Linux tty驱动学习 - UART驱动的read操作流程

在用户空间对tty设备进行读操作，经过系统调用进入到tty核心层执行的第一个函数是tty_read()。在tty_read()函数中，从文件描述符file的私有数据结构中获得tty_struct，然后再从tty_struct中获取线路规程描述符。取得线路规程描述符后，直接调用线路规程的read()函数。

static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
			loff_t *ppos)
{
	int i;
	struct tty_struct *tty;
	struct inode *inode;
	struct tty_ldisc *ld;

	tty = (struct tty_struct *)file->private_data;
	inode = file->f_path.dentry->d_inode;
	if (tty_paranoia_check(tty, inode, "tty_read"))
		return -EIO;
	if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
		return -EIO;

	/* We want to wait for the line discipline to sort out in this
	   situation */
	ld = tty_ldisc_ref_wait(tty);
	if (ld->ops->read)
		i = (ld->ops->read)(tty, file, buf, count);
	else
		i = -EIO;
	tty_ldisc_deref(ld);
	if (i > 0)
		inode->i_atime = current_fs_time(inode->i_sb);
	return i;
}

线路规程N_TTY的读操作函数为n_tty_read()，在该函数中把数据拷贝到用户空间分两种情况处理，一种是标准模式，另一种是非标准模式。在标准模式下，如果没有设置O_NONBLOCK，读操作只有在遇到文件结束符或者各行的字符都已编辑完毕后才返回。在非标准始模式下，由VMIN和VTIME两个设定来控制读操作的行为。第一种情况：VMIN和VTIME都为0，不管有没有读到数据，read()会立即返回；第二种情况：VMIN 为0，VTIME大于0，如果有读到数据，read()立即返回，如果没有读到数据，则等待VTIME时间后返回；第三种情况：VMIN大于0，VTIME等于0，read()一直阻塞直到读到VMIN个数据后返回；第四种情况：VMIN和VTIME都大于0，read()保持阻塞直到读到第一个字符，读到第一个字符后开始计时，此后如果时间到了VTIME或者时间没到但读到了VMIN个字符则返回，若在时间未到之前又读到一个字符(此时字符总数不够)则重新计时。回到n_tty_read()中，首先判断是否有数据可读，如果没有则调用schedule_timeout()把当前进程挂起，直到有数据可读或者超时后被唤醒继续执行。接下来是数据的读取过程，如果是标准模式，直接从tty->read_buf中读取字符，然后调用tty_put_user()把字符拷贝到用户空间。在非标准模式下，利用copy_from_read_buf直接把字符拷贝到用户空间。copy_from_read_buf()执行了两次，那是因为read_buf是个环形缓存区，第一次读是从read_tail到buf_end这部分数据，第二次读是从buf_end(因为是环形，所以也是buf_start)到read_head这部分数据。在copy_from_read_buf()里，用copy_to_user()直接把tty->read_buf里面的数据拷贝到用户空间。

static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
			 unsigned char __user *buf, size_t nr)
{
	……
	while (nr) {
		/* First test for status change. */
		if (packet && tty->link->ctrl_status) {
			unsigned char cs;
			if (b != buf)
				break;
			spin_lock_irqsave(&tty->link->ctrl_lock, flags);
			cs = tty->link->ctrl_status;
			tty->link->ctrl_status = 0;
			spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
			if (tty_put_user(tty, cs, b++)) {
				retval = -EFAULT;
				b--;
				break;
			}
			nr--;
			break;
		}
		/* This statement must be first before checking for input
		   so that any interrupt will set the state back to
		   TASK_RUNNING. */
		set_current_state(TASK_INTERRUPTIBLE);

		if (((minimum - (b - buf)) < tty->minimum_to_wake) &&
		    ((minimum - (b - buf)) >= 1))
			tty->minimum_to_wake = (minimum - (b - buf));

		if (!input_available_p(tty, 0)) {
			if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
				retval = -EIO;
				break;
			}
			if (tty_hung_up_p(file))
				break;
			if (!timeout)
				break;
			if (file->f_flags & O_NONBLOCK) {
				retval = -EAGAIN;
				break;
			}
			if (signal_pending(current)) {
				retval = -ERESTARTSYS;
				break;
			}
			/* FIXME: does n_tty_set_room need locking ? */
			n_tty_set_room(tty);
			timeout = schedule_timeout(timeout);
			continue;
		}
		__set_current_state(TASK_RUNNING);

