Cubietruck---26.android蓝牙分析4_pair分析

一. setting中的调用

1. 当在屏幕上点击搜索到的蓝牙设备时，会产生一个onClicked事件

在./device/softwinner/common/packages/TvdSettings/src/com/android/settings/bluetooth/BluetoothDevicePreference.java中

void onClicked() {

int bondState = mCachedDevice.getBondState();

if (mCachedDevice.isConnected()) {

askDisconnect();

} else if (bondState == BluetoothDevice.BOND_BONDED) {

mCachedDevice.connect(true);

} else if (bondState == BluetoothDevice.BOND_NONE) {

pair();

}

}

会调用pair函数

private void pair() {

if (!mCachedDevice.startPairing()) {

Utils.showError(getContext(), mCachedDevice.getName(),

R.string.bluetooth_pairing_error_message);

}

}

mCachedDevice是一个CachedBluetoothDevice

2. 在./device/softwinner/common/packages/TvdSettings/src/com/android/settings/bluetooth/CachedBluetoothDevice.java中

boolean startPairing() {

if (mLocalAdapter.isDiscovering()) {

mLocalAdapter.cancelDiscovery();

}

if (!mDevice.createBond()) {

return false;

}

mConnectAfterPairing = true; // auto-connect
after pairing

return true;

}

在pair时，如果正在搜索，则停止搜索，并调用 CachedBluetoothDevice的createBond,
mDevice是一个 BluetoothDevice在framework层

二. framework层中的调用

在./frameworks/base/core/java/android/bluetooth/BluetoothDevice.java中

public boolean createBond() {

if (sService == null) {

return false;

}

try {

return sService.createBond(this);

} catch (RemoteException e) {Log.e(TAG, "", e);}

return false;

}

调用了sService的createBond,
其中sService是IBluetooth，要到packages层去了

三.packages中的调用

3.1 在./packages/apps/Bluetooth/src/com/android/bluetooth/btservice/AdapterService.java中

的AdapterServiceBinder类中

public boolean createBond(BluetoothDevice device) {

if (!Utils.checkCaller()) {

return false;

}

AdapterService service = getService();

if (service == null) return false;

return service.createBond(device);

}

在AdapterService类中

boolean createBond(BluetoothDevice device) {

enforceCallingOrSelfPermission(BLUETOOTH_ADMIN_PERM, "Need BLUETOOTH ADMIN
permission");

DeviceProperties deviceProp = mRemoteDevices.getDeviceProperties(device);

if (deviceProp != null && deviceProp.getBondState() != BluetoothDevice.BOND_NONE) {

return false;

}

Message msg = mBondStateMachine.obtainMessage(BondStateMachine.CREATE_BOND);

msg.obj = device;

mBondStateMachine.sendMessage(msg);

return true;

}

发送了一个CREATE_BOND的消息

3.2 在./packages/apps/Bluetooth/src/com/android/bluetooth/btservice/BondStateMachine.java中

public boolean processMessage(Message msg) {

switch(msg.what) {

case CREATE_BOND:

createBond(dev, true);

break;

}

}

在消息处理函数createBond中

private boolean createBond(BluetoothDevice dev, boolean
transition) {

if (dev.getBondState() == BluetoothDevice.BOND_NONE) {

byte[] addr = Utils.getBytesFromAddress(dev.getAddress());

if (!mAdapterService.createBondNative(addr)) {

sendIntent(dev, BluetoothDevice.BOND_NONE,

BluetoothDevice.UNBOND_REASON_REMOVED);

return false;

} else if (transition) {

transitionTo(mPendingCommandState);

}

return true;

}

return false;

}

看到createBondNative这个函数，就知道要调用jni了。

四. jni中的调用

在./packages/apps/Bluetooth/jni/com_android_bluetooth_btservice_AdapterService.cpp中

static jboolean createBondNative(JNIEnv* env, jobject
obj, jbyteArray address) {

jbyte *addr;

jboolean result = JNI_FALSE;

if (!sBluetoothInterface) return
result;

addr = env->GetByteArrayElements(address, NULL);

int ret = sBluetoothInterface->create_bond((bt_bdaddr_t *)addr);

env->ReleaseByteArrayElements(address, addr, NULL);

result = (ret == BT_STATUS_SUCCESS) ? JNI_TRUE : JNI_FALSE;

return result;

