poll原理及调用过程分析

我们以Android获取TP报点为例，分析poll过程。poll系统调用功能是检测设备是否有可读等对应事件发生时，调用read系统调用实现对设备的无阻塞访问。现在我们来分析poll的基本调用流程。

首先看应用如何使用poll:

int main(int argc, char* argv[])
{
	int res;
	int nfs;
	int pollres;
	int i;
	struct input_event event;
	struct pollfd *ufds;
	int nfds = 0;
	int fd;
    // 1.打开文件获得poll的文件描述符
	fd = open(TP_DEVICE, O_RDONLY);
	if (fd < 0) {
		printf("open tp device error.\n");
		return -1;
	}
	// 2.设置需要poll的文件描述符，事件
	nfds = 1;
	ufds = calloc(1, sizeof(ufds[0]));
	ufds[0].fd = fd;
	ufds[0].events = POLLIN;
	// 3.在循环中调用poll
	while(1) {
		pollres = poll(ufds, nfds, -1);
		for(i = 0; i < nfds; i++) {
			if(ufds[i].revents & POLLIN) {
			    // 4.poll到对应事件，做相应操作
				res = read(ufds[i].fd, &event, sizeof(event));
				if(res < sizeof(event)) {
					printf("could not get event.\n");
					return -1;
				}
			}
			printf("type:%d,  code:%d,  value:%d\n", event.type, event.code, event.value);
		}
	}
	
}

以上为大致调用过程，用来获取TP等输入设备数据。

struct pollfd定位如下：

struct pollfd {
36	int fd; // poll的文件描述符
37	short events; // poll的事件
38	short revents; // poll时返回的事件
39};

poll系统调用在/kernel/fs/select.c中实现：

int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
                struct timespec *end_time)
{
        struct poll_wqueues table;
        int err = -EFAULT, fdcount, len, size;
        /* Allocate small arguments on the stack to save memory and be
           faster - use long to make sure the buffer is aligned properly
           on 64 bit archs to avoid unaligned access */
        long stack_pps[POLL_STACK_ALLOC/sizeof(long)];
        struct poll_list *const head = (struct poll_list *)stack_pps;
        struct poll_list *walk = head;
        unsigned long todo = nfds;

        if (nfds > rlimit(RLIMIT_NOFILE))
                return -EINVAL;
        // nfds
        len = min_t(unsigned int, nfds, N_STACK_PPS);
        // 将ufds依次拷贝到walk中
        for (;;) {
                walk->next = NULL;
                walk->len = len;
                if (!len)
                        break;

                if (copy_from_user(walk->entries, ufds + nfds-todo,
                                        sizeof(struct pollfd) * walk->len))
                        goto out_fds;

                todo -= walk->len;
                if (!todo)
                        break;

                len = min(todo, POLLFD_PER_PAGE);
                size = sizeof(struct poll_list) + sizeof(struct pollfd) * len;
                walk = walk->next = kmalloc(size, GFP_KERNEL);
                if (!walk) {
                        err = -ENOMEM;
                        goto out_fds;
                }
        }
        // 初始化poll_wqueues结构变量
        poll_initwait(&table);
        fdcount = do_poll(nfds, head, &table, end_time);
        poll_freewait(&table);
        // 将poll结果的返回事件给到应用
        for (walk = head; walk; walk = walk->next) {
                struct pollfd *fds = walk->entries;
                int j;

                for (j = 0; j < walk->len; j++, ufds++)
                        if (__put_user(fds[j].revents, &ufds->revents))
                                goto out_fds;
        }

        err = fdcount;
out_fds:
        walk = head->next;
        while (walk) {
                struct poll_list *pos = walk;
                walk = walk->next;
                kfree(pos);
        }

        return err;
}

接下来的poll操作将在do_poll中继续完成。但是我们需要先看下poll_initwait的作用。

struct poll_wqueues {
	poll_table pt;
	struct poll_table_page *table;
	struct task_struct *polling_task;
	int triggered;
	int error;
	int inline_index;
	struct poll_table_entry inline_entries[N_INLINE_POLL_ENTRIES];
};

typedef struct poll_table_struct {
	poll_queue_proc _qproc;
	unsigned long _key;
} poll_table;

typedef void (*poll_queue_proc)(struct file *, wait_queue_head_t *, struct poll_table_struct *);

void poll_initwait(struct poll_wqueues *pwq)
{
	init_poll_funcptr(&pwq->pt, __pollwait);
	pwq->polling_task = current;
	pwq->triggered = 0;
	pwq->error = 0;
	pwq->table = NULL;
	pwq->inline_index = 0;
}

poll_initwait初始化了poll_wqueues变量，包括设置了poll_wqueues->pt->_qproc的这个函数指针为__pollwait函数。

