BroadcastReceiver探讨之动态广播注册流程
BroadcastReceiver
博文来源于
BroadcastReceiver探讨之动态广播注册流程
csdn：linyh1992
源码：
frameworks/base/+/android-4.4.1_r1/core/java/android/app/ContextImpl.java
frameworks/base/+/android-4.4.1_r1/core/java/android/app/ActivityManagerNative.java
frameworks/base/+/android-4.4.1_r1/services/java/com/android/server/am/ActivityManagerService.java
frameworks/base/+/android-4.4.1_r1/core/java/android/app/LoadedApk.java
frameworks/base/+/android-4.4.1_r1/services/java/com/android/server/am/ReceiverList.java
frameworks/base/+/android-4.4.1_r1/services/java/com/android/server/am/BroadcastFilter.java
相关
在Android中，BroadcastReceiver是一套用来实现组件之间的通信机制，它是基于消息发布和订阅机制，可以用在不同线程之间组件的通信，也可以跨进程进行组件间通信。
在Android中，根据注册类型来看，BroadcastReceiver可以分为两种类型：静态广播和动态广播，其中静态广播中的广播中心是PMS(PackageManagerService)，而动态广播的广播中心是AMS（ActivityManagerService），这边文章主要是分析动态广播的。
动态BroadcastReceiver的注册是借助Context接口中的registerReceiver方法来实现的。其中，继承Context接口的类有：Activity，Service，Application，所以在这3个类中，都可以动态注册广播。此外，Context接口的实现类，是ContextImpl类。
在讨论BroadcastReceiver前，需要稍微了解下Android不同进程之间的通信，以及一些Android系统级的Service。
Android跨进程之间的通信，主要有Binder实现的IPC机制，匿名共享内存，socket等等，而广播的跨进程通信是使用Binder来实现的，通过Binder将App进程切换到system_server进程和AMS通信。
在手机开机的时候，Android启动了很多系统级的进程，比如zygote进程，system_server进程，其中在system_server进程上，又启动了很多服务，
比如PowerManagerService（电源管理服务），ActivityManagerService（管理四大组件）
下面，主要是通过探讨广播，主要是分为两部分，
用户进程和system_server进程，广播registerReceiver的流程
用户进程和system_server进程，广播底层的数据存储结构
广播在用户进程中的注册流程
Context.java
public abstract Intent registerReceiver(BroadcastReceiver receiver,IntentFilter filter);receiver： 广播接收组件，接收到相关的广播会调用BroadcastReceiver中的onReceive方法
filter：主要是用来过滤广播的，只有符合条件的广播才会接收.
registerReceiver方法最终是调用ContextImpl中的registerReceiverInternal方法
ContextImpl.java
private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId,
IntentFilter filter, String broadcastPermission,
Handler scheduler, Context context) {
IIntentReceiver rd = null;
if (receiver != null) {
if (mPackageInfo != null && context != null) {
if (scheduler == null) {
scheduler = mMainThread.getHandler();
}
rd = mPackageInfo.getReceiverDispatcher(
receiver, context, scheduler,
mMainThread.getInstrumentation(), true);
} else {
if (scheduler == null) {
scheduler = mMainThread.getHandler();
}
rd = new LoadedApk.ReceiverDispatcher(
receiver, context, scheduler, null, true).getIIntentReceiver();
}
}
try {
return ActivityManagerNative.getDefault().registerReceiver(
mMainThread.getApplicationThread(), mBasePackageName,
rd, filter, broadcastPermission, userId);
} catch (RemoteException e) {
return null;
}
}mPackageInfo：LoadedApk类型，保存了整个App内部的信息，比如包名，资源的路径，应用中所有启动的service，注册的reciver等等，用户进程（即一个应用进程）中，只会存在一个对象，所有ContextImpl中的mPackageInfo都指向共同的mPackageInfo对象，因此，mPackageInfo在整个用户进程中是唯一的。
registerReceiverInternal方法：
1，获取Handler类型的scheduler对象，如果scheduler不为null，则scheduler为用户传递进来的Handler，否则为主线程中的Hanlder（这也是为什么BroadcastReceiver中的onReceive方法调用是处于主线程的原因），这个Handler对象主要是用来分发AMS传递过来的Intent，
2，如果mPackageInfo存在，则通过mPackageInfo获取IIntentReceiver类型的rd对象，否则创建一个，rd同样也是Binder类型。然后，将rd传递给AMS，AMS处理相对应的广播，会通过这个Binder对象，跨进程回传到这个Context所处的进程中。
3，通过ActivityManagerNative.getDefault()获取到ActivityManagerProxy对象，然后借助ActivityManagerProxy对象，和AMS通信，这时候进程由用户进程切换到system_server进程，最终调用的是AMS中的registerReceiver方法。
scheduler = mMainThread.getHandler();mMainThread是ActivityThread对象，也可以说是主线程
这里有个疑惑，关于mPackageInfo，这个对象什么时候不存在？（以后再查看）按照我目前的理解，mPackageInfo最早是在Application创建的时候，就被初始化了，而context是当前的Activity，Service或者Application，所以符合条件(mPackageInfo != null && context != null)
