anadroid inputmanager详细分析

<pre name="code" class="cpp"><pre name="code" class="cpp">a

先上一张图，对input整体框架有个总体认识：

InputManager是输入控制中心，它有两个关键线程InputReaderThread和InputDispatcherThread，它们的主要功能部分分别在InputReader和InputDispacher。前者用于从设备中读取事件，后者将事件分发给目标窗口。EventHub是输入设备的控制中心，它直接与inputdriver打交道。负责处理输入设备的增减，查询，输入事件的处理并向上层提供getEvents()接口接收事件。在它的构造函数中，主要做三件事：
1. 创建epoll对象，之后就可以把各输入设备的fd挂在上面多路等待输入事件。
2. 建立用于唤醒的pipe，把读端挂到epoll上，以后如果有设备参数的变化需要处理，而getEvents()又阻塞在设备上，就可以调用wake()在pipe的写端写入，就可以让线程从等待中返回。
3. 利用inotify机制监听/dev/input目录下的变更，如有则意味着设备的变化，需要处理。

事件的处理是流水线，需要InputReader先读事件，然后InputDispatcher才能进一步处理和分发。因此InputDispatcher需要监听InputReader。这里使用了Listener模式，InputDispacher作为InputReader构造函数的第三个参数，它实现InputListenerInterface接口。到了InputReader的构造函数中，将之包装成QueuedInputListener。QueuedInputListener中的成员变量mArgsQueue是一个缓冲队列，只有在flush()时，才会一次性通知InputDispatcher。QueuedInputListener应用了Command模式（感觉更像观察者模式，这个设计模式待定），它通过包装InputDispatcher(实现InputListenerInterface接口)，将事件的处理请求封装成NotifyArgs，使其有了缓冲执行的功能。

下面分析inputmanager的inputReader和InputDispatcher，分析后应该知道inputReader是怎么发送input事件给InputDispatcher，并且InputDispatcher是怎么把inut事件发送出去的。

先看一张序列图：

先分析inputReader：

bool InputReaderThread::threadLoop() {    mReader->loopOnce();    return true;}

void InputReader::loopOnce() {....size_t count = mEventHub->getEvents(timeoutMillis, mEventBuffer, EVENT_BUFFER_SIZE);if (count) {            processEventsLocked(mEventBuffer, count);        }.....mQueuedListener->flush();}

这里只摘出了，我们需要分析的流程代码，EventHub先读取驱动中上报的input事件，然后再调用mQueueListener->flush()。

这个mQueueListener->flush()是什么东西？

这里用到了通知者模式：

进入InputListener.cpp查看代码可以看到，notifyXXXX，这里以notifyMotion举例说明，

void QueuedInputListener::notifyMotion(const NotifyMotionArgs* args) {    mArgsQueue.push(new NotifyMotionArgs(*args));}

这里是实现了被通知者注册的函数，想要被通知方都可以注册，然后当通知方发送通知的时候，被通知方都能够收到消息。

被通知方类：

NotifyMotionArgs::NotifyMotionArgs(......) {    for (uint32_t i = 0; i < pointerCount; i++) {        this->pointerProperties[i].copyFrom(pointerProperties[i]);        this->pointerCoords[i].copyFrom(pointerCoords[i]);    }}NotifyMotionArgs::NotifyMotionArgs(const NotifyMotionArgs& other):.... {    for (uint32_t i = 0; i < pointerCount; i++) {        pointerProperties[i].copyFrom(other.pointerProperties[i]);        pointerCoords[i].copyFrom(other.pointerCoords[i]);    }}void NotifyMotionArgs::notify(const sp<InputListenerInterface>& listener) const {    listener->notifyMotion(this);}

在哪里注册了这个NotifyMotionArgs?

void TouchInputMapper::dispatchMotion(){

    .....