}

其中这个sBluetoothInterface是协议栈的接口

五.协议栈bluedroid中的调用

5.1 在./external/bluetooth/bluedroid/btif/src/bluetooth.c中

static int create_bond(const bt_bdaddr_t *bd_addr)

{

/* sanity check */

if (interface_ready() == FALSE)

return BT_STATUS_NOT_READY;

return btif_dm_create_bond(bd_addr);

}

5.2 在./external/bluetooth/bluedroid/btif/src/btif_dm.c中

bt_status_t btif_dm_create_bond(const bt_bdaddr_t *bd_addr)

{

bdstr_t bdstr;

if (pairing_cb.state != BT_BOND_STATE_NONE)

return BT_STATUS_BUSY;

btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,

(char *)bd_addr, sizeof(bt_bdaddr_t), NULL);

return BT_STATUS_SUCCESS;

}

具体的如何调用到了这个回调函数，参见附录1

5.3 在回调函数中进行具体的处理

在./external/bluetooth/bluedroid/btif/src/btif_dm.c中

static void btif_dm_generic_evt(UINT16 event, char* p_param)

{

switch(event) //这个event就是发送的命令

{

case BTIF_DM_CB_CREATE_BOND:

{

btif_dm_cb_create_bond((bt_bdaddr_t *)p_param);

}

break;

}

}

5.3.1 回调的具体处理

在./external/bluetooth/bluedroid/btif/src/btif_dm.c中

static void btif_dm_cb_create_bond(bt_bdaddr_t *bd_addr)

{

//状态由BT_BOND_STATE_NONE--> BT_BOND_STATE_BONDING,并通知上层

//这儿具体如何调用上层的过程，参见附录2

bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);

if (check_cod(bd_addr, COD_HID_POINTING)){

int status;

status = btif_hh_connect(bd_addr);

if(status != BT_STATUS_SUCCESS)

bond_state_changed(status, bd_addr, BT_BOND_STATE_NONE);

}

else

{

BTA_DmBond ((UINT8 *)bd_addr->address);

}

pairing_cb.is_local_initiated = TRUE;

}

5.3.2

在./external/bluetooth/bluedroid/bta/dm/bta_dm_api.c中

void BTA_DmBond(BD_ADDR bd_addr)

{

tBTA_DM_API_BOND *p_msg;

if ((p_msg = (tBTA_DM_API_BOND *) GKI_getbuf(sizeof(tBTA_DM_API_BOND))) != NULL)

{

p_msg->hdr.event = BTA_DM_API_BOND_EVT;

bdcpy(p_msg->bd_addr, bd_addr);

bta_sys_sendmsg(p_msg);

}

}

在./external/bluetooth/bluedroid/bta/sys/bta_sys_main.c中

void bta_sys_sendmsg(void *p_msg)

{

GKI_send_msg(bta_sys_cb.task_id, p_bta_sys_cfg->mbox, p_msg);

}

又到了这个sendmsg,不过这次的跟上一次不一样的地方是参数task_id不是BTIF_TASK, 所以接收者不是btif_task而是btu_task

5.3.3 在./stack/btu/btu_task.c中

BTU_API UINT32 btu_task (UINT32 param)

{

if (event & TASK_MBOX_2_EVT_MASK)

{

while ((p_msg = (BT_HDR *) GKI_read_mbox(TASK_MBOX_2)) != NULL)

{

bta_sys_event(p_msg);

}

}

}

在./bta/sys/bta_sys_main.c中

BTA_API void bta_sys_event(BT_HDR *p_msg)

{

UINT8 id;

BOOLEAN freebuf = TRUE;

id = (UINT8) (p_msg->event >> 8);

freebuf = (*bta_sys_cb.reg[id]->evt_hdlr)(p_msg);

}

会调用全局函数bta_sys_cb.reg[id]->evt_hdlr，这个东东是从哪儿来的呢？

5.4 bta_sys_cb.reg[id]->evt_hdlr的由来

在bta/sys/bta_sys_main.c中

void bta_sys_register(UINT8 id, const tBTA_SYS_REG *p_reg)

{

bta_sys_cb.reg[id] = (tBTA_SYS_REG *) p_reg;

bta_sys_cb.is_reg[id] = TRUE;

}

在bta/dm/bta_dm_api.c中

static const tBTA_SYS_REG bta_dm_reg =

{

bta_dm_sm_execute,

bta_dm_sm_disable

};

