本文為《深入理解Android Wi-Fi、NFC和GPS卷》讀書筆記，Android源碼為Android 5.1

P2pStateMachine的ProvisionDiscoveryState在其EA中將發送形如"P2P_PROV_DISC 8a:32:9b:6c:d1:80 pbc"的命令給WPAS去執行，其核心處理函數是p2p_ctrl_prov_disc：
android-5.1/external/wpa_supplicant_8/wpa_supplicant/ctrl_iface.c

static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
{u8 addr[ETH_ALEN];char *pos;enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;/* <addr> <config method> [join|auto] */if (hwaddr_aton(cmd, addr))return -1;pos = cmd + 17;if (*pos != ' ')return -1;pos++;if (os_strstr(pos, " join") != NULL)use = WPAS_P2P_PD_FOR_JOIN;else if (os_strstr(pos, " auto") != NULL)use = WPAS_P2P_PD_AUTO;//wpas_p2p_prov_disc 內部將調用 p2p_prov_disc_reqreturn wpas_p2p_prov_disc(wpa_s, addr, pos, use);
}

android-5.1/external/wpa_supplicant_8/src/p2p/p2p_pd.c

int p2p_prov_disc_req(struct p2p_data *p2p, const u8 *peer_addr,u16 config_methods, int join, int force_freq,int user_initiated_pd)
{struct p2p_device *dev;dev = p2p_get_device(p2p, peer_addr);//根據目標設備地址找到對應的p2p_device對象if (dev == NULL)dev = p2p_get_device_interface(p2p, peer_addr);if (dev == NULL || (dev->flags & P2P_DEV_PROBE_REQ_ONLY)) {p2p_dbg(p2p, "Provision Discovery Request destination " MACSTR" not yet known", MAC2STR(peer_addr));return -1;}p2p_dbg(p2p, "Provision Discovery Request with " MACSTR" (config methods 0x%x)",MAC2STR(peer_addr), config_methods);if (config_methods == 0)return -1;/* Reset provisioning info */dev->wps_prov_info = 0;dev->req_config_methods = config_methods;if (join)dev->flags |= P2P_DEV_PD_FOR_JOIN;elsedev->flags &= ~P2P_DEV_PD_FOR_JOIN;//取消dev->flags中的P2P_DEV_PD_FOR_JOIN標志if (p2p->state != P2P_IDLE && p2p->state != P2P_SEARCH &&p2p->state != P2P_LISTEN_ONLY) {p2p_dbg(p2p, "Busy with other operations; postpone Provision Discovery Request with "MACSTR " (config methods 0x%x)",MAC2STR(peer_addr), config_methods);return 0;}p2p->user_initiated_pd = user_initiated_pd;p2p->pd_force_freq = force_freq;if (p2p->user_initiated_pd)p2p->pd_retries = MAX_PROV_DISC_REQ_RETRIES;/** Assign dialog token here to use the same value in each retry within* the same PD exchange.*/dev->dialog_token++;if (dev->dialog_token == 0)dev->dialog_token = 1;//最后調用p2p_send_prov_disc_req發送數據return p2p_send_prov_disc_req(p2p, dev, join, force_freq);
}

