Loading...
Note: File does not exist in v3.1.
1// SPDX-License-Identifier: GPL-2.0
2/* mm/ashmem.c
3 *
4 * Anonymous Shared Memory Subsystem, ashmem
5 *
6 * Copyright (C) 2008 Google, Inc.
7 *
8 * Robert Love <rlove@google.com>
9 */
10
11#define pr_fmt(fmt) "ashmem: " fmt
12
13#include <linux/init.h>
14#include <linux/export.h>
15#include <linux/file.h>
16#include <linux/fs.h>
17#include <linux/falloc.h>
18#include <linux/miscdevice.h>
19#include <linux/security.h>
20#include <linux/mm.h>
21#include <linux/mman.h>
22#include <linux/uaccess.h>
23#include <linux/personality.h>
24#include <linux/bitops.h>
25#include <linux/mutex.h>
26#include <linux/shmem_fs.h>
27#include "ashmem.h"
28
29#define ASHMEM_NAME_PREFIX "dev/ashmem/"
30#define ASHMEM_NAME_PREFIX_LEN (sizeof(ASHMEM_NAME_PREFIX) - 1)
31#define ASHMEM_FULL_NAME_LEN (ASHMEM_NAME_LEN + ASHMEM_NAME_PREFIX_LEN)
32
33/**
34 * struct ashmem_area - The anonymous shared memory area
35 * @name: The optional name in /proc/pid/maps
36 * @unpinned_list: The list of all ashmem areas
37 * @file: The shmem-based backing file
38 * @size: The size of the mapping, in bytes
39 * @prot_mask: The allowed protection bits, as vm_flags
40 *
41 * The lifecycle of this structure is from our parent file's open() until
42 * its release(). It is also protected by 'ashmem_mutex'
43 *
44 * Warning: Mappings do NOT pin this structure; It dies on close()
45 */
46struct ashmem_area {
47 char name[ASHMEM_FULL_NAME_LEN];
48 struct list_head unpinned_list;
49 struct file *file;
50 size_t size;
51 unsigned long prot_mask;
52};
53
54/**
55 * struct ashmem_range - A range of unpinned/evictable pages
56 * @lru: The entry in the LRU list
57 * @unpinned: The entry in its area's unpinned list
58 * @asma: The associated anonymous shared memory area.
59 * @pgstart: The starting page (inclusive)
60 * @pgend: The ending page (inclusive)
61 * @purged: The purge status (ASHMEM_NOT or ASHMEM_WAS_PURGED)
62 *
63 * The lifecycle of this structure is from unpin to pin.
64 * It is protected by 'ashmem_mutex'
65 */
66struct ashmem_range {
67 struct list_head lru;
68 struct list_head unpinned;
69 struct ashmem_area *asma;
70 size_t pgstart;
71 size_t pgend;
72 unsigned int purged;
73};
74
75/* LRU list of unpinned pages, protected by ashmem_mutex */
76static LIST_HEAD(ashmem_lru_list);
77
78/*
79 * long lru_count - The count of pages on our LRU list.
80 *
81 * This is protected by ashmem_mutex.
82 */
83static unsigned long lru_count;
84
85/*
86 * ashmem_mutex - protects the list of and each individual ashmem_area
87 *
88 * Lock Ordering: ashmex_mutex -> i_mutex -> i_alloc_sem
89 */
90static DEFINE_MUTEX(ashmem_mutex);
91
92static struct kmem_cache *ashmem_area_cachep __read_mostly;
93static struct kmem_cache *ashmem_range_cachep __read_mostly;
94
95static inline unsigned long range_size(struct ashmem_range *range)
96{
97 return range->pgend - range->pgstart + 1;
98}
99
100static inline bool range_on_lru(struct ashmem_range *range)
101{
102 return range->purged == ASHMEM_NOT_PURGED;
103}
104
105static inline bool page_range_subsumes_range(struct ashmem_range *range,
106 size_t start, size_t end)
107{
108 return (range->pgstart >= start) && (range->pgend <= end);
109}
110
111static inline bool page_range_subsumed_by_range(struct ashmem_range *range,
112 size_t start, size_t end)
113{
114 return (range->pgstart <= start) && (range->pgend >= end);
115}
116
117static inline bool page_in_range(struct ashmem_range *range, size_t page)
118{
119 return (range->pgstart <= page) && (range->pgend >= page);
120}
121
122static inline bool page_range_in_range(struct ashmem_range *range,
123 size_t start, size_t end)
124{
125 return page_in_range(range, start) || page_in_range(range, end) ||
126 page_range_subsumes_range(range, start, end);
127}
128
129static inline bool range_before_page(struct ashmem_range *range, size_t page)
130{
131 return range->pgend < page;
132}
133
134#define PROT_MASK (PROT_EXEC | PROT_READ | PROT_WRITE)
135
136/**
137 * lru_add() - Adds a range of memory to the LRU list
138 * @range: The memory range being added.
