cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

provider.rst (24181B)


      1==================================
      2DMAengine controller documentation
      3==================================
      4
      5Hardware Introduction
      6=====================
      7
      8Most of the Slave DMA controllers have the same general principles of
      9operations.
     10
     11They have a given number of channels to use for the DMA transfers, and
     12a given number of requests lines.
     13
     14Requests and channels are pretty much orthogonal. Channels can be used
     15to serve several to any requests. To simplify, channels are the
     16entities that will be doing the copy, and requests what endpoints are
     17involved.
     18
     19The request lines actually correspond to physical lines going from the
     20DMA-eligible devices to the controller itself. Whenever the device
     21will want to start a transfer, it will assert a DMA request (DRQ) by
     22asserting that request line.
     23
     24A very simple DMA controller would only take into account a single
     25parameter: the transfer size. At each clock cycle, it would transfer a
     26byte of data from one buffer to another, until the transfer size has
     27been reached.
     28
     29That wouldn't work well in the real world, since slave devices might
     30require a specific number of bits to be transferred in a single
     31cycle. For example, we may want to transfer as much data as the
     32physical bus allows to maximize performances when doing a simple
     33memory copy operation, but our audio device could have a narrower FIFO
     34that requires data to be written exactly 16 or 24 bits at a time. This
     35is why most if not all of the DMA controllers can adjust this, using a
     36parameter called the transfer width.
     37
     38Moreover, some DMA controllers, whenever the RAM is used as a source
     39or destination, can group the reads or writes in memory into a buffer,
     40so instead of having a lot of small memory accesses, which is not
     41really efficient, you'll get several bigger transfers. This is done
     42using a parameter called the burst size, that defines how many single
     43reads/writes it's allowed to do without the controller splitting the
     44transfer into smaller sub-transfers.
     45
     46Our theoretical DMA controller would then only be able to do transfers
     47that involve a single contiguous block of data. However, some of the
     48transfers we usually have are not, and want to copy data from
     49non-contiguous buffers to a contiguous buffer, which is called
     50scatter-gather.
     51
     52DMAEngine, at least for mem2dev transfers, require support for
     53scatter-gather. So we're left with two cases here: either we have a
     54quite simple DMA controller that doesn't support it, and we'll have to
     55implement it in software, or we have a more advanced DMA controller,
     56that implements in hardware scatter-gather.
     57
     58The latter are usually programmed using a collection of chunks to
     59transfer, and whenever the transfer is started, the controller will go
     60over that collection, doing whatever we programmed there.
     61
     62This collection is usually either a table or a linked list. You will
     63then push either the address of the table and its number of elements,
     64or the first item of the list to one channel of the DMA controller,
     65and whenever a DRQ will be asserted, it will go through the collection
     66to know where to fetch the data from.
     67
     68Either way, the format of this collection is completely dependent on
     69your hardware. Each DMA controller will require a different structure,
     70but all of them will require, for every chunk, at least the source and
     71destination addresses, whether it should increment these addresses or
     72not and the three parameters we saw earlier: the burst size, the
     73transfer width and the transfer size.
     74
     75The one last thing is that usually, slave devices won't issue DRQ by
     76default, and you have to enable this in your slave device driver first
     77whenever you're willing to use DMA.
     78
     79These were just the general memory-to-memory (also called mem2mem) or
     80memory-to-device (mem2dev) kind of transfers. Most devices often
     81support other kind of transfers or memory operations that dmaengine
     82support and will be detailed later in this document.
     83
     84DMA Support in Linux
     85====================
     86
     87Historically, DMA controller drivers have been implemented using the
     88async TX API, to offload operations such as memory copy, XOR,
     89cryptography, etc., basically any memory to memory operation.
     90
     91Over time, the need for memory to device transfers arose, and
     92dmaengine was extended. Nowadays, the async TX API is written as a
     93layer on top of dmaengine, and acts as a client. Still, dmaengine
     94accommodates that API in some cases, and made some design choices to
     95ensure that it stayed compatible.