		/* Deal with packet mode. */
		if (packet && b == buf) {
			if (tty_put_user(tty, TIOCPKT_DATA, b++)) {
				retval = -EFAULT;
				b--;
				break;
			}
			nr--;
		}

		if (tty->icanon) {
			/* N.B. avoid overrun if nr == 0 */
			while (nr && tty->read_cnt) {
				int eol;

				eol = test_and_clear_bit(tty->read_tail,
						tty->read_flags);
				c = tty->read_buf[tty->read_tail];
				spin_lock_irqsave(&tty->read_lock, flags);
				tty->read_tail = ((tty->read_tail+1) &
						  (N_TTY_BUF_SIZE-1));
				tty->read_cnt--;
				if (eol) {
					/* this test should be redundant:
					 * we shouldn't be reading data if
					 * canon_data is 0
					 */
					if (--tty->canon_data < 0)
						tty->canon_data = 0;
				}
				spin_unlock_irqrestore(&tty->read_lock, flags);

				if (!eol || (c != __DISABLED_CHAR)) {
					if (tty_put_user(tty, c, b++)) {
						retval = -EFAULT;
						b--;
						break;
					}
					nr--;
				}
				if (eol) {
					tty_audit_push(tty);
					break;
				}
			}
			if (retval)
				break;
		} else {
			int uncopied;
			/* The copy function takes the read lock and handles
			   locking internally for this case */
			uncopied = copy_from_read_buf(tty, &b, &nr);
			uncopied += copy_from_read_buf(tty, &b, &nr);
			if (uncopied) {
				retval = -EFAULT;
				break;
			}
		}

		/* If there is enough space in the read buffer now, let the
		 * low-level driver know. We use n_tty_chars_in_buffer() to
		 * check the buffer, as it now knows about canonical mode.
		 * Otherwise, if the driver is throttled and the line is
		 * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
		 * we won't get any more characters.
		 */
		if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE) {
			n_tty_set_room(tty);
			check_unthrottle(tty);
		}

		if (b - buf >= minimum)
			break;
		if (time)
			timeout = time;
	}
	……
}

static int copy_from_read_buf(struct tty_struct *tty,unsigned char __user **b,size_t *nr)
{
	int retval;
	size_t n;
	unsigned long flags;

	retval = 0;
	spin_lock_irqsave(&tty->read_lock, flags);
	n = min(tty->read_cnt, N_TTY_BUF_SIZE - tty->read_tail);
	n = min(*nr, n);
	spin_unlock_irqrestore(&tty->read_lock, flags);
	if (n) {
		retval = copy_to_user(*b, &tty->read_buf[tty->read_tail], n);
		n -= retval;
		tty_audit_add_data(tty, &tty->read_buf[tty->read_tail], n);
		spin_lock_irqsave(&tty->read_lock, flags);
		tty->read_tail = (tty->read_tail + n) & (N_TTY_BUF_SIZE-1);
		tty->read_cnt -= n;
		spin_unlock_irqrestore(&tty->read_lock, flags);
		*b += n;
		*nr -= n;
	}
	return retval;
}

