ioctl函数总是抢先调用，求助

dean_go

大家好，我照LDD3写了一个驱动，然后写了一个用户空间应用去测试，然后就出现了一个很奇怪的问题，主要是针对ioctl的。
我的驱动是一个虚拟的，里面是一个链接表，写操作就向链表填加项，读就是读链表字符。ioctl的SCULL_IOCSET是向链表头加一个项，SCULL_IOCGET读链表每一个字符。SCULL_IOCCLEAR清空链表。

用户空间应用先是一个write函数，写26个英文字母，然后读出来，这都没出错，但是后来我读之后加入ioctl函数，然后问题就发生了。我发现ioctl函数总是先于write和read函数被执行，这是为什么呢？
shell执行结果如下：

[root@mini2440 /]# ./ioctl
Writting to scull0 :abcdefghijklmnopqrstuvwxyz...
cmd is 0x6b01,SCULL_IOCSET is 0x40046b02       ／／
cmd is 0x40016b02,SCULL_IOCSET is 0x40046b02／／
cmd is 0x80016b03,SCULL_IOCSET is 0x40046b02／／这三句是内核驱动模块中ioctl函数的打印结果。
Write OP Successful! 28 characters written.
Read from scull0 :abcdefghijklmnopqrstuvwxyz,OP successful!
Starting ioctl!......................................................
After clear ioctl:
set the first value 'm',then it reads:

What I get is :

求大侠帮解释一下，如果需要的话，下面是我的代码。先行谢了。
我的用户空间程序代码：

1. #include <fcntl.h>
   
2. #include <string.h>
   
3. #include <stdio.h>
   
4. #include <linux/ioctl.h>
   
5. #define SCULL_IOC_MAGIC  'k'  
   
6. #define SCULL_IOCMAXCDMNR 3
   
7. #define SCULL_IOCCLEAR  _IO(SCULL_IOC_MAGIC,1)
   
8. #define SCULL_IOCSET  _IOW(SCULL_IOC_MAGIC,2,char)
   
9. #define SCULL_IOCGET _IOR(SCULL_IOC_MAGIC,3,char)
   
10. 
    
11. int  main()
    
12. {
    
13.   int ret;
    
14.   int i;
    
15.   int fd=open("/dev/scull0",O_RDWR);
    
16.   char buf[28]="abcdefghijklmnopqrstuvwxyz";
    
17.   char buff[28];
    
18.   
    
19.   printf("Writting to scull0 :%s...\n",buf);
    
20.   
    
21.   if(sizeof(buf)==write(fd,buf,sizeof(buf)))
    
22.     printf("Write OP Successful! %d characters written.\n",sizeof(buf));
    
23.   else
    
24.     printf("Write error!\n");
    
25. 
    
26.   if(sizeof(buf)==read(fd,buff,sizeof(buf)))
    
27.     printf("Read from scull0 :%s,OP successful!\n",buff);
    
28.   else
    
29.     printf("Read error!\n");
    
30. 
    
31. 
    
32. 
    
33. 
    
34.   
    
35.   printf("Starting ioctl!......................................................\n");
    
36.   ioctl(fd,SCULL_IOCCLEAR);
    
37.   strcpy(buff,"");
    
38.   read(fd,buff,sizeof(buf));
    
39.   printf("After clear ioctl:%s\n",buff);
    
40.   
    
41.   buf[0]='m';
    
42.   ioctl(fd,SCULL_IOCSET,&buf[0]);
    
43.   read(fd,buff,sizeof(buf));
    
44.   printf("set the first value 'm',then it reads:\n");
    
45.   printf("%s\n",buff);
    
46.   
    
47.   
    
48.   buff[0]=0;
    
49.   ioctl(fd,SCULL_IOCGET,buff[0]);
    
50.   printf("What I get is :%c\n",buff[0]);
    
51.   
    
52.   
    
53. 
    
54.   
    
