当BLE设备已经完成配对，并且完成GATT服务的搜索，下一步就开始profile 的连接流程了，一般LE设备都是走的HOGP的流程，我们这篇文章就分析一下hogp的连接流程。
连接是从framework到JNI，再到协议栈，我们从JNI 分析流程吧。
在HID profile中，与framework 层对接的JNI 文件是com_android_bluetooth_hid.cpp，其调用的connct函数是connectHidNative：
static jboolean connectHidNative(JNIEnv *env, jobject object, jbyteArray address) {
bt_status_t status;
jbyte *addr;
jboolean ret = JNI_TRUE;
if (!sBluetoothHidInterface) return JNI_FALSE;
addr = env->GetByteArrayElements(address, NULL);
if (!addr) {
ALOGE("Bluetooth device address null");
return JNI_FALSE;
}
if ((status = sBluetoothHidInterface->connect((bt_bdaddr_t *) addr)) !=
BT_STATUS_SUCCESS) {//获取hid host的interface，然后调用connect的接口
ALOGE("Failed HID channel connection, status: %d", status);
ret = JNI_FALSE;
}
env->ReleaseByteArrayElements(address, addr, );
return ret;
}
我们看hid的interface：
static const bthh_interface_t bthhInterface = {
sizeof(bthhInterface),
init,
connect,
disconnect,
virtual_unplug,
set_info,
get_protocol,
set_protocol,
get_report,
set_report,
send_data,
cleanup,
}
直接看 connect：
/*******************************************************************************
**
** Function connect
**
** Description connect to hid device
**
** Returns bt_status_t
**
*******************************************************************************/
static bt_status_t connect( bt_bdaddr_t *bd_addr)
{
if(btif_hh_cb.status != BTIF_HH_DEV_CONNECTING)
{
btif_transfer_context(btif_hh_handle_evt, BTIF_HH_CONNECT_REQ_EVT,
(char*)bd_addr, sizeof(bt_bdaddr_t), NULL);//转移到btif task中去执行
return BT_STATUS_SUCCESS;
}
else
return BT_STATUS_BUSY;
}
/*******************************************************************************
**
** Function btif_hh_handle_evt
**
** Description Switches context for immediate callback
**
** Returns void
**
*******************************************************************************/ static void btif_hh_handle_evt(UINT16 event, char *p_param)
{
bt_bdaddr_t *bd_addr = (bt_bdaddr_t*)p_param;
BTIF_TRACE_EVENT("%s: event=%d", __FUNCTION__, event);
int ret;
switch(event)
{
case BTIF_HH_CONNECT_REQ_EVT:
{
ret = btif_hh_connect(bd_addr);//连接走到btif
if(ret == BT_STATUS_SUCCESS)
{
HAL_CBACK(bt_hh_callbacks, connection_state_cb,bd_addr,BTHH_CONN_STATE_CONNECTING);//向上汇报正在连接
}
else
HAL_CBACK(bt_hh_callbacks, connection_state_cb,bd_addr,BTHH_CONN_STATE_DISCONNECTED);
}
看看btif_hh的实现：
/*******************************************************************************
**
** Function btif_hh_connect
**
** Description connection initiated from the BTIF thread context
**
** Returns int status
**
*******************************************************************************/ bt_status_t btif_hh_connect(bt_bdaddr_t *bd_addr)
{
btif_hh_device_t *dev;
btif_hh_added_device_t *added_dev = NULL;
char bda_str[];
int i;
BD_ADDR *bda = (BD_ADDR*)bd_addr;
CHECK_BTHH_INIT();
dev = btif_hh_find_dev_by_bda(bd_addr);
BTIF_TRACE_DEBUG("Connect _hh");
sprintf(bda_str, "%02X:%02X:%02X:%02X:%02X:%02X",
(*bda)[], (*bda)[], (*bda)[], (*bda)[], (*bda)[], (*bda)[]);
... /* Not checking the NORMALLY_Connectible flags from sdp record, and anyways sending this
request from host, for subsequent user initiated connection. If the remote is not in
pagescan mode, we will do 2 retries to connect before giving up */
tBTA_SEC sec_mask = BTUI_HH_SECURITY;
btif_hh_cb.status = BTIF_HH_DEV_CONNECTING;
BTA_HhOpen(*bda, BTA_HH_PROTO_RPT_MODE, sec_mask); HAL_CBACK(bt_hh_callbacks, connection_state_cb, bd_addr, BTHH_CONN_STATE_CONNECTING);//这里再次汇报了连接的状态
return BT_STATUS_SUCCESS;
}
这里留一个问题：此刻调用btif_hh_find_dev_by_bda 有没有找到相应的记录？估计是没有，
那么这里的重点是 就是BTA_HhOpenle ,从 函数名字看，流程已经走到了BTA 层，继续看。
/*******************************************************************************
**
** Function BTA_HhOpen
**
** Description Connect to a device of specified BD address in specified
** protocol mode and security level.
**
** Returns void
**
*******************************************************************************/
void BTA_HhOpen(BD_ADDR dev_bda, tBTA_HH_PROTO_MODE mode, tBTA_SEC sec_mask)
{
tBTA_HH_API_CONN *p_buf; p_buf = (tBTA_HH_API_CONN *)GKI_getbuf((UINT16)sizeof(tBTA_HH_API_CONN)); if (p_buf!= NULL)
{
memset((void *)p_buf, , sizeof(tBTA_HH_API_CONN)); p_buf->hdr.event = BTA_HH_API_OPEN_EVT;
p_buf->hdr.layer_specific = BTA_HH_INVALID_HANDLE;
p_buf->sec_mask = sec_mask;
p_buf->mode = mode;
bdcpy(p_buf->bd_addr, dev_bda); bta_sys_sendmsg((void *)p_buf);
}
else
{
APPL_TRACE_ERROR("No resource to send HID host Connect request.");
}
}
想BTU发送了BTA_HH_API_OPEN_EVT 事件，从函数的注释看，虽然名字上面带有open，其实就是干connect的活，我们继续看：
/*******************************************************************************
**
** Function bta_hh_hdl_event
**
** Description HID host main event handling function.
**
**
** Returns void
**
*******************************************************************************/
BOOLEAN bta_hh_hdl_event(BT_HDR *p_msg)
{
UINT8 index = BTA_HH_IDX_INVALID;
tBTA_HH_DEV_CB *p_cb = NULL; switch (p_msg->event)
{
...
default:
/* all events processed in state machine need to find corresponding
CB before proceed */
if (p_msg->event == BTA_HH_API_OPEN_EVT)
{
index = bta_hh_find_cb(((tBTA_HH_API_CONN *)p_msg)->bd_addr);
}
...
if (index != BTA_HH_IDX_INVALID)
p_cb = &bta_hh_cb.kdev[index]; bta_hh_sm_execute(p_cb, p_msg->event, (tBTA_HH_DATA *) p_msg);//进入状态机
}
return (TRUE);
}
我们继续看状态机中如何处理：bluedroid中状态机的处理的流程都i一样，这里不做详细分析：
/*******************************************************************************
**
** Function bta_hh_sm_execute
**
** Description State machine event handling function for HID Host
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_sm_execute(tBTA_HH_DEV_CB *p_cb, UINT16 event, tBTA_HH_DATA * p_data)
{
tBTA_HH_ST_TBL state_table;
UINT8 action;
tBTA_HH cback_data;
tBTA_HH_EVT cback_event = ;
#if BTA_HH_DEBUG == TRUE
tBTA_HH_STATE in_state ;
UINT16 debug_event = event;
#endif memset(&cback_data, , sizeof(tBTA_HH));
...
