当前位置：首页 > news >正文

【Android cmd命令的执行流程】

news 2025/10/3 7:03:22

代码路径

/frameworks/native/cmds/cmd/

执行逻辑

main.cpp 将参数转化为c++格式

int main(int argc, char* const argv[]) {signal(SIGPIPE, SIG_IGN);std::vector<std::string_view> arguments;arguments.reserve(argc - 1);// 0th argument is a program name, skipping.for (int i = 1; i < argc; ++i) {arguments.emplace_back(argv[i]);}return cmdMain(arguments, android::aout, android::aerr, STDIN_FILENO, STDOUT_FILENO,STDERR_FILENO, RunMode::kStandalone);
}

cmd.cpp 查找对应的服务，并调用IBinder::shellCommand命令


int cmdMain(const std::vector<std::string_view>& argv, TextOutput& outputLog, TextOutput& errorLog,int in, int out, int err, RunMode runMode) {...sp<IServiceManager> sm = defaultServiceManager();...int argc = argv.size();
// 通过 -l 列出 支持的服务if ((argc == 1) && (argv[0] == "-l")) {Vector<String16> services = sm->listServices();services.sort(sort_func);outputLog << "Currently running services:" << endl;for (size_t i=0; i<services.size(); i++) {sp<IBinder> service = sm->checkService(services[i]);if (service != nullptr) {outputLog << "  " << services[i] << endl;}}return 0;}
// 通过使用 -w 等待服务启动bool waitForService = ((argc > 1) && (argv[0] == "-w"));int serviceIdx = (waitForService) ? 1 : 0;const auto cmd = argv[serviceIdx];Vector<String16> args;
// 获得服务名称String16 serviceName = String16(cmd.data(), cmd.size());for (int i = serviceIdx + 1; i < argc; i++) {args.add(String16(argv[i].data(), argv[i].size()));}sp<IBinder> service;if(waitForService) {service = sm->waitForService(serviceName);} else {service = sm->checkService(serviceName);}...
// 发送agras到对应的服务// TODO: block until a result is returned to MyResultReceiver.status_t error = IBinder::shellCommand(service, in, out, err, args, cb, result);...status_t res = result->waitForResult();return res;
}

Binder.cpp 发送服务到对应的服务

status_t IBinder::shellCommand(const sp<IBinder>& target, int in, int out, int err,Vector<String16>& args, const sp<IShellCallback>& callback,const sp<IResultReceiver>& resultReceiver)
{Parcel send;Parcel reply;send.writeFileDescriptor(in);send.writeFileDescriptor(out);send.writeFileDescriptor(err);const size_t numArgs = args.size();send.writeInt32(numArgs);for (size_t i = 0; i < numArgs; i++) {send.writeString16(args[i]);}send.writeStrongBinder(callback != nullptr ? IInterface::asBinder(callback) : nullptr);send.writeStrongBinder(resultReceiver != nullptr ? IInterface::asBinder(resultReceiver) : nullptr);// 发送到对应的服务return target->transact(SHELL_COMMAND_TRANSACTION, send, &reply);
}

每个service会有一个接口,如PackageManagerShellCommand.java ，其Handler会继承自BasicShellCommandHandler.java中的基类，而上面的transact会调用到基类中的exec函数，代码路径aosp/frameworks/libs/modules-utils/java/com/android/modules/utils;

    public int exec(Binder target, FileDescriptor in, FileDescriptor out, FileDescriptor err,String[] args) {String cmd;int start;if (args != null && args.length > 0) {cmd = args[0];start = 1;} else {cmd = null;start = 0;}init(target, in, out, err, args, start);mCmd = cmd;int res = -1;res = onCommand(mCmd);return res;}