蓝牙关闭的流程比打开流程要简单，主要就是一些profile的断连以及协议栈相关结构的释放。
这里简单说一下其流程，就直接从协议栈的disable的接口说起了。
static int disable(void) {
if (!interface_ready())//检查hal层的callback
return BT_STATUS_NOT_READY;
stack_manager_get_interface()->shut_down_stack_async();
return BT_STATUS_SUCCESS;
}
简单看下stack_manager_get_interface ：
static const stack_manager_t interface = {
init_stack,
start_up_stack_async,
shut_down_stack_async,
clean_up_stack_async,
get_stack_is_running
};
const stack_manager_t *stack_manager_get_interface() {
ensure_manager_initialized();
return &interface;
}
看shut_down_stack_async的具体实现：
static void shut_down_stack_async(void) {
thread_post(management_thread, event_shut_down_stack, NULL);
}
这里就是把关闭的函数 post 到management_thread 里面来执行。继续执行的函数还是event_shut_down_stack
// Synchronous function to shut down the stack
static void event_shut_down_stack(UNUSED_ATTR void *context) {
...
hack_future = future_new();//为了同步用的
stack_is_running = false; btif_disable_bluetooth();//真正的disable的接口
module_shut_down(get_module(BTIF_CONFIG_MODULE));//释放btif模块 future_await(hack_future);//获得了信号量之后才能执行到这里
module_shut_down(get_module(CONTROLLER_MODULE)); // Doesn't do any work, just puts it in a restartable state LOG_DEBUG("%s finished.", __func__);
btif_thread_post(event_signal_stack_down, NULL);//通知上层stack down
}
这里简单说一下这个hack_future，其在这里的用途类似二值信号量，如果这个信号量不可用，就会一直等在future_await 这里，和其对应的一个函数叫future_ready，
void future_ready(future_t *future, void *value) {
assert(future != NULL);
assert(future->ready_can_be_called);
future->ready_can_be_called = false;
future->result = value;
semaphore_post(future->semaphore);
}
这个函数会让这个信号量变得可读，future_await 就可以顺利返回继续执行。其实就是为了disable 过程的同步性。看了一下，其会在btif_disable_bluetooth_evt 这个函数中释放信号量，看函数名字应该是disable 完成的一个事件，这也符合我们的预期。关于这个信号量，就分析到这里。
下面主要看btif_disable_bluetooth ：
/*******************************************************************************
**
** Function btif_disable_bluetooth
**
** Description Inititates shutdown of Bluetooth system.
** Any active links will be dropped and device entering
** non connectable/discoverable mode
**
** Returns void
**
*******************************************************************************/
bt_status_t btif_disable_bluetooth(void)
{
BTIF_TRACE_DEBUG("BTIF DISABLE BLUETOOTH");
btif_dm_on_disable();
/* cleanup rfcomm & l2cap api */
btif_sock_cleanup();
btif_pan_cleanup();
BTA_DisableBluetooth();
return BT_STATUS_SUCCESS;
}
这里的注释非常重要，可以帮助我们很好的理解函数，其语义是：关闭蓝牙系统，所有的link 都要断开，设备进入不可发现和不可连接的状态。
我这里的分析的case 就是当前蓝牙还连接着一个hid 设备的时候的disable 流程。
这里的重点是BTA_DisableBluetooth();，我这里先简单分析下其他的几个函数：
void btif_dm_on_disable()
{
/* cancel any pending pairing requests */
if (pairing_cb.state == BT_BOND_STATE_BONDING)
{
bt_bdaddr_t bd_addr;
bdcpy(bd_addr.address, pairing_cb.bd_addr);
btif_dm_cancel_bond(&bd_addr);//如果设备处于配对状态，那么取消配对
}
}
这个很简单，如果设备处于配对状态，这个时候关闭设备，它的确应该取消配对，符合预期。
另外两个函数 一个和sock有关，另一个和pan有关，暂时都没有用到这些模块，暂时不分析。那么重点还是看BTA_DisableBluetooth();
/*******************************************************************************
**
** Function BTA_DisableBluetooth
**
** Description Disables bluetooth service. This function is called when
** the application no longer needs bluetooth service
**
** Returns void
**
*******************************************************************************/
tBTA_STATUS BTA_DisableBluetooth(void)
{
BT_HDR *p_msg;
if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
{
p_msg->event = BTA_DM_API_DISABLE_EVT;//向DM模块发送disable
bta_sys_sendmsg(p_msg);
}
...
return BTA_SUCCESS;
}
这个函数就是向设备管理模块发送BTA_DM_API_DISABLE_EVT ，然后由设备管理模块继续进一步的操作。这里使用bta_sys_sendmsg，涉及到进程间通信，其他的文章中已经讲过，这里不赘述。最终调用的函数是在bta_dm_act.c中的bta_dm_disable：
/*******************************************************************************
**
** Function bta_dm_disable
**
** Description Disables the BT device manager
**
**
** Returns void
**
*******************************************************************************/
void bta_dm_disable (tBTA_DM_MSG *p_data)
{
UNUSED(p_data); /* Set l2cap idle timeout to 0 (so BTE immediately disconnects ACL link after last channel is closed) */
L2CA_SetIdleTimeoutByBdAddr((UINT8 *)BT_BD_ANY, , BT_TRANSPORT_BR_EDR);//设置idletimeout时间，设置为0
L2CA_SetIdleTimeoutByBdAddr((UINT8 *)BT_BD_ANY, , BT_TRANSPORT_LE); /* disable all active subsystems */
bta_sys_disable(BTA_SYS_HW_BLUETOOTH);//关闭蓝牙相关的各个子模块。这里涉及到短线等操作 BTM_SetDiscoverability(BTM_NON_DISCOVERABLE, , );//不可发现
BTM_SetConnectability(BTM_NON_CONNECTABLE, , );//不可连接 bta_dm_disable_pm();//电源管理相关
bta_dm_disable_search_and_disc();//disable 搜索和服务发现的工作
bta_dm_cb.disabling = TRUE;//设置正在断开的标志位 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
BTM_BleClearBgConnDev();//清除whitelist
#endif if(BTM_GetNumAclLinks()==)//如果已经没有link存在了，那么调用回调函数报告上层
{
#if (defined(BTA_DISABLE_DELAY) && BTA_DISABLE_DELAY > 0) bta_sys_stop_timer(&bta_dm_cb.disable_timer);
bta_dm_cb.disable_timer.p_cback = (TIMER_CBACK*)&bta_dm_disable_conn_down_timer_cback;
bta_sys_start_timer(&bta_dm_cb.disable_timer, , BTA_DISABLE_DELAY);
#else
bta_dm_disable_conn_down_timer_cback(NULL);
#endif
}
else//如果还有link存在，启动一个定时器，如果5s之后还有link存在，那么执行定时器回调函数
{
bta_dm_cb.disable_timer.p_cback = (TIMER_CBACK*)&bta_dm_disable_timer_cback;
bta_dm_cb.disable_timer.param = ;
bta_sys_start_timer(&bta_dm_cb.disable_timer, , );
} }
上面的函数的重点是蓝牙关闭各个子模块的函数bta_sys_disable(BTA_SYS_HW_BLUETOOTH) ，简单分析下另外的函数。
首先看L2CA_SetIdleTimeoutByBdAddr这里的参数是任何设备，timeout 时间是0，其语义就像其注释“Set l2cap idle timeout to 0 (so BTE immediately disconnects ACL link after last channel is closed) ”当l2cap上面没有channel存在的时候，acl link会被立即断开。
BTM_SetDiscoverability和BTM_SetConnectability，这两个函数也是比较简单，告诉蓝牙控制器不要被发现，也不可被连接，最终控制器的做法是关闭scan。
bta_dm_disable_search_and_disc，这个函数的作用也和它的名字一样，肯定是有disable search和disable discovery两步。简单说一下，如果当前设备在搜索，那么调用bta_dm_search_cancel 来把这个行为cancel掉，根据具体情况，这里涉及到的可能的case包括：cancel 掉inquiry、cancel掉获取名字的流程、cancel掉GATT的流程以及向Bluetooth 应用汇报底层状态的行为。
下面我们看下BTM_BleClearBgConnDev：
/*******************************************************************************
**
** Function BTM_BleClearBgConnDev
**
** Description This function is called to clear the whitelist,
** end any pending whitelist connections,
* and reset the local bg device list.
**
** Parameters void
**
** Returns void
**
*******************************************************************************/
void BTM_BleClearBgConnDev(void)
{
btm_ble_start_auto_conn(FALSE);
btm_ble_clear_white_list();
gatt_reset_bgdev_list();
}
我们还是看一下其注释，可知这个函数的主要作用就是清除whitelist，以及pending的连接，并且清空了bg device list
/*******************************************************************************
**
** Function btm_ble_start_auto_conn
**
** Description This function is to start/stop auto connection procedure.
**
** Parameters start: TRUE to start; FALSE to stop.
**
** Returns void
**
*******************************************************************************/
BOOLEAN btm_ble_start_auto_conn(BOOLEAN start)
{
tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
BD_ADDR dummy_bda = {};
BOOLEAN exec = TRUE;
UINT16 scan_int;
UINT16 scan_win;
UINT8 own_addr_type = p_cb->addr_mgnt_cb.own_addr_type;
UINT8 peer_addr_type = BLE_ADDR_PUBLIC;
if (start)
{
...
