int poll(struct pollfd *fds, nfds_t nfds, int timeout);

[fs/select.c -->sys_poll]asmlinkage long sys_poll(struct pollfd __user * ufds, unsigned int nfds, long timeout)
{struct poll_wqueues table;
int fdcount, err;unsigned int i;
struct poll_list *head;
struct poll_list *walk;/* Do a sanity check on nfds ... */ /* 用户给的nfds数不可以超过一个struct file结构支持
的最大fd数（默认是256）*/if (nfds > current->files->max_fdset && nfds > OPEN_MAX)return -EINVAL;if (timeout) {/* Careful about overflow in the intermediate values */if ((unsigned long) timeout < MAX_SCHEDULE_TIMEOUT / HZ)
timeout = (unsigned long)(timeout*HZ+999)/1000+1;else /* Negative or overflow */timeout = MAX_SCHEDULE_TIMEOUT;}poll_initwait(&table);

[fs/poll.h]/** structures and helpers for f_op->poll implementations*/typedef void (*poll_queue_proc)(struct file *, wait_queue_head_t *, struct
poll_table_struct *);typedef struct poll_table_struct {
poll_queue_proc qproc;}
poll_table;

[fs/select.c]void __pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p);void poll_initwait(struct poll_wqueues *pwq){&(pwq->pt)->qproc = __pollwait; /*此行已经被我“翻译”了，方便观看*/
pwq->error = 0;pwq->table = NULL;}

[fs/select.c -->sys_poll]head = NULL;walk = NULL;i = nfds;err = -ENOMEM;
while(i!=0) {struct poll_list *pp;pp = kmalloc(sizeof(struct poll_list)+sizeof(struct pollfd)*(i>POLLFD_PER_PAGE?POLLFD_PER_PAGE:i),GFP_KERNEL);if(pp==NULL)goto out_fds;pp->next=NULL;
pp->len = (i>POLLFD_PER_PAGE?POLLFD_PER_PAGE:i);if (head == NULL)head = pp;elsewalk->next = pp;walk = pp;
if (copy_from_user(pp->entries, ufds + nfds-i,sizeof(struct pollfd)*pp->len)) {err = -EFAULT;goto out_fds;}i -= pp->len;}
fdcount = do_poll(nfds, head, &table, timeout);

[fs/select.c-->sys_poll()-->do_poll()]static void do_pollfd(unsigned int num, struct pollfd * fdpage,poll_table ** pwait, int *count){int i;for (i = 0; i < num; i++) {int fd;unsigned int mask;struct pollfd *fdp;mask = 0;fdp = fdpage+i;fd = fdp->fd;if (fd >= 0) {struct file * file = fget(fd);mask = POLLNVAL;if (file != NULL) {mask = DEFAULT_POLLMASK;if (file->f_op && file->f_op->poll)mask = file->f_op->poll(file, *pwait);mask &= fdp->events | POLLERR | POLLHUP;
fput(file);}if (mask) {*pwait = NULL;(*count)++;}
}fdp->revents = mask;}}static int do_poll(unsigned int nfds, struct poll_list *list,struct poll_wqueues *wait, long timeout){int count = 0;poll_table* pt = &wait->pt;if (!timeout)pt = NULL;for (;;) {struct poll_list *walk;
set_current_state(TASK_INTERRUPTIBLE);walk = list;while(walk != NULL) {do_pollfd( walk->len, walk->entries, &pt, &count);
walk = walk->next;
}pt = NULL;
if (count || !timeout || signal_pending(current))
break;
count = wait->error;if (count)break;
timeout = schedule_timeout(timeout); /* 让current挂起，别的进程跑，timeout到了
以后再回来运行current*/
}__set_current_state(TASK_RUNNING);
return count;}

while(walk != NULL) {do_pollfd( walk->len, walk->entries, &pt, &count);walk = walk->next;}

struct file* file = fget(fd);
file->f_op->poll（file, &(table->pt));

[net/ipv4/tcp.c-->tcp_poll]
unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
{unsigned int mask;struct sock *sk = sock->sk;
struct tcp_opt *tp = tcp_sk(sk);poll_wait(file, sk->sk_sleep, wait);

