需求：需要测试wifi模块的5g吞吐量。需要开启5g wifiap

实现过程：

1.可行性

首先看下WifiManager开启ap函数的说明：

    /**
     * Start AccessPoint mode with the specified
     * configuration. If the radio is already running in
     * AP mode, update the new configuration
     * Note that starting in access point mode disables station
     * mode operation
     * @param wifiConfig SSID, security and channel details as
     *        part of WifiConfiguration
     * @return {@code true} if the operation succeeds, {@code false} otherwise
     *
     * @hide Dont open up yet
     */
    public boolean setWifiApEnabled(WifiConfiguration wifiConfig, boolean enabled) {
        try {
            mService.setWifiApEnabled(wifiConfig, enabled);
            return true;
        } catch (RemoteException e) {
            return false;
        }
    }

参数wifiConfig可指定 SSID, security 和 channel
然而，WifiConfiguration这个类中不包含channel或者freq这样的属性，那是如何实现配置的呢？

2. 跟源码

跟一下framework的实现：
目前环境是Rockchip3229 android 5.1 ，代码路径与aosp有些差别，不过总体区别不大。
mService.setWifiApEnabled(wifiConfig, enabled);
这里通过Binder直接调用到WifiService的同名函数

2.1. frameworks/opt/net/wifi/service/java/com/android/server/wifi/WifiServiceImpl.java

    /**
     * see {@link android.net.wifi.WifiManager#setWifiApEnabled(WifiConfiguration, boolean)}
     * @param wifiConfig SSID, security and channel details as
     *        part of WifiConfiguration
     * @param enabled true to enable and false to disable
     */
    public void setWifiApEnabled(WifiConfiguration wifiConfig, boolean enabled) {
        ...
        // null wifiConfig is a meaningful input for CMD_SET_AP
        if (wifiConfig == null || wifiConfig.isValid()) {
            mWifiController.obtainMessage(CMD_SET_AP, enabled ? 1 : 0, 0, wifiConfig).sendToTarget();
        } else {
            Slog.e(TAG, "Invalid WifiConfiguration");
        }
    }

这里可以看到，使用wifiController发送msg去下发指令

2.2. frameworks/opt/net/wifi/service/java/com/android/server/wifi/WifiController.java

WifiController继承了StateMachine类，上面的obtainMessage函数是StateMachine类的函数，参数列表是(msgWhat, arg1, arg2, obj)
不清楚有哪些State或各个State下对命令的策略是什么的情况下，直接搜索case CMD_SET_AP，
发现在ApStaDisabledState下的对该命令的处理为

class ApStaDisabledState extends State {
              ...
              if (msg.arg1 == 1) {
                 mWifiStateMachine.setHostApRunning((WifiConfiguration) msg.obj,
                         true);
                 transitionTo(mApEnabledState);
              }

可以看到他会执行开启softap，并转到ApEnabledState，检查一下这个State的操作

    class ApEnabledState extends State {
        @Override
        public boolean processMessage(Message msg) {
            switch (msg.what) {
                ...
                case CMD_SET_AP:
                    if (msg.arg1 == 0) {
                        mWifiStateMachine.setHostApRunning(null, false);
                        transitionTo(mApStaDisabledState);
                    }
                    break;
                default:
                    return NOT_HANDLED;
            }
            return HANDLED;
        }
    }

可以看到，这个State没有复写enter()函数，只处理了关闭softAP的命令

2.3 frameworks/opt/net/wifi/service/java/com/android/server/wifi/WifiStateMachine.java

    public void setHostApRunning(WifiConfiguration wifiConfig, boolean enable) {
        if (enable) {
            sendMessage(CMD_START_AP, wifiConfig);
        } else {
            sendMessage(CMD_STOP_AP);
        }
    }

WifiStateMachine同样继承StateMachine，所以直接找处理CMD_START_AP指令的代码，搜索case CMD_START_AP:

class InitialState extends State {
        ...
        @Override
        public boolean processMessage(Message message) {
                ...
                case CMD_START_AP:
                    if (mWifiNative.loadDriver()) {
                        setWifiApState(WIFI_AP_STATE_ENABLING);
                        transitionTo(mSoftApStartingState);
                    } else {
                        loge("Failed to load driver for softap");
                    }
                ...
        }
        ...
}