     96
     97For more information on the Async TX API, please look the relevant
     98documentation file in Documentation/crypto/async-tx-api.rst.
     99
    100DMAEngine APIs
    101==============
    102
    103``struct dma_device`` Initialization
    104------------------------------------
    105
    106Just like any other kernel framework, the whole DMAEngine registration
    107relies on the driver filling a structure and registering against the
    108framework. In our case, that structure is dma_device.
    109
    110The first thing you need to do in your driver is to allocate this
    111structure. Any of the usual memory allocators will do, but you'll also
    112need to initialize a few fields in there:
    113
    114- ``channels``: should be initialized as a list using the
    115  INIT_LIST_HEAD macro for example
    116
    117- ``src_addr_widths``:
    118  should contain a bitmask of the supported source transfer width
    119
    120- ``dst_addr_widths``:
    121  should contain a bitmask of the supported destination transfer width
    122
    123- ``directions``:
    124  should contain a bitmask of the supported slave directions
    125  (i.e. excluding mem2mem transfers)
    126
    127- ``residue_granularity``:
    128  granularity of the transfer residue reported to dma_set_residue.
    129  This can be either:
    130
    131  - Descriptor:
    132    your device doesn't support any kind of residue
    133    reporting. The framework will only know that a particular
    134    transaction descriptor is done.
    135
    136  - Segment:
    137    your device is able to report which chunks have been transferred
    138
    139  - Burst:
    140    your device is able to report which burst have been transferred
    141
    142- ``dev``: should hold the pointer to the ``struct device`` associated
    143  to your current driver instance.
    144
    145Supported transaction types
    146---------------------------
    147
    148The next thing you need is to set which transaction types your device
    149(and driver) supports.
    150
    151Our ``dma_device structure`` has a field called cap_mask that holds the
    152various types of transaction supported, and you need to modify this
    153mask using the dma_cap_set function, with various flags depending on
    154transaction types you support as an argument.
    155
    156All those capabilities are defined in the ``dma_transaction_type enum``,
    157in ``include/linux/dmaengine.h``
    158
    159Currently, the types available are:
    160
    161- DMA_MEMCPY
    162
    163  - The device is able to do memory to memory copies
    164
    165- - DMA_MEMCPY_SG
    166
    167  - The device supports memory to memory scatter-gather transfers.
    168
    169  - Even though a plain memcpy can look like a particular case of a
    170    scatter-gather transfer, with a single chunk to copy, it's a distinct
    171    transaction type in the mem2mem transfer case. This is because some very
    172    simple devices might be able to do contiguous single-chunk memory copies,
    173    but have no support for more complex SG transfers.
    174
    175  - No matter what the overall size of the combined chunks for source and
    176    destination is, only as many bytes as the smallest of the two will be
    177    transmitted. That means the number and size of the scatter-gather buffers in
    178    both lists need not be the same, and that the operation functionally is
    179    equivalent to a ``strncpy`` where the ``count`` argument equals the smallest
    180    total size of the two scatter-gather list buffers.
    181
    182  - It's usually used for copying pixel data between host memory and
    183    memory-mapped GPU device memory, such as found on modern PCI video graphics
    184    cards. The most immediate example is the OpenGL API function
    185    ``glReadPielx()``, which might require a verbatim copy of a huge framebuffer
    186    from local device memory onto host memory.
    187
    188- DMA_XOR
    189
    190  - The device is able to perform XOR operations on memory areas
    191
    192  - Used to accelerate XOR intensive tasks, such as RAID5
    193
    194- DMA_XOR_VAL
    195
    196  - The device is able to perform parity check using the XOR
    197    algorithm against a memory buffer.
    198
    199- DMA_PQ
    200
    201  - The device is able to perform RAID6 P+Q computations, P being a
    202    simple XOR, and Q being a Reed-Solomon algorithm.
    203
    204- DMA_PQ_VAL
    205
    206  - The device is able to perform parity check using RAID6 P+Q
    207    algorithm against a memory buffer.
