// 获取本地适配器
BluetoothAdapter bluetoothAdapter = BluetoothAdapter.getDefaultAdapter();
// 开启蓝牙，需要权限
if (!bluetoothAdapter.isEnabled()) {
    Intent enableBtIntent = new Intent(BluetoothAdapter.ACTION_REQUEST_ENABLE);
    startActivityForResult(enableBtIntent, REQUEST_ENABLE_BT);
}
// Discover、Pair、Connect

Intent discoverableIntent =
        new Intent(BluetoothAdapter.ACTION_REQUEST_DISCOVERABLE);
discoverableIntent.putExtra(BluetoothAdapter.EXTRA_DISCOVERABLE_DURATION, 300);
startActivity(discoverableIntent);

mBluetoothAdapter.setScanMode(
  BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE, mTimeout)；

@UnsupportedAppUsage
public boolean setScanMode(@ScanMode int mode, int duration) {
    if (getState() != STATE_ON) {
        return false;
    }
    try {
        mServiceLock.readLock().lock();
        if (mService != null) {
            return mService.setScanMode(mode, duration);
        }
    } catch (RemoteException e) {
        Log.e(TAG, "", e);
    } finally {
        mServiceLock.readLock().unlock();
    }
    return false;
}

static const bt_interface_t* sBluetoothInterface

bool SetScanMode(int scan_mode) override {
  switch (scan_mode) {
    case BT_SCAN_MODE_NONE:
    case BT_SCAN_MODE_CONNECTABLE:
    case BT_SCAN_MODE_CONNECTABLE_DISCOVERABLE:
      break;
    default:
      LOG(ERROR) << "Unknown scan mode: " << scan_mode;
      return false;
  }

  auto bd_scanmode = static_cast<bt_scan_mode_t>(scan_mode);

  if (!SetAdapterProperty(BT_PROPERTY_ADAPTER_SCAN_MODE, &bd_scanmode,
                          sizeof(bd_scanmode))) {
    LOG(ERROR) << "Failed to set scan mode to : " << scan_mode;
    return false;
  }

  return true;
}

// Sends a request to set the given HAL adapter property type and value.
bool SetAdapterProperty(bt_property_type_t type, void* value, int length) {
  CHECK(length > 0);
  CHECK(value);

  bt_property_t property;
  property.len = length;
  property.val = value;
  property.type = type;

  int status =
      hal::BluetoothInterface::Get()->GetHALInterface()->set_adapter_property(
          &property);
  if (status != BT_STATUS_SUCCESS) {
    VLOG(1) << "Failed to set property";
    return false;
  }

  return true;
}

  /** This function sets the Bluetooth connectable, discoverable, pairable and
   * conn paired only modes of local device
   */  
void BTA_DmSetVisibility(tBTA_DM_DISC disc_mode, tBTA_DM_CONN conn_mode,
                           uint8_t pairable_mode, uint8_t conn_paired_only) {
    do_in_main_thread(FROM_HERE,
                      base::Bind(bta_dm_set_visibility, disc_mode, conn_mode,
                                 pairable_mode, conn_paired_only));
  }

// stack/hcic/hcicmds.cc
void btsnd_hcic_write_cur_iac_lap(uint8_t num_cur_iac, LAP* const iac_lap) {
    BT_HDR* p = (BT_HDR*)osi_malloc(HCI_CMD_BUF_SIZE);
    uint8_t* pp = (uint8_t*)(p + 1);

    p->len = HCIC_PREAMBLE_SIZE + 1 + (LAP_LEN * num_cur_iac);
    p->offset = 0;

    UINT16_TO_STREAM(pp, HCI_WRITE_CURRENT_IAC_LAP);
    UINT8_TO_STREAM(pp, p->len - HCIC_PREAMBLE_SIZE);

    UINT8_TO_STREAM(pp, num_cur_iac);

    for (int i = 0; i < num_cur_iac; i++) LAP_TO_STREAM(pp, iac_lap[i]);

    btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
}

/*******************************************************************************
*
* Function         btu_hcif_send_cmd
*
* Description      This function is called to send commands to the Host
*                  Controller.
*
* Returns          void
*
******************************************************************************/
void btu_hcif_send_cmd(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_buf) {
    if (!p_buf) return;

    uint16_t opcode;
    uint8_t* stream = p_buf->data + p_buf->offset;
    void* vsc_callback = NULL;

    STREAM_TO_UINT16(opcode, stream);

    // Eww...horrible hackery here
    /* If command was a VSC, then extract command_complete callback */
    if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC ||
        (opcode == HCI_BLE_RAND) || (opcode == HCI_BLE_ENCRYPT)) {
      vsc_callback = *((void**)(p_buf + 1));
    }

    // Skip parameter length before logging
    stream++;
    btu_hcif_log_command_metrics(opcode, stream,
                                 android::bluetooth::hci::STATUS_UNKNOWN, false);

    hci_layer_get_interface()->transmit_command(
        p_buf, btu_hcif_command_complete_evt, btu_hcif_command_status_evt,
        vsc_callback);
}

static void transmit_command(BT_HDR* command,
                           command_complete_cb complete_callback,
                           command_status_cb status_callback, void* context) {
    waiting_command_t* wait_entry = reinterpret_cast<waiting_command_t*>(
        osi_calloc(sizeof(waiting_command_t)));

    uint8_t* stream = command->data + command->offset;
    STREAM_TO_UINT16(wait_entry->opcode, stream);
    wait_entry->complete_callback = complete_callback;
    wait_entry->status_callback = status_callback;
    wait_entry->command = command;
    wait_entry->context = context;