}
else
{
if (p_cb->conn_state == BLE_BG_CONN)
{
btsnd_hcic_ble_create_conn_cancel();//如果已经init了BG conn，那么就取消
btm_ble_set_conn_st (BLE_CONN_CANCEL);//清除init状态
p_cb->wl_state &= ~BTM_BLE_WL_INIT;//清楚wl的init状态
}
else
{
BTM_TRACE_DEBUG("conn_st = %d, not in auto conn state, cannot stop", p_cb->conn_state);
exec = FALSE;
}
}
return exec;
}
注释里面的“end any pending whitelist connections” 对应的就是btm_ble_start_auto_conn(FALSE); 函数的行为，下面我们看看btm_ble_clear_white_list：
void btm_ble_clear_white_list (void)
{
BTM_TRACE_EVENT ("btm_ble_clear_white_list");
btsnd_hcic_ble_clear_white_list();
background_connections_clear();
}
这个很简单，就是下了一个HCI命令告知控制器要把wl清除掉，另外其把本地的BG connection list也清除了。关于BTM_BleClearBgConnDev 就说到这里。
接下来看一下BTM_GetNumAclLinks，这个函数是统计当前的ACL link的数量，如果是已经没有acl link了，那么BTA_DISABLE_DELAY 时间之后就可以调用bta_dm_disable_conn_down_timer_cback 来向上层汇报BTA_SYS_API_DISABLE_EVT这个行为。该文章分析的是有link存在的情况，是不走这个流程，但是我们可以猜想，等link 断开之后，应该还会走bta_dm_disable_conn_down_timer_cback 这个流程来上报事件。
最后说一下bta_dm_disable_timer_cback，这个函数 当超过5s，还有link没有断开的时候就会执行该函数来断开，其核心流程就是btm_remove_acl ，这里不做详细分析了。（只有当所有的link都断开了，这个定时器才会被取消）
我们现在看一下disable 的重点：关闭各个子模块：bta_sys_disable(BTA_SYS_HW_BLUETOOTH);
/*******************************************************************************
**
** Function bta_sys_disable
**
** Description For each registered subsystem execute its disable function.
**
** Returns void
**
*******************************************************************************/
void bta_sys_disable(tBTA_SYS_HW_MODULE module)
{
int bta_id = ;
int bta_id_max = ;
switch( module )
{
case BTA_SYS_HW_BLUETOOTH:
bta_id = BTA_ID_DM;
bta_id_max = BTA_ID_BLUETOOTH_MAX;
break;
default:
APPL_TRACE_WARNING("bta_sys_disable: unkown module");
return;
} for ( ; bta_id <= bta_id_max; bta_id++)
{
if (bta_sys_cb.reg[bta_id] != NULL)
{
if (bta_sys_cb.is_reg[bta_id] == TRUE && bta_sys_cb.reg[bta_id]->disable != NULL)
{
(*bta_sys_cb.reg[bta_id]->disable)();
}
}
}
}
这个函数虽然执行的任务非常的多，但是其很好理解，就是调用每一个每一个子模块先前注册的handler的disable 函数，主要是做一些清理的工作。
下面对这些模块做一个简单的说明：
总共有哪些模块呢？如下：
/* SW sub-systems */
#define BTA_ID_SYS 0 /* system manager */
/* BLUETOOTH PART - from 0 to BTA_ID_BLUETOOTH_MAX */
#define BTA_ID_DM 1 /* device manager */
#define BTA_ID_DM_SEARCH 2 /* device manager search */
#define BTA_ID_DM_SEC 3 /* device manager security */
#define BTA_ID_DG 4 /* data gateway */
#define BTA_ID_AG 5 /* audio gateway */
#define BTA_ID_OPC 6 /* object push client */
#define BTA_ID_OPS 7 /* object push server */
#define BTA_ID_FTS 8 /* file transfer server */
#define BTA_ID_CT 9 /* cordless telephony terminal */
#define BTA_ID_FTC 10 /* file transfer client */
#define BTA_ID_SS 11 /* synchronization server */
#define BTA_ID_PR 12 /* Printer client */
#define BTA_ID_BIC 13 /* Basic Imaging Client */
#define BTA_ID_PAN 14 /* Personal Area Networking */
#define BTA_ID_BIS 15 /* Basic Imaging Server */
#define BTA_ID_ACC 16 /* Advanced Camera Client */
#define BTA_ID_SC 17 /* SIM Card Access server */
#define BTA_ID_AV 18 /* Advanced audio/video */
#define BTA_ID_AVK 19 /* Audio/video sink */
#define BTA_ID_HD 20 /* HID Device */
#define BTA_ID_CG 21 /* Cordless Gateway */
#define BTA_ID_BP 22 /* Basic Printing Client */
#define BTA_ID_HH 23 /* Human Interface Device Host */
#define BTA_ID_PBS 24 /* Phone Book Access Server */
#define BTA_ID_PBC 25 /* Phone Book Access Client */
#define BTA_ID_JV 26 /* Java */
#define BTA_ID_HS 27 /* Headset */
#define BTA_ID_MSE 28 /* Message Server Equipment */
#define BTA_ID_MCE 29 /* Message Client Equipment */
#define BTA_ID_HL 30 /* Health Device Profile*/
#define BTA_ID_GATTC 31 /* GATT Client */
#define BTA_ID_GATTS 32 /* GATT Client */
#define BTA_ID_SDP 33 /* SDP Client */
#define BTA_ID_BLUETOOTH_MAX 34 /* last BT profile */
前面几个是系统相关的：system manager、device manager、device manager search等，后面都是BT 的profile 模块。
那这些模块在哪里注册的呢？这里也简单介绍几个实例：
首先看看系统管理模块：
/*******************************************************************************
**
** Function bta_sys_init
**
** Description BTA initialization; called from task initialization.
**
**
** Returns void
**
*******************************************************************************/
void bta_sys_init(void)
{
...
appl_trace_level = APPL_INITIAL_TRACE_LEVEL;
/* register BTA SYS message handler */
bta_sys_register( BTA_ID_SYS, &bta_sys_hw_reg);
...
}
发现系统管理模块在bta_sys_init 的时候就注册了，这也符合预期，看看其handler实现：
static const tBTA_SYS_REG bta_sys_hw_reg =
{
bta_sys_sm_execute,
NULL //disable函数为NULL
};
再看看device manager和device manager search模块的注册情况：
/*******************************************************************************
**
** Function BTA_EnableBluetooth
**
** Description Enables bluetooth service. This function must be
** called before any other functions in the BTA API are called.
**
**
** Returns tBTA_STATUS
**
*******************************************************************************/
tBTA_STATUS BTA_EnableBluetooth(tBTA_DM_SEC_CBACK *p_cback)
{
...
bta_sys_register (BTA_ID_DM, &bta_dm_reg );
bta_sys_register (BTA_ID_DM_SEARCH, &bta_dm_search_reg );
...
}
这两个是蓝牙enable的时候注册的BTA_EnableBluetooth，看看他们的handler：
static const tBTA_SYS_REG bta_dm_reg =
{
bta_dm_sm_execute,
bta_dm_sm_disable
}; static const tBTA_SYS_REG bta_dm_search_reg =
{
bta_dm_search_sm_execute,
bta_dm_search_sm_disable
};
他们的disable函数也非常的简单，就是一个deregister的过程：
void bta_dm_search_sm_disable( )
{
bta_sys_deregister( BTA_ID_DM_SEARCH ); }
下面我们找两个profile 看看：A2dp、GATT和HID
void BTA_AvEnable(tBTA_SEC sec_mask, tBTA_AV_FEAT features, tBTA_AV_CBACK *p_cback)
{
tBTA_AV_API_ENABLE *p_buf;
/* register with BTA system manager */
bta_sys_register(BTA_ID_AV, &bta_av_reg);在AVenable的时候注册
static const tBTA_SYS_REG bta_av_reg =
{
bta_av_hdl_event,
BTA_AvDisable
};
看看disable的内容：
/*******************************************************************************
**
** Function BTA_AvDisable
**
** Description Disable the advanced audio/video service.
**
** Returns void
**
*******************************************************************************/
void BTA_AvDisable(void)
{
BT_HDR *p_buf;
bta_sys_deregister(BTA_ID_AV);
if ((p_buf = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
{
p_buf->event = BTA_AV_API_DISABLE_EVT;//会继续处理这个事件相关的东西
bta_sys_sendmsg(p_buf);
}
}
看看GATT的情况：
void BTA_GATTC_AppRegister(tBT_UUID *p_app_uuid, tBTA_GATTC_CBACK *p_client_cb)
{
tBTA_GATTC_API_REG *p_buf; if (bta_sys_is_register(BTA_ID_GATTC) == FALSE)
{
bta_sys_register(BTA_ID_GATTC, &bta_gattc_reg);
}
static const tBTA_SYS_REG bta_gattc_reg =
{
bta_gattc_hdl_event,
BTA_GATTC_Disable
};
/*******************************************************************************
**
** Function BTA_GATTC_Disable
**
** Description This function is called to disable GATTC module
**
** Parameters None.
**
** Returns None
**
*******************************************************************************/
void BTA_GATTC_Disable(void)
{
BT_HDR *p_buf; if (bta_sys_is_register(BTA_ID_GATTC) == FALSE)
{
APPL_TRACE_WARNING("GATTC Module not enabled/already disabled");
return;
}
if ((p_buf = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
{
p_buf->event = BTA_GATTC_API_DISABLE_EVT;
bta_sys_sendmsg(p_buf);
}
bta_sys_deregister(BTA_ID_GATTC); }
这边我们发现套路是一样的，都会去bta_sys_deregister，然后会发送事件相应的disable事件。
下面重点分析一下HID的情况：
/*******************************************************************************
**
** Function BTA_HhEnable
**
** Description Enable the HID host. This function must be called before
** any other functions in the HID host API are called. When the
** enable operation is complete the callback function will be
** called with BTA_HH_ENABLE_EVT.
**
**
** Returns void
**
*******************************************************************************/
void BTA_HhEnable(tBTA_SEC sec_mask, tBTA_HH_CBACK *p_cback)
{
tBTA_HH_API_ENABLE *p_buf; /* register with BTA system manager */
bta_sys_register(BTA_ID_HH, &bta_hh_reg);
...
