经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置:技术经验 » 移动开发 » Android » 查看文章
Android4.4 RIL短信接收流程分析
来源:cnblogs  作者:hackfun  时间:2019/11/1 11:47:30  对本文有异议

 

        近有客户反馈Android接收不到短信,于是一头扎进RIL里面找原因。最后发现不是RIL的问题,而是BC72上报
短信的格式不对,AT+CNMA=1无作用等几个小问题导致的。尽管问题不在RIL,但总算把RIL短信接收流程搞清楚了。

接收到新信息的log:

D/ATC ( 1269): AT< +CMT:,27
D/ATC ( 1268): AT< 0891683108705505F0040d91683117358313f500009101329154922307ea31da2c36a301
D/RILJ ( 1792): [UNSL]< UNSOL_RESPONSE_NEW_SMS
D/SmsMessage( 1792): SMS SC address: +8613800755500
V/SmsMessage( 1792): SMS originating address: +8613715338315
V/SmsMessage( 1792): SMS TP-PID:0 data coding scheme: 0
D/SmsMessage( 1792): SMS SC timestamp: 1571831129000
V/SmsMessage( 1792): SMS message body (raw): 'jchfbfh'
D/GsmInboundSmsHandler( 1776): Idle state processing message type 1
D/GsmInboundSmsHandler( 1776): acquired wakelock, leaving Idle state
D/GsmInboundSmsHandler( 1776): entering Delivering state
D/GsmInboundSmsHandler( 1776): URI of new row -> content://raw/3
D/RILJ ( 1775): [3706]> SMS_ACKNOWLEDGE true 0
D/RILC ( 1254): onRequest: SMS_ACKNOWLEDGE
D/ATC ( 1254): AT> AT+CNMA=1
D/ATC ( 1254): AT< OK
D/RILJ ( 1775): [3706]< SMS_ACKNOWLEDGE
D/GsmInboundSmsHandler( 1775): Delivering SMS to: com.android.mms com.android.mms.transaction.PrivilegedSmsReceiver
E/GsmInboundSmsHandler( 1775): unexpected BroadcastReceiver action: android.provider.Telephony.SMS_RECEIVED
D/GsmInboundSmsHandler( 1775): successful broadcast, deleting from raw table.
D/SmsMessage( 2124): SMS SC address: +8613800755500
D/GsmInboundSmsHandler( 1775): Deleted 1 rows from raw table.
D/GsmInboundSmsHandler( 1775): ordered broadcast completed in: 276 ms
D/GsmInboundSmsHandler( 1775): leaving Delivering state
D/GsmInboundSmsHandler( 1775): entering Delivering state
D/GsmInboundSmsHandler( 1775): leaving Delivering state
D/GsmInboundSmsHandler( 1775): entering Idle state
V/SmsMessage( 2124): SMS originating address: +8613715338315
V/SmsMessage( 2124): SMS TP-PID:0 data coding scheme: 0
D/SmsMessage( 2124): SMS SC timestamp: 1572253549000
V/SmsMessage( 2124): SMS message body (raw): 'jchfbfh'
D/GsmInboundSmsHandler( 1775): Idle state processing message type 5
D/GsmInboundSmsHandler( 1775): mWakeLock released

 

一、短信接收

1. vendor ril接收到modem上报的短信息

hardware/ril/reference-ril/reference-ril.c

  1. static void onUnsolicited (const char *s, const char *sms_pdu)
  2. {
  3. ... ...
  4. if (strStartsWith(s, "+CMT:")) {
  5. RIL_onUnsolicitedResponse (
  6. RIL_UNSOL_RESPONSE_NEW_SMS, /* 上报UNSOL_RESPONSE_NEW_SMS消息 */
  7. sms_pdu, strlen(sms_pdu));
  8. }
  9. ... ...
  10. }

 

