inquiry流程一般持续有12s多，当inquiry完成的时候，设备端会上报一个Event: Inquiry Complete 上来，那协议栈是如何把这个事件上传到应用层的呢？本篇文章来分析一下其具体的流程。
void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg)
{
UINT8 *p = (UINT8 *)(p_msg + ) + p_msg->offset;
UINT8 hci_evt_code, hci_evt_len;
STREAM_TO_UINT8 (hci_evt_code, p);
STREAM_TO_UINT8 (hci_evt_len, p);
switch (hci_evt_code)
{
case HCI_INQUIRY_COMP_EVT:
btu_hcif_inquiry_comp_evt (p);
break;
...
看btu_hcif_inquiry_comp_evt 的实现：
static void btu_hcif_inquiry_comp_evt (UINT8 *p)
{
UINT8 status;
STREAM_TO_UINT8 (status, p);
/* Tell inquiry processing that we are done */
btm_process_inq_complete(status, BTM_BR_INQUIRY_MASK);
}
继续看btm_process_inq_complete 的实现：
其中：
#define BTM_BR_INQUIRY_MASK (BTM_GENERAL_INQUIRY | BTM_LIMITED_INQUIRY)
btm_process_inq_complete 其实现在btm_inq.c里面：
void btm_process_inq_complete (UINT8 status, UINT8 mode)
{
tBTM_CMPL_CB *p_inq_cb = btm_cb.btm_inq_vars.p_inq_cmpl_cb;//保存回调函数指针
tBTM_INQUIRY_VAR_ST *p_inq = &btm_cb.btm_inq_vars;
...
#if (!defined(BTA_HOST_INTERLEAVE_SEARCH) || BTA_HOST_INTERLEAVE_SEARCH == FALSE)
p_inq->inqparms.mode &= ~(mode);
#endif btm_acl_update_busy_level (BTM_BLI_INQ_DONE_EVT);//向上传递
/* Ignore any stray or late complete messages if the inquiry is not active */
if (p_inq->inq_active)
{
p_inq->inq_cmpl_info.status = (tBTM_STATUS)((status == HCI_SUCCESS) ? BTM_SUCCESS : BTM_ERR_PROCESSING); /* Notify caller that the inquiry has completed; (periodic inquiries do not send completion events */
if (!(p_inq->inq_active & BTM_PERIODIC_INQUIRY_ACTIVE) && p_inq->inqparms.mode == )//mode前面已经置0
{
#if BLE_INCLUDED == TRUE
btm_clear_all_pending_le_entry();//清除还没有活动scan response的设备消息
#endif
p_inq->state = BTM_INQ_INACTIVE_STATE;//设置inquiry的状态 /* Increment so the start of a next inquiry has a new count */
p_inq->inq_counter++；//增加搜索的计数 btm_clr_inq_result_flt(); if((p_inq->inq_cmpl_info.status == BTM_SUCCESS) &&
controller_get_interface()->supports_rssi_with_inquiry_results())
{
btm_sort_inq_result();//根据rssi排序
} /* Clear the results callback if set */
p_inq->p_inq_results_cb = (tBTM_INQ_RESULTS_CB *) NULL;
p_inq->inq_active = BTM_INQUIRY_INACTIVE;//设置0
p_inq->p_inq_cmpl_cb = (tBTM_CMPL_CB *) NULL; if (p_inq_cb)//执行回调函数，在bta_dm_search_start 进行注册bta_dm_inq_cmpl_cb
(p_inq_cb)((tBTM_INQUIRY_CMPL *) &p_inq->inq_cmpl_info);
}
}
if(p_inq->inqparms.mode == && p_inq->scan_type == INQ_GENERAL)//this inquiry is complete
{
p_inq->scan_type = INQ_NONE;//scan_type置0
#if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
/* check if the LE observe is pending */
if(p_inq->p_inq_ble_results_cb != NULL)//==NULL
{
BTM_TRACE_DEBUG("BTM Inq Compl: resuming a pending LE scan");
BTM_BleObserve(,, p_inq->p_inq_ble_results_cb, p_inq->p_inq_ble_cmpl_cb);
}
#endif
} }
这里主要分三部分：
- btm_acl_update_busy_level (BTM_BLI_INQ_DONE_EVT); 向上层汇报状态
- 清各种状态标志位
- (p_inq_cb)((tBTM_INQUIRY_CMPL *) &p_inq->inq_cmpl_info);
我们主要看一下第一部分和第三部分：
1.btm_acl_update_busy_level
其实现btm_acl.c：
void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
{
tBTM_BL_UPDATE_DATA evt;
UINT8 busy_level;
BTM_TRACE_DEBUG ("btm_acl_update_busy_level");
BOOLEAN old_inquiry_state = btm_cb.is_inquiry;
switch (event)
{
...