可以看到，不管是标准模式还是非标准模式，都是从tty->read_buf里面读取数据，tty->read_buf里面的数据从哪里来？在open和write的操作中有分析过uart驱动的中断处理函数，中断处理有分两种情况，一种是数据发送完成后产生的中断，这种情况会继续调用发送函数发送数据；另一种就是接受到数据后或者接受数据寄存器长时间为0产生中断，这种情况调用receive_chars()来接受数据。在receive_chars()函数里，如果是接受数据产生的中断，则从接受数据寄存器里把数据读出来，否则把数据设为0。接下来是对接受数据错误进行处理，确定错误类型，然后修改uart_port->icount里面的计数。最后是调用uart_insert_char()对从数据寄存器里面读取到的数据进行进一步处理。uart_insert_char()里面真正执行的是tty_insert_flip_char()。

static inline void uart_insert_char(struct uart_port *port, unsigned int status,unsigned int overrun, unsigned int ch, unsigned int flag)
{
	struct tty_struct *tty = port->state->port.tty;

	if ((status & port->ignore_status_mask & ~overrun) == 0)
		tty_insert_flip_char(tty, ch, flag);

	/*
	 * Overrun is special.  Since it's reported immediately,
	 * it doesn't affect the current character.
	 */
	if (status & ~port->ignore_status_mask & overrun)
		tty_insert_flip_char(tty, 0, TTY_OVERRUN);
}

tty_insert_filp_char()有三个参数，分别为tty_struct，要处理的数据以及表示该数据状态的标志位。首先看在该函数里面的两个数据结构tty_buffer和tty_bufhead，tty_bufer是用来临时存放和管理从硬件接受到的数据，data用来存放数据，char_buf_ptr和flag_buf_ptr分别指向数据和数据标志的存储位置，used和size表示数据存储空间和已使用的空间，commit和read表示要提交和已读走的数据。而tty_bufhead是在tty_struct中用来管理tty_buffer的结构，每次都会先从tty_bufhead中寻找空闲的tty_buffer来临时存放数据，如果没有空闲，则会重新申请分配。从代码里面也可以看到，如果有空闲的tty_bufer，则直接把数据和flag放到未使用的buffer中，如果没有空闲tty_bufer，则调用tty_insert_flip_string_flags()来分配申请buffer空间并存放数据。在tty_insert_flip_string_flags()中调用tty_buffer_request_room()寻找一个可用的tty_buffer，而tty_buffer_request_room()直接调用tty_buffer_find()去完成该工作，如果没有空闲的tty_buffer，则调用tty_buffer_alloc()申请一个tty_buffer。回到tty_inster_flip_string_flags()里面，如果有找到空闲的tty_buffer可以，则调用memcpy把数据和数据标记存放到tty_buffer中。数据存放到tty_buffer中后，则调用tty_flip_buffer_push()把数据提交到tty_struct的read_buf里面。

static inline int tty_insert_flip_char(struct tty_struct *tty,
					unsigned char ch, char flag)
{
	struct tty_buffer *tb = tty->buf.tail;
	if (tb && tb->used < tb->size) {
		tb->flag_buf_ptr[tb->used] = flag;
		tb->char_buf_ptr[tb->used++] = ch;
		return 1;
	}
	return tty_insert_flip_string_flags(tty, &ch, &flag, 1);
}

int tty_insert_flip_string_flags(struct tty_struct *tty,
		const unsigned char *chars, const char *flags, size_t size)
{
	int copied = 0;
	do {
		int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
		int space = tty_buffer_request_room(tty, goal);
		struct tty_buffer *tb = tty->buf.tail;
		/* If there is no space then tb may be NULL */
		if (unlikely(space == 0))
			break;
		memcpy(tb->char_buf_ptr + tb->used, chars, space);
		memcpy(tb->flag_buf_ptr + tb->used, flags, space);
		tb->used += space;
		copied += space;
		chars += space;
		flags += space;
		/* There is a small chance that we need to split the data over
		   several buffers. If this is the case we must loop */
	} while (unlikely(size > copied));
	return copied;
}

int tty_buffer_request_room(struct tty_struct *tty, size_t size)
{
	struct tty_buffer *b, *n;
	int left;
	unsigned long flags;

	spin_lock_irqsave(&tty->buf.lock, flags);