139 *
140 * The range is first added to the end (tail) of the LRU list.
141 * After this, the size of the range is added to @lru_count
142 */
143static inline void lru_add(struct ashmem_range *range)
144{
145 list_add_tail(&range->lru, &ashmem_lru_list);
146 lru_count += range_size(range);
147}
148
149/**
150 * lru_del() - Removes a range of memory from the LRU list
151 * @range: The memory range being removed
152 *
153 * The range is first deleted from the LRU list.
154 * After this, the size of the range is removed from @lru_count
155 */
156static inline void lru_del(struct ashmem_range *range)
157{
158 list_del(&range->lru);
159 lru_count -= range_size(range);
160}
161
162/**
163 * range_alloc() - Allocates and initializes a new ashmem_range structure
164 * @asma: The associated ashmem_area
165 * @prev_range: The previous ashmem_range in the sorted asma->unpinned list
166 * @purged: Initial purge status (ASMEM_NOT_PURGED or ASHMEM_WAS_PURGED)
167 * @start: The starting page (inclusive)
168 * @end: The ending page (inclusive)
169 *
170 * This function is protected by ashmem_mutex.
171 *
172 * Return: 0 if successful, or -ENOMEM if there is an error
173 */
174static int range_alloc(struct ashmem_area *asma,
175 struct ashmem_range *prev_range, unsigned int purged,
176 size_t start, size_t end)
177{
178 struct ashmem_range *range;
179
180 range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL);
181 if (unlikely(!range))
182 return -ENOMEM;
183
184 range->asma = asma;
185 range->pgstart = start;
186 range->pgend = end;
187 range->purged = purged;
188
189 list_add_tail(&range->unpinned, &prev_range->unpinned);
190
191 if (range_on_lru(range))
192 lru_add(range);
193
194 return 0;
195}
196
197/**
198 * range_del() - Deletes and dealloctes an ashmem_range structure
199 * @range: The associated ashmem_range that has previously been allocated
200 */
201static void range_del(struct ashmem_range *range)
202{
203 list_del(&range->unpinned);
204 if (range_on_lru(range))
205 lru_del(range);
206 kmem_cache_free(ashmem_range_cachep, range);
207}
208
209/**
210 * range_shrink() - Shrinks an ashmem_range
211 * @range: The associated ashmem_range being shrunk
212 * @start: The starting byte of the new range
213 * @end: The ending byte of the new range
214 *
215 * This does not modify the data inside the existing range in any way - It
216 * simply shrinks the boundaries of the range.
217 *
218 * Theoretically, with a little tweaking, this could eventually be changed
219 * to range_resize, and expand the lru_count if the new range is larger.
220 */
221static inline void range_shrink(struct ashmem_range *range,
222 size_t start, size_t end)
223{
224 size_t pre = range_size(range);
225
226 range->pgstart = start;
227 range->pgend = end;
228
229 if (range_on_lru(range))
230 lru_count -= pre - range_size(range);
231}
232
233/**
234 * ashmem_open() - Opens an Anonymous Shared Memory structure
235 * @inode: The backing file's index node(?)
236 * @file: The backing file
237 *
238 * Please note that the ashmem_area is not returned by this function - It is
239 * instead written to "file->private_data".
240 *
241 * Return: 0 if successful, or another code if unsuccessful.
