蓝牙inquiry流程之Inquiry Complete处理

inquiry流程一般持续有12s多，当inquiry完成的时候，设备端会上报一个Event: Inquiry Complete 上来，那协议栈是如何把这个事件上传到应用层的呢？本篇文章来分析一下其具体的流程。

void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg)
{UINT8   *p = (UINT8 *)(p_msg + 1) + p_msg->offset;UINT8   hci_evt_code, hci_evt_len;STREAM_TO_UINT8  (hci_evt_code, p);STREAM_TO_UINT8  (hci_evt_len, p);switch (hci_evt_code){case HCI_INQUIRY_COMP_EVT:btu_hcif_inquiry_comp_evt (p);break;
...

看btu_hcif_inquiry_comp_evt 的实现：

static void btu_hcif_inquiry_comp_evt (UINT8 *p)
{UINT8   status;STREAM_TO_UINT8    (status, p);/* Tell inquiry processing that we are done */btm_process_inq_complete(status, BTM_BR_INQUIRY_MASK);
}

继续看btm_process_inq_complete 的实现：

其中：

#define BTM_BR_INQUIRY_MASK         (BTM_GENERAL_INQUIRY | BTM_LIMITED_INQUIRY)

btm_process_inq_complete 其实现在btm_inq.c里面：

void btm_process_inq_complete (UINT8 status, UINT8 mode)
{tBTM_CMPL_CB        *p_inq_cb = btm_cb.btm_inq_vars.p_inq_cmpl_cb;//保存回调函数指针tBTM_INQUIRY_VAR_ST *p_inq = &btm_cb.btm_inq_vars;
...
#if (!defined(BTA_HOST_INTERLEAVE_SEARCH) || BTA_HOST_INTERLEAVE_SEARCH == FALSE)p_inq->inqparms.mode &= ~(mode);
#endifbtm_acl_update_busy_level (BTM_BLI_INQ_DONE_EVT);//向上传递/* Ignore any stray or late complete messages if the inquiry is not active */if (p_inq->inq_active){p_inq->inq_cmpl_info.status = (tBTM_STATUS)((status == HCI_SUCCESS) ? BTM_SUCCESS : BTM_ERR_PROCESSING);/* Notify caller that the inquiry has completed; (periodic inquiries do not send completion events */if (!(p_inq->inq_active & BTM_PERIODIC_INQUIRY_ACTIVE) && p_inq->inqparms.mode == 0)//mode前面已经置0
        {
#if BLE_INCLUDED == TRUEbtm_clear_all_pending_le_entry();//清除还没有活动scan response的设备消息
#endifp_inq->state = BTM_INQ_INACTIVE_STATE;//设置inquiry的状态/* Increment so the start of a next inquiry has a new count */p_inq->inq_counter++；//增加搜索的计数
btm_clr_inq_result_flt();if((p_inq->inq_cmpl_info.status == BTM_SUCCESS) &&controller_get_interface()->supports_rssi_with_inquiry_results()){btm_sort_inq_result();//根据rssi排序
            }/* Clear the results callback if set */p_inq->p_inq_results_cb = (tBTM_INQ_RESULTS_CB *) NULL;p_inq->inq_active = BTM_INQUIRY_INACTIVE;//设置0p_inq->p_inq_cmpl_cb = (tBTM_CMPL_CB *) NULL;if (p_inq_cb)//执行回调函数，在bta_dm_search_start 进行注册bta_dm_inq_cmpl_cb(p_inq_cb)((tBTM_INQUIRY_CMPL *) &p_inq->inq_cmpl_info);}}if(p_inq->inqparms.mode == 0 && p_inq->scan_type == INQ_GENERAL)//this inquiry is complete
    {p_inq->scan_type = INQ_NONE;//scan_type置0
#if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)/* check if the LE observe is pending */if(p_inq->p_inq_ble_results_cb != NULL)//==NULL
        {BTM_TRACE_DEBUG("BTM Inq Compl: resuming a pending LE scan");BTM_BleObserve(1,0, p_inq->p_inq_ble_results_cb, p_inq->p_inq_ble_cmpl_cb);}
#endif}}

