主要分析下列 2 个流程：
// dump activity 的一些信息
adb shell dumpsys activity > D:\dumpsys\activity2.txt
// a11 打开 ActivityManagerDebugConfig 的开关
adb shell cmd activity log_switch enable DEBUG_ALL
1. 分析 adb shell dumpsys 实现过程
还可以使用下列命令dump 具体的组件
adb shell dumpsys activity -a a // -a 是dump全部，a 是 activities
/frameworks/native/cmds/dumpsys/main.cpp
int main(int argc, char* const argv[]) {signal(SIGPIPE, SIG_IGN);sp<IServiceManager> sm = defaultServiceManager();fflush(stdout);if (sm == nullptr) {ALOGE("Unable to get default service manager!");std::cerr << "dumpsys: Unable to get default service manager!" << std::endl;return 20;}Dumpsys dumpsys(sm.get());// 执行 dumpsys 的 main 方法return dumpsys.main(argc, argv);
}// 执行 dumpsys 的 main 方法
/frameworks/native/cmds/dumpsys/dumpsys.cpp
int Dumpsys::main(int argc, char* const argv[]) {Vector<String16> services;Vector<String16> args;String16 priorityType;Vector<String16> skippedServices;Vector<String16> protoServices;Type type = Type::DUMP;
。。。optind = 1;
。。。for (int i = optind; i < argc; i++) {if (skipServices) {skippedServices.add(String16(argv[i]));} else {// 将输入的servicename 保存到 services 中，如adb shell dumpsys activity -a a
// 则将 activity 保存到 services 中if (i == optind) {services.add(String16(argv[i]));} else {const String16 arg(argv[i]);
// args 保存其他参数 -a aargs.add(arg);const size_t N = services.size();
。。。。for (size_t i = 0; i < N; i++) {const String16& serviceName = services[i];if (IsSkipped(skippedServices, serviceName)) continue;// 调用startDumpThread 方法 type 类型为 DUMPif (startDumpThread(type, serviceName, args) == OK) {bool addSeparator = (N > 1);if (addSeparator) {writeDumpHeader(STDOUT_FILENO, serviceName, priorityFlags);}std::chrono::duration<double> elapsedDuration;size_t bytesWritten = 0;
// 输出结果status_t status =writeDump(STDOUT_FILENO, serviceName, std::chrono::milliseconds(timeoutArgMs),asProto, elapsedDuration, bytesWritten);==========
// 调用startDumpThread 方法 type 类型为 DUMPstatus_t Dumpsys::startDumpThread(Type type, const String16& serviceName,const Vector<String16>& args) {// 找到对应服务的客户端sp<IBinder> service = sm_->checkService(serviceName);if (service == nullptr) {std::cerr << "Can't find service: " << serviceName << std::endl;return NAME_NOT_FOUND;}int sfd[2];
// 管道通信if (pipe(sfd) != 0) {std::cerr << "Failed to create pipe to dump service info for " << serviceName << ": "<< strerror(errno) << std::endl;return -errno;}redirectFd_ = unique_fd(sfd[0]);unique_fd remote_end(sfd[1]);sfd[0] = sfd[1] = -1;// dump blocks until completion, so spawn a thread..activeThread_ = std::thread([=, remote_end{std::move(remote_end)}]() mutable {status_t err = 0;switch (type) {case Type::DUMP:
// binder 通信调用dump 方法err = service->dump(remote_end.get(), args);break;// binder 通信调用dump 方法
/frameworks/native/libs/binder/BpBinder.cpp
status_t BpBinder::dump(int fd, const Vector<String16>& args)
{Parcel send;Parcel reply;
// send 封装了文件描述符send.writeFileDescriptor(fd);const size_t numArgs = args.size();send.writeInt32(numArgs);for (size_t i = 0; i < numArgs; i++) {
// 保存了 args 参数send.writeString16(args[i]);}status_t err = transact(DUMP_TRANSACTION, send, &reply);return err;
}=========
status_t BpBinder::transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{// Once a binder has died, it will never come back to life.if (mAlive) {bool privateVendor = flags & FLAG_PRIVATE_VENDOR;// don't send userspace flags to the kernelflags = flags & ~FLAG_PRIVATE_VENDOR;// user transactions require a given stability levelif (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {using android::internal::Stability;auto stability = Stability::get(this);auto required = privateVendor ? Stability::VENDOR : Stability::kLocalStability;if (CC_UNLIKELY(!Stability::check(stability, required))) {ALOGE("Cannot do a user transaction on a %s binder in a %s context.",Stability::stabilityString(stability).c_str(),Stability::stabilityString(required).c_str());return BAD_TYPE;}}
