adb 简要分析

前面有篇文章介绍了adb install的后面的流程，但前面的通信过程没有怎么介绍，这里主要介绍下adb 启动的流程，以及connect、install的前面流程，这里介绍的都是服务端的。

一、adb 启动流程:

首先看下服务端adb 启动的流程

adb_main主要 调用4个初始化函数：

1、init_transport_registration：初始化本地事务处理，每个client连接都会有一个专门的处理，对每个client都会在服务端有一对套接字对与该client相连的socket上的数据流进行处理。

2、install_listener(local_name, "*smartsocket*", NULL)，这个函数 暂时还不知道做什么的；

3、local_init，初始化本地套接字，等待client的连接。

4、init_jdwp这个好像是跟dalvik中间的某个东东通讯的，没去研究。

5、fdevent_loop，事件处理，当相应的套接字上有数据到来时，调用注册的函数进行处理。

这里主要介绍下init_transport_registration，local_init，fdevent_loop这三个函数。

1)、init_transport_registration

void init_transport_registration(void){    int s[2];    if(adb_socketpair(s)){        fatal_errno("cannot open transport registration socketpair");    }    transport_registration_send = s[0];    transport_registration_recv = s[1];    fdevent_install(&transport_registration_fde,                    transport_registration_recv,                    transport_registration_func,                    0);    fdevent_set(&transport_registration_fde, FDE_READ);}

这里调用adb_socketpair建立一对匿名的已经连接的套接字，分别赋给transport_registration_send和transport_registration_recv，之后调用fdevent_install把transport_registration_recv这个套接字注册到监听到套接字里面，并把相应的处理函数设置为transport_registration_func。

2）、local_init

void local_init(int port){    adb_thread_t thr;    void* (*func)(void *);    if(HOST) {        func = client_socket_thread;    } else {        func = server_socket_thread;    }    D("transport: local %s init\n", HOST ? "client" : "server");    if(adb_thread_create(&thr, func, (void *)port)) {        fatal_errno("cannot create local socket %s thread",                    HOST ? "client" : "server");    }}

这里是server端，所以这里func为server_socket_thread，这里创建了这个线程：

static void *server_socket_thread(void * arg){    int serverfd, fd;    struct sockaddr addr;    socklen_t alen;    int port = (int)arg;    D("transport: server_socket_thread() starting\n");    serverfd = -1;    for(;;) {        if(serverfd == -1) {            serverfd = socket_inaddr_any_server(port, SOCK_STREAM);            if(serverfd < 0) {                D("server: cannot bind socket yet\n");                adb_sleep_ms(1000);                continue;            }            close_on_exec(serverfd);        }        alen = sizeof(addr);        D("server: trying to get new connection from %d\n", port);        fd = adb_socket_accept(serverfd, &addr, &alen);        if(fd >= 0) {            D("server: new connection on fd %d\n", fd);            close_on_exec(fd);            disable_tcp_nagle(fd);            register_socket_transport(fd, "host", port, 1);        }    }    D("transport: server_socket_thread() exiting\n");    return 0;}

这里调用socket_inaddr_any_server建立监听套接字，这里的port默认是5555，再调用adb_socket_accept等待客户连接的到来。

3)、fdevent_loop

void fdevent_loop(){    fdevent *fde;    for(;;) {#if DEBUG        fprintf(stderr,"--- ---- waiting for events\n");#endif        fdevent_process();        while((fde = fdevent_plist_dequeue())) {            unsigned events = fde->events;            fde->events = 0;            fde->state &= (~FDE_PENDING);            dump_fde(fde, "callback");            fde->func(fde->fd, events, fde->arg);        }    }}

这里先调用fdevent_process启动select或epoll检测机制，这里面会把有数据到来的套接字消息调用fdevent_plist_enqueue压入list_pending，调用fdevent_plist_dequeue从list_pending取出一条消息，并调用它的处理函数进行处理。

