1 DMA Buffer Sharing API Guide 2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3 4 Sumit Semwal 5 <sumit dot semwal at linaro dot org> 6 <sumit dot semwal at ti dot com> 7 8This document serves as a guide to device-driver writers on what is the dma-buf 9buffer sharing API, how to use it for exporting and using shared buffers. 10 11Any device driver which wishes to be a part of DMA buffer sharing, can do so as 12either the 'exporter' of buffers, or the 'user' of buffers. 13 14Say a driver A wants to use buffers created by driver B, then we call B as the 15exporter, and A as buffer-user. 16 17The exporter 18- implements and manages operations[1] for the buffer 19- allows other users to share the buffer by using dma_buf sharing APIs, 20- manages the details of buffer allocation, 21- decides about the actual backing storage where this allocation happens, 22- takes care of any migration of scatterlist - for all (shared) users of this 23 buffer, 24 25The buffer-user 26- is one of (many) sharing users of the buffer. 27- doesn't need to worry about how the buffer is allocated, or where. 28- needs a mechanism to get access to the scatterlist that makes up this buffer 29 in memory, mapped into its own address space, so it can access the same area 30 of memory. 31 32dma-buf operations for device dma only 33-------------------------------------- 34 35The dma_buf buffer sharing API usage contains the following steps: 36 371. Exporter announces that it wishes to export a buffer 382. Userspace gets the file descriptor associated with the exported buffer, and 39 passes it around to potential buffer-users based on use case 403. Each buffer-user 'connects' itself to the buffer 414. When needed, buffer-user requests access to the buffer from exporter 425. When finished with its use, the buffer-user notifies end-of-DMA to exporter 436. when buffer-user is done using this buffer completely, it 'disconnects' 44 itself from the buffer. 45 46 471. Exporter's announcement of buffer export 48 49 The buffer exporter announces its wish to export a buffer. In this, it 50 connects its own private buffer data, provides implementation for operations 51 that can be performed on the exported dma_buf, and flags for the file 52 associated with this buffer. 53 54 Interface: 55 struct dma_buf *dma_buf_export_named(void *priv, struct dma_buf_ops *ops, 56 size_t size, int flags, 57 const char *exp_name) 58 59 If this succeeds, dma_buf_export_named allocates a dma_buf structure, and 60 returns a pointer to the same. It also associates an anonymous file with this 61 buffer, so it can be exported. On failure to allocate the dma_buf object, 62 it returns NULL. 63 64 'exp_name' is the name of exporter - to facilitate information while 65 debugging. 66 67 Exporting modules which do not wish to provide any specific name may use the 68 helper define 'dma_buf_export()', with the same arguments as above, but 69 without the last argument; a KBUILD_MODNAME pre-processor directive will be 70 inserted in place of 'exp_name' instead. 71 722. Userspace gets a handle to pass around to potential buffer-users 73 74 Userspace entity requests for a file-descriptor (fd) which is a handle to the 75 anonymous file associated with the buffer. It can then share the fd with other 76 drivers and/or processes. 77 78 Interface: 79 int dma_buf_fd(struct dma_buf *dmabuf, int flags) 80 81 This API installs an fd for the anonymous file associated with this buffer; 82 returns either 'fd', or error. 83 843. Each buffer-user 'connects' itself to the buffer 85 86 Each buffer-user now gets a reference to the buffer, using the fd passed to 87 it. 88 89 Interface: 90 struct dma_buf *dma_buf_get(int fd) 91 92 This API will return a reference to the dma_buf, and increment refcount for 93 it. 94 95 After this, the buffer-user needs to attach its device with the buffer, which 96 helps the exporter to know of device buffer constraints. 97 98 Interface: 99 struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, 100 struct device *dev) 101 102 This API returns reference to an attachment structure, which is then used 103 for scatterlist operations. It will optionally call the 'attach' dma_buf 104 operation, if provided by the exporter. 105 106 The dma-buf sharing framework does the bookkeeping bits related to managing 107 the list of all attachments to a buffer. 