Android—Broadcast原理

registerReceiver

registerReceiver方法有很多重载方法，但是最终的入口都是在ContextImpl中，

    private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId,
            IntentFilter filter, String broadcastPermission,
            Handler scheduler, Context context, int flags) {
        IIntentReceiver rd = null;
        if (receiver != null) {
            if (mPackageInfo != null && context != null) {
                if (scheduler == null) {
                    // 注册receiver的时候可以指定接受receiver的Handler
                    // 如果没有指定，则默认用主线程的handler处理
                    scheduler = mMainThread.getHandler();
                }
                // 获取IIntentReceiver，Binder对象，当广播来临时，用于AMS向客户端发起回调
                rd = mPackageInfo.getReceiverDispatcher(
                    receiver, context, scheduler,
                    mMainThread.getInstrumentation(), true);
            } else {
                if (scheduler == null) {
                    scheduler = mMainThread.getHandler();
                }
                rd = new LoadedApk.ReceiverDispatcher(
                        receiver, context, scheduler, null, true).getIIntentReceiver();
            }
        }
        try {
            // 通过Binder与AMS通信，进行广播注册
            final Intent intent = ActivityManager.getService().registerReceiver(
                    mMainThread.getApplicationThread(), mBasePackageName, rd, filter,
                    broadcastPermission, userId, flags);
            if (intent != null) {
                intent.setExtrasClassLoader(getClassLoader());
                intent.prepareToEnterProcess();
            }
            return intent;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

在新建广播接收发布器ReceiverDispatcher时，会在构造函数里面创建一个InnerReceiver实例，这是一个Binder对象，实现了IIntentReceiver接口，可以通过ReceiverDispatcher.getIIntentReceiver函数来获得，即获取到上面的rd对象，获得后就会把它传给ActivityManagerService，以便接收广播。

有两个重要的地方：1.getReceiverDispatcher方法      2.ActivityManager.getService().registerReceiver方法

下面分析第一个getReceiverDispatcher方法

    public IIntentReceiver getReceiverDispatcher(BroadcastReceiver r,
            Context context, Handler handler,
            Instrumentation instrumentation, boolean registered) {
        synchronized (mReceivers) {
            LoadedApk.ReceiverDispatcher rd = null;
            ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher> map = null;
            if (registered) {
                map = mReceivers.get(context);
                if (map != null) {
                    rd = map.get(r);
                }
            }
            if (rd == null) {
                rd = new ReceiverDispatcher(r, context, handler,
                        instrumentation, registered);
                if (registered) {
                    if (map == null) {
                        map = new ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher>();
                        mReceivers.put(context, map);
                    }
                    map.put(r, rd);
                }
            } else {
                rd.validate(context, handler);
            }
            rd.mForgotten = false;
            return rd.getIIntentReceiver();
        }
    }

该函数通过参数r在ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher>判断ReceiverDispatcher是否存在了，有就直接返回了，否则新建一个ReceiverDispatcher并保存。接下来是以Context，这里即为MainActivity为Key，以上面ArrayMap为值保存在LoadedApk的成员变量mReceivers中，这样，只要给定一个Activity和BroadcastReceiver，就可以查看LoadedApk里面是否已经存在相应的广播接收发布器ReceiverDispatcher了。

所以该方法就是返回一个ReceiverDispatcher对象，通过该对象可以获取rd实例。

ActivityManager.getService().registerReceiver方法通过Binder驱动程序就进入到ActivityManagerService中的registerReceiver函数中去了。下面看AMS的registerReceiver方法，rd传入参数名为receiver。

public Intent registerReceiver(IApplicationThread caller, String callerPackage,
        IIntentReceiver receiver, IntentFilter filter, String permission, int userId,
        int flags) {
    //省略了关于粘性广播的代码    
    .....

