Another important feature of real devices (unlike scull ) is that data being read or written is exchanged with other hardware, and some synchronization is needed. The concepts of blocking I/O and asynchronous notification fill the gap and are introduced in this chapter by means of a modified scull device. The driver uses interaction between different processes to create asynchronous events. As with the original scull, you don't need special hardware to test the driver's workings. We will definitely deal with real hardware, but not until Chapter 8, "Hardware Management".

  int ioctl(int fd, int cmd, ...); 

The prototype stands out in the list of Unix system calls because of the dots, which usually represent not a variable number of arguments. In a real system, however, a system call can't actually have a variable number of arguments. System calls must have a well-defined number of arguments because user programs can access them only through hardware "gates,'' as outlined in "User Space and Kernel Space" in Chapter 2, "Building and Running Modules". Therefore, the dots in the prototype represent not a variable number of arguments but a single optional argument, traditionally identified as char *argp. The dots are simply there to prevent type checking during compilation. The actual nature of the third argument depends on the specific control command being issued (the second argument). Some commands take no arguments, some take an integer value, and some take a pointer to other data. Using a pointer is the way to pass arbitrary data to the ioctl call; the device will then be able to exchange any amount of data with user space.

  int (*ioctl) (struct inode *inode, struct file *filp,          unsigned int cmd, unsigned long arg); 

The inode and filp pointers are the values corresponding to the file descriptor fd passed on by the application and are the same parameters passed to the open method. The cmd argument is passed from the user unchanged, and the optional arg argument is passed in the form of an unsigned long, regardless of whether it was given by the user as an integer or a pointer. If the invoking program doesn't pass a third argument, the arg value received by the driver operation has no meaningful value.

Choosing the ioctl Commands

The command numbers should be unique across the system in order to prevent errors caused by issuing the right command to the wrong device. Such a mismatch is not unlikely to happen, and a program might find itself trying to change the baud rate of a non-serial-port input stream, such as a FIFO or an audio device. If each ioctl number is unique, then the application will get an EINVAL error rather than succeeding in doing something unintended.

The old, and now deprecated, way of choosing an ioctl number was easy: authors chose a magic eight-bit number, such as "k'' (hex 0x6b), and added an ordinal number, like this:

  #define SCULL_IOCTL1 0x6b01  #define SCULL_IOCTL2 0x6b02  /* .... */ 

If both the application and the driver agreed on the numbers, you only needed to implement the switch statement in your driver. However, this way of defining ioctlnumbers, which had its foundations in Unix tradition, shouldn't be used any more. We've only shown the old way to give you a taste of what ioctl numbers look like.

The new way to define numbers uses four bitfields, which have the following meanings. Any new symbols we introduce in the following list are defined in <linux/ioctl.h>.

  /* Use 'k' as magic number */ #define SCULL_IOC_MAGIC 'k'  #define SCULL_IOCRESET _IO(SCULL_IOC_MAGIC, 0)  /*  * S means "Set" through a ptr  * T means "Tell" directly with the argument value  * G means "Get": reply by setting through a pointer  * Q means "Query": response is on the return value  * X means "eXchange": G and S atomically  * H means "sHift": T and Q atomically  */ #define SCULL_IOCSQUANTUM _IOW(SCULL_IOC_MAGIC, 1, scull_quantum) #define SCULL_IOCSQSET  _IOW(SCULL_IOC_MAGIC, 2, scull_qset) #define SCULL_IOCTQUANTUM _IO(SCULL_IOC_MAGIC,  3) #define SCULL_IOCTQSET  _IO(SCULL_IOC_MAGIC,  4) #define SCULL_IOCGQUANTUM _IOR(SCULL_IOC_MAGIC, 5, scull_quantum) #define SCULL_IOCGQSET  _IOR(SCULL_IOC_MAGIC, 6, scull_qset) #define SCULL_IOCQQUANTUM _IO(SCULL_IOC_MAGIC,  7) #define SCULL_IOCQQSET  _IO(SCULL_IOC_MAGIC,  8) #define SCULL_IOCXQUANTUM _IOWR(SCULL_IOC_MAGIC, 9, scull_quantum) #define SCULL_IOCXQSET  _IOWR(SCULL_IOC_MAGIC,10, scull_qset) #define SCULL_IOCHQUANTUM _IO(SCULL_IOC_MAGIC, 11) #define SCULL_IOCHQSET  _IO(SCULL_IOC_MAGIC, 12) #define SCULL_IOCHARDRESET _IO(SCULL_IOC_MAGIC, 15) /* debugging tool */  #define SCULL_IOC_MAXNR 15 

We chose to implement both ways of passing integer arguments -- by pointer and by explicit value, although by an established convention ioctl should exchange values by pointer. Similarly, both ways are used to return an integer number: by pointer or by setting the return value. This works as long as the return value is a positive integer; on return from any system call, a positive value is preserved (as we saw for read and write), while a negative value is considered an error and is used to set errno in user space.

The "exchange'' and "shift'' operations are not particularly useful for scull. We implemented "exchange'' to show how the driver can combine separate operations into a single atomic one, and "shift'' to pair "tell'' and "query.'' There are times when atomic[24] test-and-set operations like these are needed, in particular, when applications need to set or release locks.

The explicit ordinal number of the command has no specific meaning. It is used only to tell the commands apart. Actually, you could even use the same ordinal number for a read command and a write command, since the actual ioctl number is different in the "direction'' bits, but there is no reason why you would want to do so. We chose not to use the ordinal number of the command anywhere but in the declaration, so we didn't assign a symbolic value to it. That's why explicit numbers appear in the definition given previously. The example shows one way to use the command numbers, but you are free to do it differently.

The Return Value

The Predefined Commands

The predefined commands are divided into three groups:

• Those that can be issued on any file (regular, device, FIFO, or socket)

• Those that are issued only on regular files

• Those specific to the filesystem type

Commands in the last group are executed by the implementation of the hosting filesystem (see the chattrcommand). Device driver writers are interested only in the first group of commands, whose magic number is "T.'' Looking at the workings of the other groups is left to the reader as an exercise; ext2_ioctl is a most interesting function (though easier than you may expect), because it implements the append-only flag and the immutable flag.