这里主要分三部分：

btm_acl_update_busy_level (BTM_BLI_INQ_DONE_EVT); 向上层汇报状态
清各种状态标志位
(p_inq_cb)((tBTM_INQUIRY_CMPL *) &p_inq->inq_cmpl_info);

我们主要看一下第一部分和第三部分：

1.btm_acl_update_busy_level

其实现btm_acl.c：

void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
{tBTM_BL_UPDATE_DATA  evt;UINT8 busy_level;BTM_TRACE_DEBUG ("btm_acl_update_busy_level");BOOLEAN old_inquiry_state = btm_cb.is_inquiry;switch (event){
...case BTM_BLI_INQ_DONE_EVT:BTM_TRACE_DEBUG ("BTM_BLI_INQ_DONE_EVT");btm_cb.is_inquiry = FALSE;evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;break;}
...if ((busy_level != btm_cb.busy_level) ||(old_inquiry_state != btm_cb.is_inquiry)){evt.event         = BTM_BL_UPDATE_EVT;evt.busy_level    = busy_level;btm_cb.busy_level = busy_level;if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)){(*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);}}
}

可以看出，主要做的事情是组建一个evt：

evt.event = BTM_BL_UPDATE_EVT;
evt.busy_level = busy_level;

evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;

然后调用 (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);

看看这个回调函数是在哪里注册的呢？

在btm_acl.c有个注册函数：

tBTM_STATUS BTM_RegBusyLevelNotif (tBTM_BL_CHANGE_CB *p_cb, UINT8 *p_level,tBTM_BL_EVENT_MASK evt_mask)
{
...    btm_cb.bl_evt_mask = evt_mask;
...btm_cb.p_bl_changed_cb = p_cb;//保存回调return(BTM_SUCCESS);
}

发现该函数是在bta_dm_sys_hw_cback里面注册的：

BTM_RegBusyLevelNotif (bta_dm_bl_change_cback, NULL, BTM_BL_UPDATE_MASK|BTM_BL_ROLE_CHG_MASK);

我们发现这个回调函数就是bta_dm_bl_change_cback ，其实现在bta_dm_act.c中：

根据上面的分析，我们知道这次传入的event = BTM_BL_UPDATE_EVT;

static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
{tBTA_DM_ACL_CHANGE * p_msg;if ((p_msg = (tBTA_DM_ACL_CHANGE *) GKI_getbuf(sizeof(tBTA_DM_ACL_CHANGE))) != NULL){p_msg->event = p_data->event;.//继承上面eventp_msg->is_new = FALSE;//is_new = falseswitch(p_msg->event){
...case BTM_BL_UPDATE_EVT:p_msg->busy_level = p_data->update.busy_level;p_msg->busy_level_flags = p_data->update.busy_level_flags;break;
...}p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;bta_sys_sendmsg(p_msg);}}

观其实现，还是组建了一个 tBTA_DM_ACL_CHANGE 这样的事件，然后发送到btu 线程：

p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;

p_msg->event = p_data->event = BTM_BL_UPDATE_EVT;
p_msg->is_new = FALSE;

这边追踪一下代码，处理这个BTA_DM_ACL_CHANGE_EVT的函数是：

/*******************************************************************************
**
** Function         bta_dm_acl_change
**
** Description      Process BTA_DM_ACL_CHANGE_EVT
**
**
** Returns          void
**
*******************************************************************************/
void bta_dm_acl_change(tBTA_DM_MSG *p_data)
{UINT8 i;UINT8 *p;tBTA_DM_SEC conn;BOOLEAN is_new = p_data->acl_change.is_new;BD_ADDR_PTR     p_bda = p_data->acl_change.bd_addr;BOOLEAN         need_policy_change = FALSE;BOOLEAN         issue_unpair_cb = FALSE;tBTA_DM_PEER_DEVICE *p_dev;memset(&conn, 0, sizeof(tBTA_DM_SEC));switch(p_data->acl_change.event){case BTM_BL_UPDATE_EVT:     /* busy level update */if( bta_dm_cb.p_sec_cback ){conn.busy_level.level = p_data->acl_change.busy_level;conn.busy_level.level_flags = p_data->acl_change.busy_level_flags;bta_dm_cb.p_sec_cback(BTA_DM_BUSY_LEVEL_EVT, &conn);//回调到上层
        }return;
...

