移动开发 之 手动搜网过程.docx

1、移动开发 之 手动搜网过程移动开发系列之手动搜网流程简介在手机的移动网络设置里，有一项搜网网络的功能，如下图所示：通过搜索网络，可以把手机所在环境的网络给搜索出来，如上图的下半部分。那么搜索网络的功能是如何实现的呢？这就是本文所要重点阐述的内容。 本文主要基于Android + Qualcomm的平台来描述搜索网络的步骤，每一步都有函数的调用关系，以及每一步的关键Log。因此要阅读本文，最好有Android的源码和高通平台的代码。 搜索网络，原理其实就是对所有的频段，以某种制式（比如LTE）进行扫描，检查到同步信号后，读取相应的系统参数，如PLMN。只要知道PLMN，就可以确定是哪个运营商的网

2、络。但是这都是物理层做的事情，本文这一部分要忽略掉，要想对搜索的过程有一个详细的了解，可以参考本系列的LTE小区搜索过程 本文主要描述从应用层开始，如果把搜索网络的请求下发的RRC层，RRC层把搜网的请求发给物理层，得到结果后又是如何上报给上层应用的。步骤Step 1:应用调用phone的接口getAvailableNetworks, 该接口在GSMPhone和CDMAPhone都有实现，下面以GSMPhone为例。Step 2:GSMPhone:getAvailableNetworks调用的是Ril层的getAvailableNetworks。Step 3:RIL:getAvailableN

3、etworks向底层发送消息RIL_REQUEST_QUERY_AVAILABLE_NETWORKS，如下面的ril的log09-17 11:24:13.614 D/RILJ ( 6268): 9730 QUERY_AVAILABLE_NETWORKS SUB0Step 4:qcril_qmi_nas:qcril_qmi_nas_query_available_networks发送QMI消息QMI_NAS_PERFORM_NETWORK_SCAN_REQ_MSG_V01到modemQMI2015 Sep 17 03:24:16.037 7B 0x138E QMI Link 1 RX PDUIF

4、Type = 1QmiLength = 16QmiCtlFlags = 0QmiType = NASService_Nas ClientId = 1 SduCtlFlags = REQ TxId = 244 MsgType = QMI_NAS_PERFORM_NETWORK_SCAN_MSG MsgLength = 4 QmiNasPerformNetworkScan QmiNasPerformNetworkScanReqTlvs0 Type = 16 Length = 1 NetworkTypeTlv network_type = GSM | UMTS | LTE | TD-SCDMA St

5、ep 5:qmi_nas:qmi_nasi_perform_network_scan调用cm_ph_cm_get_network_extnCm:cm_ph_cm_get_network_extn调用cm_ph_cm_get_network_per_subs_extn这里发送命令CM_PH_CMD_GET_NETWORKSMSG 03:24:16.037 MMODE QMI/Medium qmi_nas.c 09851 Starting Net Scan, waiting for responseStep 6:cmph_client_cmd_proccmph_client_cmd_proccmp

6、h_client_cmd_forward_mmll处理CM_PH_CMD_GET_NETWORKS消息，处理函数为：cmph_cmd_get_networks_poc:调用mmoc_cmd_get_network_gwMSG 03:24:16.037 Call Manager/High cmph.c 14139 =CM= CM_PH_CMD_GET_NETWORKS sys_mode 5MSG 03:24:16.038 Call Manager/High cmph.c 20439 =CM= GET_NET mode pref 39 ue mode capability 1704MSG 03:2

7、4:16.038 Call Manager/High cmph.c 20443 =CM= GET_NET. bands(MSB): cgw 0x00020000, lte 0x00000180 tds 0x00000000MSG 03:24:16.038 Call Manager/High cmph.c 20447 =CM= GET_NET. bands(LSB): cgw 0x00680180, lte 0x00000005 tds 0x00000000Step 7:mmoc: mmoc_cmd_get_network_gw发送命令PROT_GEN_CMD_GET_NETWORKS_GW,处