The following ioctl commands are predefined for any file:

The last item in the list introduced a new system call, fcntl, which looks like ioctl. In fact, the fcntlcall is very similar to ioctl in that it gets a command argument and an extra (optional) argument. It is kept separate from ioctl mainly for historical reasons: when Unix developers faced the problem of controlling I/O operations, they decided that files and devices were different. At the time, the only devices with ioctl implementations were ttys, which explains why -ENOTTY is the standard reply for an incorrect ioctl command. Things have changed, but fcntl remains in the name of backward compatibility.

Using the ioctl Argument

When a pointer is used to refer to user space, we must ensure that the user address is valid and that the corresponding page is currently mapped. If kernel code tries to access an out-of-range address, the processor issues an exception. Exceptions in kernel code are turned to oops messages by every Linux kernel up through 2.0.x ; version 2.1 and later handle the problem more gracefully. In any case, it's the driver's responsibility to make proper checks on every user-space address it uses and to return an error if it is invalid.

 int access_ok(int type, const void *addr, unsigned long size); 

Unlike most functions, access_ok returns a boolean value: 1 for success (access is OK) and 0 for failure (access is not OK). If it returns false, the driver will usually return -EFAULT to the caller.

There are a couple of interesting things to note about access_ok. First is that it does not do the complete job of verifying memory access; it only checks to see that the memory reference is in a region of memory that the process might reasonably have access to. In particular, access_ok ensures that the address does not point to kernel-space memory. Second, most driver code need not actually call access_ok. The memory-access routines described later take care of that for you. We will nonetheless demonstrate its use so that you can see how it is done, and for backward compatibility reasons that we will get into toward the end of the chapter.

   int err = 0, tmp;  int ret = 0;     /*   * extract the type and number bitfields, and don't decode   * wrong cmds: return ENOTTY (inappropriate ioctl) before access_ok()   */  if (_IOC_TYPE(cmd) != SCULL_IOC_MAGIC) return -ENOTTY;  if (_IOC_NR(cmd) > SCULL_IOC_MAXNR) return -ENOTTY;   /*   * the direction is a bitmask, and VERIFY_WRITE catches R/W   * transfers. `Type' is user oriented, while   * access_ok is kernel oriented, so the concept of "read" and   * "write" is reversed   */  if (_IOC_DIR(cmd) & _IOC_READ)    err = !access_ok(VERIFY_WRITE, (void *)arg, _IOC_SIZE(cmd));  else if (_IOC_DIR(cmd) & _IOC_WRITE)    err = !access_ok(VERIFY_READ, (void *)arg, _IOC_SIZE(cmd));  if (err) return -EFAULT; 

After calling access_ok, the driver can safely perform the actual transfer. In addition to the copy_from_user and copy_to_user functions, the programmer can exploit a set of functions that are optimized for the most-used data sizes (one, two, and four bytes, as well as eight bytes on 64-bit platforms). These functions are described in the following list and are defined in <asm/uaccess.h>.

If an attempt is made to use one of the listed functions to transfer a value that does not fit one of the specific sizes, the result is usually a strange message from the compiler, such as "conversion to non-scalar type requested.'' In such cases, copy_to_user or copy_from_user must be used.

Capabilities and Restricted Operations

Unix systems have traditionally restricted privileged operations to the superuser account. Privilege is an all-or-nothing thing -- the superuser can do absolutely anything, but all other users are highly restricted. The Linux kernel as of version 2.2 provides a more flexible system called capabilities. A capability-based system leaves the all-or-nothing mode behind and breaks down privileged operations into separate subgroups. In this way, a particular user (or program) can be empowered to perform a specific privileged operation without giving away the ability to perform other, unrelated operations. Capabilities are still little used in user space, but kernel code uses them almost exclusively.

 int capable(int capability); 

In the scull sample driver, any user is allowed to query the quantum and quantum set sizes. Only privileged users, however, may change those values, since inappropriate values could badly affect system performance. When needed, the scull implementation of ioctl checks a user's privilege level as follows:

   if (! capable (CAP_SYS_ADMIN))    return -EPERM; 

In the absence of a more specific capability for this task, CAP_SYS_ADMIN was chosen for this test.

The Implementation of the ioctl Commands

   switch(cmd) {  #ifdef SCULL_DEBUG    case SCULL_IOCHARDRESET:      /*      * reset the counter to 1, to allow unloading in case      * of problems. Use 1, not 0, because the invoking      * process has the device open.      */      while (MOD_IN_USE)        MOD_DEC_USE_COUNT;      MOD_INC_USE_COUNT;      /* don't break: fall through and reset things */ #endif /* SCULL_DEBUG */     case SCULL_IOCRESET:     scull_quantum = SCULL_QUANTUM;     scull_qset = SCULL_QSET;     break;         case SCULL_IOCSQUANTUM: /* Set: arg points to the value */     if (! capable (CAP_SYS_ADMIN))       return -EPERM;     ret = _ _get_user(scull_quantum, (int *)arg);     break;     case SCULL_IOCTQUANTUM: /* Tell: arg is the value */     if (! capable (CAP_SYS_ADMIN))       return -EPERM;     scull_quantum = arg;     break;     case SCULL_IOCGQUANTUM: /* Get: arg is pointer to result */     ret = _ _put_user(scull_quantum, (int *)arg);     break;     case SCULL_IOCQQUANTUM: /* Query: return it (it's positive) */     return scull_quantum;     case SCULL_IOCXQUANTUM: /* eXchange: use arg as pointer */     if (! capable (CAP_SYS_ADMIN))       return -EPERM;     tmp = scull_quantum;     ret = _ _get_user(scull_quantum, (int *)arg);     if (ret == 0)       ret = _ _put_user(tmp, (int *)arg);     break;     case SCULL_IOCHQUANTUM: /* sHift: like Tell + Query */     if (! capable (CAP_SYS_ADMIN))       return -EPERM;     tmp = scull_quantum;     scull_quantum = arg;     return tmp;     default: /* redundant, as cmd was checked against MAXNR */     return -ENOTTY;  }  return ret; 

scull also includes six entries that act on scull_qset. These entries are identical to the ones for scull_quantum and are not worth showing in print.

The six ways to pass and receive arguments look like the following from the caller's point of view (i.e., from user space):

  int quantum;   ioctl(fd,SCULL_IOCSQUANTUM, &quantum);  ioctl(fd,SCULL_IOCTQUANTUM, quantum);   ioctl(fd,SCULL_IOCGQUANTUM, &quantum);  quantum = ioctl(fd,SCULL_IOCQQUANTUM);   ioctl(fd,SCULL_IOCXQUANTUM, &quantum);  quantum = ioctl(fd,SCULL_IOCHQUANTUM, quantum); 

Device Control Without ioctl

Controlling by write is definitely the way to go for those devices that don't transfer data but just respond to commands, such as robotic devices.