static const tBTA_SYS_REG bta_hh_reg =
{
bta_hh_hdl_event,
BTA_HhDisable
};
/*******************************************************************************
**
** Function BTA_HhDisable
**
** Description Disable the HID host. If the server is currently
** connected, the connection will be closed.
**
** Returns void
**
*******************************************************************************/
void BTA_HhDisable(void)
{
BT_HDR *p_buf; bta_sys_deregister(BTA_ID_HH);
if ((p_buf = (BT_HDR *)GKI_getbuf(sizeof(BT_HDR))) != NULL)
{
p_buf->event = BTA_HH_API_DISABLE_EVT;
bta_sys_sendmsg(p_buf);
}
}
这里注意一下，函数的注释，“如果当前的hid server是已经连接的，那么连接会被中断”，那我们可以想象，蓝牙都关闭了，和它连着的设备肯定也会断开的。
/*******************************************************************************
**
** Function bta_hh_hdl_event
**
** Description HID host main event handling function.
**
**
** Returns void
**
*******************************************************************************/
BOOLEAN bta_hh_hdl_event(BT_HDR *p_msg)
{
UINT8 index = BTA_HH_IDX_INVALID;
tBTA_HH_DEV_CB *p_cb = NULL; switch (p_msg->event)
{
case BTA_HH_API_ENABLE_EVT:
bta_hh_api_enable((tBTA_HH_DATA *) p_msg);
break; case BTA_HH_API_DISABLE_EVT:
bta_hh_api_disable();
break;
继续看bta_hh_api_disable：
/*******************************************************************************
**
** Function bta_hh_api_disable
**
** Description Perform necessary operations to disable HID host.
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_api_disable(void)
{
UINT8 xx; /* service is not enabled */
if (bta_hh_cb.p_cback == NULL)
return; /* no live connection, signal DISC_CMPL_EVT directly */
if (!bta_hh_cb.cnt_num)
{
bta_hh_disc_cmpl();
}
else /* otherwise, disconnect all live connections */ //如果有连接断开所有的连接
{
bta_hh_cb.w4_disable = TRUE; for(xx = ; xx < BTA_HH_MAX_DEVICE; xx ++)
{
/* send API_CLOSE event to every connected device */
if ( bta_hh_cb.kdev[xx].state == BTA_HH_CONN_ST )
{
/* disconnect all connected devices */
bta_hh_sm_execute(&bta_hh_cb.kdev[xx],
BTA_HH_API_CLOSE_EVT,
NULL);
}
}
} return;
}
这里分析的重点 就是bta_hh_sm_execute(&bta_hh_cb.kdev[xx],BTA_HH_API_CLOSE_EVT,NULL); 的流程
/*******************************************************************************
**
** Function bta_hh_sm_execute
**
** Description State machine event handling function for HID Host
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_sm_execute(tBTA_HH_DEV_CB *p_cb, UINT16 event, tBTA_HH_DATA * p_data)
{
tBTA_HH_ST_TBL state_table;
UINT8 action;
tBTA_HH cback_data;
tBTA_HH_EVT cback_event = ;
#if BTA_HH_DEBUG == TRUE
tBTA_HH_STATE in_state ;
UINT16 debug_event = event;
#endif memset(&cback_data, , sizeof(tBTA_HH));
...
else
{
if ((p_cb->state == BTA_HH_NULL_ST) || (p_cb->state >= BTA_HH_INVALID_ST))
{
APPL_TRACE_ERROR("bta_hh_sm_execute: Invalid state State = 0x%x, Event = %d",
p_cb->state,event);
return;
}
state_table = bta_hh_st_tbl[p_cb->state - ];
event &= 0xff;
p_cb->state = state_table[event][BTA_HH_NEXT_STATE] ; if ((action = state_table[event][BTA_HH_ACTION]) != BTA_HH_IGNORE)
{
(*bta_hh_action[action])(p_cb, p_data);
}
} return;
}
上面的函数涉及到状态机，看似复杂，其实就是根据当前状态找到状态转换表，根据这张表就可以知道下一步做什么动作，然后根据这个动作就可以找到相应的函数：
当前状态是已经连接状态：
const UINT8 bta_hh_st_connected[][BTA_HH_NUM_COLS] =
{
/* Event Action Next state */
/* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST },
/* BTA_HH_API_CLOSE_EVT */ {BTA_HH_API_DISC_ACT, BTA_HH_CONN_ST },
/* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_CONN_ST },
/* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_CLOSE_ACT, BTA_HH_IDLE_ST },
/* BTA_HH_INT_DATA_EVT */ {BTA_HH_DATA_ACT, BTA_HH_CONN_ST },
/* BTA_HH_INT_CTRL_DATA */ {BTA_HH_CTRL_DAT_ACT, BTA_HH_CONN_ST },
/* BTA_HH_INT_HANDSK_EVT */ {BTA_HH_HANDSK_ACT, BTA_HH_CONN_ST },
/* BTA_HH_SDP_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST },
/* BTA_HH_API_WRITE_DEV_EVT */ {BTA_HH_WRITE_DEV_ACT, BTA_HH_CONN_ST },
/* BTA_HH_API_GET_DSCP_EVT */ {BTA_HH_GET_DSCP_ACT, BTA_HH_CONN_ST },
/* BTA_HH_API_MAINT_DEV_EVT */ {BTA_HH_MAINT_DEV_ACT, BTA_HH_CONN_ST },
/* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST }
#if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
/* BTA_HH_GATT_CLOSE_EVT */ ,{BTA_HH_GATT_CLOSE, BTA_HH_IDLE_ST }
/* BTA_HH_GATT_OPEN_EVT */ ,{BTA_HH_IGNORE, BTA_HH_CONN_ST }
/* BTA_HH_START_ENC_EVT */ ,{BTA_HH_IGNORE, BTA_HH_CONN_ST }
/* BTA_HH_ENC_CMPL_EVT */ ,{BTA_HH_IGNORE, BTA_HH_CONN_ST }
/* READ_CHAR_CMPL_EVT */ ,{BTA_HH_LE_READ_CHAR, BTA_HH_CONN_ST }
/* WRITE_CHAR_CMPL_EVT*/ ,{BTA_HH_LE_WRITE, BTA_HH_CONN_ST }
/* READ_DESCR_CMPL_EVT */ ,{BTA_HH_LE_READ_DESCR, BTA_HH_CONN_ST } /* do not currently read any descr when connection up */
/* WRITE_DESCR_CMPL_EVT */ ,{BTA_HH_WRITE_DESCR, BTA_HH_CONN_ST } /* do not currently write any descr when connection up */
/* SCPP_UPDATE_EVT */ ,{BTA_HH_LE_UPDATE_SCPP, BTA_HH_CONN_ST }
/* BTA_HH_GATT_ENC_CMPL_EVT */ ,{BTA_HH_IGNORE, BTA_HH_CONN_ST }
#endif
}
根据这张表我们知道，下一个状态依然是已连接状态，下一个要执行的行为是BTA_HH_API_DISC_ACT，看这个行为对应的函数 ：
/*******************************************************************************
**
** Function bta_hh_api_disc_act
**
** Description HID Host initiate a disconnection.
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_api_disc_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
{
tBTA_HH_CBDATA disc_dat;
tHID_STATUS status; if (p_cb->is_le_device)
bta_hh_le_api_disc_only_act(p_cb);//这里le 没有active
else
{
/* found an active connection */
disc_dat.handle = p_data ?(UINT8)p_data->hdr.layer_specific :p_cb->hid_handle;
disc_dat.status = BTA_HH_ERR;
status = HID_HostCloseDev(disc_dat.handle);断开连接
if (status)
(* bta_hh_cb.p_cback)(BTA_HH_CLOSE_EVT, (tBTA_HH *)&disc_dat);//成功之后上报close事件
}
return;
