[Posted April 3, 2012 by corbet]
DMA Buffer Sharing API Guide
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sumit Semwal
<sumit dot semwal at linaro dot org>
<sumit dot semwal at ti dot com>
This document serves as a guide to device-driver writers on what is the dma-buf
buffer sharing API, how to use it for exporting and using shared buffers.
Any device driver which wishes to be a part of DMA buffer sharing, can do so as
either the 'exporter' of buffers, or the 'user' of buffers.
Say a driver A wants to use buffers created by driver B, then we call B as the
exporter, and A as buffer-user.
The exporter
- implements and manages operations[1] for the buffer
- allows other users to share the buffer by using dma_buf sharing APIs,
- manages the details of buffer allocation,
- decides about the actual backing storage where this allocation happens,
- takes care of any migration of scatterlist - for all (shared) users of this
buffer,
The buffer-user
- is one of (many) sharing users of the buffer.
- doesn't need to worry about how the buffer is allocated, or where.
- needs a mechanism to get access to the scatterlist that makes up this buffer
in memory, mapped into its own address space, so it can access the same area
of memory.
*IMPORTANT*: [see https://lkml.org/lkml/2011/12/20/211 for more details]
For this first version, A buffer shared using the dma_buf sharing API:
- *may* be exported to user space using "mmap" *ONLY* by exporter, outside of
this framework.
- with this new iteration of the dma-buf api cpu access from the kernel has been
enable, see below for the details.
dma-buf operations for device dma only
--------------------------------------
The dma_buf buffer sharing API usage contains the following steps:
1. Exporter announces that it wishes to export a buffer
2. Userspace gets the file descriptor associated with the exported buffer, and
passes it around to potential buffer-users based on use case
3. Each buffer-user 'connects' itself to the buffer
4. When needed, buffer-user requests access to the buffer from exporter
5. When finished with its use, the buffer-user notifies end-of-DMA to exporter
6. when buffer-user is done using this buffer completely, it 'disconnects'
itself from the buffer.
1. Exporter's announcement of buffer export
The buffer exporter announces its wish to export a buffer. In this, it
connects its own private buffer data, provides implementation for operations
that can be performed on the exported dma_buf, and flags for the file
associated with this buffer.
Interface:
struct dma_buf *dma_buf_export(void *priv, struct dma_buf_ops *ops,
size_t size, int flags)
If this succeeds, dma_buf_export allocates a dma_buf structure, and returns a
pointer to the same. It also associates an anonymous file with this buffer,
so it can be exported. On failure to allocate the dma_buf object, it returns
NULL.
//实际上就是初始化并返回一个dma_buf
struct dma_buf *dma_buf_export(void *priv, const struct dma_buf_ops *ops, size_t size, int flags)
+-- dmabuf = kzalloc(sizeof(struct dma_buf), GFP_KERNEL);
+-- dmabuf->priv = priv;
+-- dmabuf->ops = ops;
+-- dmabuf->size = size;
//anon_inode_getfile的形参priv对应的就是struct dma_buf * dmabuf
//struct file *anon_inode_getfile(const char *name, const struct file_operations *fops,
// void *priv, int flags)
//所以,此后,就可以通过指针file->private_date指针拿到dambuf,进而拿到dmabuf相关的数据,例如：
//由exporter定义的struct dma_buf_ops接口函数集
+-- file = anon_inode_getfile("dmabuf", &dma_buf_fops, dmabuf, flags);
+-- file->private_data = priv;
+-- dmabuf->file = file;
+-- return dmabuf;
//这里要注意一下anon_inode_getfile()的第二个形参是一个struct file_operations结构
//struct file *anon_inode_getfile(const char *name,
// const struct file_operations *fops,
// void *priv, int flags)
//而传入的dma_buf_ops似乎只初始化了了一个release函数指针.其余接口函数指针均未初始化.
//static const struct file_operations dma_buf_fops = {
// .release = dma_buf_release,
//};
//dma_buf真正的操作是由传入的struct dma_buf_ops *ops来完成的.这个结构有exporter实现.
//下面看下这个结构的定义：
/**
* struct dma_buf_ops - operations possible on struct dma_buf
* @attach: [optional] allows different devices to 'attach' themselves to the
* given buffer. It might return -EBUSY to signal that backing storage
* is already allocated and incompatible with the requirements
* of requesting device.