case BTM_BLI_INQ_DONE_EVT:
BTM_TRACE_DEBUG ("BTM_BLI_INQ_DONE_EVT");
btm_cb.is_inquiry = FALSE;
evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
break;
}
...
if ((busy_level != btm_cb.busy_level) ||(old_inquiry_state != btm_cb.is_inquiry))
{
evt.event = BTM_BL_UPDATE_EVT;
evt.busy_level = busy_level;
btm_cb.busy_level = busy_level;
if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK))
{
(*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
}
}
}
可以看出，主要做的事情是组建一个evt：
evt.event = BTM_BL_UPDATE_EVT;
evt.busy_level = busy_level;
evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
然后调用 (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
看看这个回调函数是在哪里注册的呢？
在btm_acl.c有个注册函数：
tBTM_STATUS BTM_RegBusyLevelNotif (tBTM_BL_CHANGE_CB *p_cb, UINT8 *p_level,
tBTM_BL_EVENT_MASK evt_mask)
{
...
btm_cb.bl_evt_mask = evt_mask;
...
btm_cb.p_bl_changed_cb = p_cb;//保存回调
return(BTM_SUCCESS);
}
发现该函数是在bta_dm_sys_hw_cback里面注册的：
BTM_RegBusyLevelNotif (bta_dm_bl_change_cback, NULL, BTM_BL_UPDATE_MASK|BTM_BL_ROLE_CHG_MASK);
我们发现这个回调函数就是bta_dm_bl_change_cback ，其实现在bta_dm_act.c中：
根据上面的分析，我们知道这次传入的event = BTM_BL_UPDATE_EVT;
static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
{
tBTA_DM_ACL_CHANGE * p_msg;
if ((p_msg = (tBTA_DM_ACL_CHANGE *) GKI_getbuf(sizeof(tBTA_DM_ACL_CHANGE))) != NULL)
{
p_msg->event = p_data->event;.//继承上面event
p_msg->is_new = FALSE;//is_new = false
switch(p_msg->event)
{
...
case BTM_BL_UPDATE_EVT:
p_msg->busy_level = p_data->update.busy_level;
p_msg->busy_level_flags = p_data->update.busy_level_flags;
break;
...
}
p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;
bta_sys_sendmsg(p_msg);
} }
观其实现，还是组建了一个 tBTA_DM_ACL_CHANGE 这样的事件，然后发送到btu 线程：
p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;
p_msg->event = p_data->event = BTM_BL_UPDATE_EVT;
p_msg->is_new = FALSE;
这边追踪一下代码，处理这个BTA_DM_ACL_CHANGE_EVT的函数是：
/*******************************************************************************
**
** Function bta_dm_acl_change
**
** Description Process BTA_DM_ACL_CHANGE_EVT
**
**
** Returns void
**
*******************************************************************************/
void bta_dm_acl_change(tBTA_DM_MSG *p_data)
{
UINT8 i;
UINT8 *p;
tBTA_DM_SEC conn;
BOOLEAN is_new = p_data->acl_change.is_new;
BD_ADDR_PTR p_bda = p_data->acl_change.bd_addr;
BOOLEAN need_policy_change = FALSE;
BOOLEAN issue_unpair_cb = FALSE; tBTA_DM_PEER_DEVICE *p_dev;
memset(&conn, , sizeof(tBTA_DM_SEC)); switch(p_data->acl_change.event)
{
case BTM_BL_UPDATE_EVT: /* busy level update */
if( bta_dm_cb.p_sec_cback )
{
conn.busy_level.level = p_data->acl_change.busy_level;
conn.busy_level.level_flags = p_data->acl_change.busy_level_flags;
bta_dm_cb.p_sec_cback(BTA_DM_BUSY_LEVEL_EVT, &conn);//回调到上层
}
return;
...