8、理该命令也在mmoc的Mmoc_proc_prot_gen_cmd,调用sd_ss_ind_user_get_net_gw_ssStep 8:sd: sd_ss_ind_user_get_net_gw_ss调用sdcmd_user_get_net_gw_ssStep 9: sdcmd:sdcmd_user_get_net_gw_ss根据不同的情况发送下面其中一个命令SDSS_EVT_USER_GET_NET_GWSDSS_EVT_HYBR_2_USER_GET_NET_GWSDSS_EVT_HYBR_3_USER_GET_NET_GWStep 10:sdss:sdss_get_net创建act

9、ion ：SDSS_IACT_GET_NET_GWLStep 11: sdcmd:sd_ss_event_proc处理上一步的 SDSS_IACT_GET_NET_GWL：在这里发送action SD_SS_ACT_GET_NET_GW到cmregprx模块。Step 12：cmregprx ：cmregprx_process_sd_action处理命令SD_SS_ACT_GET_NET_GW处理函数cmregprx_send_reg_net_list_req：发送命令CM_NETWORK_LIST_REQMSG 03:24:16.042 Call Manager/Medium cmregpr

10、x.c 06072 =CMREGPRX= cmregprx_process_sd_action(): is_gwl_mode_supp 1, is_1x_hdr_mode_supp 0 sd_mode_pref 3752MSG 03:24:16.042 Call Manager/High cmregprx.c 03797 =CMREGPRX= AS_ID=0, stack=0, Send NETWORK_LIST_REQMSG 03:24:16.042 Call Manager/High cmregprx.c 03800 =CMREGPRX= mode_pref 5MSG 03:24:16.0

11、42 Call Manager/High cmregprx.c 03803 =CMREGPRX= band_pref 0680180MSG 03:24:16.042 Call Manager/High cmregprx.c 03806 =CMREGPRX= srv_domain 3MSG 03:24:16.042 Call Manager/High cmregprx.c 03809 =CMREGPRX= nw_list_req 0MSG 03:24:16.042 Call Manager/High cmregprx.c 03813 =CMREGPRX= rat_pri_list num = 3

12、MSG 03:24:16.042 Call Manager/High cmregprx.c 03815 =CMREGPRX= mode/band filter num = 0Step 13:reg_state:reg_state_main处理CM_NETWORK_LIST_REQ：调用当前状态的process_cm_network_list_reqMSG 03:24:16.043 NAS REG/High/Error/Fatal reg_state.c 08103 DS: SUB 1 =REG= CM_NETWORK_LIST_REQStep 14：Reg_state:reg_state_pr

13、ocess_cm_network_list_req调 reg_send_mmr_plmn_search_req进行下一步MSG 03:24:16.043 NAS REG/High/Error/Fatal reg_state.c 01293 DS: SUB 1 =REG= Rat priority list num_items = 3MSG 03:24:16.043 NAS REG/High/Error/Fatal reg_state.c 01298 DS: SUB 1 =REG= sys_mode = 9 band_cap = 0x5MSG 03:24:16.043 NAS REG/High/

14、Error/Fatal reg_state.c 01298 DS: SUB 1 =REG= sys_mode = 5 band_cap = 0x680180MSG 03:24:16.043 NAS REG/High/Error/Fatal reg_state.c 01298 DS: SUB 1 =REG= sys_mode = 3 band_cap = 0x680180MSG 03:24:16.043 NAS REG/High/Error/Fatal reg_state.c 01301 DS: SUB 1 =REG= MCC mode band filter num_items = 0MSG

15、03:24:16.043 NAS REG/High/Error/Fatal reg_state.c 01389 DS: SUB 1 =REG= LIST_REQ TYPE 0Step 15 :Reg_send: reg_send_mmr_plmn_search_req发送消息MMR_PLMN_SEARCH_REQ, 从下面的log可以看出搜索的是哪个网络MSG 03:24:16.043 NAS REG/High/Error/Fatal reg_send.c 01228 DS: SUB 1 =REG= MMR_PLMN_SEARCH_REQ RAT(UMTS) TI (1) scan scope

