Android USB/MTP相关实现

前面转发了篇博客介绍了MTP, 偏重于上层，已经很清楚了。这篇侧重于底层,按照一定的流程讲。

1. 代码位置

packages/providers/MediaProvider/src/com/android/providers/media/MtpReceiver.java
packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java
packages/providers/MediaProvider/src/com/android/providers/media/MediaProvider.java
frameworks/base/media/java/android/mtp/MtpServer.java
frameworks/base/media/java/android/mtp/MtpDatabase.java
frameworks/base/media/java/android/mtp/MtpStorage.java
frameworks/base/media/java/android/mtp/MtpPropertyGroup.java
frameworks/base/media/java/android/mtp/MtpPropertyList.java
frameworks/base/media/java/android/mtp/MtpConstants.java
frameworks/base/media/jni/android_mtp_MtpServer.cpp
frameworks/base/media/jni/android_mtp_MtpDatabase.cpp
frameworks/av/media/mtp/MtpServer.h
frameworks/av/media/mtp/MtpServer.cpp
frameworks/av/media/mtp/MtpDatabase.h

frameworks/base/services/java/com/android/server/usb/UsbDeviceManager.java (UsbManager, UsbService)

kernel/drivers/usb/* (主要是android.c, f_mtp.c)

2. 在Settings设置mtp后，代码执行

Usbanager.SetCurrentFunction()

->UsbService.SetCurrentFunction()

->UsbDeviceManager.setCurrentFunctions()

-> mHandler.sendMessage(MSG_SET_CURRENT_FUNCTIONS)

->setEnabledFunctions(functions, makeDefault);

->SystemProperties.set("persist.sys.usb.config", functions);

此时会调用到init.usb.rc执行相应的代码

如果直接开机，开机时会在设置persist.sys.usb.config/sys.usb.config时执行init.usb.rc中代码（没有经过framework及以上代码）。

write /sys/class/android_usb/android0/enable 0/1

以上代码对应执行enable_store (android.c)

enable_store
1)enabled
f->enable(f_holder->f);
     adb_android_function_enable
        android_disable
           usb_ep_dequeue
           usb_remove_config
android_enable(dev);
    usb_add_config
    usb_gadget_connect
2)disabled
android_disable(dev);
     usb_ep_dequeue
     usb_remove_config
f->disable(f_holder->f)
     adb_android_function_disable

usb_add_config(android_bind_config)   composite.c
   bind()
     android_bind_config()
         android_bind_enabled_functions()
            f->bind_config()
             mtp_function_bind_config(mtp)
              adb_function_bind_config(adb)
                  -> usb_add_function()


usb_remove_config()
   reset_config(cdev);
   unbind_config(cdev, config);
       f->unbind(config, f);
          ****_function_unbind_config()
      config->unbind(config);

write /sys/class/android_usb/android0/functions mtp

以上代码对应执行functions_store (android.c)

functions_store()
-> android_enable_function()
-> list_add_tail

3. 如果开机后，连上USB线，首先执行chargr检测，然后是枚举过程（以高通某芯片为例），这小节讲充电器检测

kernel\drivers\power\qpnp-charger.c

     rc = devm_request_irq(chip->dev, chip->usbin_valid.irq,
    qpnp_chg_usb_usbin_valid_irq_handler,
    IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
     "usbin-valid", chip);

qpnp_chg_usb_usbin_valid_irq_handler()中断处理函数，检测USB插入拔出

在连USB开机的情况下，这个处理函数会在qpnp_charger_probe()调用。

首先是电源恢复工作，

power_supply_set_present()

->msm_otg_set_vbus_state(POWER_SUPPLY_PROP_PRESENT)

->msm_otg_sm_work()

->pm_runtime_resume()

->msm_otg_runtime_resume()

->msm_otg_resume()

此时会看到log "USB exited from low power mode"