        ReceiverList rl = mRegisteredReceivers.get(receiver.asBinder());
        if (rl == null) {
    //receiver封装到一个ReceiverList对象
            rl = new ReceiverList(this, callerApp, callingPid, callingUid,
                    userId, receiver);
            if (rl.app != null) {
                rl.app.receivers.add(rl);
            } else {
                try {
                    receiver.asBinder().linkToDeath(rl, 0);
                } catch (RemoteException e) {
                    return sticky;
                }
                rl.linkedToDeath = true;
            }
            mRegisteredReceivers.put(receiver.asBinder(), rl);
        }         
    //rl又封装到BroadcastFilter 
        BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage,
                permission, callingUid, userId, instantApp, visibleToInstantApps);
        rl.add(bf);
        if (!bf.debugCheck()) {
            Slog.w(TAG, "==> For Dynamic broadcast");
        }
    //bf添加到mReceiverResolver内部的集合中了
        mReceiverResolver.addFilter(bf);
        return sticky;
    }
}

把广播接收器receiver保存一个ReceiverList列表中，这个列表的宿主进程是rl.app，这里就是MainActivity所在的进程了，在ActivityManagerService中，用一个进程记录块来表示这个应用程序进程，它里面有一个列表receivers，专门用来保存这个进程注册的广播接收器。接着，又把这个ReceiverList列表以receiver为Key保存在ActivityManagerService的成员变量mRegisteredReceivers中，这些都是为了方便在收到广播时，快速找到对应的广播接收器的。

接着创建一个BroadcastFilter来把广播接收器列表rl和filter关联起来，然后保存在ActivityManagerService中的成员变量mReceiverResolver中去。

总结：广播注册，主要就是将广播接收器receiver及其要接收的广播类型filter保存在ActivityManagerService中，以便以后能够接收到相应的广播并进行处理。

sendBroadcast

ActivityManager.getService().broadcastIntent(
                    mMainThread.getApplicationThread(), intent, resolvedType, null,
                    Activity.RESULT_OK, null, null, receiverPermissions, appOp, null, false, false,
                    getUserId());

无论是有序还是无序广播，最后都是通过该方法进入到ActivityManagerService中的broadcastIntent函数中去。

    public final int broadcastIntent(IApplicationThread caller,
            Intent intent, String resolvedType, IIntentReceiver resultTo,
            int resultCode, String resultData, Bundle resultExtras,
            String[] requiredPermissions, int appOp, Bundle bOptions,
            boolean serialized, boolean sticky, int userId) {
        enforceNotIsolatedCaller("broadcastIntent");
        synchronized(this) {
            .....
            int res = broadcastIntentLocked(callerApp,
                    callerApp != null ? callerApp.info.packageName : null,
                    intent, resolvedType, resultTo, resultCode, resultData, resultExtras,
                    requiredPermissions, appOp, bOptions, serialized, sticky,
                    callingPid, callingUid, userId);
            Binder.restoreCallingIdentity(origId);
            return res;
        }
    }

进入ActivityManagerService.broadcastIntentLocked方法

    final int broadcastIntentLocked(ProcessRecord callerApp,
            String callerPackage, Intent intent, String resolvedType,
            IIntentReceiver resultTo, int resultCode, String resultData,
            Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions,
            boolean ordered, boolean sticky, int callingPid, int callingUid, int userId) {
        .......        
        ........ 
        queue.enqueueOrderedBroadcastLocked(r);
        queue.scheduleBroadcastsLocked();
        ........  
        return ActivityManager.BROADCAST_SUCCESS;
    }

内部调用了broadcastIntentLocked方法。这个方法比较长，前面的流程是在判断是否是系统的广播，如果是系统的广播，则抛出安全权限异常。对动态，静态广播进行合并，获取所有接收该广播的广播接收器，然后封装到BroadcastRecord对象，并且添加到BroadcastQueue中。

scheduleBroadcastsLocked方法，发送了一个消息
public void scheduleBroadcastsLocked() {
    if (mBroadcastsScheduled) {
        return;
    }
    mHandler.sendMessage(mHandler.obtainMessage(BROADCAST_INTENT_MSG, this));
    mBroadcastsScheduled = true;
}

