android6.0 adbd深入分析（四）adbd usb线拔掉再连接的过程

最新推荐文章于 2024-05-11 20:01:18 发布

kc专栏

最新推荐文章于 2024-05-11 20:01:18 发布

阅读量5.7k

点赞数 1

分类专栏： android adb 文章标签： adbd

本文链接：https://blog.csdn.net/kc58236582/article/details/51151123

版权

android adb 专栏收录该内容

10 篇文章 8 订阅

订阅专栏

这篇博客我们主要分析下adbd在usb线拔掉，然后再连接的代码流程。

一、log打印流程

我们先来看下自己调试的代码打印：

由于显示的问题，我把log的时间去除了，只显示了pid 和tid

//拔去usb线
185   188 I adbd    : output_thread:(null): remote read failed for transport
185   188 I adbd    : output_thread:(null) SYNC offline for transport
185   185 I adbd    : handle_packet: A_SYNC
185   185 I adbd    : handle_packet: A_SYNC CS_OFFLINE
185   187 I adbd    : input_thread:(null): transport SYNC offline
185   187 I adbd    : input_thread:(null): transport input thread is exiting, fd 13
185   186 I usb_adb_open_thread: adbd usb_thread - opening device
185   186 I usb_adb_open_thread: adbd opening device succeeded
185   185 I adbd    : handle_packet: A_SYNC
185   185 I adbd    : handle_packet: A_SYNC send_packet
185  2164 I adbd    : input_thread:(null): transport SYNC online



//插上usb线
185  2165 I adbd    : output_thread: read_from_remote after
185   185 I adbd    : handle_packet: A_CNXN
185   185 I adbd    : handle_packet: A_CNXN handle_online
185   185 I adbd    : handle_packet: A_CNXN send_connect
185  2165 I adbd    : output_thread: read_from_remote after
185   185 I adbd    : adb command: 'shell:dumpsys iphonesubinfo'
185  2165 I adbd    : output_thread: read_from_remote after
185  2165 I adbd    : output_thread: read_from_remote after
185   185 I adbd    : adb command: 'shell:dumpsys battery'
185  2165 I adbd    : output_thread: read_from_remote after
185  2165 I adbd    : output_thread: read_from_remote after
185  2165 I adbd    : output_thread: read_from_remote after
185   185 I adbd    : handle_packet: A_CNXN
185   185 I adbd    : handle_packet: A_CNXN handle_offline
185   185 I adbd    : handle_packet: A_CNXN handle_online
185   185 I adbd    : handle_packet: A_CNXN send_connect

二、拔usb线流程

2.1 output_thread读取adb驱动的数据出错

我们按照log看，首先就是output_thread读取adb驱动的数据出错了

static void *output_thread(void *_t)
{
    atransport *t = reinterpret_cast<atransport*>(_t);
    apacket *p;

    D("%s: starting transport output thread on fd %d, SYNC online (%d)\n",
       t->serial, t->fd, t->sync_token + 1);
    p = get_apacket();
    p->msg.command = A_SYNC;
    p->msg.arg0 = 1;
    p->msg.arg1 = ++(t->sync_token);
    p->msg.magic = A_SYNC ^ 0xffffffff;
    if(write_packet(t->fd, t->serial, &p)) {
        put_apacket(p);
        D("%s: failed to write SYNC packet\n", t->serial);
        goto oops;
    }

    D("%s: data pump started\n", t->serial);
    for(;;) {
        p = get_apacket();

        if(t->read_from_remote(p, t) == 0){
            D("%s: received remote packet, sending to transport\n",
              t->serial);
            if(write_packet(t->fd, t->serial, &p)){
                put_apacket(p);
                D("%s: failed to write apacket to transport\n", t->serial);
		LOG("%s:%s: failed to write apacket to transport\n", __FUNCTION__, t->serial);
                goto oops;
            }
        } else {
            D("%s: remote read failed for transport\n", t->serial);
	    LOG("%s:%s: remote read failed for transport\n", __FUNCTION__, t->serial);//读取adb驱动数据失败
            put_apacket(p);
            break;
        }
    }