这边的核心代码还是组建事件往上层回调，:

conn.busy_level.level = p_data->acl_change.busy_level;
conn.busy_level.level_flags = p_data->acl_change.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
bta_dm_cb.p_sec_cback(BTA_DM_BUSY_LEVEL_EVT, &conn);

那我们现在看看bta_dm_cb.p_sec_cback 这个回调函数是在哪里注册的：

void bta_dm_enable(tBTA_DM_MSG *p_data){
.../* first, register our callback to SYS HW manager */bta_sys_hw_register( BTA_SYS_HW_BLUETOOTH, bta_dm_sys_hw_cback );bta_dm_cb.p_sec_cback = p_data->enable.p_sec_cback;//注册回调
...
}

发现是在bta_dm_enable 里面注册的，也就是在tBTA_STATUS BTA_EnableBluetooth(tBTA_DM_SEC_CBACK *p_cback) 传入的回调函数：

void btif_init_ok(UNUSED_ATTR uint16_t event, UNUSED_ATTR char *p_param) {BTIF_TRACE_DEBUG("btif_task: received trigger stack init event");
#if (BLE_INCLUDED == TRUE)btif_dm_load_ble_local_keys();
#endifBTA_EnableBluetooth(bte_dm_evt);//这里注册
}

那我们知道上面回调的内容如下：

conn.busy_level.level = p_data->acl_change.busy_level;
conn.busy_level.level_flags = p_data->acl_change.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
bte_dm_evt(BTA_DM_BUSY_LEVEL_EVT, &conn);

，下面继续分析bte_dm_evt：

void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC *p_data)
{/* switch context to btif task context (copy full union size for convenience) */bt_status_t status = btif_transfer_context(btif_dm_upstreams_evt, (uint16_t)event,(void*)p_data, sizeof(tBTA_DM_SEC), btif_dm_data_copy);/* catch any failed context transfers */ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
}

发现该函数就是一个中转，他把事件交与bt_jni_workqueue_thread 线程中的btif_dm_upstreams_evt 函数去执行了。event从btu task 转换到了bt_jni_workqueue_thread ，我们也能感受到，事件正在一层一层往上面走，

看看btif_dm_upstreams_evt 的实现，这里面肯定也是会去处理各种不同的event：我们这种case 要处理的event = BTA_DM_BUSY_LEVEL_EVT,

/*******************************************************************************
**
** Function         btif_dm_upstreams_cback
**
** Description      Executes UPSTREAMS events in btif context
**
** Returns          void
**
*******************************************************************************/
static void btif_dm_upstreams_evt(UINT16 event, char* p_param)
{tBTA_DM_SEC *p_data = (tBTA_DM_SEC*)p_param;tBTA_SERVICE_MASK service_mask;uint32_t i;bt_bdaddr_t bd_addr;switch (event){   case BTA_DM_BUSY_LEVEL_EVT:{if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK){if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED){HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,BT_DISCOVERY_STARTED);btif_dm_inquiry_in_progress = TRUE;}else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED){HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,BT_DISCOVERY_STOPPED);btif_dm_inquiry_in_progress = FALSE;}else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE){btif_dm_inquiry_in_progress = FALSE;//设置了这个值
                }}}

从上面的代码分析，这里做的最重要的一件事就是：

btif_dm_inquiry_in_progress = FALSE;
第一部分的分析到此结束，下面开始看inquiry结束之后的回调函数：

3.(p_inq_cb)((tBTM_INQUIRY_CMPL *) &p_inq->inq_cmpl_info) = bta_dm_inq_cmpl_cb

这个回调函数的注册是在进行搜索的时候：

void bta_dm_search_start (tBTA_DM_MSG *p_data){
...result.status = BTM_StartInquiry(   (tBTM_INQ_PARMS*)&p_data->search.inq_params,bta_dm_inq_results_cb,(tBTM_CMPL_CB*) bta_dm_inq_cmpl_cb);
...
}

