移动开发_之_手动搜网过程

1、移动开发系列之手动搜网流程简介在手机的移动网络设置里，有一项搜网网络的功能，如下图所示：通过搜索网络，可以把手机所在环境的网络给搜索出来，如上图的下半部分。那么搜索网络的功能是如何实现的呢？这就是本文所要重点阐述的内容。本文主要基于 Android + Qualcomm 的平台来描述搜索网络的步骤，每一步都有函数的调用关系，以及每一步的关键 Log。因此要阅读本文，最好有 Android 的源码和高通平台的代码。搜索网络，原理其实就是对所有的频段， 以某种制式（比如 LTE）进行扫描，检查到同步信号后，读取相应的系统参数，如 PLMN。只要知道 PLMN，就可以确定是哪个运营商的网络。 但是这

2、都是物理层做的事情， 本文这一部分要忽略掉，要想对搜索的过程有一个详细的了解，可以参考本系列的 LTE小区搜索过程本文主要描述从应用层开始， 如果把搜索网络的请求下发的 RRC层，RRC层把搜网的请求发给物理层，得到结果后又是如何上报给上层应用的。步骤Step 1:应用调用 phone 的接口 getAvailableNetworks, 该接口在 GSMPhone 和 CDMAPhone 都有实现，下面以 GSMPhone 为例。Step 2:GSMPhone:getAvailableNetworks调用的是 Ril 层的 getAvailableNetworks 。Step 3:RIL:ge

3、tAvailableNetworks向底层发送消息RIL_REQUEST_QUERY_AVAILABLE_NETWORKS，如下面的ril 的 log09-17 11:24:13.614 D/RILJ( 6268): 9730> QUERY_AVAILABLE_NETWORKSSUB0Step 4:qcril_qmi_nas:qcril_qmi_nas_query_available_networks发送 QMI 消息 QMI_NAS_PERFORM_NETWORK_SCAN_REQ_MSG_V01到 modemQMI2015 Sep 17 03:24:16.037 7B 0x138E

4、QMI Link 1 RX PDU IFType = 1QmiLength = 16QmiCtlFlags = 0QmiType = NASService_Nas ClientId = 1SduCtlFlags = REQTxId = 244MsgType = QMI_NAS_PERFORM_NETWORK_SCAN_MSGMsgLength = 4QmiNasPerformNetworkScan QmiNasPerformNetworkScanReqTlvs0 Type = 16Length = 1NetworkTypeTlv network_type = GSM | UMTS | LTE

5、| TD-SCDMAStep 5:qmi_nas:qmi_nasi_perform_network_scan调用 cm_ph_cm_get_network_extnCm:cm_ph_cm_get_network_extn调用 cm_ph_cm_get_network_per_subs_extn这里发送命令CM_PH_CMD_GET_NETWORKSMSGqmi_nas.c0985103:24:16.037Starting Net Scan, waiting for responseMMODEQMI/MediumStep 6:cmph_client_cmd_proccmph_client_cmd

6、_proccmph_client_cmd_forward_mmll处理 CM_PH_CMD_GET_NETWORKS消息，处理函数为：cmph_cmd_get_networks_poc: 调用 mmoc_cmd_get_network_gwMSG03:24:16.037Call Manager/Highcmph.c14139=CM= CM_PH_CMD_GET_NETWORKS sys_mode 5MSG03:24:16.038Call Manager/Highcmph.c20439=CM= GET_NET mode pref 39 ue mode capability 1704MSG03:2

7、4:16.038Call Manager/Highcmph.c20443=CM= GET_NET. bands(MSB): cgw 0x00020000, lte 0x00000180 tds 0x00000000MSG03:24:16.038Call Manager/Highcmph.c20447=CM= GET_NET. bands(LSB): cgw 0x00680180, lte 0x00000005 tds 0x00000000Step 7:mmoc: mmoc_cmd_get_network_gw发送命令 PROT_GEN_CMD_GET_NETWORKS_GW,处理该命令也在 m

8、moc 的 Mmoc_proc_prot_gen_cmd, 调用 sd_ss_ind_user_get_net_gw_ssStep 8:sd: sd_ss_ind_user_get_net_gw_ss调用 sdcmd_user_get_net_gw_ssStep 9: sdcmd:sdcmd_user_get_net_gw_ss根据不同的情况发送下面其中一个命令SDSS_EVT_USER_GET_NET_GWSDSS_EVT_HYBR_2_USER_GET_NET_GWSDSS_EVT_HYBR_3_USER_GET_NET_GWStep 10:sdss:sdss_get_net创建 acti

