详解Android4.4 RIL短信接收流程分析

hardware/ril/reference-ril/reference-ril.cstatic void onUnsolicited (const char *s, const char *sms_pdu){ ... ... if (strStartsWith(s, "+CMT:")) {  RIL_onUnsolicitedResponse (   RIL_UNSOL_RESPONSE_NEW_SMS,        /* 上报UNSOL_RESPONSE_NEW_SMS消息 */   sms_pdu, strlen(sms_pdu));  } ... ...}

hardware/ril/libril/ril.cppextern "C"void RIL_onUnsolicitedResponse(int unsolResponse, void *data,        size_t datalen){ ... ... unsolResponseIndex = unsolResponse - RIL_UNSOL_RESPONSE_BASE; /* 找出消息在s_unsolResponses[]的索引 */ ... ... switch (s_unsolResponses[unsolResponseIndex].wakeType) {   /* 禁止进入休眠 */  case WAKE_PARTIAL:   grabPartialWakeLock();   shouldScheduleTimeout = true;  break;  ... ... } ... ... ret = s_unsolResponses[unsolResponseIndex]      /* 调用消息处理函数responseString() */    .responseFunction(p, data, datalen); ... ... ret = sendResponse(p);           /* 发送Parcel中的信息内容到服务端RILJ */}static UnsolResponseInfo s_unsolResponses[] = { ... .../* 消息对应的消息处理函数，新信息到来会唤醒系统 */{RIL_UNSOL_RESPONSE_NEW_SMS, responseString, WAKE_PARTIAL},... ...}；static int responseString(Parcel &p, void *response, size_t responselen) { /* one string only */ startResponse; appendPrintBuf("%s%s", printBuf, (char*)response);     closeResponse; writeStringToParcel(p, (const char *)response);     /* 把字符串格式的信息存到Parcel容器中 */ return 0;}

frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.javaprivate void processUnsolicited (Parcel p) {  ... ... case RIL_UNSOL_RESPONSE_NEW_SMS: ret = responseString(p); break; ... ... switch(response) {  ... ...  case RIL_UNSOL_RESPONSE_NEW_SMS: {   if (RILJ_LOGD) unsljLog(response);      /* 参考log：[UNSL]< UNSOL_RESPONSE_NEW_SMS */   // FIXME this should move up a layer   String a[] = new String[2];   a[1] = (String)ret;   SmsMessage sms;   sms = SmsMessage.newFromCMT(a);       /* 解析PDU格式的短信息 */   if (mGsmSmsRegistrant != null) {    mGsmSmsRegistrant     .notifyRegistrant(new AsyncResult(null, sms, null));   }   break;  }  ... ... } ... ...}private ObjectresponseString(Parcel p) {  String response; response = p.readString();               /* 信息内容转换成Object */ return response;}

frameworks/opt/telephony/src/java/android/telephony/SmsMessage.javapublic static SmsMessage newFromCMT(String[] lines) { // received SMS in 3GPP format SmsMessageBase wrappedMessage =   com.android.internal.telephony.gsm.SmsMessage.newFromCMT(lines);  /* 是对另一个newFromCMT的封装，因为有gsm和cdma两种短信，                     * 即cdma中也有newFromCMT，根据情况按需选择                      */ return new SmsMessage(wrappedMessage);}  com.android.internal.telephony.gsm.SmsMessage.newFromCMT(lines)的实现在frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/SmsMessage.javapublic class SmsMessage extends SmsMessageBase { ... ... public static SmsMessage newFromCMT(String[] lines) {  try {   SmsMessage msg = new SmsMessage();   msg.parsePdu(IccUtils.hexStringToBytes(lines[1]));    /* 解析PDU短信 */   return msg;  } catch (RuntimeException ex) {   Rlog.e(LOG_TAG, "SMS PDU parsing failed: ", ex);   return null;  } } ... ...}  IccUtils.hexStringToBytes(lines[1])把十六进制的字符串转换成字节数组msg.parsePdu()解析这个数组的内容，最后获得短信内容frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/SmsMessage.javaprivate void parsePdu(byte[] pdu) {  ... ... mScAddress = p.getSCAddress();  if (mScAddress != null) {    if (VDBG) Rlog.d(LOG_TAG, "SMS SC address: " + mScAddress);   /* 参考log：SMS SC address: +8613800755500 */ } ... ... mMti = firstByte & 0x3; switch (mMti) {  ... ...   case 3: //GSM 03.40 9.2.3.1: MTI == 3 is Reserved.     //This should be processed in the same way as MTI == 0 (Deliver)    parseSmsDeliver(p, firstByte);         /* 对短信类型为Deliver的短信进行解析 */    break;   ... ...  } ... ...}private void parseSmsDeliver(PduParser p, int firstByte) { ... ... mOriginatingAddress = p.getAddress();                             if (mOriginatingAddress != null) {  if (VDBG) Rlog.v(LOG_TAG, "SMS originating address: "    /* 参考log: SMS originating address: +861371533xxxx */                         + mOriginatingAddress.address);                            } ... ... mProtocolIdentifier = p.getByte(); // TP-Data-Coding-Scheme // see TS 23.038 mDataCodingScheme = p.getByte(); if (VDBG) {  Rlog.v(LOG_TAG, "SMS TP-PID:" + mProtocolIdentifier    + " data coding scheme: " + mDataCodingScheme);    /* 参考log: SMS TP-PID:0 data coding scheme: 0 */ } mScTimeMillis = p.getSCTimestampMillis(); if (VDBG) Rlog.d(LOG_TAG, "SMS SC timestamp: " + mScTimeMillis);   /* 参考log：SMS SC timestamp: 1571831129000 */ boolean hasUserDataHeader = (firstByte & 0x40) == 0x40; parseUserData(p, hasUserDataHeader);          /* 解析信息有效内容 */ ... ... }  private void parseUserData(PduParser p, boolean hasUserDataHeader) { ... ... if (VDBG) Rlog.v(LOG_TAG, "SMS message body (raw): '" + mMessageBody + "'"); /* 短信内容，参考log: SMS message body (raw): 'jchfbfh' */ ... ...} 

frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.javamGsmSmsRegistrant .notifyRegistrant(new AsyncResult(null, sms, null));        /* 把sms转成Object类型 */frameworks/base/core/java/android/os/AsyncResult.javapublic class AsyncResult{ ... ... /** please note, this sets m.obj to be this */ public AsyncResult (Object uo, Object r, Throwable ex) {  userObj = uo;  result = r;  exception = ex; } ... ...}

frameworks/opt/telephony/src/java/com/android/internal/telephony/BaseCommands.java public abstract class BaseCommands implements CommandsInterface { ... ... @Override                                     public void setOnNewGsmSms(Handler h, int what, Object obj) {  /* mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null))中的mGsmSmsRegistrant是在这里创建的 */                        mGsmSmsRegistrant = new Registrant (h, what, obj);                          } ... ...} 

frameworks/base/core/java/android/os/Registrant.javapublic class Registrant                                  {  public Registrant(Handler h, int what, Object obj)      /* 传入需要处理消息为what的事件处理Handler h，obj为事件内容，参考phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null); */                           {   refH = new WeakReference(h);                                 this.what = what;                                   userObj = obj;                                   }  ... ... /**  * This makes a copy of @param ar  */ public void notifyRegistrant(AsyncResult ar)         /* 参考mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null)) */ {  internalNotifyRegistrant (ar.result, ar.exception);   /* ar.result为sms */ } /*package*/ void internalNotifyRegistrant (Object result, Throwable exception)  /* internalNotifyRegistrant (sms, Throwable exception) */ {  Handler h = getHandler();  if (h == null) {   clear();  } else {   Message msg = Message.obtain();       /* 创建一个消息 */   msg.what = what;           /* 消息类型EVENT_NEW_SMS */   msg.obj = new AsyncResult(userObj, result, exception); /* 消息内容sms */   h.sendMessage(msg);          /* 发送消息到注册了这个消息的Handler，参考phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null);的getHandler() */  } } ... ...} 