这边的核心代码还是组建事件往上层回调，:
conn.busy_level.level = p_data->acl_change.busy_level;
conn.busy_level.level_flags = p_data->acl_change.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
bta_dm_cb.p_sec_cback(BTA_DM_BUSY_LEVEL_EVT, &conn);
那我们现在看看bta_dm_cb.p_sec_cback 这个回调函数是在哪里注册的：
void bta_dm_enable(tBTA_DM_MSG *p_data){
...
/* first, register our callback to SYS HW manager */
bta_sys_hw_register( BTA_SYS_HW_BLUETOOTH, bta_dm_sys_hw_cback );
bta_dm_cb.p_sec_cback = p_data->enable.p_sec_cback;//注册回调
...
}
发现是在bta_dm_enable 里面注册的，也就是在tBTA_STATUS BTA_EnableBluetooth(tBTA_DM_SEC_CBACK *p_cback) 传入的回调函数：
void btif_init_ok(UNUSED_ATTR uint16_t event, UNUSED_ATTR char *p_param) {
BTIF_TRACE_DEBUG("btif_task: received trigger stack init event");
#if (BLE_INCLUDED == TRUE)
btif_dm_load_ble_local_keys();
#endif
BTA_EnableBluetooth(bte_dm_evt);//这里注册
}
那我们知道上面回调的内容如下：
conn.busy_level.level = p_data->acl_change.busy_level;
conn.busy_level.level_flags = p_data->acl_change.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
bte_dm_evt(BTA_DM_BUSY_LEVEL_EVT, &conn);
，下面继续分析bte_dm_evt：
void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC *p_data)
{
/* switch context to btif task context (copy full union size for convenience) */
bt_status_t status = btif_transfer_context(btif_dm_upstreams_evt, (uint16_t)event,
(void*)p_data, sizeof(tBTA_DM_SEC), btif_dm_data_copy); /* catch any failed context transfers */
ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
}
发现该函数就是一个中转，他把事件交与bt_jni_workqueue_thread 线程中的btif_dm_upstreams_evt 函数去执行了。event从btu task 转换到了bt_jni_workqueue_thread ，我们也能感受到，事件正在一层一层往上面走，
看看btif_dm_upstreams_evt 的实现，这里面肯定也是会去处理各种不同的event：我们这种case 要处理的event = BTA_DM_BUSY_LEVEL_EVT,
/*******************************************************************************
**
** Function btif_dm_upstreams_cback
**
** Description Executes UPSTREAMS events in btif context
**
** Returns void
**
*******************************************************************************/
static void btif_dm_upstreams_evt(UINT16 event, char* p_param)
{
tBTA_DM_SEC *p_data = (tBTA_DM_SEC*)p_param;
tBTA_SERVICE_MASK service_mask;
uint32_t i;
bt_bdaddr_t bd_addr;
switch (event)
{
case BTA_DM_BUSY_LEVEL_EVT:
{
if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK)
{
if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED)
{
HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
BT_DISCOVERY_STARTED);
btif_dm_inquiry_in_progress = TRUE;
}
else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED)
{
HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
BT_DISCOVERY_STOPPED);
btif_dm_inquiry_in_progress = FALSE;
}
else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE)
{
btif_dm_inquiry_in_progress = FALSE;//设置了这个值
}
}
}
从上面的代码分析，这里做的最重要的一件事就是：
btif_dm_inquiry_in_progress = FALSE;
第一部分的分析到此结束，下面开始看inquiry结束之后的回调函数：
3.(p_inq_cb)((tBTM_INQUIRY_CMPL *) &p_inq->inq_cmpl_info) = bta_dm_inq_cmpl_cb
这个回调函数的注册是在 进行搜索的时候：
void bta_dm_search_start (tBTA_DM_MSG *p_data){
...
result.status = BTM_StartInquiry( (tBTM_INQ_PARMS*)&p_data->search.inq_params,
bta_dm_inq_results_cb,
(tBTM_CMPL_CB*) bta_dm_inq_cmpl_cb);
...
