devbox
笔触狂放9
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

fastboot系统更新代码流程分析_ifc_match_func

作者：笔触狂放9 | 2024-03-24 01:15:35

赞

踩

ifc_match_func

说明：本流程基于Android4.4.2中的fastboot源代码讲解，该代码路径在"/system/core/fastboot"下。

从fastboot.c文件的main函数开始

  1. int main(int argc, char **argv)
  2. {
  3.     int wants_wipe = 0;
  4.     int wants_reboot = 0;
  5.     int wants_reboot_bootloader = 0;
  6.     int erase_first = 1;
  7.     void *data;
  8.     unsigned sz;
  9.     int status;
  10.     int c;
  11.     int r;
  12.  
  13.     const struct option longopts[] = {
  14.         {"base", required_argument, 0, 'b'},
  15.         {"kernel_offset", required_argument, 0, 'k'},
  16.         {"page_size", required_argument, 0, 'n'},
  17.         {"ramdisk_offset", required_argument, 0, 'r'},
  18.         {"help", 0, 0, 'h'},
  19.         {0, 0, 0, 0}
  20.     };
  21.  
  22.     serial = getenv("ANDROID_SERIAL");
  23.  
  24.     while (1) {
  25.         int option_index = 0;
  26.         c = getopt_long(argc, argv, "wub:k:n:r:s:S:lp:c:i:m:h", longopts, NULL);
  27.         if (c < 0) {
  28.             break;
  29.         }
  30.         /* Alphabetical cases */
  31.         switch (c) {
  32.         case 'b':
  33.             base_addr = strtoul(optarg, 0, 16);
  34.             break;
  35.         case 'c':
  36.             cmdline = optarg;
  37.             break;
  38.         case 'h':
  39.             usage();
  40.             return 1;
  41.         case 'i': {
  42.                 char *endptr = NULL;
  43.                 unsigned long val;
  44.  
  45.                 val = strtoul(optarg, &endptr, 0);
  46.                 if (!endptr || *endptr != '\0' || (val & ~0xffff))
  47.                     die("invalid vendor id '%s'", optarg);
  48.                 vendor_id = (unsigned short)val;
  49.                 break;
  50.             }
  51.         case 'k':
  52.             kernel_offset = strtoul(optarg, 0, 16);
  53.             break;
  54.         case 'l':
  55.             long_listing = 1;
  56.             break;
  57.         case 'n':
  58.             page_size = (unsigned)strtoul(optarg, NULL, 0);
  59.             if (!page_size) die("invalid page size");
  60.             break;
  61.         case 'p':
  62.             product = optarg;
  63.             break;
  64.         case 'r':
  65.             ramdisk_offset = strtoul(optarg, 0, 16);
  66.             break;
  67.         case 's':
  68.             serial = optarg;
  69.             break;
  70.         case 'S':
  71.             sparse_limit = parse_num(optarg);
  72.             if (sparse_limit < 0) {
  73.                     die("invalid sparse limit");
  74.             }
  75.             break;
  76.         case 'u':
  77.             erase_first = 0;
  78.             break;
  79.         case 'w':
  80.             wants_wipe = 1;
  81.             break;
  82.         case '?':
  83.             return 1;
  84.         default:
  85.             abort();
  86.         }
  87.     }
  88.  
  89.     argc -= optind;
  90.     argv += optind;
  91.  
  92.     if (argc == 0 && !wants_wipe) {
  93.         usage();
  94.         return 1;
  95.     }
  96.  
  97.     if (argc > 0 && !strcmp(*argv, "devices")) {
  98.         skip(1);
  99.         list_devices();
  100.         return 0;
  101.     }
  102.  
  103.     if (argc > 0 && !strcmp(*argv, "help")) {
  104.         usage();
  105.         return 0;
  106.     }
  107.  
  108.     usb = open_device();
  109.  
  110.     while (argc > 0) {
  111.         if(!strcmp(*argv, "getvar")) {
  112.             require(2);
  113.             fb_queue_display(argv[1], argv[1]);
  114.             skip(2);
  115.         } else if(!strcmp(*argv, "erase")) {
  116.             require(2);
  117.  
  118.             if (fb_format_supported(usb, argv[1])) {
  119.                 fprintf(stderr, "******** Did you mean to fastboot format this partition?\n");
  120.             }
  121.  
  122.             fb_queue_erase(argv[1]);
  123.             skip(2);
  124.         } else if(!strcmp(*argv, "format")) {
  125.             require(2);
  126.             if (erase_first && needs_erase(argv[1])) {