android-5.1/external/wpa_supplicant_8/src/p2p/p2p_pd.c

int p2p_send_prov_disc_req(struct p2p_data *p2p, struct p2p_device *dev,int join, int force_freq)
{struct wpabuf *req;int freq;//確定對端設備所在的工作頻段if (force_freq > 0)freq = force_freq;elsefreq = dev->listen_freq > 0 ? dev->listen_freq :dev->oper_freq;if (freq <= 0) {p2p_dbg(p2p, "No Listen/Operating frequency known for the peer "MACSTR " to send Provision Discovery Request",MAC2STR(dev->info.p2p_device_addr));return -1;}if (dev->flags & P2P_DEV_GROUP_CLIENT_ONLY) {if (!(dev->info.dev_capab &P2P_DEV_CAPAB_CLIENT_DISCOVERABILITY)) {p2p_dbg(p2p, "Cannot use PD with P2P Device " MACSTR" that is in a group and is not discoverable",MAC2STR(dev->info.p2p_device_addr));return -1;}/* TODO: use device discoverability request through GO */}//構造Provision Discovery Request幀內容req = p2p_build_prov_disc_req(p2p, dev->dialog_token,dev->req_config_methods,join ? dev : NULL);if (req == NULL)return -1;if (p2p->state != P2P_IDLE)p2p_stop_listen_for_freq(p2p, freq);p2p->pending_action_state = P2P_PENDING_PD; //該標志表明當前pending的Action是PD//p2p_send_action內部將調用 wpas_send_action 函數if (p2p_send_action(p2p, freq, dev->info.p2p_device_addr,p2p->cfg->dev_addr, dev->info.p2p_device_addr,wpabuf_head(req), wpabuf_len(req), 200) < 0) {p2p_dbg(p2p, "Failed to send Action frame");wpabuf_free(req);return -1;}//保存對端P2P設備地址os_memcpy(p2p->pending_pd_devaddr, dev->info.p2p_device_addr, ETH_ALEN);wpabuf_free(req);return 0;
}

上述代碼中，PD Request幀最終將通過p2p_send_action函數發送出去。不過p2p_send_action并不簡單，它將涉及Off Channel發送以及處理對應netlink消息的過程。

下面來看PD Response幀的處理流程。由于PD Response屬于Action幀，所有我么將介紹WPAS中Action幀的接收流程，然后再分析PD Response的處理流程
PD Response幀屬于Public Action幀的一種，根據7.4.1節注冊Action幀監聽事件的分析可知，當收到對端設備發來的PD Response幀后，process_bss_event函數將被調用：
android-5.1/external/wpa_supplicant_8/src/drivers/driver_nl80211.c

static int process_bss_event(struct nl_msg *msg, void *arg)
{struct i802_bss *bss = arg;struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));struct nlattr *tb[NL80211_ATTR_MAX + 1];nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),genlmsg_attrlen(gnlh, 0), NULL);wpa_printf(MSG_DEBUG, "nl80211: BSS Event %d (%s) received for %s",gnlh->cmd, nl80211_command_to_string(gnlh->cmd),bss->ifname);switch (gnlh->cmd) {case NL80211_CMD_FRAME:	//收到對端發送的幀case NL80211_CMD_FRAME_TX_STATUS:	//對應本機發送的管理幀的TX Reportmlme_event(bss, gnlh->cmd, tb[NL80211_ATTR_FRAME],tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],tb[NL80211_ATTR_COOKIE],tb[NL80211_ATTR_RX_SIGNAL_DBM]);break;case NL80211_CMD_UNEXPECTED_FRAME:nl80211_spurious_frame(bss, tb, 0);break;case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:nl80211_spurious_frame(bss, tb, 1);break;default:wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event ""(cmd=%d)", gnlh->cmd);break;}return NL_SKIP;
}

由上述代碼可知，不論是代表由本機所發送的管理幀TX Report的 NL80211_CMD_FRAME_TX_STATUS消息，還是代表本機接收到對端發來的管理幀事件的 NL80211_CMD_FRAME 消息，最終都會調用 mlme_event函數：
android-5.1/external/wpa_supplicant_8/src/drivers/driver_nl80211.c

