Android之 MTP框架和流程分析 (3)

阿新 • • 發佈：2019-01-17

前面轉發了篇部落格介紹了MTP, 偏重於上層，已經很清楚了。這篇側重於底層,按照一定的流程講。

1. 程式碼位置

packages/providers/MediaProvider/src/com/android/providers/media/MtpReceiver.java
packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java
packages/providers/MediaProvider/src/com/android/providers/media/MediaProvider.java
frameworks/base/media/java/android/mtp/MtpServer.java
frameworks/base/media/java/android/mtp/MtpDatabase.java
frameworks/base/media/java/android/mtp/MtpStorage.java
frameworks/base/media/java/android/mtp/MtpPropertyGroup.java
frameworks/base/media/java/android/mtp/MtpPropertyList.java
frameworks/base/media/java/android/mtp/MtpConstants.java
frameworks/base/media/jni/android_mtp_MtpServer.cpp
frameworks/base/media/jni/android_mtp_MtpDatabase.cpp
frameworks/av/media/mtp/MtpServer.h
frameworks/av/media/mtp/MtpServer.cpp
frameworks/av/media/mtp/MtpDatabase.h

frameworks/base/services/java/com/android/server/usb/UsbDeviceManager.java (UsbManager, UsbService)

kernel/drivers/usb/* (主要是android.c, f_mtp.c)

2. 在Settings設定mtp後，程式碼執行

Usbanager.SetCurrentFunction()

->UsbService.SetCurrentFunction()

->UsbDeviceManager.setCurrentFunctions()

-> mHandler.sendMessage(MSG_SET_CURRENT_FUNCTIONS)

->setEnabledFunctions(functions, makeDefault);

->SystemProperties.set("persist.sys.usb.config", functions);

此時會呼叫到init.usb.rc執行相應的程式碼

如果直接開機，開機時會在設定persist.sys.usb.config/sys.usb.config時執行init.usb.rc中程式碼（沒有經過framework及以上程式碼）。

write /sys/class/android_usb/android0/enable 0/1

以上程式碼對應執行enable_store (android.c)

enable_store
1)enabled
f->enable(f_holder->f);
     adb_android_function_enable
        android_disable
           usb_ep_dequeue
           usb_remove_config
android_enable(dev);
    usb_add_config
    usb_gadget_connect
2)disabled
android_disable(dev);
     usb_ep_dequeue
     usb_remove_config
f->disable(f_holder->f)
     adb_android_function_disable

usb_add_config(android_bind_config)   composite.c
   bind()
     android_bind_config()
         android_bind_enabled_functions()
            f->bind_config()
             mtp_function_bind_config(mtp)
              adb_function_bind_config(adb)
                  -> usb_add_function()


usb_remove_config()
   reset_config(cdev);
   unbind_config(cdev, config);
       f->unbind(config, f);
          ****_function_unbind_config()
      config->unbind(config);

write /sys/class/android_usb/android0/functions mtp

以上程式碼對應執行functions_store (android.c)

functions_store()
-> android_enable_function()
-> list_add_tail

3. 如果開機後，連上USB線，首先執行chargr檢測，然後是列舉過程（以高通某晶片為例），這小節講充電器檢測

kernel\drivers\power\qpnp-charger.c

     rc = devm_request_irq(chip->dev, chip->usbin_valid.irq,
    qpnp_chg_usb_usbin_valid_irq_handler,
    IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
     "usbin-valid", chip);

qpnp_chg_usb_usbin_valid_irq_handler()中斷處理函式，檢測USB插入拔出

在連USB開機的情況下，這個處理函式會在qpnp_charger_probe()呼叫。

首先是電源恢復工作，

power_supply_set_present()

->msm_otg_set_vbus_state(POWER_SUPPLY_PROP_PRESENT)

->msm_otg_sm_work()

->pm_runtime_resume()

->msm_otg_runtime_resume()

->msm_otg_resume()

此時會看到log "USB exited from low power mode"