二、adb connect流程：

上面 我们讲server_socket_thread讲到创建了一个线程并监听等待客户连接的到来，当client连接过来的时候， 这里accept会返回，我们接着往下看，会调用register_socket_transport注册这个连接

void register_socket_transport(int s, const char *serial, int port, int local){    atransport *t = calloc(1, sizeof(atransport));    D("transport: %p init'ing for socket %d, on port %d\n", t, s, port);    if ( init_socket_transport(t, s, port, local) < 0 ) {        adb_close(s);        free(t);        return;    }    if(serial) {        t->serial = strdup(serial);    }    register_transport(t);}

分配了一个atransport结构并调用init_socket_transport进行初始化

int init_socket_transport(atransport *t, int s, int adb_port, int local){    int  fail = 0;    t->kick = remote_kick;    t->close = remote_close;    t->read_from_remote = remote_read;    t->write_to_remote = remote_write;    t->sfd = s;    t->sync_token = 1;    t->connection_state = CS_OFFLINE;    t->type = kTransportLocal;    t->adb_port = 0;｝

注意这里的sdf是这个连接的套接字，还有remote_read及remote_write.

接着调用register_transport注册这个事务

static void register_transport(atransport *transport){    tmsg m;    m.transport = transport;    m.action = 1;    D("transport: %p registered\n", transport);    if(transport_write_action(transport_registration_send, &m)) {        fatal_errno("cannot write transport registration socket\n");    }}

注意这里transport_write_action的第一个参数是transport_registration_send，是否有点印象，对的，这个fd就是我们在init_transport_registration建立的一对已连接的匿名套接字中 的一个。这样在transport_registration_recv就会有数据到来。并调用transport_registration_func，

static void transport_registration_func(int _fd, unsigned ev, void *data){    tmsg m;    adb_thread_t output_thread_ptr;    adb_thread_t input_thread_ptr;    int s[2];    atransport *t;    if(!(ev & FDE_READ)) {        return;    }    if(transport_read_action(_fd, &m)) {        fatal_errno("cannot read transport registration socket");    }    t = m.transport;    if(m.action == 0){        D("transport: %p removing and free'ing %d\n", t, t->transport_socket);            /* IMPORTANT: the remove closes one half of the            ** socket pair.  The close closes the other half.            */        fdevent_remove(&(t->transport_fde));        adb_close(t->fd);        adb_mutex_lock(&transport_lock);        t->next->prev = t->prev;        t->prev->next = t->next;        adb_mutex_unlock(&transport_lock);        run_transport_disconnects(t);        if (t->product)            free(t->product);        if (t->serial)            free(t->serial);        memset(t,0xee,sizeof(atransport));        free(t);        update_transports();        return;    }    /* don't create transport threads for inaccessible devices */    if (t->connection_state != CS_NOPERM) {        /* initial references are the two threads */        t->ref_count = 2;        if(adb_socketpair(s)) {            fatal_errno("cannot open transport socketpair");        }        D("transport: %p (%d,%d) starting\n", t, s[0], s[1]);        t->transport_socket = s[0];        t->fd = s[1];        D("transport: %p install %d\n", t, t->transport_socket );        fdevent_install(&(t->transport_fde),                        t->transport_socket,                        transport_socket_events,                        t);        fdevent_set(&(t->transport_fde), FDE_READ);        if(adb_thread_create(&input_thread_ptr, input_thread, t)){            fatal_errno("cannot create input thread");        }        if(adb_thread_create(&output_thread_ptr, output_thread, t)){            fatal_errno("cannot create output thread");        }    }        /* put us on the master device list */    adb_mutex_lock(&transport_lock);    t->next = &transport_list;    t->prev = transport_list.prev;    t->next->prev = t;    t->prev->next = t;    adb_mutex_unlock(&transport_lock);    t->disconnects.next = t->disconnects.prev = &t->disconnects;    update_transports();}