通过bta_sys_register (BTA_ID_DM, &bta_dm_reg )注册的，

所以这儿的bta_sys_cb.reg[id]->evt_hdlr调用的就是bta_dm_sm_execute

5.5 bta_dm_sm_execute

在bta/dm/bta_dm_main.c中

BOOLEAN bta_dm_sm_execute(BT_HDR *p_msg)

{

UINT16 event = p_msg->event & 0x00ff;

if(event < BTA_DM_NUM_ACTIONS)

{

(*bta_dm_action[event])( (tBTA_DM_MSG*) p_msg);

}

return TRUE;

}

bta_dm_action是一个函数指针的数组，此时event=10,在数组中是函数bta_dm_bond

5.6

在./bta/dm/bta_dm_act.c中

void bta_dm_bond (tBTA_DM_MSG *p_data)

{

tBTM_STATUS status;

tBTA_DM_SEC sec_event;

char *p_name;

status = BTM_SecBond ( p_data->bond.bd_addr, 0, NULL, 0 );

if (bta_dm_cb.p_sec_cback && (status != BTM_CMD_STARTED))

{

p_name = BTM_SecReadDevName(p_data->bond.bd_addr);

if (!p_name)

p_name = "";

memset(&sec_event, 0, sizeof(tBTA_DM_SEC));

bdcpy(sec_event.auth_cmpl.bd_addr, p_data->bond.bd_addr);

memcpy(sec_event.auth_cmpl.bd_name, p_name, (BD_NAME_LEN-1));

sec_event.auth_cmpl.bd_name[BD_NAME_LEN-1] = 0;

sec_event.auth_cmpl.fail_reason = HCI_ERR_ILLEGAL_COMMAND;

if (status == BTM_SUCCESS)

sec_event.auth_cmpl.success = TRUE;

bta_dm_cb.p_sec_cback(BTA_DM_AUTH_CMPL_EVT, &sec_event);

}

}

5.6.1 在./stack/btm/btm_sec.c中

tBTM_STATUS BTM_SecBond (BD_ADDR bd_addr, UINT8 pin_len, UINT8 *p_pin, UINT32
trusted_mask[])

{

p_dev_rec = btm_find_or_alloc_dev (bd_addr);
//第一次配对时alloc一个device

status = btm_sec_dd_create_conn(p_dev_rec);
//进入下一步

return status;

}

在stack/l2cap/l2c_utils.c中

在

附一: 协议栈中消息的传递

在btif_dm_create_bond中调用了函数btif_transfer_context来发送CREATE_BOND命令

btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,

(char *)bd_addr, sizeof(bt_bdaddr_t), NULL);

其中btif_dm_generic_evt 是回调函数，

BTIF_DM_CB_CREATE_BOND是命令

(char *)bd_addr是参数

1.1 stack中消息的发送与处理过程

在./external/bluetooth/bluedroid/btif/src/btif_core.c中

bt_status_t btif_transfer_context (tBTIF_CBACK *p_cback, UINT16
event, char* p_params, int param_len, tBTIF_COPY_CBACK *p_copy_cback)

{

tBTIF_CONTEXT_SWITCH_CBACK *p_msg;

//第1步获取msg的buffer

if ((p_msg = (tBTIF_CONTEXT_SWITCH_CBACK *) GKI_getbuf(sizeof(tBTIF_CONTEXT_SWITCH_CBACK) + param_len)) != NULL)

{

//第2步组成一个msg

p_msg->hdr.event = BT_EVT_CONTEXT_SWITCH_EVT;

p_msg->p_cb = p_cback;

p_msg->event = event;

if (p_copy_cback)

{

p_copy_cback(event, p_msg->p_param, p_params);

}

else if (p_params)

{

memcpy(p_msg->p_param, p_params, param_len); /* callback
parameter data */

}

/第3步，最后一步发送

btif_sendmsg(p_msg);

return BT_STATUS_SUCCESS;

}

else

{

return BT_STATUS_NOMEM;

}

}

1.2 进入core

在 ./external/bluetooth/bluedroid/btif/src/btif_core.c中

void btif_sendmsg(void *p_msg)

{

GKI_send_msg(BTIF_TASK, BTU_BTIF_MBOX, p_msg);