}
我们看看bta_dm_inq_cmpl_cb的实现：
/*******************************************************************************
**
** Function bta_dm_inq_cmpl_cb
**
** Description Inquiry complete callback from BTM
**
** Returns void
**
*******************************************************************************/
static void bta_dm_inq_cmpl_cb (void * p_result)
{
tBTA_DM_MSG * p_msg;
if (bta_dm_search_cb.cancel_pending == FALSE)
{
p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG));
p_msg->inq_cmpl.hdr.event = BTA_DM_INQUIRY_CMPL_EVT;
p_msg->inq_cmpl.num = ((tBTM_INQUIRY_CMPL *)p_result)->num_resp;
bta_sys_sendmsg(p_msg);
}
这里发现是组建了一个msg，然后发送到btu 线程：
p_msg->inq_cmpl.hdr.event = BTA_DM_INQUIRY_CMPL_EVT;
p_msg->inq_cmpl.num = ((tBTM_INQUIRY_CMPL *)p_result)->num_resp;
BTA_DM_API_SEARCH_EVT = BTA_SYS_EVT_START(BTA_ID_DM_SEARCH),
BTA_DM_API_SEARCH_CANCEL_EVT,
BTA_DM_API_DISCOVER_EVT,
BTA_DM_INQUIRY_CMPL_EVT,//0x203
...
处理该event 是handler是：
static const tBTA_SYS_REG bta_dm_search_reg =
{
bta_dm_search_sm_execute,
bta_dm_search_sm_disable
};
bta_dm_search_sm_execute：
BOOLEAN bta_dm_search_sm_execute(BT_HDR *p_msg)
{
tBTA_DM_ST_TBL state_table;
UINT8 action;
int i;
/* look up the state table for the current state */
state_table = bta_dm_search_st_tbl[bta_dm_search_cb.state];
bta_dm_search_cb.state = state_table[p_msg->event & 0x00ff][BTA_DM_SEARCH_NEXT_STATE];
/* execute action functions */
for (i = ; i < BTA_DM_SEARCH_ACTIONS; i++)
{
if ((action = state_table[p_msg->event & 0x00ff][i]) != BTA_DM_SEARCH_IGNORE)
{
(*bta_dm_search_action[action])( (tBTA_DM_MSG*) p_msg);
}
}
return TRUE;
}
他的处理流程是先找到该状态的table，然后赋值下一个状态，然后根据event 在table中查找该事件应该执行的action，这些action 有函数和他们一一对应，执行这些函数就行。
我们当前的状态是bta_dm_search_search_active_st_table，需要执行的action = BTA_DM_INQUIRY_CMPL，下一个状态依然是BTA_DM_SEARCH_ACTIVE
我们看看BTA_DM_INQUIRY_CMPL 对应的函数是什么？
/* action function list */
const tBTA_DM_ACTION bta_dm_search_action[] =
{ bta_dm_search_start, /* 0 BTA_DM_API_SEARCH */
bta_dm_search_cancel, /* 1 BTA_DM_API_SEARCH_CANCEL */
bta_dm_discover, /* 2 BTA_DM_API_DISCOVER */
bta_dm_inq_cmpl, /* 3 BTA_DM_INQUIRY_CMPL */
bta_dm_rmt_name, /* 4 BTA_DM_REMT_NAME */
看看 回调函数的具体实现：
/*******************************************************************************
**
** Function bta_dm_inq_cmpl
**
** Description Process the inquiry complete event from BTM
**
** Returns void
**
*******************************************************************************/
void bta_dm_inq_cmpl (tBTA_DM_MSG *p_data)
{
tBTA_DM_MSG * p_msg;
tBTA_DM_SEARCH data; APPL_TRACE_DEBUG("bta_dm_inq_cmpl"); data.inq_cmpl.num_resps = p_data->inq_cmpl.num;
bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data);//执行回调，向上层通知 if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbFirst()) != NULL)//如果搜索到设备了，对设备做discover的动作
{
/* start name and service discovery from the first device on inquiry result */
bta_dm_search_cb.name_discover_done = FALSE;
bta_dm_search_cb.peer_name[] = ;
bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);
}
else //否则结束，向上层传 BTA_DM_SEARCH_CMPL_EVT;
{
/* no devices, search complete */
bta_dm_search_cb.services = ; if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
{
p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
bta_sys_sendmsg(p_msg);
}
}
}
这一部分的内容也可以分为三部分：
- bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data);
- 有搜索到设备，进行discovery