For instance, a driver written for fun by one of your authors moves a camera on two axes. In this driver, the "device'' is simply a pair of old stepper motors, which can't really be read from or written to. The concept of "sending a data stream'' to a stepper motor makes little or no sense. In this case, the driver interprets what is being written as ASCII commands and converts the requests to sequences of impulses that manipulate the stepper motors. The idea is similar, somewhat, to the AT commands you send to the modem in order to set up communication, the main difference being that the serial port used to communicate with the modem must transfer real data as well. The advantage of direct device control is that you can use cat to move the camera without writing and compiling special code to issue the ioctl calls.

When writing command-oriented drivers, there's no reason to implement the ioctl method. An additional command in the interpreter is easier to implement and use.

The default answer is "go to sleep waiting for data.'' This section shows how a process is put to sleep, how it is awakened, and how an application can ask if there is data without just blindly issuing a read call and blocking. We then apply the same concepts to write.

As usual, before we show actual code, we'll explain a few concepts.

Going to Sleep and Awakening

  wait_queue_head_t my_queue;  init_waitqueue_head (&my_queue); 

  DECLARE_WAIT_QUEUE_HEAD (my_queue); 

It is a common mistake to neglect to initialize a wait queue (especially since earlier versions of the kernel did not require this initialization); if you forget, the results will usually not be what you intended.

Once the wait queue is declared and initialized, a process may use it to go to sleep. Sleeping is accomplished by calling one of the variants of sleep_on, depending on how deep a sleep is called for.

It is worth repeating that driver writers should almost always use the interruptible instances of these functions/macros. The noninterruptible version exists for the small number of situations in which signals cannot be dealt with, for example, when waiting for a data page to be retrieved from swap space. Most drivers do not present such special situations.

Just as there is more than one way to sleep, so there is also more than one way to wake up. The high-level functions provided by the kernel to wake up processes are as follows:

If your driver is using interruptible_sleep_on, there is little difference between wake_up and wake_up_interruptible. Calling the latter is a common convention, however, to preserve consistency between the two calls.

  DECLARE_WAIT_QUEUE_HEAD(wq);  ssize_t sleepy_read (struct file *filp, char *buf, size_t count,     loff_t *pos) {   printk(KERN_DEBUG "process %i (%s) going to sleep\n",       current->pid, current->comm);   interruptible_sleep_on(&wq);   printk(KERN_DEBUG "awoken %i (%s)\n", current->pid, current->comm);   return 0; /* EOF */ }  ssize_t sleepy_write (struct file *filp, const char *buf, size_t count, 		loff_t *pos) {   printk(KERN_DEBUG "process %i (%s) awakening the readers...\n",      current->pid, current->comm);   wake_up_interruptible(&wq);   return count; /* succeed, to avoid retrial */ } 

The code for this device is available as sleepy in the example programs and can be tested using cat and input/output redirection, as usual.

An important thing to remember with wait queues is that being woken up does not guarantee that the event you were waiting for has occurred; a process can be woken for other reasons, mainly because it received a signal. Any code that sleeps should do so in a loop that tests the condition after returning from the sleep, as discussed in "A Sample Implementation: scullpipe" later in this chapter.

A Deeper Look at Wait Queues

  void simplified_sleep_on(wait_queue_head_t *queue)  {    wait_queue_t wait;     init_waitqueue_entry(&wait, current);    current->state = TASK_INTERRUPTIBLE;     add_wait_queue(queue, &wait);    schedule();    remove_wait_queue (queue, &wait);   } 

Figure 5-1 shows the internals of the data structures involved in wait queues and how they are used by processes.

The code to perform an exclusive sleep looks very similar to that for a regular sleep:

  void simplified_sleep_exclusive(wait_queue_head_t *queue)  {    wait_queue_t wait;     init_waitqueue_entry(&wait, current);    current->state = TASK_INTERRUPTIBLE | TASK_EXCLUSIVE;     add_wait_queue_exclusive(queue, &wait);    schedule();    remove_wait_queue (queue, &wait);   } 

The attentive reader may have noticed another reason to manipulate wait queues and the scheduler explicitly. Whereas functions like sleep_on will block a process on exactly one wait queue, working with the queues directly allows sleeping on multiple queues simultaneously. Most drivers need not sleep on more than one queue; if yours is the exception, you will need to use code like what we've shown.

Writing Reentrant Code

Of course, on SMP systems, multiple simultaneous calls to your driver can happen even when you do not sleep.

Such situations can be handled painlessly by writing reentrant code. Reentrant code is code that doesn't keep status information in global variables and thus is able to manage interwoven invocations without mixing anything up. If all the status information is process specific, no interference will ever happen.

If you need to save large amounts of status data, you can keep the pointer in a local variable and use kmalloc to retrieve the actual storage space. In this case you must remember to kfree the data, because there's no equivalent to "everything is released at process termination'' when you're working in kernel space. Using local variables for large items is not good practice, because the data may not fit the single page of memory allocated for stack space.

Blocking and Nonblocking Operations

The flag gets its name from "open-nonblock,'' because it can be specified at open time (and originally could only be specified there). If you browse the source code, you'll find some references to an O_NDELAY flag; this is an alternate name for O_NONBLOCK, accepted for compatibility with System V code. The flag is cleared by default, because the normal behavior of a process waiting for data is just to sleep. In the case of a blocking operation, which is the default, the following behavior should be implemented in order to adhere to the standard semantics:

We didn't use an input buffer in scull, because data is already available when read is issued. Similarly, no output buffer was used, because data is simply copied to the memory area associated with the device. Essentially, the device is a buffer, so the implementation of additional buffers would be superfluous. We'll see the use of buffers in Chapter 9, "Interrupt Handling", in the section titled "Interrupt-Driven I/O".

The behavior of read and write is different if O_NONBLOCK is specified. In this case, the calls simply return -EAGAIN if a process calls read when no data is available or if it calls write when there's no space in the buffer.

As you might expect, nonblocking operations return immediately, allowing the application to poll for data. Applications must be careful when using the stdio functions while dealing with nonblocking files, because they can easily mistake a nonblocking return for EOF. They always have to check errno.

