Android14 WiFi 打开流程

目次
0.概览
1.App-->Framework状态机的流程
1.0 StateMachine底子知识
1.1 WifiEnabler
1.2 WifiManager
1.3 WifiServiceImpl
1.4 ActiveModeWarden
WifiController状态机
1.5 ConcreteClientModeManager
ClientModeStateMachine状态机
IdleState的处理惩罚
StartedState的处理惩罚
ConnectModeState
1.6 ClientModeImpl
2.WifiNative-->Hal流程
2.1 setupInterfaceForClientInScanMode 初始化interface
2.1.1 加载驱动和初始化vendor HAL接口
【流程概览】
【Java层的处理惩罚】
【Hal层的处理惩罚】
2.1.2 创建sta interface
【流程概览】
【Java层的处理惩罚】
【Hal层的处理惩罚】
2.1.3 wificond配置 interface
2.1.4 小结
2.2 switchClientInterfaceToConnectivityMode 启动supplicant
2.2.1 WifiNative
2.2.2 SupplicantStaIfaceHalAidlImpl.startDaemon()流程
【Java层流程】
【JNI层】
【Native层流程】
参考链接：

---

0.概览

本篇介绍Android14  WiFi 的 Enable流程。
        我们可以在 Settings界面上举行 开/关 Wi-Fi 的操作，打开Wi-Fi涉及的流程比力多，这里先给出大概的流程有个整体的印象，后文会结合源码举行分析。

① WiFi Enable 过程中，Framework层涉及3个状态机：

② 抛开Framework层各种状态的切换，Enable WiFi的操作终极是由 WifiNative 的两个方法触发的：
    1.setupInterfaceForClientInScanMode()启动扫描模式：加载驱动和vendor hal、wificond配置interface等;
    2.switchClientInterfaceToConnectivityMode()切换到连接模式：启动supplicant服务。

1.App-->Framework状态机的流程

        下面分析wifi打开过程中，从 App 到 Framework状态机的流程，下图给出了涉及的关键类：

1.0 StateMachine底子知识

        Android状态机的重要工作是消息处理惩罚和状态切换。它通过界说一组状态和状态之间的切换，来控制相关运动。
StateMachine路径为：
frameworks/libs/modules-utils/java/com/android/internal/util/StateMachine.java
①State基本结构：
        enter()：在状态机转入这个状态时调用的方法；
        exit()：在状态机转出这个状态时调用的方法。
        processMessage()：用于处理惩罚当前状态的消息。如果当前状态处理惩罚不了，则将消息交给父状态处理惩罚。若根状态依然无法处理惩罚，则将变乱抛弃并通知体系。
②StateMachine重要API：
        addState()：添加状态
        setInitialState()：设置初始状态
        start()：启动状态机
        transitionTo()：用于切换状态。在切换过程中，会自动调用旧状态的exit()方法和新状态的enter()方法。
        deferMessage()：将消息缓存，直到下一次状态切换完成后处理惩罚。
        ...

1.1 WifiEnabler

        应用层通过 Context.getSystemService 来获取 WifiManager对象，并通过它调用wifi服务的接口：

1. //packages/apps/Settings/src/com/android/settings/wifi/WifiEnabler.java
2. public class WifiEnabler implements SwitchWidgetController.OnSwitchChangeListener  {
4.     ...
5.     private final WifiManager mWifiManager;
7.     WifiEnabler(Context context, SwitchWidgetController switchWidget,
8.             MetricsFeatureProvider metricsFeatureProvider,
9.             ConnectivityManager connectivityManager) {
10.         mContext = context;
11.         ...
12.         //1.获取 WifiManager 实例
13.         mWifiManager = (WifiManager) context.getSystemService(Context.WIFI_SERVICE);
14.         ...
15.     }
16.    
17.     public boolean onSwitchToggled(boolean isChecked) {
18.         ...
19.         //2.调用 WifiManager的 setWifiEnabled 函数，实现开关wifi
20.         if (!mWifiManager.setWifiEnabled(isChecked)) {
21.             // Error
22.             ...
23.         }
24.         return true;
25.     }

复制代码

1.2 WifiManager

        WifiManager是袒露给应用的api接口类：

1. //packages/modules/Wifi/framework/java/android/net/wifi/WifiManager.java
2. package android.net.wifi;
3. ...
4. @SystemService(Context.WIFI_SERVICE)
5. public class WifiManager {
6.     ...
7.     IWifiManager mService;
8.     ...
9.     public boolean setWifiEnabled(boolean enabled) {
10.         try {
11.             //通过AIDL调用 WifiServiceImpl 的方法
12.             return mService.setWifiEnabled(mContext.getOpPackageName(), enabled);
13.         } catch (RemoteException e) {
14.             throw e.rethrowFromSystemServer();
15.         }
16.     }

复制代码

1.3 WifiServiceImpl

1. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiServiceImpl.java
2. /**
3. * see {@link android.net.wifi.WifiManager#setWifiEnabled(boolean)}
4. * @param enable {@code true} to enable, {@code false} to disable.
5. * @return {@code true} if the enable/disable operation was
6. *         started or is already in the queue.
7. */
8. @Override
9. public synchronized boolean setWifiEnabled(String packageName, boolean enable) {
10.     ...
11.     setWifiEnabledInternal(packageName, enable, callingUid, callingPid, isPrivileged);
12.     return true;
13. }
14. private void setWifiEnabledInternal(String packageName, boolean enable,
15.         int callingUid, int callingPid, boolean isPrivileged) {
16.     //打印关键信息：
17.     mLog.info("setWifiEnabled package=% uid=% enable=% isPrivileged=%").c(packageName)
18.             .c(callingUid).c(enable).c(isPrivileged).flush();
19.     ...
20.     //关注点：调用 ActiveModeWarden 的方法
21.     mActiveModeWarden.wifiToggled(new WorkSource(callingUid, packageName));
22.     ...
23. }

复制代码

1.4 ActiveModeWarden

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ActiveModeWarden.java
2. /**
3. * This class provides the implementation for different WiFi operating modes.
4. */
5. public class ActiveModeWarden {
6.     private static final String TAG = "WifiActiveModeWarden";
7.     ...
8.     /** Wifi has been toggled. */
9.     public void wifiToggled(WorkSource requestorWs) {
10.         //1.向 WifiController 状态机发送 CMD_WIFI_TOGGLED 消息：
11.         mWifiController.sendMessage(WifiController.CMD_WIFI_TOGGLED, requestorWs);
12.     }

复制代码

WifiController状态机

        WifiController 是ActiveModeWarden的内部类，是一个状态机，来看下它的构造函数：

1. /**
2. * WifiController is the class used to manage wifi state for various operating
3. * modes (normal, airplane, wifi hotspot, etc.).
4. */
5. private class WifiController extends StateMachine {
6.     ...
7.     //                       DefaultState
8.     //                      /           \
9.     //   DisabledState（初始状态）        EnabledState
10.     // 在 WifiController.start方法中，会设置初始状态为 DisabledState
11.     // wifi打开过程中的状态切换：DisabledState --> EnabledState
12.     WifiController() {
13.         super(TAG, mLooper);
14.         final int threshold = mContext.getResources().getInteger(
15.                 R.integer.config_wifiConfigurationWifiRunnerThresholdInMs);
16.         DefaultState defaultState = new DefaultState(threshold);
17.         mEnabledState = new EnabledState(threshold);
18.         mDisabledState = new DisabledState(threshold);
19.         addState(defaultState); {
20.             addState(mDisabledState, defaultState);
21.             addState(mEnabledState, defaultState);
22.         }
23.         ...
24.     }

