devbox
不正经
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Android13 广播发送流程分析_android suppress to broadcast intent

作者：不正经 | 2024-03-25 09:15:09

赞

踩

android suppress to broadcast intent

一、广播相关概念

广播分类

1、标准广播：异步广播，广播发出后，所有注册了的广播接收器都会同时接收到该广播。打个比方：做地铁过程中的语音播报，当列车员(广播发出者)进行语音播报(发送广播)时，所有乘客(注册接收该广播的程序)都可以同时听到语音，不分先后顺序。

sendBroadcast(); 

2、有序广播：同步发送，广播发出后，按照注册了的广播接收器的优先级顺序广播，优先级的范围是-1000~1000，数字越大，优先级越高，最先接收到该广播，接收器的优先级通过android:priority设置，并且先收到广播的可以修改或者抛弃该广播，后面优先级小的接收器就无法收到了。同级别的广播，动态优先于静态；同级别同类型的广播，静态：先扫描的优先于后扫描的，动态：先注册的优先于后注册的。

sendOrderedBroadcast();

3、粘性广播：粘性广播的机制就是发送广播的时候如果没有找到接收器，就会先保存下来，等有广播接收器注册的时候，再把之前保存的广播发出去。因为从Android 5.0(API 21)开始，因为安全性的问题，官方已经正式废弃了粘性广播。

 sendStickyBroadcast();

 广播注册方式
1、动态注册：在Context(即Service或Activity)组件中注册，通过registerReceiver()方法注册，在不使用时取消注册unregisterReceiver()。如果广播发送的时候注册Broadcast的组件没有启动的话，是收不到广播的。

2、 静态注册：在AndroidManifest.xml中注册，并在intent-filter中添加响应的action，并新建一个Broadcast组件类来处理注册广播。如果广播发送的时候Broadcast的组件类进程没有启动的话，会收到广播并启动进程。

具体实现可参考Android的有序广播和无序广播（解决安卓8.0版本之后有序广播的接收问题） 区分了Android8.0前后的实现方式。

前台广播及后台广播
前台广播：在广播发送的时候添加Intent.FLAG_RECEIVER_FOREGROUND flag。
后台广播：在广播发送的时候没有Intent.FLAG_RECEIVER_FOREGROUND flag。

默认情况下，Intent是不带Intent.FLAG_RECEIVER_FOREGROUND 的flag的，所以我们默认使用的都是后台广播。

二、广播发送流程

1、调用ContextImpl的sendBroadcast发送广播

frameworks/base/core/java/android/app/ContextImpl.java

    @Override
    public void sendBroadcast(Intent intent) {
        warnIfCallingFromSystemProcess();
        String resolvedType = intent.resolveTypeIfNeeded(getContentResolver());
        try {
            //准备离开现有进程
            intent.prepareToLeaveProcess(this);
            //调用 AMS 的broadcastIntentWithFeature方法 
            ActivityManager.getService().broadcastIntentWithFeature(
                    mMainThread.getApplicationThread(), getAttributionTag(), intent, resolvedType,
                    null, Activity.RESULT_OK, null, null, null, null /*excludedPermissions=*/,
                    null, AppOpsManager.OP_NONE, null, false/**表示非有序**/, false/**表示非粘性**/, getUserId());
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }
2、调用AMS的broadcastIntentWithFeature方法 

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    @Override
    public final int broadcastIntentWithFeature(IApplicationThread caller, String callingFeatureId,
            Intent intent, String resolvedType, IIntentReceiver resultTo,
            int resultCode, String resultData, Bundle resultExtras,
            String[] requiredPermissions, String[] excludedPermissions,
            String[] excludedPackages, int appOp, Bundle bOptions,
            boolean serialized, boolean sticky, int userId) {
        enforceNotIsolatedCaller("broadcastIntent");
        synchronized(this) {
            // 验证广播的有效性
            intent = verifyBroadcastLocked(intent);
            final ProcessRecord callerApp = getRecordForAppLOSP(caller);
            final int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();

       //保留原始的origId  
       final long origId = Binder.clearCallingIdentity();

            /// M: DuraSpeed @{
            String suppressAction = mAmsExt.onReadyToStartComponent(
                        callerApp != null ? callerApp.info.packageName : null, callingUid,
                        "broadcast", null);
            if ((suppressAction != null) && suppressAction.equals("skipped")) {
                Binder.restoreCallingIdentity(origId);
                Slog.d(TAG, "broadcastIntentWithFeature, suppress to broadcastIntent!");
                return ActivityManager.BROADCAST_SUCCESS;
            }
            /// @}

            try {
                return broadcastIntentLocked(callerApp,
                        callerApp != null ? callerApp.info.packageName : null, callingFeatureId,
                        intent, resolvedType, resultTo, resultCode, resultData, resultExtras,
                        requiredPermissions, excludedPermissions, excludedPackages, appOp, bOptions,
                        serialized, sticky, callingPid, callingUid, callingUid, callingPid, userId);
            } finally {
                //恢复origId
                Binder.restoreCallingIdentity(origId);
            }
        }
    }

 单独罗列 verifyBroadcastLocked 方法:

    final Intent verifyBroadcastLocked(Intent intent) {
        // Refuse possible leaked file descriptors
        // 拒绝存在有文件描述符的intent
        if (intent != null && intent.hasFileDescriptors() == true) {
            throw new IllegalArgumentException("File descriptors passed in Intent");
        }

        int flags = intent.getFlags();

        if (!mProcessesReady) { //系统还没有准备好,表示还没有调用systemReady 函数.

            // if the caller really truly claims to know what they're doing, go
            // ahead and allow the broadcast without launching any receivers

            if ((flags&Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT) != 0) {
                //包含Intent.FLAG_RECEIVER_REGISTERED_ONLY的flag,可以继续往下走.
                // This will be turned into a FLAG_RECEIVER_REGISTERED_ONLY later on if needed.
            } else if ((flags&Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
                Slog.e(TAG, "Attempt to launch receivers of broadcast intent " + intent
                        + " before boot completion");
                throw new IllegalStateException("Cannot broadcast before boot completed");
            }
        }

        if ((flags&Intent.FLAG_RECEIVER_BOOT_UPGRADE) != 0) {
          //禁止携带Intent.FLAG_RECEIVER_BOOT_UPGRADE flag
            throw new IllegalArgumentException(
                    "Can't use FLAG_RECEIVER_BOOT_UPGRADE here");
        }

        if ((flags & Intent.FLAG_RECEIVER_FROM_SHELL) != 0) {
            switch (Binder.getCallingUid()) {
                case ROOT_UID:
                case SHELL_UID:
                    break;
                default:
// 若不是ROOT和SHELL用户,则移除 Intent.FLAG_RECEIVER_FROM_SHELL flag
                    Slog.w(TAG, "Removing FLAG_RECEIVER_FROM_SHELL because caller is UID "
                            + Binder.getCallingUid());
                    intent.removeFlags(Intent.FLAG_RECEIVER_FROM_SHELL);
                    break;
            }
        }

        return intent;
    }

  单独罗列 getRecordForAppLOSP 方法:

    @GuardedBy(anyOf = {"this", "mProcLock"})
    ProcessRecord getRecordForAppLOSP(IApplicationThread thread) {
        if (thread == null) {
            return null;
        }

        ProcessRecord record = mProcessList.getLRURecordForAppLOSP(thread);
        if (record != null) return record;

        // Validation: if it isn't in the LRU list, it shouldn't exist, but let's  double-check that.

        final IBinder threadBinder = thread.asBinder();
        final ArrayMap<String, SparseArray<ProcessRecord>> pmap =
                mProcessList.getProcessNamesLOSP().getMap();

        for (int i = pmap.size()-1; i >= 0; i--) {
            final SparseArray<ProcessRecord> procs = pmap.valueAt(i);
            for (int j = procs.size()-1; j >= 0; j--) {
                final ProcessRecord proc = procs.valueAt(j);
                final IApplicationThread procThread = proc.getThread();
                if (procThread != null && procThread.asBinder() == threadBinder) {
                    Slog.wtf(TAG, "getRecordForApp: exists in name list but not in LRU list: "
                            + proc);
                    return proc;
                }
            }
        }