    D("%s: SYNC offline for transport\n", t->serial);
    LOG("%s:%s SYNC offline for transport\n", __FUNCTION__, t->serial);//线程退出
    p = get_apacket();
    p->msg.command = A_SYNC;
    p->msg.arg0 = 0;
    p->msg.arg1 = 0;
    p->msg.magic = A_SYNC ^ 0xffffffff;
    if(write_packet(t->fd, t->serial, &p)) {//往sockpair另一侧写信息
        put_apacket(p);
        D("%s: failed to write SYNC apacket to transport", t->serial);
    }

output_thread读取adb驱动的数据出错了，然后退出线程并发送sockpair的另一侧数据

另一侧的socketpair关联的函数是transport_socket_events函数

        fdevent_install(&(t->transport_fde),
                        t->transport_socket,
                        transport_socket_events,
                        t);

transport_socket_events函数，接着调用了handle_packet函数

static void transport_socket_events(int fd, unsigned events, void *_t)
{
    atransport *t = reinterpret_cast<atransport*>(_t);
    D("transport_socket_events(fd=%d, events=%04x,...)\n", fd, events);
    if(events & FDE_READ){
        apacket *p = 0;
        if(read_packet(fd, t->serial, &p)){
            D("%s: failed to read packet from transport socket on fd %d\n", t->serial, fd);
        } else {
            handle_packet(p, (atransport *) _t);
        }
    }
}

2.2 handle_packet处理offline

handle_packet函数收到A_SYNC命令，然后处理offline

void handle_packet(apacket *p, atransport *t)
{
    asocket *s;

    D("handle_packet() %c%c%c%c\n", ((char*) (&(p->msg.command)))[0],
            ((char*) (&(p->msg.command)))[1],
            ((char*) (&(p->msg.command)))[2],
            ((char*) (&(p->msg.command)))[3]);
    print_packet("recv", p);

    switch(p->msg.command){
    case A_SYNC:
	LOG("%s: A_SYNC \n", __FUNCTION__);//进入sync
        if(p->msg.arg0){
            send_packet(p, t);
	    LOG("%s: A_SYNC send_packet\n", __FUNCTION__);
            if(HOST) send_connect(t);
        } else {
            t->connection_state = CS_OFFLINE;
	    LOG("%s: A_SYNC CS_OFFLINE\n", __FUNCTION__);//offline处理
            handle_offline(t);
            send_packet(p, t);
        }
        return;

hand_packet处理sync消息，我们先来看handle_offline函数，其实就是把状态处理下

void handle_offline(atransport *t)
{
    D("adb: offline\n");
    //Close the associated usb
    t->online = 0;
    run_transport_disconnects(t);
}

2.3 Input_thread处理offline

处理offline的我们看send_packet也是往socketpair的另一侧写数据，这样inputThread会有数据接收

static void *input_thread(void *_t)
{
    atransport *t = reinterpret_cast<atransport*>(_t);
    apacket *p;
    int active = 0;

    D("%s: starting transport input thread, reading from fd %d\n",
       t->serial, t->fd);

    for(;;){
        if(read_packet(t->fd, t->serial, &p)) {
            D("%s: failed to read apacket from transport on fd %d\n",
               t->serial, t->fd );
	      LOG("%s:%s: failed to read apacket from transport on fd %d\n", __FUNCTION__, t->serial, t->fd );
            break;
        }
        if(p->msg.command == A_SYNC){
            if(p->msg.arg0 == 0) {
                D("%s: transport SYNC offline\n", t->serial);
                put_apacket(p);
		LOG("%s:%s: transport SYNC offline\n", __FUNCTION__, t->serial);//收到handle_packet发来的offline的消息，跳出循环
                break;
            } else {
                if(p->msg.arg1 == t->sync_token) {
		    LOG("%s:%s: transport SYNC online\n", __FUNCTION__, t->serial);
                    active = 1;
                } else {
                    D("%s: transport ignoring SYNC %d != %d\n",
                      t->serial, p->msg.arg1, t->sync_token);
                }
            }
        } else {
            if(active) {
                D("%s: transport got packet, sending to remote\n", t->serial);
                t->write_to_remote(p, t);
            } else {
                D("%s: transport ignoring packet while offline\n", t->serial);
            }
        }

        put_apacket(p);
    }

    // this is necessary to avoid a race condition that occured when a transport closes
    // while a client socket is still active.
    close_all_sockets(t);

