* 最近拖延症又犯了。。。嗯。。。废话不多说。。。直接上硬货。。。→_→ *

比较select系统调用请戳传送门——select内核源代码剖析

了解poll机制请戳传送门——poll机制内核源代码剖析

• epoll_create

这是Linux_3.0.12内核版本。。。和之前剖析的2.4.0内核版本的系统调用有一些差别。。。所以直接进SYSCALL_DEFINE1。。。

//为每一个监听的事件都分配一个epitem数据结构
struct epitem {
	/* RB tree node used to link this structure to the eventpoll RB tree */
	//每个epitem都存放在eventpoll中以rbr为根的红黑树中
	//rbn记录epitem在红黑树中的结点
	struct rb_node rbn;

	/* List header used to link this structure to the eventpoll ready list */
	//每个就绪事件所对应的epitem都链入了eventpoll中的rdllink
	//rdllink记录就绪链表头
	struct list_head rdllink;

	/*
	 * Works together "struct eventpoll"->ovflist in keeping the
	 * single linked chain of items.
	 */
	//记录每个epitem在eventpoll数据结构中的ovflist的下一个epitem
	struct epitem *next;

	/* The file descriptor information this item refers to */
	//epoll_filefd数据结构记录epitem所对应的struct file和fd文件描述符
	struct epoll_filefd ffd;

	/* Number of active wait queue attached to poll operations */
	//poll操作上的等待队列个数
	int nwait;

	/* List containing poll wait queues */
	//包含等待队列对头的单链表
	struct list_head pwqlist;

	/* The "container" of this item */
	//记录epitem所属哪一个eventpoll数据结构
	struct eventpoll *ep;

	/* List header used to link this item to the "struct file" items list */
	//记录epitem所对应的struct file的单链表
	struct list_head fllink;

	/* The structure that describe the interested events and the source fd */
	//记录epitem对应的epoll_event数据结构，epoll_event是epoll_ctl函数传入的参数 
	struct epoll_event event;
};

struct eventpoll {
	/* Protect the access to this structure */
	spinlock_t lock;

	/*
	 * This mutex is used to ensure that files are not removed
	 * while epoll is using them. This is held during the event
	 * collection loop, the file cleanup path, the epoll file exit
	 * code and the ctl operations.
	 */
	//对事件进行处理时，内核都都会持有这个互斥锁，因此在内核态中epoll的相关操作可以保证是线程安全的
	struct mutex mtx;
	
	/* Wait queue used by sys_epoll_wait() */
	//调用sys_epoll_wait()时，存放当前进程的等待队列
	wait_queue_head_t wq;

	/* Wait queue used by file->poll() */
	//此等待队列存放监听事件的poll操作
	wait_queue_head_t poll_wait;

	/* List of ready file descriptors */
	//为每个事件都会分配一个epitem，当事件就绪时其所对应的epitem就会链入rdllist双向链表中
	//epitem数据类型定义在上面
	struct list_head rdllist;

	/* RB tree root used to store monitored fd structs */
	//为每个事件都会分配一个epitem，所有的epitem都会存放在这个红黑树中
	struct rb_root rbr;

	/*
	 * This is a single linked list that chains all the "struct epitem" that
	 * happened while transferring ready events to userspace w/out
	 * holding ->lock.
	 */
	//就绪事件在转移到用户空间时，发生了就绪事件，其所对应的epitem被链入ovflist双向链表中
	struct epitem *ovflist;

	/* The user that created the eventpoll descriptor */
	//保存用户信息，比如资源的上限值
	struct user_struct *user;
};

SYSCALL_DEFINE1(epoll_create1, int, flags)
{
	int error;
	//eventpoll是epoll中非常重要的数据结构！每一个epollfd都有一个对应的eventpoll数据结构
	//eventpoll数据结构定义在上面
	struct eventpoll *ep = NULL;

