有了解过Linux IIC的设备驱动问题？

    写在前面

由于IIC总线只需要两根线就可以完成读写操作，而且通信协议简单，一条总线上可以挂载多个设备，因此被广泛使用。但是IIC总线有一个缺点，就是传输速率比较低。本文基于Linux-2.6.36版本，说说IIC子系统在Linux中的实现。

IIC子系统框架分为3各部分：

1. I2C核心：I2C总线和I2C设备驱动的中间枢纽，它为I2C总线和设备驱动提供了注册、注销等方法。

2. I2C总线驱动（I2C控制器驱动）：对I2C硬件体系中适配器端的实现，控制器可以在CPU内部，也可以集成在CPU内部。     

主要包含：

I2C适配器数据结构i2c_adapter、

I2C适配器的Algorithm数据结构i2c_algorithm

控制I2C适配器产生通信信号的函数

经由I2C总线驱动的代码，我们可以控制I2C适配器以主控的方式产生开始位、停止位、读写周期，以及以从设备方式被读写、产生ACK。

3. I2C设备驱动（客户驱动）：对I2C从设备驱动的实现，如：AT24C02的驱动。

借用某书上的IIC子系统的体系结构图：

Linux IIC子系统体系结构

下面开始分析IIC子系统。

IIC子系统的初始化在drivers/i2c/i2c-core.c文件中的i2c_init函数中：

00001221 static int __init i2c_init(void)00001222 {00001223 int retval;00001224 00001225 retval = bus_register(&i2c_bus_type);00001226 if (retval)00001227 return retval;00001228 #ifdef CONFIG_I2C_COMPAT00001229 i2c_adapter_compat_class = class_compat_register("i2c-adapter");00001230 if (!i2c_adapter_compat_class) {00001231 retval = -ENOMEM;00001232 goto bus_err;00001233 }00001234 #endif00001235 retval = i2c_add_driver(&dummy_driver);00001236 if (retval)00001237 goto class_err;00001238 return 0;00001239 00001240 class_err:00001241 #ifdef CONFIG_I2C_COMPAT00001242 class_compat_unregister(i2c_adapter_compat_class);00001243 bus_err:00001244 #endif00001245 bus_unregister(&i2c_bus_type);00001246 return retval;00001247 }

1225行，向系统注册IIC总线，其中i2c_bus_type的定义为：

00000343 struct bus_type i2c_bus_type = {00000344 .name = "i2c",00000345 .match = i2c_device_match,00000346 .probe = i2c_device_probe,00000347 .remove = i2c_device_remove,00000348 .shutdown = i2c_device_shutdown,00000349 .pm = &i2c_device_pm_ops,00000350 };

345行，i2c_device_match函数时用来匹配IIC总线上的设备和设备驱动的，下面看下它的定义：

00000068 static int i2c_device_match(struct device *dev, struct device_driver *drv)00000069 {00000070 struct i2c_client *client = i2c_verify_client(dev);00000071 struct i2c_driver *driver;00000072 00000073 if (!client)00000074 return 0;00000075 00000076 /* Attempt an OF style match */00000077 if (of_driver_match_device(dev, drv))00000078 return 1;00000079 00000080 driver = to_i2c_driver(drv);00000081 /* match on an id table if there is one */00000082 if (driver->id_table)00000083 return i2c_match_id(driver->id_table, client) != NULL;00000084 00000085 return 0;00000086 }

在IIC子系统中，用struct i2c_client来描述一个具体的IIC设备（IIC从机）。73行，如果没有IIC设备的话就直接返回0，表示匹配不成功。

77行，用of的方式进行匹配，应该是设备树方面的，具体没了解过。

82行，如果驱动的id table存在则调用83行的i2c_match_id函数进行匹配：

00000057 static const struct i2c_device_id *i2c_match_id(const struct i2c_device_id *id,00000058 const struct i2c_client *client)00000059 {00000060 while (id->name[0]) {00000061 if (strcmp(client->name, id->name) == 0)00000062 return id;00000063 id++;00000064 }00000065 return NULL;00000066 }

很简单，就是拿驱动的id table中的每一项与i2c_client的name成员进行比较，如果它们的名字相同就表示匹配成功，否则匹配失败，返回NULL。从这里也可以看出IIC的总线匹配方式与platform总线的匹配方式是不一样，一般情况下，IIC总线的匹配方式是根据设备名字和驱动中的id table，而platfrom总线的匹配方式是根据设备名字和驱动名字。下面看i2c_device_probe函数：

00000106 static int i2c_device_probe(struct device *dev)00000107 {00000108 struct i2c_client *client = i2c_verify_client(dev);00000109 struct i2c_driver *driver;00000110 int status;00000111 00000112 if (!client)00000113 return 0;00000114 00000115 driver = to_i2c_driver(dev->driver);00000116 if (!driver->probe || !driver->id_table)00000117 return -ENODEV;00000118 client->driver = driver;00000119 if (!device_can_wakeup(&client->dev))00000120 device_init_wakeup(&client->dev,00000121 client->flags & I2C_CLIENT_WAKE);00000122 dev_dbg(dev, "probe\n");00000123 00000124 status = driver->probe(client, i2c_match_id(driver->id_table, client));00000125 if (status) {00000126 client->driver = NULL;00000127 i2c_set_clientdata(client, NULL);00000128 }00000129 return status;00000130 }

112行，检查IIC设备是否存在。

119至121行，电源管理方面的，IIC在电源管理方面做得还是不错的，有兴趣可以看一下。

124行，重要，调用IIC设备驱动中probe函数。

下面以tiny6410为具体平台去说IIC子系统的其他内容。S3c6410的IIC控制器驱动位于drivers/i2c/busses/i2c-s3c2410.c文件中，首先看初始化函数：

00001009 static struct platform_driver s3c24xx_i2c_driver = {00001010 .probe = s3c24xx_i2c_probe,00001011 .remove = s3c24xx_i2c_remove,00001012 .id_table = s3c24xx_driver_ids,00001013 .driver = {00001014 .owner = THIS_MODULE,00001015 .name = "s3c-i2c",00001016 .pm = S3C24XX_DEV_PM_OPS,00001017 },00001018 };00001019 00001020 static int __init i2c_adap_s3c_init(void)00001021 {00001022 return platform_driver_register(&s3c24xx_i2c_driver);00001023 }00001024 subsys_initcall(i2c_adap_s3c_init);

1022行，注册平台驱动，看下s3c24xx_i2c_driver的定义可以发现.driver.name的值与板文件中定义的platform device的name不一样，所以这里采用的是id table方式进行匹配。我们知道，当此驱动与设备匹配后，驱动中的probe函数将会被调用，那么下面看probe函数的定义：