Naturally, O_NONBLOCK is meaningful in the open method also. This happens when the call can actually block for a long time; for example, when opening a FIFO that has no writers (yet), or accessing a disk file with a pending lock. Usually, opening a device either succeeds or fails, without the need to wait for external events. Sometimes, however, opening the device requires a long initialization, and you may choose to support O_NONBLOCK in your open method by returning immediately with -EAGAIN ("try it again") if the flag is set, after initiating device initialization. The driver may also implement a blocking open to support access policies in a way similar to file locks. We'll see one such implementation in the section "Blocking open as an Alternative to EBUSY" later in this chapter.

Some drivers may also implement special semantics for O_NONBLOCK; for example, an open of a tape device usually blocks until a tape has been inserted. If the tape drive is opened with O_NONBLOCK, the open succeeds immediately regardless of whether the media is present or not.

A Sample Implementation: scullpipe

Within a driver, a process blocked in a read call is awakened when data arrives; usually the hardware issues an interrupt to signal such an event, and the driver awakens waiting processes as part of handling the interrupt. The scull driver works differently, so that it can be run without requiring any particular hardware or an interrupt handler. We chose to use another process to generate the data and wake the reading process; similarly, reading processes are used to wake sleeping writer processes. The resulting implementation is similar to that of a FIFO (or named pipe) filesystem node, whence the name.

The device driver uses a device structure that embeds two wait queues and a buffer. The size of the buffer is configurable in the usual ways (at compile time, load time, or runtime).

  typedef struct Scull_Pipe {   wait_queue_head_t inq, outq;  /* read and write queues */   char *buffer, *end;       /* begin of buf, end of buf */   int buffersize;         /* used in pointer arithmetic */   char *rp, *wp;         /* where to read, where to write */   int nreaders, nwriters;     /* number of openings for r/w */   struct fasync_struct *async_queue; /* asynchronous readers */   struct semaphore sem;      /* mutual exclusion semaphore */   devfs_handle_t handle;     /* only used if devfs is there */ } Scull_Pipe; 

The read implementation manages both blocking and nonblocking input and looks like this (the puzzling first line of the function is explained later, in "Seeking a Device"):

  ssize_t scull_p_read (struct file *filp, char *buf, size_t count,         loff_t *f_pos) {   Scull_Pipe *dev = filp->private_data;    if (f_pos != &filp->f_pos) return -ESPIPE;    if (down_interruptible(&dev->sem))     return -ERESTARTSYS;   while (dev->rp == dev->wp) { /* nothing to read */     up(&dev->sem); /* release the lock */     if (filp->f_flags & O_NONBLOCK)       return -EAGAIN;     PDEBUG("\"%s\" reading: going to sleep\n", current->comm);     if (wait_event_interruptible(dev->inq, (dev->rp != dev->wp)))       return -ERESTARTSYS; /* signal: tell the fs layer to handle it */     /* otherwise loop, but first reacquire the lock */     if (down_interruptible(&dev->sem))       return -ERESTARTSYS;   }   /* ok, data is there, return something */   if (dev->wp > dev->rp)     count = min(count, dev->wp - dev->rp);   else /* the write pointer has wrapped, return data up to dev->end */     count = min(count, dev->end - dev->rp);   if (copy_to_user(buf, dev->rp, count)) {     up (&dev->sem);     return -EFAULT;   }   dev->rp += count;   if (dev->rp == dev->end)     dev->rp = dev->buffer; /* wrapped */   up (&dev->sem);    /* finally, awaken any writers and return */   wake_up_interruptible(&dev->outq);   PDEBUG("\"%s\" did read %li bytes\n",current->comm, (long)count);   return count; } 

As you can see, we left some PDEBUG statements in the code. When you compile the driver, you can enable messaging to make it easier to follow the interaction of different processes.

It's worth repeating that a process can go to sleep both when it calls schedule, either directly or indirectly, and when it copies data to or from user space. In the latter case the process may sleep if the user array is not currently present in main memory. If scull sleeps while copying data between kernel and user space, it will sleep with the device semaphore held. Holding the semaphore in this case is justified since it will not deadlock the system, and since it is important that the device memory array not change while the driver sleeps.

The implementation for write is quite similar to that for read (and, again, its first line will be explained later). Its only "peculiar'' feature is that it never completely fills the buffer, always leaving a hole of at least one byte. Thus, when the buffer is empty, wp and rp are equal; when there is data there, they are always different.

  static inline int spacefree(Scull_Pipe *dev) {   if (dev->rp == dev->wp)     return dev->buffersize - 1;   return ((dev->rp + dev->buffersize - dev->wp) % dev->buffersize) - 1; }  ssize_t scull_p_write(struct file *filp, const char *buf, size_t count,         loff_t *f_pos) {   Scull_Pipe *dev = filp->private_data;      if (f_pos != &filp->f_pos) return -ESPIPE;    if (down_interruptible(&dev->sem))     return -ERESTARTSYS;      /* Make sure there's space to write */   while (spacefree(dev) == 0) { /* full */     up(&dev->sem);     if (filp->f_flags & O_NONBLOCK)       return -EAGAIN;     PDEBUG("\"%s\" writing: going to sleep\n",current->comm);     if (wait_event_interruptible(dev->outq, spacefree(dev) > 0))       return -ERESTARTSYS; /* signal: tell the fs layer to handle it */     if (down_interruptible(&dev->sem))       return -ERESTARTSYS;   }   /* ok, space is there, accept something */   count = min(count, spacefree(dev));   if (dev->wp >= dev->rp)     count = min(count, dev->end - dev->wp); /* up to end-of-buffer */   else /* the write pointer has wrapped, fill up to rp-1 */     count = min(count, dev->rp - dev->wp - 1);   PDEBUG("Going to accept %li bytes to %p from %p\n",       (long)count, dev->wp, buf);   if (copy_from_user(dev->wp, buf, count)) {     up (&dev->sem);     return -EFAULT;   }   dev->wp += count;   if (dev->wp == dev->end)     dev->wp = dev->buffer; /* wrapped */   up(&dev->sem);    /* finally, awaken any reader */   wake_up_interruptible(&dev->inq); /* blocked in read() and select() */    /* and signal asynchronous readers, explained later in Chapter 5 */   if (dev->async_queue)     kill_fasync(&dev->async_queue, SIGIO, POLL_IN);   PDEBUG("\"%s\" did write %li bytes\n",current->comm, (long)count);   return count; } 

