Android6.0 之Bluetooth Enable流程分析

最近开始分析蓝牙模块代码，特在此记录一下，本文主要是基于Android6.0 代码的蓝牙系统服务的使能流程分析，因为jni以下的流程网上有很多文章写得很清楚，故本文仅分析package和framework层的流程，涉及到的主要的类有：

• framework/base/core/java/android/bluetooth/BluetoothAdapter.java

• framework/base/services/core/java/com/android/server/BluetoothService.java

• framework/base/services/java/com/android/server/SystemServer.java -

• packages/apps/Bluetooth/src/com/android/bluetooth/adapterService.java-

• packages/apps/Bluetooth/src/com/android/bluetooth/adapterState.java-

---

蓝牙Enable

Android 的蓝牙Enable 是由BluetoothAdapter 提供的，只需要调用BluetoothAdapter.enable()即可启动蓝牙，下面就开始分析这一个过程

@RequiresPermission(Manifest.permission.BLUETOOTH_ADMIN)    public boolean enable() {        int state = STATE_OFF;        if (isEnabled() == true){            if (DBG) Log.d(TAG, "enable(): BT is already enabled..!");            return true;        }        //Use service interface to get the exact state        if (mService != null) {            try {               state = mService.getState();            } catch (RemoteException e) {Log.e(TAG, "", e);}        }        if (state == BluetoothAdapter.STATE_BLE_ON) {                Log.e(TAG, "BT is in BLE_ON State");                notifyUserAction(true);                return true;        }        Log.d(TAG, ":  bt enable current package name : "+ActivityThread.currentPackageName());        AppOpsManager appOps = (AppOpsManager)((ActivityThread.currentApplication()).getApplicationContext()).getSystemService(Context.APP_OPS_SERVICE);        if (appOps.noteOp(AppOpsManager.OP_BLUETOOTH_ON_OFF) != AppOpsManager.MODE_ALLOWED) {           Log.d(TAG, ": bt enable");           return false;        }        try {            if (DBG) Log.d(TAG, "enable");            return mManagerService.enable();        } catch (RemoteException e) {Log.e(TAG, "", e);}        return false;    }

重点关注mManagerService.enable()函数，mManagerService是IBluetoothManager类型，也就是btAdapter的一个proxy，为什么这么说呢？可以看一下getDefaultAdapter()

public static synchronized BluetoothAdapter getDefaultAdapter() {        if (sAdapter == null) {            IBinder b = ServiceManager.getService(BLUETOOTH_MANAGER_SERVICE);            if (b != null) {                IBluetoothManager managerService = IBluetoothManager.Stub.asInterface(b);                sAdapter = new BluetoothAdapter(managerService);            } else {                Log.e(TAG, "Bluetooth binder is null");            }        }        return sAdapter;    }    /**     * Use {@link #getDefaultAdapter} to get the BluetoothAdapter instance.     */    BluetoothAdapter(IBluetoothManager managerService) {        if (managerService == null) {            throw new IllegalArgumentException("bluetooth manager service is null");        }        try {            mService = managerService.registerAdapter(mManagerCallback);        } catch (RemoteException e) {Log.e(TAG, "", e);}        mManagerService = managerService;        mLeScanClients = new HashMap<LeScanCallback, ScanCallback>();        mToken = new Binder();    }

通过ServiceManager 获取了一个系统服务， 然后转换为了IBluetoothManager 接口，让mManagerService 作为了BLUETOOTH_MANAGER_SERVICE的代理。
此处顺便提一下BLUETOOTH_MANAGER_SERVICE的开启，看SystemServer.java类

mSystemServiceManager.startService(BluetoothService.class);

继续看BluetoothService.java的构造函数

public BluetoothService(Context context) {        super(context);        mBluetoothManagerService = new BluetoothManagerService(context);    }

可以看到构造函数中new了BluetoothManagerService类的实例，继续看onStart函数

public void onStart() {        Log.d(TAG, "onStart: publishing BluetoothManagerService");        publishBinderService(BluetoothAdapter.BLUETOOTH_MANAGER_SERVICE, mBluetoothManagerService);    }

至此，该服务的开启分析完毕，可以知道原来BLUETOOTH_MANAGER_SERVICE就是BluetoothManagerService类。
继续回到最初的主线，现在enable的调用到了BluetoothManagerService.java中的enable()

public boolean enable() {        ……        /// @}        synchronized(mReceiver) {            mQuietEnableExternal = false;            mEnableExternal = true;            // waive WRITE_SECURE_SETTINGS permission check            sendEnableMsg(false);        }        if (DBG) Log.d(TAG, "enable returning");        return true;    }

继续看sendEnableMsg

private void sendEnableMsg(boolean quietMode) {        mHandler.sendMessage(mHandler.obtainMessage(MESSAGE_ENABLE,                             quietMode ? 1 : 0, 0));    }

