Android之 MTP框架和流程分析 (3)

前面转发了篇博客介绍了MTP, 偏重于上层，已经很清楚了。这篇侧重于底层,按照一定的流程讲。

1. 代码位置

packages/providers/MediaProvider/src/com/android/providers/media/MtpReceiver.java

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java

packages/providers/MediaProvider/src/com/android/providers/media/MediaProvider.java

frameworks/base/media/java/android/mtp/MtpServer.java

frameworks/base/media/java/android/mtp/MtpDatabase.java

frameworks/base/media/java/android/mtp/MtpStorage.java

frameworks/base/media/java/android/mtp/MtpPropertyGroup.java

frameworks/base/media/java/android/mtp/MtpPropertyList.java

frameworks/base/media/java/android/mtp/MtpConstants.java

frameworks/base/media/jni/android_mtp_MtpServer.cpp

frameworks/base/media/jni/android_mtp_MtpDatabase.cpp

frameworks/av/media/mtp/MtpServer.h

frameworks/av/media/mtp/MtpServer.cpp

frameworks/av/media/mtp/MtpDatabase.h

frameworks/base/services/java/com/android/server/usb/UsbDeviceManager.java (UsbManager, UsbService)

kernel/drivers/usb/* (主要是android.c, f_mtp.c)

2. 在Settings设置mtp后，代码执行

Usbanager.SetCurrentFunction()

->UsbService.SetCurrentFunction()

->UsbDeviceManager.setCurrentFunctions()

-> mHandler.sendMessage(MSG_SET_CURRENT_FUNCTIONS)

->setEnabledFunctions(functions, makeDefault);

->SystemProperties.set("persist.sys.usb.config", functions);

此时会调用到init.usb.rc执行相应的代码

如果直接开机，开机时会在设置persist.sys.usb.config/sys.usb.config时执行init.usb.rc中代码（没有经过framework及以上代码）。

write /sys/class/android_usb/android0/enable 0/1

以上代码对应执行enable_store (android.c)

enable_store

1)enabled

f->enable(f_holder->f);

adb_android_function_enable

android_disable

usb_ep_dequeue

usb_remove_config

android_enable(dev);

usb_add_config

usb_gadget_connect

2)disabled

android_disable(dev);

usb_ep_dequeue

usb_remove_config

f->disable(f_holder->f)

adb_android_function_disable

usb_add_config(android_bind_config) composite.c

bind()

android_bind_config()

android_bind_enabled_functions()

f->bind_config()

mtp_function_bind_config(mtp)

adb_function_bind_config(adb)

-> usb_add_function()

usb_remove_config()

reset_config(cdev);

unbind_config(cdev, config);

f->unbind(config, f);

****_function_unbind_config()

config->unbind(config);

write /sys/class/android_usb/android0/functions mtp

以上代码对应执行functions_store (android.c)

functions_store()

-> android_enable_function()

-> list_add_tail

3. 如果开机后，连上USB线，首先执行chargr检测，然后是枚举过程 （以高通某芯片为例），这小节讲充电器检测

kernel\drivers\power\qpnp-charger.c

rc = devm_request_irq(chip->dev, chip->usbin_valid.irq,

qpnp_chg_usb_usbin_valid_irq_handler,

IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,

"usbin-valid", chip);

qpnp_chg_usb_usbin_valid_irq_handler()中断处理函数，检测USB插入拔出

在连USB开机的情况下，这个处理函数会在qpnp_charger_probe()调用。

首先是电源恢复工作，

power_supply_set_present()

->msm_otg_set_vbus_state(POWER_SUPPLY_PROP_PRESENT)

->msm_otg_sm_work()

->pm_runtime_resume()

->msm_otg_runtime_resume()

->msm_otg_resume()

此时会看到log "USB exited from low power mode"

开始充电器检测工作

主要函数式msm_chg_detect_work() in msm_otg.c

通常USB线的检测状态变化

USB_CHG_STATE_UNDEFINED->USB_CHG_STATE_WAIT_FOR_DCD（循环几次）->USB_CHG_STATE_DCD_DONE

USB线的检测结果是USB_SDP_CHARGER，

此时会设置otg->phy->state=b_peripheral, 并设置current=100mA

4. 枚举过程

4.1 中断

ci13xxx_msm.c

ret = request_irq(wake_irq, ci13xxx_msm_resume_irq,

IRQF_TRIGGER_RISING | IRQF_ONESHOT, "usb resume", NULL);

ret = request_irq(_udc_ctxt.irq, msm_udc_irq, IRQF_SHARED, pdev->name, pdev);

msm_udc_irq()直接调用udc_irq()，处理PM and tr complete

isr_reset_handler/isr_suspend_handler/isr_resume_handler/isr_tr_complete_handler

msm_otg.c

Vbus检测中断

ret = request_irq(motg->irq, msm_otg_irq, IRQF_SHARED,

"msm_otg", motg);

msm_otg_irq()->queue_work(system_nrt_wq, &motg->sm_work);->msm_otg_sm_work()

插OTG 线后中断

msm_pmic_id_irq(), ID pin

4.2 调用过程

ci13xxx_udc.c

isr_reset_handler/isr_suspend_handler/isr_resume_handler/isr_tr_complete_handler

（我还不太熟，略过这个部分）

4.3 判读HS, FS

ci13xxx_udc.c

udc_probe()

udc->gadget.speed = USB_SPEED_UNKNOWN;

udc->gadget.max_speed = USB_SPEED_HIGH; //最大速度

isr_resume_handler()

udc->gadget.speed = hw_port_is_high_speed() ? USB_SPEED_HIGH : USB_SPEED_FULL;

