Linux设备驱动模型-Ktype

前言

在之前创建的object的时候，使用的是kobject_create_and_add函数。而此函数中创建的object使用的是默认的ktype(dynamic_kobj_ktype), 如果想指定ktype的话就需要使用kobject_init_and_add函数来创建object。那ktype是具体的作用是什么？ ktype其实就是kobject的属性的操作集合，因为某些模块的操作集合相同，所以就将ktype单独抽象出来，这样就实现了代码复用。

数据结构

内核使用kobj_type定义一个ktype结构

struct kobj_type {
	void (*release)(struct kobject *kobj);
	const struct sysfs_ops *sysfs_ops;
	struct attribute **default_attrs;
	const struct kobj_ns_type_operations *(*child_ns_type)(struct kobject *kobj);
	const void *(*namespace)(struct kobject *kobj);
};

release:        通过该回调，做最后的收尾工作，比如释放掉申请的内存等。

sysfs_ops:    该kobject的属性的操作函数，也就是show和store函数，直接可以通过shell命令操作。

struct sysfs_ops {
	ssize_t	(*show)(struct kobject *, struct attribute *, char *);
	ssize_t	(*store)(struct kobject *, struct attribute *, const char *, size_t);
};

defalut_attrs:   代表该kobject所对应的属性，而这些属性最终可以通过sysfs_ops操作。

struct attribute {
	const char		*name;
	umode_t			mode;
};

name就代表该属性的名字，mode代表该属性的权限。可读, 可写， 读写。

namespace/child_ns_type:  是代表namespace的相关，不做过多介绍。

示例

修改上次的示例，增加ktype。

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/kobject.h>
#include <linux/sysfs.h>
#include <linux/init.h>
#include <linux/file.h>
#include <linux/fs.h>

static struct kobject kobj;
static struct kobject* pkobj = NULL;

static void test_kobj_release(struct kobject *kobj)
{
	printk(KERN_EMERG "kobject: test_kobj_release!\n");
}

static ssize_t test_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
{
	printk(KERN_EMERG "kobject: test_attr_show!\n");
	return 0;
}

static ssize_t test_attr_store(struct kobject *kobj, struct attribute *attr, const char *page, size_t length)
{
	printk(KERN_EMERG "kobject: test_attr_shore!\n");
	return 123;
}

static const struct sysfs_ops test_sysfs_ops = {
	.show  = test_attr_show,
	.store = test_attr_store,
};

static struct kobj_type test_ktype = {
	.sysfs_ops = &test_sysfs_ops,
	.release = test_kobj_release,
};


static struct attribute test_attr ={
	.name = "test",
	.mode = S_IWUSR | S_IRUGO,
};

static int kobject_test_init(void)
{
	int ret = 0;

	printk(KERN_EMERG "kobject: kobject_test_init!\n");
	pkobj = kobject_create_and_add("123_test", NULL);
	ret = kobject_init_and_add(&kobj, &test_ktype, pkobj, "%s", "456_test");

	ret = sysfs_create_file(&kobj, &test_attr);
	return ret;
}

static void kobject_test_exit(void)
{
	printk(KERN_EMERG "kobject: kobject_test_exit!\n");
	sysfs_remove_file(&kobj, &test_attr);
	kobject_del(&kobj);
	kobject_del(pkobj);
}

module_init(kobject_test_init);
module_exit(kobject_test_exit);
MODULE_LICENSE("GPL v2");

上述是个最简单的测试，会在sys下生成这样的文件：  /sys/123_test/456_test/test

测试结果如下：

root@test:/sys/123_test/456_test # ls -l 
-rw-r--r-- root     root         4096 2012-01-01 09:01 test

可以看到该文件是可读可写的。这样的test文件来自于上述属性的设置。

执行的流程如下

root@test:/# insmod object.ko
root@test:/sys/123_test/456_test # cat test
root@test:/sys/123_test/456_test # echo 123 > test
root@test:/sys/123_test/456_test # rmmod object.ko
root@test:/sys/123_test/456_test # dmesg | grep "kobject"

测试结果如下：

[   74.484138] c4 kobject: kobject_test_init!
[  101.197689] c0 kobject: test_attr_show!
[  111.062197] c0 kobject: test_attr_shore!
[  129.452907] c7 kobject: kobject_test_exit!