else
{
state_table = bta_hh_st_tbl[p_cb->state - ]; event &= 0xff; p_cb->state = state_table[event][BTA_HH_NEXT_STATE] ; if ((action = state_table[event][BTA_HH_ACTION]) != BTA_HH_IGNORE)
{
(*bta_hh_action[action])(p_cb, p_data);
}
} return;
}
看看状态表：
/* BTA_HH_API_OPEN_EVT */ {BTA_HH_START_SDP, BTA_HH_W4_CONN_ST },
那么下一个状态是BTA_HH_W4_CONN_ST，当前执行的action 是BTA_HH_START_SDP ，我们从action 的名字上面可以看出，肯定是 做HID host相关的搜索的工作，这里执行的函数是bta_hh_start_sdp：
其实我们知道，BREDR的设备进行服务搜索走的是sdp的流程，但是BLE 一般走的是GATT的流程。
/*******************************************************************************
**
** Function bta_hh_start_sdp
**
** Description Start SDP service search, and obtain necessary SDP records.
** Only one SDP service search request is allowed at the same
** time. For every BTA_HhOpen API call, do SDP first unless SDP
** has been done previously.
**
** Returns void
**
*******************************************************************************/
void bta_hh_start_sdp(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
{
tBTA_HH_STATUS status = BTA_HH_ERR_SDP;
UINT8 hdl; p_cb->sec_mask = p_data->api_conn.sec_mask;
p_cb->mode = p_data->api_conn.mode;
bta_hh_cb.p_cur = p_cb; #if (BTA_HH_LE_INCLUDED == TRUE)
if (bta_hh_is_le_device(p_cb, p_data->api_conn.bd_addr))
{
bta_hh_le_open_conn(p_cb, p_data->api_conn.bd_addr);//le open
return;
}
#endif
...
这里判断是le 的设备，走le 的流程：
/*******************************************************************************
**
** Function bta_hh_le_open_conn
**
** Description open a GATT connection first.
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_open_conn(tBTA_HH_DEV_CB *p_cb, BD_ADDR remote_bda)
{
/* update cb_index[] map */
p_cb->hid_handle = BTA_HH_GET_LE_DEV_HDL(p_cb->index);
memcpy(p_cb->addr, remote_bda, BD_ADDR_LEN);
bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
p_cb->in_use = TRUE; BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, TRUE, BTA_GATT_TRANSPORT_LE);//open
}
这里又走到了BTA_GATTC_Open，我们在 这篇文章中分析过这个函数，这里需要注意的是 这里的bta_hh_cb.gatt_if 是 hogp 注册到GATT的 interface，这里打开也是打开 hogp的接口。
从之前的文章分析中得知，在配对之后也会进行BTA_GATTC_Open，只是那时打开的是 device manager注册到GATT的接口，并且在那个流程已经完成了对于GATT service的查询。这一次再次打开一个GATT 的接口，应该不会再进行服务的重新搜索，可能会对已经搜索到的服务进行读取工作。我们继续看：
void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport)
{
tBTA_GATTC_API_OPEN *p_buf; if ((p_buf = (tBTA_GATTC_API_OPEN *) GKI_getbuf(sizeof(tBTA_GATTC_API_OPEN))) != NULL)
{
p_buf->hdr.event = BTA_GATTC_API_OPEN_EVT; p_buf->client_if = client_if;
p_buf->is_direct = is_direct;
p_buf->transport = transport;
memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN); bta_sys_sendmsg(p_buf);
}
return;
}
发送事件到btu： BTA_GATTC_API_OPEN_EVT;
BOOLEAN bta_gattc_hdl_event(BT_HDR *p_msg)
{
tBTA_GATTC_CB *p_cb = &bta_gattc_cb;
tBTA_GATTC_CLCB *p_clcb = NULL;
tBTA_GATTC_RCB *p_clreg;
BOOLEAN rt = TRUE;
switch (p_msg->event)
{
case BTA_GATTC_API_OPEN_EVT:
bta_gattc_process_api_open(p_cb, (tBTA_GATTC_DATA *) p_msg);
break;
...
继续看：
/*******************************************************************************
**
** Function bta_gattc_process_api_open
**
** Description process connect API request.
**
** Returns void
**
*******************************************************************************/
void bta_gattc_process_api_open (tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA * p_msg)
{
UINT16 event = ((BT_HDR *)p_msg)->event;
tBTA_GATTC_CLCB *p_clcb = NULL;
tBTA_GATTC_RCB *p_clreg = bta_gattc_cl_get_regcb(p_msg->api_conn.client_if);//r is register
UNUSED(p_cb); if (p_clreg != NULL)
{
if (p_msg->api_conn.is_direct)
{
if ((p_clcb = bta_gattc_find_alloc_clcb(p_msg->api_conn.client_if,
p_msg->api_conn.remote_bda,
p_msg->api_conn.transport)) != NULL)//分配一个p_clcb
{
bta_gattc_sm_execute(p_clcb, event, p_msg);
}
... }
进入状态机，继续看：，状态处理的流程也和之前一样：
/*******************************************************************************
**
** Function bta_gattc_sm_execute
**
** Description State machine event handling function for GATTC
**
**
** Returns BOOLEAN : TRUE if queued client request buffer can be immediately released
** else FALSE
**
*******************************************************************************/
BOOLEAN bta_gattc_sm_execute(tBTA_GATTC_CLCB *p_clcb, UINT16 event, tBTA_GATTC_DATA *p_data)
{
tBTA_GATTC_ST_TBL state_table;
UINT8 action;
int i;
BOOLEAN rt = TRUE;
/* look up the state table for the current state */
state_table = bta_gattc_st_tbl[p_clcb->state]; event &= 0x00FF; /* set next state */
p_clcb->state = state_table[event][BTA_GATTC_NEXT_STATE]; /* execute action functions */
for (i = ; i < BTA_GATTC_ACTIONS; i++)
{
if ((action = state_table[event][i]) != BTA_GATTC_IGNORE)
{
(*bta_gattc_action[action])(p_clcb, p_data);
if (p_clcb->p_q_cmd == p_data) {
/* buffer is queued, don't free in the bta dispatcher.
* we free it ourselves when a completion event is received.
*/
rt = FALSE;
}
}
else
{
break;
}
} return rt;
}
刚开始的是idle 状态：
/* BTA_GATTC_API_OPEN_EVT */ {BTA_GATTC_OPEN, BTA_GATTC_W4_CONN_ST},
这里的状态是GATT client 的状态转换，文章开头也涉及到状态机，那个是BTA_HH的状态转换，两者不能搞错，这种情况应该是属于状态机嵌套。
我们继续分析GATT client 的状态转换，下一个状态是BTA_GATTC_W4_CONN_ST，执行的函数丨BTA_GATTC_OPEN-->
/*******************************************************************************
**
** Function bta_gattc_open
**
** Description Process API connection function.
**
** Returns void
**
*******************************************************************************/
void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
{
tBTA_GATTC_DATA gattc_data; /* open/hold a connection */
if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
TRUE, p_data->api_conn.transport))
{
...//错误处理
}
else
{
/* a connected remote device */
if (GATT_GetConnIdIfConnected(p_clcb->p_rcb->client_if,
p_data->api_conn.remote_bda,
&p_clcb->bta_conn_id,
p_data->api_conn.transport))
{
gattc_data.int_conn.hdr.layer_specific = p_clcb->bta_conn_id; bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, &gattc_data);//还是在状态机里面轮转
}
/* else wait for the callback event */
}
}
因为这个link 已经存在了，所以GATT_Connect 肯定是 直接返回了。那就是走到状态机发送新的事件：BTA_GATTC_INT_CONN_EVT，那我们继续看这个event 的处理：
/* BTA_GATTC_INT_CONN_EVT */ {BTA_GATTC_CONN, BTA_GATTC_CONN_ST},
下一个状态是 BTA_GATTC_CONN_ST，执行的action 是BTA_GATTC_CONN，我们继续看，
/*******************************************************************************
**
** Function bta_gattc_conn
**
** Description receive connection callback from stack
**
** Returns void
**
*******************************************************************************/
void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
{
tBTA_GATTC_IF gatt_if;
if (p_data != NULL)
{
p_clcb->bta_conn_id = p_data->int_conn.hdr.layer_specific; GATT_GetConnectionInfor(p_data->hdr.layer_specific,
&gatt_if, p_clcb->bda, &p_clcb->transport);
} p_clcb->p_srcb->connected = TRUE; if (p_clcb->p_srcb->mtu == )
p_clcb->p_srcb->mtu = GATT_DEF_BLE_MTU_SIZE; /* start database cache if needed */
if (p_clcb->p_srcb->p_srvc_cache == NULL ||
p_clcb->p_srcb->state != BTA_GATTC_SERV_IDLE)//第一次打开的时候会进行service的搜索，现在p_srvc_cache！=NULL，并且p_srcb->state == BTA_GATTC_SERV_IDLE
{
APPL_TRACE_DEBUG("bta_gattc_conn start database cache if needed libs_liu");
if (p_clcb->p_srcb->state == BTA_GATTC_SERV_IDLE)
{
p_clcb->p_srcb->state = BTA_GATTC_SERV_LOAD;
bta_gattc_sm_execute(p_clcb, BTA_GATTC_START_CACHE_EVT, NULL);
}
else /* cache is building */
p_clcb->state = BTA_GATTC_DISCOVER_ST;
} else
{
/* a pending service handle change indication */
if (p_clcb->p_srcb->srvc_hdl_chg)
{
p_clcb->p_srcb->srvc_hdl_chg = FALSE;
/* start discovery */
bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
}
} if (p_clcb->p_rcb)
{
...