这里的执行了加载wifi驱动并转入softapStartingState，没有其他操作，那具体配置softap的操作应该是在该State的enter函数中处理的
我们来看SoftApStartingState这个类的enter函数

    class SoftApStartingState extends State {
        @Override
        public void enter() {
            final Message message = getCurrentMessage();
            if (message.what == CMD_START_AP) {
                final WifiConfiguration config = (WifiConfiguration) message.obj;

                if (config == null) {
                    mWifiApConfigChannel.sendMessage(CMD_REQUEST_AP_CONFIG);
                } else {
                    mWifiApConfigChannel.sendMessage(CMD_SET_AP_CONFIG, config);
                    startSoftApWithConfig(config);
                }
            } else {
                throw new RuntimeException("Illegal transition to SoftApStartingState: " + message);
            }
        }
    ...
    }

这里我们传入的config是不为空的，那么核心逻辑应该是在startSoftApWithConfig(config)这个函数中

    private void startSoftApWithConfig(final WifiConfiguration config) {
        // Start hostapd on a separate thread
        new Thread(new Runnable() {
            public void run() {
                try {
                    mNwService.startAccessPoint(config, mInterfaceName);
                } catch (Exception e) {
                    loge("Exception in softap start " + e);
                    try {
                        mNwService.stopAccessPoint(mInterfaceName);
                        mNwService.startAccessPoint(config, mInterfaceName);
                    } catch (Exception e1) {
                        loge("Exception in softap re-start " + e1);
                        sendMessage(CMD_START_AP_FAILURE);
                        return;
                    }
                }
                ...
            }
        }).start();
    }

这里调用mNwService.startAccessPoint(config, mInterfaceName)并进行了一次出错的重试，这个mInterfaceName是初始化WifiStateMachine时赋值的，我们在WifiServiceImpl类的构造函数中可以看到：

public WifiServiceImpl(Context context) {
        mContext = context;
        mInterfaceName =  SystemProperties.get("wifi.interface", "wlan0");
        mTrafficPoller = new WifiTrafficPoller(mContext, mInterfaceName);
        ...
    }

这里执行getprop，默认值为wlan0，实际也就是wlan0
现在我们继续跟到mNwService这个对象，这里也是通过Binder的叫做INetworkManagementService的接口调用的，在frameworks目录find一下文件NetworkManagementService.java

前方高能！！！！！！！！！！！！！！

2.4 frameworks/base/services/core/java/com/android/server/NetworkManagementService.java

    @Override
    public void startAccessPoint(
            WifiConfiguration wifiConfig, String wlanIface) {
        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
        try {
            wifiFirmwareReload(wlanIface, "AP");
            if (wifiConfig == null) {
                mConnector.execute("softap", "set", wlanIface);
            } else {
                mConnector.execute("softap", "set", wlanIface, wifiConfig.SSID,
                                   "broadcast", "6", getSecurityType(wifiConfig),
                                   new SensitiveArg(wifiConfig.preSharedKey));
            }
            mConnector.execute("softap", "startap");
        } catch (NativeDaemonConnectorException e) {
            throw e.rethrowAsParcelableException();
        }
    }

这里可以看到，这个execute函数里面，终于用到了我们传入的WifiConfiguration，这个参数经历了长途跋涉，终于被解析了！
但是，这里只解析了ssid和preSharedKey，也就是wifiap的用户名密码，没有留地方给我们需要的channel或者freq。我们继续往下看这个函数的形参。

2.5 frameworks/base/services/core/java/com/android/server/NativeDaemonConnector.java

