BroadcastReceiver注册、发送、接收源码分析

BroadcastReceiver包括两方面，一是广播的注册过程，二是广播的发送和接收过程。

首先要定义一个广播的接受者，只需要集成BroadcastReceiver，并重写它的onReceiver（)方法就可以了，在该方法内不要做超过10ms的耗时工作。

注册广播接受者有两种方式；

一是在AndroidManifest文件中静态注册：

二是在代码中动态注册，采用registerReceiver注册，但它需要在合适的时机进行解除注册，采用unregisterReceiver。

IntentFilter filter =new IntentFilter();

filter.addAction(“….”);

registerReceiver(new MyReceiver(),filter);

常用在activity的onDestroy()方法中解除注解unregisterReceiver();

然后是发送广播：

Intent intent = new Intent();

intent.setAction(“…)

sendBroadcast(intent);

先附上一张广播动态注册、发送、接收的流程图

1.广播的注册过程

广播的注册分为静态和动态注册两种，静态注册的广播是在应用安装时有系统自动完成注册，具体来说是有PMS(PackageManagerService)来解析注册的，除了动态注册的广播，其他三大组件也是应用在安装时由PMS解析并注册。这里分析动态广播的注册过程。动态注册是从ContextWrapper的registerReceiver开始，ContextWrapper并没有做实际的工作，而是将注册过程交由ContextImpl来完成：

@Override
    public Intent registerReceiver(
        BroadcastReceiver receiver, IntentFilter filter) {
        return mBase.registerReceiver(receiver, filter);
    }

ContextImpl的registerReceiver调用了registerReceiverInternal。
 @Override
    public Intent registerReceiver(BroadcastReceiver receiver, IntentFilter filter) {
        return registerReceiver(receiver, filter, null, null);
    }

    @Override
    public Intent registerReceiver(BroadcastReceiver receiver, IntentFilter filter,
            String broadcastPermission, Handler scheduler) {
        return registerReceiverInternal(receiver, getUserId(),
                filter, broadcastPermission, scheduler, getOuterContext());
    }

private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId,
            IntentFilter filter, String broadcastPermission,
            Handler scheduler, Context context) {
        IIntentReceiver rd = null;
        if (receiver != null) {
            if (mPackageInfo != null && context != null) {
                if (scheduler == null) {
                    scheduler = mMainThread.getHandler();
                }
                rd = mPackageInfo.getReceiverDispatcher(
                    receiver, context, scheduler,
                    mMainThread.getInstrumentation(), true);
            } else {
                if (scheduler == null) {
                    scheduler = mMainThread.getHandler();
                }
                rd = new LoadedApk.ReceiverDispatcher(
                        receiver, context, scheduler, null, true).getIIntentReceiver();
            }
        }
        try {
            final Intent intent = ActivityManagerNative.getDefault().registerReceiver(
                    mMainThread.getApplicationThread(), mBasePackageName,
                    rd, filter, broadcastPermission, userId);
            if (intent != null) {
                intent.setExtrasClassLoader(getClassLoader());
                intent.prepareToEnterProcess();
            }
            return intent;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

系统通过mPackageInfo获取IIntentReceiver,然后采用跨进程的方式向AMS发送注册请求。BroadcastReceiver作为android组件是不能跨进程通信的，需要通过IIntentReceiver中转。IIntentReceiver是一个Binder接口，具体实现是有LoadedApk.ReceiverDispatcher.InnerReceiver,它的内部同时保留了BroadcastReceiver和InnerReceiver,这里的逻辑类似于binService的实现原理，后面会具体说。查看getReceiverDispatcher方法：

public IIntentReceiver getReceiverDispatcher(BroadcastReceiver r,
            Context context, Handler handler,
            Instrumentation instrumentation, boolean registered) {
        synchronized (mReceivers) {
            LoadedApk.ReceiverDispatcher rd = null;
            ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher> map = null;
            if (registered) {
                map = mReceivers.get(context);
                if (map != null) {
                    rd = map.get(r);
                }
            }
            if (rd == null) {
                rd = new ReceiverDispatcher(r, context, handler,
                        instrumentation, registered);
                if (registered) {
                    if (map == null) {
                        map = new ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher>();
                        mReceivers.put(context, map);
                    }
                    map.put(r, rd);
                }
            } else {
                rd.validate(context, handler);
            }
            rd.mForgotten = false;
            return rd.getIIntentReceiver();
        }
    }

  final IIntentReceiver.Stub mIIntentReceiver;
IIntentReceiver getIIntentReceiver() {
            return mIIntentReceiver;
        }