我们看看bta_dm_inq_cmpl_cb的实现：

/*******************************************************************************
**
** Function         bta_dm_inq_cmpl_cb
**
** Description      Inquiry complete callback from BTM
**
** Returns          void
**
*******************************************************************************/
static void bta_dm_inq_cmpl_cb (void * p_result)
{tBTA_DM_MSG * p_msg;if (bta_dm_search_cb.cancel_pending == FALSE){p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG));p_msg->inq_cmpl.hdr.event = BTA_DM_INQUIRY_CMPL_EVT;p_msg->inq_cmpl.num = ((tBTM_INQUIRY_CMPL *)p_result)->num_resp;bta_sys_sendmsg(p_msg);}

这里发现是组建了一个msg，然后发送到btu 线程：

p_msg->inq_cmpl.hdr.event = BTA_DM_INQUIRY_CMPL_EVT;

p_msg->inq_cmpl.num = ((tBTM_INQUIRY_CMPL *)p_result)->num_resp;

    BTA_DM_API_SEARCH_EVT = BTA_SYS_EVT_START(BTA_ID_DM_SEARCH),BTA_DM_API_SEARCH_CANCEL_EVT,BTA_DM_API_DISCOVER_EVT,BTA_DM_INQUIRY_CMPL_EVT,//0x203
...

处理该event 是handler是：

static const tBTA_SYS_REG bta_dm_search_reg =
{bta_dm_search_sm_execute,bta_dm_search_sm_disable
};

bta_dm_search_sm_execute：

BOOLEAN bta_dm_search_sm_execute(BT_HDR *p_msg)
{tBTA_DM_ST_TBL      state_table;UINT8               action;int                 i;
/* look up the state table for the current state */state_table = bta_dm_search_st_tbl[bta_dm_search_cb.state];bta_dm_search_cb.state = state_table[p_msg->event & 0x00ff][BTA_DM_SEARCH_NEXT_STATE];/* execute action functions */for (i = 0; i < BTA_DM_SEARCH_ACTIONS; i++){if ((action = state_table[p_msg->event & 0x00ff][i]) != BTA_DM_SEARCH_IGNORE){(*bta_dm_search_action[action])( (tBTA_DM_MSG*) p_msg);}
    }return TRUE;
}

他的处理流程是先找到该状态的table，然后赋值下一个状态，然后根据event 在table中查找该事件应该执行的action，这些action 有函数和他们一一对应，执行这些函数就行。

我们当前的状态是bta_dm_search_search_active_st_table，需要执行的action = BTA_DM_INQUIRY_CMPL，下一个状态依然是BTA_DM_SEARCH_ACTIVE 　　

我们看看BTA_DM_INQUIRY_CMPL 对应的函数是什么？

/* action function list */
const tBTA_DM_ACTION bta_dm_search_action[] =
{bta_dm_search_start,              /* 0 BTA_DM_API_SEARCH */bta_dm_search_cancel,             /* 1 BTA_DM_API_SEARCH_CANCEL */bta_dm_discover,                  /* 2 BTA_DM_API_DISCOVER */bta_dm_inq_cmpl,                  /* 3 BTA_DM_INQUIRY_CMPL */bta_dm_rmt_name,                  /* 4 BTA_DM_REMT_NAME */

看看回调函数的具体实现：

/*******************************************************************************
**
** Function         bta_dm_inq_cmpl
**
** Description      Process the inquiry complete event from BTM
**
** Returns          void
**
*******************************************************************************/
void bta_dm_inq_cmpl (tBTA_DM_MSG *p_data)
{tBTA_DM_MSG * p_msg;tBTA_DM_SEARCH  data;APPL_TRACE_DEBUG("bta_dm_inq_cmpl");data.inq_cmpl.num_resps = p_data->inq_cmpl.num;bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data);//执行回调，向上层通知if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbFirst()) != NULL)//如果搜索到设备了，对设备做discover的动作
    {/* start name and service discovery from the first device on inquiry result */bta_dm_search_cb.name_discover_done = FALSE;bta_dm_search_cb.peer_name[0]       = 0;bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);}else //否则结束，向上层传 BTA_DM_SEARCH_CMPL_EVT;
    {/* no devices, search complete */bta_dm_search_cb.services = 0;if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL){p_msg->hdr.event          = BTA_DM_SEARCH_CMPL_EVT;p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;bta_sys_sendmsg(p_msg);}}}