* @detach: [optional] detach a given device from this buffer.
* @map_dma_buf: returns list of scatter pages allocated, increases usecount
* of the buffer. Requires atleast one attach to be called
* before. Returned sg list should already be mapped into
* _device_ address space. This call may sleep. May also return
* -EINTR. Should return -EINVAL if attach hasn't been called yet.
* @unmap_dma_buf: decreases usecount of buffer, might deallocate scatter
* pages.
* @release: release this buffer; to be called after the last dma_buf_put.
* @begin_cpu_access: [optional] called before cpu access to invalidate cpu
* caches and allocate backing storage (if not yet done)
* respectively pin the objet into memory.
* @end_cpu_access: [optional] called after cpu access to flush cashes.
* @kmap_atomic: maps a page from the buffer into kernel address
* space, users may not block until the subsequent unmap call.
* This callback must not sleep.
* @kunmap_atomic: [optional] unmaps a atomically mapped page from the buffer.
* This Callback must not sleep.
* @kmap: maps a page from the buffer into kernel address space.
* @kunmap: [optional] unmaps a page from the buffer.
*/
struct dma_buf_ops {
int (*attach)(struct dma_buf *, struct device *, struct dma_buf_attachment *);
void (*detach)(struct dma_buf *, struct dma_buf_attachment *);
//For {map,unmap}_dma_buf below, any specific buffer attributes required should
//get added to device_dma_parameters accessible via dev->dma_params.
struct sg_table * (*map_dma_buf)(struct dma_buf_attachment *, enum dma_data_direction);
void (*unmap_dma_buf)(struct dma_buf_attachment *, struct sg_table *, enum dma_data_direction);
//TODO: Add try_map_dma_buf version, to return immed with -EBUSY if the call would block.
/* after final dma_buf_put() */
void (*release)(struct dma_buf *);
int (*begin_cpu_access)(struct dma_buf *, size_t, size_t, enum dma_data_direction);
void (*end_cpu_access)(struct dma_buf *, size_t, size_t, enum dma_data_direction);
void *(*kmap_atomic)(struct dma_buf *, unsigned long);
void (*kunmap_atomic)(struct dma_buf *, unsigned long, void *);
void *(*kmap)(struct dma_buf *, unsigned long);
void (*kunmap)(struct dma_buf *, unsigned long, void *);
};
2. Userspace gets a handle to pass around to potential buffer-users
Userspace entity requests for a file-descriptor (fd) which is a handle to the
anonymous file associated with the buffer. It can then share the fd with other
drivers and/or processes.
Interface:
int dma_buf_fd(struct dma_buf *dmabuf)
This API installs an fd for the anonymous file associated with this buffer;
returns either 'fd', or error.
//猜想,exporter为了提供共享dma buffer的服务,它自己应该将dma_buf_fd封装成一个不需要任何参数的接口
//并将这个接口暴露出来，其他进程以此获得file对应的文件描述符fd.
int dma_buf_fd(struct dma_buf *dmabuf, int flags)
+-- error = get_unused_fd_flags(flags);
+-- alloc_fd(0, (flags))
+-- struct files_struct *files = current->files;
+-- fdt = files_fdtable(files);
+-- fd = find_next_zero_bit(fdt->open_fds, fdt->max_fds, fd);
+-- files->next_fd = fd + 1;
+-- __set_open_fd(fd, fdt);
+-- error = fd;
+-- return error;
+-- fd = error;
//dmabuf->file在dma_buf_export的时候实际已经创建好了,这里只不过是在当前进程中找到一个空闲的文件描述符,
//并将这个文件描述符和dmabuf->file关联起来,之后当前进程就可以用这个文件描述符来访问这个struct file结构了.
//而通过file->private_data就可以拿到dma_buf(dma_buf_export()已经激昂dma_buf保存在private_data域里面了)
//进而拿到dma_buf相关的其他东西.
+-- fd_install(fd, dmabuf->file);
+-- struct files_struct *files = current->files;
+-- fdt = files_fdtable(files);
+-- rcu_assign_pointer(fdt->fd[fd], file);
+-- return fd;
3. Each buffer-user 'connects' itself to the buffer
Each buffer-user now gets a reference to the buffer, using the fd passed to
it.
Interface:
struct dma_buf *dma_buf_get(int fd)
This API will return a reference to the dma_buf, and increment refcount for
it.