复制代码

当前处于DisabledState状态， 来看下 CMD_WIFI_TOGGLED 消息的处理惩罚：

1. class DisabledState extends BaseState {
2.     ...
3.     @Override
4.     public boolean processMessageFiltered(Message msg) {
5.         switch (msg.what) {
6.             case CMD_WIFI_TOGGLED:
7.             case CMD_SCAN_ALWAYS_MODE_CHANGED:
8.                 handleStaToggleChangeInDisabledState((WorkSource) msg.obj);
9.                 break;
10.             ...
11.             default:
12.                 return NOT_HANDLED;
13.         }
14.         return HANDLED;
15.     }
16.     ...
17. }
18. private void handleStaToggleChangeInDisabledState(WorkSource requestorWs) {
19.     if (shouldEnableSta()) {
20.         //1.会触发启动wifi流程
21.         startPrimaryOrScanOnlyClientModeManager(requestorWs);
22.         //2.状态切换到EnabledState
23.         transitionTo(mEnabledState);
24.     }
25. }
26. /**
27. * Method to enable a new primary client mode manager.
28. */
29. private boolean startPrimaryOrScanOnlyClientModeManager(WorkSource requestorWs) {
30.     ActiveModeManager.ClientRole role = getRoleForPrimaryOrScanOnlyClientModeManager();
31.     if (role == ROLE_CLIENT_PRIMARY) {//走这个分支
32.         return startPrimaryClientModeManager(requestorWs);
33.     } else if (role == ROLE_CLIENT_SCAN_ONLY) {
34.         return startScanOnlyClientModeManager(requestorWs);
35.     } else {
36.         return false;
37.     }
38. }  
39. /**
40. * Method to enable a new primary client mode manager in connect mode.
41. */
42. private boolean startPrimaryClientModeManager(WorkSource requestorWs) {
43.     ...
44.     Log.d(TAG, "Starting primary ClientModeManager in connect mode");
45.     //创建 ConcreteClientModeManager 对象（会去启动wifi）
46.     ConcreteClientModeManager manager = mWifiInjector.makeClientModeManager(
47.             new ClientListener(), requestorWs, ROLE_CLIENT_PRIMARY, mVerboseLoggingEnabled);
48.     mClientModeManagers.add(manager);
49.     mLastPrimaryClientModeManagerRequestorWs = requestorWs;
50.     return true;
51. }
53. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiInjector.java
54. /**
55. * Create a ClientModeManager
56. *
57. * @param listener listener for ClientModeManager state changes
58. * @return a new instance of ClientModeManager
59. */
60. public ConcreteClientModeManager makeClientModeManager(
61.         @NonNull ClientModeManager.Listener<ConcreteClientModeManager> listener,
62.         @NonNull WorkSource requestorWs,
63.         @NonNull ActiveModeManager.ClientRole role,
64.         boolean verboseLoggingEnabled) {
65.     return new ConcreteClientModeManager(
66.             mContext, mWifiHandlerThread.getLooper(), mClock,
67.             mWifiNative, listener, mWifiMetrics, mWakeupController,
68.             this, mSelfRecovery, mWifiGlobals, mDefaultClientModeManager,
69.             mClock.getElapsedSinceBootMillis(), requestorWs, role, mBroadcastQueue,
70.             verboseLoggingEnabled);
71. }

复制代码

1.5 ConcreteClientModeManager

来看下ConcreteClientModeManager 的构造函数：

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ConcreteClientModeManager.java
2. ConcreteClientModeManager(
3.         Context context, @NonNull Looper looper, Clock clock,
4.         WifiNative wifiNative, @NonNull Listener<ConcreteClientModeManager> listener,
5.         WifiMetrics wifiMetrics,
6.         WakeupController wakeupController, WifiInjector wifiInjector,
7.         SelfRecovery selfRecovery, WifiGlobals wifiGlobals,
8.         DefaultClientModeManager defaultClientModeManager, long id,
9.         @NonNull WorkSource requestorWs, @NonNull ClientRole role,
10.         @NonNull ClientModeManagerBroadcastQueue broadcastQueue,
11.         boolean verboseLoggingEnabled) {
12.     ...
13.     //1.创建并启动 ClientModeStateMachine 状态机
14.     mStateMachine = new ClientModeStateMachine(looper);
15.     ...
16.     //2.向状态机发送CMD_START的消息
17.     mStateMachine.sendMessage(ClientModeStateMachine.CMD_START, mTargetRoleChangeInfo);
18. }

复制代码

ClientModeStateMachine状态机

        ClientModeStateMachine 是 ConcreteClientModeManager的内部类，来看下它的构造函数：

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ConcreteClientModeManager.java
2. //                IdleState(初始状态)
3. //                     |
4. //                StartedState
5. //              /               \
6. //      ScanOnlyModeState       ConnectModeState
7. //Wifi打开过程中的状态切换：IdleState-->StartedState-->ConnectModeState
8. ClientModeStateMachine(Looper looper) {
9.     super(TAG, looper);
10.     final int threshold = mContext.getResources().getInteger(
11.             R.integer.config_wifiConfigurationWifiRunnerThresholdInMs);
12.     mIdleState = new IdleState(threshold);
13.     mStartedState = new StartedState(threshold);
14.     mScanOnlyModeState = new ScanOnlyModeState(threshold);
15.     mConnectModeState = new ConnectModeState(threshold);
16.     addState(mIdleState);
17.         addState(mStartedState, mIdleState);
18.             addState(mScanOnlyModeState, mStartedState);
19.             addState(mConnectModeState, mStartedState);
21.     //设置初始状态
22.     setInitialState(mIdleState);
23.     start();
24. }

复制代码

IdleState的处理惩罚

        当前处于 IdleState 状态， 来看下 CMD_START消息的处理惩罚：

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ConcreteClientModeManager.java
2. private class IdleState extends RunnerState {
3.     ...
4.     @Override
5.     public boolean processMessageImpl(Message message) {
6.         if (mVerboseLoggingEnabled) {
7.             Log.d(getTag(),
8.                     getName() + " cmd = " + getWhatToString(message.what) + " "
9.                             + message.toString());
10.         }
11.         switch (message.what) {
12.             case CMD_START:
13.                 // Always start in scan mode first.
14.                 RoleChangeInfo roleChangeInfo = (RoleChangeInfo) message.obj;
15.                 //1.调用WifiNative方法去创建wlan接口(会加载驱动和vendor hal)
16.                 mClientInterfaceName = mWifiNative.setupInterfaceForClientInScanMode(
17.                         mWifiNativeInterfaceCallback, roleChangeInfo.requestorWs,
18.                         ConcreteClientModeManager.this);
19.                 ...
20.                 mWifiNative.setWifiNativeInterfaceEventCallback(
21.                         mWifiNativeInterfaceEventCallback);
22.                 if (roleChangeInfo.role instanceof ClientConnectivityRole) {//进入这个分支
23.                     //2.发送 CMD_SWITCH_TO_CONNECT_MODE，会触发supplicant的启动
24.                     sendMessage(CMD_SWITCH_TO_CONNECT_MODE, roleChangeInfo);
25.                     // 切换到 StartedState 状态
26.                     transitionTo(mStartedState);
27.                 } else {
28.                     mScanRoleChangeInfoToSetOnTransition = roleChangeInfo;
29.                     transitionTo(mScanOnlyModeState);
30.                 }
31.                 break;
32.             ...
33.         }
34.         return HANDLED;
35.     }

复制代码

从上面看出，IdleState 处理惩罚CMD_START消息过程中：
        1.会调用 WifiNative.setupInterfaceForClientInScanMode()去创建 wlan 接口进入扫描模式，具体流程会放到下一节举行分析。
        2.会切换到 StartedState 状态，来看下 CMD_SWITCH_TO_CONNECT_MODE 消息的处理惩罚：
StartedState的处理惩罚

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ConcreteClientModeManager.java
2. private class StartedState extends RunnerState {
3.     ...
4.     @Override
5.     public boolean processMessageImpl(Message message) {
6.         if (mVerboseLoggingEnabled) {
7.             Log.d(getTag(),
8.                     getName() + " cmd = " + getWhatToString(message.what) + " "
9.                             + message.toString());
10.         }
11.         switch (message.what) {
12.             ...
13.             case CMD_SWITCH_TO_CONNECT_MODE: {
14.                 RoleChangeInfo roleChangeInfo = (RoleChangeInfo) message.obj;
15.                 updateConnectModeState(roleChangeInfo.role,
16.                         WifiManager.WIFI_STATE_ENABLING,
17.                         WifiManager.WIFI_STATE_DISABLED);
18.                 //1.调用WifiNative方法，将接口切换到连接模式。会触发supplicant的启动
19.                 if (!mWifiNative.switchClientInterfaceToConnectivityMode(
20.                         mClientInterfaceName, roleChangeInfo.requestorWs)) {
21.                     ...
22.                     break;
23.                 }
24.                 // Role set in the enter of ConnectModeState.
25.                 mConnectRoleChangeInfoToSetOnTransition = roleChangeInfo;
26.                 //2.切换状态
27.                 transitionTo(mConnectModeState);
28.                 break;
29.         }

复制代码

从上面看出，StartedState 处理惩罚CMD_SWITCH_TO_CONNECT_MODE消息过程中：
        1.会调用 WifiNative.switchClientInterfaceToConnectivityMode() 将设备接口切换到连接模式，从而触发 supplicant服务的启动。具体流程会在下一节分析；
        2.会切换到 ConnectModeState 状态：
ConnectModeState

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ConcreteClientModeManager.java
2. private class ConnectModeState extends RunnerState {
3.     ...
4.     @Override
5.     public void enterImpl() {
6.         Log.d(getTag(), "entering ConnectModeState, starting ClientModeImpl");
7.         if (mClientInterfaceName == null) {
8.             Log.e(getTag(), "Supposed to start ClientModeImpl, but iface is null!");
9.         } else {
10.             if (mClientModeImpl != null) {
11.                 Log.e(getTag(), "ConnectModeState.enter(): mClientModeImpl is already "
12.                         + "instantiated?!");
13.             }
14.             //实例化 ClientModeImpl 状态机(ClientModeImpl构造函数中会启动状态机)
15.             mClientModeImpl = mWifiInjector.makeClientModeImpl(
16.                     mClientInterfaceName, ConcreteClientModeManager.this,
17.                     mVerboseLoggingEnabled);
18.             ...
19.         }
20. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiInjector.java
21. /**
22. * Create a ClientModeImpl
23. * @param ifaceName interface name for the ClientModeImpl
24. * @param clientModeManager ClientModeManager that will own the ClientModeImpl
25. */
26. public ClientModeImpl makeClientModeImpl(
27.         @NonNull String ifaceName,
28.         @NonNull ConcreteClientModeManager clientModeManager,
29.         boolean verboseLoggingEnabled) {
30.     ExtendedWifiInfo wifiInfo = new ExtendedWifiInfo(mWifiGlobals, ifaceName);
31.     //1.创建 SupplicantStateTracker 状态机；
32.     SupplicantStateTracker supplicantStateTracker = new SupplicantStateTracker(...);
33.     //2.创建并返回 ClientModeImpl 状态机
34.     return new ClientModeImpl(mContext, ..., supplicantStateTracker, ...);
35. }