  127.                 fb_queue_erase(argv[1]);
  128.             }
  129.             fb_queue_format(argv[1], 0);
  130.             skip(2);
  131.         } else if(!strcmp(*argv, "signature")) {
  132.             require(2);
  133.             data = load_file(argv[1], &sz);
  134.             if (data == 0) die("could not load '%s': %s", argv[1], strerror(errno));
  135.             if (sz != 256) die("signature must be 256 bytes");
  136.             fb_queue_download("signature", data, sz);
  137.             fb_queue_command("signature", "installing signature");
  138.             skip(2);
  139.         } else if(!strcmp(*argv, "reboot")) {
  140.             wants_reboot = 1;
  141.             skip(1);
  142.         } else if(!strcmp(*argv, "reboot-bootloader")) {
  143.             wants_reboot_bootloader = 1;
  144.             skip(1);
  145.         } else if (!strcmp(*argv, "continue")) {
  146.             fb_queue_command("continue", "resuming boot");
  147.             skip(1);
  148.         } else if(!strcmp(*argv, "boot")) {
  149.             char *kname = 0;
  150.             char *rname = 0;
  151.             skip(1);
  152.             if (argc > 0) {
  153.                 kname = argv[0];
  154.                 skip(1);
  155.             }
  156.             if (argc > 0) {
  157.                 rname = argv[0];
  158.                 skip(1);
  159.             }
  160.             data = load_bootable_image(kname, rname, &sz, cmdline);
  161.             if (data == 0) return 1;
  162.             fb_queue_download("boot.img", data, sz);
  163.             fb_queue_command("boot", "booting");
  164.         } else if(!strcmp(*argv, "flash")) {
  165.             char *pname = argv[1];
  166.             char *fname = 0;
  167.             require(2);
  168.             if (argc > 2) {
  169.                 fname = argv[2];
  170.                 skip(3);
  171.             } else {
  172.                 fname = find_item(pname, product);
  173.                 skip(2);
  174.             }
  175.             if (fname == 0) die("cannot determine image filename for '%s'", pname);
  176.             if (erase_first && needs_erase(pname)) {
  177.                 fb_queue_erase(pname);
  178.             }
  179.             do_flash(usb, pname, fname);
  180.         } else if(!strcmp(*argv, "flash:raw")) {
  181.             char *pname = argv[1];
  182.             char *kname = argv[2];
  183.             char *rname = 0;
  184.             require(3);
  185.             if(argc > 3) {
  186.                 rname = argv[3];
  187.                 skip(4);
  188.             } else {
  189.                 skip(3);
  190.             }
  191.             data = load_bootable_image(kname, rname, &sz, cmdline);
  192.             if (data == 0) die("cannot load bootable image");
  193.             fb_queue_flash(pname, data, sz);
  194.         } else if(!strcmp(*argv, "flashall")) {
  195.             skip(1);
  196.             do_flashall(usb, erase_first);
  197.             wants_reboot = 1;
  198.         } else if(!strcmp(*argv, "update")) {
  199.             if (argc > 1) {
  200.                 do_update(usb, argv[1], erase_first);
  201.                 skip(2);
  202.             } else {
  203.                 do_update(usb, "update.zip", erase_first);
  204.                 skip(1);
  205.             }
  206.             wants_reboot = 1;
  207.         } else if(!strcmp(*argv, "oem")) {
  208.             argc = do_oem_command(argc, argv);
  209.         } else {
  210.             usage();
  211.             return 1;
  212.         }
  213.     }
  214.  
  215.     if (wants_wipe) {
  216.         fb_queue_erase("userdata");
  217.         fb_queue_format("userdata", 1);
  218.         fb_queue_erase("cache");
  219.         fb_queue_format("cache", 1);
  220.     }
  221.     if (wants_reboot) {
  222.         fb_queue_reboot();
  223.     } else if (wants_reboot_bootloader) {
  224.         fb_queue_command("reboot-bootloader", "rebooting into bootloader");
  225.     }
  226.  
  227.     if (fb_queue_is_empty())
  228.         return 0;
  229.  
  230.     status = fb_execute_queue(usb);
  231.     return (status) ? 1 : 0;
  232. }

