Android4.4 RIL短信接收流程分析 [復制鏈接]

2019-12-5 14:00
byebye0521 閱讀:22 評論:0 贊:0
Tag:  短信

 近有客戶反饋Android接收不到短信,于是一頭扎進RIL里面找原因。最后發現不是RIL的問題,而是BC72上報
短信的格式不對,AT+CNMA=1無作用等幾個小問題導致的。盡管問題不在RIL,但總算把RIL短信接收流程搞清楚了。

接收到新信息的log:

D/ATC ( 1269): AT< +CMT:,27
D/ATC ( 1268): AT< 0891683108705505F0040d91683117358313f500009101329154922307ea31da2c36a301
D/RILJ ( 1792): [UNSL]< UNSOL_RESPONSE_NEW_SMS
D/SmsMessage( 1792): SMS SC address: +8613800755500
V/SmsMessage( 1792): SMS originating address: +8613715338315
V/SmsMessage( 1792): SMS TP-PID:0 data coding scheme: 0
D/SmsMessage( 1792): SMS SC timestamp: 1571831129000
V/SmsMessage( 1792): SMS message body (raw): 'jchfbfh'
D/GsmInboundSmsHandler( 1776): Idle state processing message type 1
D/GsmInboundSmsHandler( 1776): acquired wakelock, leaving Idle state
D/GsmInboundSmsHandler( 1776): entering Delivering state
D/GsmInboundSmsHandler( 1776): URI of new row -> content://raw/3
D/RILJ ( 1775): [3706]> SMS_ACKNOWLEDGE true 0
D/RILC ( 1254): onRequest: SMS_ACKNOWLEDGE
D/ATC ( 1254): AT> AT+CNMA=1
D/ATC ( 1254): AT< OK
D/RILJ ( 1775): [3706]< SMS_ACKNOWLEDGE
D/GsmInboundSmsHandler( 1775): Delivering SMS to: com.android.mms com.android.mms.transaction.PrivilegedSmsReceiver
E/GsmInboundSmsHandler( 1775): unexpected BroadcastReceiver action: android.provider.Telephony.SMS_RECEIVED
D/GsmInboundSmsHandler( 1775): successful broadcast, deleting from raw table.
D/SmsMessage( 2124): SMS SC address: +8613800755500
D/GsmInboundSmsHandler( 1775): Deleted 1 rows from raw table.
D/GsmInboundSmsHandler( 1775): ordered broadcast completed in: 276 ms
D/GsmInboundSmsHandler( 1775): leaving Delivering state
D/GsmInboundSmsHandler( 1775): entering Delivering state
D/GsmInboundSmsHandler( 1775): leaving Delivering state
D/GsmInboundSmsHandler( 1775): entering Idle state
V/SmsMessage( 2124): SMS originating address: +8613715338315
V/SmsMessage( 2124): SMS TP-PID:0 data coding scheme: 0
D/SmsMessage( 2124): SMS SC timestamp: 1572253549000
V/SmsMessage( 2124): SMS message body (raw): 'jchfbfh'
D/GsmInboundSmsHandler( 1775): Idle state processing message type 5
D/GsmInboundSmsHandler( 1775): mWakeLock released

 

一、短信接收

1. vendor ril接收到modem上報的短信息

hardware/ril/reference-ril/reference-ril.c

復制代碼
static void onUnsolicited (const char *s, const char *sms_pdu)
{
    ... ...
    if (strStartsWith(s, "+CMT:")) {
        RIL_onUnsolicitedResponse (
            RIL_UNSOL_RESPONSE_NEW_SMS,                             /* 上報UNSOL_RESPONSE_NEW_SMS消息 */
            sms_pdu, strlen(sms_pdu)); 
    }
    ... ...
}
復制代碼

 

