InputManagerService分析一：IMS的啓動與事件傳遞

從這一節裏面，我們開始介紹InputManagerService部分的知識。它用於管理整個系統的輸入部分，包括鍵盤、鼠標、觸摸屏等等。這一章裏面我們主要就要介紹IMS。首先從IMS的啓動來分析：

HandlerThread wmHandlerThread = new HandlerThread("WindowManager");
wmHandlerThread.start();
Handler wmHandler = new Handler(wmHandlerThread.getLooper());

    inputManager = new InputManagerService(context, wmHandler);
    wm = WindowManagerService.main(context, power, display, inputManager,
            wmHandler, factoryTest != SystemServer.FACTORY_TEST_LOW_LEVEL,
            !firstBoot, onlyCore);
    ServiceManager.addService(Context.WINDOW_SERVICE, wm);
    ServiceManager.addService(Context.INPUT_SERVICE, inputManager);

    inputManager.setWindowManagerCallbacks(wm.getInputMonitor());
    inputManager.start();

因爲 在Android系統中，按鍵事件是由InputManager來收集並由WindowManagerService服務來分發給各個Activity處理的，所以在介紹WMS的啓動時，我們也一起來介紹一下InputManager的啓動，首先來看InputManagerService的構造函數：

InputManagerService的啓動

public InputManagerService(Context context, Handler handler) {
    this.mContext = context;
    this.mHandler = new InputManagerHandler(handler.getLooper());

    mUseDevInputEventForAudioJack =
            context.getResources().getBoolean(R.bool.config_useDevInputEventForAudioJack);
    mPtr = nativeInit(this, mContext, mHandler.getLooper().getQueue());
}

這裏首先構造InputManagerHandler用於處理消息，當然這個handle是綁定在"WindowManager"這個looper上的。然後調用nativeInit去完成初natvie層的初始化：

static jint nativeInit(JNIEnv* env, jclass clazz,
        jobject serviceObj, jobject contextObj, jobject messageQueueObj) {
    sp<MessageQueue> messageQueue = android_os_MessageQueue_getMessageQueue(env, messageQueueObj);

    NativeInputManager* im = new NativeInputManager(contextObj, serviceObj,
            messageQueue->getLooper());
    im->incStrong(0);
    return reinterpret_cast<jint>(im);
}

android_os_MessageQueue_getMessageQueue這個函數我們在介紹Looper的時候已經分析過，因爲Java層的MessageQueue總是對應native層的NativeMessageQueue對象，所以首先先取得native層的messageQueue，並構造NativeInputManager對象：

NativeInputManager::NativeInputManager(jobject contextObj,
        jobject serviceObj, const sp<Looper>& looper) :
        mLooper(looper) {
    JNIEnv* env = jniEnv();

    mContextObj = env->NewGlobalRef(contextObj);
    mServiceObj = env->NewGlobalRef(serviceObj);

    {
        AutoMutex _l(mLock);
        mLocked.systemUiVisibility = ASYSTEM_UI_VISIBILITY_STATUS_BAR_VISIBLE;
        mLocked.pointerSpeed = 0;
        mLocked.pointerGesturesEnabled = true;
        mLocked.showTouches = false;
    }

    sp<EventHub> eventHub = new EventHub();
    mInputManager = new InputManager(eventHub, this, this);
}

上面的InputManagerService的NativeInputManager的類圖關係如下：

在NativeInputManager的構造函數中，首先對mLocked中的一些變量賦初值。然後構造EventHub對象，並通過它最終構造InputManager對象。首先來看EventHub的構造函數：

EventHub::EventHub(void) :
        mBuiltInKeyboardId(NO_BUILT_IN_KEYBOARD), mNextDeviceId(1), mControllerNumbers(),
        mOpeningDevices(0), mClosingDevices(0),
        mNeedToSendFinishedDeviceScan(false),
        mNeedToReopenDevices(false), mNeedToScanDevices(true),
        mPendingEventCount(0), mPendingEventIndex(0), mPendingINotify(false) {
    acquire_wake_lock(PARTIAL_WAKE_LOCK, WAKE_LOCK_ID);

    mEpollFd = epoll_create(EPOLL_SIZE_HINT);
    LOG_ALWAYS_FATAL_IF(mEpollFd < 0, "Could not create epoll instance.  errno=%d", errno);