The device, as we conceived it, doesn't implement blocking open and is simpler than a real FIFO. If you want to look at the real thing, you can find it in fs/pipe.c, in the kernel sources.

  int main(int argc, char **argv) {   int delay=1, n, m=0;    if (argc>1) delay=atoi(argv[1]);   fcntl(0, F_SETFL, fcntl(0,F_GETFL) | O_NONBLOCK); /* stdin */   fcntl(1, F_SETFL, fcntl(1,F_GETFL) | O_NONBLOCK); /* stdout */    while (1) {     n=read(0, buffer, 4096);     if (n>=0)       m=write(1, buffer, n);     if ((n<0 || m<0) && (errno != EAGAIN))       break;     sleep(delay);   }   perror( n<0 ? "stdin" : "stdout");   exit(1); } 

Support for either system call requires support from the device driver to function. In version 2.0 of the kernel the device method was modeled on select (and no poll was available to user programs); from version 2.1.23 onward both were offered, and the device method was based on the newly introduced poll system call because poll offered more detailed control than select.

Implementations of the poll method, implementing both the poll and selectsystem calls, have the following prototype:

  unsigned int (*poll) (struct file *, poll_table *); 

The driver's method will be called whenever the user-space program performs a poll or selectsystem call involving a file descriptor associated with the driver. The device method is in charge of these two steps:

Both of these operations are usually straightforward, and tend to look very similar from one driver to the next. They rely, however, on information that only the driver can provide, and thus must be implemented individually by each driver.

  void poll_wait (struct file *, wait_queue_head_t *, poll_table *); 

The second task performed by the poll method is returning the bit mask describing which operations could be completed immediately; this is also straightforward. For example, if the device has data available, a read would complete without sleeping; the poll method should indicate this state of affairs. Several flags (defined in <linux/poll.h>) are used to indicate the possible operations:

It's worth noting that POLLRDBAND and POLLWRBAND are meaningful only with file descriptors associated with sockets: device drivers won't normally use these flags.

The description of poll takes up a lot of space for something that is relatively simple to use in practice. Consider the scullpipe implementation of the poll method:

  unsigned int scull_p_poll(struct file *filp, poll_table *wait) {   Scull_Pipe *dev = filp->private_data;   unsigned int mask = 0;    /*    * The buffer is circular; it is considered full    * if "wp" is right behind "rp". "left" is 0 if the    * buffer is empty, and it is "1" if it is completely full.    */   int left = (dev->rp + dev->buffersize - dev->wp) % dev->buffersize;    poll_wait(filp, &dev->inq, wait);   poll_wait(filp, &dev->outq, wait);   if (dev->rp != dev->wp) mask |= POLLIN | POLLRDNORM; /* readable */   if (left != 1)     mask |= POLLOUT | POLLWRNORM; /* writable */    return mask; } 

This code simply adds the two scullpipewait queues to the poll_table, then sets the appropriate mask bits depending on whether data can be read or written.

Implementing end-of-file in the same way as FIFOs do would mean checking dev->nwriters, both in read and in poll, and reporting end-of-file (as just described) if no process has the device opened for writing. Unfortunately, though, if a reader opened the scullpipe device before the writer, it would see end-of-file without having a chance to wait for data. The best way to fix this problem would be to implement blocking within open; this task is left as an exercise for the reader.

Interaction with read and write

The purpose of the poll and select calls is to determine in advance if an I/O operation will block. In that respect, they complement read and write. More important, poll and selectare useful because they let the application wait simultaneously for several data streams, although we are not exploiting this feature in the scull examples.

A correct implementation of the three calls is essential to make applications work correctly. Though the following rules have more or less already been stated, we'll summarize them here.

Reading data from the device

Writing to the device

Although these are a good set of general rules, one should also recognize that each device is unique and that sometimes the rules must be bent slightly. For example, record-oriented devices (such as tape drives) cannot execute partial writes.

Flushing pending output

  int (*fsync) (struct file *file, struct dentry *dentry, int datasync); 

The Underlying Data Structure

If none of the drivers being polled indicates that I/O can occur without blocking, the poll call simply sleeps until one of the (perhaps many) wait queues it is on wakes it up.

What's interesting in the implementation of pollis that the file operation may be called with a NULL pointer as poll_table argument. This situation can come about for a couple of reasons. If the application calling poll has provided a timeout value of 0 (indicating that no wait should be done), there is no reason to accumulate wait queues, and the system simply does not do it. The poll_table pointer is also set to NULL immediately after any driver being polled indicates that I/O is possible. Since the kernel knows at that point that no wait will occur, it does not build up a list of wait queues.

When the poll call completes, the poll_table structure is deallocated, and all wait queue entries previously added to the poll table (if any) are removed from the table and their wait queues.

Actually, things are somewhat more complex than depicted here, because the poll table is not a simple array but rather a set of one or more pages, each hosting an array. This complication is meant to avoid putting too low a limit (dictated by the page size) on the maximum number of file descriptors involved in a poll or select system call.

Let's imagine, for example, a process that executes a long computational loop at low priority, but needs to process incoming data as soon as possible. If the input channel is the keyboard, you are allowed to send a signal to the application (using the `INTR' character, usually CTRL-C), but this signaling ability is part of the tty abstraction, a software layer that isn't used for general char devices. What we need for asynchronous notification is something different. Furthermore, any input data should generate an interrupt, not just CTRL-C.

For example, the following lines of code in a user program enable asynchronous notification to the current process for the stdin input file:

 signal(SIGIO, &input_handler); /* dummy sample; sigaction() is better */ fcntl(STDIN_FILENO, F_SETOWN, getpid()); oflags = fcntl(STDIN_FILENO, F_GETFL); fcntl(STDIN_FILENO, F_SETFL, oflags | FASYNC); 

The program named asynctest in the sources is a simple program that reads stdin as shown. It can be used to test the asynchronous capabilities of scullpipe. The program is similar to cat, but doesn't terminate on end-of-file; it responds only to input, not to the absence of input.

There is one remaining problem with input notification. When a process receives a SIGIO, it doesn't know which input file has new input to offer. If more than one file is enabled to asynchronously notify the process of pending input, the application must still resort to poll or select to find out what happened.