	/* OPTIMISATION: We could keep a per tty "zero" sized buffer to
	   remove this conditional if its worth it. This would be invisible
	   to the callers */
	if ((b = tty->buf.tail) != NULL)
		left = b->size - b->used;
	else
		left = 0;

	if (left < size) {
		/* This is the slow path - looking for new buffers to use */
		if ((n = tty_buffer_find(tty, size)) != NULL) {
			if (b != NULL) {
				b->next = n;
				b->commit = b->used;
			} else
				tty->buf.head = n;
			tty->buf.tail = n;
		} else
			size = left;
	}

	spin_unlock_irqrestore(&tty->buf.lock, flags);
	return size;
}

static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
{
	struct tty_buffer **tbh = &tty->buf.free;
	while ((*tbh) != NULL) {
		struct tty_buffer *t = *tbh;
		if (t->size >= size) {
			*tbh = t->next;
			t->next = NULL;
			t->used = 0;
			t->commit = 0;
			t->read = 0;
			tty->buf.memory_used += t->size;
			return t;
		}
		tbh = &((*tbh)->next);
	}
	/* Round the buffer size out */
	size = (size + 0xFF) & ~0xFF;
	return tty_buffer_alloc(tty, size);
	/* Should possibly check if this fails for the largest buffer we
	   have queued and recycle that ? */
}

static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
{
	struct tty_buffer *p;

	if (tty->buf.memory_used + size > 65536)
		return NULL;
	p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
	if (p == NULL)
		return NULL;
	p->used = 0;
	p->size = size;
	p->next = NULL;
	p->commit = 0;
	p->read = 0;
	p->char_buf_ptr = (char *)(p->data);
	p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
	tty->buf.memory_used += size;
	return p;
}

在tty_flip_buffer_push中，如果设置了tty->low_latency，则调用flush_to_ldisc()来刷新数据到tty_struct的read_buf。否则调用schedule_delayed_work()来延期执行tty->buf.work，最后执行的也是flush_to_ldisc()。在flush_to_ldisc()中先计算出要提交的数据数目，head->commit表示要提交的总数，head->read表示已被读走的数目，所以相减表示剩下的需要提交的数据。如果线路规程正在处理数据或者read_buf空间不够，则暂停数据提交。char_buf和flag_buf是计算出的当前要提交的数据和数据标记在buffer中的位置，之后调用线路规程的receive_buf()来把数据存放到tty_struct的read_buf中。

static void flush_to_ldisc(struct work_struct *work)
{
	struct tty_struct *tty =
		container_of(work, struct tty_struct, buf.work.work);
	unsigned long 	flags;
	struct tty_ldisc *disc;

	disc = tty_ldisc_ref(tty);
	if (disc == NULL)	/*  !TTY_LDISC */
		return;

	spin_lock_irqsave(&tty->buf.lock, flags);

	if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) {
		struct tty_buffer *head, *tail = tty->buf.tail;
		int seen_tail = 0;
		while ((head = tty->buf.head) != NULL) {
			int count;
			char *char_buf;
			unsigned char *flag_buf;

			count = head->commit - head->read;
			if (!count) {
				if (head->next == NULL)
					break;
				/*
				  There's a possibility tty might get new buffer
				  added during the unlock window below. We could
				  end up spinning in here forever hogging the CPU
				  completely. To avoid this let's have a rest each
				  time we processed the tail buffer.
				*/
				if (tail == head)
					seen_tail = 1;
				tty->buf.head = head->next;
				tty_buffer_free(tty, head);
				continue;
			}
			/* Ldisc or user is trying to flush the buffers
			   we are feeding to the ldisc, stop feeding the
			   line discipline as we want to empty the queue */
			if (test_bit(TTY_FLUSHPENDING, &tty->flags))
				break;
			if (!tty->receive_room || seen_tail) {
				schedule_delayed_work(&tty->buf.work, 1);
				break;
			}
			if (count > tty->receive_room)
				count = tty->receive_room;
			char_buf = head->char_buf_ptr + head->read;
			flag_buf = head->flag_buf_ptr + head->read;
			head->read += count;
			spin_unlock_irqrestore(&tty->buf.lock, flags);
			disc->ops->receive_buf(tty, char_buf,
							flag_buf, count);
			spin_lock_irqsave(&tty->buf.lock, flags);
		}
		clear_bit(TTY_FLUSHING, &tty->flags);
	}

