Linux设备驱动剖析之IIC（三）

下面以eeprom用户程序调用ioctl函数的写操作为例追踪IIC子系统的调用过程。eeprom的用户测试是大部分开发板都自带的。看写一个字节数据的eeprom_write_byte函数的定义：

int eeprom_write_byte(struct eeprom *e, __u16 mem_addr, __u8 data)
{
    if(e->type == EEPROM_TYPE_8BIT_ADDR) {
        __u8 buf[] = { mem_addr & 0x00ff, data };
        return i2c_write_2b(e, buf);
    } else if(e->type == EEPROM_TYPE_16BIT_ADDR) {
        __u8 buf[] =
            { (mem_addr >> ) & 0x00ff, mem_addr & 0x00ff, data };
        return i2c_write_3b(e, buf);
    }
    fprintf(stderr, "ERR: unknown eeprom type\n");
    return -;
}

这里使用的是8位地址，因此调用的是i2c_write_2b函数，为什么是2b？这是eeprom规定的，写数据之前要先写地址。注意buf[0]=要写的地址，buf[1]=要写的字节数据。下面是i2c_write_2b函数的定义：

static int i2c_write_2b(struct eeprom *e, __u8 buf[])
{
    int r;
    // we must simulate a plain I2C byte write with SMBus functions
    r = i2c_smbus_write_byte_data(e->fd, buf[], buf[]);
    if(r < )
        fprintf(stderr, "Error i2c_write_2b: %s\n", strerror(errno));
    usleep();
    return r;
}

就调用了i2c_smbus_write_byte_data函数，注意参数的含义，下面是它的定义：

static inline __s32 i2c_smbus_write_byte_data(int file, __u8 command,
                                              __u8 value)
{
    union i2c_smbus_data data;
    data.byte = value;
    return i2c_smbus_access(file,I2C_SMBUS_WRITE,command,
                            I2C_SMBUS_BYTE_DATA, &data);
}

调用了i2c_smbus_access函数，继续追踪，看i2c_smbus_access函数的定义：

static inline __s32 i2c_smbus_access(int file, char read_write, __u8 command,
                                     int size, union i2c_smbus_data *data)
{
    struct i2c_smbus_ioctl_data args;

    args.read_write = read_write;
    args.command = command;
    args.size = size;
    args.data = data;
    return ioctl(file,I2C_SMBUS,&args);
}

首先弄清楚参数的含义，file是使用open打开的文件。read_write表示是读操作还是写操作，这里是写，所以它的值为I2C_SMBUS_WRITE。command是要写的地址。size的值为I2C_SMBUS_BYTE_DATA。最后一个参数data.byte=要写的字节数据。

下面开始进入ioctl系统调用，最后会到达i2c-dev.c中的i2cdev_ioctl函数，看它的定义：

 static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
     struct i2c_client *client = file->private_data;
     unsigned long funcs;

     dev_dbg(&client->adapter->dev, "ioctl, cmd=0x%02x, arg=0x%02lx\n",
         cmd, arg);

     switch (cmd) {
     case I2C_SLAVE:
     case I2C_SLAVE_FORCE:
         /* NOTE:  devices set up to work with "new style" drivers
00000408          * can't use I2C_SLAVE, even when the device node is not
00000409          * bound to a driver.  Only I2C_SLAVE_FORCE will work.
00000410          *
00000411          * Setting the PEC flag here won't affect kernel drivers,
00000412          * which will be using the i2c_client node registered with
00000413          * the driver model core.  Likewise, when that client has
00000414          * the PEC flag already set, the i2c-dev driver won't see
00000415          * (or use) this setting.
00000416          */
         if ((arg > 0x3ff) ||
             (((client->flags & I2C_M_TEN) == ) && arg > 0x7f))
             return -EINVAL;
         if (cmd == I2C_SLAVE && i2cdev_check_addr(client->adapter, arg))
             return -EBUSY;
         /* REVISIT: address could become busy later */
         client->addr = arg;
         return ;
     case I2C_TENBIT:
         if (arg)
             client->flags |= I2C_M_TEN;
         else
             client->flags &= ~I2C_M_TEN;
         return ;
     case I2C_PEC:
         if (arg)
             client->flags |= I2C_CLIENT_PEC;
         else
             client->flags &= ~I2C_CLIENT_PEC;
         return ;
     case I2C_FUNCS:
         funcs = i2c_get_functionality(client->adapter);
         return put_user(funcs, (unsigned long __user *)arg);

