About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Documentation / dma-buf-sharing.txt




Custom Search

Based on kernel version 4.0. Page generated on 2015-04-14 21:23 EST.

1	                    DMA Buffer Sharing API Guide
2	                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3	
4	                            Sumit Semwal
5	                <sumit dot semwal at linaro dot org>
6	                 <sumit dot semwal at ti dot com>
7	
8	This document serves as a guide to device-driver writers on what is the dma-buf
9	buffer sharing API, how to use it for exporting and using shared buffers.
10	
11	Any device driver which wishes to be a part of DMA buffer sharing, can do so as
12	either the 'exporter' of buffers, or the 'user' of buffers.
13	
14	Say a driver A wants to use buffers created by driver B, then we call B as the
15	exporter, and A as buffer-user.
16	
17	The exporter
18	- implements and manages operations[1] for the buffer
19	- allows other users to share the buffer by using dma_buf sharing APIs,
20	- manages the details of buffer allocation,
21	- decides about the actual backing storage where this allocation happens,
22	- takes care of any migration of scatterlist - for all (shared) users of this
23	   buffer,
24	
25	The buffer-user
26	- is one of (many) sharing users of the buffer.
27	- doesn't need to worry about how the buffer is allocated, or where.
28	- needs a mechanism to get access to the scatterlist that makes up this buffer
29	   in memory, mapped into its own address space, so it can access the same area
30	   of memory.
31	
32	dma-buf operations for device dma only
33	--------------------------------------
34	
35	The dma_buf buffer sharing API usage contains the following steps:
36	
37	1. Exporter announces that it wishes to export a buffer
38	2. Userspace gets the file descriptor associated with the exported buffer, and
39	   passes it around to potential buffer-users based on use case
40	3. Each buffer-user 'connects' itself to the buffer
41	4. When needed, buffer-user requests access to the buffer from exporter
42	5. When finished with its use, the buffer-user notifies end-of-DMA to exporter
43	6. when buffer-user is done using this buffer completely, it 'disconnects'
44	   itself from the buffer.
45	
46	
47	1. Exporter's announcement of buffer export
48	
49	   The buffer exporter announces its wish to export a buffer. In this, it
50	   connects its own private buffer data, provides implementation for operations
51	   that can be performed on the exported dma_buf, and flags for the file
52	   associated with this buffer.
53	
54	   Interface:
55	      struct dma_buf *dma_buf_export_named(void *priv, struct dma_buf_ops *ops,
56					     size_t size, int flags,
57					     const char *exp_name)
58	
59	   If this succeeds, dma_buf_export_named allocates a dma_buf structure, and
60	   returns a pointer to the same. It also associates an anonymous file with this
61	   buffer, so it can be exported. On failure to allocate the dma_buf object,
62	   it returns NULL.
63	
64	   'exp_name' is the name of exporter - to facilitate information while
65	   debugging.
66	
67	   Exporting modules which do not wish to provide any specific name may use the
68	   helper define 'dma_buf_export()', with the same arguments as above, but
69	   without the last argument; a KBUILD_MODNAME pre-processor directive will be
70	   inserted in place of 'exp_name' instead.
71	
72	2. Userspace gets a handle to pass around to potential buffer-users
73	
74	   Userspace entity requests for a file-descriptor (fd) which is a handle to the
75	   anonymous file associated with the buffer. It can then share the fd with other
76	   drivers and/or processes.
77	
78	   Interface:
79	      int dma_buf_fd(struct dma_buf *dmabuf, int flags)
80	
81	   This API installs an fd for the anonymous file associated with this buffer;
82	   returns either 'fd', or error.
83	
84	3. Each buffer-user 'connects' itself to the buffer
85	
86	   Each buffer-user now gets a reference to the buffer, using the fd passed to
87	   it.
88	
89	   Interface:
90	      struct dma_buf *dma_buf_get(int fd)
91	
92	   This API will return a reference to the dma_buf, and increment refcount for
93	   it.
94	
95	   After this, the buffer-user needs to attach its device with the buffer, which
96	   helps the exporter to know of device buffer constraints.
97	
98	   Interface:
99	      struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
100	                                                struct device *dev)
101	
102	   This API returns reference to an attachment structure, which is then used
103	   for scatterlist operations. It will optionally call the 'attach' dma_buf
104	   operation, if provided by the exporter.
