Android usb学习笔记:Android AOA协议设备端 流程总结

背景

前段时间的项目开发中，由于wifi稳定性的限制，项目采用了Android手机与嵌入式设备通过usb直接连接的方式进行通信。其中Android的usb层使用了Android自身的AOA模式，嵌入式端借助libusb库与Android端通信。在应用层简单实现了一个tcp连接，最终可以抽象为双方socket端口与端口间的通信过程。探索的过程比较曲折，其间受到两位同事也是前辈的帮助指导，收获颇多。

实现

AOA协议实现流程简述

下面是我对AOA通信过程的一些理解

1.Android连接设备，设备可以通过轮询或者注册热插拔事件的方式，检测当前插入的usb设备，查询这个设备是否处在AOA模式，如果不是则开启AOA模式。也就是设备向Android设备写入相应的usb控制信息，写入成功后，我们的Android设备就开启了AOA模式，这时嵌入式端就拿到了Android设备usb的读写描述符，可以对其进行数据传输。

2.Android端接收到嵌入式端写入的信息后，就把自己设置为accessory模式，这时Android会发送一条系统广播，在广播接受者中查询当前是否有accessory连接。如果可以拿到这个accessory，那么就能获取到相应的读写流，也就可以通过这两个流对设备进行读写。

这里设备端底层使用了libusb库，下面是项目地址，可以直接在mac或者linux下编译。在开发Android端代码时网上的参考代码有不少bug，这里给出一份相对比较稳定的Android端例程。

libusb项目链接 https://github.com/libusb/libusb.git
设备aoa模式参考项目链接 https://github.com/timotto/AOA-Proxy.git
本例程设备端项目链接 https://git.oschina.net/vonchenchen/aoa_proxy.git
本例程Android端项目链接 https://git.oschina.net/vonchenchen/aoa_android.git

例程的编译与使用

在编译设备端项目之前需要先编译并安装libusb库。安装完成libusb库后，运行本例程设备端项目中的configure文件，参考日志信息安装其他依赖库，然后执行make，编译完成后将会生成aoaproxy文件，也就是我们能最后生成的可执行文件。

Android端例程可以直接在Android Studio打开运行，直接装入手机即可。

在设备端执行

sudo ./aoaproxy

如果看到如下日志，则说明程序已经正常启动

start_service
start connect device
prepare to connect device

这时，插入android设备，应用会自动启动，设备控制台开始每隔一秒打印如下信息

Start send
recived len 12
usb recive len 12
receive hello

这样就说明例子程序运行起来了。这里每隔1秒设备将向Android端发送一个Hello字符串，Android端收到数据后会原样返回这些数据，这时设备端收到数据后会将这些信息打印在控制台上。

代码分析

设备端代码主要分为一下几个文件，文件对应功能如下

aoaproxy.c —– 主程序

accessory.c —— AOA底层开启

a2spipe.c ——usb与本地server交互管道

tcp.c ——-tcp连接

local_service.c ——- 本地 server 用于数据接收和发送，可以在单独进程中开启

下面我们将分布对这几个文件进行介绍。

main函数

int main(int argc, char** argv) {
    int r;
    int opt;
    int xcount=0;

    while ((opt = getopt(argc, argv, "dfh:p:x:")) != -1) {
       //参数
       ....
    }

    ctx = NULL;
    connectedDevices = NULL;

    //开启本地socketserver
    create_start_service();

    if (do_fork)
        do_fork_foo();

    //注册信号
    initSigHandler();

    // it is important to init usb after the fork!
    if (0 > initUsb()) {
        logError("Failed to initialize USB\n");
        return 1;
    }
    //定时任务轮询
    if(autoscan) {
        struct itimerval timer;
        timer.it_value.tv_sec = 1;
        timer.it_value.tv_usec = 0;
        timer.it_interval.tv_sec = 1;
        timer.it_interval.tv_usec = 0;
        setitimer (ITIMER_REAL, &timer, NULL);
    }