    208
    209- DMA_MEMSET
    210
    211  - The device is able to fill memory with the provided pattern
    212
    213  - The pattern is treated as a single byte signed value.
    214
    215- DMA_INTERRUPT
    216
    217  - The device is able to trigger a dummy transfer that will
    218    generate periodic interrupts
    219
    220  - Used by the client drivers to register a callback that will be
    221    called on a regular basis through the DMA controller interrupt
    222
    223- DMA_PRIVATE
    224
    225  - The devices only supports slave transfers, and as such isn't
    226    available for async transfers.
    227
    228- DMA_ASYNC_TX
    229
    230  - Must not be set by the device, and will be set by the framework
    231    if needed
    232
    233  - TODO: What is it about?
    234
    235- DMA_SLAVE
    236
    237  - The device can handle device to memory transfers, including
    238    scatter-gather transfers.
    239
    240  - While in the mem2mem case we were having two distinct types to
    241    deal with a single chunk to copy or a collection of them, here,
    242    we just have a single transaction type that is supposed to
    243    handle both.
    244
    245  - If you want to transfer a single contiguous memory buffer,
    246    simply build a scatter list with only one item.
    247
    248- DMA_CYCLIC
    249
    250  - The device can handle cyclic transfers.
    251
    252  - A cyclic transfer is a transfer where the chunk collection will
    253    loop over itself, with the last item pointing to the first.
    254
    255  - It's usually used for audio transfers, where you want to operate
    256    on a single ring buffer that you will fill with your audio data.
    257
    258- DMA_INTERLEAVE
    259
    260  - The device supports interleaved transfer.
    261
    262  - These transfers can transfer data from a non-contiguous buffer
    263    to a non-contiguous buffer, opposed to DMA_SLAVE that can
    264    transfer data from a non-contiguous data set to a continuous
    265    destination buffer.
    266
    267  - It's usually used for 2d content transfers, in which case you
    268    want to transfer a portion of uncompressed data directly to the
    269    display to print it
    270
    271- DMA_COMPLETION_NO_ORDER
    272
    273  - The device does not support in order completion.
    274
    275  - The driver should return DMA_OUT_OF_ORDER for device_tx_status if
    276    the device is setting this capability.
    277
    278  - All cookie tracking and checking API should be treated as invalid if
    279    the device exports this capability.
    280
    281  - At this point, this is incompatible with polling option for dmatest.
    282
    283  - If this cap is set, the user is recommended to provide an unique
    284    identifier for each descriptor sent to the DMA device in order to
    285    properly track the completion.
    286
    287- DMA_REPEAT
    288
    289  - The device supports repeated transfers. A repeated transfer, indicated by
    290    the DMA_PREP_REPEAT transfer flag, is similar to a cyclic transfer in that
    291    it gets automatically repeated when it ends, but can additionally be
    292    replaced by the client.
    293
    294  - This feature is limited to interleaved transfers, this flag should thus not
    295    be set if the DMA_INTERLEAVE flag isn't set. This limitation is based on
    296    the current needs of DMA clients, support for additional transfer types
    297    should be added in the future if and when the need arises.
    298
    299- DMA_LOAD_EOT
    300
    301  - The device supports replacing repeated transfers at end of transfer (EOT)
    302    by queuing a new transfer with the DMA_PREP_LOAD_EOT flag set.
    303
    304  - Support for replacing a currently running transfer at another point (such
    305    as end of burst instead of end of transfer) will be added in the future
    306    based on DMA clients needs, if and when the need arises.
    307
    308These various types will also affect how the source and destination
    309addresses change over time.
    310
    311Addresses pointing to RAM are typically incremented (or decremented)
    312after each transfer. In case of a ring buffer, they may loop
    313(DMA_CYCLIC). Addresses pointing to a device's register (e.g. a FIFO)
    314are typically fixed.
    315
    316Per descriptor metadata support
    317-------------------------------
    318Some data movement architecture (DMA controller and peripherals) uses metadata
    319associated with a transaction. The DMA controller role is to transfer the
    320payload and the metadata alongside.