	/* Check the EPOLL_* constant for consistency.  */
	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);

	if (flags & ~EPOLL_CLOEXEC)
		return -EINVAL;
	/*
	 * Create the internal data structure ("struct eventpoll").
	 */
	//初始化一个eventpoll数据结构
	//ep_alloc定义在下面
	error = ep_alloc(&ep);
	if (error < 0)
		return error;
	/*
	 * Creates all the items needed to setup an eventpoll file. That is,
	 * a file structure and a free file descriptor.
	 */
	//创建epollfd
	//因为epollfd并不存在真正对应的文件，所以内核创建了一个虚拟的文件，并为这个虚拟文件分配struct file数据结构
	//参数eventpoll_fops就是file operations，即文件支持的操作
	//关于file operations在之前的poll机制内核源代码剖析一文中已经做了非常深入的解释
	//这里简单解释一下，file operations中的每一个成员都是回调函数指针，对应每一种操作的具体实现
	//epollfd文件实现了三种操作，即release、poll、llseek
	//eventpoll_fops数据结构定义在下面
	//参数ep就是epollfd所对应的eventpoll数据结构，在anon_inode_getfd中，将struct file的private_data成员赋值为ep的地址
	//anon_inode_getfd定义在下面
	error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
				 O_RDWR | (flags & O_CLOEXEC));
	if (error < 0)
		ep_free(ep);
	//返回epollfd的值
	return error;
}

SYSCALL_DEFINE1(epoll_create, int, size)
{
	//实际上传入的size参数并没有什么用。。。
	if (size <= 0)
		return -EINVAL;
	//sys_epoll_create1定义在上面
	return sys_epoll_create1(0);
}

static int ep_alloc(struct eventpoll **pep)
{
	int error;
	struct user_struct *user;
	struct eventpoll *ep;
	
	//获取当前用户信息
	user = get_current_user();
	error = -ENOMEM;
	//通过kmalloc为eventpoll数据结构分配内存空间
	ep = kzalloc(sizeof(*ep), GFP_KERNEL);
	if (unlikely(!ep))
		goto free_uid;
	
	spin_lock_init(&ep->lock);
	mutex_init(&ep->mtx);
	//初始化eventpoll中的wq
	init_waitqueue_head(&ep->wq);
	//初始化eventpoll中的poll_wait
	init_waitqueue_head(&ep->poll_wait);
	//初始化存放就绪事件所对应的epitem的双向链表
	INIT_LIST_HEAD(&ep->rdllist);
	//初始化存放所有事件对应的epiitem的红黑树，初始值为NULL
	//#define RB_ROOT	(struct rb_root) { NULL, }
	ep->rbr = RB_ROOT;
	//初始化转移到用户空间之前，存放就绪事件所对应的epitem的双向链表，初始值为-1L
	//#define EP_UNACTIVE_PTR ((void *) -1L)
	ep->ovflist = EP_UNACTIVE_PTR;
	//初始化用户信息
	ep->user = user;
	//为eventpoll数据结构指针赋值
	*pep = ep;

	return 0;

free_uid:
	free_uid(user);
	return error;
}

//由此可见epollfd所对应的的匿名文件只实现了三种操作
//release操作为释放epollfd所对应的eventpoll数据结构
//ep_eventpoll_release定义在下面
//poll操作为事件就绪时，调用poll操作对应的回调函数对当前进程进行一些列操作
//ep_eventpoll_poll定义先放一边，在epoll_wait中会详细解释
//llseek操作为获取匿名文件的游标偏移
//noop_llseek定义在下面
static const struct file_operations eventpoll_fops = {
	.release	= ep_eventpoll_release, 
	.poll		= ep_eventpoll_poll,
	.llseek		= noop_llseek,
};

static int ep_eventpoll_release(struct inode *inode, struct file *file)
{
	//通过struct file中的成员private_data得到epollfd所对应的eventpoll数据结构
	struct eventpoll *ep = file->private_data;
	//释放eventpoll数据结构
	if (ep)
		ep_free(ep);

	return 0;
}

loff_t noop_llseek(struct file *file, loff_t offset, int origin)
{
	//返回当前文件的偏移量
	return file->f_pos;
}

int anon_inode_getfd(const char *name, const struct file_operations *fops,
		     void *priv, int flags)
{
	int error, fd;
	struct file *file;
	//分配文件描述符，即epollfd
	error = get_unused_fd_flags(flags);
	if (error < 0)
		return error;
	fd = error;
	//创建匿名文件
	file = anon_inode_getfile(name, fops, priv, flags);
	if (IS_ERR(file)) {
		error = PTR_ERR(file);
		goto err_put_unused_fd;
	}
	//将文件描述符fd和匿名文件绑定，即将file_struct中的fdtable的成员fd[fd]赋值为file
	fd_install(fd, file);
	//返回epollfd的值
	return fd;

err_put_unused_fd:
	put_unused_fd(fd);
	return error;
}

• epoll_ctl

struct epoll_event {
	__u32 events; //epoll事件类型
	__u64 data; //指定所要监听的事件的文件描述符
} EPOLL_PACKED;