bta_gattc_send_open_cback(p_clcb->p_rcb,
BTA_GATT_OK,
p_clcb->bda,
p_clcb->bta_conn_id,
p_clcb->transport,
p_clcb->p_srcb->mtu);直接上报状态
}
}
这里注意的是 。因为之前已经打开过了，已经走了gatt service的discovery的动作了，所以不会进行再次discovery了，直接来到上报状态的流程：
/*******************************************************************************
**
** Function bta_gattc_send_open_cback
**
** Description send open callback
**
** Returns
**
*******************************************************************************/
void bta_gattc_send_open_cback( tBTA_GATTC_RCB *p_clreg, tBTA_GATT_STATUS status,
BD_ADDR remote_bda, UINT16 conn_id,
tBTA_TRANSPORT transport, UINT16 mtu)
{
tBTA_GATTC cb_data; if (p_clreg->p_cback)
{
memset(&cb_data, , sizeof(tBTA_GATTC)); cb_data.open.status = status;
cb_data.open.client_if = p_clreg->client_if;
cb_data.open.conn_id = conn_id;
cb_data.open.mtu = mtu;
cb_data.open.transport = transport;
bdcpy(cb_data.open.remote_bda, remote_bda); (*p_clreg->p_cback)(BTA_GATTC_OPEN_EVT, &cb_data);//这里是注册的回调
}
}
这个函数很简单，就是上报 BTA_GATTC_OPEN_EVT的状态，这里有时候会忘记这个回调是在在哪里注册的，其实很简单，看看上报的event 的名字是BTA_GATTC 打头的，那肯定是BTA_GATTC_AppRegister中注册的。
那注册的回调函数是什么呢？注册的时候是在bta_hh_le_enable，注册是”BTA HH OVER LE“，
/*******************************************************************************
**
** Function bta_hh_le_enable
**
** Description initialize LE HID related functionality
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_le_enable(void)
{
char app_name[LEN_UUID_128 + ];
tBT_UUID app_uuid = {LEN_UUID_128,{}};
UINT8 xx; bta_hh_cb.gatt_if = BTA_GATTS_INVALID_IF; for (xx = ; xx < BTA_HH_MAX_DEVICE; xx ++)
bta_hh_cb.le_cb_index[xx] = BTA_HH_IDX_INVALID; memset (app_name, , LEN_UUID_128 + );
strncpy(app_name, "BTA HH OVER LE", LEN_UUID_128); memcpy((void *)app_uuid.uu.uuid128, (void *)app_name, LEN_UUID_128); BTA_GATTC_AppRegister(&app_uuid, bta_hh_gattc_callback); return;
}
那我们知道，其实这个回调就是bta_hh_gattc_callback，它是”GATT client callback function used in BTA HH“，我们看看其处理的event有：
BTA_GATTC_REG_EVT、BTA_GATTC_DEREG_EVT、BTA_GATTC_OPEN_EVT、BTA_GATTC_READ_CHAR_EVT、BTA_GATTC_WRITE_DESCR_EVT、BTA_GATTC_WRITE_CHAR_EVT、BTA_GATTC_CLOSE_EVT、BTA_GATTC_SEARCH_CMPL_EVT、BTA_GATTC_SEARCH_RES_EVT、BTA_GATTC_NOTIF_EVT、BTA_GATTC_ENC_CMPL_CB_EVT、BTA_GATTC_CFG_MTU_EVT
从上面处理的事件来看，其回调几乎处理了hogp 相关的所有的事件，包括读写各种属性，搜索完成，以及搜索结果，以及LE设备的消息通知，都是从这里来处理，可见其是GATT流程中的重要一环。
我们继续分析BTA_GATTC_OPEN_EVT 的处理：
/*******************************************************************************
**
** Function bta_hh_gattc_callback
**
** Description This is GATT client callback function used in BTA HH.
**
** Parameters:
**
*******************************************************************************/
static void bta_hh_gattc_callback(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
{
tBTA_HH_DEV_CB *p_dev_cb;
UINT16 evt; if (p_data == NULL)
return; switch (event)
{
...
case BTA_GATTC_OPEN_EVT: /* 2 */
p_dev_cb = bta_hh_le_find_dev_cb_by_bda(p_data->open.remote_bda);
if (p_dev_cb) {
bta_hh_sm_execute(p_dev_cb, BTA_HH_GATT_OPEN_EVT, (tBTA_HH_DATA *)&p_data->open);//这里我们发现跳到HH相关的状态机
}
break;
这个 事件是关联模块是BTA_ID_HH ，这里又转回了文章开始的时候的状态机
#define BTA_ID_HH 23 /* Human Interface Device Host */
看看 bta_hh_sm_execute的处理，当前的状态是BTA_HH_W4_CONN_ST ，
/* BTA_HH_GATT_OPEN_EVT */ ,{BTA_HH_GATT_OPEN, BTA_HH_W4_CONN_ST }
下一个状态还是BTA_HH_W4_CONN_ST ，执行的action 是BTA_HH_GATT_OPEN，我们看看其实现：
/*******************************************************************************
**
** Function bta_hh_gatt_open
**
** Description process GATT open event.
**
** Parameters:
**
*******************************************************************************/
void bta_hh_gatt_open(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_buf)
{
tBTA_GATTC_OPEN *p_data = &p_buf->le_open;
UINT8 *p2;
tHID_STATUS status = BTA_HH_ERR; /* if received invalid callback data , ignore it */
if (p_cb == NULL || p_data == NULL)
return; p2 = p_data->remote_bda; if (p_data->status == BTA_GATT_OK)
{
p_cb->is_le_device = TRUE;
p_cb->in_use = TRUE;
p_cb->conn_id = p_data->conn_id;
p_cb->hid_handle = BTA_HH_GET_LE_DEV_HDL(p_cb->index); bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
bta_hh_sm_execute(p_cb, BTA_HH_START_ENC_EVT, NULL);//开始进行encryption相关动作 }
else /* open failure */
{
bta_hh_sm_execute(p_cb, BTA_HH_SDP_CMPL_EVT, (tBTA_HH_DATA *)&status);
} }
我们继续看：
/* BTA_HH_START_ENC_EVT */ ,{BTA_HH_START_SEC, BTA_HH_W4_SEC }
下一个状态是 BTA_HH_W4_SEC，执行的操作是BTA_HH_START_SEC，我们继续看：
/*******************************************************************************
**
** Function bta_hh_start_security
**
** Description start the security check of the established connection
**
** Parameters:
**
*******************************************************************************/
void bta_hh_start_security(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_buf)
{
UINT8 sec_flag=;
tBTM_SEC_DEV_REC *p_dev_rec;
UNUSED(p_buf); p_dev_rec = btm_find_dev(p_cb->addr);
...