2. RILD把短信息发送到RILJ

hardware/ril/libril/ril.cpp

  1. extern "C"
  2. void RIL_onUnsolicitedResponse(int unsolResponse, void *data,
  3. size_t datalen)
  4. {
  5. ... ...
  6. unsolResponseIndex = unsolResponse - RIL_UNSOL_RESPONSE_BASE; /* 找出消息在s_unsolResponses[]的索引 */
  7. ... ...
  8. switch (s_unsolResponses[unsolResponseIndex].wakeType) { /* 禁止进入休眠 */
  9. case WAKE_PARTIAL:
  10. grabPartialWakeLock();
  11. shouldScheduleTimeout = true;
  12. break;
  13. ... ...
  14. }
  15. ... ...
  16. ret = s_unsolResponses[unsolResponseIndex] /* 调用消息处理函数responseString() */
  17. .responseFunction(p, data, datalen);
  18. ... ...
  19. ret = sendResponse(p); /* 发送Parcel中的信息内容到服务端RILJ */
  20. }
  21. static UnsolResponseInfo s_unsolResponses[] = {
  22. ... ...
  23. /* 消息对应的消息处理函数,新信息到来会唤醒系统 */
  24. {RIL_UNSOL_RESPONSE_NEW_SMS, responseString, WAKE_PARTIAL},
  25. ... ...
  26. };
  27. static int responseString(Parcel &p, void *response, size_t responselen) {
  28. /* one string only */
  29. startResponse;
  30. appendPrintBuf("%s%s", printBuf, (char*)response);
  31. closeResponse;
  32. writeStringToParcel(p, (const char *)response); /* 把字符串格式的信息存到Parcel容器中 */
  33.  
  34. return 0;
  35. }

 

二、解析短信息

1. RILJ获取短信息

frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java

  1. private void
  2. processUnsolicited (Parcel p) {
  3. ... ...
  4. case RIL_UNSOL_RESPONSE_NEW_SMS: ret = responseString(p); break;
  5. ... ...
  6. switch(response) {
  7. ... ...
  8. case RIL_UNSOL_RESPONSE_NEW_SMS: {
  9. if (RILJ_LOGD) unsljLog(response); /* 参考log:[UNSL]< UNSOL_RESPONSE_NEW_SMS */
  10. // FIXME this should move up a layer
  11. String a[] = new String[2];
  12. a[1] = (String)ret;
  13. SmsMessage sms;
  14. sms = SmsMessage.newFromCMT(a); /* 解析PDU格式的短信息 */
  15. if (mGsmSmsRegistrant != null) {
  16. mGsmSmsRegistrant
  17. .notifyRegistrant(new AsyncResult(null, sms, null));
  18. }
  19. break;
  20. }
  21. ... ...
  22. }
  23. ... ...
  24. }
  25. private Object
  26. responseString(Parcel p) {
  27. String response;
  28. response = p.readString(); /* 信息内容转换成Object */
  29.  
  30. return response;
  31. }

 

2. 解析短信息

        SmsMessage.newFromCMT(a);根据import android.telephony.SmsMessage,得知代码路径:

frameworks/opt/telephony/src/java/android/telephony/SmsMessage.java

  1. public static SmsMessage newFromCMT(String[] lines) {
  2. // received SMS in 3GPP format
  3. SmsMessageBase wrappedMessage =
  4. com.android.internal.telephony.gsm.SmsMessage.newFromCMT(lines); /* 是对另一个newFromCMT的封装,因为有gsm和cdma两种短信,
  5. * 即cdma中也有newFromCMT,根据情况按需选择
  6. */
  7.  
  8. return new SmsMessage(wrappedMessage);
  9. }

 

        com.android.internal.telephony.gsm.SmsMessage.newFromCMT(lines)的实现在

frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/SmsMessage.java

  1. public class SmsMessage extends SmsMessageBase {
  2. ... ...
  3. public static SmsMessage newFromCMT(String[] lines) {
  4. try {
  5. SmsMessage msg = new SmsMessage();
  6. msg.parsePdu(IccUtils.hexStringToBytes(lines[1])); /* 解析PDU短信 */
  7. return msg;
  8. } catch (RuntimeException ex) {
  9. Rlog.e(LOG_TAG, "SMS PDU parsing failed: ", ex);
  10. return null;
  11. }
  12. }
  13. ... ...
  14. }