    //usb设备列表
    libusb_device **devs = NULL;
    while(!do_exit) {

        if (doUpdateUsbInventory == 1) {
            doUpdateUsbInventory = 0;
            //清空设备
            cleanupDeadDevices();
            //尝试链接设备
            updateUsbInventory(devs);
        }
        //阻塞等待usb事件
        r = libusb_handle_events(ctx);
        if (r) {
            if (r == LIBUSB_ERROR_INTERRUPTED) {
                // ignore
            } else {
                if(!do_exit)
                    logDebug("libusb_handle_events_timeout: %d\n", r);

                break;
            }
        }
    }

    if (devs != NULL)
        libusb_free_device_list(devs, 1);

    if(autoscan) {
        struct itimerval timer;
        memset (&timer, 0, sizeof(timer));
        setitimer (ITIMER_REAL, &timer, NULL);
    }
    shutdownEverything();
    return EXIT_SUCCESS;
}

这里比较重要的是updateUsbInventory函数。

updateUsbInventory

下面看一下updateUsbInventory方法做什么的

static int updateUsbInventory(libusb_device **devs) {
    static ssize_t cnt = 0;
    static ssize_t lastCnt = 0;
//  static libusb_device **devs;
    static libusb_device **lastDevs = NULL;
    //获取usb设备列表
    cnt = libusb_get_device_list(ctx, &devs);
    if(cnt < 0) {
        logError("Failed to list devices\n");
        return -1;
    }

    ssize_t i, j;
    int foundBefore;
    for(i = 0; i < cnt; i++) {
        foundBefore = 0;
        if ( lastDevs != NULL) {
            for(j=0;j < lastCnt; j++) {
                if (devs[i] == lastDevs[j]) {
                    foundBefore = 1;
                    break;
                }
            }
        }
        if (!foundBefore) {
            logDebug("start connect device\n");
            //连接设备 连接本地服务端
            if(connectDevice(devs[i]) >= 0)
                libusb_ref_device(devs[i]);
        }
    }

    if (lastDevs != NULL) {
//      if (cnt != lastCnt)
//          fprintf(LOG_DEB, "number of USB devices changed from %d to %d\n", lastCnt, cnt);

        for (i=0;i<lastCnt;i++) {
            foundBefore = 0;
            for(j=0;j<cnt;j++) {
                if (devs[j] == lastDevs[i]) {
                    foundBefore = 1;
                    break;
                }
            }
            if(!foundBefore) {
                struct listentry *hit = connectedDevices;

                while(hit != NULL) {
                    if ( hit->usbDevice == lastDevs[i]) {
                        disconnectDevice(lastDevs[i]);
                        libusb_unref_device(lastDevs[i]);
                        break;
                    }
                    hit = hit->next;
                }
            }
        }
        libusb_free_device_list(lastDevs, 1);
    }
    lastDevs = devs;
    lastCnt = cnt;

    return 0;
}

connectDevice

这个函数比较关键，开启了android的accessory，同时也和本地服务器进行连接，这样就打通了usb和本地server的通道。

static int connectDevice(libusb_device *device) {

    logDebug("prepare to connect device \n");

    struct libusb_device_descriptor desc;
    //获取usb设备描述信息
    int r = libusb_get_device_descriptor(device, &desc);
    if (r < 0) {
        logError("failed to get device descriptor: %d", r);
        return -1;
    }

    switch(desc.bDeviceClass) {
    case 0x09:
        logDebug("device 0x%04X:%04X has wrong deviceClass: 0x%02x",
                desc.idVendor, desc.idProduct,
                desc.bDeviceClass);
        return -1;
    }

    struct t_excludeList *e = exclude;
    while(e != NULL) {
        logDebug("comparing device [%04x:%04x] and [%04x:%04x]",
                desc.idVendor, desc.idProduct, e->vid, e->pid);
        if(e->vid == desc.idVendor && e->pid == desc.idProduct) {
            logDebug("device is on exclude list", desc.idVendor, desc.idProduct);
            return -1;
        }
        e = e->next;
    }