    NotifyMotionArgs args(when, getDeviceId(), source, policyFlags,            action, flags, metaState, buttonState, edgeFlags,            mViewport.displayId, pointerCount, pointerProperties, pointerCoords,            xPrecision, yPrecision, downTime);    getListener()->notifyMotion(&args);}

这里就注册了被通知者，当然还有一些其他的被通知者类型，大家可以看InputListener.cpp文件。

QueuedInputListener::flush()函数的实现：

void QueuedInputListener::flush() {    size_t count = mArgsQueue.size();    for (size_t i = 0; i < count; i++) {        NotifyArgs* args = mArgsQueue[i];        args->notify(mInnerListener);        delete args;    }    mArgsQueue.clear();}

从上面代码可以看出，当调用flush的时候就会发起通知，通知所有的被通知者调用notify。

void NotifyMotionArgs::notify(const sp<InputListenerInterface>& listener) const {<pre name="code" class="cpp">InputManager::InputManager(        const sp<EventHubInterface>& eventHub,        const sp<InputReaderPolicyInterface>& readerPolicy,        const sp<InputDispatcherPolicyInterface>& dispatcherPolicy) {    mDispatcher = new InputDispatcher(dispatcherPolicy);    mReader = new InputReader(eventHub, readerPolicy, mDispatcher);    initialize();}

listener->notifyMotion(this);}

listener是什么？

listener是mInnerListener，mInnerListener是什么？

QueuedInputListener::QueuedInputListener(const sp<InputListenerInterface>& innerListener) :        mInnerListener(innerListener) {}

InputReader::InputReader(const sp<EventHubInterface>& eventHub,        const sp<InputReaderPolicyInterface>& policy,        const sp<InputListenerInterface>& listener) {    mQueuedListener = new QueuedInputListener(listener);    { // acquire lock        AutoMutex _l(mLock);        refreshConfigurationLocked(0);        updateGlobalMetaStateLocked();    } // release lock}

InputManager::InputManager(        const sp<EventHubInterface>& eventHub,        const sp<InputReaderPolicyInterface>& readerPolicy,        const sp<InputDispatcherPolicyInterface>& dispatcherPolicy) {    mDispatcher = new InputDispatcher(dispatcherPolicy);    mReader = new InputReader(eventHub, readerPolicy, mDispatcher);    initialize();}

可以看到listener其实就是InputDispatcher。

所以

listener->notifyMotion(this);

调用的就是：

void InputDispatcher::notifyMotion(const NotifyMotionArgs* args) {....needWake = enqueueInboundEventLocked(newEntry);.....if (needWake) {        mLooper->wake();    }}

enqueueInboundEventLocked()----mInboundQueue.enqueueAtTail(entry); inputevent事件都存在了mInboundQueue中。
mLooper->wake();wake 肯定有mLooper->wait();继续分析。

在分析InputDispatcher之前，再给大家分析一个重要的观察者模式。

在上面分析的loopOnce()中，还有processEventsLocked(mEventBuffer, count);函数，该函数里面也运用了观察者模式。

void InputReader::processEventsLocked(const RawEvent* rawEvents, size_t count) {    for (const RawEvent* rawEvent = rawEvents; count;) {        int32_t type = rawEvent->type;        size_t batchSize = 1;        if (type < EventHubInterface::FIRST_SYNTHETIC_EVENT) {            int32_t deviceId = rawEvent->deviceId;            while (batchSize < count) {                if (rawEvent[batchSize].type >= EventHubInterface::FIRST_SYNTHETIC_EVENT                        || rawEvent[batchSize].deviceId != deviceId) {                    break;                }                batchSize += 1;            }#if DEBUG_RAW_EVENTS            ALOGD("BatchSize: %d Count: %d", batchSize, count);#endif            processEventsForDeviceLocked(deviceId, rawEvent, batchSize);        } else {            switch (rawEvent->type) {            case EventHubInterface::DEVICE_ADDED:                addDeviceLocked(rawEvent->when, rawEvent->deviceId);                break;            case EventHubInterface::DEVICE_REMOVED:                removeDeviceLocked(rawEvent->when, rawEvent->deviceId);                break;            case EventHubInterface::FINISHED_DEVICE_SCAN:                handleConfigurationChangedLocked(rawEvent->when);                break;            default:                ALOG_ASSERT(false); // can't happen                break;            }        }        count -= batchSize;        rawEvent += batchSize;    }}