}
这里看看HID_HostCloseDev的实现：
/*******************************************************************************
**
** Function HID_HostCloseDev
**
** Description This function disconnects the device.
**
** Returns void
**
*******************************************************************************/
tHID_STATUS HID_HostCloseDev( UINT8 dev_handle )
{
if( !hh_cb.reg_flag )
return (HID_ERR_NOT_REGISTERED); if( (dev_handle >= HID_HOST_MAX_DEVICES) || (!hh_cb.devices[dev_handle].in_use) )
return HID_ERR_INVALID_PARAM; hh_cb.devices[dev_handle].conn_tries = HID_HOST_MAX_CONN_RETRY+;
btu_stop_timer( &(hh_cb.devices[dev_handle].conn.timer_entry) ) ; if( hh_cb.devices[dev_handle].state != HID_DEV_CONNECTED )
return HID_ERR_NO_CONNECTION; hh_cb.devices[dev_handle].conn_tries = HID_HOST_MAX_CONN_RETRY+;
return hidh_conn_disconnect( dev_handle );//执行这里
}
/*******************************************************************************
**
** Function hidh_conn_disconnect
**
** Description This function disconnects a connection.
**
** Returns TRUE if disconnect started, FALSE if already disconnected
**
*******************************************************************************/
tHID_STATUS hidh_conn_disconnect (UINT8 dhandle)
{
tHID_CONN *p_hcon = &hh_cb.devices[dhandle].conn; if ((p_hcon->ctrl_cid != ) || (p_hcon->intr_cid != ))
{
p_hcon->conn_state = HID_CONN_STATE_DISCONNECTING; /* Set l2cap idle timeout to 0 (so ACL link is disconnected
* immediately after last channel is closed) */
L2CA_SetIdleTimeoutByBdAddr(hh_cb.devices[dhandle].addr, , BT_TRANSPORT_BR_EDR);
/* Disconnect both interrupt and control channels */
if (p_hcon->intr_cid)
L2CA_DisconnectReq (p_hcon->intr_cid);
else if (p_hcon->ctrl_cid)
L2CA_DisconnectReq (p_hcon->ctrl_cid);
}
else
{
p_hcon->conn_state = HID_CONN_STATE_UNUSED;
}
return (HID_SUCCESS);
}
我们可以看出主要执行的函数是hidh_conn_disconnect ，发现这个 hid host应该是有两个通道，一个中断通道，一个控制通道
这边结合btsnoop 看了一下发现，中断通道是用来传播数据的。控制通道是用来传输控制信令的。具体可能还要研究下hid profile
我们继续看，这里通过L2CA_SetIdleTimeoutByBdAddr设置了设备的idle timeout时间 为0，其实这个在一开始的disable 的函数的入口就已经设置过了。
从代码的逻辑可以看出，是优先释放中断通道，这个也好理解，因为中断通道是传输数据的。传输信令的通道肯定是后释放。下面看l2cap 层面channel的释放过程：
以下简述l2cap的释放过程，不感兴趣的可以直接略过。
这里已经走到了l2cap层：
/*******************************************************************************
**
** Function L2CA_DisconnectReq
**
** Description Higher layers call this function to disconnect a channel.
**
** Returns TRUE if disconnect sent, else FALSE
**
*******************************************************************************/
BOOLEAN L2CA_DisconnectReq (UINT16 cid)
{
tL2C_CCB *p_ccb;
counter_add("l2cap.disconn.req", );
/* Find the channel control block. We don't know the link it is on. */
if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
{
L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_disc_req, CID: %d", cid);
return (FALSE);
}
l2c_csm_execute (p_ccb, L2CEVT_L2CA_DISCONNECT_REQ, NULL);对于该channel 执行操作
return (TRUE);
}
这里会先根据cid 来找这个channel control block，然后 调用l2c_csm_execute 继续执行：
/*******************************************************************************
**
** Function l2c_csm_execute
**
** Description This function executes the state machine.
**
** Returns void
**
*******************************************************************************/
void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
switch (p_ccb->chnl_state)
{
case CST_CLOSED:
l2c_csm_closed (p_ccb, event, p_data);
break;
...
case CST_OPEN:
l2c_csm_open (p_ccb, event, p_data);//当前是open状态
break;
...
继续看l2c_csm_open：
static void l2c_csm_open (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
UINT16 local_cid = p_ccb->local_cid;
tL2CAP_CFG_INFO *p_cfg;
tL2C_CHNL_STATE tempstate;
UINT8 tempcfgdone;
UINT8 cfg_result;
...
switch (event)
{
...
case L2CEVT_L2CA_DISCONNECT_REQ: /* Upper wants to disconnect */
/* Make sure we are not in sniff mode */
{
tBTM_PM_PWR_MD settings;
memset((void*)&settings, , sizeof(settings));
settings.mode = BTM_PM_MD_ACTIVE;
BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p_ccb->p_lcb->remote_bd_addr, &settings);//HCI_Exit_Sniff_Mode } l2cu_send_peer_disc_req (p_ccb);//发送给对端设备
p_ccb->chnl_state = CST_W4_L2CAP_DISCONNECT_RSP;//设置当前状态
btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_L2CAP_CHNL, L2CAP_CHNL_DISCONNECT_TOUT);
break;
...
接下来就会收到对端设备对于断开channel 的回复，我们执行的函数还是
void l2c_csm_execute (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
switch (p_ccb->chnl_state)
{
case CST_CLOSED:
l2c_csm_closed (p_ccb, event, p_data);
break;
...
case CST_W4_L2CAP_DISCONNECT_RSP:
l2c_csm_w4_l2cap_disconnect_rsp (p_ccb, event, p_data);
break;
...
static void l2c_csm_w4_l2cap_disconnect_rsp (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
{
tL2CA_DISCONNECT_CFM_CB *disconnect_cfm = p_ccb->p_rcb->api.pL2CA_DisconnectCfm_Cb;
UINT16 local_cid = p_ccb->local_cid;
switch (event)
{
case L2CEVT_L2CAP_DISCONNECT_RSP: /* Peer disconnect response */
l2cu_release_ccb (p_ccb);
if (disconnect_cfm)
{
(*disconnect_cfm)(local_cid, L2CAP_DISC_OK);
}
break;
...
接收到对端的回复之后，可以直接调用l2cu_release_ccb (p_ccb);来释放掉channel 了，
我们看看具体的处理：
/*******************************************************************************
**
** Function l2cu_release_ccb
**
** Description This function releases a Channel Control Block. The timer
** is stopped, any attached buffers freed, and the CCB is removed
** from the link control block.
**
** Returns void
**
*******************************************************************************/
void l2cu_release_ccb (tL2C_CCB *p_ccb)
{
tL2C_LCB *p_lcb = p_ccb->p_lcb;
tL2C_RCB *p_rcb = p_ccb->p_rcb; if (p_rcb && (p_rcb->psm != p_rcb->real_psm))
{
btm_sec_clr_service_by_psm(p_rcb->psm);
}
if (p_ccb->should_free_rcb)
{
osi_free(p_rcb);
p_ccb->p_rcb = NULL;
p_ccb->should_free_rcb = false;
}
btm_sec_clr_temp_auth_service (p_lcb->remote_bd_addr); /* Stop the timer */
btu_stop_timer (&p_ccb->timer_entry); while (!GKI_queue_is_empty(&p_ccb->xmit_hold_q))
GKI_freebuf (GKI_dequeue (&p_ccb->xmit_hold_q)); l2c_fcr_cleanup (p_ccb); /* Channel may not be assigned to any LCB if it was just pre-reserved */
if ( (p_lcb) &&
( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID)
#if (L2CAP_UCD_INCLUDED == TRUE)
||(p_ccb->local_cid == L2CAP_CONNECTIONLESS_CID)
#endif
)
)
{
l2cu_dequeue_ccb (p_ccb);//通过ccb找到lcb里面的ccb队列，并移除
/* Delink the CCB from the LCB */
p_ccb->p_lcb = NULL;//ccb不再保存指向lcb的指针
} /* Put the CCB back on the free pool */
if (!l2cb.p_free_ccb_first)//把ccb放到l2cb.p_free_ccb_queue 队列
{
l2cb.p_free_ccb_first = p_ccb;
l2cb.p_free_ccb_last = p_ccb;
p_ccb->p_next_ccb = NULL;
p_ccb->p_prev_ccb = NULL;
}
else
{
p_ccb->p_next_ccb = NULL;
p_ccb->p_prev_ccb = l2cb.p_free_ccb_last;
l2cb.p_free_ccb_last->p_next_ccb = p_ccb;
l2cb.p_free_ccb_last = p_ccb;
}
/* Flag as not in use */
p_ccb->in_use = FALSE;
/* If no channels on the connection, start idle timeout */
if ((p_lcb) && p_lcb->in_use && (p_lcb->link_state == LST_CONNECTED))
{
if (!p_lcb->ccb_queue.p_first_ccb)//如果没有ccb 存在
{
l2cu_no_dynamic_ccbs (p_lcb);//这里主要是断开link
}
else
{
/* Link is still active, adjust channel quotas. */
l2c_link_adjust_chnl_allocation ();
