详解Android4.4 RIL短信接收流程分析

hardware/ril/reference-ril/reference-ril.c
static void onunsolicited (const char *s, const char *sms_pdu)
{
 ... ...
 if (strstartswith(s, "+cmt:")) {
  ril_onunsolicitedresponse (
   ril_unsol_response_new_sms,        /* 上报unsol_response_new_sms消息 */
   sms_pdu, strlen(sms_pdu)); 
 }
 ... ...
}

hardware/ril/libril/ril.cpp
extern "c"
void ril_onunsolicitedresponse(int unsolresponse, void *data,
        size_t datalen)
{
 ... ...
 unsolresponseindex = unsolresponse - ril_unsol_response_base; /* 找出消息在s_unsolresponses[]的索引 */
 ... ...
 switch (s_unsolresponses[unsolresponseindex].waketype) {   /* 禁止进入休眠 */
  case wake_partial:
   grabpartialwakelock();
   shouldscheduletimeout = true;
  break;
  ... ...
 }
 ... ...
 ret = s_unsolresponses[unsolresponseindex]      /* 调用消息处理函数responsestring() */
    .responsefunction(p, data, datalen);
 ... ...
 ret = sendresponse(p);           /* 发送parcel中的信息内容到服务端rilj */
}
static unsolresponseinfo s_unsolresponses[] = { 
... ...
/* 消息对应的消息处理函数，新信息到来会唤醒系统 */
{ril_unsol_response_new_sms, responsestring, wake_partial},
... ...
}；
static int responsestring(parcel &p, void *response, size_t responselen) {
 /* one string only */
 startresponse;
 appendprintbuf("%s%s", printbuf, (char*)response);    
 closeresponse;
 writestringtoparcel(p, (const char *)response);     /* 把字符串格式的信息存到parcel容器中 */
 return 0;
}

frameworks/opt/telephony/src/java/com/android/internal/telephony/ril.java
private void 
processunsolicited (parcel p) { 
 ... ...
 case ril_unsol_response_new_sms: ret = responsestring(p); break;
 ... ...
 switch(response) {
  ... ...
  case ril_unsol_response_new_sms: {
   if (rilj_logd) unsljlog(response);      /* 参考log：[unsl]< unsol_response_new_sms */
   // fixme this should move up a layer
   string a[] = new string[2];
   a[1] = (string)ret;
   smsmessage sms;
   sms = smsmessage.newfromcmt(a);       /* 解析pdu格式的短信息 */
   if (mgsmsmsregistrant != null) {
    mgsmsmsregistrant
     .notifyregistrant(new asyncresult(null, sms, null));
   }
   break;
  }
  ... ...
 }
 ... ...
}
private object
responsestring(parcel p) { 
 string response;
 response = p.readstring();               /* 信息内容转换成object */
 return response;
}