 

        IccUtils.hexStringToBytes(lines[1])把十六进制的字符串转换成字节数组msg.parsePdu()解析这个数组的内容,最后获得短信内容
frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/SmsMessage.java

  1. private void parsePdu(byte[] pdu) {
  2. ... ...
  3. mScAddress = p.getSCAddress();
  4. if (mScAddress != null) {
  5. if (VDBG) Rlog.d(LOG_TAG, "SMS SC address: " + mScAddress); /* 参考log:SMS SC address: +8613800755500 */
  6. }
  7. ... ...
  8. mMti = firstByte & 0x3;
  9. switch (mMti) {
  10. ... ...
  11. case 3: //GSM 03.40 9.2.3.1: MTI == 3 is Reserved.
  12. //This should be processed in the same way as MTI == 0 (Deliver)
  13. parseSmsDeliver(p, firstByte); /* 对短信类型为Deliver的短信进行解析 */
  14. break;
  15. ... ...
  16. }
  17. ... ...
  18. }
  19. private void parseSmsDeliver(PduParser p, int firstByte) {
  20. ... ...
  21. mOriginatingAddress = p.getAddress();
  22. if (mOriginatingAddress != null) {
  23. if (VDBG) Rlog.v(LOG_TAG, "SMS originating address: " /* 参考log: SMS originating address: +861371533xxxx */
  24. + mOriginatingAddress.address);
  25. }
  26. ... ...
  27. mProtocolIdentifier = p.getByte();
  28. // TP-Data-Coding-Scheme
  29. // see TS 23.038
  30. mDataCodingScheme = p.getByte();
  31. if (VDBG) {
  32. Rlog.v(LOG_TAG, "SMS TP-PID:" + mProtocolIdentifier
  33. + " data coding scheme: " + mDataCodingScheme); /* 参考log: SMS TP-PID:0 data coding scheme: 0 */
  34. }
  35. mScTimeMillis = p.getSCTimestampMillis();
  36. if (VDBG) Rlog.d(LOG_TAG, "SMS SC timestamp: " + mScTimeMillis); /* 参考log:SMS SC timestamp: 1571831129000 */
  37.  
  38. boolean hasUserDataHeader = (firstByte & 0x40) == 0x40;
  39. parseUserData(p, hasUserDataHeader); /* 解析信息有效内容 */
  40. ... ...
  41. }
  42. private void parseUserData(PduParser p, boolean hasUserDataHeader) {
  43. ... ...
  44. if (VDBG) Rlog.v(LOG_TAG, "SMS message body (raw): '" + mMessageBody + "'"); /* 短信内容,参考log: SMS message body (raw): 'jchfbfh' */
  45. ... ...
  46. }

 

三、处理短信息     

        对用户有效的短信内容,最终保存在类型为String的mMessageBody变量中,该变量属于SmsMessageBase抽象类,而
SmsMessage继承于SmsMessageBase。
        回到前面frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java中processUnsolicited(),
sms = SmsMessage.newFromCMT(a);解析完短信息后,返回一个SmsMessage并通知上层应用。

frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java

  1. mGsmSmsRegistrant
  2. .notifyRegistrant(new AsyncResult(null, sms, null)); /* 把sms转成Object类型 */

 

frameworks/base/core/java/android/os/AsyncResult.java

  1. public class AsyncResult
  2. {
  3. ... ...
  4. /** please note, this sets m.obj to be this */
  5. public
  6. AsyncResult (Object uo, Object r, Throwable ex)
  7. {
  8. userObj = uo;
  9. result = r;
  10. exception = ex;
  11. }
  12. ... ...
  13. }

 

        根据mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null));找到mGsmSmsRegistrant注册的代码:

frameworks/opt/telephony/src/java/com/android/internal/telephony/BaseCommands.java  

