广播的注册、发送和接收过程

广播作为四大组件之，使用频率远没有 Activity 高，但是广播的工作过程还是十分有必要了解的。本节主要从三个方面讲解广播工作过程，分别是广播的注册、发送和接收。本文基于Android8.1.0系统分析广播的注册、发送和接收过程。

1. 广播的注册过程

广播的注册通俗来讲就是广播接受者注册自己感兴趣的广播，广播的注册分为两种形式，分别是静态注册和动态注册，静态注册在应用安装时有PackageManagerService来完成注册过程，关于这一过程本文先不做介绍，本文主要分析广播的动态注册过程。

想要动态注册广播，需要调用registerReceiver方法，它在ContextWrapper中实现，代码如下所示：

frameworks/base/core/java/android/content/ContextWrapper.java

    @Override
    public Intent registerReceiver(
        BroadcastReceiver receiver, IntentFilter filter) {
        return mBase.registerReceiver(receiver, filter);
    }

这里 mBase 具体指向就是 Co nte xtlm pl ， Contextlmpl 的 register Receiver 方法有很多重载的方法，但是最终都会调用 registerReceiverInternal方法，代码如下所示：

frameworks/base/core/java/android/app/ContextImpl.java

    private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId,
            IntentFilter filter, String broadcastPermission,
            Handler scheduler, Context context, int flags) {
        IIntentReceiver rd = null;
        if (receiver != null) {
            if (mPackageInfo != null && context != null) { // ... 1
                if (scheduler == null) {
                    scheduler = mMainThread.getHandler();
                }
                rd = mPackageInfo.getReceiverDispatcher(
                    receiver, context, scheduler,
                    mMainThread.getInstrumentation(), true); // ... 2
            } else {
                if (scheduler == null) {
                    scheduler = mMainThread.getHandler();
                }
                rd = new LoadedApk.ReceiverDispatcher(
                        receiver, context, scheduler, null, true).getIIntentReceiver(); // ... 3
            }
        }
        try {
            final Intent intent = ActivityManager.getService().registerReceiver(
                    mMainThread.getApplicationThread(), mBasePackageName, rd, filter,
                    broadcastPermission, userId, flags); // ... 4
            if (intent != null) {
                intent.setExtrasClassLoader(getClassLoader());
                intent.prepareToEnterProcess();
            }
            return intent;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

在注释1 处判断如果 Loaded Apk 类型的 mPackagel nfo 不等于 null ，并且 context 不等与 null 就调用注释2 处的代码，通过 mPackageinfo 的 getRece iverDispatcher 方法获取 rd 对象，否则就调用注释3处的代码来创建 rd 对象。注释2 和注释3处的代码的目的都是要获取 IIntentReceiver 类型的 rd 对象， IIntentReceiver 是一个 Binder 接口，用于广播的跨进程的通信，它在 Loa ded Apk.ReceiverDi spatc her.InnerR ece iver 中实现，代码如下所示：

frameworks/base/core/java/android/app/LoadedApk.java


    static final class ReceiverDispatcher {

        final static class InnerReceiver extends IIntentReceiver.Stub {
            final WeakReference<LoadedApk.ReceiverDispatcher> mDispatcher;
            final LoadedApk.ReceiverDispatcher mStrongRef;

            InnerReceiver(LoadedApk.ReceiverDispatcher rd, boolean strong) {
                mDispatcher = new WeakReference<LoadedApk.ReceiverDispatcher>(rd);
                mStrongRef = strong ? rd : null;
            }
            ...

        }
        ...      