rd = mPackageInfo.getReceiverDispatcher(receiver, context, scheduler, mMainThread.getInstrumentation(), true);LoadedApk
public IIntentReceiver getReceiverDispatcher(BroadcastReceiver r,
Context context, Handler handler,
Instrumentation instrumentation, boolean registered) {
synchronized (mReceivers) {
LoadedApk.ReceiverDispatcher rd = null;
ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher> map = null;
if (registered) {
map = mReceivers.get(context);
if (map != null) {
rd = map.get(r);
}
}
if (rd == null) {
rd = new ReceiverDispatcher(r, context, handler,
instrumentation, registered);
if (registered) {
if (map == null) {
map = new ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher>();
mReceivers.put(context, map);
}
map.put(r, rd);
}
} else {
rd.validate(context, handler);
}
rd.mForgotten = false;
return rd.getIIntentReceiver();
}
}
1，如果广播已经注册过，则通过mReceivers对象获取key为当前Context的LoadedApk.ReceiverDispatcher类型的rd对象
2，如果rd对象不存在，则创建，并且将rd添加到map中；否则，验证rd对象中的context和activitythread（validate这个方法有疑惑，什么场景下，rd中context和activitythread和目前的不一致）
3，返回rd对象的中IIntentReceiver对象
广播在用户进程中的底层数据存储
上面说过，在用户进程中所有ContextImpl中的mPackageInfo都指向同一对象。
mPackageInfo中存在维持一个ArrayMap的mReceivers变量，mReceivers是ArrayMap嵌套ArrayMap的数据结构
key：为注册的Context（即Activity，Service或者Application），
value：同样也是个ArrayMap，
key：注册的BroadcastReceiver
value：ReceiverDispatcher对象，广播分发者，该对象内部保存注册者的Context，Handler，BroadcastReceiver，IIntentReceiver.Stub（和用户进程交互的）等等，
发送广播时，AMS将会将Intent信息分发到BroadcastReceiver的onRecieve方法中。
mReceivers
private final ArrayMap<Context, ArrayMap<BroadcastReceiver, ReceiverDispatcher>> mReceivers
= new ArrayMap<Context, ArrayMap<BroadcastReceiver, LoadedApk.ReceiverDispatcher>>();LoadedApk.ReceiverDispatcher
final IIntentReceiver.Stub mIIntentReceiver;
final BroadcastReceiver mReceiver;
final Context mContext;
final Handler mActivityThread;
final Instrumentation mInstrumentation;
final boolean mRegistered;
final IntentReceiverLeaked mLocation;
RuntimeException mUnregisterLocation;
//....广播在AMS中的注册流程
try {
// 跨进程和AMS通信，广播的注册实际上是在AMS中执行的
return ActivityManagerNative.getDefault().registerReceiver(
mMainThread.getApplicationThread(), mBasePackageName,
rd, filter, broadcastPermission, userId);
} catch (RemoteException e) {
return null;
}ActivityManagerNative.getDefault()
public abstract class ActivityManagerNative extends Binder implements IActivityManager {
// ...省略
// 获取到唯一的
static public IActivityManager getDefault() {
return gDefault.get();
}
// ...省略
// Singleton是一个抽象类，Android实现的单例模式
private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
protected IActivityManager create() {
// 获取指向ActivityManagerService的IBinder对象
IBinder b = ServiceManager.getService("activity");
if (false) {
Log.v("ActivityManager", "default service binder = " + b);
}
// 创建ActivityManagerProxy对象，并将ActivityManagerService的Binder传递给ActivityManagerProxy
IActivityManager am = asInterface(b);
if (false) {
Log.v("ActivityManager", "default service = " + am);
}
return am;
}
};
// 创建一个ActivityManagerProxy对象
static public IActivityManager asInterface(IBinder obj) {
if (obj == null) {
return null;
}
IActivityManager in =
(IActivityManager)obj.queryLocalInterface(descriptor);
if (in != null) {
return in;
}
return new ActivityManagerProxy(obj);
}
}ActivityManagerNative.getDefault()第一次会创建一个AMP(ActivityManagerProxy)对象，并通过ServiceManager远程获取到一个指向AMS
的IBinder对象，并将这个IBinder引用传递给AMS对象，最后返回AMP对象，注意这个对象运行在用户进程中的，