}

1.3 组成命令，并发送//这个event就是发送的命令

在./external/bluetooth/bluedroid/gki/common/gki_buffer.c中

void GKI_send_msg (UINT8 task_id, UINT8 mbox, void *msg)

{

BUFFER_HDR_T *p_hdr;

tGKI_COM_CB *p_cb = &gki_cb.com;

p_hdr = (BUFFER_HDR_T *) ((UINT8 *) msg - BUFFER_HDR_SIZE);

GKI_disable();

if (p_cb->OSTaskQFirst[task_id][mbox])

p_cb->OSTaskQLast[task_id][mbox]->p_next = p_hdr;

else

p_cb->OSTaskQFirst[task_id][mbox] = p_hdr;

p_cb->OSTaskQLast[task_id][mbox] = p_hdr;

p_hdr->p_next = NULL;

p_hdr->status = BUF_STATUS_QUEUED;

p_hdr->task_id = task_id;

GKI_enable();

GKI_send_event(task_id, (UINT16)EVENT_MASK(mbox));

return;

}

1.4 具体的发送过程

这儿说是发送，并不是发送msg,而是向接收者发送了一个信号。

在./external/bluetooth/bluedroid/gki/ulinux/gki_ulinux.c中

UINT8 GKI_send_event (UINT8 task_id, UINT16 event)

{

if (task_id < GKI_MAX_TASKS)

{

pthread_mutex_lock(&gki_cb.os.thread_evt_mutex[task_id]);

gki_cb.com.OSWaitEvt[task_id] |= event;

pthread_cond_signal(&gki_cb.os.thread_evt_cond[task_id]);

pthread_mutex_unlock(&gki_cb.os.thread_evt_mutex[task_id]);

return ( GKI_SUCCESS );

}

return (GKI_FAILURE);

}

1.5 接收者

因为GKI_send_msg(BTIF_TASK, BTU_BTIF_MBOX, p_msg);发送的task是BTIF_TASK

所以在./external/bluetooth/bluedroid/btif/src/btif_core.c中

static void btif_task(UINT32 params)

{

UINT16 event;

BT_HDR *p_msg;

btif_associate_evt();

for(;;)

{

//上面的pthread_cond_signal,把下面的wait打断

event = GKI_wait(0xFFFF, 0);

if(event & TASK_MBOX_1_EVT_MASK)

{//这个event就是发送的命令

while((p_msg = GKI_read_mbox(BTU_BTIF_MBOX)) != NULL)

{

switch (p_msg->event)

{

case BT_EVT_CONTEXT_SWITCH_EVT: //执行到这儿

btif_context_switched(p_msg);

break;

default:

break;

}

GKI_freebuf(p_msg);

}

}

}

btif_disassociate_evt();

}

1.6 最后调用回调函数

在./external/bluetooth/bluedroid/btif/src/btif_core.c中

static void btif_context_switched(void *p_msg)

{

tBTIF_CONTEXT_SWITCH_CBACK *p;

BTIF_TRACE_VERBOSE0("btif_context_switched");

p = (tBTIF_CONTEXT_SWITCH_CBACK *) p_msg;

//调用回调函数

if (p->p_cb)

p->p_cb(p->event, p->p_param);

}

1.7 在回调函数中进行具体的处理

在./external/bluetooth/bluedroid/btif/src/btif_dm.c中

static void btif_dm_generic_evt(UINT16 event, char* p_param)

{

switch(event) //这个event就是发送的命令

{

case BTIF_DM_CB_CREATE_BOND:

{

btif_dm_cb_create_bond((bt_bdaddr_t *)p_param);

}

break;

}

}

1.8

根据task_id来区分是发送给btif_task还是btu_task

2.5 总结一下

附三：

在stack/hcic/hcicmds.c中

BOOLEAN btsnd_hcic_delete_stored_key (BD_ADDR bd_addr, BOOLEAN delete_all_flag)

{

BT_HDR *p;

UINT8 *pp;

p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_DELETE_STORED_KEY);
//获取buffer

pp = (UINT8 *)(p + 1);

p->len = HCIC_PREAMBLE_SIZE + HCIC_PARAM_SIZE_DELETE_STORED_KEY;

p->offset = 0;

UINT16_TO_STREAM (pp, HCI_DELETE_STORED_LINK_KEY);

UINT8_TO_STREAM (pp, HCIC_PARAM_SIZE_DELETE_STORED_KEY);