/// 通过binder 驱动去找到对端服务器端status_t status = IPCThreadState::self()->transact(mHandle, code, data, reply, flags);===========服务端执行流程===========
走到服务器端的 BBinder
/frameworks/base/core/jni/android_util_Binder.cpp
// javabinder 继承了 BBinder
class JavaBBinder : public BBinder
{
public:JavaBBinder(JNIEnv* env, jobject /* Java Binder */ object): mVM(jnienv_to_javavm(env)), mObject(env->NewGlobalRef(object)){。。。status_t onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0) override{JNIEnv* env = javavm_to_jnienv(mVM);ALOGV("onTransact() on %p calling object %p in env %p vm %p\n", this, mObject, env, mVM);IPCThreadState* thread_state = IPCThreadState::self();const int32_t strict_policy_before = thread_state->getStrictModePolicy();//printf("Transact from %p to Java code sending: ", this);//data.print();//printf("\n");// 调用java 层的execTransact 方法jboolean res = env->CallBooleanMethod(mObject, gBinderOffsets.mExecTransact,code, reinterpret_cast<jlong>(&data), reinterpret_cast<jlong>(reply), flags);// mExecTransact 为java 层的 execTransact 方法gBinderOffsets.mExecTransact = GetMethodIDOrDie(env, clazz, "execTransact", "(IJJI)Z");// 调用java 层的execTransact 方法
/frameworks/base/core/java/android/os/Binder.java
@UnsupportedAppUsageprivate boolean execTransact(int code, long dataObj, long replyObj,int flags) {// At that point, the parcel request headers haven't been parsed so we do not know what// WorkSource the caller has set. Use calling uid as the default.final int callingUid = Binder.getCallingUid();final long origWorkSource = ThreadLocalWorkSource.setUid(callingUid);try {return execTransactInternal(code, dataObj, replyObj, flags, callingUid);===========private boolean execTransactInternal(int code, long dataObj, long replyObj, int flags,int callingUid) {final BinderInternal.Observer observer = sObserver;final CallSession callSession =observer != null ? observer.callStarted(this, code, UNSET_WORKSOURCE) : null;Parcel data = Parcel.obtain(dataObj);Parcel reply = Parcel.obtain(replyObj);boolean res;// Log any exceptions as warnings, don't silently suppress them.// If the call was FLAG_ONEWAY then these exceptions disappear into the ether.final boolean tracingEnabled = Binder.isTracingEnabled();try {if ((flags & FLAG_COLLECT_NOTED_APP_OPS) != 0) {AppOpsManager.startNotedAppOpsCollection(callingUid);try {res = onTransact(code, data, reply, flags);} finally {AppOpsManager.finishNotedAppOpsCollection();}} else {
// 调用 onTransact 方法res = onTransact(code, data, reply, flags);}=============protected boolean onTransact(int code, @NonNull Parcel data, @Nullable Parcel reply,int flags) throws RemoteException {// 如果是dump 命令，则执行 dump 方法} else if (code == DUMP_TRANSACTION) {ParcelFileDescriptor fd = data.readFileDescriptor();String[] args = data.readStringArray();if (fd != null) {try {dump(fd.getFileDescriptor(), args);// 如果是 adb shell cmd，则调用 shellCommand 方法} else if (code == SHELL_COMMAND_TRANSACTION) {ParcelFileDescriptor in = data.readFileDescriptor();ParcelFileDescriptor out = data.readFileDescriptor();ParcelFileDescriptor err = data.readFileDescriptor();String[] args = data.readStringArray();ShellCallback shellCallback = ShellCallback.CREATOR.createFromParcel(data);ResultReceiver resultReceiver = ResultReceiver.CREATOR.createFromParcel(data);try {if (out != null) {shellCommand(in != null ? in.getFileDescriptor() : null,out.getFileDescriptor(),err != null ? err.getFileDescriptor() : out.getFileDescriptor(),args, shellCallback, resultReceiver);}=========public void dump(@NonNull FileDescriptor fd, @Nullable String[] args) {FileOutputStream fout = new FileOutputStream(fd);PrintWriter pw = new FastPrintWriter(fout);try {doDump(fd, pw, args);=========void doDump(FileDescriptor fd, PrintWriter pw, String[] args) {final String disabled = sDumpDisabled;if (disabled == null) {try {dump(fd, pw, args);由 aidl 自动生成的 IActivityManager.Stub 是继承于Binder 对象的