static void mlme_event(struct i802_bss *bss,enum nl80211_commands cmd, struct nlattr *frame,struct nlattr *addr, struct nlattr *timed_out,struct nlattr *freq, struct nlattr *ack,struct nlattr *cookie, struct nlattr *sig)
{struct wpa_driver_nl80211_data *drv = bss->drv;const u8 *data;size_t len;if (timed_out && addr) {mlme_timeout_event(drv, cmd, addr);return;}if (frame == NULL) {wpa_printf(MSG_DEBUG,"nl80211: MLME event %d (%s) without frame data",cmd, nl80211_command_to_string(cmd));return;}data = nla_data(frame);len = nla_len(frame);if (len < 4 + 2 * ETH_ALEN) {wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s("MACSTR ") - too short",cmd, nl80211_command_to_string(cmd), bss->ifname,MAC2STR(bss->addr));return;}wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s(" MACSTR") A1=" MACSTR " A2=" MACSTR, cmd,nl80211_command_to_string(cmd), bss->ifname,MAC2STR(bss->addr), MAC2STR(data + 4),MAC2STR(data + 4 + ETH_ALEN));if (cmd != NL80211_CMD_FRAME_TX_STATUS && !(data[4] & 0x01) &&os_memcmp(bss->addr, data + 4, ETH_ALEN) != 0 &&os_memcmp(bss->addr, data + 4 + ETH_ALEN, ETH_ALEN) != 0) {wpa_printf(MSG_MSGDUMP, "nl80211: %s: Ignore MLME frame event ""for foreign address", bss->ifname);return;}wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",nla_data(frame), nla_len(frame));switch (cmd) {case NL80211_CMD_AUTHENTICATE:mlme_event_auth(drv, nla_data(frame), nla_len(frame));break;case NL80211_CMD_ASSOCIATE:mlme_event_assoc(drv, nla_data(frame), nla_len(frame));break;case NL80211_CMD_DEAUTHENTICATE:mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,nla_data(frame), nla_len(frame));break;case NL80211_CMD_DISASSOCIATE:mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,nla_data(frame), nla_len(frame));break;case NL80211_CMD_FRAME:mlme_event_mgmt(bss, freq, sig, nla_data(frame),nla_len(frame));break;case NL80211_CMD_FRAME_TX_STATUS:mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),nla_len(frame), ack);break;case NL80211_CMD_UNPROT_DEAUTHENTICATE:mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,nla_data(frame), nla_len(frame));break;case NL80211_CMD_UNPROT_DISASSOCIATE:mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,nla_data(frame), nla_len(frame));break;default:break;}
}

mlme_event 將處理各種類型的幀事件。對應本例而言，此時將調用 mlme_event_mgmt 函數：
android-5.1/external/wpa_supplicant_8/src/drivers/driver_nl80211.c

static void mlme_event_mgmt(struct i802_bss *bss,struct nlattr *freq, struct nlattr *sig,const u8 *frame, size_t len)
{struct wpa_driver_nl80211_data *drv = bss->drv;const struct ieee80211_mgmt *mgmt;union wpa_event_data event;u16 fc, stype;int ssi_signal = 0;int rx_freq = 0;wpa_printf(MSG_MSGDUMP, "nl80211: Frame event");mgmt = (const struct ieee80211_mgmt *) frame;if (len < 24) {wpa_printf(MSG_DEBUG, "nl80211: Too short management frame");return;}fc = le_to_host16(mgmt->frame_control);stype = WLAN_FC_GET_STYPE(fc);if (sig)ssi_signal = (s32) nla_get_u32(sig);os_memset(&event, 0, sizeof(event));if (freq) {event.rx_mgmt.freq = nla_get_u32(freq);rx_freq = drv->last_mgmt_freq = event.rx_mgmt.freq;}wpa_printf(MSG_DEBUG,"nl80211: RX frame sa=" MACSTR" freq=%d ssi_signal=%d stype=%u (%s) len=%u",MAC2STR(mgmt->sa), rx_freq, ssi_signal, stype, fc2str(fc),(unsigned int) len);event.rx_mgmt.frame = frame;event.rx_mgmt.frame_len = len;event.rx_mgmt.ssi_signal = ssi_signal;event.rx_mgmt.drv_priv = bss;//EVENT_RX_MGMT代表管理幀wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
}

wpa_supplicant_event(android-5.1/external/wpa_supplicant_8/wpa_supplicant/event.c)處理 EVENT_RX_ACTION的內容比較豐富，不過對應P2P來說， wpa_supplicant_event將調用 wpas_event_rx_mgmt_action(event.c),wpas_event_rx_mgmt_action調用 wpas_p2p_rx_action(p2p_supplicant.c),wpas_p2p_rx_action 調用 p2p_rx_action()
android-5.1/external/wpa_supplicant_8/src/p2p/p2p.c

