/**********************************************************************
* Android ashmem hacking
* 声明：
* 最近有些东西涉及到binder，而binder又涉及到ashmem，于是先跟一下这
* 部分的内容。
*
* 2016-1-12 深圳 南山平山村 曾剑锋
*********************************************************************/
/**
* 参考文章：
* Android系统匿名共享内存Ashmem（Anonymous Shared Memory）驱动程序源代码分析
* http://blog.csdn.net/luoshengyang/article/details/6664554
*/
/*
* ashmem_area - anonymous shared memory area
* Lifecycle: From our parent file's open() until its release()
* Locking: Protected by `ashmem_mutex'
* Big Note: Mappings do NOT pin this structure; it dies on close()
*/
struct ashmem_area {
char name[ASHMEM_FULL_NAME_LEN];/* optional name for /proc/pid/maps */
struct list_head unpinned_list; /* list of all ashmem areas */
struct file *file; /* the shmem-based backing file */
size_t size; /* size of the mapping, in bytes */
unsigned long prot_mask; /* allowed prot bits, as vm_flags */
};
/*
* ashmem_range - represents an interval of unpinned (evictable) pages
* Lifecycle: From unpin to pin
* Locking: Protected by `ashmem_mutex'
*/
struct ashmem_range {
struct list_head lru; /* entry in LRU list */
struct list_head unpinned; /* entry in its area's unpinned list */
struct ashmem_area *asma; /* associated area */
size_t pgstart; /* starting page, inclusive */
size_t pgend; /* ending page, inclusive */
unsigned int purged; /* ASHMEM_NOT or ASHMEM_WAS_PURGED */
};
module_init(ashmem_init); ----------+
module_exit(ashmem_exit); |
|
static int __init ashmem_init(void) <---------+
{
int ret;
// static struct kmem_cache *ashmem_area_cachep __read_mostly;
ashmem_area_cachep = kmem_cache_create("ashmem_area_cache",
sizeof(struct ashmem_area),
0, 0, NULL);
if (unlikely(!ashmem_area_cachep)) {
printk(KERN_ERR "ashmem: failed to create slab cache\n");
return -ENOMEM;
}
ashmem_range_cachep = kmem_cache_create("ashmem_range_cache",
sizeof(struct ashmem_range),
0, 0, NULL);
if (unlikely(!ashmem_range_cachep)) {
printk(KERN_ERR "ashmem: failed to create slab cache\n");
return -ENOMEM;
}
ret = misc_register(&ashmem_misc); -------------------+
if (unlikely(ret)) { |
printk(KERN_ERR "ashmem: failed to register misc device!\n"); |
return ret; |
} |
|
register_shrinker(&ashmem_shrinker); |
|
printk(KERN_INFO "ashmem: initialized\n"); |
|
return 0; |
} |
|
static struct file_operations ashmem_fops = { <-------+ |
.owner = THIS_MODULE, | |
.open = ashmem_open, -------*-+ |
.release = ashmem_release, | | |
.read = ashmem_read, | | |
.llseek = ashmem_llseek, | | |
.mmap = ashmem_mmap, ---------------*-*--------*---------+
.unlocked_ioctl = ashmem_ioctl, ---------------*-*--------*-------+ |
.compat_ioctl = ashmem_ioctl, | | | | |
}; | | | | |
| | | | |
static struct miscdevice ashmem_misc = { <-------*-*--------+ | |
.minor = MISC_DYNAMIC_MINOR, | | | |
.name = "ashmem", | | | |
.fops = &ashmem_fops, --------+ | | |
}; +-------------------------------------------+ | |
V | |
static int ashmem_open(struct inode *inode, struct file *file) | |
{ | |
struct ashmem_area *asma; | |
int ret; | |
| |
ret = generic_file_open(inode, file); | |
if (unlikely(ret)) | |
return ret; | |
| |
// static struct kmem_cache *ashmem_area_cachep __read_mostly; | |
// ashmem_area_cachep = kmem_cache_create("ashmem_area_cache", | |
// sizeof(struct ashmem_area), | |
// 0, 0, NULL); | |
asma = kmem_cache_zalloc(ashmem_area_cachep, GFP_KERNEL); | |
if (unlikely(!asma)) | |
return -ENOMEM; | |
| |
INIT_LIST_HEAD(&asma->unpinned_list); | |
// #define ASHMEM_NAME_PREFIX "dev/ashmem/" | |
// #define ASHMEM_NAME_PREFIX_LEN (sizeof(ASHMEM_NAME_PREFIX) - 1) | |
// #define ASHMEM_FULL_NAME_LEN (ASHMEM_NAME_LEN + ASHMEM_NAME_PREFIX_LEN)| |
memcpy(asma->name, ASHMEM_NAME_PREFIX, ASHMEM_NAME_PREFIX_LEN); | |
// #define PROT_MASK (PROT_EXEC | PROT_READ | PROT_WRITE) | |
asma->prot_mask = PROT_MASK; | |
// can get this asma struct in other function | |
file->private_data = asma; | |
| |
return 0; +-----------------------------------------------------------+ |
} | |
V |