    mINotifyFd = inotify_init();
    int result = inotify_add_watch(mINotifyFd, DEVICE_PATH, IN_DELETE | IN_CREATE);
    LOG_ALWAYS_FATAL_IF(result < 0, "Could not register INotify for %s.  errno=%d",
            DEVICE_PATH, errno);

    struct epoll_event eventItem;
    memset(&eventItem, 0, sizeof(eventItem));
    eventItem.events = EPOLLIN;
    eventItem.data.u32 = EPOLL_ID_INOTIFY;
    result = epoll_ctl(mEpollFd, EPOLL_CTL_ADD, mINotifyFd, &eventItem);
    LOG_ALWAYS_FATAL_IF(result != 0, "Could not add INotify to epoll instance.  errno=%d", errno);

    int wakeFds[2];
    result = pipe(wakeFds);
    LOG_ALWAYS_FATAL_IF(result != 0, "Could not create wake pipe.  errno=%d", errno);

    mWakeReadPipeFd = wakeFds[0];
    mWakeWritePipeFd = wakeFds[1];

    result = fcntl(mWakeReadPipeFd, F_SETFL, O_NONBLOCK);
    LOG_ALWAYS_FATAL_IF(result != 0, "Could not make wake read pipe non-blocking.  errno=%d",
            errno);

    result = fcntl(mWakeWritePipeFd, F_SETFL, O_NONBLOCK);
    LOG_ALWAYS_FATAL_IF(result != 0, "Could not make wake write pipe non-blocking.  errno=%d",
            errno);

    eventItem.data.u32 = EPOLL_ID_WAKE;
    result = epoll_ctl(mEpollFd, EPOLL_CTL_ADD, mWakeReadPipeFd, &eventItem);
    LOG_ALWAYS_FATAL_IF(result != 0, "Could not add wake read pipe to epoll instance.  errno=%d",
            errno);
}

首先是對一些成員變量做初始化，這些變量等到我們用到時再來一一介紹。然後調用inotify機制對/dev/input文件目錄下的增和刪操作做監聽，/dev/input目錄就是所有的input設備文件。並調用epoll機制EPOLL_CTL_ADD命令對上面的inotify的句柄和mWakeReadPipeFd句柄加入到epoll的句柄mEpollFd中。我們可以看到當有/dev/input下面的增刪操作或者在mWakeWritePipeFd中寫數據時，epoll_wait將會返回。再來看InputManager的構造函數：

InputManager::InputManager(
        const sp<EventHubInterface>& eventHub,
        const sp<InputReaderPolicyInterface>& readerPolicy,
        const sp<InputDispatcherPolicyInterface>& dispatcherPolicy) {
    mDispatcher = new InputDispatcher(dispatcherPolicy);
    mReader = new InputReader(eventHub, readerPolicy, mDispatcher);
    initialize();
}

void InputManager::initialize() {
    mReaderThread = new InputReaderThread(mReader);
    mDispatcherThread = new InputDispatcherThread(mDispatcher);
}

這InputManager的構造函數中首先構造InputDispatcher和InputReader兩個對象，然後在initialize構造InputReaderThread和InputDispatcherThread分別用於收按鍵輸入和分發按鍵消息。InputDispatcher是分發消息的對象，InputReader是從驅動獲取按鍵消息，首先來看一下它們的構造函數：

InputDispatcher::InputDispatcher(const sp<InputDispatcherPolicyInterface>& policy) :
    mPolicy(policy),
    mPendingEvent(NULL), mAppSwitchSawKeyDown(false), mAppSwitchDueTime(LONG_LONG_MAX),
    mNextUnblockedEvent(NULL),
    mDispatchEnabled(false), mDispatchFrozen(false), mInputFilterEnabled(false),
    mInputTargetWaitCause(INPUT_TARGET_WAIT_CAUSE_NONE) {
    mLooper = new Looper(false);

    mKeyRepeatState.lastKeyEntry = NULL;

    policy->getDispatcherConfiguration(&mConfig);
}

InputDispatcher的構造函數中首先初始化一些成員變量，然後構造一個Native層的Looper，並通過IMS獲取VirtualKeyQuietime和ExcludedDevice系統配置保存到InputDispatcherConfiguration選項。接着來看InputReader的構造函數：