        return null;
    }

3、调用AMS的broadcastIntentLocked方法
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
3.1 系统广播处理broadcastIntentLocked
  1.     @GuardedBy("this")
  2.     final int broadcastIntentLocked(ProcessRecord callerApp, String callerPackage,
  3.             @Nullable String callerFeatureId, Intent intent, String resolvedType,
  4.             IIntentReceiver resultTo, int resultCode, String resultData,
  5.             Bundle resultExtras, String[] requiredPermissions,
  6.             String[] excludedPermissions, String[] excludedPackages, int appOp, Bundle bOptions,
  7.             boolean ordered, boolean sticky, int callingPid, int callingUid,
  8.             int realCallingUid, int realCallingPid, int userId,
  9.             boolean allowBackgroundActivityStarts,
  10.             @Nullable IBinder backgroundActivityStartsToken,
  11.             @Nullable int[] broadcastAllowList) {
  12.         intent = new Intent(intent);
  13.          //判断是InstantApp
  14.         final boolean callerInstantApp = isInstantApp(callerApp, callerPackage, callingUid);
  15.  
  16.         // Instant Apps cannot use FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS
  17.         if (callerInstantApp) {
  18.           //取消FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS flag标记
  19.             intent.setFlags(intent.getFlags() & ~Intent.FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS);
  20.         }
  21.  
  22.         if (userId == UserHandle.USER_ALL && broadcastAllowList != null) {
  23.                 Slog.e(TAG, "broadcastAllowList only applies when sending to individual users. "
  24.                         + "Assuming restrictive whitelist.");
  25.                // userId是USER_ALL ,则不需要此限制.
  26.                 broadcastAllowList = new int[]{};
  27.         }
  28.  
  29.         // By default broadcasts do not go to stopped apps.
  30.         //默认情况下,不会像已经停止的应用发送广播.
  31.         intent.addFlags(Intent.FLAG_EXCLUDE_STOPPED_PACKAGES);
  32.  
  33.         // If we have not finished booting, don't allow this to launch new processes.
  34.         //开机完成之前,不允许开启新的进程.
  35.  
  36.         if (!mProcessesReady && (intent.getFlags()&Intent.FLAG_RECEIVER_BOOT_UPGRADE) == 0) {
  37.             intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
  38.         }
  39.  
  40.         //告知广播的类型
  41.         if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST,
  42.                 (sticky ? "Broadcast sticky: ": "Broadcast: ") + intent
  43.                 + " ordered=" + ordered + " userid=" + userId);
  44.         if ((resultTo != null) && !ordered) {
  45.             Slog.w(TAG, "Broadcast " + intent + " not ordered but result callback requested!");
  46.         }
  47.  
  48.         userId = mUserController.handleIncomingUser(callingPid, callingUid, userId, true,
  49.                 ALLOW_NON_FULL, "broadcast", callerPackage);
  50.  
  51.         // Make sure that the user who is receiving this broadcast or its parent is running.
  52.         // If not, we will just skip it. Make an exception for shutdown broadcasts, upgrade steps.
  53.  
  54.         if (userId != UserHandle.USER_ALL && !mUserController.isUserOrItsParentRunning(userId)) {
  55.             if ((callingUid != SYSTEM_UID
  56.                     || (intent.getFlags() & Intent.FLAG_RECEIVER_BOOT_UPGRADE) == 0)
  57.                     && !Intent.ACTION_SHUTDOWN.equals(intent.getAction())) {
  58.                 Slog.w(TAG, "Skipping broadcast of " + intent
  59.                         + ": user " + userId + " and its parent (if any) are stopped");
  60.                 return ActivityManager.BROADCAST_FAILED_USER_STOPPED;
  61.             }
  62.         }
  63.  
  64.         final String action = intent.getAction();
  65.         BroadcastOptions brOptions = null;
  66.         if (bOptions != null) {
  67.             brOptions = new BroadcastOptions(bOptions);
  68.             if (brOptions.getTemporaryAppAllowlistDuration() > 0) {
  69.                 // See if the caller is allowed to do this.  Note we are checking against
  70.                 // the actual real caller (not whoever provided the operation as say a
  71.                 // PendingIntent), because that who is actually supplied the arguments.
  72.                 
  73. //判断权限是否赋于
  74. if (checkComponentPermission(CHANGE_DEVICE_IDLE_TEMP_WHITELIST,
  75.                         realCallingPid, realCallingUid, -1, true)
  76.                         != PackageManager.PERMISSION_GRANTED
  77.                         && checkComponentPermission(START_ACTIVITIES_FROM_BACKGROUND,
  78.                         realCallingPid, realCallingUid, -1, true)
  79.                         != PackageManager.PERMISSION_GRANTED
  80.                         && checkComponentPermission(START_FOREGROUND_SERVICES_FROM_BACKGROUND,
  81.                         realCallingPid, realCallingUid, -1, true)
  82.                         != PackageManager.PERMISSION_GRANTED) {
  83.                     String msg = "Permission Denial: " + intent.getAction()
  84.                             + " broadcast from " + callerPackage + " (pid=" + callingPid
  85.                             + ", uid=" + callingUid + ")"
  86.                             + " requires "
  87.                             + CHANGE_DEVICE_IDLE_TEMP_WHITELIST + " or "
  88.                             + START_ACTIVITIES_FROM_BACKGROUND + " or "
  89.                             + START_FOREGROUND_SERVICES_FROM_BACKGROUND;
  90.                     Slog.w(TAG, msg);
  91.                     throw new SecurityException(msg);
  92.                 }
  93.             }
  94.             // 不能发送给受限的应用
  95.             if (brOptions.isDontSendToRestrictedApps()
  96.                     && !isUidActiveLOSP(callingUid)
  97.                     && isBackgroundRestrictedNoCheck(callingUid, callerPackage)) {
  98.                 Slog.i(TAG, "Not sending broadcast " + action + " - app " + callerPackage
  99.                         + " has background restrictions");
  100.                 return ActivityManager.START_CANCELED;
  101.             }
  102.  
  103.             if (brOptions.allowsBackgroundActivityStarts()) {
  104.                 // See if the caller is allowed to do this.  Note we are checking against
  105.                 // the actual real caller (not whoever provided the operation as say a
  106.                 // PendingIntent), because that who is actually supplied the arguments.
  107.                 
  108.                  //权限没有赋于
  109.                  if (checkComponentPermission(
  110.                         android.Manifest.permission.START_ACTIVITIES_FROM_BACKGROUND,
  111.                         realCallingPid, realCallingUid, -1, true)
  112.                         != PackageManager.PERMISSION_GRANTED) {
  113.                     String msg = "Permission Denial: " + intent.getAction()
  114.                             + " broadcast from " + callerPackage + " (pid=" + callingPid
  115.                             + ", uid=" + callingUid + ")"
  116.                             + " requires "
  117.                             + android.Manifest.permission.START_ACTIVITIES_FROM_BACKGROUND;
  118.                     Slog.w(TAG, msg);
  119.                     throw new SecurityException(msg);
  120.                 } else {
  121.                     allowBackgroundActivityStarts = true;
  122.                     // We set the token to null since if it wasn't for it we'd allow anyway here
  123.                     backgroundActivityStartsToken = null;
  124.                 }
  125.             }
  126.         }
  127.  
  128.         // Verify that protected broadcasts are only being sent by system code,
  129.         // and that system code is only sending protected broadcasts.
  130.         final boolean isProtectedBroadcast;
  131.         //判断受保护的广播
  132.         try {
  133.             isProtectedBroadcast = AppGlobals.getPackageManager().isProtectedBroadcast(action);
  134.         } catch (RemoteException e) {
  135.             Slog.w(TAG, "Remote exception", e);
  136.             return ActivityManager.BROADCAST_SUCCESS;
  137.         }
  138.  
  139.         final boolean isCallerSystem;
  140.         switch (UserHandle.getAppId(callingUid)) {
  141.             case ROOT_UID:
  142.             case SYSTEM_UID:
  143.             case PHONE_UID:
  144.             case BLUETOOTH_UID:
  145.             case NFC_UID:
  146.             case SE_UID:
  147.             case NETWORK_STACK_UID:
  148.                 isCallerSystem = true;
  149.                 break;
  150.             default:
  151.                 //TINNO BEGIN
  152.                 //DATE20221208,  Modify By XIBIN,DGF-1148
  153.                 isCallerSystem = (callerApp != null) && callerApp.isPersistent()
  154.                 ||("com.android.systemui".equals(callerPackage) && "com.android.settings.flashlight.action.FLASHLIGHT_CHANGED".equals(action));
  155.                 //TINNO END
  156.                 break;
  157.         }
  158.  
  159.         // First line security check before anything else: stop non-system apps from   sending protected broadcasts.
  160.         // 非系统应用阻止发送系统广播
  161.         if (!isCallerSystem) {
  162.  
  163.             if (isProtectedBroadcast) {
  164.                 //非系统应用发送受保护广播,直接报异常
  165.                 String msg = "Permission Denial: not allowed to send broadcast "
  166.                         + action + " from pid="
  167.                         + callingPid + ", uid=" + callingUid;
  168.                 Slog.w(TAG, msg);
  169.                 throw new SecurityException(msg);
  170.  
  171.             } else if (AppWidgetManager.ACTION_APPWIDGET_CONFIGURE.equals(action)
  172.                     || AppWidgetManager.ACTION_APPWIDGET_UPDATE.equals(action)) {
  173.                 // Special case for compatibility: we don't want apps to send this,
  174.                 // but historically it has not been protected and apps may be using it
  175.                 // to poke their own app widget.  So, instead of making it protected,
  176.                 // just limit it to the caller.
  177.                 if (callerPackage == null) {
  178.                     //若找不到广播的调用者,直接报异常.
  179.                     String msg = "Permission Denial: not allowed to send broadcast "
  180.                             + action + " from unknown caller.";
  181.                     Slog.w(TAG, msg);
  182.                     throw new SecurityException(msg);
  183.                 } else if (intent.getComponent() != null) {
  184.                     // They are good enough to send to an explicit component...  verify
  185.                     // it is being sent to the calling app.
  186.                     //对于ACTION_APPWIDGET_CONFIGURE和ACTION_APPWIDGET_UPDATE 了,两个action,需要调用着和显式组件的包名保持一致.
  187.                     if (!intent.getComponent().getPackageName().equals(
  188.                             callerPackage)) {
  189.                         String msg = "Permission Denial: not allowed to send broadcast "
  190.                                 + action + " to "
  191.                                 + intent.getComponent().getPackageName() + " from "
  192.                                 + callerPackage;
  193.                         Slog.w(TAG, msg);
  194.                         throw new SecurityException(msg);
  195.                     }
  196.                 } else {
  197.                     // Limit broadcast to their own package.
  198.                     //没有现式组件,则默认使用调用者的包名
  199.                     intent.setPackage(callerPackage);
  200.                 }
  201.             }
  202.         }
  203.  
  204.         boolean timeoutExempt = false;
  205.  
  206.         if (action != null) {
  207.              //判断是否属于豁免的广播.
  208.             if (getBackgroundLaunchBroadcasts().contains(action)) {
  209.                 if (DEBUG_BACKGROUND_CHECK) {
  210.                     Slog.i(TAG, "Broadcast action " + action + " forcing include-background");
  211.                 }
  212.                 //增加background 应用接收.
  213.                 intent.addFlags(Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
  214.             }
  215.  
  216.             switch (action) {
  217.                 case Intent.ACTION_UID_REMOVED:
  218.                 case Intent.ACTION_PACKAGE_REMOVED:
  219.                 case Intent.ACTION_PACKAGE_CHANGED:
  220.                 case Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE:
  221.                 case Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE:
  222.                 case Intent.ACTION_PACKAGES_SUSPENDED:
  223.                 case Intent.ACTION_PACKAGES_UNSUSPENDED:
  224.                     // Handle special intents: if this broadcast is from the package
  225.                     // manager about a package being removed, we need to remove all of
  226.                     // its activities from the history stack.
  227.                     //若没有赋于权限,则报异常.
  228.                     if (checkComponentPermission(
  229.                             android.Manifest.permission.BROADCAST_PACKAGE_REMOVED,
  230.                             callingPid, callingUid, -1, true)
  231.                             != PackageManager.PERMISSION_GRANTED) {
  232.                         String msg = "Permission Denial: " + intent.getAction()
  233.                                 + " broadcast from " + callerPackage + " (pid=" + callingPid
  234.                                 + ", uid=" + callingUid + ")"
  235.                                 + " requires "
  236.                                 + android.Manifest.permission.BROADCAST_PACKAGE_REMOVED;
  237.                         Slog.w(TAG, msg);
  238.                         throw new SecurityException(msg);
  239.                     }
  240.                     switch (action) {
  241.                         case Intent.ACTION_UID_REMOVED:
  242.                             final int uid = getUidFromIntent(intent);
  243.                             if (uid >= 0) {
  244.                                 mBatteryStatsService.removeUid(uid);
  245.                                 if (intent.getBooleanExtra(Intent.EXTRA_REPLACING, false)) {
  246.                                     mAppOpsService.resetAllModes(UserHandle.getUserId(uid),
  247.                                             intent.getStringExtra(Intent.EXTRA_PACKAGE_NAME));
  248.                                 } else {
  249.                                     mAppOpsService.uidRemoved(uid);
  250.                                 }
  251.                             }
  252.                             break;
  253.                         case Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE:
  254.                             // If resources are unavailable just force stop all those packages
  255.                             // and flush the attribute cache as well.
  256.                             String list[] =
  257.                                     intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
  258.                             //将可以用的应用进行force stop
  259.                             if (list != null && list.length > 0) {
  260.                                 for (int i = 0; i < list.length; i++) {
  261.                                     forceStopPackageLocked(list[i], -1, false, true, true,
  262.                                             false, false, userId, "storage unmount");
  263.                                 }
  264.                                 
  265. //清理 recent task
  266. mAtmInternal.cleanupRecentTasksForUser(UserHandle.USER_ALL);
  267.  
  268. //触发GC清理.
  269.                                 sendPackageBroadcastLocked(
  270.                                         ApplicationThreadConstants.EXTERNAL_STORAGE_UNAVAILABLE,
  271.                                         list, userId);
  272.                             }
  273.                             break;
  274.                         case Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE:
  275.                             mAtmInternal.cleanupRecentTasksForUser(UserHandle.USER_ALL);
  276.                             break;
  277.                         case Intent.ACTION_PACKAGE_REMOVED:
  278.                         case Intent.ACTION_PACKAGE_CHANGED:
  279.                             Uri data = intent.getData();
  280.                             String ssp;
  281.                             if (data != null && (ssp=data.getSchemeSpecificPart()) != null) {
  282.                                 boolean removed = Intent.ACTION_PACKAGE_REMOVED.equals(action);
  283.                                 final boolean replacing =
  284.                                         intent.getBooleanExtra(Intent.EXTRA_REPLACING, false);
  285.                                 final boolean killProcess =
  286.                                         !intent.getBooleanExtra(Intent.EXTRA_DONT_KILL_APP, false);
  287.                                 final boolean fullUninstall = removed && !replacing;
  288.                                 if (removed) {
  289.                                     if (killProcess) {
  290.                                         forceStopPackageLocked(ssp, UserHandle.getAppId(
  291.                                                 intent.getIntExtra(Intent.EXTRA_UID, -1)),
  292.                                                 false, true, true, false, fullUninstall, userId,
  293.                                                 removed ? "pkg removed" : "pkg changed");
  294.                                     } else {
  295.                                         // Kill any app zygotes always, since they can't fork new
  296.                                         // processes with references to the old code
  297.                                         forceStopAppZygoteLocked(ssp, UserHandle.getAppId(
  298.                                                 intent.getIntExtra(Intent.EXTRA_UID, -1)),
  299.                                                 userId);
  300.                                     }
  301.                                     final int cmd = killProcess
  302.                                             ? ApplicationThreadConstants.PACKAGE_REMOVED
  303.                                             : ApplicationThreadConstants.PACKAGE_REMOVED_DONT_KILL;
  304.                                     sendPackageBroadcastLocked(cmd,
  305.                                             new String[] {ssp}, userId);
  306.                                     //完全卸载
  307.                                     if (fullUninstall) {
  308.                                         mAppOpsService.packageRemoved(
  309.                                                 intent.getIntExtra(Intent.EXTRA_UID, -1), ssp);
  310.  
  311.                                         // Remove all permissions granted from/to this package
  312. //撤销赋于的权限
  313.                                         mUgmInternal.removeUriPermissionsForPackage(ssp, userId,
  314.                                                 true, false);
  315.  
  316. //移除recent task                                        mAtmInternal.removeRecentTasksByPackageName(ssp, userId);
  317. // force stop 对应的package
  318.  
  319.                                         mServices.forceStopPackageLocked(ssp, userId);
  320. //卸载对应的应用
  321.                                         mAtmInternal.onPackageUninstalled(ssp);
  322. //记录卸载信息
  323.                                         mBatteryStatsService.notePackageUninstalled(ssp);
  324.                                     }
  325.                                 } else {
  326.                                     if (killProcess) {
  327.                                         final int extraUid = intent.getIntExtra(Intent.EXTRA_UID,
  328.                                                 -1);
  329.                                         synchronized (mProcLock) {
  330. //杀掉对应的进程
  331.                                             mProcessList.killPackageProcessesLSP(ssp,
  332.                                                     UserHandle.getAppId(extraUid),
  333.                                                     userId, ProcessList.INVALID_ADJ,
  334.                                                     ApplicationExitInfo.REASON_USER_REQUESTED,
  335.                                                     ApplicationExitInfo.SUBREASON_UNKNOWN,
  336.                                                     "change " + ssp);
  337.                                         }
  338.                                     }
  339. //清理disable的包名
  340.                                     cleanupDisabledPackageComponentsLocked(ssp, userId,
  341.                                             intent.getStringArrayExtra(
  342.                                                     Intent.EXTRA_CHANGED_COMPONENT_NAME_LIST));
  343. //处理所有此packagename的service
  344.                                     mServices.schedulePendingServiceStartLocked(ssp, userId);
  345.                                 }
  346.                             }
  347.                             break;
  348.                         case Intent.ACTION_PACKAGES_SUSPENDED:
  349.                         case Intent.ACTION_PACKAGES_UNSUSPENDED:
  350.                             final boolean suspended = Intent.ACTION_PACKAGES_SUSPENDED.equals(
  351.                                     intent.getAction());
  352.                             final String[] packageNames = intent.getStringArrayExtra(
  353.                                     Intent.EXTRA_CHANGED_PACKAGE_LIST);
  354.                             final int userIdExtra = intent.getIntExtra(
  355.                                     Intent.EXTRA_USER_HANDLE, UserHandle.USER_NULL);
  356.                             
  357.  
  358.                             mAtmInternal.onPackagesSuspendedChanged(packageNames, suspended,
  359.                                     userIdExtra);
  360.                             break;
  361.                     }
  362.                     break;
  363.                 case Intent.ACTION_PACKAGE_REPLACED:
  364.                 {
  365.                     final Uri data = intent.getData();
  366.                     final String ssp;
  367.                     if (data != null && (ssp = data.getSchemeSpecificPart()) != null) {
  368.                         ApplicationInfo aInfo = null;
  369.                         try {
  370.                             aInfo = AppGlobals.getPackageManager()
  371.                                     .getApplicationInfo(ssp, STOCK_PM_FLAGS, userId);
  372.                         } catch (RemoteException ignore) {}
  373.                         if (aInfo == null) {
  374.                             Slog.w(TAG, "Dropping ACTION_PACKAGE_REPLACED for non-existent pkg:"
  375.                                     + " ssp=" + ssp + " data=" + data);
  376.                             return ActivityManager.BROADCAST_SUCCESS;