242 */
243static int ashmem_open(struct inode *inode, struct file *file)
244{
245 struct ashmem_area *asma;
246 int ret;
247
248 ret = generic_file_open(inode, file);
249 if (unlikely(ret))
250 return ret;
251
252 asma = kmem_cache_zalloc(ashmem_area_cachep, GFP_KERNEL);
253 if (unlikely(!asma))
254 return -ENOMEM;
255
256 INIT_LIST_HEAD(&asma->unpinned_list);
257 memcpy(asma->name, ASHMEM_NAME_PREFIX, ASHMEM_NAME_PREFIX_LEN);
258 asma->prot_mask = PROT_MASK;
259 file->private_data = asma;
260
261 return 0;
262}
263
264/**
265 * ashmem_release() - Releases an Anonymous Shared Memory structure
266 * @ignored: The backing file's Index Node(?) - It is ignored here.
267 * @file: The backing file
268 *
269 * Return: 0 if successful. If it is anything else, go have a coffee and
270 * try again.
271 */
272static int ashmem_release(struct inode *ignored, struct file *file)
273{
274 struct ashmem_area *asma = file->private_data;
275 struct ashmem_range *range, *next;
276
277 mutex_lock(&ashmem_mutex);
278 list_for_each_entry_safe(range, next, &asma->unpinned_list, unpinned)
279 range_del(range);
280 mutex_unlock(&ashmem_mutex);
281
282 if (asma->file)
283 fput(asma->file);
284 kmem_cache_free(ashmem_area_cachep, asma);
285
286 return 0;
287}
288
289static ssize_t ashmem_read_iter(struct kiocb *iocb, struct iov_iter *iter)
290{
291 struct ashmem_area *asma = iocb->ki_filp->private_data;
292 int ret = 0;
293
294 mutex_lock(&ashmem_mutex);
295
296 /* If size is not set, or set to 0, always return EOF. */
297 if (asma->size == 0)
298 goto out_unlock;
299
300 if (!asma->file) {
301 ret = -EBADF;
302 goto out_unlock;
303 }
304
305 /*
306 * asma and asma->file are used outside the lock here. We assume
307 * once asma->file is set it will never be changed, and will not
308 * be destroyed until all references to the file are dropped and
309 * ashmem_release is called.
310 */
311 mutex_unlock(&ashmem_mutex);
312 ret = vfs_iter_read(asma->file, iter, &iocb->ki_pos, 0);
313 mutex_lock(&ashmem_mutex);
314 if (ret > 0)
315 asma->file->f_pos = iocb->ki_pos;
316out_unlock:
317 mutex_unlock(&ashmem_mutex);
318 return ret;
319}
320
321static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin)
322{
323 struct ashmem_area *asma = file->private_data;
324 loff_t ret;
325
326 mutex_lock(&ashmem_mutex);
327
328 if (asma->size == 0) {
329 mutex_unlock(&ashmem_mutex);
330 return -EINVAL;
331 }
332
333 if (!asma->file) {
334 mutex_unlock(&ashmem_mutex);
335 return -EBADF;
336 }
337
338 mutex_unlock(&ashmem_mutex);
339
340 ret = vfs_llseek(asma->file, offset, origin);
341 if (ret < 0)
342 return ret;
343
344 /** Copy f_pos from backing file, since f_ops->llseek() sets it */
345 file->f_pos = asma->file->f_pos;
346 return ret;
347}
348
349static inline vm_flags_t calc_vm_may_flags(unsigned long prot)
350{
351 return _calc_vm_trans(prot, PROT_READ, VM_MAYREAD) |
352 _calc_vm_trans(prot, PROT_WRITE, VM_MAYWRITE) |
353 _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC);
354}
355
356static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
357{
358 struct ashmem_area *asma = file->private_data;
359 int ret = 0;
360
361 mutex_lock(&ashmem_mutex);
362
363 /* user needs to SET_SIZE before mapping */
364 if (unlikely(!asma->size)) {
365 ret = -EINVAL;
366 goto out;
367 }
368
369 /* requested protection bits must match our allowed protection mask */
370 if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
371 calc_vm_prot_bits(PROT_MASK, 0))) {
372 ret = -EPERM;
373 goto out;
374 }
375 vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);
376
377 if (!asma->file) {
378 char *name = ASHMEM_NAME_DEF;
379 struct file *vmfile;
380
381 if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0')
382 name = asma->name;
383
384 /* ... and allocate the backing shmem file */
385 vmfile = shmem_file_setup(name, asma->size, vma->vm_flags);
386 if (IS_ERR(vmfile)) {
387 ret = PTR_ERR(vmfile);
388 goto out;
389 }
390 vmfile->f_mode |= FMODE_LSEEK;
391 asma->file = vmfile;
392 }
393 get_file(asma->file);
394
395 /*
396 * XXX - Reworked to use shmem_zero_setup() instead of
397 * shmem_set_file while we're in staging. -jstultz
398 */
399 if (vma->vm_flags & VM_SHARED) {
400 ret = shmem_zero_setup(vma);
401 if (ret) {
402 fput(asma->file);
403 goto out;
404 }
405 }
406
407 if (vma->vm_file)
408 fput(vma->vm_file);
409 vma->vm_file = asma->file;
410
411out:
412 mutex_unlock(&ashmem_mutex);
413 return ret;
414}
415
416/*
417 * ashmem_shrink - our cache shrinker, called from mm/vmscan.c
418 *
419 * 'nr_to_scan' is the number of objects to scan for freeing.
