linux usb gadget驱动详解（五）

        现从fsg_bind()讲起。

//不失一般性，删掉错误处理和configfs相关代码
static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
{
	struct fsg_dev		*fsg = fsg_from_func(f);
	struct fsg_common	*common = fsg->common;
	struct usb_gadget	*gadget = c->cdev->gadget;
	int			i;
	struct usb_ep		*ep;
	unsigned		max_burst;
	int			ret;
	struct fsg_opts		*opts;

	/* Don't allow to bind if we don't have at least one LUN */
	ret = _fsg_common_get_max_lun(common);

	opts = fsg_opts_from_func_inst(f->fi);

	if (!common->thread_task) {
		common->state = FSG_STATE_IDLE;
		common->thread_task =
			kthread_create(fsg_main_thread, common, "file-storage");
		if (IS_ERR(common->thread_task)) {
			...
		}
		wake_up_process(common->thread_task);
	}

	fsg->gadget = gadget;

	/* New interface */
	i = usb_interface_id(c, f);

	fsg_intf_desc.bInterfaceNumber = i;
	fsg->interface_number = i;

	/* Find all the endpoints we will use */
	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
	fsg->bulk_in = ep;

	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
	fsg->bulk_out = ep;

	/* Assume endpoint addresses are the same for both speeds */
	fsg_hs_bulk_in_desc.bEndpointAddress =
		fsg_fs_bulk_in_desc.bEndpointAddress;
	fsg_hs_bulk_out_desc.bEndpointAddress =
		fsg_fs_bulk_out_desc.bEndpointAddress;

	/* Calculate bMaxBurst, we know packet size is 1024 */
	max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15);

	fsg_ss_bulk_in_desc.bEndpointAddress =
		fsg_fs_bulk_in_desc.bEndpointAddress;
	fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;

	fsg_ss_bulk_out_desc.bEndpointAddress =
		fsg_fs_bulk_out_desc.bEndpointAddress;
	fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;

	ret = usb_assign_descriptors(f, fsg_fs_function, fsg_hs_function,
			fsg_ss_function);
...
	return 0;
}

可以看到该函数主要是通过kthread_create+wake_up_process的组合创建了一个内核线程fsg_main_thread，名称是"file-storage"，通过shell的ps可以看到。另外就是利用usb_interface_id()分配一个接口号，填充进接口描述符，以便在设备枚举时返回给usb host，最后利用composite.c框架所创建的gadget对象对U盘的IN/OUT端点初始化：

//storage_common.c

/*
 * Three 
full-speed endpoint descriptors: bulk-in, bulk-out, and
 * interrupt-in.
 */
struct usb_endpoint_descriptor fsg_fs_bulk_in_desc = {
	.bLength =		USB_DT_ENDPOINT_SIZE,
	.bDescriptorType =	USB_DT_ENDPOINT,

	.bEndpointAddress =	USB_DIR_IN,
	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
	/* wMaxPacketSize set by autoconfiguration */
};
struct usb_endpoint_descriptor fsg_fs_bulk_out_desc = {
	.bLength =		USB_DT_ENDPOINT_SIZE,
	.bDescriptorType =	USB_DT_ENDPOINT,

	.bEndpointAddress =	USB_DIR_OUT,
	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
	/* wMaxPacketSize set by autoconfiguration */
};
	
    /* Find all the endpoints we will use */
	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
	fsg->bulk_in = ep;

	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
	fsg->bulk_out = ep;

        因为只有端点（fifo）初始化完，未来才可以利用由usb_ep_queue()传输usb数据，而我们的U盘gadget驱动就利用usb_ep_queue()封装而成以下两个函数用于传输U盘数据：

static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh);
static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh);

        当然现在只是初始化，U盘还不能正常工作，毕竟现在连fsg_setup()都没有调用！也就是说还没被usb host枚举到，也没有SetConfiguration()等操作。那究竟什么时候调用fsg_setup()回调？？

        事实上，我们无需关心，因为在composite.c（libcomposite.ko）框架已经帮我们处理好细节了，在composite_setup()函数中被处理，该函数处于中断上下文中，不要放入sleep或者切换调度之类的代码。相当于当我们插入我们的U盘到PC上，它就会在composite_setup()回调我们的fsg_setup()。

        fsg_setup()中主要处理了两个Mass Storage Class相关的请求：US_BULK_RESET_REQUEST和US_BULK_GET_MAX_LUN，这些请求都是由usb host（电脑的U盘驱动）下发给U盘的，U盘只有按要求处理即可。