frameworks/opt/telephony/src/java/android/telephony/smsmessage.java
public static smsmessage newfromcmt(string[] lines) {
 // received sms in 3gpp format
 smsmessagebase wrappedmessage =
   com.android.internal.telephony.gsm.smsmessage.newfromcmt(lines);  /* 是对另一个newfromcmt的封装，因为有gsm和cdma两种短信，
                     * 即cdma中也有newfromcmt，根据情况按需选择 
                     */
 return new smsmessage(wrappedmessage);
}
  com.android.internal.telephony.gsm.smsmessage.newfromcmt(lines)的实现在
frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/smsmessage.java
public class smsmessage extends smsmessagebase {
 ... ...
 public static smsmessage newfromcmt(string[] lines) {
  try {
   smsmessage msg = new smsmessage();
   msg.parsepdu(iccutils.hexstringtobytes(lines[1]));    /* 解析pdu短信 */
   return msg;
  } catch (runtimeexception ex) {
   rlog.e(log_tag, "sms pdu parsing failed: ", ex);
   return null;
  }
 }
 ... ...
}
  iccutils.hexstringtobytes(lines[1])把十六进制的字符串转换成字节数组msg.parsepdu()解析这个数组的内容，最后获得短信内容
frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/smsmessage.java
private void parsepdu(byte[] pdu) { 
 ... ...
 mscaddress = p.getscaddress(); 
 if (mscaddress != null) {  
  if (vdbg) rlog.d(log_tag, "sms sc address: " + mscaddress);   /* 参考log：sms sc address: +8613800755500 */
 }
 ... ...
 mmti = firstbyte & 0x3;
 switch (mmti) {
  ... ...
   case 3: //gsm 03.40 9.2.3.1: mti == 3 is reserved.
     //this should be processed in the same way as mti == 0 (deliver)
    parsesmsdeliver(p, firstbyte);         /* 对短信类型为deliver的短信进行解析 */
    break;
   ... ...
  }
 ... ...
}
private void parsesmsdeliver(pduparser p, int firstbyte) {
 ... ...
 moriginatingaddress = p.getaddress();                            
 if (moriginatingaddress != null) {
  if (vdbg) rlog.v(log_tag, "sms originating address: "    /* 参考log: sms originating address: +861371533xxxx */                     
    + moriginatingaddress.address);                           
 }
 ... ...
 mprotocolidentifier = p.getbyte();
 // tp-data-coding-scheme
 // see ts 23.038
 mdatacodingscheme = p.getbyte();
 if (vdbg) {
  rlog.v(log_tag, "sms tp-pid:" + mprotocolidentifier
    + " data coding scheme: " + mdatacodingscheme);    /* 参考log: sms tp-pid:0 data coding scheme: 0 */
 }
 msctimemillis = p.getsctimestampmillis();
 if (vdbg) rlog.d(log_tag, "sms sc timestamp: " + msctimemillis);   /* 参考log：sms sc timestamp: 1571831129000 */
 boolean hasuserdataheader = (firstbyte & 0x40) == 0x40;
 parseuserdata(p, hasuserdataheader);          /* 解析信息有效内容 */
 ... ... 
}  
private void parseuserdata(pduparser p, boolean hasuserdataheader) {
 ... ...
 if (vdbg) rlog.v(log_tag, "sms message body (raw): '" + mmessagebody + "'"); /* 短信内容，参考log: sms message body (raw): 'jchfbfh' */
 ... ...
} 

frameworks/opt/telephony/src/java/com/android/internal/telephony/ril.java
mgsmsmsregistrant
 .notifyregistrant(new asyncresult(null, sms, null));        /* 把sms转成object类型 */
frameworks/base/core/java/android/os/asyncresult.java
public class asyncresult
{
 ... ...
 /** please note, this sets m.obj to be this */
 public
 asyncresult (object uo, object r, throwable ex)
 {
  userobj = uo;
  result = r;
  exception = ex;
 }
 ... ...
}

frameworks/opt/telephony/src/java/com/android/internal/telephony/basecommands.java 
public abstract class basecommands implements commandsinterface {
 ... ...
 @override                                    
 public void setonnewgsmsms(handler h, int what, object obj) {  /* mgsmsmsregistrant.notifyregistrant(new asyncresult(null, sms, null))中的mgsmsmsregistrant是在这里创建的 */                      
  mgsmsmsregistrant = new registrant (h, what, obj);                         
 }
 ... ...
} 