    //检查当前设备是否处于accessory模式
    if(!isDroidInAcc(device)) {
        logDebug("attempting AOA on device 0x%04X:%04X\n",
                desc.idVendor, desc.idProduct);
        //写入要启动的应用的信息 开启android的accessory模式 
        switchDroidToAcc(device, 1, haveAudio);
        return -1;
    }

    //entry管理socket与usb
    struct listentry *entry = malloc(sizeof(struct listentry));
    if (entry == NULL) {
        logError("Not enough RAM");
        return -2;
    }
    bzero(entry, sizeof(struct listentry));

    //entry拿到usb句柄device
    entry->usbDevice = device;

    //entry拿到socket句柄
#ifdef SOCKET_RETRY
    //连接本地socketserver, 返回socket客户端的描述符
    while((r = connectTcpSocket(hostname, portno)) <= 0) {
        logError("failed to setup socket: %d, retrying\n", r);
        sleep(1);
    }
    //记录本地soket链接的描述符
    entry->sockfd = r;
    entry->socketDead = 0;
#else
    r = connectTcpSocket(hostname, portno);
    if (r < 0) {
        fprintf(LOG_ERR, "failed to setup socket: %d\n", r);
        free(entry);
        return -4;
    }
    entry->sockfd = r;
    entry->socketDead = 0;
#endif
    //如果android设备已经是aoa模式,打开usb
    logDebug("start setup droid \n");
    //找到accessory接口并用接口信息初始化entry->droid
    r = setupDroid(device, &entry->droid);
    if (r < 0) {
        logError("failed to setup droid: %d\n", r);
        free(entry);
        return -3;
    }

    //将entry加入链表
    entry->next = NULL;
    if (connectedDevices == NULL) {
        entry->prev = NULL;
        connectedDevices = entry;
    } else {
        struct listentry *last = connectedDevices;
        while(last->next != NULL)
            last = last->next;
        entry->prev = last;
        last->next = entry;
    }

    //建立usb与socket互相通信的任务
    r = startUSBPipe(entry);
    if (r < 0) {
        logError("failed to start pipe: %d", r);
        disconnectDevice(device);
        return -5;
    }

    if (haveAudio && entry->droid.audioendp) {
        startAudio(entry);
    }

    logDebug("new Android connected");
    return 0;
}

上述代码中首先检测当前接口是否为accessory模式，如果不是则将其设置为accessory模式，但是此处将所有设备都设置为accessory，可能有些设备并非android设备。同时connectTcpSocket方法开启了tcp连接。这里用entry记录socket和usb信息，并将其放入全局链表connectedDevices维护。
这里不经会让我们产生疑问，到底usb收发数据是在哪里，又是在什么地方与tcp server进行交互，我们继续往下看。
entry中维护了usb状态，同时也有socket，entry被放入startUSBPipe函数，下面着重看一下startUSBPipe的实现。

startUSBPipe

static int startUSBPipe(struct listentry *device) {
    int r;
    if(initUsbXferThread(&device->usbRxThread) < 0) {
        logError("failed to allocate usb rx transfer\n");
        return -1;
    }
    if(initUsbXferThread(&device->socketRxThread) < 0) {
        logError("failed to allocate usb tx transfer\n");
        destroyUsbXferThread(&device->usbRxThread);
        return -1;
    }

    //写入到usb任务
    r = pthread_create(&device->usbRxThread.thread, NULL, (void*)&a2s_usbRxThread, (void*)device);
    if (r < 0) {
        logError("failed to start usb rx thread\n");
        return -1;
    }

    //读出到socket任务
    r = pthread_create(&device->socketRxThread.thread, NULL, (void*)&a2s_socketRxThread, (void*)device);
    if (r < 0) {
        // other thread is stopped in disconnectDevice method
        logError("failed to start socket rx thread\n");
        return -1;
    }

    return 0;
}

这里开启了两个线程，分别是usb数据写入server任务和server写入usb任务。下面分别看一下这两个任务。

a2s_usbRxThread

//usb写入socket任务
void *a2s_usbRxThread( void *d ) {
    logDebug("a2s_usbRxThread started\n");

    struct listentry *device = (struct listentry*)d;

    unsigned char buffer[device->droid.inpacketsize];
    int rxBytes = 0;
    int txBytes;
    int sent;
    int r;

