Android 广播

订阅 BroadcastReceiver 用于事务通知，包括系统广播和自定义广播，注册方式分静态注册和动态注册。
静态注册，写在 AndroidMainfest.xml 文件中。
动态注册，通过代码，注册广播接收器后，App 实现广播接收器 onReceive() 方法，在通知端发送广播即可。

一、动态注册

App 进程中广播注册代码。

ConnectivityReceiver connectivityReceiver = new ConnectivityReceiver();
IntentFilter filter = new IntentFilter();
filter.addAction(android.net.ConnectivityManager.CONNECTIVITY_ACTION);
filter.addAction("android.media.VOLUME_CHANGED_ACTION");
registerReceiver(connectivityReceiver, filter);

自定义 BroadcastReceiver，设置 IntentFilter，匹配规则，registerReceiver() 方法注册，该接收器监听网络连接情况和音量改变的动作，属于系统广播，当系统监听到两者发生改变时，发出广播， App 的接收器，收到通知，onReceive() 方法。
一般在 Activity 或 Service 组件中注册，调用装饰者基类 ContextWrapper 的 registerReceiver() 方法。

@Override
public Intent registerReceiver(BroadcastReceiver receiver, IntentFilter filter) {
    return mBase.registerReceiver(receiver, filter);
}

装饰者内部真实类 ContextImpl，实现 registerReceiver() 抽象方法。

@Override
public Intent registerReceiver(BroadcastReceiver receiver, IntentFilter filter) {
    return registerReceiver(receiver, filter, null, null);
}

App 进程，注册广播接收器最终调用 ContextImpl 的 registerReceiverInternal() 方法。

private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId,
                        IntentFilter filter, String broadcastPermission,
                        Handler scheduler, Context context) {
    IIntentReceiver rd = null;
    if (receiver != null) {
        if (mPackageInfo != null && context != null) {
            if (scheduler == null) {
                scheduler = mMainThread.getHandler();
            }
            //LoadedApk的方法获取IIntentReceiver
            rd = mPackageInfo.getReceiverDispatcher(
                    receiver, context, scheduler,
                    mMainThread.getInstrumentation(), true);
        } else {
            if (scheduler == null) {
                scheduler = mMainThread.getHandler();
            }
            rd = new LoadedApk.ReceiverDispatcher(
                    receiver, context, scheduler, null, true).getIIntentReceiver();
        }
    }
    try {
        return ActivityManagerNative.getDefault().registerReceiver(
                mMainThread.getApplicationThread(), mBasePackageName,
                rd, filter, broadcastPermission, userId);
    } catch (RemoteException e) {
        return null;
    }
}

调用 ActivityManagerNative 的 registerReceiver() 方法，向 Ams 服务注册广播。
注册参数中，先获取 IIntentReceiver rd，Binder 对象，在 Ams 回调 App 进程，和 ApplicationThread 相似。
LoadedApk 类 getReceiverDispatcher() 方法。

public IIntentReceiver getReceiverDispatcher(BroadcastReceiver r,
                        Context context, Handler handler,
                        Instrumentation instrumentation, boolean registered) {
    synchronized (mReceivers) {
        ReceiverDispatcher rd = null;
        ArrayMap<BroadcastReceiver, ReceiverDispatcher> map = null;
        if (registered) {
            map = mReceivers.get(context);
            //该组件的 Map 存在，根据BroadcastReceiver查找ReceiverDispatcher。
            if (map != null) {
                rd = map.get(r);
            }
        }
        //未找到ReceiverDispatcher则新建。
        if (rd == null) {
            rd = new ReceiverDispatcher(r, context, handler,
                    instrumentation, registered);
            if (registered) {
                //存储在ArrayMap，对应BroadcastReceiver
                if (map == null) {
                    map = new ArrayMap<BroadcastReceiver, ReceiverDispatcher>();
                    mReceivers.put(context, map);//存入mReceivers
                }
                map.put(r, rd);
            }
        } else {
            rd.validate(context, handler);
        }
        rd.mForgotten = false;
        return rd.getIIntentReceiver();
    }
}

当前组件上下文 Context 作为 key 在 mReceivers 查找 ArrayMap，即通过它注册的广播，ArrayMap<BroadcastReceiver, ReceiverDispatcher>。

根据 BroadcastReceiver key，在 ArrayMap 中查找 ReceiverDispatcher 接收分发者，或者新建。

ReceiverDispatcher(BroadcastReceiver receiver, Context context,
                Handler activityThread, Instrumentation instrumentation,
                boolean registered) {
    ....
    //引用InnerReceiver
    mIIntentReceiver = new InnerReceiver(this, !registered);
    mReceiver = receiver;//广播接收时使用的接收器
    mContext = context;//接收器入参
    mActivityThread = activityThread;
    ..
}

