本文基于 AOSP 的 android-11.0.0_r48 分支。

1.Overview

作用：各模块的 BTA 层的状态机触发事件源。

1. bta_sys_sendmsg() 与 bta_sys_sendmsg_delayed() 差距在于立即执行与延时执行，其他运行机制相同；
2. bta_sys_sendmsg() 会在 main_thread 中处理消息；
3. bta_sys_sendmsg() 对应各个模块（Profile）处于蓝牙协议栈的 Bluetooth Application 层的状态机入口；
4. bta_sys_sendmsg() 对应的消息处理回调函数在各模块的 bat_xx_api.cc 源文件中注册，该回调函数在各模块的 bta_xx_main.cc 中实现；
5. 本文以某个模块为例，介绍了 bta_xx_main.cc 中的回到函数代表的状态机的执行原理
6. 消息的 event 字段（p_msg->event ）右移 8 位的值即为模块 ID，模块 ID 列表在第二部分的末尾列出。

---

2. bta_sys_sendmsg() - Implementation

2.1 bta_sys_sendmsg() 执行流程

system/bt/bta/sys/bta_sys_main.cc

void bta_sys_sendmsg(void* p_msg) {
  if (do_in_main_thread(
          FROM_HERE,
          base::Bind(&bta_sys_event, static_cast<BT_HDR_RIGID*>(p_msg))) !=
      BT_STATUS_SUCCESS) {
......
  }
}



void bta_sys_sendmsg_delayed(void* p_msg, const base::TimeDelta& delay) {
  if (do_in_main_thread_delayed(
          FROM_HERE,
          base::Bind(&bta_sys_event, static_cast<BT_HDR_RIGID*>(p_msg)),
          delay) != BT_STATUS_SUCCESS) {
......
  }
}

由 bta_sys_sendmsg() 源码可知，其作用是在 main_thread 中执行 bta_sys_event()

void bta_sys_event(BT_HDR* p_msg) {
......
  /* get subsystem id from event */
  id = (uint8_t)(p_msg->event >> 8);

  /* verify id and call subsystem event handler */
  if ((id < BTA_ID_MAX) && (bta_sys_cb.reg[id] != NULL)) {
    freebuf = (*bta_sys_cb.reg[id]->evt_hdlr)(p_msg);
......
  }
......
}

由 bta_sys_event() 源码可知，其作用执行 msg 持有的 event 对应的回调函数，该回调函数由其他模块注册到此。

2.2 bta_sys_sendmsg() 执行的回调函数的注册流程

void bta_sys_register(uint8_t id, const tBTA_SYS_REG* p_reg) {
  bta_sys_cb.reg[id] = (tBTA_SYS_REG*)p_reg;
  bta_sys_cb.is_reg[id] = true;
}

1. id 作为数组的角标
2. p_reg 作为回调函数或函数列表

根据下面的 bta_sys_register() 的参数原型可知，调用的即为传递进来的 struct 的第一个函数。
system/bt/bta/sys/bta_sys.h

typedef struct {
  tBTA_SYS_EVT_HDLR* evt_hdlr;
  tBTA_SYS_DISABLE* disable;
} tBTA_SYS_REG;

下面看看 bta_sys_register() 的调用情况

bta_sys_register() 调用举例

以第一个 bta_dm_api.cc 的调用为例，详细看看注册过程。
system/bt/bta/dm/bta_dm_api.cc

tBTA_STATUS BTA_EnableBluetooth(tBTA_DM_SEC_CBACK* p_cback) {
......
  bta_sys_register(BTA_ID_DM_SEARCH, &bta_dm_search_reg);
......
  return BTA_SUCCESS;
}

暂不关心 BTA_EnableBluetooth() 何时执行，但一定会执行。
回调函数所在的结构体如下

static const tBTA_SYS_REG bta_dm_search_reg = {bta_dm_search_sm_execute,
                                               bta_dm_search_sm_disable};