}
}
}
做的事情主要就是从lcb里面移除ccb，如果link上面没有ccb存在了，那么断开link。简单看一下l2cu_no_dynamic_ccbs的实现：
/*******************************************************************************
**
** Function l2cu_no_dynamic_ccbs
**
** Description Handles the case when there are no more dynamic CCBs. If there
** are any fixed CCBs, start the longest of the fixed CCB timeouts,
** otherwise start the default link idle timeout or disconnect.
**
** Returns void
**
*******************************************************************************/
void l2cu_no_dynamic_ccbs (tL2C_LCB *p_lcb)
{
tBTM_STATUS rc;
UINT16 timeout = p_lcb->idle_timeout; #if (L2CAP_NUM_FIXED_CHNLS > 0)
int xx; for (xx = ; xx < L2CAP_NUM_FIXED_CHNLS; xx++)//在p_fixed_ccbs中找idletimeout最大的
{
if ( (p_lcb->p_fixed_ccbs[xx] != NULL) && (p_lcb->p_fixed_ccbs[xx]->fixed_chnl_idle_tout > timeout) )
timeout = p_lcb->p_fixed_ccbs[xx]->fixed_chnl_idle_tout;
}
#endif /* If the link is pairing, do not mess with the timeouts */
if (p_lcb->is_bonding)
return; if (timeout == )
{
rc = btm_sec_disconnect (p_lcb->handle, HCI_ERR_PEER_USER);//直接断开
if (rc == BTM_CMD_STARTED)
{
l2cu_process_fixed_disc_cback(p_lcb);
p_lcb->link_state = LST_DISCONNECTING;
timeout = L2CAP_LINK_DISCONNECT_TOUT;
}
else if (rc == BTM_SUCCESS)
{
l2cu_process_fixed_disc_cback(p_lcb);
/* BTM SEC will make sure that link is release (probably after pairing is done) */
p_lcb->link_state = LST_DISCONNECTING;
timeout = 0xFFFF;
}
else if ( (p_lcb->is_bonding)
&& (btsnd_hcic_disconnect (p_lcb->handle, HCI_ERR_PEER_USER)) )
{
l2cu_process_fixed_disc_cback(p_lcb);
p_lcb->link_state = LST_DISCONNECTING;
timeout = L2CAP_LINK_DISCONNECT_TOUT;
}
else
{
/* probably no buffer to send disconnect */
timeout = BT_1SEC_TIMEOUT;
}
}
if (timeout != 0xFFFF)
{
btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, timeout);
}
else
{
btu_stop_timer(&p_lcb->timer_entry);
}
}
这里我们还要回到l2c_csm_w4_l2cap_disconnect_rsp函数中，我们已经分析了：l2cu_release_ccb的流程
case L2CEVT_L2CAP_DISCONNECT_RSP: /* Peer disconnect response */
l2cu_release_ccb (p_ccb);
if (disconnect_cfm)
{
(*disconnect_cfm)(local_cid, L2CAP_DISC_OK);
}
break;
下面我们继续分析一下disconnect_cfm 的流程：
tL2CA_DISCONNECT_CFM_CB *disconnect_cfm = p_ccb->p_rcb->api.pL2CA_DisconnectCfm_Cb; 从该语句，我们可以猜想到这个函数是从l2cap的上层注册到l2cap的，那具体是在哪里注册的呢？
是在bta_hh_api_enable 里面一步一步注册的：
/*****************************************************************************
** Action Functions
*****************************************************************************/
/*******************************************************************************
**
** Function bta_hh_api_enable
**
** Description Perform necessary operations to enable HID host.
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_api_enable(tBTA_HH_DATA *p_data)
{
tBTA_HH_STATUS status = BTA_HH_ERR;
UINT8 xx; /* initialize BTE HID */
HID_HostInit(); memset(&bta_hh_cb, , sizeof(tBTA_HH_CB)); HID_HostSetSecurityLevel("", p_data->api_enable.sec_mask); /* Register with L2CAP */
if ( HID_HostRegister (bta_hh_cback) == HID_SUCCESS) //注册到l2cap
...
Register with L2CAP使用的是hidh_conn_reg,另外注意到这里还传入了一个参数,注册了一个hh_cb.callback = bta_hh_cback ; 后面上报事件的时候会调用到
/*******************************************************************************
**
** Function HID_HostRegister
**
** Description This function registers HID-Host with lower layers
**
** Returns tHID_STATUS
**
*******************************************************************************/
tHID_STATUS HID_HostRegister (tHID_HOST_DEV_CALLBACK *dev_cback)
{
tHID_STATUS st; if( hh_cb.reg_flag )
return HID_ERR_ALREADY_REGISTERED; if( dev_cback == NULL )
return HID_ERR_INVALID_PARAM; /* Register with L2CAP */
if( (st = hidh_conn_reg()) != HID_SUCCESS )
{
return st;
}
hh_cb.callback = dev_cback ;
hh_cb.reg_flag = TRUE;
return (HID_SUCCESS);
/*******************************************************************************
**
** Function hidh_l2cif_reg
**
** Description This function initializes the SDP unit.
**
** Returns void
**
*******************************************************************************/
tHID_STATUS hidh_conn_reg (void)
{
int xx; /* Initialize the L2CAP configuration. We only care about MTU and flush */
memset(&hh_cb.l2cap_cfg, , sizeof(tL2CAP_CFG_INFO)); hh_cb.l2cap_cfg.mtu_present = TRUE;
hh_cb.l2cap_cfg.mtu = HID_HOST_MTU;
hh_cb.l2cap_cfg.flush_to_present = TRUE;
hh_cb.l2cap_cfg.flush_to = HID_HOST_FLUSH_TO; /* Now, register with L2CAP */
if (!L2CA_Register (HID_PSM_CONTROL, (tL2CAP_APPL_INFO *) &hst_reg_info))
{
HIDH_TRACE_ERROR ("HID-Host Control Registration failed");
return (HID_ERR_L2CAP_FAILED) ;
}
if (!L2CA_Register (HID_PSM_INTERRUPT, (tL2CAP_APPL_INFO *) &hst_reg_info))
{
...
这里我们看到了L2CA_Register了，
/*******************************************************************************
**
** Function L2CA_Register
**
** Description Other layers call this function to register for L2CAP
** services.
**
** Returns PSM to use or zero if error. Typically, the PSM returned
** is the same as was passed in, but for an outgoing-only
** connection to a dynamic PSM, a "virtual" PSM is returned
** and should be used in the calls to L2CA_ConnectReq(),
** L2CA_ErtmConnectReq() and L2CA_Deregister()
**
*******************************************************************************/
UINT16 L2CA_Register (UINT16 psm, tL2CAP_APPL_INFO *p_cb_info)
{
tL2C_RCB *p_rcb;
UINT16 vpsm = psm; L2CAP_TRACE_API ("L2CAP - L2CA_Register() called for PSM: 0x%04x", psm); /* Verify that the required callback info has been filled in
** Note: Connection callbacks are required but not checked
** for here because it is possible to be only a client
** or only a server.
*/
if ((!p_cb_info->pL2CA_ConfigCfm_Cb)
|| (!p_cb_info->pL2CA_ConfigInd_Cb)
|| (!p_cb_info->pL2CA_DataInd_Cb)
|| (!p_cb_info->pL2CA_DisconnectInd_Cb))
{
L2CAP_TRACE_ERROR ("L2CAP - no cb registering PSM: 0x%04x", psm);
return ();
} /* Verify PSM is valid */
if (L2C_INVALID_PSM(psm))
{
L2CAP_TRACE_ERROR ("L2CAP - invalid PSM value, PSM: 0x%04x", psm);
return ();
} /* Check if this is a registration for an outgoing-only connection to */
/* a dynamic PSM. If so, allocate a "virtual" PSM for the app to use. */
if ( (psm >= 0x1001) && (p_cb_info->pL2CA_ConnectInd_Cb == NULL) )
{
for (vpsm = 0x1002; vpsm < 0x8000; vpsm += )
{
if ((p_rcb = l2cu_find_rcb_by_psm (vpsm)) == NULL)
break;
} L2CAP_TRACE_API ("L2CA_Register - Real PSM: 0x%04x Virtual PSM: 0x%04x", psm, vpsm);
} /* If registration block already there, just overwrite it */
if ((p_rcb = l2cu_find_rcb_by_psm (vpsm)) == NULL)
{
if ((p_rcb = l2cu_allocate_rcb (vpsm)) == NULL)
{
L2CAP_TRACE_WARNING ("L2CAP - no RCB available, PSM: 0x%04x vPSM: 0x%04x", psm, vpsm);
return ();
}
} p_rcb->api = *p_cb_info;
p_rcb->real_psm = psm; return (vpsm);