	/* We may have a deferred request to flush the input buffer,
	   if so pull the chain under the lock and empty the queue */
	if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
		__tty_buffer_flush(tty);
		clear_bit(TTY_FLUSHPENDING, &tty->flags);
		wake_up(&tty->read_wait);
	}
	spin_unlock_irqrestore(&tty->buf.lock, flags);

	tty_ldisc_deref(disc);
}

N_TTY的receive_buf函数为n_tty_receive_buf()，拷贝数据到read_buf分两种情况：标准模式和非标准模式。在非标准模式下，直接从memcpy()把数据复制到tty->read_buf，同样也是复制两次。在标准模式下，会根据数据标志对数据先进行处理，最后调用put_tty_queue_nolock()把数据复制到tty->read_buf中。当复制到tty->read_buf里面的数据达到tty->minimum_to_wake后，调用wake_up_interruptible()唤醒挂在tty->read_wait上的进程，让上层的读操作继续进行。

static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
			      char *fp, int count)
{
	const unsigned char *p;
	char *f, flags = TTY_NORMAL;
	int	i;
	char	buf[64];
	unsigned long cpuflags;

	if (!tty->read_buf)
		return;

	if (tty->real_raw) {
		spin_lock_irqsave(&tty->read_lock, cpuflags);
		i = min(N_TTY_BUF_SIZE - tty->read_cnt,
			N_TTY_BUF_SIZE - tty->read_head);
		i = min(count, i);
		memcpy(tty->read_buf + tty->read_head, cp, i);
		tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
		tty->read_cnt += i;
		cp += i;
		count -= i;

		i = min(N_TTY_BUF_SIZE - tty->read_cnt,
			N_TTY_BUF_SIZE - tty->read_head);
		i = min(count, i);
		memcpy(tty->read_buf + tty->read_head, cp, i);
		tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
		tty->read_cnt += i;
		spin_unlock_irqrestore(&tty->read_lock, cpuflags);
	} else {
		for (i = count, p = cp, f = fp; i; i--, p++) {
			if (f)
				flags = *f++;
			switch (flags) {
			case TTY_NORMAL:
				n_tty_receive_char(tty, *p);
				break;
			case TTY_BREAK:
				n_tty_receive_break(tty);
				break;
			case TTY_PARITY:
			case TTY_FRAME:
				n_tty_receive_parity_error(tty, *p);
				break;
			case TTY_OVERRUN:
				n_tty_receive_overrun(tty);
				break;
			default:
				printk(KERN_ERR "%s: unknown flag %d\n",
				       tty_name(tty, buf), flags);
				break;
			}
		}
		if (tty->ops->flush_chars)
			tty->ops->flush_chars(tty);
	}

	n_tty_set_room(tty);

	if (!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) {
		kill_fasync(&tty->fasync, SIGIO, POLL_IN);
		if (waitqueue_active(&tty->read_wait))
			wake_up_interruptible(&tty->read_wait);
	}

	/*
	 * Check the remaining room for the input canonicalization
	 * mode.  We don't want to throttle the driver if we're in
	 * canonical mode and don't have a newline yet!
	 */
	if (tty->receive_room < TTY_THRESHOLD_THROTTLE)
		tty_throttle(tty);
}

static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
{
	if (tty->read_cnt < N_TTY_BUF_SIZE) {
		tty->read_buf[tty->read_head] = c;
		tty->read_head = (tty->read_head + 1) & (N_TTY_BUF_SIZE-1);
		tty->read_cnt++;
	}
}

    从整个分析来看，uart驱动会把从硬件接受到的数据暂时存放在tty_buffer里面，然后调用线路规程的receive_buf()把数据存放到tty->read_buf里面，而系统调用的read()函数直接从tty->read_buf里面读取数据。