420 *
421 * 'gfp_mask' is the mask of the allocation that got us into this mess.
422 *
423 * Return value is the number of objects freed or -1 if we cannot
424 * proceed without risk of deadlock (due to gfp_mask).
425 *
426 * We approximate LRU via least-recently-unpinned, jettisoning unpinned partial
427 * chunks of ashmem regions LRU-wise one-at-a-time until we hit 'nr_to_scan'
428 * pages freed.
429 */
430static unsigned long
431ashmem_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
432{
433 struct ashmem_range *range, *next;
434 unsigned long freed = 0;
435
436 /* We might recurse into filesystem code, so bail out if necessary */
437 if (!(sc->gfp_mask & __GFP_FS))
438 return SHRINK_STOP;
439
440 if (!mutex_trylock(&ashmem_mutex))
441 return -1;
442
443 list_for_each_entry_safe(range, next, &ashmem_lru_list, lru) {
444 loff_t start = range->pgstart * PAGE_SIZE;
445 loff_t end = (range->pgend + 1) * PAGE_SIZE;
446
447 vfs_fallocate(range->asma->file,
448 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
449 start, end - start);
450 range->purged = ASHMEM_WAS_PURGED;
451 lru_del(range);
452
453 freed += range_size(range);
454 if (--sc->nr_to_scan <= 0)
455 break;
456 }
457 mutex_unlock(&ashmem_mutex);
458 return freed;
459}
460
461static unsigned long
462ashmem_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
463{
464 /*
465 * note that lru_count is count of pages on the lru, not a count of
466 * objects on the list. This means the scan function needs to return the
467 * number of pages freed, not the number of objects scanned.
468 */
469 return lru_count;
470}
471
472static struct shrinker ashmem_shrinker = {
473 .count_objects = ashmem_shrink_count,
474 .scan_objects = ashmem_shrink_scan,
475 /*
476 * XXX (dchinner): I wish people would comment on why they need on
477 * significant changes to the default value here
478 */
479 .seeks = DEFAULT_SEEKS * 4,
480};
481
482static int set_prot_mask(struct ashmem_area *asma, unsigned long prot)
483{
484 int ret = 0;
485
486 mutex_lock(&ashmem_mutex);
487
488 /* the user can only remove, not add, protection bits */
489 if (unlikely((asma->prot_mask & prot) != prot)) {
490 ret = -EINVAL;
491 goto out;
492 }
493
494 /* does the application expect PROT_READ to imply PROT_EXEC? */
495 if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
496 prot |= PROT_EXEC;
497
498 asma->prot_mask = prot;
499
500out:
501 mutex_unlock(&ashmem_mutex);
502 return ret;
503}
504
505static int set_name(struct ashmem_area *asma, void __user *name)
506{
507 int len;
508 int ret = 0;
509 char local_name[ASHMEM_NAME_LEN];
510
511 /*
512 * Holding the ashmem_mutex while doing a copy_from_user might cause
513 * an data abort which would try to access mmap_sem. If another
514 * thread has invoked ashmem_mmap then it will be holding the
515 * semaphore and will be waiting for ashmem_mutex, there by leading to
516 * deadlock. We'll release the mutex and take the name to a local
517 * variable that does not need protection and later copy the local
518 * variable to the structure member with lock held.