ReceiverDispatcher 构造方法，引用 InnerReceiver 和 BroadcastReceiver，其中，InnerReceiver 继承 IIntentReceiver #Stub ，作为 Binder 服务端口。

接收器 ReceiverDispatcher 分发者

二、Ams 注册广播

Ams 服务方法。

public Intent registerReceiver(IApplicationThread caller, String callerPackage,
                IIntentReceiver receiver, IntentFilter filter, 
                String permission, int userId) {
    ArrayList<Intent> stickyIntents = null;
    ProcessRecord callerApp = null;
    int callingUid;//调用者进程Uid
    int callingPid;//调用者进程Pid
    synchronized(this) {
        if (caller != null) {
            callerApp = getRecordForAppLocked(caller);
            //ProcessRecord调用进程是空，报出异常。
            ....
            callingUid = callerApp.info.uid;
            callingPid = callerApp.pid;
        } else {
            callerPackage = null;
            callingUid = Binder.getCallingUid();
            callingPid = Binder.getCallingPid();
        }

        userId = handleIncomingUser(callingPid, callingUid, userId,
                true, ALLOW_FULL_ONLY, "registerReceiver", callerPackage);
        //从IntentFilter中读取Action列表
        Iterator<String> actions = filter.actionsIterator();
        if (actions == null) {
            ArrayList<String> noAction = new ArrayList<String>(1);
            noAction.add(null);
            actions = noAction.iterator();
        }
        //按照userId与Action遍历，加入Intent列表stickyIntents
        int[] userIds = { UserHandle.USER_ALL, UserHandle.getUserId(callingUid) };
        while (actions.hasNext()) {
            String action = actions.next();
            for (int id : userIds) {
                ArrayMap<String, ArrayList<Intent>> stickies = mStickyBroadcasts.get(id);
                if (stickies != null) {
                    ArrayList<Intent> intents = stickies.get(action);
                    if (intents != null) {
                        if (stickyIntents == null) {
                            stickyIntents = new ArrayList<Intent>();
                        }
                        stickyIntents.addAll(intents);
                    }
                }
            }
        }
    }
    //找到匹配的Intent放入allSticky列表
    ArrayList<Intent> allSticky = null;
    if (stickyIntents != null) {
        final ContentResolver resolver = mContext.getContentResolver();
        for (int i = 0, N = stickyIntents.size(); i < N; i++) {
            Intent intent = stickyIntents.get(i);
            if (filter.match(resolver, intent, true, TAG) >= 0) {
                if (allSticky == null) {
                    allSticky = new ArrayList<Intent>();
                }
                allSticky.add(intent);
            }
        }
    }
      
    Intent sticky = allSticky != null ? allSticky.get(0) : null;
    if (receiver == null) {
        return sticky;
    }

    //BroadcastFilter写入Map
}

SparseArray 类型的 mStickyBroadcasts，根据 userId 保存一个 ArrayMap。它是 Action 对应 Intent 列表。BroadcastReceiver 广播可以注册监听多个行为，在匹配者 IntentFilter 中可增加多个 Action，将每个 Action 对应的 Intent 列表加入 stickyIntents 中。下面还是相关代码段。

...
synchronized (this) {
    ...
    ReceiverList rl = mRegisteredReceivers.get(receiver.asBinder());
    if (rl == null) {
        rl = new ReceiverList(this, callerApp, callingPid, callingUid,
                userId, receiver);
        if (rl.app != null) {
            rl.app.receivers.add(rl);
        } else {
            try {
                receiver.asBinder().linkToDeath(rl, 0);
            } catch (RemoteException e) {
                return sticky;
            }
            rl.linkedToDeath = true;
        }
        mRegisteredReceivers.put(receiver.asBinder(), rl);
    } else if (rl.uid != callingUid) {
        //抛出异常
    } 
    ...
    BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage,
            permission, callingUid, userId);
    rl.add(bf);

    mReceiverResolver.addFilter(bf);

    if (allSticky != null) {
        ArrayList receivers = new ArrayList();
        receivers.add(bf);

        final int stickyCount = allSticky.size();
        for (int i = 0; i < stickyCount; i++) {
            Intent intent = allSticky.get(i);
            BroadcastQueue queue = broadcastQueueForIntent(intent);
            BroadcastRecord r = new BroadcastRecord(queue, intent, null,
                    null, -1, -1, null, null, AppOpsManager.OP_NONE, null, receivers,
                    null, 0, null, null, false, true, true, -1);
            queue.enqueueParallelBroadcastLocked(r);
            queue.scheduleBroadcastsLocked();
        }
    }

    return sticky;
}

HashMap 类的 mRegisteredReceivers，key 是 IIntentReceiver，Binder 类型，代表 App 进程注册的广播接收器，value 是 BroadcastFilter 列表 ReceiverList，每一个 BroadcastFilter 对象代表接收器监听的一个行为。新建 BroadcastFilter，加到 ReceiverList 列表。

final HashMap<IBinder, ReceiverList> mRegisteredReceivers = new HashMap<>();