这一部分的内容也可以分为三部分：

bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data);
有搜索到设备，进行discovery
没有搜索到设备，上报BTA_DM_SEARCH_CMPL_EVT

首先来看看第一部分：

3.1 bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data);

bta_dm_search_cb.p_search_cback 在BTA_DmSearch 中赋值的，为bte_search_devices_evt ，我们看看其实现：

/*******************************************************************************
**
** Function         bte_search_devices_evt
**
** Description      Switches context from BTE to BTIF for DM search events
**
** Returns          void
**
*******************************************************************************/
static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
{UINT16 param_len = 0;
...btif_transfer_context (btif_dm_search_devices_evt , (UINT16) event, (void *)p_data, param_len,(param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
}

发现其直接被transfer 到btif线程中执行btif_dm_search_devices_evt：

/******************************************************************************
**
** Function         btif_dm_search_devices_evt
**
** Description      Executes search devices callback events in btif context
**
** Returns          void
**
******************************************************************************/
static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
{tBTA_DM_SEARCH *p_search_data;BTIF_TRACE_EVENT("%s event=%s", __FUNCTION__, dump_dm_search_event(event));switch (event){
...case BTA_DM_INQ_CMPL_EVT://并没有进一步去通知上层
        {
#if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))tBTA_DM_BLE_PF_FILT_PARAMS adv_filt_param;memset(&adv_filt_param, 0, sizeof(tBTA_DM_BLE_PF_FILT_PARAMS));BTA_DmBleScanFilterSetup(BTA_DM_BLE_SCAN_COND_DELETE, 0, &adv_filt_param, NULL,bte_scan_filt_param_cfg_evt, 0);
#endif}break;case BTA_DM_DISC_CMPL_EVT:{HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED);//如果是BTA_DM_DISC_CMPL_EVT:会进一步通知上层
        }break;

这里发现，BTA_DM_INQ_CMPL_EVT:并不会一直往上面传，而 BTA_DM_DISC_CMPL_EVT:则是会上报给上层。那如果一直搜索不到设备就不会给上层答复吗？我们看看第三部分的行为。

3.2 有搜索到设备，进行discovery

再次贴上代码：

  if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbFirst()) != NULL){/* start name and service discovery from the first device on inquiry result */bta_dm_search_cb.name_discover_done = FALSE;bta_dm_search_cb.peer_name[0]       = 0;bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);}

看代码的注释，是开始名字和service 的discovery 的工作。看看这个函数的实现：

首先简述一下该函数的作用：

判断是否需要去获取对端设备的名字。不需要跳过，需要就去获取名字并返回，这里猜想服务方面的搜索肯定是在获取名字返回的函数里面进行。
判断是否需要进行服务的搜索，需要则进行，从开始的discovery的接口看，应该是不需要进行服务的搜索。
发出服务完成的event，发送到btu 线程。