519 */
520 len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
521 if (len < 0)
522 return len;
523 if (len == ASHMEM_NAME_LEN)
524 local_name[ASHMEM_NAME_LEN - 1] = '\0';
525 mutex_lock(&ashmem_mutex);
526 /* cannot change an existing mapping's name */
527 if (unlikely(asma->file))
528 ret = -EINVAL;
529 else
530 strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
531
532 mutex_unlock(&ashmem_mutex);
533 return ret;
534}
535
536static int get_name(struct ashmem_area *asma, void __user *name)
537{
538 int ret = 0;
539 size_t len;
540 /*
541 * Have a local variable to which we'll copy the content
542 * from asma with the lock held. Later we can copy this to the user
543 * space safely without holding any locks. So even if we proceed to
544 * wait for mmap_sem, it won't lead to deadlock.
545 */
546 char local_name[ASHMEM_NAME_LEN];
547
548 mutex_lock(&ashmem_mutex);
549 if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0') {
550 /*
551 * Copying only `len', instead of ASHMEM_NAME_LEN, bytes
552 * prevents us from revealing one user's stack to another.
553 */
554 len = strlen(asma->name + ASHMEM_NAME_PREFIX_LEN) + 1;
555 memcpy(local_name, asma->name + ASHMEM_NAME_PREFIX_LEN, len);
556 } else {
557 len = sizeof(ASHMEM_NAME_DEF);
558 memcpy(local_name, ASHMEM_NAME_DEF, len);
559 }
560 mutex_unlock(&ashmem_mutex);
561
562 /*
563 * Now we are just copying from the stack variable to userland
564 * No lock held
565 */
566 if (unlikely(copy_to_user(name, local_name, len)))
567 ret = -EFAULT;
568 return ret;
569}
570
571/*
572 * ashmem_pin - pin the given ashmem region, returning whether it was
573 * previously purged (ASHMEM_WAS_PURGED) or not (ASHMEM_NOT_PURGED).
574 *
575 * Caller must hold ashmem_mutex.
576 */
577static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
578{
579 struct ashmem_range *range, *next;
580 int ret = ASHMEM_NOT_PURGED;
581
582 list_for_each_entry_safe(range, next, &asma->unpinned_list, unpinned) {
583 /* moved past last applicable page; we can short circuit */
584 if (range_before_page(range, pgstart))
585 break;
586
587 /*
588 * The user can ask us to pin pages that span multiple ranges,
589 * or to pin pages that aren't even unpinned, so this is messy.
590 *
591 * Four cases:
592 * 1. The requested range subsumes an existing range, so we
593 * just remove the entire matching range.
594 * 2. The requested range overlaps the start of an existing
595 * range, so we just update that range.
596 * 3. The requested range overlaps the end of an existing
597 * range, so we just update that range.
598 * 4. The requested range punches a hole in an existing range,
599 * so we have to update one side of the range and then
600 * create a new range for the other side.
601 */
602 if (page_range_in_range(range, pgstart, pgend)) {
603 ret |= range->purged;
604
605 /* Case #1: Easy. Just nuke the whole thing. */
606 if (page_range_subsumes_range(range, pgstart, pgend)) {
607 range_del(range);
608 continue;
609 }
610
611 /* Case #2: We overlap from the start, so adjust it */
612 if (range->pgstart >= pgstart) {
613 range_shrink(range, pgend + 1, range->pgend);
614 continue;
615 }
616
617 /* Case #3: We overlap from the rear, so adjust it */
618 if (range->pgend <= pgend) {
619 range_shrink(range, range->pgstart,
620 pgstart - 1);
621 continue;
622 }
623
624 /*
625 * Case #4: We eat a chunk out of the middle. A bit
626 * more complicated, we allocate a new range for the
627 * second half and adjust the first chunk's endpoint.
628 */
629 range_alloc(asma, range, range->purged,
630 pgend + 1, range->pgend);
631 range_shrink(range, range->pgstart, pgstart - 1);
632 break;
633 }
634 }
635
636 return ret;
637}
638
639/*
640 * ashmem_unpin - unpin the given range of pages. Returns zero on success.