在这个类中搜到了三个execute()函数，根据上面的类型，只能是下面这个

    /**
     * Issue the given command to the native daemon and return a single expected
     * response. Any arguments must be separated from base command so they can
     * be properly escaped.
     */
    public NativeDaemonEvent execute(String cmd, Object... args)
            throws NativeDaemonConnectorException {
        final NativeDaemonEvent[] events = executeForList(cmd, args);
        if (events.length != 1) {
            throw new NativeDaemonConnectorException(
                    "Expected exactly one response, but received " + events.length);
        }
        return events[0];
    }

函数说明中说道，将指令传给native daemon，参数和基础命令必须分开，继续跟调用

    public NativeDaemonEvent[] executeForList(String cmd, Object... args)
            throws NativeDaemonConnectorException {
            return execute(DEFAULT_TIMEOUT, cmd, args);
    }

最终跟到了boss，

    public NativeDaemonEvent[] execute(int timeout, String cmd, Object... args)
            throws NativeDaemonConnectorException {
        ...
        final StringBuilder rawBuilder = new StringBuilder();
        final StringBuilder logBuilder = new StringBuilder();
        final int sequenceNumber = mSequenceNumber.incrementAndGet();

        makeCommand(rawBuilder, logBuilder, sequenceNumber, cmd, args);

        final String rawCmd = rawBuilder.toString();
        final String logCmd = logBuilder.toString();

        synchronized (mDaemonLock) {
            if (mOutputStream == null) {
                throw new NativeDaemonConnectorException("missing output stream");
            } else {
                try {
                    mOutputStream.write(rawCmd.getBytes(StandardCharsets.UTF_8));
                } catch (IOException e) {
                    throw new NativeDaemonConnectorException("problem sending command", e);
                }
            }
        }
        ...
    }

核心部分是通过这个outputStream将指令写出去，写到哪里呢，我们看下这个流对象如何被赋值的：

private void listenToSocket() throws IOException {
        LocalSocket socket = null;
        try {
            socket = new LocalSocket();
            LocalSocketAddress address = determineSocketAddress();
            socket.connect(address);
            InputStream inputStream = socket.getInputStream();
            synchronized (mDaemonLock) {
                mOutputStream = socket.getOutputStream();
            }

            ...
        } catch (IOException ex) {
            loge("Communications error: " + ex);
            throw ex;
        } finally {

           ...
        }
    }

很明显这个是通过determineSocketAddress()这个函数建立的unixSocket，并以客户端的形式连接上这个socket， 看下bind到了哪个地址上：

    private LocalSocketAddress determineSocketAddress() {
        if (mSocket.startsWith("__test__") && Build.IS_DEBUGGABLE) {
            return new LocalSocketAddress(mSocket);
        } else {
            return new LocalSocketAddress(mSocket, LocalSocketAddress.Namespace.RESERVED);
        }
    }

这个mSocket又是在构造中赋值的，那追构造到NativeDaemonConnector->NetworkManagementService
发现这个构造是private的，直接本地搜索，发现在

    static NetworkManagementService create(Context context,
            String socket) throws InterruptedException {
        final NetworkManagementService service = new NetworkManagementService(context, socket);
        final CountDownLatch connectedSignal = service.mConnectedSignal;
        if (DBG) Slog.d(TAG, "Creating NetworkManagementService");
        service.mThread.start();
        if (DBG) Slog.d(TAG, "Awaiting socket connection");
        connectedSignal.await();
        if (DBG) Slog.d(TAG, "Connected");
        return service;
    }

    public static NetworkManagementService create(Context context) throws InterruptedException {
        return create(context, NETD_SOCKET_NAME);
    }

    private static final String NETD_SOCKET_NAME = "netd";

可以看到NETD_SOCKET_NAME就是刚才unixSocket通信的文件名，值为"netd"，那connector这边是socket的client端，另一端在哪里呢。
我们可以看下刚才的代码

return new LocalSocketAddress(mSocket, LocalSocketAddress.Namespace.RESERVED);

注意第二个参数namespace是RESERVED，这说明这个socket必须是init进程开启的，netd是android的很重要的daemon进程，我们在init.rc中可以找到netd的声明

service netd /system/bin/netd
    class main
    socket netd stream 0660 root system
    socket dnsproxyd stream 0660 root inet
    socket mdns stream 0660 root system
    socket fwmarkd stream 0660 root inet