    D("%s: transport input thread is exiting, fd %d\n", t->serial, t->fd);
    LOG("%s:%s: transport input thread is exiting, fd %d\n", __FUNCTION__, t->serial, t->fd);//线程结束
    kick_transport(t);//调用了kick_transport函数
    transport_unref(t);
    return 0;

Input_thread收到handle_packet发来的offline消息，直接退出线程，并且调用了kick_transport函数

void kick_transport(atransport* t)
{
    if (t && !t->kicked)
    {
        int  kicked;

        adb_mutex_lock(&transport_lock);
        kicked = t->kicked;
        if (!kicked)
            t->kicked = 1;
        adb_mutex_unlock(&transport_lock);

        if (!kicked)
            t->kick(t);
    }
}

这里调用了kick其实是remote_kick函数

void init_usb_transport(atransport *t, usb_handle *h, int state)
{
    D("transport: usb\n");
    t->close = remote_close;
    t->kick = remote_kick;
    t->read_from_remote = remote_read;
    t->write_to_remote = remote_write;
    t->sync_token = 1;
    t->connection_state = state;
    t->type = kTransportUsb;
    t->usb = h;

#if ADB_HOST
    HOST = 1;
#else
    HOST = 0;
#endif
}

remote_kick调用了usb_kick函数

static void remote_kick(atransport *t)
{
    usb_kick(t->usb);
}

然后才调用了usb_handle的kick函数

void usb_kick(usb_handle *h)
{
    h->kick(h);
}

在usb_adb_init初始化的时候kick为usb_adb_kick

static void usb_adb_init()
{
    usb_handle* h = reinterpret_cast<usb_handle*>(calloc(1, sizeof(usb_handle)));
    if (h == nullptr) fatal("couldn't allocate usb_handle");

    h->write = usb_adb_write;
    h->read = usb_adb_read;
    h->kick = usb_adb_kick;

我们再来看看这个函数，最终是发送了一个signal

static void usb_adb_kick(usb_handle *h)
{
    D("usb_kick\n");
    adb_mutex_lock(&h->lock);
    adb_close(h->fd);
    h->fd = -1;

    // notify usb_adb_open_thread that we are disconnected
    adb_cond_signal(&h->notify);
    adb_mutex_unlock(&h->lock);
}

而就是这个signal导致usb_adb_open_thread等待的状态打破，重新打开了adb驱动，然后重新开启input_thread output_thread

static void *usb_adb_open_thread(void *x)
{
    struct usb_handle *usb = (struct usb_handle *)x;
    int fd;

    while (true) {
        // wait until the USB device needs opening
        adb_mutex_lock(&usb->lock);
        while (usb->fd != -1)
            adb_cond_wait(&usb->notify, &usb->lock);// 等待信号
        adb_mutex_unlock(&usb->lock);

        D("[ usb_thread - opening device ]\n");//重新打开adb驱动
        __android_log_print(ANDROID_LOG_INFO, __FUNCTION__,
                   "adbd usb_thread - opening device\n");
        do {
            /* XXX use inotify? */
            fd = unix_open("/dev/android_adb", O_RDWR);
            if (fd < 0) {
                // to support older kernels
                fd = unix_open("/dev/android", O_RDWR);
            }
            if (fd < 0) {
                adb_sleep_ms(1000);
            }
        } while (fd < 0);
        D("[ opening device succeeded ]\n");
        __android_log_print(ANDROID_LOG_INFO, __FUNCTION__,
                   "adbd opening device succeeded\n");

        close_on_exec(fd);
        usb->fd = fd;

        D("[ usb_thread - registering device ]\n");
        register_usb_transport(usb, 0, 0, 1);//注册usb通道，最好开启input_thread和output_thread
    }

    // never gets here
    return 0;
}

2.3 重启开启output_thread input_thread线程

然后在output_thread打开后，先会往handle_packet发送一个A_SYNC命令

static void *output_thread(void *_t)
{
    atransport *t = reinterpret_cast<atransport*>(_t);
    apacket *p;

    D("%s: starting transport output thread on fd %d, SYNC online (%d)\n",
       t->serial, t->fd, t->sync_token + 1);
    p = get_apacket();
    p->msg.command = A_SYNC;
    p->msg.arg0 = 1;
    p->msg.arg1 = ++(t->sync_token);
    p->msg.magic = A_SYNC ^ 0xffffffff;
    if(write_packet(t->fd, t->serial, &p)) {
        put_apacket(p);
        D("%s: failed to write SYNC packet\n", t->serial);
        goto oops;
    }