00000790 static int s3c24xx_i2c_probe(struct platform_device *pdev)00000791 {00000792 struct s3c24xx_i2c *i2c;00000793 struct s3c2410_platform_i2c *pdata;00000794 struct resource *res;00000795 int ret;00000796 00000797 pdata = pdev->dev.platform_data;00000798 if (!pdata) {00000799 dev_err(&pdev->dev, "no platform data\n");00000800 return -EINVAL;00000801 }00000802 00000803 i2c = kzalloc(sizeof(struct s3c24xx_i2c), GFP_KERNEL);00000804 if (!i2c) {00000805 dev_err(&pdev->dev, "no memory for state\n");00000806 return -ENOMEM;00000807 }00000808 00000809 strlcpy(i2c->adap.name, "s3c2410-i2c", sizeof(i2c->adap.name));00000810 i2c->adap.owner = THIS_MODULE;00000811 i2c->adap.algo = &s3c24xx_i2c_algorithm;00000812 i2c->adap.retries = 2;00000813 i2c->adap.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;00000814 i2c->tx_setup = 50;00000815 00000816 spin_lock_init(&i2c->lock);00000817 init_waitqueue_head(&i2c->wait);00000818 00000819 /* find the clock and enable it */00000820 00000821 i2c->dev = &pdev->dev;00000822 i2c->clk = clk_get(&pdev->dev, "i2c");00000823 if (IS_ERR(i2c->clk)) {00000824 dev_err(&pdev->dev, "cannot get clock\n");00000825 ret = -ENOENT;00000826 goto err_noclk;00000827 }00000828 00000829 dev_dbg(&pdev->dev, "clock source %p\n", i2c->clk);00000830 00000831 clk_enable(i2c->clk);00000832 00000833 /* map the registers */00000834 00000835 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);00000836 if (res == NULL) {00000837 dev_err(&pdev->dev, "cannot find IO resource\n");00000838 ret = -ENOENT;00000839 goto err_clk;00000840 }00000841 00000842 i2c->ioarea = request_mem_region(res->start, resource_size(res),00000843 pdev->name);00000844 00000845 if (i2c->ioarea == NULL) {00000846 dev_err(&pdev->dev, "cannot request IO\n");00000847 ret = -ENXIO;00000848 goto err_clk;00000849 }00000850 00000851 i2c->regs = ioremap(res->start, resource_size(res));00000852 00000853 if (i2c->regs == NULL) {00000854 dev_err(&pdev->dev, "cannot map IO\n");00000855 ret = -ENXIO;00000856 goto err_ioarea;00000857 }00000858 00000859 dev_dbg(&pdev->dev, "registers %p (%p, %p)\n",00000860 i2c->regs, i2c->ioarea, res);00000861 00000862 /* setup info block for the i2c core */00000863 00000864 i2c->adap.algo_data = i2c;00000865 i2c->adap.dev.parent = &pdev->dev;00000866 00000867 /* initialise the i2c controller */00000868 00000869 ret = s3c24xx_i2c_init(i2c);00000870 if (ret != 0)00000871 goto err_iomap;00000872 00000873 /* find the IRQ for this unit (note, this relies on the init call to00000874 * ensure no current IRQs pending00000875 */00000876 00000877 i2c->irq = ret = platform_get_irq(pdev, 0);00000878 if (ret <= 0) {00000879 dev_err(&pdev->dev, "cannot find IRQ\n");00000880 goto err_iomap;00000881 }00000882 00000883 ret = request_irq(i2c->irq, s3c24xx_i2c_irq, IRQF_DISABLED,00000884 dev_name(&pdev->dev), i2c);00000885 00000886 if (ret != 0) {00000887 dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq);00000888 goto err_iomap;00000889 }00000890 00000891 ret = s3c24xx_i2c_register_cpufreq(i2c);00000892 if (ret < 0) {00000893 dev_err(&pdev->dev, "failed to register cpufreq notifier\n");00000894 goto err_irq;00000895 }00000896 00000897 /* Note, previous versions of the driver used i2c_add_adapter()00000898 * to add the bus at any number. We now pass the bus number via00000899 * the platform data, so if unset it will now default to always00000900 * being bus 0.00000901 */00000902 00000903 i2c->adap.nr = pdata->bus_num;00000904 00000905 ret = i2c_add_numbered_adapter(&i2c->adap);00000906 if (ret < 0) {00000907 dev_err(&pdev->dev, "failed to add bus to i2c core\n");00000908 goto err_cpufreq;00000909 }00000910 00000911 platform_set_drvdata(pdev, i2c);00000912 00000913 dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev));00000914 return 0;00000915 00000916 err_cpufreq:00000917 s3c24xx_i2c_deregister_cpufreq(i2c);00000918 00000919 err_irq:00000920 free_irq(i2c->irq, i2c);00000921 00000922 err_iomap:00000923 iounmap(i2c->regs);00000924 00000925 err_ioarea:00000926 release_resource(i2c->ioarea);00000927 kfree(i2c->ioarea);00000928 00000929 err_clk:00000930 clk_disable(i2c->clk);00000931 clk_put(i2c->clk);00000932 00000933 err_noclk:00000934 kfree(i2c);00000935 return ret;00000936 }

797至801行，没有平台数据是不行的。

803至807行，为具体平台的IIC控制器数据结构申请内存，一般来说，不仅是IIC控制器，每一个控制器都会有一个结构体来描述。struct s3c24xx_i2c的定义也是在drivers/i2c/busses/i2c-s3c2410.c中：

00000060 struct s3c24xx_i2c {00000061 spinlock_t lock;00000062 wait_queue_head_t wait;00000063 unsigned int suspended:1;00000064 00000065 struct i2c_msg *msg;00000066 unsigned int msg_num;00000067 unsigned int msg_idx;00000068 unsigned int msg_ptr;00000069 00000070 unsigned int tx_setup;00000071 unsigned int irq;00000072 00000073 enum s3c24xx_i2c_state state;00000074 unsigned long clkrate;00000075 00000076 void __iomem *regs;00000077 struct clk *clk;00000078 struct device *dev;00000079 struct resource *ioarea;00000080 struct i2c_adapter adap;00000081 00000082 #ifdef CONFIG_CPU_FREQ00000083 struct notifier_block freq_transition;00000084 #endif00000085 };

63行，表示IIC控制器是否已经挂起，挂起的话就不能操作IIC控制器了。

65行，struct i2c_msg用来描述一次读写操作包含的信息。定义在include/linux/i2c.h，比较简单：

00000507 struct i2c_msg {00000508 __u16 addr; /* slave address */00000509 __u16 flags;00000510 #define I2C_M_TEN 0x0010 /* this is a ten bit chip address */00000511 #define I2C_M_RD 0x0001 /* read data, from slave to master */00000512 #define I2C_M_NOSTART 0x4000 /* if I2C_FUNC_PROTOCOL_MANGLING */00000513 #define I2C_M_REV_DIR_ADDR 0x2000 /* if I2C_FUNC_PROTOCOL_MANGLING */00000514 #define I2C_M_IGNORE_NAK 0x1000 /* if I2C_FUNC_PROTOCOL_MANGLING */00000515 #define I2C_M_NO_RD_ACK 0x0800 /* if I2C_FUNC_PROTOCOL_MANGLING */00000516 #define I2C_M_RECV_LEN 0x0400 /* length will be first received byte */00000517 __u16 len; /* msg length */00000518 __u8 *buf; /* pointer to msg data */00000519 };

508行，IIC从机的地址。

509行，flags的取值就是510至516行这些值。

517行，这次读写操作的数据长度。518行，读写数据的地址。

回到struct s3c24xx_i2c，66行，message的数量。67行，当前是第几个message。68行，缓冲区数组成员的索引值，表示当前要读写的是第几个数据。

70行，当数据写入IIC控制器的数据移位寄存器后需要延时多久，在s3c6410里的单位是ns。

71行，IIC控制器使用的中断号。

73行，IIC控制器的状态，具体来说有以下几种状态：

00000047 enum s3c24xx_i2c_state {00000048 STATE_IDLE,00000049 STATE_START,00000050 STATE_READ,00000051 STATE_WRITE,00000052 STATE_STOP00000053 };

74行，IIC总线的速率。76行，IIC控制器寄存器起始地址。

77行，IIC控制器时钟。78行，设备模型相关的。79行，IO口资源。

80行，每一个IIC控制器对应一个adapter。struct i2c_adapter同样是在include/linux/i2c.h中定义：

00000354 struct i2c_adapter {00000355 struct module *owner;00000356 unsigned int id;00000357 unsigned int class; /* classes to allow probing for */00000358 const struct i2c_algorithm *algo; /* the algorithm to access the bus */00000359 void *algo_data;00000360 00000361 /* data fields that are valid for all devices */00000362 struct rt_mutex bus_lock;00000363 00000364 int timeout; /* in jiffies */00000365 int retries;00000366 struct device dev; /* the adapter device */00000367 00000368 int nr;00000369 char name[48];00000370 struct completion dev_released;00000371 00000372 struct mutex userspace_clients_lock;00000373 struct list_head userspace_clients;00000374 };

355行，模块的所有者。

356行，此适配器的编号，第1个适配器的编号为0，以此类推。

358行，算法？第一眼看到的时候差点被吓倒了，其实就是定义了3个函数指针，这些函数来完成具体的读写操作。

364行，超时时间。365行，重试次数，一次读写操作不成功的话就多试几次。368行，适配器编号。369行，适配器的名字。

回到s3c24xx_i2c_probe函数，809行，设置适配器的名字。

811行，s3c6410的IIC控制器进行读写操作时所使用的逻辑，等碰到时再详细说吧。

813行，刚才在说struct i2c_adapter时被忽略的成员class就是在这里被赋值的。

814行，对于s3c6410的IIC控制器而言，数据被写入移位寄存器后需要延时50ns。

822至831行，获取IIC时钟并使能。

835至857行，获取IO口资源并进行映射。

869行，设置相应的IO口为IIC功能，并设置IICADD寄存器和IICCON寄存器。

877至889行，申请IIC中断，中断处理函数为s3c24xx_i2c_irq，后面会遇到，到时再说。

891至895行，CPU频率相关的，略过吧。

905行，“重头戏”啊，注册IIC适配器和注册IIC设备等都发生在里面，i2c_add_numbered_adapter函数在drivers/i2c/i2c-core.c里定义：

00000948 int i2c_add_numbered_adapter(struct i2c_adapter *adap)00000949 {00000950 int id;00000951 int status;00000952 00000953 if (adap->nr & ~MAX_ID_MASK)00000954 return -EINVAL;00000955 00000956 retry:00000957 if (idr_pre_get(&i2c_adapter_idr, GFP_KERNEL) == 0)00000958 return -ENOMEM;00000959 00000960 mutex_lock(&core_lock);00000961 /* "above" here means "above or equal to", sigh;00000962 * we need the "equal to" result to force the result00000963 */00000964 status = idr_get_new_above(&i2c_adapter_idr, adap, adap->nr, &id);00000965 if (status == 0 && id != adap->nr) {00000966 status = -EBUSY;00000967 idr_remove(&i2c_adapter_idr, id);00000968 }00000969 mutex_unlock(&core_lock);00000970 if (status == -EAGAIN)00000971 goto retry;00000972 00000973 if (status == 0)00000974 status = i2c_register_adapter(adap);00000975 return status;00000976 }