}
我们看看hst_reg_info这个结构：
static const tL2CAP_APPL_INFO hst_reg_info =
{
hidh_l2cif_connect_ind,
hidh_l2cif_connect_cfm,
NULL,
hidh_l2cif_config_ind,
hidh_l2cif_config_cfm,
hidh_l2cif_disconnect_ind,
hidh_l2cif_disconnect_cfm,
NULL,
hidh_l2cif_data_ind,
hidh_l2cif_cong_ind,
NULL /* tL2CA_TX_COMPLETE_CB */
}
现在我们知道disconnect_cfm = hidh_l2cif_disconnect_cfm
/*******************************************************************************
**
** Function hidh_l2cif_disconnect_cfm
**
** Description This function handles a disconnect confirm event from L2CAP.
**
** Returns void
**
*******************************************************************************/
static void hidh_l2cif_disconnect_cfm (UINT16 l2cap_cid, UINT16 result)
{
UINT8 dhandle;
tHID_CONN *p_hcon = NULL;
UNUSED(result); /* Find CCB based on CID */
if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
p_hcon = &hh_cb.devices[dhandle].conn; if (p_hcon == NULL)
{
HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP disc cfm, unknown CID: 0x%x", l2cap_cid);
return;
} if (l2cap_cid == p_hcon->ctrl_cid)
p_hcon->ctrl_cid = ;
else
{
p_hcon->intr_cid = ;
if (p_hcon->ctrl_cid)
{
L2CA_DisconnectReq (p_hcon->ctrl_cid);//控制通道没有断开，继续断开
}
} if ((p_hcon->ctrl_cid == ) && (p_hcon->intr_cid == ))
{
hh_cb.devices[dhandle].state = HID_DEV_NO_CONN;
p_hcon->conn_state = HID_CONN_STATE_UNUSED;
hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, p_hcon->disc_reason, NULL ) ;//调用回调上报事件
}
}
接下来的断开控制channel 和断开中断channel的流程是一样的。这里就不赘述了，通道都断开之后，link就会被断开。
link全部断开之后会调用hh_cb.callback向上汇报事情:这个回调函数就是bta_hh_cback,看看其做的事情:
/*****************************************************************************
** Static Function
*****************************************************************************/
/*******************************************************************************
**
** Function bta_hh_cback
**
** Description BTA HH callback function.
**
**
** Returns void
**
*******************************************************************************/
static void bta_hh_cback (UINT8 dev_handle, BD_ADDR addr, UINT8 event,
UINT32 data, BT_HDR *pdata)
{
tBTA_HH_CBACK_DATA *p_buf = NULL;
UINT16 sm_event = BTA_HH_INVALID_EVT;
UINT8 xx = ; #if BTA_HH_DEBUG
APPL_TRACE_DEBUG("bta_hh_cback::HID_event [%s]", bta_hh_hid_event_name(event));
#endif switch (event)
{
case HID_HDEV_EVT_OPEN:
sm_event = BTA_HH_INT_OPEN_EVT;
break;
case HID_HDEV_EVT_CLOSE:
sm_event = BTA_HH_INT_CLOSE_EVT;
break;
...
} if (sm_event != BTA_HH_INVALID_EVT &&
(p_buf = (tBTA_HH_CBACK_DATA *)GKI_getbuf(sizeof(tBTA_HH_CBACK_DATA) +
sizeof(BT_HDR))) != NULL)
{
p_buf->hdr.event = sm_event;
p_buf->hdr.layer_specific = (UINT16)dev_handle;
p_buf->data = data;
bdcpy(p_buf->addr, addr);
p_buf->p_data = pdata; bta_sys_sendmsg(p_buf);//发送事件到bt_work_queue
} }
从代码中可以看到这里发送的事件 是BTA_HH_INT_CLOSE_EVT:看看其处理:
HH的event 会交给bta_hh_hdl_event 来处理,然后根据事件类型路由到bta_hh_sm_execute,在这里处理的也很简单,都是一样的套路:
state_table = bta_hh_st_tbl[p_cb->state - ];//找到状态转换表
event &= 0xff;//取出子事件
p_cb->state = state_table[event][BTA_HH_NEXT_STATE] ;//设置下一个状态
if ((action = state_table[event][BTA_HH_ACTION]) != BTA_HH_IGNORE)
{
(*bta_hh_action[action])(p_cb, p_data);//执行action
}
现在处于已经连接状态:
const UINT8 bta_hh_st_connected[][BTA_HH_NUM_COLS] =
{
/* Event Action Next state */
/* BTA_HH_API_OPEN_EVT */ {BTA_HH_IGNORE, BTA_HH_CONN_ST },
/* BTA_HH_API_CLOSE_EVT */ {BTA_HH_API_DISC_ACT, BTA_HH_CONN_ST },
/* BTA_HH_INT_OPEN_EVT */ {BTA_HH_OPEN_ACT, BTA_HH_CONN_ST },
/* BTA_HH_INT_CLOSE_EVT */ {BTA_HH_CLOSE_ACT, BTA_HH_IDLE_ST },
/* BTA_HH_INT_DATA_EVT */ {BTA_HH_DATA_ACT, BTA_HH_CONN_ST },
我们发现下一个状态是BTA_HH_IDLE_ST ,当前要执行的操作是BTA_HH_CLOSE_ACT:对应的行为是bta_hh_close_act
/*******************************************************************************
**
** Function bta_hh_close_act
**
** Description HID Host process a close event
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_close_act (tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
{
tBTA_HH_CONN conn_dat ;
tBTA_HH_CBDATA disc_dat = {BTA_HH_OK, };
UINT32 reason = p_data->hid_cback.data; /* Reason for closing (32-bit) */
UINT16 event = p_cb->vp ? BTA_HH_VC_UNPLUG_EVT : BTA_HH_CLOSE_EVT; disc_dat.handle = p_cb->hid_handle;
disc_dat.status = p_data->hid_cback.data; /* Check reason for closing */
if ((reason & (HID_L2CAP_CONN_FAIL|HID_L2CAP_REQ_FAIL)) || /* Failure to initialize connection (page timeout or l2cap error) */
(reason == HID_ERR_AUTH_FAILED) || /* Authenication error (while initiating) */
(reason == HID_ERR_L2CAP_FAILED)) /* Failure creating l2cap connection */
{
...
}
/* otherwise report CLOSE/VC_UNPLUG event */
else
{
/* finaliza device driver */
bta_hh_co_close(p_cb->hid_handle, p_cb->app_id);//close
/* inform role manager */
bta_sys_conn_close( BTA_ID_HH ,p_cb->app_id, p_cb->addr);
/* update total conn number */
bta_hh_cb.cnt_num --; if (disc_dat.status)
disc_dat.status = BTA_HH_ERR; (*bta_hh_cb.p_cback)(event, (tBTA_HH *)&disc_dat);
...
} /* clean up control block, but retain SDP info and device handle */
p_cb->vp = FALSE;
p_cb->w4_evt = ; /* if no connection is active and HH disable is signaled, disable service */
if (bta_hh_cb.cnt_num == && bta_hh_cb.w4_disable)
{
bta_hh_disc_cmpl();
}
return;
}
上面的过程主要做了 bta_hh_co_close 和 bta_hh_cb.p_cback 以及bta_hh_disc_cmpl()
bta_hh_co_close 主要做的是close 通信的节点,以及一些和driver 有关的事情,和结束poll线程的行为btif_hh_close_poll_thread
bta_hh_cb.p_cback 这个是一个回调函数,从这个函数的名字上来看,应该是应用层传下来的callback,这边搜索了一下代码,是bte_hh_evt这个函数,他是在哪里注册的呢?
bt_status_t btif_hh_execute_service(BOOLEAN b_enable)
{
if (b_enable)
{
/* Enable and register with BTA-HH */
BTA_HhEnable(BTUI_HH_SECURITY, bte_hh_evt);
这个回调函数做的事情也就是 向上层汇报disable的事件：
/*******************************************************************************
**
** Function bte_hh_evt
**
** Description Switches context from BTE to BTIF for all HH events
**
** Returns void
**
*******************************************************************************/ static void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH *p_data)
{
bt_status_t status;
int param_len = ; if (BTA_HH_ENABLE_EVT == event)
param_len = sizeof(tBTA_HH_STATUS);
else if (BTA_HH_OPEN_EVT == event)
param_len = sizeof(tBTA_HH_CONN);
else if (BTA_HH_DISABLE_EVT == event)
param_len = sizeof(tBTA_HH_STATUS);
else if (BTA_HH_CLOSE_EVT == event)
param_len = sizeof(tBTA_HH_CBDATA);
else if (BTA_HH_GET_DSCP_EVT == event)
param_len = sizeof(tBTA_HH_DEV_DSCP_INFO);
else if ((BTA_HH_GET_PROTO_EVT == event) || (BTA_HH_GET_RPT_EVT == event)|| (BTA_HH_GET_IDLE_EVT == event))
param_len = sizeof(tBTA_HH_HSDATA);
else if ((BTA_HH_SET_PROTO_EVT == event) || (BTA_HH_SET_RPT_EVT == event) || (BTA_HH_VC_UNPLUG_EVT == event) || (BTA_HH_SET_IDLE_EVT == event))
param_len = sizeof(tBTA_HH_CBDATA);
else if ((BTA_HH_ADD_DEV_EVT == event) || (BTA_HH_RMV_DEV_EVT == event) )
param_len = sizeof(tBTA_HH_DEV_INFO);
else if (BTA_HH_API_ERR_EVT == event)
param_len = ;
/* switch context to btif task context (copy full union size for convenience) */
status = btif_transfer_context(btif_hh_upstreams_evt, (uint16_t)event, (void*)p_data, param_len, NULL);//通过btif_hh_upstreams_evt 上报 /* catch any failed context transfers */
ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
}
简单看下：
static void btif_hh_upstreams_evt(UINT16 event, char* p_param)
{
tBTA_HH *p_data = (tBTA_HH *)p_param;
btif_hh_device_t *p_dev = NULL;
int i;
int len, tmplen; switch (event)
{
...
case BTA_HH_CLOSE_EVT:
p_dev = btif_hh_find_connected_dev_by_handle(p_data->dev_status.handle);
if (p_dev != NULL) {
if(p_dev->vup_timer_active)
btif_hh_stop_vup_timer(&(p_dev->bd_addr));
if (p_dev->fd >= ) {
bta_hh_co_destroy(p_dev->fd);//销毁节点
p_dev->fd = -;
}
btif_hh_cb.status = BTIF_HH_DEV_DISCONNECTED;
p_dev->dev_status = BTHH_CONN_STATE_DISCONNECTED;
HAL_CBACK(bt_hh_callbacks, connection_state_cb,&(p_dev->bd_addr), p_dev->dev_status);继续向上汇报状态
}
...