static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)|
{ |
struct ashmem_area *asma = file->private_data; |
long ret = -ENOTTY; |
|
switch (cmd) { |
case ASHMEM_SET_NAME: |
ret = set_name(asma, (void __user *) arg); -------+ |
break; | |
case ASHMEM_GET_NAME: | |
ret = get_name(asma, (void __user *) arg); -------*-----+ |
break; | | |
case ASHMEM_SET_SIZE: | | |
ret = -EINVAL; | | |
if (!asma->file) { | | |
ret = 0; | | |
asma->size = (size_t) arg; | | |
} | | |
break; | | |
case ASHMEM_GET_SIZE: | | |
ret = asma->size; | | |
break; | | |
case ASHMEM_SET_PROT_MASK: | | |
ret = set_prot_mask(asma, arg); | | |
break; | | |
case ASHMEM_GET_PROT_MASK: | | |
ret = asma->prot_mask; | | |
break; | | |
case ASHMEM_PIN: | | |
case ASHMEM_UNPIN: | | |
case ASHMEM_GET_PIN_STATUS: | | |
ret = ashmem_pin_unpin(asma, cmd, (void __user *) arg);| | |
break; | | |
case ASHMEM_PURGE_ALL_CACHES: | | |
ret = -EPERM; | | |
if (capable(CAP_SYS_ADMIN)) { | | |
struct shrink_control sc = { | | |
.gfp_mask = GFP_KERNEL, | | |
.nr_to_scan = 0, | | |
}; | | |
ret = ashmem_shrink(&ashmem_shrinker, &sc); | | |
sc.nr_to_scan = ret; | | |
ashmem_shrink(&ashmem_shrinker, &sc); | | |
} | | |
break; | | |
} | | |
| | |
return ret; | | |
} +----------------------------------------------+ | |
V | |
static int set_name(struct ashmem_area *asma, void __user *name) | |
{ | |
int ret = 0; | |
| |
mutex_lock(&ashmem_mutex); | |
| |
/* cannot change an existing mapping's name */ | |
if (unlikely(asma->file)) { | |
ret = -EINVAL; | |
goto out; | |
} | |
| |
if (unlikely(copy_from_user(asma->name + ASHMEM_NAME_PREFIX_LEN, | |
name, ASHMEM_NAME_LEN))) | |
ret = -EFAULT; | |
asma->name[ASHMEM_FULL_NAME_LEN-1] = '\0'; | |
| |
out: | |
mutex_unlock(&ashmem_mutex); | |
| |
return ret; | |
} +------------------------------------------------------+ |
V |
static int get_name(struct ashmem_area *asma, void __user *name) |
{ |
int ret = 0; |
|
mutex_lock(&ashmem_mutex); |
if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0') { |
size_t len; |
|
/* |
* Copying only `len', instead of ASHMEM_NAME_LEN, bytes |
* prevents us from revealing one user's stack to another. |
*/ |
len = strlen(asma->name + ASHMEM_NAME_PREFIX_LEN) + 1; |
if (unlikely(copy_to_user(name, |
asma->name + ASHMEM_NAME_PREFIX_LEN, len))) |
ret = -EFAULT; |
} else { |
if (unlikely(copy_to_user(name, ASHMEM_NAME_DEF, |
sizeof(ASHMEM_NAME_DEF)))) |
ret = -EFAULT; |
} |
mutex_unlock(&ashmem_mutex); |
|
return ret; |
} |
|
static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) <--------+
{
struct ashmem_area *asma = file->private_data;
int ret = 0;
mutex_lock(&ashmem_mutex);
/* user needs to SET_SIZE before mapping */
if (unlikely(!asma->size)) {
ret = -EINVAL;
goto out;
}
/* requested protection bits must match our allowed protection mask */
if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) &
calc_vm_prot_bits(PROT_MASK))) {
ret = -EPERM;
goto out;
}
vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);
if (!asma->file) {
char *name = ASHMEM_NAME_DEF;
struct file *vmfile;
if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0')
name = asma->name;
/* ... and allocate the backing shmem file */
vmfile = shmem_file_setup(name, asma->size, vma->vm_flags);
if (unlikely(IS_ERR(vmfile))) {
ret = PTR_ERR(vmfile);
goto out;
}
asma->file = vmfile;
}
// #define get_file(x) atomic_long_inc(&(x)->f_count)
get_file(asma->file);
if (vma->vm_flags & VM_SHARED)
shmem_set_file(vma, asma->file); --------------+
else { |
if (vma->vm_file) |
fput(vma->vm_file); |
vma->vm_file = asma->file; |
} |
vma->vm_flags |= VM_CAN_NONLINEAR; |
|
out: |
mutex_unlock(&ashmem_mutex); |
return ret; |
} +------------------------------------------+
v
void shmem_set_file(struct vm_area_struct *vma, struct file *file)
{
if (vma->vm_file)
fput(vma->vm_file); -------------+
vma->vm_file = file; |
vma->vm_ops = &shmem_vm_ops; |
vma->vm_flags |= VM_CAN_NONLINEAR; |
} |
|
void fput(struct file *file) <------------+
{
if (atomic_long_dec_and_test(&file->f_count))
__fput(file);
}