16、 0Step 16: mmcoord:mmcoord_process_mmr_plmn_search_req调用mm_send_mmr_plmn_search_cnf发送 MMR_PLMN_SEARCH_CNFMSG 03:24:16.045 NAS MM/High/Error/Fatal mmcoord.c 01185 DS: SUB 1 =MM= MM received MMR_PLMN_SEARCH_REQMSG 03:24:16.045 NAS MM/High/Error/Fatal mmcoord.c 01219 DS: SUB 1 =MM= Received CSG Search

17、Type - 0MSG 03:24:16.045 NAS MM/High/Error/Fatal mmcoord.c 01232 DS: SUB 1 =MM= Dual Mode. Sending request on Active RAT 1Step 17:mmplmnserch:mm_get_plmn_list调用mm_request_list_from_rr发送RRC_PLMN_LIST_REQ到RRC层MSG 03:24:16.045 NAS MM/High/Error/Fatal mmplmnsrch.c 00200 DS: SUB 1 =MM= PLMN LIST REQ : Ma

18、nual selectionMSG 03:24:16.045 NAS MM/High/Error/Fatal mmplmnsrch.c 00721 DS: SUB 1 =MM= Manual PLMN Timer value FIRST 0 MORE 0 MAX 0MSG 03:24:16.045 NAS MM/High/Error/Fatal mmplmnsrch.c 00724 DS: SUB 1 =MM= BST changes length of mcc mode filter =0MSG 03:24:16.045 NAS MM/High/Error/Fatal mmplmnsrch.

19、c 00736 DS: SUB 1 =MM= MM sent RRC_PLMN_LIST_REQStep 18:RrcDispatcher:rrc_dispatch_mm_commands调用rrcm_event_handler进一步处理MSG 03:24:16.045 WCDMA RRC/High rrcdispatcher.c 04724 Rx: RRC_PLMN_LIST_REQStep 19: Rrcmcm:rrcmcm_event_handler调rrcmcm_initial_substate_event_handler，这里继续下一步rrc_cell_selection_proce

20、dureMSG 03:24:16.045 WCDMA RRC/High rrcmcm.c 05848 function rrcmcm_event_handler is called in rrcmcm_state = rrcmcm_state_e_type_value0 / Event is received by MCM: 5000007MSG 03:24:16.045 WCDMA RRC/High rrcmcm.c 03763 Rx:RRC_PLMN_LIST_REQStep 20：rrccsp: rrc_cell_selection_procedureMSG 03:24:16.045 W

21、CDMA RRC/High rrccsp.c 31483 function rrc_cell_selection_procedure is called in rrc_csp_substate rrc_csp_substate_e_type_value13MSG 03:24:16.046 WCDMA RRC/High rrccsputil.c 22136 RAT Search order for PLMN List ReqMSG 03:24:16.046 WCDMA RRC/High rrccsputil.c 22141 0 -GSM RAT-MSG 03:24:16.046 WCDMA RR

22、C/High rrccsputil.c 22150 1 -LTE RAT-MSG 03:24:16.046 WCDMA RRC/High rrccsputil.c 22145 2 -UMTS RAT-MSG 03:24:16.046 WCDMA RRC/High rrccsputil.c 22110 Do WTOG search first到这里主要是向L1层请求搜索频点获取网络的过程搜索完成，向上层返回结果搜索结果回来MSG 03:24:48.004 WCDMA RRC/High rrcllc.c 36280 Rcvd CPHY_ACQ_CNF from L1MSG 03:24:48.004

23、 WCDMA RRC/High rrccspfscan.c 01791 Freq scan - no more frequencyMSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 05262 All bands exhaustedMSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 14034 WTOW: no more freq fnd. W Search completedMSG 03:24:48.004 WCDMA RRC/High rrccsp.c 27440 BPLMN: Starting Manual PL

