Android N Wi-Fi 扫描流程分析

上一篇我们分析了wifi的启动流程，最终 WifiStateMachine 是停留在了DisconnectedState 状态中。
接下来我们就来分析wifi是怎么进行扫描的。这就要从 WifiSettings 的 onResume 函数说起。

@Override
public void onResume() {
final Activity activity = getActivity();
super.onResume();
removePreference("dummy");
if (mWifiEnabler != null) {
mWifiEnabler.resume(activity);
}

mWifiTracker.startTracking();
activity.invalidateOptionsMenu();

/// M: register no WAPI certification action receiver
activity.registerReceiver(mReceiver, mFilter);
mWifiSettingsExt.onResume();
}

在这个函数中，执行了 WifiTracker.startTracking() 函数。

public void startTracking() {
resumeScanning();
if (!mRegistered) {
mContext.registerReceiver(mReceiver, mFilter);
// NetworkCallback objects cannot be reused. http://b/20701525 .
mNetworkCallback = new WifiTrackerNetworkCallback();
mConnectivityManager.registerNetworkCallback(mNetworkRequest, mNetworkCallback);
mRegistered = true;
}
}

public void resumeScanning() {
if (mScanner == null) {
mScanner = new Scanner();
}

mWorkHandler.sendEmptyMessage(WorkHandler.MSG_RESUME);
if (mWifiManager.isWifiEnabled()) {
mScanner.resume();
}
mWorkHandler.sendEmptyMessage(WorkHandler.MSG_UPDATE_ACCESS_POINTS);
}

其中 resumeScanning() 函数发送了一条消息 orkHandler.MSG_RESUME 。

case MSG_RESUME:
handleResume();
break;

private void handleResume() {
mScanResultCache.clear();
mSeenBssids.clear();
mScanId = 0;
}

这个函数是为了清空当前 ScanResultCache 中的信息，紧接着将执行 mScanner.resume() 函数。

void resume() {
if (!hasMessages(MSG_SCAN)) {
sendEmptyMessage(MSG_SCAN);
}
}

@Override
public void handleMessage(Message message) {
if (message.what != MSG_SCAN) return;
if (mWifiManager.startScan()) {
mRetry = 0;
} else if (++mRetry >= 3) {
mRetry = 0;
if (mContext != null) {
Toast.makeText(mContext, R.string.wifi_fail_to_scan, Toast.LENGTH_LONG).show();
}
return;
}
sendEmptyMessageDelayed(0, WIFI_RESCAN_INTERVAL_MS);
}

这个函数将先发送一条 MSG_SCAN 消息，然后将执行 mWifiManager.startScan() 函数。

public boolean startScan() {
try {
mService.startScan(null, null);
return true;
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}

而 WifiManager 将通过aidl 调用 wifiserviceimpl 的同名函数。

public void startScan(ScanSettings settings, WorkSource workSource) {
enforceChangePermission();
synchronized (this) {
if (mInIdleMode) {
// Need to send an immediate scan result broadcast in case the
// caller is waiting for a result ..

// clear calling identity to send broadcast
long callingIdentity = Binder.clearCallingIdentity();
try {
mWifiStateMachine.sendScanResultsAvailableBroadcast(/* scanSucceeded = */ false);
} finally {
// restore calling identity
Binder.restoreCallingIdentity(callingIdentity);
}
mScanPending = true;
return;
}
}
if (settings != null) {
settings = new ScanSettings(settings);
if (!settings.isValid()) {
Slog.e(TAG, "invalid scan setting");
return;
}
}
if (workSource != null) {
enforceWorkSourcePermission();
// WifiManager currently doesn't use names, so need to clear names out of the
// supplied WorkSource to allow future WorkSource combining.
workSource.clearNames();
}
if (workSource == null && Binder.getCallingUid() >= 0) {
workSource = new WorkSource(Binder.getCallingUid());
}
mWifiStateMachine.startScan(Binder.getCallingUid(), scanRequestCounter++,
settings, workSource);
}

此函数最后调用 WifiStateMachine.startScan（）。

public void startScan(int callingUid, int scanCounter,
ScanSettings settings, WorkSource workSource) {
Bundle bundle = new Bundle();
bundle.putParcelable(CUSTOMIZED_SCAN_SETTING, settings);
bundle.putParcelable(CUSTOMIZED_SCAN_WORKSOURCE, workSource);
bundle.putLong(SCAN_REQUEST_TIME, System.currentTimeMillis());
sendMessage(CMD_START_SCAN, callingUid, scanCounter, bundle);
}

