Wifi启动流程分析
因工作需要，对Android的Wifi模块做了些分析与跟踪，当前的源码版本是Android 4.4的，在Android 5以后已经发生了一些变化。
从Android的启动开始
进入Android的入口是SystemServer，在这里面注册了许多的Service。这里主要看与Wifi相关的服务。
try {
Slog.i(TAG, "Wi-Fi Service");
wifi = new WifiService(context);
ServiceManager.addService(Context.WIFI_SERVICE, wifi);
} catch (Throwable e) {
reportWtf("starting Wi-Fi Service", e);
}
try {
Slog.i(TAG, "Connectivity Service");
connectivity = new ConnectivityService(
context, networkManagement, networkStats, networkPolicy);
ServiceManager.addService(Context.CONNECTIVITY_SERVICE, connectivity);
networkStats.bindConnectivityManager(connectivity);
networkPolicy.bindConnectivityManager(connectivity);
wifiP2p.connectivityServiceReady();
wifi.checkAndStartWifi();
} catch (Throwable e) {
reportWtf("starting Connectivity Service", e);
}
上述代码中，初始化了wifiService，并把这两个对象加到ServiceManager上，接着又创建了ConnectivityService对象，然后通过创建的WiFiService对象调用wifi.checkAndStartWifi();用于初始化开机时的wifi状态。
先说说WifiService
进入到WifiService.java的构造方法中，路径：
/frameworks/base/services/java/com/android/server/wifi/WifiService.java
public WifiService(Context context) {
mContext = context;
mInterfaceName = SystemProperties.get("wifi.interface", "wlan0");
mWifiStateMachine = new WifiStateMachine(mContext, mInterfaceName);
mWifiStateMachine.enableRssiPolling(true);
mBatteryStats = BatteryStatsService.getService();
mAppOps = (AppOpsManager)context.getSystemService(Context.APP_OPS_SERVICE);
mNotificationController = new WifiNotificationController(mContext, mWifiStateMachine);
mTrafficPoller = new WifiTrafficPoller(mContext, mInterfaceName);
mSettingsStore = new WifiSettingsStore(mContext);
HandlerThread wifiThread = new HandlerThread("WifiService");
wifiThread.start();
mClientHandler = new ClientHandler(wifiThread.getLooper());
mWifiStateMachineHandler = new WifiStateMachineHandler(wifiThread.getLooper());
mWifiController = new WifiController(mContext, this, wifiThread.getLooper());
mWifiController.start();
mBatchedScanSupported = mContext.getResources().getBoolean(
R.bool.config_wifi_batched_scan_supported);
registerForScanModeChange();
mContext.registerReceiver(
new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
if (mSettingsStore.handleAirplaneModeToggled()) {
mWifiController.sendMessage(CMD_AIRPLANE_TOGGLED);
}
}
},
new IntentFilter(Intent.ACTION_AIRPLANE_MODE_CHANGED));
// Adding optimizations of only receiving broadcasts when wifi is enabled
// can result in race conditions when apps toggle wifi in the background
// without active user involvement. Always receive broadcasts.
registerForBroadcasts();
}这里可以看到，首先读取系统属性，获取系统wifi.interface,默认为wlan0。主要看这两句：
mWifiStateMachine =new WifiStateMachine(mContext,mInterfaceName);
mWifiStateMachine.enableRssiPolling(true);可以看到，在实例化WifiService的时候，先创建了一个Wifi状态机对象，然后开始Rssi轮询。然后新建一个HandlerThread来处理所有的Message，并注册一些Broadcast的接收者。接着又创建了一个mWifiController 。（【注】：其实自己之前看到这里的时候也在想，为什么这么麻烦？先搞了一个Wifi状态机（哈哈，以前听到状态机，感觉感觉蛮高大上的样子），然后又弄了个WifiController又是干嘛的。）
其实，WifiStateMachine用于控制整个Wifi的开启、关闭、连接和断开等各个状态的切换，这个感觉还是比较复杂的，后面再说吧。不过还是先看看它的构造方法做了些什么：源码路径在：/frameworks/base/wifi/java/android/net/wifi/WifiStateMachine.java
这个构造方法太长了，截取一段比较关键的：
mWifiNative = new WifiNative(mInterfaceName);
mWifiConfigStore = new WifiConfigStore(context, mWifiNative);
mWifiMonitor = new WifiMonitor(this, mWifiNative);
mWifiInfo = new WifiInfo();
mSupplicantStateTracker = new SupplicantStateTracker(context, this, mWifiConfigStore, getHandler());
mLinkProperties = new LinkProperties();
mNetlinkLinkProperties = new LinkProperties();这里初始化了一些对象，都是与wifi的控制相关的信息。