105	
106	   The dma-buf sharing framework does the bookkeeping bits related to managing
107	   the list of all attachments to a buffer.
108	
109	Until this stage, the buffer-exporter has the option to choose not to actually
110	allocate the backing storage for this buffer, but wait for the first buffer-user
111	to request use of buffer for allocation.
112	
113	
114	4. When needed, buffer-user requests access to the buffer
115	
116	   Whenever a buffer-user wants to use the buffer for any DMA, it asks for
117	   access to the buffer using dma_buf_map_attachment API. At least one attach to
118	   the buffer must have happened before map_dma_buf can be called.
119	
120	   Interface:
121	      struct sg_table * dma_buf_map_attachment(struct dma_buf_attachment *,
122	                                         enum dma_data_direction);
123	
124	   This is a wrapper to dma_buf->ops->map_dma_buf operation, which hides the
125	   "dma_buf->ops->" indirection from the users of this interface.
126	
127	   In struct dma_buf_ops, map_dma_buf is defined as
128	      struct sg_table * (*map_dma_buf)(struct dma_buf_attachment *,
129	                                                enum dma_data_direction);
130	
131	   It is one of the buffer operations that must be implemented by the exporter.
132	   It should return the sg_table containing scatterlist for this buffer, mapped
133	   into caller's address space.
134	
135	   If this is being called for the first time, the exporter can now choose to
136	   scan through the list of attachments for this buffer, collate the requirements
137	   of the attached devices, and choose an appropriate backing storage for the
138	   buffer.
139	
140	   Based on enum dma_data_direction, it might be possible to have multiple users
141	   accessing at the same time (for reading, maybe), or any other kind of sharing
142	   that the exporter might wish to make available to buffer-users.
143	
144	   map_dma_buf() operation can return -EINTR if it is interrupted by a signal.
145	
146	
147	5. When finished, the buffer-user notifies end-of-DMA to exporter
148	
149	   Once the DMA for the current buffer-user is over, it signals 'end-of-DMA' to
150	   the exporter using the dma_buf_unmap_attachment API.
151	
152	   Interface:
153	      void dma_buf_unmap_attachment(struct dma_buf_attachment *,
154	                                    struct sg_table *);
155	
156	   This is a wrapper to dma_buf->ops->unmap_dma_buf() operation, which hides the
157	   "dma_buf->ops->" indirection from the users of this interface.
158	
159	   In struct dma_buf_ops, unmap_dma_buf is defined as
160	      void (*unmap_dma_buf)(struct dma_buf_attachment *,
161	                            struct sg_table *,
162	                            enum dma_data_direction);
163	
164	   unmap_dma_buf signifies the end-of-DMA for the attachment provided. Like
165	   map_dma_buf, this API also must be implemented by the exporter.
166	
167	
168	6. when buffer-user is done using this buffer, it 'disconnects' itself from the
169	   buffer.
170	
171	   After the buffer-user has no more interest in using this buffer, it should
172	   disconnect itself from the buffer:
173	
174	   - it first detaches itself from the buffer.
175	
176	   Interface:
177	      void dma_buf_detach(struct dma_buf *dmabuf,
178	                          struct dma_buf_attachment *dmabuf_attach);
179	
180	   This API removes the attachment from the list in dmabuf, and optionally calls
181	   dma_buf->ops->detach(), if provided by exporter, for any housekeeping bits.
182	
183	   - Then, the buffer-user returns the buffer reference to exporter.
184	
185	   Interface:
186	     void dma_buf_put(struct dma_buf *dmabuf);
187	
188	   This API then reduces the refcount for this buffer.
189	
190	   If, as a result of this call, the refcount becomes 0, the 'release' file
191	   operation related to this fd is called. It calls the dmabuf->ops->release()
192	   operation in turn, and frees the memory allocated for dmabuf when exported.
193	
194	NOTES:
195	- Importance of attach-detach and {map,unmap}_dma_buf operation pairs
196	   The attach-detach calls allow the exporter to figure out backing-storage
197	   constraints for the currently-interested devices. This allows preferential
198	   allocation, and/or migration of pages across different types of storage
199	   available, if possible.
200	
201	   Bracketing of DMA access with {map,unmap}_dma_buf operations is essential
202	   to allow just-in-time backing of storage, and migration mid-way through a
203	   use-case.