    //初始化usbRxThread.xfr ，关联数据buffer   传输完毕后回调a2s_usbrx_cb  解锁device->usbRxThread.condition
    libusb_fill_bulk_transfer(device->usbRxThread.xfr, device->droid.usbHandle, device->droid.inendp,
            buffer, sizeof(buffer),
            (libusb_transfer_cb_fn)&a2s_usbrx_cb, (void*)&device->usbRxThread, 0);

    while(!device->usbRxThread.stop && !device->usbDead && !device->socketDead) {

        pthread_mutex_lock( &device->usbRxThread.mutex );
        device->usbRxThread.usbActive = 1;

//      logDebug("a2s_usbRxThread reading...\n");
        //请求数据
        r = libusb_submit_transfer(device->usbRxThread.xfr);
        if (r < 0) {
            logError("a2s usbrx submit transfer failed\n");
            device->usbDead = 1;
            device->usbRxThread.usbActive = 0;
            pthread_mutex_unlock( &device->usbRxThread.mutex );
            break;
        }

//      waitUsbXferThread(&device->usbRxThread);

//      logDebug("a2s_usbRxThread waiting...\n");
        //等待接收数据
        pthread_cond_wait( &device->usbRxThread.condition, &device->usbRxThread.mutex);
//      logDebug("a2s_usbRxThread wait over\n");
        if (device->usbRxThread.usbActive) {
            logError("wait, unlock but usbActive!\n");
        }
        pthread_mutex_unlock( &device->usbRxThread.mutex );

        if (device->usbRxThread.stop || device->usbDead || device->socketDead)
            break;

        //查看usb接收数据的状态
        switch(device->usbRxThread.xfr->status) {
        case LIBUSB_TRANSFER_COMPLETED:
//          logDebug("a2s_usbRxThread writing...\n");
            rxBytes = device->usbRxThread.xfr->actual_length;

            logDebug("usb recive len %d \n", rxBytes);

            sent = 0;
            txBytes = 0;
            while(sent < rxBytes && !device->usbRxThread.stop) {
                //将usb接收到的数据全部写入到socket
                txBytes = write(device->sockfd, buffer + sent, rxBytes - sent);
                if (txBytes <= 0) {
                    logError("a2s usbrx socket tx failed\n");
                    device->socketDead = 1;
                    device->usbRxThread.stop = 1;
                } else {
                    sent += txBytes;
                }
            }
            break;
        case LIBUSB_TRANSFER_NO_DEVICE:
            device->usbDead = 1;
            device->usbRxThread.stop = 1;
            break;
        default:
//          logDebug("a2s_usbRxThread usb error %d, ignoring\n", device->usbRxThread.xfr->status);
            break;
        }
    }

    device->usbRxThread.stopped = 1;
    logDebug("a2s_usbRxThread finished\n");
    pthread_exit(0);
    return NULL;
}

libusb_fill_bulk_transfer

这个方法使用entry中的数据，开启usb通路，如果接收到了usb数据，就会回调a2s_usbrx_cb。

之后调用

libusb_submit_transfer

请求接收数据。请求完数据线程被锁，如果a2s_usbrx_cb被回调，则会发送一个信号量，线程锁打开。此时usb数据已经传入到了缓冲区，entry中存储的socket的描述符，直接将buffer写入这个描述符，server就会收到usb信息。数据发送任务也是同理。到此，usb和server通道就已经打通。