24、MN FreqScan timerMSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 09001 CPHY GO TO SLEEP IND sent to L1Step 21：Rrccsptuil: rrc_csp_bplmn_send_mm_plmn_list_cnf_cmd发送命令RRC_PLMN_LIST_CNFMSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11019 CSG: Adding WCDMA PLMN 460-1MSG 03:24:48.004 WCDMA RRC/High rrccsputil

25、.c 11037 Adding GSM PLMN 460-0MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11037 Adding GSM PLMN 460-1MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11056 CSG: Adding LTE CSG ID -1MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11060 Adding LTE PLMN 460-1MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11056

26、 CSG: Adding LTE CSG ID -1MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11060 Adding LTE PLMN 460-0MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11056 CSG: Adding LTE CSG ID -1MSG 03:24:48.004 WCDMA RRC/High rrccsputil.c 11060 Adding LTE PLMN 460-11MSG 03:24:48.005 NAS MM/High/Error/Fatal mmcoord.c 08

27、312 DS: SUB 1 =MM= MM received RRC_PLMN_LIST_CNFMSG 03:24:48.005 NAS MM/High/Error/Fatal mmplmnsrch.c 00446 DS: SUB 1 =MM= Received RRC_PLMN_LIST_CNF TI (1)MSG 03:24:48.005 NAS MM/High/Error/Fatal mmsend.c 01250 DS: SUB 1 =MM= MM sent MMR_PLMN_SEARCH_CNFStep 22 :Reg_state:reg_state_main处理MMR_PLMN_SE

28、ARCH_CNF,调用的是Reg_State_manual_search:process_mmr_plmn_search_cnf这里调用reg_send_cm_network_list_cnfStep 23：Reg_send:reg_send_cm_network_list_cnf发送CM_NETWORK_LIST_CNFMSG 03:24:48.007 NAS REG/High/Error/Fatal reg_state.c 08530 DS: SUB 1 =REG= MMR_PLMN_SEARCH_CNFMSG 03:24:48.014 NAS REG/High/Error/Fatal r

29、eg_send.c 00538 DS: SUB 1 =REG= CM_NETWORK_LIST_CNFStep 24：Sd_si_net_list_rpt_cbMSG 03:24:48.018 CDMA System Determination/High sdcmd.c 06659 =SD= Get network list result postedStep 25：cmtask:cm_si_network_list_cb发送命令CM_SI_NETWORK_LIST_F，Step 26：cmph:cmph_rpt_proc处理命令CM_SI_NETWORK_LIST_F调用cmph_proce

30、ss_network_list_cnf发送CM_PH_EVENT_AVAILABLE_NETWORKS_CONF消息MSG 03:24:48.025 Call Manager/High cmph.c 28718 =CM= cmph_process_network_list_cnf: net_list_cnf_ptr-status=0Step 27 : qmi_nas: qmi_nas_process_cmph_evt处理CM_PH_EVENT_AVAILABLE_NETWORKS_CONF消息，调用qmi_nas_generate_net_scan_resp_ext来处理NAS_CMD_PER

31、FORM_NETWORK_SCANqmi_nasi_generate_perform_network_scan_respStep 28 : qmi_nas:qmi_nasi_send_responseMSG 03:24:48.028 MMODE QMI/High qmi_nas.c 07048 generate_net_scan resp/ind(list_cnf=0, length=6,incremental status=0)-QMI数据回来2015 Sep 17 03:24:48.036 37 0x138F QMI Link 1 TX PDUIFType = 1QmiLength = 225QmiCtlFlags = 128QmiType = NASService_Nas ClientId = 1 SduCtlFlags = RSP TxId = 244 MsgType = QMI_NAS_PERFORM_NETWORK_SCAN_MSG MsgLength = 213 QmiNasPerformNetworkScan QmiNasPerformNetworkScanRespTlvs0 Type = 2 Length