这是定义在JNI层的函数com_android_bluetooth_hid.cpp；
static bthh_callbacks_t sBluetoothHidCallbacks = {
sizeof(sBluetoothHidCallbacks),
connection_state_callback,//会一直调用到java层
NULL,
get_protocol_mode_callback,
NULL,
get_report_callback,
virtual_unplug_callback,
handshake_callback
};
bta_hh_disc_cmpl()的 实现很简单：
/*******************************************************************************
**
** Function bta_hh_disc_cmpl
**
** Description All connections have been closed, disable service.
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_disc_cmpl(void)
{
tBTA_HH_STATUS status = BTA_HH_OK; /* Deregister with lower layer */
if (HID_HostDeregister() != HID_SUCCESS)
status = BTA_HH_ERR; #if (BTA_HH_LE_INCLUDED == TRUE)
bta_hh_le_deregister();
UNUSED(status);
#else
bta_hh_cleanup_disable(status);//会再次发送一个事件BTA_HH_DISABLE_EVT到btif_hh_upstreams_evt
#endif }
做的事情就是清空各种结构体：
case BTA_HH_DISABLE_EVT:
btif_hh_cb.status = BTIF_HH_DISABLED;
if (p_data->status == BTA_HH_OK) {
int i;
//Clear the control block
memset(&btif_hh_cb, , sizeof(btif_hh_cb));
for (i = ; i < BTIF_HH_MAX_HID; i++){
btif_hh_cb.devices[i].dev_status = BTHH_CONN_STATE_UNKNOWN;
}
}
到此，关于hid 设备的在蓝牙disable 过程中所走的流程就分析完了。
最后说一下 bta_dm_disable_conn_down_timer_cback 的执行时机，在disable 的初期，如果没有蓝牙link存在，那么会直接执行，如果有蓝牙link，那么会将所有的蓝牙link断开，然后去执行。
当蓝牙link 全部断开，会有断开完成事件上来，然后通过l2cu_release_lcb清除lcb，然后告诉BTM Acl management 这个link的已经被移除了（btm_acl_removed），接着通过btm_cb.p_bl_changed_cb = bta_dm_bl_change_cback 的回调,
/*******************************************************************************
**
** Function bta_dm_bl_change_cback
**
** Description Callback from btm when acl connection goes up or down
**
**
** Returns void
**
*******************************************************************************/
static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
{
tBTA_DM_ACL_CHANGE * p_msg; if ((p_msg = (tBTA_DM_ACL_CHANGE *) GKI_getbuf(sizeof(tBTA_DM_ACL_CHANGE))) != NULL)
{
p_msg->event = p_data->event;
p_msg->is_new = FALSE;//不是new switch(p_msg->event)
{
case BTM_BL_CONN_EVT:
p_msg->is_new = TRUE;
bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
#if BLE_INCLUDED == TRUE
p_msg->transport = p_data->conn.transport;
p_msg->handle = p_data->conn.handle;
#endif
break;
case BTM_BL_DISCN_EVT:
bdcpy(p_msg->bd_addr, p_data->discn.p_bda);
#if BLE_INCLUDED == TRUE
p_msg->transport = p_data->discn.transport;
p_msg->handle = p_data->discn.handle;
#endif
break;
case BTM_BL_UPDATE_EVT:
p_msg->busy_level = p_data->update.busy_level;
p_msg->busy_level_flags = p_data->update.busy_level_flags;
break;
...
} p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;//发送event
bta_sys_sendmsg(p_msg); } }
最终会处理两个事件BTM_BL_DISCN_EVT和BTM_BL_UPDATE_EVT，看该函数的注释也可以看出，它会在link 状态改变的时候被调用。最终会发送一个BTA_DM_ACL_CHANGE_EVT 到device manager
执行函数实现在bta_dm_act.c里面的bta_dm_acl_change ，
/*******************************************************************************
**
** Function bta_dm_acl_change
**
** Description Process BTA_DM_ACL_CHANGE_EVT
**
**
** Returns void
**
*******************************************************************************/
void bta_dm_acl_change(tBTA_DM_MSG *p_data)
{ UINT8 i;
UINT8 *p;
tBTA_DM_SEC conn;
BOOLEAN is_new = p_data->acl_change.is_new;
BD_ADDR_PTR p_bda = p_data->acl_change.bd_addr;
BOOLEAN need_policy_change = FALSE;
BOOLEAN issue_unpair_cb = FALSE; tBTA_DM_PEER_DEVICE *p_dev;
memset(&conn, , sizeof(tBTA_DM_SEC));
...
if(is_new)
{
...
} else {
for(i=; i<bta_dm_cb.device_list.count; i++)
{
if (bdcmp( bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_bda)
#if BLE_INCLUDED == TRUE
||bta_dm_cb.device_list.peer_device[i].transport != p_data->acl_change.transport
#endif
)
continue; if( bta_dm_cb.device_list.peer_device[i].conn_state == BTA_DM_UNPAIRING )//如果解配状态，那么开始解配相关的操作
{
if (BTM_SecDeleteDevice(bta_dm_cb.device_list.peer_device[i].peer_bdaddr)){
issue_unpair_cb = TRUE;
}
} conn.link_down.is_removed = bta_dm_cb.device_list.peer_device[i].remove_dev_pending; for(; i<bta_dm_cb.device_list.count ; i++)
{
memcpy(&bta_dm_cb.device_list.peer_device[i], &bta_dm_cb.device_list.peer_device[i+], sizeof(bta_dm_cb.device_list.peer_device[i]));
}
break;
}
if(bta_dm_cb.device_list.count)
bta_dm_cb.device_list.count--;
#if BLE_INCLUDED == TRUE
if ((p_data->acl_change.transport == BT_TRANSPORT_LE) &&
(bta_dm_cb.device_list.le_count))
bta_dm_cb.device_list.le_count--;
conn.link_down.link_type = p_data->acl_change.transport;
#endif if(bta_dm_search_cb.wait_disc && !bdcmp(bta_dm_search_cb.peer_bdaddr, p_bda))
{
bta_dm_search_cb.wait_disc = FALSE;
if(bta_dm_search_cb.sdp_results)
{
bta_sys_stop_timer(&bta_dm_search_cb.search_timer);
bta_dm_discover_next_device();
} }
if(bta_dm_cb.disabling)
{
if(!BTM_GetNumAclLinks())
{
bta_sys_stop_timer(&bta_dm_cb.disable_timer);
bta_dm_cb.disable_timer.p_cback = (TIMER_CBACK*)&bta_dm_disable_conn_down_timer_cback;//如果没有link，那么1s之后执行回调
/*
* Start a timer to make sure that the profiles
* get the disconnect event.