     case I2C_RDWR:
         return i2cdev_ioctl_rdrw(client, arg);

     case I2C_SMBUS:
         return i2cdev_ioctl_smbus(client, arg);

     case I2C_RETRIES:
         client->adapter->retries = arg;
         break;
     case I2C_TIMEOUT:
         /* For historical reasons, user-space sets the timeout
00000452          * value in units of 10 ms.
00000453          */
         client->adapter->timeout = msecs_to_jiffies(arg * );
         break;
     default:
         /* NOTE:  returning a fault code here could cause trouble
00000458          * in buggy userspace code.  Some old kernel bugs returned
00000459          * zero in this case, and userspace code might accidentally
00000460          * have depended on that bug.
00000461          */
         return -ENOTTY;
     }
     return ;
 }

比较简单，根据不同的cmd执行不同的分支。由于ioctl传下来的cmd是I2C_SMBUS，因此直接看444、445行，调用i2cdev_ioctl_smbus函数：

 static noinline int i2cdev_ioctl_smbus(struct i2c_client *client,
         unsigned long arg)
 {
     struct i2c_smbus_ioctl_data data_arg;
     union i2c_smbus_data temp;
     int datasize, res;

     if (copy_from_user(&data_arg,
                (struct i2c_smbus_ioctl_data __user *) arg,
                sizeof(struct i2c_smbus_ioctl_data)))
         return -EFAULT;
     if ((data_arg.size != I2C_SMBUS_BYTE) &&
         (data_arg.size != I2C_SMBUS_QUICK) &&
         (data_arg.size != I2C_SMBUS_BYTE_DATA) &&
         (data_arg.size != I2C_SMBUS_WORD_DATA) &&
         (data_arg.size != I2C_SMBUS_PROC_CALL) &&
         (data_arg.size != I2C_SMBUS_BLOCK_DATA) &&
         (data_arg.size != I2C_SMBUS_I2C_BLOCK_BROKEN) &&
         (data_arg.size != I2C_SMBUS_I2C_BLOCK_DATA) &&
         (data_arg.size != I2C_SMBUS_BLOCK_PROC_CALL)) {
         dev_dbg(&client->adapter->dev,
             "size out of range (%x) in ioctl I2C_SMBUS.\n",
             data_arg.size);
         return -EINVAL;
     }
     /* Note that I2C_SMBUS_READ and I2C_SMBUS_WRITE are 0 and 1,
00000337        so the check is valid if size==I2C_SMBUS_QUICK too. */
     if ((data_arg.read_write != I2C_SMBUS_READ) &&
         (data_arg.read_write != I2C_SMBUS_WRITE)) {
         dev_dbg(&client->adapter->dev,
             "read_write out of range (%x) in ioctl I2C_SMBUS.\n",
             data_arg.read_write);
         return -EINVAL;
     }

     /* Note that command values are always valid! */

     if ((data_arg.size == I2C_SMBUS_QUICK) ||
         ((data_arg.size == I2C_SMBUS_BYTE) &&
         (data_arg.read_write == I2C_SMBUS_WRITE)))
         /* These are special: we do not use data */
         return i2c_smbus_xfer(client->adapter, client->addr,
                       client->flags, data_arg.read_write,
                       data_arg.command, data_arg.size, NULL);

     if (data_arg.data == NULL) {
         dev_dbg(&client->adapter->dev,
             "data is NULL pointer in ioctl I2C_SMBUS.\n");
         return -EINVAL;
     }

     if ((data_arg.size == I2C_SMBUS_BYTE_DATA) ||
         (data_arg.size == I2C_SMBUS_BYTE))
         datasize = sizeof(data_arg.data->byte);
     else if ((data_arg.size == I2C_SMBUS_WORD_DATA) ||
          (data_arg.size == I2C_SMBUS_PROC_CALL))
         datasize = sizeof(data_arg.data->word);
     else /* size == smbus block, i2c block, or block proc. call */
         datasize = sizeof(data_arg.data->block);