分析处理流程

先分析sysfs_create_file函数的处理流程

sysfs_create_file
    sysfs_create_file_ns
         sysfs_add_file_mode_ns

int sysfs_add_file_mode_ns(struct kernfs_node *parent,
			   const struct attribute *attr, bool is_bin,
			   umode_t mode, const void *ns)
{
	struct lock_class_key *key = NULL;
	const struct kernfs_ops *ops;
	struct kernfs_node *kn;
	loff_t size;

	if (!is_bin) {
		struct kobject *kobj = parent->priv;
		const struct sysfs_ops *sysfs_ops = kobj->ktype->sysfs_ops;               //不是bin文件属性的时候，设置Ktype中的sysfs_ops

		/* every kobject with an attribute needs a ktype assigned */
		if (WARN(!sysfs_ops, KERN_ERR
			 "missing sysfs attribute operations for kobject: %s\n",
			 kobject_name(kobj)))
			return -EINVAL;

		if (sysfs_ops->show && sysfs_ops->store)                  //show和store函数都存在的话，也就是可读可写，就会赋值ops。
			ops = &sysfs_file_kfops_rw;
		else if (sysfs_ops->show)                                 //只读
			ops = &sysfs_file_kfops_ro;
		else if (sysfs_ops->store)                               //只写
			ops = &sysfs_file_kfops_wo;
		else
			ops = &sysfs_file_kfops_empty;                    //空的

		size = PAGE_SIZE;
	} else {
                  .......
	}

	kn = __kernfs_create_file(parent, attr->name, mode, size, ops,      //重要的参数，ops和attr
				  (void *)attr, ns, true, key);
	if (IS_ERR(kn)) {
		if (PTR_ERR(kn) == -EEXIST)
			sysfs_warn_dup(parent, attr->name);
		return PTR_ERR(kn);
	}
	return 0;
}

接下来分析__kernfs_create_file函数。记得传入得两个重要的参数。

struct kernfs_node *__kernfs_create_file(struct kernfs_node *parent,
					 const char *name,
					 umode_t mode, loff_t size,
					 const struct kernfs_ops *ops,
					 void *priv, const void *ns,
					 bool name_is_static,
					 struct lock_class_key *key)
{
	struct kernfs_node *kn;
	unsigned flags;
	int rc;

	flags = KERNFS_FILE;
	if (name_is_static)
		flags |= KERNFS_STATIC_NAME;

	kn = kernfs_new_node(parent, name, (mode & S_IALLUGO) | S_IFREG, flags);
	if (!kn)
		return ERR_PTR(-ENOMEM);

	kn->attr.ops = ops;             //设置ops到kn->attr.ops中
	kn->attr.size = size;
	kn->ns = ns;
	kn->priv = priv;
        .......
}

至此，这是注册一个sys文件的准备工作。这时候上层就如果使用到此文件，首先肯定是open的操作，会通过系统调用进入到内核的sys_open函数中，经过一系列的操作最后进入到kernfs_fop_open函数中，关于如何执行到此函数，暂且不分析。

static int kernfs_fop_open(struct inode *inode, struct file *file)
{
	struct kernfs_node *kn = file->f_path.dentry->d_fsdata;
	struct kernfs_root *root = kernfs_root(kn);
	const struct kernfs_ops *ops;
	struct kernfs_open_file *of;
	bool has_read, has_write, has_mmap;
	int error = -EACCES;

	if (!kernfs_get_active(kn))
		return -ENODEV;

	ops = kernfs_ops(kn);                            //得到注册时候的ops

	has_read = ops->seq_show || ops->read || ops->mmap;
	has_write = ops->write || ops->mmap;
	has_mmap = ops->mmap;

	of->kn = kn;
	of->file = file;

	/*
	 * Write path needs to atomic_write_len outside active reference.
	 * Cache it in open_file.  See kernfs_fop_write() for details.
	 */
	of->atomic_write_len = ops->atomic_write_len;

	/*
	 * Always instantiate seq_file even if read access doesn't use
	 * seq_file or is not requested.  This unifies private data access
	 * and readable regular files are the vast majority anyway.
	 */
	if (ops->seq_show)                                                //如果ops中存在seq_show就会调用seq_open函数。
		error = seq_open(file, &kernfs_seq_ops);
	else
		error = seq_open(file, NULL);
	if (error)
		goto err_free;

	((struct seq_file *)file->private_data)->private = of;

	/* seq_file clears PWRITE unconditionally, restore it if WRITE */
	if (file->f_mode & FMODE_WRITE)
		file->f_mode |= FMODE_PWRITE;

	/* make sure we have open node struct */
	error = kernfs_get_open_node(kn, of);
	if (error)
		goto err_close;

	/* open succeeded, put active references */
	kernfs_put_active(kn);
	return 0;
}

上述的代码会删除一些不相关的操作，依次来分析重点函数。

static const struct kernfs_ops *kernfs_ops(struct kernfs_node *kn)
{
	if (kn->flags & KERNFS_LOCKDEP)
		lockdep_assert_held(kn);
	return kn->attr.ops;