953行，适配器的编号大于MAX_ID_MASK是不行的，MAX_ID_MASK是一个宏，展开后的值为61。

957至968行，关于管理小整形ID数的，没怎么了解，略过。

974行，调用i2c_register_adapter函数注册IIC适配器，下面是它的定义：

00000837 static int i2c_register_adapter(struct i2c_adapter *adap)00000838 {00000839 int res = 0;00000840 00000841 /* Can't register until after driver model init */00000842 if (unlikely(WARN_ON(!i2c_bus_type.p))) {00000843 res = -EAGAIN;00000844 goto out_list;00000845 }00000846 00000847 rt_mutex_init(&adap->bus_lock);00000848 mutex_init(&adap->userspace_clients_lock);00000849 INIT_LIST_HEAD(&adap->userspace_clients);00000850 00000851 /* Set default timeout to 1 second if not already set */00000852 if (adap->timeout == 0)00000853 adap->timeout = HZ;00000854 00000855 dev_set_name(&adap->dev, "i2c-%d", adap->nr);00000856 adap->dev.bus = &i2c_bus_type;00000857 adap->dev.type = &i2c_adapter_type;00000858 res = device_register(&adap->dev);00000859 if (res)00000860 goto out_list;00000861 00000862 dev_dbg(&adap->dev, "adapter [%s] registered\n", adap->name);00000863 00000864 #ifdef CONFIG_I2C_COMPAT00000865 res = class_compat_create_link(i2c_adapter_compat_class, &adap->dev,00000866 adap->dev.parent);00000867 if (res)00000868 dev_warn(&adap->dev,00000869 "Failed to create compatibility class link\n");00000870 #endif00000871 00000872 /* create pre-declared device nodes */00000873 if (adap->nr < __i2c_first_dynamic_bus_num)00000874 i2c_scan_static_board_info(adap);00000875 00000876 /* Notify drivers */00000877 mutex_lock(&core_lock);00000878 bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_new_adapter);00000879 mutex_unlock(&core_lock);00000880 00000881 return 0;00000882 00000883 out_list:00000884 mutex_lock(&core_lock);00000885 idr_remove(&i2c_adapter_idr, adap->nr);00000886 mutex_unlock(&core_lock);00000887 return res;00000888 }

842至845行，i2c_bus_type的私有成员p在IIC子系统初始化时在bus_register函数里已经被初始化了，因此if条件不会成立，可以继续往下走。

848、849行，之前说struct i2c_adapter时被略过的最后两个成员在这里被初始化。

852、853行，如果timeout没有设置，那么就给它个默认值HZ。一路走来可以发现，timeout在这里会被设置成HZ。

858行，注册适配器这个设备。

864至870行，兼容性方面的，略过。

874行，调用i2c_scan_static_board_info函数注册所有在板文件里定义的设备，下面看它的定义：

00000802 static void i2c_scan_static_board_info(struct i2c_adapter *adapter)00000803 {00000804 struct i2c_devinfo *devinfo;00000805 00000806 down_read(&__i2c_board_lock);00000807 list_for_each_entry(devinfo, &__i2c_board_list, list) {00000808 if (devinfo->busnum == adapter->nr00000809 && !i2c_new_device(adapter,00000810 &devinfo->board_info))00000811 dev_err(&adapter->dev,00000812 "Can't create device at 0x%02x\n",00000813 devinfo->board_info.addr);00000814 }00000815 up_read(&__i2c_board_lock);00000816 }

807行，遍历__i2c_board_list链表，每找到一个成员就调用i2c_new_device函数创建一个IIC从机设备，下面是i2c_new_device函数的定义：

00000523 struct i2c_client *00000524 i2c_new_device(struct i2c_adapter *adap, struct i2c_board_info const *info)00000525 {00000526 struct i2c_client *client;00000527 int status;00000528 00000529 client = kzalloc(sizeof *client, GFP_KERNEL);00000530 if (!client)00000531 return NULL;00000532 00000533 client->adapter = adap;00000534 00000535 client->dev.platform_data = info->platform_data;00000536 00000537 if (info->archdata)00000538 client->dev.archdata = *info->archdata;00000539 00000540 client->flags = info->flags;00000541 client->addr = info->addr;00000542 client->irq = info->irq;00000543 00000544 strlcpy(client->name, info->type, sizeof(client->name));00000545 00000546 /* Check for address validity */00000547 status = i2c_check_client_addr_validity(client);00000548 if (status) {00000549 dev_err(&adap->dev, "Invalid %d-bit I2C address 0x%02hx\n",00000550 client->flags & I2C_CLIENT_TEN ? 10 : 7, client->addr);00000551 goto out_err_silent;00000552 }00000553 00000554 /* Check for address business */00000555 status = i2c_check_addr_busy(adap, client->addr);00000556 if (status)00000557 goto out_err;00000558 00000559 client->dev.parent = &client->adapter->dev;00000560 client->dev.bus = &i2c_bus_type;00000561 client->dev.type = &i2c_client_type;00000562 #ifdef CONFIG_OF00000563 client->dev.of_node = info->of_node;00000564 #endif00000565 00000566 dev_set_name(&client->dev, "%d-%04x", i2c_adapter_id(adap),00000567 client->addr);00000568 status = device_register(&client->dev);00000569 if (status)00000570 goto out_err;00000571 00000572 dev_dbg(&adap->dev, "client [%s] registered with bus id %s\n",00000573 client->name, dev_name(&client->dev));00000574 00000575 return client;00000576 00000577 out_err:00000578 dev_err(&adap->dev, "Failed to register i2c client %s at 0x%02x "00000579 "(%d)\n", client->name, client->addr, status);00000580 out_err_silent:00000581 kfree(client);00000582 return NULL;00000583 }

529行，为IIC从机设备结构体申请内存。

533至542行，一些赋值。

544行，为client的name成员赋值，IIC总线的match函数能否匹配成功就要看这里了。从这里也可以知道如何让板文件里定义的设备与驱动匹配起来。

547行，检查IIC从机设备地址的合法性，怎样才合法？如果从机使用十位地址的话，那么地址的最大值不能大于0x3ff；如果使用的是七位地址，那么地址的最大值不能大于0x7f，也不能为0。

555行，检查当前IIC从机设备的地址有没有被使用，一条IIC总线或者一个IIC适配器上可以挂多个从机设备，靠设备的地址来识别不同的设备，因此一条总线上不能有两个同样地址的设备。

561行，设备的类型，IIC从机设备在IIC子系统里属于client类型。

568行，将IIC从机设备注册进系统。

回到i2c_register_adapter函数，878行，遍历IIC总线上的所有已经注册了的驱动，每找到一个就调用__process_new_adapter函数进行处理，__process_new_adapter函数的定义如下：

00000832 static int __process_new_adapter(struct device_driver *d, void *data)00000833 {00000834 return i2c_do_add_adapter(to_i2c_driver(d), data);00000835 }

里面就是调用i2c_do_add_adapter函数：

00000818 static int i2c_do_add_adapter(struct i2c_driver *driver,00000819 struct i2c_adapter *adap)00000820 {00000821 /* Detect supported devices on that bus, and instantiate them */00000822 i2c_detect(adap, driver);00000823 00000824 /* Let legacy drivers scan this bus for matching devices */00000825 if (driver->attach_adapter) {00000826 /* We ignore the return code; if it fails, too bad */00000827 driver->attach_adapter(adap);00000828 }00000829 return 0;00000830 }

822行，检查驱动是否能够与该适配器所在总线上的设备匹配。

825行，如果驱动的attach_adapter函数有定义就调用之，这主要针对旧的驱动，像i2c-dev.c就是使用这种方式来驱动IIC适配器的，这个函数指针在将来可能会被移除。

到这里，说完了s3c6410的IIC控制器驱动的初始化过程。下面开始说drivers/i2c/i2c-dev.c这个通用的i2c驱动，首先看它的初始化函数i2c_dev_init：

00000595 static int __init i2c_dev_init(void)00000596 {00000597 int res;00000598 00000599 printk(KERN_INFO "i2c /dev entries driver\n");00000600 00000601 res = register_chrdev(I2C_MAJOR, "i2c", &i2cdev_fops);00000602 if (res)00000603 goto out;00000604 00000605 i2c_dev_class = class_create(THIS_MODULE, "i2c-dev");00000606 if (IS_ERR(i2c_dev_class)) {00000607 res = PTR_ERR(i2c_dev_class);00000608 goto out_unreg_chrdev;00000609 }00000610 00000611 res = i2c_add_driver(&i2cdev_driver);00000612 if (res)00000613 goto out_unreg_class;00000614 00000615 return 0;00000616 00000617 out_unreg_class:00000618 class_destroy(i2c_dev_class);00000619 out_unreg_chrdev:00000620 unregister_chrdev(I2C_MAJOR, "i2c");00000621 out:00000622 printk(KERN_ERR "%s: Driver Initialisation failed\n", __FILE__);00000623 return res;00000624 }

601行，注册IIC设备，主设备号为I2C_MAJOR，它的值为89，文件操作结构体对象是i2cdev_fops，定义为：

00000514 static const struct file_operations i2cdev_fops = {00000515 .owner = THIS_MODULE,00000516 .llseek = no_llseek,00000517 .read = i2cdev_read,00000518 .write = i2cdev_write,00000519 .unlocked_ioctl = i2cdev_ioctl,00000520 .open = i2cdev_open,00000521 .release = i2cdev_release,00000522 };