641 *
642 * Caller must hold ashmem_mutex.
643 */
644static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
645{
646 struct ashmem_range *range, *next;
647 unsigned int purged = ASHMEM_NOT_PURGED;
648
649restart:
650 list_for_each_entry_safe(range, next, &asma->unpinned_list, unpinned) {
651 /* short circuit: this is our insertion point */
652 if (range_before_page(range, pgstart))
653 break;
654
655 /*
656 * The user can ask us to unpin pages that are already entirely
657 * or partially pinned. We handle those two cases here.
658 */
659 if (page_range_subsumed_by_range(range, pgstart, pgend))
660 return 0;
661 if (page_range_in_range(range, pgstart, pgend)) {
662 pgstart = min(range->pgstart, pgstart);
663 pgend = max(range->pgend, pgend);
664 purged |= range->purged;
665 range_del(range);
666 goto restart;
667 }
668 }
669
670 return range_alloc(asma, range, purged, pgstart, pgend);
671}
672
673/*
674 * ashmem_get_pin_status - Returns ASHMEM_IS_UNPINNED if _any_ pages in the
675 * given interval are unpinned and ASHMEM_IS_PINNED otherwise.
676 *
677 * Caller must hold ashmem_mutex.
678 */
679static int ashmem_get_pin_status(struct ashmem_area *asma, size_t pgstart,
680 size_t pgend)
681{
682 struct ashmem_range *range;
683 int ret = ASHMEM_IS_PINNED;
684
685 list_for_each_entry(range, &asma->unpinned_list, unpinned) {
686 if (range_before_page(range, pgstart))
687 break;
688 if (page_range_in_range(range, pgstart, pgend)) {
689 ret = ASHMEM_IS_UNPINNED;
690 break;
691 }
692 }
693
694 return ret;
695}
696
697static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
698 void __user *p)
699{
700 struct ashmem_pin pin;
701 size_t pgstart, pgend;
702 int ret = -EINVAL;
703
704 if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
705 return -EFAULT;
706
707 mutex_lock(&ashmem_mutex);
708
709 if (unlikely(!asma->file))
710 goto out_unlock;
711
712 /* per custom, you can pass zero for len to mean "everything onward" */
713 if (!pin.len)
714 pin.len = PAGE_ALIGN(asma->size) - pin.offset;
715
716 if (unlikely((pin.offset | pin.len) & ~PAGE_MASK))
717 goto out_unlock;
718
719 if (unlikely(((__u32)-1) - pin.offset < pin.len))
720 goto out_unlock;
721
722 if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len))
723 goto out_unlock;
724
725 pgstart = pin.offset / PAGE_SIZE;
726 pgend = pgstart + (pin.len / PAGE_SIZE) - 1;
727
728 switch (cmd) {
729 case ASHMEM_PIN:
730 ret = ashmem_pin(asma, pgstart, pgend);
731 break;
732 case ASHMEM_UNPIN:
733 ret = ashmem_unpin(asma, pgstart, pgend);
734 break;
735 case ASHMEM_GET_PIN_STATUS:
736 ret = ashmem_get_pin_status(asma, pgstart, pgend);
737 break;
738 }
739
740out_unlock:
741 mutex_unlock(&ashmem_mutex);
742
743 return ret;
744}
745
746static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
747{
748 struct ashmem_area *asma = file->private_data;
749 long ret = -ENOTTY;
750
751 switch (cmd) {
752 case ASHMEM_SET_NAME:
753 ret = set_name(asma, (void __user *)arg);
754 break;
755 case ASHMEM_GET_NAME:
756 ret = get_name(asma, (void __user *)arg);
757 break;
758 case ASHMEM_SET_SIZE:
759 ret = -EINVAL;
760 mutex_lock(&ashmem_mutex);
761 if (!asma->file) {
762 ret = 0;
763 asma->size = (size_t)arg;
764 }
765 mutex_unlock(&ashmem_mutex);