The Driver's Point of View

While implementing the first step is trivial -- there's nothing to do on the driver's part -- the other steps involve maintaining a dynamic data structure to keep track of the different asynchronous readers; there might be several of these readers. This dynamic data structure, however, doesn't depend on the particular device involved, and the kernel offers a suitable general-purpose implementation so that you don't have to rewrite the same code in every driver.

  int fasync_helper(int fd, struct file *filp, 	int mode, struct fasync_struct **fa);  void kill_fasync(struct fasync_struct **fa, int sig, int band); 

fasync_helper is invoked to add files to or remove files from the list of interested processes when the FASYNC flag changes for an open file. All of its arguments except the last are provided to the fasync method and can be passed through directly. kill_fasync is used to signal the interested processes when data arrives. Its arguments are the signal to send (usually SIGIO) and the band, which is almost always POLL_IN (but which may be used to send "urgent" or out-of-band data in the networking code).

Here's how scullpipe implements the fasync method:

  int scull_p_fasync(fasync_file fd, struct file *filp, int mode) {   Scull_Pipe *dev = filp->private_data;    return fasync_helper(fd, filp, mode, &dev->async_queue); } 

It's clear that all the work is performed by fasync_helper. It wouldn't be possible, however, to implement the functionality without a method in the driver, because the helper function needs to access the correct pointer to struct fasync_struct * (here &dev->async_queue), and only the driver can provide the information.

When data arrives, then, the following statement must be executed to signal asynchronous readers. Since new data for the scullpipe reader is generated by a process issuing a write, the statement appears in the write method of scullpipe.

   if (dev->async_queue)    kill_fasync(&dev->async_queue, SIGIO, POLL_IN); 

It might appear that we're done, but there's still one thing missing. We must invoke our fasync method when the file is closed to remove the file from the list of active asynchronous readers. Although this call is required only if filp->f_flags has FASYNC set, calling the function anyway doesn't hurt and is the usual implementation. The following lines, for example, are part of the close method for scullpipe:

   /* remove this filp from the asynchronously notified filp's */  scull_p_fasync(-1, filp, 0); 

The llseek Implementation

  loff_t scull_llseek(struct file *filp, loff_t off, int whence) {   Scull_Dev *dev = filp->private_data;   loff_t newpos;    switch(whence) {    case 0: /* SEEK_SET */     newpos = off;     break;     case 1: /* SEEK_CUR */     newpos = filp->f_pos + off;     break;     case 2: /* SEEK_END */     newpos = dev->size + off;     break;     default: /* can't happen */     return -EINVAL;   }   if (newpos<0) return -EINVAL;   filp->f_pos = newpos;   return newpos; } 

The only device-specific operation here is retrieving the file length from the device. In scull the read and write methods cooperate as needed, as shown in "read and write" in Chapter 3, "Char Drivers".

Although the implementation just shown makes sense for scull, which handles a well-defined data area, most devices offer a data flow rather than a data area (just think about the serial ports or the keyboard), and seeking those devices does not make sense. If this is the case, you can't just refrain from declaring the llseek operation, because the default method allows seeking. Instead, you should use the following code:

  loff_t scull_p_llseek(struct file *filp, loff_t off, int whence) {   return -ESPIPE; /* unseekable */ } 

This function comes from the scullpipedevice, which isn't seekable; the error code is translated to "Illegal seek,'' though the symbolic name means "is a pipe.'' Because the position indicator is meaningless for nonseekable devices, neither read nor write needs to update it during data transfer.

   if (f_pos != &filp->f_pos) return -ESPIPE; 

The problem is similar to that of using ttys. In that case, the login process changes the ownership of the device node whenever a user logs into the system, in order to prevent other users from interfering with or sniffing the tty data flow. However, it's impractical to use a privileged program to change the ownership of a device every time it is opened, just to grant unique access to it.

None of the code shown up to now implements any access control beyond the filesystem permission bits. If the opensystem call forwards the request to the driver, open will succeed. We now introduce a few techniques for implementing some additional checks.

Every device shown in this section has the same behavior as the bare scull device (that is, it implements a persistent memory area) but differs from scull in access control, which is implemented in the open and close operations.

Single-Open Devices

Allowing only a single process to open a device has undesirable properties, but it is also the easiest access control to implement for a device driver, so it's shown here. The source code is extracted from a device called scullsingle.

  int scull_s_open(struct inode *inode, struct file *filp) {   Scull_Dev *dev = &scull_s_device; /* device information */   int num = NUM(inode->i_rdev);    if (!filp->private_data && num > 0)     return -ENODEV; /* not devfs: allow 1 device only */   spin_lock(&scull_s_lock);   if (scull_s_count) {     spin_unlock(&scull_s_lock);     return -EBUSY; /* already open */   }   scull_s_count++;   spin_unlock(&scull_s_lock);   /* then, everything else is copied from the bare scull device */    if ( (filp->f_flags & O_ACCMODE) == O_WRONLY)     scull_trim(dev);   if (!filp->private_data)     filp->private_data = dev;   MOD_INC_USE_COUNT;   return 0;     /* success */ } 

  int scull_s_release(struct inode *inode, struct file *filp) {   scull_s_count--; /* release the device */   MOD_DEC_USE_COUNT;   return 0; } 

Normally, we recommend that you put the open flag scull_s_count (with the accompanying spinlock, scull_s_lock, whose role is explained in the next subsection) within the device structure (Scull_Dev here) because, conceptually, it belongs to the device. The scull driver, however, uses standalone variables to hold the flag and the lock in order to use the same device structure and methods as the bare scull device and minimize code duplication.

Another Digression into Race Conditions

As soon as you get into the SMP world, however, a problem arises. If two processes on two processors attempt to open the device simultaneously, it is possible that they could both test the value of scull_s_count before either modifies it. In this scenario you'll find that, at best, the single-open semantics of the device is not enforced. In the worst case, unexpected concurrent access could create data structure corruption and system crashes.

Spinlocks can be the ideal mechanism for small critical sections. Processes should hold spinlocks for the minimum time possible, and must never sleep while holding a lock. Thus, the main scull driver, which exchanges data with user space and can therefore sleep, is not suitable for a spinlock solution. But spinlocks work nicely for controlling access to scull_s_single (even if they still are not the optimal solution, which we will see in Chapter 9, "Interrupt Handling").

  spin_lock_init(spinlock_t *lock); 

  spin_lock(spinlock_t *lock); 

  spin_unlock(spinlock_t *lock); 

Spinlocks can be more complicated than this, and we'll get into the details in Chapter 9, "Interrupt Handling". But the simple case as shown here suits our needs for now, and all of the access-control variants of scull will use simple spinlocks in this manner.