在这个函数中，先调用transport_read_action读取前面写入的tmsg数据，m.action =1，所以不执行，这里t->connection_state!= CS_NOPERM，前面赋值了为CS_OFFLINE。adb_socketpair又建立两个本地通信套接字，分别赋给t->transport_socket和t->fd，接着调用fdevent_install把t->transport_socket添加进去,创建input_thread 和output_thread两线程。

static void *input_thread(void *_t){    atransport *t = _t;    apacket *p;    int active = 0;    D("to_remote: starting input_thread for %p, reading from fd %d\n",       t, t->fd);    for(;;){        if(read_packet(t->fd, &p)) {            D("to_remote: failed to read apacket from transport %p on fd %d\n",                t, t->fd );            break;        }        if(p->msg.command == A_SYNC){            if(p->msg.arg0 == 0) {                D("to_remote: transport %p SYNC offline\n", t);                put_apacket(p);                break;            } else {                if(p->msg.arg1 == t->sync_token) {                    D("to_remote: transport %p SYNC online\n", t);                    active = 1;                } else {                    D("to_remote: trandport %p ignoring SYNC %d != %d\n",                      t, p->msg.arg1, t->sync_token);                }            }        } else {            if(active) {                D("to_remote: transport %p got packet, sending to remote\n", t);                t->write_to_remote(p, t);            } else {                D("to_remote: transport %p ignoring packet while offline\n", t);            }        }        put_apacket(p);    }    // this is necessary to avoid a race condition that occured when a transport closes    // while a client socket is still active.    close_all_sockets(t);    D("to_remote: thread is exiting for transport %p, fd %d\n", t, t->fd);    kick_transport(t);    transport_unref(t);    return 0;}

input_thread就是从t->fd读数据，然后调用write_to_remote,write_to_remote中有一句writex(t->sfd,&p->msg, sizeof(amessage) + length)发给远端

再来看下output_thread

static void *output_thread(void *_t){    atransport *t = _t;    apacket *p;    D("from_remote: starting thread for transport %p, on fd %d\n", t, t->fd );    D("from_remote: transport %p SYNC online (%d)\n", t, t->sync_token + 1);    p = get_apacket();    p->msg.command = A_SYNC;    p->msg.arg0 = 1;    p->msg.arg1 = ++(t->sync_token);    p->msg.magic = A_SYNC ^ 0xffffffff;    if(write_packet(t->fd, &p)) {        put_apacket(p);        D("from_remote: failed to write SYNC apacket to transport %p", t);        goto oops;    }    D("from_remote: data pump  for transport %p\n", t);    for(;;) {        p = get_apacket();        if(t->read_from_remote(p, t) == 0){            D("from_remote: received remote packet, sending to transport %p\n",              t);            if(write_packet(t->fd, &p)){                put_apacket(p);                D("from_remote: failed to write apacket to transport %p", t);                goto oops;            }        } else {            D("from_remote: remote read failed for transport %p\n", p);            put_apacket(p);            break;        }    }    D("from_remote: SYNC offline for transport %p\n", t);    p = get_apacket();    p->msg.command = A_SYNC;    p->msg.arg0 = 0;    p->msg.arg1 = 0;    p->msg.magic = A_SYNC ^ 0xffffffff;    if(write_packet(t->fd, &p)) {        put_apacket(p);        D("from_remote: failed to write SYNC apacket to transport %p", t);    }oops:    D("from_remote: thread is exiting for transport %p\n", t);    kick_transport(t);    transport_unref(t);    return 0;}

output_thread先往t->fd写一个A_SYNC命令，然后循环调用read_from_remote，remote_read 中有(readx(t->sfd,p->data, p->msg.data_length)，然后write_packet把数据写到t->fd。上面output_thread中往t->fdk中写了一个A_SYNC命令，这样就触发了t->transport_socket上的读操作，并调用transport_socket_events

static void transport_socket_events(int fd, unsigned events, void *_t){    if(events & FDE_READ){        apacket *p = 0;        if(read_packet(fd, &p)){            D("failed to read packet from transport socket on fd %d\n", fd);        } else {            handle_packet(p, (atransport *) _t);        }    }}

