现从fsg_bind()讲起。
//不失一般性，删掉错误处理和configfs相关代码 static int fsg_bind(struct usb_configuration *c, struct usb_function *f) { struct fsg_dev *fsg = fsg_from_func(f); struct fsg_common *common = fsg->common; struct usb_gadget *gadget = c->cdev->gadget; int i; struct usb_ep *ep; unsigned max_burst; int ret; struct fsg_opts *opts; /* Don't allow to bind if we don't have at least one LUN */ ret = _fsg_common_get_max_lun(common); opts = fsg_opts_from_func_inst(f->fi); if (!common->thread_task) { common->state = FSG_STATE_IDLE; common->thread_task = kthread_create(fsg_main_thread, common, "file-storage"); if (IS_ERR(common->thread_task)) { ... } wake_up_process(common->thread_task); } fsg->gadget = gadget; /* New interface */ i = usb_interface_id(c, f); fsg_intf_desc.bInterfaceNumber = i; fsg->interface_number = i; /* Find all the endpoints we will use */ ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc); fsg->bulk_in = ep; ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc); fsg->bulk_out = ep; /* Assume endpoint addresses are the same for both speeds */ fsg_hs_bulk_in_desc.bEndpointAddress = fsg_fs_bulk_in_desc.bEndpointAddress; fsg_hs_bulk_out_desc.bEndpointAddress = fsg_fs_bulk_out_desc.bEndpointAddress; /* Calculate bMaxBurst, we know packet size is 1024 */ max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15); fsg_ss_bulk_in_desc.bEndpointAddress = fsg_fs_bulk_in_desc.bEndpointAddress; fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst; fsg_ss_bulk_out_desc.bEndpointAddress = fsg_fs_bulk_out_desc.bEndpointAddress; fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst; ret = usb_assign_descriptors(f, fsg_fs_function, fsg_hs_function, fsg_ss_function); ... return 0; }可以看到该函数主要是通过kthread_create+wake_up_process的组合创建了一个内核线程fsg_main_thread，名称是"file-storage"，通过shell的ps可以看到。另外就是利用usb_interface_id()分配一个接口号，填充进接口描述符，以便在设备枚举时返回给usb host，最后利用composite.c框架所创建的gadget对象对U盘的IN/OUT端点初始化：
//storage_common.c /* * Three full-speed endpoint descriptors: bulk-in, bulk-out, and * interrupt-in. */ struct usb_endpoint_descriptor fsg_fs_bulk_in_desc = { .bLength = USB_DT_ENDPOINT_SIZE, .bDescriptorType = USB_DT_ENDPOINT, .bEndpointAddress = USB_DIR_IN, .bmAttributes = USB_ENDPOINT_XFER_BULK, /* wMaxPacketSize set by autoconfiguration */ }; struct usb_endpoint_descriptor fsg_fs_bulk_out_desc = { .bLength = USB_DT_ENDPOINT_SIZE, .bDescriptorType = USB_DT_ENDPOINT, .bEndpointAddress = USB_DIR_OUT, .bmAttributes = USB_ENDPOINT_XFER_BULK, /* wMaxPacketSize set by autoconfiguration */ }; /* Find all the endpoints we will use */ ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc); fsg->bulk_in = ep; ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc); fsg->bulk_out = ep;因为只有端点（fifo）初始化完，未来才可以利用由usb_ep_queue()传输usb数据，而我们的U盘gadget驱动就利用usb_ep_queue()封装而成以下两个函数用于传输U盘数据：
static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh); static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh);
当然现在只是初始化，U盘还不能正常工作，毕竟现在连fsg_setup()都没有调用！也就是说还没被usb host枚举到，也没有SetConfiguration()等操作。那究竟什么时候调用fsg_setup()回调？？