The astute reader may have noticed that whereas scull_s_open acquires the scull_s_lock lock prior to incrementing the scull_s_count flag, scull_s_close takes no such precautions. This code is safe because no other code will change the value of scull_s_count if it is nonzero, so there will be no conflict with this particular assignment.

Restricting Access to a Single User at a Time

Those access policies are a little trickier to implement than single-open policies. In this case, two items are needed: an open count and the uid of the "owner'' of the device. Once again, the best place for such items is within the device structure; our example uses global variables instead, for the reason explained earlier for scullsingle. The name of the device is sculluid.

   spin_lock(&scull_u_lock);  if (scull_u_count &&     (scull_u_owner != current->uid) && /* allow user */    (scull_u_owner != current->euid) && /* allow whoever did su */          !capable(CAP_DAC_OVERRIDE)) { /* still allow root */      spin_unlock(&scull_u_lock);      return -EBUSY;  /* -EPERM would confuse the user */  }   if (scull_u_count == 0)    scull_u_owner = current->uid; /* grab it */   scull_u_count++;  spin_unlock(&scull_u_lock); 

We chose to return -EBUSY and not -EPERM, even though the code is performing a permission check, in order to point a user who is denied access in the right direction. The reaction to "Permission denied'' is usually to check the mode and owner of the /dev file, while "Device busy'' correctly suggests that the user should look for a process already using the device.

The code for close is not shown, since all it does is decrement the usage count.

Blocking open as an Alternative to EBUSY

For example, if a data communication channel is used both to transmit reports on a timely basis (using crontab) and for casual usage according to people's needs, it's much better for the timely report to be slightly delayed rather than fail just because the channel is currently busy.

This is one of the choices that the programmer must make when designing a device driver, and the right answer depends on the particular problem being solved.

The alternative to EBUSY, as you may have guessed, is to implement blocking open.

The scullwuid device is a version of sculluid that waits for the device on open instead of returning -EBUSY. It differs from sculluid only in the following part of the open operation:

   spin_lock(&scull_w_lock);  while (scull_w_count &&    (scull_w_owner != current->uid) && /* allow user */   (scull_w_owner != current->euid) && /* allow whoever did su */   !capable(CAP_DAC_OVERRIDE)) {    spin_unlock(&scull_w_lock);    if (filp->f_flags & O_NONBLOCK) return -EAGAIN;     interruptible_sleep_on(&scull_w_wait);    if (signal_pending(current)) /* a signal arrived */     return -ERESTARTSYS; /* tell the fs layer to handle it */    /* else, loop */    spin_lock(&scull_w_lock);  }  if (scull_w_count == 0)    scull_w_owner = current->uid; /* grab it */  scull_w_count++;  spin_unlock(&scull_w_lock); 

The implementation is based once again on a wait queue. Wait queues were created to maintain a list of processes that sleep while waiting for an event, so they fit perfectly here.

  int scull_w_release(struct inode *inode, struct file *filp) {   scull_w_count--;   if (scull_w_count == 0)     wake_up_interruptible(&scull_w_wait); /* awaken other uid's */   MOD_DEC_USE_COUNT;   return 0; } 

The problem with a blocking-open implementation is that it is really unpleasant for the interactive user, who has to keep guessing what is going wrong. The interactive user usually invokes precompiled commands such as cp and tar and can't just add O_NONBLOCK to the opencall. Someone who's making a backup using the tape drive in the next room would prefer to get a plain "device or resource busy'' message instead of being left to guess why the hard drive is so silent today while tar is scanning it.

This kind of problem (different, incompatible policies for the same device) is best solved by implementing one device node for each access policy. An example of this practice can be found in the Linux tape driver, which provides multiple device files for the same device. Different device files will, for example, cause the drive to record with or without compression, or to automatically rewind the tape when the device is closed.

Cloning the Device on Open

Clearly this is possible only if the device is not bound to a hardware object; scull is an example of such a "software'' device. The internals of /dev/ttyuse a similar technique in order to give its process a different "view'' of what the /dev entry point represents. When copies of the device are created by the software driver, we call them virtual devices -- just as virtual consoles use a single physical tty device.

Although this kind of access control is rarely needed, the implementation can be enlightening in showing how easily kernel code can change the application's perspective of the surrounding world (i.e., the computer). The topic is quite exotic, actually, so if you aren't interested, you can jump directly to the next section.

The /dev/scullpriv device node implements virtual devices within the scull package. The scullpriv implementation uses the minor number of the process's controlling tty as a key to access the virtual device. You can nonetheless easily modify the sources to use any integer value for the key; each choice leads to a different policy. For example, using the uid leads to a different virtual device for each user, while using a pid key creates a new device for each process accessing it.

The decision to use the controlling terminal is meant to enable easy testing of the device using input/output redirection: the device is shared by all commands run on the same virtual terminal and is kept separate from the one seen by commands run on another terminal.

The open method looks like the following code. It must look for the right virtual device and possibly create one. The final part of the function is not shown because it is copied from the bare scull, which we've already seen.

  /* The clone-specific data structure includes a key field */ struct scull_listitem {   Scull_Dev device;   int key;   struct scull_listitem *next;    };  /* The list of devices, and a lock to protect it */ struct scull_listitem *scull_c_head; spinlock_t scull_c_lock;  /* Look for a device or create one if missing */ static Scull_Dev *scull_c_lookfor_device(int key) {   struct scull_listitem *lptr, *prev = NULL;    for (lptr = scull_c_head; lptr && (lptr->key != key); lptr = lptr->next)     prev=lptr;   if (lptr) return &(lptr->device);    /* not found */   lptr = kmalloc(sizeof(struct scull_listitem), GFP_ATOMIC);   if (!lptr) return NULL;    /* initialize the device */   memset(lptr, 0, sizeof(struct scull_listitem));   lptr->key = key;   scull_trim(&(lptr->device)); /* initialize it */   sema_init(&(lptr->device.sem), 1);    /* place it in the list */   if (prev) prev->next = lptr;   else    scull_c_head = lptr;    return &(lptr->device); }  int scull_c_open(struct inode *inode, struct file *filp) {   Scull_Dev *dev;   int key, num = NUM(inode->i_rdev);     if (!filp->private_data && num > 0)     return -ENODEV; /* not devfs: allow 1 device only */    if (!current->tty) {      PDEBUG("Process \"%s\" has no ctl tty\n",current->comm);     return -EINVAL;   }   key = MINOR(current->tty->device);    /* look for a scullc device in the list */   spin_lock(&scull_c_lock);   dev = scull_c_lookfor_device(key);   spin_unlock(&scull_c_lock);    if (!dev) return -ENOMEM;    /* then, everything else is copied from the bare scull device */ 

  int scull_c_release(struct inode *inode, struct file *filp) {   /*    * Nothing to do, because the device is persistent.    * A `real' cloned device should be freed on last close    */   MOD_DEC_USE_COUNT;   return 0; } 