此处的handler的线程还是在AMS线程

        public void handleMessage(Message msg) {
            switch (msg.what) {
                case BROADCAST_INTENT_MSG: {
                    processNextBroadcast(true);
                } break;
                case BROADCAST_TIMEOUT_MSG: {
                    synchronized (mService) {
                        broadcastTimeoutLocked(true);
                    }
                } break;
            }
        }

processNextBroadcast方法也很长，是广播调度与派发的流程。

1. 进程在的情况下processCurBroadcastLocked
2. 进程不在则启动进程，记录要处理的广播mPendingBroadcast

final void processNextBroadcast(boolean fromMsg) {
    synchronized(mService) {
        BroadcastRecord r;
        .....
        // First, deliver any non-serialized broadcasts right away.
        while (mParallelBroadcasts.size() > 0) {
            r = mParallelBroadcasts.remove(0);
            r.dispatchTime = SystemClock.uptimeMillis();
            r.dispatchClockTime = System.currentTimeMillis(); 
            final int N = r.receivers.size();
              for (int i=0; i<N; i++) {
                Object target = r.receivers.get(i);
                if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
                        "Delivering non-ordered on [" + mQueueName + "] to registered "
                        + target + ": " + r);

                deliverToRegisteredReceiverLocked(r, (BroadcastFilter)target, false, i);

            }
            addBroadcastToHistoryLocked(r);
            if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST, "Done with parallel broadcast ["
                    + mQueueName + "] " + r);
        }

        ....
    }

 deliverToRegisteredReceiverLocked方法，主要里面调用了performReceiveLocked方法

void performReceiveLocked(ProcessRecord app, IIntentReceiver receiver,
        Intent intent, int resultCode, String data, Bundle extras,
        boolean ordered, boolean sticky, int sendingUser) throws RemoteException {
    // Send the intent to the receiver asynchronously using one-way binder calls.
    if (app != null) {
        if (app.thread != null) {
            // If we have an app thread, do the call through that so it is
            // correctly ordered with other one-way calls.
            try {

                app.thread.scheduleRegisteredReceiver(receiver, intent, resultCode,
                        data, extras, ordered, sticky, sendingUser, app.repProcState);

                } catch (RemoteException ex) {
            ....   
            }
      } 
}

调用了ActivityThread的scheduleRegisteredReceiver方法

public void scheduleRegisteredReceiver(IIntentReceiver receiver, Intent intent,
        int resultCode, String dataStr, Bundle extras, boolean ordered,
        boolean sticky, int sendingUser, int processState) throws RemoteException {
    updateProcessState(processState, false);
    receiver.performReceive(intent, resultCode, dataStr, extras, ordered,
            sticky, sendingUser);
}

这里调用了receiver的performReceive方法

public void performReceive(Intent intent, int resultCode, String data,
        Bundle extras, boolean ordered, boolean sticky, int sendingUser) {
    final Args args = new Args(intent, resultCode, data, extras, ordered,
            sticky, sendingUser);
        if (intent == null || !mActivityThread.post(args.getRunnable())) {
        if (mRegistered && ordered) {
            IActivityManager mgr = ActivityManager.getService();
            if (ActivityThread.DEBUG_BROADCAST) Slog.i(ActivityThread.TAG,
                    "Finishing sync broadcast to " + mReceiver);
            args.sendFinished(mgr);
        }
    }
}

post了一个Runnable，这个Runnable里面的代码就会调用我们的onReceive方法。

public final Runnable getRunnable() {
    return () -> {
        final BroadcastReceiver receiver = mReceiver;
        final IActivityManager mgr = ActivityManager.getService();
        final Intent intent = mCurIntent;
        mCurIntent = null;
        mDispatched = true;
        mPreviousRunStacktrace = new Throwable("Previous stacktrace");
        try {
            ClassLoader cl = mReceiver.getClass().getClassLoader();
            intent.setExtrasClassLoader(cl);
            intent.prepareToEnterProcess();
            setExtrasClassLoader(cl);
            receiver.setPendingResult(this);
            receiver.onReceive(mContext, intent);
        } catch (Exception e) {
          }
    };
}