复制代码

1.6 ClientModeImpl

        来看下 ClientModeImpl 的构造函数：

1. //packages/modules/Wifi/service/java/com/android/server/wifi/ClientModeImpl.java
2. /**
3. * Implementation of ClientMode.  Event handling for Client mode logic is done here,
4. * and all changes in connectivity state are initiated here.
5. *
6. * Note: No external modules should be calling into {@link ClientModeImpl}. Please plumb it via
7. * {@link ClientModeManager} until b/160014176 is fixed.
8. */
9. public class ClientModeImpl extends StateMachine implements ClientMode {
10.     ...
11.     /** Note that this constructor will also start() the StateMachine. */
12.     public ClientModeImpl(
13.         @NonNull WifiContext context,
14.         ...
15.         @NonNull WifiNotificationManager wifiNotificationManager) {
16.             //...
17.             //1.构建状态树:
18.             //                                           ConnectableState
19.             //                                      /                     \
20.             //              ConnectingOrConnectedState              DisconnectedState(初始状态)
21.             //                  /                          \
22.             //       L2ConnectingState             L2ConnectedState
23.             //                                /             |                \               \
24.             //    WaitBeforeL3ProvisioningState    L3ProvisioningState    L3ConnectedState    RoamingState
25.             addState(mConnectableState); {
26.                 addState(mConnectingOrConnectedState, mConnectableState); {
27.                     addState(mL2ConnectingState, mConnectingOrConnectedState);
28.                     addState(mL2ConnectedState, mConnectingOrConnectedState); {
29.                         addState(mWaitBeforeL3ProvisioningState, mL2ConnectedState);
30.                         addState(mL3ProvisioningState, mL2ConnectedState);
31.                         addState(mL3ConnectedState, mL2ConnectedState);
32.                         addState(mRoamingState, mL2ConnectedState);
33.                     }
34.                 }
35.                 addState(mDisconnectedState, mConnectableState);
36.             }
37.         
38.             //2.设置初始状态为 DisconnectedState
39.             setInitialState(mDisconnectedState);
40.         
41.             setLogOnlyTransitions(false);
42.         
43.             //3.启动状态机
44.             start();
45.             ...
46.         }

复制代码

至此，wifi打开过程中，Framework层涉及的3个重要状态机已初步介绍完毕： 

状态机	描述	状态切换
ActiveModeWarden$WifiController	记录上层的WiFi开关状态	DisabledState -> EnabledState
ConcreteClientModeManager$ClientModeStateMachine	WiFi的设备状态	IdleState -> StartedState -> ConnectModeState
ClientModeImpl	管理WiFi的连接状态	DisconnectedState

接下来将介绍 WifiNative 的两个重要方法：
1.setupInterfaceForClientInScanMode()启动扫描模式：加载驱动和vendor hal、wificond配置interface;
2.switchClientInterfaceToConnectivityMode()切换到连接模式：会触发supplicant服务的启动


2.WifiNative-->Hal流程

2.1 setupInterfaceForClientInScanMode 初始化interface

1. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
2. /**
3. * Setup an interface for client mode (for scan) operations.
4. *
5. * This method configures an interface in STA mode in the native daemons
6. * (wificond, vendor HAL).
7. *
8. * @param interfaceCallback Associated callback for notifying status changes for the iface.
9. * @param requestorWs Requestor worksource.
10. * @param concreteClientModeManager ConcreteClientModeManager requesting the interface.
11. * @return Returns the name of the allocated interface, will be null on failure.
12. */
13. public String setupInterfaceForClientInScanMode(
14.         @NonNull InterfaceCallback interfaceCallback, @NonNull WorkSource requestorWs,
15.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
16.     synchronized (mLock) {
17.         //1.加载驱动和vendor hal
18.         if (!startHal()) {
19.             ...
20.         }
21.         //2.创建并初始化 Iface
22.         Iface iface = mIfaceMgr.allocateIface(Iface.IFACE_TYPE_STA_FOR_SCAN);
23.         ...
24.         iface.externalListener = interfaceCallback;
25.         iface.name = createStaIface(iface, requestorWs, concreteClientModeManager);
26.         ...
27.         //3.wificond 对 iface 进行配置
28.         if (!mWifiCondManager.setupInterfaceForClientMode(iface.name, Runnable::run,
29.                 new NormalScanEventCallback(iface.name),
30.                 new PnoScanEventCallback(iface.name))) {
31.             ...
32.         }
33.         //4.监听interface的 up/down
34.         registerInterfaceObserver();
35.         iface.networkObserver = new NetworkObserverInternal(iface.id);
36.         if (!registerNetworkObserver(iface.networkObserver)) {
37.             ...
38.         }
39.         //5.开启supplicant监听（此时supplicant还未启动）
40.         mWifiMonitor.startMonitoring(iface.name);
41.         // Just to avoid any race conditions with interface state change callbacks,
42.         // update the interface state before we exit.
43.         onInterfaceStateChanged(iface, isInterfaceUp(iface.name));
44.         mWifiVendorHal.enableLinkLayerStats(iface.name);
45.         Log.i(TAG, "Successfully setup " + iface);
47.         //6.获取芯片支持的wifi特征
48.         iface.featureSet = getSupportedFeatureSetInternal(iface.name);
49.         updateSupportedBandForStaInternal(iface);
51.         mWifiVendorHal.enableStaChannelForPeerNetwork(mContext.getResources().getBoolean(
52.                         R.bool.config_wifiEnableStaIndoorChannelForPeerNetwork),
53.                 mContext.getResources().getBoolean(
54.                         R.bool.config_wifiEnableStaDfsChannelForPeerNetwork));
55.         return iface.name;
56.     }
57. }

复制代码

2.1.1 加载驱动和初始化vendor HAL接口

【流程概览】

【Java层的处理惩罚】

① WifiNative.startHal() --> WifiVendorHal.startVendorHal() --> HalDeviceManager.start() --> startWifi()

1. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
2. /** Helper method invoked to start supplicant if there were no ifaces */
3. private boolean startHal() {
4.     synchronized (mLock) {
5.         if (!mIfaceMgr.hasAnyIface()) {//如果没有Iface
6.             if (mWifiVendorHal.isVendorHalSupported()) {//如果支持vendor hal
7.                 if (!mWifiVendorHal.startVendorHal()) {//启动vendor hal
8.                     Log.e(TAG, "Failed to start vendor HAL");
9.                     return false;
10.                 }
11.                 ...
12.             } ...
13.         }
14.         registerWificondListenerIfNecessary();
15.         return true;
16.     }
17. }
18. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiVendorHal.java
19. /**
20. * Bring up the Vendor HAL.
21. * @return true on success, false otherwise.
22. */
23. public boolean startVendorHal() {
24.     synchronized (sLock) {
25.         if (!mHalDeviceManager.start()) {//关键
26.             mLog.err("Failed to start vendor HAL").flush();
27.             return false;
28.         }
29.         //打印信息：
30.         mLog.info("Vendor Hal started successfully").flush();
31.         return true;
32.     }
33. }
34. //packages/modules/Wifi/service/java/com/android/server/wifi/HalDeviceManager.java
35. /**
36. * Attempts to start Wi-Fi. Returns the success (true) or failure (false) or
37. * the start operation. Will also dispatch any registered ManagerStatusCallback.onStart() on
38. * success.
39. */
40. public boolean start() {
41.     return startWifi();
42. }
43. private boolean startWifi() {
44.     if (VDBG) Log.d(TAG, "startWifi");
45.     //初始化 Wi-Fi HAL service（其实在SystemServer启动WifiService时，会初始化Wi-Fi HAL service，所以这里是为了确保）
46.     initializeInternal();
47.     synchronized (mLock) {
48.         int triedCount = 0;
49.         while (triedCount <= START_HAL_RETRY_TIMES) {//最多尝试启动三次
50.             //1.调用wifi hal的start方法去启动
51.             int status = mWifiHal.start();
52.             if (status == WifiHal.WIFI_STATUS_SUCCESS) {
53.                 ...
54.                 //2.获取所有芯片信息
55.                 WifiChipInfo[] wifiChipInfos = getAllChipInfo();
56.                 ...
57.                 return true;
58.             } ...
59.         }
60.         Log.e(TAG, "Cannot start IWifi after trying " + triedCount + " times");
61.         return false;
62.     }
63. }

复制代码

② WifiHal.start() --> WifiHalAidlImpl.start()