  1. public abstract class BaseCommands implements CommandsInterface {
  2. ... ...
  3. @Override
  4. public void setOnNewGsmSms(Handler h, int what, Object obj) { /* mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null))中的mGsmSmsRegistrant是在这里创建的 */
  5. mGsmSmsRegistrant = new Registrant (h, what, obj);
  6. }
  7. ... ...
  8. }

 

        封装消息EVENT_NEW_SMS消息

frameworks/base/core/java/android/os/Registrant.java

  1. public class Registrant
  2. {
  3. public
  4. Registrant(Handler h, int what, Object obj) /* 传入需要处理消息为what的事件处理Handler h,obj为事件内容,参考phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null); */
  5. {
  6. refH = new WeakReference(h);
  7. this.what = what;
  8. userObj = obj;
  9. }
  10. ... ...
  11. /**
  12. * This makes a copy of @param ar
  13. */
  14. public void
  15. notifyRegistrant(AsyncResult ar) /* 参考mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null)) */
  16. {
  17. internalNotifyRegistrant (ar.result, ar.exception); /* ar.result为sms */
  18. }
  19. /*package*/ void
  20. internalNotifyRegistrant (Object result, Throwable exception) /* internalNotifyRegistrant (sms, Throwable exception) */
  21. {
  22. Handler h = getHandler();
  23. if (h == null) {
  24. clear();
  25. } else {
  26. Message msg = Message.obtain(); /* 创建一个消息 */
  27. msg.what = what; /* 消息类型EVENT_NEW_SMS */
  28. msg.obj = new AsyncResult(userObj, result, exception); /* 消息内容sms */
  29. h.sendMessage(msg); /* 发送消息到注册了这个消息的Handler,参考phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null);的getHandler() */
  30. }
  31. }
  32. ... ...
  33. }

 

        然而BaseCommands是一个抽象类,实现了CommandsInterface中的setOnNewGsmSms接口,这个接口由GsmInboundSmsHandler调用
(phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null)),也就是说GsmInboundSmsHandler的getHandler()是EVENT_NEW_SMS
的监听者,也就是说frameworks/opt/telephony/src/java/com/android/internal/telephony/RIL.java中mGsmSmsRegistrant.notifyRegistrant(new AsyncResult(null, sms, null))
调用之后,会触发GsmInboundSmsHandler中getHandler()的Handler对EVENT_NEW_SMS消息进行解析。这个Handler肯定是GsmInboundSmsHandler
实例化的对象中的,这个对象在什么时候,在哪里创建的,暂且不管。我们只管EVENT_NEW_SMS这个消息从哪里来,然后到哪里去
就行了。

./frameworks/opt/telephony/src/java/com/android/internal/telephony/ImsSMSDispatcher.java

  1. public final class ImsSMSDispatcher extends SMSDispatcher {
  2. ... ...
  3. mGsmInboundSmsHandler = GsmInboundSmsHandler.makeInboundSmsHandler(phone.getContext(), /* 获取mGsmInboundSmsHandler,并启动状态机 */
  4. storageMonitor, phone);
  5. ... ...
  6. }

 

./frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/GsmInboundSmsHandler.java