此处发送Handler消息，继续看处理该消息的代码

private class BluetoothHandler extends Handler {        public BluetoothHandler(Looper looper) {            super(looper);        }        @Override        public void handleMessage(Message msg) {            if (DBG) Log.d (TAG, "Message: " + msg.what);            switch (msg.what) {            ……            case MESSAGE_ENABLE:                    if (DBG) {                        Log.d(TAG, "MESSAGE_ENABLE: mBluetooth = " + mBluetooth);                    }                    mHandler.removeMessages(MESSAGE_RESTART_BLUETOOTH_SERVICE);                    mEnable = true;                    handleEnable(msg.arg1 == 1);                    break;                    ……                   

继续看handleEnable()

private void handleEnable(boolean quietMode) {        mQuietEnable = quietMode;        synchronized(mConnection) {            if (DBG) Log.d(TAG, "handleEnable: mBluetooth = " + mBluetooth +                    ", mBinding = " + mBinding + "quietMode = " + quietMode);            if ((mBluetooth == null) && (!mBinding)) {                if (DBG) Log.d(TAG, "Bind AdapterService");                //Start bind timeout and bind                Message timeoutMsg=mHandler.obtainMessage(MESSAGE_TIMEOUT_BIND);                mHandler.sendMessageDelayed(timeoutMsg,TIMEOUT_BIND_MS);                mConnection.setGetNameAddressOnly(false);                Intent i = new Intent(IBluetooth.class.getName());                if (!doBind(i, mConnection,Context.BIND_AUTO_CREATE | Context.BIND_IMPORTANT,                        UserHandle.CURRENT)) {                    mHandler.removeMessages(MESSAGE_TIMEOUT_BIND);                    Log.e(TAG, "Fail to bind to: " + IBluetooth.class.getName());                } else {                    mBinding = true;                }            } else if (mBluetooth != null) {                if (mConnection.isGetNameAddressOnly()) {                    // if GetNameAddressOnly is set, we can clear this flag,                    // so the service won't be unbind                    // after name and address are saved                    mConnection.setGetNameAddressOnly(false);                    //Register callback object                    try {                        mBluetooth.registerCallback(mBluetoothCallback);                    } catch (RemoteException re) {                        Log.e(TAG, "Unable to register BluetoothCallback",re);                    }                    //Inform BluetoothAdapter instances that service is up                    sendBluetoothServiceUpCallback();                }                //Enable bluetooth                try {                    if (!mQuietEnable) {                        if(!mBluetooth.enable()) {                            Log.e(TAG,"IBluetooth.enable() returned false");                        }                    }                    else {                        if(!mBluetooth.enableNoAutoConnect()) {                            Log.e(TAG,"IBluetooth.enableNoAutoConnect() returned false");                        }                    }                } catch (RemoteException e) {                    Log.e(TAG,"Unable to call enable()",e);                }            }        }    }

绕了一圈，最后就是调用了mBluetooth.enable()，而在 BluetoothAdapter 里面本来就有一个 mService，并且 mService就是registerAdapter() 返回的 mBluetooth！

public IBluetooth registerAdapter(IBluetoothManagerCallback callback){        if (callback == null) {            Log.w(TAG, "Callback is null in registerAdapter");            return null;        }        Message msg = mHandler.obtainMessage(MESSAGE_REGISTER_ADAPTER);        msg.obj = callback;        mHandler.sendMessage(msg);        synchronized(mConnection) {            return mBluetooth;        }    }

不过值得注意的是，BluetoothAdapter类中的mService的赋值是在这里的bindService之前的，而且其他的API的实现，都是直接用的mService，所以其实bindService，是在BluetoothManagerService.java的另一个case（MESSAGE_GET_NAME_AND_ADDRESS）中调用的，这个mBluetooth就是蓝牙APP里面的AdapterService了。

public synchronized boolean enable(boolean quietMode) {         enforceCallingOrSelfPermission(BLUETOOTH_ADMIN_PERM, "Need BLUETOOTH ADMIN permission");         debugLog("enable() - Enable called with quiet mode status =  " + mQuietmode);         mQuietmode = quietMode;         Message m = mAdapterStateMachine.obtainMessage(AdapterState.BLE_TURN_ON);         mAdapterStateMachine.sendMessage(m);         return true;     }