这里主要看for循环中else部分。

其中

addDeviceLocked(rawEvent->when, rawEvent->deviceId);

是添加被通知者。

  removeDeviceLocked(rawEvent->when, rawEvent->deviceId);

删除一个被通知者。

processEventsForDeviceLocked

是通知所有订阅者（为了方便分析，这里把被通知者叫做订阅者），来处理event事件。

现在逐一分析他们,

addDeviceLocked ----- createDeviceLocked ----- device->addMapper(new SingleTouchInputMapper(device));(这里以 SingleTouchInputMapper来举例说明)

这里就添加了一个SingleTouchInputMapper的订阅者。

processEventsForDeviceLocked ----- device->process 

void InputDevice::process(const RawEvent* rawEvents, size_t count) { size_t numMappers = mMappers.size();    for (const RawEvent* rawEvent = rawEvents; count--; rawEvent++) {        if (mDropUntilNextSync) {            if (rawEvent->type == EV_SYN && rawEvent->code == SYN_REPORT) {                mDropUntilNextSync = false;            } else {....            }        } else if (rawEvent->type == EV_SYN && rawEvent->code == SYN_DROPPED) {            ALOGI("Detected input event buffer overrun for device %s.", getName().string());            mDropUntilNextSync = true;            reset(rawEvent->when);        } else {<span style="white-space:pre"></span> for (size_t i = 0; i < numMappers; i++) {                InputMapper* mapper = mMappers[i];                mapper->process(rawEvent);            }        }    }}

这里的红色字体就会调用所有的订阅者的process函数，来处理event事件。

void SingleTouchInputMapper::process(const RawEvent* rawEvent) {    TouchInputMapper::process(rawEvent);    mSingleTouchMotionAccumulator.process(rawEvent);}

这里再分析

 TouchInputMapper::process(rawEvent);

void TouchInputMapper::process(const RawEvent* rawEvent) {    mCursorButtonAccumulator.process(rawEvent);    mCursorScrollAccumulator.process(rawEvent);    mTouchButtonAccumulator.process(rawEvent);    if (rawEvent->type == EV_SYN && rawEvent->code == SYN_REPORT) {       sync(rawEvent->when);    }}

sync就会调用dispatchTouches(when, policyFlags);，然后dispatchTouches(when, policyFlags);会调用dispatchMotion，根据前面的分析就知道了，dispatchMotion会注册一个NotifyMotionArgs类型的订阅者。

可以看到这里很多的观察者模式。

下面再来分析InputDispatcher：

bool InputDispatcherThread::threadLoop() {    mDispatcher->dispatchOnce();    return true;}

void InputDispatcher::dispatchOnce() {    nsecs_t nextWakeupTime = LONG_LONG_MAX;    { ....        if (!haveCommandsLocked()) {            dispatchOnceInnerLocked(&nextWakeupTime);        }....    }     // Wait for callback or timeout or wake.  (make sure we round up, not down)    nsecs_t currentTime = now();    int timeoutMillis = toMillisecondTimeoutDelay(currentTime, nextWakeupTime);    mLooper->pollOnce(timeoutMillis);}

void InputDispatcher::dispatchOnceInnerLocked(nsecs_t* nextWakeupTime) {.....mPendingEvent = mInboundQueue.dequeueAtHead();.....case EventEntry::TYPE_MOTION: {......done = dispatchMotionLocked(currentTime, typedEntry,                &dropReason, nextWakeupTime);        break;    }.....}

在前面分析notifyMotion的时候，有把一些motion的坐标信息存在mInboundQueue里面，看如下代码enqueueInboundEventLocked会把MotionEntry保存到mInboundQueue中：

void InputDispatcher::notifyMotion(const NotifyMotionArgs* args) {.....        MotionEntry* newEntry = new MotionEntry(args->eventTime,                args->deviceId, args->source, policyFlags,                args->action, args->flags, args->metaState, args->buttonState,                args->edgeFlags, args->xPrecision, args->yPrecision, args->downTime,                args->displayId,                args->pointerCount, args->pointerProperties, args->pointerCoords);        needWake = enqueueInboundEventLocked(newEntry);.....}