//参数epfd就是epoll_create中返回的epollfd
//参数op指定对事件的操作类型，具体分为三种
//#define EPOLL_CTL_ADD 1 添加新的监听事件
//#define EPOLL_CTL_DEL 2 删除监听事件
//#define EPOLL_CTL_MOD 3 修改监听事件
//参数fd就是想要操作的文件描述符
//参数event表示监听的是什么事件类型
//数据可读事件EPOLLIN、高效工作事件模式EPOLLET、事件只被处理一次EPOLLONESHOT
//epoll_event数据结构定义在上面
SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
		struct epoll_event __user *, event)
{
	int error; 
	int did_lock_epmutex = 0;
	struct file *file, *tfile;
	struct eventpoll *ep;
	struct epitem *epi;
	struct epoll_event epds;

	error = -EFAULT;
	//ep_op_has_event中为return op != EPOLL_CTL_DEL;即判断op操作是否为删除监听事件
	//从用户拷贝epoll_event数据结构到内核空间
	if (ep_op_has_event(op) &&
	    copy_from_user(&epds, event, sizeof(struct epoll_event)))
		goto error_return;

	/* Get the "struct file *" for the eventpoll file */
	error = -EBADF;
	//获取epollfd所对应的匿名文件struct file数据结构
	file = fget(epfd);
	if (!file)
		goto error_return;

	/* Get the "struct file *" for the target file */
	//获取所要操作的文件描述符所对应的struct file数据结构
	tfile = fget(fd);
	if (!tfile)
		goto error_fput;

	/* The target file descriptor must support poll */
	error = -EPERM;
	//判断所要监听的事件是否支持文件操作或poll操作
	if (!tfile->f_op || !tfile->f_op->poll)
		goto error_tgt_fput;

	/*
	 * We have to check that the file structure underneath the file descriptor
	 * the user passed to us _is_ an eventpoll file. And also we do not permit
	 * adding an epoll file descriptor inside itself.
	 */
	error = -EINVAL;
	//判断所要监听的事件是否是epollfd本身、判断所要监听的事件是否支持epoll对文件的三种操作
	if (file == tfile || !is_file_epoll(file))
		goto error_tgt_fput;

	/*
	 * At this point it is safe to assume that the "private_data" contains
	 * our own data structure.
	 */
	//从struct file数据结构中获取eventpoll数据结构
	ep = file->private_data;

	/*
	 * When we insert an epoll file descriptor, inside another epoll file
	 * descriptor, there is the change of creating closed loops, which are
	 * better be handled here, than in more critical paths.
	 *
	 * We hold epmutex across the loop check and the insert in this case, in
	 * order to prevent two separate inserts from racing and each doing the
	 * insert "at the same time" such that ep_loop_check passes on both
	 * before either one does the insert, thereby creating a cycle.
	 */
	//检查监听的事件是否支持epoll对文件的三种操作且为添加事件
	//当我们插入一个epoll文件描述符时，在另一个epoll文件描述符中，创建闭环，这在这里更好地处理，而不是更关键的路径。
	//在这种情况下，我们保留epmutex的循环检查和插入，以防止两个单独的插入，并且每个插入“同时进行”，使得ep_loop_check在两个插入之前都通过，从而创建一个周期。
	if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
		mutex_lock(&epmutex);
		did_lock_epmutex = 1;
		error = -ELOOP;
		if (ep_loop_check(ep, tfile) != 0)
			goto error_tgt_fput;
	}

	mutex_lock_nested(&ep->mtx, 0);