frameworks/base/core/java/android/os/registrant.java
public class registrant                                  
{ 
 public
 registrant(handler h, int what, object obj)      /* 传入需要处理消息为what的事件处理handler h，obj为事件内容，参考phone.mci.setonnewgsmsms(gethandler(), event_new_sms, null); */                          
 { 
  refh = new weakreference(h);                               
  this.what = what;                                 
  userobj = obj;                                  
 } 
 ... ...
 /**
  * this makes a copy of @param ar
  */
 public void
 notifyregistrant(asyncresult ar)         /* 参考mgsmsmsregistrant.notifyregistrant(new asyncresult(null, sms, null)) */
 {
  internalnotifyregistrant (ar.result, ar.exception);   /* ar.result为sms */
 }
 /*package*/ void
 internalnotifyregistrant (object result, throwable exception)  /* internalnotifyregistrant (sms, throwable exception) */
 {
  handler h = gethandler();
  if (h == null) {
   clear();
  } else {
   message msg = message.obtain();       /* 创建一个消息 */
   msg.what = what;           /* 消息类型event_new_sms */
   msg.obj = new asyncresult(userobj, result, exception); /* 消息内容sms */
   h.sendmessage(msg);          /* 发送消息到注册了这个消息的handler，参考phone.mci.setonnewgsmsms(gethandler(), event_new_sms, null);的gethandler() */
  }
 }
 ... ...
} 

./frameworks/opt/telephony/src/java/com/android/internal/telephony/imssmsdispatcher.java
public final class imssmsdispatcher extends smsdispatcher {
 ... ...
 mgsminboundsmshandler = gsminboundsmshandler.makeinboundsmshandler(phone.getcontext(),   /* 获取mgsminboundsmshandler，并启动状态机 */
   storagemonitor, phone); 
 ... ...
}
./frameworks/opt/telephony/src/java/com/android/internal/telephony/gsm/gsminboundsmshandler.java
public class gsminboundsmshandler extends inboundsmshandler {
 ... ...
 /**
  * create a new gsm inbound sms handler.
  */
 private gsminboundsmshandler(context context, smsstoragemonitor storagemonitor,
   phonebase phone) {
  super("gsminboundsmshandler", context, storagemonitor, phone,        /* 构造gsminboundsmshandler时，通过super()调用inboundsmshandler的构造函数 */
    gsmcellbroadcasthandler.makegsmcellbroadcasthandler(context, phone));
  phone.mci.setonnewgsmsms(gethandler(), event_new_sms, null);        /* 注册event_new_sms消息 */
  mdatadownloadhandler = new usimdatadownloadhandler(phone.mci);
 }
 ... ...
 /** 
  * wait for state machine to enter startup state. we can't send any messages until then.
  */
 public static gsminboundsmshandler makeinboundsmshandler(context context,
   smsstoragemonitor storagemonitor, phonebase phone) {
  gsminboundsmshandler handler = new gsminboundsmshandler(context, storagemonitor, phone); /* 实例化gsminboundsmshandler */
  handler.start();                   /* 抽象类inboundsmshandler继承与statemachine，而gsminboundsmshandler继承于inboundsmshandler，
                         * gsminboundsmshandler调用启动状态机方法start()
                         */
  return handler;
 }
 ... ...
}
./frameworks/opt/telephony/src/java/com/android/internal/telephony/inboundsmshandler.java
public abstract class inboundsmshandler extends statemachine {
 ... ...
 protected inboundsmshandler(string name, context context, smsstoragemonitor storagemonitor,
   phonebase phone, cellbroadcasthandler cellbroadcasthandler) {
  ... ...
  addstate(mdefaultstate);                 /* 构造inboundsmshandler时，添加状态机的状态 */
  addstate(mstartupstate, mdefaultstate);
  addstate(midlestate, mdefaultstate);
  addstate(mdeliveringstate, mdefaultstate);
  addstate(mwaitingstate, mdeliveringstate);
  setinitialstate(mstartupstate);               /* 初始化状态机 */
  if (dbg) log("created inboundsmshandler");
 }
 ... ... 
 class idlestate extends state {
  @override
  public void enter() {
   if (dbg) log("entering idle state");
   sendmessagedelayed(event_release_wakelock, wakelock_timeout);
  }
  @override
  public void exit() {
   mwakelock.acquire();
   if (dbg) log("acquired wakelock, leaving idle state");
  }
  @override
  public boolean processmessage(message msg) {
   if (dbg) log("idle state processing message type " + msg.what);
   switch (msg.what) {
    case event_new_sms:                /* 空闲时，接收到短信 */
    case event_broadcast_sms:
     defermessage(msg);
     transitionto(mdeliveringstate);            /* 转到mdeliveringstate */
     return handled;
    ... ...
   }
  }
 } 
  ... ...
 class deliveringstate extends state {               /* 转到mdeliveringstate状态 */
  @override
  public void enter() {
   if (dbg) log("entering delivering state");
  }
  @override
  public void exit() {
   if (dbg) log("leaving delivering state");
  }
  @override
  public boolean processmessage(message msg) {
   switch (msg.what) {
    case event_new_sms:
     // handle new sms from ril
     handlenewsms((asyncresult) msg.obj);           /* 处理新sms */
     sendmessage(event_return_to_idle);            /* 处理完回到空闲状态 */
     return handled;
    ... ...
   }
  } 
   ... ...
 }
}
void handlenewsms(asyncresult ar) {
 ... ...
 smsmessage sms = (smsmessage) ar.result;
 result = dispatchmessage(sms.mwrappedsmsmessage);
 ... ...
}
public int dispatchmessage(smsmessagebase smsb) {
 ... ...
 return dispatchmessageradiospecific(smsb);
 ... ...
}