    321The metadata itself is not used by the DMA engine itself, but it contains
    322parameters, keys, vectors, etc for peripheral or from the peripheral.
    323
    324The DMAengine framework provides a generic ways to facilitate the metadata for
    325descriptors. Depending on the architecture the DMA driver can implement either
    326or both of the methods and it is up to the client driver to choose which one
    327to use.
    328
    329- DESC_METADATA_CLIENT
    330
    331  The metadata buffer is allocated/provided by the client driver and it is
    332  attached (via the dmaengine_desc_attach_metadata() helper to the descriptor.
    333
    334  From the DMA driver the following is expected for this mode:
    335
    336  - DMA_MEM_TO_DEV / DEV_MEM_TO_MEM
    337
    338    The data from the provided metadata buffer should be prepared for the DMA
    339    controller to be sent alongside of the payload data. Either by copying to a
    340    hardware descriptor, or highly coupled packet.
    341
    342  - DMA_DEV_TO_MEM
    343
    344    On transfer completion the DMA driver must copy the metadata to the client
    345    provided metadata buffer before notifying the client about the completion.
    346    After the transfer completion, DMA drivers must not touch the metadata
    347    buffer provided by the client.
    348
    349- DESC_METADATA_ENGINE
    350
    351  The metadata buffer is allocated/managed by the DMA driver. The client driver
    352  can ask for the pointer, maximum size and the currently used size of the
    353  metadata and can directly update or read it. dmaengine_desc_get_metadata_ptr()
    354  and dmaengine_desc_set_metadata_len() is provided as helper functions.
    355
    356  From the DMA driver the following is expected for this mode:
    357
    358  - get_metadata_ptr()
    359
    360    Should return a pointer for the metadata buffer, the maximum size of the
    361    metadata buffer and the currently used / valid (if any) bytes in the buffer.
    362
    363  - set_metadata_len()
    364
    365    It is called by the clients after it have placed the metadata to the buffer
    366    to let the DMA driver know the number of valid bytes provided.
    367
    368  Note: since the client will ask for the metadata pointer in the completion
    369  callback (in DMA_DEV_TO_MEM case) the DMA driver must ensure that the
    370  descriptor is not freed up prior the callback is called.
    371
    372Device operations
    373-----------------
    374
    375Our dma_device structure also requires a few function pointers in
    376order to implement the actual logic, now that we described what
    377operations we were able to perform.
    378
    379The functions that we have to fill in there, and hence have to
    380implement, obviously depend on the transaction types you reported as
    381supported.
    382
    383- ``device_alloc_chan_resources``
    384
    385- ``device_free_chan_resources``
    386
    387  - These functions will be called whenever a driver will call
    388    ``dma_request_channel`` or ``dma_release_channel`` for the first/last
    389    time on the channel associated to that driver.
    390
    391  - They are in charge of allocating/freeing all the needed
    392    resources in order for that channel to be useful for your driver.
    393
    394  - These functions can sleep.
    395
    396- ``device_prep_dma_*``
    397
    398  - These functions are matching the capabilities you registered
    399    previously.
    400
    401  - These functions all take the buffer or the scatterlist relevant
    402    for the transfer being prepared, and should create a hardware
    403    descriptor or a list of hardware descriptors from it
    404
    405  - These functions can be called from an interrupt context
    406
    407  - Any allocation you might do should be using the GFP_NOWAIT
    408    flag, in order not to potentially sleep, but without depleting
    409    the emergency pool either.
    410
    411  - Drivers should try to pre-allocate any memory they might need
    412    during the transfer setup at probe time to avoid putting to
    413    much pressure on the nowait allocator.
    414
    415  - It should return a unique instance of the
    416    ``dma_async_tx_descriptor structure``, that further represents this
    417    particular transfer.
    418
    419  - This structure can be initialized using the function
    420    ``dma_async_tx_descriptor_init``.
    421
    422  - You'll also need to set two fields in this structure:
    423
    424    - flags:
    425      TODO: Can it be modified by the driver itself, or
    426      should it be always the flags passed in the arguments
    427
    428    - tx_submit: A pointer to a function you have to implement,
    429      that is supposed to push the current transaction descriptor to a
    430      pending queue, waiting for issue_pending to be called.