     if ((data_arg.size == I2C_SMBUS_PROC_CALL) ||
         (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||
         (data_arg.size == I2C_SMBUS_I2C_BLOCK_DATA) ||
         (data_arg.read_write == I2C_SMBUS_WRITE)) {
         if (copy_from_user(&temp, data_arg.data, datasize))
             return -EFAULT;
     }
     if (data_arg.size == I2C_SMBUS_I2C_BLOCK_BROKEN) {
         /* Convert old I2C block commands to the new
00000380            convention. This preserves binary compatibility. */
         data_arg.size = I2C_SMBUS_I2C_BLOCK_DATA;
         if (data_arg.read_write == I2C_SMBUS_READ)
             temp.block[] = I2C_SMBUS_BLOCK_MAX;
     }
     res = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
           data_arg.read_write, data_arg.command, data_arg.size, &temp);
     if (!res && ((data_arg.size == I2C_SMBUS_PROC_CALL) ||
              (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||
              (data_arg.read_write == I2C_SMBUS_READ))) {
         if (copy_to_user(data_arg.data, &temp, datasize))
             return -EFAULT;
     }
     return res;
 }

一大堆的if判断。318行，调用copy_from_user函数将用户空间的数据拷贝到内核空间。这样data_arg的内容就与ioctl第三个参数的内容是一样的了。

322至335行，都是判断，一路走来，我们知道data_arg.size的值为I2C_SMBUS_BYTE_DATA，所以这里的if条件不会成立。

338至344行，如果既不是读操作又不是写操作，那肯定不行，返回出错。

348行，由于不满足第一个条件，所以不会执行if里的语句。

356至360行，我们的data_arg.data是不为NULL的，可以继续往下执行。

362行，data_arg.size == I2C_SMBUS_BYTE_DATA这个条件满足，所以执行364行的语句，因此datasize的值为1。

371行，由于满足data_arg.read_write == I2C_SMBUS_WRITE这个条件，所以执行375行语句，将data_arg.data的第一个字节拷贝到temp变量中。

378行，条件不满足，略过。

先看387行，条件不满足，因此就剩下385行的i2c_smbus_xfer函数，下面看它在drivers/i2c/i2c-core.c中的定义：

 s32 i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr, unsigned short flags,
            char read_write, u8 command, int protocol,
            union i2c_smbus_data *data)
 {
     unsigned long orig_jiffies;
     int try;
     s32 res;

     flags &= I2C_M_TEN | I2C_CLIENT_PEC;

     if (adapter->algo->smbus_xfer) {
         i2c_lock_adapter(adapter);

         /* Retry automatically on arbitration loss */
         orig_jiffies = jiffies;
         for (res = , try = ; try <= adapter->retries; try++) {
             res = adapter->algo->smbus_xfer(adapter, addr, flags,
                             read_write, command,
                             protocol, data);
             if (res != -EAGAIN)
                 break;
             if (time_after(jiffies,
                        orig_jiffies + adapter->timeout))
                 break;
         }
         i2c_unlock_adapter(adapter);
     } else
         res = i2c_smbus_xfer_emulated(adapter, addr, flags, read_write,
                           command, protocol, data);

     return res;
 }

2076行，对于s3c6410的IIC控制器驱动来说，没有定义smbus_xfer函数，因此执行2093行的i2c_smbus_xfer_emulated函数，它的定义如下：

 static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
                    unsigned short flags,
                    char read_write, u8 command, int size,
                    union i2c_smbus_data *data)
 {
     /* So we need to generate a series of msgs. In the case of writing, we
00001895       need to use only one message; when reading, we need two. We initialize
00001896       most things with sane defaults, to keep the code below somewhat
00001897       simpler. */
     unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+];
     unsigned char msgbuf1[I2C_SMBUS_BLOCK_MAX+];
     int num = read_write == I2C_SMBUS_READ ?  : ;
     struct i2c_msg msg[] = { { addr, flags, , msgbuf0 },
                               { addr, flags | I2C_M_RD, , msgbuf1 }
                             };
     int i;
     u8 partial_pec = ;
     int status;