开始充电器检测工作

主要函数式msm_chg_detect_work() in msm_otg.c

通常USB线的检测状态变化

USB_CHG_STATE_UNDEFINED->USB_CHG_STATE_WAIT_FOR_DCD（循环几次）->USB_CHG_STATE_DCD_DONE

USB线的检测结果是USB_SDP_CHARGER，

此时会设置otg->phy->state=b_peripheral, 并设置current=100mA

4. 枚举过程

4.1 中断

ci13xxx_msm.c
ret = request_irq(wake_irq, ci13xxx_msm_resume_irq,
IRQF_TRIGGER_RISING | IRQF_ONESHOT, "usb resume", NULL);
ret = request_irq(_udc_ctxt.irq, msm_udc_irq, IRQF_SHARED, pdev->name, pdev);

msm_udc_irq()直接调用udc_irq()，处理PM and tr complete
isr_reset_handler/isr_suspend_handler/isr_resume_handler/isr_tr_complete_handler

msm_otg.c
Vbus检测中断
ret = request_irq(motg->irq, msm_otg_irq, IRQF_SHARED,
"msm_otg", motg);

msm_otg_irq()->queue_work(system_nrt_wq, &motg->sm_work);->msm_otg_sm_work()

插OTG 线后中断

msm_pmic_id_irq(), ID pin

4.2 调用过程

ci13xxx_udc.c

isr_reset_handler/isr_suspend_handler/isr_resume_handler/isr_tr_complete_handler

msm_otg_sm_work() in msm_otg.c

msm_chg_detect_work(b_idle b_sess_vld USB_SDP_CHARGER)

msm_otg_start_peripheral(otg, 1); "gadget on"

setup_gpio (.setup_gpio = isp1763_setup_gpio)

usb_gadget_vbus_connect

ci13xxx_vbus_session "vbus online" ci13xxx_udc.c

hw_device_reset

notify_event(CI13XXX_CONTROLLER_RESET_EVENT)

hw_device_state

notify_event(CI13XXX_CONTROLLER_CONNECT_EVENT);

msm_udc_irq kernel/drivers/usb/gadget/ci13xxx_msm.c ( request_irq(_udc_ctxt.irq, msm_udc_irq, IRQF_SHARED, pdev->name...)

udc_irq

isr_suspend_handler ci13xxx_udc.c

udc->driver->suspend(&udc->gadget);

notify_event(CI13XXX_CONTROLLER_SUSPEND_EVENT);

usb_phy_set_suspend(1)

suspended=1

isr_reset_handler ci13xxx_udc.c

notify_event(CI13XXX_CONTROLLER_RESUME_EVENT);

usb_phy_set_suspend(0)

udc->driver->resume(&udc->gadget);

suspended=0

usb_phy_set_power(udc->transceiver, 100);

set_power() otg.h

msm_otg_set_power msm_otg.c

msm_otg_notify_charger(motg, mA); msm_otg.c

msm_otg_notify_chg_type msm_otg.c

power_supply_set_supply_type power/power_supply_core.c

set_property(POWER_SUPPLY_PROP_TYPE)

otg_power_set_property_usb(POWER_SUPPLY_PROP_TYPE)

msm_otg_notify_power_supply msm_otg.c

power_supply_set_online(psy, true))

power_supply_set_current_limit(100mA)

_gadget_stop_activity ci13xxx_udc.c

android_disconnect

composite_disconnect

schedule_work()->android_work "android_work: did not send uevent (0 0 (null))"

hw_usb_reset();

isr_resume_handler

notify_event(CI13XXX_CONTROLLER_RESUME_EVENT)

usb_phy_set_suspend(0);

udc->driver->resume(&udc->gadget);

isr_tr_complete_handler ci13xxx_udc.c

driver->setup

android_setup android.c

f->ctrlrequest(f, cdev, c);

mtp_function_ctrlrequest()

composite_setup(USB_REQ_GET_DESCRIPTOR USB_DT_DEVICE) composite.c

schedule_work() ->android_work "android_work: sent uevent USB_STATE=CONNECTED"

isr_reset_handler

...