addState(mDefaultState);
addState(mInitialState, mDefaultState);
addState(mSupplicantStartingState, mDefaultState);
addState(mSupplicantStartedState, mDefaultState);
addState(mDriverStartingState, mSupplicantStartedState);
addState(mDriverStartedState, mSupplicantStartedState);
addState(mScanModeState, mDriverStartedState);
addState(mConnectModeState, mDriverStartedState);
addState(mL2ConnectedState, mConnectModeState);
addState(mObtainingIpState, mL2ConnectedState);
addState(mVerifyingLinkState, mL2ConnectedState);
addState(mCaptivePortalCheckState, mL2ConnectedState);
addState(mConnectedState, mL2ConnectedState);
addState(mDisconnectingState, mConnectModeState);
addState(mDisconnectedState, mConnectModeState);
addState(mWpsRunningState, mConnectModeState);
addState(mWaitForP2pDisableState, mSupplicantStartedState);
addState(mDriverStoppingState, mSupplicantStartedState);
addState(mDriverStoppedState, mSupplicantStartedState);
addState(mSupplicantStoppingState, mDefaultState);
addState(mSoftApStartingState, mDefaultState);
addState(mSoftApStartedState, mDefaultState);
addState(mTetheringState, mSoftApStartedState);
addState(mTetheredState, mSoftApStartedState);
addState(mUntetheringState, mSoftApStartedState);
setInitialState(mInitialState);
setLogRecSize(2000);
setLogOnlyTransitions(false);
if (DBG) setDbg(true);
//start the state machine
start();这里可以看到，WifiStateMachine在实例化的时候，往状态机中添加了许许多多的状态，在wifi连接与断开的整个流程中，都会与上述添加的状态息息相关。添加完这些状态后，先是设置了一下wifi状态机的最初始状态为InitialState。然后调用start()方法启动wifi状态机工作，这个start()方法的实现在WifiStateMachine的父类StateMachine中，所以状态机也叫层次状态机。
由上面的分析，知道了在WifiService初始化的时候，实例化了一个WifiStateMachine，然后由WifiStateMachine接管了整个Wifi运行时期各种状态变化的管理。
不过，在WifiService的构造方法中，还实例化了一个WifiController对象，这个又是在干嘛呢？来看看它在实例化的时候做了些什么：
/frameworks/base/services/java/com/android/server/wifi/WifiController.java
WifiController(Context context, WifiService service, Looper looper) {
super(TAG, looper);
mContext = context;
mWifiStateMachine = service.mWifiStateMachine;
mSettingsStore = service.mSettingsStore;
mLocks = service.mLocks;
mAlarmManager = (AlarmManager)mContext.getSystemService(Context.ALARM_SERVICE);
Intent idleIntent = new Intent(ACTION_DEVICE_IDLE, null);
mIdleIntent = PendingIntent.getBroadcast(mContext, IDLE_REQUEST, idleIntent, 0);
addState(mDefaultState);
addState(mApStaDisabledState, mDefaultState);
addState(mStaEnabledState, mDefaultState);
addState(mDeviceActiveState, mStaEnabledState);
addState(mDeviceInactiveState, mStaEnabledState);
addState(mScanOnlyLockHeldState, mDeviceInactiveState);
addState(mFullLockHeldState, mDeviceInactiveState);
addState(mFullHighPerfLockHeldState, mDeviceInactiveState);
addState(mNoLockHeldState, mDeviceInactiveState);
addState(mStaDisabledWithScanState, mDefaultState);
addState(mApEnabledState, mDefaultState);
addState(mEcmState, mDefaultState);
if (mSettingsStore.isScanAlwaysAvailable()) {
setInitialState(mStaDisabledWithScanState);
} else {
setInitialState(mApStaDisabledState);
}
setLogRecSize(100);
setLogOnlyTransitions(false);
IntentFilter filter = new IntentFilter();
filter.addAction(ACTION_DEVICE_IDLE);
filter.addAction(WifiManager.NETWORK_STATE_CHANGED_ACTION);
mContext.registerReceiver(
new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
String action = intent.getAction();
if (action.equals(ACTION_DEVICE_IDLE)) {
sendMessage(CMD_DEVICE_IDLE);
} else if (action.equals(WifiManager.NETWORK_STATE_CHANGED_ACTION)) {
mNetworkInfo = (NetworkInfo) intent.getParcelableExtra(
WifiManager.EXTRA_NETWORK_INFO);
}
}
},