下面看代码：

/*******************************************************************************
**
** Function         bta_dm_discover_device
**
** Description      Starts name and service discovery on the device
**
** Returns          void
**
*******************************************************************************/
static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
{tBTA_DM_MSG * p_msg;tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
#if BLE_INCLUDED == TRUEif (bta_dm_search_cb.transport == BTA_TRANSPORT_UNKNOWN)//一开始都是unkown，会BTM_ReadDevInfo来判断transport
    {tBT_DEVICE_TYPE dev_type;tBLE_ADDR_TYPE  addr_type;BTM_ReadDevInfo(remote_bd_addr, &dev_type, &addr_type);if (dev_type == BT_DEVICE_TYPE_BLE || addr_type == BLE_ADDR_RANDOM)transport = BT_TRANSPORT_LE;} else {transport = bta_dm_search_cb.transport;}
#endif/* Reset transport state for next discovery */bta_dm_search_cb.transport = BTA_TRANSPORT_UNKNOWN;//reset
bdcpy(bta_dm_search_cb.peer_bdaddr, remote_bd_addr);if (bta_dm_search_cb.p_btm_inq_info){APPL_TRACE_DEBUG("%s appl_knows_rem_name %d", __func__,bta_dm_search_cb.p_btm_inq_info->appl_knows_rem_name);//显示app是否已经知道名字，这是inquiry db里面的数据
    }if((bta_dm_search_cb.p_btm_inq_info)&& (bta_dm_search_cb.p_btm_inq_info->results.device_type == BT_DEVICE_TYPE_BLE)&& (bta_dm_search_cb.state == BTA_DM_SEARCH_ACTIVE)){/* Do not perform RNR for LE devices at inquiry complete*/bta_dm_search_cb.name_discover_done = TRUE; //不要去查找LE 设备的名字
    }/* if name discovery is not done and application needs remote name */if ((!bta_dm_search_cb.name_discover_done)&& (( bta_dm_search_cb.p_btm_inq_info == NULL )||(bta_dm_search_cb.p_btm_inq_info && (!bta_dm_search_cb.p_btm_inq_info->appl_knows_rem_name))))//需要名字则进行名字的搜索
    {if (bta_dm_read_remote_device_name(bta_dm_search_cb.peer_bdaddr, transport) == TRUE)return;//返回/* starting name discovery failed */bta_dm_search_cb.name_discover_done = TRUE;}/* if application wants to discover service */if ( bta_dm_search_cb.services )//一般是0
    {/* initialize variables */bta_dm_search_cb.service_index      = 0;bta_dm_search_cb.services_found     = 0;bta_dm_search_cb.services_to_search = bta_dm_search_cb.services;
#if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUEbta_dm_search_cb.uuid_to_search     = bta_dm_search_cb.num_uuid;
#endifif ((bta_dm_search_cb.p_btm_inq_info != NULL) &&bta_dm_search_cb.services != BTA_USER_SERVICE_MASK&&(bta_dm_search_cb.sdp_search == FALSE)){/* check if EIR provides the information of supported services */bta_dm_eir_search_services( &bta_dm_search_cb.p_btm_inq_info->results,&bta_dm_search_cb.services_to_search,&bta_dm_search_cb.services_found );}/* if seaching with EIR is not completed */if(bta_dm_search_cb.services_to_search){/* check whether connection already exists to the deviceif connection exists, we don't have to wait for ACLlink to go down to start search on next device */if (BTM_IsAclConnectionUp(bta_dm_search_cb.peer_bdaddr, BT_TRANSPORT_BR_EDR))bta_dm_search_cb.wait_disc = FALSE;elsebta_dm_search_cb.wait_disc = TRUE;#if (BLE_INCLUDED == TRUE && (defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE))if ( bta_dm_search_cb.p_btm_inq_info ){APPL_TRACE_DEBUG("%s p_btm_inq_info 0x%x results.device_type 0x%x services_to_search 0x%x",__func__,bta_dm_search_cb.p_btm_inq_info,bta_dm_search_cb.p_btm_inq_info->results.device_type,bta_dm_search_cb.services_to_search);}if (transport == BT_TRANSPORT_LE){if (bta_dm_search_cb.services_to_search & BTA_BLE_SERVICE_MASK){//set the raw data buffer herememset(g_disc_raw_data_buf, 0, sizeof(g_disc_raw_data_buf));bta_dm_search_cb.p_ble_rawdata = g_disc_raw_data_buf;bta_dm_search_cb.ble_raw_size = MAX_DISC_RAW_DATA_BUF;bta_dm_search_cb.ble_raw_used = 0;/* start GATT for service discovery */btm_dm_start_gatt_discovery(bta_dm_search_cb.peer_bdaddr);return;}}else
#endif{bta_dm_search_cb.sdp_results = FALSE;bta_dm_find_services(bta_dm_search_cb.peer_bdaddr);return;}}}/* name discovery and service discovery are done for this device */if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL){p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;//发送event到btu 线程/* initialize the data structure - includes p_raw_data and raw_data_size */memset(&(p_msg->disc_result.result), 0, sizeof(tBTA_DM_DISC_RES));p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);BCM_STRNCPY_S((char*)p_msg->disc_result.result.disc_res.bd_name,  sizeof(BD_NAME),(char*)bta_dm_search_cb.peer_name, (BD_NAME_LEN-1));/* make sure the string is terminated */p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN-1] = 0;bta_sys_sendmsg(p_msg);}
}

