RIL短信接收和发送流程分析最新版android.docx

1、RIL短信接收和发送流程分析最新版android(RIL)短信接收和发送流程分析最新版(android ) 参考网站： 为了能更好的了解android接收短信的流程，我进行了更深入的分析，从RIL的通信架构来分析当接收到短信的整个流程。从frameword里的RIL.java（观察360的短信拦截和QQ管家的短信拦截，发现先安装的就能先拦截到的短信，然后中断广播，之后谁都不能获取到短信。从这里可以推出系统大概有一个广播表，同等级的按安装先后顺序排放。目前的方法是在应用层调用framework API进行控制的） 文件可以看出发送短信和接收短信是通过Receiver和Sender架构，发送短信主

2、要通过Sender框架，主要如下(图是从网上窃滴)： 上层函数调用Command Interface将请求消息发送到sender架构，由该架构将请求发送到RILD的架构。补充发送的子类 class RILSender extends Handler implements Runnable public RILSender(Looper looper) super(looper); / Only allocated once byte dataLength = new byte4; /* Runnable implementation public void run() /setup if ne

3、eded /* Handler implementation Override public void handleMessage(Message msg) RILRequest rr = (RILRequest)(msg.obj); RILRequest req = null; switch (msg.what) case EVENT_SEND: /* * mRequestMessagePending+ already happened for every * EVENT_SEND, thus we must make sure * mRequestMessagePending- happe

4、ns once and only once */ boolean alreadySubtracted = false; try LocalSocket s; s = mSocket; if (s = null) rr.onError(RADIO_NOT_AVAILABLE, null); rr.release(); if (mRequestMessagesPending 0) mRequestMessagesPending-; alreadySubtracted = true; return; synchronized (mRequestsList) mRequestsList.add(rr)

5、; mRequestMessagesWaiting+; if (mRequestMessagesPending 0) mRequestMessagesPending-; alreadySubtracted = true; byte data; data = rr.mp.marshall(); rr.mp.recycle(); rr.mp = null; if (data.length RIL_MAX_COMMAND_BYTES) throw new RuntimeException( Parcel larger than max bytes allowed! + data.length); /

6、 parcel length in big endian dataLength0 = dataLength1 = 0; dataLength2 = (byte)(data.length 8) & 0xff); dataLength3 = (byte)(data.length) & 0xff); /Log.v(LOG_TAG, writing packet: + data.length + bytes); s.getOutputStream().write(dataLength); s.getOutputStream().write(data); catch (IOException ex) L

7、og.e(LOG_TAG, IOException, ex); req = findAndRemoveRequestFromList(rr.mSerial); / make sure this request has not already been handled, / eg, if RILReceiver cleared the list. if (req != null | !alreadySubtracted) rr.onError(RADIO_NOT_AVAILABLE, null); rr.release(); catch (RuntimeException exc) Log.e(

8、LOG_TAG, Uncaught exception , exc); req = findAndRemoveRequestFromList(rr.mSerial); / make sure this request has not already been handled, / eg, if RILReceiver cleared the list. if (req != null | !alreadySubtracted) rr.onError(GENERIC_FAILURE, null); rr.release(); finally / Note: We are Done only if

9、 there are no outstanding / requests or replies. Thus this code path will only release / the wake lock on errors. releaseWakeLockIfDone(); if (!alreadySubtracted & mRequestMessagesPending 0) mRequestMessagesPending-; break; case EVENT_WAKE_LOCK_TIMEOUT: / Havent heard back from the last request. Ass

10、ume were / not getting a response and release the wake lock. synchronized (mWakeLock) if (mWakeLock.isHeld() / The timer of WAKE_LOCK_TIMEOUT is reset with each / new send request. So when WAKE_LOCK_TIMEOUT occurs / all requests in mRequestList already waited at / least DEFAULT_WAKE_LOCK_TIMEOUT but

11、 no response. / Reset mRequestMessagesWaiting to enable / releaseWakeLockIfDone(). / / Note: Keep mRequestList so that delayed response / can still be handled when response finally comes. if (mRequestMessagesWaiting != 0) Log.d(LOG_TAG, NOTE: mReqWaiting is NOT 0 but + mRequestMessagesWaiting + at T