void p2p_rx_action(struct p2p_data *p2p, const u8 *da, const u8 *sa,const u8 *bssid, u8 category,const u8 *data, size_t len, int freq)
{if (category == WLAN_ACTION_PUBLIC) { //處理Public Action幀p2p_rx_action_public(p2p, da, sa, bssid, data, len, freq);return;}if (category != WLAN_ACTION_VENDOR_SPECIFIC)return;if (len < 4)return;if (WPA_GET_BE32(data) != P2P_IE_VENDOR_TYPE)return;data += 4;len -= 4;/* P2P action frame */p2p_dbg(p2p, "RX P2P Action from " MACSTR, MAC2STR(sa));wpa_hexdump(MSG_MSGDUMP, "P2P: P2P Action contents", data, len);if (len < 1)return;switch (data[0]) {//P2P規范使用的其他非Public類型的Action幀case P2P_NOA:p2p_dbg(p2p, "Received P2P Action - Notice of Absence");/* TODO */break;case P2P_PRESENCE_REQ:p2p_process_presence_req(p2p, da, sa, data + 1, len - 1, freq);break;case P2P_PRESENCE_RESP:p2p_process_presence_resp(p2p, da, sa, data + 1, len - 1);break;case P2P_GO_DISC_REQ:p2p_process_go_disc_req(p2p, da, sa, data + 1, len - 1, freq);break;default:p2p_dbg(p2p, "Received P2P Action - unknown type %u", data[0]);break;}
}

上述代碼中專門處理Public Action幀的p2p_rx_action_public函數代碼如下所示：
android-5.1/external/wpa_supplicant_8/src/p2p/p2p.c

static void p2p_rx_action_public(struct p2p_data *p2p, const u8 *da,const u8 *sa, const u8 *bssid, const u8 *data,size_t len, int freq)
{if (len < 1)return;switch (data[0]) {case WLAN_PA_VENDOR_SPECIFIC:data++;len--;if (len < 4)return;if (WPA_GET_BE32(data) != P2P_IE_VENDOR_TYPE)return;data += 4;len -= 4;p2p_rx_p2p_action(p2p, sa, data, len, freq);break;case WLAN_PA_GAS_INITIAL_REQ:p2p_rx_gas_initial_req(p2p, sa, data + 1, len - 1, freq);break;case WLAN_PA_GAS_INITIAL_RESP:p2p_rx_gas_initial_resp(p2p, sa, data + 1, len - 1, freq);break;case WLAN_PA_GAS_COMEBACK_REQ:p2p_rx_gas_comeback_req(p2p, sa, data + 1, len - 1, freq);break;case WLAN_PA_GAS_COMEBACK_RESP:p2p_rx_gas_comeback_resp(p2p, sa, data + 1, len - 1, freq);break;}
}

p2p_rx_p2p_action 函數是P2P模塊中Public Action幀得到分類處理的最后一關：
android-5.1/external/wpa_supplicant_8/src/p2p/p2p.c