public IActivityManager IRemoteService extends android.os.IInterface {public static abstract class Stub extends android.os.Binder implements xxx而 ActivityManagerService 是继承了 IActivityManager.Stub，所以走到其 dump(fd, pw, args) 方法
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
10510 @Override
10511 protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
// 传入参数是 mPriorityDumper
10512 PriorityDump.dump(mPriorityDumper, fd, pw, args);
10513 }=============调用 PriorityDump 工具类的dump 方法
/frameworks/base/services/core/java/com/android/server/utils/PriorityDump.java
public static void dump(PriorityDumper dumper, FileDescriptor fd, PrintWriter pw,String[] args) {boolean asProto = false;@PriorityType int priority = PRIORITY_TYPE_INVALID;
...String[] strippedArgs = new String[args.length];int strippedCount = 0;for (int argIndex = 0; argIndex < args.length; argIndex++) {if (args[argIndex].equals(PROTO_ARG)) {asProto = true;} else if (args[argIndex].equals(PRIORITY_ARG)) {if (argIndex + 1 < args.length) {argIndex++;priority = getPriorityType(args[argIndex]);}} else {
// 分离出命令args 来strippedArgs[strippedCount++] = args[argIndex];}}if (strippedCount < args.length) {strippedArgs = Arrays.copyOf(strippedArgs, strippedCount);}switch (priority) {
...default: {
// 调用 PriorityDumper 去dumpdumper.dump(fd, pw, strippedArgs, asProto);return;}}// 调用 PriorityDumper 去dump
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
674 private final PriorityDump.PriorityDumper mPriorityDumper = new PriorityDump.PriorityDumper() {
675 @Override
676 public void dumpCritical(FileDescriptor fd, PrintWriter pw, String[] args,
677 boolean asProto) {
678 if (asProto) return;
679 doDump(fd, pw, new String[]{"activities"}, asProto);
680 doDump(fd, pw, new String[]{"service", "all-platform-critical"}, asProto);
681 }。。。。。
687
688 @Override
689 public void dump(FileDescriptor fd, PrintWriter pw, String[] args, boolean asProto) {// dump 方法
690 doDump(fd, pw, args, asProto);
691 }
692 };========
// dump 方法
10666 private void doDump(FileDescriptor fd, PrintWriter pw, String[] args, boolean useProto) {
10667 if (!DumpUtils.checkDumpAndUsageStatsPermission(mContext, TAG, pw)) return;
10668
10669 boolean dumpAll = false;
10670 boolean dumpClient = false;
10671 boolean dumpCheckin = false;
10672 boolean dumpCheckinFormat = false;
10673 boolean dumpNormalPriority = false;
10674 boolean dumpVisibleStacksOnly = false;
10675 boolean dumpFocusedStackOnly = false;
10676 String dumpPackage = null;
10677
10678 int opti = 0;
10679 while (opti < args.length) {
10680 String opt = args[opti];
10681 if (opt == null || opt.length() <= 0 || opt.charAt(0) != '-') {
10682 break;
10683 }
10684 opti++;// 先判断输入命令是否有 -a ，如果有则dump全部信息
10685 if ("-a".equals(opt)) {
10686 dumpAll = true;。。。// useProto 为false
10718 if (useProto) {
10719 final ProtoOutputStream proto = new ProtoOutputStream(fd);
10720 String cmd = opti < args.length ? args[opti] : "";
10721 opti++;
。。。
10786 int dumpAppId = getAppId(dumpPackage);
10787 boolean more = false;
10788 // Is the caller requesting to dump a particular piece of data?