在初始化完成poll_wqueues结构后，就可以看do_poll()函数了。

static int do_poll(unsigned int nfds,  struct poll_list *list,
                   struct poll_wqueues *wait, struct timespec *end_time)
{
    poll_table* pt = &wait->pt;
    ktime_t expire, *to = NULL;
    int timed_out = 0, count = 0;
    u64 slack = 0;
    unsigned int busy_flag = net_busy_loop_on() ? POLL_BUSY_LOOP : 0;
    
    // 有时一个大循环
    for (;;) {
        struct poll_list *walk;
        bool can_busy_loop = false;
        // walk->entries中有poll的所有文件描述符
        for (walk = list; walk != NULL; walk = walk->next) {
                struct pollfd * pfd, * pfd_end;
    
                pfd = walk->entries;
                pfd_end = pfd + walk->len;
                // 对每个文件描述符调用do_pollfd操作
                for (; pfd != pfd_end; pfd++) {
                        /*
                         * Fish for events. If we found one, record it
                         * and kill poll_table->_qproc, so we don't
                         * needlessly register any other waiters after
                         * this. They'll get immediately deregistered
                         * when we break out and return.
                         */
                         // 如果有poll的事件，如POLLIN，则count++
                        if (do_pollfd(pfd, pt, &can_busy_loop,
                                      busy_flag)) {
                                count++;
                                pt->_qproc = NULL;
                                /* found something, stop busy polling */
                                busy_flag = 0;
                                can_busy_loop = false;
                        }
                }
            }
        /*
         * All waiters have already been registered, so don't provide
         * a poll_table->_qproc to them on the next loop iteration.
         */
        pt->_qproc = NULL;
        if (!count) {
                count = wait->error;
                if (signal_pending(current))
                        count = -EINTR;
        }
        // 循环只有在count > 0或者timed_out=1退出
        if (count || timed_out)
                break;
               if (end_time && !to) {
               //超时时间
                expire = timespec_to_ktime(*end_time);
                to = &expire;
        }
        // 每poll一次，进入一次休眠，时间为设定的超时时间
        if (!poll_schedule_timeout(wait, TASK_INTERRUPTIBLE, to, slack))
                timed_out = 1;
    }
    return count;
}

}

因此，对于应用来看，只有当有符合poll的事件发生或者超时（(count || timed_out)），poll系统调用才会返回，期间进程将进入休眠等待下一次调度poll_schedule_timeout。

最后看do_pollfd实现：

static inline unsigned int do_pollfd(struct pollfd *pollfd, poll_table *pwait,
                                     bool *can_busy_poll,
                                     unsigned int busy_flag)
{
        unsigned int mask;
        int fd;

        mask = 0;
        fd = pollfd->fd;
        if (fd >= 0) {
                struct fd f = fdget(fd);
                mask = POLLNVAL;
                if (f.file) {
                        mask = DEFAULT_POLLMASK;
                        //调用驱动程序的poll
                        if (f.file->f_op->poll) {
                                pwait->_key = pollfd->events|POLLERR|POLLHUP;
                                pwait->_key |= busy_flag;
                                mask = f.file->f_op->poll(f.file, pwait);
                                if (mask & busy_flag)
                                        *can_busy_poll = true;
                        }
                        /* Mask out unneeded events. */
                        mask &= pollfd->events | POLLERR | POLLHUP;
                        fdput(f);
                }
        }
        // 设置revents
        pollfd->revents = mask;

        return mask;
}

对应输入设备TP，f.file->f_op->poll就是调用evdev的ops的poll方法。当只有poll到需要的应用设置的事件时，mask才能大于0，do_poll()才能如此循环。对于evdev.c，poll方法实现为：

&kernel/driver/input/evdev.c
static unsigned int evdev_poll(struct file *file, poll_table *wait)
{
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
	unsigned int mask;

	poll_wait(file, &evdev->wait, wait);
    // 设置mask
	if (evdev->exist && !client->revoked)
		mask = POLLOUT | POLLWRNORM;
	else
		mask = POLLHUP | POLLERR;

	if (client->packet_head != client->tail)
		mask |= POLLIN | POLLRDNORM;

	return mask;
}

static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p)
{
	if (p && p->_qproc && wait_address)
		p->_qproc(filp, wait_address, p);
}

poll_wait()将调用poll_table->_qproc函数指针。这个指针在poll_wqueues初始化时被设置为__pollwait函数。

__pollwait函数创建struct poll_table_entry，并将其与当前进程绑定。当有数据时，通过驱动evdev->wait来唤醒当前进程。

poll_wait当前进程添加到wait参数指定的等待列表(poll_table)中，需要注意的是这个函数是不会引起阻塞的。

总结：

• 1.poll对于驱动程序来说，是无阻塞访问的
• 2.poll也会导致自身进行休眠
• 3.当设置的poll事件发生或者超时，poll才会返回
• 4.poll_wait将驱动的wait_queue_head_t加入到poll_wqueues的等待队列，当有数据可使用时，将唤醒poll_wqueues所在进程。