后面会以i2cdev_ioctl为例说说它的工作过程。

605至609行，创建IIC设备类，是后面自动创建设备节点的基础。

611行，添加IIC驱动，起始里面是对i2c_register_driver函数的包装，在include/linux/i2c.h里定义：

00000434 static inline int i2c_add_driver(struct i2c_driver *driver)00000435 {00000436 return i2c_register_driver(THIS_MODULE, driver);00000437 }

这样就可以省去写THIS_MODULE，也可以避免忘记写THIS_MODULE。下面看i2c_register_driver函数的定义，在drivers/i2c/i2c-core.c中：

00001108 int i2c_register_driver(struct module *owner, struct i2c_driver *driver)00001109 {00001110 int res;00001111 00001112 /* Can't register until after driver model init */00001113 if (unlikely(WARN_ON(!i2c_bus_type.p)))00001114 return -EAGAIN;00001115 00001116 /* add the driver to the list of i2c drivers in the driver core */00001117 driver->driver.owner = owner;00001118 driver->driver.bus = &i2c_bus_type;00001119 00001120 /* When registration returns, the driver core00001121 * will have called probe() for all matching-but-unbound devices.00001122 */00001123 res = driver_register(&driver->driver);00001124 if (res)00001125 return res;00001126 00001127 pr_debug("i2c-core: driver [%s] registered\n", driver->driver.name);00001128 00001129 INIT_LIST_HEAD(&driver->clients);00001130 /* Walk the adapters that are already present */00001131 mutex_lock(&core_lock);00001132 bus_for_each_dev(&i2c_bus_type, NULL, driver, __process_new_driver);00001133 mutex_unlock(&core_lock);00001134 00001135 return 0;00001136 }

1113行，检查IIC总线的私有数据p是否已经初始化，前面已经说过了，在IIC子系统初始化的时候p就已经被初始化了。

1117、1118行，没什么好说的吧。

1123行，将该驱动注册进系统，经过一层层调用后会调用IIC总线的match函数。

1132行，遍历IIC总线上的所有设备，每找到一个就调用__process_new_driver函数进行处理，__process_new_driver函数的定义：

00001096 static int __process_new_driver(struct device *dev, void *data)00001097 {00001098 if (dev->type != &i2c_adapter_type)00001099 return 0;00001100 return i2c_do_add_adapter(data, to_i2c_adapter(dev));00001101 }

1098行，如果设备不是适配器类型，就表示不是要找的设备，直接返回0。否则调用1100行的i2c_do_add_adapter函数，这个函数前面已经说过了，这里就不重复了。

我们知道，此驱动注册进系统后会导致i2cdev_attach_adapter函数被调用，下面看它的定义：

00000534 static int i2cdev_attach_adapter(struct i2c_adapter *adap)00000535 {00000536 struct i2c_dev *i2c_dev;00000537 int res;00000538 00000539 i2c_dev = get_free_i2c_dev(adap);00000540 if (IS_ERR(i2c_dev))00000541 return PTR_ERR(i2c_dev);00000542 00000543 /* register this i2c device with the driver core */00000544 i2c_dev->dev = device_create(i2c_dev_class, &adap->dev,00000545 MKDEV(I2C_MAJOR, adap->nr), NULL,00000546 "i2c-%d", adap->nr);00000547 if (IS_ERR(i2c_dev->dev)) {00000548 res = PTR_ERR(i2c_dev->dev);00000549 goto error;00000550 }00000551 res = device_create_file(i2c_dev->dev, &dev_attr_name);00000552 if (res)00000553 goto error_destroy;00000554 00000555 pr_debug("i2c-dev: adapter [%s] registered as minor %d\n",00000556 adap->name, adap->nr);00000557 return 0;00000558 error_destroy:00000559 device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));00000560 error:00000561 return_i2c_dev(i2c_dev);00000562 return res;00000563 }

539行，不要被它的名字所迷惑，看它的定义：

00000076 static struct i2c_dev *get_free_i2c_dev(struct i2c_adapter *adap)00000077 {00000078 struct i2c_dev *i2c_dev;00000079 00000080 if (adap->nr >= I2C_MINORS) {00000081 printk(KERN_ERR "i2c-dev: Out of device minors (%d)\n",00000082 adap->nr);00000083 return ERR_PTR(-ENODEV);00000084 }00000085 00000086 i2c_dev = kzalloc(sizeof(*i2c_dev), GFP_KERNEL);00000087 if (!i2c_dev)00000088 return ERR_PTR(-ENOMEM);00000089 i2c_dev->adap = adap;00000090 00000091 spin_lock(&i2c_dev_list_lock);00000092 list_add_tail(&i2c_dev->list, &i2c_dev_list);00000093 spin_unlock(&i2c_dev_list_lock);00000094 return i2c_dev;00000095 }

80至84行，如果适配器的编号大于最大的次设备号，那么就返回出错。I2C_MINORS的值为256。

86行，为i2c_dev对象申请内存。

92行，将i2c_dev对象加入到i2c_dev_list链表中。

回到i2cdev_attach_adapter函数，544行，创建设备节点，主设备号为I2C_MAJOR，次设备号为适配器的编号，设备节点的名字为i2c-x，x的值就是适配器的编号。如果适配器的编号为0，那么就会在/dev下创建一个名为i2c-0的文件，即/dev/i2c-0，但在某些嵌入式Linux平台上没有看到这个文件，而是/dev/i2c/0这种形式，原因在于在启动文件里调用了mdev –s这条命令，导致/dev/i2c-0变成了/dev/i2c/0，不信？把i2c-x的-去掉，变成i2cx，重新编译后启动内核，看生成的是否是/dev/i2cx文件。之所以会造成那样是因为字符‘-’引起的。

551行，创建设备文件，关于设备模型的，不多说了。

到此，i2c-dev.c的初始化过程也说完了。

某某大侠说得对：“内核代码就像酒，有的苦有的烈，这样的滋味你我早晚要体会，请与我举起杯，与内核干杯。”多么形象的比喻！多么可爱的文字！

不管多“苦”多“累”，既然认定了前方，路还是要走下去的。

下面以eeprom用户程序调用ioctl函数的写操作为例追踪IIC子系统的调用过程。eeprom的用户测试是大部分开发板都自带的。看写一个字节数据的eeprom_write_byte函数的定义：

int eeprom_write_byte(struct eeprom *e, __u16 mem_addr, __u8 data){ if(e->type == EEPROM_TYPE_8BIT_ADDR) { __u8 buf[2] = { mem_addr & 0x00ff, data }; return i2c_write_2b(e, buf); } else if(e->type == EEPROM_TYPE_16BIT_ADDR) { __u8 buf[3] = { (mem_addr >> 8) & 0x00ff, mem_addr & 0x00ff, data }; return i2c_write_3b(e, buf); } fprintf(stderr, "ERR: unknown eeprom type\n"); return -1;}

这里使用的是8位地址，因此调用的是i2c_write_2b函数，为什么是2b？这是eeprom规定的，写数据之前要先写地址。注意buf[0]=要写的地址，buf[1]=要写的字节数据。下面是i2c_write_2b函数的定义：

static int i2c_write_2b(struct eeprom *e, __u8 buf[2]){ int r; // we must simulate a plain I2C byte write with SMBus functions r = i2c_smbus_write_byte_data(e->fd, buf[0], buf[1]); if(r < 0) fprintf(stderr, "Error i2c_write_2b: %s\n", strerror(errno)); usleep(10); return r;}

就调用了i2c_smbus_write_byte_data函数，注意参数的含义，下面是它的定义：

static inline __s32 i2c_smbus_write_byte_data(int file, __u8 command, __u8 value){ union i2c_smbus_data data; data.byte = value; return i2c_smbus_access(file,I2C_SMBUS_WRITE,command, I2C_SMBUS_BYTE_DATA, &data);}

调用了i2c_smbus_access函数，继续追踪，看i2c_smbus_access函数的定义：

static inline __s32 i2c_smbus_access(int file, char read_write, __u8 command, int size, union i2c_smbus_data *data){ struct i2c_smbus_ioctl_data args; args.read_write = read_write; args.command = command; args.size = size; args.data = data; return ioctl(file,I2C_SMBUS,&args);}

首先弄清楚参数的含义，file是使用open打开的文件。read_write表示是读操作还是写操作，这里是写，所以它的值为I2C_SMBUS_WRITE。command是要写的地址。size的值为I2C_SMBUS_BYTE_DATA。最后一个参数data.byte=要写的字节数据。