/* verify bond */
BTM_GetSecurityFlagsByTransport(p_cb->addr, &sec_flag, BT_TRANSPORT_LE);//获取设备的sec flag /* if link has been encrypted */
if (sec_flag & BTM_SEC_FLAG_ENCRYPTED)
{
bta_hh_sm_execute(p_cb, BTA_HH_ENC_CMPL_EVT, NULL);//继续状态机
}
/* if bonded and link not encrypted */
else if (sec_flag & BTM_SEC_FLAG_LKEY_KNOWN)
{
...
/* otherwise let it go through */
else
{
bta_hh_sm_execute(p_cb, BTA_HH_ENC_CMPL_EVT, NULL);
} }
我们继续分析状态机流程：
/* BTA_HH_ENC_CMPL_EVT */ {BTA_HH_SEC_CMPL, BTA_HH_W4_CONN_ST },
新状态变成了BTA_HH_W4_CONN_ST，执行的action是BTA_HH_SEC_CMPL，我们看看bta_hh_security_cmpl 的具体实现：
/*******************************************************************************
**
** Function bta_hh_security_cmpl
**
** Description Security check completed, start the service discovery
** if no cache available, otherwise report connection open completed
**
** Parameters:
**
*******************************************************************************/
void bta_hh_security_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_buf)
{
tBTA_HH_RPT_CACHE_ENTRY *p_rpt_cache;
UINT8 num_rpt = ;
UNUSED(p_buf); if (p_cb->status == BTA_HH_OK)
{
if (!p_cb->hid_srvc[BTA_HH_LE_SRVC_DEF].in_use)
{
/* start loading the cache if not in stack */
if ((p_rpt_cache = bta_hh_le_co_cache_load(p_cb->addr, &num_rpt, p_cb->app_id)) != NULL)
{
bta_hh_process_cache_rpt(p_cb, p_rpt_cache, num_rpt);
}
}
/* discovery has been done for HID service */
if (p_cb->app_id != && p_cb->hid_srvc[BTA_HH_LE_SRVC_DEF].in_use)
{
/* configure protocol mode */
if (bta_hh_le_set_protocol_mode(p_cb, p_cb->mode) == FALSE)
{
APPL_TRACE_ERROR("bta_hh_security_cmpl");
bta_hh_le_open_cmpl(p_cb);
}
}
/* start primary service discovery for HID service */
else
{
bta_hh_le_pri_service_discovery(p_cb);//继续进行hid service的discovery
}
}
else
{
...
}
}
下面进行的hid service 的搜索，也就是 hogp的范畴了：bta_hh_le_pri_service_discovery：
/*******************************************************************************
**
** Function bta_hh_le_pri_service_discovery
**
** Description Initialize GATT discovery on the remote LE HID device by opening
** a GATT connection first.
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_pri_service_discovery(tBTA_HH_DEV_CB *p_cb)
{
tBT_UUID pri_srvc; bta_hh_le_co_reset_rpt_cache(p_cb->addr, p_cb->app_id); p_cb->disc_active |= (BTA_HH_LE_DISC_HIDS|BTA_HH_LE_DISC_DIS);//这里是标志位，标志要搜索两个服务，当两个服务搜索完成，会调用bta_hh_le_open_cmpl 来上报状态 /* read DIS info */
if (!DIS_ReadDISInfo(p_cb->addr, bta_hh_le_dis_cback, DIS_ATTR_PNP_ID_BIT))//注意第三个参数，读的是PID、VID
{
APPL_TRACE_ERROR("read DIS failed");
p_cb->disc_active &= ~BTA_HH_LE_DISC_DIS;
} /* in parallel */
/* start primary service discovery for HID service */
pri_srvc.len = LEN_UUID_16;
pri_srvc.uu.uuid16 = UUID_SERVCLASS_LE_HID;
BTA_GATTC_ServiceSearchRequest(p_cb->conn_id, &pri_srvc);//开始HID 的service的搜索
return;
}
这里分为两个部分：
- DIS信息的搜索DIS_ReadDISInfo
- HID service 的信息的搜索。BTA_GATTC_ServiceSearchRequest
我们先看 DIS 的信息的搜索：
/*******************************************************************************
**
** Function DIS_ReadDISInfo
**
** Description Read remote device DIS information.
**
** Returns void
**
*******************************************************************************/
BOOLEAN DIS_ReadDISInfo(BD_ADDR peer_bda, tDIS_READ_CBACK *p_cback, tDIS_ATTR_MASK mask)
{
UINT16 conn_id; /* Initialize the DIS client if it hasn't been initialized already. */
srvc_eng_init();//对DIS client 进行初始化，并注册了srvc_eng_cb.gatt_if 到GATT
...
dis_cb.p_read_dis_cback = p_cback;//保存callback = bta_hh_le_dis_cback
/* Mark currently active operation */
dis_cb.dis_read_uuid_idx = ; dis_cb.request_mask = mask; GATT_GetConnIdIfConnected(srvc_eng_cb.gatt_if, peer_bda, &conn_id, BT_TRANSPORT_LE); /* need to enhance it as multiple service is needed */
srvc_eng_request_channel(peer_bda, SRVC_ID_DIS);
...
return dis_gatt_c_read_dis_req(conn_id);//读PID VID }
我们继续看：
/*******************************************************************************
**
** Function dis_gatt_c_read_dis_req
**
** Description Read remote device DIS attribute request.
**
** Returns void
**
*******************************************************************************/
BOOLEAN dis_gatt_c_read_dis_req(UINT16 conn_id)
{
tGATT_READ_PARAM param;
memset(¶m, , sizeof(tGATT_READ_PARAM));
param.service.uuid.len = LEN_UUID_16;
param.service.s_handle = ;
param.service.e_handle = 0xFFFF;
param.service.auth_req = ;
while (dis_cb.dis_read_uuid_idx < DIS_MAX_CHAR_NUM)
{
if (dis_uuid_to_attr(dis_attr_uuid[dis_cb.dis_read_uuid_idx]) &
dis_cb.request_mask)//根据mask 来读相关的属性
{
param.service.uuid.uu.uuid16 = dis_attr_uuid[dis_cb.dis_read_uuid_idx]; if (GATTC_Read(conn_id, GATT_READ_BY_TYPE, ¶m) == GATT_SUCCESS)//开始读
return TRUE; GATT_TRACE_ERROR ("Read DISInfo: 0x%04x GATT_Read Failed", param.service.uuid.uu.uuid16);
} dis_cb.dis_read_uuid_idx++;
} dis_gatt_c_read_dis_value_cmpl(conn_id); return(FALSE);
}
读写成功就直接返回true。
这里简单看一下，对于DIS 结果的处理：
gatt_process_read_by_type_rsp -->(p_clcb->operation == GATTC_OPTYPE_READ && p_clcb->op_subtype == GATT_READ_BY_TYPE)-->gatt_end_operation(p_clcb, GATT_SUCCESS, (void *)p);--->(*p_cmpl_cb)(conn_id, op, status, &cb_data);(这里需要注意，因为注册这个eng的时候，没有注册discovery result或者discovery complete等接口，所以调用的是p_cmpl_cb，实际调用的函数就是srvc_eng_c_cmpl_cback)，--->srvc_eng_c_cmpl_cback-->srvc_eng_c_cmpl_act[0]--->dis_c_cmpl_cback:
/*******************************************************************************
**
** Function dis_c_cmpl_cback
**
** Description Client operation complete callback.
**
** Returns void
**
*******************************************************************************/
void dis_c_cmpl_cback (tSRVC_CLCB *p_clcb, tGATTC_OPTYPE op,
tGATT_STATUS status, tGATT_CL_COMPLETE *p_data)
{
UINT16 read_type = dis_attr_uuid[dis_cb.dis_read_uuid_idx];
UINT8 *pp = NULL, *p_str;
UINT16 conn_id = p_clcb->conn_id;
...