	/*
	 * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
	 * above, we can be sure to be able to use the item looked up by
	 * ep_find() till we release the mutex.
	 */
	//epoll不允许重复添加fd
	//在eventpoll数据结构中的rbr红黑树里，根据监听事件的struct和fd，与每一个epitem中的epoll_filefd数据结构进行比较
	//找到返回监听事件对应的epitem，没有找到返回NULL
	epi = ep_find(ep, tfile, fd);

	error = -EINVAL;
	//根据对事件的操作进行分类操作
	switch (op) {
	//添加新的监听事件
	case EPOLL_CTL_ADD:
		//如果之前不存在此事件才可以添加
		if (!epi) {
			//添加内核关心的事件类型POLLERR和POLLHUP
			epds.events |= POLLERR | POLLHUP;
			//真正的添加新的监听事件
			//ep_insert定义在下面
			error = ep_insert(ep, &epds, tfile, fd);
		} else
			error = -EEXIST;
		break;
	//删除事件
	case EPOLL_CTL_DEL:
		//如果存在此事件才可以删除
		if (epi)
			//ep_remove就不剖了。。
			error = ep_remove(ep, epi);
		else
			error = -ENOENT;
		break;
	//修改事件
	case EPOLL_CTL_MOD:
		if (epi) {
			epds.events |= POLLERR | POLLHUP;
			//ep_modify就不剖了。。。
			error = ep_modify(ep, epi, &epds);
		} else
			error = -ENOENT;
		break;
	}
	mutex_unlock(&ep->mtx);

error_tgt_fput:
	if (unlikely(did_lock_epmutex))
		mutex_unlock(&epmutex);

	fput(tfile);
error_fput:
	fput(file);
error_return:

	return error;
}

typedef struct poll_table_struct {
	//poll_queue_proc就是当监听事件就绪时，对事件进行具体操作的回调函数
	poll_queue_proc qproc;
	//key记录对监听事件的何种event感兴趣
	unsigned long key;
} poll_table;

struct ep_pqueue {
	//poll_table数据结构和poll回调函数机制有关
	//poll_table数据结构定义在上面
	poll_table pt; 
	//记录对应的epitem数据结构
	struct epitem *epi;
};

static inline void init_poll_funcptr(poll_table *pt, poll_queue_proc qproc)
{
	//初始化poll机制的回调函数
	pt->qproc = qproc;
	//初始化感兴趣的事件类型，初值为对所有event都感兴趣
	pt->key   = ~0UL; /* all events enabled */
}

//ep参数为epollfd所对应的eventpoll数据结构
//event参数为新监听事件的epoll事件类型，即epoll_event数据结构
//tfile参数为新监听事件所对应的struct file数据结构
//fd参数为新监听事件的文件描述符
static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
		     struct file *tfile, int fd)
{
	int error, revents, pwake = 0;
	unsigned long flags;
	long user_watches;
	struct epitem *epi;
	struct ep_pqueue epq;
	
	//将当前用户的监听事件数加1
	user_watches = atomic_long_read(&ep->user->epoll_watches);
	//判断是否超过当前用户的最大监听数
	if (unlikely(user_watches >= max_user_watches))
		return -ENOSPC;
	//从slab中分配一个epitem数据结构
	if (!(epi = kmem_cache_alloc(epi_cache, GFP_KERNEL)))
		return -ENOMEM;

	/* Item initialization follow here ... */
	//初始化各个链表
	INIT_LIST_HEAD(&epi->rdllink);
	INIT_LIST_HEAD(&epi->fllink);
	INIT_LIST_HEAD(&epi->pwqlist);
	//记录epitem所对应的eventpoll数据结构
	epi->ep = ep;
	//在epitem中的epoll_filefd数据结构中记录新监听事件所对应的struct file数据结构和文件描述符fd
	ep_set_ffd(&epi->ffd, tfile, fd);
	//记录新监听事件，想要监听的事件类型
	epi->event = *event;
	//poll操作上的等待队列个数初始化为0
	epi->nwait = 0;
	//初始化epitem在eventpoll中的ovflist链表的后继为(void *) -1L
	epi->next = EP_UNACTIVE_PTR;