下面开始进入ioctl系统调用，最后会到达i2c-dev.c中的i2cdev_ioctl函数，看它的定义：

00000396 static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)00000397 {00000398 struct i2c_client *client = file->private_data;00000399 unsigned long funcs;00000400 00000401 dev_dbg(&client->adapter->dev, "ioctl, cmd=0x%02x, arg=0x%02lx\n",00000402 cmd, arg);00000403 00000404 switch (cmd) {00000405 case I2C_SLAVE:00000406 case I2C_SLAVE_FORCE:00000407 /* NOTE: devices set up to work with "new style" drivers00000408 * can't use I2C_SLAVE, even when the device node is not00000409 * bound to a driver. Only I2C_SLAVE_FORCE will work.00000410 *00000411 * Setting the PEC flag here won't affect kernel drivers,00000412 * which will be using the i2c_client node registered with00000413 * the driver model core. Likewise, when that client has00000414 * the PEC flag already set, the i2c-dev driver won't see00000415 * (or use) this setting.00000416 */00000417 if ((arg > 0x3ff) ||00000418 (((client->flags & I2C_M_TEN) == 0) && arg > 0x7f))00000419 return -EINVAL;00000420 if (cmd == I2C_SLAVE && i2cdev_check_addr(client->adapter, arg))00000421 return -EBUSY;00000422 /* REVISIT: address could become busy later */00000423 client->addr = arg;00000424 return 0;00000425 case I2C_TENBIT:00000426 if (arg)00000427 client->flags |= I2C_M_TEN;00000428 else00000429 client->flags &= ~I2C_M_TEN;00000430 return 0;00000431 case I2C_PEC:00000432 if (arg)00000433 client->flags |= I2C_CLIENT_PEC;00000434 else00000435 client->flags &= ~I2C_CLIENT_PEC;00000436 return 0;00000437 case I2C_FUNCS:00000438 funcs = i2c_get_functionality(client->adapter);00000439 return put_user(funcs, (unsigned long __user *)arg);00000440 00000441 case I2C_RDWR:00000442 return i2cdev_ioctl_rdrw(client, arg);00000443 00000444 case I2C_SMBUS:00000445 return i2cdev_ioctl_smbus(client, arg);00000446 00000447 case I2C_RETRIES:00000448 client->adapter->retries = arg;00000449 break;00000450 case I2C_TIMEOUT:00000451 /* For historical reasons, user-space sets the timeout00000452 * value in units of 10 ms.00000453 */00000454 client->adapter->timeout = msecs_to_jiffies(arg * 10);00000455 break;00000456 default:00000457 /* NOTE: returning a fault code here could cause trouble00000458 * in buggy userspace code. Some old kernel bugs returned00000459 * zero in this case, and userspace code might accidentally00000460 * have depended on that bug.00000461 */00000462 return -ENOTTY;00000463 }00000464 return 0;00000465 }

比较简单，根据不同的cmd执行不同的分支。由于ioctl传下来的cmd是I2C_SMBUS，因此直接看444、445行，调用i2cdev_ioctl_smbus函数：

00000311 static noinline int i2cdev_ioctl_smbus(struct i2c_client *client,00000312 unsigned long arg)00000313 {00000314 struct i2c_smbus_ioctl_data data_arg;00000315 union i2c_smbus_data temp;00000316 int datasize, res;00000317 00000318 if (copy_from_user(&data_arg,00000319 (struct i2c_smbus_ioctl_data __user *) arg,00000320 sizeof(struct i2c_smbus_ioctl_data)))00000321 return -EFAULT;00000322 if ((data_arg.size != I2C_SMBUS_BYTE) &&00000323 (data_arg.size != I2C_SMBUS_QUICK) &&00000324 (data_arg.size != I2C_SMBUS_BYTE_DATA) &&00000325 (data_arg.size != I2C_SMBUS_WORD_DATA) &&00000326 (data_arg.size != I2C_SMBUS_PROC_CALL) &&00000327 (data_arg.size != I2C_SMBUS_BLOCK_DATA) &&00000328 (data_arg.size != I2C_SMBUS_I2C_BLOCK_BROKEN) &&00000329 (data_arg.size != I2C_SMBUS_I2C_BLOCK_DATA) &&00000330 (data_arg.size != I2C_SMBUS_BLOCK_PROC_CALL)) {00000331 dev_dbg(&client->adapter->dev,00000332 "size out of range (%x) in ioctl I2C_SMBUS.\n",00000333 data_arg.size);00000334 return -EINVAL;00000335 }00000336 /* Note that I2C_SMBUS_READ and I2C_SMBUS_WRITE are 0 and 1,00000337 so the check is valid if size==I2C_SMBUS_QUICK too. */00000338 if ((data_arg.read_write != I2C_SMBUS_READ) &&00000339 (data_arg.read_write != I2C_SMBUS_WRITE)) {00000340 dev_dbg(&client->adapter->dev,00000341 "read_write out of range (%x) in ioctl I2C_SMBUS.\n",00000342 data_arg.read_write);00000343 return -EINVAL;00000344 }00000345 00000346 /* Note that command values are always valid! */00000347 00000348 if ((data_arg.size == I2C_SMBUS_QUICK) ||00000349 ((data_arg.size == I2C_SMBUS_BYTE) &&00000350 (data_arg.read_write == I2C_SMBUS_WRITE)))00000351 /* These are special: we do not use data */00000352 return i2c_smbus_xfer(client->adapter, client->addr,00000353 client->flags, data_arg.read_write,00000354 data_arg.command, data_arg.size, NULL);00000355 00000356 if (data_arg.data == NULL) {00000357 dev_dbg(&client->adapter->dev,00000358 "data is NULL pointer in ioctl I2C_SMBUS.\n");00000359 return -EINVAL;00000360 }00000361 00000362 if ((data_arg.size == I2C_SMBUS_BYTE_DATA) ||00000363 (data_arg.size == I2C_SMBUS_BYTE))00000364 datasize = sizeof(data_arg.data->byte);00000365 else if ((data_arg.size == I2C_SMBUS_WORD_DATA) ||00000366 (data_arg.size == I2C_SMBUS_PROC_CALL))00000367 datasize = sizeof(data_arg.data->word);00000368 else /* size == smbus block, i2c block, or block proc. call */00000369 datasize = sizeof(data_arg.data->block);00000370 00000371 if ((data_arg.size == I2C_SMBUS_PROC_CALL) ||00000372 (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||00000373 (data_arg.size == I2C_SMBUS_I2C_BLOCK_DATA) ||00000374 (data_arg.read_write == I2C_SMBUS_WRITE)) {00000375 if (copy_from_user(&temp, data_arg.data, datasize))00000376 return -EFAULT;00000377 }00000378 if (data_arg.size == I2C_SMBUS_I2C_BLOCK_BROKEN) {00000379 /* Convert old I2C block commands to the new00000380 convention. This preserves binary compatibility. */00000381 data_arg.size = I2C_SMBUS_I2C_BLOCK_DATA;00000382 if (data_arg.read_write == I2C_SMBUS_READ)00000383 temp.block[0] = I2C_SMBUS_BLOCK_MAX;00000384 }00000385 res = i2c_smbus_xfer(client->adapter, client->addr, client->flags,00000386 data_arg.read_write, data_arg.command, data_arg.size, &temp);00000387 if (!res && ((data_arg.size == I2C_SMBUS_PROC_CALL) ||00000388 (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||00000389 (data_arg.read_write == I2C_SMBUS_READ))) {00000390 if (copy_to_user(data_arg.data, &temp, datasize))00000391 return -EFAULT;00000392 }00000393 return res;00000394 }

一大堆的if判断。318行，调用copy_from_user函数将用户空间的数据拷贝到内核空间。这样data_arg的内容就与ioctl第三个参数的内容是一样的了。

322至335行，都是判断，一路走来，我们知道data_arg.size的值为I2C_SMBUS_BYTE_DATA，所以这里的if条件不会成立。

338至344行，如果既不是读操作又不是写操作，那肯定不行，返回出错。

348行，由于不满足第一个条件，所以不会执行if里的语句。

356至360行，我们的data_arg.data是不为NULL的，可以继续往下执行。

362行，data_arg.size == I2C_SMBUS_BYTE_DATA这个条件满足，所以执行364行的语句，因此datasize的值为1。

371行，由于满足data_arg.read_write == I2C_SMBUS_WRITE这个条件，所以执行375行语句，将data_arg.data的第一个字节拷贝到temp变量中。

378行，条件不满足，略过。

先看387行，条件不满足，因此就剩下385行的i2c_smbus_xfer函数，下面看它在drivers/i2c/i2c-core.c中的定义：

00002066 s32 i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr, unsigned short flags,00002067 char read_write, u8 command, int protocol,00002068 union i2c_smbus_data *data)00002069 {00002070 unsigned long orig_jiffies;00002071 int try;00002072 s32 res;00002073 00002074 flags &= I2C_M_TEN | I2C_CLIENT_PEC;00002075 00002076 if (adapter->algo->smbus_xfer) {00002077 i2c_lock_adapter(adapter);00002078 00002079 /* Retry automatically on arbitration loss */00002080 orig_jiffies = jiffies;00002081 for (res = 0, try = 0; try <= adapter->retries; try++) {00002082 res = adapter->algo->smbus_xfer(adapter, addr, flags,00002083 read_write, command,00002084 protocol, data);00002085 if (res != -EAGAIN)00002086 break;00002087 if (time_after(jiffies,00002088 orig_jiffies + adapter->timeout))00002089 break;00002090 }00002091 i2c_unlock_adapter(adapter);00002092 } else00002093 res = i2c_smbus_xfer_emulated(adapter, addr, flags, read_write,00002094 command, protocol, data);00002095 00002096 return res;00002097 }