./frameworks/opt/telephony/src/java/com/android/internal/telephony/inboundsmshandler.java 


class deliveringstate extends state {
 ... ...
 public boolean processmessage(message msg) {
  switch (msg.what) {
   ... ...
   case event_broadcast_sms:               /* 接收到event_broadcast_sms消息并处理 */
    // if any broadcasts were sent, transition to waiting state
    if (processmessagepart((inboundsmstracker) msg.obj)) {
     transitionto(mwaitingstate);
    }
    return handled;
   ... ...
  }
 }
 ... ...

}
 
boolean processmessagepart(inboundsmstracker tracker) {
 ... ...
 broadcastreceiver resultreceiver = new smsbroadcastreceiver(tracker);     /* 创建一个广播接收者，用来处理短信广播的结果 */
 ... ...
 intent = new intent(intents.sms_deliver_action);           /* 设置当前intent的action为sms_deliver_action */

 // direct the intent to only the default sms app. if we can't find a default sms app
 // then sent it to all broadcast receivers.
 componentname componentname = smsapplication.getdefaultsmsapplication(mcontext, true); /* 这个action只会发送给carrier app，而且carrier app可以通过set result为result_canceled来终止这个广播 */
 if (componentname != null) {
  // deliver sms message only to this receiver
  intent.setcomponent(componentname);
  log("delivering sms to: " + componentname.getpackagename() +
    " " + componentname.getclassname());
 }
 ... ...
 dispatchintent(intent, android.manifest.permission.receive_sms,       /* 广播intent */
    appopsmanager.op_receive_sms, resultreceiver);
 ... ...
}

 
private final class smsbroadcastreceiver extends broadcastreceiver {
 ... ... 
 public void onreceive(context context, intent intent) {
  ... ...
  // now that the intents have been deleted we can clean up the pdu data.
  if (!intents.data_sms_received_action.equals(action)
    && !intents.data_sms_received_action.equals(action)
    && !intents.wap_push_received_action.equals(action)) {
   loge("unexpected broadcastreceiver action: " + action);
  }

  int rc = getresultcode();
  if ((rc != activity.result_ok) && (rc != intents.result_sms_handled)) {
   loge("a broadcast receiver set the result code to " + rc
     + ", deleting from raw table anyway!");
  } else if (dbg) {
   log("successful broadcast, deleting from raw table.");
  }

  deletefromrawtable(mdeletewhere, mdeletewhereargs);
  sendmessage(event_broadcast_complete);            /* 成功广播 */

  ... ...
 }
 ... ...
}