204	
205	- Migration of backing storage if needed
206	   If after
207	   - at least one map_dma_buf has happened,
208	   - and the backing storage has been allocated for this buffer,
209	   another new buffer-user intends to attach itself to this buffer, it might
210	   be allowed, if possible for the exporter.
211	
212	   In case it is allowed by the exporter:
213	    if the new buffer-user has stricter 'backing-storage constraints', and the
214	    exporter can handle these constraints, the exporter can just stall on the
215	    map_dma_buf until all outstanding access is completed (as signalled by
216	    unmap_dma_buf).
217	    Once all users have finished accessing and have unmapped this buffer, the
218	    exporter could potentially move the buffer to the stricter backing-storage,
219	    and then allow further {map,unmap}_dma_buf operations from any buffer-user
220	    from the migrated backing-storage.
221	
222	   If the exporter cannot fulfill the backing-storage constraints of the new
223	   buffer-user device as requested, dma_buf_attach() would return an error to
224	   denote non-compatibility of the new buffer-sharing request with the current
225	   buffer.
226	
227	   If the exporter chooses not to allow an attach() operation once a
228	   map_dma_buf() API has been called, it simply returns an error.
229	
230	Kernel cpu access to a dma-buf buffer object
231	--------------------------------------------
232	
233	The motivation to allow cpu access from the kernel to a dma-buf object from the
234	importers side are:
235	- fallback operations, e.g. if the devices is connected to a usb bus and the
236	  kernel needs to shuffle the data around first before sending it away.
237	- full transparency for existing users on the importer side, i.e. userspace
238	  should not notice the difference between a normal object from that subsystem
239	  and an imported one backed by a dma-buf. This is really important for drm
240	  opengl drivers that expect to still use all the existing upload/download
241	  paths.
242	
243	Access to a dma_buf from the kernel context involves three steps:
244	
245	1. Prepare access, which invalidate any necessary caches and make the object
246	   available for cpu access.
247	2. Access the object page-by-page with the dma_buf map apis
248	3. Finish access, which will flush any necessary cpu caches and free reserved
249	   resources.
250	
251	1. Prepare access
252	
253	   Before an importer can access a dma_buf object with the cpu from the kernel
254	   context, it needs to notify the exporter of the access that is about to
255	   happen.
256	
257	   Interface:
258	      int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
259					   size_t start, size_t len,
260					   enum dma_data_direction direction)
261	
262	   This allows the exporter to ensure that the memory is actually available for
263	   cpu access - the exporter might need to allocate or swap-in and pin the
264	   backing storage. The exporter also needs to ensure that cpu access is
265	   coherent for the given range and access direction. The range and access
266	   direction can be used by the exporter to optimize the cache flushing, i.e.
267	   access outside of the range or with a different direction (read instead of
268	   write) might return stale or even bogus data (e.g. when the exporter needs to
269	   copy the data to temporary storage).
270	
271	   This step might fail, e.g. in oom conditions.
272	
273	2. Accessing the buffer
274	
275	   To support dma_buf objects residing in highmem cpu access is page-based using
276	   an api similar to kmap. Accessing a dma_buf is done in aligned chunks of
277	   PAGE_SIZE size. Before accessing a chunk it needs to be mapped, which returns
278	   a pointer in kernel virtual address space. Afterwards the chunk needs to be
279	   unmapped again. There is no limit on how often a given chunk can be mapped
280	   and unmapped, i.e. the importer does not need to call begin_cpu_access again
281	   before mapping the same chunk again.
282	
283	   Interfaces:
284	      void *dma_buf_kmap(struct dma_buf *, unsigned long);
285	      void dma_buf_kunmap(struct dma_buf *, unsigned long, void *);
286	
287	   There are also atomic variants of these interfaces. Like for kmap they
288	   facilitate non-blocking fast-paths. Neither the importer nor the exporter (in
289	   the callback) is allowed to block when using these.
290	
291	   Interfaces:
292	      void *dma_buf_kmap_atomic(struct dma_buf *, unsigned long);
293	      void dma_buf_kunmap_atomic(struct dma_buf *, unsigned long, void *);
294	
295	   For importers all the restrictions of using kmap apply, like the limited
296	   supply of kmap_atomic slots. Hence an importer shall only hold onto at most 2
297	   atomic dma_buf kmaps at the same time (in any given process context).
