Android7 WIFI系统 PNO机制流程详解和隐藏BUG修改

WIFI启动过程，WifiStateMachine加载驱动固件，连接上wpa_s的socket并检查好配置文件后，进入到DisconnectedState状态。在DisconnectedState状态下启动了mWifiConnectivityManager.handleConnectionStateChanged(WifiConnectivityManager.WIFI_STATE_DISCONNECTED)。这是启动扫描的第一步。

handleConnectionStateChanged(WifiConnectivityManager.WIFI_STATE_DISCONNECTED)startConnectivityScan(SCAN_ON_SCHEDULE)  // SCAN_ON_SCHEDULE == fause

在startConnectivityScan(SCAN_ON_SCHEDULE)中看到：

if (mScreenOn) {startPeriodicScan(scanImmediately); // 亮屏下周期扫描
} else { // screenOffif (mWifiState == WIFI_STATE_CONNECTED) {startConnectedPnoScan();} else {startDisconnectedPnoScan(); // 息屏下扫描wifi}
}

以上代码的扫描过程根据屏幕是否点亮，分成两种情况。一种亮屏下，开始周期扫描。另一种是息屏状态，使用pno扫描。pno扫描又根据当前WifiState是连接状态还是断开状态分为两种情况。

一、startPeriodicScan方法

这个方法用来在亮屏下进行周期扫描：

if (!ENABLE_BACKGROUND_SCAN) {if (scanImmediately) {resetLastPeriodicSingleScanTimeStamp();}Log.e(TAG, "PeriodicSingleScan by zhangdalei");mPeriodicSingleScanInterval = PERIODIC_SCAN_INTERVAL_MS;startPeriodicSingleScan();
}

二、startConnectedPnoScan方法

因为ENABLE_CONNECTED_PNO_SCAN变量设置为false，因此这个方法将不被执行。

三、startDisconnectedPnoScan方法

这是我们现在需要关注的PNO扫描过程：

    private void startDisconnectedPnoScan() {// Initialize PNO settingsPnoSettings pnoSettings = new PnoSettings();ArrayList<PnoSettings.PnoNetwork> pnoNetworkList =mConfigManager.retrieveDisconnectedPnoNetworkList();int listSize = pnoNetworkList.size();if (listSize == 0) {// No saved networklocalLog("No saved network for starting disconnected PNO.");return;}// 设置 pnoSetting 对象参数pnoSettings.networkList = new PnoSettings.PnoNetwork[listSize];pnoSettings.networkList = pnoNetworkList.toArray(pnoSettings.networkList);pnoSettings.min5GHzRssi = mMin5GHzRssi;pnoSettings.min24GHzRssi = mMin24GHzRssi;pnoSettings.initialScoreMax = mInitialScoreMax;pnoSettings.currentConnectionBonus = mCurrentConnectionBonus;pnoSettings.sameNetworkBonus = mSameNetworkBonus;pnoSettings.secureBonus = mSecureBonus;pnoSettings.band5GHzBonus = mBand5GHzBonus;// Initialize scan settingsScanSettings scanSettings = new ScanSettings();scanSettings.band = getScanBand();scanSettings.reportEvents = WifiScanner.REPORT_EVENT_NO_BATCH;scanSettings.numBssidsPerScan = 0;scanSettings.periodInMs = DISCONNECTED_PNO_SCAN_INTERVAL_MS;    // 20s// TODO: enable exponential back off scan later to further save energy// scanSettings.maxPeriodInMs = 8 * scanSettings.periodInMs;mPnoScanListener.clearScanDetails();// 调用Scanner的函数，启动断开wifi下的pno扫描mScanner.startDisconnectedPnoScan(scanSettings, pnoSettings, mPnoScanListener);mPnoScanStarted = true;}

在startDisconnectedPnoScan方法中，将传入的mPnoScanListener放到一个map中，得到一个key。然后调用

startPnoScan(scanSettings, pnoSettings, key);