    // Store the command message type in the event field
    // in case the upper layer didn't already
    command->event = MSG_STACK_TO_HC_HCI_CMD;

    enqueue_command(wait_entry);
}

// Event/packet receiving functions
void process_command_credits(int credits) {
    std::lock_guard<std::mutex> command_credits_lock(command_credits_mutex);

    if (!hci_thread.IsRunning()) {
      // HCI Layer was shut down or not running
      return;
    }

    // Subtract commands in flight.
    command_credits = credits - get_num_waiting_commands();

    while (command_credits > 0 && !command_queue.empty()) {
      if (!hci_thread.DoInThread(FROM_HERE, std::move(command_queue.front()))) {
        LOG(ERROR) << __func__ << ": failed to enqueue command";
      }
      command_queue.pop();
      command_credits--;
    }
}

Return<void> BluetoothHci::initialize(
  const ::android::sp<IBluetoothHciCallbacks>& cb) {
    ALOGI("BluetoothHci::initialize()");
    if (cb == nullptr) {
      ALOGE("cb == nullptr! -> Unable to call initializationComplete(ERR)");
      return Void();
    }

    death_recipient_->setHasDied(false);
    cb->linkToDeath(death_recipient_, 0);
    int hci_fd = openBtHci();
    auto hidl_status = cb->initializationComplete(
            hci_fd > 0 ? Status::SUCCESS : Status::INITIALIZATION_ERROR);
    if (!hidl_status.isOk()) {
        ALOGE("VendorInterface -> Unable to call initializationComplete(ERR)");
    }
    hci::H4Protocol* h4_hci = new hci::H4Protocol(
        hci_fd,
        [cb](const hidl_vec<uint8_t>& packet) { cb->hciEventReceived(packet); },
        [cb](const hidl_vec<uint8_t>& packet) { cb->aclDataReceived(packet); },
        [cb](const hidl_vec<uint8_t>& packet) { cb->scoDataReceived(packet); });

    fd_watcher_.WatchFdForNonBlockingReads(
            hci_fd, [h4_hci](int fd) { h4_hci->OnDataReady(fd); });
    hci_handle_ = h4_hci;

    unlink_cb_ = [cb](sp<BluetoothDeathRecipient>& death_recipient) {
      if (death_recipient->getHasDied())
        ALOGI("Skipping unlink call, service died.");
      else
        cb->unlinkToDeath(death_recipient);
    };

    return Void();
}

// system/bt/vendor_libs/linux/interface/bluetooth_hci.cc
int BluetoothHci::openBtHci() {
    ALOGI( "%s", __func__);

    int hci_interface = 0;
    rfkill_state_ = NULL;
    rfKill(1);

    int fd = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
    if (fd < 0) {
    ALOGE( "Bluetooth socket error: %s", strerror(errno));
      return -1;
    }
    bt_soc_fd_ = fd;

    if (waitHciDev(hci_interface)) {
    ALOGE( "HCI interface (%d) not found", hci_interface);
      ::close(fd);
      return -1;
    }
    struct sockaddr_hci addr;
    memset(&addr, 0, sizeof(addr));
    addr.hci_family = AF_BLUETOOTH;
    addr.hci_dev = hci_interface;
    addr.hci_channel = HCI_CHANNEL_USER;
    if (bind(fd, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
    ALOGE( "HCI Channel Control: %s", strerror(errno));
      ::close(fd);
      return -1;
    }
    ALOGI( "HCI device ready");
    return fd;
}

static void enqueue_command(waiting_command_t* wait_entry) {
	base::Closure callback = base::Bind(&event_command_ready, wait_entry);
    //...
	command_queue.push(std::move(callback));
}

  static void event_command_ready(waiting_command_t* wait_entry) {
    {
      /// Move it to the list of commands awaiting response
      std::lock_guard<std::recursive_timed_mutex> lock(
          commands_pending_response_mutex);
      wait_entry->timestamp = std::chrono::steady_clock::now();
      list_append(commands_pending_response, wait_entry);
    }
    // Send it off
    packet_fragmenter->fragment_and_dispatch(wait_entry->command);

    update_command_response_timer();
  }

static void fragment_and_dispatch(BT_HDR* packet) {
    CHECK(packet != NULL);

    uint16_t event = packet->event & MSG_EVT_MASK;
    uint8_t* stream = packet->data + packet->offset;

    // We only fragment ACL packets
    if (event != MSG_STACK_TO_HC_HCI_ACL) {
      callbacks->fragmented(packet, true);
      return;
    }
    // ACL/L2CAP fragment...
}

static const packet_fragmenter_callbacks_t packet_fragmenter_callbacks = {
  transmit_fragment, dispatch_reassembled, fragmenter_transmit_finished
};

// Callback for the fragmenter to send a fragment
static void transmit_fragment(BT_HDR* packet, bool send_transmit_finished) {
    btsnoop->capture(packet, false);

    // HCI command packets are freed on a different thread when the matching
    // event is received. Check packet->event before sending to avoid a race.
    bool free_after_transmit =
        (packet->event & MSG_EVT_MASK) != MSG_STACK_TO_HC_HCI_CMD &&
        send_transmit_finished;

    hci_transmit(packet);

    if (free_after_transmit) {
      buffer_allocator->free(packet);
    }
}