        想要深入理解gadget，还是需要仔细阅读libcomposite.c（libcomposite.ko）的实现，否则我们就只会调调gadget的api，以后我再讲解libcomposite.ko和udc驱动的流程。

        下面主要分析fsg_main_thread()；基本上U盘的所有读写操作都是靠它完成，十分重要的一个函数！

static int fsg_main_thread(void *common_)
{
	struct fsg_common	*common = common_;

	/*
	 * Allow the thread to be killed by a signal, but set the signal mask
	 * to block everything but INT, TERM, KILL, and USR1.
	 */
	allow_signal(SIGINT);
	allow_signal(SIGTERM);
	allow_signal(SIGKILL);
	allow_signal(SIGUSR1);

	/* Allow the thread to be frozen */
	set_freezable();

	/*
	 * Arrange for userspace references to be interpreted as kernel
	 * pointers.  That way we can pass a kernel pointer to a routine
	 * that expects a __user pointer and it will work okay.
	 */
	set_fs(get_ds());

	/* The main loop */
	while (common->state != FSG_STATE_TERMINATED) {
		if (exception_in_progress(common) || signal_pending(current)) {
			handle_exception(common);
			continue;
		}

		if (!common->running) {
			sleep_thread(common, true);
			continue;
		}

		if (get_next_command(common))
			continue;

		spin_lock_irq(&common->lock);
		if (!exception_in_progress(common))
			common->state = FSG_STATE_DATA_PHASE;
		spin_unlock_irq(&common->lock);

		if (do_scsi_command(common) || finish_reply(common))
			continue;

		spin_lock_irq(&common->lock);
		if (!exception_in_progress(common))
			common->state = FSG_STATE_STATUS_PHASE;
		spin_unlock_irq(&common->lock);

		if (send_status(common))
			continue;

		spin_lock_irq(&common->lock);
		if (!exception_in_progress(common))
			common->state = FSG_STATE_IDLE;
		spin_unlock_irq(&common->lock);
	}

	spin_lock_irq(&common->lock);
	common->thread_task = NULL;
	spin_unlock_irq(&common->lock);

	if (!common->ops || !common->ops->thread_exits
	 || common->ops->thread_exits(common) < 0) {
		int i;

		down_write(&common->filesem);
		for (i = 0; i < ARRAY_SIZE(common->luns); --i) {
			struct fsg_lun *curlun = common->luns[i];
			if (!curlun || !fsg_lun_is_open(curlun))
				continue;

			fsg_lun_close(curlun);
			curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
		}
		up_write(&common->filesem);
	}

	/* Let fsg_unbind() know the thread has exited */
	complete_and_exit(&common->thread_notifier, 0);
}

        它先是声明可以被信号kill调该内核线程，以及能冻结，譬如kiill -STOP、kill -CONT之类的。它主要是靠如下几个函数工作：get_next_command(common)

do_scsi_command(common) || finish_reply(common)

和send_status(common)

        Bulk only 的传输协议可阅读《usbmassbulk_10.pdf》文档，下面只是截取其中一部分：

和

以及阅读SCSI命令文档。本U盘gadget只是实现其中一些常用的SCSI命令子集而已，我们就挑读（READ_10）和写（WRITE_10）这两个操作：

和

        可以看到主要是do_read和do_write。因为流程比较繁杂，这里只简单描述，有兴趣的朋友可以逐行代码分析研究，do_write()是通过start_out_transfer()从usb host获取到文件数据，然后调用vfs_write()写入文件系统，完成了将文件写入U盘的过程；而do_read()则是先通过vfs_read()从文件系统（加载驱动时指定的文件路径file=filename[,filename...]）中读取文件，然后调用start_in_transfer()写入usb host，完成了读取U盘内的文件到PC。

        终于把U盘gadget驱动讲解了一遍，当然只是粗略走读了一下，代码细节上还是需要大家仔细研究，譬如没有深入到composite.c（libcomposite.ko）gadget框架的具体实现，U盘方面也没有细节到每个SCSI命令的讲解，以及没有讲解CBW/CSW的细节处理（有兴趣可以对照《usbmassbulk_10.pdf》阅读代码）等。