writing-char-drivers

Writing Character Drivers

Purpose

Guide agents through Linux character device implementation: struct file_operations, cdev registration, safe userspace copies, ioctl design, and basic mmap — focused depth beyond skills/kernel/device-drivers.

When to Use

• Exposing hardware to /dev/mydev
• Implementing read/write/poll from kernel
• Defining ioctl commands with type-safe macros
• Mapping device MMIO to userspace (carefully)

Workflow

1. Char device registration

#include <linux/fs.h>
#include <linux/cdev.h>
#include <linux/uaccess.h>

#define MY_MAJOR 0   /* 0 = dynamic alloc */
#define MY_MINOR 0

static dev_t devno;
static struct cdev my_cdev;
static struct class *class;

static const struct file_operations my_fops = {
    .owner          = THIS_MODULE,
    .open           = my_open,
    .release        = my_release,
    .read           = my_read,
    .write          = my_write,
    .unlocked_ioctl = my_ioctl,
    .llseek         = no_llseek,
};

static int __init my_init(void)
{
    int ret = alloc_chrdev_region(&devno, MY_MINOR, 1, "mydev");
    if (ret)
        return ret;

    cdev_init(&my_cdev, &my_fops);
    ret = cdev_add(&my_cdev, devno, 1);
    if (ret)
        goto err_cdev;

    class = class_create("mydev");
    device_create(class, NULL, devno, NULL, "mydev");
    return 0;

err_cdev:
    unregister_chrdev_region(devno, 1);
    return ret;
}

Modern drivers often use devm_* variants inside probe.

2. Safe userspace I/O

static ssize_t my_read(struct file *filp, char __user *buf,
                       size_t count, loff_t *ppos)
{
    char kbuf[128];
    ssize_t len;

    if (*ppos >= sizeof(kbuf))
        return 0;
    len = min(count, sizeof(kbuf) - *ppos);
    memcpy(kbuf, "data", 4);
    if (copy_to_user(buf, kbuf + *ppos, len))
        return -EFAULT;
    *ppos += len;
    return len;
}

Never dereference __user pointers directly.

3. ioctl pattern

#include <linux/ioctl.h>

#define MY_IOC_MAGIC 'k'
#define MY_IOC_RESET  _IO(MY_IOC_MAGIC, 0)
#define MY_IOC_SET    _IOW(MY_IOC_MAGIC, 1, int)

static long my_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
    switch (cmd) {
    case MY_IOC_RESET:
        return 0;
    case MY_IOC_SET: {
        int val;
        if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
            return -EFAULT;
        return 0;
    }
    default:
        return -ENOTTY;
    }
}

Use _IOWR with fixed-size structs; prefer compat_ioctl on bi-arch.

4. mmap (device memory)

static int my_mmap(struct file *filp, struct vm_area_struct *vma)
{
    unsigned long size = vma->vm_end - vma->vm_start;
    phys_addr_t phys = device_phys_base;

    vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
    return remap_pfn_range(vma, vma->vm_start, phys >> PAGE_SHIFT,
                           size, vma->vm_page_prot);
}

Prefer mmap of DMA buffers only with explicit size limits and permission checks.

5. poll / async I/O

Implement poll + wake_up_interruptible for blocking reads; use fasync_helper for SIGIO.

6. Agent usage

/writing-char-drivers Add unlocked_ioctl SET_SPEED to existing platform driver

Common Problems

Symptom	Cause	Fix
-EFAULT	Bad user pointer	Validate access_ok (older) / rely on copy_*
ENOTTY	Wrong ioctl magic	Match userspace ioctl.h
Major conflict	Static major taken	Use alloc_chrdev_region
mmap SIGSEGV	Cached mapping to device	pgprot_noncached
Sleep in ioctl	Holding spinlock	Drop lock before blocking

Related Skills

• skills/kernel-dev/platform-device-model — probe context
• skills/kernel/device-drivers — full driver lifecycle
• skills/kernel/kernel-concurrency — locking in file ops
• skills/kernel-dev/kernel-debugging-advanced — trace ioctl path
• skills/low-level-programming/linux-kernel-modules — module boilerplate