2076行，对于s3c6410的IIC控制器驱动来说，没有定义smbus_xfer函数，因此执行2093行的i2c_smbus_xfer_emulated函数，它的定义如下：

00001889 static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,00001890 unsigned short flags,00001891 char read_write, u8 command, int size,00001892 union i2c_smbus_data *data)00001893 {00001894 /* So we need to generate a series of msgs. In the case of writing, we00001895 need to use only one message; when reading, we need two. We initialize00001896 most things with sane defaults, to keep the code below somewhat00001897 simpler. */00001898 unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+3];00001899 unsigned char msgbuf1[I2C_SMBUS_BLOCK_MAX+2];00001900 int num = read_write == I2C_SMBUS_READ ? 2 : 1;00001901 struct i2c_msg msg[2] = { { addr, flags, 1, msgbuf0 },00001902 { addr, flags | I2C_M_RD, 0, msgbuf1 }00001903 };00001904 int i;00001905 u8 partial_pec = 0;00001906 int status;00001907 00001908 msgbuf0[0] = command;00001909 switch (size) {00001910 case I2C_SMBUS_QUICK:00001911 msg[0].len = 0;00001912 /* Special case: The read/write field is used as data */00001913 msg[0].flags = flags | (read_write == I2C_SMBUS_READ ?00001914 I2C_M_RD : 0);00001915 num = 1;00001916 break;00001917 case I2C_SMBUS_BYTE:00001918 if (read_write == I2C_SMBUS_READ) {00001919 /* Special case: only a read! */00001920 msg[0].flags = I2C_M_RD | flags;00001921 num = 1;00001922 }00001923 break;00001924 case I2C_SMBUS_BYTE_DATA:00001925 if (read_write == I2C_SMBUS_READ)00001926 msg[1].len = 1;00001927 else {00001928 msg[0].len = 2;00001929 msgbuf0[1] = data->byte;00001930 }00001931 break;00001932 case I2C_SMBUS_WORD_DATA:00001933 if (read_write == I2C_SMBUS_READ)00001934 msg[1].len = 2;00001935 else {00001936 msg[0].len = 3;00001937 msgbuf0[1] = data->word & 0xff;00001938 msgbuf0[2] = data->word >> 8;00001939 }00001940 break;00001941 case I2C_SMBUS_PROC_CALL:00001942 num = 2; /* Special case */00001943 read_write = I2C_SMBUS_READ;00001944 msg[0].len = 3;00001945 msg[1].len = 2;00001946 msgbuf0[1] = data->word & 0xff;00001947 msgbuf0[2] = data->word >> 8;00001948 break;00001949 case I2C_SMBUS_BLOCK_DATA:00001950 if (read_write == I2C_SMBUS_READ) {00001951 msg[1].flags |= I2C_M_RECV_LEN;00001952 msg[1].len = 1; /* block length will be added by00001953 the underlying bus driver */00001954 } else {00001955 msg[0].len = data->block[0] + 2;00001956 if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 2) {00001957 dev_err(&adapter->dev,00001958 "Invalid block write size %d\n",00001959 data->block[0]);00001960 return -EINVAL;00001961 }00001962 for (i = 1; i < msg[0].len; i++)00001963 msgbuf0[i] = data->block[i-1];00001964 }00001965 break;00001966 case I2C_SMBUS_BLOCK_PROC_CALL:00001967 num = 2; /* Another special case */00001968 read_write = I2C_SMBUS_READ;00001969 if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {00001970 dev_err(&adapter->dev,00001971 "Invalid block write size %d\n",00001972 data->block[0]);00001973 return -EINVAL;00001974 }00001975 msg[0].len = data->block[0] + 2;00001976 for (i = 1; i < msg[0].len; i++)00001977 msgbuf0[i] = data->block[i-1];00001978 msg[1].flags |= I2C_M_RECV_LEN;00001979 msg[1].len = 1; /* block length will be added by00001980 the underlying bus driver */00001981 break;00001982 case I2C_SMBUS_I2C_BLOCK_DATA:00001983 if (read_write == I2C_SMBUS_READ) {00001984 msg[1].len = data->block[0];00001985 } else {00001986 msg[0].len = data->block[0] + 1;00001987 if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {00001988 dev_err(&adapter->dev,00001989 "Invalid block write size %d\n",00001990 data->block[0]);00001991 return -EINVAL;00001992 }00001993 for (i = 1; i <= data->block[0]; i++)00001994 msgbuf0[i] = data->block[i];00001995 }00001996 break;00001997 default:00001998 dev_err(&adapter->dev, "Unsupported transaction %d\n", size);00001999 return -EOPNOTSUPP;00002000 }00002001 00002002 i = ((flags & I2C_CLIENT_PEC) && size != I2C_SMBUS_QUICK00002003 && size != I2C_SMBUS_I2C_BLOCK_DATA);00002004 if (i) {00002005 /* Compute PEC if first message is a write */00002006 if (!(msg[0].flags & I2C_M_RD)) {00002007 if (num == 1) /* Write only */00002008 i2c_smbus_add_pec(&msg[0]);00002009 else /* Write followed by read */00002010 partial_pec = i2c_smbus_msg_pec(0, &msg[0]);00002011 }00002012 /* Ask for PEC if last message is a read */00002013 if (msg[num-1].flags & I2C_M_RD)00002014 msg[num-1].len++;00002015 }00002016 00002017 status = i2c_transfer(adapter, msg, num);00002018 if (status < 0)00002019 return status;00002020 00002021 /* Check PEC if last message is a read */00002022 if (i && (msg[num-1].flags & I2C_M_RD)) {00002023 status = i2c_smbus_check_pec(partial_pec, &msg[num-1]);00002024 if (status < 0)00002025 return status;00002026 }00002027 00002028 if (read_write == I2C_SMBUS_READ)00002029 switch (size) {00002030 case I2C_SMBUS_BYTE:00002031 data->byte = msgbuf0[0];00002032 break;00002033 case I2C_SMBUS_BYTE_DATA:00002034 data->byte = msgbuf1[0];00002035 break;00002036 case I2C_SMBUS_WORD_DATA:00002037 case I2C_SMBUS_PROC_CALL:00002038 data->word = msgbuf1[0] | (msgbuf1[1] << 8);00002039 break;00002040 case I2C_SMBUS_I2C_BLOCK_DATA:00002041 for (i = 0; i < data->block[0]; i++)00002042 data->block[i+1] = msgbuf1[i];00002043 break;00002044 case I2C_SMBUS_BLOCK_DATA:00002045 case I2C_SMBUS_BLOCK_PROC_CALL:00002046 for (i = 0; i < msgbuf1[0] + 1; i++)00002047 data->block[i] = msgbuf1[i];00002048 break;00002049 }00002050 return 0;00002051 }

函数很长，但是逻辑却很简单。1898行，定义msgbuf0数组用作写操作，里面放的是要写的数据，后面会看到。

1899行，定义msgbuf1数组用作读操作，这里讨论的是写操作，因此略过与读操作相关的内容。

1900行，因为read_write=I2C_SMBUS_WRITE，所以num的值为1。

1901行，定义2个message数组，同样，一个用作写，一个用作读。

1908行，msgbuf0[0] = command，即要写数据的地址。

1909行，switch(size)，由于size的值为I2C_SMBUS_BYTE_DATA，所以1924行的条件成立。

1925行，条件不成立，因此直接到1928行，msg[0].len = 2，写一字节地址和写一个字节数据加起来刚好是2字节。1929行，msgbuf0[1] = data->byte，即要写入的数据。

2002至2015行，与错误检测相关的，略过它不会有什么影响。

先看2022至2050行，都是与读操作相关的，因此不说了。

再看2017行，调用i2c_transfer函数来进行传输，i2c_transfer函数的定义：

00001281 int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)00001282 {00001283 unsigned long orig_jiffies;00001284 int ret, try;00001285 00001286 /* REVISIT the fault reporting model here is weak:00001287 *00001288 * - When we get an error after receiving N bytes from a slave,00001289 * there is no way to report "N".00001290 *00001291 * - When we get a NAK after transmitting N bytes to a slave,00001292 * there is no way to report "N" ... or to let the master00001293 * continue executing the rest of this combined message, if00001294 * that's the appropriate response.00001295 *00001296 * - When for example "num" is two and we successfully complete00001297 * the first message but get an error part way through the00001298 * second, it's unclear whether that should be reported as00001299 * one (discarding status on the second message) or errno00001300 * (discarding status on the first one).00001301 */00001302 00001303 if (adap->algo->master_xfer) {00001304 #ifdef DEBUG00001305 for (ret = 0; ret < num; ret++) {00001306 dev_dbg(&adap->dev, "master_xfer[%d] %c, addr=0x%02x, "00001307 "len=%d%s\n", ret, (msgs[ret].flags & I2C_M_RD)00001308 ? 'R' : 'W', msgs[ret].addr, msgs[ret].len,00001309 (msgs[ret].flags & I2C_M_RECV_LEN) ? "+" : "");00001310 }00001311 #endif00001312 00001313 if (in_atomic() || irqs_disabled()) {00001314 ret = i2c_trylock_adapter(adap);00001315 if (!ret)00001316 /* I2C activity is ongoing. */00001317 return -EAGAIN;00001318 } else {00001319 i2c_lock_adapter(adap);00001320 }00001321 00001322 /* Retry automatically on arbitration loss */00001323 orig_jiffies = jiffies;00001324 for (ret = 0, try = 0; try <= adap->retries; try++) {00001325 ret = adap->algo->master_xfer(adap, msgs, num);00001326 if (ret != -EAGAIN)00001327 break;00001328 if (time_after(jiffies, orig_jiffies + adap->timeout))00001329 break;00001330 }00001331 i2c_unlock_adapter(adap);00001332 00001333 return ret;00001334 } else {00001335 dev_dbg(&adap->dev, "I2C level transfers not supported\n");00001336 return -EOPNOTSUPP;00001337 }00001338 }