2. RILD把短信息發送到RILJ

hardware/ril/libril/ril.cpp

復制代碼
extern "C"
void RIL_onUnsolicitedResponse(int unsolResponse, void *data,
                                size_t datalen)
{
    ... ...
    unsolResponseIndex = unsolResponse - RIL_UNSOL_RESPONSE_BASE;    /* 找出消息在s_unsolResponses[]的索引 */
    ... ...
    
    switch (s_unsolResponses[unsolResponseIndex].wakeType) {         /* 禁止進入休眠 */
        case WAKE_PARTIAL:
            grabPartialWakeLock();
            shouldScheduleTimeout = true;
        break;
        ... ...
    }
    ... ...
    ret = s_unsolResponses[unsolResponseIndex]                       /* 調用消息處理函數responseString() */
                .responseFunction(p, data, datalen);
    ... ...
    
    ret = sendResponse(p);                                           /* 發送Parcel中的信息內容到服務端RILJ */
}

static UnsolResponseInfo s_unsolResponses[] = { 
... ...
/* 消息對應的消息處理函數,新信息到來會喚醒系統 */
{RIL_UNSOL_RESPONSE_NEW_SMS, responseString, WAKE_PARTIAL},
... ...
};

static int responseString(Parcel &p, void *response, size_t responselen) {
    /* one string only */
    startResponse;
    appendPrintBuf("%s%s", printBuf, (char*)response);               
    closeResponse;

    writeStringToParcel(p, (const char *)response);                  /* 把字符串格式的信息存到Parcel容器中 */

    return 0;
}
復制代碼

 

二、解析短信息

1. RILJ獲取短信息

frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java

復制代碼
private void 
processUnsolicited (Parcel p) { 
    ... ...
    case RIL_UNSOL_RESPONSE_NEW_SMS: ret =  responseString(p); break;
    ... ...
    
    switch(response) {
        ... ...
        case RIL_UNSOL_RESPONSE_NEW_SMS: {
            if (RILJ_LOGD) unsljLog(response);                        /* 參考log:[UNSL]< UNSOL_RESPONSE_NEW_SMS */
            // FIXME this should move up a layer
            String a[] = new String[2];

            a[1] = (String)ret;

            SmsMessage sms;

            sms = SmsMessage.newFromCMT(a);                           /* 解析PDU格式的短信息 */
            if (mGsmSmsRegistrant != null) {
                mGsmSmsRegistrant
                    .notifyRegistrant(new AsyncResult(null, sms, null));
            }
            break;
        }
        ... ...
    }
    ... ...
}


private Object
responseString(Parcel p) { 
    String response;

    response = p.readString();                                                         /* 信息內容轉換成Object */

    return response;
}
復制代碼

 

2. 解析短信息

        SmsMessage.newFromCMT(a);根據import android.telephony.SmsMessage,得知代碼路徑:

frameworks/opt/telephony/src/java/android/telephony/SmsMessage.java

復制代碼
public static SmsMessage newFromCMT(String[] lines) {
    // received SMS in 3GPP format
    SmsMessageBase wrappedMessage =
            com.android.internal.telephony.gsm.SmsMessage.newFromCMT(lines);       /* 是對另一個newFromCMT的封裝,因為有gsm和cdma兩種短信,
                                                                                    * 即cdma中也有newFromCMT,根據情況按需選擇 
                                                                                    */

    return new SmsMessage(wrappedMessage);
}
復制代碼

 

        com.android.internal.telephony.gsm.SmsMessage.newFromCMT(lines)的實現在

frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/SmsMessage.java

復制代碼
public class SmsMessage extends SmsMessageBase {
    
    ... ...
    
    public static SmsMessage newFromCMT(String[] lines) {
        try {
            SmsMessage msg = new SmsMessage();
            msg.parsePdu(IccUtils.hexStringToBytes(lines[1]));               /* 解析PDU短信 */
            return msg;
        } catch (RuntimeException ex) {
            Rlog.e(LOG_TAG, "SMS PDU parsing failed: ", ex);
            return null;
        }
    }

