MPSS异常引起系统无法休眠

1、遇到一个现象，手机待机17小时电量耗光了，从BatteryStats的Historian图表看，持续有Phone scanning，但实际上未插卡。

2、从电量估算来看，绝大部分都是Unaccounted，并非APP的CPU消耗：

  Estimated power use (mAh):
    Capacity: 4850, Computed drain: 139, actual drain: 3444-3492
    Unaccounted: 3305 ( ) Including smearing: 0 ( ) Excluded from smearing
    Cell standby: 54.8 ( radio=54.8 ) Excluded from smearing

3、从BatteryStats的log看整个信号都很差，有+phone_scanning但没有-phone_scanning配对出现：

     Cellular Rx signal strength (RSRP):
       very poor (less than -128dBm):  17h 41m 5s 538ms (100.0%) 

4、从代码流程看，+phone_scanning一直没等到-phone_scanning，原因是TelephonyRegistry.java没收到底层的状态改变广播broadcastServiceStateChanged。

private void updateAllPhoneStateLocked(int state, int simState, int strengthBin) {

        boolean scanning = false;

        if (simState == TelephonyManager.SIM_STATE_ABSENT) {   //不插卡
            // In this case we will always be STATE_OUT_OF_SERVICE, so need
            // to infer that we are scanning from other data.
            if (state == ServiceState.STATE_OUT_OF_SERVICE
                    && strengthBin > SignalStrength.SIGNAL_STRENGTH_NONE_OR_UNKNOWN) {   //信号强度
                state = ServiceState.STATE_IN_SERVICE;   //in service
            }
        }

        if (state == ServiceState.STATE_POWER_OFF) {
            strengthBin = -1;

        // If we are in service, make sure the correct signal string timer is running.
        } else if (state == ServiceState.STATE_IN_SERVICE) {
            // Bin will be changed below.

        // If we're out of service, we are in the lowest signal strength
        // bin and have the scanning bit set.
        } else if (state == ServiceState.STATE_OUT_OF_SERVICE) {
            scanning = true;
            strengthBin = SignalStrength.SIGNAL_STRENGTH_NONE_OR_UNKNOWN;
            if (!mPhoneSignalScanningTimer.isRunningLocked()) {
                mHistoryCur.states |= HistoryItem.STATE_PHONE_SCANNING_FLAG;    //对应batterystats的+phone_scanning
                newHistory = true;
                if (DEBUG_HISTORY) Slog.v(TAG, "Phone started scanning to: "
                        + Integer.toHexString(mHistoryCur.states));
                mPhoneSignalScanningTimer.startRunningLocked(elapsedRealtime);
                StatsLog.write(StatsLog.PHONE_SERVICE_STATE_CHANGED, state, simState, strengthBin);
            }
        }

        if (!scanning) {
            // If we are no longer scanning, then stop the scanning timer.
            if (mPhoneSignalScanningTimer.isRunningLocked()) {
                mHistoryCur.states &= ~HistoryItem.STATE_PHONE_SCANNING_FLAG;     //对应batterystats的-phone_scanning
                if (DEBUG_HISTORY) Slog.v(TAG, "Phone stopped scanning to: "
                        + Integer.toHexString(mHistoryCur.states));
                newHistory = true;
                mPhoneSignalScanningTimer.stopRunningLocked(elapsedRealtime);
                StatsLog.write(StatsLog.PHONE_SERVICE_STATE_CHANGED, state, simState, strengthBin);
            }
        }

}

5、从kernel的log看，从msm_rpmh_master_stats_show埋点统计看，MPSS的Sleep Count一直都是0x0，一直无法休眠。

6、总结：高通的5G Modem在某种情况下一直无法完成搜网，即使不插卡的情况也会发生，导致MPSS系统无法休眠，电池电量很快消耗完毕，需要高通支持介入分析原因。