開始充電器檢測工作

主要函式式msm_chg_detect_work() in msm_otg.c

通常USB線的檢測狀態變化

USB_CHG_STATE_UNDEFINED->USB_CHG_STATE_WAIT_FOR_DCD（迴圈幾次）->USB_CHG_STATE_DCD_DONE

USB線的檢測結果是USB_SDP_CHARGER，

此時會設定otg->phy->state=b_peripheral, 並設定current=100mA

4. 列舉過程

4.1 中斷

ci13xxx_msm.c
ret = request_irq(wake_irq, ci13xxx_msm_resume_irq,
IRQF_TRIGGER_RISING | IRQF_ONESHOT, "usb resume", NULL);
ret = request_irq(_udc_ctxt.irq, msm_udc_irq, IRQF_SHARED, pdev->name, pdev);

msm_udc_irq()直接呼叫udc_irq()，處理PM and tr complete
isr_reset_handler/isr_suspend_handler/isr_resume_handler/isr_tr_complete_handler

msm_otg.c
Vbus檢測中斷
ret = request_irq(motg->irq, msm_otg_irq, IRQF_SHARED,
"msm_otg", motg);

msm_otg_irq()->queue_work(system_nrt_wq, &motg->sm_work);->msm_otg_sm_work()

插OTG 線後中斷

msm_pmic_id_irq(), ID pin

4.2 呼叫過程

ci13xxx_udc.c

isr_reset_handler/isr_suspend_handler/isr_resume_handler/isr_tr_complete_handler

（我還不太熟，略過這個部分）

4.3 判讀HS, FS
ci13xxx_udc.c
udc_probe()
udc->gadget.speed = USB_SPEED_UNKNOWN;
udc->gadget.max_speed = USB_SPEED_HIGH; //最大速度

isr_resume_handler()
udc->gadget.speed = hw_port_is_high_speed() ? USB_SPEED_HIGH : USB_SPEED_FULL;
HS/FS是通過函式hw_port_is_high_speed()得到

4.4 判斷Host/Device

msm_otg_start_peripheral(on=1)
這裡通過判斷是SDP_CHARGER,然後設成peripheral(device).

qpnp_chg_usb_usbin_valid_irq_handler: qpnp_chg_usb_usbin_valid_irq_handler usbin-valid triggered: 1 host_mode: 0
上面就可以打印出host_mode, 是通過下面函式得到
host_mode = qpnp_chg_is_otg_en_set(chip);

接OTG線後，可以通過如下中斷處理函式看出
msm_pmic_id_irq(), 主要處理函式msm_pmic_id_status_w()

也可以通過函式得到msm_otg_read_pmic_id_state()

PMIC: ID clear host
PMIC: ID set device

5. 下面才是MTP的單獨部分

5.1 start MTP server

android_work()傳送uevent(USB_STATE=CONFIGURED)給上層

packages/providers/MediaProvider/src/com/android/providers/media/MtpReceiver.java

handleUsbState()

intent = new Intent(context, MtpService.class);
context.startService(intent);

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java

onStartCommand
manageServiceLocked()    MtpService.java "starting MTP server in MTP mode"
      mServer = new MtpServer(mDatabase, mPtpMode);
        MtpServer(MtpDatabase database, boolean usePtp) frameworks/base/media/java/android/mtp/MtpServer.java
     mServer.start();

frameworks/base/media/jni/android_mtp_MtpServer.cpp

native_setup
   android_mtp_MtpServer_setup
         int fd = open("/dev/mtp_usb", O_RDWR);
               mtp_open()    f_mtp.c
    MtpServer* server = new MtpServer(fd, getMtpDatabase(env, javaDatabase),..)

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java
mServer.start();
run() frameworks/base/media/java/android/mtp/MtpServer.java
      native_run   frameworks/base/media/jni/android_mtp_MtpServer.cpp
    android_mtp_MtpServer_run
         server->run();
             MtpServer::run()   frameworks/av/media/mtp/MtpServer.cpp

5.2 主要處理函式

frameworks/av/media/mtp/MtpServer.cpp

MtpServer::run()
infinite loop; read request; send data/response (write)
Read part
mRequest.read(fd);
    MtpRequestPacket::read() (MtpRequestPacket    mRequest;)
      ::read(fd, mBuffer, mBufferSize);
         mtp_read()    f_mtp.c

Write data/response
mData.write
    MtpDataPacket::write(int fd)
       ::write(fd, mBuffer, mPacketSize);
          mtp_write()    f_mtp.c
mResponse.write
    MtpResponsePacket::write
       ::write(fd, mBuffer, mPacketSize);
          mtp_write()    f_mtp.c