    ... ...
}
復制代碼

 

        IccUtils.hexStringToBytes(lines[1])把十六進制的字符串轉換成字節數組msg.parsePdu()解析這個數組的內容,最后獲得短信內容
frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/SmsMessage.java

復制代碼
private void parsePdu(byte[] pdu) { 
    ... ...
    mScAddress = p.getSCAddress(); 
     
    if (mScAddress != null) {      
        if (VDBG) Rlog.d(LOG_TAG, "SMS SC address: " + mScAddress);          /* 參考log:SMS SC address: +8613800755500 */
    }
    
    ... ...
    mMti = firstByte & 0x3;
    switch (mMti) {
        ... ...
          case 3: //GSM 03.40 9.2.3.1: MTI == 3 is Reserved.
                  //This should be processed in the same way as MTI == 0 (Deliver)
              parseSmsDeliver(p, firstByte);                                   /* 對短信類型為Deliver的短信進行解析 */
              break;
           ... ...
      }
    ... ...
}

private void parseSmsDeliver(PduParser p, int firstByte) {
    ... ...
    mOriginatingAddress = p.getAddress();                                                                                                                
    
    if (mOriginatingAddress != null) {
        if (VDBG) Rlog.v(LOG_TAG, "SMS originating address: "                /* 參考log: SMS originating address: +861371533xxxx */                                                                                  
                + mOriginatingAddress.address);                                                                                                          
    }
    
    ... ...
    
    mProtocolIdentifier = p.getByte();

    // TP-Data-Coding-Scheme
    // see TS 23.038
    mDataCodingScheme = p.getByte();

    if (VDBG) {
        Rlog.v(LOG_TAG, "SMS TP-PID:" + mProtocolIdentifier
                + " data coding scheme: " + mDataCodingScheme);               /* 參考log: SMS TP-PID:0 data coding scheme: 0 */
    }

    mScTimeMillis = p.getSCTimestampMillis();

    if (VDBG) Rlog.d(LOG_TAG, "SMS SC timestamp: " + mScTimeMillis);          /* 參考log:SMS SC timestamp: 1571831129000 */

    boolean hasUserDataHeader = (firstByte & 0x40) == 0x40;

    parseUserData(p, hasUserDataHeader);                                      /* 解析信息有效內容 */
    
    ... ... 
}     
    
private void parseUserData(PduParser p, boolean hasUserDataHeader) {
    ... ...
    if (VDBG) Rlog.v(LOG_TAG, "SMS message body (raw): '" + mMessageBody + "'");    /* 短信內容,參考log: SMS message body (raw): 'jchfbfh' */
    ... ...
} 
復制代碼

 

三、處理短信息     

        對用戶有效的短信內容,最終保存在類型為String的mMessageBody變量中,該變量屬于SmsMessageBase抽象類,而
SmsMessage繼承于SmsMessageBase。
        回到前面frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java中processUnsolicited(),
sms = SmsMessage.newFromCMT(a);解析完短信息后,返回一個SmsMessage并通知上層應用。

frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java

mGsmSmsRegistrant
    .notifyRegistrant(new AsyncResult(null, sms, null));                             /* 把sms轉成Object類型 */

 

frameworks/base/core/java/android/os/AsyncResult.java

復制代碼
public class AsyncResult
{
    ... ...
    /** please note, this sets m.obj to be this */
    public
    AsyncResult (Object uo, Object r, Throwable ex)
    {
        userObj = uo;
        result = r;
        exception = ex;
    }
    ... ...
}
復制代碼

 

        根據mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null));找到mGsmSmsRegistrant注冊的代碼:

frameworks/opt/telephony/src/java/com/android/internal/telephony/BaseCommands.java  

復制代碼
public abstract class BaseCommands implements CommandsInterface {
    ... ...
    