    431
    432  - In this structure the function pointer callback_result can be
    433    initialized in order for the submitter to be notified that a
    434    transaction has completed. In the earlier code the function pointer
    435    callback has been used. However it does not provide any status to the
    436    transaction and will be deprecated. The result structure defined as
    437    ``dmaengine_result`` that is passed in to callback_result
    438    has two fields:
    439
    440    - result: This provides the transfer result defined by
    441      ``dmaengine_tx_result``. Either success or some error condition.
    442
    443    - residue: Provides the residue bytes of the transfer for those that
    444      support residue.
    445
    446- ``device_issue_pending``
    447
    448  - Takes the first transaction descriptor in the pending queue,
    449    and starts the transfer. Whenever that transfer is done, it
    450    should move to the next transaction in the list.
    451
    452  - This function can be called in an interrupt context
    453
    454- ``device_tx_status``
    455
    456  - Should report the bytes left to go over on the given channel
    457
    458  - Should only care about the transaction descriptor passed as
    459    argument, not the currently active one on a given channel
    460
    461  - The tx_state argument might be NULL
    462
    463  - Should use dma_set_residue to report it
    464
    465  - In the case of a cyclic transfer, it should only take into
    466    account the total size of the cyclic buffer.
    467
    468  - Should return DMA_OUT_OF_ORDER if the device does not support in order
    469    completion and is completing the operation out of order.
    470
    471  - This function can be called in an interrupt context.
    472
    473- device_config
    474
    475  - Reconfigures the channel with the configuration given as argument
    476
    477  - This command should NOT perform synchronously, or on any
    478    currently queued transfers, but only on subsequent ones
    479
    480  - In this case, the function will receive a ``dma_slave_config``
    481    structure pointer as an argument, that will detail which
    482    configuration to use.
    483
    484  - Even though that structure contains a direction field, this
    485    field is deprecated in favor of the direction argument given to
    486    the prep_* functions
    487
    488  - This call is mandatory for slave operations only. This should NOT be
    489    set or expected to be set for memcpy operations.
    490    If a driver support both, it should use this call for slave
    491    operations only and not for memcpy ones.
    492
    493- device_pause
    494
    495  - Pauses a transfer on the channel
    496
    497  - This command should operate synchronously on the channel,
    498    pausing right away the work of the given channel
    499
    500- device_resume
    501
    502  - Resumes a transfer on the channel
    503
    504  - This command should operate synchronously on the channel,
    505    resuming right away the work of the given channel
    506
    507- device_terminate_all
    508
    509  - Aborts all the pending and ongoing transfers on the channel
    510
    511  - For aborted transfers the complete callback should not be called
    512
    513  - Can be called from atomic context or from within a complete
    514    callback of a descriptor. Must not sleep. Drivers must be able
    515    to handle this correctly.
    516
    517  - Termination may be asynchronous. The driver does not have to
    518    wait until the currently active transfer has completely stopped.
    519    See device_synchronize.
    520
    521- device_synchronize
    522
    523  - Must synchronize the termination of a channel to the current
    524    context.
    525
    526  - Must make sure that memory for previously submitted
    527    descriptors is no longer accessed by the DMA controller.
    528
    529  - Must make sure that all complete callbacks for previously
    530    submitted descriptors have finished running and none are
    531    scheduled to run.
    532
    533  - May sleep.
    534
    535
    536Misc notes
    537==========
    538
    539(stuff that should be documented, but don't really know
    540where to put them)
    541
    542``dma_run_dependencies``
    543
    544- Should be called at the end of an async TX transfer, and can be
    545  ignored in the slave transfers case.
    546
    547- Makes sure that dependent operations are run before marking it
    548  as complete.
    549
    550dma_cookie_t
    551
    552- it's a DMA transaction ID that will increment over time.
    553
    554- Not really relevant any more since the introduction of ``virt-dma``
    555  that abstracts it away.