所以在

void InputDispatcher::dispatchOnceInnerLocked(nsecs_t* nextWakeupTime)

中会先取出mInboundQueue中保存的EventEntry。然后调用dispatchMotionLocked ----  dispatchEventLocked ----  prepareDispatchCycleLocked ---- enqueueDispatchEntriesLocked ---- startDispatchCycleLocked

void InputDispatcher::startDispatchCycleLocked(nsecs_t currentTime,        const sp<Connection>& connection) {..... while (connection->status == Connection::STATUS_NORMAL            && !connection->outboundQueue.isEmpty()) {        DispatchEntry* dispatchEntry = connection->outboundQueue.head;        dispatchEntry->deliveryTime = currentTime;        // Publish the event.        status_t status;        EventEntry* eventEntry = dispatchEntry->eventEntry;        switch (eventEntry->type) {....case EventEntry::TYPE_MOTION: {....            status = connection->inputPublisher.publishMotionEvent(dispatchEntry->seq,                    motionEntry->deviceId, motionEntry->source,                    dispatchEntry->resolvedAction, dispatchEntry->resolvedFlags,                    motionEntry->edgeFlags, motionEntry->metaState, motionEntry->buttonState,                    xOffset, yOffset,                    motionEntry->xPrecision, motionEntry->yPrecision,                    motionEntry->downTime, motionEntry->eventTime,                    motionEntry->pointerCount, motionEntry->pointerProperties,                    usingCoords);            break;        }.....    }}

status_t InputPublisher::publishMotionEvent(        uint32_t seq,        int32_t deviceId,        int32_t source,        int32_t action,        int32_t flags,        int32_t edgeFlags,        int32_t metaState,        int32_t buttonState,        float xOffset,        float yOffset,        float xPrecision,        float yPrecision,        nsecs_t downTime,        nsecs_t eventTime,        size_t pointerCount,        const PointerProperties* pointerProperties,        const PointerCoords* pointerCoords) {    .....    InputMessage msg;    msg.header.type = InputMessage::TYPE_MOTION;    msg.body.motion.seq = seq;    msg.body.motion.deviceId = deviceId;    msg.body.motion.source = source;    msg.body.motion.action = action;    msg.body.motion.flags = flags;    msg.body.motion.edgeFlags = edgeFlags;    msg.body.motion.metaState = metaState;    msg.body.motion.buttonState = buttonState;    msg.body.motion.xOffset = xOffset;    msg.body.motion.yOffset = yOffset;    msg.body.motion.xPrecision = xPrecision;    msg.body.motion.yPrecision = yPrecision;    msg.body.motion.downTime = downTime;    msg.body.motion.eventTime = eventTime;    msg.body.motion.pointerCount = pointerCount;    for (size_t i = 0; i < pointerCount; i++) {        msg.body.motion.pointers[i].properties.copyFrom(pointerProperties[i]);        msg.body.motion.pointers[i].coords.copyFrom(pointerCoords[i]);    }    return mChannel->sendMessage(&msg);

最终通过mChannel->sendMessage(&msg);把input事件从InputDispatcher发送出去了，发送给谁了，实际上是发送给NativeInputEventReceiver了。

接着分析dispatchOnce()函数，看该函数最后调用了mLooper->pollOnce(timeoutMillis);，

意思就是当没有event的时候会在这里wait，那么唤醒它的位置自然就是前面分析的mLooper->wake()；

下面分析，InputDispatcher怎么把input事件发送给了应用程序。

InputDispatcher和应用是通过socket，把input事件传递过去的？socket是跨进程通讯了，那他们是那两个进程进行通信的？

答案就是，systemserver进程和acitityThread进程（ui进程）。

先上一张序列图：

android在开启一个应用程序后会调用ViewRootImpl.setView() ----- mWindowSession.addToDisplay()

 mWindowSession.addToDisplay()会通过binder跨进程调用到 mService.addWindow（mService是WindowManagerService），

public int addWindow(Session session, IWindow client, int seq,            WindowManager.LayoutParams attrs, int viewVisibility, int displayId,            Rect outContentInsets, InputChannel outInputChannel) {..... if (outInputChannel != null && (attrs.inputFeatures                    & WindowManager.LayoutParams.INPUT_FEATURE_NO_INPUT_CHANNEL) == 0) {                String name = win.makeInputChannelName();                InputChannel[] inputChannels = InputChannel.openInputChannelPair(name);                win.setInputChannel(inputChannels[0]);                inputChannels[1].transferTo(outInputChannel);                mInputManager.registerInputChannel(win.mInputChannel, win.mInputWindowHandle);            }.....}