10789 if (opti < args.length) {
10790 String cmd = args[opti];
10791 opti++;// DUMP_ACTIVITIES_CMD 为 activities，DUMP_ACTIVITIES_SHORT_CMD 为a
10792 if (DUMP_ACTIVITIES_CMD.equals(cmd) || DUMP_ACTIVITIES_SHORT_CMD.equals(cmd)
10793 || DUMP_LASTANR_CMD.equals(cmd) || DUMP_LASTANR_TRACES_CMD.equals(cmd)
10794 || DUMP_STARTER_CMD.equals(cmd) || DUMP_CONTAINERS_CMD.equals(cmd)
10795 || DUMP_RECENTS_CMD.equals(cmd) || DUMP_RECENTS_SHORT_CMD.equals(cmd)) {
10796 mAtmInternal.dump(
10797 cmd, fd, pw, args, opti, true /* dumpAll */, dumpClient, dumpPackage);调用 ActivityTaskManagerService 的方法
6979 @Override
6980 public void dump(String cmd, FileDescriptor fd, PrintWriter pw, String[] args, int opti,
6981 boolean dumpAll, boolean dumpClient, String dumpPackage) {
6982 synchronized (mGlobalLock) {
6983 if (DUMP_ACTIVITIES_CMD.equals(cmd) || DUMP_ACTIVITIES_SHORT_CMD.equals(cmd)) {
6984 dumpActivitiesLocked(fd, pw, args, opti, dumpAll, dumpClient, dumpPackage);2. 分析 adb shell cmd 实现过程
adb shell cmd activity -h
/frameworks/native/cmds/cmd/main.cpp
int main(int argc, char* const argv[]) {signal(SIGPIPE, SIG_IGN);std::vector<std::string_view> arguments;arguments.reserve(argc - 1);// 0th argument is a program name, skipping.for (int i = 1; i < argc; ++i) {arguments.emplace_back(argv[i]);}// 调用 cmdMain 方法return cmdMain(arguments, android::aout, android::aerr, STDIN_FILENO, STDOUT_FILENO,STDERR_FILENO, RunMode::kStandalone);// 调用 cmdMain 方法
/frameworks/native/cmds/cmd/cmd.cpp
int cmdMain(const std::vector<std::string_view>& argv, TextOutput& outputLog, TextOutput& errorLog,int in, int out, int err, RunMode runMode) {sp<ProcessState> proc = ProcessState::self();proc->startThreadPool();#if DEBUGALOGD("cmd: starting");
#endifsp<IServiceManager> sm = defaultServiceManager();int argc = argv.size();// 如果命令是：adb shell cmd -l 则列出所有的service 的名字if ((argc == 1) && (argv[0] == "-l")) {Vector<String16> services = sm->listServices();services.sort(sort_func);
// 会打印出下列string 值outputLog << "Currently running services:" << endl;for (size_t i=0; i<services.size(); i++) {sp<IBinder> service = sm->checkService(services[i]);if (service != nullptr) {outputLog << " " << services[i] << endl;}}return 0;}// 这里是 false 的bool waitForService = ((argc > 1) && (argv[0] == "-w"));
// index 的值为 0int serviceIdx = (waitForService) ? 1 : 0;
// cmd 为第一个参数为 servicenameconst auto cmd = argv[serviceIdx];Vector<String16> args;
// 通过cmd 获取到 servicenameString16 serviceName = String16(cmd.data(), cmd.size());// 遍历service 后面的参数，保存到 args 中for (int i = serviceIdx + 1; i < argc; i++) {args.add(String16(argv[i].data(), argv[i].size()));}sp<IBinder> service;if(waitForService) {service = sm->waitForService(serviceName);} else {// 获取到对应的serviceservice = sm->checkService(serviceName);}。。。// TODO: block until a result is returned to MyResultReceiver.