	/* Initialize the poll table using the queue callback */
	//记录ep_pqueue中的epitem数据结构
	//epq数据类型为ep_pqueue，ep_pqueue数据结构定义在上面
	epq.epi = epi;
	//初始化poll_table数据结构
	//init_poll_funcptr定义在上面
	init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);

	/*
	 * Attach the item to the poll hooks and get current event bits.
	 * We can safely use the file* here because its usage count has
	 * been increased by the caller of this function. Note that after
	 * this operation completes, the poll callback can start hitting
	 * the new item.
	 */
	//对监听事件所对应的struct file中的file operation中的poll操作进行初始化，即对poll回调函数进行初始化，详细的poll机制回调函数在之前已经做了详细说明
	//返回值为已经就绪的事件
	revents = tfile->f_op->poll(tfile, &epq.pt);

	/*
	 * We have to check if something went wrong during the poll wait queue
	 * install process. Namely an allocation for a wait queue failed due
	 * high memory pressure.
	 */
	error = -ENOMEM;
	//如果内存不够，有可能导致等待队列分配失败，所以此时需要判断等待队列是否存在
	if (epi->nwait < 0)
		goto error_unregister;

	/* Add the current item to the list of active epoll hook for this file */
	spin_lock(&tfile->f_lock);
	//将epitem链入监听事件所对应的strcut file中的f_ep_links成员上
	list_add_tail(&epi->fllink, &tfile->f_ep_links);
	spin_unlock(&tfile->f_lock);

	/*
	 * Add the current item to the RB tree. All RB tree operations are
	 * protected by "mtx", and ep_insert() is called with "mtx" held.
	 */
	//将epitem插入到epollfd所对应的eventpolld中的rbr红黑树中
	ep_rbtree_insert(ep, epi);

	/* We have to drop the new item inside our item list to keep track of it */
	spin_lock_irqsave(&ep->lock, flags);

	/* If the file is already "ready" we drop it inside the ready list */
	//此时判断一下是不是新的监听事件已经就绪且就绪链表为空
	if ((revents & event->events) && !ep_is_linked(&epi->rdllink)) {
		//将epitem链入就绪链表中
		list_add_tail(&epi->rdllink, &ep->rdllist);

		/* Notify waiting tasks that events are available */
		//判断eventpoll中的wq等待队列是否为NULL，如果不为空，就唤醒等待队列上对应的进程
		if (waitqueue_active(&ep->wq))
			wake_up_locked(&ep->wq);
		//判断poll_wait等待队列是否为NULL，如果不为NULL，pwake加1
		if (waitqueue_active(&ep->poll_wait))
			pwake++;
	}

	spin_unlock_irqrestore(&ep->lock, flags);

	atomic_long_inc(&ep->user->epoll_watches);

	/* We have to call this outside the lock */
	if (pwake)
		ep_poll_safewake(&ep->poll_wait);

	return 0;

error_unregister:
	ep_unregister_pollwait(ep, epi);

	/*
	 * We need to do this because an event could have been arrived on some
	 * allocated wait queue. Note that we don't care about the ep->ovflist
	 * list, since that is used/cleaned only inside a section bound by "mtx".
	 * And ep_insert() is called with "mtx" held.
	 */
	spin_lock_irqsave(&ep->lock, flags);
	if (ep_is_linked(&epi->rdllink))
		list_del_init(&epi->rdllink);
	spin_unlock_irqrestore(&ep->lock, flags);

	kmem_cache_free(epi_cache, epi);

	return error;
}

• epoll_wait

//参数epfd就是epollfd
//参数events指向一个数组，用来存放最后返回的就绪事件
//参数maxevents表示最多监听多少个事件
//参数timeout表示阻塞时间
SYSCALL_DEFINE4(epoll_wait, int, epfd, struct epoll_event __user *, events,
		int, maxevents, int, timeout)
{
	int error;
	struct file *file;
	struct eventpoll *ep;

	/* The maximum number of event must be greater than zero */
	//判断maxevents是否合法
	if (maxevents <= 0 || maxevents > EP_MAX_EVENTS)
		return -EINVAL;