    556
    557DMA_CTRL_ACK
    558
    559- If clear, the descriptor cannot be reused by provider until the
    560  client acknowledges receipt, i.e. has a chance to establish any
    561  dependency chains
    562
    563- This can be acked by invoking async_tx_ack()
    564
    565- If set, does not mean descriptor can be reused
    566
    567DMA_CTRL_REUSE
    568
    569- If set, the descriptor can be reused after being completed. It should
    570  not be freed by provider if this flag is set.
    571
    572- The descriptor should be prepared for reuse by invoking
    573  ``dmaengine_desc_set_reuse()`` which will set DMA_CTRL_REUSE.
    574
    575- ``dmaengine_desc_set_reuse()`` will succeed only when channel support
    576  reusable descriptor as exhibited by capabilities
    577
    578- As a consequence, if a device driver wants to skip the
    579  ``dma_map_sg()`` and ``dma_unmap_sg()`` in between 2 transfers,
    580  because the DMA'd data wasn't used, it can resubmit the transfer right after
    581  its completion.
    582
    583- Descriptor can be freed in few ways
    584
    585  - Clearing DMA_CTRL_REUSE by invoking
    586    ``dmaengine_desc_clear_reuse()`` and submitting for last txn
    587
    588  - Explicitly invoking ``dmaengine_desc_free()``, this can succeed only
    589    when DMA_CTRL_REUSE is already set
    590
    591  - Terminating the channel
    592
    593- DMA_PREP_CMD
    594
    595  - If set, the client driver tells DMA controller that passed data in DMA
    596    API is command data.
    597
    598  - Interpretation of command data is DMA controller specific. It can be
    599    used for issuing commands to other peripherals/register reads/register
    600    writes for which the descriptor should be in different format from
    601    normal data descriptors.
    602
    603- DMA_PREP_REPEAT
    604
    605  - If set, the transfer will be automatically repeated when it ends until a
    606    new transfer is queued on the same channel with the DMA_PREP_LOAD_EOT flag.
    607    If the next transfer to be queued on the channel does not have the
    608    DMA_PREP_LOAD_EOT flag set, the current transfer will be repeated until the
    609    client terminates all transfers.
    610
    611  - This flag is only supported if the channel reports the DMA_REPEAT
    612    capability.
    613
    614- DMA_PREP_LOAD_EOT
    615
    616  - If set, the transfer will replace the transfer currently being executed at
    617    the end of the transfer.
    618
    619  - This is the default behaviour for non-repeated transfers, specifying
    620    DMA_PREP_LOAD_EOT for non-repeated transfers will thus make no difference.
    621
    622  - When using repeated transfers, DMA clients will usually need to set the
    623    DMA_PREP_LOAD_EOT flag on all transfers, otherwise the channel will keep
    624    repeating the last repeated transfer and ignore the new transfers being
    625    queued. Failure to set DMA_PREP_LOAD_EOT will appear as if the channel was
    626    stuck on the previous transfer.
    627
    628  - This flag is only supported if the channel reports the DMA_LOAD_EOT
    629    capability.
    630
    631General Design Notes
    632====================
    633
    634Most of the DMAEngine drivers you'll see are based on a similar design
    635that handles the end of transfer interrupts in the handler, but defer
    636most work to a tasklet, including the start of a new transfer whenever
    637the previous transfer ended.
    638
    639This is a rather inefficient design though, because the inter-transfer
    640latency will be not only the interrupt latency, but also the
    641scheduling latency of the tasklet, which will leave the channel idle
    642in between, which will slow down the global transfer rate.
    643
    644You should avoid this kind of practice, and instead of electing a new
    645transfer in your tasklet, move that part to the interrupt handler in
    646order to have a shorter idle window (that we can't really avoid
    647anyway).
    648
    649Glossary
    650========
    651
    652- Burst: A number of consecutive read or write operations that
    653  can be queued to buffers before being flushed to memory.
    654
    655- Chunk: A contiguous collection of bursts
    656
    657- Transfer: A collection of chunks (be it contiguous or not)