- 没有搜索到设备，上报BTA_DM_SEARCH_CMPL_EVT
首先来看看 第一部分：
3.1 bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data);
bta_dm_search_cb.p_search_cback 在BTA_DmSearch 中赋值的，为bte_search_devices_evt ，我们看看其实现：
/*******************************************************************************
**
** Function bte_search_devices_evt
**
** Description Switches context from BTE to BTIF for DM search events
**
** Returns void
**
*******************************************************************************/
static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
{
UINT16 param_len = ;
...
btif_transfer_context (btif_dm_search_devices_evt , (UINT16) event, (void *)p_data, param_len,
(param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
}
发现其直接被transfer 到btif线程 中执行btif_dm_search_devices_evt：
/******************************************************************************
**
** Function btif_dm_search_devices_evt
**
** Description Executes search devices callback events in btif context
**
** Returns void
**
******************************************************************************/
static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
{
tBTA_DM_SEARCH *p_search_data;
BTIF_TRACE_EVENT("%s event=%s", __FUNCTION__, dump_dm_search_event(event)); switch (event)
{
...
case BTA_DM_INQ_CMPL_EVT://并没有进一步去通知上层
{
#if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
tBTA_DM_BLE_PF_FILT_PARAMS adv_filt_param;
memset(&adv_filt_param, , sizeof(tBTA_DM_BLE_PF_FILT_PARAMS));
BTA_DmBleScanFilterSetup(BTA_DM_BLE_SCAN_COND_DELETE, , &adv_filt_param, NULL,
bte_scan_filt_param_cfg_evt, );
#endif
}
break;
case BTA_DM_DISC_CMPL_EVT:
{
HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED);//如果是BTA_DM_DISC_CMPL_EVT:会进一步通知上层
}
break;
这里发现，BTA_DM_INQ_CMPL_EVT:并不会一直往上面传，而 BTA_DM_DISC_CMPL_EVT:则是会上报给上层。那如果一直搜索不到设备就不会给上层答复吗？我们看看第三部分的行为。
3.2 有搜索到设备，进行discovery
再次贴上代码：
if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbFirst()) != NULL)
{
/* start name and service discovery from the first device on inquiry result */
bta_dm_search_cb.name_discover_done = FALSE;
bta_dm_search_cb.peer_name[] = ;
bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);
}
看代码的注释，是开始名字和service 的discovery 的工作。看看 这个函数的实现：
首先简述一下该函数的作用：
- 判断是否需要去获取对端设备的名字。不需要跳过，需要就去获取名字并返回，这里猜想服务方面的搜索肯定是在获取名字返回的函数里面进行。
- 判断是否需要进行服务的搜索，需要则 进行，从开始 的discovery的接口看，应该是不需要进行服务的搜索。
- 发出服务完成的event，发送到btu 线程。
下面看代码：
/*******************************************************************************
**
** Function bta_dm_discover_device
**
** Description Starts name and service discovery on the device
**
** Returns void
**
*******************************************************************************/
static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
{
tBTA_DM_MSG * p_msg;
tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
#if BLE_INCLUDED == TRUE
if (bta_dm_search_cb.transport == BTA_TRANSPORT_UNKNOWN)//一开始都是unkown，会BTM_ReadDevInfo来判断transport
{
tBT_DEVICE_TYPE dev_type;
tBLE_ADDR_TYPE addr_type; BTM_ReadDevInfo(remote_bd_addr, &dev_type, &addr_type);
if (dev_type == BT_DEVICE_TYPE_BLE || addr_type == BLE_ADDR_RANDOM)
transport = BT_TRANSPORT_LE;
} else {
transport = bta_dm_search_cb.transport;
}
#endif /* Reset transport state for next discovery */
bta_dm_search_cb.transport = BTA_TRANSPORT_UNKNOWN;//reset bdcpy(bta_dm_search_cb.peer_bdaddr, remote_bd_addr); if (bta_dm_search_cb.p_btm_inq_info)