./frameworks/opt/telephony/src/java/com/android/internal/telephony/ImsSMSDispatcher.javapublic final class ImsSMSDispatcher extends SMSDispatcher { ... ... mGsmInboundSmsHandler = GsmInboundSmsHandler.makeInboundSmsHandler(phone.getContext(),   /* 获取mGsmInboundSmsHandler，并启动状态机 */   storageMonitor, phone);  ... ...}./frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/GsmInboundSmsHandler.javapublic class GsmInboundSmsHandler extends InboundSmsHandler { ... ... /**  * Create a new GSM inbound SMS handler.  */ private GsmInboundSmsHandler(Context context, SmsStorageMonitor storageMonitor,   PhoneBase phone) {  super("GsmInboundSmsHandler", context, storageMonitor, phone,        /* 构造GsmInboundSmsHandler时，通过super()调用InboundSmsHandler的构造函数 */    GsmCellBroadcastHandler.makeGsmCellBroadcastHandler(context, phone));  phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null);        /* 注册EVENT_NEW_SMS消息 */  mDataDownloadHandler = new UsimDataDownloadHandler(phone.mCi); } ... ... /**   * Wait for state machine to enter startup state. We can't send any messages until then.  */ public static GsmInboundSmsHandler makeInboundSmsHandler(Context context,   SmsStorageMonitor storageMonitor, PhoneBase phone) {  GsmInboundSmsHandler handler = new GsmInboundSmsHandler(context, storageMonitor, phone); /* 实例化GsmInboundSmsHandler */  handler.start();                   /* 抽象类InboundSmsHandler继承与StateMachine，而GsmInboundSmsHandler继承于InboundSmsHandler，                         * GsmInboundSmsHandler调用启动状态机方法start()                         */  return handler; } ... ...}./frameworks/opt/telephony/src/java/com/android/internal/telephony/InboundSmsHandler.javapublic abstract class InboundSmsHandler extends StateMachine { ... ... protected InboundSmsHandler(String name, Context context, SmsStorageMonitor storageMonitor,   PhoneBase phone, CellBroadcastHandler cellBroadcastHandler) {  ... ...  addState(mDefaultState);                 /* 构造InboundSmsHandler时，添加状态机的状态 */  addState(mStartupState, mDefaultState);  addState(mIdleState, mDefaultState);  addState(mDeliveringState, mDefaultState);  addState(mWaitingState, mDeliveringState);  setInitialState(mStartupState);               /* 初始化状态机 */  if (DBG) log("created InboundSmsHandler"); } ... ...  class IdleState extends State {  @Override  public void enter() {   if (DBG) log("entering Idle state");   sendMessageDelayed(EVENT_RELEASE_WAKELOCK, WAKELOCK_TIMEOUT);  }  @Override  public void exit() {   mWakeLock.acquire();   if (DBG) log("acquired wakelock, leaving Idle state");  }  @Override  public boolean processMessage(Message msg) {   if (DBG) log("Idle state processing message type " + msg.what);   switch (msg.what) {    case EVENT_NEW_SMS:                /* 空闲时，接收到短信 */    case EVENT_BROADCAST_SMS:     deferMessage(msg);     transitionTo(mDeliveringState);            /* 转到mDeliveringState */     return HANDLED;    ... ...   }  } }   ... ... class DeliveringState extends State {               /* 转到mDeliveringState状态 */  @Override  public void enter() {   if (DBG) log("entering Delivering state");  }  @Override  public void exit() {   if (DBG) log("leaving Delivering state");  }  @Override  public boolean processMessage(Message msg) {   switch (msg.what) {    case EVENT_NEW_SMS:     // handle new SMS from RIL     handleNewSms((AsyncResult) msg.obj);           /* 处理新SMS */     sendMessage(EVENT_RETURN_TO_IDLE);            /* 处理完回到空闲状态 */     return HANDLED;    ... ...   }  }    ... ... }}void handleNewSms(AsyncResult ar) { ... ... SmsMessage sms = (SmsMessage) ar.result; result = dispatchMessage(sms.mWrappedSmsMessage); ... ...}public int dispatchMessage(SmsMessageBase smsb) { ... ... return dispatchMessageRadioSpecific(smsb); ... ...}

./frameworks/opt/telephony/src/java/com/android/internal/telephony/InboundSmsHandler.java class DeliveringState extends State { ... ... public boolean processMessage(Message msg) {  switch (msg.what) {   ... ...   case EVENT_BROADCAST_SMS:               /* 接收到EVENT_BROADCAST_SMS消息并处理 */    // if any broadcasts were sent, transition to waiting state    if (processMessagePart((InboundSmsTracker) msg.obj)) {     transitionTo(mWaitingState);    }    return HANDLED;   ... ...  } } ... ...} boolean processMessagePart(InboundSmsTracker tracker) { ... ... BroadcastReceiver resultReceiver = new SmsBroadcastReceiver(tracker);     /* 创建一个广播接收者，用来处理短信广播的结果 */ ... ... intent = new Intent(Intents.SMS_DELIVER_ACTION);           /* 设置当前intent的action为SMS_DELIVER_ACTION */ // Direct the intent to only the default SMS app. If we can't find a default SMS app // then sent it to all broadcast receivers. ComponentName componentName = SmsApplication.getDefaultSmsApplication(mContext, true); /* 这个action只会发送给carrier app，而且carrier app可以通过set result为RESULT_CANCELED来终止这个广播 */ if (componentName != null) {  // Deliver SMS message only to this receiver  intent.setComponent(componentName);  log("Delivering SMS to: " + componentName.getPackageName() +    " " + componentName.getClassName()); } ... ... dispatchIntent(intent, android.Manifest.permission.RECEIVE_SMS,       /* 广播intent */    AppOpsManager.OP_RECEIVE_SMS, resultReceiver); ... ...} private final class SmsBroadcastReceiver extends BroadcastReceiver { ... ...  public void onReceive(Context context, Intent intent) {  ... ...  // Now that the intents have been deleted we can clean up the PDU data.  if (!Intents.DATA_SMS_RECEIVED_ACTION.equals(action)    && !Intents.DATA_SMS_RECEIVED_ACTION.equals(action)    && !Intents.WAP_PUSH_RECEIVED_ACTION.equals(action)) {   loge("unexpected BroadcastReceiver action: " + action);  }  int rc = getResultCode();  if ((rc != Activity.RESULT_OK) && (rc != Intents.RESULT_SMS_HANDLED)) {   loge("a broadcast receiver set the result code to " + rc     + ", deleting from raw table anyway!");  } else if (DBG) {   log("successful broadcast, deleting from raw table.");  }  deleteFromRawTable(mDeleteWhere, mDeleteWhereArgs);  sendMessage(EVENT_BROADCAST_COMPLETE);            /* 成功广播 */  ... ... } ... ...}