这里先从fd读数据，然后调用handle_packet处理，对于A_SYNC，有相应的如下代码：

void handle_packet(apacket *p, atransport *t){   ...   case A_SYNC:        if(p->msg.arg0){            send_packet(p, t);            if(HOST) send_connect(t);        } else {            t->connection_state = CS_OFFLINE;            handle_offline(t);            send_packet(p, t);        }        return;   ...}

p->msg.arg0= 1；所以直接send_packet，这里面会调用write_packet(t->transport_socket,&p)，这样与它相应的对端就可以收到数据，在input_thread中会从t->fd读出数据并发给远端,注意这里远端连接的套接字并没有加入fdevent，而是在output_thread中阻塞在read上面，直到Client端有数据到来。客户端收到A_SYNC命令后，会发送一个connect消息过来，收到数据后就转发给t->fd，触发t->transport_socket,执行transport_socket_events同样调用handle_packet处理收到的数据。

void handle_packet(apacket *p, atransport *t){    ...    case A_CNXN: /* CONNECT(version, maxdata, "system-id-string") */            /* XXX verify version, etc */        if(t->connection_state != CS_OFFLINE) {            t->connection_state = CS_OFFLINE;            handle_offline(t);        }        parse_banner((char*) p->data, t);        handle_online();        if(!HOST) send_connect(t);        break;      ....}

调用send_connect发送版本等信息到远端.

三、adb install 通讯过程

同样消息从远端的sfd送到t->fd，触发t->transport_socket执行handle_packet，这里Client先发送一条A_OPEN消息

void handle_packet(apacket *p, atransport *t){   ...   case A_OPEN: /* OPEN(local-id, 0, "destination") */        if(t->connection_state != CS_OFFLINE) {            char *name = (char*) p->data;            name[p->msg.data_length > 0 ? p->msg.data_length - 1 : 0] = 0;            s = create_local_service_socket(name);            if(s == 0) {                send_close(0, p->msg.arg0, t);            } else {                s->peer = create_remote_socket(p->msg.arg0, t);                s->peer->peer = s;                send_ready(s->id, s->peer->id, t);                s->ready(s);            }        }        break;   ...}

这里的name 是”sync：”，用于通知服务端同步读取client发送过来的文件，调用create_local_service_socket创建一个本地服务的socket

asocket *create_local_service_socket(const char *name){    asocket *s;    int fd;    fd = service_to_fd(name);    if(fd < 0) return 0;    s = create_local_socket(fd);    D("LS(%d): bound to '%s'\n", s->id, name);    return s;}

在service_to_fd中这里对应于create_service_thread(file_sync_service, NULL);

static int create_service_thread(void (*func)(int, void *), void *cookie){    stinfo *sti;    adb_thread_t t;    int s[2];    if(adb_socketpair(s)) {        printf("cannot create service socket pair\n");        return -1;    }    sti = malloc(sizeof(stinfo));    if(sti == 0) fatal("cannot allocate stinfo");    sti->func = func;    sti->cookie = cookie;    sti->fd = s[1];    if(adb_thread_create( &t, service_bootstrap_func, sti)){        free(sti);        adb_close(s[0]);        adb_close(s[1]);        printf("cannot create service thread\n");        return -1;    }    D("service thread started, %d:%d\n",s[0], s[1]);    return s[0];}

在这里面又调用adb_socketpair创建了两个本地通信套接字，并返回其中s[0]，这里还创建一个线程：service_bootstrap_func，执行void *service_bootstrap_func(void *x)

void *service_bootstrap_func(void *x){    stinfo *sti = x;    sti->func(sti->fd, sti->cookie);    free(sti);    return 0;}