然后到handle_packet如何处理这个sync命令的呢

void handle_packet(apacket *p, atransport *t)
{
    asocket *s;

    D("handle_packet() %c%c%c%c\n", ((char*) (&(p->msg.command)))[0],
            ((char*) (&(p->msg.command)))[1],
            ((char*) (&(p->msg.command)))[2],
            ((char*) (&(p->msg.command)))[3]);
    print_packet("recv", p);

    switch(p->msg.command){
    case A_SYNC:
	LOG("%s: A_SYNC \n", __FUNCTION__);
        if(p->msg.arg0){//为1
            send_packet(p, t);//就又往input_thread发送包了
	    LOG("%s: A_SYNC send_packet\n", __FUNCTION__);
            if(HOST) send_connect(t);
        } else {
            t->connection_state = CS_OFFLINE;
	    LOG("%s: A_SYNC CS_OFFLINE\n", __FUNCTION__);
            handle_offline(t);
            send_packet(p, t);
        }
        return;

而input_thread收到这sync命令后的处理如下：

static void *input_thread(void *_t)
{
    atransport *t = reinterpret_cast<atransport*>(_t);
    apacket *p;
    int active = 0;

    D("%s: starting transport input thread, reading from fd %d\n",
       t->serial, t->fd);

    for(;;){
        if(read_packet(t->fd, t->serial, &p)) {
            D("%s: failed to read apacket from transport on fd %d\n",
               t->serial, t->fd );
			LOG("%s:%s: failed to read apacket from transport on fd %d\n", __FUNCTION__, t->serial, t->fd );
            break;
        }
        if(p->msg.command == A_SYNC){
            if(p->msg.arg0 == 0) {
                D("%s: transport SYNC offline\n", t->serial);
                put_apacket(p);
		LOG("%s:%s: transport SYNC offline\n", __FUNCTION__, t->serial);
                break;
            } else {
                if(p->msg.arg1 == t->sync_token) {//收到sync命令后，将active置为1，代表下次就可以往adb驱动写了
                    D("%s: transport SYNC online\n", t->serial);
		    LOG("%s:%s: transport SYNC online\n", __FUNCTION__, t->serial);
                    active = 1;
                } else {
                    D("%s: transport ignoring SYNC %d != %d\n",
                      t->serial, p->msg.arg1, t->sync_token);
					LOG("%s:%s: transport ignoring SYNC\n", __FUNCTION__, t->serial);
                }
            }
        } else {
            if(active) {
                D("%s: transport got packet, sending to remote\n", t->serial);
                t->write_to_remote(p, t);
            } else {
                D("%s: transport ignoring packet while offline\n", t->serial);
            }
        }

        put_apacket(p);
    }

input_thread收到sync命令后将active置为1，代表下次有数据过来可以往adb驱动里面写了。

但是是不是有个疑问，因为这个时候usb先拔了，而且没有再插上，那为什么这个时候input_thread可以往adb驱动写数据呢？答案在这里：

static void *output_thread(void *_t)
{
    atransport *t = reinterpret_cast<atransport*>(_t);
    apacket *p;

    D("%s: starting transport output thread on fd %d, SYNC online (%d)\n",
       t->serial, t->fd, t->sync_token + 1);
    p = get_apacket();
    p->msg.command = A_SYNC;
    p->msg.arg0 = 1;
    p->msg.arg1 = ++(t->sync_token);
    p->msg.magic = A_SYNC ^ 0xffffffff;
    if(write_packet(t->fd, t->serial, &p)) {
        put_apacket(p);
        D("%s: failed to write SYNC packet\n", t->serial);
        goto oops;
    }