108 109Until this stage, the buffer-exporter has the option to choose not to actually 110allocate the backing storage for this buffer, but wait for the first buffer-user 111to request use of buffer for allocation. 112 113 1144. When needed, buffer-user requests access to the buffer 115 116 Whenever a buffer-user wants to use the buffer for any DMA, it asks for 117 access to the buffer using dma_buf_map_attachment API. At least one attach to 118 the buffer must have happened before map_dma_buf can be called. 119 120 Interface: 121 struct sg_table * dma_buf_map_attachment(struct dma_buf_attachment *, 122 enum dma_data_direction); 123 124 This is a wrapper to dma_buf->ops->map_dma_buf operation, which hides the 125 "dma_buf->ops->" indirection from the users of this interface. 126 127 In struct dma_buf_ops, map_dma_buf is defined as 128 struct sg_table * (*map_dma_buf)(struct dma_buf_attachment *, 129 enum dma_data_direction); 130 131 It is one of the buffer operations that must be implemented by the exporter. 132 It should return the sg_table containing scatterlist for this buffer, mapped 133 into caller's address space. 134 135 If this is being called for the first time, the exporter can now choose to 136 scan through the list of attachments for this buffer, collate the requirements 137 of the attached devices, and choose an appropriate backing storage for the 138 buffer. 139 140 Based on enum dma_data_direction, it might be possible to have multiple users 141 accessing at the same time (for reading, maybe), or any other kind of sharing 142 that the exporter might wish to make available to buffer-users. 143 144 map_dma_buf() operation can return -EINTR if it is interrupted by a signal. 145 146 1475. When finished, the buffer-user notifies end-of-DMA to exporter 148 149 Once the DMA for the current buffer-user is over, it signals 'end-of-DMA' to 150 the exporter using the dma_buf_unmap_attachment API. 151 152 Interface: 153 void dma_buf_unmap_attachment(struct dma_buf_attachment *, 154 struct sg_table *); 155 156 This is a wrapper to dma_buf->ops->unmap_dma_buf() operation, which hides the 157 "dma_buf->ops->" indirection from the users of this interface. 158 159 In struct dma_buf_ops, unmap_dma_buf is defined as 160 void (*unmap_dma_buf)(struct dma_buf_attachment *, 161 struct sg_table *, 162 enum dma_data_direction); 163 164 unmap_dma_buf signifies the end-of-DMA for the attachment provided. Like 165 map_dma_buf, this API also must be implemented by the exporter. 166 167 1686. when buffer-user is done using this buffer, it 'disconnects' itself from the 169 buffer. 170 171 After the buffer-user has no more interest in using this buffer, it should 172 disconnect itself from the buffer: 173 174 - it first detaches itself from the buffer. 175 176 Interface: 177 void dma_buf_detach(struct dma_buf *dmabuf, 178 struct dma_buf_attachment *dmabuf_attach); 179 180 This API removes the attachment from the list in dmabuf, and optionally calls 181 dma_buf->ops->detach(), if provided by exporter, for any housekeeping bits. 182 183 - Then, the buffer-user returns the buffer reference to exporter. 184 185 Interface: 186 void dma_buf_put(struct dma_buf *dmabuf); 187 188 This API then reduces the refcount for this buffer. 189 190 If, as a result of this call, the refcount becomes 0, the 'release' file 191 operation related to this fd is called. It calls the dmabuf->ops->release() 192 operation in turn, and frees the memory allocated for dmabuf when exported. 193 194NOTES: 195- Importance of attach-detach and {map,unmap}_dma_buf operation pairs 196 The attach-detach calls allow the exporter to figure out backing-storage 197 constraints for the currently-interested devices. This allows preferential 198 allocation, and/or migration of pages across different types of storage 199 available, if possible. 200 201 Bracketing of DMA access with {map,unmap}_dma_buf operations is essential 202 to allow just-in-time backing of storage, and migration mid-way through a 203 use-case. 204 205- Migration of backing storage if needed 206 If after 207 - at least one map_dma_buf has happened, 208 - and the backing storage has been allocated for this buffer, 209 another new buffer-user intends to attach itself to this buffer, it might 210 be allowed, if possible for the exporter. 