BDADDR_TO_STREAM (pp, bd_addr);

UINT8_TO_STREAM (pp, delete_all_flag);

btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);

return (TRUE);

}

在stack/btu/btu_hcif.c中

void btu_hcif_send_cmd (UINT8 controller_id, BT_HDR *p_buf)

{

if (controller_id == LOCAL_BR_EDR_CONTROLLER_ID)

HCI_CMD_TO_LOWER(p_buf);

}

#define HCI_CMD_TO_LOWER(p) bte_main_hci_send((BT_HDR *)(p), BT_EVT_TO_LM_HCI_CMD);

在main/bte_main.c 中

void bte_main_hci_send (BT_HDR *p_msg, UINT16
event)

{

UINT16 sub_event = event & BT_SUB_EVT_MASK; /* local
controller ID */

p_msg->event = event;

if((sub_event == LOCAL_BR_EDR_CONTROLLER_ID) || (sub_event == LOCAL_BLE_CONTROLLER_ID))

{

if (bt_hc_if)

{

bt_hc_if->transmit_buf((TRANSAC)p_msg, (char *) (p_msg + 1), p_msg->len);

}

else

GKI_freebuf(p_msg);

}

}

在hci/src/bt_hci_bdroid.c中

static int transmit_buf(TRANSAC transac, char *p_buf, int len)

{

utils_enqueue(&tx_q, (void *) transac);

bthc_signal_event(HC_EVENT_TX);

return BT_HC_STATUS_SUCCESS;

}

发送了一个HC_EVENT_TX信号

那么是谁来接收这个HC_EVENT_TX命令呢？

在hci/src/bt_hci_bdroid.c中

static void *bt_hc_worker_thread(void *arg)

{

if (events & HC_EVENT_TX)

{

tx_cmd_pkts_pending = FALSE;

HC_BT_HDR * sending_msg_que[64];

int sending_msg_count = 0;

utils_lock();

p_next_msg = tx_q.p_first;

while (p_next_msg && sending_msg_count < (int)sizeof(sending_msg_que)/sizeof(sending_msg_que[0]))

{

if ((p_next_msg->event & MSG_EVT_MASK)==MSG_STACK_TO_HC_HCI_CMD)

{

if ((tx_cmd_pkts_pending == TRUE) || (num_hci_cmd_pkts <= 0))

{

tx_cmd_pkts_pending = TRUE;

p_next_msg = utils_getnext(p_next_msg);

continue;

}

}

p_msg = p_next_msg;

p_next_msg = utils_getnext(p_msg);

utils_remove_from_queue_unlocked(&tx_q, p_msg);

sending_msg_que[sending_msg_count++] = p_msg;

}

utils_unlock();

int i;

for(i = 0; i < sending_msg_count; i++)

p_hci_if->send(sending_msg_que[i]);

if (tx_cmd_pkts_pending == TRUE)

BTHCDBG("Used up Tx Cmd credits");

}

}

其中p_hci_if的初始化是在hci/src/bt_hci_bdroid.c中

static int init(const bt_hc_callbacks_t* p_cb, unsigned
char *local_bdaddr)

{

#ifdef HCI_USE_MCT //MCT: Multi-Channels Transport

extern tHCI_IF hci_mct_func_table;

p_hci_if = &hci_mct_func_table;

#elif defined HCI_USE_RTK_H5

extern tHCI_IF hci_h5_func_table;

p_hci_if = &hci_h5_func_table;

#else

extern tHCI_IF hci_h4_func_table;

p_hci_if = &hci_h4_func_table; //这儿是用的这个

#endif

p_hci_if->init();

}

在hci/src/userial.c中

uint16_t userial_write(uint16_t msg_id, uint8_t *p_data, uint16_t len)

{

int ret, total = 0;

while(len != 0)

{

ret = write(userial_cb.fd, p_data+total, len);

total += ret;

len -= ret;

}

return ((uint16_t)total);

}

在hci/src/userial.c中，初始化了userial_cb.fd

uint8_t userial_open(uint8_t port)

{

bt_vnd_if->op(BT_VND_OP_USERIAL_OPEN, &fd_array); //向libbt_verder.so发消息

userial_cb.fd = fd_array[0];

}

root@android:/ # ls /dev/ttyS2 -l

crw-rw---- bluetooth
net_bt_stack 250, 2 2014-08-19 15:30
ttyS2