此函数将往 WifiStateMachine 中发送 CMD_START_SCAN 消息。由于 DisconnectedState 状态不处理，
此消息将在 DriverStartedState 中被处理。

case CMD_START_SCAN:
handleScanRequest(message);
break;

private void handleScanRequest(Message message) {
ScanSettings settings = null;
WorkSource workSource = null;

// unbundle parameters
Bundle bundle = (Bundle) message.obj;

if (bundle != null) {
settings = bundle.getParcelable(CUSTOMIZED_SCAN_SETTING);
workSource = bundle.getParcelable(CUSTOMIZED_SCAN_WORKSOURCE);
}

Set<Integer> freqs = null;
if (settings != null && settings.channelSet != null) {
freqs = new HashSet<Integer>();
for (WifiChannel channel : settings.channelSet) {
freqs.add(channel.freqMHz);
}
}

// Retrieve the list of hidden networkId's to scan for.
Set<Integer> hiddenNetworkIds = mWifiConfigManager.getHiddenConfiguredNetworkIds();

// call wifi native to start the scan
if (startScanNative(freqs, hiddenNetworkIds, workSource)) {
// a full scan covers everything, clearing scan request buffer
if (freqs == null)
mBufferedScanMsg.clear();
messageHandlingStatus = MESSAGE_HANDLING_STATUS_OK;
if (workSource != null) {
// External worksource was passed along the scan request,
// hence always send a broadcast
mSendScanResultsBroadcast = true;
}
return;
}

// if reach here, scan request is rejected

if (!mIsScanOngoing) {
// if rejection is NOT due to ongoing scan (e.g. bad scan parameters),

// discard this request and pop up the next one
if (mBufferedScanMsg.size() > 0) {
sendMessage(mBufferedScanMsg.remove());
}
messageHandlingStatus = MESSAGE_HANDLING_STATUS_DISCARD;
} else if (!mIsFullScanOngoing) {
// if rejection is due to an ongoing scan, and the ongoing one is NOT a full scan,
// buffer the scan request to make sure specified channels will be scanned eventually
if (freqs == null)
mBufferedScanMsg.clear();
if (mBufferedScanMsg.size() < SCAN_REQUEST_BUFFER_MAX_SIZE) {
Message msg = obtainMessage(CMD_START_SCAN,
message.arg1, message.arg2, bundle);
mBufferedScanMsg.add(msg);
} else {
// if too many requests in buffer, combine them into a single full scan
bundle = new Bundle();
bundle.putParcelable(CUSTOMIZED_SCAN_SETTING, null);
bundle.putParcelable(CUSTOMIZED_SCAN_WORKSOURCE, workSource);
Message msg = obtainMessage(CMD_START_SCAN, message.arg1, message.arg2, bundle);
mBufferedScanMsg.clear();
mBufferedScanMsg.add(msg);
}
messageHandlingStatus = MESSAGE_HANDLING_STATUS_LOOPED;
} else {
// mIsScanOngoing and mIsFullScanOngoing
messageHandlingStatus = MESSAGE_HANDLING_STATUS_FAIL;
}
}

这里 startScanNative 函数将 调用 WifiScanner.startScan 函数。

public void startScan(ScanSettings settings, ScanListener listener, WorkSource workSource) {
Log.d(TAG, "startScan, pid:" + Process.myPid() + ", tid:" + Process.myTid() + ", uid:" +
Process.myUid());
Preconditions.checkNotNull(listener, "listener cannot be null");
int key = addListener(listener);
if (key == INVALID_KEY) return;
validateChannel();
Bundle scanParams = new Bundle();
scanParams.putParcelable(SCAN_PARAMS_SCAN_SETTINGS_KEY, settings);
scanParams.putParcelable(SCAN_PARAMS_WORK_SOURCE_KEY, workSource);
mAsyncChannel.sendMessage(CMD_START_SINGLE_SCAN, 0, key, scanParams);
}

此函数将发送 CMD_START_SINGLE_SCAN 消息到 WifiScanningServiceImpl 中实现。

case WifiScanner.CMD_START_SINGLE_SCAN:
case WifiScanner.CMD_STOP_SINGLE_SCAN:
mSingleScanStateMachine.sendMessage(Message.obtain(msg));
break;