55.   return 0;
    
56. }
    

复制代码

我的驱动程序代码：

1. #include <linux/init.h>
   
2. #include <linux/module.h>
   
3. #include <linux/moduleparam.h>
   
4. #include <linux/kdev_t.h>
   
5. #include <linux/fs.h>
   
6. #include <linux/cdev.h>
   
7. #include <asm/uaccess.h>
   
8. #include <linux/proc_fs.h>
   
9. //#include <asm/semaphore.h>
   
10. 
    
11. MODULE_LICENSE("Dual BSD/GPL");
    
12. #define SCULL_USE_PROC
    
13. #define MAX_PROC_IN 30
    
14. #define SCULL_IOC_MAGIC  'k'  
    
15. #define SCULL_IOCMAXCDMNR 3
    
16. #define SCULL_IOCCLEAR  _IO(SCULL_IOC_MAGIC,1)
    
17. #define SCULL_IOCSET  _IOW(SCULL_IOC_MAGIC,2,int)
    
18. #define SCULL_IOCGET _IOR(SCULL_IOC_MAGIC,3,int)
    
19. 
    
20. static int major=0;
    
21. static int minor=0;
    
22. static int  devCount=4;
    
23. static char proc_in[MAX_PROC_IN]="";
    
24. 
    
25. struct scull_buf{
    
26.   char value;
    
27.   struct scull_buf * next;
    
28. };
    
29. struct scull_dev{
    
30.   struct cdev cdev;
    
31.   struct  scull_buf  *bufHead;
    
32.   struct semaphore sem;
    
33. };
    
34. 
    
35. struct scull_dev * scull;
    
36. 
    
37. int scull_open(struct inode * inode ,struct file *filp)
    
38. {
    
39.   struct scull_dev *dev;
    
40.   dev=container_of(inode->i_cdev,struct scull_dev,cdev);
    
41.   filp->private_data=dev;//for later use in other methods.
    
42.   return 0;
    
43. }
    
44. 
    
45. int scull_release(struct inode *inode,struct file *filp)
    
46. {
    
47.   return 0;
    
48. }
    
49. 
    
50. ssize_t scull_write(struct file *filp,const char __user *buff,size_t count,loff_t *offp)
    
51. {
    
52.   int i;
    
53.   struct scull_dev * dev=filp->private_data;
    
54.   struct scull_buf *bptr=NULL;
    
55. 
    
56.   if (down_interruptible (&dev->sem))
    
57.                 return -ERESTARTSYS;
    
58.   
    
59.   for(i=0;i<count;i++)
    
60.   {
    
61.     struct scull_buf *tmp=kmalloc(sizeof(struct scull_buf),GFP_KERNEL);
    
62.    
    
63.     if(!copy_from_user(&tmp->value,buff++,1))
    
64.     {
    
65.       tmp->next=NULL;
    
66.       if(i==0)
    
67.       {
    
68.         dev->bufHead=tmp;
    
69.         bptr=tmp;
    
70.       }
    
71.       else
    
72.       {
    
73.         bptr->next=tmp;
    
74.         bptr=tmp;
    
75.       }
    
76.     }
    
77.     else
    
78.     {
    
79.       printk(KERN_ALERT"Copy from user failed!\n");
    
80.       return -EFAULT;
    
81.     }
    
82.   }
    
83. 
    
84. up (&dev->sem);
    
85. return count;
    
86.   
    
87. }
    
88. 
    
89. ssize_t scull_read(struct file *filp,char __user *buff,size_t count,loff_t * offp)
    
90. {
    
91.   int i;
    
92.   struct scull_dev * dev=filp->private_data;
    
93.   struct scull_buf *bptr=dev->bufHead;
    
94.   
    
95.   if(down_interruptible(&dev->sem))
    
96.     return -ERESTARTSYS;
    
97. 
    
98.   for(i=0;i<count&&bptr!=NULL;i++)
    
99.   {
    
100.     if(!copy_to_user(buff++,&(bptr->value),1)==1)
     
101.       bptr=bptr->next;
     
102.     else
     
103.     {
     
104.       printk(KERN_INFO"Copy to user failed!");
     
105.     }
     
106.   }
     
107.   up(&dev->sem);
     
108.   return count;
     
109. }
     
110. 
     