     msgbuf0[] = command;
     switch (size) {
     case I2C_SMBUS_QUICK:
         msg[].len = ;
         /* Special case: The read/write field is used as data */
         msg[].flags = flags | (read_write == I2C_SMBUS_READ ?
                     I2C_M_RD : );
         num = ;
         break;
     case I2C_SMBUS_BYTE:
         if (read_write == I2C_SMBUS_READ) {
             /* Special case: only a read! */
             msg[].flags = I2C_M_RD | flags;
             num = ;
         }
         break;
     case I2C_SMBUS_BYTE_DATA:
         if (read_write == I2C_SMBUS_READ)
             msg[].len = ;
         else {
             msg[].len = ;
             msgbuf0[] = data->byte;
         }
         break;
     case I2C_SMBUS_WORD_DATA:
         if (read_write == I2C_SMBUS_READ)
             msg[].len = ;
         else {
             msg[].len = ;
             msgbuf0[] = data->word & 0xff;
             msgbuf0[] = data->word >> ;
         }
         break;
     case I2C_SMBUS_PROC_CALL:
         num = ; /* Special case */
         read_write = I2C_SMBUS_READ;
         msg[].len = ;
         msg[].len = ;
         msgbuf0[] = data->word & 0xff;
         msgbuf0[] = data->word >> ;
         break;
     case I2C_SMBUS_BLOCK_DATA:
         if (read_write == I2C_SMBUS_READ) {
             msg[].flags |= I2C_M_RECV_LEN;
             msg[].len = ; /* block length will be added by
00001953                        the underlying bus driver */
         } else {
             msg[].len = data->block[] + ;
             if (msg[].len > I2C_SMBUS_BLOCK_MAX + ) {
                 dev_err(&adapter->dev,
                     "Invalid block write size %d\n",
                     data->block[]);
                 return -EINVAL;
             }
             for (i = ; i < msg[].len; i++)
                 msgbuf0[i] = data->block[i-];
         }
         break;
     case I2C_SMBUS_BLOCK_PROC_CALL:
         num = ; /* Another special case */
         read_write = I2C_SMBUS_READ;
         if (data->block[] > I2C_SMBUS_BLOCK_MAX) {
             dev_err(&adapter->dev,
                 "Invalid block write size %d\n",
                 data->block[]);
             return -EINVAL;
         }
         msg[].len = data->block[] + ;
         for (i = ; i < msg[].len; i++)
             msgbuf0[i] = data->block[i-];
         msg[].flags |= I2C_M_RECV_LEN;
         msg[].len = ; /* block length will be added by
00001980                    the underlying bus driver */
         break;
     case I2C_SMBUS_I2C_BLOCK_DATA:
         if (read_write == I2C_SMBUS_READ) {
             msg[].len = data->block[];
         } else {
             msg[].len = data->block[] + ;
             if (msg[].len > I2C_SMBUS_BLOCK_MAX + ) {
                 dev_err(&adapter->dev,
                     "Invalid block write size %d\n",
                     data->block[]);
                 return -EINVAL;
             }
             for (i = ; i <= data->block[]; i++)
                 msgbuf0[i] = data->block[i];
         }
         break;
     default:
         dev_err(&adapter->dev, "Unsupported transaction %d\n", size);
         return -EOPNOTSUPP;
     }

     i = ((flags & I2C_CLIENT_PEC) && size != I2C_SMBUS_QUICK
                       && size != I2C_SMBUS_I2C_BLOCK_DATA);
     if (i) {
         /* Compute PEC if first message is a write */
         if (!(msg[].flags & I2C_M_RD)) {
             if (num == ) /* Write only */
                 i2c_smbus_add_pec(&msg[]);
             else /* Write followed by read */
                 partial_pec = i2c_smbus_msg_pec(, &msg[]);
         }
         /* Ask for PEC if last message is a read */
         if (msg[num-].flags & I2C_M_RD)
             msg[num-].len++;
     }

     status = i2c_transfer(adapter, msg, num);
     if (status < )
         return status;

     /* Check PEC if last message is a read */
     if (i && (msg[num-].flags & I2C_M_RD)) {
         status = i2c_smbus_check_pec(partial_pec, &msg[num-]);
         if (status < )
             return status;
     }

     if (read_write == I2C_SMBUS_READ)
         switch (size) {
         case I2C_SMBUS_BYTE:
             data->byte = msgbuf0[];
             break;
         case I2C_SMBUS_BYTE_DATA:
             data->byte = msgbuf1[];
             break;
         case I2C_SMBUS_WORD_DATA:
         case I2C_SMBUS_PROC_CALL:
             data->word = msgbuf1[] | (msgbuf1[] << );
             break;
         case I2C_SMBUS_I2C_BLOCK_DATA:
             for (i = ; i < data->block[]; i++)
                 data->block[i+] = msgbuf1[i];
             break;
         case I2C_SMBUS_BLOCK_DATA:
         case I2C_SMBUS_BLOCK_PROC_CALL:
             for (i = ; i < msgbuf1[] + ; i++)
                 data->block[i] = msgbuf1[i];
             break;
         }
     return ;
 }