一看，呆了眼，函数里面竟然有这么多注释。

1303行，master_xfer这个指针是有赋值的，因此执行if里面的语句。

1304至1311行，调试相关的，打印一些调试信息。

1313至1320行，锁住当前的适配器。

1324行，adap->retries的值在IIC控制器初始化的时候就设置为2，因此重试2次。

1325行，调用的是drivers/i2c/busses/i2c-s3c2410.c里的s3c24xx_i2c_xfer函数，它的定义：

00000551 static int s3c24xx_i2c_xfer(struct i2c_adapter *adap,00000552 struct i2c_msg *msgs, int num)00000553 {00000554 struct s3c24xx_i2c *i2c = (struct s3c24xx_i2c *)adap->algo_data;00000555 int retry;00000556 int ret;00000557 00000558 for (retry = 0; retry < adap->retries; retry++) {00000559 00000560 ret = s3c24xx_i2c_doxfer(i2c, msgs, num);00000561 00000562 if (ret != -EAGAIN)00000563 return ret;00000564 00000565 dev_dbg(i2c->dev, "Retrying transmission (%d)\n", retry);00000566 00000567 udelay(100);00000568 }00000569 00000570 return -EREMOTEIO;00000571 }

558行，又重试2次。

560行，调用s3c24xx_i2c_doxfer函数：

00000482 static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,00000483 struct i2c_msg *msgs, int num)00000484 {00000485 unsigned long iicstat, timeout;00000486 int spins = 20;00000487 int ret;00000488 00000489 if (i2c->suspended)00000490 return -EIO;00000491 00000492 ret = s3c24xx_i2c_set_master(i2c);00000493 if (ret != 0) {00000494 dev_err(i2c->dev, "cannot get bus (error %d)\n", ret);00000495 ret = -EAGAIN;00000496 goto out;00000497 }00000498 00000499 spin_lock_irq(&i2c->lock);00000500 00000501 i2c->msg = msgs;00000502 i2c->msg_num = num;00000503 i2c->msg_ptr = 0;00000504 i2c->msg_idx = 0;00000505 i2c->state = STATE_START;00000506 00000507 s3c24xx_i2c_enable_irq(i2c);00000508 s3c24xx_i2c_message_start(i2c, msgs);00000509 spin_unlock_irq(&i2c->lock);00000510 00000511 timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);00000512 00000513 ret = i2c->msg_idx;00000514 00000515 /* having these next two as dev_err() makes life very00000516 * noisy when doing an i2cdetect */00000517 00000518 if (timeout == 0)00000519 dev_dbg(i2c->dev, "timeout\n");00000520 else if (ret != num)00000521 dev_dbg(i2c->dev, "incomplete xfer (%d)\n", ret);00000522 00000523 /* ensure the stop has been through the bus */00000524 00000525 dev_dbg(i2c->dev, "waiting for bus idle\n");00000526 00000527 /* first, try busy waiting briefly */00000528 do {00000529 iicstat = readl(i2c->regs + S3C2410_IICSTAT);00000530 } while ((iicstat & S3C2410_IICSTAT_START) && --spins);00000531 00000532 /* if that timed out sleep */00000533 if (!spins) {00000534 msleep(1);00000535 iicstat = readl(i2c->regs + S3C2410_IICSTAT);00000536 }00000537 00000538 if (iicstat & S3C2410_IICSTAT_START)00000539 dev_warn(i2c->dev, "timeout waiting for bus idle\n");00000540 00000541 out:00000542 return ret;00000543 }

489行，如果IIC控制器挂起了的话就不用往下走了，返回出错。

492至497行，调用s3c24xx_i2c_set_master函数，读取IICSTAT寄存器，等待IIC总线空闲。

501至505行，记住这些变量的值，后面的分析会遇到。

507行，使能IIC控制器中断。

508行，调用s3c24xx_i2c_message_start函数开始读写操作，它的定义如下：

00000163 static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c,00000164 struct i2c_msg *msg)00000165 {00000166 unsigned int addr = (msg->addr & 0x7f) << 1;00000167 unsigned long stat;00000168 unsigned long iiccon;00000169 00000170 stat = 0;00000171 stat |= S3C2410_IICSTAT_TXRXEN;00000172 00000173 if (msg->flags & I2C_M_RD) {00000174 stat |= S3C2410_IICSTAT_MASTER_RX;00000175 addr |= 1;00000176 } else00000177 stat |= S3C2410_IICSTAT_MASTER_TX;00000178 00000179 if (msg->flags & I2C_M_REV_DIR_ADDR)00000180 addr ^= 1;00000181 00000182 /* todo - check for wether ack wanted or not */00000183 s3c24xx_i2c_enable_ack(i2c);00000184 00000185 iiccon = readl(i2c->regs + S3C2410_IICCON);00000186 writel(stat, i2c->regs + S3C2410_IICSTAT);00000187 00000188 dev_dbg(i2c->dev, "START: %08lx to IICSTAT, %02x to DS\n", stat, addr);00000189 writeb(addr, i2c->regs + S3C2410_IICDS);00000190 00000191 /* delay here to ensure the data byte has gotten onto the bus00000192 * before the transaction is started */00000193 00000194 ndelay(i2c->tx_setup);00000195 00000196 dev_dbg(i2c->dev, "iiccon, %08lx\n", iiccon);00000197 writel(iiccon, i2c->regs + S3C2410_IICCON);00000198 00000199 stat |= S3C2410_IICSTAT_START;00000200 writel(stat, i2c->regs + S3C2410_IICSTAT);00000201 }

166行，高7位表示从机地址，最低1位表示读或写操作，0表示写，1表示读。

171行，IIC控制器发送和接收使能。

173行，条件不成立，所以执行177行，主机发送使能。

179行，与读操作相关的，因此if条件不成立。

183行，使能IIC控制器ACK应答。

剩下那些语句基本上都是在操作IIC控制器的寄存器，具体含义请看s3c6410的数据手册。

189行，将从机地址写入移位寄存器。

s3c24xx_i2c_message_start函数执行完后硬件就开始进行数据传输，回到s3c24xx_i2c_doxfer函数的第509行，释放锁，与499行是配对使用的。

511行，等待，等待传输操作完成，等待，只因曾经承若。有两种情况会唤醒它，一是超时，二是传输完成。

程序是在等待了，但我们的步伐却不会因此而停留，前面还有很长的路等着我们呢，还等什么，继续前进！

接下来看等待过程中发生的事情，没错，就是在中断里。中断处理函数是s3c24xx_i2c_irq，它的定义：

00000423 static irqreturn_t s3c24xx_i2c_irq(int irqno, void *dev_id)00000424 {00000425 struct s3c24xx_i2c *i2c = dev_id;00000426 unsigned long status;00000427 unsigned long tmp;00000428 00000429 status = readl(i2c->regs + S3C2410_IICSTAT);00000430 00000431 if (status & S3C2410_IICSTAT_ARBITR) {00000432 /* deal with arbitration loss */00000433 dev_err(i2c->dev, "deal with arbitration loss\n");00000434 }00000435 00000436 if (i2c->state == STATE_IDLE) {00000437 dev_dbg(i2c->dev, "IRQ: error i2c->state == IDLE\n");00000438 00000439 tmp = readl(i2c->regs + S3C2410_IICCON);00000440 tmp &= ~S3C2410_IICCON_IRQPEND;00000441 writel(tmp, i2c->regs + S3C2410_IICCON);00000442 goto out;00000443 }00000444 00000445 /* pretty much this leaves us with the fact that we've00000446 * transmitted or received whatever byte we last sent */00000447 00000448 i2s_s3c_irq_nextbyte(i2c, status);00000449 00000450 out:00000451 return IRQ_HANDLED;00000452 }