继续看：

@Scanner.java
private void startPnoScan(ScanSettings scanSettings, PnoSettings pnoSettings, int key) {// Bundle up both the settings and send it across.Bundle pnoParams = new Bundle();// Set the PNO scan flag.scanSettings.isPnoScan = true;pnoParams.putParcelable(PNO_PARAMS_SCAN_SETTINGS_KEY, scanSettings);    // 将setting保存到budle，用来发送pnoParams.putParcelable(PNO_PARAMS_PNO_SETTINGS_KEY, pnoSettings);// 调用mAsyncChannel发送消息mAsyncChannel.sendMessage(CMD_START_PNO_SCAN, 0, key, pnoParams);
}

在WifiStateMachine::DriverStartedState中定义了mWifiScanner。初始化时，出入其中变量mService为WifiScanningServiceImpl。现在看看WifiScanningServiceImpl的初始化过程：

messager为WifiScanningServiceImpl对象，WifiScanner是一个client，WifiScanningServiceImpl是服务端，WifiScanner通过AsyncChannel向WifiScanningServiceImpl发送扫描的命令，在Scanner中完成扫描动作。

在WifiScanningServiceImpl::startService中创建了几个状态机对象并开启了状态机。现在关注mPnoScanStateMachine。

WifiPnoScanStateMachine(Looper looper) {super("WifiPnoScanStateMachine", looper);setLogRecSize(512);setLogOnlyTransitions(false);// CHECKSTYLE:OFF IndentationCheckaddState(mDefaultState);addState(mStartedState, mDefaultState);addState(mHwPnoScanState, mStartedState);addState(mSingleScanState, mHwPnoScanState);addState(mSwPnoScanState, mStartedState);// CHECKSTYLE:ON IndentationCheck  初始化为mDefaultState并setInitialState(mDefaultState);

CMD_START_PNO_SCAN将在SwPnoScanState这个状态中处理。

@WifiScanningServiceImpl.java::SwPnoScanStatepublic boolean processMessage(Message msg) {ClientInfo ci = mClients.get(msg.replyTo);switch (msg.what) {case WifiScanner.CMD_START_PNO_SCAN:Bundle pnoParams = (Bundle) msg.obj;if (pnoParams == null) {replyFailed(msg, WifiScanner.REASON_INVALID_REQUEST, "params null");return HANDLED;}pnoParams.setDefusable(true);PnoSettings pnoSettings =pnoParams.getParcelable(WifiScanner.PNO_PARAMS_PNO_SETTINGS_KEY);ScanSettings scanSettings =pnoParams.getParcelable(WifiScanner.PNO_PARAMS_SCAN_SETTIGS_KEY);if (addSwPnoScanRequest(ci, msg.arg2, scanSettings,pnoSettings)) {replySucceeded(msg);} else {replyFailed(msg, WifiScanner.REASON_INVALID_REQUEST, "bad request");transitionTo(mStartedState);}break;

在处理上次发送的CMD_START_PNO_SCAN消息时，在此处将调用StartedState()做进一步处理。现在看起实现：

@WifiScanningServiceImpl.java::StartedState
public boolean processMessage(Message msg) {ClientInfo ci = mClients.get(msg.replyTo);switch (msg.what) {case WifiScanner.CMD_START_PNO_SCAN:Bundle pnoParams = (Bundle) msg.obj;if (pnoParams == null) {replyFailed(msg, WifiScanner.REASON_INVALID_REQUEST, "params null");return HANDLED;}pnoParams.setDefusable(true);PnoSettings pnoSettings =pnoParams.getParcelable(WifiScanner.PNO_PARAMS_PNO_SETTINGS_KEY);// This message is handled after the transition to SwPnoScan/HwPnoScan statedeferMessage(msg);if (mScannerImpl.isHwPnoSupported(pnoSettings.isConnected)) {transitionTo(mHwPnoScanState);} else {transitionTo(mSwPnoScanState);}break;