new IntentFilter(filter));
initializeAndRegisterForSettingsChange(looper);
}这段代码好长，感觉贴图上来好难看。。。
不过可以大致看到，在WifiService中把WifiStateMachine的实例传了进来。这里也注册了好几种状态，是的，WifiController也继承自StateMachine，并且在实例化的时候设置了初始状态。如下，当wifi被设置为一直可以扫描的话，初始状态会设置为mStaDisabledWithScanState，一般会走else分支。
if (mSettingsStore.isScanAlwaysAvailable()) {
setInitialState(mStaDisabledWithScanState);
} else {
setInitialState(mApStaDisabledState);
}在WifiService中创建该实例后，立即调用了mWifiController.start();根据刚才对WiFiStateMachine的分析可知，这里调用的是状态机父类StateMachine中的start()方法。调用start方法后，WifiController首先进入mDefaultState状态，然后进入mApStaDisabledState状态（为什么呢？从addState(mApStaDisabledState, mDefaultState);可以看出，mDefaultState是mApStaDisabledState的父状态，执行的时候，会先进入父状态的enter()，然后再执行子状态。【层次状态机】），此时，WifiController状态机的状态为mApStaDisabledState状态，进入到该状态的enter()方法：
@Override
public void enter() {
mWifiStateMachine.setSupplicantRunning(false);
// Supplicant can't restart right away, so not the time we switched off
mDisabledTimestamp = SystemClock.elapsedRealtime();
mDeferredEnableSerialNumber++;
mHaveDeferredEnable = false;
}发现做了些配置，没有更多的动作，到这里WifiService的初始化大致做完了，还有一些细节，留到以后再分析吧。
回到SystemServer
在本文开始的时候，有贴过一段代码，其中在初始化完WifiService和ConnectivityService后，执行了如下代码：
wifi.checkAndStartWifi();这句代码才开始真正从开机状态完成真正的wifi监测与打开的动作。
public void checkAndStartWifi() {
//检查WiFi是否需要使能
boolean wifiEnabled = mSettingsStore.isWifiToggleEnabled();
Slog.i(TAG, "WifiService starting up with Wi-Fi " +
(wifiEnabled ? "enabled" : "disabled"));
// If we are already disabled (could be due to airplane mode), avoid changing persist
// state here
// MStar Android Patch Begin
if (wifiEnabled) {
setWifiEnabled(wifiEnabled);
} else {
//如果Wifi本身没有启动，测试softap是否需要启动
boolean wifiApEnabled = mSettingsStore.isWifiApToggleEnabled();
if (wifiApEnabled) {
Slog.d(TAG, "wifi ap start with enabled");
setWifiApEnabled(null, wifiApEnabled);
} else {
Slog.d(TAG, "wifi ap start with disabled");
}
}
// MStar Android Patch End
mWifiWatchdogStateMachine = WifiWatchdogStateMachine.makeWifiWatchdogStateMachine(mContext);
}上述实现WifiService.java中，首先来看这句：
boolean wifiEnabled = mSettingsStore.isWifiToggleEnabled();先读取系统上次关机时的wifi开关状态，如果该值为true，证明上次是打开的，那么执行如下代码：
setWifiEnabled(wifiEnabled);来看这句代码的实现：
public synchronized boolean setWifiEnabled(boolean enable) {
enforceChangePermission();
Slog.d(TAG, "setWifiEnabled: " + enable + " pid=" + Binder.getCallingPid() + ", uid=" + Binder.getCallingUid());
if (DBG) {
Slog.e(TAG, "Invoking mWifiStateMachine.setWifiEnabled\n");
}
/*
* Caller might not have WRITE_SECURE_SETTINGS,
* only CHANGE_WIFI_STATE is enforced
*/
long ident = Binder.clearCallingIdentity();
try {
if (! mSettingsStore.handleWifiToggled(enable)) {
// Nothing to do if wifi cannot be toggled
return true;
}
} finally {
Binder.restoreCallingIdentity(ident);
}
mWifiController.sendMessage(CMD_WIFI_TOGGLED);
return true;
}关键是最后一句：mWifiController.sendMessage(CMD_WIFI_TOGGLED);
给WifiController发了个消息：CMD_WIFI_TOGGLED。又转到了WifiController中 :)
刚才前面已经分析过，当wifiController的初始化状态为：ApStaDisabledState。所以，当前这个消息将由该状态来处理，来看它的processMessage()方法：
public boolean processMessage(Message msg) {
switch (msg.what) {
case CMD_WIFI_TOGGLED:
case CMD_AIRPLANE_TOGGLED:
if (mSettingsStore.isWifiToggleEnabled()) {
if (doDeferEnable(msg)) {
if (mHaveDeferredEnable) {
// have 2 toggles now, inc serial number an ignore both
mDeferredEnableSerialNumber++;
}
mHaveDeferredEnable = !mHaveDeferredEnable;
break;
}
if (mDeviceIdle == false) {
transitionTo(mDeviceActiveState);
} else {
checkLocksAndTransitionWhenDeviceIdle();
}
}
break;
....