    D("%s: data pump started\n", t->serial);
    for(;;) {
        p = get_apacket();
	//在这里修改了代码，本来没有result变量的，这个函数直接在if判断中，这里我们把它分开，并且打log，就是为了验证这个函数是否阻塞
	int result = t->read_from_remote(p, t);//没有插上usb线，这个函数一直会阻塞
	LOG("%s: read_from_remote after\n", __FUNCTION__);

        if(result == 0){
            D("%s: received remote packet, sending to transport\n",
              t->serial);
            if(write_packet(t->fd, t->serial, &p)){
                put_apacket(p);
                D("%s: failed to write apacket to transport\n", t->serial);
		LOG("%s:%s: failed to write apacket to transport\n", __FUNCTION__, t->serial);
                goto oops;
            }
        } else {
            D("%s: remote read failed for transport\n", t->serial);
	    LOG("%s:%s: remote read failed for transport\n", __FUNCTION__, t->serial);
            put_apacket(p);
            break;
        }
    }

这个时候我们在output_thread里面稍微修改了代码，并且增加了log，发现没有插上usb线的时候，这个时候output_thread在读取adb驱动数据的时候会阻塞，这样也就不会有数据传到input_thread往adb驱动中写了，当然就不会有问题了。

三、插上usb线流程

下面我们再来分析细插上usb线的代码流程：

我们先看log，拔去usb线先打印了read_from_remote after这个log，说明这个时候output_thread从adb驱动读取数据不再阻塞了，然后就把数据发送了handle_packet.

handle_packet这个时候直接收到adb驱动来的 A_CNXN命令:

    case A_CNXN: /* CONNECT(version, maxdata, "system-id-string") */
            /* XXX verify version, etc */
	LOG("%s: A_CNXN\n", __FUNCTION__);
        if(t->connection_state != CS_OFFLINE) {
            t->connection_state = CS_OFFLINE;
            handle_offline(t);
	    LOG("%s: A_CNXN handle_offline\n", __FUNCTION__);
        }

        parse_banner(reinterpret_cast<const char*>(p->data), t);

        if (HOST || !auth_required) {
            handle_online(t);
	    LOG("%s: A_CNXN handle_online\n", __FUNCTION__);
            if (!HOST) {
		send_connect(t);
		LOG("%s: A_CNXN send_connect\n", __FUNCTION__);
            }
        } else {
            send_auth_request(t);
	    LOG("%s: A_CNXN send_auth_request\n", __FUNCTION__);
        }
        break;

由于一开始，transport的connection_state = CS_OFFLINE，所以先处理了handle_online, 然后调用了send_connect函数：

void handle_online(atransport *t)
{
    D("adb: online\n");
    t->online = 1;
}

send_connect就是往input_thread发送连接信息，最后就是往adb驱动发送, 这样pc就知道和adbd连接上了。

void send_connect(atransport *t)
{
    D("Calling send_connect \n");
    apacket *cp = get_apacket();
    cp->msg.command = A_CNXN;
    cp->msg.arg0 = A_VERSION;
    cp->msg.arg1 = MAX_PAYLOAD;
    cp->msg.data_length = fill_connect_data((char *)cp->data,
                                            sizeof(cp->data));
    send_packet(cp, t);
}

还有就是，在parse_banner这个函数中对connection_state做了处理

void parse_banner(const char* banner, atransport* t) {
    D("parse_banner: %s\n", banner);

    // The format is something like:
    // "device::ro.product.name=x;ro.product.model=y;ro.product.device=z;".
    std::vector<std::string> pieces = android::base::Split(banner, ":");

    if (pieces.size() > 2) {
        const std::string& props = pieces[2];
        for (auto& prop : android::base::Split(props, ";")) {
            // The list of properties was traditionally ;-terminated rather than ;-separated.
            if (prop.empty()) continue;

            std::vector<std::string> key_value = android::base::Split(prop, "=");
            if (key_value.size() != 2) continue;

            const std::string& key = key_value[0];
            const std::string& value = key_value[1];
            if (key == "ro.product.name") {
                qual_overwrite(&t->product, value);
            } else if (key == "ro.product.model") {
                qual_overwrite(&t->model, value);
            } else if (key == "ro.product.device") {
                qual_overwrite(&t->device, value);
            }
        }
    }

    const std::string& type = pieces[0];
    if (type == "bootloader") {
        D("setting connection_state to CS_BOOTLOADER\n");
        t->connection_state = CS_BOOTLOADER;
        update_transports();
    } else if (type == "device") {
        D("setting connection_state to CS_DEVICE\n");
        t->connection_state = CS_DEVICE;
        update_transports();
    } else if (type == "recovery") {
        D("setting connection_state to CS_RECOVERY\n");
        t->connection_state = CS_RECOVERY;
        update_transports();
    } else if (type == "sideload") {
        D("setting connection_state to CS_SIDELOAD\n");
        t->connection_state = CS_SIDELOAD;
        update_transports();
    } else {
        D("setting connection_state to CS_HOST\n");
        t->connection_state = CS_HOST;
    }
}