static void p2p_rx_p2p_action(struct p2p_data *p2p, const u8 *sa,const u8 *data, size_t len, int rx_freq)
{p2p_dbg(p2p, "RX P2P Public Action from " MACSTR, MAC2STR(sa));wpa_hexdump(MSG_MSGDUMP, "P2P: P2P Public Action contents", data, len);if (len < 1)return;switch (data[0]) { //P2P支持的Public Action幀在此處得到分類和相應處理case P2P_GO_NEG_REQ:	//處理GON Request幀p2p_process_go_neg_req(p2p, sa, data + 1, len - 1, rx_freq);break;case P2P_GO_NEG_RESP:	//處理GON Response幀p2p_process_go_neg_resp(p2p, sa, data + 1, len - 1, rx_freq);break;case P2P_GO_NEG_CONF:	//處理GON Confirmation幀p2p_process_go_neg_conf(p2p, sa, data + 1, len - 1);break;case P2P_INVITATION_REQ:	//處理Invitation Request幀p2p_process_invitation_req(p2p, sa, data + 1, len - 1,rx_freq);break;case P2P_INVITATION_RESP:	//處理Invitation Response幀p2p->cfg->send_action_done(p2p->cfg->cb_ctx);p2p_process_invitation_resp(p2p, sa, data + 1, len - 1);break;case P2P_PROV_DISC_REQ:	//處理PD Request幀p2p_process_prov_disc_req(p2p, sa, data + 1, len - 1, rx_freq);break;case P2P_PROV_DISC_RESP://處理PD Response幀p2p_process_prov_disc_resp(p2p, sa, data + 1, len - 1);break;case P2P_DEV_DISC_REQ:	//處理Device Discoverability Request幀p2p_process_dev_disc_req(p2p, sa, data + 1, len - 1, rx_freq);break;case P2P_DEV_DISC_RESP:	//處理Device Discoverability Response幀p2p_process_dev_disc_resp(p2p, sa, data + 1, len - 1);break;default:p2p_dbg(p2p, "Unsupported P2P Public Action frame type %d",data[0]);break;}
}

p2p_rx_p2p_action為P2P Public Action幀處理邏輯的總入口，如果后文分析時碰到其他類型的P2P Public Action幀，我們將直接轉入該函數來分析。

由上述的 p2p_rx_p2p_action可知，PD Response幀對應的處理函數是 p2p_process_prov_disc_resp ：
android-5.1/external/wpa_supplicant_8/src/p2p/p2p_pd.c

void p2p_process_prov_disc_resp(struct p2p_data *p2p, const u8 *sa,const u8 *data, size_t len)
{struct p2p_message msg;struct p2p_device *dev;u16 report_config_methods = 0, req_config_methods;int success = 0;//解析 PD Response幀if (p2p_parse(data, len, &msg))return;p2p_dbg(p2p, "Received Provision Discovery Response from " MACSTR" with config methods 0x%x",MAC2STR(sa), msg.wps_config_methods);//獲取對應的P2P Device對象dev = p2p_get_device(p2p, sa);if (dev == NULL || !dev->req_config_methods) {p2p_dbg(p2p, "Ignore Provision Discovery Response from " MACSTR" with no pending request", MAC2STR(sa));p2p_parse_free(&msg);return;}if (dev->dialog_token != msg.dialog_token) {p2p_dbg(p2p, "Ignore Provision Discovery Response with unexpected Dialog Token %u (expected %u)",msg.dialog_token, dev->dialog_token);p2p_parse_free(&msg);return;}//當前我們pending的action是PD，由于已經收到了PD Response，所以可以置 pending_action_state變量為 P2P_NO_PENDING_ACTION 。if (p2p->pending_action_state == P2P_PENDING_PD) {os_memset(p2p->pending_pd_devaddr, 0, ETH_ALEN);p2p->pending_action_state = P2P_NO_PENDING_ACTION;}/** Use a local copy of the requested config methods since* p2p_reset_pending_pd() can clear this in the peer entry.*/req_config_methods = dev->req_config_methods;/** If the response is from the peer to whom a user initiated request* was sent earlier, we reset that state info here.*/if (p2p->user_initiated_pd &&os_memcmp(p2p->pending_pd_devaddr, sa, ETH_ALEN) == 0)p2p_reset_pending_pd(p2p);//如果所要求的WSC方法和PD Response返回的WSC方法不一致，則表明對端P2P設備不支持所要求的WSC方法。if (msg.wps_config_methods != req_config_methods) {//調用 wpas_prov_disc_fail，以處理PD失敗的情況//不過WPAS中，該函數沒有干什么有意義的事情p2p_dbg(p2p, "Peer rejected our Provision Discovery Request (received config_methods 0x%x expected 0x%x",msg.wps_config_methods, req_config_methods);if (p2p->cfg->prov_disc_fail)p2p->cfg->prov_disc_fail(p2p->cfg->cb_ctx, sa,P2P_PROV_DISC_REJECTED);p2p_parse_free(&msg);goto out;}report_config_methods = req_config_methods;dev->flags &= ~(P2P_DEV_PD_PEER_DISPLAY |P2P_DEV_PD_PEER_KEYPAD);if (req_config_methods & WPS_CONFIG_DISPLAY) {p2p_dbg(p2p, "Peer " MACSTR" accepted to show a PIN on display", MAC2STR(sa));dev->flags |= P2P_DEV_PD_PEER_DISPLAY;} else if (msg.wps_config_methods & WPS_CONFIG_KEYPAD) {p2p_dbg(p2p, "Peer " MACSTR" accepted to write our PIN using keypad",MAC2STR(sa));dev->flags |= P2P_DEV_PD_PEER_KEYPAD;}/* Store the provisioning info */dev->wps_prov_info = msg.wps_config_methods;p2p_parse_free(&msg);success = 1;out:dev->req_config_methods = 0;p2p->cfg->send_action_done(p2p->cfg->cb_ctx);if (dev->flags & P2P_DEV_PD_BEFORE_GO_NEG) {p2p_dbg(p2p, "Start GO Neg after the PD-before-GO-Neg workaround with "MACSTR, MAC2STR(dev->info.p2p_device_addr));dev->flags &= ~P2P_DEV_PD_BEFORE_GO_NEG;p2p_connect_send(p2p, dev);return;}if (success && p2p->cfg->prov_disc_resp) //prov_disc_resp指向 wpas_prov_disc_respp2p->cfg->prov_disc_resp(p2p->cfg->cb_ctx, sa,report_config_methods);if (p2p->state == P2P_PD_DURING_FIND) {p2p_clear_timeout(p2p);p2p_continue_find(p2p);}
}