第108行：usb = open_device(); //打开单板设备对应的usb设备

1、 open_device代码如下

总结：打开特定vendor的usb设备，白名单在  match_fastboot_with_serial函数中，详情请往下看。 

  1. usb_handle *open_device(void)
  2. {
  3.     static usb_handle *usb = 0;
  4.     int announce = 1;
  5.  
  6.     if(usb) return usb;
  7.  
  8.     for(;;) {
  9.         usb = usb_open(match_fastboot);
  10.         if(usb) return usb;
  11.         if(announce) {
  12.             announce = 0;
  13.             fprintf(stderr,"< waiting for device >\n");
  14.         }
  15.         sleep(1);
  16.     }
  17. }

第8行到第15行是一个循环结构，如果没有找到可用的usb设备，则一直循环，并在第一次没有找到设备时打印“waiting for devece”;

第9行，使用usb_open函数打开usb设备，该函数针对不同的操作系统（windows,linux,os）有三种不同的实现，本文以linux为例。

1.1 usb_open

  1. usb_handle *usb_open(ifc_match_func callback)
  2. {
  3.     return find_usb_device("/dev/bus/usb", callback);
  4. }

usb_open函数的第三行，它调用了find_usb_device函数，并以"/dev/bus/usb"作为第一个参数，以callback作为第二个参数。

1.1.1 find_usb_device
  1. static usb_handle *find_usb_device(const char *base, ifc_match_func callback)
  2. {
  3.     usb_handle *usb = 0;
  4.     char busname[64], devname[64];
  5.     char desc[1024];
  6.     int n, in, out, ifc;
  7.  
  8.     DIR *busdir, *devdir;
  9.     struct dirent *de;
  10.     int fd;
  11.     int writable;
  12.  
  13.     busdir = opendir(base);
  14.     if(busdir == 0) return 0;
  15.  
  16.     while((de = readdir(busdir)) && (usb == 0)) {
  17.         if(badname(de->d_name)) continue;
  18.  
  19.         sprintf(busname, "%s/%s", base, de->d_name);
  20.         devdir = opendir(busname);
  21.         if(devdir == 0) continue;
  22.  
  23. //        DBG("[ scanning %s ]\n", busname);
  24.         while((de = readdir(devdir)) && (usb == 0)) {
  25.  
  26.             if(badname(de->d_name)) continue;
  27.             sprintf(devname, "%s/%s", busname, de->d_name);
  28.  
  29. //            DBG("[ scanning %s ]\n", devname);
  30.             writable = 1;
  31.             if((fd = open(devname, O_RDWR)) < 0) {
  32.                 // Check if we have read-only access, so we can give a helpful
  33.                 // diagnostic like "adb devices" does.
  34.                 writable = 0;
  35.                 if((fd = open(devname, O_RDONLY)) < 0) {
  36.                     continue;
  37.                 }
  38.             }
  39.  
  40.             n = read(fd, desc, sizeof(desc));
  41.  
  42.             if(filter_usb_device(fd, desc, n, writable, callback,
  43.                                  &in, &out, &ifc) == 0) {
  44.                 usb = calloc(1, sizeof(usb_handle));
  45.                 strcpy(usb->fname, devname);
  46.                 usb->ep_in = in;
  47.                 usb->ep_out = out;
  48.                 usb->desc = fd;
  49.  
  50.                 n = ioctl(fd, USBDEVFS_CLAIMINTERFACE, &ifc);
  51.                 if(n != 0) {
  52.                     close(fd);
  53.                     free(usb);
  54.                     usb = 0;
  55.                     continue;
  56.                 }
  57.             } else {
  58.                 close(fd);
  59.             }
  60.         }
  61.         closedir(devdir);
  62.     }
  63.     closedir(busdir);
  64.  
  65.     return usb;
  66. }
先来看一下linux下usb设备节点的目录结构：



由以上信息可以得知，在"/dev/bus/usb"目录下有子目录001,002等，在子目录下有对应usb设备对应的文件节点，这样我们看find_usb_device函数的第13行到第24行，就更容易理解了。