这里的func是file_sync_service，sti->fd= s[1]。

void file_sync_service(int fd, void *cookie){    syncmsg msg;    char name[1025];    unsigned namelen;    char *buffer = malloc(SYNC_DATA_MAX);    if(buffer == 0) goto fail;    for(;;) {        D("sync: waiting for command\n");        if(readx(fd, &msg.req, sizeof(msg.req))) {            fail_message(fd, "command read failure");            break;        }        namelen = ltohl(msg.req.namelen);        if(namelen > 1024) {            fail_message(fd, "invalid namelen");            break;        }        if(readx(fd, name, namelen)) {            fail_message(fd, "filename read failure");            break;        }        name[namelen] = 0;        msg.req.namelen = 0;        D("sync: '%s' '%s'\n", (char*) &msg.req, name);        switch(msg.req.id) {        case ID_STAT:            if(do_stat(fd, name)) goto fail;            break;        case ID_LIST:            if(do_list(fd, name)) goto fail;            break;        case ID_SEND:            if(do_send(fd, name, buffer)) goto fail;            break;        case ID_RECV:            if(do_recv(fd, name, buffer)) goto fail;            break;        case ID_QUIT:            goto fail;        default:            fail_message(fd, "unknown command");            goto fail;        }    }fail:    if(buffer != 0) free(buffer);    D("sync: done\n");    adb_close(fd);}

这里就阻塞在读上面了，等待套接字上数据的到来。

回到create_local_service_socket，继续调用create_local_socket，并把刚返回的s[0]传进来了

asocket *create_local_socket(int fd){    asocket *s = calloc(1, sizeof(asocket));    if(s == 0) fatal("cannot allocate socket");    install_local_socket(s);    s->fd = fd;    s->enqueue = local_socket_enqueue;    s->ready = local_socket_ready;    s->close = local_socket_close;    fdevent_install(&s->fde, fd, local_socket_event_func, s);/*    fdevent_add(&s->fde, FDE_ERROR); */    //fprintf(stderr, "Created local socket in create_local_socket \n");    D("LS(%d): created (fd=%d)\n", s->id, s->fd);    return s;}

注意这里asocket类型变量t的enqueue为local_socket_enqueue，这里fd就是前面 返回的s[0]，安装到fdevent，这里的处理函数是local_socket_event_func.,这里的local_socket_event_func函数是在s[1],即进行文件操作的那端需要往对端发送消息时触发的。

回到handle_packet,再调用create_remote_socket,创建一个asocket，初始化,把这个peer初始化为他的对端。

asocket *create_remote_socket(unsigned id, atransport *t){    asocket *s = calloc(1, sizeof(aremotesocket));    adisconnect*  dis = &((aremotesocket*)s)->disconnect;    if(s == 0) fatal("cannot allocate socket");    s->id = id;    s->enqueue = remote_socket_enqueue;    s->ready = remote_socket_ready;    s->close = remote_socket_close;    s->transport = t;    dis->func   = remote_socket_disconnect;    dis->opaque = s;    add_transport_disconnect( t, dis );    D("RS(%d): created\n", s->id);    return s;}

赋值给s->peer;然后调用send_ready发送A_OKAY,最后调用s->ready把s->fd加入fdevent

A_OPEN处理完了，就会在与Client连接的套接字字上收到A_WRTE，

void handle_packet(apacket *p, atransport *t){    asocket *s;    ...    case A_WRTE:        if(t->connection_state != CS_OFFLINE) {            if((s = find_local_socket(p->msg.arg1))) {                unsigned rid = p->msg.arg0;                p->len = p->msg.data_length;                if(s->enqueue(s, p) == 0) {                    D("Enqueue the socket\n");                    send_ready(s->id, rid, t);                }                return;            }        }        break;    ....｝

先调用find_local_socket找到前面建立的local_service_socket，调用s->enqueue，这里调用local_socket_enqueue

static int local_socket_enqueue(asocket *s, apacket *p){   ...       while(p->len > 0) {        int r = adb_write(s->fd, p->ptr, p->len);        if(r > 0) {            p->len -= r;            p->ptr += r;            continue;        }        if((r == 0) || (errno != EAGAIN)) {            D( "LS(%d): not ready, errno=%d: %s\n", s->id, errno, strerror(errno) );            s->close(s);            return 1; /* not ready (error) */        } else {            break;        }    }   ...}

这里把数据写到s->fd，也即前面的s[0]，往s[0]写数据时候会触发file_sync_service读数据，这个函数阻塞在readx读数据，上面写了数据后，这里就会去读。所有数据都处理完了则发送send_ready