    }

回到 registerReceiverInternal 方法，在注释4 处调用了I Activity Manager 的 registerReceiver 方法，最终会调用 AMS 的 register Receiver 方法，并将 llntentReceiver 类型的 rd 传进去，这里之所以不直接传入 BroadcastReceiver 而是传入 llntentReceiver ，是因为注册广播是一个跨进程过程，需要具有跨进程的通信功能的 IlntentReceiver 。接下来分析AMS的register Receiver方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    public Intent registerReceiver(IApplicationThread caller, String callerPackage,
            IIntentReceiver receiver, IntentFilter filter, String permission, int userId,
            int flags) {
        ...
        ArrayList<Intent> stickyIntents = null;
        ProcessRecord callerApp = null;
        ...
        synchronized(this) {
            if (caller != null) {
                callerApp = getRecordForAppLocked(caller); // ... 1
                ...
            } else {
                ...
            }
            ...  
            Iterator<String> actions = filter.actionsIterator(); // ... 2
            if (actions == null) {
                ArrayList<String> noAction = new ArrayList<String>(1);
                noAction.add(null);
                actions = noAction.iterator();
            }

            // Collect stickies of users
            int[] userIds = { UserHandle.USER_ALL, UserHandle.getUserId(callingUid) };
            while (actions.hasNext()) {
                String action = actions.next();
                for (int id : userIds) {
                    ArrayMap<String, ArrayList<Intent>> stickies = mStickyBroadcasts.get(id);
                    if (stickies != null) {
                        ArrayList<Intent> intents = stickies.get(action);
                        if (intents != null) {
                            if (stickyIntents == null) {
                                stickyIntents = new ArrayList<Intent>();
                            }
                            stickyIntents.addAll(intents); // ... 3
                        }
                    }
                }
            }
        }

        ArrayList<Intent> allSticky = null;
        if (stickyIntents != null) {
            final ContentResolver resolver = mContext.getContentResolver();
            // Look for any matching sticky broadcasts...
            // 遍历寻找匹配的粘性广播
            for (int i = 0, N = stickyIntents.size(); i < N; i++) {
                Intent intent = stickyIntents.get(i);
                // Don't provided intents that aren't available to instant apps.
                if (instantApp &&
                        (intent.getFlags() & Intent.FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS) == 0) {
                    continue;
                }
                // If intent has scheme "content", it will need to acccess
                // provider that needs to lock mProviderMap in ActivityThread
                // and also it may need to wait application response, so we
                // cannot lock ActivityManagerService here.
                if (filter.match(resolver, intent, true, TAG) >= 0) {
                    if (allSticky == null) {
                        allSticky = new ArrayList<Intent>();
                    }
                    allSticky.add(intent); // ... 4
                }
            }
        }

        // The first sticky in the list is returned directly back to the client.
        Intent sticky = allSticky != null ? allSticky.get(0) : null;
        if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Register receiver " + filter + ": " + sticky);
        if (receiver == null) {
            return sticky;
        }

        synchronized (this) {
            ... 
            ReceiverList rl = mRegisteredReceivers.get(receiver.asBinder()); // ... 5
            if (rl == null) {
                rl = new ReceiverList(this, callerApp, callingPid, callingUid,
                        userId, receiver); // ... 6
               ...
            } 
            ...
            BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage,
                    permission, callingUid, userId, instantApp, visibleToInstantApps); // ... 7
            rl.add(bf); // ... 8
            if (!bf.debugCheck()) {
                Slog.w(TAG, "==> For Dynamic broadcast");
            }
            mReceiverResolver.addFilter(bf); // ... 9
            ...
            return sticky;
        }
    }

在注释1处通过 getRecordF or App Locked 方法得到 ProcessRecord 类型的 caller App 对象，它用于描述请求 AMS 注册广播接收者的 Activity 所在的应用程序进程。在注释2 处根据传人的 IntentFilter 类型 filter 得到 actions 列表，根据 actions 列表和 userlds (user Ids 可以理解为应用程序的uid ）得到所有的粘性广播的 intent ，并在注释3 处传入到 sticky Intents 中。接下来从 sticky Intents 中找到匹配传入的参数 filter 的粘性广播的 intent ，在注释4 处将这些 intent 存入到 all Sticky 列表中，从这里可以看出粘性广播是存储在 AMS 中的。