另外，AOA模式可以直接打开应用，下面看一下AOA模式是如何打开的。

isDroidInAcc

这个函数用于设备检测是否处于AOA模式

int isDroidInAcc(libusb_device *dev) {
    struct libusb_device_descriptor desc;
    int r = libusb_get_device_descriptor(dev, &desc);
    if (r < 0) {
        logError("failed to get device descriptor\n");
//      fprintf(LOG_ERR, ERR_USB_DEVDESC);
        return 0;
    }

    if (desc.idVendor == VID_GOOGLE) {
        switch(desc.idProduct) {
        case PID_AOA_ACC:
        case PID_AOA_ACC_ADB:
        case PID_AOA_ACC_AU:
        case PID_AOA_ACC_AU_ADB:
            return 1;
        case PID_AOA_AU:
        case PID_AOA_AU_ADB:
            logDebug("device is audio-only\n");
//          logDebug( "device is audio-only\n");
            break;
        default:
            break;
        }
    }

    return 0;
}

通过libusb_device获取当前usb设备的状态信息，用来判断usb的厂商和模式等信息。

switchDroidToAcc

这个函数是将设备设置为Accessory模式，这里可以配置我们的设备连接手机后启动哪个android设备。

void switchDroidToAcc(libusb_device *dev, int force, int audio) {
    struct libusb_device_handle* handle;
    unsigned char ioBuffer[2];
    int r;
    int deviceProtocol;

    //打开设备
    if(0 > libusb_open(dev, &handle)){
        logError("Failed to connect to device\n");
        return;
    }

    //写入控制信息
    if(libusb_kernel_driver_active(handle, 0) > 0) {
        if(!force) {
            logError("kernel driver active, ignoring device");
            libusb_close(handle);
            return;
        }
        if(libusb_detach_kernel_driver(handle, 0)!=0) {
            logError("failed to detach kernel driver, ignoring device");
            libusb_close(handle);
            return;
        }
    }
    if(0> (r = libusb_control_transfer(handle,
            0xC0, //bmRequestType
            51, //Get Protocol
            0,
            0,
            ioBuffer,
            2,
            2000))) {
        logError("get protocol call failed %d \n", r);
        libusb_close(handle);
        return;
    }

    deviceProtocol = ioBuffer[1] << 8 | ioBuffer[0];
    if (deviceProtocol < AOA_PROTOCOL_MIN || deviceProtocol > AOA_PROTOCOL_MAX) {
//      logDebug("Unsupported AOA protocol %d\n", deviceProtocol);
        logDebug( "Unsupported AOA protocol %d\n", deviceProtocol);
        libusb_close(handle);
        return;
    }

    //这些量用于指定启动app，我们在app中也会写入同样的信息
    const char *setupStrings[6];
    setupStrings[0] = vendor;
    setupStrings[1] = model;
    setupStrings[2] = description;
    setupStrings[3] = version;
    setupStrings[4] = uri;
    setupStrings[5] = serial;

    int i;
    for(i=0;i<6;i++) {
        if(0 > (r = libusb_control_transfer(handle,
                0x40,
                52,
                0,
                (uint16_t)i,
                (unsigned char*)setupStrings[i],
                strlen(setupStrings[i]),2000))) {
            logDebug( "send string %d call failed\n", i);
            libusb_close(handle);
            return;
        }
    }

    if (deviceProtocol >= 2) {
        if(0 > (r = libusb_control_transfer(handle,
                0x40, //厂商的请求
                58,
#ifdef USE_AUDIO
                audio, // 0=no audio, 1=2ch,16bit PCM, 44.1kHz
#else
                0,
#endif
                0,
                NULL,
                0,
                2000))) {
            logDebug( "set audio call failed\n");
            libusb_close(handle);
            return;
        }
    }

    if(0 > (r = libusb_control_transfer(handle,0x40,53,0,0,NULL,0,2000))) {
        logDebug( "start accessory call failed\n");
        libusb_close(handle);
        return;
    }

    libusb_close(handle);
}

server例程

下面是我们自己实现的socket server，用于接收和发送数据，这里我们会向usb发送“hello“字符串，然后打印收到的数据。当然，在使用时可以把上面的例子作为单独进程开启，作为单独模块，而数据发送和接收在我们自己的应用的进程中。