__poll_wait(file, sk->sk_sleep, wait);

[fs/select.c-->__poll_wait()]void __pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *_p)
{struct poll_wqueues *p = container_of(_p, struct poll_wqueues, pt);struct poll_table_page *table = p->table;if (!table || POLL_TABLE_FULL(table)) {struct poll_table_page *new_table;new_table = (struct poll_table_page *) __get_free_page(GFP_KERNEL);if (!new_table) {p->error = -ENOMEM;__set_current_state(TASK_RUNNING);return;
}new_table->entry = new_table->entries;new_table->next = table;p->table = new_table;table = new_table;}/* Add a new entry */{struct poll_table_entry * entry = table->entry;table->entry = entry+1;
get_file(filp);entry->filp = filp;
entry->wait_address = wait_address;init_waitqueue_entry(&entry->wait, current);add_wait_queue(wait_address,&entry->wait);}
}

[fs/eventpoll.c-->evetpoll_init()]static int __init eventpoll_init(void){int error;init_MUTEX(&epsem);/* Initialize the structure used to perform safe poll wait head wake ups */ep_poll_safewake_init(&psw);/* Allocates slab cache used to allocate "struct epitem" items */epi_cache = kmem_cache_create("eventpoll_epi", sizeof(struct epitem),
0, SLAB_HWCACHE_ALIGN|EPI_SLAB_DEBUG|SLAB_PANIC,NULL, NULL);/* Allocates slab cache used to allocate "struct eppoll_entry" */pwq_cache = kmem_cache_create("eventpoll_pwq",sizeof(struct eppoll_entry), 0,EPI_SLAB_DEBUG|SLAB_PANIC, NULL, NULL);/** Register the virtual file system that will be the source of inodes* for the eventpoll files*/error = register_filesystem(&eventpoll_fs_type);if (error)
goto epanic;/* Mount the above commented virtual file system */eventpoll_mnt = kern_mount(&eventpoll_fs_type);error = PTR_ERR(eventpoll_mnt);if (IS_ERR(eventpoll_mnt))
goto epanic;DNPRINTK(3, (KERN_INFO "[%p] eventpoll: successfully initialized.n",current));
return 0;epanic:panic("eventpoll_init() failedn");}

[fs/eventpoll.c-->sys_epoll_create()]asmlinkage long sys_epoll_create(int size){int error, fd;struct inode *inode;struct file *file;DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d)n",current, size));/* Sanity check on the size parameter */error = -EINVAL;if (size <= 0)goto eexit_1;/** Creates all the items needed to setup an eventpoll file. That is,
* a file structure, and inode and a free file descriptor.*/error = ep_getfd(&fd, &inode, &file);if (error)
goto eexit_1;/* Setup the file internal data structure ( "struct eventpoll" ) */error = ep_file_init(file);if (error)goto eexit_2;

[fs/eventpoll.c-->sys_epoll_ctl()]asmlinkage longsys_epoll_ctl(int epfd, int op, int fd, struct epoll_event __user *event){int error;struct file *file, *tfile;struct eventpoll *ep;struct epitem *epi;struct epoll_event epds;
....epi = ep_find(ep, tfile, fd);error = -EINVAL;
switch (op) {
case EPOLL_CTL_ADD:
if (!epi) {epds.events |= POLLERR | POLLHUP;error = ep_insert(ep, &epds, tfile, fd);} elseerror = -EEXIST;break;case EPOLL_CTL_DEL:if (epi)error = ep_remove(ep, epi);
else
error = -ENOENT;break;
case EPOLL_CTL_MOD:if (epi) {epds.events |= POLLERR | POLLHUP;error = ep_modify(ep, epi, &epds);} else
error = -ENOENT;break;
}

[fs/eventpoll.c-->sys_epoll_wait()]asmlinkage long sys_epoll_wait(int epfd, struct epoll_event __user *events,int maxevents, int timeout){int error;struct file *file;struct eventpoll *ep;DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_wait(%d, %p, %d, %d)n",
current, epfd, events, maxevents, timeout));/* The maximum number of event must be greater than zero */if (maxevents <= 0)return -EINVAL;/* Verify that the area passed by the user is writeable */if ((error = verify_area(VERIFY_WRITE, events, maxevents * sizeof(struct
epoll_event))))
goto eexit_1;/* Get the "struct file *" for the eventpoll file */error = -EBADF;file = fget(epfd);if (!file)goto eexit_1;/** We have to check that the file structure underneath the fd* the user passed to us _is_ an eventpoll file.*/
error = -EINVAL;if (!IS_FILE_EPOLL(file))goto eexit_2;/** At this point it is safe to assume that the "private_data" contains* our own data structure.*/ep = file->private_data;/* Time to fish for events ... */error = ep_poll(ep, events, maxevents, timeout);eexit_2:fput(file);
eexit_1:
DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_wait(%d, %p, %d, %d) =
%dn",current, epfd, events, maxevents, timeout, error));return error;}