  377.                         }
  378.                         updateAssociationForApp(aInfo);
  379.                         mAtmInternal.onPackageReplaced(aInfo);
  380.                         mServices.updateServiceApplicationInfoLocked(aInfo);
  381.                         sendPackageBroadcastLocked(ApplicationThreadConstants.PACKAGE_REPLACED,
  382.                                 new String[] {ssp}, userId);
  383.                     }
  384.                     break;
  385.                 }
  386.                 case Intent.ACTION_PACKAGE_ADDED:
  387.                 {
  388.                     // Special case for adding a package: by default turn on compatibility mode.
  389.                     Uri data = intent.getData();
  390.                     String ssp;
  391.                     if (data != null && (ssp = data.getSchemeSpecificPart()) != null) {
  392.                         final boolean replacing =
  393.                                 intent.getBooleanExtra(Intent.EXTRA_REPLACING, false);
  394.                         mAtmInternal.onPackageAdded(ssp, replacing);
  395.  
  396.                         try {
  397.                             ApplicationInfo ai = AppGlobals.getPackageManager().
  398.                                     getApplicationInfo(ssp, STOCK_PM_FLAGS, 0);
  399.                             mBatteryStatsService.notePackageInstalled(ssp,
  400.                                     ai != null ? ai.longVersionCode : 0);
  401.                         } catch (RemoteException e) {
  402.                         }
  403.                     }
  404.                     break;
  405.                 }
  406.                 case Intent.ACTION_PACKAGE_DATA_CLEARED:
  407.                 {
  408.                     Uri data = intent.getData();
  409.                     String ssp;
  410.                     if (data != null && (ssp = data.getSchemeSpecificPart()) != null) {
  411.                         mAtmInternal.onPackageDataCleared(ssp);
  412.                     }
  413.                     break;
  414.                 }
  415.                 case Intent.ACTION_TIMEZONE_CHANGED:
  416.                     // If this is the time zone changed action, queue up a message that will reset
  417.                     // the timezone of all currently running processes. This message will get
  418.                     // queued up before the broadcast happens.
  419.                     mHandler.sendEmptyMessage(UPDATE_TIME_ZONE);
  420.                     break;
  421.                 case Intent.ACTION_TIME_CHANGED:
  422.                     // EXTRA_TIME_PREF_24_HOUR_FORMAT is optional so we must distinguish between
  423.                     // the tri-state value it may contain and "unknown".
  424.                     // For convenience we re-use the Intent extra values.
  425.                     final int NO_EXTRA_VALUE_FOUND = -1;
  426.                     final int timeFormatPreferenceMsgValue = intent.getIntExtra(
  427.                             Intent.EXTRA_TIME_PREF_24_HOUR_FORMAT,
  428.                             NO_EXTRA_VALUE_FOUND /* defaultValue */);
  429.                     // Only send a message if the time preference is available.
  430.                     if (timeFormatPreferenceMsgValue != NO_EXTRA_VALUE_FOUND) {
  431.                         Message updateTimePreferenceMsg =
  432.                                 mHandler.obtainMessage(UPDATE_TIME_PREFERENCE_MSG,
  433.                                         timeFormatPreferenceMsgValue, 0);
  434.                         mHandler.sendMessage(updateTimePreferenceMsg);
  435.                     }
  436.                     mBatteryStatsService.noteCurrentTimeChanged();
  437.                     break;
  438.                 case ConnectivityManager.ACTION_CLEAR_DNS_CACHE:
  439.                     mHandler.sendEmptyMessage(CLEAR_DNS_CACHE_MSG);
  440.                     break;
  441.                 case Proxy.PROXY_CHANGE_ACTION:
  442.                     mHandler.sendMessage(mHandler.obtainMessage(UPDATE_HTTP_PROXY_MSG));
  443.                     break;
  444.                 case android.hardware.Camera.ACTION_NEW_PICTURE:
  445.                 case android.hardware.Camera.ACTION_NEW_VIDEO:
  446.                     // In N we just turned these off; in O we are turing them back on partly,
  447.                     // only for registered receivers.  This will still address the main problem
  448.                     // (a spam of apps waking up when a picture is taken putting significant
  449.                     // memory pressure on the system at a bad point), while still allowing apps
  450.                     // that are already actively running to know about this happening.
  451.                     intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
  452.                     break;
  453.                 case android.security.KeyChain.ACTION_TRUST_STORE_CHANGED:
  454.                     mHandler.sendEmptyMessage(HANDLE_TRUST_STORAGE_UPDATE_MSG);
  455.                     break;
  456.                 case "com.android.launcher.action.INSTALL_SHORTCUT":
  457.                     // As of O, we no longer support this broadcasts, even for pre-O apps.
  458.                     // Apps should now be using ShortcutManager.pinRequestShortcut().
  459.                     Log.w(TAG, "Broadcast " + action
  460.                             + " no longer supported. It will not be delivered.");
  461.                     return ActivityManager.BROADCAST_SUCCESS;
  462.                 case Intent.ACTION_PRE_BOOT_COMPLETED:
  463.                     timeoutExempt = true;
  464.                     break;
  465.                 case Intent.ACTION_CLOSE_SYSTEM_DIALOGS:
  466.                     if (!mAtmInternal.checkCanCloseSystemDialogs(callingPid, callingUid,
  467.                             callerPackage)) {
  468.                         // Returning success seems to be the pattern here
  469.                         return ActivityManager.BROADCAST_SUCCESS;
  470.                     }
  471.                     break;
  472.             }
  473.  
  474.             if (Intent.ACTION_PACKAGE_ADDED.equals(action) ||
  475.                     Intent.ACTION_PACKAGE_REMOVED.equals(action) ||
  476.                     Intent.ACTION_PACKAGE_REPLACED.equals(action)) {
  477.                 final int uid = getUidFromIntent(intent);
  478.                 if (uid != -1) {
  479.                     final UidRecord uidRec = mProcessList.getUidRecordLOSP(uid);
  480.                     if (uidRec != null) {
  481.                         uidRec.updateHasInternetPermission();
  482.                     }
  483.                 }
  484.             }
  485.         }
  486.  
  487.         // Add to the sticky list if requested.
  488.         //粘性广播
  489.         if (sticky) {
  490.             //判断是否赋于BROADCAST_STICKY 权限
  491.             if (checkPermission(android.Manifest.permission.BROADCAST_STICKY,
  492.                     callingPid, callingUid)
  493.                     != PackageManager.PERMISSION_GRANTED) {
  494.                 String msg = "Permission Denial: broadcastIntent() requesting a sticky broadcast from pid="
  495.                         + callingPid + ", uid=" + callingUid
  496.                         + " requires " + android.Manifest.permission.BROADCAST_STICKY;
  497.                 Slog.w(TAG, msg);
  498.                 throw new SecurityException(msg);
  499.             }
  500.             //粘性广播不需要对应的权限
  501.  
  502.             if (requiredPermissions != null && requiredPermissions.length > 0) {
  503.                 Slog.w(TAG, "Can't broadcast sticky intent " + intent
  504.                         + " and enforce permissions " + Arrays.toString(requiredPermissions));
  505.                 return ActivityManager.BROADCAST_STICKY_CANT_HAVE_PERMISSION;
  506.             }
  507.            //粘性广播不需要指明组件
  508.             if (intent.getComponent() != null) {
  509.                 throw new SecurityException(
  510.                         "Sticky broadcasts can't target a specific component");
  511.             }
  512.             // We use userId directly here, since the "all" target is maintained
  513.             // as a separate set of sticky broadcasts.
  514.             if (userId != UserHandle.USER_ALL) {
  515.                 // But first, if this is not a broadcast to all users, then
  516.                 // make sure it doesn't conflict with an existing broadcast to
  517.                 // all users.
  518.                 ArrayMap<String, ArrayList<Intent>> stickies = mStickyBroadcasts.get(
  519.                         UserHandle.USER_ALL);
  520.                 if (stickies != null) {
  521.                     ArrayList<Intent> list = stickies.get(intent.getAction());
  522.                     if (list != null) {
  523.                         int N = list.size();
  524.                         int i;
  525.                         for (i=0; i<N; i++) {
  526.                             if (intent.filterEquals(list.get(i))) {
  527.                                //若粘性广播在队里里面,则报冲突
  528.                                 throw new IllegalArgumentException(
  529.                                         "Sticky broadcast " + intent + " for user "
  530.                                         + userId + " conflicts with existing global broadcast");
  531.                             }
  532.                         }
  533.                     }
  534.                 }
  535.             }
  536.             ArrayMap<String, ArrayList<Intent>> stickies = mStickyBroadcasts.get(userId);
  537.             if (stickies == null) {
  538.                 stickies = new ArrayMap<>();
  539.                 mStickyBroadcasts.put(userId, stickies);
  540.             }
  541.             ArrayList<Intent> list = stickies.get(intent.getAction());
  542.             if (list == null) {
  543.                 list = new ArrayList<>();
  544.                 stickies.put(intent.getAction(), list);
  545.             }
  546.             final int stickiesCount = list.size();
  547.             int i;
  548.             for (i = 0; i < stickiesCount; i++) {
  549.                 if (intent.filterEquals(list.get(i))) {
  550.                     //若在userId中的队列,出现重复,则替换
  551.                     // This sticky already exists, replace it.
  552.                     list.set(i, new Intent(intent));
  553.                     break;
  554.                 }
  555.             }
  556.             if (i >= stickiesCount) {
  557.                 list.add(new Intent(intent));
  558.             }
  559.         }
  560.  
  561.         int[] users;
  562.         if (userId == UserHandle.USER_ALL) {
  563.             // Caller wants broadcast to go to all started users.
  564.             users = mUserController.getStartedUserArray();
  565.         } else {
  566.             // Caller wants broadcast to go to one specific user.
  567.             users = new int[] {userId};
  568.         }
  569.  
  570.         // Figure out who all will receive this broadcast.
  571.         //寻找所有接收广播的接收者
  572.         List receivers = null;
  573.         List<BroadcastFilter> registeredReceivers = null;
  574.         // Need to resolve the intent to interested receivers...
  575.         if ((intent.getFlags()&Intent.FLAG_RECEIVER_REGISTERED_ONLY)
  576.                  == 0) {
  577.             //在PMS中去查询对应的广播接收者,获取静态广播接受者的列表
  578.             receivers = collectReceiverComponents(
  579.                     intent, resolvedType, callingUid, users, broadcastAllowList);
  580.         }
  581.         if (intent.getComponent() == null) {
  582.             //若不指定广播接收者.则会遍历所有符合条件的接收者
  583.             if (userId == UserHandle.USER_ALL && callingUid == SHELL_UID) {
  584.                 // Query one target user at a time, excluding shell-restricted users
  585.                 for (int i = 0; i < users.length; i++) {
  586.                     if (mUserController.hasUserRestriction(
  587.                             UserManager.DISALLOW_DEBUGGING_FEATURES, users[i])) {
  588.                         continue;
  589.                     }
  590.                     //查看动态广播接收者
  591.                     List<BroadcastFilter> registeredReceiversForUser =
  592.                             mReceiverResolver.queryIntent(intent,
  593.                                     resolvedType, false /*defaultOnly*/, users[i]);
  594.                     if (registeredReceivers == null) {
  595.                         registeredReceivers = registeredReceiversForUser;
  596.                     } else if (registeredReceiversForUser != null) {
  597.                         registeredReceivers.addAll(registeredReceiversForUser);
  598.                     }
  599.                 }
  600.             } else {
  601.                 //查看动态广播接收者
  602.                 registeredReceivers = mReceiverResolver.queryIntent(intent,
  603.                         resolvedType, false /*defaultOnly*/, userId);
  604.             }
  605.         }
  606.         //支持替换旧的广播
  607.         final boolean replacePending =
  608.                 (intent.getFlags()&Intent.FLAG_RECEIVER_REPLACE_PENDING) != 0;
  609.  
  610.         if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Enqueueing broadcast: " + intent.getAction()
  611.                 + " replacePending=" + replacePending);
  612.         if (registeredReceivers != null && broadcastAllowList != null) {
  613.             // if a uid whitelist was provided, remove anything in the application space that wasn't
  614.             // in it.
  615.             for (int i = registeredReceivers.size() - 1; i >= 0; i--) {
  616.                 final int owningAppId = UserHandle.getAppId(registeredReceivers.get(i).owningUid);
  617.                 if (owningAppId >= Process.FIRST_APPLICATION_UID
  618.                         && Arrays.binarySearch(broadcastAllowList, owningAppId) < 0) {
  619.                     registeredReceivers.remove(i);
  620.                 }
  621.             }
  622.         }
  623.  
  624.         int NR = registeredReceivers != null ? registeredReceivers.size() : 0;
  625.         if (!ordered && NR > 0) {
  626.             // If we are not serializing this broadcast, then send the
  627.             // registered receivers separately so they don't wait for the
  628.             // components to be launched.
  629.            //针对非有序广播,进行并发发送广播.
  630.             if (isCallerSystem) {
  631.                 //对应system的调用者进行验证
  632.                 checkBroadcastFromSystem(intent, callerApp, callerPackage, callingUid,
  633.                         isProtectedBroadcast, registeredReceivers);
  634.             }
  635.  
  636.             final BroadcastQueue queue = broadcastQueueForIntent(intent);
  637.  
  638.             BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp, callerPackage,
  639.                     callerFeatureId, callingPid, callingUid, callerInstantApp, resolvedType,
  640.                     requiredPermissions, excludedPermissions, excludedPackages, appOp, brOptions,
  641.                     registeredReceivers, resultTo, resultCode, resultData, resultExtras, ordered,
  642.                     sticky, false, userId, allowBackgroundActivityStarts,
  643.                     backgroundActivityStartsToken, timeoutExempt);
  644.             
  645.                if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Enqueueing parallel broadcast " + r);
  646.             final boolean replaced = replacePending
  647.                     && (queue.replaceParallelBroadcastLocked(r) != null);
  648.             // Note: We assume resultTo is null for non-ordered broadcasts.
  649.             if (!replaced) {
  650.                 //若不进行旧的广播替换,则开始加入队列进行并行分发.
  651.                 queue.enqueueParallelBroadcastLocked(r);
  652.                 //安排广播分发
  653.                 queue.scheduleBroadcastsLocked();
  654.             }
  655.             //表示处理完成,则将动态广播接收者进行清空.
  656.             registeredReceivers = null;
  657.             NR = 0;
  658.         }
  659.  
  660.         // Merge into one list.
  661.         // 合并动态和静态广播接收者
  662.         int ir = 0;
  663.         if (receivers != null) {
  664.             // A special case for PACKAGE_ADDED: do not allow the package
  665.             // being added to see this broadcast.  This prevents them from
  666.             // using this as a back door to get run as soon as they are
  667.             // installed.  Maybe in the future we want to have a special install
  668.             // broadcast or such for apps, but we'd like to deliberately make
  669.             // this decision.
  670.             //过滤ACTION_PACKAGE_ADDED , ACTION_PACKAGE_RESTARTED 和ACTION_PACKAGE_DATA_CLEARED 对应包名
  671.             String skipPackages[] = null;
  672.             
  673.             if (Intent.ACTION_PACKAGE_ADDED.equals(intent.getAction())
  674.                     || Intent.ACTION_PACKAGE_RESTARTED.equals(intent.getAction())
  675.                     || Intent.ACTION_PACKAGE_DATA_CLEARED.equals(intent.getAction())) {
  676.                 Uri data = intent.getData();
  677.                 if (data != null) {
  678.                     String pkgName = data.getSchemeSpecificPart();
  679.                     if (pkgName != null) {
  680.                         skipPackages = new String[] { pkgName };
  681.                     }
  682.                 }
  683.             } else if (Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE.equals(intent.getAction())) {
  684.                 skipPackages = intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
  685.             }
  686.            
  687.             if (skipPackages != null && (skipPackages.length > 0)) {
  688.                 for (String skipPackage : skipPackages) {
  689.                     if (skipPackage != null) {
  690.                         int NT = receivers.size();
  691.                         for (int it=0; it<NT; it++) {
  692.                             ResolveInfo curt = (ResolveInfo)receivers.get(it);
  693.                             if (curt.activityInfo.packageName.equals(skipPackage)) {
  694.                                 receivers.remove(it);
  695.                                 it--;
  696.                                 NT--;
  697.                             }
  698.                         }
  699.                     }
  700.                 }
  701.             }
  702.  
  703.             int NT = receivers != null ? receivers.size() : 0;
  704.             int it = 0;
  705.             ResolveInfo curt = null;
  706.             BroadcastFilter curr = null;
  707.             while (it < NT && ir < NR) {
  708.                 if (curt == null) {
  709.                     //先在静态广播中获取
  710.                     curt = (ResolveInfo)receivers.get(it);
  711.                 }
  712.                 if (curr == null) {
  713.                     //其次在动态广播中获取
  714.                     curr = registeredReceivers.get(ir);
  715.                 }
  716.                 if (curr.getPriority() >= curt.priority) {
  717.                     //同样的优先级,动态广播优先于静态广播
  718.                     // Insert this broadcast record into the final list.
  719.                     receivers.add(it, curr);
  720.                     ir++;
  721.                     curr = null;
  722.                     it++;
  723.                     NT++;
  724.                 } else {
  725.                     // Skip to the next ResolveInfo in the final list.
  726.                     it++;
  727.                     curt = null;
  728.                 }
  729.             }
  730.         }
  731.         //将所有的动态广播插入final receivers 中
  732.         while (ir < NR) {
  733.             if (receivers == null) {
  734.                 receivers = new ArrayList();
  735.             }
  736.             receivers.add(registeredReceivers.get(ir));
  737.             ir++;
  738.         }
  739.  
  740.         if (isCallerSystem) {
  741.             checkBroadcastFromSystem(intent, callerApp, callerPackage, callingUid,
  742.                     isProtectedBroadcast, receivers);
  743.         }
  744.  
  745.         if ((receivers != null && receivers.size() > 0)
  746.                 || resultTo != null) {
  747.             //
  748.             BroadcastQueue queue = broadcastQueueForIntent(intent);
  749.             BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp, callerPackage,
  750.                     callerFeatureId, callingPid, callingUid, callerInstantApp, resolvedType,
  751.                     requiredPermissions, excludedPermissions, excludedPackages, appOp, brOptions,
  752.                     receivers, resultTo, resultCode, resultData, resultExtras,
  753.                     ordered, sticky, false, userId, allowBackgroundActivityStarts,
  754.                     backgroundActivityStartsToken, timeoutExempt);
  755.  
  756.             if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Enqueueing ordered broadcast " + r);
  757.  
  758.             final BroadcastRecord oldRecord =
  759.                     replacePending ? queue.replaceOrderedBroadcastLocked(r) : null;
  760.             if (oldRecord != null) {
  761.                 // Replaced, fire the result-to receiver.
  762.                 if (oldRecord.resultTo != null) {
  763.                     final BroadcastQueue oldQueue = broadcastQueueForIntent(oldRecord.intent);
  764.                     try {
  765.                         //若替代的广播,则更新old的队列
  766.                         oldQueue.performReceiveLocked(oldRecord.callerApp, oldRecord.resultTo,
  767.                                 oldRecord.intent,
  768.                                 Activity.RESULT_CANCELED, null, null,
  769.                                 false, false, oldRecord.userId);
  770.                     } catch (RemoteException e) {
  771.                         Slog.w(TAG, "Failure ["
  772.                                 + queue.mQueueName + "] sending broadcast result of "
  773.                                 + intent, e);
  774.  
  775.                     }
  776.                 }
  777.             } else {
  778.                 //分发有序广播
  779.                 queue.enqueueOrderedBroadcastLocked(r);
  780.                 queue.scheduleBroadcastsLocked();
  781.             }
  782.         } else {
  783.             // There was nobody interested in the broadcast, but we still want to record
  784.             // that it happened.
  785.             if (intent.getComponent() == null && intent.getPackage() == null
  786.                     && (intent.getFlags()&Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
  787.                 // This was an implicit broadcast... let's record it for posterity.
  788.                 addBroadcastStatLocked(intent.getAction(), callerPackage, 0, 0, 0);
  789.             }
  790.         }
  791.  
  792.         return ActivityManager.BROADCAST_SUCCESS;
  793.     }