298	
299	   dma_buf kmap calls outside of the range specified in begin_cpu_access are
300	   undefined. If the range is not PAGE_SIZE aligned, kmap needs to succeed on
301	   the partial chunks at the beginning and end but may return stale or bogus
302	   data outside of the range (in these partial chunks).
303	
304	   Note that these calls need to always succeed. The exporter needs to complete
305	   any preparations that might fail in begin_cpu_access.
306	
307	   For some cases the overhead of kmap can be too high, a vmap interface
308	   is introduced. This interface should be used very carefully, as vmalloc
309	   space is a limited resources on many architectures.
310	
311	   Interfaces:
312	      void *dma_buf_vmap(struct dma_buf *dmabuf)
313	      void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr)
314	
315	   The vmap call can fail if there is no vmap support in the exporter, or if it
316	   runs out of vmalloc space. Fallback to kmap should be implemented. Note that
317	   the dma-buf layer keeps a reference count for all vmap access and calls down
318	   into the exporter's vmap function only when no vmapping exists, and only
319	   unmaps it once. Protection against concurrent vmap/vunmap calls is provided
320	   by taking the dma_buf->lock mutex.
321	
322	3. Finish access
323	
324	   When the importer is done accessing the range specified in begin_cpu_access,
325	   it needs to announce this to the exporter (to facilitate cache flushing and
326	   unpinning of any pinned resources). The result of any dma_buf kmap calls
327	   after end_cpu_access is undefined.
328	
329	   Interface:
330	      void dma_buf_end_cpu_access(struct dma_buf *dma_buf,
331					  size_t start, size_t len,
332					  enum dma_data_direction dir);
333	
334	
335	Direct Userspace Access/mmap Support
336	------------------------------------
337	
338	Being able to mmap an export dma-buf buffer object has 2 main use-cases:
339	- CPU fallback processing in a pipeline and
340	- supporting existing mmap interfaces in importers.
341	
342	1. CPU fallback processing in a pipeline
343	
344	   In many processing pipelines it is sometimes required that the cpu can access
345	   the data in a dma-buf (e.g. for thumbnail creation, snapshots, ...). To avoid
346	   the need to handle this specially in userspace frameworks for buffer sharing
347	   it's ideal if the dma_buf fd itself can be used to access the backing storage
348	   from userspace using mmap.
349	
350	   Furthermore Android's ION framework already supports this (and is otherwise
351	   rather similar to dma-buf from a userspace consumer side with using fds as
352	   handles, too). So it's beneficial to support this in a similar fashion on
353	   dma-buf to have a good transition path for existing Android userspace.
354	
355	   No special interfaces, userspace simply calls mmap on the dma-buf fd.
356	
357	2. Supporting existing mmap interfaces in importers
358	
359	   Similar to the motivation for kernel cpu access it is again important that
360	   the userspace code of a given importing subsystem can use the same interfaces
361	   with a imported dma-buf buffer object as with a native buffer object. This is
362	   especially important for drm where the userspace part of contemporary OpenGL,
363	   X, and other drivers is huge, and reworking them to use a different way to
364	   mmap a buffer rather invasive.
365	
366	   The assumption in the current dma-buf interfaces is that redirecting the
367	   initial mmap is all that's needed. A survey of some of the existing
368	   subsystems shows that no driver seems to do any nefarious thing like syncing
369	   up with outstanding asynchronous processing on the device or allocating
370	   special resources at fault time. So hopefully this is good enough, since
371	   adding interfaces to intercept pagefaults and allow pte shootdowns would
372	   increase the complexity quite a bit.
373	
374	   Interface:
375	      int dma_buf_mmap(struct dma_buf *, struct vm_area_struct *,
376			       unsigned long);
377	
378	   If the importing subsystem simply provides a special-purpose mmap call to set
379	   up a mapping in userspace, calling do_mmap with dma_buf->file will equally
380	   achieve that for a dma-buf object.
381	
382	3. Implementation notes for exporters
383	
384	   Because dma-buf buffers have invariant size over their lifetime, the dma-buf
385	   core checks whether a vma is too large and rejects such mappings. The
386	   exporter hence does not need to duplicate this check.