最终将调用 mWifiNative.scan进行扫描网络热入点。扫描结束后，WifiMonitor.handleEvent 将收到SCAN_RESULTS 消息。

case SCAN_RESULTS:
sendMessage(iface, SCAN_RESULTS_EVENT);
break;

WifiMonitor 将向 WifiStateMachine 中发送 SCAN_RESULTS_EVENT 消息。
由于 DisconnectedState 状态不执行此消息，最终 由 SupplicantStartedState 状态来执行此消息。

case WifiMonitor.SCAN_RESULTS_EVENT:
case WifiMonitor.SCAN_FAILED_EVENT:
maybeRegisterNetworkFactory(); // Make sure our NetworkFactory is registered
setScanResults();
///M: for operator plugin @{
if (hasCustomizedAutoConnect()) {
mShowReselectDialog = false;
Log.d(TAG, "SCAN_RESULTS_EVENT, mScanForWeakSignal:" + mScanForWeakSignal);
if (mScanForWeakSignal) {
showReselectionDialog();
}
mDisconnectNetworkId = INVALID_NETWORK_ID;
}
///@}
loge("mIsFullScanOngoing: " + mIsFullScanOngoing
+ ", mSendScanResultsBroadcast: " + mSendScanResultsBroadcast);
///M: ALPS02028415 the last two times scan results should be broadcasted @{
if (mIsFullScanOngoing || mSendScanResultsBroadcast || mWifiOnScanCount < 2) {
loge("mWifiOnScanCount: " + mWifiOnScanCount);
/* Just updated results from full scan, let apps know a
c440
bout this */
boolean scanSucceeded = message.what == WifiMonitor.SCAN_RESULTS_EVENT;
sendScanResultsAvailableBroadcast(scanSucceeded);//发送扫描成功广播
}
mWifiOnScanCount ++;
///@}
mSendScanResultsBroadcast = false;
mIsScanOngoing = false;
mIsFullScanOngoing = false;
if (mBufferedScanMsg.size() > 0)
sendMessage(mBufferedScanMsg.remove());
break;

setScanResults()函数将会调用 WifiNative.getScanResults() 去获取扫描结果，
sendScanResultsAvailableBroadcast(scanSucceeded); 随后将发送
WifiManager.SCAN_RESULTS_AVAILABLE_ACTION 广播。
WifiTracker 接收到此广播后，将发送 MSG_UPDATE_ACCESS_POINTS 消息。

@VisibleForTesting
final BroadcastReceiver mReceiver = new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
String action = intent.getAction();
if (WifiManager.WIFI_STATE_CHANGED_ACTION.equals(action)) {
updateWifiState(intent.getIntExtra(WifiManager.EXTRA_WIFI_STATE,
WifiManager.WIFI_STATE_UNKNOWN));
} else if (WifiManager.SCAN_RESULTS_AVAILABLE_ACTION.equals(action) ||
WifiManager.CONFIGURED_NETWORKS_CHANGED_ACTION.equals(action) ||
WifiManager.LINK_CONFIGURATION_CHANGED_ACTION.equals(action)) {
mWorkHandler.sendEmptyMessage(WorkHandler.MSG_UPDATE_ACCESS_POINTS);
} else if (WifiManager.NETWORK_STATE_CHANGED_ACTION.equals(action)) {
NetworkInfo info = (NetworkInfo) intent.getParcelableExtra(
WifiManager.EXTRA_NETWORK_INFO);
mConnected.set(info.isConnected());

mMainHandler.sendEmptyMessage(MainHandler.MSG_CONNECTED_CHANGED);

mWorkHandler.sendEmptyMessage(WorkHandler.MSG_UPDATE_ACCESS_POINTS);
mWorkHandler.obtainMessage(WorkHandler.MSG_UPDATE_NETWORK_INFO, info)
.sendToTarget();
}
}
};

WifiTracker 的 WorkHandler 接收到此消息将进行 更新AP操作。

private void updateAccessPoints() {
// Swap the current access points into a cached list.
List<AccessPoint> cachedAccessPoints = getAccessPoints();
ArrayList<AccessPoint> accessPoints = new ArrayList<>();