        ReceiverDispatcher(BroadcastReceiver receiver, Context context,
                Handler activityThread, Instrumentation instrumentation,
                boolean registered) {
            if (activityThread == null) {
                throw new NullPointerException("Handler must not be null");
            }

            mIIntentReceiver = new InnerReceiver(this, !registered);
            mReceiver = receiver;
            mContext = context;
            mActivityThread = activityThread;
            mInstrumentation = instrumentation;
            mRegistered = registered;
            mLocation = new IntentReceiverLeaked(null);
            mLocation.fillInStackTrace();
        }

 final static class InnerReceiver extends IIntentReceiver.Stub {
            final WeakReference<LoadedApk.ReceiverDispatcher> mDispatcher;
            final LoadedApk.ReceiverDispatcher mStrongRef;
	InnerReceiver(LoadedApk.ReceiverDispatcher rd, boolean strong) {
                mDispatcher = new WeakReference<LoadedApk.ReceiverDispatcher>(rd);
                mStrongRef = strong ? rd : null;
            }

            @Override
            public void performReceive(Intent intent, int resultCode, String data,
                    Bundle extras, boolean ordered, boolean sticky, int sendingUser) {
	……
	if (rd != null) {
                    rd.performReceive(intent, resultCode, data, extras,
                            ordered, sticky, sendingUser);
                }
	……
}

显然getReceiverDispatcher方法重建了一个ReceiverDispatcher对象，并将其保存的InnerReceiver对象作为返回值返回。查看AMS的registerReceiver的实现，下面的方法只需注意关键的一点，最终把InnerReceiver对象以及IntentFilter对象存储起来，这样就完成广播的注册。

final class ReceiverList extends ArrayList<BroadcastFilter>
        implements IBinder.DeathRecipient 
  /**
     * Keeps track of all IIntentReceivers that have been registered for broadcasts.
     * Hash keys are the receiver IBinder, hash value is a ReceiverList.
     */
    final HashMap<IBinder, ReceiverList> mRegisteredReceivers = new HashMap<>();

 public Intent registerReceiver(IApplicationThread caller, String callerPackage,
            IIntentReceiver receiver, IntentFilter filter, String permission, int userId) {
        enforceNotIsolatedCaller(“registerReceiver");
      …….
 ReceiverList rl = mRegisteredReceivers.get(receiver.asBinder());
	…….
 mRegisteredReceivers.put(receiver.asBinder(), rl);
BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage,
                    permission, callingUid, userId);
            rl.add(bf);
            if (!bf.debugCheck()) {
                Slog.w(TAG, "==> For Dynamic broadcast");
            }
            mReceiverResolver.addFilter(bf);
	…….
}

2.广播的发送和接收过程

通过send方法发送广播，AMS会查出匹配的广播接收并处理。广播的发送种类有普通广播、有序广播、粘性广播。

普通广播：广播发出之后所有满足条件的应用都能获取到广播里面的数据，缺点是应用获取广播中的数据修改之后不能传递给其它接收广播的应用。broadcast，

sendBroadcast()：发送给所有广播接收者，按照注册的先后顺序，如果你这个时候设置了广播接收者的优先级，优先级如果恰好与注册顺序相同，则不会有任何问题，如果顺序不一样，会出leaked IntentReceiver 这样的异常，并且在前面的广播接收者不能调用abortBroadcast()方法将其终止，如果调用会出BroadcastReceiver trying to return result during a non-ordered broadcast的异常，当然，先接收到广播的receiver可以修改广播数据。

