安卓源码避坑指南11—手机侧连接HFP总是失败

手机侧连接HFP总是失败

安卓版本：Android-9（P版本）

问题现象：手机侧主动连接设备蓝牙总是出现通话不可用

蓝牙连接出现通话协议不可用，说明此次连接中 HFP 连接失败，从而导致通话不可用，HFP相关的连接流程可查看往期文章，此处直接进入正题。

首先查看设备端的HCI，明显看到手机主动连接RFCOMM请求DLC参数协商时，设备侧总是拒绝回复DM，并断开此次的L2CAP链路。

从logcat上能更加清晰知晓设备侧回复DM的具体原因：没找到与之匹配的服务端口 tPORT

01-01 00:44:20.182  1068  1684 D bt_rfcomm: RFCOMM_BufDataInd: Handle multiplexer event 0, p_mcb=0x76aa7ff100
01-01 00:44:20.182  1068  1684 I bt_rfcomm: rfc_mx_sm_state_wait_sabme - evt:0
01-01 00:44:20.182  1068  1684 I bt_rfcomm: rfc_timer_stop
01-01 00:44:20.182  1068  1684 I bt_rfcomm: PORT_StartInd
01-01 00:44:20.182  1068  1684 D bt_rfcomm: PORT_StartInd, RFCOMM_StartRsp RFCOMM_SUCCESS: p_mcb:0x76aa7ff100
01-01 00:44:20.182  1068  1684 I bt_rfcomm: rfc_mx_sm_state_wait_sabme - evt:7
01-01 00:44:20.182  1068  1684 I bt_rfcomm: PORT_StartCnf result:0
01-01 00:44:20.182  1068  1684 I bt_rfcomm: rfc_timer_start - timeout:2 seconds
01-01 00:44:20.193  1068  1684 D bt_rfcomm: RFCOMM_BufDataInd: Handle multiplexer event 4, p_mcb=0x76aa7ff100
01-01 00:44:20.193  1068  1684 D bt_rfcomm: rfc_process_mx_message: type=128, p_mcb=0x76aa7ff100
01-01 00:44:20.193  1068  1684 I bt_stack: [INFO:port_utils.cc(322)] port_find_mcb_dlci_port: Cannot find allocated RFCOMM app port for DLCI 4 on 90:94:97:30:50:21, p_mcb=0x76aa7ff100
01-01 00:44:20.193  1068  1684 I bt_rfcomm: PORT_ParNegInd dlci:4 mtu:256
01-01 00:44:20.193  1068  1684 E bt_stack: [ERROR:port_rfc.cc(285)] PORT_ParNegInd: Disconnect RFCOMM, port not found, dlci=4, p_mcb=0x76aa7ff100, bd_addr=90:94:97:30:50:21
01-01 00:44:20.193  1068  1684 I bt_rfcomm: rfc_timer_start - timeout:2 seconds

查看代码，确定该服务端口是由HF侧通过 bta_hf_client_start_server() 创建并等待AG侧发起连接时使用的。

并且该服务端口的创建在协议栈代码中只有两处调用到：

1. bta_hf_client_api_enable（）协议栈初始化成功后
2. bta_hf_client_mgmt_cback（）前一个AG侧发起的连接成功后

既然协议栈已经考虑到AG侧主动来连接HFP的场景，且做好了相关服务端口的初始化工作，那么本问题中出现端口无法匹配到的情况，又是怎么回事呢？ 难道端口没有被创建出来？

带着这样的疑问继续分析logcat，发现在首次无法匹配到服务端口前有一处异常：HFP连接已达最大连接数时，如果再有HFP的连接请求从AG侧过来，HF侧会直接断开新的连接

