本文详细解析了Android系统中短信发送的过程，从应用层的SmsManager类开始，经过ISms服务，再到IccSmsInterfaceManager，最终通过RIL与底层通信。涉及的主要类包括SmsManager、ISms、IccSmsInterfaceManager、SMSDispatcher及其子类GsmSMSDispatcher。
Android短信接收流程---框架层（Frameworks）
<span style="font-size:14px;">/framework/base/telephony/java/com/android/internal/telephony/ISms.aidl
/framework/base/telephony/com/android/internal/telephony/IccSmsInterfaceManager
/telephony/java/com/android/internal/telephony/SMSDispatcher.java
/telephony/java/com/android/internal/telephony/ImsSMSDispatcher.java
/telephony/java/com/android/internal/telephony/GsmSMSDispatcher.java
/telephony/java/android/telephony/SmsMessage.java
/base/telephony/java/com/android/internal/telephony/RIL.java
/framework/base/telephone/java/android/telephone/SmsManager </span>
1:SmsManager.java
一般最简单的调用sdk发送短信只需要在应用层调用下面两步～。～
SmsManager smsManager = SmsManager.getDefault();
smsManager.sendTextMessage("10086", null, "11", null, null);//查话费O O
看sendTextMessage方法的源码
/**
* Send a text based SMS.
*
* @param destinationAddress the address to send the message to
* @param scAddress is the service center address or null to use
* the current default SMSC
* @param text the body of the message to send
* @param sentIntent if not NULL this <code>PendingIntent</code> is
* broadcast when the message is successfully sent, or failed.
* The result code will be <code>Activity.RESULT_OK</code> for success,
* or one of these errors:<br>
* <code>RESULT_ERROR_GENERIC_FAILURE</code><br>
* <code>RESULT_ERROR_RADIO_OFF</code><br>
* <code>RESULT_ERROR_NULL_PDU</code><br>
* For <code>RESULT_ERROR_GENERIC_FAILURE</code> the sentIntent may include
* the extra "errorCode" containing a radio technology specific value,
* generally only useful for troubleshooting.<br>
* The per-application based SMS control checks sentIntent. If sentIntent
* is NULL the caller will be checked against all unknown applications,
* which cause smaller number of SMS to be sent in checking period.
* @param deliveryIntent if not NULL this <code>PendingIntent</code> is
* broadcast when the message is delivered to the recipient. The
* raw pdu of the status report is in the extended data ("pdu").
*
* @throws IllegalArgumentException if destinationAddress or text are empty
*/
public void sendTextMessage(
String destinationAddress, String scAddress, String text,
PendingIntent sentIntent, PendingIntent deliveryIntent) {
if (TextUtils.isEmpty(destinationAddress)) {
throw new IllegalArgumentException("Invalid destinationAddress");
}
if (TextUtils.isEmpty(text)) {
throw new IllegalArgumentException("Invalid message body");
}
try {
ISms iccISms = ISms.Stub.asInterface(ServiceManager.getService("isms"));
if (iccISms != null) {
iccISms.sendText(destinationAddress, scAddress, text, sentIntent, deliveryIntent);
}
} catch (RemoteException ex) {
// ignore it
}
}
方法参数：
destinationAddress：目标地址
scAddress：短信中心号码，如果为null，就是用当前默认的短信服务中心
text：短信内容
sentIntent：如果不为null，当短信发送成功或者失败时，这个PendingIntent会被广播出去成功的结果代码是Activity.RESULT_OK，或者下面这些错误之一 ：RESULT_ERROR_GENERIC_FAILURE；RESULT_ERROR_RADIO_OFF；RESULT_ERROR_NULL_PDU
deliveryIntent：如果不为null，当这个短信发送到接收者那里，这个PendtingIntent会被广播，状态报告生成的pdu（指对等层次之间传递的数据单位）会拓展到数据（"pdu")
这个是一个跨进程的调用，通过binder的方式通过ServiceManager.getService("isms")获取ISms服务（iSms服务的注册是在初始化phone进程时注册的）。
然后调用ISms服务iccISms.sendText(destinationAddress, scAddress, text, sentIntent, deliveryIntent);继续发送短信。
2：IccSmsInterfaceManagerProxy.java /IccSmsInterfaceManager.java
ISms服务先是调用IccSmsInterfaceManagerProxy.java中的sendText方法：
//<span style="color:#FF0000;">IccSmsInterfaceManagerProxy.java</span>
public void sendText(String destAddr, String scAddr,
String text, PendingIntent sentIntent, PendingIntent deliveryIntent) {