case GATT_UUID_PNP_ID:
if (p_data->att_value.len == DIS_PNP_ID_SIZE)//保存pid vid
{
p_clcb->dis_value.attr_mask |= DIS_ATTR_PNP_ID_BIT;
STREAM_TO_UINT8 (p_clcb->dis_value.pnp_id.vendor_id_src, pp);
STREAM_TO_UINT16 (p_clcb->dis_value.pnp_id.vendor_id, pp);
STREAM_TO_UINT16 (p_clcb->dis_value.pnp_id.product_id, pp);
STREAM_TO_UINT16 (p_clcb->dis_value.pnp_id.product_version, pp);
}
break;
...
dis_cb.dis_read_uuid_idx ++; dis_gatt_c_read_dis_req(conn_id);//继续搜索
继续搜索的结果是 根据mask来判定的。如果当初mask只设定一个值，那么就会直接调用discovery 完成事件：
/*******************************************************************************
**
** Function dis_gatt_c_read_dis_value_cmpl
**
** Description Client read DIS database complete callback.
**
** Returns void
**
*******************************************************************************/
static void dis_gatt_c_read_dis_value_cmpl(UINT16 conn_id)
{
tSRVC_CLCB *p_clcb = srvc_eng_find_clcb_by_conn_id(conn_id); dis_cb.dis_read_uuid_idx = 0xff; srvc_eng_release_channel(conn_id); if (dis_cb.p_read_dis_cback && p_clcb)//调用进行搜索的时候（DIS_ReadDISInfo）注册的函数bta_hh_le_dis_cback
{
LOG_INFO("%s conn_id:%d attr_mask = 0x%04x", __func__, conn_id,
p_clcb->dis_value.attr_mask); (*dis_cb.p_read_dis_cback)(p_clcb->bda, &p_clcb->dis_value);
dis_cb.p_read_dis_cback = NULL;
}
}
下面我们 看看 第二点：
HID service 的信息的搜索。BTA_GATTC_ServiceSearchRequest
/*******************************************************************************
**
** Function BTA_GATTC_ServiceSearchRequest
**
** Description This function is called to request a GATT service discovery
** on a GATT server. This function report service search result
** by a callback event, and followed by a service search complete
** event.
**
** Parameters conn_id: connection ID.
** p_srvc_uuid: a UUID of the service application is interested in.
** If Null, discover for all services.
**
** Returns None
**
*******************************************************************************/
void BTA_GATTC_ServiceSearchRequest (UINT16 conn_id, tBT_UUID *p_srvc_uuid)
{
tBTA_GATTC_API_SEARCH *p_buf;
UINT16 len = sizeof(tBTA_GATTC_API_SEARCH) + sizeof(tBT_UUID); if ((p_buf = (tBTA_GATTC_API_SEARCH *) GKI_getbuf(len)) != NULL)
{
memset(p_buf, , len); p_buf->hdr.event = BTA_GATTC_API_SEARCH_EVT;//gatt search
p_buf->hdr.layer_specific = conn_id; if (p_srvc_uuid)
{
p_buf->p_srvc_uuid = (tBT_UUID *)(p_buf + );
memcpy(p_buf->p_srvc_uuid, p_srvc_uuid, sizeof(tBT_UUID));
}
else
p_buf->p_srvc_uuid = NULL; bta_sys_sendmsg(p_buf);
}
return;
}
我们继续看，上面的流程就是触发”GATT service discovery“ ，那这里又进入了熟悉的状态机轮转，当前的状态机的状态是已经连接的状态：
BOOLEAN bta_gattc_sm_execute(tBTA_GATTC_CLCB *p_clcb, UINT16 event, tBTA_GATTC_DATA *p_data)
{
tBTA_GATTC_ST_TBL state_table;
UINT8 action;
int i;
BOOLEAN rt = TRUE; /* look up the state table for the current state */
state_table = bta_gattc_st_tbl[p_clcb->state]; event &= 0x00FF; /* set next state */
p_clcb->state = state_table[event][BTA_GATTC_NEXT_STATE]; /* execute action functions */
for (i = ; i < BTA_GATTC_ACTIONS; i++)
{
if ((action = state_table[event][i]) != BTA_GATTC_IGNORE)
{
(*bta_gattc_action[action])(p_clcb, p_data);
if (p_clcb->p_q_cmd == p_data) {
/* buffer is queued, don't free in the bta dispatcher.
* we free it ourselves when a completion event is received.
*/
rt = FALSE;
}
}
else
{
break;
}
} return rt;
}
/* BTA_GATTC_API_SEARCH_EVT */ {BTA_GATTC_SEARCH, BTA_GATTC_CONN_ST},
下一个状态 还是BTA_GATTC_CONN_ST ，执行的action 是BTA_GATTC_SEARCH：
/*******************************************************************************
**
** Function bta_gattc_search
**
** Description start a search in the local server cache
**
** Returns None.
**
*******************************************************************************/
void bta_gattc_search(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
{
tBTA_GATT_STATUS status = GATT_INTERNAL_ERROR;
tBTA_GATTC cb_data;
APPL_TRACE_DEBUG("bta_gattc_search conn_id=%d",p_clcb->bta_conn_id);//注意这里的p_clcb是hogp 注册到GATT的接口
if (p_clcb->p_srcb && p_clcb->p_srcb->p_srvc_cache)
{
status = BTA_GATT_OK;
/* search the local cache of a server device */
bta_gattc_search_service(p_clcb, p_data->api_search.p_srvc_uuid);//这里的uuid = UUID_SERVCLASS_LE_HID 0x1812
}
cb_data.search_cmpl.status = status;
cb_data.search_cmpl.conn_id = p_clcb->bta_conn_id; /* end of search or no server cache available */
( *p_clcb->p_rcb->p_cback)(BTA_GATTC_SEARCH_CMPL_EVT, &cb_data);
}//bta_hh_gattc_callback
search 这个接口，他实现的思想是先 搜索cache 里面有没有相关的服务，如果cache 存在，那么就会 调用回调（再GATT register注册的）进行上报，这里 是已经了cache，直接load，load完成之后还会通过BTA_GATTC_SEARCH_RES_EVT把结果（p_dev_cb->hid_srvc[idx].in_use = TRUE）保存在p_dev_cb。 我们直接看看 下面的回调函数的处理：
/*******************************************************************************
**
** Function bta_hh_gattc_callback
**
** Description This is GATT client callback function used in BTA HH.
**
** Parameters:
**
*******************************************************************************/
static void bta_hh_gattc_callback(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
{
tBTA_HH_DEV_CB *p_dev_cb;
UINT16 evt;
...
case BTA_GATTC_SEARCH_CMPL_EVT: /* 6 */
bta_hh_le_srvc_search_cmpl(&p_data->search_cmpl);
break;
...
继续看bta_hh_le_srvc_search_cmpl：
/*******************************************************************************
**
** Function bta_hh_le_srvc_search_cmpl
**
** Description This function process the GATT service search complete.
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_srvc_search_cmpl(tBTA_GATTC_SEARCH_CMPL *p_data)
{
tBTA_HH_DEV_CB *p_dev_cb = bta_hh_le_find_dev_cb_by_conn_id(p_data->conn_id);
...
if(p_data->status != BTA_GATT_OK || p_dev_cb->total_srvc == )
{
...