//利用fd拿到对应的stuct dma_buf结构实例
struct dma_buf *
dma_buf_get(int fd)
+-- struct file *file;
+-- file = fget(fd);
+-- is_dma_buf_file(file)
+-- return file->f_op == &dma_buf_fops;
+-- return file->private_data;
After this, the buffer-user needs to attach its device with the buffer, which
helps the exporter to know of device buffer constraints.
Interface:
struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
struct device *dev)
This API returns reference to an attachment structure, which is then used
for scatterlist operations. It will optionally call the 'attach' dma_buf
operation, if provided by the exporter.
The dma-buf sharing framework does the bookkeeping bits related to managing
the list of all attachments to a buffer.
Until this stage, the buffer-exporter has the option to choose not to actually
allocate the backing storage for this buffer, but wait for the first buffer-user
to request use of buffer for allocation.
struct dma_buf_attachment *
dma_buf_attach(struct dma_buf *dmabuf, struct device *dev)
+-- struct dma_buf_attachment *attach;
+-- attach = kzalloc(sizeof(struct dma_buf_attachment), GFP_KERNEL);
+-- attach->dev = dev;
+-- attach->dmabuf = dmabuf;
+-- mutex_lock(&dmabuf->lock);
+-- dmabuf->ops->attach(dmabuf, dev, attach);
+-- list_add(&attach->node, &dmabuf->attachments);
+-- mutex_unlock(&dmabuf->lock);
+-- return attach;
4. When needed, buffer-user requests access to the buffer
Whenever a buffer-user wants to use the buffer for any DMA, it asks for
access to the buffer using dma_buf_map_attachment API. At least one attach to
the buffer must have happened before map_dma_buf can be called.
Interface:
struct sg_table * dma_buf_map_attachment(struct dma_buf_attachment *,
enum dma_data_direction);
This is a wrapper to dma_buf->ops->map_dma_buf operation, which hides the
"dma_buf->ops->" indirection from the users of this interface.
In struct dma_buf_ops, map_dma_buf is defined as
struct sg_table * (*map_dma_buf)(struct dma_buf_attachment *,
enum dma_data_direction);
It is one of the buffer operations that must be implemented by the exporter.
It should return the sg_table containing scatterlist for this buffer, mapped
into caller's address space.
If this is being called for the first time, the exporter can now choose to
scan through the list of attachments for this buffer, collate the requirements
of the attached devices, and choose an appropriate backing storage for the
buffer.
Based on enum dma_data_direction, it might be possible to have multiple users
accessing at the same time (for reading, maybe), or any other kind of sharing
that the exporter might wish to make available to buffer-users.
map_dma_buf() operation can return -EINTR if it is interrupted by a signal.
struct sg_table *
dma_buf_map_attachment(struct dma_buf_attachment *attach, enum dma_data_direction direction)
+-- struct sg_table *sg_table = ERR_PTR(-EINVAL);
+-- might_sleep();
+-- sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
+-- return sg_table;
5. When finished, the buffer-user notifies end-of-DMA to exporter
Once the DMA for the current buffer-user is over, it signals 'end-of-DMA' to
the exporter using the dma_buf_unmap_attachment API.
Interface:
void dma_buf_unmap_attachment(struct dma_buf_attachment *,
struct sg_table *);
This is a wrapper to dma_buf->ops->unmap_dma_buf() operation, which hides the
"dma_buf->ops->" indirection from the users of this interface.
In struct dma_buf_ops, unmap_dma_buf is defined as
void (*unmap_dma_buf)(struct dma_buf_attachment *, struct sg_table *);
unmap_dma_buf signifies the end-of-DMA for the attachment provided. Like
map_dma_buf, this API also must be implemented by the exporter.
void dma_buf_unmap_attachment(struct dma_buf_attachment *attach, struct sg_table *sg_table,
enum dma_data_direction direction)
+-- attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
6. when buffer-user is done using this buffer, it 'disconnects' itself from the buffer.
After the buffer-user has no more interest in using this buffer, it should
disconnect itself from the buffer:
- it first detaches itself from the buffer.