InputReader::InputReader(const sp<EventHubInterface>& eventHub,
        const sp<InputReaderPolicyInterface>& policy,
        const sp<InputListenerInterface>& listener) :
        mContext(this), mEventHub(eventHub), mPolicy(policy),
        mGlobalMetaState(0), mGeneration(1),
        mDisableVirtualKeysTimeout(LLONG_MIN), mNextTimeout(LLONG_MAX),
        mConfigurationChangesToRefresh(0) {
    mQueuedListener = new QueuedInputListener(listener);

    { // acquire lock
        AutoMutex _l(mLock);

        refreshConfigurationLocked(0);
        updateGlobalMetaStateLocked();
    } // release lock
}

這裏首先由傳入的InputDispatcher構造一個QueuedInputListener並保存在mQueuedListener中。回到InputManager的構造函數中，接着調用initialize構造分別構造InputReaderThread和InputDispatcherThread兩個thread。

InputReader和InputDispatcher兩個類都比較龐大，我們先來看一下它們的類圖：

再來看一下上面IMS構造過程的流程圖：

到這裏InputManagerService的構造函數就介紹完了，回到SystemService中接着調用WMS的main方法，並把前面創建的InputManagerService作爲參數傳入：

private WindowManagerService(Context context, PowerManagerService pm,
        DisplayManagerService displayManager, InputManagerService inputManager,
        boolean haveInputMethods, boolean showBootMsgs, boolean onlyCore) {

    ......

    mInputManager = inputManager; // Must be before createDisplayContentLocked.

    mPointerEventDispatcher = new PointerEventDispatcher(mInputManager.monitorInput(TAG));

    .....
}

在WMS的構造函數中，首先在mInputManager中保存InputManagerService對象，然後構造PointerEventDispatcher對用於分析點擊事件。首先來看InputManagerService的monitorInput方法：

public InputChannel monitorInput(String inputChannelName) {
    InputChannel[] inputChannels = InputChannel.openInputChannelPair(inputChannelName);
    nativeRegisterInputChannel(mPtr, inputChannels[0], null, true);
    inputChannels[0].dispose(); // don't need to retain the Java object reference
    return inputChannels[1];
}

先來看一下InputChannel的類圖結構：

InputChannel用於從InputDispatcher中後去所有的input消息，所以這裏構造一對InputChannel，一個註冊到底層的InputDispatcher中，一個用於PointerEventDispatcher給activity分發消息。先來看InputChannel的openInputChannelPair函數：

    public static InputChannel[] openInputChannelPair(String name) {
        return nativeOpenInputChannelPair(name);
    }

static jobjectArray android_view_InputChannel_nativeOpenInputChannelPair(JNIEnv* env,
        jclass clazz, jstring nameObj) {
    const char* nameChars = env->GetStringUTFChars(nameObj, NULL);
    String8 name(nameChars);
    env->ReleaseStringUTFChars(nameObj, nameChars);

    sp<InputChannel> serverChannel;
    sp<InputChannel> clientChannel;
    status_t result = InputChannel::openInputChannelPair(name, serverChannel, clientChannel);

    if (result) {
        String8 message;
        message.appendFormat("Could not open input channel pair.  status=%d", result);
        jniThrowRuntimeException(env, message.string());
        return NULL;
    }

    jobjectArray channelPair = env->NewObjectArray(2, gInputChannelClassInfo.clazz, NULL);
    if (env->ExceptionCheck()) {
        return NULL;
    }

    jobject serverChannelObj = android_view_InputChannel_createInputChannel(env,
            new NativeInputChannel(serverChannel));
    if (env->ExceptionCheck()) {
        return NULL;
    }

    jobject clientChannelObj = android_view_InputChannel_createInputChannel(env,
            new NativeInputChannel(clientChannel));
    if (env->ExceptionCheck()) {
        return NULL;
    }

    env->SetObjectArrayElement(channelPair, 0, serverChannelObj);
    env->SetObjectArrayElement(channelPair, 1, clientChannelObj);
    return channelPair;
}

android_view_InputChannel_nativeOpenInputChannelPair函數首先調用Native層的InputChannel的openInputChannelPair函數創建一對socket，先來看openInputChannelPair的實現：

status_t InputChannel::openInputChannelPair(const String8& name,
        sp<InputChannel>& outServerChannel, sp<InputChannel>& outClientChannel) {
    int sockets[2];
    if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, sockets)) {
        status_t result = -errno;
        ALOGE("channel '%s' ~ Could not create socket pair.  errno=%d",
                name.string(), errno);
        outServerChannel.clear();
        outClientChannel.clear();
        return result;
    }

