Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Peter Chen <peter.chen@nxp.com>
To:     Jeremy Linton <jeremy.linton@arm.com>
CC:     "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "stern@rowland.harvard.edu" <stern@rowland.harvard.edu>,
        "git@thegavinli.com" <git@thegavinli.com>,
        "jarkko.sakkinen@linux.intel.com" <jarkko.sakkinen@linux.intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-arm-kernel@lists.infradead.org" 
        <linux-arm-kernel@lists.infradead.org>,
        "mark.rutland@arm.com" <mark.rutland@arm.com>,
        "maz@kernel.org" <maz@kernel.org>,
        "robin.murphy@arm.com" <robin.murphy@arm.com>
Subject: Re: [PATCH v2] usb: usbfs: correct kernel->user page attribute
 mismatch
Thread-Topic: [PATCH v2] usb: usbfs: correct kernel->user page attribute
 mismatch
Thread-Index: AQHWIlCQKCNSJB0Ze0OFrgpi79LmXKiasbyA
Date:   Wed, 6 May 2020 07:51:18 +0000
Message-ID: <20200506075143.GC30237@b29397-desktop>
References: <20200504201348.1183246-1-jeremy.linton@arm.com>
In-Reply-To: <20200504201348.1183246-1-jeremy.linton@arm.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3D04C5076955E44790E54A8BFA0EB3D7@eurprd04.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 642030e4-2dd5-4d28-1e3e-08d7f19242db
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 May 2020 07:51:18.4742
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: nCeRC0I0LSk9B2gUjx4U7d2V9TpJLm8gbq8wdegALMiNREK4tlWFk/jhIURvDSGyZgS9hs8YEjP8udzWYbpBFw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR04MB7190
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 20-05-04 15:13:48, Jeremy Linton wrote:
> On some architectures (e.g. arm64) requests for
> IO coherent memory may use non-cachable attributes if
> the relevant device isn't cache coherent. If these
> pages are then remapped into userspace as cacheable,
> they may not be coherent with the non-cacheable mappings.
>=20
> In particular this happens with libusb, when it attempts
> to create zero-copy buffers for use by rtl-sdr
> (https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgith=
ub.com%2Fosmocom%2Frtl-sdr%2F&amp;data=3D02%7C01%7Cpeter.chen%40nxp.com%7Cb=
088a6f1a4d5462d65e808d7f067b1b2%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C1%=
7C637242200467457447&amp;sdata=3DnPbLuHBIWqKSc0h4UGqRBv7W7wcQ0SYwq51ggLVcBV=
s%3D&amp;reserved=3D0). On low end arm
> devices with non-coherent USB ports, the application will
> be unexpectedly killed, while continuing to work fine on
> arm machines with coherent USB controllers.
>=20
> This bug has been discovered/reported a few times over
> the last few years. In the case of rtl-sdr a compile time
> option to enable/disable zero copy was implemented to
> work around it.
>=20
> Rather than relaying on application specific workarounds,
> dma_mmap_coherent() can be used instead of remap_pfn_range().
> The page cache/etc attributes will then be correctly set in
> userspace to match the kernel mapping.
>=20
> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
> ---
> v1->v2:
> 	Update commit message and change to dma_mmap_coherent()
> 	from dma_mmap_attr(,,,0) which are the same.
>=20
>  drivers/usb/core/devio.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>=20
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index 6833c918abce..b9db9812d6c5 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -217,6 +217,7 @@ static int usbdev_mmap(struct file *file, struct vm_a=
rea_struct *vma)
>  {
>  	struct usb_memory *usbm =3D NULL;
>  	struct usb_dev_state *ps =3D file->private_data;
> +	struct usb_hcd *hcd =3D bus_to_hcd(ps->dev->bus);
>  	size_t size =3D vma->vm_end - vma->vm_start;
>  	void *mem;
>  	unsigned long flags;
> @@ -250,9 +251,7 @@ static int usbdev_mmap(struct file *file, struct vm_a=
rea_struct *vma)
>  	usbm->vma_use_count =3D 1;
>  	INIT_LIST_HEAD(&usbm->memlist);
> =20
> -	if (remap_pfn_range(vma, vma->vm_start,
> -			virt_to_phys(usbm->mem) >> PAGE_SHIFT,
> -			size, vma->vm_page_prot) < 0) {
> +	if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, size)) {
>  		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
>  		return -EAGAIN;
>  	}
> --=20
> 2.24.1
>=20

Tested at NXP imx8qm (ARM64) platform, it fixes mmap issue for using
libusb.

I am not sure if it covers all use cases at hcd_buffer_alloc.

--=20

Thanks,
Peter Chen=