事实上，我们无需关心，因为在composite.c（libcomposite.ko）框架已经帮我们处理好细节了，在composite_setup()函数中被处理，该函数处于中断上下文中，不要放入sleep或者切换调度之类的代码。相当于当我们插入我们的U盘到PC上，它就会在composite_setup()回调我们的fsg_setup()。
fsg_setup()中主要处理了两个Mass Storage Class相关的请求：US_BULK_RESET_REQUEST和US_BULK_GET_MAX_LUN，这些请求都是由usb host（电脑的U盘驱动）下发给U盘的，U盘只有按要求处理即可。
想要深入理解gadget，还是需要仔细阅读libcomposite.c（libcomposite.ko）的实现，否则我们就只会调调gadget的api，以后我再讲解libcomposite.ko和udc驱动的流程。
下面主要分析fsg_main_thread()；基本上U盘的所有读写操作都是靠它完成，十分重要的一个函数！
static int fsg_main_thread(void *common_) { struct fsg_common *common = common_; /* * Allow the thread to be killed by a signal, but set the signal mask * to block everything but INT, TERM, KILL, and USR1. */ allow_signal(SIGINT); allow_signal(SIGTERM); allow_signal(SIGKILL); allow_signal(SIGUSR1); /* Allow the thread to be frozen */ set_freezable(); /* * Arrange for userspace references to be interpreted as kernel * pointers. That way we can pass a kernel pointer to a routine * that expects a __user pointer and it will work okay. */ set_fs(get_ds()); /* The main loop */ while (common->state != FSG_STATE_TERMINATED) { if (exception_in_progress(common) || signal_pending(current)) { handle_exception(common); continue; } if (!common->running) { sleep_thread(common, true); continue; } if (get_next_command(common)) continue; spin_lock_irq(&common->lock); if (!exception_in_progress(common)) common->state = FSG_STATE_DATA_PHASE; spin_unlock_irq(&common->lock); if (do_scsi_command(common) || finish_reply(common)) continue; spin_lock_irq(&common->lock); if (!exception_in_progress(common)) common->state = FSG_STATE_STATUS_PHASE; spin_unlock_irq(&common->lock); if (send_status(common)) continue; spin_lock_irq(&common->lock); if (!exception_in_progress(common)) common->state = FSG_STATE_IDLE; spin_unlock_irq(&common->lock); } spin_lock_irq(&common->lock); common->thread_task = NULL; spin_unlock_irq(&common->lock); if (!common->ops || !common->ops->thread_exits || common->ops->thread_exits(common) < 0) { int i; down_write(&common->filesem); for (i = 0; i < ARRAY_SIZE(common->luns); --i) { struct fsg_lun *curlun = common->luns[i]; if (!curlun || !fsg_lun_is_open(curlun)) continue; fsg_lun_close(curlun); curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT; } up_write(&common->filesem); } /* Let fsg_unbind() know the thread has exited */ complete_and_exit(&common->thread_notifier, 0); }它先是声明可以被信号kill调该内核线程，以及能冻结，譬如kiill -STOP、kill -CONT之类的。它主要是靠如下几个函数工作：get_next_command(common)
do_scsi_command(common) || finish_reply(common)
和send_status(common)
Bulk only 的传输协议可阅读《usbmassbulk_10.pdf》文档，下面只是截取其中一部分：
和
以及阅读SCSI命令文档。本U盘gadget只是实现其中一些常用的SCSI命令子集而已，我们就挑读（READ_10）和写（WRITE_10）这两个操作：
和
可以看到主要是do_read和do_write。因为流程比较繁杂，这里只简单描述，有兴趣的朋友可以逐行代码分析研究，do_write()是通过start_out_transfer()从usb host获取到文件数据，然后调用vfs_write()写入文件系统，完成了将文件写入U盘的过程；而do_read()则是先通过vfs_read()从文件系统（加载驱动时指定的文件路径file=filename[,filename...]）中读取文件，然后调用start_in_transfer()写入usb host，完成了读取U盘内的文件到PC。
终于把U盘gadget驱动讲解了一遍，当然只是粗略走读了一下，代码细节上还是需要大家仔细研究，譬如没有深入到composite.c（libcomposite.ko）gadget框架的具体实现，U盘方面也没有细节到每个SCSI命令的讲解，以及没有讲解CBW/CSW的细节处理（有兴趣可以对照《usbmassbulk_10.pdf》阅读代码）等。