1. //************************** 来看下 WifiHal 的start 方法 *************************
2. //packages/modules/Wifi/service/java/com/android/server/wifi/hal/WifiHal.java
3. /**
4. * See comments for {@link IWifiHal#start()}
5. */
6. public @WifiStatusCode int start() {
7.     return validateAndCall("start", WIFI_STATUS_ERROR_UNKNOWN,
8.             () -> mWifiHal.start());
9. }
10. //packages/modules/Wifi/service/java/com/android/server/wifi/hal/WifiHalAidlImpl.java
11. public class WifiHalAidlImpl implements IWifiHal {
12.     private static final String TAG = "WifiHalAidlImpl";
13.     private static final String HAL_INSTANCE_NAME =
14.             android.hardware.wifi.IWifi.DESCRIPTOR + "/default";
16.     private android.hardware.wifi.IWifi mWifi;
18.     /**
19.      * See comments for {@link IWifiHal#start()}
20.      */
21.     @Override
22.     public @WifiHal.WifiStatusCode int start() {
23.         final String methodStr = "start";
24.         synchronized (mLock) {
25.             try {
26.                 if (!checkWifiAndLogFailure(methodStr)) return WifiHal.WIFI_STATUS_ERROR_UNKNOWN;
27.                 //调用 wifi hal 服务的 start 方法
28.                 mWifi.start();
29.                 return WifiHal.WIFI_STATUS_SUCCESS;
30.             } ...
31.         }
32.     }

复制代码

【Hal层的处理惩罚】

1. //**************************** HAL层的处理 ****************************
2. //hardware/interfaces/wifi/aidl/default/wifi.cpp
3. ndk::ScopedAStatus Wifi::start() {
4.     return validateAndCall(this, WifiStatusCode::ERROR_UNKNOWN, &Wifi::startInternal);
5. }
6. ndk::ScopedAStatus Wifi::startInternal() {
7.     ...
8.     //关注点1：加载驱动和初始化vendor hal
9.     ndk::ScopedAStatus wifi_status = initializeModeControllerAndLegacyHal();
10.     if (wifi_status.isOk()) {
11.         // Register the callback for subsystem restart
12.         ...
14.         //关注点2：当HAL启动后，创建chip实例
15.         // Create the chip instance once the HAL is started.
16.         int32_t chipId = kPrimaryChipId;
17.         for (auto& hal : legacy_hals_) {
18.             chips_.push_back(
19.                     WifiChip::create(chipId, chipId == kPrimaryChipId, hal, mode_controller_,
20.                                      std::make_shared<iface_util::WifiIfaceUtil>(iface_tool_, hal),
21.                                      feature_flags_, on_subsystem_restart_callback, false));
22.             chipId++;
23.         }
24.         ...
25.         LOG(INFO) << "Wifi HAL started";
26.     } ...
27.     return wifi_status;
28. }

复制代码

继承跟踪驱动的加载、vendor hal 接口的初始化流程：

1. //hardware/interfaces/wifi/aidl/default/wifi.cpp
2. ndk::ScopedAStatus Wifi::initializeModeControllerAndLegacyHal() {
3.     //1.1.加载驱动
4.     if (!mode_controller_->initialize()) {
5.         ...
6.     }
8.     //1.2.获取vendor hal
9.     legacy_hals_ = legacy_hal_factory_->getHals();
10.     if (legacy_hals_.empty()) return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
11.     ...
12.     for (auto& hal : legacy_hals_) {
13.         //1.3.初始化legacy_hal(目前没做什么)
14.         legacy_hal::wifi_error legacy_status = hal->initialize();
15.         ...
16.     }
17.     return ndk::ScopedAStatus::ok();
18. }
19. //1.1加载驱动流程：
20. //hardware/interfaces/wifi/aidl/default/wifi_mode_controller.cpp
21. bool WifiModeController::initialize() {
22.     if (!driver_tool_->LoadDriver()) {
23.         LOG(ERROR) << "Failed to load WiFi driver";
24.         return false;
25.     }
26.     return true;
27. }
28. //1.2 获取vendor hal流程：
29. //hardware/interfaces/wifi/aidl/default/wifi_legacy_hal_factory.cpp
30. std::vector<std::shared_ptr<WifiLegacyHal>> WifiLegacyHalFactory::getHals() {
31.     if (legacy_hals_.empty()) {
32.         //1.2.1 先从已链接的so库中初始化vendor hal（对函数指针进行赋值）;
33.         //1.2.2 如果失败，说明是多wifi芯片的设备（Android12开始支持多wifi芯片），需要从 xml 文件中解析vendor hal信息并进行初始化
34.         if (!initVendorHalDescriptorFromLinked()) initVendorHalsDescriptorList();
35.         for (auto& desc : descs_) {
36.             std::shared_ptr<WifiLegacyHal> hal =
37.                     std::make_shared<WifiLegacyHal>(iface_tool_, desc.fn, desc.primary);
38.             legacy_hals_.push_back(hal);
39.         }
40.     }
42.     return legacy_hals_;
43. }
44. //1.2.1 流程跟踪：
45. bool WifiLegacyHalFactory::initVendorHalDescriptorFromLinked() {
46.     wifi_hal_lib_desc desc;
48.     if (!initLinkedHalFunctionTable(&desc.fn)) return false;
49.     ...
50.     return true;
51. }
52. bool WifiLegacyHalFactory::initLinkedHalFunctionTable(wifi_hal_fn* hal_fn) {
53.     init_wifi_vendor_hal_func_table_t initfn;
55.     //在已经链接的库中查找 init_wifi_vendor_hal_func_table 方法
56.     initfn = (init_wifi_vendor_hal_func_table_t)dlsym(RTLD_DEFAULT,
57.                                                       "init_wifi_vendor_hal_func_table");
58.     if (!initfn) {
59.         LOG(INFO) << "no vendor HAL library linked, will try dynamic load";
60.         return false;
61.     }
63.     //先给 wifi_hal_fn 的所有函数指针赋一个空实现，否则会是null，后面上层调用时会报错
64.     if (!initHalFuncTableWithStubs(hal_fn)) {
65.         LOG(ERROR) << "Can not initialize the basic function pointer table";
66.         return false;
67.     }
69.     //调用 init_wifi_vendor_hal_func_table 方法，具体是由vendor提供的legacy_hal实现的，一般只是初始化函数指针。
70.     if (initfn(hal_fn) != WIFI_SUCCESS) {
71.         LOG(ERROR) << "Can not initialize the vendor function pointer table";
72.         return false;
73.     }
75.     return true;
76. }

复制代码

我们可以从 libwifi-hal 中的Android.bp 看下库的配置：
文件路径：frameworks/opt/net/wifi/libwifi_hal/Android.bp（选取部分内容）

1. soong_config_module_type {
2.     name: "wifi_cc_defaults",
3.     module_type: "cc_defaults",
4.     config_namespace: "wifi",
5.     bool_variables: [
6.         "multiple_vendor_hals", // WIFI_MULTIPLE_VENDOR_HALS
7.         "google_wifi_config_lib", // $(wildcard vendor/google/libraries/GoogleWifiConfigLib)
8.     ],
9.     value_variables: [
10.         "driver_module_path", // WIFI_DRIVER_MODULE_PATH
11.         "driver_module_arg", // WIFI_DRIVER_MODULE_ARG
12.         "driver_module_name", // WIFI_DRIVER_MODULE_NAME
13.         "driver_fw_path_sta", // WIFI_DRIVER_FW_PATH_STA
14.         ...
15.         "driver_state_off", // WIFI_DRIVER_STATE_OFF
16.     ],
17.     variables: [
18.         "board_wlan_device", // BOARD_WLAN_DEVICE
19.     ],
20.     ...
21. }
23. soong_config_string_variable {
24.     name: "board_wlan_device",
25.     values: [
26.         "bcmdhd",
27.         "synadhd",
28.         "qcwcn",
29.         ...
30.         "realtek",
31.         "emulator",
32.         "rtl",
33.         "slsi",
34.         "wlan0",
35.     ],
36. }
38. wifi_cc_defaults {
39.     name: "libwifi_hal_vendor_impl_defaults",
40.     soong_config_variables: {
41.         board_wlan_device: {
42.             bcmdhd: {
43.                 whole_static_libs: ["libwifi-hal-bcm"],
44.             },
45.             ...
46.         },
47.     },
48. }
51. cc_library_shared {
52.     name: "libwifi-hal",
53.     proprietary: true,
54.     compile_multilib: "first",
55.     defaults: [
56.         "libwifi_hal_cflags_defaults",
57.         "libwifi_hal_vendor_deps_defaults", // shared_libs used by libwifi-hal-<vendor>
58.         "libwifi_hal_vendor_impl_defaults",
59.     ],
60.     ...
61.     srcs: [
62.         "driver_tool.cpp",
63.         "hal_tool.cpp",
64.     ],
65.     whole_static_libs: ["libwifi-hal-common"],
66.     // b/242259479 remove this
67.     sanitize: {
68.         cfi: true,
69.         integer_overflow: true,
70.     },
71. }