12、IMEOUT, reset! + There still msg waitng for response); mRequestMessagesWaiting = 0; if (RILJ_LOGD) synchronized (mRequestsList) int count = mRequestsList.size(); Log.d(LOG_TAG, WAKE_LOCK_TIMEOUT + mRequestList= + count); for (int i = 0; i 0 & retryCount 8) Log.i (LOG_TAG, Couldnt find + rilSocket +

13、socket; retrying after timeout); try Thread.sleep(SOCKET_OPEN_RETRY_MILLIS); catch (InterruptedException er) retryCount+; continue; retryCount = 0; mSocket = s; Log.i(LOG_TAG, Connected to + rilSocket + socket); int length = 0; try InputStream is = mSocket.getInputStream(); for (;) Parcel p; length

14、= readRilMessage(is, buffer); if (length 0) / End-of-stream reached break; p = Parcel.obtain(); p.unmarshall(buffer, 0, length); p.setDataPosition(0); /Log.v(LOG_TAG, Read packet: + length + bytes); processResponse(p); p.recycle(); catch (java.io.IOException ex) Log.i(LOG_TAG, + rilSocket + socket c

15、losed, ex); catch (Throwable tr) Log.e(LOG_TAG, Uncaught exception read length= + length + Exception: + tr.toString(); Log.i(LOG_TAG, Disconnected from + rilSocket + socket); setRadioState (RadioState.RADIO_UNAVAILABLE); try mSocket.close(); catch (IOException ex) mSocket = null; RILRequest.resetSer

16、ial(); / Clear request list on close clearRequestsList(RADIO_NOT_AVAILABLE, false); catch (Throwable tr) Log.e(LOG_TAG,Uncaught exception, tr); /* Were disconnected so we dont know the ril version */ notifyRegistrantsRilConnectionChanged(-1); 因此从代码可以看出获取到短信消息后经过一系列地分析然后提交给processResponse(p); 方法处理，处理

17、过程中会有两种response，一种是主动上报，比如网络状态，短信，来电等都不需要经过请求，用unsolicited词语专门描述，另一种才是真正意义上的response，也就是命令的响应用solicited描述。那接收短信就是属于unsolicited，跳到processUnsolicited (Parcel p)方法，查看该方法可得出会继续触发以下方法mSMSRegistrant.notifyRegistrant(new AsyncResult(null, sms, null);追溯该方法对象的创建，最后发现该方法设置handler的源头是在：SMSDispatcher类里 该类做了一件重要

18、的事：给Command Interface设置handler的处理方法，就是当接收到短信后触发mSMSRegistrant.notifyRegistrant(new AsyncResult(null, sms, null);方法，然后回调调用之前传入的handler，接着在handler里面处理短信消息。mCm.setOnNewSMS(this, EVENT_NEW_SMS, null);mCm.setOnSmsStatus(this, EVENT_NEW_SMS_STATUS_REPORT, null);mCm.setOnIccSmsFull(this, EVENT_ICC_FULL, nu

19、ll);mCm.registerForOn(this, EVENT_RADIO_ON, null);handler处理接收到的短信消息：Override public void handleMessage(Message msg) AsyncResult ar; switch (msg.what) case EVENT_NEW_SMS: / A new SMS has been received by the device if (Config.LOGD) Log.d(TAG, New SMS Message Received); SmsMessage sms; ar = (AsyncResu

20、lt) msg.obj; if (ar.exception != null) Log.e(TAG, Exception processing incoming SMS. Exception: + ar.exception); return; sms = (SmsMessage) ar.result; try int result = dispatchMessage(sms.mWrappedSmsMessage); if (result != Activity.RESULT_OK) / RESULT_OK means that message was broadcast for app(s) t

21、o / handle. / Any other result, we should ack here. boolean handled = (result = Intents.RESULT_SMS_HANDLED); notifyAndAcknowledgeLastIncomingSms(handled, result, null); catch (RuntimeException ex) Log.e(TAG, Exception dispatching message, ex); notifyAndAcknowledgeLastIncomingSms(false, Intents.RESULT_SMS_GENERIC_ERROR, null); break; int result = dispatchMessage(sms.mWrappedSmsMessage); 该段会通过子类（GsmSMSDispatcher）的dispatchMessage方法处理。经一系列的判断处理最后普通短信将交给dispatchPdus(pdus);这个方法处理。protected void