[fs/eventpoll.c-->sys_epoll_wait()->ep_poll()]static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,int maxevents, long timeout){
int res, eavail;
unsigned long flags;long jtimeout;wait_queue_t wait;/** Calculate the timeout by checking for the "infinite" value ( -1 )* and the overflow condition. The passed timeout is in milliseconds,* that why (t * HZ) / 1000.*/jtimeout = timeout == -1 || timeout > (MAX_SCHEDULE_TIMEOUT - 1000) / HZ ?MAX_SCHEDULE_TIMEOUT: (timeout * HZ + 999) / 1000;retry:write_lock_irqsave(&ep->lock, flags);res = 0;if (list_empty(&ep->rdllist)) {/** We don't have any available event to return to the caller.* We need to sleep here, and we will be wake up by* ep_poll_callback() when events will become available.
*/init_waitqueue_entry(&wait, current);add_wait_queue(&ep->wq, &wait);for (;;) {/** We don't want to sleep if the ep_poll_callback() sends us* a wakeup in between. That's why we set the task state* to TASK_INTERRUPTIBLE before doing the checks.*/set_current_state(TASK_INTERRUPTIBLE);if (!list_empty(&ep->rdllist) || !jtimeout)break;if (signal_pending(current)) {res = -EINTR;break;}write_unlock_irqrestore(&ep->lock, flags);jtimeout = schedule_timeout(jtimeout);write_lock_irqsave(&ep->lock, flags);
}remove_wait_queue(&ep->wq, &wait);set_current_state(TASK_RUNNING);
}

[fs/eventpoll.c-->sys_epoll_ctl()-->ep_insert()]static int ep_insert(struct eventpoll *ep, struct epoll_event *event,struct file *tfile, int fd){int error, revents, pwake = 0;unsigned long flags;struct epitem *epi;
struct ep_pqueue epq;error = -ENOMEM;if (!(epi = EPI_MEM_ALLOC()))goto eexit_1;/* Item initialization follow here ... */
EP_RB_INITNODE(&epi->rbn);
INIT_LIST_HEAD(&epi->rdllink);INIT_LIST_HEAD(&epi->fllink);INIT_LIST_HEAD(&epi->txlink);INIT_LIST_HEAD(&epi->pwqlist);epi->ep = ep;EP_SET_FFD(&epi->ffd, tfile, fd);epi->event = *event;atomic_set(&epi->usecnt, 1);
epi->nwait = 0;/* Initialize the poll table using the queue callback */epq.epi = epi;init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);/*
* Attach the item to the poll hooks and get current event bits.* We can safely use the file* here because its usage count has* been increased by the caller of this function.*/revents = tfile->f_op->poll(tfile, &epq.pt);

[fs/eventpoll.c-->ep_ptable_queue_proc()]static void ep_ptable_queue_proc(struct file *file, wait_queue_head_t *whead,
poll_table *pt){struct epitem *epi = EP_ITEM_FROM_EPQUEUE(pt);struct eppoll_entry *pwq;if (epi->nwait >= 0 && (pwq = PWQ_MEM_ALLOC())) {init_waitqueue_func_entry(&pwq->wait, ep_poll_callback);pwq->whead = whead;pwq->base = epi;add_wait_queue(whead, &pwq->wait);
list_add_tail(&pwq->llink, &epi->pwqlist);epi->nwait++;} else {/* We have to signal that an error occurred */
epi->nwait = -1;}}

[fs/eventpoll.c-->ep_poll_callback()]static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *key){int pwake = 0;unsigned long flags;struct epitem *epi = EP_ITEM_FROM_WAIT(wait);struct eventpoll *ep = epi->ep;DNPRINTK(3, (KERN_INFO "[%p] eventpoll: poll_callback(%p) epi=%p
ep=%pn",current, epi->file, epi, ep));write_lock_irqsave(&ep->lock, flags);/** If the event mask does not contain any poll(2) event, we consider the* descriptor to be disabled. This condition is likely the effect of the* EPOLLONESHOT bit that disables the descriptor when an event is received,* until the next EPOLL_CTL_MOD will be issued.
*/if (!(epi->event.events & ~EP_PRIVATE_BITS))goto is_disabled;/* If this file is already in the ready list we exit soon */if (EP_IS_LINKED(&epi->rdllink))goto is_linked;list_add_tail(&epi->rdllink, &ep->rdllist);is_linked:/** Wake up ( if active ) both the eventpoll wait list and the ->poll()* wait list.*/if (waitqueue_active(&ep->wq))wake_up(&ep->wq);if (waitqueue_active(&ep->poll_wait))pwake++;is_disabled:write_unlock_irqrestore(&ep->lock, flags);/* We have to call this outside the lock */
if (pwake)ep_poll_safewake(&psw, &ep->poll_wait);return 1;}