第13行：打开"/dev/bus/usb"目录；

第14行：打开失败，返回；

第16行：循环遍历"/dev/bus/usb"的第一级子目录，如002；

第20行：打开某一个第一级子目录，如002；

第24行：循环遍历第一级子目录（如/dev/bus/usb/002"）下的usb驱动节点文件；

第31行：以读写方式打开usb驱动节点文件，其实就是以读写方式打开usb设备，如果返回值小于于等于0，则说明打开成功失败；设置writable值。 

第35行：以读方式打开usb驱动节点文件，打开失败则终止本次循环，测试下一个usb节点； 

第40行：读取usb节点文件信息，包含了vid，pid等。

第42行：过滤usb设备，代码如下

1.1.1.1 filter_usb_device

  1. static int filter_usb_device(int fd, char *ptr, int len, int writable,
  2.                              ifc_match_func callback,
  3.                              int *ept_in_id, int *ept_out_id, int *ifc_id)
  4. {
  5.     struct usb_device_descriptor *dev;
  6.     struct usb_config_descriptor *cfg;
  7.     struct usb_interface_descriptor *ifc;
  8.     struct usb_endpoint_descriptor *ept;
  9.     struct usb_ifc_info info;
  10.  
  11.     int in, out;
  12.     unsigned i;
  13.     unsigned e;
  14.     
  15.     struct stat st;
  16.     int result;
  17.  
  18.     if(check(ptr, len, USB_DT_DEVICE, USB_DT_DEVICE_SIZE))
  19.         return -1;
  20.     dev = (void*) ptr;
  21.     len -= dev->bLength;
  22.     ptr += dev->bLength;
  23.  
  24.     if(check(ptr, len, USB_DT_CONFIG, USB_DT_CONFIG_SIZE))
  25.         return -1;
  26.     cfg = (void*) ptr;
  27.     len -= cfg->bLength;
  28.     ptr += cfg->bLength;
  29.  
  30.     info.dev_vendor = dev->idVendor;
  31.     info.dev_product = dev->idProduct;
  32.     info.dev_class = dev->bDeviceClass;
  33.     info.dev_subclass = dev->bDeviceSubClass;
  34.     info.dev_protocol = dev->bDeviceProtocol;
  35.     info.writable = writable;
  36.  
  37.     // read device serial number (if there is one)
  38.     info.serial_number[0] = 0;
  39.     if (dev->iSerialNumber) {
  40.         struct usbdevfs_ctrltransfer  ctrl;
  41.         // Keep it short enough because some bootloaders are borked if the URB len is > 255
  42.         // 128 is too big by 1.
  43.         __u16 buffer[127];
  44.  
  45.         memset(buffer, 0, sizeof(buffer));
  46.  
  47.         ctrl.bRequestType = USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_DEVICE;
  48.         ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
  49.         ctrl.wValue = (USB_DT_STRING << 8) | dev->iSerialNumber;
  50.         //language ID (en-us) for serial number string
  51.         ctrl.wIndex = 0x0409;
  52.         ctrl.wLength = sizeof(buffer);
  53.         ctrl.data = buffer;
  54.         ctrl.timeout = 50;
  55.  
  56.         result = ioctl(fd, USBDEVFS_CONTROL, &ctrl);
  57.         if (result > 0) {
  58.             int i;
  59.             // skip first word, and copy the rest to the serial string, changing shorts to bytes.
  60.             result /= 2;
  61.             for (i = 1; i < result; i++)
  62.                 info.serial_number[i - 1] = buffer[i];
  63.             info.serial_number[i - 1] = 0;
  64.         }
  65.     }
  66.  
  67.     /* We need to get a path that represents a particular port on a particular
  68.      * hub.  We are passed an fd that was obtained by opening an entry under
  69.      * /dev/bus/usb.  Unfortunately, the names of those entries change each
  70.      * time devices are plugged and unplugged.  So how to get a repeatable