9、on ： SDSS_IACT_GET_NET_GWLStep 11: sdcmd:sd_ss_event_proc处理上一步的 SDSS_IACT_GET_NET_GWL：在这里发送 action SD_SS_ACT_GET_NET_GW到 cmregprx 模块。Step 12： cmregprx ： cmregprx_process_sd_action处理命令 SD_SS_ACT_GET_NET_GW处理函数 cmregprx_send_reg_net_list_req ：发送命令 CM_NETWORK_LIST_REQMSG03:24:16.042CallManager/Mediumcm

10、regprx.c06072=CMREGPRX=cmregprx_process_sd_action():is_gwl_mode_supp1,is_1x_hdr_mode_supp 0 sd_mode_pref 3752MSG03:24:16.042CallManager/Highcmregprx.c03797=CMREGPRX= AS_ID=0, stack=0, Send NETWORK_LIST_REQMSG03:24:16.042CallManager/Highcmregprx.c03800=CMREGPRX= mode_pref 5MSG03:24:16.042CallManager/

11、Highcmregprx.c03803=CMREGPRX= band_pref 0680180MSG03:24:16.042CallManager/Highcmregprx.c03806=CMREGPRX= srv_domain 3MSG03:24:16.042CallManager/Highcmregprx.c03809=CMREGPRX= nw_list_req 0MSG03:24:16.042CallManager/Highcmregprx.c03813=CMREGPRX= rat_pri_list num = 3MSG03:24:16.042CallManager/Highcmregp

12、rx.c03815=CMREGPRX= mode/band filter num = 0Step 13:reg_state:reg_state_main处理 CM_NETWORK_LIST_REQ：调用当前状态的process_cm_network_list_reqMSG0810303:24:16.043NAS REG/High/Error/FatalDS: SUB 1 =REG= CM_NETWORK_LIST_REQreg_state.cStep 14： Reg_state:reg_state_process_cm_network_list_req调 reg_send_mmr_plmn_s

13、earch_req 进行下一步MSG03:24:16.043NAS REG/High/Error/Fatalreg_state.c01293 DS: SUB 1=REG= Rat priority list num_items = 3MSG03:24:16.043NAS REG/High/Error/Fatalreg_state.c01298 DS: SUB 1=REG= sys_mode = 9 band_cap = 0x5MSG03:24:16.043NAS REG/High/Error/Fatalreg_state.c01298 DS: SUB 1=REG= sys_mode = 5 b

14、and_cap = 0x680180MSG03:24:16.043NAS REG/High/Error/Fatalreg_state.c01298DS: SUB 1=REG= sys_mode = 3 band_cap = 0x680180MSG03:24:16.043NASREG/High/Error/Fatalreg_state.c01301DS: SUB 1=REG= MCC mode band filter num_items = 0MSG03:24:16.043NASREG/High/Error/Fatalreg_state.c01389DS: SUB 1=REG= LIST_REQ

15、 TYPE 0Step 15 :Reg_send: reg_send_mmr_plmn_search_req发送消息MMR_PLMN_SEARCH_REQ,从下面的log 可以看出搜索的是哪个网络MSG03:24:16.043NAS REG/High/Error/Fatalreg_send.c01228DS: SUB 1 =REG= MMR_PLMN_SEARCH_REQ RAT(UMTS) TI (1) scan scope 0Step 16: mmcoord:mmcoord_process_mmr_plmn_search_req调用 mm_send_mmr_plmn_search_cnf发

16、送MMR_PLMN_SEARCH_CNFMSG03:24:16.045NAS MM/High/Error/Fatalmmcoord.c01185DS: SUB 1=MM= MM received MMR_PLMN_SEARCH_REQMSG03:24:16.045NAS MM/High/Error/Fatalmmcoord.c01219DS: SUB 1=MM= Received CSG Search Type - 0MSG03:24:16.045NAS MM/High/Error/Fatalmmcoord.c01232DS: SUB 1=MM= Dual Mode. Sending requ

17、est on Active RAT 1Step 17:mmplmnserch:mm_get_plmn_list调用 mm_request_list_from_rr发送 RRC_PLMN_LIST_REQ到 RRC层MSG03:24:16.045NAS MM/High/Error/Fatalmmplmnsrch.c00200DS: SUB 1=MM= PLMN LIST REQ : Manual selectionMSG03:24:16.045NAS MM/High/Error/Fatalmmplmnsrch.c00721DS: SUB 1=MM= Manual PLMN Timer value

18、 FIRST 0 MORE 0MAX 0MSG03:24:16.045NAS MM/High/Error/Fatalmmplmnsrch.c00724DS: SUB 1=MM= BST changes length of mcc mode filter =0MSG03:24:16.045NAS MM/High/Error/Fatalmmplmnsrch.c00736DS: SUB 1=MM= MM sent RRC_PLMN_LIST_REQStep 18:RrcDispatcher:rrc_dispatch_mm_commands调用 rrcm_event_handler进一步处理MSG03