小结:

(1) 对粘性广播的处理过程。把粘性广播放在了list列表中，而list以action为键放置在了stickies中，而stickies又以userId为键放在了mStickyBroadcasts中，因此mStickyBroadcasts保存了设备中所有用户粘性广播的Intent相关信息。

(2)静态和动态注册的接收器

[1] 上面这段代码主要是获取静态和动态注册的接收器。其中receivers 表示静态注册接收器列表， registeredReceivers 表示动态注册接收器列表；
[2] Intent.FLAG_RECEIVER_REGISTERED_ONLY该flag表示仅支持动态注册，不支持静态注册，如果在manifest中注册是收不到该广播的；
[3] 如果发送广播不加Component信息会遍历获取所有的当前intent的接收者，因此如果定向发给某个应用的话，要把Component信息加上。

(3) 无序动态注册接收器添加到并发列表中

  [1] 上面这段代码是，如果发送的是无序广播，且存在动态注册的广播接收者，就将该广播加入并行处理队列，并进行一次广播发送。简单来说就是【动态注册且接受无序广播的广播接收者】是并行操作，广播发送速度会比较快。
 [2]  Intent.FLAG_RECEIVER_REPLACE_PENDING 该flag表示是否替换待发出的广播，如果flag为1会进行替换, 位置与待发广播一样。

(4)合并有序动态注册和静态注册接收器

 [1] 上面这段代码主要是对【动态注册接受有序广播的广播接收者】和【静态注册的广播接收者】进行合并，如果是有序广播，动态接收者和静态的接收者合并到一个队列里面进行处理，也就是说order广播下，所有的接收者（静态和动态）处理方式都是一样的，都是串行处理；
 [2] 对于静态注册的接收者而言，始终是和order广播的处理方式是一样的，也就是说静态的接收者只有order模式(串行化接收)；
 [3] 在合并过程中，如果一个动态注册的广播接收者和一个静态注册的目标广播接收者的优先级相同，那么动态注册的目标接收者会排在静态注册的目标广播接收者前面，即动态注册的目标广播接收者会优先于静态注册的广播接收者接收到有序广播。
 

(5)系统广播处理broadcastIntentLocked函数这部分代码逻辑总结：

首先是判断是不是系统广播，也就是switch语句中的部分，这部分的广播是系统发出的，根据不同广播做出不同的处理，系统广播我们可以接收但是不能发送，只能由系统发出；
接着是粘性广播的处理；
然后是【动态注册且接受无序广播的广播接收者】的处理，把他们放入到BroadcastQueue的mParallelBroadcasts中，并调用scheduleBroadcastsLocked，BroadcastQueue对mParallelBroadcasts列表中条目的最终处理是通过并行操作来完成的；
最后是【动态注册接受有序广播的广播接收者】和【静态注册的广播接收者】的处理，把他们放入到BroadcastQueue的mOrderedBroadcasts中，并调用scheduleBroadcastsLocked，BroadcastQueue对mOrderedBroadcasts列表中条目的最终处理是通过串行操作来完成的；
4、BroadcastQueue广播处理
    4.1 BroadcastQueue队列定义及入队列方法判断

frameworks/base/services/core/java/com/android/server/am/BroadcastQueue.java

    /**
     * Lists of all active broadcasts that are to be executed immediately
     * (without waiting for another broadcast to finish).  Currently this only
     * contains broadcasts to registered receivers, to avoid spinning up
     * a bunch of processes to execute IntentReceiver components.  Background-
     * and foreground-priority broadcasts are queued separately.
     */
    final ArrayList<BroadcastRecord> mParallelBroadcasts = new ArrayList<>();
    /**
     * Tracking of the ordered broadcast queue, including deferral policy and alarm
     * prioritization.
     */
    final BroadcastDispatcher mDispatcher;

在广播队列中定义了两个处理列表，一个是并发处理列表mParallelBroadcasts，一个是有序处理列表mDispatcher。

  1.     BroadcastQueue broadcastQueueForIntent(Intent intent) {
  2.         if (isOnOffloadQueue(intent.getFlags())) {
  3.             if (DEBUG_BROADCAST_BACKGROUND) {
  4.                 Slog.i(TAG_BROADCAST,
  5.                         "Broadcast intent " + intent + " on offload queue");
  6.             }
  7.             return mOffloadBroadcastQueue;
  8.         }
  9.  
  10.         final boolean isFg = (intent.getFlags() & Intent.FLAG_RECEIVER_FOREGROUND) != 0;
  11.         if (DEBUG_BROADCAST_BACKGROUND) Slog.i(TAG_BROADCAST,
  12.                 "Broadcast intent " + intent + " on "
  13.                 + (isFg ? "foreground" : "background") + " queue");
  14.         return (isFg) ? mFgBroadcastQueue : mBgBroadcastQueue;
  15.     }
  16.  
  17.     
  18.  public void enqueueParallelBroadcastLocked(BroadcastRecord r) {
  19.         mParallelBroadcasts.add(r);
  20.         enqueueBroadcastHelper(r);
  21.     }
  22.  
  23.     public void enqueueOrderedBroadcastLocked(BroadcastRecord r) {
  24.         mDispatcher.enqueueOrderedBroadcastLocked(r);
  25.         enqueueBroadcastHelper(r);
  26.     }

上面的三个方法是上面源码中出现的，broadcastQueueForIntent根据intent是否含有Intent.FLAG_RECEIVER_FOREGROUND来判断是前台广播还是普通后台广播，如果是前台广播返回前台广播处队列。如果是普通后台广播返回后台广播处理队列。

获取队列后，将发给【动态注册且接受无序广播的广播接收者】的广播通过enqueueParallelBroadcastLocked函数添加到该队列的并发处理列表中。将发给【动态注册接受有序广播的广播接收者】和【静态注册的广播接收者】的广播通过enqueueOrderedBroadcastLocked函数添加到该队列的有序处理列表中。

4.2 BroadcastQueue队列中广播发送流程

从上面的源码分析中看到最后我们都执行了scheduleBroadcastsLocked对广播进行了进一步发送处理，接下来看下这个函数的逻辑。

  1.     public void scheduleBroadcastsLocked() {
  2.         if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Schedule broadcasts ["
  3.                 + mQueueName + "]: current="
  4.                 + mBroadcastsScheduled);
  5.  
  6.         if (mBroadcastsScheduled) {
  7.             //若正在调度中,则取消本地调度
  8.             return;
  9.         }
  10.         mHandler.sendMessage(mHandler.obtainMessage(BROADCAST_INTENT_MSG, this));
  11.         mBroadcastsScheduled = true;
  12.     }
  13.  
  14.     private final class BroadcastHandler extends Handler {
  15.         public BroadcastHandler(Looper looper) {
  16.             super(looper, null, true);
  17.         }
  18.  
  19.         @Override
  20.         public void handleMessage(Message msg) {
  21.             switch (msg.what) {
  22.                 case BROADCAST_INTENT_MSG: {
  23.                     if (DEBUG_BROADCAST) Slog.v(
  24.                             TAG_BROADCAST, "Received BROADCAST_INTENT_MSG ["
  25.                             + mQueueName + "]");
  26.                     //开始处理广播
  27.                     processNextBroadcast(true);
  28.                 } break;
  29.                 case BROADCAST_TIMEOUT_MSG: {
  30.                     synchronized (mService) {
  31.                         broadcastTimeoutLocked(true);
  32.                     }
  33.                 } break;
  34.             }
  35.         }
  36.     }

先判断mBroadcastsScheduled的值，如果true说明消息队列已经存在一个类型为BROADCAST_INTENT_MSG的消息了，直接返回，因为该消息在执行完毕会自动调用下一条消息；
接下来广播的处理逻辑会走到 processNextBroadcast函数中，下面来看下该函数的逻辑。
 

  1.     private void processNextBroadcast(boolean fromMsg) {
  2.         synchronized (mService) {
  3.             processNextBroadcastLocked(fromMsg, false);
  4.         }
  5.     }

详细分析 processNextBroadcastLocked 函数:

  1.     final void processNextBroadcastLocked(boolean fromMsg, boolean skipOomAdj) {
  2.         BroadcastRecord r;
  3.  
  4.         if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "processNextBroadcast ["
  5.                 + mQueueName + "]: "
  6.                 + mParallelBroadcasts.size() + " parallel broadcasts; "
  7.                 + mDispatcher.describeStateLocked());
  8.  
  9.         //更新CPU统计信息
  10.         mService.updateCpuStats();
  11.  
  12.         if (fromMsg) {
  13.             //来自于BROADCAST_INTENT_MSG, 说明广播已经在处理,可以将此变量标记为false
  14.             mBroadcastsScheduled = false;
  15.         }
  16.  
  17.         // First, deliver any non-serialized broadcasts right away.
  18.         // 无序广播之间不存在相互等待，这里处理的是保存在无序广播调度队列mParallelBroadcasts中的广播发送任务，
  19.         // 即把保存在无序广播调度队列mParallelBroadcasts中的广播发送给它的目标广播接收者处理
  20.         while (mParallelBroadcasts.size() > 0) {
  21.             r = mParallelBroadcasts.remove(0);
  22.             r.dispatchTime = SystemClock.uptimeMillis();
  23.             r.dispatchClockTime = System.currentTimeMillis();
  24.  
  25.             if (Trace.isTagEnabled(Trace.TRACE_TAG_ACTIVITY_MANAGER)) {
  26.                 Trace.asyncTraceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER,
  27.                     createBroadcastTraceTitle(r, BroadcastRecord.DELIVERY_PENDING),
  28.                     System.identityHashCode(r));
  29.                 Trace.asyncTraceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER,
  30.                     createBroadcastTraceTitle(r, BroadcastRecord.DELIVERY_DELIVERED),
  31.                     System.identityHashCode(r));
  32.             }
  33.  
  34.             final int N = r.receivers.size();
  35.             if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST, "Processing parallel broadcast ["
  36.                     + mQueueName + "] " + r);
  37.             for (int i=0; i<N; i++) {
  38.                 Object target = r.receivers.get(i);
  39.                 if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  40.                         "Delivering non-ordered on [" + mQueueName + "] to registered "
  41.                         + target + ": " + r);
  42.  
  43.                 //通过deliverToRegisteredReceiverLocked调用ActivityThread.scheduleRegisteredReceiver处理广播
  44.                 deliverToRegisteredReceiverLocked(r,
  45.                         (BroadcastFilter) target, false, i);
  46.             }
  47.             //记录在历史列表中.
  48.             addBroadcastToHistoryLocked(r);
  49.             if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST, "Done with parallel broadcast ["
  50.                     + mQueueName + "] " + r);
  51.         }
  52.  
  53.         // Now take care of the next serialized one...
  54.  
  55.         // If we are waiting for a process to come up to handle the next
  56.         // broadcast, then do nothing at this point.  Just in case, we
  57.         // check that the process we're waiting for still exists.
  58.        //接下来处理有序广播
  59.         if (mPendingBroadcast != null) {
  60.             if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST,
  61.                     "processNextBroadcast [" + mQueueName + "]: waiting for "
  62.                     + mPendingBroadcast.curApp);
  63.  
  64.             boolean isDead;
  65.             //等待Broadcast有对应的pid
  66.             if (mPendingBroadcast.curApp.getPid() > 0) {
  67.                 synchronized (mService.mPidsSelfLocked) {
  68.                     ProcessRecord proc = mService.mPidsSelfLocked.get(
  69.                             mPendingBroadcast.curApp.getPid());
  70.                     //等待广播接收者,是否存在或者已经发生了crash
  71.                     isDead = proc == null || proc.mErrorState.isCrashing();
  72.                 }
  73.             } else {
  74.                 //若没有获取到当前等待广播的pid,则通过进程名称进行搜索.
  75.                 final ProcessRecord proc = mService.mProcessList.getProcessNamesLOSP().get(
  76.                         mPendingBroadcast.curApp.processName, mPendingBroadcast.curApp.uid);
  77.                 //判断接收者是否还存在
  78.                 isDead = proc == null || !proc.isPendingStart();
  79.             }
  80.             if (!isDead) {
  81.                 // It's still alive, so keep waiting
  82.                 //若接收者存在,则继续保持. 如果应用已经启动，会调用AMS的函数来处理静态广播，这里直接return
  83.  
  84.                 return;
  85.             } else {
  86.                 Slog.w(TAG, "pending app  ["
  87.                         + mQueueName + "]" + mPendingBroadcast.curApp
  88.                         + " died before responding to broadcast");
  89.                 //若不存在,则记录为idle状态
  90.                 mPendingBroadcast.state = BroadcastRecord.IDLE;
  91.                 mPendingBroadcast.nextReceiver = mPendingBroadcastRecvIndex;
  92.                 mPendingBroadcast = null;
  93.             }
  94.         }
  95.  
  96.         boolean looped = false;
  97.  
  98.         do {
  99.             final long now = SystemClock.uptimeMillis();
  100.             //获取当前时间的BroadcastRecord
  101.             r = mDispatcher.getNextBroadcastLocked(now);
  102.  
  103.             if (r == null) {
  104.                 // No more broadcasts are deliverable right now, so all done!
  105.                 //没有获取到BroadcastRecord, 说明已经处理完成.
  106.                 //安排延迟广播检查
  107.                 mDispatcher.scheduleDeferralCheckLocked(false);
  108.                 synchronized (mService.mAppProfiler.mProfilerLock) {
  109.                     //触发GC
  110.                     mService.mAppProfiler.scheduleAppGcsLPf();
  111.                 }
  112.                 if (looped && !skipOomAdj) {
  113.                     // If we had finished the last ordered broadcast, then
  114.                     // make sure all processes have correct oom and sched
  115.                     // adjustments.
  116.                    //更新ADJ
  117.                     mService.updateOomAdjPendingTargetsLocked(
  118.                             OomAdjuster.OOM_ADJ_REASON_START_RECEIVER);
  119.                 }
  120.  
  121.                 // when we have no more ordered broadcast on this queue, stop logging
  122.                 //因为已经处理完成广播,停止日志记录. 
  123.                 if (mService.mUserController.mBootCompleted && mLogLatencyMetrics) {
  124.                     mLogLatencyMetrics = false;
  125.                 }
  126.  
  127.                 return;
  128.             }
  129.  
  130.             boolean forceReceive = false;
  131.  
  132.             // Ensure that even if something goes awry with the timeout
  133.             // detection, we catch "hung" broadcasts here, discard them,
  134.             // and continue to make progress.
  135.             //
  136.             // This is only done if the system is ready so that early-stage receivers
  137.             // don't get executed with timeouts; and of course other timeout-
  138.             // exempt broadcasts are ignored.
  139.             int numReceivers = (r.receivers != null) ? r.receivers.size() : 0;
  140.             if (mService.mProcessesReady && !r.timeoutExempt && r.dispatchTime > 0) {
  141.                 //超时广播强制执行
  142.                 if ((numReceivers > 0) &&
  143.                         (now > r.dispatchTime + (2 * mConstants.TIMEOUT * numReceivers)) &&
  144.                         /// M: ANR Debug Mechanism
  145.                         !mService.mAnrManager.isAnrDeferrable()) {
  146.                     Slog.w(TAG, "Hung broadcast ["
  147.                             + mQueueName + "] discarded after timeout failure:"
  148.                             + " now=" + now
  149.                             + " dispatchTime=" + r.dispatchTime
  150.                             + " startTime=" + r.receiverTime
  151.                             + " intent=" + r.intent
  152.                             + " numReceivers=" + numReceivers
  153.                             + " nextReceiver=" + r.nextReceiver
  154.                             + " state=" + r.state);
  155.                     //出现超时，强制结束
  156.                     broadcastTimeoutLocked(false); // forcibly finish this broadcast                // 重置参数，继续处理有序广播调度队列mOrderedBroadcasts的下一个广播转发任务
  157.                     forceReceive = true;
  158.                     r.state = BroadcastRecord.IDLE;
  159.                 }
  160.             }
  161.  
  162.             if (r.state != BroadcastRecord.IDLE) {
  163.                 //广播不处于IDLE 状态,则直接返回.
  164.                 if (DEBUG_BROADCAST) Slog.d(TAG_BROADCAST,
  165.                         "processNextBroadcast("
  166.                         + mQueueName + ") called when not idle (state="
  167.                         + r.state + ")");
  168.                 return;
  169.             }
  170.  
  171.             // Is the current broadcast is done for any reason?
  172.             if (r.receivers == null || r.nextReceiver >= numReceivers
  173.                     || r.resultAbort || forceReceive) {
  174.                 // Send the final result if requested
  175.                 if (r.resultTo != null) {
  176.                     boolean sendResult = true;
  177.  
  178.                     // if this was part of a split/deferral complex, update the refcount and only
  179.                     // send the completion when we clear all of them
  180.                     if (r.splitToken != 0) {
  181.                         int newCount = mSplitRefcounts.get(r.splitToken) - 1;
  182.                         if (newCount == 0) {
  183.                             // done!  clear out this record's bookkeeping and deliver
  184.                             if (DEBUG_BROADCAST_DEFERRAL) {
  185.                                 Slog.i(TAG_BROADCAST,
  186.                                         "Sending broadcast completion for split token "
  187.                                         + r.splitToken + " : " + r.intent.getAction());
  188.                             }
  189.                             mSplitRefcounts.delete(r.splitToken);
  190.                         } else {
  191.                             // still have some split broadcast records in flight; update refcount
  192.                             // and hold off on the callback
  193.                             if (DEBUG_BROADCAST_DEFERRAL) {
  194.                                 Slog.i(TAG_BROADCAST,
  195.                                         "Result refcount now " + newCount + " for split token "
  196.                                         + r.splitToken + " : " + r.intent.getAction()
  197.                                         + " - not sending completion yet");
  198.                             }
  199.                             sendResult = false;
  200.                             mSplitRefcounts.put(r.splitToken, newCount);
  201.                         }
  202.                     }
  203.                     if (sendResult) {
  204.                         if (r.callerApp != null) {
  205.                             mService.mOomAdjuster.mCachedAppOptimizer.unfreezeTemporarily(
  206.                                     r.callerApp);
  207.                         }
  208.                         try {
  209.                             if (DEBUG_BROADCAST) {
  210.                                 Slog.i(TAG_BROADCAST, "Finishing broadcast [" + mQueueName + "] "
  211.                                         + r.intent.getAction() + " app=" + r.callerApp);
  212.                             }
  213.                             performReceiveLocked(r.callerApp, r.resultTo,
  214.                                     new Intent(r.intent), r.resultCode,
  215.                                     r.resultData, r.resultExtras, false, false, r.userId);
  216.                             // Set this to null so that the reference
  217.                             // (local and remote) isn't kept in the mBroadcastHistory.
  218.                             r.resultTo = null;
  219.                         } catch (RemoteException e) {
  220.                             r.resultTo = null;
  221.                             Slog.w(TAG, "Failure ["
  222.                                     + mQueueName + "] sending broadcast result of "
  223.                                     + r.intent, e);
  224.                         }
  225.                     }
  226.                 }
  227.  
  228.                 if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Cancelling BROADCAST_TIMEOUT_MSG");
  229.                 //取消广播超时
  230.                 cancelBroadcastTimeoutLocked();
  231.  
  232.                 if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST,
  233.                         "Finished with ordered broadcast " + r);
  234.  
  235.                 // ... and on to the next...
  236.                 //添加在历史记录里面
  237.                 addBroadcastToHistoryLocked(r);
  238.                 if (r.intent.getComponent() == null && r.intent.getPackage() == null
  239.                         && (r.intent.getFlags()&Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
  240.                     // This was an implicit broadcast... let's record it for posterity.
  241.                     mService.addBroadcastStatLocked(r.intent.getAction(), r.callerPackage,
  242.                             r.manifestCount, r.manifestSkipCount, r.finishTime-r.dispatchTime);
  243.                 }
  244.                 mDispatcher.retireBroadcastLocked(r);
  245.                 r = null;
  246.                 looped = true;
  247.                 continue;
  248.             }
  249.  
  250.             // Check whether the next receiver is under deferral policy, and handle that
  251.             // accordingly.  If the current broadcast was already part of deferred-delivery
  252.             // tracking, we know that it must now be deliverable as-is without re-deferral.
  253.             if (!r.deferred) {
  254.                 final int receiverUid = r.getReceiverUid(r.receivers.get(r.nextReceiver));
  255.                 if (mDispatcher.isDeferringLocked(receiverUid)) {
  256.                     if (DEBUG_BROADCAST_DEFERRAL) {
  257.                         Slog.i(TAG_BROADCAST, "Next receiver in " + r + " uid " + receiverUid
  258.                                 + " at " + r.nextReceiver + " is under deferral");
  259.                     }
  260.                     // If this is the only (remaining) receiver in the broadcast, "splitting"
  261.                     // doesn't make sense -- just defer it as-is and retire it as the
  262.                     // currently active outgoing broadcast.
  263.                     BroadcastRecord defer;
  264.                     if (r.nextReceiver + 1 == numReceivers) {
  265.                         if (DEBUG_BROADCAST_DEFERRAL) {
  266.                             Slog.i(TAG_BROADCAST, "Sole receiver of " + r
  267.                                     + " is under deferral; setting aside and proceeding");
  268.                         }
  269.                         defer = r;
  270.                         mDispatcher.retireBroadcastLocked(r);
  271.                     } else {
  272.                         // Nontrivial case; split out 'uid's receivers to a new broadcast record
  273.                         // and defer that, then loop and pick up continuing delivery of the current
  274.                         // record (now absent those receivers).
  275.  
  276.                         // The split operation is guaranteed to match at least at 'nextReceiver'