那么在/system/core/init/init.c中的main函数中可以看到解析init.rc的操作

int main(int argc, char **argv)
{
      ...
      restorecon("/dev");
      restorecon("/dev/socket");
      …
      init_parse_config_file("/init.rc");
      …
}

socket的创建过程是在启动netd service的时候，在函数service_start中实现

void service_start(struct service *svc, const char *dynamic_args)
{
        ...
        for (si = svc->sockets; si; si = si->next) {
        int socket_type = (!strcmp(si->type, "stream") ? SOCK_STREAM : (!strcmp(si->type, "dgram") ? SOCK_DGRAM :                     SOCK_SEQPACKET));
            int s = create_socket(si->name, socket_type,
                                  si->perm, si->uid, si->gid);
            if (s >= 0) {
                publish_socket(si->name, s);
            }
        }
        …
}

socket的建立是在create_socket函数中

int create_socket(const char *name, int type, mode_t perm, uid_t uid, gid_t gid)
{
    struct sockaddr_un addr;
    int fd, ret;
#ifdef HAVE_SELINUX
    char *secon;
#endif
 
    fd = socket(PF_UNIX, type, 0);
    ...
}

其实从init启动到socket建立还有很复杂的过程，如要详细说明需要另起篇幅，这里就说到netd的socket建立，然后继续查看netd作为socket的server端，如何处理从NativeDaemonConnector写过去的命令的。
在netd的main.cpp中，可以看到他如何处理命令

2.6 system/netd/server/main.cpp

int main() {
    CommandListener *cl;
    NetlinkManager *nm;
    ...

    ALOGI("Netd 1.0 starting");
    remove_pid_file();
    blockSigpipe();
    if (!(nm = NetlinkManager::Instance())) {
        ALOGE("Unable to create NetlinkManager");
        exit(1);
    };
    cl = new CommandListener();
    nm->setBroadcaster((SocketListener *) cl);
    if (nm->start()) {
        ALOGE("Unable to start NetlinkManager (%s)", strerror(errno));
        exit(1);
    }
    ...

}

这里注册了一个command监听器，来处理通过netd socket传进来的指令

2.7 /system/netd/server/CommandListener.cpp

CommandListener::CommandListener() :
                 FrameworkListener("netd", true) {
    registerCmd(new InterfaceCmd());
    registerCmd(new IpFwdCmd());
    registerCmd(new TetherCmd());
    registerCmd(new NatCmd());
    registerCmd(new ListTtysCmd());
    registerCmd(new PppdCmd());
    registerCmd(new SoftapCmd());
    registerCmd(new BandwidthControlCmd());
    registerCmd(new IdletimerControlCmd());
    registerCmd(new ResolverCmd());
    registerCmd(new FirewallCmd());
    registerCmd(new ClatdCmd());
    registerCmd(new NetworkCommand());
    if (!sNetCtrl)
        sNetCtrl = new NetworkController();
    if (!sTetherCtrl)
        sTetherCtrl = new TetherController();
    if (!sNatCtrl)
        sNatCtrl = new NatController();
    if (!sPppCtrl)
        sPppCtrl = new PppController();
    if (!sSoftapCtrl)
        sSoftapCtrl = new SoftapController();
    if (!sBandwidthCtrl)
        sBandwidthCtrl = new BandwidthController();
    if (!sIdletimerCtrl)
        sIdletimerCtrl = new IdletimerController();
    if (!sResolverCtrl)
        sResolverCtrl = new ResolverController();
    if (!sFirewallCtrl)
        sFirewallCtrl = new FirewallController();
    if (!sInterfaceCtrl)
        sInterfaceCtrl = new InterfaceController();
    if (!sClatdCtrl)
        sClatdCtrl = new ClatdController(sNetCtrl);
    ...