211 212 In case it is allowed by the exporter: 213 if the new buffer-user has stricter 'backing-storage constraints', and the 214 exporter can handle these constraints, the exporter can just stall on the 215 map_dma_buf until all outstanding access is completed (as signalled by 216 unmap_dma_buf). 217 Once all users have finished accessing and have unmapped this buffer, the 218 exporter could potentially move the buffer to the stricter backing-storage, 219 and then allow further {map,unmap}_dma_buf operations from any buffer-user 220 from the migrated backing-storage. 221 222 If the exporter cannot fulfill the backing-storage constraints of the new 223 buffer-user device as requested, dma_buf_attach() would return an error to 224 denote non-compatibility of the new buffer-sharing request with the current 225 buffer. 226 227 If the exporter chooses not to allow an attach() operation once a 228 map_dma_buf() API has been called, it simply returns an error. 229 230Kernel cpu access to a dma-buf buffer object 231-------------------------------------------- 232 233The motivation to allow cpu access from the kernel to a dma-buf object from the 234importers side are: 235- fallback operations, e.g. if the devices is connected to a usb bus and the 236 kernel needs to shuffle the data around first before sending it away. 237- full transparency for existing users on the importer side, i.e. userspace 238 should not notice the difference between a normal object from that subsystem 239 and an imported one backed by a dma-buf. This is really important for drm 240 opengl drivers that expect to still use all the existing upload/download 241 paths. 242 243Access to a dma_buf from the kernel context involves three steps: 244 2451. Prepare access, which invalidate any necessary caches and make the object 246 available for cpu access. 2472. Access the object page-by-page with the dma_buf map apis 2483. Finish access, which will flush any necessary cpu caches and free reserved 249 resources. 250 2511. Prepare access 252 253 Before an importer can access a dma_buf object with the cpu from the kernel 254 context, it needs to notify the exporter of the access that is about to 255 happen. 256 257 Interface: 258 int dma_buf_begin_cpu_access(struct dma_buf *dmabuf, 259 size_t start, size_t len, 260 enum dma_data_direction direction) 261 262 This allows the exporter to ensure that the memory is actually available for 263 cpu access - the exporter might need to allocate or swap-in and pin the 264 backing storage. The exporter also needs to ensure that cpu access is 265 coherent for the given range and access direction. The range and access 266 direction can be used by the exporter to optimize the cache flushing, i.e. 267 access outside of the range or with a different direction (read instead of 268 write) might return stale or even bogus data (e.g. when the exporter needs to 269 copy the data to temporary storage). 270 271 This step might fail, e.g. in oom conditions. 272 2732. Accessing the buffer 274 275 To support dma_buf objects residing in highmem cpu access is page-based using 276 an api similar to kmap. Accessing a dma_buf is done in aligned chunks of 277 PAGE_SIZE size. Before accessing a chunk it needs to be mapped, which returns 278 a pointer in kernel virtual address space. Afterwards the chunk needs to be 279 unmapped again. There is no limit on how often a given chunk can be mapped 280 and unmapped, i.e. the importer does not need to call begin_cpu_access again 281 before mapping the same chunk again. 282 283 Interfaces: 284 void *dma_buf_kmap(struct dma_buf *, unsigned long); 285 void dma_buf_kunmap(struct dma_buf *, unsigned long, void *); 286 287 There are also atomic variants of these interfaces. Like for kmap they 288 facilitate non-blocking fast-paths. Neither the importer nor the exporter (in 289 the callback) is allowed to block when using these. 290 291 Interfaces: 292 void *dma_buf_kmap_atomic(struct dma_buf *, unsigned long); 293 void dma_buf_kunmap_atomic(struct dma_buf *, unsigned long, void *); 294 295 For importers all the restrictions of using kmap apply, like the limited 296 supply of kmap_atomic slots. Hence an importer shall only hold onto at most 2 297 atomic dma_buf kmaps at the same time (in any given process context). 