{
APPL_TRACE_DEBUG("%s appl_knows_rem_name %d", __func__,
bta_dm_search_cb.p_btm_inq_info->appl_knows_rem_name);//显示app是否已经知道名字，这是inquiry db里面的数据
} if((bta_dm_search_cb.p_btm_inq_info)
&& (bta_dm_search_cb.p_btm_inq_info->results.device_type == BT_DEVICE_TYPE_BLE)
&& (bta_dm_search_cb.state == BTA_DM_SEARCH_ACTIVE))
{
/* Do not perform RNR for LE devices at inquiry complete*/
bta_dm_search_cb.name_discover_done = TRUE; //不要去查找LE 设备的名字
} /* if name discovery is not done and application needs remote name */
if ((!bta_dm_search_cb.name_discover_done)
&& (( bta_dm_search_cb.p_btm_inq_info == NULL )
||(bta_dm_search_cb.p_btm_inq_info && (!bta_dm_search_cb.p_btm_inq_info->appl_knows_rem_name))))//需要名字则进行名字的搜索
{
if (bta_dm_read_remote_device_name(bta_dm_search_cb.peer_bdaddr, transport) == TRUE)
return;//返回 /* starting name discovery failed */
bta_dm_search_cb.name_discover_done = TRUE;
}
/* if application wants to discover service */
if ( bta_dm_search_cb.services )//一般是0
{
/* initialize variables */
bta_dm_search_cb.service_index = ;
bta_dm_search_cb.services_found = ;
bta_dm_search_cb.services_to_search = bta_dm_search_cb.services;
#if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
bta_dm_search_cb.uuid_to_search = bta_dm_search_cb.num_uuid;
#endif
if ((bta_dm_search_cb.p_btm_inq_info != NULL) &&
bta_dm_search_cb.services != BTA_USER_SERVICE_MASK
&&(bta_dm_search_cb.sdp_search == FALSE))
{
/* check if EIR provides the information of supported services */
bta_dm_eir_search_services( &bta_dm_search_cb.p_btm_inq_info->results,
&bta_dm_search_cb.services_to_search,
&bta_dm_search_cb.services_found );
} /* if seaching with EIR is not completed */
if(bta_dm_search_cb.services_to_search)
{
/* check whether connection already exists to the device
if connection exists, we don't have to wait for ACL
link to go down to start search on next device */
if (BTM_IsAclConnectionUp(bta_dm_search_cb.peer_bdaddr, BT_TRANSPORT_BR_EDR))
bta_dm_search_cb.wait_disc = FALSE;
else
bta_dm_search_cb.wait_disc = TRUE; #if (BLE_INCLUDED == TRUE && (defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE))
if ( bta_dm_search_cb.p_btm_inq_info )
{
APPL_TRACE_DEBUG("%s p_btm_inq_info 0x%x results.device_type 0x%x services_to_search 0x%x",
__func__,
bta_dm_search_cb.p_btm_inq_info,
bta_dm_search_cb.p_btm_inq_info->results.device_type,
bta_dm_search_cb.services_to_search);
} if (transport == BT_TRANSPORT_LE)
{
if (bta_dm_search_cb.services_to_search & BTA_BLE_SERVICE_MASK)
{
//set the raw data buffer here
memset(g_disc_raw_data_buf, , sizeof(g_disc_raw_data_buf));
bta_dm_search_cb.p_ble_rawdata = g_disc_raw_data_buf; bta_dm_search_cb.ble_raw_size = MAX_DISC_RAW_DATA_BUF;
bta_dm_search_cb.ble_raw_used = ; /* start GATT for service discovery */
btm_dm_start_gatt_discovery(bta_dm_search_cb.peer_bdaddr);
return;
}
}
else
#endif
{
bta_dm_search_cb.sdp_results = FALSE;
bta_dm_find_services(bta_dm_search_cb.peer_bdaddr);
return;
}
}
} /* name discovery and service discovery are done for this device */
if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
{
p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;//发送event到btu 线程
/* initialize the data structure - includes p_raw_data and raw_data_size */
memset(&(p_msg->disc_result.result), , sizeof(tBTA_DM_DISC_RES));