HS/FS是通过函数hw_port_is_high_speed()得到

4.4 判断Host/Device

msm_otg_start_peripheral(on=1)

这里通过判断是SDP_CHARGER,然后设成peripheral(device).

qpnp_chg_usb_usbin_valid_irq_handler: qpnp_chg_usb_usbin_valid_irq_handler usbin-valid triggered: 1 host_mode: 0

上面就可以打印出host_mode, 是通过下面函数得到

host_mode = qpnp_chg_is_otg_en_set(chip);

接OTG线后，可以通过如下中断处理函数看出

msm_pmic_id_irq(), 主要处理函数msm_pmic_id_status_w()

也可以通过函数得到msm_otg_read_pmic_id_state()

PMIC: ID clear host

PMIC: ID set device

5. 下面才是MTP的单独部分

5.1 start MTP server

android_work()发送uevent(USB_STATE=CONFIGURED)给上层

packages/providers/MediaProvider/src/com/android/providers/media/MtpReceiver.java

handleUsbState()

intent = new Intent(context, MtpService.class);

context.startService(intent);

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java

onStartCommand

manageServiceLocked() MtpService.java "starting MTP server in MTP mode"

mServer = new MtpServer(mDatabase, mPtpMode);

MtpServer(MtpDatabase database, boolean usePtp) frameworks/base/media/java/android/mtp/MtpServer.java

mServer.start();

frameworks/base/media/jni/android_mtp_MtpServer.cpp

native_setup

android_mtp_MtpServer_setup

int fd = open("/dev/mtp_usb", O_RDWR);

mtp_open() f_mtp.c

MtpServer* server = new MtpServer(fd, getMtpDatabase(env, javaDatabase),..)

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java

mServer.start();

run() frameworks/base/media/java/android/mtp/MtpServer.java

native_run frameworks/base/media/jni/android_mtp_MtpServer.cpp

android_mtp_MtpServer_run

server->run();

MtpServer::run() frameworks/av/media/mtp/MtpServer.cpp

5.2 主要处理函数

frameworks/av/media/mtp/MtpServer.cpp

MtpServer::run()

infinite loop; read request; send data/response (write)

Read part

mRequest.read(fd);

MtpRequestPacket::read() (MtpRequestPacket mRequest;)

::read(fd, mBuffer, mBufferSize);

mtp_read() f_mtp.c

Write data/response

mData.write

MtpDataPacket::write(int fd)

::write(fd, mBuffer, mPacketSize);

mtp_write() f_mtp.c

mResponse.write

MtpResponsePacket::write

::write(fd, mBuffer, mPacketSize);

mtp_write() f_mtp.c

Event

MtpServer::doGetObject()

ioctl(mFD, MTP_SEND_FILE_WITH_HEADER, (unsigned long)&mfr);

mtp_ioctl() in f_mtp.c

MtpServer::doSendObject()

ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);

mtp_ioctl() in f_mtp.c

MtpServer::sendObjectAdded/sendObjectRemoved/sendStoreAdded/sendStoreRemoved/sendDevicePropertyChanged

MtpServer::sendEvent(MtpEventCode code, uint32_t param1)

MtpEventPacket::write(int fd)

::ioctl(fd, MTP_SEND_EVENT, (unsigned long)&event);

mtp_ioctl() in f_mtp.c

mtp_send_event()

开始的几个操作

MTP_OPERATION_OPEN_SESSION (1002)

MTP_OPERATION_GET_DEVICE_INFO (1001)

MTP_OPERATION_GET_OBJECT_PROPS_SUPPORTED (9801)

MTP_OPERATION_GET_OBJECT_PROPS_SUPPORTED (9801)

MTP_OPERATION_GET_DEVICE_PROP_DESC (1014)

MTP_OPERATION_GET_OBJECT_PROP_LIST (9805)

6. Debug方法

首先看看是哪部分出问题了

a. 检查main log, UsbDeviceManager, setEnabledFunctions()是否正常

b. 检查property, persist.sys.usb.config, sys.usb.config, sys.usb.state

c. 检查sysfs, functions and state, vid, pid

d. 检查kernel log, 能否看到sent uevent(USB_STATE=CONFIGURED), 同时看看main log, UsbDeviceManager

e. 检查main log/kernel, MTP server启动是否正常

f. 如果正常看看命令接收和response是否正常

针对不同出错地方，仔细看相应部分代码

调试工具

USB sniffer 方便看到所有数据，从协议上看看出错地方，尤其是可能是PC问题时

对比方法

换PC, 换手机的方法来对比测试

7. 正常log

mtp_bind_config

msm_otg : USB exited from low power mode

msm_otg : chg_type = USB_SDP_CHARGER

msm_hsusb msm_hsusb: vbus online

msm_hsusb msm_hsusb: CI13XXX_CONTROLLER_RESET_EVENT received

msm_hsusb msm_hsusb: CI13XXX_CONTROLLER_CONNECT_EVENT received

msm_hsusb msm_hsusb: reset

msm_otg : Avail curr from USB = 100

android_work: android_work: did not send uevent (0 0 (null))

android_work: android_work: sent uevent USB_STATE=CONNECTED

msm_hsusb msm_hsusb: reset

android_work: android_work: sent uevent USB_STATE=DISCONNECTED

android_work: android_work: sent uevent USB_STATE=CONNECTED

msm_otg : Avail curr from USB = 500

android_work: android_work: sent uevent USB_STATE=CONFIGURED

MtpService: starting MTP server in MTP mode

mtp_open