default:
return NOT_HANDLED;
}
return HANDLED;
}这里可以看到，当系统wifi打开，并且mDeviceIdle == false，则会执行状态转换：
transitionTo(mDeviceActiveState);由addState(mDeviceActiveState, mStaEnabledState);可知，mStaEnabledState是mDeviceActiveState的父状态，所以先执行其enter()方法，
class StaEnabledState extends State {
@Override
public void enter() {
mWifiStateMachine.setSupplicantRunning(true);
}
...
}这里执行了WifiStateMachine的setSupplicantRunning方法。
public void setSupplicantRunning(boolean enable) {
if (enable) {
sendMessage(CMD_START_SUPPLICANT);
} else {
sendMessage(CMD_STOP_SUPPLICANT);
}
}可以看到，这里又发了消息：CMD_START_SUPPLICANT。前面分析WiFiStateMachine初始化的时候，已经说过，其初始化状态为InitialState，所以这个消息将由它的processMessage()方法来处理：
case CMD_START_SUPPLICANT:
if (mWifiNative.loadDriver()) {
try {
mNwService.wifiFirmwareReload(mInterfaceName, "STA");
} catch (Exception e) {
loge("Failed to reload STA firmware " + e);
// continue
}
try {
// A runtime crash can leave the interface up and
// this affects connectivity when supplicant starts up.
// Ensure interface is down before a supplicant start.
mNwService.setInterfaceDown(mInterfaceName);
// Set privacy extensions
mNwService.setInterfaceIpv6PrivacyExtensions(mInterfaceName, true);
// IPv6 is enabled only as long as access point is connected since:
// - IPv6 addresses and routes stick around after disconnection
// - kernel is unaware when connected and fails to start IPv6 negotiation
// - kernel can start autoconfiguration when 802.1x is not complete
mNwService.disableIpv6(mInterfaceName);
} catch (RemoteException re) {
loge("Unable to change interface settings: " + re);
} catch (IllegalStateException ie) {
loge("Unable to change interface settings: " + ie);
}
/* Stop a running supplicant after a runtime restart
* Avoids issues with drivers that do not handle interface down
* on a running supplicant properly.
*/
mWifiMonitor.killSupplicant(mP2pSupported);
if(mWifiNative.startSupplicant(mP2pSupported)) {
setWifiState(WIFI_STATE_ENABLING);
if (DBG) log("Supplicant start successful");
mWifiMonitor.startMonitoring();
transitionTo(mSupplicantStartingState);
} else {
loge("Failed to start supplicant!");
}
} else {
loge("Failed to load driver");
}
break;这一段代码还是比较关键的，可以看到首先通过mWifiNative.loadDriver()去加载驱动，当驱动加载成功后，重新加载固件：
mNwService.wifiFirmwareReload(mInterfaceName, "STA");
mNwService.setInterfaceDown(mInterfaceName)
...
setWifiState(WIFI_STATE_ENABLING);
mWifiMonitor.startMonitoring();
transitionTo(mSupplicantStartingState);
...做了一系列的配置操作，设置wifi状态为WIFI_STATE_ENABLING正在打开，开始监管startMonitoring()，最后把状态转移到mSupplicantStartingState。
看完父状态的操作，再来看mDeviceActiveState的enter方法：
class DeviceActiveState extends State {
@Override
public void enter() {
mWifiStateMachine.setOperationalMode(WifiStateMachine.CONNECT_MODE);
mWifiStateMachine.setDriverStart(true);
mWifiStateMachine.setHighPerfModeEnabled(false);
}
...
}可以看到，这里都是在通过wifi状态机去做一系列的操作，比如设置连接模式，启动driver等，来看看
mWifiStateMachine.setDriverStart(true);看看它的实现：
public void setDriverStart(boolean enable) {
if (enable) {
sendMessage(CMD_START_DRIVER);
} else {
sendMessage(CMD_STOP_DRIVER);
}
}这里由刚才分析的结果，WiFiStateMachine进入了mSupplicantStartingState状态，所以，这个消息将由它的方法去处理，再经过几次状态转换到SupplicantStartedState，driver就启动了。