}
/* GATT service discovery sucessfully finished */
else
{
if (p_dev_cb->disc_active & BTA_HH_LE_DISC_SCPS)//active = 1+2 = DIS+HID
{
p_dev_cb->disc_active &= ~BTA_HH_LE_DISC_SCPS;
bta_hh_le_open_cmpl(p_dev_cb);
}
else /* discover HID service */
{
p_dev_cb->cur_srvc_index = ;
bta_hh_le_srvc_expl_srvc(p_dev_cb);
}
}
}
现在开始 真正的HID services 的搜索，这里因为已经load 了相关的LE 的pri service，所以接下来的搜索应该是直接对handle 进行搜索，我们继续看bta_hh_le_srvc_expl_srvc的实现：
/*******************************************************************************
**
** Function bta_hh_le_srvc_expl_srvc
**
** Description This function discover the next avaible HID service.
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_srvc_expl_srvc(tBTA_HH_DEV_CB *p_dev_cb)
{
if (p_dev_cb->cur_srvc_index < BTA_HH_LE_HID_SRVC_MAX &&
p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].in_use)
{
if (!p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].expl_incl_srvc)
/* explore included service first */
bta_hh_le_search_hid_included(p_dev_cb);//先进行include的搜索
else
{
/* explore characterisc */
p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].cur_expl_char_idx = ;
bta_hh_le_search_hid_chars(p_dev_cb);
}
}
else /* all service discvery finished */
{
bta_hh_le_gatt_disc_cmpl(p_dev_cb, p_dev_cb->status);
}
}
最先进行的是include的服务的搜索，然后应该是 chars，这里发现，这个include 的搜索 就是搜索cache 里面是不是有相应的项目，分析代码发现，搜索的是电池服务UUID_SERVCLASS_BATTERY， 不管有没有搜索到，都会设置p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].expl_incl_srvc 为true，然后继续调用bta_hh_le_srvc_expl_srvc进行搜索，那么接下来就是explore characterisc 的流程了bta_hh_le_search_hid_chars：
/*******************************************************************************
**
** Function bta_hh_le_search_hid_chars
**
** Description This function discover all characteristics a service and
** all descriptors available.
**
** Parameters:
**
*******************************************************************************/
static void bta_hh_le_search_hid_chars(tBTA_HH_DEV_CB *p_dev_cb)
{
tBT_UUID char_cond;
tBTA_GATTC_CHAR_ID char_result;
tBTA_GATT_CHAR_PROP prop;
BOOLEAN next = TRUE;
UINT16 char_uuid = ;
tBTA_GATT_SRVC_ID srvc_id; if (p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].cur_expl_char_idx == BTA_HH_LE_DISC_CHAR_NUM ||
(p_dev_cb->status != BTA_HH_OK && p_dev_cb->status != BTA_HH_ERR_PROTO))
{
p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].cur_expl_char_idx = ;
/* explore next service */
p_dev_cb->cur_srvc_index ++;
bta_hh_le_srvc_expl_srvc(p_dev_cb);//搜索完成，继续调用此函数，进入到
return;
} p_dev_cb->hid_srvc[ p_dev_cb->cur_srvc_index].cur_expl_char_idx ++;
char_uuid = bta_hh_le_disc_char_uuid[p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].cur_expl_char_idx - ];//总共有8个chars 等待搜索 char_cond.len = LEN_UUID_16;
char_cond.uu.uuid16 = char_uuid; bta_hh_le_fill_16bits_srvc_id(TRUE, p_dev_cb->cur_srvc_index, UUID_SERVCLASS_LE_HID, &srvc_id); if (BTA_GATTC_GetFirstChar( p_dev_cb->conn_id,
&srvc_id,
&char_cond,
&char_result,
&prop) == BTA_GATT_OK)//查找 相应的UUID
{
switch (char_uuid)
{
case GATT_UUID_HID_CONTROL_POINT:
p_dev_cb->hid_srvc[char_result.srvc_id.id.inst_id].option_char |= BTA_HH_LE_CP_BIT;
next = TRUE;
break;
case GATT_UUID_HID_INFORMATION:
case GATT_UUID_HID_REPORT_MAP:
/* read the char value */
BTA_GATTC_ReadCharacteristic(p_dev_cb->conn_id,
&char_result,
BTA_GATT_AUTH_REQ_NONE);//对于相应的uuid 进行搜索，并且涉及到uuid2handle的转换
next = FALSE;
break; case GATT_UUID_HID_PROTO_MODE:
p_dev_cb->hid_srvc[char_result.srvc_id.id.inst_id].option_char |= BTA_HH_LE_PROTO_MODE_BIT;
next = !bta_hh_le_set_protocol_mode(p_dev_cb, p_dev_cb->mode);
break; case GATT_UUID_HID_REPORT:
#ifdef BLUETOOTH_RTK_BQB
if(cert_conf_mask&BLUETOOTH_RTK_BQB_PATCH_HOGP)
{
APPL_TRACE_ERROR("BQB:this is seen in hogp bqb test");
BTA_GATTC_ReadCharacteristic(p_dev_cb->conn_id,
&char_result,
BTA_GATT_AUTH_REQ_NONE);
memcpy(&(p_dev_cb->bqb_report_char_result), &char_result, sizeof(tBTA_GATTC_CHAR_ID));
memcpy(&(p_dev_cb->bqb_report_char_cond), &char_cond, sizeof(tBT_UUID));
p_dev_cb->bqb_report_prop = prop;
}
else
#endif
bta_hh_le_expl_rpt(p_dev_cb, &char_result, &char_cond, prop);
next = FALSE;
break; /* found boot mode report types */
case GATT_UUID_HID_BT_KB_OUTPUT:
case GATT_UUID_HID_BT_MOUSE_INPUT:
case GATT_UUID_HID_BT_KB_INPUT:
bta_hh_le_expl_boot_rpt(p_dev_cb, char_uuid, prop);
break;
}
}
else
{
if (char_uuid == GATT_UUID_HID_PROTO_MODE)
next = !bta_hh_le_set_protocol_mode(p_dev_cb, p_dev_cb->mode); } if (next == TRUE)
{
bta_hh_le_search_hid_chars(p_dev_cb);
}
}
从上面我们发现对于不同的UUID，往往有不同的函数去处理，当所有的char 都被搜索完成了以后，就又会执行bta_hh_le_srvc_expl_srvc 来结束这个流程。
这里先看下 我们上面搜索的有哪些UUID：
static const UINT16 bta_hh_le_disc_char_uuid[BTA_HH_LE_DISC_CHAR_NUM] =
{
GATT_UUID_HID_INFORMATION,
GATT_UUID_HID_REPORT_MAP,
GATT_UUID_HID_CONTROL_POINT,
GATT_UUID_HID_REPORT,
GATT_UUID_HID_BT_KB_INPUT,
GATT_UUID_HID_BT_KB_OUTPUT,
GATT_UUID_HID_BT_MOUSE_INPUT,
GATT_UUID_HID_PROTO_MODE /* always make sure this is the last attribute to discover */
}
我们再次看一下bta_hh_le_srvc_expl_srvc：
void bta_hh_le_srvc_expl_srvc(tBTA_HH_DEV_CB *p_dev_cb)
{
#if BTA_HH_DEBUG == TRUE
APPL_TRACE_DEBUG("bta_hh_le_srvc_expl_srvc cur_srvc_index = %d in_use = %d",
p_dev_cb->cur_srvc_index,
p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].in_use);
#endif if (p_dev_cb->cur_srvc_index < BTA_HH_LE_HID_SRVC_MAX &&
p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].in_use)//
{
if (!p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].expl_incl_srvc)
/* explore included service first */
bta_hh_le_search_hid_included(p_dev_cb);
else
{
/* explore characterisc */
p_dev_cb->hid_srvc[p_dev_cb->cur_srvc_index].cur_expl_char_idx = ;
bta_hh_le_search_hid_chars(p_dev_cb);
}
}
else /* all service discvery finished */
{
bta_hh_le_gatt_disc_cmpl(p_dev_cb, p_dev_cb->status);//所有的搜索已经完成
}
}
我们继续看bta_hh_le_gatt_disc_cmpl：
/*******************************************************************************
**
** Function bta_hh_le_gatt_disc_cmpl
**
** Description Check to see if the remote device is a LE only device
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_gatt_disc_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_STATUS status)
{
/* if open sucessful or protocol mode not desired, keep the connection open but inform app */
if (status == BTA_HH_OK || status == BTA_HH_ERR_PROTO)
{
/* assign a special APP ID temp, since device type unknown */
p_cb->app_id = BTA_HH_APP_ID_LE; /* set report notification configuration */
p_cb->clt_cfg_idx = ;
bta_hh_le_write_rpt_clt_cfg(p_cb, BTA_HH_LE_SRVC_DEF);//开始做report的配置工作
}
else /* error, close the GATT connection */
{
/* close GATT connection if it's on */
bta_hh_le_api_disc_act(p_cb);
}
}
上面的配置的工作就是把所有的input 的属性，都配置成notification 的形式。
这里关于hogp的服务搜索基本完成，下面 再说一下 每次配置属性之后进行的回调的流程：
每次一个行为配置完成都会调用：bta_gattc_op_cmpl：
/*******************************************************************************
**
** Function bta_gattc_op_cmpl
**
** Description operation completed.
**
** Returns None.
**
*******************************************************************************/
void bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
{
UINT8 op = (UINT8)p_data->op_cmpl.op_code;
UINT8 mapped_op = ;
...
else if (op == GATTC_OPTYPE_WRITE)
bta_gattc_write_cmpl(p_clcb, &p_data->op_cmpl);
...