//数据接收线程
void *recvThread(void *arg){

    int length;

    struct thread_param *param = (struct thread_param *)arg;
    int socket = param->socket_id;

    printf("recvThread %d\n", socket);

    char buffer[BUFFER_SIZE];
    bzero(buffer, BUFFER_SIZE);

    while(loop_flag){

        length = recv(socket,buffer,BUFFER_SIZE,0 );
        if (length < 0)
        {
            printf("Server Recieve Data Failed!\n");
            loop_flag = 0;
            break;
        }
        //打印接收到的数据内容
        printf("receive %s\n", buffer);
    }
}

//数据发送线程 每隔一秒发送
void *sendThread(void *arg){

    struct thread_param *param = (struct thread_param *)arg;
    int socket = param->socket_id;

    printf("sendThread %d\n", socket);

    char buffer[BUFFER_SIZE];
    bzero(buffer, BUFFER_SIZE);

    while(loop_flag){

        printf("\nStart send\n");

        int length = 12;
        buffer[0] = 'h';
        buffer[1] = 'e';
        buffer[2] = 'l';
        buffer[3] = 'l';
        buffer[4] = 'o';
        buffer[5] = 0;
        //发送buffer中的字符串到new_server_socket,实际是给客户端
        if(send(socket,buffer,length,0)<0)
        {
            printf("Send faield\n");
            loop_flag = 0;
            break;
        }
        sleep(1);
    }
}

//开启自定义服务 
int start_service(int argc, char **argv)
{
    printf("start_service\n");
    //设置一个socket地址结构server_addr,代表服务器internet地址, 端口
    struct sockaddr_in server_addr;
    bzero(&server_addr,sizeof(server_addr)); //把一段内存区的内容全部设置为0
    server_addr.sin_family = AF_INET;
    server_addr.sin_addr.s_addr = htons(INADDR_ANY);
    server_addr.sin_port = htons(HELLO_WORLD_SERVER_PORT);

    //创建用于internet的流协议(TCP)socket,用server_socket代表服务器socket
    int server_socket = socket(PF_INET,SOCK_STREAM,0);
    if( server_socket < 0)
    {
        printf("Create Socket Failed!");
        exit(1);
    }
    { 
    int opt =1;
    setsockopt(server_socket,SOL_SOCKET,SO_REUSEADDR,&opt,sizeof(opt));
    }

    //把socket和socket地址结构联系起来
    if( bind(server_socket,(struct sockaddr*)&server_addr,sizeof(server_addr)))
    {
        printf("Server Bind Port : %d Failed!", HELLO_WORLD_SERVER_PORT); 
        exit(1);
    }

    //server_socket用于监听
    if ( listen(server_socket, LENGTH_OF_LISTEN_QUEUE) )
    {
        printf("Server Listen Failed!"); 
        exit(1);
    }
    while (1) 
    {
        struct sockaddr_in client_addr;
        socklen_t length = sizeof(client_addr);

        int new_server_socket = accept(server_socket,(struct sockaddr*)&client_addr,&length);
        if ( new_server_socket < 0)
        {
            printf("Server Accept Failed!\n");
            break;
        }

        loop_flag = 1;

        threadParam.socket_id = new_server_socket;
        pthread_create(&recvThreadId, NULL, recvThread, &threadParam);
        pthread_create(&sendThreadId, NULL, sendThread, &threadParam);

        char buffer[BUFFER_SIZE];
        bzero(buffer, BUFFER_SIZE);

        while(1){
            sleep(1);
            if(loop_flag == 0){
                break;
            }
        }

        printf("close server socket \n");
        //关闭与客户端的连接
        close(new_server_socket);
    }
    //关闭监听用的socket
    close(server_socket);
    return 0;
}

void create_start_service(){

    pthread_create(&mainThreadId, NULL, start_service, &mainThreadParam);
}

总结

上文介绍了Android AOA协议设备端实现的基本流程，首先介绍了项目的使用方法，之后梳理了本地server和usb通信的流程，最后介绍了设备端开启app的方法，下一篇文章我们将分析android端代码如何对接设备端。