	/* Verify that the area passed by the user is writeable */
	//判断用户传入的events指向的空间是否合法有效
	if (!access_ok(VERIFY_WRITE, events, maxevents * sizeof(struct epoll_event))) {
		error = -EFAULT;
		goto error_return;
	}

	/* Get the "struct file *" for the eventpoll file */
	error = -EBADF;
	//通过epollfd获得其所对应的struct file数据结构
	file = fget(epfd);
	if (!file)
		goto error_return;

	/*
	 * We have to check that the file structure underneath the fd
	 * the user passed to us _is_ an eventpoll file.
	 */
	error = -EINVAL;
	//判断file文件是否支持epoll对文件的操作
	if (!is_file_epoll(file))
		goto error_fput;

	/*
	 * At this point it is safe to assume that the "private_data" contains
	 * our own data structure.
	 */
	//struct file中的private_data成员存储着epollfd对应的eventpoll数据结构
	ep = file->private_data;

	/* Time to fish for events ... */
	//ep_poll的定义在下面
	error = ep_poll(ep, events, maxevents, timeout);

error_fput:
	fput(file);
error_return:

	return error;
}

//参数ep为epollfd所对应的eventpoll数据结构
//其余参数与epoll_wait参数含义相同
static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
		   int maxevents, long timeout)
{
	int res = 0, eavail, timed_out = 0;
	unsigned long flags;
	long slack = 0;
	//存放当前进程的等待队列
	wait_queue_t wait;
	ktime_t expires, *to = NULL;
	
	//如果阻塞时间大于0，就将timeout转化为计算机内部的时间
	if (timeout > 0) {
		struct timespec end_time = ep_set_mstimeout(timeout);

		slack = select_estimate_accuracy(&end_time);
		to = &expires;
		*to = timespec_to_ktime(end_time);
	}
	//如果阻塞时间等于0，即非阻塞模式就直接调转到check_events执行
	else if (timeout == 0) {
		/*
		 * Avoid the unnecessary trip to the wait queue loop, if the
		 * caller specified a non blocking operation.
		 */
		timed_out = 1;
		spin_lock_irqsave(&ep->lock, flags);
		goto check_events;
	}

fetch_events:
	spin_lock_irqsave(&ep->lock, flags);
	//如果eventpoll中的rdllist为空或者ovflist为初始化值EP_UNACTIVE_PTR时，满足条件
	if (!ep_events_available(ep)) {
		/*
		 * We don't have any available event to return to the caller.
		 * We need to sleep here, and we will be wake up by
		 * ep_poll_callback() when events will become available.
		 */
		//初始化等待队列wait，参数current是一个宏，代表当前进程
		//init_waitqueue_entry定义在下面
		init_waitqueue_entry(&wait, current);
		//将等待队列wait添加到eventpoll中的wq等待队列中
		__add_wait_queue_exclusive(&ep->wq, &wait);

		for (;;) {
			/*
			 * We don't want to sleep if the ep_poll_callback() sends us
			 * a wakeup in between. That's why we set the task state
			 * to TASK_INTERRUPTIBLE before doing the checks.
			 */
			//将当前进程调度后的状态设置为浅睡眠，即可中断睡眠状态
			set_current_state(TASK_INTERRUPTIBLE);
			//如果此时eventpoll中的rdllist就绪链表不为NULL或ovflist不为EP_UNACTIVE_PTR或timed_out为0，那么就不再调度了，直接break跳出循环
			if (ep_events_available(ep) || timed_out)
				break;
			//如果此时收到了信号，那么也不再调度了，直接break跳出循环
			if (signal_pending(current)) {
				res = -EINTR;
				break;
			}

			spin_unlock_irqrestore(&ep->lock, flags);
			//当前进程被调度，进入前睡眠状态
			//在此期间，若发生事件就绪或收到信号，就执行poll回调机制
			if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS))
				timed_out = 1;

			spin_lock_irqsave(&ep->lock, flags);
		}
		//此时已从for循环中跳出
		//从eventpoll中的wq等待队列里删除wait等待队列
		__remove_wait_queue(&ep->wq, &wait);
		//设置当前进程下一次调度的状态为运行中状态
		set_current_state(TASK_RUNNING);
	}
check_events:
	/* Is it worth to try to dig for events ? */
	//判断此时eventpoll中的rdllist是否为空或者ovflist为初始化值是否为EP_UNACTIVE_PTR
	eavail = ep_events_available(ep);

	spin_unlock_irqrestore(&ep->lock, flags);