在addWindow()中InputChannel.openInputChannelPair(name)会创建一对InputChannel（Nativie层），实际上是创建一对Socket，服务端InputChanel通过mInputManager.registerInputChannel(win.mInputChannel, win.mInputWindowHandle)被WMS注册到InputDispatcher中，客户端InputChannel通过inputChannels[1].transferTo(outInputChannel)被返回给ViewRootImpl，ViewRootImpl将客户端InputChannel作为参数new一个InputEventReceiver对象，在InputEventReceiver()构造函数中继续调用nativeInit()函数来创建一个native层的NativeInputEventReceiver对象，前面创建的客户端InputChannel会保存在该对象中。

见ViewRootImpl.java如下代码：

public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {.....res = mWindowSession.addToDisplay(mWindow, mSeq, mWindowAttributes,                            getHostVisibility(), mDisplay.getDisplayId(),                            mAttachInfo.mContentInsets, mInputChannel);..... if (mInputChannel != null) {                    if (mInputQueueCallback != null) {                        mInputQueue = new InputQueue();                        mInputQueueCallback.onInputQueueCreated(mInputQueue);                    }               mInputEventReceiver = new WindowInputEventReceiver(mInputChannel,                            Looper.myLooper());                }.....                // Set up the input pipeline.                CharSequence counterSuffix = attrs.getTitle();                InputStage syntheticInputStage = new SyntheticInputStage();                InputStage viewPostImeStage = new ViewPostImeInputStage(syntheticInputStage);                InputStage nativePostImeStage = new NativePostImeInputStage(viewPostImeStage,                        "aq:native-post-ime:" + counterSuffix);                InputStage earlyPostImeStage = new EarlyPostImeInputStage(nativePostImeStage);                InputStage imeStage = new ImeInputStage(earlyPostImeStage,                        "aq:ime:" + counterSuffix);                InputStage viewPreImeStage = new ViewPreImeInputStage(imeStage);                InputStage nativePreImeStage = new NativePreImeInputStage(viewPreImeStage,                        "aq:native-pre-ime:" + counterSuffix);                mFirstInputStage = nativePreImeStage;                mFirstPostImeInputStage = earlyPostImeStage;                mPendingInputEventQueueLengthCounterName = "aq:pending:" + counterSuffix;            }        }    }

mInputEventReceiver = new WindowInputEventReceiver(mInputChannel,                            Looper.myLooper());

就会new一个InputEventReceiver对象，在InputEventReceiver()构造函数中继续调用nativeInit()函数来创建一个native层的NativeInputEventReceiver对象。这里面的Looper.myLooper（）实际上是获取activityThread（ui进程）中的looper，从这里也可以看到looper是应用动起来的真因，在AcivityThread中它会监听各个事件并处理，比较input事件，activity的oncreat，onpause包括四大组件等。

为什么loooper是从activityThread这里获取的，因为activity的oncreat是在activityThread进程中执行，在oncreat中，setContentView(R.layout.activity_main);函数会调用ViewRootImpl的setView，所以WindowInputEventReceiver里的looper是从activityThread进程中获取的looper。