111. int scull_ioctl(struct inode *inode,struct file *filp,unsigned int cmd,unsigned long arg)
     
112. {
     
113.   int err=0,ret=0;
     
114.   struct scull_dev * dev=filp->private_data;
     
115.   struct scull_buf * buf=dev->bufHead;
     
116. 
     
117.   if(_IOC_TYPE(cmd)!=SCULL_IOC_MAGIC) return -ENOTTY;
     
118.   if(_IOC_NR(cmd)>SCULL_IOCMAXCDMNR) return -ENOTTY;
     
119. 
     
120. /*
     
121.   if(_IOC_DIR(cmd)&_IOC_READ)
     
122.     err=!access_ok(VERIFY_WRITE,(void __user *)arg ,_IOC_SIZE(cmd));
     
123.   else if(_IOC_DIR(cmd)&_IOC_WRITE)
     
124.     err=!access_ok(VERIFY_READ,(void __user *)arg, _IOC_SIZE(cmd));
     
125.   if(err) return -ENOTTY;*/
     
126. printk("cmd is 0x%x,SCULL_IOCSET is 0x%x\n",cmd,SCULL_IOCSET);
     
127.   
     
128. 
     
129.   switch (cmd)
     
130.   {
     
131.     case SCULL_IOCCLEAR:
     
132.       while(buf!=NULL)
     
133.       {
     
134.         struct scull_buf * b;
     
135.         b=buf->next;
     
136.         kfree(buf);
     
137.         buf=b;
     
138.       }
     
139.       break;
     
140.       
     
141.     case SCULL_IOCSET:
     
142.     {
     
143.       struct scull_buf *b;
     
144.      // while(buf!=NULL&&buf->value!=0)
     
145.         //buf=buf->next;
     
146.      // b=buf->next;
     
147.       b=kmalloc(sizeof(struct scull_buf),GFP_KERNEL);
     
148.       ret=__get_user(b->value,(char __user *)arg);
     
149.       b->next=buf->next;
     
150.       kfree(buf);
     
151.       buf=b;
     
152.       printk("%c........",b->value);
     
153.     }
     
154.     break;
     
155.     case SCULL_IOCGET:
     
156.     {
     
157.       ret=__put_user(buf->value,(char __user *)arg);
     
158.     }
     
159.     break;
     
160.     default:
     
161.       return -ENOTTY;
     
162.   }
     
163.   dev->bufHead=buf;
     
164.   return ret;
     
165. }
     
166.       
     
167.       
     
168.       
     
169. #ifdef SCULL_USE_PROC
     
170. static int proc_scull_read(char * buf,char **start,off_t offset,int len,int *eof,void *data)
     
171. {
     
172.   int i,count=0;
     
173.   struct scull_buf * buff;
     
174.   for(i=0;i<devCount;i++)
     
175.   {
     
176.     if((scull+i)->bufHead==NULL)
     
177.       count+=sprintf(buf+count,"scull%d is empty.\n",i);
     
178.     else
     
179.     {
     
180.       buff=(scull+i)->bufHead;
     
181.       count+=sprintf(buf+count,"scull%d is :\n",i);
     
182.       while(buff!=NULL)
     
183.       {
     
184.         count+=sprintf(buf+count,"%c",buff->value);
     
185.         buff=buff->next;
     
186.       }
     
187.       count+=sprintf(buf+count,"\n");
     
188.     }
     
189.   }
     
190.   
     
191.   count+=sprintf(buf+count,"proc_in:%s",proc_in);
     
192.   return count;
     
193. }
     
194. 
     
195. static ssize_t proc_scull_write(struct file *filp,const char __user * buf,unsigned long len,void *data)
     
196. {
     
197.   if(len<=MAX_PROC_IN)       
     
198.     if(!copy_from_user(proc_in,buf,len))
     
199.       printk(KERN_INFO"Write done!\n");
     
200.   return len;
     
201. }
     
202. 
     