复制代码

        一般我们会在 device/xxx/BoardConfig.mk 文件中配置我们使用的硬件信息，可以通过配置 BOARD_WLAN_DEVICE 这个宏来声明我们使用的 wifi 芯片型号。
        下面以单wifi芯片为例，看下厂商库相关初始化流程。以使用博通的芯片为例，会配置： BOARD_WLAN_DEVICE := bcmdhd，libwifi_hal 会链接静态库 libwifi-hal-bcm 。libwifi-hal-bcm 库的代码路径为：hardware/broadcom/wlan/bcmdhd/wifi_hal/。
来看下它的 init_wifi_vendor_hal_func_table 方法：

1. //hardware/broadcom/wlan/bcmdhd/wifi_hal/wifi_hal.cpp
2. /*initialize function pointer table with Broadcom HHAL API*/
3. wifi_error init_wifi_vendor_hal_func_table(wifi_hal_fn *fn)
4. {
5.     if (fn == NULL) {
6.         return WIFI_ERROR_UNKNOWN;
7.     }
8.     fn->wifi_initialize = wifi_initialize;
9.     fn->wifi_wait_for_driver_ready = wifi_wait_for_driver_ready;
10.     fn->wifi_cleanup = wifi_cleanup;
11.     fn->wifi_event_loop = wifi_event_loop;
12.     fn->wifi_get_supported_feature_set = wifi_get_supported_feature_set;
13.     fn->wifi_get_concurrency_matrix = wifi_get_concurrency_matrix;
14.     ...
15.     return WIFI_SUCCESS;
16. }

复制代码

可以看到，只是为函数指针赋值。

2.1.2 创建sta interface

【流程概览】

【Java层的处理惩罚】

重要调用链如下：
WifiNative.createStaIface() --> WifiVendorHal.createStaIface() --> HalDeviceManager.createStaIface() --> createStaIface() -->createIface()：
①HalDeviceManager.getAllChipInfo()
        -->WifiHal.getChip()
                -->IWifiHal.getChip() 
                        -->WifiHalAidlImpl.getChip()
                                 --> wifi.cpp::getChip()  //通过 hal 接口获取chip信息
                                 --> new WifiChip()       //创建WifiChip对象
②HalDeviceManager.createIfaceIfPossible() 
        -->getBestIfaceCreationProposal()；
        -->executeChipReconfiguration()
                -->WifiChip.configureChip()    //通过hal接口配置chip
                -->WifiChip.createStaIface()   //通过hal接口创建sta interface