我们看看bta_gattc_write_cmpl的实现：
....
event = BTA_GATTC_WRITE_DESCR_EVT; utl_freebuf((void **)&p_clcb->p_q_cmd);
cb_data.write.conn_id = p_clcb->bta_conn_id;
/* write complete, callback */
( *p_clcb->p_rcb->p_cback)(event, (tBTA_GATTC *)&cb_data);
...
调用注册的时候的回调：bta_hh_gattc_callback:
...
case BTA_GATTC_WRITE_DESCR_EVT: /* 9 */
case BTA_GATTC_WRITE_CHAR_EVT: /* 4 */
p_dev_cb = bta_hh_le_find_dev_cb_by_conn_id(p_data->write.conn_id);
if (event == BTA_GATTC_WRITE_CHAR_EVT)
evt = BTA_HH_GATT_WRITE_CHAR_CMPL_EVT;
else
evt = BTA_HH_GATT_WRITE_DESCR_CMPL_EVT; bta_hh_sm_execute(p_dev_cb, evt, (tBTA_HH_DATA *)&p_data->write);
break;
这里注意，此时的bta_hh的状态应是BTA_HH_W4_CONN_ST ，我们看其状态机的转换：event = BTA_HH_GATT_WRITE_DESCR_CMPL_EVT
/* WRITE_DESCR_CMPL_EVT */ ,{BTA_HH_WRITE_DESCR, BTA_HH_W4_CONN_ST }
下一个状态不变，执行的函数是：bta_hh_le_write_char_descr_cmpl：该函数的实现套路还是一样的，就是继续之前的行为，如果是已经搜索完成，那么会有回调向上：
/*******************************************************************************
**
** Function bta_hh_le_write_char_descr_cmpl
**
** Description Write charactersitic descriptor complete event
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_write_char_descr_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_buf)
{
tBTA_GATTC_WRITE *p_data = (tBTA_GATTC_WRITE *)p_buf;
UINT8 srvc_inst_id, hid_inst_id; /* only write client configuration possible */
if (p_data->descr_type.uuid.uu.uuid16 == GATT_UUID_CHAR_CLIENT_CONFIG)
{
srvc_inst_id = p_data->srvc_id.id.inst_id;
hid_inst_id = srvc_inst_id;
switch (p_data->char_id.uuid.uu.uuid16)
{
case GATT_UUID_BATTERY_LEVEL: /* battery level clt cfg registered */
hid_inst_id = bta_hh_le_find_service_inst_by_battery_inst_id(p_dev_cb, srvc_inst_id);
/* fall through */
case GATT_UUID_HID_BT_KB_INPUT:
case GATT_UUID_HID_BT_MOUSE_INPUT:
case GATT_UUID_HID_REPORT:
if (p_data->status == BTA_GATT_OK)
p_dev_cb->hid_srvc[hid_inst_id].report[p_dev_cb->clt_cfg_idx].client_cfg_value =
BTA_GATT_CLT_CONFIG_NOTIFICATION;
p_dev_cb->clt_cfg_idx ++;
bta_hh_le_write_rpt_clt_cfg(p_dev_cb, hid_inst_id);//继续write break;
我们继续分析：在bta_hh_le_write_rpt_clt_cfg 这个函数里面 ，肯定要发生”质变“：
/*******************************************************************************
**
** Function bta_hh_le_write_rpt_clt_cfg
**
** Description write client configuration. This is only for input report
** enable all input notification upon connection open.
**
*******************************************************************************/
BOOLEAN bta_hh_le_write_rpt_clt_cfg(tBTA_HH_DEV_CB *p_cb, UINT8 srvc_inst_id)
{
UINT8 i;
tBTA_HH_LE_RPT *p_rpt = &p_cb->hid_srvc[srvc_inst_id].report[p_cb->clt_cfg_idx];
UINT16 srvc_uuid; for (i = p_cb->clt_cfg_idx; i < BTA_HH_LE_RPT_MAX && p_rpt->in_use; i ++, p_rpt ++)
{
/* enable notification for all input report, regardless mode */
if (p_rpt->rpt_type == BTA_HH_RPTT_INPUT) {
if (p_rpt->uuid == GATT_UUID_BATTERY_LEVEL)
srvc_uuid = UUID_SERVCLASS_BATTERY;
else
srvc_uuid = UUID_SERVCLASS_LE_HID; if (bta_hh_le_write_char_clt_cfg(p_cb,
BTA_HH_LE_RPT_GET_SRVC_INST_ID(p_rpt->inst_id),
srvc_uuid,
BTA_HH_LE_RPT_GET_RPT_INST_ID(p_rpt->inst_id),
p_rpt->uuid,
BTA_GATT_CLT_CONFIG_NOTIFICATION))
{
p_cb->clt_cfg_idx = i;
return TRUE;
}
} }
p_cb->clt_cfg_idx = ;//执行到这里说明，write 行为已经全部结束 /* client configuration is completed, send open callback */
if (p_cb->state == BTA_HH_W4_CONN_ST)//此时bta_hh 正是BTA_HH_W4_CONN_ST
{
p_cb->disc_active &= ~BTA_HH_LE_DISC_HIDS;//清掉 这个标志，也意味着hid service流程完成 /* discover scan parameter profile is act as report host */
bta_hh_le_search_scps(p_cb);//进行scan parameter service 流程
}
return FALSE;
}
上面 的函数已经注释，我们继续看bta_hh_le_search_scps：
/*******************************************************************************
**
** Function bta_hh_le_search_scps
**
** Description discovery scan parameter service if act as report host, otherwise
** finish LE connection.
**
** Parameters:
**
*******************************************************************************/
static void bta_hh_le_search_scps(tBTA_HH_DEV_CB *p_cb)
{
tBT_UUID pri_srvc; if ( p_cb->mode == BTA_HH_PROTO_RPT_MODE)//猜测：搜索完成会设置这个标志位
{
p_cb->disc_active |= BTA_HH_LE_DISC_SCPS;//设置此标志位
/* start service discovery for Scan Parameter service */
pri_srvc.len = LEN_UUID_16;
pri_srvc.uu.uuid16 = UUID_SERVCLASS_SCAN_PARAM; BTA_GATTC_ServiceSearchRequest(p_cb->conn_id, &pri_srvc);
}//开始搜索
else
bta_hh_le_open_cmpl(p_cb);
}
继续看：会发出0x1f09 继续搜索：
void BTA_GATTC_ServiceSearchRequest (UINT16 conn_id, tBT_UUID *p_srvc_uuid)
{
tBTA_GATTC_API_SEARCH *p_buf;
UINT16 len = sizeof(tBTA_GATTC_API_SEARCH) + sizeof(tBT_UUID); if ((p_buf = (tBTA_GATTC_API_SEARCH *) GKI_getbuf(len)) != NULL)
{
memset(p_buf, , len); p_buf->hdr.event = BTA_GATTC_API_SEARCH_EVT;
p_buf->hdr.layer_specific = conn_id; if (p_srvc_uuid)
{
p_buf->p_srvc_uuid = (tBT_UUID *)(p_buf + );
memcpy(p_buf->p_srvc_uuid, p_srvc_uuid, sizeof(tBT_UUID));
}
else
p_buf->p_srvc_uuid = NULL; bta_sys_sendmsg(p_buf);
}
return;
}
继续执行bta_gattc_search：
void bta_gattc_search(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
{
tBTA_GATT_STATUS status = GATT_INTERNAL_ERROR;
tBTA_GATTC cb_data;
APPL_TRACE_DEBUG("bta_gattc_search conn_id=%d",p_clcb->bta_conn_id);
if (p_clcb->p_srcb && p_clcb->p_srcb->p_srvc_cache)
{
status = BTA_GATT_OK;
/* search the local cache of a server device */
bta_gattc_search_service(p_clcb, p_data->api_search.p_srvc_uuid);//seach local cache
}
cb_data.search_cmpl.status = status;
cb_data.search_cmpl.conn_id = p_clcb->bta_conn_id; /* end of search or no server cache available */
( *p_clcb->p_rcb->p_cback)(BTA_GATTC_SEARCH_CMPL_EVT, &cb_data);//不管结果，直接上报BTA_GATTC_SEARCH_CMPL_EVT
}
这里会对cache 里面去搜索，这个看看btsnoop 发现其是可以搜索到的：通过btsnoop，我们发现从handle 74-79 就是scan parameter的相关属性。
下面我们看看回调函数 对于BTA_GATTC_SEARCH_CMPL_EVT的处理：
static void bta_hh_gattc_callback(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
{
tBTA_HH_DEV_CB *p_dev_cb;
UINT16 evt;
...