_gadget_stop_activity

android_disconnect

composite_disconnect

schedule_work()->android_work "android_work: sent uevent USB_STATE=DISCONNECTED"

isr_resume_handler

...

isr_tr_complete_handler USB_REQ_SET_ADDRESS 1

isr_tr_complete_handler driver->setup

android_setup android.c

composite_setup(USB_REQ_GET_DESCRIPTOR USB_DT_DEVICE) composite.c

schedule_work()->android_work "android_work: sent uevent USB_STATE=CONNECTED"

isr_tr_complete_handler driver->setup

android_setup

composite_setup USB_REQ_GET_DESCRIPTOR USB_DT_CONFIG

isr_tr_complete_handler driver->setup (USB_DT_STRING 3 times, vary)

android_setup

composite_setup USB_REQ_GET_DESCRIPTOR USB_DT_STRING

isr_tr_complete_handler driver->setup

android_setup android.c

composite_setup(USB_REQ_GET_DESCRIPTOR USB_DT_DEVICE) composite.c

isr_tr_complete_handler driver->setup

android_setup

composite_setup USB_REQ_GET_DESCRIPTOR USB_DT_CONFIG

isr_tr_complete_handler USB_REQ_SET_CONFIGURATION 1

isr_tr_complete_handler driver->setup

android_setup

composite_setup USB_REQ_SET_CONFIGURATION composite.c

set_config

set_alt

mtp_function_set_alt

adb_function_set_alt

usb_gadget_vbus_draw()

vbus_draw()

ci13xxx_vbus_draw ci13xxx_udc.c

usb_phy_set_power

set_power

msm_otg_set_power

msm_otg_notify_charger(motg, mA); "usb: Avail curr from USB = 500"

msm_otg_notify_chg_type

power_supply_set_supply_type

msm_otg_notify_power_supply

...

isr_tr_complete_handler driver->setup

android_setup

composite_setup USB_REQ_GET_DESCRIPTOR USB_DT_STRING

schedule_work()->android_work "android_work: sent uevent USB_STATE=CONFIGURED"

4.3 判读HS, FS
ci13xxx_udc.c
udc_probe()
udc->gadget.speed = USB_SPEED_UNKNOWN;
udc->gadget.max_speed = USB_SPEED_HIGH; //最大速度

isr_resume_handler()
udc->gadget.speed = hw_port_is_high_speed() ? USB_SPEED_HIGH : USB_SPEED_FULL;
HS/FS是通过函数hw_port_is_high_speed()得到

4.4 判断Host/Device

msm_otg_start_peripheral(on=1)
这里通过判断是SDP_CHARGER,然后设成peripheral(device).

qpnp_chg_usb_usbin_valid_irq_handler: qpnp_chg_usb_usbin_valid_irq_handler usbin-valid triggered: 1 host_mode: 0
上面就可以打印出host_mode, 是通过下面函数得到
host_mode = qpnp_chg_is_otg_en_set(chip);

接OTG线后，可以通过如下中断处理函数看出
msm_pmic_id_irq(), 主要处理函数msm_pmic_id_status_w()

也可以通过函数得到msm_otg_read_pmic_id_state()

PMIC: ID clear host
PMIC: ID set device

5. 下面才是MTP的单独部分

5.1 start MTP server

android_work()发送uevent(USB_STATE=CONFIGURED)给上层

packages/providers/MediaProvider/src/com/android/providers/media/MtpReceiver.java

handleUsbState()

intent = new Intent(context, MtpService.class);
context.startService(intent);

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java

onStartCommand
manageServiceLocked()    MtpService.java "starting MTP server in MTP mode"
      mServer = new MtpServer(mDatabase, mPtpMode);
        MtpServer(MtpDatabase database, boolean usePtp) frameworks/base/media/java/android/mtp/MtpServer.java
     mServer.start();

frameworks/base/media/jni/android_mtp_MtpServer.cpp

native_setup
   android_mtp_MtpServer_setup
         int fd = open("/dev/mtp_usb", O_RDWR);
               mtp_open()    f_mtp.c
    MtpServer* server = new MtpServer(fd, getMtpDatabase(env, javaDatabase),..)