android-5.1/external/wpa_supplicant_8/wpa_supplicant/p2p_supplicant.c

static void wpas_prov_disc_resp(void *ctx, const u8 *peer, u16 config_methods)
{struct wpa_supplicant *wpa_s = ctx;unsigned int generated_pin = 0;char params[20];//pending_pd_before_join變量對應于這樣一種場景：即GON已經完成，但WSC配置方法還沒有確定if (wpa_s->pending_pd_before_join &&(os_memcmp(peer, wpa_s->pending_join_dev_addr, ETH_ALEN) == 0 ||os_memcmp(peer, wpa_s->pending_join_iface_addr, ETH_ALEN) == 0)) {wpa_s->pending_pd_before_join = 0;wpa_printf(MSG_DEBUG, "P2P: Starting pending ""join-existing-group operation");wpas_p2p_join_start(wpa_s, 0, NULL, 0);return;}if (wpa_s->pending_pd_use == AUTO_PD_JOIN ||wpa_s->pending_pd_use == AUTO_PD_GO_NEG)os_snprintf(params, sizeof(params), " peer_go=%d",wpa_s->pending_pd_use == AUTO_PD_JOIN);elseparams[0] = '\0';if (config_methods & WPS_CONFIG_DISPLAY)wpas_prov_disc_local_keypad(wpa_s, peer, params);else if (config_methods & WPS_CONFIG_KEYPAD) {generated_pin = wps_generate_pin();wpas_prov_disc_local_display(wpa_s, peer, params,generated_pin);} else if (config_methods & WPS_CONFIG_PUSHBUTTON)wpa_msg_global(wpa_s, MSG_INFO, P2P_EVENT_PROV_DISC_PBC_RESPMACSTR "%s", MAC2STR(peer), params);wpas_notify_p2p_provision_discovery(wpa_s, peer, 0 /* response */,P2P_PROV_DISC_SUCCESS,config_methods, generated_pin);
}

對于WSC PBC方法而言，wpa_msg將發送 P2P_EVENT_PROV_DISC_PBC_RESP(字符串，值為"P2P-PROV-DISC-PBC-RESP")消息給客戶端，這也觸發了7.3.2節分析 P2P_PROV_DISC_PBC_RSP_EVENT處理流程中所描述的工作流程

總結

以上是生活随笔為你收集整理的Provision Discovery流程分析的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。