}

这个commandListener的构造里面，定义了很多针对特定指令的处理器，这里我们发送的是softap类型的command，指令是set和startap，处理softap指令部分的代码如下

int CommandListener::SoftapCmd::runCommand(SocketClient *cli,
                                        int argc, char **argv) {
    ...

    if (argc < 2) {
        cli->sendMsg(ResponseCode::CommandSyntaxError,
                     "Missing argument in a SoftAP command", false);
        return 0;
    }
    if (!strcmp(argv[1], "startap")) {
        rc = sSoftapCtrl->startSoftap();
    } else if (!strcmp(argv[1], "stopap")) {
        rc = sSoftapCtrl->stopSoftap();
    } else if (!strcmp(argv[1], "fwreload")) {
        rc = sSoftapCtrl->fwReloadSoftap(argc, argv);
    } else if (!strcmp(argv[1], "status")) {
        asprintf(&retbuf, "Softap service %s running",
                 (sSoftapCtrl->isSoftapStarted() ? "is" : "is not"));
        cli->sendMsg(rc, retbuf, false);
        free(retbuf);
        return 0;
    } else if (!strcmp(argv[1], "set")) {
        rc = sSoftapCtrl->setSoftap(argc, argv);
    } else {
        cli->sendMsg(ResponseCode::CommandSyntaxError, "Unrecognized SoftAP command", false);
        return 0;
    }
    ...

    return 0;
}

看到调用的是softapController->setSoftap()和softapController->startSoftap()

2.7 system/netd/server/SoftapController.cpp

static const char HOSTAPD_CONF_FILE[]    = "/data/misc/wifi/hostapd.conf";
int SoftapController::setSoftap(int argc, char *argv[]) {
    ...

    if (argc > 7) {
        if (!strcmp(argv[6], "wpa-psk")) {
            generatePsk(argv[3], argv[7], psk_str);
            asprintf(&fbuf, "%swpa=3\nwpa_pairwise=TKIP CCMP\nwpa_psk=%s\n", wbuf, psk_str);
        } else if (!strcmp(argv[6], "wpa2-psk")) {
            generatePsk(argv[3], argv[7], psk_str);
            asprintf(&fbuf, "%swpa=2\nrsn_pairwise=CCMP\nwpa_psk=%s\n", wbuf, psk_str);
        } else if (!strcmp(argv[6], "open")) {
            asprintf(&fbuf, "%s", wbuf);
        }
    }
    ...

    fd = open(HOSTAPD_CONF_FILE, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW, 0660);
    ...

    if (write(fd, fbuf, strlen(fbuf)) < 0) {
        ALOGE("Cannot write to \"%s\": %s", HOSTAPD_CONF_FILE, strerror(errno));
        ret = ResponseCode::OperationFailed;
    }
    ...

    return ret;
}

可以看到setSoftap()实际就是把参数存入了配置文件/data/misc/wifi/hostapd.conf
而startSoftap()函数如下：

static const char HOSTAPD_BIN_FILE[]    = "/system/bin/hostapd";
int SoftapController::startSoftap() {
    ...

    if ((pid = fork()) < 0) {
        ALOGE("fork failed (%s)", strerror(errno));
        return ResponseCode::ServiceStartFailed;
    }
    if (!pid) {
        ensure_entropy_file_exists();
        if (execl(HOSTAPD_BIN_FILE, HOSTAPD_BIN_FILE,
                  "-e", WIFI_ENTROPY_FILE,
                  HOSTAPD_CONF_FILE, (char *) NULL)) {
            ALOGE("execl failed (%s)", strerror(errno));
        }
        ALOGE("SoftAP failed to start");
        return ResponseCode::ServiceStartFailed;
    } else {
        mPid = pid;
        ALOGD("SoftAP started successfully");
        usleep(AP_BSS_START_DELAY);
    }
    return ResponseCode::SoftapStatusResult;
}

核心就是调用/system/bin/hostapd，然后使用/data/misc/wifi/hostapd.conf中存储的参数，开启ap。接下来就是hostapd去调用驱动的过程了，平台层的代码就分析完了。接下还会出发TetherStateChange，然后通过TetherController去调用dnsmasq去开启DHCP服务，这里就不做详细分析了。