  277.                         defer = r.splitRecipientsLocked(receiverUid, r.nextReceiver);
  278.                         if (DEBUG_BROADCAST_DEFERRAL) {
  279.                             Slog.i(TAG_BROADCAST, "Post split:");
  280.                             Slog.i(TAG_BROADCAST, "Original broadcast receivers:");
  281.                             for (int i = 0; i < r.receivers.size(); i++) {
  282.                                 Slog.i(TAG_BROADCAST, "  " + r.receivers.get(i));
  283.                             }
  284.                             Slog.i(TAG_BROADCAST, "Split receivers:");
  285.                             for (int i = 0; i < defer.receivers.size(); i++) {
  286.                                 Slog.i(TAG_BROADCAST, "  " + defer.receivers.get(i));
  287.                             }
  288.                         }
  289.                         // Track completion refcount as well if relevant
  290.                         if (r.resultTo != null) {
  291.                             int token = r.splitToken;
  292.                             if (token == 0) {
  293.                                 // first split of this record; refcount for 'r' and 'deferred'
  294.                                 r.splitToken = defer.splitToken = nextSplitTokenLocked();
  295.                                 mSplitRefcounts.put(r.splitToken, 2);
  296.                                 if (DEBUG_BROADCAST_DEFERRAL) {
  297.                                     Slog.i(TAG_BROADCAST,
  298.                                             "Broadcast needs split refcount; using new token "
  299.                                             + r.splitToken);
  300.                                 }
  301.                             } else {
  302.                                 // new split from an already-refcounted situation; increment count
  303.                                 final int curCount = mSplitRefcounts.get(token);
  304.                                 if (DEBUG_BROADCAST_DEFERRAL) {
  305.                                     if (curCount == 0) {
  306.                                         Slog.wtf(TAG_BROADCAST,
  307.                                                 "Split refcount is zero with token for " + r);
  308.                                     }
  309.                                 }
  310.                                 mSplitRefcounts.put(token, curCount + 1);
  311.                                 if (DEBUG_BROADCAST_DEFERRAL) {
  312.                                     Slog.i(TAG_BROADCAST, "New split count for token " + token
  313.                                             + " is " + (curCount + 1));
  314.                                 }
  315.                             }
  316.                         }
  317.                     }
  318.                     mDispatcher.addDeferredBroadcast(receiverUid, defer);
  319.                     r = null;
  320.                     looped = true;
  321.                     continue;
  322.                 }
  323.             }
  324.         } while (r == null);
  325.  
  326.         // Get the next receiver...
  327.         //获取下一个将要处理的广播接收者在其列表中的位置
  328.         int recIdx = r.nextReceiver++;
  329.  
  330.         // Keep track of when this receiver started, and make sure there
  331.         // is a timeout message pending to kill it if need be.
  332.         //记录receiver 时间
  333.         r.receiverTime = SystemClock.uptimeMillis();
  334.         if (recIdx == 0) {
  335.             //记录分发时间戳,便于判断超时
  336.             r.dispatchTime = r.receiverTime;
  337.             r.dispatchClockTime = System.currentTimeMillis();
  338.  
  339.             if (mLogLatencyMetrics) {
  340.                 FrameworkStatsLog.write(
  341.                         FrameworkStatsLog.BROADCAST_DISPATCH_LATENCY_REPORTED,
  342.                         r.dispatchClockTime - r.enqueueClockTime);
  343.             }
  344.  
  345.             if (Trace.isTagEnabled(Trace.TRACE_TAG_ACTIVITY_MANAGER)) {
  346.                 Trace.asyncTraceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER,
  347.                     createBroadcastTraceTitle(r, BroadcastRecord.DELIVERY_PENDING),
  348.                     System.identityHashCode(r));
  349.                 Trace.asyncTraceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER,
  350.                     createBroadcastTraceTitle(r, BroadcastRecord.DELIVERY_DELIVERED),
  351.                     System.identityHashCode(r));
  352.             }
  353.             if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST, "Processing ordered broadcast ["
  354.                     + mQueueName + "] " + r);
  355.         }
  356.         if (! mPendingBroadcastTimeoutMessage) {
  357.             long timeoutTime = r.receiverTime + mConstants.TIMEOUT;
  358.             if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST,
  359.                     "Submitting BROADCAST_TIMEOUT_MSG ["
  360.                     + mQueueName + "] for " + r + " at " + timeoutTime);
  361.             //设置ANR的超时时间. 在这里可以为某个应用定制ANR 时间.
  362.             setBroadcastTimeoutLocked(timeoutTime);
  363.         }
  364.  
  365.         final BroadcastOptions brOptions = r.options;
  366.         final Object nextReceiver = r.receivers.get(recIdx);
  367.  
  368.          // 如果当前nextReceiver是一个BroadcastFilter类型，说明是一个动态注册接收者，不需要启动一个进程
  369.  
  370.         if (nextReceiver instanceof BroadcastFilter) {
  371.             // Simple case: this is a registered receiver who gets
  372.             // a direct call.
  373.             BroadcastFilter filter = (BroadcastFilter)nextReceiver;
  374.             if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  375.                     "Delivering ordered ["
  376.                     + mQueueName + "] to registered "
  377.                     + filter + ": " + r);
  378.         // 调用deliverToRegisteredReceiverLocked向所有的receivers发送广播
  379.         // 将它所描述的每一个无序广播发送给每一个广播接收者，异步处理广播
  380.         // 通过deliverToRegisteredReceiverLocked调用
  381.             deliverToRegisteredReceiverLocked(r, filter, r.ordered, recIdx);
  382.             if (r.receiver == null || !r.ordered) {
  383.                 // The receiver has already finished, so schedule to
  384.                 // process the next one.
  385.                 if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Quick finishing ["
  386.                         + mQueueName + "]: ordered="
  387.                         + r.ordered + " receiver=" + r.receiver);
  388.                 r.state = BroadcastRecord.IDLE;
  389.                 scheduleBroadcastsLocked();
  390.             } else {
  391.                 if (filter.receiverList != null) {
  392.                     maybeAddAllowBackgroundActivityStartsToken(filter.receiverList.app, r);
  393.                     // r is guaranteed ordered at this point, so we know finishReceiverLocked()
  394.                     // will get a callback and handle the activity start token lifecycle.
  395.                 }
  396.             }
  397.             return;
  398.         }
  399.  
  400.         // Hard case: need to instantiate the receiver, possibly
  401.         // starting its application process to host it.
  402.         // 如果上面if没有进行拦截，说明不是广播接收者动态注册的，而应该是静态注册的
  403.         // 此时进程可能没有启动
  404.         ResolveInfo info =
  405.             (ResolveInfo)nextReceiver;
  406.         ComponentName component = new ComponentName(
  407.                 info.activityInfo.applicationInfo.packageName,
  408.                 info.activityInfo.name);
  409.  
  410.         boolean skip = false;
  411.         if (brOptions != null &&
  412.                 (info.activityInfo.applicationInfo.targetSdkVersion
  413.                         < brOptions.getMinManifestReceiverApiLevel() ||
  414.                 info.activityInfo.applicationInfo.targetSdkVersion
  415.                         > brOptions.getMaxManifestReceiverApiLevel())) {
  416.             //不符合要求直接跳过
  417.             Slog.w(TAG, "Target SDK mismatch: receiver " + info.activityInfo
  418.                     + " targets " + info.activityInfo.applicationInfo.targetSdkVersion
  419.                     + " but delivery restricted to ["
  420.                     + brOptions.getMinManifestReceiverApiLevel() + ", "
  421.                     + brOptions.getMaxManifestReceiverApiLevel()
  422.                     + "] broadcasting " + broadcastDescription(r, component));
  423.             skip = true;
  424.         }
  425.  
  426.         if (!skip && !mService.validateAssociationAllowedLocked(r.callerPackage, r.callingUid,
  427.                 component.getPackageName(), info.activityInfo.applicationInfo.uid)) {
  428.             Slog.w(TAG, "Association not allowed: broadcasting "
  429.                     + broadcastDescription(r, component));
  430.             skip = true;
  431.         }
  432.         if (!skip) {
  433.             skip = !mService.mIntentFirewall.checkBroadcast(r.intent, r.callingUid,
  434.                     r.callingPid, r.resolvedType, info.activityInfo.applicationInfo.uid);
  435.             if (skip) {
  436.                 Slog.w(TAG, "Firewall blocked: broadcasting "
  437.                         + broadcastDescription(r, component));
  438.             }
  439.         }
  440.         int perm = mService.checkComponentPermission(info.activityInfo.permission,
  441.                 r.callingPid, r.callingUid, info.activityInfo.applicationInfo.uid,
  442.                 info.activityInfo.exported);
  443.         if (!skip && perm != PackageManager.PERMISSION_GRANTED) {
  444.             if (!info.activityInfo.exported) {
  445.                 Slog.w(TAG, "Permission Denial: broadcasting "
  446.                         + broadcastDescription(r, component)
  447.                         + " is not exported from uid " + info.activityInfo.applicationInfo.uid);
  448.             } else {
  449.                 Slog.w(TAG, "Permission Denial: broadcasting "
  450.                         + broadcastDescription(r, component)
  451.                         + " requires " + info.activityInfo.permission);
  452.             }
  453.             skip = true;
  454.         } else if (!skip && info.activityInfo.permission != null) {
  455.             final int opCode = AppOpsManager.permissionToOpCode(info.activityInfo.permission);
  456.             if (opCode != AppOpsManager.OP_NONE && mService.getAppOpsManager().noteOpNoThrow(opCode,
  457.                     r.callingUid, r.callerPackage, r.callerFeatureId,
  458.                     "Broadcast delivered to " + info.activityInfo.name)
  459.                     != AppOpsManager.MODE_ALLOWED) {
  460.                 Slog.w(TAG, "Appop Denial: broadcasting "
  461.                         + broadcastDescription(r, component)
  462.                         + " requires appop " + AppOpsManager.permissionToOp(
  463.                                 info.activityInfo.permission));
  464.                 skip = true;
  465.             }
  466.         }
  467.  
  468.         boolean isSingleton = false;
  469.         try {
  470.             isSingleton = mService.isSingleton(info.activityInfo.processName,
  471.                     info.activityInfo.applicationInfo,
  472.                     info.activityInfo.name, info.activityInfo.flags);
  473.         } catch (SecurityException e) {
  474.             Slog.w(TAG, e.getMessage());
  475.             skip = true;
  476.         }
  477.         if ((info.activityInfo.flags&ActivityInfo.FLAG_SINGLE_USER) != 0) {
  478.             if (ActivityManager.checkUidPermission(
  479.                     android.Manifest.permission.INTERACT_ACROSS_USERS,
  480.                     info.activityInfo.applicationInfo.uid)
  481.                             != PackageManager.PERMISSION_GRANTED) {
  482.                 Slog.w(TAG, "Permission Denial: Receiver " + component.flattenToShortString()
  483.                         + " requests FLAG_SINGLE_USER, but app does not hold "
  484.                         + android.Manifest.permission.INTERACT_ACROSS_USERS);
  485.                 skip = true;
  486.             }
  487.         }
  488.         if (!skip && info.activityInfo.applicationInfo.isInstantApp()
  489.                 && r.callingUid != info.activityInfo.applicationInfo.uid) {
  490.             Slog.w(TAG, "Instant App Denial: receiving "
  491.                     + r.intent
  492.                     + " to " + component.flattenToShortString()
  493.                     + " due to sender " + r.callerPackage
  494.                     + " (uid " + r.callingUid + ")"
  495.                     + " Instant Apps do not support manifest receivers");
  496.             skip = true;
  497.         }
  498.         if (!skip && r.callerInstantApp
  499.                 && (info.activityInfo.flags & ActivityInfo.FLAG_VISIBLE_TO_INSTANT_APP) == 0
  500.                 && r.callingUid != info.activityInfo.applicationInfo.uid) {
  501.             Slog.w(TAG, "Instant App Denial: receiving "
  502.                     + r.intent
  503.                     + " to " + component.flattenToShortString()
  504.                     + " requires receiver have visibleToInstantApps set"
  505.                     + " due to sender " + r.callerPackage
  506.                     + " (uid " + r.callingUid + ")");
  507.             skip = true;
  508.         }
  509.         if (r.curApp != null && r.curApp.mErrorState.isCrashing()) {
  510.             // If the target process is crashing, just skip it.
  511.             Slog.w(TAG, "Skipping deliver ordered [" + mQueueName + "] " + r
  512.                     + " to " + r.curApp + ": process crashing");
  513.             skip = true;
  514.         }
  515.         if (!skip) {
  516.             boolean isAvailable = false;
  517.             try {
  518.                 isAvailable = AppGlobals.getPackageManager().isPackageAvailable(
  519.                         info.activityInfo.packageName,
  520.                         UserHandle.getUserId(info.activityInfo.applicationInfo.uid));
  521.             } catch (Exception e) {
  522.                 // all such failures mean we skip this receiver
  523.                 Slog.w(TAG, "Exception getting recipient info for "
  524.                         + info.activityInfo.packageName, e);
  525.             }
  526.             if (!isAvailable) {
  527.                 Slog.w(TAG_BROADCAST,
  528.                         "Skipping delivery to " + info.activityInfo.packageName + " / "
  529.                         + info.activityInfo.applicationInfo.uid
  530.                         + " : package no longer available");
  531.                 skip = true;
  532.             }
  533.         }
  534.  
  535.         // If permissions need a review before any of the app components can run, we drop
  536.         // the broadcast and if the calling app is in the foreground and the broadcast is
  537.         // explicit we launch the review UI passing it a pending intent to send the skipped
  538.         // broadcast.
  539.         if (!skip) {
  540.             if (!requestStartTargetPermissionsReviewIfNeededLocked(r,
  541.                     info.activityInfo.packageName, UserHandle.getUserId(
  542.                             info.activityInfo.applicationInfo.uid))) {
  543.                 Slog.w(TAG_BROADCAST,
  544.                         "Skipping delivery: permission review required for "
  545.                                 + broadcastDescription(r, component));
  546.                 skip = true;
  547.             }
  548.         }
  549.  