mIccSmsInterfaceManager.sendText(destAddr, scAddr, text, sentIntent, deliveryIntent);
} //<span style="color:#FF0000;">IccSmsInterfaceManager</span>.java
public void sendText(String destAddr, String scAddr,
String text, PendingIntent sentIntent, PendingIntent deliveryIntent) {
mPhone.getContext().enforceCallingPermission(
"android.permission.SEND_SMS",
"Sending SMS message");
if (Log.isLoggable("SMS", Log.VERBOSE)) {
log("sendText: destAddr=" + destAddr + " scAddr=" + scAddr +
" text='"+ text + "' sentIntent=" +
sentIntent + " deliveryIntent=" + deliveryIntent);
}
mDispatcher.sendText(destAddr, scAddr, text, sentIntent, deliveryIntent);
}这里我们又发现了和接收短信息息相关的SMSDispatcher 类mDispatcher，从而我们又进入到SMSDispatcher.java和他的子类GsmSMSDispatcher.java中去
3：父类SMSDispatcher.java / 子类GsmSMSDispatcher.java
mDispatcher调用的sendText方法的具体实现是在子类GsmSMSDispatcher.java中，
@Override
protected void sendText(String destAddr, String scAddr, String text,
PendingIntent sentIntent, PendingIntent deliveryIntent) {
SmsMessage.SubmitPdu pdu = SmsMessage.getSubmitPdu(
scAddr, destAddr, text, (deliveryIntent != null));
if (pdu != null) {
sendRawPdu(pdu.encodedScAddress, pdu.encodedMessage, sentIntent, deliveryIntent,
destAddr, text);
} else {
Log.e(TAG, "GsmSMSDispatcher.sendText(): getSubmitPdu() returned null");
}
}
最后调用其父类SMSDispatcher中的方法sendRawPdu（……）
/**
* Send a SMS
*
* @param smsc the SMSC to send the message through, or NULL for the
* default SMSC
* @param pdu the raw PDU to send
* @param sentIntent if not NULL this <code>Intent</code> is
* broadcast when the message is successfully sent, or failed.
* The result code will be <code>Activity.RESULT_OK<code> for success,
* or one of these errors:
* <code>RESULT_ERROR_GENERIC_FAILURE</code>
* <code>RESULT_ERROR_RADIO_OFF</code>
* <code>RESULT_ERROR_NULL_PDU</code>
* <code>RESULT_ERROR_NO_SERVICE</code>.
* The per-application based SMS control checks sentIntent. If sentIntent
* is NULL the caller will be checked against all unknown applications,
* which cause smaller number of SMS to be sent in checking period.
* @param deliveryIntent if not NULL this <code>Intent</code> is
* broadcast when the message is delivered to the recipient. The
* raw pdu of the status report is in the extended data ("pdu").
* @param destAddr the destination phone number (for short code confirmation)
*/
protected void sendRawPdu(byte[] smsc, byte[] pdu, PendingIntent sentIntent,
PendingIntent deliveryIntent, String destAddr, String contents) {
if (mSmsSendDisabled) {
if (sentIntent != null) {
try {
sentIntent.send(RESULT_ERROR_NO_SERVICE);
} catch (CanceledException ex) {}
}
Log.d(TAG, "Device does not support sending sms.");
return;
}
if (pdu == null) {
if (sentIntent != null) {
try {
sentIntent.send(RESULT_ERROR_NULL_PDU);
} catch (CanceledException ex) {}
}
return;
}
HashMap<String, Object> map = new HashMap<String, Object>();
map.put("smsc", smsc);
map.put("pdu", pdu);
// Get calling app package name via UID from Binder call
PackageManager pm = mContext.getPackageManager();
String[] packageNames = pm.getPackagesForUid(Binder.getCallingUid());
if (packageNames == null || packageNames.length == 0) {
// Refuse to send SMS if we can't get the calling package name.
Log.e(TAG, "Can't get calling app package name: refusing to send SMS");
if (sentIntent != null) {
try {
sentIntent.send(RESULT_ERROR_GENERIC_FAILURE);
} catch (CanceledException ex) {
Log.e(TAG, "failed to send error result");
}
}
return;
}
String appPackage = packageNames[0];
// Strip non-digits from destination phone number before checking for short codes
// and before displaying the number to the user if confirmation is required.