The 2.2 wait queue implementation used variables of the type struct wait_queue * instead of wait_queue_head_t. This pointer had to be initialized to NULL prior to its first use. A typical declaration and initialization of a wait queue looked like this:

  struct wait_queue *my_queue = NULL; 

  # define DECLARE_WAIT_QUEUE_HEAD(head) struct wait_queue *head = NULL   typedef struct wait_queue *wait_queue_head_t; # define init_waitqueue_head(head) (*(head)) = NULL 

The synchronous versions of wake_up were added in 2.3.29, and sysdep.h provides macros with the same names so that you can use the feature in your code while maintaining portability. The replacement macros expand to normal wake_up, since the underlying mechanisms were missing from earlier kernels. The timeout versions of sleep_on were added in kernel 2.1.127. The rest of the wait queue interface has remained relatively unchanged. The sysdep.h header defines the needed macros in order to compile and run your modules with Linux 2.2 and Linux 2.0 without cluttering the code with lots of #ifdefs.

The wait_event macro did not exist in the 2.0 kernel. For those who need it, we have provided an implementation in sysdep.h

Asynchronous Notification

In Linux 2.3.21, kill_fasync got its third argument. Prior to this release, kill_fasync was called as

  kill_fasync(struct fasync_struct *queue, int signal); 

Fortunately, sysdep.h takes care of the issue.

  int (*fasync) (struct inode *inode, struct file *filp, int on); 

To solve this incompatibility, we use the same approach taken for read and write: use of a wrapper function when the module is compiled under 2.0 headers.

The inode argument to the fasync method was also passed in when called from the release method, rather than the -1 value used with later kernels.

The fsync Method

Access to User Space in Linux 2.0

The functions used to access memory under Linux 2.0 were as follows:

verify_area had to be called explicitly because no user-area copy function performed the check. The great news introduced by Linux 2.1, which forced the incompatible change in the get_user and put_userfunctions, was that the task of verifying user addresses was left to the hardware, because the kernel was now able to trap and handle processor exceptions generated during data copies to user space.

As an example of how the older calls are used, consider scull one more time. A version of scull using the 2.0 API would call verify_area in this way:

   int err = 0, tmp;     /*   * extract the type and number bitfields, and don't decode   * wrong cmds: return ENOTTY before verify_area()   */  if (_IOC_TYPE(cmd) != SCULL_IOC_MAGIC) return -ENOTTY;   if (_IOC_NR(cmd) > SCULL_IOC_MAXNR) return -ENOTTY;   /*   * the direction is a bit mask, and VERIFY_WRITE catches R/W    * transfers. `Type' is user oriented, while   * verify_area is kernel oriented, so the concept of "read" and   * "write" is reversed   */  if (_IOC_DIR(cmd) & _IOC_READ)    err = verify_area(VERIFY_WRITE, (void *)arg, _IOC_SIZE(cmd));  else if (_IOC_DIR(cmd) & _IOC_WRITE)    err = verify_area(VERIFY_READ, (void *)arg, _IOC_SIZE(cmd));  if (err) return err; 

Then get_user and put_usercan be used as follows:

   case SCULL_IOCXQUANTUM: /* eXchange: use arg as pointer */   tmp = scull_quantum;   scull_quantum = get_user((int *)arg);   put_user(tmp, (int *)arg);   break;   default: /* redundant, as cmd was checked against MAXNR */   return -ENOTTY;  }   return 0; 

Only a small portion of the ioctl switch code has been shown, since it is little different from the version for 2.2 and beyond.

Life would be relatively easy for the compatibility-conscious driver writer if it weren't for the fact that put_userand get_user are implemented as macros in all Linux versions, and their interfaces changed. As a result, a straightforward fix using macros cannot be done.

Capabilities in 2.0

suser still exists in later kernels, but its use is strongly discouraged. It is better to define a version of capable for 2.0, as is done in sysdep.h:

  # define capable(anything) suser() 

In this way, code can be written that is portable but which works with modern, capability-oriented systems.

The Linux 2.0 select Method

The select method is passed a pointer to a select_table, and must pass that pointer to select_wait only if the calling process should wait for the requested condition (one of SEL_IN, SEL_OUT, or SEL_EX).

The scull driver deals with the incompatibility by declaring a specific selectmethod to be used when it is compiled for version 2.0 of the kernel:

  #ifdef _ _USE_OLD_SELECT_ _ int scull_p_poll(struct inode *inode, struct file *filp,          int mode, select_table *table) {   Scull_Pipe *dev = filp->private_data;    if (mode == SEL_IN) {     if (dev->rp != dev->wp) return 1; /* readable */     PDEBUG("Waiting to read\n");     select_wait(&dev->inq, table); /* wait for data */     return 0;   }   if (mode == SEL_OUT) {     /*      * The buffer is circular; it is considered full      * if "wp" is right behind "rp". "left" is 0 if the      * buffer is empty, and it is "1" if it is completely full.      */     int left = (dev->rp + dev->buffersize - dev->wp) % dev->buffersize;     if (left != 1) return 1; /* writable */     PDEBUG("Waiting to write\n");     select_wait(&dev->outq, table); /* wait for free space */     return 0;   }   return 0; /* never exception-able */ } #else /* Use poll instead, already shown */ 

Seeking in Linux 2.0

The prototype of the file operation in the 2.0 kernel was the following:

  int (*lseek) (struct inode *inode, struct file *filp , off_t off,  int whence); 

Those working to write drivers compatible with 2.0 and 2.2 usually end up defining separate implementations of the seek method for the two interfaces.

2.0 and SMP

Because Linux 2.0 only minimally supported SMP systems, race conditions of the type mentioned in this chapter did not normally come about. The 2.0 kernel did have a spinlock implementation, but, since only one processor could be running kernel code at a time, there was less need for locking.