  71.      * path?  udevadm provided the inspiration.  We can get the major and
  72.      * minor of the device file, read the symlink that can be found here:
  73.      *   /sys/dev/char/<major>:<minor>
  74.      * and then use the last element of that path.  As a concrete example, I
  75.      * have an Android device at /dev/bus/usb/001/027 so working with bash:
  76.      *   $ ls -l /dev/bus/usb/001/027
  77.      *   crw-rw-r-- 1 root plugdev 189, 26 Apr  9 11:03 /dev/bus/usb/001/027
  78.      *   $ ls -l /sys/dev/char/189:26
  79.      *   lrwxrwxrwx 1 root root 0 Apr  9 11:03 /sys/dev/char/189:26 ->
  80.      *           ../../devices/pci0000:00/0000:00:1a.7/usb1/1-4/1-4.2/1-4.2.3
  81.      * So our device_path would be 1-4.2.3 which says my device is connected
  82.      * to port 3 of a hub on port 2 of a hub on port 4 of bus 1 (per
  83.      * http://www.linux-usb.org/FAQ.html).
  84.      */
  85.     info.device_path[0] = '\0';
  86.     result = fstat(fd, &st);
  87.     if (!result && S_ISCHR(st.st_mode)) {
  88.         char cdev[128];
  89.         char link[256];
  90.         char *slash;
  91.         ssize_t link_len;
  92.         snprintf(cdev, sizeof(cdev), "/sys/dev/char/%d:%d",
  93.                  major(st.st_rdev), minor(st.st_rdev));
  94.         link_len = readlink(cdev, link, sizeof(link) - 1);
  95.         if (link_len > 0) {
  96.             link[link_len] = '\0';
  97.             slash = strrchr(link, '/');
  98.             if (slash)
  99.                 snprintf(info.device_path, sizeof(info.device_path), "usb:%s", slash+1);
  100.         }
  101.     }
  102.  
  103.     for(i = 0; i < cfg->bNumInterfaces; i++) {
  104.         if(check(ptr, len, USB_DT_INTERFACE, USB_DT_INTERFACE_SIZE))
  105.             return -1;
  106.         ifc = (void*) ptr;
  107.         len -= ifc->bLength;
  108.         ptr += ifc->bLength;
  109.  
  110.         in = -1;
  111.         out = -1;
  112.         info.ifc_class = ifc->bInterfaceClass;
  113.         info.ifc_subclass = ifc->bInterfaceSubClass;
  114.         info.ifc_protocol = ifc->bInterfaceProtocol;
  115.  
  116.         for(e = 0; e < ifc->bNumEndpoints; e++) {
  117.             if(check(ptr, len, USB_DT_ENDPOINT, USB_DT_ENDPOINT_SIZE))
  118.                 return -1;
  119.             ept = (void*) ptr;
  120.             len -= ept->bLength;
  121.             ptr += ept->bLength;
  122.  
  123.             if((ept->bmAttributes & 0x03) != 0x02)
  124.                 continue;
  125.  
  126.             if(ept->bEndpointAddress & 0x80) {
  127.                 in = ept->bEndpointAddress;
  128.             } else {
  129.                 out = ept->bEndpointAddress;
  130.             }
  131.         }
  132.  
  133.         info.has_bulk_in = (in != -1);
  134.         info.has_bulk_out = (out != -1);
  135.  
  136.         if(callback(&info) == 0) {
  137.             *ept_in_id = in;
  138.             *ept_out_id = out;
  139.             *ifc_id = ifc->bInterfaceNumber;
  140.             return 0;
  141.         }
  142.     }
  143.  
  144.     return -1;
  145. }
第5行到第8行的这四个结构体定义在android4.2.2的external\kernel-headers\original\linux\usb\Ch9.h文件中。