[fs/eventpoll.c->ep_poll()]/** Try to transfer events to user space. In case we get 0 events and* there's still timeout left over, we go trying again in search of* more luck.*/
if (!res && eavail &&!(res = ep_events_transfer(ep, events, maxevents)) && jtimeout)goto retry;return res;}

[fs/eventpoll.c->ep_events_transfer()]static int ep_events_transfer(struct eventpoll *ep,
struct epoll_event __user *events, int maxevents){int eventcnt = 0;struct list_head txlist;INIT_LIST_HEAD(&txlist);/** We need to lock this because we could be hit by* eventpoll_release_file() and epoll_ctl(EPOLL_CTL_DEL).*/
down_read(&ep->sem);/* Collect/extract ready items */if (ep_collect_ready_items(ep, &txlist, maxevents) > 0) {
/* Build result set in userspace */
eventcnt = ep_send_events(ep, &txlist, events);/* Reinject ready items into the ready list */
ep_reinject_items(ep, &txlist);}up_read(&ep->sem);return eventcnt;
}

[fs/eventpoll.c->ep_send_events()]static int ep_send_events(struct eventpoll *ep, struct list_head *txlist,struct epoll_event __user *events){int eventcnt = 0;unsigned int revents;struct list_head *lnk;struct epitem *epi;/** We can loop without lock because this is a task private list.* The test done during the collection loop will guarantee us that* another task will not try to collect this file. Also, items* cannot vanish during the loop because we are holding "sem".*/list_for_each(lnk, txlist) {epi = list_entry(lnk, struct epitem, txlink);/** Get the ready file event set. We can safely use the file* because we are holding the "sem" in read and this will* guarantee that both the file and the item will not vanish.*/revents = epi->ffd.file->f_op->poll(epi->ffd.file, NULL);/** Set the return event set for the current file descriptor.* Note that only the task task was successfully able to link* the item to its "txlist" will write this field.*/epi->revents = revents & epi->event.events;if (epi->revents) {if (__put_user(epi->revents,&events[eventcnt].events) ||__put_user(epi->event.data,&events[eventcnt].data))return -EFAULT;if (epi->event.events & EPOLLONESHOT)epi->event.events &= EP_PRIVATE_BITS;eventcnt++;}}return eventcnt;
}

static unsigned int scull_p_poll(struct file *filp, poll_table *wait)
{
struct scull_pipe *dev = filp->private_data;
unsigned int mask = 0;
/*
* The buffer is circular; it is considered full
* if "wp" is right behind "rp" and empty if the
* two are equal.
*/
down(&dev->sem);
poll_wait(filp, &dev->inq, wait);
poll_wait(filp, &dev->outq, wait);
if (dev->rp != dev->wp)
mask |= POLLIN | POLLRDNORM; /* readable */
if (spacefree(dev))
mask |= POLLOUT | POLLWRNORM; /* writable */
up(&dev->sem);
return mask;
}

[include/linux/poll.h->poll_wait]static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address,
poll_table *p){if (p && wait_address)p->qproc(filp, wait_address, p);}

[fs/eventpoll.c->ep_reinject_items]static void ep_reinject_items(struct eventpoll *ep, struct list_head *txlist){int ricnt = 0, pwake = 0;unsigned long flags;struct epitem *epi;write_lock_irqsave(&ep->lock, flags);while (!list_empty(txlist)) {epi = list_entry(txlist->next, struct epitem, txlink);/* Unlink the current item from the transfer list */EP_LIST_DEL(&epi->txlink);/*
* If the item is no more linked to the interest set, we don't* have to push it inside the ready list because the following* ep_release_epitem() is going to drop it. Also, if the current* item is set to have an Edge Triggered behaviour, we don't have* to push it back either.*/if (EP_RB_LINKED(&epi->rbn) && !(epi->event.events & EPOLLET) &&(epi->revents & epi->event.events) && !EP_IS_LINKED(&epi->rdllink)) {list_add_tail(&epi->rdllink, &ep->rdllist);
ricnt++;}}if (ricnt) {/*
* Wake up ( if active ) both the eventpoll wait list and the ->poll()* wait list.*/if (waitqueue_active(&ep->wq))wake_up(&ep->wq);if (waitqueue_active(&ep->poll_wait))pwake++;}
write_unlock_irqrestore(&ep->lock, flags);/* We have to call this outside the lock */if (pwake)ep_poll_safewake(&psw, &ep->poll_wait);}