  550.         // This is safe to do even if we are skipping the broadcast, and we need
  551.         // this information now to evaluate whether it is going to be allowed to run.
  552.         final int receiverUid = info.activityInfo.applicationInfo.uid;
  553.         // If it's a singleton, it needs to be the same app or a special app
  554.         if (r.callingUid != Process.SYSTEM_UID && isSingleton
  555.                 && mService.isValidSingletonCall(r.callingUid, receiverUid)) {
  556.             info.activityInfo = mService.getActivityInfoForUser(info.activityInfo, 0);
  557.         }
  558.         // 得到ResolveInfo对象info所描述的广播接收者的android:process属性值，
  559.         // 即它需要运行在的应用程序进程的名称，并且保存在变量targetProcess中
  560.         String targetProcess = info.activityInfo.processName;
  561.         // 获取当前广播接收者的进程记录，也就是该静态广播接收者是否已经运行
  562.         ProcessRecord app = mService.getProcessRecordLocked(targetProcess,
  563.                 info.activityInfo.applicationInfo.uid);
  564.  
  565.         if (!skip) {
  566.             final int allowed = mService.getAppStartModeLOSP(
  567.                     info.activityInfo.applicationInfo.uid, info.activityInfo.packageName,
  568.                     info.activityInfo.applicationInfo.targetSdkVersion, -1, true, false, false);
  569.             if (allowed != ActivityManager.APP_START_MODE_NORMAL) {
  570.                 // We won't allow this receiver to be launched if the app has been
  571.                 // completely disabled from launches, or it was not explicitly sent
  572.                 // to it and the app is in a state that should not receive it
  573.                 // (depending on how getAppStartModeLOSP has determined that).
  574.                 if (allowed == ActivityManager.APP_START_MODE_DISABLED) {
  575.                     Slog.w(TAG, "Background execution disabled: receiving "
  576.                             + r.intent + " to "
  577.                             + component.flattenToShortString());
  578.                     skip = true;
  579.                 } else if (((r.intent.getFlags()&Intent.FLAG_RECEIVER_EXCLUDE_BACKGROUND) != 0)
  580.                         || (r.intent.getComponent() == null
  581.                             && r.intent.getPackage() == null
  582.                             && ((r.intent.getFlags()
  583.                                     & Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND) == 0)
  584.                             && !isSignaturePerm(r.requiredPermissions))) {
  585.                     mService.addBackgroundCheckViolationLocked(r.intent.getAction(),
  586.                             component.getPackageName());
  587.                     Slog.w(TAG, "Background execution not allowed: receiving "
  588.                             + r.intent + " to "
  589.                             + component.flattenToShortString());
  590.                     skip = true;
  591.                 }
  592.             }
  593.         }
  594.  
  595.         if (!skip && !Intent.ACTION_SHUTDOWN.equals(r.intent.getAction())
  596.                 && !mService.mUserController
  597.                 .isUserRunning(UserHandle.getUserId(info.activityInfo.applicationInfo.uid),
  598.                         0 /* flags */)) {
  599.             skip = true;
  600.             Slog.w(TAG,
  601.                     "Skipping delivery to " + info.activityInfo.packageName + " / "
  602.                             + info.activityInfo.applicationInfo.uid + " : user is not running");
  603.         }
  604.  
  605.         /// M: DuraSpeed @{
  606.         boolean isSuppress = false;
  607.         isSuppress = mService.mAmsExt.onBeforeStartProcessForStaticReceiver(
  608.                 info.activityInfo.packageName);
  609.         if (isSuppress) {
  610.             //快霸进行定制
  611.             Slog.d(TAG, "processNextBroadcastLocked, suppress to start process of staticReceiver"
  612.                 + " for package:" + info.activityInfo.packageName);
  613.             skip = true;
  614.         }
  615.         /// @}
  616.  
  617.         if (!skip && r.excludedPermissions != null && r.excludedPermissions.length > 0) {
  618.             for (int i = 0; i < r.excludedPermissions.length; i++) {
  619.                 String excludedPermission = r.excludedPermissions[i];
  620.                 try {
  621.                     perm = AppGlobals.getPackageManager()
  622.                         .checkPermission(excludedPermission,
  623.                                 info.activityInfo.applicationInfo.packageName,
  624.                                 UserHandle
  625.                                 .getUserId(info.activityInfo.applicationInfo.uid));
  626.                 } catch (RemoteException e) {
  627.                     perm = PackageManager.PERMISSION_DENIED;
  628.                 }
  629.  
  630.                 int appOp = AppOpsManager.permissionToOpCode(excludedPermission);
  631.                 if (appOp != AppOpsManager.OP_NONE) {
  632.                     // When there is an app op associated with the permission,
  633.                     // skip when both the permission and the app op are
  634.                     // granted.
  635.                     if ((perm == PackageManager.PERMISSION_GRANTED) && (
  636.                                 mService.getAppOpsManager().checkOpNoThrow(appOp,
  637.                                 info.activityInfo.applicationInfo.uid,
  638.                                 info.activityInfo.packageName)
  639.                             == AppOpsManager.MODE_ALLOWED)) {
  640.                         skip = true;
  641.                         break;
  642.                     }
  643.                 } else {
  644.                     // When there is no app op associated with the permission,
  645.                     // skip when permission is granted.
  646.                     if (perm == PackageManager.PERMISSION_GRANTED) {
  647.                         skip = true;
  648.                         break;
  649.                     }
  650.                 }
  651.             }
  652.         }
  653.  
  654.         // Check that the receiver does *not* belong to any of the excluded packages
  655.         if (!skip && r.excludedPackages != null && r.excludedPackages.length > 0) {
  656.             if (ArrayUtils.contains(r.excludedPackages, component.getPackageName())) {
  657.                 Slog.w(TAG, "Skipping delivery of excluded package "
  658.                         + r.intent + " to "
  659.                         + component.flattenToShortString()
  660.                         + " excludes package " + component.getPackageName()
  661.                         + " due to sender " + r.callerPackage
  662.                         + " (uid " + r.callingUid + ")");
  663.                 skip = true;
  664.             }
  665.         }
  666.  
  667.         if (!skip && info.activityInfo.applicationInfo.uid != Process.SYSTEM_UID &&
  668.                 r.requiredPermissions != null && r.requiredPermissions.length > 0) {
  669.             for (int i = 0; i < r.requiredPermissions.length; i++) {
  670.                 String requiredPermission = r.requiredPermissions[i];
  671.                 try {
  672.                     perm = AppGlobals.getPackageManager().
  673.                             checkPermission(requiredPermission,
  674.                                     info.activityInfo.applicationInfo.packageName,
  675.                                     UserHandle
  676.                                     .getUserId(info.activityInfo.applicationInfo.uid));
  677.                 } catch (RemoteException e) {
  678.                     perm = PackageManager.PERMISSION_DENIED;
  679.                 }
  680.                 if (perm != PackageManager.PERMISSION_GRANTED) {
  681.                     Slog.w(TAG, "Permission Denial: receiving "
  682.                             + r.intent + " to "
  683.                             + component.flattenToShortString()
  684.                             + " requires " + requiredPermission
  685.                             + " due to sender " + r.callerPackage
  686.                             + " (uid " + r.callingUid + ")");
  687.                     skip = true;
  688.                     break;
  689.                 }
  690.                 int appOp = AppOpsManager.permissionToOpCode(requiredPermission);
  691.                 if (appOp != AppOpsManager.OP_NONE && appOp != r.appOp) {
  692.                     if (!noteOpForManifestReceiver(appOp, r, info, component)) {
  693.                         skip = true;
  694.                         break;
  695.                     }
  696.                 }
  697.             }
  698.         }
  699.         if (!skip && r.appOp != AppOpsManager.OP_NONE) {
  700.             if (!noteOpForManifestReceiver(r.appOp, r, info, component)) {
  701.                 skip = true;
  702.             }
  703.         }
  704.  
  705.         if (skip) {
  706.             if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  707.                     "Skipping delivery of ordered [" + mQueueName + "] "
  708.                     + r + " for reason described above");
  709.             r.delivery[recIdx] = BroadcastRecord.DELIVERY_SKIPPED;
  710.             r.receiver = null;
  711.             r.curFilter = null;
  712.             r.state = BroadcastRecord.IDLE;
  713.             r.manifestSkipCount++;
  714.             scheduleBroadcastsLocked();
  715.             return;
  716.         }
  717.         r.manifestCount++;
  718.  
  719.         r.delivery[recIdx] = BroadcastRecord.DELIVERY_DELIVERED;
  720.         r.state = BroadcastRecord.APP_RECEIVE;
  721.         r.curComponent = component;
  722.         r.curReceiver = info.activityInfo;
  723.         if (DEBUG_MU && r.callingUid > UserHandle.PER_USER_RANGE) {
  724.             Slog.v(TAG_MU, "Updated broadcast record activity info for secondary user, "
  725.                     + info.activityInfo + ", callingUid = " + r.callingUid + ", uid = "
  726.                     + receiverUid);
  727.         }
  728.         final boolean isActivityCapable =
  729.                 (brOptions != null && brOptions.getTemporaryAppAllowlistDuration() > 0);
  730.         //临时白名单
  731.         maybeScheduleTempAllowlistLocked(receiverUid, r, brOptions);
  732.  
  733.         // Report that a component is used for explicit broadcasts.
  734.         if (r.intent.getComponent() != null && r.curComponent != null
  735.                 && !TextUtils.equals(r.curComponent.getPackageName(), r.callerPackage)) {
  736.             //记录显式广播
  737.             mService.mUsageStatsService.reportEvent(
  738.                     r.curComponent.getPackageName(), r.userId, Event.APP_COMPONENT_USED);
  739.         }
  740.  
  741.         // Broadcast is being executed, its package can't be stopped.
  742.         try {
  743.             //广播被接收,不能将接收者设置为stop 状态.
  744.             AppGlobals.getPackageManager().setPackageStoppedState(
  745.                     r.curComponent.getPackageName(), false, r.userId);
  746.         } catch (RemoteException e) {
  747.         } catch (IllegalArgumentException e) {
  748.             Slog.w(TAG, "Failed trying to unstop package "
  749.                     + r.curComponent.getPackageName() + ": " + e);
  750.         }
  751.  
  752.         // Is this receiver's application already running?
  753.         //判断当前接收者的应用是否在运行.
  754.         if (app != null && app.getThread() != null && !app.isKilled()) {
  755.             try {
  756.                 app.addPackage(info.activityInfo.packageName,
  757.                         info.activityInfo.applicationInfo.longVersionCode, mService.mProcessStats);
  758.                 maybeAddAllowBackgroundActivityStartsToken(app, r);
  759.                 //处理当前广播
  760.                 // app进程存在，通过processCurBroadcastLocked -> ActivityThread.scheduleReceiver -> receiver.onReceive处理当前广播 
  761.  
  762.                 processCurBroadcastLocked(r, app);
  763.                 //若进程还是一直活着,当前接收者处理完成,直接结束
  764.                 // 静态广播是order广播是一种同步处理方式，因此处理完可以直接return
  765.  
  766.                 return;
  767.             } catch (RemoteException e) {
  768.                 Slog.w(TAG, "Exception when sending broadcast to "
  769.                       + r.curComponent, e);
  770.             } catch (RuntimeException e) {
  771.                 Slog.wtf(TAG, "Failed sending broadcast to "
  772.                         + r.curComponent + " with " + r.intent, e);
  773.                 // If some unexpected exception happened, just skip
  774.                 // this broadcast.  At this point we are not in the call
  775.                 // from a client, so throwing an exception out from here
  776.                 // will crash the entire system instead of just whoever
  777.                 // sent the broadcast.
  778.                 logBroadcastReceiverDiscardLocked(r);
  779.                 finishReceiverLocked(r, r.resultCode, r.resultData,
  780.                         r.resultExtras, r.resultAbort, false);
  781.                 scheduleBroadcastsLocked();
  782.                 // We need to reset the state if we failed to start the receiver.
  783.                 r.state = BroadcastRecord.IDLE;
  784.                 return;
  785.             }
  786.  
  787.             // If a dead object exception was thrown -- fall through to
  788.             // restart the application.
  789.         }
  790.  
  791.         // Not running -- get it started, to be executed when the app comes up.
  792.         if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  793.                 "Need to start app ["
  794.                 + mQueueName + "] " + targetProcess + " for broadcast " + r);
  795.         //当前接收者应用没有存活,则直接启动它.
  796.         r.curApp = mService.startProcessLocked(targetProcess,
  797.                 info.activityInfo.applicationInfo, true,
  798.                 r.intent.getFlags() | Intent.FLAG_FROM_BACKGROUND,
  799.                 new HostingRecord("broadcast", r.curComponent), isActivityCapable
  800.                 ? ZYGOTE_POLICY_FLAG_LATENCY_SENSITIVE : ZYGOTE_POLICY_FLAG_EMPTY,
  801.                 (r.intent.getFlags() & Intent.FLAG_RECEIVER_BOOT_UPGRADE) != 0, false);
  802.         //启动应用失败.
  803.         if (r.curApp == null) {
  804.             // Ah, this recipient is unavailable.  Finish it if necessary,
  805.             // and mark the broadcast record as ready for the next.
  806.             //若启动失败,则丢失信息,并记录.
  807.             Slog.w(TAG, "Unable to launch app "
  808.                     + info.activityInfo.applicationInfo.packageName + "/"
  809.                     + receiverUid + " for broadcast "
  810.                     + r.intent + ": process is bad");
  811.             logBroadcastReceiverDiscardLocked(r);
  812.             finishReceiverLocked(r, r.resultCode, r.resultData,
  813.                     r.resultExtras, r.resultAbort, false);
  814.             scheduleBroadcastsLocked();
  815.             r.state = BroadcastRecord.IDLE;
  816.             return;
  817.         }
  818.        // 将BroadcastRecord赋值为mPendingBroadcast，等待应用启动完成后处理
  819.        // 正在启动接收者进程，将正在启动的BroadcastRecord记录存储到mPendingBroadcast中，同时将当前正在
  820.        // 启动的接收者进程在所有接收者中的索引存储到mPendingBroadcastRecvIndex，如果当前广播接收者处理
  821.         // 完，需要继续从mPendingBroadcastRecvIndex计算到下一个接收者发送当前广播
  822.  
  823.         maybeAddAllowBackgroundActivityStartsToken(r.curApp, r);
  824.         mPendingBroadcast = r;
  825.         mPendingBroadcastRecvIndex = recIdx;
  826.     }