p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
BCM_STRNCPY_S((char*)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
(char*)bta_dm_search_cb.peer_name, (BD_NAME_LEN-)); /* make sure the string is terminated */
p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN-] = ; bta_sys_sendmsg(p_msg);
}
}
服务方面 ok了之后是 会向btu 线程发送event:
p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
BTA_DM_DISCOVERY_RESULT_EVT = 0x207
执行的action = BTA_DM_SEARCH_RESULT，对应的函数是bta_dm_search_result，看看其具体的实现:
/*******************************************************************************
**
** Function bta_dm_search_result
**
** Description Service discovery result while searching for devices
**
** Returns void
**
*******************************************************************************/
void bta_dm_search_result (tBTA_DM_MSG *p_data)
{
/* call back if application wants name discovery or found services that application is searching */
if (( !bta_dm_search_cb.services )
||(( bta_dm_search_cb.services ) && ( p_data->disc_result.result.disc_res.services )))
{
bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);//回调
} /* if searching did not initiate to create link */
if(!bta_dm_search_cb.wait_disc )//如果没有pending
{
/* if service searching is done with EIR, don't search next device */
if( bta_dm_search_cb.p_btm_inq_info )
bta_dm_discover_next_device();//去搜索下一个设备的服务
}
else
{
/* wait until link is disconnected or timeout */
bta_dm_search_cb.sdp_results = TRUE;
bta_dm_search_cb.search_timer.p_cback = (TIMER_CBACK*)&bta_dm_search_timer_cback;
bta_sys_start_timer(&bta_dm_search_cb.search_timer, , *(L2CAP_LINK_INACTIVITY_TOUT+) );//如果pending了，那么设置定时器，并且在回调函数里面继续执行搜索下一个设备的服务
} }
这里简单分析两点：
- bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result)
- bta_dm_discover_next_device，如果有数据库里面还有设备的话，那么继续搜索服务，如果没有设备的话，向上面传：BTA_DM_SEARCH_CMPL_EVT，最终也会上报到java层。前面已经分析过。‘
分析一下bta_dm_search_cb.p_search_cback,我们又遇到这个函数了，其实是bte_search_devices_evt-->btif_dm_search_devices_evt:
/******************************************************************************
**
** Function btif_dm_search_devices_evt
**
** Description Executes search devices callback events in btif context
**
** Returns void
**
******************************************************************************/
static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
{
tBTA_DM_SEARCH *p_search_data;
switch (event)
{
case BTA_DM_DISC_RES_EVT:
{
p_search_data = (tBTA_DM_SEARCH *)p_param;
/* Remote name update */
if (strlen((const char *) p_search_data->disc_res.bd_name))//如果早先已经知道了名字，这里的名字的长度0
{
bt_property_t properties[];
bt_bdaddr_t bdaddr;
bt_status_t status; properties[].type = BT_PROPERTY_BDNAME;
properties[].val = p_search_data->disc_res.bd_name;
properties[].len = strlen((char *)p_search_data->disc_res.bd_name);
bdcpy(bdaddr.address, p_search_data->disc_res.bd_addr); status = btif_storage_set_remote_device_property(&bdaddr, &properties[]);
ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device property", status);
HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
status, &bdaddr, , properties);
}
现在简单看下：bta_dm_discover_next_device：
/*******************************************************************************