服务方面 ok了之后是会向btu 线程发送event:

p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);

BTA_DM_DISCOVERY_RESULT_EVT = 0x207

执行的action = BTA_DM_SEARCH_RESULT，对应的函数是bta_dm_search_result，看看其具体的实现:

/*******************************************************************************
**
** Function         bta_dm_search_result
**
** Description      Service discovery result while searching for devices
**
** Returns          void
**
*******************************************************************************/
void bta_dm_search_result (tBTA_DM_MSG *p_data)
{/* call back if application wants name discovery or found services that application is searching */if (( !bta_dm_search_cb.services )||(( bta_dm_search_cb.services ) && ( p_data->disc_result.result.disc_res.services ))){bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);//回调
    }/* if searching did not initiate to create link */if(!bta_dm_search_cb.wait_disc )//如果没有pending
    {/* if service searching is done with EIR, don't search next device */if( bta_dm_search_cb.p_btm_inq_info )bta_dm_discover_next_device();//去搜索下一个设备的服务
    }else{/* wait until link is disconnected or timeout */bta_dm_search_cb.sdp_results = TRUE;bta_dm_search_cb.search_timer.p_cback = (TIMER_CBACK*)&bta_dm_search_timer_cback;bta_sys_start_timer(&bta_dm_search_cb.search_timer, 0, 1000*(L2CAP_LINK_INACTIVITY_TOUT+1) );//如果pending了，那么设置定时器，并且在回调函数里面继续执行搜索下一个设备的服务
    }}

这里简单分析两点：

bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result)　　
bta_dm_discover_next_device，如果有数据库里面还有设备的话，那么继续搜索服务，如果没有设备的话，向上面传：BTA_DM_SEARCH_CMPL_EVT，最终也会上报到java层。前面已经分析过。‘

分析一下bta_dm_search_cb.p_search_cback,我们又遇到这个函数了，其实是bte_search_devices_evt-->btif_dm_search_devices_evt:

/******************************************************************************
**
** Function         btif_dm_search_devices_evt
**
** Description      Executes search devices callback events in btif context
**
** Returns          void
**
******************************************************************************/
static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
{tBTA_DM_SEARCH *p_search_data;switch (event){case BTA_DM_DISC_RES_EVT:{p_search_data = (tBTA_DM_SEARCH *)p_param;/* Remote name update */if (strlen((const char *) p_search_data->disc_res.bd_name))//如果早先已经知道了名字，这里的名字的长度0
            {bt_property_t properties[1];bt_bdaddr_t bdaddr;bt_status_t status;properties[0].type = BT_PROPERTY_BDNAME;properties[0].val = p_search_data->disc_res.bd_name;properties[0].len = strlen((char *)p_search_data->disc_res.bd_name);bdcpy(bdaddr.address, p_search_data->disc_res.bd_addr);status = btif_storage_set_remote_device_property(&bdaddr, &properties[0]);ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device property", status);HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,status, &bdaddr, 1, properties);}