可以看到返回了在注册时候设置ops，此ops也就是kernfs_ops。

在seq_open中会设置序列文件的ops为kernfs_seq_ops结构，当再次read文件的时候，会调用到kernfs_seq_ops中的show函数。

static int kernfs_seq_show(struct seq_file *sf, void *v)
{
	struct kernfs_open_file *of = sf->private;

	of->event = atomic_read(&of->kn->attr.open->event);

	return of->kn->attr.ops->seq_show(sf, v);
}

经过一系列指针操作，最后调用到kernfs_ops中的seq_show函数，也就是注册时候的sysfs_file_kfops_rw。

static const struct kernfs_ops sysfs_file_kfops_rw = {
	.seq_show	= sysfs_kf_seq_show,
	.write		= sysfs_kf_write,
};

接着来看下seq_show函数

static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
{
	struct kernfs_open_file *of = sf->private;
	struct kobject *kobj = of->kn->parent->priv;
	const struct sysfs_ops *ops = sysfs_file_ops(of->kn);         -------------------------A
	ssize_t count;
	char *buf;

	/* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
	count = seq_get_buf(sf, &buf);
	if (count < PAGE_SIZE) {
		seq_commit(sf, -1);
		return 0;
	}
	memset(buf, 0, PAGE_SIZE);

	/*
	 * Invoke show().  Control may reach here via seq file lseek even
	 * if @ops->show() isn't implemented.
	 */
	if (ops->show) {
		count = ops->show(kobj, of->kn->priv, buf);    -----------调用到sysfs_show函数，也就是例子中的test_attr_show函数
		if (count < 0)
			return count;
	}

	seq_commit(sf, count);
	return 0;
}

A：  获取ktype中的sysfs_ops

static const struct sysfs_ops *sysfs_file_ops(struct kernfs_node *kn)
{
	struct kobject *kobj = kn->parent->priv;

	if (kn->flags & KERNFS_LOCKDEP)
		lockdep_assert_held(kn);
	return kobj->ktype ? kobj->ktype->sysfs_ops : NULL;
}

通过判断kobj的ktype时候存在，如果存在返回sysfs_ops结构。最终调用到show函数中。

当然了store函数同理，这里就不在详细分析了。

补充

刚才在测试中忽略了release函数的调用，先来看看release函数在什么条件下会调用到。

kobject_put
     kobject_release
          kobject_cleanup
                

/*
 * kobject_cleanup - free kobject resources.
 * @kobj: object to cleanup
 */
static void kobject_cleanup(struct kobject *kobj)
{
	struct kobj_type *t = get_ktype(kobj);
	const char *name = kobj->name;

	pr_debug("kobject: '%s' (%p): %s, parent %p\n",
		 kobject_name(kobj), kobj, __func__, kobj->parent);

	if (t && !t->release)
		pr_debug("kobject: '%s' (%p): does not have a release() "
			 "function, it is broken and must be fixed.\n",
			 kobject_name(kobj), kobj);

	/* send "remove" if the caller did not do it but sent "add" */
	if (kobj->state_add_uevent_sent && !kobj->state_remove_uevent_sent) {
		pr_debug("kobject: '%s' (%p): auto cleanup 'remove' event\n",
			 kobject_name(kobj), kobj);
		kobject_uevent(kobj, KOBJ_REMOVE);
	}

	/* remove from sysfs if the caller did not do it */
	if (kobj->state_in_sysfs) {
		pr_debug("kobject: '%s' (%p): auto cleanup kobject_del\n",
			 kobject_name(kobj), kobj);
		kobject_del(kobj);
	}

	if (t && t->release) {                                   //如果存在release就调用到release函数。在我们测测试case中release函数是存在的。
		pr_debug("kobject: '%s' (%p): calling ktype release\n",
			 kobject_name(kobj), kobj);
		t->release(kobj);
	}

	/* free name if we allocated it */
	if (name) {
		pr_debug("kobject: '%s': free name\n", name);
		kfree(name);
	}
}

所以基于上述的执行路径，在驱动的exit函数中调用kobject_put函数。

static void kobject_test_exit(void)
{
	printk(KERN_EMERG "kobject: kobject_test_exit!\n");
	sysfs_remove_file(&kobj, &test_attr);
	kobject_put(&kobj);
	kobject_del(&kobj);
	kobject_del(pkobj);
}

插入模块，重新测试，就会调到release函数。

root@test:/data # dmesg | grep "kobject"                            
[ 4136.988959] c5 kobject: kobject_test_init!
[ 4160.808964] c6 kobject: kobject_test_exit!
[ 4160.813139] c6 kobject: test_kobj_release!

当然了release函数中一般会做一些内存释放的操作，这里只是打印信息而已。


至此分析完了整个执行流程。