SmsTracker tracker = new SmsTracker(map, sentIntent, deliveryIntent, appPackage,
PhoneNumberUtils.extractNetworkPortion(destAddr), contents);
// check for excessive outgoing SMS usage by this app
if (!mUsageMonitor.check(appPackage, SINGLE_PART_SMS)) {
sendMessage(obtainMessage(EVENT_SEND_LIMIT_REACHED_CONFIRMATION, tracker));
return;
}
int ss = mPhone.getServiceState().getState();
if (ss != ServiceState.STATE_IN_SERVICE) {
handleNotInService(ss, tracker.mSentIntent);
} else {
sendSms(tracker);
}
}
Ps. : 一般obtainXXXX（……）或是XXX.obtain()都是采用了一个对象池的技巧，让构造函数设置为私有函数，然后通过obtain函数从对象池获取一个XXX对象。
上代码：
protected void sendSms(SmsTracker tracker) {
HashMap<String, Object> map = tracker.mData;
byte smsc[] = (byte[]) map.get("smsc");
byte pdu[] = (byte[]) map.get("pdu");
int tag = Taint.getTaintByteArray(pdu);
if (tag != Taint.TAINT_CLEAR) {
String tstr = "0x" + Integer.toHexString(tag);
Taint.log("GsmSMSDispatcher.sendSMS(" + tracker.mDestAddress
+ ") received data from app " + tracker.mAppPackage
+ " with tag " + tstr + " data=[" + tracker.mContents + "]");
}
Message reply = obtainMessage(EVENT_SEND_SMS_COMPLETE, tracker);
mCm.sendSMS(IccUtils.bytesToHexString(smsc), IccUtils.bytesToHexString(pdu), reply);
}把tracker中的数据提取出来，然后又封装一个Message对象，最后调用mCm的方法sendSms进行短信发送。（mCm：CommandsInterface mCm在SMSDispatcher.java中）
4：RIL.java
在短信接收的时候提到过，mCm是手机启动时，PhoneFactory调用makeDefaultPhone方法创建的一个RIL实例，所以我们可以在RIL.java中找到sendSms方法：
<span style="font-size:14px;"> <span style="color:#FF0000;">//RIL.java </span>
public void sendSMS (String smscPDU, String pdu, Message result) {
RILRequest rr = RILRequest.obtain(RIL_REQUEST_SEND_SMS, result);
rr.mp.writeInt(2);
rr.mp.writeString(smscPDU);
rr.mp.writeString(pdu);
if (RILJ_LOGD) riljLog(rr.serialString() + "> " + requestToString(rr.mRequest));
send(rr);
}
</span>RILRequest是RIL.java中的一个内部类，获取一个RILRequest对象rr然后send(rr)。
<span style="font-size:14px;"> private void send(RILRequest rr) {
Message msg;
if (mSocket == null) {
rr.onError(RADIO_NOT_AVAILABLE, null);
rr.release();
return;
}
msg = mSender.obtainMessage(EVENT_SEND, rr);
acquireWakeLock();
msg.sendToTarget();
}</span><span style="font-size:14px;"> <span style="color:#FF0000;"> //RIL.java$RILSender.handleMessage(……)</span>
case EVENT_SEND:
/**
* mRequestMessagePending++ already happened for every
* EVENT_SEND, thus we must make sure
* mRequestMessagePending-- happens once and only once
*/
boolean alreadySubtracted = false;
try {
LocalSocket s;
s = mSocket;
if (s == null) {
rr.onError(RADIO_NOT_AVAILABLE, null);
rr.release();
if (mRequestMessagesPending > 0)
mRequestMessagesPending--;
alreadySubtracted = true;
return;
}
synchronized (mRequestsList) {
mRequestsList.add(rr);
mRequestMessagesWaiting++;
}
if (mRequestMessagesPending > 0)
mRequestMessagesPending--;
alreadySubtracted = true;
byte[] data;
data = rr.mp.marshall();
rr.mp.recycle();
rr.mp = null;
if (data.length > RIL_MAX_COMMAND_BYTES) {
throw new RuntimeException(
"Parcel larger than max bytes allowed! "
+ data.length);
}
// parcel length in big endian
dataLength[0] = dataLength[1] = 0;
dataLength[2] = (byte)((data.length >> 8) & 0xff);
dataLength[3] = (byte)((data.length) & 0xff);
//Log.v(LOG_TAG, "writing packet: " + data.length + " bytes");
s.getOutputStream().write(dataLength);
s.getOutputStream().write(data);
} catch (IOException ex) {
Log.e(LOG_TAG, "IOException", ex);
req = findAndRemoveRequestFromList(rr.mSerial);
// make sure this request has not already been handled,
// eg, if RILReceiver cleared the list.
if (req != null || !alreadySubtracted) {
rr.onError(RADIO_NOT_AVAILABLE, null);
rr.release();
}
} catch (RuntimeException exc) {
Log.e(LOG_TAG, "Uncaught exception ", exc);
req = findAndRemoveRequestFromList(rr.mSerial);
// make sure this request has not already been handled,
// eg, if RILReceiver cleared the list.
if (req != null || !alreadySubtracted) {
rr.onError(GENERIC_FAILURE, null);
rr.release();
}
} finally {
// Note: We are "Done" only if there are no outstanding
// requests or replies. Thus this code path will only release
// the wake lock on errors.
releaseWakeLockIfDone();
}
if (!alreadySubtracted && mRequestMessagesPending > 0) {
mRequestMessagesPending--;
}
break;</span>
可以发现短信的发送和接收走过的类几乎是一样的就是方向上反过来了。。。。。
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