case BTA_GATTC_SEARCH_CMPL_EVT: /* 6 */
bta_hh_le_srvc_search_cmpl(&p_data->search_cmpl);
break;
...
继续看：
/*******************************************************************************
**
** Function bta_hh_le_srvc_search_cmpl
**
** Description This function process the GATT service search complete.
**
** Parameters:
**
*******************************************************************************/
void bta_hh_le_srvc_search_cmpl(tBTA_GATTC_SEARCH_CMPL *p_data)
{
tBTA_HH_DEV_CB *p_dev_cb = bta_hh_le_find_dev_cb_by_conn_id(p_data->conn_id); if(p_data->status != BTA_GATT_OK || p_dev_cb->total_srvc == )
{
...
}
/* GATT service discovery sucessfully finished */
else
{
if (p_dev_cb->disc_active & BTA_HH_LE_DISC_SCPS)
{
p_dev_cb->disc_active &= ~BTA_HH_LE_DISC_SCPS;//清掉scps标志
bta_hh_le_open_cmpl(p_dev_cb);//上报hh open event
}
else /* discover HID service */
{
p_dev_cb->cur_srvc_index = ;
bta_hh_le_srvc_expl_srvc(p_dev_cb);
}
}
}
调用bta_hh_le_open_cmpl 上报状态，汇报”HID over GATT connection sucessfully opened“，我们继续分析：
/*******************************************************************************
**
** Function bta_hh_le_open_cmpl
**
** Description HID over GATT connection sucessfully opened
**
*******************************************************************************/
void bta_hh_le_open_cmpl(tBTA_HH_DEV_CB *p_cb)
{
if ( p_cb->disc_active == BTA_HH_LE_DISC_NONE)
{
bta_hh_le_register_input_notif(p_cb, , p_cb->mode, TRUE);//注册input notification
bta_hh_sm_execute(p_cb, BTA_HH_OPEN_CMPL_EVT, NULL);//状态机继续轮转 #if (BTA_HH_LE_RECONN == TRUE)
if (p_cb->status == BTA_HH_OK)
{
bta_hh_le_add_dev_bg_conn(p_cb, TRUE);//加入到bg conn，用于回连
}
#endif
}
}
关于注册input notification 的部分，这里就不细讲了，我们看看 状态机的转换：
void bta_hh_sm_execute(tBTA_HH_DEV_CB *p_cb, UINT16 event, tBTA_HH_DATA * p_data)
{
tBTA_HH_ST_TBL state_table;
UINT8 action;
tBTA_HH cback_data;
tBTA_HH_EVT cback_event = ;
#if BTA_HH_DEBUG == TRUE
tBTA_HH_STATE in_state ;
UINT16 debug_event = event;
#endif memset(&cback_data, , sizeof(tBTA_HH));
...
state_table = bta_hh_st_tbl[p_cb->state - ]; event &= 0xff; p_cb->state = state_table[event][BTA_HH_NEXT_STATE] ; if ((action = state_table[event][BTA_HH_ACTION]) != BTA_HH_IGNORE)
{
(*bta_hh_action[action])(p_cb, p_data);
}
...
可以看到，下一个状态是 connection 状态：
/* BTA_HH_OPEN_CMPL_EVT */ {BTA_HH_OPEN_CMPL_ACT, BTA_HH_CONN_ST }
执行的行为是：BTA_HH_OPEN_CMPL_ACT：
/*******************************************************************************
**
** Function bta_hh_open_cmpl_act
**
** Description HID host connection completed
**
**
** Returns void
**
*******************************************************************************/
void bta_hh_open_cmpl_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
{
tBTA_HH_CONN conn ;
UINT8 dev_handle = p_data ? (UINT8)p_data->hid_cback.hdr.layer_specific : \
p_cb->hid_handle; memset((void *)&conn, , sizeof (tBTA_HH_CONN));
conn.handle = dev_handle;
bdcpy(conn.bda, p_cb->addr); /* increase connection number */
bta_hh_cb.cnt_num ++; /* initialize device driver */
bta_hh_co_open(p_cb->hid_handle, p_cb->sub_class,
p_cb->attr_mask, p_cb->app_id);//打开uhid驱动，并且初始化线程btif_hh_poll_event_thread conn.status = p_cb->status;
conn.le_hid = p_cb->is_le_device;
conn.scps_supported = p_cb->scps_supported; /* set protocol mode when not default report mode */
if ( p_cb->mode != BTA_HH_PROTO_RPT_MODE
&& !p_cb->is_le_device)
{
...
}
else
(* bta_hh_cb.p_cback)(BTA_HH_OPEN_EVT, (tBTA_HH *)&conn);//继续上报bta_hh_cb.p_cback = bte_hh_evt p_cb->incoming_conn = FALSE;
p_cb->incoming_hid_handle = BTA_HH_INVALID_HANDLE; }
初始化驱动的部分，这里不讲了，，我们继续看看 状态上报的流程：callback 实际执行流程是btif_hh_upstreams_evt，我们继续分析：
static void btif_hh_upstreams_evt(UINT16 event, char* p_param)
{
tBTA_HH *p_data = (tBTA_HH *)p_param;
btif_hh_device_t *p_dev = NULL;
int i;
int len, tmplen;
...
case BTA_HH_OPEN_EVT:
if (p_data->conn.status == BTA_HH_OK) {
p_dev = btif_hh_find_connected_dev_by_handle(p_data->conn.handle);
if (p_dev == NULL) {
...
}
else if (p_dev->fd < ) {
...
}
else {
btif_hh_cb.status = BTIF_HH_DEV_CONNECTED;
// Send set_idle if the peer_device is a keyboard
if (check_cod((bt_bdaddr_t*)p_data->conn.bda, COD_HID_KEYBOARD )||
check_cod((bt_bdaddr_t*)p_data->conn.bda, COD_HID_COMBO))
BTA_HhSetIdle(p_data->conn.handle, );
btif_hh_cb.p_curr_dev = btif_hh_find_connected_dev_by_handle(p_data->conn.handle);
BTA_HhGetDscpInfo(p_data->conn.handle);//这里涉及到将despinfo 发送到kernel，逻辑简单这里不做具体分析
p_dev->dev_status = BTHH_CONN_STATE_CONNECTED; HAL_CBACK(bt_hh_callbacks, connection_state_cb,&(p_dev->bd_addr), p_dev->dev_status);//上报到JNI 层面
上面的流程主要就是 上报状态，最后会上报到JNI 层面，最后肯定会通知到framework。
hogp的流程分析到这里就结束了。