	/*
	 * Try to transfer events to user space. In case we get 0 events and
	 * there's still timeout left over, we go trying again in search of
	 * more luck.
	 */
	//此时尝试将就绪事件传输到用户空间
	//如果我们得到0个就绪事件，还有超时时间，就跳转至fetch_events
	//ep_send_events定义在下面
	if (!res && eavail &&
	    !(res = ep_send_events(ep, events, maxevents)) && !timed_out)
		goto fetch_events;

	return res;
}

static inline void init_waitqueue_entry(wait_queue_t *q, struct task_struct *p)
{
	q->flags = 0; //将等待队列状态初始化为0
	q->private = p; //将等待队列的成员private指针初始化为p，即当前进程
	q->func = default_wake_function; //将等待队列的成员func初始化为default_wake_function，即唤醒进程时的函数
}

//参数含义与ep_poll函数参数相同，不再赘述
static int ep_send_events(struct eventpoll *ep,
			  struct epoll_event __user *events, int maxevents)
{
	//初始化ep_send_events_data数据结构，这个数据结构就只包含maxevents和events
	struct ep_send_events_data esed;

	esed.maxevents = maxevents;
	esed.events = events;
	//ep_scan_ready_list定义在下面
	return ep_scan_ready_list(ep, ep_send_events_proc, &esed, 0);
}

//参数ep为epollfd所对应的eventpoll
//参数sproc为函数指针，调用时赋值为ep_send_events_proc
//参数priv指向ep_send_events_data数据结构
//参数depth初始化为0
static int ep_scan_ready_list(struct eventpoll *ep,
			      int (*sproc)(struct eventpoll *,
					   struct list_head *, void *),
			      void *priv,
			      int depth)
{
	int error, pwake = 0;
	unsigned long flags;
	struct epitem *epi, *nepi;
	LIST_HEAD(txlist);

	/*
	 * We need to lock this because we could be hit by
	 * eventpoll_release_file() and epoll_ctl().
	 */
	mutex_lock_nested(&ep->mtx, depth);

	/*
	 * Steal the ready list, and re-init the original one to the
	 * empty list. Also, set ep->ovflist to NULL so that events
	 * happening while looping w/out locks, are not lost. We cannot
	 * have the poll callback to queue directly on ep->rdllist,
	 * because we want the "sproc" callback to be able to do it
	 * in a lockless way.
	 */
	spin_lock_irqsave(&ep->lock, flags);
	//此时所有发生就绪事件的epitem都已经链入了eventpoll中的rdllist就绪链表了
	//此时将rdllist就绪链表上的所有元素都转移到txlist中，而rdllist被清空
	list_splice_init(&ep->rdllist, &txlist);
	//将ovlist置NULL，是因为此时不希望再有新的就绪事件对应的epitem加入到rdllist中
	ep->ovflist = NULL;
	spin_unlock_irqrestore(&ep->lock, flags);

	/*
	 * Now call the callback function.
	 */
	//此时调用参数传入的回调函数，即ep_send_events_proc
	//ep_send_events_proc定义在下面
	error = (*sproc)(ep, &txlist, priv);

	spin_lock_irqsave(&ep->lock, flags);
	/*
	 * During the time we spent inside the "sproc" callback, some
	 * other events might have been queued by the poll callback.
	 * We re-insert them inside the main ready-list here.
	 */
	//当调用ep_send_events_proc函数时，即向用户空间传递数据时
	//发生了就绪事件，这些就绪事件对应的epitem都链入了eventpoll中的ovflist
	//现在遍历ovflist链表，依次处理这些epitem
	for (nepi = ep->ovflist; (epi = nepi) != NULL;
	     nepi = epi->next, epi->next = EP_UNACTIVE_PTR) {
		/*
		 * We need to check if the item is already in the list.
		 * During the "sproc" callback execution time, items are
		 * queued into ->ovflist but the "txlist" might already
		 * contain them, and the list_splice() below takes care of them.
		 */
		//如果epitem存在，就将epitem尾插进rddlist中
		if (!ep_is_linked(&epi->rdllink))
			list_add_tail(&epi->rdllink, &ep->rdllist);
	}
	/*
	 * We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after
	 * releasing the lock, events will be queued in the normal way inside
	 * ep->rdllist.
	 */
	//将ovflist置为EP_UNACTIVE_PTR，即((void *) -1L)
	ep->ovflist = EP_UNACTIVE_PTR;