有序广播：orderbroadcast,广播发出之后各应用根据应用的优先级依次接收广播，优先级高的应用接收广播之后修改的数据也可以传递给后来的接受者，优先级高的应用也可以调用abrotbroascast方法停止该广播的向下传播，优先级靠应用的android:prioioty属性控制，该值的取值区间为-1000到1000，值越大优先级越高。

sendOrderedBroadcast()按照设置的优先级发送，还有这个api能指定final的receiver，这个receiver是最后一个接收广播时间的receiver，并且一定会接收到广播事件，是不能被前面的receiver拦截的。实际做实验的情况是这样的，假设我有3个receiver依序排列，并且sendOrderedBroadcast()方法指定了一个finalReceiver，那么intent传递给这4个Receiver的顺序为Receiver1-->finalReceiver-->Receiver2-->finalReceiver-->Receiver3-->finalReceiver。这个特性可以用来统计系统中能监听某种广播的Receiver的数目。

粘性广播：使用这个api需要权限android.Manifest.permission.BROADCAST_STICKY,特点是Intent会一直保留到广播事件结束，而这种广播也没有所谓的10秒限制，10秒限制是指普通的广播如果onReceive方法执行时间太长，超过10秒的时候系统会将这个广播置为可以干掉的candidate，一旦系统资源不够的时候，就会干掉这个广播而让它不执行。

他们的发送和接收过程类似，这里只介绍普通广播。广播的接收和发送，本质是一个过程的两个阶段。先说发送，同样从ContextImpl的sendBroadcast()方法开始：

@Override
    public void sendBroadcast(Intent intent) {
        warnIfCallingFromSystemProcess();
        String resolvedType = intent.resolveTypeIfNeeded(getContentResolver());
        try {
            intent.prepareToLeaveProcess(this);
            ActivityManagerNative.getDefault().broadcastIntent(
                    mMainThread.getApplicationThread(), intent, resolvedType, null,
                    Activity.RESULT_OK, null, null, null, AppOpsManager.OP_NONE, null, false, false,
                    getUserId());
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

直接是AMS的broadcastIntent方法：

public final int broadcastIntent(IApplicationThread caller,
            Intent intent, String resolvedType, IIntentReceiver resultTo,
            int resultCode, String resultData, Bundle resultExtras,
            String[] requiredPermissions, int appOp, Bundle bOptions,
            boolean serialized, boolean sticky, int userId) {
        enforceNotIsolatedCaller("broadcastIntent");
        synchronized(this) {
            intent = verifyBroadcastLocked(intent);

            final ProcessRecord callerApp = getRecordForAppLocked(caller);
            final int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();
            final long origId = Binder.clearCallingIdentity();
            int res = broadcastIntentLocked(callerApp,
                    callerApp != null ? callerApp.info.packageName : null,
                    intent, resolvedType, resultTo, resultCode, resultData, resultExtras,
                    requiredPermissions, appOp, bOptions, serialized, sticky,
                    callingPid, callingUid, userId);
            Binder.restoreCallingIdentity(origId);
            return res;
        }

调用了broadcastIntentLocked方法，代码较多先只看其中一句：

      // By default broadcasts do not go to stopped apps.
        intent.addFlags(Intent.FLAG_EXCLUDE_STOPPED_PACKAGES);

这里表示在Android5.0，默认情况下广播不会发送给已经停止的应用。其实从Android 3.0开始广播已经有这种特性，它在Intent中添加了两个标记位，分别是FLAG_INCLUDE_STOPPED_PACKAGES

表示包含以已经停止的应用，这个时候的广播会发送给已经停止的应用。

FLAG_EXCLUDE_STOPPED_PACKAGES。

表示不包含已经停止的应用，这个时候的广播是不会发送给已经停止的应用。

从Android3.1默认添加FLAG_EXCLUDE_STOPPED_PACKAGES，停机状态无法接到开机广播。

如果确实需要启动未启动的应用，添加标记FLAG_INCLUDE_STOPPED_PACKAGES即可。当两种标记共存时，以FLAG_INCLUDE_STOPPED_PACKAGES为准。一个应用处于停止状态有两种：一是应用处安装后未运行；二是应用被手动或其他应用强停了。