这里用到了StateMachine，此处不展开状态机的用法，简单的说就是一个状态机包含多个状态，在不同的状态对同一个消息由不同的处理，直接看初始状态，处理该消息的地方

public boolean processMessage(Message msg) {            AdapterService adapterService = mAdapterService;            if (adapterService == null) {                errorLog("Received message in OffState after cleanup: " + msg.what);                return false;            }            debugLog("Current state: OFF, message: " + msg.what);            switch(msg.what) {               case BLE_TURN_ON:               //                   notifyAdapterStateChange(BluetoothAdapter.STATE_BLE_TURNING_ON);                   mPendingCommandState.setBleTurningOn(true);                   transitionTo(mPendingCommandState);                   sendMessageDelayed(BLE_START_TIMEOUT, BLE_START_TIMEOUT_DELAY);                   adapterService.BleOnProcessStart();                   break;                   ……            }            return true;        }    }

AdapterState状态机进入mPendingCommandState，并打开mPendingCommandState.setBleTurningOn(true)，值得注意的是，只有这里设置为true之后，processProfileServiceStateChanged函数中才会来发送BLE_STARTED消息，调用JNI函数enableNative函数。

private void processProfileServiceStateChanged(String serviceName, int state) {        boolean doUpdate=false;        boolean isBleTurningOn;        boolean isBleTurningOff;        boolean isTurningOn;        boolean isTurningOff;        synchronized (mProfileServicesState) {            Integer prevState = mProfileServicesState.get(serviceName);            if (prevState != null && prevState != state) {                mProfileServicesState.put(serviceName,state);                doUpdate=true;            }        }        debugLog("onProfileServiceStateChange() serviceName=" + serviceName                + ", state = " + state + ", doUpdate = " + doUpdate);        if (!doUpdate) {            return;        }        synchronized (mAdapterStateMachine) {            isTurningOff = mAdapterStateMachine.isTurningOff();            isTurningOn = mAdapterStateMachine.isTurningOn();            isBleTurningOn = mAdapterStateMachine.isBleTurningOn();            isBleTurningOff = mAdapterStateMachine.isBleTurningOff();        }        debugLog("processProfileServiceStateChanged() - serviceName=" + serviceName +                 " isTurningOn=" + isTurningOn + " isTurningOff=" + isTurningOff +                 " isBleTurningOn=" + isBleTurningOn + " isBleTurningOff=" + isBleTurningOff);        if (isBleTurningOn) {            if (serviceName.equals("com.android.bluetooth.gatt.GattService")) {                debugLog("GattService is started");                mAdapterStateMachine.sendMessage(mAdapterStateMachine.obtainMessage(AdapterState.BLE_STARTED));                return;            }            

显然此时AdapterState处于PendingCommandState，看其processMessage函数
public boolean processMessage(Message msg) {

        boolean isTurningOn= isTurningOn();        boolean isTurningOff = isTurningOff();        boolean isBleTurningOn = isBleTurningOn();        boolean isBleTurningOff = isBleTurningOff();        AdapterService adapterService = mAdapterService;        AdapterProperties adapterProperties = mAdapterProperties;        if ((adapterService == null) || (adapterProperties == null)) {            errorLog("Received message in PendingCommandState after cleanup: " + msg.what);            return false;        }        debugLog("Current state: PENDING_COMMAND, message: " + msg.what);        switch (msg.what) {            ……            case BLE_STARTED:                //Remove start timeout                removeMessages(BLE_START_TIMEOUT);                //Enable                boolean isGuest = UserManager.get(mAdapterService).isGuestUser();                if (!adapterService.enableNative(isGuest)) {                    errorLog("Error while turning Bluetooth on");                    notifyAdapterStateChange(BluetoothAdapter.STATE_OFF);                    transitionTo(mOffState);                } else {                    sendMessageDelayed(ENABLE_TIMEOUT, ENABLE_TIMEOUT_DELAY);                }                break;                            ……

至此，上层终于调用到了jni层，enableNative是在jni注册的native函数。继续看BleOnProcessStart

void BleOnProcessStart() {        debugLog("BleOnProcessStart()");        Class[] supportedProfileServices = Config.getSupportedProfiles();        //Initialize data objects        debugLog("supportedProfileServices.length = " + supportedProfileServices.length);        for (int i=0; i < supportedProfileServices.length;i++) {            debugLog("supportedProfileServices[" + i + "]: " + supportedProfileServices[i].getName());            mProfileServicesState.put(supportedProfileServices[i].getName(),BluetoothAdapter.STATE_OFF);        }        mRemoteDevices = new RemoteDevices(this);        mAdapterProperties.init(mRemoteDevices);        debugLog("BleOnProcessStart() - Make Bond State Machine");        mBondStateMachine = BondStateMachine.make(mPowerManager, this, mAdapterProperties, mRemoteDevices);        mJniCallbacks.init(mBondStateMachine,mRemoteDevices);        setAdapterService(this);        //Start Gatt service        setGattProfileServiceState(supportedProfileServices,BluetoothAdapter.STATE_ON);    }

可以看到至此，设备支持的Profile服务都起来了。