下面是源码分析：

1. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
2. public String setupInterfaceForClientInScanMode(
3.         @NonNull InterfaceCallback interfaceCallback, @NonNull WorkSource requestorWs,
4.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
5.     synchronized (mLock) {
6.     ...
7.     //2.创建并初始化 Iface
8.     // 创建一个Iface对象
9.     Iface iface = mIfaceMgr.allocateIface(Iface.IFACE_TYPE_STA_FOR_SCAN);
10.     if (iface == null) {
11.         Log.e(TAG, "Failed to allocate new STA iface");
12.         return null;
13.     }
14.     iface.externalListener = interfaceCallback;
15.     //关注点：创建sta iface
16.     iface.name = createStaIface(iface, requestorWs, concreteClientModeManager);
17.     ...
18. }
20. /**
21. * Helper function to handle creation of STA iface.
22. * For devices which do not the support the HAL, this will bypass HalDeviceManager &
23. * teardown any existing iface.
24. */
25. private String createStaIface(@NonNull Iface iface, @NonNull WorkSource requestorWs,
26.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
27.     synchronized (mLock) {
28.         if (mWifiVendorHal.isVendorHalSupported()) {
29.             //调用 WifiVendorHal的方法
30.             return mWifiVendorHal.createStaIface(
31.                     new InterfaceDestoyedListenerInternal(iface.id), requestorWs,
32.                     concreteClientModeManager);
33.         } ...
34.     }
35. }
37. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiVendorHal.java
38. public String createStaIface(@Nullable InterfaceDestroyedListener destroyedListener,
39.         @NonNull WorkSource requestorWs,
40.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
41.     synchronized (sLock) {
42.         //关注点：调用 HalDeviceManager.createStaIface 方法
43.         WifiStaIface iface = mHalDeviceManager.createStaIface(
44.                 new StaInterfaceDestroyedListenerInternal(destroyedListener), mHalEventHandler,
45.                 requestorWs, concreteClientModeManager);
46.         ...
47.         //注册回调方法
48.         if (!registerStaIfaceCallback(iface)) {
49.             mLog.err("Failed to register STA iface callback").flush();
50.             return null;
51.         }
52.         ...
53.         return ifaceName;
54.     }
55. }
57. //packages/modules/Wifi/service/java/com/android/server/wifi/HalDeviceManager.java
58. public WifiStaIface createStaIface(
59.         @Nullable InterfaceDestroyedListener destroyedListener, @Nullable Handler handler,
60.         @NonNull WorkSource requestorWs,
61.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
62.     return createStaIface(CHIP_CAPABILITY_ANY, destroyedListener, handler, requestorWs,
63.             concreteClientModeManager);
64. }
65. public WifiStaIface createStaIface(
66.         long requiredChipCapabilities,
67.         @Nullable InterfaceDestroyedListener destroyedListener, @Nullable Handler handler,
68.         @NonNull WorkSource requestorWs,
69.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
70.     ...
71.     WifiStaIface staIface = (WifiStaIface) createIface(HDM_CREATE_IFACE_STA,
72.             requiredChipCapabilities, destroyedListener, handler, requestorWs);
73.     ...
74.     return staIface;
75. }
76. private WifiHal.WifiInterface createIface(@HdmIfaceTypeForCreation int createIfaceType,
77.         long requiredChipCapabilities, InterfaceDestroyedListener destroyedListener,
78.         Handler handler, WorkSource requestorWs) {
79.     ...
80.     synchronized (mLock) {
81.         //获取所有芯片信息
82.         WifiChipInfo[] chipInfos = getAllChipInfo();
83.         ...
85.         //关注点：createIfaceIfPossible
86.         return createIfaceIfPossible(
87.                 chipInfos, createIfaceType, requiredChipCapabilities,
88.                 destroyedListener, handler, requestorWs);
89.     }
90. }
91. private WifiHal.WifiInterface createIfaceIfPossible(
92.         WifiChipInfo[] chipInfos, @HdmIfaceTypeForCreation int createIfaceType,
93.         long requiredChipCapabilities, InterfaceDestroyedListener destroyedListener,
94.         Handler handler, WorkSource requestorWs) {
95.     int targetHalIfaceType = HAL_IFACE_MAP.get(createIfaceType);
96.     if (VDBG) {
97.         Log.d(TAG, "createIfaceIfPossible: chipInfos=" + Arrays.deepToString(chipInfos)
98.                 + ", createIfaceType=" + createIfaceType
99.                 + ", targetHalIfaceType=" + targetHalIfaceType
100.                 + ", requiredChipCapabilities=" + requiredChipCapabilities
101.                 + ", requestorWs=" + requestorWs);
102.     }
103.     synchronized (mLock) {
104.         //获取最合适的iface（暂不分析，一般都是单wifi芯片）
105.         IfaceCreationData bestIfaceCreationProposal = getBestIfaceCreationProposal(chipInfos,
106.                 createIfaceType, requiredChipCapabilities, requestorWs);
108.         if (bestIfaceCreationProposal != null) {
109.             //关注点：对芯片进行重新配置并返回新建的interface。这里会调用 wifi hal的方法
110.             WifiHal.WifiInterface iface = executeChipReconfiguration(bestIfaceCreationProposal,
111.                     createIfaceType);
112.             ...
113.         } else {
114.            ...
115.     }
116.     ...
117.     return null;
118. }
119. /**
120. * Performs chip reconfiguration per the input:
121. * - Removes the specified interfaces
122. * - Reconfigures the chip to the new chip mode (if necessary)
123. * - Creates the new interface
124. *
125. * Returns the newly created interface or a null on any error.
126. */
127. private WifiHal.WifiInterface executeChipReconfiguration(IfaceCreationData ifaceCreationData,
128.         @HdmIfaceTypeForCreation int createIfaceType) {
129.     if (mDbg) {
130.         Log.d(TAG, "executeChipReconfiguration: ifaceCreationData=" + ifaceCreationData
131.                 + ", createIfaceType=" + createIfaceType);
132.     }
133.     ...
134.     synchronized (mLock) {
135.         // is this a mode change?
136.         boolean isModeConfigNeeded = !ifaceCreationData.chipInfo.currentModeIdValid
137.                 || ifaceCreationData.chipInfo.currentModeId != ifaceCreationData.chipModeId;
138.         if (mDbg) Log.d(TAG, "isModeConfigNeeded=" + isModeConfigNeeded);
139.         Log.i(TAG, "currentModeId=" + ifaceCreationData.chipInfo.currentModeId
140.                 + ", requestModeId=" + ifaceCreationData.chipModeId
141.                 + ", currentModeIdValid=" + ifaceCreationData.chipInfo.currentModeIdValid);
142.         
143.         // first delete interfaces/change modes
144.         if (isModeConfigNeeded) {
145.             ...
146.             //通过wifi hal接口配置chip
147.             boolean success = ifaceCreationData.chipInfo.chip.configureChip(
148.                     ifaceCreationData.chipModeId);
149.             ...
150.         }
151.         ...
152.         WifiHal.WifiInterface iface = null;
153.         switch (createIfaceType) {
154.             case HDM_CREATE_IFACE_STA:
155.                 //通过 wifi hal 接口创建 sta interface
156.                 iface = ifaceCreationData.chipInfo.chip.createStaIface();
157.                 break;
158.             ...
159.         }
160.         ...
161.         return iface;
162.     }
163.    
164. //packages/modules/Wifi/service/java/com/android/server/wifi/hal/WifiChip.java
165. private IWifiChip mWifiChip;
167. /**
168. * See comments for {@link IWifiChip#createStaIface()}
169. */
170. @Nullable
171. public WifiStaIface createStaIface() {
172.     //调用 hal 层接口
173.     return validateAndCall("createStaIface", null,
174.             () -> mWifiChip.createStaIface());
175. }//packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
176. public String setupInterfaceForClientInScanMode(
177.     ...
178.     //2.创建并初始化 Iface
179.     // 创建一个Iface对象
180.     Iface iface = mIfaceMgr.allocateIface(Iface.IFACE_TYPE_STA_FOR_SCAN);
181.     if (iface == null) {
182.         Log.e(TAG, "Failed to allocate new STA iface");
183.         return null;
184.     }
185.     iface.externalListener = interfaceCallback;
186.     //关注点：创建sta iface
187.     iface.name = createStaIface(iface, requestorWs, concreteClientModeManager);
188.     ...
189. }
191. /**
192. * Helper function to handle creation of STA iface.
193. * For devices which do not the support the HAL, this will bypass HalDeviceManager &
194. * teardown any existing iface.
195. */
196. private String createStaIface(@NonNull Iface iface, @NonNull WorkSource requestorWs,
197.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
198.     synchronized (mLock) {
199.         if (mWifiVendorHal.isVendorHalSupported()) {
200.             //调用 WifiVendorHal的方法
201.             return mWifiVendorHal.createStaIface(
202.                     new InterfaceDestoyedListenerInternal(iface.id), requestorWs,
203.                     concreteClientModeManager);
204.         } ...
205.     }
206. }
208. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiVendorHal.java
209. public String createStaIface(@Nullable InterfaceDestroyedListener destroyedListener,
210.         @NonNull WorkSource requestorWs,
211.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
212.     synchronized (sLock) {
213.         //关注点：调用 HalDeviceManager.createStaIface 方法
214.         WifiStaIface iface = mHalDeviceManager.createStaIface(
215.                 new StaInterfaceDestroyedListenerInternal(destroyedListener), mHalEventHandler,
216.                 requestorWs, concreteClientModeManager);
217.         ...
218.         //注册回调方法
219.         if (!registerStaIfaceCallback(iface)) {
220.             mLog.err("Failed to register STA iface callback").flush();
221.             return null;
222.         }
223.         ...
224.         return ifaceName;
225.     }
226. }
228. //packages/modules/Wifi/service/java/com/android/server/wifi/HalDeviceManager.java
229. public WifiStaIface createStaIface(
230.         @Nullable InterfaceDestroyedListener destroyedListener, @Nullable Handler handler,
231.         @NonNull WorkSource requestorWs,
232.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
233.     return createStaIface(CHIP_CAPABILITY_ANY, destroyedListener, handler, requestorWs,
234.             concreteClientModeManager);
235. }
236. public WifiStaIface createStaIface(
237.         long requiredChipCapabilities,
238.         @Nullable InterfaceDestroyedListener destroyedListener, @Nullable Handler handler,
239.         @NonNull WorkSource requestorWs,
240.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
241.     ...
242.     WifiStaIface staIface = (WifiStaIface) createIface(HDM_CREATE_IFACE_STA,
243.             requiredChipCapabilities, destroyedListener, handler, requestorWs);
244.     ...
245.     return staIface;
246. }
247. private WifiHal.WifiInterface createIface(@HdmIfaceTypeForCreation int createIfaceType,
248.         long requiredChipCapabilities, InterfaceDestroyedListener destroyedListener,
249.         Handler handler, WorkSource requestorWs) {
250.     ...
251.     synchronized (mLock) {
252.         //获取所有芯片信息
253.         WifiChipInfo[] chipInfos = getAllChipInfo();
254.         ...
256.         //关注点：createIfaceIfPossible
257.         return createIfaceIfPossible(
258.                 chipInfos, createIfaceType, requiredChipCapabilities,
259.                 destroyedListener, handler, requestorWs);
260.     }
261. }
262. private WifiHal.WifiInterface createIfaceIfPossible(
263.         WifiChipInfo[] chipInfos, @HdmIfaceTypeForCreation int createIfaceType,
264.         long requiredChipCapabilities, InterfaceDestroyedListener destroyedListener,
265.         Handler handler, WorkSource requestorWs) {
266.     int targetHalIfaceType = HAL_IFACE_MAP.get(createIfaceType);
267.     if (VDBG) {
268.         Log.d(TAG, "createIfaceIfPossible: chipInfos=" + Arrays.deepToString(chipInfos)
269.                 + ", createIfaceType=" + createIfaceType
270.                 + ", targetHalIfaceType=" + targetHalIfaceType
271.                 + ", requiredChipCapabilities=" + requiredChipCapabilities
272.                 + ", requestorWs=" + requestorWs);
273.     }
274.     synchronized (mLock) {
275.         //获取最合适的iface（暂不分析，一般都是单wifi芯片）
276.         IfaceCreationData bestIfaceCreationProposal = getBestIfaceCreationProposal(chipInfos,
277.                 createIfaceType, requiredChipCapabilities, requestorWs);
279.         if (bestIfaceCreationProposal != null) {
280.             //关注点：对芯片进行重新配置并返回新建的interface。这里会调用 wifi hal的方法
281.             WifiHal.WifiInterface iface = executeChipReconfiguration(bestIfaceCreationProposal,
282.                     createIfaceType);
283.             ...
284.         } else {
285.            ...
286.     }
287.     ...
288.     return null;
289. }
290. /**
291. * Performs chip reconfiguration per the input:
292. * - Removes the specified interfaces
293. * - Reconfigures the chip to the new chip mode (if necessary)
294. * - Creates the new interface
295. *
296. * Returns the newly created interface or a null on any error.
297. */
298. private WifiHal.WifiInterface executeChipReconfiguration(IfaceCreationData ifaceCreationData,
299.         @HdmIfaceTypeForCreation int createIfaceType) {
300.     if (mDbg) {
301.         Log.d(TAG, "executeChipReconfiguration: ifaceCreationData=" + ifaceCreationData
302.                 + ", createIfaceType=" + createIfaceType);
303.     }
304.     ...
305.     synchronized (mLock) {
306.         // is this a mode change?
307.         boolean isModeConfigNeeded = !ifaceCreationData.chipInfo.currentModeIdValid
308.                 || ifaceCreationData.chipInfo.currentModeId != ifaceCreationData.chipModeId;
309.         if (mDbg) Log.d(TAG, "isModeConfigNeeded=" + isModeConfigNeeded);
310.         Log.i(TAG, "currentModeId=" + ifaceCreationData.chipInfo.currentModeId
311.                 + ", requestModeId=" + ifaceCreationData.chipModeId
312.                 + ", currentModeIdValid=" + ifaceCreationData.chipInfo.currentModeIdValid);
313.         
314.         // first delete interfaces/change modes
315.         if (isModeConfigNeeded) {
316.             ...
317.             //通过 wifi hal 接口配置 chip
318.             boolean success = ifaceCreationData.chipInfo.chip.configureChip(
319.                     ifaceCreationData.chipModeId);
320.             ...
321.         }
322.         ...
323.         WifiHal.WifiInterface iface = null;
324.         switch (createIfaceType) {
325.             case HDM_CREATE_IFACE_STA:
326.                 //通过 wifi hal 接口创建 sta interface
327.                 iface = ifaceCreationData.chipInfo.chip.createStaIface();
328.                 break;
329.             ...
330.         }
331.         ...
332.         return iface;
333.     }
334.    
335. //packages/modules/Wifi/service/java/com/android/server/wifi/hal/WifiChip.java
336. private IWifiChip mWifiChip;
338. /**
339. * See comments for {@link IWifiChip#createStaIface()}
340. */
341. @Nullable
342. public WifiStaIface createStaIface() {
343.     //调用 hal 层接口
344.     return validateAndCall("createStaIface", null,
345.             () -> mWifiChip.createStaIface());
346. }

复制代码

【Hal层的处理惩罚】

重要调用链如下：
WifiChip::createStaIface() --> createStaIfaceInternal()
        --> allocateStaIfaceName()             //1.获取interface的名字
                -->allocateApOrStaIfaceName()    -->getWlanIfaceNameWithType()
                        -->WifiLegacyHal::getSupportedIfaceName() //优先通过 vendor hal 接口获取；
                        -->getWlanIfaceName() //如果vendor hal不支持该接口，则通过属性获取
        -->WifiLegacyHal::createVirtualInterface()    //2.创建假造interface(调用vendor hal接口)
        -->WifiStaIface::create()     //3.创建 WifiStaIface 对象