在broadcastIntentLocked内部会根据intent-filter查找匹配的广播接收者并过滤，最终满足的广播接受者添加到BroadcastQueue中，接着BroadcastQueue会将广播发送给对应的广播接收者。

if ((receivers != null && receivers.size() > 0)
                || resultTo != null) {
            BroadcastQueue queue = broadcastQueueForIntent(intent);
            BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
                    callerPackage, callingPid, callingUid, resolvedType,
                    requiredPermissions, appOp, brOptions, receivers, resultTo, resultCode,
                    resultData, resultExtras, ordered, sticky, false, userId);

            if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Enqueueing ordered broadcast " + r
                    + ": prev had " + queue.mOrderedBroadcasts.size());
            if (DEBUG_BROADCAST) Slog.i(TAG_BROADCAST,
                    "Enqueueing broadcast " + r.intent.getAction());

            boolean replaced = replacePending && queue.replaceOrderedBroadcastLocked(r);
            if (!replaced) {
                queue.enqueueOrderedBroadcastLocked(r);
                queue.scheduleBroadcastsLocked();
            }
}

查看BroadcastQueue 的scheduleBroadcastsLocked方法：

public void scheduleBroadcastsLocked() {
        if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Schedule broadcasts ["
                + mQueueName + "]: current="
                + mBroadcastsScheduled);

        if (mBroadcastsScheduled) {
            return;
        }
        mHandler.sendMessage(mHandler.obtainMessage(BROADCAST_INTENT_MSG, this));
        mBroadcastsScheduled = true;
    }

scheduleBroadcastsLocked没有立即发送广播，而是发送了一个BROCAST_INTENT_MSG类型的消息。

private final class BroadcastHandler extends Handler {
        public BroadcastHandler(Looper looper) {
            super(looper, null, true);
        }

        @Override
        public void handleMessage(Message msg) {
            switch (msg.what) {
                case BROADCAST_INTENT_MSG: {
                    if (DEBUG_BROADCAST) Slog.v(
                            TAG_BROADCAST, "Received BROADCAST_INTENT_MSG");
                    processNextBroadcast(true);
                } break;
                case BROADCAST_TIMEOUT_MSG: {
                    synchronized (mService) {
                        broadcastTimeoutLocked(true);
                    }
                } break;
                case SCHEDULE_TEMP_WHITELIST_MSG: {
                    DeviceIdleController.LocalService dic = mService.mLocalDeviceIdleController;
                    if (dic != null) {
                        dic.addPowerSaveTempWhitelistAppDirect(UserHandle.getAppId(msg.arg1),
                                msg.arg2, true, (String)msg.obj);
                    }
                } break;
            }
        }
    }

Handler处理中调用processNextBroadcast(true)方法。

// First, deliver any non-serialized broadcasts right away.
            while (mParallelBroadcasts.size() > 0) {
                r = mParallelBroadcasts.remove(0);
                r.dispatchTime = SystemClock.uptimeMillis();
                r.dispatchClockTime = System.currentTimeMillis();
                final int N = r.receivers.size();
                if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST, "Processing parallel broadcast ["
                        + mQueueName + "] " + r);
                for (int i=0; i<N; i++) {
                    Object target = r.receivers.get(i);
                    if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
                            "Delivering non-ordered on [" + mQueueName + "] to registered "
                            + target + ": " + r);
                    deliverToRegisteredReceiverLocked(r, (BroadcastFilter)target, false, i);
                }
                addBroadcastToHistoryLocked(r);
                if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST, "Done with parallel broadcast ["
                        + mQueueName + "] " + r);
            }