429行，读取状态寄存器。

431至434行，如果总线仲裁失败就打印错误信息。

436至443行，我们知道i2c->state是等于STATE_START的，因此这里的if条件不成立。

448行，i2s_s3c_irq_nextbyte函数执行具体中断处理，i2s_s3c_irq_nextbyte函数的定义：

00000257 static int i2s_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)00000258 {00000259 unsigned long tmp;00000260 unsigned char byte;00000261 int ret = 0;00000262 00000263 switch (i2c->state) {00000264 00000265 case STATE_IDLE:00000266 dev_err(i2c->dev, "%s: called in STATE_IDLE\n", __func__);00000267 goto out;00000268 break;00000269 00000270 case STATE_STOP:00000271 dev_err(i2c->dev, "%s: called in STATE_STOP\n", __func__);00000272 s3c24xx_i2c_disable_irq(i2c);00000273 goto out_ack;00000274 00000275 case STATE_START:00000276 /* last thing we did was send a start condition on the00000277 * bus, or started a new i2c message00000278 */00000279 00000280 if (iicstat & S3C2410_IICSTAT_LASTBIT &&00000281 !(i2c->msg->flags & I2C_M_IGNORE_NAK)) {00000282 /* ack was not received... */00000283 00000284 dev_dbg(i2c->dev, "ack was not received\n");00000285 s3c24xx_i2c_stop(i2c, -ENXIO);00000286 goto out_ack;00000287 }00000288 00000289 if (i2c->msg->flags & I2C_M_RD)00000290 i2c->state = STATE_READ;00000291 else00000292 i2c->state = STATE_WRITE;00000293 00000294 /* terminate the transfer if there is nothing to do00000295 * as this is used by the i2c probe to find devices. */00000296 00000297 if (is_lastmsg(i2c) && i2c->msg->len == 0) {00000298 s3c24xx_i2c_stop(i2c, 0);00000299 goto out_ack;00000300 }00000301 00000302 if (i2c->state == STATE_READ)00000303 goto prepare_read;00000304 00000305 /* fall through to the write state, as we will need to00000306 * send a byte as well */00000307 00000308 case STATE_WRITE:00000309 /* we are writing data to the device... check for the00000310 * end of the message, and if so, work out what to do00000311 */00000312 00000313 if (!(i2c->msg->flags & I2C_M_IGNORE_NAK)) {00000314 if (iicstat & S3C2410_IICSTAT_LASTBIT) {00000315 dev_dbg(i2c->dev, "WRITE: No Ack\n");00000316 00000317 s3c24xx_i2c_stop(i2c, -ECONNREFUSED);00000318 goto out_ack;00000319 }00000320 }00000321 00000322 retry_write:00000323 00000324 if (!is_msgend(i2c)) {00000325 byte = i2c->msg->buf[i2c->msg_ptr++];00000326 writeb(byte, i2c->regs + S3C2410_IICDS);00000327 00000328 /* delay after writing the byte to allow the00000329 * data setup time on the bus, as writing the00000330 * data to the register causes the first bit00000331 * to appear on SDA, and SCL will change as00000332 * soon as the interrupt is acknowledged */00000333 00000334 ndelay(i2c->tx_setup);00000335 00000336 } else if (!is_lastmsg(i2c)) {00000337 /* we need to go to the next i2c message */00000338 00000339 dev_dbg(i2c->dev, "WRITE: Next Message\n");00000340 00000341 i2c->msg_ptr = 0;00000342 i2c->msg_idx++;00000343 i2c->msg++;00000344 00000345 /* check to see if we need to do another message */00000346 if (i2c->msg->flags & I2C_M_NOSTART) {00000347 00000348 if (i2c->msg->flags & I2C_M_RD) {00000349 /* cannot do this, the controller00000350 * forces us to send a new START00000351 * when we change direction */00000352 00000353 s3c24xx_i2c_stop(i2c, -EINVAL);00000354 }00000355 00000356 goto retry_write;00000357 } else {00000358 /* send the new start */00000359 s3c24xx_i2c_message_start(i2c, i2c->msg);00000360 i2c->state = STATE_START;00000361 }00000362 00000363 } else {00000364 /* send stop */00000365 00000366 s3c24xx_i2c_stop(i2c, 0);00000367 }00000368 break;00000369 00000370 case STATE_READ:00000371 /* we have a byte of data in the data register, do00000372 * something with it, and then work out wether we are00000373 * going to do any more read/write00000374 */00000375 00000376 byte = readb(i2c->regs + S3C2410_IICDS);00000377 i2c->msg->buf[i2c->msg_ptr++] = byte;00000378 00000379 prepare_read:00000380 if (is_msglast(i2c)) {00000381 /* last byte of buffer */00000382 00000383 if (is_lastmsg(i2c))00000384 s3c24xx_i2c_disable_ack(i2c);00000385 00000386 } else if (is_msgend(i2c)) {00000387 /* ok, we've read the entire buffer, see if there00000388 * is anything else we need to do */00000389 00000390 if (is_lastmsg(i2c)) {00000391 /* last message, send stop and complete */00000392 dev_dbg(i2c->dev, "READ: Send Stop\n");00000393 00000394 s3c24xx_i2c_stop(i2c, 0);00000395 } else {00000396 /* go to the next transfer */00000397 dev_dbg(i2c->dev, "READ: Next Transfer\n");00000398 00000399 i2c->msg_ptr = 0;00000400 i2c->msg_idx++;00000401 i2c->msg++;00000402 }00000403 }00000404 00000405 break;00000406 }00000407 00000408 /* acknowlegde the IRQ and get back on with the work */00000409 00000410 out_ack:00000411 tmp = readl(i2c->regs + S3C2410_IICCON);00000412 tmp &= ~S3C2410_IICCON_IRQPEND;00000413 writel(tmp, i2c->regs + S3C2410_IICCON);00000414 out:00000415 return ret;00000416 }

函数够长的，不过一路走来，早就已经习惯了。

263行，因为i2c->state=STATE_START，因此忽略其他case，直接从275行开始看。

280行，如果没有收到ACK信号并且没有设置忽略ACK则停止这次传输。

289行，if条件不成立，执行292行，i2c->state = STATE_WRITE。

297行，is_lastmsg函数的定义：

00000227 static inline int is_lastmsg(struct s3c24xx_i2c *i2c)00000228 {00000229 return i2c->msg_idx >= (i2c->msg_num - 1);00000230 }

因为i2c->msg_idx=0，i2c->msg_num=1，所以返回1。但是i2c->msg->len=2不为0，所以297行的if条件不成立。

302行，if条件不成立。

注意，这个case里没有并没有break，因此会继续往下执行。

313至320行，也是没收到ACK条件才会成立的。

324行，is_msgend函数的定义：

00000247 static inline int is_msgend(struct s3c24xx_i2c *i2c)00000248 {00000249 return i2c->msg_ptr >= i2c->msg->len;00000250 }

因为i2c->msg_ptr=0，i2c->msg->len=2，因此返回0。324行的if条件成立。

325行，读取第一个要写的字节数据，然后i2c->msg_ptr= i2c->msg_ptr +1。

326行，将数据写入移位寄存器。

334行，延时一下。

368行，跳出switch，到411行。

411至413行，清除pending标志，恢复IIC传输。

下一次进中断的时候会进入308行的case，经过313至320行的判断后来到324行，这次is_msgend函数还是会返回0。325行，读取下一个字节数据，326行，将数据写入移位寄存器，过程和前面的一样。

当第三次进中断的时候，324行的条件就不会成立了，并且336行的if条件也不会成立，因此就会执行366行的s3c24xx_i2c_stop函数，它的定义如下：

00000203 static inline void s3c24xx_i2c_stop(struct s3c24xx_i2c *i2c, int ret)00000204 {00000205 unsigned long iicstat = readl(i2c->regs + S3C2410_IICSTAT);00000206 00000207 dev_dbg(i2c->dev, "STOP\n");00000208 00000209 /* stop the transfer */00000210 iicstat &= ~S3C2410_IICSTAT_START;00000211 writel(iicstat, i2c->regs + S3C2410_IICSTAT);00000212 00000213 i2c->state = STATE_STOP;00000214 00000215 s3c24xx_i2c_master_complete(i2c, ret);00000216 s3c24xx_i2c_disable_irq(i2c);00000217 }

205行，读取状态寄存器。

210、211行，发送停止信号。

213行，i2c->state = STATE_STOP。

215行，调用s3c24xx_i2c_master_complete函数。

216行，禁止IIC控制器中断。下面看s3c24xx_i2c_master_complete函数的定义：

00000109 static inline void s3c24xx_i2c_master_complete(struct s3c24xx_i2c *i2c, int ret)00000110 {00000111 dev_dbg(i2c->dev, "master_complete %d\n", ret);00000112 00000113 i2c->msg_ptr = 0;00000114 i2c->msg = NULL;00000115 i2c->msg_idx++;00000116 i2c->msg_num = 0;00000117 if (ret)00000118 i2c->msg_idx = ret;00000119 00000120 wake_up(&i2c->wait);00000121 }

113至118行，不用说了。

120行，唤醒那个睡着了的她，谁？就是那个“承若”。忘记了的话就回去看看呗。

至此，可以说ioctl的整个写过程已经说完了，至于读过程就不说了。累，确实有点累。

结束语

i2c-dev.c提供了一套不依赖于具体平台的驱动，让具体的驱动逻辑放在应用程序中，和SPI中的spidev.c的作用是很类似的。