我们这里支持HardwarePno,将计入mHwPnoScanState状态，进行处理CMD_START_PNO_SCAN消息：

@HwPnoScanState
public boolean processMessage(Message msg) {ClientInfo ci = mClients.get(msg.replyTo);switch (msg.what) {case WifiScanner.CMD_START_PNO_SCAN:Bundle pnoParams = (Bundle) msg.obj;if (pnoParams == null) {replyFailed(msg, WifiScanner.REASON_INVALID_REQUEST, "params null");return HANDLED;}pnoParams.setDefusable(true);PnoSettings pnoSettings = pnoParams.getParcelable(WifiScanner.PNO_PARAMS_PNO_SETTINGS_KEY);ScanSettings scanSettings =pnoParams.getParcelable(WifiScanner.PNO_PARAMS_SCAN_SETTINGS_KEY);if (addHwPnoScanRequest(ci, msg.arg2, scanSettings, pnoSettings)) {replySucceeded(msg);} else {replyFailed(msg, WifiScanner.REASON_INVALID_REQUEST, "bad request");transitionTo(mStartedState);}break;

上面代码进一步调用addHwPnoScanRequest()函数处理PNO扫描请求。

private boolean addHwPnoScanRequest(ClientInfo ci, int handler, ScanSettings scanSettings, PnoSettings pnoSettings) {WifiNative.PnoSettings nativePnoSettings = convertPnoSettingsToNative(pnoSettings);if (!mScannerImpl.setHwPnoList(nativePnoSettings,mPnoScanStateMachine)) {return false;}
}

这里的mScannerImpl实际是SupplicantWifiScannerImpl类。这里将调用到SupplicantWifiScannerImpl::setHwPnoList();

public boolean setHwPnoList(WifiNative.PnoSettings settings,WifiNative.PnoEventHandler eventHandler) {synchronized (mSettingsLock) {if (mPnoSettings != null) {Log.w(TAG, "Already running a PNO scan");return false;}mPnoEventHandler = eventHandler;mPnoSettings = settings;if (!setNetworkPriorities(settings.networkList)) return false;// For supplicant based PNO, we start the scan immediately when we set pno list.processPendingScans();return true;}
}

调用processPendingScans()进一步处理扫描请求。processPendingScans()函数用来处理各种扫描请求，包括正常的扫描和PNO扫描。现在我们只看PNO扫描:

private void processPendingScans() {else if (isHwPnoScanRequired()) {newScanSettings.setHwPnoScan(mPnoSettings.networkList, mPnoEventHandler);boolean status;// If the PNO network list has changed from the previous request, ensure that// we bypass the debounce logic and restart PNO scan.if (isDifferentPnoScanSettings(newScanSettings)) {// 启动PNO扫描status = restartHwPnoScan();} else {// 启动PNO扫描status = startHwPnoScan();}if (status) {mLastScanSettings = newScanSettings;} else {Log.e(TAG, "Failed to start PNO scan");// indicate scan failure asyncmEventHandler.post(new Runnable() {public void run() {if (mPnoEventHandler != null) {mPnoEventHandler.onPnoScanFailed();}// Clean up PNO state, we don't want to continue PNO scanning.mPnoSettings = null;mPnoEventHandler = null;}});}
}

我们看restartHwPnoScan()的执行流程。不过可想到，接下来将要向wpa_supplicant发送执行了。

private boolean restartHwPnoScan() {mHwPnoDebouncer.forceStopPnoScan();return mHwPnoDebouncer.startPnoScan(mHwPnoDebouncerListener);
}public boolean startPnoScan(Listener listener) {if (DBG) Log.d(TAG, "Starting PNO scan");mListener = listener;if (!setPnoState(true)) {mListener = null;return false;}return true;
}

setPnoState()将调用updatePnoState()函数：

private boolean updatePnoState(boolean enable) {if (mCurrentPnoState == enable) {if (DBG) Log.d(TAG, "PNO state is already " + enable);return true;}mLastPnoChangeTimeStamp = mClock.elapsedRealtime();// 调用Native函数向wpa_supplicant发消息了if (mWifiNative.setPnoScan(enable)) {Log.d(TAG, "Changed PNO state from " + mCurrentPnoState + " to " + enable);mCurrentPnoState = enable;return true;} else {Log.e(TAG, "PNO state change to " + enable + " failed");mCurrentPnoState = false;return false;}
}

public boolean setPnoScan(boolean enable) {String cmd = enable ? "SET pno 1" : "SET pno 0";return doBooleanCommand(cmd);
}