1. //*********************** HAL层的处理： ***********************
2. //hardware/interfaces/wifi/aidl/default/wifi_chip.cpp
3. ndk::ScopedAStatus WifiChip::createStaIface(std::shared_ptr<IWifiStaIface>* _aidl_return) {
4.     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
5.                            &WifiChip::createStaIfaceInternal, _aidl_return);
6. }
7. std::pair<std::shared_ptr<IWifiStaIface>, ndk::ScopedAStatus> WifiChip::createStaIfaceInternal() {
8.     ...
9.     //1.获取interface的名字:
10.     //优先从 vendor hal 的 wifi_get_supported_iface_name() 接口获取；
11.     //如果 vendor hal不支持该接口，则通过属性 wifi.interface 获取。可以通过 adb shell getprop wifi.interface 命令查看属性值。
12.     std::string ifname = allocateStaIfaceName();
14.     //2.创建虚拟interface：会调用vendor hal 的 wifi_virtual_interface_create()，通过 nl80211 接口创建 interface
15.     legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->createVirtualInterface(
16.             ifname, aidl_struct_util::convertAidlIfaceTypeToLegacy(IfaceType::STA));
17.     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
18.         LOG(ERROR) << "Failed to add interface: " << ifname << " "
19.                    << legacyErrorToString(legacy_status);
20.         return {nullptr, createWifiStatusFromLegacyError(legacy_status)};
21.     }
22.     //3.创建 WifiStaIface 对象（AIDL interface object used to control a STA Iface instance）
23.     std::shared_ptr<WifiStaIface> iface = WifiStaIface::create(ifname, legacy_hal_, iface_util_);
24.     sta_ifaces_.push_back(iface);
25.     for (const auto& callback : event_cb_handler_.getCallbacks()) {
26.         if (!callback->onIfaceAdded(IfaceType::STA, ifname).isOk()) {
27.             LOG(ERROR) << "Failed to invoke onIfaceAdded callback";
28.         }
29.     }
30.     setActiveWlanIfaceNameProperty(getFirstActiveWlanIfaceName());
31.     return {iface, ndk::ScopedAStatus::ok()};
32. }

复制代码

至此，wifi的interface已经创建成功。

2.1.3 wificond配置 interface

        前面已经加载驱动和初始化vendor hal接口，且wifi interface也已经创建成功；接下来是通过wificond对interface举行配置，使其具备扫描功能。

1. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
2. /**
3. * Setup an interface for client mode (for scan) operations.
4. *
5. * This method configures an interface in STA mode in the native daemons
6. * (wificond, vendor HAL).
7. *
8. * @param interfaceCallback Associated callback for notifying status changes for the iface.
9. * @param requestorWs Requestor worksource.
10. * @param concreteClientModeManager ConcreteClientModeManager requesting the interface.
11. * @return Returns the name of the allocated interface, will be null on failure.
12. */
13. public String setupInterfaceForClientInScanMode(
14.         @NonNull InterfaceCallback interfaceCallback, @NonNull WorkSource requestorWs,
15.         @NonNull ConcreteClientModeManager concreteClientModeManager) {
16.     synchronized (mLock) {
17.         ...
18.         //3.wificond 对 iface 进行配置
19.         if (!mWifiCondManager.setupInterfaceForClientMode(iface.name, Runnable::run,
20.                 new NormalScanEventCallback(iface.name),
21.                 new PnoScanEventCallback(iface.name))) {
22.             Log.e(TAG, "Failed to setup iface in wificond=" + iface.name);
23.             teardownInterface(iface.name);
24.             mWifiMetrics.incrementNumSetupClientInterfaceFailureDueToWificond();
25.             return null;
26.         }
27. //frameworks/base/wifi/java/src/android/net/wifi/nl80211/WifiNl80211Manager.java
28. public boolean setupInterfaceForClientMode(@NonNull String ifaceName,
29.         @NonNull @CallbackExecutor Executor executor,
30.         @NonNull ScanEventCallback scanCallback, @NonNull ScanEventCallback pnoScanCallback) {
31.     Log.d(TAG, "Setting up interface for client mode: " + ifaceName);
32.     //1.获取 wifinl80211 服务，并注册死亡通知
33.     if (!retrieveWificondAndRegisterForDeath()) {
34.         return false;
35.     }
36.     ...
38.     IClientInterface clientInterface = null;
39.     try {
40.         //2.通过 wifinl80211 服务，创建一个适用于Wifi客户端的网络接口
41.         //(核心是通过netlink跟内核nl80211模块进行通信)
42.         clientInterface = mWificond.createClientInterface(ifaceName);
43.     } catch (RemoteException e1) {
44.         Log.e(TAG, "Failed to get IClientInterface due to remote exception");
45.         return false;
46.     }
47.     ...
49.     // Refresh Handlers
50.     mClientInterfaces.put(ifaceName, clientInterface);
51.     try {
52.         //3.获取关联的WifiScanner接口
53.         IWifiScannerImpl wificondScanner = clientInterface.getWifiScannerImpl();
54.         ...
55.         ScanEventHandler scanEventHandler = new ScanEventHandler(executor, scanCallback);
56.         mScanEventHandlers.put(ifaceName,  scanEventHandler);
57.         //订阅扫描事件
58.         wificondScanner.subscribeScanEvents(scanEventHandler);
59.         PnoScanEventHandler pnoScanEventHandler = new PnoScanEventHandler(executor,
60.                 pnoScanCallback);
61.         ...
62.     } catch (RemoteException e) {
63.         Log.e(TAG, "Failed to refresh wificond scanner due to remote exception");
64.     }
66.     return true;
67. }
68. //wificond 通过netlink跟内核nl80211模块进行通信，用于提供wifi相关信息和控制功能。
69. //目前对该模块不太熟悉，暂不展开相关代码了。

复制代码

2.1.4 小结

        setupInterfaceForClientInScanMode 重要完成三件事：①加载驱动，初始化vendor hal接口；②创建并初始化sta接口；③负责扫描功能的wificond对网卡接口举行相关配置。
        为什么叫setupInterfaceForClientInScanMode，由于到目前为止，只能扫描，还不能为上层提供连接功能。
接下来必要启动提供连接功能的wpa_supplicant进程。

2.2 switchClientInterfaceToConnectivityMode 启动supplicant

1. // packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
2. public boolean switchClientInterfaceToConnectivityMode(@NonNull String ifaceName,
3.             @NonNull WorkSource requestorWs) {
4.     ...
5.     //关注点：启动supplicant
6.     startSupplicant();
7.    
8.    ...
9.     //supplicant中初始化iface
10.     mSupplicantStaIfaceHal.setupIface(iface.name);
11.     ...
12. }

复制代码

来看下wpa_supplicant的启动流程：
2.2.1 WifiNative

startSupplicant() --> startAndWaitForSupplicantConnection()

1. //packages/modules/Wifi/service/java/com/android/server/wifi/WifiNative.java
2. /** Helper method invoked to start supplicant if there were no STA ifaces */
3. private boolean startSupplicant() {
4.     synchronized (mLock) {
5.         //如果没有用于连接的staIface
6.         if (!mIfaceMgr.hasAnyStaIfaceForConnectivity()) {
7.             //关注点：启动并等待与supplicant的连接
8.             if (!startAndWaitForSupplicantConnection()) {
9.                 Log.e(TAG, "Failed to connect to supplicant");
10.                 return false;
11.             }
12.             //注册supplicant死亡通知
13.             if (!mSupplicantStaIfaceHal.registerDeathHandler(
14.                     new SupplicantDeathHandlerInternal())) {
15.                 Log.e(TAG, "Failed to register supplicant death handler");
16.                 return false;
17.             }
18.         }
19.         return true;
20.     }
21. }
22. //来看下 startAndWaitForSupplicantConnection 的逻辑：
23. private boolean startAndWaitForSupplicantConnection() {
24.     // Start initialization if not already started.
25.     // 1.初始化：SupplicantStaIfaceHal.initialize()
26.     if (!mSupplicantStaIfaceHal.isInitializationStarted()
27.             && !mSupplicantStaIfaceHal.initialize()) {
28.         return false;
29.     }
30.     // 2.启动服务：SupplicantStaIfaceHal.startDaemon()
31.     if (!mSupplicantStaIfaceHal.startDaemon()) {
32.         Log.e(TAG, "Failed to startup supplicant");
33.         return false;
34.     }
35.     // 3.检查supplicant是否启动成功。每100ms检测一次，最多检测50次。
36.     boolean connected = false;
37.     int connectTries = 0;
38.     while (!connected && connectTries++ < CONNECT_TO_SUPPLICANT_RETRY_TIMES) {
39.         // Check if the initialization is complete.
40.         connected = mSupplicantStaIfaceHal.isInitializationComplete();
41.         if (connected) {
42.             break;
43.         }
44.         try {
45.             Thread.sleep(CONNECT_TO_SUPPLICANT_RETRY_INTERVAL_MS);
46.         } catch (InterruptedException ignore) {
47.         }
48.     }
49.     return connected;
50. }