整个函数就是为了找到正确的数据填充这四个结构体，并最终转存到第9行的info变量中，还有就是找到usb对应的in与out端口用来传输数据。

第136行：callback(&info)，callback为函数指针，由外层函数 1、open_device 传进来的，实际指向match_fastboot函数，代码如下所示：

  1. int match_fastboot(usb_ifc_info *info)
  2. {
  3.     return match_fastboot_with_serial(info, serial);
  4. }

  1. int match_fastboot_with_serial(usb_ifc_info *info, const char *local_serial)
  2. {
  3.     if(!(vendor_id && (info->dev_vendor == vendor_id)) &&
  4.        (info->dev_vendor != 0x18d1) &&  // Google
  5.        (info->dev_vendor != 0x8087) &&  // Intel
  6.        (info->dev_vendor != 0x0451) &&
  7.        (info->dev_vendor != 0x0502) &&
  8.        (info->dev_vendor != 0x0fce) &&  // Sony Ericsson
  9.        (info->dev_vendor != 0x05c6) &&  // Qualcomm
  10.        (info->dev_vendor != 0x22b8) &&  // Motorola
  11.        (info->dev_vendor != 0x0955) &&  // Nvidia
  12.        (info->dev_vendor != 0x413c) &&  // DELL
  13.        (info->dev_vendor != 0x2314) &&  // INQ Mobile
  14.        (info->dev_vendor != 0x0b05) &&  // Asus
  15.        (info->dev_vendor != 0x0bb4))    // HTC
  16.             return -1;
  17.     if(info->ifc_class != 0xff) return -1;
  18.     if(info->ifc_subclass != 0x42) return -1;
  19.     if(info->ifc_protocol != 0x03) return -1;
  20.     // require matching serial number or device path if requested
  21.     // at the command line with the -s option.
  22.     if (local_serial && (strcmp(local_serial, info->serial_number) != 0 &&
  23.                    strcmp(local_serial, info->device_path) != 0)) return -1;
  24.     return 0;
  25. }