因此我在处理A_CNXN的时候，在parse_banner前后打了log

   case A_CNXN: /* CONNECT(version, maxdata, "system-id-string") */
            /* XXX verify version, etc */
		LOG("%s: A_CNXN\n", __FUNCTION__);
        if(t->connection_state != CS_OFFLINE) {
            t->connection_state = CS_OFFLINE;
            handle_offline(t);
			LOG("%s: A_CNXN handle_offline\n", __FUNCTION__);
        }

	LOG("%s: A_CNXN parse_banner before: connection_state:%d\n", __FUNCTION__, t->connection_state);

        parse_banner(reinterpret_cast<const char*>(p->data), t);

	LOG("%s: A_CNXN parse_banner after: connection_state:%d\n", __FUNCTION__, t->connection_state);

最后发现当插上usb线的时候，一开始connection_state:0也就是CS_OFFLINE，后面变成了3也就是CS_HOST

185   185 I adbd    : handle_packet: A_CNXN
185   185 I adbd    : handle_packet: A_CNXN parse_banner before: connection_state:0
185   185 I adbd    : handle_packet: A_CNXN parse_banner after: connection_state:3
185   185 I adbd    : handle_packet: A_CNXN handle_online
185   185 I adbd    : handle_packet: A_CNXN send_connect

至于后面一些log，shell:dumpsys iphonesubinfo' shell:dumpsys battery'都是一些别的命令

//插上usb线

185   185 I adbd    : handle_packet: A_CNXN
185   185 I adbd    : handle_packet: A_CNXN parse_banner before: connection_state:0
185   185 I adbd    : handle_packet: A_CNXN parse_banner after: connection_state:3
185   185 I adbd    : handle_packet: A_CNXN handle_online
185   185 I adbd    : handle_packet: A_CNXN send_connect
185   185 I adbd    : adb command: 'shell:dumpsys iphonesubinfo'
185   185 I adbd    : adb command: 'shell:dumpsys battery'
185   185 I adbd    : handle_packet: A_CNXN
185   185 I adbd    : handle_packet: A_CNXN handle_offline
185   185 I adbd    : handle_packet: A_CNXN parse_banner before: connection_state:0
185   185 I adbd    : handle_packet: A_CNXN parse_banner after: connection_state:3
185   185 I adbd    : handle_packet: A_CNXN handle_online
185   185 I adbd    : handle_packet: A_CNXN send_connect

最后还有一个命令先处理handle_offline，状态先为0，再改为3

    case A_CNXN: /* CONNECT(version, maxdata, "system-id-string") */
            /* XXX verify version, etc */
		LOG("%s: A_CNXN\n", __FUNCTION__);
        if(t->connection_state != CS_OFFLINE) {
            t->connection_state = CS_OFFLINE;// handleoffline了后connection_state = CS_OFFLINE就为0了
            handle_offline(t);
	    LOG("%s: A_CNXN handle_offline\n", __FUNCTION__);
        }

	LOG("%s: A_CNXN parse_banner before: connection_state:%d\n", __FUNCTION__, t->connection_state);

        parse_banner(reinterpret_cast<const char*>(p->data), t);

	LOG("%s: A_CNXN parse_banner after: connection_state:%d\n", __FUNCTION__, t->connection_state);

        ......

至于最后为什么会连接两次，不是很明白，这应该是协议规定的。

kc专栏

关注

1
点赞
踩
2

收藏

觉得还不错? 一键收藏
1
评论
android6.0 adbd深入分析（四）adbd usb线拔掉再连接的过程

这篇博客我们主要分析下adbd在usb线拔掉，然后再连接的代码流程。一、log打印流程我们先来看下自己调试的代码打印：由于显示的问题，我把log的时间去除了，只显示了pid 和tid//拔去usb线185 188 I adbd : output_thread:(null): remote read failed for transport185 188 I
复制链接

扫一扫

专栏目录