在注释5 处获取 ReceiverList 列表，如果为空则在注释6 处创建 Receiver List 继承自 Array List ，用来存储广播接收者。在注释 7 处创建 BroadcastFilter 并传入此前创建的 Receiver List , BroadcastFilter 用来描述注册的广播接者，并在注释8 处通过 add 将自身添加到 Receiver List 中。在注释9处将 BroadcastFilter 加到 IntentRes olver 类型 rnReceiverResolver 中，这样当 A MS 收到广播时就可以从 m Receiver Resolver 中找到对应的广播接者了，从而达到了注册广播的目的。

2. 广播的发送和接收过程

广播的发送和接收过程分为两个部分来进行讲解，分别是 Contextlmpl 到 AMS 的调用过程和 AMS 到 BroadcastReceiver 的调用过程。

2.1 ContextImpl到AMS的调用过程

广播可以发送多种类型，括无序广播（普通广播）、有序广播和粘性广播，这里以无序广播为例来讲解广播的发送过程。要发送无序广播需要调用 se ndBroadcast 方法，它在 ContextWrapper 中实现，代码如下所示：

frameworks/base/core/java/android/content/ContextWrapper.java

    public void sendBroadcast(Intent intent) {
        mBase.sendBroadcast(intent);
    }

在“解析Service的启动过程”一文章我们分析过，mBase具体指向就是ContextImpl，接下来查看ContextImpl的sendBroadcast方法，代码如下所示：

frameworks/base/core/java/android/app/Contextlmpl.java

    public void sendBroadcast(Intent intent) {
        warnIfCallingFromSystemProcess();
        String resolvedType = intent.resolveTypeIfNeeded(getContentResolver());
        try {
            intent.prepareToLeaveProcess(this);
            ActivityManager.getService().broadcastIntent(
                    mMainThread.getApplicationThread(), intent, resolvedType, null,
                    Activity.RESULT_OK, null, null, null, AppOpsManager.OP_NONE, null, false, false,
                    getUserId()); // ... 1
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

在注释1处最终会调用AMS的broadcastIntent方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    public final int broadcastIntent(IApplicationThread caller,
            Intent intent, String resolvedType, IIntentReceiver resultTo,
            int resultCode, String resultData, Bundle resultExtras,
            String[] requiredPermissions, int appOp, Bundle bOptions,
            boolean serialized, boolean sticky, int userId) {
        enforceNotIsolatedCaller("broadcastIntent");
        synchronized(this) {
            // 验证广播是否合法
            intent = verifyBroadcastLocked(intent); // ... 1
            final ProcessRecord callerApp = getRecordForAppLocked(caller);
            final int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();
            final long origId = Binder.clearCallingIdentity();
            int res = broadcastIntentLocked(callerApp,
                    callerApp != null ? callerApp.info.packageName : null,
                    intent, resolvedType, resultTo, resultCode, resultData, resultExtras,
                    requiredPermissions, appOp, bOptions, serialized, sticky,
                    callingPid, callingUid, userId); // ... 2
            Binder.restoreCallingIdentity(origId);
            return res;
        }
    }

在注释1处，首先验证广播是否合法，我们先分析verifyBroadcastLocked方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    final Intent verifyBroadcastLocked(Intent intent) {
        // Refuse possible leaked file descriptors
        if (intent != null && intent.hasFileDescriptors() == true) { // ... 1
            throw new IllegalArgumentException("File descriptors passed in Intent");
        }

        int flags = intent.getFlags(); // ... 2

        if (!mProcessesReady) {
            // if the caller really truly claims to know what they're doing, go
            // ahead and allow the broadcast without launching any receivers
            if ((flags&Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT) != 0) { // ... 3
                // This will be turned into a FLAG_RECEIVER_REGISTERED_ONLY later on if needed.
            } else if ((flags&Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) { // ... 4
                Slog.e(TAG, "Attempt to launch receivers of broadcast intent " + intent
                        + " before boot completion");
                throw new IllegalStateException("Cannot broadcast before boot completed");
            }
        }