第3-15行：如果能够匹配其中的某一个vid，则跳转到第17行，并执行后面的语句。

回到1.1.1.1 filter_usb_device；

第137行：获取到in端口；

第138行：获取到out端口；

回到1.1.1 find_usb_device：

第44行：申请usb对象内存；

第45-48行：将usb的节点路径，in、out端口，设备句柄保存在usb变量中。

第65，返回该usb变量。这个就是我们以后

再回到1.1 usb_open函数也执行完了，那么open_device返回的就是usb的句柄。


回到main函数来：

第164行：此处就是更新系统的分支；（更新命令如：fastboot flash boot boot.img为例）

第165行：pname保存分区名；

第166-174:找到boot.img在pc机上的位置；

第175行：检查文件名是否合法；

第179行：将boot.img写到设备上，下面我们分析该函数。


2、do_flash

总结：将要更新的系统数据保存到了action_list链表中。 
  1. void do_flash(usb_handle *usb, const char *pname, const char *fname)
  2. {
  3.     struct fastboot_buffer buf;
  4.  
  5.     if (load_buf(usb, fname, &buf)) {
  6.         die("cannot load '%s'", fname);
  7.     }
  8.     flash_buf(pname, &buf);
  9. }
2.1、load_buf
  1. static int load_buf(usb_handle *usb, const char *fname,
  2.         struct fastboot_buffer *buf)
  3. {
  4.     int fd;
  5.  
  6.     fd = open(fname, O_RDONLY | O_BINARY);
  7.     if (fd < 0) {
  8.         die("cannot open '%s'\n", fname);
  9.     }
  10.  
  11.     return load_buf_fd(usb, fd, buf);
  12. }
2.1.1、load_buf_fd
  1. static int load_buf_fd(usb_handle *usb, int fd,
  2.         struct fastboot_buffer *buf)
  3. {
  4.     int64_t sz64;
  5.     void *data;
  6.     int64_t limit;
  7.  
  8.     sz64 = file_size(fd);
  9.     if (sz64 < 0) {
  10.         return -1;
  11.     }
  12.     limit = get_sparse_limit(usb, sz64);
  13.     if (limit) {
  14.         struct sparse_file **s = load_sparse_files(fd, limit);
  15.         if (s == NULL) {
  16.             return -1;
  17.         }
  18.         buf->type = FB_BUFFER_SPARSE;
  19.         buf->data = s;
  20.     } else {
  21.         unsigned int sz;
  22.         data = load_fd(fd, &sz);
  23.         if (data == 0) return -1;
  24.         buf->type = FB_BUFFER;
  25.         buf->data = data;
  26.         buf->sz = sz;
  27.     }
  28.  
  29.     return 0;
  30. }
将数据加载到了buf。
2.2、flash_buf
  1. static void flash_buf(const char *pname, struct fastboot_buffer *buf)
  2. {
  3.     struct sparse_file **s;
  4.  
  5.     switch (buf->type) {
  6.         case FB_BUFFER_SPARSE:
  7.             s = buf->data;
  8.             while (*s) {
  9.                 int64_t sz64 = sparse_file_len(*s, true, false);
  10.                 fb_queue_flash_sparse(pname, *s++, sz64);
  11.             }
  12.             break;
  13.         case FB_BUFFER:
  14.             fb_queue_flash(pname, buf->data, buf->sz);
  15.             break;
  16.         default:
  17.             die("unknown buffer type: %d", buf->type);
  18.     }
  19. }
2.2.1、fb_queue_flash 
  1. void fb_queue_flash(const char *ptn, void *data, unsigned sz)
  2. {
  3.     Action *a;
  4.  
  5.     a = queue_action(OP_DOWNLOAD, "");
  6.     a->data = data;
  7.     a->size = sz;
  8.     a->msg = mkmsg("sending '%s' (%d KB)", ptn, sz / 1024);
  9.  
  10.     a = queue_action(OP_COMMAND, "flash:%s", ptn);
  11.     a->msg = mkmsg("writing '%s'", ptn);
  12. }
这个函数看似将数据放到了变量a里面，我们来看一下queue_action函数 
  1. static Action *queue_action(unsigned op, const char *fmt, ...)
  2. {
  3.     Action *a;
  4.     va_list ap;
  5.     size_t cmdsize;
  6.  
  7.     a = calloc(1, sizeof(Action));
  8.     if (a == 0) die("out of memory");
  9.  
  10.     va_start(ap, fmt);
  11.     cmdsize = vsnprintf(a->cmd, sizeof(a->cmd), fmt, ap);
  12.     va_end(ap);
  13.  
  14.     if (cmdsize >= sizeof(a->cmd)) {
  15.         free(a);
  16.         die("Command length (%d) exceeds maximum size (%d)", cmdsize, sizeof(a->cmd));
  17.     }
  18.  
  19.     if (action_last) {
  20.         action_last->next = a;
  21.     } else {
  22.         action_list = a;
  23.     }
  24.     action_last = a;
  25.     a->op = op;
  26.     a->func = cb_default;
  27.  
  28.     a->start = -1;
  29.  
  30.     return a;
  31. }
原来a是action_list链表中的一个元素，也就是将要写的数据保存到了链表 action_list中。
2.3、调用流程图如下