    @Override                                                                                                                                                
    public void setOnNewGsmSms(Handler h, int what, Object obj) {     /* mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null))中的mGsmSmsRegistrant是在這里創建的 */                                                                                       
        mGsmSmsRegistrant = new Registrant (h, what, obj);                                                                                                   
    }
    
    ... ...
}
復制代碼

 

        封裝消息EVENT_NEW_SMS消息

frameworks/base/core/java/android/os/Registrant.java

復制代碼
public class Registrant                                                                                                                                      
{ 
    public
    Registrant(Handler h, int what, Object obj)                       /* 傳入需要處理消息為what的事件處理Handler h,obj為事件內容,參考phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null); */                                                                                                      
    {   
        refH = new WeakReference(h);                                                                                                                         
        this.what = what;                                                                                                                                    
        userObj = obj;                                                                                                                                       
    } 
    
    ... ...
    
    /**
     * This makes a copy of @param ar
     */
    public void
    notifyRegistrant(AsyncResult ar)                                  /* 參考mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null)) */
    {
        internalNotifyRegistrant (ar.result, ar.exception);           /* ar.result為sms */
    }

    /*package*/ void
    internalNotifyRegistrant (Object result, Throwable exception)     /* internalNotifyRegistrant (sms, Throwable exception) */
    {
        Handler h = getHandler();

        if (h == null) {
            clear();
        } else {
            Message msg = Message.obtain();                           /* 創建一個消息 */

            msg.what = what;                                          /* 消息類型EVENT_NEW_SMS */

            msg.obj = new AsyncResult(userObj, result, exception);    /* 消息內容sms */

            h.sendMessage(msg);                                       /* 發送消息到注冊了這個消息的Handler,參考phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null);的getHandler() */
        }
    }

    ... ...
}  
復制代碼

 

        然而BaseCommands是一個抽象類,實現了CommandsInterface中的setOnNewGsmSms接口,這個接口由GsmInboundSmsHandler調用
(phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null)),也就是說GsmInboundSmsHandler的getHandler()是EVENT_NEW_SMS
的監聽者,也就是說frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java中mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null))
調用之后,會觸發GsmInboundSmsHandler中getHandler()的Handler對EVENT_NEW_SMS消息進行解析。這個Handler肯定是GsmInboundSmsHandler
實例化的對象中的,這個對象在什么時候,在哪里創建的,暫且不管。我們只管EVENT_NEW_SMS這個消息從哪里來,然后到哪里去
就行了。

./frameworks/opt/telephony/src/java/com/android/internal/telephony/ImsSMSDispatcher.java

public final class ImsSMSDispatcher extends SMSDispatcher {
    ... ...
    mGsmInboundSmsHandler = GsmInboundSmsHandler.makeInboundSmsHandler(phone.getContext(),         /* 獲取mGsmInboundSmsHandler,并啟動狀態機 */
            storageMonitor, phone);  
    ... ...
}

 

./frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/GsmInboundSmsHandler.java

復制代碼
public class GsmInboundSmsHandler extends InboundSmsHandler {
    ... ...
    /**
     * Create a new GSM inbound SMS handler.
     */
    private GsmInboundSmsHandler(Context context, SmsStorageMonitor storageMonitor,
            PhoneBase phone) {
        super("GsmInboundSmsHandler", context, storageMonitor, phone,                              /* 構造GsmInboundSmsHandler時,通過super()調用InboundSmsHandler的構造函數 */
                GsmCellBroadcastHandler.makeGsmCellBroadcastHandler(context, phone));
        phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null);                               /* 注冊EVENT_NEW_SMS消息 */
        mDataDownloadHandler = new UsimDataDownloadHandler(phone.mCi);
    }
    
    ... ...
    