  1. public class GsmInboundSmsHandler extends InboundSmsHandler {
  2. ... ...
  3. /**
  4. * Create a new GSM inbound SMS handler.
  5. */
  6. private GsmInboundSmsHandler(Context context, SmsStorageMonitor storageMonitor,
  7. PhoneBase phone) {
  8. super("GsmInboundSmsHandler", context, storageMonitor, phone, /* 构造GsmInboundSmsHandler时,通过super()调用InboundSmsHandler的构造函数 */
  9. GsmCellBroadcastHandler.makeGsmCellBroadcastHandler(context, phone));
  10. phone.mCi.setOnNewGsmSms(getHandler(), EVENT_NEW_SMS, null); /* 注册EVENT_NEW_SMS消息 */
  11. mDataDownloadHandler = new UsimDataDownloadHandler(phone.mCi);
  12. }
  13. ... ...
  14. /**
  15. * Wait for state machine to enter startup state. We can't send any messages until then.
  16. */
  17. public static GsmInboundSmsHandler makeInboundSmsHandler(Context context,
  18. SmsStorageMonitor storageMonitor, PhoneBase phone) {
  19. GsmInboundSmsHandler handler = new GsmInboundSmsHandler(context, storageMonitor, phone); /* 实例化GsmInboundSmsHandler */
  20. handler.start(); /* 抽象类InboundSmsHandler继承与StateMachine,而GsmInboundSmsHandler继承于InboundSmsHandler,
  21. * GsmInboundSmsHandler调用启动状态机方法start()
  22. */
  23. return handler;
  24. }
  25. ... ...
  26. }

 

./frameworks/opt/telephony/src/java/com/android/internal/telephony/InboundSmsHandler.java

  1. public abstract class InboundSmsHandler extends StateMachine {
  2. ... ...
  3. protected InboundSmsHandler(String name, Context context, SmsStorageMonitor storageMonitor,
  4. PhoneBase phone, CellBroadcastHandler cellBroadcastHandler) {
  5. ... ...
  6. addState(mDefaultState); /* 构造InboundSmsHandler时,添加状态机的状态 */
  7. addState(mStartupState, mDefaultState);
  8. addState(mIdleState, mDefaultState);
  9. addState(mDeliveringState, mDefaultState);
  10. addState(mWaitingState, mDeliveringState);
  11. setInitialState(mStartupState); /* 初始化状态机 */
  12. if (DBG) log("created InboundSmsHandler");
  13. }
  14. ... ...
  15. class IdleState extends State {
  16. @Override
  17. public void enter() {
  18. if (DBG) log("entering Idle state");
  19. sendMessageDelayed(EVENT_RELEASE_WAKELOCK, WAKELOCK_TIMEOUT);
  20. }
  21. @Override
  22. public void exit() {
  23. mWakeLock.acquire();
  24. if (DBG) log("acquired wakelock, leaving Idle state");
  25. }
  26. @Override
  27. public boolean processMessage(Message msg) {
  28. if (DBG) log("Idle state processing message type " + msg.what);
  29. switch (msg.what) {
  30. case EVENT_NEW_SMS: /* 空闲时,接收到短信 */
  31. case EVENT_BROADCAST_SMS:
  32. deferMessage(msg);
  33. transitionTo(mDeliveringState); /* 转到mDeliveringState */
  34. return HANDLED;
  35. ... ...
  36. }
  37. }
  38. }
  39. ... ...
  40. class DeliveringState extends State { /* 转到mDeliveringState状态 */
  41. @Override
  42. public void enter() {
  43. if (DBG) log("entering Delivering state");
  44. }
  45. @Override
  46. public void exit() {
  47. if (DBG) log("leaving Delivering state");
  48. }
  49. @Override
  50. public boolean processMessage(Message msg) {
  51. switch (msg.what) {
  52. case EVENT_NEW_SMS:
  53. // handle new SMS from RIL
  54. handleNewSms((AsyncResult) msg.obj); /* 处理新SMS */
  55. sendMessage(EVENT_RETURN_TO_IDLE); /* 处理完回到空闲状态 */
  56. return HANDLED;
  57. ... ...
  58. }
  59. }
  60. ... ...
  61. }
  62. }
  63. void handleNewSms(AsyncResult ar) {
  64. ... ...
  65. SmsMessage sms = (SmsMessage) ar.result;
  66. result = dispatchMessage(sms.mWrappedSmsMessage);
  67. ... ...
  68. }
  69. public int dispatchMessage(SmsMessageBase smsb) {
  70. ... ...
  71. return dispatchMessageRadioSpecific(smsb);
  72. ... ...
  73. }

 