766 break;
767 case ASHMEM_GET_SIZE:
768 ret = asma->size;
769 break;
770 case ASHMEM_SET_PROT_MASK:
771 ret = set_prot_mask(asma, arg);
772 break;
773 case ASHMEM_GET_PROT_MASK:
774 ret = asma->prot_mask;
775 break;
776 case ASHMEM_PIN:
777 case ASHMEM_UNPIN:
778 case ASHMEM_GET_PIN_STATUS:
779 ret = ashmem_pin_unpin(asma, cmd, (void __user *)arg);
780 break;
781 case ASHMEM_PURGE_ALL_CACHES:
782 ret = -EPERM;
783 if (capable(CAP_SYS_ADMIN)) {
784 struct shrink_control sc = {
785 .gfp_mask = GFP_KERNEL,
786 .nr_to_scan = LONG_MAX,
787 };
788 ret = ashmem_shrink_count(&ashmem_shrinker, &sc);
789 ashmem_shrink_scan(&ashmem_shrinker, &sc);
790 }
791 break;
792 }
793
794 return ret;
795}
796
797/* support of 32bit userspace on 64bit platforms */
798#ifdef CONFIG_COMPAT
799static long compat_ashmem_ioctl(struct file *file, unsigned int cmd,
800 unsigned long arg)
801{
802 switch (cmd) {
803 case COMPAT_ASHMEM_SET_SIZE:
804 cmd = ASHMEM_SET_SIZE;
805 break;
806 case COMPAT_ASHMEM_SET_PROT_MASK:
807 cmd = ASHMEM_SET_PROT_MASK;
808 break;
809 }
810 return ashmem_ioctl(file, cmd, arg);
811}
812#endif
813#ifdef CONFIG_PROC_FS
814static void ashmem_show_fdinfo(struct seq_file *m, struct file *file)
815{
816 struct ashmem_area *asma = file->private_data;
817
818 mutex_lock(&ashmem_mutex);
819
820 if (asma->file)
821 seq_printf(m, "inode:\t%ld\n", file_inode(asma->file)->i_ino);
822
823 if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0')
824 seq_printf(m, "name:\t%s\n",
825 asma->name + ASHMEM_NAME_PREFIX_LEN);
826
827 mutex_unlock(&ashmem_mutex);
828}
829#endif
830static const struct file_operations ashmem_fops = {
831 .owner = THIS_MODULE,
832 .open = ashmem_open,
833 .release = ashmem_release,
834 .read_iter = ashmem_read_iter,
835 .llseek = ashmem_llseek,
836 .mmap = ashmem_mmap,
837 .unlocked_ioctl = ashmem_ioctl,
838#ifdef CONFIG_COMPAT
839 .compat_ioctl = compat_ashmem_ioctl,
840#endif
841#ifdef CONFIG_PROC_FS
842 .show_fdinfo = ashmem_show_fdinfo,
843#endif
844};
845
846static struct miscdevice ashmem_misc = {
847 .minor = MISC_DYNAMIC_MINOR,
848 .name = "ashmem",
849 .fops = &ashmem_fops,
850};
851
852static int __init ashmem_init(void)
853{
854 int ret = -ENOMEM;
855
856 ashmem_area_cachep = kmem_cache_create("ashmem_area_cache",
857 sizeof(struct ashmem_area),
858 0, 0, NULL);
859 if (unlikely(!ashmem_area_cachep)) {
860 pr_err("failed to create slab cache\n");
861 goto out;
862 }
863
864 ashmem_range_cachep = kmem_cache_create("ashmem_range_cache",
865 sizeof(struct ashmem_range),
866 0, 0, NULL);
867 if (unlikely(!ashmem_range_cachep)) {
868 pr_err("failed to create slab cache\n");
869 goto out_free1;
870 }
871
872 ret = misc_register(&ashmem_misc);
873 if (unlikely(ret)) {
874 pr_err("failed to register misc device!\n");
875 goto out_free2;
876 }
877
878 ret = register_shrinker(&ashmem_shrinker);
879 if (ret) {
880 pr_err("failed to register shrinker!\n");
881 goto out_demisc;
882 }
883
884 pr_info("initialized\n");
885
886 return 0;
887
888out_demisc:
889 misc_deregister(&ashmem_misc);
890out_free2:
891 kmem_cache_destroy(ashmem_range_cachep);
892out_free1:
893 kmem_cache_destroy(ashmem_area_cachep);
894out:
895 return ret;
896}
897device_initcall(ashmem_init);