// 调用 shellCommand 方法status_t error = IBinder::shellCommand(service, in, out, err, args, cb, result);if (error < 0) {// 调用 shellCommand 方法
/frameworks/native/libs/binder/Binder.cpp
status_t IBinder::shellCommand(const sp<IBinder>& target, int in, int out, int err,Vector<String16>& args, const sp<IShellCallback>& callback,const sp<IResultReceiver>& resultReceiver)
{Parcel send;Parcel reply;
// 将传入的参数封装为 Parcel send.writeFileDescriptor(in);send.writeFileDescriptor(out);send.writeFileDescriptor(err);const size_t numArgs = args.size();send.writeInt32(numArgs);for (size_t i = 0; i < numArgs; i++) {send.writeString16(args[i]);}send.writeStrongBinder(callback != nullptr ? IInterface::asBinder(callback) : nullptr);send.writeStrongBinder(resultReceiver != nullptr ? IInterface::asBinder(resultReceiver) : nullptr);// 调用对应的service 的客户端去binder 通信return target->transact(SHELL_COMMAND_TRANSACTION, send, &reply);
}如前面的分析也会调用 java 层的execTransact 方法
/frameworks/base/core/java/android/os/Binder.java
private boolean execTransactInternal(int code, long dataObj, long replyObj, int flags,int callingUid) {final BinderInternal.Observer observer = sObserver;final CallSession callSession =observer != null ? observer.callStarted(this, code, UNSET_WORKSOURCE) : null;Parcel data = Parcel.obtain(dataObj);Parcel reply = Parcel.obtain(replyObj);boolean res;// Log any exceptions as warnings, don't silently suppress them.// If the call was FLAG_ONEWAY then these exceptions disappear into the ether.final boolean tracingEnabled = Binder.isTracingEnabled();try {if ((flags & FLAG_COLLECT_NOTED_APP_OPS) != 0) {AppOpsManager.startNotedAppOpsCollection(callingUid);try {res = onTransact(code, data, reply, flags);} finally {AppOpsManager.finishNotedAppOpsCollection();}} else {
// 调用 onTransact 方法res = onTransact(code, data, reply, flags);}=============protected boolean onTransact(int code, @NonNull Parcel data, @Nullable Parcel reply,int flags) throws RemoteException {// 如果是dump 命令，则执行 dump 方法} else if (code == DUMP_TRANSACTION) {ParcelFileDescriptor fd = data.readFileDescriptor();String[] args = data.readStringArray();if (fd != null) {try {dump(fd.getFileDescriptor(), args);// 如果是 adb shell cmd，则调用 shellCommand 方法} else if (code == SHELL_COMMAND_TRANSACTION) {ParcelFileDescriptor in = data.readFileDescriptor();ParcelFileDescriptor out = data.readFileDescriptor();ParcelFileDescriptor err = data.readFileDescriptor();String[] args = data.readStringArray();ShellCallback shellCallback = ShellCallback.CREATOR.createFromParcel(data);ResultReceiver resultReceiver = ResultReceiver.CREATOR.createFromParcel(data);try {if (out != null) {shellCommand(in != null ? in.getFileDescriptor() : null,out.getFileDescriptor(),err != null ? err.getFileDescriptor() : out.getFileDescriptor(),args, shellCallback, resultReceiver);}================
// shellCommand 方法的实现public void shellCommand(@Nullable FileDescriptor in, @Nullable FileDescriptor out,@Nullable FileDescriptor err,@NonNull String[] args, @Nullable ShellCallback callback,@NonNull ResultReceiver resultReceiver) throws RemoteException {// 同样去调用 ams 的 onShellCommand 方法onShellCommand(in, out, err, args, callback, resultReceiver);}
// 同样去调用 ams 的 onShellCommand 方法
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
10502 @Override
10503 public void onShellCommand(FileDescriptor in, FileDescriptor out,
10504 FileDescriptor err, String[] args, ShellCallback callback,