        通过以上流程可以了解到,当状态机接收到SMS后,对消息进行分发,针对type zero, SMS-PP data download,
和3GPP/CPHS MWI type SMS判断,如果是Normal SMS messages,则调用dispatchNormalMessage(smsb),然后创建
一个InboundSmsTracker对象,把信息保存到raw table,然后在通过sendMessage(EVENT_BROADCAST_SMS, tracker)
把消息广播出去。

./frameworks/opt/telephony/src/java/com/android/internal/telephony/InboundSmsHandler.java  

  1. class DeliveringState extends State {
  2. ... ...
  3. public boolean processMessage(Message msg) {
  4. switch (msg.what) {
  5. ... ...
  6. case EVENT_BROADCAST_SMS: /* 接收到EVENT_BROADCAST_SMS消息并处理 */
  7. // if any broadcasts were sent, transition to waiting state
  8. if (processMessagePart((InboundSmsTracker) msg.obj)) {
  9. transitionTo(mWaitingState);
  10. }
  11. return HANDLED;
  12. ... ...
  13. }
  14. }
  15. ... ...
  16. }
  17. boolean processMessagePart(InboundSmsTracker tracker) {
  18. ... ...
  19. BroadcastReceiver resultReceiver = new SmsBroadcastReceiver(tracker); /* 创建一个广播接收者,用来处理短信广播的结果 */
  20. ... ...
  21. intent = new Intent(Intents.SMS_DELIVER_ACTION); /* 设置当前intent的action为SMS_DELIVER_ACTION */
  22.  
  23. // Direct the intent to only the default SMS app. If we can't find a default SMS app
  24. // then sent it to all broadcast receivers.
  25. ComponentName componentName = SmsApplication.getDefaultSmsApplication(mContext, true); /* 这个action只会发送给carrier app,而且carrier app可以通过set result为RESULT_CANCELED来终止这个广播 */
  26. if (componentName != null) {
  27. // Deliver SMS message only to this receiver
  28. intent.setComponent(componentName);
  29. log("Delivering SMS to: " + componentName.getPackageName() +
  30. " " + componentName.getClassName());
  31. }
  32. ... ...
  33. dispatchIntent(intent, android.Manifest.permission.RECEIVE_SMS, /* 广播intent */
  34. AppOpsManager.OP_RECEIVE_SMS, resultReceiver);
  35. ... ...
  36. }
  37. private final class SmsBroadcastReceiver extends BroadcastReceiver {
  38. ... ...
  39. public void onReceive(Context context, Intent intent) {
  40. ... ...
  41. // Now that the intents have been deleted we can clean up the PDU data.
  42. if (!Intents.DATA_SMS_RECEIVED_ACTION.equals(action)
  43. && !Intents.DATA_SMS_RECEIVED_ACTION.equals(action)
  44. && !Intents.WAP_PUSH_RECEIVED_ACTION.equals(action)) {
  45. loge("unexpected BroadcastReceiver action: " + action);
  46. }
  47. int rc = getResultCode();
  48. if ((rc != Activity.RESULT_OK) && (rc != Intents.RESULT_SMS_HANDLED)) {
  49. loge("a broadcast receiver set the result code to " + rc
  50. + ", deleting from raw table anyway!");
  51. } else if (DBG) {
  52. log("successful broadcast, deleting from raw table.");
  53. }
  54. deleteFromRawTable(mDeleteWhere, mDeleteWhereArgs);
  55. sendMessage(EVENT_BROADCAST_COMPLETE); /* 成功广播 */
  56. ... ...
  57. }
  58. ... ...
  59. }

 

        到这里,在应用层注册具有Intents.SMS_RECEIVED_ACTION这样action的广播,就可以获取到短信了。

 

原文链接:http://www.cnblogs.com/hackfun/p/11775588.html

 友情链接:直通硅谷  点职佳  北美留学生论坛

本站QQ群:前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

W3xue 的所有内容仅供测试,对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接(目前9元/月)请联系QQ:27243702 沸活量
皖ICP备17017327号-2 皖公网安备34020702000426号