open系统调用在内核中的流程分析

真是蛮复杂的，我分三步走，力求讲得比较清楚。

以字符设备为例，相对于块设备要简单些。

基于2.6.26的内核

一）驱动注册open函数都干了些什么？

register_chrdev -> cdev_add -> kobj_map

file: fs/char_dev.c

int register_chrdev(unsigned int major, const char *name,

const struct file_operations *fops)

{

struct char_device_struct *cd;

struct cdev *cdev;

char *s;

int err = -ENOMEM;

cd = __register_chrdev_region(major, 0, 256, name);

if (IS_ERR(cd))

return PTR_ERR(cd);

cdev = cdev_alloc();

if (!cdev)

goto out2;

cdev->owner = fops->owner;

cdev->ops = fops; // 注意，在后面的 chrdev_open会从cdev再得到 fops

...

}

file: fs/char_dev.c

int cdev_add(struct cdev *p, dev_t dev, unsigned count)

{

p->dev = dev;

p->count = count;

return kobj_map(cdev_map, dev, count, NULL, exact_match, exact_lock, p);

}

file: fs/char_dev.c

static struct kobject *exact_match(dev_t dev, int *part, void *data)

{

struct cdev *p = data;

return &p->kobj;

}

file: drivers/base/map.c

int kobj_map(struct kobj_map *domain, dev_t dev, unsigned long range,

struct module *module, kobj_probe_t *probe,

int (*lock)(dev_t, void *), void *data)

{

unsigned n = MAJOR(dev + range - 1) - MAJOR(dev) + 1;

unsigned index = MAJOR(dev);

unsigned i;

struct probe *p;

if (n > 255)

n = 255;

p = kmalloc(sizeof(struct probe) * n, GFP_KERNEL);

if (p == NULL)

return -ENOMEM;

for (i = 0; i < n; i++, p++) {

p->owner = module;

p->get = probe; // 此处其实就是exact_match

p->lock = lock;

p->dev = dev;

p->range = range;

p->data = data;

}

mutex_lock(domain->lock);

for (i = 0, p -= n; i < n; i++, p++, index++) {

struct probe **s = &domain->probes[index % 255];

while (*s && (*s)->range < range)

s = &(*s)->next;

p->next = *s;

*s = p;

}

mutex_unlock(domain->lock);

return 0;

}

二）从系统调用往内核走，看当初驱动里注册的file_operations里的open函数怎么被调用的

sys_open -> do_sys_open -> do_filp_open -> nameidata_to_filp -> __dentry_open

问题是 1）__dentry_open如何找到 chrdev_open?

2）最终又是如何调用file_operations里的在驱动里面注册的open函数的呢?

static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,

int flags, struct file *f,

int (*open)(struct inode *, struct file *))

{

struct inode *inode;

int error;

f->f_flags = flags;

f->f_mode = ((flags+1) & O_ACCMODE) | FMODE_LSEEK |

FMODE_PREAD | FMODE_PWRITE;

inode = dentry->d_inode;

if (f->f_mode & FMODE_WRITE) {

error = __get_file_write_access(inode, mnt);

if (error)

goto cleanup_file;

if (!special_file(inode->i_mode))

file_take_write(f);

}

f->f_mapping = inode->i_mapping;

f->f_path.dentry = dentry;

f->f_path.mnt = mnt;

f->f_pos = 0;

f->f_op = fops_get(inode->i_fop); // 此处获得 def_chr_fops

file_move(f, &inode->i_sb->s_files);

error = security_dentry_open(f);

if (error)

goto cleanup_all;

if (!open && f->f_op)

open = f->f_op->open; // 此处调用 def_chr_fops里的open函数，即chrdev_open

...

}

file: fs/char_dev.c

chrdev_open() {

struct cdev *p;

struct cdev *new = NULL;

int ret = 0;

spin_lock(&cdev_lock);

p = inode->i_cdev;

if (!p) {

struct kobject *kobj;

int idx;

spin_unlock(&cdev_lock);

kobj = kobj_lookup(cdev_map, inode->i_rdev, &idx); // 找到cdev对应的kobj对象, 跟kobj_map遥相对应的，反操作

if (!kobj)

return -ENXIO;

new = container_of(kobj, struct cdev, kobj); // 找到cdev

spin_lock(&cdev_lock);

p = inode->i_cdev;

if (!p) {

inode->i_cdev = p = new;

inode->i_cindex = idx;

list_add(&inode->i_devices, &p->list);

new = NULL;

} else if (!cdev_get(p))

ret = -ENXIO;

} else if (!cdev_get(p))

ret = -ENXIO;

spin_unlock(&cdev_lock);

cdev_put(new);

if (ret)

return ret;

filp->f_op = fops_get(p->ops); // 这里又找回了当初驱动注册时的 file_operations指针

if (!filp->f_op) {

cdev_put(p);

return -ENXIO;

}

if (filp->f_op->open) {

lock_kernel();

ret = filp->f_op->open(inode,filp); // 此处算真正的调用了file_operations里的open函数

unlock_kernel();

}

...

}

file: drivers/base/map.c

struct kobject *kobj_lookup(struct kobj_map *domain, dev_t dev, int *index)

{

struct kobject *kobj;

struct probe *p;

unsigned long best = ~0UL;

retry:

mutex_lock(domain->lock);

for (p = domain->probes[MAJOR(dev) % 255]; p; p = p->next) {

struct kobject *(*probe)(dev_t, int *, void *);

struct module *owner;

void *data;

if (p->dev > dev || p->dev + p->range - 1 < dev)

continue;

if (p->range - 1 >= best)

break;

if (!try_module_get(p->owner))

continue;

owner = p->owner;

data = p->data;

probe = p->get; // 这里其实就是 exact_match函数了

best = p->range - 1;

*index = dev - p->dev;

if (p->lock && p->lock(dev, data) < 0) {

module_put(owner);

continue;

}

mutex_unlock(domain->lock);

kobj = probe(dev, index, data); // 这里调用了 exact_match 函数

/* Currently ->owner protects _only_ ->probe() itself. */

module_put(owner);

if (kobj)

return kobj;

goto retry;

}

mutex_unlock(domain->lock);

return NULL;

}

三）什么时候为字符设备设置的def_chr_fops ?

这个跟具体的文件系统有关系的。

现在/dev/下的设备节点都是通过udev动态创建的，udev会去调用mknod（假定是ext2，内核会调用ext2_mknod），

如果是char设备，会把def_chr_fops附给inode->i_fop，而ext2_mknod会调用init_special_inode()，函数

的部分实现如下：

file: fs/ext2/namei.c

static int ext2_mknod (struct inode * dir, struct dentry *dentry, int mode, dev_t rdev)

{

struct inode * inode;

int err;

if (!new_valid_dev(rdev))

return -EINVAL;

inode = ext2_new_inode (dir, mode);

err = PTR_ERR(inode);

if (!IS_ERR(inode)) {

init_special_inode(inode, inode->i_mode, rdev); // 调用 init_special_inode

file: fs/inode.c

void init_special_inode(struct inode *inode, umode_t mode, dev_t rdev)

{

inode->i_mode = mode;

if (S_ISCHR(mode)) {

inode->i_fop = &def_chr_fops; // 这里为char设备设置的缺省操作

inode->i_rdev = rdev;

}

...

}

file: fs/char_dev.c

const struct file_operations def_chr_fops = {

.open = chrdev_open,

};