        if ((flags&Intent.FLAG_RECEIVER_BOOT_UPGRADE) != 0) {
            throw new IllegalArgumentException(
                    "Can't use FLAG_RECEIVER_BOOT_UPGRADE here");
        }

        if ((flags & Intent.FLAG_RECEIVER_FROM_SHELL) != 0) {
            switch (Binder.getCallingUid()) {
                case ROOT_UID:
                case SHELL_UID:
                    break;
                default:
                    Slog.w(TAG, "Removing FLAG_RECEIVER_FROM_SHELL because caller is UID "
                            + Binder.getCallingUid());
                    intent.removeFlags(Intent.FLAG_RECEIVER_FROM_SHELL);
                    break;
            }
        }

        return intent;
    }

在注释1处验证 intent 是否不为 null 且有文件描述符。注释2处获得 intent 中的 flag 。注释3 处如果系统正在启动过程中，判断如果flag 设置为 FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT(启动检查时只接受动态注册的广播接收者）则不做处理，如果不是则在注释4 处判断如果 flag 没有设置为 FLAG_RECEIVER_REGISTERED_ONLY （只接受动态注册的广播接收者）则抛出异常。我们再回到 broadcastln tent 方法，在注释2处调用了 broadcastIntentLocked 方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    final int broadcastIntentLocked(ProcessRecord callerApp,
            String callerPackage, Intent intent, String resolvedType,
            IIntentReceiver resultTo, int resultCode, String resultData,
            Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions,
            boolean ordered, boolean sticky, int callingPid, int callingUid, int userId) {
 ...
 if ((receivers != null && receivers.size() > 0)
                || resultTo != null) {
            BroadcastQueue queue = broadcastQueueForIntent(intent);
            BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
                    callerPackage, callingPid, callingUid, callerInstantApp, resolvedType,
                    requiredPermissions, appOp, brOptions, receivers, resultTo, resultCode,
                    resultData, resultExtras, ordered, sticky, false, userId); // ... 1

            if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Enqueueing ordered broadcast " + r
                    + ": prev had " + queue.mOrderedBroadcasts.size());
            if (DEBUG_BROADCAST) Slog.i(TAG_BROADCAST,
                    "Enqueueing broadcast " + r.intent.getAction());

            final BroadcastRecord oldRecord =
                    replacePending ? queue.replaceOrderedBroadcastLocked(r) : null;
            if (oldRecord != null) {
                // Replaced, fire the result-to receiver.
                if (oldRecord.resultTo != null) {
                    final BroadcastQueue oldQueue = broadcastQueueForIntent(oldRecord.intent);
                    try {
                        oldQueue.performReceiveLocked(oldRecord.callerApp, oldRecord.resultTo,
                                oldRecord.intent,
                                Activity.RESULT_CANCELED, null, null,
                                false, false, oldRecord.userId);
                    } catch (RemoteException e) {
                        Slog.w(TAG, "Failure ["
                                + queue.mQueueName + "] sending broadcast result of "
                                + intent, e);

                    }
                }
            } else {
                queue.enqueueOrderedBroadcastLocked(r);
                queue.scheduleBroadcastsLocked(); // ... 2
            }
        } else {
            // There was nobody interested in the broadcast, but we still want to record
            // that it happened.
            if (intent.getComponent() == null && intent.getPackage() == null
                    && (intent.getFlags()&Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
                // This was an implicit broadcast... let's record it for posterity.
                addBroadcastStatLocked(intent.getAction(), callerPackage, 0, 0, 0);
            }
        }

        return ActivityManager.BROADCAST_SUCCESS;
}

这里省略了很多代码，前面的工作主要是将动态注册的广播接收者和静态注册的广播接受者按照优先级高低不同存储在不同的列表中，再将这两个列表合并到receivers列表中，这样receivers列表包含了所有广播接受者（无序广播和有序广播）。在注释1处创建BroadcastRecord对象并将receivers传进去，在注释2处调用BroadcastQueue的scheduleBroadcastsLocked方法。