203. 
     
204. static struct proc_dir_entry * proc_scull_entry;   
     
205. #endif
     
206. 
     
207. struct file_operations scull_ops={
     
208.   .owner=THIS_MODULE,
     
209.   .open=scull_open,
     
210.   .release=scull_release,
     
211.   .write= scull_write,
     
212.   .read=scull_read,
     
213.   .ioctl=scull_ioctl,
     
214. };
     
215. 
     
216. static void scull_setup_cdev(struct scull_dev *dev,int index)
     
217. {
     
218.   int err;
     
219.   dev_t devno=MKDEV(major,minor+index);
     
220.   cdev_init(&dev->cdev,&scull_ops);
     
221.   dev->cdev.owner=THIS_MODULE;
     
222.   dev->bufHead=NULL;
     
223.   //dev->cdev.ops=&scull_fops;//don't know about what it is like in other version of kernel,but in 2.6.30,this is not at all neccessary.
     
224.   //it's already done by cdev_init.
     
225.   err=cdev_add(&dev->cdev,devno,1);
     
226.   /*fail gracefully if need be */
     
227.   if(err)
     
228.     printk(KERN_NOTICE"Error %d adding scull%d",err,index);
     
229. }
     
230. static int scull_init(void)
     
231. {
     
232.   int ret,i;
     
233.   static dev_t devno;
     
234.     if(major==0)
     
235.   {
     
236.     ret=alloc_chrdev_region(&devno ,minor,devCount,"scull");
     
237.     major=MAJOR(devno);
     
238.     minor=MINOR(devno);
     
239.   }
     
240.   else
     
241.   {
     
242.     devno=MKDEV(major,minor);
     
243.     ret=register_chrdev_region(devno,devCount,"scull");
     
244.   }
     
245.   if(ret<0)
     
246.   {
     
247.     printk(KERN_WARNING "scull:can't get major %d\n",major);
     
248.     return ret;
     
249.   }
     
250.   else
     
251.      printk(KERN_ALERT"Dev_t registered:%d ,%d\n",major,minor);
     
252.   scull=kmalloc(devCount*sizeof(struct scull_dev),GFP_KERNEL);
     
253.   if(!scull)
     
254.   {
     
255.     ret=-ENOMEM;
     
256.     printk(KERN_INFO"fail malloc for scull_dev\n");
     
257.     goto fail_malloc;
     
258.   }
     
259.   memset(scull,0,devCount*sizeof(struct scull_dev));
     
260.   
     
261.   for(i=0;i<devCount;i++)
     
262.   {
     
263.     scull_setup_cdev(scull+i,i);
     
264.     sema_init(&(scull+i)->sem,1);
     
265.   }
     
266.   
     
267. #ifdef SCULL_USE_PROC
     
268.   proc_scull_entry=create_proc_entry("scull",0,NULL);
     
269.   if(proc_scull_entry)
     
270.   {
     
271.     proc_scull_entry->read_proc=proc_scull_read;
     
272.     proc_scull_entry->write_proc=proc_scull_write;
     
273.   }
     
274.   else
     
275.     printk(KERN_ERR"Proc file scull registration failed!\n");
     
276. #endif
     
277.   
     
278.   fail_malloc:
     
279.   unregister_chrdev_region(devno,devCount);
     
280.   return 0;
     
281. }
     
282. static void scull_exit(void)
     
283. {
     
284.   static dev_t devno;
     
285.   int i;
     
286. #ifdef SCULL_USE_PROC
     
287.   remove_proc_entry("scull",NULL);
     
288. #endif
     
289.   
     
290.   for(i=0;i<devCount;i++)
     
291.   {
     
292.     cdev_del(&scull[i].cdev);
     
293.   }
     
294.   kfree(scull);
     
295.   unregister_chrdev_region(devno,devCount);
     
296. }
     
297. 
     
298. module_param(major,int,S_IRUGO);
     
299. module_init(scull_init);
     
300. module_exit(scull_exit);
     

复制代码