19、:24:16.045WCDMA RRC/Highrrcdispatcher.c04724Rx: RRC_PLMN_LIST_REQStep 19: Rrcmcm:rrcmcm_event_handler调 rrcmcm_initial_substate_event_handler ，这里继续下一步 rrc_cell_selection_procedureMSG03:24:16.045WCDMARRC/Highrrcmcm.c05848functionrrcmcm_event_handleriscalledinrrcmcm_state=rrcmcm_state_e_type_value0 / E

20、vent is received by MCM: 5000007MSG03:24:16.045WCDMARRC/Highrrcmcm.c03763Rx:RRC_PLMN_LIST_REQStep 20： rrccsp: rrc_cell_selection_procedureMSG03:24:16.045WCDMA RRC/Highrrccsp.c31483functionrrc_cell_selection_procedureiscalledinrrc_csp_substaterrc_csp_substate_e_type_value13MSG03:24:16.046WCDMARRC/Hig

21、hrrccsputil.c22136RAT Search order for PLMN List ReqMSG03:24:16.046WCDMARRC/Highrrccsputil.c22141>0-GSM RAT-MSG03:24:16.046WCDMARRC/Highrrccsputil.c22150>1-LTE RAT-MSG03:24:16.046WCDMARRC/Highrrccsputil.c22145>2-UMTS RAT-MSG03:24:16.046WCDMARRC/Highrrccsputil.c22110Do WTOG search first到这里主要

22、是向L1 层请求搜索频点获取网络的过程搜索完成，向上层返回结果搜索结果回来MSG03:24:48.004WCDMA RRC/Highrrcllc.c36280Rcv'd CPHY_ACQ_CNF from L1MSG03:24:48.004WCDMA RRC/Highrrccspfscan.c01791Freq scan - no more frequencyMSG03:24:48.004WCDMARRC/Highrrccsputil.c05262All bands exhaustedMSG03:24:48.004WCDMARRC/Highrrccsputil.c14034WTOW:

23、no more freq fnd. W Search completedMSG03:24:48.004WCDMA RRC/Highrrccsp.c27440BPLMN: Starting Manual PLMN FreqScan timerMSG03:24:48.004WCDMARRC/Highrrccsputil.c09001CPHY GO TO SLEEP IND sent to L1Step 21： Rrccsptuil: rrc_csp_bplmn_send_mm_plmn_list_cnf_cmd发送命令 RRC_PLMN_LIST_CNFMSG03:24:48.004WCDMA R

24、RC/Highrrccsputil.c11019CSG: Adding WCDMA PLMN 460-1MSG03:24:48.004WCDMARRC/Highrrccsputil.c11037Adding GSM PLMN 460-0MSG03:24:48.004WCDMA RRC/Highrrccsputil.c11037Adding GSM PLMN 460-1MSG03:24:48.004WCDMARRC/Highrrccsputil.c11056CSG: Adding LTE CSG ID -1MSG03:24:48.004WCDMARRC/Highrrccsputil.c11060

25、Adding LTE PLMN 460-1MSG03:24:48.004WCDMARRC/Highrrccsputil.c11056CSG: Adding LTE CSG ID -1MSG03:24:48.004WCDMARRC/Highrrccsputil.c11060Adding LTE PLMN 460-0MSG03:24:48.004WCDMARRC/Highrrccsputil.c11056CSG: Adding LTE CSG ID -1MSG03:24:48.004WCDMARRC/Highrrccsputil.c11060Adding LTE PLMN 460-11MSG03:

26、24:48.005NAS MM/High/Error/Fatalmmcoord.c08312DS: SUB 1=MM= MM received RRC_PLMN_LIST_CNFMSG03:24:48.005NAS MM/High/Error/Fatalmmplmnsrch.c00446DS: SUB 1=MM= Received RRC_PLMN_LIST_CNF TI (1)MSG03:24:48.005NAS MM/High/Error/Fatalmmsend.c01250DS: SUB 1=MM= MM sent MMR_PLMN_SEARCH_CNFStep 22 :Reg_stat

27、e:reg_state_main处理 MMR_PLMN_SEARCH_CNF,调用的是Reg_State_manual_search:process_mmr_plmn_search_cnf这里调用 reg_send_cm_network_list_cnfStep 23： Reg_send:reg_send_cm_network_list_cnf发送 CM_NETWORK_LIST_CNFMSG03:24:48.007NAS REG/High/Error/Fatalreg_state.c08530DS: SUB 1 =REG= MMR_PLMN_SEARCH_CNFMSG03:24:48.014

28、NAS REG/High/Error/Fatalreg_send.c00538DS: SUB 1 =REG= CM_NETWORK_LIST_CNFStep 24： Sd_si_net_list_rpt_cbMSG0665903:24:48.018 CDMA System Determination/High =SD= Get network list result postedsdcmd.cStep 25： cmtask:cm_si_network_list_cb发送命令CM_SI_NETWORK_LIST_，FStep 26： cmph:cmph_rpt_proc处理命令CM_SI_NET