回到main函数，第230行：status = fb_execute_queue(usb)，如下

3、fb_execute_queue

总结：最终调用ioctl将数据写到usb设备上。 
  1. int fb_execute_queue(usb_handle *usb)
  2. {
  3.     Action *a;
  4.     char resp[FB_RESPONSE_SZ+1];
  5.     int status = 0;
  6.  
  7.     a = action_list;
  8.     if (!a)
  9.         return status;
  10.     resp[FB_RESPONSE_SZ] = 0;
  11.  
  12.     double start = -1;
  13.     for (a = action_list; a; a = a->next) {
  14.         a->start = now();
  15.         if (start < 0) start = a->start;
  16.         if (a->msg) {
  17.             // fprintf(stderr,"%30s... ",a->msg);
  18.             fprintf(stderr,"%s...\n",a->msg);
  19.         }
  20.         if (a->op == OP_DOWNLOAD) {
  21.             status = fb_download_data(usb, a->data, a->size);
  22.             status = a->func(a, status, status ? fb_get_error() : "");
  23.             if (status) break;
  24.         } else if (a->op == OP_COMMAND) {
  25.             status = fb_command(usb, a->cmd);
  26.             status = a->func(a, status, status ? fb_get_error() : "");
  27.             if (status) break;
  28.         } else if (a->op == OP_QUERY) {
  29.             status = fb_command_response(usb, a->cmd, resp);
  30.             status = a->func(a, status, status ? fb_get_error() : resp);
  31.             if (status) break;
  32.         } else if (a->op == OP_NOTICE) {
  33.             fprintf(stderr,"%s\n",(char*)a->data);
  34.         } else if (a->op == OP_FORMAT) {
  35.             status = fb_format(a, usb, (int)a->data);
  36.             status = a->func(a, status, status ? fb_get_error() : "");
  37.             if (status) break;
  38.         } else if (a->op == OP_DOWNLOAD_SPARSE) {
  39.             status = fb_download_data_sparse(usb, a->data);
  40.             status = a->func(a, status, status ? fb_get_error() : "");
  41.             if (status) break;
  42.         } else {
  43.             die("bogus action");
  44.         }
  45.     }
  46.  
  47.     fprintf(stderr,"finished. total time: %.3fs\n", (now() - start));
  48.     return status;
  49. }
这里，我们只分析OP_DOWNLOAD分支，请看：
第21行：fb_download_data，代码如下： 
  1. int fb_download_data(usb_handle *usb, const void *data, unsigned size)
  2. {
  3.     char cmd[64];
  4.     int r;
  5.  
  6.     sprintf(cmd, "download:%08x", size);
  7.     r = _command_send(usb, cmd, data, size, 0);
  8.  
  9.     if(r < 0) {
  10.         return -1;
  11.     } else {
  12.         return 0;
  13.     }
  14. }
再看_command_send： 
  1. static int _command_send(usb_handle *usb, const char *cmd,
  2.                          const void *data, unsigned size,
  3.                          char *response)
  4. {
  5.     int r;
  6.     if (size == 0) {
  7.         return -1;
  8.     }
  9.  
  10.     r = _command_start(usb, cmd, size, response);
  11.     if (r < 0) {
  12.         return -1;
  13.     }
  14.  
  15.     r = _command_data(usb, data, size);
  16.     if (r < 0) {
  17.         return -1;
  18.     }
  19.  
  20.     r = _command_end(usb);
  21.     if(r < 0) {
  22.         return -1;
  23.     }
  24.  
  25.     return size;
  26. }
这里调用了三个函数：_command_start、_command_data与_command_end，如下： 
  1. static int _command_start(usb_handle *usb, const char *cmd, unsigned size,
  2.                           char *response)
  3. {
  4.     int cmdsize = strlen(cmd);
  5.     int r;
  6.  
  7.     if(response) {
  8.         response[0] = 0;
  9.     }
  10.  
  11.     if(cmdsize > 64) {
  12.         sprintf(ERROR,"command too large");
  13.         return -1;
  14.     }
  15.  
  16.     if(usb_write(usb, cmd, cmdsize) != cmdsize) {
  17.         sprintf(ERROR,"command write failed (%s)", strerror(errno));
  18.         usb_close(usb);
  19.         return -1;
  20.     }
  21.  
  22.     return check_response(usb, size, response);
  23. }
  1. static int _command_data(usb_handle *usb, const void *data, unsigned size)
  2. {
  3.     int r;
  4.  
  5.     r = usb_write(usb, data, size);
  6.     if(r < 0) {
  7.         sprintf(ERROR, "data transfer failure (%s)", strerror(errno));
  8.         usb_close(usb);
  9.         return -1;
  10.     }
  11.     if(r != ((int) size)) {
  12.         sprintf(ERROR, "data transfer failure (short transfer)");
  13.         usb_close(usb);
  14.         return -1;
  15.     }
  16.  
  17.     return r;
  18. }
  1. static int _command_end(usb_handle *usb)
  2. {
  3.     int r;
  4.     r = check_response(usb, 0, 0);
  5.     if(r < 0) {
  6.         return -1;
  7.     }
  8.     return 0;
  9. }
前面两个函数最终都调用了 usb_write将数据写下去，该函数实现如下： 
  1. int usb_write(usb_handle *h, const void *_data, int len)
  2. {
  3.     unsigned char *data = (unsigned char*) _data;
  4.     unsigned count = 0;
  5.     struct usbdevfs_bulktransfer bulk;
  6.     int n;
  7.  
  8.     if(h->ep_out == 0) {
  9.         return -1;
  10.     }
  11.  
  12.     if(len == 0) {
  13.         bulk.ep = h->ep_out;
  14.         bulk.len = 0;
  15.         bulk.data = data;
  16.         bulk.timeout = 0;
  17.  
  18.         n = ioctl(h->desc, USBDEVFS_BULK, &bulk);
  19.         if(n != 0) {
  20.             fprintf(stderr,"ERROR: n = %d, errno = %d (%s)\n",
  21.                     n, errno, strerror(errno));
  22.             return -1;
  23.         }
  24.         return 0;
  25.     }
  26.  
  27.     while(len > 0) {
  28.         int xfer;
  29.         xfer = (len > MAX_USBFS_BULK_SIZE) ? MAX_USBFS_BULK_SIZE : len;
  30.  
  31.         bulk.ep = h->ep_out;
  32.         bulk.len = xfer;
  33.         bulk.data = data;
  34.         bulk.timeout = 0;
  35.  
  36.         n = ioctl(h->desc, USBDEVFS_BULK, &bulk);
  37.         if(n != xfer) {
  38.             DBG("ERROR: n = %d, errno = %d (%s)\n",
  39.                 n, errno, strerror(errno));
  40.             return -1;
  41.         }
  42.  
  43.         count += xfer;
  44.         len -= xfer;
  45.         data += xfer;
  46.     }
  47.  
  48.     return count;
  49. }
第36行：调用ioctl将数据写到usb设备上。



























声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/笔触狂放9/article/detail/298933
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号