298 299 dma_buf kmap calls outside of the range specified in begin_cpu_access are 300 undefined. If the range is not PAGE_SIZE aligned, kmap needs to succeed on 301 the partial chunks at the beginning and end but may return stale or bogus 302 data outside of the range (in these partial chunks). 303 304 Note that these calls need to always succeed. The exporter needs to complete 305 any preparations that might fail in begin_cpu_access. 306 307 For some cases the overhead of kmap can be too high, a vmap interface 308 is introduced. This interface should be used very carefully, as vmalloc 309 space is a limited resources on many architectures. 310 311 Interfaces: 312 void *dma_buf_vmap(struct dma_buf *dmabuf) 313 void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr) 314 315 The vmap call can fail if there is no vmap support in the exporter, or if it 316 runs out of vmalloc space. Fallback to kmap should be implemented. Note that 317 the dma-buf layer keeps a reference count for all vmap access and calls down 318 into the exporter's vmap function only when no vmapping exists, and only 319 unmaps it once. Protection against concurrent vmap/vunmap calls is provided 320 by taking the dma_buf->lock mutex. 321 3223. Finish access 323 324 When the importer is done accessing the range specified in begin_cpu_access, 325 it needs to announce this to the exporter (to facilitate cache flushing and 326 unpinning of any pinned resources). The result of any dma_buf kmap calls 327 after end_cpu_access is undefined. 328 329 Interface: 330 void dma_buf_end_cpu_access(struct dma_buf *dma_buf, 331 size_t start, size_t len, 332 enum dma_data_direction dir); 333 334 335Direct Userspace Access/mmap Support 336------------------------------------ 337 338Being able to mmap an export dma-buf buffer object has 2 main use-cases: 339- CPU fallback processing in a pipeline and 340- supporting existing mmap interfaces in importers. 341 3421. CPU fallback processing in a pipeline 343 344 In many processing pipelines it is sometimes required that the cpu can access 345 the data in a dma-buf (e.g. for thumbnail creation, snapshots, ...). To avoid 346 the need to handle this specially in userspace frameworks for buffer sharing 347 it's ideal if the dma_buf fd itself can be used to access the backing storage 348 from userspace using mmap. 349 350 Furthermore Android's ION framework already supports this (and is otherwise 351 rather similar to dma-buf from a userspace consumer side with using fds as 352 handles, too). So it's beneficial to support this in a similar fashion on 353 dma-buf to have a good transition path for existing Android userspace. 354 355 No special interfaces, userspace simply calls mmap on the dma-buf fd. 356 3572. Supporting existing mmap interfaces in importers 358 359 Similar to the motivation for kernel cpu access it is again important that 360 the userspace code of a given importing subsystem can use the same interfaces 361 with a imported dma-buf buffer object as with a native buffer object. This is 362 especially important for drm where the userspace part of contemporary OpenGL, 363 X, and other drivers is huge, and reworking them to use a different way to 364 mmap a buffer rather invasive. 365 366 The assumption in the current dma-buf interfaces is that redirecting the 367 initial mmap is all that's needed. A survey of some of the existing 368 subsystems shows that no driver seems to do any nefarious thing like syncing 369 up with outstanding asynchronous processing on the device or allocating 370 special resources at fault time. So hopefully this is good enough, since 371 adding interfaces to intercept pagefaults and allow pte shootdowns would 372 increase the complexity quite a bit. 373 374 Interface: 375 int dma_buf_mmap(struct dma_buf *, struct vm_area_struct *, 376 unsigned long); 377 378 If the importing subsystem simply provides a special-purpose mmap call to set 379 up a mapping in userspace, calling do_mmap with dma_buf->file will equally 380 achieve that for a dma-buf object. 381 3823. Implementation notes for exporters 383 384 Because dma-buf buffers have invariant size over their lifetime, the dma-buf 385 core checks whether a vma is too large and rejects such mappings. The 386 exporter hence does not need to duplicate this check. 