packages/providers/MediaProvider/src/com/android/providers/media/MtpService.java
mServer.start();
run() frameworks/base/media/java/android/mtp/MtpServer.java
      native_run   frameworks/base/media/jni/android_mtp_MtpServer.cpp
    android_mtp_MtpServer_run
         server->run();
             MtpServer::run()   frameworks/av/media/mtp/MtpServer.cpp

5.2 主要处理函数

frameworks/av/media/mtp/MtpServer.cpp

MtpServer::run()
infinite loop; read request; send data/response (write)
Read part
mRequest.read(fd);
    MtpRequestPacket::read() (MtpRequestPacket    mRequest;)
      ::read(fd, mBuffer, mBufferSize);
         mtp_read()    f_mtp.c

Write data/response
mData.write
    MtpDataPacket::write(int fd)
       ::write(fd, mBuffer, mPacketSize);
          mtp_write()    f_mtp.c
mResponse.write
    MtpResponsePacket::write
       ::write(fd, mBuffer, mPacketSize);
          mtp_write()    f_mtp.c

Event
MtpServer::doGetObject()
   ioctl(mFD, MTP_SEND_FILE_WITH_HEADER, (unsigned long)&mfr);
     mtp_ioctl() in f_mtp.c
MtpServer::doSendObject()
   ret = ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
     mtp_ioctl() in f_mtp.c

MtpServer::sendObjectAdded/sendObjectRemoved/sendStoreAdded/sendStoreRemoved/sendDevicePropertyChanged
MtpServer::sendEvent(MtpEventCode code, uint32_t param1)
    MtpEventPacket::write(int fd)
       ::ioctl(fd, MTP_SEND_EVENT, (unsigned long)&event);
          mtp_ioctl() in f_mtp.c
            mtp_send_event()

开始的几个操作

MTP_OPERATION_OPEN_SESSION (1002)
MTP_OPERATION_GET_DEVICE_INFO (1001)
MTP_OPERATION_GET_OBJECT_PROPS_SUPPORTED (9801)
MTP_OPERATION_GET_OBJECT_PROPS_SUPPORTED (9801)
MTP_OPERATION_GET_DEVICE_PROP_DESC (1014)
MTP_OPERATION_GET_OBJECT_PROP_LIST (9805)

6. Debug方法

首先看看是哪部分出问题了

a. 检查main log, UsbDeviceManager, setEnabledFunctions()是否正常

b. 检查property, persist.sys.usb.config, sys.usb.config, sys.usb.state

c. 检查sysfs, functions and state, vid, pid

d. 检查kernel log, 能否看到sent uevent(USB_STATE=CONFIGURED), 同时看看main log, UsbDeviceManager

e. 检查main log/kernel, MTP server启动是否正常

f. 如果正常看看命令接收和response是否正常

针对不同出错地方，仔细看相应部分代码

调试工具

USB sniffer 方便看到所有数据，从协议上看看出错地方，尤其是可能是PC问题时

对比方法

换PC, 换手机的方法来对比测试

7. 正常log

mtp_bind_config
msm_otg : USB exited from low power mode
msm_otg : chg_type = USB_SDP_CHARGER
msm_hsusb msm_hsusb: vbus online
msm_hsusb msm_hsusb: CI13XXX_CONTROLLER_RESET_EVENT received
msm_hsusb msm_hsusb: CI13XXX_CONTROLLER_CONNECT_EVENT received
msm_hsusb msm_hsusb: reset
msm_otg : Avail curr from USB = 100
android_work: android_work: did not send uevent (0 0   (null))
android_work: android_work: sent uevent USB_STATE=CONNECTED
msm_hsusb msm_hsusb: reset
android_work: android_work: sent uevent USB_STATE=DISCONNECTED
android_work: android_work: sent uevent USB_STATE=CONNECTED
msm_otg : Avail curr from USB = 500
android_work: android_work: sent uevent USB_STATE=CONFIGURED
MtpService: starting MTP server in MTP mode
mtp_open

Android USB/MTP相关实现

悦读