ActivityManagerProxy中的IBinder引用是用来跨进程和AMS通信的。
ActivityManagerProxy.registerReceiver
public Intent registerReceiver(IApplicationThread caller, String packageName,
IIntentReceiver receiver,
IntentFilter filter, String perm, int userId) throws RemoteException
{
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
data.writeStrongBinder(caller != null ? caller.asBinder() : null);
data.writeString(packageName);
data.writeStrongBinder(receiver != null ? receiver.asBinder() : null);
filter.writeToParcel(data, 0);
data.writeString(perm);
data.writeInt(userId);
// 跨进程和AMS通信，注意Binder驱动会挂起当前用户线程
mRemote.transact(REGISTER_RECEIVER_TRANSACTION, data, reply, 0);
reply.readException();
Intent intent = null;
int haveIntent = reply.readInt();
if (haveIntent != 0) {
intent = Intent.CREATOR.createFromParcel(reply);
}
reply.recycle();
data.recycle();
return intent;
}很明显，这段代码是用来跨进程通信的。mRemote是一个IBinder对象，指向AMS的。
mRemote.transact(REGISTER_RECEIVER_TRANSACTION, data, reply, 0);Binder机制非常复杂，这里不做讨论。我们只需要知道IBinder.transact方法，会调用到IBinder.onTransact方法。
题外话：
这里有个疑惑，mRemote.transact会不会阻塞线程呢？仔细思考了下，应该会的，准确的来说，Binder驱动会挂起当前用户进程。
因为registerReceiver返回Intent对象，如果当前用户线程没有挂起的话，那么后面的代码就没意义了，比如reply.readException肯定没效果。
mRemote这个IBinder对象是指向AMS的，而AMS继承了ActivityManagerNative类，并且AMS的onTransact方法是由ActivityManagerNative实现的。
ActivityManagerNative.onTransact，注意调用这个方法的时候，进程已经从用户进程切换到system_server进程了。
@Override
public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
throws RemoteException {
switch (code) {
case REGISTER_RECEIVER_TRANSACTION:
{
data.enforceInterface(IActivityManager.descriptor);
IBinder b = data.readStrongBinder();
IApplicationThread app =
b != null ? ApplicationThreadNative.asInterface(b) : null;
String packageName = data.readString();
b = data.readStrongBinder();
IIntentReceiver rec
= b != null ? IIntentReceiver.Stub.asInterface(b) : null;
IntentFilter filter = IntentFilter.CREATOR.createFromParcel(data);
String perm = data.readString();
int userId = data.readInt();
// 调用AMS中的registerReceiver方法，这个方法是广播注册的最终实现
Intent intent = registerReceiver(app, packageName, rec, filter, perm, userId);
reply.writeNoException();
if (intent != null) {
reply.writeInt(1);
intent.writeToParcel(reply, 0);
} else {
reply.writeInt(0);
}
return true;
}
}ActivityManagerService.registerReceiver
public Intent registerReceiver(IApplicationThread caller, String callerPackage,
IIntentReceiver receiver, IntentFilter filter, String permission, int userId) {
enforceNotIsolatedCaller("registerReceiver");
int callingUid;
int callingPid;
synchronized(this) {
ProcessRecord callerApp = null;
if (caller != null) {
callerApp = getRecordForAppLocked(caller);
if (callerApp == null) {
throw new SecurityException(
"Unable to find app for caller " + caller
+ " (pid=" + Binder.getCallingPid()
+ ") when registering receiver " + receiver);
}
if (callerApp.info.uid != Process.SYSTEM_UID &&
!callerApp.pkgList.containsKey(callerPackage) &&
!"android".equals(callerPackage)) {
throw new SecurityException("Given caller package " + callerPackage
+ " is not running in process " + callerApp);
}
callingUid = callerApp.info.uid;
callingPid = callerApp.pid;
} else {
callerPackage = null;
callingUid = Binder.getCallingUid();
callingPid = Binder.getCallingPid();
}
userId = this.handleIncomingUser(callingPid, callingUid, userId,
true, true, "registerReceiver", callerPackage);
List allSticky = null;
// Look for any matching sticky broadcasts...