**
** Function bta_dm_discover_next_device
**
** Description Starts discovery on the next device in Inquiry data base
**
** Returns void
**
*******************************************************************************/
static void bta_dm_discover_next_device(void)
{ tBTA_DM_MSG * p_msg; /* searching next device on inquiry result */
if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbNext(bta_dm_search_cb.p_btm_inq_info)) != NULL)
{
bta_dm_search_cb.name_discover_done = FALSE;
bta_dm_search_cb.peer_name[] = ;
bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);//继续搜索服务
}
else
{
/* no devices, search complete */
bta_dm_search_cb.services = ; if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
{
p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;//都搜索我弄成之后上报event，结束discovery的流程
p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
bta_sys_sendmsg(p_msg);
}
}
}
服务搜索部分就介绍到这里。
3.3 没有搜索到设备或者搜索完成，上报BTA_DM_SEARCH_CMPL_EVT
再附上这段代码：
{
/* no devices, search complete */
bta_dm_search_cb.services = ;
if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
{
p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
bta_sys_sendmsg(p_msg);
}
这边还是组装了一个event：
p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
相应的log也就是：BTA got event 0x206
const tBTA_DM_ACTION bta_dm_search_action[] =
{ bta_dm_search_start, /* 0 BTA_DM_API_SEARCH */
bta_dm_search_cancel, /* 1 BTA_DM_API_SEARCH_CANCEL */
bta_dm_discover, /* 2 BTA_DM_API_DISCOVER */
bta_dm_inq_cmpl, /* 3 BTA_DM_INQUIRY_CMPL */
bta_dm_rmt_name, /* 4 BTA_DM_REMT_NAME */
bta_dm_sdp_result, /* 5 BTA_DM_SDP_RESULT */
bta_dm_search_cmpl, /* 6 BTA_DM_SEARCH_CMPL */
执行的就是bta_dm_search_cmpl：
/*******************************************************************************
**
** Function bta_dm_search_cmpl
**
** Description Sends event to application
**
** Returns void
**
*******************************************************************************/
void bta_dm_search_cmpl (tBTA_DM_MSG *p_data)
{
APPL_TRACE_EVENT("%s", __func__);
...
if (p_data->hdr.layer_specific == BTA_DM_API_DI_DISCOVER_EVT)
bta_dm_di_disc_cmpl(p_data);
else
bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, NULL);
#endif
}
函数如注释阐明的那样：Sends event to application
我们前面已经分析过bta_dm_search_cb.p_search_cback=bte_search_devices_evt ，这次传入的事件是BTA_DM_DISC_CMPL_EVT
bte_search_devices_evt --->继续进入到btif_dm_search_devices_evt:
/******************************************************************************
**
** Function btif_dm_search_devices_evt
**
** Description Executes search devices callback events in btif context
**
** Returns void
**
******************************************************************************/
static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
{
tBTA_DM_SEARCH *p_search_data;
BTIF_TRACE_EVENT("%s event=%s", __FUNCTION__, dump_dm_search_event(event)); switch (event)
{
...
case BTA_DM_DISC_CMPL_EVT:
{
HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED);
}
break;
...
这一段其实再第一部分已经分析过，当传入的事件是BTA_DM_DISC_CMPL_EVT，那么就会调用：HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED); 来通知上层 。
其实也就是说，即便一条设备信息也搜索不到，那么也会发送BTA_DM_SEARCH_CMPL_EVT---->BTA_DM_DISC_CMPL_EVT --->调用HAL_CBACK：BT_DISCOVERY_STOPPED 来通知上层。
到这里 inquiry complete的流程就已经分析完毕了。
总结：
Inquiry Complete
- update level busy，（btm_acl_update_busy_level）并不会上报到java层
- 执行bta_dm_inq_cmpl_cb
- bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data); 该函数不会通知上层，
- 有搜索到设备，进行discovery
- 没有搜索到设备，上报BTA_DM_SEARCH_CMPL_EVT ，并通知到上层。