复制代码

startAndWaitForSupplicantConnection()这个函数重要逻辑：
1.调用mSupplicantStaIfaceHal.startDaemon()启动supplicant；
2.然后通过mSupplicantStaIfaceHal.isInitializationComplete()检查supplicant是否成功启动。
（每100ms检查一次，最多检查50次，）

继承看supplicant服务的启动流程：
2.2.2 SupplicantStaIfaceHalAidlImpl.startDaemon()流程

调用链：

【Java层流程】

1. //packages/modules/Wifi/service/java/com/android/server/wifi/SupplicantStaIfaceHalAidlImpl.java
2. /**
3. * Start the supplicant daemon.
4. *
5. * @return true on success, false otherwise.
6. */
7. public boolean startDaemon() {
8.     synchronized (mLock) {
9.         ...
10.         //关注点：获取supplicant服务(会拉起supplicant服务)
11.         mISupplicant = getSupplicantMockable();
12.         ...
13.         Log.i(TAG, "Obtained ISupplicant binder.");
14.         Log.i(TAG, "Local Version: " + ISupplicant.VERSION);
16.         try {
17.             ...
18.             IBinder serviceBinder = getServiceBinderMockable();
19.             ...
20.             //注册死亡通知
21.             serviceBinder.linkToDeath(mSupplicantDeathRecipient, /* flags= */  0);
22.             ...
23.             return true;
24.         } ...
25.     }
26. }
27. //重点关注：getSupplicantMockable()
28. private static final String HAL_INSTANCE_NAME = ISupplicant.DESCRIPTOR + "/default";
29. /**
30. * Wrapper functions to access HAL objects, created to be mockable in unit tests
31. */
32. @VisibleForTesting
33. protected ISupplicant getSupplicantMockable() {
34.     synchronized (mLock) {
35.         try {
36.             if (SdkLevel.isAtLeastT()) {
37.                 // 通过servicemanager 启动supplicant服务。
38.                 // supplicant服务的名称为：android.hardware.wifi.supplicant.ISupplicant/default
39.                 return ISupplicant.Stub.asInterface(
40.                         ServiceManager.waitForDeclaredService(HAL_INSTANCE_NAME));
41.             } else {
42.                 return null;
43.             }
44.         } ...
45.     }
46. }
47. //frameworks/base/core/java/android/os/ServiceManager.java
48. /**
49. * Returns the specified service from the service manager, if declared.
50. *
51. * If the service is not running, servicemanager will attempt to start it, and this function
52. * will wait for it to be ready.
53. * ...
54. */
55. @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
56. @Nullable public static IBinder waitForDeclaredService(@NonNull String name) {
57.     return isDeclared(name) ? waitForService(name) : null;
58. }
59. public static IBinder waitForService(@NonNull String name) {
60.     //调用native方法
61.     return Binder.allowBlocking(waitForServiceNative(name));
62. }

复制代码

【JNI层】

1. //****************************** JNI 层 ******************************
2. //frameworks/base/core/jni/android_os_ServiceManager.cpp
3. // Native because we have a client-side wait in waitForService() and we do not
4. // want an unnecessary second copy of it.
5. static jobject android_os_ServiceManager_waitForServiceNative(JNIEnv* env, jclass /* clazzObj */,
6.                                                               jstring serviceNameObj) {
7.     const jchar* serviceName = env->GetStringCritical(serviceNameObj, nullptr);
8.     ...
9.     String16 nameCopy = String16(reinterpret_cast<const char16_t *>(serviceName),
10.             env->GetStringLength(serviceNameObj));
11.     env->ReleaseStringCritical(serviceNameObj, serviceName);
13.     //调用native servicemanager 的方法
14.     sp<IBinder> service = defaultServiceManager()->waitForService(nameCopy);
15.     ...
16.     return javaObjectForIBinder(env, service);
17. }

复制代码

【Native层流程】

1. //************************** Native 层 **************************************
2. //************************ servicemanager 客户端 ************************
3. //frameworks/native/libs/binder/IServiceManager.cpp
4. sp<IBinder> ServiceManagerShim::waitForService(const String16& name16)
5. {
6.     ...
7.     sp<IBinder> out;
8.     //关注点：realGetService
9.     if (Status status = realGetService(name, &out); !status.isOk()) {
10.         ...
11.         return nullptr;
12.     }
13.     if (out != nullptr) return out;
14.     ...
15. }
16. // From the old libbinder IServiceManager interface to IServiceManager.
17. class ServiceManagerShim : public IServiceManager
18. {
19. public:
20.     ...
21. protected:
22.     sp<AidlServiceManager> mTheRealServiceManager;
23.     ...
24.     virtual Status realGetService(const std::string& name, sp<IBinder>* _aidl_return) {
25.         return mTheRealServiceManager->getService(name, _aidl_return);
26.     }
27. };
28. //************************ servicemanager 服务端 ************************
29. //frameworks/native/cmds/servicemanager/ServiceManager.cpp
30. Status ServiceManager::getService(const std::string& name, sp<IBinder>* outBinder) {
31.     *outBinder = tryGetService(name, true);
32.     // returns ok regardless of result for legacy reasons
33.     return Status::ok();
34. }
35. sp<IBinder> ServiceManager::tryGetService(const std::string& name, bool startIfNotFound) {
36.     auto ctx = mAccess->getCallingContext();
38.     sp<IBinder> out;
39.     Service* service = nullptr;
40.     ...
41.     if (!out && startIfNotFound) {
42.         //尝试启动service
43.         tryStartService(name);
44.     }
45.     ...
46. }
47. void ServiceManager::tryStartService(const std::string& name) {
48.     //注意这里的打印：
49.     ALOGI("Since '%s' could not be found, trying to start it as a lazy AIDL service. (if it's not "
50.           "configured to be a lazy service, it may be stuck starting or still starting).",
51.           name.c_str());
53.     std::thread([=] {
54.         if (!base::SetProperty("ctl.interface_start", "aidl/" + name)) {
55.             ...
56.         }
57.     }).detach();
58. }

复制代码

        可以看到，终极是通过设置属性 "ctrl.interface_start aidl/xxx" 来触发init进程去拉起 supplicant 服务的。supplicant服务的名称睁开为：android.hardware.wifi.supplicant.ISupplicant/default。
        来看下supplicant 服务对应的rc文件，路径为：external/wpa_supplicant_8/wpa_supplicant/aidl/android.hardware.wifi.supplicant-service.rc

1. service wpa_supplicant /vendor/bin/hw/wpa_supplicant \
2.     -O/data/vendor/wifi/wpa/sockets -dd \
3.     -g@android:wpa_wlan0
4.     #   we will start as root and wpa_supplicant will switch to user wifi
5.     #   after setting up the capabilities required for WEXT
6.     #   user wifi
7.     #   group wifi inet keystore
8.     interface aidl android.hardware.wifi.supplicant.ISupplicant/default
9.     class main
10.     #创建一个socket，wpa_s使用该socket接收framework的命令和向上传递event。
11.     socket wpa_wlan0 dgram 660 wifi wifi
12.     disabled
13.     oneshot

复制代码

关于 supplicant 的初始化流程，会放到后续章节举行介绍，这里就不举行睁开。
以下是关键打印：

1. I SupplicantStaIfaceHalAidlImpl: Clearing internal state
2. I servicemanager: Found android.hardware.wifi.supplicant.ISupplicant/default in device VINTF manifest.
3. I servicemanager: Since 'android.hardware.wifi.supplicant.ISupplicant/default' could not be found, trying to start it as a lazy AIDL service. (if it's not configured to be a lazy service, it may be stuck starting or still starting).
4. I init    : starting service 'wpa_supplicant'...
5. I init    : Created socket '/dev/socket/wpa_wlan0', mode 660, user 1010, group 1010
6. I init    : ... started service 'wpa_supplicant' has pid 2024
7. I init    : Control message: Processed ctl.interface_start for 'aidl/android.hardware.wifi.supplicant.ISupplicant/default' from pid: 130 (/system/bin/servicemanager)
8. I wpa_supplicant: Processing aidl events on FD 3
9. I wpa_supplicant: Starting AIDL supplicant
10. I wpa_supplicant: Interface version: 2
11. I wpa_supplicant: Successfully initialized wpa_supplicant
12. I SupplicantStaIfaceHalAidlImpl: Obtained ISupplicant binder.
13. I SupplicantStaIfaceHalAidlImpl: Local Version: 2
14. I SupplicantStaIfaceHalAidlImpl: Remote Version: 2

复制代码

        至此， SupplicantStaIfaceHalAidlImpl已经将supplicnat进程成功拉起，并且与supplicant hal service举行了绑定。后续Frameowork层可通过SupplicantStaIfaceHalAidlImpl调用supplicnat相关接口。



参考链接：

Wi-Fi架构（二）-- Wi-Fi打开流程2.1
Android WiFi 开启流程(基于Android S)




免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。