Iterator actions = filter.actionsIterator();
if (actions != null) {
while (actions.hasNext()) {
String action = (String)actions.next();
allSticky = getStickiesLocked(action, filter, allSticky,
UserHandle.USER_ALL);
allSticky = getStickiesLocked(action, filter, allSticky,
UserHandle.getUserId(callingUid));
}
} else {
allSticky = getStickiesLocked(null, filter, allSticky,
UserHandle.USER_ALL);
allSticky = getStickiesLocked(null, filter, allSticky,
UserHandle.getUserId(callingUid));
}
// The first sticky in the list is returned directly back to
// the client.
Intent sticky = allSticky != null ? (Intent)allSticky.get(0) : null;
if (DEBUG_BROADCAST) Slog.v(TAG, "Register receiver " + filter
+ ": " + sticky);
if (receiver == null) {
return sticky;
}
ReceiverList rl
= (ReceiverList)mRegisteredReceivers.get(receiver.asBinder());
if (rl == null) {
rl = new ReceiverList(this, callerApp, callingPid, callingUid,
userId, receiver);
if (rl.app != null) {
rl.app.receivers.add(rl);
} else {
try {
receiver.asBinder().linkToDeath(rl, 0);
} catch (RemoteException e) {
return sticky;
}
rl.linkedToDeath = true;
}
mRegisteredReceivers.put(receiver.asBinder(), rl);
} else if (rl.uid != callingUid) {
throw new IllegalArgumentException(
"Receiver requested to register for uid " + callingUid
+ " was previously registered for uid " + rl.uid);
} else if (rl.pid != callingPid) {
throw new IllegalArgumentException(
"Receiver requested to register for pid " + callingPid
+ " was previously registered for pid " + rl.pid);
} else if (rl.userId != userId) {
throw new IllegalArgumentException(
"Receiver requested to register for user " + userId
+ " was previously registered for user " + rl.userId);
}
BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage,
permission, callingUid, userId);
rl.add(bf);
if (!bf.debugCheck()) {
Slog.w(TAG, "==> For Dynamic broadast");
}
mReceiverResolver.addFilter(bf);
// Enqueue broadcasts for all existing stickies that match
// this filter.
if (allSticky != null) {
ArrayList receivers = new ArrayList();
receivers.add(bf);
int N = allSticky.size();
for (int i=0; i<N; i++) {
Intent intent = (Intent)allSticky.get(i);
BroadcastQueue queue = broadcastQueueForIntent(intent);
BroadcastRecord r = new BroadcastRecord(queue, intent, null,
null, -1, -1, null, null, AppOpsManager.OP_NONE, receivers, null, 0,
null, null, false, true, true, -1);
queue.enqueueParallelBroadcastLocked(r);
queue.scheduleBroadcastsLocked();
}
}
return sticky;
}
}1，首先会获取应用的uid和pid，然后调用handleIncomingUser检测注册广播所需的权限，并获取userId
2，检测所有符合条件的黏性事件，如果广播为null，则返回最近的一条黏性事件
3，通过mRegisteredReceivers获取key为receiver(IBinder对象，从用户进程中传递进来的IIntentReceiver对象)，获取相关的ReceiverList;
如果ReceiverList为null，则创建，并添加到mRegisteredReceivers中4，创建BroadcastFilter（继承IntentFilter）对象，并添加进入到ReceiverList中
5，处理符合条件的黏性事件（这里暂不探讨）
广播在AMS中的底层数据存储
ReceiverList：继承ArrayList，存储的是BroadcastFilter对象
BroadcastFilter：继承IntentFilter，主要是用来过滤广播的，广播接收器只能接收指定的广播类型
AMS中维持一个mRegisteredReceivers变量的HashMap
final HashMap<IBinder, ReceiverList> mRegisteredReceivers =
new HashMap<IBinder, ReceiverList>();mRegisteredReceivers的数据结构是HashMap
key：IBinder,也就是ReceiverDispatcher中的IIntentReceiver对象，是用于AMS和用户进程通信的
value：ReceiverList，存储一系列的BroadcastFilter的List
mReceiverResolver：存储对应的BroadcastFilter
动态广播注册的底层数据存储
参考：
Android应用程序注册广播接收器（registerReceiver）的过程分析
四大组件的工作过程
Android中Context详解 —- 你所不知道的Context
品茗论道说广播(Broadcast内部机制讲解)(上)
Android 内核–Context对象