29、WORK_LIST_F 调用cmph_process_network_list_cnfCM_PH_EVENT_AVAILABLE_NETWORKS_CONF消息MSG03:24:48.025Call Manager/High28718=CM= cmph_process_network_list_cnf: net_list_cnf_ptr->status=0发送cmph.cStep 27 : qmi_nas: qmi_nas_process_cmph_evt处理 CM_PH_EVENT_AVAILABLE_NETWORKS_CONF消息，调用 qmi_nas_generate_net_sc

30、an_resp_ext 来处理NAS_CMD_PERFORM_NETWORK_SCANqmi_nasi_generate_perform_network_scan_respStep 28 : qmi_nas:qmi_nasi_send_responseMSG03:24:48.028MMODEQMI/Highqmi_nas.c07048generate_net_scan resp/ind(list_cnf=0, length=6,incremental status=0)-QMI数据回来2015 Sep 1703:24:48.036370x138FQMI Link 1 TX PDUIFType

31、= 1QmiLength = 225QmiCtlFlags = 128QmiType = NASService_Nas ClientId = 1SduCtlFlags = RSPTxId = 244MsgType = QMI_NAS_PERFORM_NETWORK_SCAN_MSGMsgLength = 213QmiNasPerformNetworkScan QmiNasPerformNetworkScanRespTlvs0 Type = 2Length = 4ResultCodeTlv ResultCode = QMI_RESULT_SUCCESSErrorCode = QMI_ERROR_

32、NONEQmiNasPerformNetworkScanRespTlvs1 Type = 16Length = 98NetworkInfo3gppTlv NumNetworkInfo3gppStructs = 6NetworkInfo3gppStructs0 MobileCountryCode = 460MobileNetworkCode = 1NetworkStatus= AVAILABLE|HOME |NOT_FORBIDDEN|PREFERREDNetworkDescLength = 10NetworkDesc = CHN-UNICOMNetworkInfo3gppStructs1 Mo

33、bileCountryCode = 460MobileNetworkCode = 1NetworkStatus = CURRENT_SERVING | HOME | NOT_FORBIDDEN |PREFERREDNetworkDescLength = 10NetworkDesc = CHN-UNICOMNetworkInfo3gppStructs2 MobileCountryCode = 460MobileNetworkCode = 1NetworkStatus= AVAILABLE|HOME |NOT_FORBIDDEN|PREFERREDNetworkDescLength = 10Net

34、workDesc = CHN-UNICOMNetworkInfo3gppStructs3 MobileCountryCode = 460MobileNetworkCode = 0NetworkStatus = AVAILABLE | ROAM | FORBIDDEN | NOT_PREFERRED NetworkDescLength = 12NetworkDesc = CHINA MOBILENetworkInfo3gppStructs4 MobileCountryCode = 460MobileNetworkCode = 0NetworkStatus = AVAILABLE | ROAM |

35、 FORBIDDEN | NOT_PREFERRED NetworkDescLength = 12NetworkDesc = CHINA MOBILENetworkInfo3gppStructs5 MobileCountryCode = 460MobileNetworkCode = 11NetworkStatus= AVAILABLE|ROAM |FORBIDDEN |NOT_PREFERREDNetworkDescLength = 6NetworkDesc = CHN-CTQmiNasPerformNetworkScanRespTlvs2 Type = 17Length = 32Networ

36、kRadioAccessTechnologyTlv Nas Nrs Tech Length = 6NasNrsTechTlv0 Mcc = 460Mnc = 1Rat = LTENasNrsTechTlv1 Mcc = 460Mnc = 1Rat = UMTSNasNrsTechTlv2 Mcc = 460Mnc = 1Rat = GERANNasNrsTechTlv3 Mcc = 460Mnc = 0Rat = LTENasNrsTechTlv4 Mcc = 460Mnc = 0Rat = GERANNasNrsTechTlv5 Mcc = 460Mnc = 11Rat = LTEQmiNa

37、sPerformNetworkScanRespTlvs3 Type = 18Length = 32MncPcsDigitIncludeStatusTlv mnc_includes_pcs_digit_len = 6MncPcsDigit0 Mcc = 460Mnc = 1mnc_includes_pcs_digit = FALSEMncPcsDigit1 Mcc = 460Mnc = 1mnc_includes_pcs_digit = FALSEMncPcsDigit2 Mcc = 460Mnc = 1mnc_includes_pcs_digit = FALSEMncPcsDigit3 Mcc = 460Mnc = 0mnc_includes_pcs_digit = FALSEMncPcsDigit4 Mcc = 460Mnc = 0mnc_includes_pcs_digit = FALSE