01-01 00:36:58.991  1068  1684 D bt_rfcomm: PORT_DlcEstablishInd p_mcb:0x76aa7ff5e0, dlci:4 mtu:1685i, p_port:0x76aa7ff048
01-01 00:36:58.991  1068  1684 I bt_rfcomm: rfc_timer_stop
01-01 00:36:58.991  1068  1684 W bt_btif : bta_hf_client_find_cb_by_rfc_handle: no cb yet 30 alloc 1 conn_handle 29
01-01 00:36:58.991  1068  1684 E bt_btif : bta_hf_client_find_cb_by_rfc_handle: no cb found for rfc handle 30
01-01 00:36:58.992  1068  1684 I bt_rfcomm: PORT_CheckConnection() handle:30
01-01 00:36:58.992  1068  1684 W bt_btif : bta_hf_client_find_cb_by_bda: bdaddr mismatch for handle 0 alloc 1
01-01 00:36:58.992  1068  1684 E bt_btif : bta_hf_client_find_cb_by_bda: block not found
01-01 00:36:58.992  1068  1684 W bt_btif : bta_hf_client_allocate_handle: control block already used index 0
01-01 00:36:58.992  1068  1684 E bt_btif : bta_hf_client_allocate_handle: all control blocks in use!
01-01 00:36:58.992  1068  1684 E bt_btif : bta_hf_client_find_cb_by_handle: handle out of range (1, 1) 65535
01-01 00:36:58.992  1068  1684 E bt_btif : bta_hf_client_mgmt_cback: error allocating a new handle 65535
01-01 00:36:58.992  1068  1684 I bt_rfcomm: RFCOMM_RemoveServer() handle:30
01-01 00:36:58.992  1068  1684 I bt_rfcomm: rfc_port_timer_start - timeout:3 seconds
01-01 00:36:58.992  1068  1684 E bt_btif : bta_hf_client_find_cb_by_handle: handle out of range (1, 1) 0
01-01 00:36:58.992  1068  1684 E bt_btif : bta_hf_client_sm_execute: cb not found for handle 0
01-01 00:36:59.000  1068  1684 D bt_rfcomm: RFCOMM_BufDataInd: Handle multiplexer event 4, p_mcb=0x76aa7ff5e0
01-01 00:36:59.000  1068  1684 D bt_rfcomm: rfc_process_mx_message: type=224, p_mcb=0x76aa7ff5e0
01-01 00:36:59.000  1068  1684 I bt_rfcomm: PORT_ControlInd
01-01 00:36:59.000  1068  1684 I bt_rfcomm: PORT_ControlInd DTR_DSR : 1, RTS_CTS : 1, RI : 0, DCD : 1
01-01 00:36:59.001  1068  1684 W bt_rfcomm: rfc_port_sm_disc_wait_ua, RFC_EVENT_DM|RFC_EVENT_UA[1], index=30
01-01 00:36:59.001  1068  1684 I bt_rfcomm: rfc_port_timer_stop
01-01 00:36:59.001  1068  1684 I bt_rfcomm: rfc_mx_sm_state_connected - evt:8
01-01 00:36:59.001  1068  1684 I bt_rfcomm: rfc_timer_start - timeout:3 seconds
01-01 00:36:59.001  1068  1684 W bt_rfcomm: port_rfc_closed: RFCOMM connection closed, index=30, state=2 reason=Closed[19], UUID=111E, bd_addr=fc:d4:36:22:22:29, is_server=1
01-01 00:36:59.001  1068  1684 D bt_rfcomm: port_release_port p_port: 0x76aa7ff048 state: 0 keep_handle: 0
01-01 00:36:59.001  1068  1684 I bt_rfcomm: rfc_timer_start - timeout:2 seconds
01-01 00:36:59.001  1068  1684 I bt_rfcomm: rfc_port_timer_stop
01-01 00:36:59.001  1068  1684 D bt_rfcomm: port_release_port Clean-up handle: 30

因此在 bta_hf_client_mgmt_cback() 回调函数中因为连接数已达最大值而导致HFP连接失败，首先会 RFCOMM_RemoveServer() 清除掉此次连接所使用的服务端口，但是没有启动创建新服务端口等待其他连接请求。

解决方案：
在bta_hf_client_mgmt_cback（）回调中不管连接成功还是失败都重新创建新的服务端口，保证后续AG侧的HFP连接请求都能正常回复。感兴趣的小伙伴欢迎私信留言一起讨论，共同学习，一起进步！

更多互联互通技术，欢迎关注微信公众号：Connectivity