存储一个 Binder 与 ReceiverList 的 Map。Binder 是 IIntentReceiver 类型。
ReceiverList 是 BroadcastFilter 类型的列表，内部包含 IIntentReceiver 和 ProcessRecord。
动态注册结束。

三、发送广播

自定义的广播，通知接收器时，调用 sendBroadcast() 方法。

@Override
public void sendBroadcast(Intent intent) {
    mBase.sendBroadcast(intent);
}

ContextImpl 的 sendBroadcast() 方法。

@Override
public void sendBroadcast(Intent intent) {
    ...
    String resolvedType = intent.resolveTypeIfNeeded(getContentResolver());
    try {
        intent.prepareToLeaveProcess();
        ActivityManagerNative.getDefault().broadcastIntent(
                    mMainThread.getApplicationThread(), intent, resolvedType, null,
                    android.app.Activity.RESULT_OK, null, null, null, AppOpsManager.OP_NONE, null, false, false,
                    getUserId());
    } catch (RemoteException e) {  
    }
}

Ams 服务 broadcastIntent() 方法。

public final int broadcastIntent(IApplicationThread caller,
                    Intent intent, String resolvedType, IIntentReceiver resultTo,
                    int resultCode, String resultData, Bundle resultExtras,
                    String[] requiredPermissions, int appOp, Bundle options,
                    boolean serialized, boolean sticky, int userId) {
    synchronized(this) {
        ...
        int res = broadcastIntentLocked(callerApp,
                callerApp != null ? callerApp.info.packageName : null,
                intent, resolvedType, resultTo, resultCode, resultData, resultExtras,
                requiredPermissions, appOp, null, serialized, sticky,
                callingPid, callingUid, userId);
        ...
        return res;
    }
}

成功将返回 ActivityManager.BROADCAST_SUCCESS，最后会触发BroadcastQueue 的 performReceiveLocked() 方法，传给 performReceiveLocked 的参数ProcessRecord，IIntentReceiver 和 Intent 等来自BroadcastRecord对象。
然后，通过 ProcessRecord 的 ApplicationThread 回调 App 进程。
scheduleRegisteredReceiver() 方法，入参包括 IIntentReceiver 对象。

public void scheduleRegisteredReceiver(IIntentReceiver receiver, Intent intent,
                int resultCode, String dataStr, Bundle extras, boolean ordered,
                boolean sticky, int sendingUser, int processState) throws RemoteException {
    updateProcessState(processState, false);
    receiver.performReceive(intent, resultCode, dataStr, extras, ordered,
                    sticky, sendingUser);
}

调用 IIntentReceiver 的 performReceive() 方法，在 ReceiverDispatcher 内部，通过 get() 方法，获取弱引用外部 ReceiverDispatcher 对象，performReceive() 方法。

public void performReceive(Intent intent, int resultCode, String data,
                    Bundle extras, boolean ordered, boolean sticky, int sendingUser) {
    ReceiverDispatcher rd = mDispatcher.get();          
    if (rd != null) {
        rd.performReceive(intent, resultCode, data, extras,ordered, sticky, sendingUser);
    } else {       
    }
}

在 App 进程执行 ReceiverDispatcher 的 performReceive() 方法，实现广播分发。

public void performReceive(Intent intent, int resultCode, String data,
                Bundle extras, boolean ordered, boolean sticky, int sendingUser) {
    Args args = new Args(intent, resultCode, data, extras, ordered,
                    sticky, sendingUser);
    if (!mActivityThread.post(args)) {
        if (mRegistered && ordered) {
            IActivityManager mgr = ActivityManagerNative.getDefault();
            args.sendFinished(mgr);
        }
    }
}

该方法中的 mActivityThread 是 ActivityThread 中的 H 对象。Args 是 Runnable 类，post 方法，将发送一个消息到主线程队列，主线程触发 Args 的 run 方法。
Args 类是 ReceiverDispatcher 内部类，run 方法，获取 ReceiverDispatcher 内部保存的 BroadcastReceiver，触发 onReceiver 方法，到这里，终于到达了我们的广播接收器方法。入参 Context 是 ReceiverDispatcher 内部的 Context，即初始化注册广播的组件。

onReceive(Context context, Intent intent);

三、总结

当系统监控到注册接收器匹配的行为发生时，在 Ams 服务，会根据行为 Action 查找注册接收器的那个 App 进程对应的 IIntentReceiver，Ams 服务回调 App 进程，根据回调参数 IIntentReceiver，在 App 进程查找分发者，实现广播接收器的分发回调。

任重而道远