Event
MtpServer::doGetObject()
   ioctl(mFD, MTP_SEND_FILE_WITH_HEADER, (unsigned long)&mfr);
     mtp_ioctl() in f_mtp.c
MtpServer::doSendObject()
   ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
     mtp_ioctl() in f_mtp.c

MtpServer::sendObjectAdded/sendObjectRemoved/sendStoreAdded/sendStoreRemoved/sendDevicePropertyChanged
MtpServer::sendEvent(MtpEventCode code, uint32_t param1)
    MtpEventPacket::write(int fd)
       ::ioctl(fd, MTP_SEND_EVENT, (unsigned long)&event);
          mtp_ioctl() in f_mtp.c
            mtp_send_event()

開始的幾個操作

MTP_OPERATION_OPEN_SESSION (1002)
MTP_OPERATION_GET_DEVICE_INFO (1001)
MTP_OPERATION_GET_OBJECT_PROPS_SUPPORTED (9801)
MTP_OPERATION_GET_OBJECT_PROPS_SUPPORTED (9801)
MTP_OPERATION_GET_DEVICE_PROP_DESC (1014)
MTP_OPERATION_GET_OBJECT_PROP_LIST (9805)

6. Debug方法

首先看看是哪部分出問題了

a. 檢查main log, UsbDeviceManager, setEnabledFunctions()是否正常

b. 檢查property, persist.sys.usb.config, sys.usb.config, sys.usb.state

c. 檢查sysfs, functions and state, vid, pid

d. 檢查kernel log, 能否看到sent uevent(USB_STATE=CONFIGURED), 同時看看main log, UsbDeviceManager

e. 檢查main log/kernel, MTP server啟動是否正常

f. 如果正常看看命令接收和response是否正常

針對不同出錯地方，仔細看相應部分程式碼

除錯工具

USB sniffer 方便看到所有資料，從協議上看看出錯地方，尤其是可能是PC問題時

對比方法

換PC, 換手機的方法來對比測試

7. 正常log

mtp_bind_config
msm_otg : USB exited from low power mode
msm_otg : chg_type = USB_SDP_CHARGER
msm_hsusb msm_hsusb: vbus online
msm_hsusb msm_hsusb: CI13XXX_CONTROLLER_RESET_EVENT received
msm_hsusb msm_hsusb: CI13XXX_CONTROLLER_CONNECT_EVENT received
msm_hsusb msm_hsusb: reset
msm_otg : Avail curr from USB = 100
android_work: android_work: did not send uevent (0 0   (null))
android_work: android_work: sent uevent USB_STATE=CONNECTED
msm_hsusb msm_hsusb: reset
android_work: android_work: sent uevent USB_STATE=DISCONNECTED
android_work: android_work: sent uevent USB_STATE=CONNECTED
msm_otg : Avail curr from USB = 500
android_work: android_work: sent uevent USB_STATE=CONFIGURED
MtpService: starting MTP server in MTP mode
mtp_open

Android之 MTP框架和流程分析 (3)

Android之 MTP框架和流程分析 (3)

android之MTP框架和流程分析

Android之 MTP框架和流程分析

Android MTP框架和流程分析

Android OTA升級原理和流程分析（一）

Android OTA升級原理和流程分析（三）---Android系統的三種啟動模式

Android OTA升級原理和流程分析（二）---update.zip差分包問題的解決

Spring系列之Spring框架和SpringAOP整合過程分析(十二)

Spring系列之Spring框架和SpringAOP整合過程分析(十)

Android系統載入Apk檔案的時機和流程分析（1）--Android 4.4.4 r1的原始碼

Android之Fresco框架（四）--ImagePipeline的呼叫和使用

Android 5.0 Camera系統原始碼分析(3)：Camera預覽流程控制流

1、Android項目框架搭建（分析需求、整理資料）

[Abp 源碼分析] 一、Abp 框架啟動流程分析

C語言基礎之函數和流程控制

滴滴開源Android外掛化框架VirtualAPK原理分析

Android之Volley框架載入網路圖片

Android 之採用execSQL和rawQuery方法完成資料的添刪改查操作

K8S 原始碼探祕之 kubeadm join 執行流程分析

K8S 原始碼探祕之 kubeadm init 執行流程分析

Android之 MTP框架和流程分析 (3)

相關推薦