    /** 
     * Wait for state machine to enter startup state. We can't send any messages until then.
     */
    public static GsmInboundSmsHandler makeInboundSmsHandler(Context context,
            SmsStorageMonitor storageMonitor, PhoneBase phone) {
        GsmInboundSmsHandler handler = new GsmInboundSmsHandler(context, storageMonitor, phone);   /* 實例化GsmInboundSmsHandler */
        handler.start();                                                                           /* 抽象類InboundSmsHandler繼承與StateMachine,而GsmInboundSmsHandler繼承于InboundSmsHandler,
                                                                                                    * GsmInboundSmsHandler調用啟動狀態機方法start()
                                                                                                    */
        return handler;
    }

    ... ...
}
復制代碼

 

./frameworks/opt/telephony/src/java/com/android/internal/telephony/InboundSmsHandler.java

復制代碼
public abstract class InboundSmsHandler extends StateMachine {
    ... ...
    protected InboundSmsHandler(String name, Context context, SmsStorageMonitor storageMonitor,
            PhoneBase phone, CellBroadcastHandler cellBroadcastHandler) {
        ... ...
        
        addState(mDefaultState);                                                                   /* 構造InboundSmsHandler時,添加狀態機的狀態 */
        addState(mStartupState, mDefaultState);
        addState(mIdleState, mDefaultState);
        addState(mDeliveringState, mDefaultState);
        addState(mWaitingState, mDeliveringState);

        setInitialState(mStartupState);                                                            /* 初始化狀態機 */
        if (DBG) log("created InboundSmsHandler");
    }
    
    ... ...    
    
    class IdleState extends State {
        @Override
        public void enter() {
            if (DBG) log("entering Idle state");
            sendMessageDelayed(EVENT_RELEASE_WAKELOCK, WAKELOCK_TIMEOUT);
        }

        @Override
        public void exit() {
            mWakeLock.acquire();
            if (DBG) log("acquired wakelock, leaving Idle state");
        }

        @Override
        public boolean processMessage(Message msg) {
            if (DBG) log("Idle state processing message type " + msg.what);
            switch (msg.what) {
                case EVENT_NEW_SMS:                                                                /* 空閑時,接收到短信 */
                case EVENT_BROADCAST_SMS:
                    deferMessage(msg);
                    transitionTo(mDeliveringState);                                                /* 轉到mDeliveringState */
                    return HANDLED;
                    
                ... ...
            }
        }
    }    
        ... ...
        
    class DeliveringState extends State {                                                          /* 轉到mDeliveringState狀態 */
        @Override
        public void enter() {
            if (DBG) log("entering Delivering state");
        }

        @Override
        public void exit() {
            if (DBG) log("leaving Delivering state");
        }

        @Override
        public boolean processMessage(Message msg) {
            switch (msg.what) {
                case EVENT_NEW_SMS:
                    // handle new SMS from RIL
                    handleNewSms((AsyncResult) msg.obj);                                           /* 處理新SMS */
                    sendMessage(EVENT_RETURN_TO_IDLE);                                             /* 處理完回到空閑狀態 */
                    return HANDLED;
                
                ... ...
            }
        }    
            ... ...
    }
}


void handleNewSms(AsyncResult ar) {
    ... ...
    SmsMessage sms = (SmsMessage) ar.result;
    result = dispatchMessage(sms.mWrappedSmsMessage);
    ... ...
}


public int dispatchMessage(SmsMessageBase smsb) {
    ... ...
    return dispatchMessageRadioSpecific(smsb);
    ... ...
}
復制代碼

 

        通過以上流程可以了解到,當狀態機接收到SMS后,對消息進行分發,針對type zero, SMS-PP data download,
和3GPP/CPHS MWI type SMS判斷,如果是Normal SMS messages,則調用dispatchNormalMessage(smsb),然后創建
一個InboundSmsTracker對象,把信息保存到raw table,然后在通過sendMessage(EVENT_BROADCAST_SMS, tracker)
把消息廣播出去。

./frameworks/opt/telephony/src/java/com/android/internal/telephony/InboundSmsHandler.java  

復制代碼
class DeliveringState extends State {
    ... ...
    public boolean processMessage(Message msg) {
        switch (msg.what) {
            ... ...
            case EVENT_BROADCAST_SMS:                                                         /* 接收到EVENT_BROADCAST_SMS消息并處理 */
                // if any broadcasts were sent, transition to waiting state
                if (processMessagePart((InboundSmsTracker) msg.obj)) {
                    transitionTo(mWaitingState);
                }
                return HANDLED;
            ... ...
        }
    }
    ... ...