    int bufferSize = SOCKET_BUFFER_SIZE;
    setsockopt(sockets[0], SOL_SOCKET, SO_SNDBUF, &bufferSize, sizeof(bufferSize));
    setsockopt(sockets[0], SOL_SOCKET, SO_RCVBUF, &bufferSize, sizeof(bufferSize));
    setsockopt(sockets[1], SOL_SOCKET, SO_SNDBUF, &bufferSize, sizeof(bufferSize));
    setsockopt(sockets[1], SOL_SOCKET, SO_RCVBUF, &bufferSize, sizeof(bufferSize));

    String8 serverChannelName = name;
    serverChannelName.append(" (server)");
    outServerChannel = new InputChannel(serverChannelName, sockets[0]);

    String8 clientChannelName = name;
    clientChannelName.append(" (client)");
    outClientChannel = new InputChannel(clientChannelName, sockets[1]);
    return OK;
}

上面的代碼比較簡單，首先創建一對未命名、相互連接的UNIX域套接字，然後分別通過Fd分別構造兩個Native層的InputChannel代表server和client端。在android_view_InputChannel_nativeOpenInputChannelPair函數中把Native層的InputChannel和Java層的InputChannel通過NativeInputChannel相互綁定起來。

回到InputManagerService的monitorInput方法中，InputChannel的openInputChannelPair返回一對InputChannel對象，其中index爲0的代表server端，index爲1的代表client端。接着調用nativeRegisterInputChannel把InputChannel[0]到InputDispatcher，用於從InputDispatcher獲取觸摸事件：

static void nativeRegisterInputChannel(JNIEnv* env, jclass clazz,
        jint ptr, jobject inputChannelObj, jobject inputWindowHandleObj, jboolean monitor) {
    NativeInputManager* im = reinterpret_cast<NativeInputManager*>(ptr);

    sp<InputChannel> inputChannel = android_view_InputChannel_getInputChannel(env,
            inputChannelObj);
    if (inputChannel == NULL) {
        throwInputChannelNotInitialized(env);
        return;
    }

    sp<InputWindowHandle> inputWindowHandle =
            android_server_InputWindowHandle_getHandle(env, inputWindowHandleObj);

    status_t status = im->registerInputChannel(
            env, inputChannel, inputWindowHandle, monitor);
    if (status) {
    }
}

status_t NativeInputManager::registerInputChannel(JNIEnv* env,
        const sp<InputChannel>& inputChannel,
        const sp<InputWindowHandle>& inputWindowHandle, bool monitor) {
    return mInputManager->getDispatcher()->registerInputChannel(
            inputChannel, inputWindowHandle, monitor);
}

nativeRegisterInputChannel首先通過Java層的InputChannel對象獲取到Native層的InputChannel對象，然後調用NativeInputManager的registerInputChannel方法，因爲當前沒有設置inputWindowhandler，所以這裏的InputWindowHandler爲NULL：

status_t InputDispatcher::registerInputChannel(const sp<InputChannel>& inputChannel,
        const sp<InputWindowHandle>& inputWindowHandle, bool monitor) {
    { // acquire lock
        AutoMutex _l(mLock);

        if (getConnectionIndexLocked(inputChannel) >= 0) {
            ALOGW("Attempted to register already registered input channel '%s'",
                    inputChannel->getName().string());
            return BAD_VALUE;
        }

        sp<Connection> connection = new Connection(inputChannel, inputWindowHandle, monitor);

        int fd = inputChannel->getFd();
        mConnectionsByFd.add(fd, connection);

        if (monitor) {
            mMonitoringChannels.push(inputChannel);
        }

        mLooper->addFd(fd, 0, ALOOPER_EVENT_INPUT, handleReceiveCallback, this);
    } // release lock

    // Wake the looper because some connections have changed.
            return BAD_VALUE;
        }

        sp<Connection> connection = new Connection(inputChannel, inputWindowHandle, monitor);

        int fd = inputChannel->getFd();
        mConnectionsByFd.add(fd, connection);

        if (monitor) {
            mMonitoringChannels.push(inputChannel);
        }

        mLooper->addFd(fd, 0, ALOOPER_EVENT_INPUT, handleReceiveCallback, this);
    } // release lock

    // Wake the looper because some connections have changed.
    mLooper->wake();
    return OK;