现在简单看下：bta_dm_discover_next_device：

/*******************************************************************************
**
** Function         bta_dm_discover_next_device
**
** Description      Starts discovery on the next device in Inquiry data base
**
** Returns          void
**
*******************************************************************************/
static void bta_dm_discover_next_device(void)
{tBTA_DM_MSG * p_msg;/* searching next device on inquiry result */if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbNext(bta_dm_search_cb.p_btm_inq_info)) != NULL){bta_dm_search_cb.name_discover_done = FALSE;bta_dm_search_cb.peer_name[0]       = 0;bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);//继续搜索服务
    }else{/* no devices, search complete */bta_dm_search_cb.services = 0;if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL){p_msg->hdr.event          = BTA_DM_SEARCH_CMPL_EVT;//都搜索我弄成之后上报event，结束discovery的流程p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;bta_sys_sendmsg(p_msg);}}
}

服务搜索部分就介绍到这里。

3.3 没有搜索到设备或者搜索完成，上报BTA_DM_SEARCH_CMPL_EVT

再附上这段代码：

    {/* no devices, search complete */bta_dm_search_cb.services = 0;if ((p_msg = (tBTA_DM_MSG *) GKI_getbuf(sizeof(tBTA_DM_MSG))) != NULL){p_msg->hdr.event          = BTA_DM_SEARCH_CMPL_EVT;p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;bta_sys_sendmsg(p_msg);}

这边还是组装了一个event：

p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;

相应的log也就是：BTA got event 0x206

const tBTA_DM_ACTION bta_dm_search_action[] =
{bta_dm_search_start,              /* 0 BTA_DM_API_SEARCH */bta_dm_search_cancel,             /* 1 BTA_DM_API_SEARCH_CANCEL */bta_dm_discover,                  /* 2 BTA_DM_API_DISCOVER */bta_dm_inq_cmpl,                  /* 3 BTA_DM_INQUIRY_CMPL */bta_dm_rmt_name,                  /* 4 BTA_DM_REMT_NAME */bta_dm_sdp_result,                /* 5 BTA_DM_SDP_RESULT */bta_dm_search_cmpl,               /* 6 BTA_DM_SEARCH_CMPL */

执行的就是bta_dm_search_cmpl：

/*******************************************************************************
**
** Function         bta_dm_search_cmpl
**
** Description      Sends event to application
**
** Returns          void
**
*******************************************************************************/
void bta_dm_search_cmpl (tBTA_DM_MSG *p_data)
{APPL_TRACE_EVENT("%s", __func__);
...if (p_data->hdr.layer_specific == BTA_DM_API_DI_DISCOVER_EVT)bta_dm_di_disc_cmpl(p_data);elsebta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, NULL);
#endif
}

函数如注释阐明的那样：Sends event to application

我们前面已经分析过bta_dm_search_cb.p_search_cback=bte_search_devices_evt ，这次传入的事件是BTA_DM_DISC_CMPL_EVT

bte_search_devices_evt --->继续进入到btif_dm_search_devices_evt:

  /******************************************************************************
**
** Function         btif_dm_search_devices_evt
**
** Description      Executes search devices callback events in btif context
**
** Returns          void
**
******************************************************************************/
static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
{tBTA_DM_SEARCH *p_search_data;BTIF_TRACE_EVENT("%s event=%s", __FUNCTION__, dump_dm_search_event(event));switch (event){
...case BTA_DM_DISC_CMPL_EVT:{HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED);}break;
...

这一段其实再第一部分已经分析过，当传入的事件是BTA_DM_DISC_CMPL_EVT，那么就会调用：HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED); 来通知上层。

其实也就是说，即便一条设备信息也搜索不到，那么也会发送BTA_DM_SEARCH_CMPL_EVT---->BTA_DM_DISC_CMPL_EVT --->调用HAL_CBACK：BT_DISCOVERY_STOPPED 来通知上层。

到这里 inquiry complete的流程就已经分析完毕了。

总结：

　　Inquiry Complete

update level busy，（btm_acl_update_busy_level）并不会上报到java层
执行bta_dm_inq_cmpl_cb
1. bta_dm_search_cb.p_search_cback(BTA_DM_INQ_CMPL_EVT, &data); 该函数不会通知上层，
2. 有搜索到设备，进行discovery
3. 没有搜索到设备，上报BTA_DM_SEARCH_CMPL_EVT ，并通知到上层。

转载于:https://www.cnblogs.com/libs-liu/p/9223989.html