Interface:
void dma_buf_detach(struct dma_buf *dmabuf,
struct dma_buf_attachment *dmabuf_attach);
This API removes the attachment from the list in dmabuf, and optionally calls
dma_buf->ops->detach(), if provided by exporter, for any housekeeping bits.
void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
+-- mutex_lock(&dmabuf->lock);
+-- list_del(&attach->node);
+-- dmabuf->ops->detach(dmabuf, attach);
+-- mutex_unlock(&dmabuf->lock);
- Then, the buffer-user returns the buffer reference to exporter.
Interface:
void dma_buf_put(struct dma_buf *dmabuf);
This API then reduces the refcount for this buffer.
If, as a result of this call, the refcount becomes 0, the 'release' file
operation related to this fd is called. It calls the dmabuf->ops->release()
operation in turn, and frees the memory allocated for dmabuf when exported.
void dma_buf_put(struct dma_buf *dmabuf)
+-- fput(dmabuf->file);
NOTES:
- Importance of attach-detach and {map,unmap}_dma_buf operation pairs
The attach-detach calls allow the exporter to figure out backing-storage
constraints for the currently-interested devices. This allows preferential
allocation, and/or migration of pages across different types of storage
available, if possible.
Bracketing of DMA access with {map,unmap}_dma_buf operations is essential
to allow just-in-time backing of storage, and migration mid-way through a
use-case.
- Migration of backing storage if needed
If after
- at least one map_dma_buf has happened,
- and the backing storage has been allocated for this buffer,
another new buffer-user intends to attach itself to this buffer, it might
be allowed, if possible for the exporter.
In case it is allowed by the exporter:
if the new buffer-user has stricter 'backing-storage constraints', and the
exporter can handle these constraints, the exporter can just stall on the
map_dma_buf until all outstanding access is completed (as signalled by
unmap_dma_buf).
Once all users have finished accessing and have unmapped this buffer, the
exporter could potentially move the buffer to the stricter backing-storage,
and then allow further {map,unmap}_dma_buf operations from any buffer-user
from the migrated backing-storage.
If the exporter cannot fulfil the backing-storage constraints of the new
buffer-user device as requested, dma_buf_attach() would return an error to
denote non-compatibility of the new buffer-sharing request with the current
buffer.
If the exporter chooses not to allow an attach() operation once a
map_dma_buf() API has been called, it simply returns an error.
Kernel cpu access to a dma-buf buffer object
--------------------------------------------
The motivation to allow cpu access from the kernel to a dma-buf object from the
importers side are:
- fallback operations, e.g. if the devices is connected to a usb bus and the
kernel needs to shuffle the data around first before sending it away.
- full transparency for existing users on the importer side, i.e. userspace
should not notice the difference between a normal object from that subsystem
and an imported one backed by a dma-buf. This is really important for drm
opengl drivers that expect to still use all the existing upload/download
paths.
Access to a dma_buf from the kernel context involves three steps:
1. Prepare access, which invalidate any necessary caches and make the object
available for cpu access.
2. Access the object page-by-page with the dma_buf map apis
3. Finish access, which will flush any necessary cpu caches and free reserved
resources.
1. Prepare access
Before an importer can access a dma_buf object with the cpu from the kernel
context, it needs to notify the exporter of the access that is about to
happen.
Interface:
int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
size_t start, size_t len,
enum dma_data_direction direction)
This allows the exporter to ensure that the memory is actually available for
cpu access - the exporter might need to allocate or swap-in and pin the
backing storage. The exporter also needs to ensure that cpu access is
coherent for the given range and access direction. The range and access
direction can be used by the exporter to optimize the cache flushing, i.e.
access outside of the range or with a different direction (read instead of
write) might return stale or even bogus data (e.g. when the exporter needs to
copy the data to temporary storage).
This step might fail, e.g. in oom conditions.
int dma_buf_begin_cpu_access(struct dma_buf *dmabuf, size_t start, size_t len,
enum dma_data_direction direction)
+-- dmabuf->ops->begin_cpu_access(dmabuf, start, len, direction);
2. Accessing the buffer
To support dma_buf objects residing in highmem cpu access is page-based using
an api similar to kmap. Accessing a dma_buf is done in aligned chunks of
PAGE_SIZE size. Before accessing a chunk it needs to be mapped, which returns
a pointer in kernel virtual address space. Afterwards the chunk needs to be
unmapped again. There is no limit on how often a given chunk can be mapped
and unmapped, i.e. the importer does not need to call begin_cpu_access again
before mapping the same chunk again.