387 388 Because existing importing subsystems might presume coherent mappings for 389 userspace, the exporter needs to set up a coherent mapping. If that's not 390 possible, it needs to fake coherency by manually shooting down ptes when 391 leaving the cpu domain and flushing caches at fault time. Note that all the 392 dma_buf files share the same anon inode, hence the exporter needs to replace 393 the dma_buf file stored in vma->vm_file with it's own if pte shootdown is 394 required. This is because the kernel uses the underlying inode's address_space 395 for vma tracking (and hence pte tracking at shootdown time with 396 unmap_mapping_range). 397 398 If the above shootdown dance turns out to be too expensive in certain 399 scenarios, we can extend dma-buf with a more explicit cache tracking scheme 400 for userspace mappings. But the current assumption is that using mmap is 401 always a slower path, so some inefficiencies should be acceptable. 402 403 Exporters that shoot down mappings (for any reasons) shall not do any 404 synchronization at fault time with outstanding device operations. 405 Synchronization is an orthogonal issue to sharing the backing storage of a 406 buffer and hence should not be handled by dma-buf itself. This is explicitly 407 mentioned here because many people seem to want something like this, but if 408 different exporters handle this differently, buffer sharing can fail in 409 interesting ways depending upong the exporter (if userspace starts depending 410 upon this implicit synchronization). 411 412Other Interfaces Exposed to Userspace on the dma-buf FD 413------------------------------------------------------ 414 415- Since kernel 3.12 the dma-buf FD supports the llseek system call, but only 416 with offset=0 and whence=SEEK_END|SEEK_SET. SEEK_SET is supported to allow 417 the usual size discover pattern size = SEEK_END(0); SEEK_SET(0). Every other 418 llseek operation will report -EINVAL. 419 420 If llseek on dma-buf FDs isn't support the kernel will report -ESPIPE for all 421 cases. Userspace can use this to detect support for discovering the dma-buf 422 size using llseek. 423 424Miscellaneous notes 425------------------- 426 427- Any exporters or users of the dma-buf buffer sharing framework must have 428 a 'select DMA_SHARED_BUFFER' in their respective Kconfigs. 429 430- In order to avoid fd leaks on exec, the FD_CLOEXEC flag must be set 431 on the file descriptor. This is not just a resource leak, but a 432 potential security hole. It could give the newly exec'd application 433 access to buffers, via the leaked fd, to which it should otherwise 434 not be permitted access. 435 436 The problem with doing this via a separate fcntl() call, versus doing it 437 atomically when the fd is created, is that this is inherently racy in a 438 multi-threaded app[3]. The issue is made worse when it is library code 439 opening/creating the file descriptor, as the application may not even be 440 aware of the fd's. 441 442 To avoid this problem, userspace must have a way to request O_CLOEXEC 443 flag be set when the dma-buf fd is created. So any API provided by 444 the exporting driver to create a dmabuf fd must provide a way to let 445 userspace control setting of O_CLOEXEC flag passed in to dma_buf_fd(). 446 447- If an exporter needs to manually flush caches and hence needs to fake 448 coherency for mmap support, it needs to be able to zap all the ptes pointing 449 at the backing storage. Now linux mm needs a struct address_space associated 450 with the struct file stored in vma->vm_file to do that with the function 451 unmap_mapping_range. But the dma_buf framework only backs every dma_buf fd 452 with the anon_file struct file, i.e. all dma_bufs share the same file. 453 454 Hence exporters need to setup their own file (and address_space) association 455 by setting vma->vm_file and adjusting vma->vm_pgoff in the dma_buf mmap 456 callback. In the specific case of a gem driver the exporter could use the 457 shmem file already provided by gem (and set vm_pgoff = 0). Exporters can then 458 zap ptes by unmapping the corresponding range of the struct address_space 459 associated with their own file. 460 461References: 462[1] struct dma_buf_ops in include/linux/dma-buf.h 463[2] All interfaces mentioned above defined in include/linux/dma-buf.h 464[3] https://lwn.net/Articles/236486/ 465