数据的发送过程：

先发送ID_STAT，查看文件是否存在，不存在的话再发送ID_SEND发送文件，文件发送完毕发送ID_QUIT退出，关关闭套接字

这里在client发送了ID_STAT时会回一个消息给client，就是通过往s[1]里面写，而s[0]是加到了select或poll中监听的，这个时候 s[0]就会触发，执行local_socket_event_func

static void local_socket_event_func(int fd, unsigned ev, void *_s){     ....    if(ev & FDE_READ){        apacket *p = get_apacket();        unsigned char *x = p->data;        size_t avail = MAX_PAYLOAD;        int r;        int is_eof = 0;        while(avail > 0) {            r = adb_read(fd, x, avail);            if(r > 0) {                avail -= r;                x += r;                continue;            }            if(r < 0) {                if(errno == EAGAIN) break;                if(errno == EINTR) continue;            }                /* r = 0 or unhandled error */            is_eof = 1;            break;        }        if((avail == MAX_PAYLOAD) || (s->peer == 0)) {            put_apacket(p);        } else {            p->len = MAX_PAYLOAD - avail;            r = s->peer->enqueue(s->peer, p);            if(r < 0) {                    /* error return means they closed us as a side-effect                    ** and we must return immediately.                    **                    ** note that if we still have buffered packets, the                    ** socket will be placed on the closing socket list.                    ** this handler function will be called again                    ** to process FDE_WRITE events.                    */                return;            }       }     ....}

这里的s->peer->enpueue即是remote_socket_enqueue

static int remote_socket_enqueue(asocket *s, apacket *p){    D("Calling remote_socket_enqueue\n");    p->msg.command = A_WRTE;    p->msg.arg0 = s->peer->id;    p->msg.arg1 = s->id;    p->msg.data_length = p->len;    send_packet(p, s->transport);    return 1;}

这里往transport写数据又回到了前面的流程了，会在input_thread中会从t->fd读出数据并发给远端。

具体文件接收过程：

先接收消息头，判断是否为文件内容消息，以及是否发送完毕消息：

如果是文件内容消息，则接收数据并盘入文件

如果是发送完毕消息，则跳出循环，发送ID_OKAY消息。

文件接收完毕，Client会再发个A_OPEN消息name = shell:pm install /data/local/tmp/sipDemo.apk，这个时候会重新建立一个create_local_socket，最后调用create_subprocess，这里会打开伪终端/dev/ptmx。( 通过函数open()打开设备“/dev/ptmx”，可以得到一对伪终端的主从设备，得到的fd是主设备的文件描述符)在父进程里使用fd，子进程中打开从设备的设备名可以通过函数ptsname()，在子进程中重定位标准输出到伪终端，这样子进程中的有输出父进程就能得到，注意在pm.java  runInstall函数中有这样几行代码

    private void runInstall() {    .....  PackageInstallObserver obs = new PackageInstallObserver();        try {            mPm.installPackage(Uri.fromFile(new File(apkFilePath)), obs, installFlags,                    installerPackageName);            synchronized (obs) {                while (!obs.finished) {                    try {                        obs.wait();                    } catch (InterruptedException e) {                    }                }                if (obs.result == PackageManager.INSTALL_SUCCEEDED) {                    System.out.println("Success");                } else {                    System.err.println("Failure ["                            + installFailureToString(obs.result)                            + "]");                }            }        } catch (RemoteException e) {            System.err.println(e.toString());            System.err.println(PM_NOT_RUNNING_ERR);        }  ...,}

这里用System.err.println就是打到标准输出设备，也就是伪终端了

安装完毕后，发送结果给Client,Client还会发一个A_OPEN消息，name = shell:rm /data/local/tmp/sipDemo.apk，删除这个apk最后发送A_CLSE删除这个连接

Adb处理install流程：

参考：

http://blog.chinaunix.net/uid-20514606-id-375756.html

http://blog.csdn.net/yinlijun2004/article/details/7008952