大体的扫描流程就是这样了。

问题

Pno存在这样一个问题：

设置一个wifi密码为空，让设备连接。连接上后，设置wifi有密码。这个时候PNO能够匹配SSID找到wifi，但是加密方式改变了。这是PNO就会持续不断的扫描，导致功耗高。需要解决这个问题。

在SupplicantWifiScannerImpl.java中注册了接收WifiMonitor扫描结果的消息的handle。当扫描错误或是有扫描结果时将调用handle处理。

@SupplicantWifiScannerImpl.java
WifiMonitor.getInstance().registerHandler(mWifiNative.getInterfaceName(), WifiMonitor.SCAN_FAILED_EVENT, mEventHandler);
WifiMonitor.getInstance().registerHandler(mWifiNative.getInterfaceName(), WifiMonitor.SCAN_RESULTS_EVENT, mEventHandler);@Override
public boolean handleMessage(Message msg) {switch(msg.what) {case WifiMonitor.SCAN_FAILED_EVENT:Log.w(TAG, "Scan failed");mAlarmManager.cancel(mScanTimeoutListener);reportScanFailure();processPendingScans();break;case WifiMonitor.SCAN_RESULTS_EVENT:mAlarmManager.cancel(mScanTimeoutListener);pollLatestScanData();processPendingScans();break;default:// ignore unknown event}return true;
}

不管是SCAN_FAILED_EVENT或是SCAN_RESULTS_EVENT都讲调用processPendingScans()进一步处理PNO扫描。

lse if (isHwPnoScanRequired()) {newScanSettings.setHwPnoScan(mPnoSettings.networkList, mPnoEventHandler);boolean status;// If the PNO network list has changed from the previous request, ensure that// we bypass the debounce logic and restart PNO scan.if (isDifferentPnoScanSettings(newScanSettings)) {status = restartHwPnoScan();} else {status = startHwPnoScan();}if (status) {mLastScanSettings = newScanSettings;} else {Log.e(TAG, "Failed to start PNO scan");// indicate scan failure asyncmEventHandler.post(new Runnable() {public void run() {if (mPnoEventHandler != null) {mPnoEventHandler.onPnoScanFailed();}// Clean up PNO state, we don't want to continue PNO scanning.mPnoSettings = null;mPnoEventHandler = null;}});}

现在看上面代码的一些细节：

一是isHwPnoScanRequired()函数：

private boolean isHwPnoScanRequired(boolean isConnectedPno) {return (!isConnectedPno & mHwPnoScanSupported);
}private boolean isHwPnoScanRequired() {if (mPnoSettings == null) return false;return isHwPnoScanRequired(mPnoSettings.isConnected);
}

如果mPnoSettings为NULL,返回false，PNO不在执行。然后mPnoSettings.isConnected我们这里是断开wifi时的pno，为false. mPnoSettings在setHwPnoList时设置。

但是当我们PNO扫描成功，并不会把mPnoSettings设置为NULL，这将导致一次PNO扫描之后，将接着下一次PNO扫描。代码如下；

if (status) {mLastScanSettings = newScanSettings;} else {Log.e(TAG, "Failed to start PNO scan");// indicate scan failure asyncmEventHandler.post(new Runnable() {public void run() {if (mPnoEventHandler != null) {mPnoEventHandler.onPnoScanFailed();}// Clean up PNO state, we don't want to continue PNO scanning.mPnoSettings = null;mPnoEventHandler = null;}});

所以我们需要在扫描成功是吧mPnoSettings设置为NULL。解决问题。