如下：

在android_view_InputEventReceiver.cpp中nativeInit

static jint nativeInit(JNIEnv* env, jclass clazz, jobject receiverWeak,        jobject inputChannelObj, jobject messageQueueObj) {.....   sp<NativeInputEventReceiver> receiver = new NativeInputEventReceiver(env,            receiverWeak, inputChannel, messageQueue);    status_t status = receiver->initialize();......}

status_t NativeInputEventReceiver::initialize() {    setFdEvents(ALOOPER_EVENT_INPUT);    return OK;}

void NativeInputEventReceiver::setFdEvents(int events) {    if (mFdEvents != events) {        mFdEvents = events;        int fd = mInputConsumer.getChannel()->getFd();        if (events) {            mMessageQueue->getLooper()->addFd(fd, 0, events, this, NULL);        } else {            mMessageQueue->getLooper()->removeFd(fd);        }    }}

mMessageQueue->getLooper()->addFd(fd, 0, events, this, NULL);将客户端socket句柄添加到Looper的轮询队列中，参数this指向NativeInputEventReceiver本身，意味着只要服务端InputDispatcher发送输入事件，客户端收到这个事件，就调用NativeInputEventReceiver的某个函数，具体调用哪个函数，自然是NativeInputEventReceiver实现了LooperCallback的接口函数handleEvent()。

客户端收到输入事件，即调用NativeInputEventReceiver->handleEvent() ---- consumeEvents() ----- mInputConsumer.consume() ----- mChannel->receiveMessage(&mMsg) 将具体输入事件读取出来，然后调用env->CallVoidMethod(receiverObj.get(), gInputEventReceiverClassInfo.dispatchInputEvent,seq,inputEventObj)，可以知道native层读取输入事件后，然后会回调java层InputEventReceiver.java中的dispatchInputEvent()函数。

事实上，

dispatchInputEvent继续调用onInputEvent(event);此时可能并不调用InputEventReceiver类中的onInputEvent()方法，而是调用子类onInputEvent()方法。在ViewRootImpl中存在WindowInputEventReceiver类型变量mInputEventReceiver，WindowInputEventReceiver类继承InputEventReceiver，并实现onInputEvent()方法。

此可得出结论：native层socket客户端读取输入事件，最终调用InputEventReceiver类子类的onInputEvent()方法，WindowInputEventReceiver继承InputEventReceiver，因此WindowInputEventReceiver.onInputEvent()将被调用。

对于一般的触摸屏事件最终处理者是ViewRootImpl类，对于输入法则处理者是IInputMethodSessionWrapper类，当然WMS是不会处理这些输入事件的。

继续研究ViewRootImpl.onInputEvent()函数，onInputEvent()----doProcessInputEvents()----deliverInputEvent()，deliverInputEvent()函数中会调用stage.deliver(q)，stage是mFirstPostImeInputStage或 mFirstInputStage，这个两个InputStage对象在setView中赋值。InputStage类设计就是责任链模式。因为触摸事件是要分发到具体的View上来，所以对于一般的触摸事件最后是传递到ViewPostImeInputStage类中来处理，处理函数是processPointerEvent(q)，这个函数调用mView.dispatchPointerEvent(event)将事件分发出去，mView具体是什么呢？mView其实就是DecorView，每一个窗口有且仅有一个DecorView，且处在最顶层，由于DecorView未重写dispatchPointerEvent()，所以调用还是父类View类的dispatchPointerEvent()方法，dispatchPointerEvent会调用onTouchEvent。

public boolean onTouchEvent(MotionEvent event) {....switch (event.getAction()) {                case MotionEvent.ACTION_UP:....if (!mHasPerformedLongPress) {                            // This is a tap, so remove the longpress check                            removeLongPressCallback();                            // Only perform take click actions if we were in the pressed state                            if (!focusTaken) {                                // Use a Runnable and post this rather than calling                                // performClick directly. This lets other visual state                                // of the view update before click actions start.                                if (mPerformClick == null) {                                    mPerformClick = new PerformClick();                                }                                if (!post(mPerformClick)) {                                    performClick();                                }                            }                        }.....  }                    break;.....          }            return true;        }        return false;    }

 public boolean performClick() {        sendAccessibilityEvent(AccessibilityEvent.TYPE_VIEW_CLICKED);        ListenerInfo li = mListenerInfo;        if (li != null && li.mOnClickListener != null) {            playSoundEffect(SoundEffectConstants.CLICK);            li.mOnClickListener.onClick(this);            return true;        }        return false;    }

最后就会调用具体控件的onClick事件。

最后，这些input事件消息（当然还有其它的message）等，把ActivityThread的looper唤醒，然后进行进一步的处理，才使得apk应用程序真正的动起来了。