Interfaces:
void *dma_buf_kmap(struct dma_buf *, unsigned long);
void dma_buf_kunmap(struct dma_buf *, unsigned long, void *);
void * dma_buf_kmap(struct dma_buf *dmabuf, unsigned long page_num)
+-- dmabuf->ops->kmap(dmabuf, page_num);
void dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long page_num, void *vaddr)
+-- dmabuf->ops->kunmap(dmabuf, page_num, vaddr);
There are also atomic variants of these interfaces. Like for kmap they
facilitate non-blocking fast-paths. Neither the importer nor the exporter (in
the callback) is allowed to block when using these.
Interfaces:
void *dma_buf_kmap_atomic(struct dma_buf *, unsigned long);
void dma_buf_kunmap_atomic(struct dma_buf *, unsigned long, void *);
void *dma_buf_kmap_atomic(struct dma_buf *dmabuf, unsigned long page_num)
+-- dmabuf->ops->kmap_atomic(dmabuf, page_num);
void dma_buf_kunmap_atomic(struct dma_buf *dmabuf, unsigned long page_num, void *vaddr)
+-- dmabuf->ops->kunmap_atomic(dmabuf, page_num, vaddr);
For importers all the restrictions of using kmap apply, like the limited
supply of kmap_atomic slots. Hence an importer shall only hold onto at most 2
atomic dma_buf kmaps at the same time (in any given process context).
dma_buf kmap calls outside of the range specified in begin_cpu_access are
undefined. If the range is not PAGE_SIZE aligned, kmap needs to succeed on
the partial chunks at the beginning and end but may return stale or bogus
data outside of the range (in these partial chunks).
Note that these calls need to always succeed. The exporter needs to complete
any preparations that might fail in begin_cpu_access.
3. Finish access
When the importer is done accessing the range specified in begin_cpu_access,
it needs to announce this to the exporter (to facilitate cache flushing and
unpinning of any pinned resources). The result of of any dma_buf kmap calls
after end_cpu_access is undefined.
Interface:
void dma_buf_end_cpu_access(struct dma_buf *dma_buf,
size_t start, size_t len,
enum dma_data_direction dir);
void dma_buf_end_cpu_access(struct dma_buf *dmabuf, size_t start, size_t len,
enum dma_data_direction direction)
+-- dmabuf->ops->end_cpu_access(dmabuf, start, len, direction);
Miscellaneous notes ------------------- - Any exporters or users of the dma-buf buffer sharing framework must have a 'select DMA_SHARED_BUFFER' in their respective Kconfigs. - In order to avoid fd leaks on exec, the FD_CLOEXEC flag must be set on the file descriptor. This is not just a resource leak, but a potential security hole. It could give the newly exec'd application access to buffers, via the leaked fd, to which it should otherwise not be permitted access. The problem with doing this via a separate fcntl() call, versus doing it atomically when the fd is created, is that this is inherently racy in a multi-threaded app[3]. The issue is made worse when it is library code opening/creating the file descriptor, as the application may not even be aware of the fd's. To avoid this problem, userspace must have a way to request O_CLOEXEC flag be set when the dma-buf fd is created. So any API provided by the exporting driver to create a dmabuf fd must provide a way to let userspace control setting of O_CLOEXEC flag passed in to dma_buf_fd(). References: [1] struct dma_buf_ops in include/linux/dma-buf.h [2] All interfaces mentioned above defined in include/linux/dma-buf.h [3] https://lwn.net/Articles/236486/
//@drivers/base/dma-buf.c对外暴露的接口:
EXPORT_SYMBOL_GPL(dma_buf_export);
EXPORT_SYMBOL_GPL(dma_buf_fd);
EXPORT_SYMBOL_GPL(dma_buf_get);
EXPORT_SYMBOL_GPL(dma_buf_put);
EXPORT_SYMBOL_GPL(dma_buf_attach);
EXPORT_SYMBOL_GPL(dma_buf_detach);
EXPORT_SYMBOL_GPL(dma_buf_map_attachment);
EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);
EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
EXPORT_SYMBOL_GPL(dma_buf_kmap_atomic);
EXPORT_SYMBOL_GPL(dma_buf_kunmap_atomic);
EXPORT_SYMBOL_GPL(dma_buf_kmap);
EXPORT_SYMBOL_GPL(dma_buf_kunmap);
4355
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