	/*
	 * Quickly re-inject items left on "txlist".
	 */
	//经过ep_send_events_proc对epitem的处理后，有的epitem还未被处理完，将这些epitem重新链入rdllist中
	list_splice(&txlist, &ep->rdllist);
	
	//如果rdllist就绪链表不为NULL时
	if (!list_empty(&ep->rdllist)) {
		/*
		 * Wake up (if active) both the eventpoll wait list and
		 * the ->poll() wait list (delayed after we release the lock).
		 */
		//当wq等待队列wq不为NULL时
		if (waitqueue_active(&ep->wq))
			//唤醒等待队列wq上的成员，及当前进程
			wake_up_locked(&ep->wq);
		if (waitqueue_active(&ep->poll_wait))
			pwake++;
	}
	spin_unlock_irqrestore(&ep->lock, flags);

	mutex_unlock(&ep->mtx);

	/* We have to call this outside the lock */
	if (pwake)
		ep_poll_safewake(&ep->poll_wait);

	return error;
}

//参数ep为epollfd所对应的eventpoll
//参数head为txlist
//参数priv为ep_send_events_data数据结构
static int ep_send_events_proc(struct eventpoll *ep, struct list_head *head,
			       void *priv)
{
	struct ep_send_events_data *esed = priv;
	int eventcnt;
	unsigned int revents;
	struct epitem *epi;
	struct epoll_event __user *uevent;

	/*
	 * We can loop without lock because we are passed a task private list.
	 * Items cannot vanish during the loop because ep_scan_ready_list() is
	 * holding "mtx" during this call.
	 */
	//遍历整个txlist链表
	for (eventcnt = 0, uevent = esed->events;
	     !list_empty(head) && eventcnt < esed->maxevents;) {
	    //获取txlist链表中的第一个节点
		epi = list_first_entry(head, struct epitem, rdllink);
		//从txlink链表中将epitem删除
		list_del_init(&epi->rdllink);
		//获取此时，最新的epitem的就绪事件类型
		revents = epi->ffd.file->f_op->poll(epi->ffd.file, NULL) &
			epi->event.events;

		/*
		 * If the event mask intersect the caller-requested one,
		 * deliver the event to userspace. Again, ep_scan_ready_list()
		 * is holding "mtx", so no operations coming from userspace
		 * can change the item.
		 */
		//再一次判断是否有就绪事件发生
		if (revents) {
			//将当前的就绪事件拷贝到用户空间中
			//如果此时epitem还没有处理完，就将epitem再链入txlist链表中
			if (__put_user(revents, &uevent->events) ||
			    __put_user(epi->event.data, &uevent->data)) {
				list_add(&epi->rdllink, head);
				return eventcnt ? eventcnt : -EFAULT;
			}
			eventcnt++;
			uevent++;
			if (epi->event.events & EPOLLONESHOT)
				epi->event.events &= EP_PRIVATE_BITS;
			//判断fd是否为ET模式，如果不是ET模式，就要将自己再一次链入rdllist就绪链表中，这是LT和ET模式本质区别
			//以便下次调用epoll_wait（）会再次检查事件的可用性
			else if (!(epi->event.events & EPOLLET)) {
				/*
				 * If this file has been added with Level
				 * Trigger mode, we need to insert back inside
				 * the ready list, so that the next call to
				 * epoll_wait() will check again the events
				 * availability. At this point, no one can insert
				 * into ep->rdllist besides us. The epoll_ctl()
				 * callers are locked out by
				 * ep_scan_ready_list() holding "mtx" and the
				 * poll callback will queue them in ep->ovflist.
				 */
				list_add_tail(&epi->rdllink, &ep->rdllist);
			}
		}
	}

	return eventcnt;
}