// Clear out the configs so we don't think something is saved when it isn't.
for (AccessPoint accessPoint : cachedAccessPoints) {
accessPoint.clearConfig();
}
/// M: ALPS02334170: Use ReadWriteLock to prevent multi-thread JE @{
mReadWriteLock.readLock().lock();
try {
/** Lookup table to more quickly update AccessPoints by only considering objects with
*  the correct SSID.  Maps SSID -> List of AccessPoints with the given SSID.  */
Multimap<String, AccessPoint> apMap = new Multimap<String, AccessPoint>();
WifiConfiguration connectionConfig = null;
if (mLastInfo != null) {
connectionConfig = getWifiConfigurationForNetworkId(mLastInfo.getNetworkId());
}

final Collection<ScanResult> results = fetchScanResults();

final List<WifiConfiguration> configs = mWifiManager.getConfiguredNetworks();
if (configs != null) {
mSavedNetworksExist = configs.size() != 0;
for (WifiConfiguration config : configs) {
if (config.selfAdded && config.numAssociation == 0) {
continue;
}
AccessPoint accessPoint = getCachedOrCreate(config, cachedAccessPoints);
if (mLastInfo != null && mLastNetworkInfo != null) {
if (config.isPasspoint() == false) {
accessPoint.update(connectionConfig, mLastInfo, mLastNetworkInfo);
}
}
if (mIncludeSaved) {
if (!config.isPasspoint() || mIncludePasspoints) {
// If saved network not present in scan result then set its Rssi
// to MAX_VALUE
boolean apFound = false;
for (ScanResult result : results) {
if (result.SSID.equals(accessPoint.getSsidStr())) {
apFound = true;
break;
}
}
if (!apFound) {
accessPoint.setRssi(Integer.MAX_VALUE);
}
accessPoints.add(accessPoint);
}

if (config.isPasspoint() == false) {
apMap.put(accessPoint.getSsidStr(), accessPoint);
}
} else {
// If we aren't using saved networks, drop them into the cache so that
// we have access to their saved info.
cachedAccessPoints.add(accessPoint);
}
}
}

if (results != null) {
for (ScanResult result : results) {
// Ignore hidden and ad-hoc networks.
if (result.SSID == null || result.SSID.length() == 0 ||
result.capabilities.contains("[IBSS]")) {
continue;
}

boolean found = false;
for (AccessPoint accessPoint : apMap.getAll(result.SSID)) {
if (accessPoint.update(result)) {
found = true;
break;
}
}
if (!found && mIncludeScans) {
AccessPoint accessPoint = getCachedOrCreate(result, cachedAccessPoints);
if (mLastInfo != null && mLastNetworkInfo != null) {
accessPoint.update(connectionConfig, mLastInfo, mLastNetworkInfo);
}

if (result.isPasspointNetwork()) {
WifiConfiguration config = mWifiManager.getMatchingWifiConfig(result);
if (config != null) {
accessPoint.update(config);
}
}

if (mLastInfo != null && mLastInfo.getBSSID() != null
&& mLastInfo.getBSSID().equals(result.BSSID)
&& connectionConfig != null && connectionConfig.isPasspoint()) {
/* This network is connected via this passpoint config */
/* SSID match is not going to work for it; so update explicitly */
accessPoint.update(connectionConfig);
}

accessPoints.add(accessPoint);
apMap.put(accessPoint.getSsidStr(), accessPoint);
}
}
}
} finally {
mReadWriteLock.readLock().unlock();
}
/// @}

// Pre-sort accessPoints to speed preference insertion
Collections.sort(accessPoints);

// Log accesspoints that were deleted
if (DBG) Log.d(TAG, "------ Dumping SSIDs that were not seen on this scan ------");
for (AccessPoint prevAccessPoint : mAccessPoints) {
if (prevAccessPoint.getSsid() == null) continue;
String prevSsid = prevAccessPoint.getSsidStr();
boolean found = false;
for (AccessPoint newAccessPoint : accessPoints) {
if (newAccessPoint.getSsid() != null && newAccessPoint.getSsid().equals(prevSsid)) {
found = true;
break;
}
}
if (!found)
if (DBG) Log.d(TAG, "Did not find " + prevSsid + " in this scan");
}
if (DBG)  Log.d(TAG, "---- Done dumping SSIDs that were not seen on this scan ----");

mAccessPoints = accessPoints;
mMainHandler.sendEmptyMessage(MainHandler.MSG_ACCESS_POINT_CHANGED);
}