernel memory).
+		 * Component creation (drv->ops.create) runs in user thread
+		 * so untrusted module code does not execute in kernel context.
+		 * Cross-core creation stays fully in kernel.
+		 */
+		struct ipc4_module_init_instance mi;
+
+		BUILD_ASSERT(sizeof(struct comp_driver) + sizeof(struct tr_ctx) <=
+			     sizeof(((struct ipc_user *)0)->init_drv_data),
+			     "ipc_user.init_drv_data too small for driver copy");
+
+		ret = memcpy_s(&mi, sizeof(mi), ipc4, sizeof(*ipc4));
+		if (ret < 0)
+			break;
+
+		if (!cpu_is_me(mi.extension.r.core_id)) {
+			ret = ipc4_init_module_instance(ipc4);
+		} else {
+			struct ipc *ipc = ipc_get();
+			uint32_t comp_id = IPC4_COMP_ID(mi.primary.r.module_id,
+							mi.primary.r.instance_id);
+			const struct comp_driver *drv = ipc4_get_comp_drv(
+				IPC4_MOD_ID(comp_id));
+			struct ipc_user *pdata = ipc->ipc_user_pdata;
+
+			if (!drv) {
+				ret = IPC4_MOD_NOT_INITIALIZED;
+				break;
+			}
+
+			/* Copy comp_driver and tr_ctx into user-accessible ipc_user buffer
+			 * originals are in kernel .rodata/.data and not readable from user mode.
+			 */
+			struct comp_driver *drv_copy =
+				(struct comp_driver *)pdata->init_drv_data;
+			struct tr_ctx *tctx_copy =
+				(struct tr_ctx *)(pdata->init_drv_data +
+						sizeof(struct comp_driver));
+
+			ret = memcpy_s(drv_copy, sizeof(*drv_copy),
+				       drv, sizeof(*drv));
+			if (!ret && drv->tctx) {
+				ret = memcpy_s(tctx_copy, sizeof(*tctx_copy),
+					       drv->tctx, sizeof(*drv->tctx));
+				drv_copy->tctx = tctx_copy;
+			}
+
+			if (ret < 0)
+				break;
+
+			pdata->init_drv = drv;
+			ret = ipc_user_forward_cmd(ipc4->primary.dat,
+						   ipc4->extension.dat);
+		}
+	}
+#else
 		ret = ipc4_init_module_instance(ipc4);
+#endif
 		break;
 	case SOF_IPC4_MOD_CONFIG_GET:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		/* Forward to user thread for privilege-separated execution */
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+		if (!ret) {
+			struct ipc *ipc = ipc_get();
+			struct ipc_user *pdata = ipc->ipc_user_pdata;
+
+			msg_reply->extension = pdata->reply_ext;
+		}
+#else
 		ret = ipc4_set_get_config_module_instance(ipc4, false);
+#endif
 		break;
 	case SOF_IPC4_MOD_CONFIG_SET:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		/* Forward to user thread for privilege-separated execution */
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_set_get_config_module_instance(ipc4, true);
+#endif
 		break;
 	case SOF_IPC4_MOD_LARGE_CONFIG_GET:
+#ifdef CONFIG_SOF_USERSPACE_LL
+	{
+		struct ipc4_module_large_config config;
+
+		memcpy_s(&config, sizeof(config), ipc4, sizeof(*ipc4));
+		if (config.primary.r.module_id) {
+			/* Module case: forward to user thread */
+			ret = ipc_user_forward_cmd(ipc4->primary.dat,
+						   ipc4->extension.dat);
+			if (!ret) {
+				struct ipc *ipc = ipc_get();
+				struct ipc_user *pdata = ipc->ipc_user_pdata;
+
+				msg_reply->extension = pdata->reply_ext;
+				msg_reply->tx_size = pdata->reply_tx_size;
+				msg_reply->tx_data = pdata->reply_tx_data;
+			}
+		} else {
+			/* Base firmware (module_id==0): keep in kernel —
+			 * ipc4_get_comp_drv() accesses IMR manifest which
+			 * has no user-space partition.
+			 */
+			ret = ipc4_get_large_config_module_instance(ipc4);
+		}
+	}
+#else
 		ret = ipc4_get_large_config_module_instance(ipc4);
+#endif
 		break;
 	case SOF_IPC4_MOD_LARGE_CONFIG_SET:
+#ifdef CONFIG_SOF_USERSPACE_LL
+	{
+		struct ipc4_module_large_config config;
+
+		memcpy_s(&config, sizeof(config), ipc4, sizeof(*ipc4));
+		if (config.primary.r.module_id) {
+			ret = ipc_user_forward_cmd(ipc4->primary.dat,
+						   ipc4->extension.dat);
+		} else {
+			/* Base firmware: keep in kernel (IMR access) */
+			ret = ipc4_set_large_config_module_instance(ipc4);
+		}
+	}
+#else
 		ret = ipc4_set_large_config_module_instance(ipc4);
+#endif
 		break;
 	case SOF_IPC4_MOD_BIND:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_bind_module_instance(ipc4);
+#endif
 		break;
 	case SOF_IPC4_MOD_UNBIND:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_unbind_module_instance(ipc4);
+#endif
 		break;
 	case SOF_IPC4_MOD_DELETE_INSTANCE:
+#ifdef CONFIG_SOF_USERSPACE_LL
+		ret = ipc_user_forward_cmd(ipc4->primary.dat, ipc4->extension.dat);
+#else
 		ret = ipc4_delete_module_instance(ipc4);
+#endif
 		break;
 	case SOF_IPC4_MOD_ENTER_MODULE_RESTORE:
 	case SOF_IPC4_MOD_EXIT_MODULE_RESTORE:

From cc101b52ea45f7e973d43c8bbbdc09121a217f52 Mon Sep 17 00:00:00 2001
From: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Date: Mon, 15 Jun 2026 15:16:30 +0200
Subject: [PATCH 12/13] userspace: ll: ipc: increase IPC processing timeout

Sometimes 10ms aren't enough for userspace IPC processing, increase
it to 100ms.

Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/ipc/ipc-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ipc/ipc-common.c b/src/ipc/ipc-common.c
index 6ed6c41a55d4..d876a3be0ac6 100644
--- a/src/ipc/ipc-common.c
+++ b/src/ipc/ipc-common.c
@@ -356,7 +356,7 @@ int ipc_user_forward_cmd(uint32_t primary, uint32_t extension)
 	k_event_set(pdata->event, IPC_USER_EVENT_CMD);
 
 	/* Wait for user thread to complete */
-	ret = k_sem_take(pdata->sem, K_MSEC(10));
+	ret = k_sem_take(pdata->sem, K_MSEC(100));
 	if (ret) {
 		LOG_ERR("IPC user: sem error %d\n", ret);
 		/* fall through to complete the cmd */

From ae6fade14e089acfafa7dce1e85cde8ad509a199 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 14 Jul 2026 12:00:11 +0300
Subject: [PATCH 13/13] ipc: move standalone-test check later in ipc_init()

If CONFIG_SOF_BOOT_TEST_STANDALONE is set, ipc_init() is terminated
early. This ensures SOF will not start to generate or respond
to IPC messages that could potentially interfere with standalone
test cases (some of which send and receive IPCs).

The current implementation leaves the component list uninitialized
and this can cause trouble to standalone tests that want to utilzie
common IPC code to build messages.

Fix this problem by executing more of ipc_init() also in the standalone
mode.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
---
 src/ipc/ipc-common.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/ipc/ipc-common.c b/src/ipc/ipc-common.c
index d876a3be0ac6..ce0b37194654 100644
--- a/src/ipc/ipc-common.c
+++ b/src/ipc/ipc-common.c
@@ -506,11 +506,6 @@ __cold int ipc_init(struct sof *sof)
 
 	tr_dbg(&ipc_tr, "entry");
 
-#if CONFIG_SOF_BOOT_TEST_STANDALONE
-	LOG_INF("SOF_BOOT_TEST_STANDALONE, skipping platform IPC init.");
-	return 0;
-#endif
-
 #ifdef CONFIG_SOF_USERSPACE_LL
 	heap = zephyr_ll_user_heap();
 
@@ -560,6 +555,11 @@ __cold int ipc_init(struct sof *sof)
 	io_perf_monitor_init_data(&ipc->io_perf_out_msg_count, &init_data);
 #endif
 
+#if CONFIG_SOF_BOOT_TEST_STANDALONE
+	LOG_INF("SOF_BOOT_TEST_STANDALONE, disabling IPC.");
+	return 0;
+#endif
+
 #ifdef __ZEPHYR__
 	struct k_thread *thread = &ipc->ipc_send_wq.thread;