*/
bta_sys_start_timer(&bta_dm_cb.disable_timer, , );
}
}
if (conn.link_down.is_removed)
{
BTM_SecDeleteDevice(p_bda);
#if (BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE)
/* need to remove all pending background connection */
BTA_GATTC_CancelOpen(, p_bda, FALSE);
/* remove all cached GATT information */
BTA_GATTC_Refresh(p_bda);
#endif
} bdcpy(conn.link_down.bd_addr, p_bda);
conn.link_down.status = (UINT8) btm_get_acl_disc_reason_code();
if( bta_dm_cb.p_sec_cback )
{
bta_dm_cb.p_sec_cback(BTA_DM_LINK_DOWN_EVT, &conn);//向上层汇报状态
if( issue_unpair_cb )
bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &conn);
}
} bta_dm_adjust_roles(TRUE);
}
这里需要分析的点有处：
1.bta_dm_disable_conn_down_timer_cback
2.bta_dm_cb.p_sec_cback = bte_dm_evt（BTA_DM_LINK_DOWN_EVT, &conn） 的执行流程
首先看看.bta_dm_disable_conn_down_timer_cback 的执行
/*******************************************************************************
**
** Function bta_dm_disable_conn_down_timer_cback
**
** Description Sends disable event to application
**
**
** Returns void
**
*******************************************************************************/
static void bta_dm_disable_conn_down_timer_cback (TIMER_LIST_ENT *p_tle)
{
UNUSED(p_tle);
tBTA_SYS_HW_MSG *sys_enable_event; /* disable the power managment module */
bta_dm_disable_pm(); /* register our callback to SYS HW manager */
bta_sys_hw_register( BTA_SYS_HW_BLUETOOTH, bta_dm_sys_hw_cback );//注册callback /* send a message to BTA SYS */
if ((sys_enable_event = (tBTA_SYS_HW_MSG *) GKI_getbuf(sizeof(tBTA_SYS_HW_MSG))) != NULL)
{
sys_enable_event->hdr.event = BTA_SYS_API_DISABLE_EVT;//发送系统管理模块disable的事件
sys_enable_event->hw_module = BTA_SYS_HW_BLUETOOTH;
bta_sys_sendmsg(sys_enable_event);
} bta_dm_cb.disabling = FALSE; }
看看这个 disable event 在 系统管理模块中是怎么处理的：
BOOLEAN bta_sys_sm_execute(BT_HDR *p_msg)
{
BOOLEAN freebuf = TRUE;
tBTA_SYS_ST_TBL state_table;
UINT8 action;
int i; /* look up the state table for the current state */
state_table = bta_sys_st_tbl[bta_sys_cb.state];
/* update state */
bta_sys_cb.state = state_table[p_msg->event & 0x00ff][BTA_SYS_NEXT_STATE];
/* execute action functions */
for (i = ; i < BTA_SYS_ACTIONS; i++)
{
if ((action = state_table[p_msg->event & 0x00ff][i]) != BTA_SYS_IGNORE)
{
(*bta_sys_action[action])( (tBTA_SYS_HW_MSG*) p_msg);
}
else
{
break;
}
}
return freebuf; }
这里发现 下一个状态还是BTA_SYS_HW_ON ，执行的动作是BTA_SYS_HW_API_DISABLE，执行的函数是bta_sys_hw_api_disable ，这里发现它的先一个状态不少stopped，说明还有事件要交互，先看disable的动作：
/*******************************************************************************
**
** Function bta_sys_hw_disable
**
** Description if no other module is using the HW, this function will call ( if defined ) a user-macro to turn off the HW
**
**
** Returns success or failure
**
*******************************************************************************/
void bta_sys_hw_api_disable(tBTA_SYS_HW_MSG *p_sys_hw_msg)
{
/* make sure the related SW blocks were stopped */
bta_sys_disable( p_sys_hw_msg->hw_module );//再次确认已经关闭子模块 /* register which module we turn off */
bta_sys_cb.sys_hw_module_active &= ~((UINT32) << p_sys_hw_msg->hw_module );//清除标志 /* if there are still some SW modules using the HW, just provide an answer to the calling */
if( bta_sys_cb.sys_hw_module_active != )
{
/* if there are still some SW modules using the HW, directly notify the caller */
if( bta_sys_cb.sys_hw_cback[p_sys_hw_msg->hw_module ]!= NULL )
bta_sys_cb.sys_hw_cback[p_sys_hw_msg->hw_module ]( BTA_SYS_HW_OFF_EVT );
}
else
{
/* manually update the state of our system */
bta_sys_cb.state = BTA_SYS_HW_STOPPING;//设置状态 tBTA_SYS_HW_MSG *p_msg;
if ((p_msg = (tBTA_SYS_HW_MSG *) GKI_getbuf(sizeof(tBTA_SYS_HW_MSG))) != NULL)
{
p_msg->hdr.event = BTA_SYS_EVT_DISABLED_EVT;//继续发送disabled的消息
p_msg->hw_module = p_sys_hw_msg->hw_module;
bta_sys_sendmsg(p_msg);
}
} }
当前的状态已经是 bta_sys_cb.state = BTA_SYS_HW_STOPPING;，其状态转换图也不同：
const UINT8 bta_sys_hw_stopping[][BTA_SYS_NUM_COLS] =
{
/* Event Action 1 Action 2 Next State */
/* API_ENABLE */ {BTA_SYS_IGNORE, BTA_SYS_IGNORE, BTA_SYS_HW_STARTING}, /* change state, and wait for completion event to enable */
/* EVT_ENABLED */ {BTA_SYS_HW_EVT_ENABLED, BTA_SYS_IGNORE, BTA_SYS_HW_STOPPING}, /* successive enable/disable: finish the enable before disabling */
/* STACK_ENABLED */ {BTA_SYS_HW_EVT_STACK_ENABLED, BTA_SYS_HW_API_DISABLE, BTA_SYS_HW_STOPPING}, /* successive enable/disable: notify, then stop */
/* API_DISABLE */ {BTA_SYS_IGNORE, BTA_SYS_IGNORE, BTA_SYS_HW_STOPPING}, /* wait for completion event */
/* EVT_DISABLED */ {BTA_SYS_HW_EVT_DISABLED, BTA_SYS_IGNORE, BTA_SYS_HW_OFF},
/* EVT_ERROR */ {BTA_SYS_HW_API_DISABLE, BTA_SYS_IGNORE, BTA_SYS_HW_STOPPING}
};
可知下一个状态是BTA_SYS_HW_OFF，另外执行的action是BTA_SYS_HW_EVT_DISABLED，执行的函数 是
void bta_sys_hw_evt_disabled(tBTA_SYS_HW_MSG *p_sys_hw_msg)
{
UINT8 hw_module_index; for (hw_module_index = ; hw_module_index < BTA_SYS_MAX_HW_MODULES; hw_module_index++)
{
if (bta_sys_cb.sys_hw_cback[hw_module_index] != NULL)
bta_sys_cb.sys_hw_cback[hw_module_index] (BTA_SYS_HW_OFF_EVT);
}
}
这里执行之前注册到HW manager的函数 bta_sys_hw_register( BTA_SYS_HW_BLUETOOTH, bta_dm_sys_hw_cback )，看其实现：
/*******************************************************************************
**
** Function bta_dm_sys_hw_cback
**
** Description callback register to SYS to get HW status updates
**
**
** Returns void
**
*******************************************************************************/
static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
{
DEV_CLASS dev_class;
tBTA_DM_SEC_CBACK *temp_cback;
#if BLE_INCLUDED == TRUE
UINT8 key_mask = ;
BT_OCTET16 er;
tBTA_BLE_LOCAL_ID_KEYS id_key;
#endif
...
if( status == BTA_SYS_HW_OFF_EVT )
{
if( bta_dm_cb.p_sec_cback != NULL )
bta_dm_cb.p_sec_cback(BTA_DM_DISABLE_EVT, NULL);//继续向上层汇报事件 /* reinitialize the control block */
memset(&bta_dm_cb, , sizeof(bta_dm_cb)); /* unregister from SYS */
bta_sys_hw_unregister( BTA_SYS_HW_BLUETOOTH );
/* notify BTA DM is now unactive */
bta_dm_cb.is_bta_dm_active = FALSE;
}
...
这边主要分析bta_dm_cb.p_sec_cback 的两个事件 BTA_DM_LINK_DOWN_EVT和BTA_DM_DISABLE_EVT
static void btif_dm_upstreams_evt(UINT16 event, char* p_param)
{
tBTA_DM_SEC *p_data = (tBTA_DM_SEC*)p_param;
tBTA_SERVICE_MASK service_mask;
uint32_t i;
bt_bdaddr_t bd_addr; switch (event)
{
...
case BTA_DM_DISABLE_EVT:
/* for each of the enabled services in the mask, trigger the profile
* disable */
service_mask = btif_get_enabled_services_mask();
for (i=; i <= BTA_MAX_SERVICE_ID; i++)
{
if (service_mask &
(tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i)))
{
btif_in_execute_service_request(i, FALSE);//关闭没有关闭的服务
}
}
btif_disable_bluetooth_evt();//继续向上汇报状态
break;
...
case BTA_DM_BUSY_LEVEL_EVT:
{ if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK)
{
if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED)
{
HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
BT_DISCOVERY_STARTED);
btif_dm_inquiry_in_progress = TRUE;
}
else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED)
{
HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
BT_DISCOVERY_STOPPED);
btif_dm_inquiry_in_progress = FALSE;
}
else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE)
{
btif_dm_inquiry_in_progress = FALSE;
}
}
}break;
...
case BTA_DM_LINK_DOWN_EVT:
bdcpy(bd_addr.address, p_data->link_down.bd_addr);
btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
BTIF_TRACE_DEBUG("BTA_DM_LINK_DOWN_EVT. Sending BT_ACL_STATE_DISCONNECTED");
HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
&bd_addr, BT_ACL_STATE_DISCONNECTED);
break;
...
这里简单分析下btif_disable_bluetooth_evt：
/*******************************************************************************
**
** Function btif_disable_bluetooth_evt
**
** Description Event notifying BT disable is now complete.
** Terminates main stack tasks and notifies HAL
** user with updated BT state.
**
** Returns void
**
*******************************************************************************/ void btif_disable_bluetooth_evt(void)
{
#if (defined(HCILP_INCLUDED) && HCILP_INCLUDED == TRUE)
bte_main_enable_lpm(FALSE);
#endif #if (BLE_INCLUDED == TRUE)
BTA_VendorCleanup();
#endif
bte_main_disable();//关闭hci模块和btsnoop模块，关闭BTU，
/* callback to HAL */
future_ready(stack_manager_get_hack_future(), FUTURE_SUCCESS);//发送信号量
}
还记得在文章的开头event_shut_down_stack 里面会等待一个信号量，这里，这个信号量终于发出来了，那么event_shut_down_stack这个函数也得以继续执行：
static void event_shut_down_stack(UNUSED_ATTR void *context) {
...
hack_future = future_new();
stack_is_running = false;
btif_disable_bluetooth();//文章从这里分析
module_shut_down(get_module(BTIF_CONFIG_MODULE));
future_await(hack_future);//获得信号量继续执行
module_shut_down(get_module(CONTROLLER_MODULE)); // Doesn't do any work, just puts it in a restartable state
btif_thread_post(event_signal_stack_down, NULL);
}
static void event_signal_stack_down(UNUSED_ATTR void *context) {
HAL_CBACK(bt_hal_cbacks, adapter_state_changed_cb, BT_STATE_OFF);
}
最后的这个函数 就是往上层汇报BT_STATE_OFF的状态的。
关于蓝牙disable的流程就先分析到这里。
最后说一点，蓝牙关闭的流程还包括各个profile的关闭，这里只是介绍了协议栈对于各个模块的关闭流程。