}
    
boolean processMessagePart(InboundSmsTracker tracker) {
    ... ...
    BroadcastReceiver resultReceiver = new SmsBroadcastReceiver(tracker);                    /* 創建一個廣播接收者,用來處理短信廣播的結果 */
    ... ...
    intent = new Intent(Intents.SMS_DELIVER_ACTION);                                         /* 設置當前intent的action為SMS_DELIVER_ACTION */

    // Direct the intent to only the default SMS app. If we can't find a default SMS app
    // then sent it to all broadcast receivers.
    ComponentName componentName = SmsApplication.getDefaultSmsApplication(mContext, true);   /* 這個action只會發送給carrier app,而且carrier app可以通過set result為RESULT_CANCELED來終止這個廣播 */
    if (componentName != null) {
        // Deliver SMS message only to this receiver
        intent.setComponent(componentName);
        log("Delivering SMS to: " + componentName.getPackageName() +
                " " + componentName.getClassName());
    }
    ... ...
    dispatchIntent(intent, android.Manifest.permission.RECEIVE_SMS,                          /* 廣播intent */
                AppOpsManager.OP_RECEIVE_SMS, resultReceiver);
    ... ...
}

    
private final class SmsBroadcastReceiver extends BroadcastReceiver {
    ... ... 
    public void onReceive(Context context, Intent intent) {
        ... ...
        // Now that the intents have been deleted we can clean up the PDU data.
        if (!Intents.DATA_SMS_RECEIVED_ACTION.equals(action)
                && !Intents.DATA_SMS_RECEIVED_ACTION.equals(action)
                && !Intents.WAP_PUSH_RECEIVED_ACTION.equals(action)) {
            loge("unexpected BroadcastReceiver action: " + action);
        }

        int rc = getResultCode();
        if ((rc != Activity.RESULT_OK) && (rc != Intents.RESULT_SMS_HANDLED)) {
            loge("a broadcast receiver set the result code to " + rc
                    + ", deleting from raw table anyway!");
        } else if (DBG) {
            log("successful broadcast, deleting from raw table.");
        }

        deleteFromRawTable(mDeleteWhere, mDeleteWhereArgs);
        sendMessage(EVENT_BROADCAST_COMPLETE);                                               /* 成功廣播 */

        ... ...
    }
    ... ...
}
復制代碼

 

        到這里,在應用層注冊具有Intents.SMS_RECEIVED_ACTION這樣action的廣播,就可以獲取到短信了。


我來說兩句
您需要登錄后才可以評論 登錄 | 立即注冊
facelist
所有評論(0)
領先的中文移動開發者社區
18620764416
7*24全天服務
意見反饋:[email protected]

掃一掃關注我們

Powered by Discuz! X3.2© 2001-2019 Comsenz Inc.( 粵ICP備15117877號 )

龙江福彩p62开奖 北京赛车pk10 甘肃麻将如何胡牌几对 小说任务打字赚钱的软件 刮刮乐 淘宝秒杀群主怎么赚钱 捕鱼来了官方论坛 足彩比分直播即时比分直播 现在梦幻西游69级怎么赚钱 2012足球直播表 爱波足球指数 街机欢乐捕鱼 倩女幽魂手游赚钱功率 好彩头彩票首页 玩今日头条赚钱安全吗 排列5 妈妈嫌弃女儿赚钱少