两个回调函数的实现如下，前者是一个状态机，后者是取消注册。
system/bt/bta/dm/bta_dm_main.cc

bool bta_dm_search_sm_execute(BT_HDR* p_msg) {
......
  return true;
}


void bta_dm_search_sm_disable() { bta_sys_deregister(BTA_ID_DM_SEARCH); }

2.3 回调函数对应的模块列表

回调函数对应的全部的模块 id 如下宏定义
system/bt/bta/sys/bta_sys.h

/* SW sub-systems */
#define BTA_ID_SYS 0 /* system manager */
/* BLUETOOTH PART - from 0 to BTA_ID_BLUETOOTH_MAX */
#define BTA_ID_DM_SEARCH 2      /* device manager search */
#define BTA_ID_DM_SEC 3         /* device manager security */
#define BTA_ID_DG 4             /* data gateway */
#define BTA_ID_AG 5             /* audio gateway */
#define BTA_ID_OPC 6            /* object push client */
#define BTA_ID_OPS 7            /* object push server */
#define BTA_ID_FTS 8            /* file transfer server */
#define BTA_ID_CT 9             /* cordless telephony terminal */
#define BTA_ID_FTC 10           /* file transfer client */
#define BTA_ID_SS 11            /* synchronization server */
#define BTA_ID_PR 12            /* Printer client */
#define BTA_ID_BIC 13           /* Basic Imaging Client */
#define BTA_ID_PAN 14           /* Personal Area Networking */
#define BTA_ID_BIS 15           /* Basic Imaging Server */
#define BTA_ID_ACC 16           /* Advanced Camera Client */
#define BTA_ID_SC 17            /* SIM Card Access server */
#define BTA_ID_AV 18            /* Advanced audio/video */
#define BTA_ID_AVK 19           /* Audio/video sink */
#define BTA_ID_HD 20            /* HID Device */
#define BTA_ID_CG 21            /* Cordless Gateway */
#define BTA_ID_BP 22            /* Basic Printing Client */
#define BTA_ID_HH 23            /* Human Interface Device Host */
#define BTA_ID_PBS 24           /* Phone Book Access Server */
#define BTA_ID_PBC 25           /* Phone Book Access Client */
#define BTA_ID_JV 26            /* Java */
#define BTA_ID_HS 27            /* Headset */
#define BTA_ID_MSE 28           /* Message Server Equipment */
#define BTA_ID_MCE 29           /* Message Client Equipment */
#define BTA_ID_HL 30            /* Health Device Profile*/
#define BTA_ID_GATTC 31         /* GATT Client */
#define BTA_ID_GATTS 32         /* GATT Client */
#define BTA_ID_SDP 33           /* SDP Client */
#define BTA_ID_BLUETOOTH_MAX 34 /* last BT profile */

/* GENERIC */
#define BTA_ID_PRM 38
#define BTA_ID_SYSTEM 39  /* platform-specific */
#define BTA_ID_SWRAP 40   /* Insight script wrapper */
#define BTA_ID_MIP 41     /* Multicase Individual Polling */
#define BTA_ID_RT 42      /* Audio Routing module: This module is always on. */
#define BTA_ID_CLOSURE 43 /* Generic C++ closure  */

/* JV */
#define BTA_ID_JV1 44 /* JV1 */
#define BTA_ID_JV2 45 /* JV2 */

#define BTA_ID_MAX (44 + BTA_DM_NUM_JV_ID)

---

3. 状态机的运行原理 - bta_dm_search_sm_execute()

system/bt/bta/dm/bta_dm_main.cc

bool bta_dm_search_sm_execute(BT_HDR* p_msg) {
  tBTA_DM_ST_TBL state_table;
  uint8_t action;
  int i;

  APPL_TRACE_EVENT("bta_dm_search_sm_execute state:%d, event:0x%x",
                   bta_dm_search_cb.state, p_msg->event);

  /* look up the state table for the current state */
  state_table = bta_dm_search_st_tbl[bta_dm_search_cb.state];

  bta_dm_search_cb.state =
      state_table[p_msg->event & 0x00ff][BTA_DM_SEARCH_NEXT_STATE];

  /* execute action functions */
  for (i = 0; i < BTA_DM_SEARCH_ACTIONS; i++) {
    action = state_table[p_msg->event & 0x00ff][i];
    if (action != BTA_DM_SEARCH_IGNORE) {
      (*bta_dm_search_action[action])((tBTA_DM_MSG*)p_msg);
    } else {
      break;
    }
  }
  return true;
}

挖坑待填