10505 ResultReceiver resultReceiver) {// 创建 ActivityManagerShellCommand 对象去执行 exec
10506 (new ActivityManagerShellCommand(this, false)).exec(
10507 this, in, out, err, args, callback, resultReceiver);
10508 }// 创建 ActivityManagerShellCommand 对象去执行 exec
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerShellCommand.java
// 继承了 ShellCommand 方法
124 final class ActivityManagerShellCommand extends ShellCommand {
125 public static final String NO_CLASS_ERROR_CODE = "Error type 3";/frameworks/base/core/java/android/os/ShellCommand.java
// ShellCommand 又继承了 BasicShellCommandHandler
36 public abstract class ShellCommand extends BasicShellCommandHandler {
37 private ShellCallback mShellCallback;
38 private ResultReceiver mResultReceiver;
39 // 执行 exec 方法
40 public int exec(Binder target, FileDescriptor in, FileDescriptor out, FileDescriptor err,
41 String[] args, ShellCallback callback, ResultReceiver resultReceiver) {
42 mShellCallback = callback;
43 mResultReceiver = resultReceiver;// 调用父类BasicShellCommandHandler 的 exec 方法
44 final int result = super.exec(target, in, out, err, args);
45 // 发送结果给cmd 进程
46 if (mResultReceiver != null) {
47 mResultReceiver.send(result, null);
48 }
49
50 return result;
51 }// 调用父类BasicShellCommandHandler 的 exec 方法
/frameworks/base/core/java/android/os/BasicShellCommandHandler.java
75 public int exec(Binder target, FileDescriptor in, FileDescriptor out, FileDescriptor err,
76 String[] args) {
77 String cmd;
78 int start;
79 if (args != null && args.length > 0) {// 获取adb shell cmd activity 后面的第一个参数
80 cmd = args[0];
81 start = 1;
82 } else {
83 cmd = null;
84 start = 0;
85 }
86 init(target, in, out, err, args, start);
87 mCmd = cmd;
88
89 if (DEBUG) {
90 RuntimeException here = new RuntimeException("here");
91 here.fillInStackTrace();
92 Log.d(TAG, "Starting command " + mCmd + " on " + mTarget, here);
93 Log.d(TAG, "Calling uid=" + Binder.getCallingUid()
94 + " pid=" + Binder.getCallingPid());
95 }
96 int res = -1;
97 try {// 回调子类ActivityManagerShellCommand.java的方法 onCommand
98 res = onCommand(mCmd);
99 if (DEBUG) Log.d(TAG, "Executed command " + mCmd + " on " + mTarget);// 回调子类ActivityManagerShellCommand.java的方法 onCommand
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerShellCommand.java
@Overridepublic int onCommand(String cmd) {if (cmd == null) {return handleDefaultCommands(cmd);}final PrintWriter pw = getOutPrintWriter();try {switch (cmd) {// 启动activity 命令case "start":case "start-activity":return runStartActivity(pw);// 启动service 的命令case "startservice":case "start-service":return runStartService(pw, false);//如果都不满足上述情形，则执行 default:return handleDefaultCommands(cmd);}/frameworks/base/core/java/android/os/BasicShellCommandHandler.java
// 调用到 父类的方法
289 public int handleDefaultCommands(String cmd) {
290 if (cmd == null || "help".equals(cmd) || "-h".equals(cmd)) {
291 onHelp();又调用到子类的方法
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerShellCommand.java
@Overridepublic void onHelp() {PrintWriter pw = getOutPrintWriter();
// mDumping 为falsedumpHelp(pw, mDumping);}============static void dumpHelp(PrintWriter pw, boolean dumping) {if (dumping) {
。。。。。} else {pw.println("Activity manager (activity) commands:");pw.println(" help");pw.println(" Print this help text.");pw.println(" start-activity [-D] [-N] [-W] [-P <FILE>] [--start-profiler <FILE>]");总结：
adb shell cmd 命令：
1. 对应命令会调用到service 的 onCommand
2. 帮助命令会调用到 onHelp
adb shell dumpsys 命令：
对应命令调用到 service 的 dump方法
自动续期)