函数很长，但是逻辑却很简单。1898行，定义msgbuf0数组用作写操作，里面放的是要写的数据，后面会看到。

1899行，定义msgbuf1数组用作读操作，这里讨论的是写操作，因此略过与读操作相关的内容。

1900行，因为read_write=I2C_SMBUS_WRITE，所以num的值为1。

1901行，定义2个message数组，同样，一个用作写，一个用作读。

1908行，msgbuf0[0] = command，即要写数据的地址。

1909行，switch(size)，由于size的值为I2C_SMBUS_BYTE_DATA，所以1924行的条件成立。

1925行，条件不成立，因此直接到1928行，msg[0].len = 2，写一字节地址和写一个字节数据加起来刚好是2字节。1929行，msgbuf0[1] = data->byte，即要写入的数据。

2002至2015行，与错误检测相关的，略过它不会有什么影响。

先看2022至2050行，都是与读操作相关的，因此不说了。

再看2017行，调用i2c_transfer函数来进行传输，i2c_transfer函数的定义：

 int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 {
     unsigned long orig_jiffies;
     int ret, try;

     /* REVISIT the fault reporting model here is weak:
00001287      *
00001288      *  - When we get an error after receiving N bytes from a slave,
00001289      *    there is no way to report "N".
00001290      *
00001291      *  - When we get a NAK after transmitting N bytes to a slave,
00001292      *    there is no way to report "N" ... or to let the master
00001293      *    continue executing the rest of this combined message, if
00001294      *    that's the appropriate response.
00001295      *
00001296      *  - When for example "num" is two and we successfully complete
00001297      *    the first message but get an error part way through the
00001298      *    second, it's unclear whether that should be reported as
00001299      *    one (discarding status on the second message) or errno
00001300      *    (discarding status on the first one).
00001301      */

     if (adap->algo->master_xfer) {
 #ifdef DEBUG
         for (ret = ; ret < num; ret++) {
             dev_dbg(&adap->dev, "master_xfer[%d] %c, addr=0x%02x, "
                 "len=%d%s\n", ret, (msgs[ret].flags & I2C_M_RD)
                 ? 'R' : 'W', msgs[ret].addr, msgs[ret].len,
                 (msgs[ret].flags & I2C_M_RECV_LEN) ? "+" : "");
         }
 #endif

         if (in_atomic() || irqs_disabled()) {
             ret = i2c_trylock_adapter(adap);
             if (!ret)
                 /* I2C activity is ongoing. */
                 return -EAGAIN;
         } else {
             i2c_lock_adapter(adap);
         }

         /* Retry automatically on arbitration loss */
         orig_jiffies = jiffies;
         for (ret = , try = ; try <= adap->retries; try++) {
             ret = adap->algo->master_xfer(adap, msgs, num);
             if (ret != -EAGAIN)
                 break;
             if (time_after(jiffies, orig_jiffies + adap->timeout))
                 break;
         }
         i2c_unlock_adapter(adap);

         return ret;
     } else {
         dev_dbg(&adap->dev, "I2C level transfers not supported\n");
         return -EOPNOTSUPP;
     }
 }

一看，呆了眼，函数里面竟然有这么多注释。

1303行，master_xfer这个指针是有赋值的，因此执行if里面的语句。

1304至1311行，调试相关的，打印一些调试信息。

1313至1320行，锁住当前的适配器。

1324行，adap->retries的值在IIC控制器初始化的时候就设置为2，因此重试2次。

1325行，调用的是drivers/i2c/busses/i2c-s3c2410.c里的s3c24xx_i2c_xfer函数，它的定义：

 static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,
             struct i2c_msg *msgs, int num)
 {
     struct s3c24xx_i2c *i2c = (struct s3c24xx_i2c *)adap->algo_data;
     int retry;
     int ret;

     for (retry = ; retry < adap->retries; retry++) {

         ret = s3c24xx_i2c_doxfer(i2c, msgs, num);

         if (ret != -EAGAIN)
             return ret;

         dev_dbg(i2c->dev, "Retrying transmission (%d)\n", retry);

         udelay();
     }

     return -EREMOTEIO;
 }