387	
388	   Because existing importing subsystems might presume coherent mappings for
389	   userspace, the exporter needs to set up a coherent mapping. If that's not
390	   possible, it needs to fake coherency by manually shooting down ptes when
391	   leaving the cpu domain and flushing caches at fault time. Note that all the
392	   dma_buf files share the same anon inode, hence the exporter needs to replace
393	   the dma_buf file stored in vma->vm_file with it's own if pte shootdown is
394	   required. This is because the kernel uses the underlying inode's address_space
395	   for vma tracking (and hence pte tracking at shootdown time with
396	   unmap_mapping_range).
397	
398	   If the above shootdown dance turns out to be too expensive in certain
399	   scenarios, we can extend dma-buf with a more explicit cache tracking scheme
400	   for userspace mappings. But the current assumption is that using mmap is
401	   always a slower path, so some inefficiencies should be acceptable.
402	
403	   Exporters that shoot down mappings (for any reasons) shall not do any
404	   synchronization at fault time with outstanding device operations.
405	   Synchronization is an orthogonal issue to sharing the backing storage of a
406	   buffer and hence should not be handled by dma-buf itself. This is explicitly
407	   mentioned here because many people seem to want something like this, but if
408	   different exporters handle this differently, buffer sharing can fail in
409	   interesting ways depending upong the exporter (if userspace starts depending
410	   upon this implicit synchronization).
411	
412	Other Interfaces Exposed to Userspace on the dma-buf FD
413	------------------------------------------------------
414	
415	- Since kernel 3.12 the dma-buf FD supports the llseek system call, but only
416	  with offset=0 and whence=SEEK_END|SEEK_SET. SEEK_SET is supported to allow
417	  the usual size discover pattern size = SEEK_END(0); SEEK_SET(0). Every other
418	  llseek operation will report -EINVAL.
419	
420	  If llseek on dma-buf FDs isn't support the kernel will report -ESPIPE for all
421	  cases. Userspace can use this to detect support for discovering the dma-buf
422	  size using llseek.
423	
424	Miscellaneous notes
425	-------------------
426	
427	- Any exporters or users of the dma-buf buffer sharing framework must have
428	  a 'select DMA_SHARED_BUFFER' in their respective Kconfigs.
429	
430	- In order to avoid fd leaks on exec, the FD_CLOEXEC flag must be set
431	  on the file descriptor.  This is not just a resource leak, but a
432	  potential security hole.  It could give the newly exec'd application
433	  access to buffers, via the leaked fd, to which it should otherwise
434	  not be permitted access.
435	
436	  The problem with doing this via a separate fcntl() call, versus doing it
437	  atomically when the fd is created, is that this is inherently racy in a
438	  multi-threaded app[3].  The issue is made worse when it is library code
439	  opening/creating the file descriptor, as the application may not even be
440	  aware of the fd's.
441	
442	  To avoid this problem, userspace must have a way to request O_CLOEXEC
443	  flag be set when the dma-buf fd is created.  So any API provided by
444	  the exporting driver to create a dmabuf fd must provide a way to let
445	  userspace control setting of O_CLOEXEC flag passed in to dma_buf_fd().
446	
447	- If an exporter needs to manually flush caches and hence needs to fake
448	  coherency for mmap support, it needs to be able to zap all the ptes pointing
449	  at the backing storage. Now linux mm needs a struct address_space associated
450	  with the struct file stored in vma->vm_file to do that with the function
451	  unmap_mapping_range. But the dma_buf framework only backs every dma_buf fd
452	  with the anon_file struct file, i.e. all dma_bufs share the same file.
453	
454	  Hence exporters need to setup their own file (and address_space) association
455	  by setting vma->vm_file and adjusting vma->vm_pgoff in the dma_buf mmap
456	  callback. In the specific case of a gem driver the exporter could use the
457	  shmem file already provided by gem (and set vm_pgoff = 0). Exporters can then
458	  zap ptes by unmapping the corresponding range of the struct address_space
459	  associated with their own file.
460	
461	References:
462	[1] struct dma_buf_ops in include/linux/dma-buf.h
463	[2] All interfaces mentioned above defined in include/linux/dma-buf.h
464	[3] https://lwn.net/Articles/236486/
Hide Line Numbers
About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Information is copyright its respective author. All material is available from the Linux Kernel Source distributed under a GPL License. This page is provided as a free service by mjmwired.net.