无序广播存储在mParallelBroadcasts中，系统会遍历mParallelBroadcasts,并将启动的广播发送给他们的接收者。发送过程有deliverToRegisteredReceiverLocked方法实现。

private void deliverToRegisteredReceiverLocked(BroadcastRecord r,
            BroadcastFilter filter, boolean ordered, int index) {
	……
 performReceiveLocked(filter.receiverList.app, filter.receiverList.receiver,
                        new Intent(r.intent), r.resultCode, r.resultData,
                        r.resultExtras, r.ordered, r.initialSticky, r.userId);
……
}

void performReceiveLocked(ProcessRecord app, IIntentReceiver receiver,
            Intent intent, int resultCode, String data, Bundle extras,
            boolean ordered, boolean sticky, int sendingUser) throws RemoteException {
        // Send the intent to the receiver asynchronously using one-way binder calls.
        if (app != null) {
            if (app.thread != null) {
                // If we have an app thread, do the call through that so it is
                // correctly ordered with other one-way calls.
                try {
                    app.thread.scheduleRegisteredReceiver(receiver, intent, resultCode,
                            data, extras, ordered, sticky, sendingUser, app.repProcState);
                // TODO: Uncomment this when (b/28322359) is fixed and we aren't getting
                // DeadObjectException when the process isn't actually dead.
                //} catch (DeadObjectException ex) {
                // Failed to call into the process.  It's dying so just let it die and move on.
                //    throw ex;
                } catch (RemoteException ex) {
                    // Failed to call into the process. It's either dying or wedged. Kill it gently.
                    synchronized (mService) {
                        Slog.w(TAG, "Can't deliver broadcast to " + app.processName
                                + " (pid " + app.pid + "). Crashing it.");
                        app.scheduleCrash("can't deliver broadcast");
                    }
                    throw ex;
                }
            } else {
                // Application has died. Receiver doesn't exist.
                throw new RemoteException("app.thread must not be null");
            }
        } else {
            receiver.performReceive(intent, resultCode, data, extras, ordered,
                    sticky, sendingUser);
        }
    }

广播要调用应用程序，因此app.Thread不可能是null。查看ApplicationThread的scheduleRegisteredReceiver方法。

 // This function exists to make sure all receiver dispatching is
        // correctly ordered, since these are one-way calls and the binder driver
        // applies transaction ordering per object for such calls.

        public void scheduleRegisteredReceiver(IIntentReceiver receiver, Intent intent,
                int resultCode, String dataStr, Bundle extras, boolean ordered,
                boolean sticky, int sendingUser, int processState) throws RemoteException {
            updateProcessState(processState, false);
            receiver.performReceive(intent, resultCode, dataStr, extras, ordered,
                    sticky, sendingUser);
        }

InnerReceiver的performReceive方法会调用LoadedApk.ReceiverDispatcher的performReceive方法。

public void performReceive(Intent intent, int resultCode, String data,
                Bundle extras, boolean ordered, boolean sticky, int sendingUser) {
            final Args args = new Args(intent, resultCode, data, extras, ordered,
                    sticky, sendingUser);
            if (intent == null) {
                Log.wtf(TAG, "Null intent received");
            } else {
                if (ActivityThread.DEBUG_BROADCAST) {
                    int seq = intent.getIntExtra("seq", -1);
                    Slog.i(ActivityThread.TAG, "Enqueueing broadcast " + intent.getAction()
                            + " seq=" + seq + " to " + mReceiver);
                }
            }
            if (intent == null || !mActivityThread.post(args)) {
                if (mRegistered && ordered) {
                    IActivityManager mgr = ActivityManagerNative.getDefault();
                    if (ActivityThread.DEBUG_BROADCAST) Slog.i(ActivityThread.TAG,
                            "Finishing sync broadcast to " + mReceiver);
                    args.sendFinished(mgr);
                }
            }
        }

    }


final class Args extends BroadcastReceiver.PendingResult implements Runnable {
            private Intent mCurIntent;
            private final boolean mOrdered;
            private boolean mDispatched;

            ……
            
            public void run() {
                final BroadcastReceiver receiver = mReceiver;
                final boolean ordered = mOrdered;
                ……               
                final IActivityManager mgr = ActivityManagerNative.getDefault();
               ……
                try {
                    ClassLoader cl =  mReceiver.getClass().getClassLoader();
                    intent.setExtrasClassLoader(cl);
                    intent.prepareToEnterProcess();
                    setExtrasClassLoader(cl);
                    receiver.setPendingResult(this);
                    receiver.onReceive(mContext, intent);
                } catch (Exception e) {
                    ……..            
         }