(1)上面这段代码逻辑：对并行处理列表中的广播调用deliverToRegisteredReceiverLocked将每一个无序广播发送给每一个广播接收者，异步处理广播。注意入参ordered值为false。

(2)上面这段代码是在处理广播前对一些特殊情况进行处理，例如，处理列表为空，直接返回；当前广播正在处理中返回；下一个接收者为空或者当前接受者设置了resultAbort 等异常情况处理。

(3)上面代码开始对广播进行处理，先进行了计时操作，然后根据接收者不同，先对动态注册接收器进行处理（BroadcastFilter类型）。逻辑最后通过deliverToRegisteredReceiverLocked调用ActivityThread.scheduleRegisteredReceiver处理广播。上面有分析这个函数，此时入参ordered是true，用来执行动态注册的广播接收者的发送接收过程。
 

4.2.2.2 静态接收器的处理

上面代码是对静态广播的处理，静态广播又分为两种，静态接收者所在进程是启动状态，静态接收者所在进程是未启动状态。根据所在进程的启动状态分别来进行处理。

app进程存在，通过processCurBroadcastLocked -> ActivityThread.scheduleReceiver -> receiver.onReceive处理当前广播。

app进程不存在，会先创建该进程。
 

APP存在，调用BroadcastQueue的processCurBroadcastLocked方法处理有序广播

  1.     private final void processCurBroadcastLocked(BroadcastRecord r,
  2.             ProcessRecord app) throws RemoteException {
  3.  
  4.         //LOG打印
  5.         if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  6.                 "Process cur broadcast " + r + " for app " + app);
  7.         
  8.         final IApplicationThread thread = app.getThread();
  9.         if (thread == null) {
  10.             //若没有找到ApplicationThread 对象,则报异常.
  11.             throw new RemoteException();
  12.         }
  13.         if (app.isInFullBackup()) {
  14.             //若是FULL备份,则忽略此广播
  15.             skipReceiverLocked(r);
  16.             return;
  17.         }
  18.    
  19.         // 将进程的相关信息写入当前BroadcastRecord中相关的接收者 
  20.         r.receiver = thread.asBinder();
  21.         r.curApp = app;
  22.         final ProcessReceiverRecord prr = app.mReceivers;
  23.         prr.addCurReceiver(r);
  24.         app.mState.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_RECEIVER);
  25.         mService.updateLruProcessLocked(app, false, null);
  26.         // Make sure the oom adj score is updated before delivering the broadcast.
  27.         // Force an update, even if there are other pending requests, overall it still saves time,
  28.         // because time(updateOomAdj(N apps)) <= N * time(updateOomAdj(1 app)).
  29.         mService.enqueueOomAdjTargetLocked(app);
  30.         mService.updateOomAdjPendingTargetsLocked(OomAdjuster.OOM_ADJ_REASON_START_RECEIVER);
  31.  
  32.         // Tell the application to launch this receiver.
  33.         //告知启动的组件
  34.         r.intent.setComponent(r.curComponent);
  35.  
  36.         boolean started = false;
  37.         try {
  38.             if (DEBUG_BROADCAST_LIGHT) Slog.v(TAG_BROADCAST,
  39.                     "Delivering to component " + r.curComponent
  40.                     + ": " + r);
  41.             
  42.             mService.notifyPackageUse(r.intent.getComponent().getPackageName(),
  43.                                       PackageManager.NOTIFY_PACKAGE_USE_BROADCAST_RECEIVER);
  44.             //处理广播发送.
  45.             thread.scheduleReceiver(new Intent(r.intent), r.curReceiver,
  46.                     mService.compatibilityInfoForPackage(r.curReceiver.applicationInfo),
  47.                     r.resultCode, r.resultData, r.resultExtras, r.ordered, r.userId,
  48.                     app.mState.getReportedProcState());
  49.            
  50.             if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  51.                     "Process cur broadcast " + r + " DELIVERED for app " + app);
  52.             started = true;
  53.         } finally {
  54.             if (!started) {
  55.                 //若启动失败,则打印对应的信息
  56.                 if (DEBUG_BROADCAST)  Slog.v(TAG_BROADCAST,
  57.                         "Process cur broadcast " + r + ": NOT STARTED!");
  58.                 r.receiver = null;
  59.                 r.curApp = null;
  60.                 prr.removeCurReceiver(r);
  61.             }
  62.         }
  63.     }

APP存在，调用ApplicationThread的scheduleReceiver方法

android/frameworks/base/core/java/android/app/ActivityThread.java

  1.     private class ApplicationThread extends IApplicationThread.Stub {
  2.         private static final String DB_INFO_FORMAT = "  %8s %8s %14s %14s  %s";
  3.  
  4.         public final void scheduleReceiver(Intent intent, ActivityInfo info,
  5.                 CompatibilityInfo compatInfo, int resultCode, String data, Bundle extras,
  6.                 boolean sync, int sendingUser, int processState) {
  7.             updateProcessState(processState, false);
  8.             ReceiverData r = new ReceiverData(intent, resultCode, data, extras,
  9.                     sync, false, mAppThread.asBinder(), sendingUser);
  10.             r.info = info;
  11.             r.compatInfo = compatInfo;
  12.             sendMessage(H.RECEIVER, r);
  13.         }
  14.  
  15.         public void handleMessage(Message msg) {
  16.             if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
  17.  
  18.                 case RECEIVER:
  19.                     Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "broadcastReceiveComp");
  20.                     //使用handleReceiver函数
  21.                     handleReceiver((ReceiverData)msg.obj);
  22.                     Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

APP存在，调用ApplicationThread的handleReceiver方法

  1.     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
  2.     private void handleReceiver(ReceiverData data) {
  3.         // If we are getting ready to gc after going to the background, well
  4.         // we are back active so skip it.
  5.         unscheduleGcIdler();
  6.         // 1） 创建BroadcastReceiver对象
  7.         // 这里处理的是静态广播接收者，默认认为接收者BroadcastReceiver对象不存在
  8.         // 每次接受都会创建一个新的BroadcastReceiver对象
  9.         //获取组件
  10.         String component = data.intent.getComponent().getClassName();
  11.  
  12.          //获取packageinfo 对象
  13.          LoadedApk packageInfo = getPackageInfoNoCheck(
  14.                 data.info.applicationInfo, data.compatInfo);
  15.  
  16.         IActivityManager mgr = ActivityManager.getService();
  17.  
  18.         Application app;
  19.         BroadcastReceiver receiver;
  20.         ContextImpl context;
  21.         try {
  22.  
  23.             // 首先从AMS传递的intent中获取当前处理该广播的组件名称，然后通过反射创建一个BroadcastReceiver
  24.             // 对象，从这里可以看出来，静态广播处理的时候，每次都会创建一个新的BroadcastReceiver对象；
  25.  
  26.             // 创建Application对象，如果进程已经启动，Application对象已经创建
  27.  
  28.             app = packageInfo.makeApplication(false, mInstrumentation);
  29.             context = (ContextImpl) app.getBaseContext();
  30.             if (data.info.splitName != null) {
  31.                 context = (ContextImpl) context.createContextForSplit(data.info.splitName);
  32.             }
  33.             if (data.info.attributionTags != null && data.info.attributionTags.length > 0) {
  34.                 final String attributionTag = data.info.attributionTags[0];
  35.                 context = (ContextImpl) context.createAttributionContext(attributionTag);
  36.             }
  37.             java.lang.ClassLoader cl = context.getClassLoader();
  38.             data.intent.setExtrasClassLoader(cl);
  39.             data.intent.prepareToEnterProcess(
  40.                     isProtectedComponent(data.info) || isProtectedBroadcast(data.intent),
  41.                     context.getAttributionSource());
  42.             data.setExtrasClassLoader(cl);
  43.  
  44.             receiver = packageInfo.getAppFactory()
  45.                     .instantiateReceiver(cl, data.info.name, data.intent);
  46.         } catch (Exception e) {
  47.             if (DEBUG_BROADCAST) Slog.i(TAG,
  48.                     "Finishing failed broadcast to " + data.intent.getComponent());
  49.             data.sendFinished(mgr);
  50.             throw new RuntimeException(
  51.                 "Unable to instantiate receiver " + component
  52.                 + ": " + e.toString(), e);
  53.         }
  54.         // 2） 执行onReceive函数
  55.         try {
  56.             if (localLOGV) Slog.v(
  57.                 TAG, "Performing receive of " + data.intent
  58.                 + ": app=" + app
  59.                 + ", appName=" + app.getPackageName()
  60.                 + ", pkg=" + packageInfo.getPackageName()
  61.                 + ", comp=" + data.intent.getComponent().toShortString()
  62.                 + ", dir=" + packageInfo.getAppDir());
  63.  
  64.             sCurrentBroadcastIntent.set(data.intent);
  65.             // 调用接收者的onReceive方法，这里还调用了setPendingResult方法，详细内容请看BroadcastReceiver.goAsync方法。
  66.             receiver.setPendingResult(data);
  67.             receiver.onReceive(context.getReceiverRestrictedContext(),
  68.                     data.intent);
  69.         } catch (Exception e) {
  70.             if (DEBUG_BROADCAST) Slog.i(TAG,
  71.                     "Finishing failed broadcast to " + data.intent.getComponent());
  72.             data.sendFinished(mgr);
  73.             if (!mInstrumentation.onException(receiver, e)) {
  74.                 throw new RuntimeException(
  75.                     "Unable to start receiver " + component
  76.                     + ": " + e.toString(), e);
  77.             }
  78.         } finally {
  79.             sCurrentBroadcastIntent.set(null);
  80.         }
  81.  
  82.         if (receiver.getPendingResult() != null) {
  83.             // 3） 向AMS发送处理结束消息
  84.             data.finish();
  85.         }
  86.     }

上面代码主要干了三件事情：

  • 创建BroadcastReceiver对象；
  • 执行onReceive函数；
  • 向AMS发送处理结束消息，通知将当前广播发送给下一个接收者；

APP未启动，先创建该进程
如果静态广播接收者进程尚未启动，会直接调用AMS的startProcessLocked函数启动该接收者进程，并将当前正在等待进程
启动的BroadcastRecord存储到mPendingBroadcast里面，这个就是静态广播拉起应用的原理。

在app进程启动之后，会先调用application的attach和onCreate方法，然后才会调用ActivityManagerService的sendPendingBroadcastsLocked方法。
 

  1.     // The app just attached; send any pending broadcasts that it should receive
  2.     boolean sendPendingBroadcastsLocked(ProcessRecord app) {
  3.         boolean didSomething = false;
  4.         for (BroadcastQueue queue : mBroadcastQueues) {
  5.          	//调用BroadcastQueue的sendPendingBroadcastsLocked方法
  6.             didSomething |= queue.sendPendingBroadcastsLocked(app);
  7.         }
  8.         return didSomething;
  9.     }

mBroadcastQueues是包含前台和后台广播队列，这里分别调用前台和后台优先级广播的BroadcastQueue.sendPendingBroadcastsLocked方法。

调用BroadcastQueue的sendPendingBroadcastsLocked方法

  1.     // 未启动进程的广播接收者需要先启动进程，最后到达这个函数
  2.     public boolean sendPendingBroadcastsLocked(ProcessRecord app) {
  3.         boolean didSomething = false;
  4.         final BroadcastRecord br = mPendingBroadcast;
  5.         if (br != null && br.curApp.getPid() > 0 && br.curApp.getPid() == app.getPid()) {
  6.             if (br.curApp != app) {
  7.                 Slog.e(TAG, "App mismatch when sending pending broadcast to "
  8.                         + app.processName + ", intended target is " + br.curApp.processName);
  9.                 return false;
  10.             }
  11.             try {
  12.                 //启动完成设置为null
  13.                 mPendingBroadcast = null;
  14.                 //调用processCurBroadcastLocked方法进行处理
  15.                 processCurBroadcastLocked(br, app);
  16.                 didSomething = true;
  17.             } catch (Exception e) {
  18.                 Slog.w(TAG, "Exception in new application when starting receiver "
  19.                         + br.curComponent.flattenToShortString(), e);
  20.                 logBroadcastReceiverDiscardLocked(br);
  21.                 finishReceiverLocked(br, br.resultCode, br.resultData,
  22.                         br.resultExtras, br.resultAbort, false);
  23.                 scheduleBroadcastsLocked();
  24.                 // We need to reset the state if we failed to start the receiver.
  25.                 br.state = BroadcastRecord.IDLE;
  26.                 throw new RuntimeException(e.getMessage());
  27.             }
  28.         }
  29.         return didSomething;
  30.     }

这里是找到等待处理的广播并且判断是否为空，以及是否和当前进程的pid相同，也就是不是这个进程的等待广播，如果是就调用processCurBroadcastLocked方法进行处理，后面的处理和上面app已启动的流程一致了。

5、流程总结

上面流程大体流程图：

执行时序图：

三、总结
看完源码再来看下一开始的问题：
1、广播为啥会阻塞呢？发送给接收器就行了，为啥还要等着接收器处理完才处理下一个？

从上面的源码分析可知，广播的处理分为并行和有序两个队列，出问题的无序广播静态接收器放在了有序处理列表中，而有序处理列表的执行是串行的，只有前面的执行完，才会轮到下一个处理，所以前面的广播如果在onReceive中有耗时操作，后面的广播就会堵塞。

2、 由普通的后台广播改为前台广播后，为啥处理的会更快？

在上面源码中有个变量的注释：mTimeoutPeriod。这个变量初始化是在BroadcastQueue初始化的时候传入的，也就是在AMS（AMS构造函数中）中初始化mFgBroadcastQueue和mBgBroadcastQueue时传入的，前台广播的超时时间是10s，后台的超时时间是60s。 也会出现一种问题,就是产生发生ANR的时间段时间不一样.
 

BROADCAST_FG_TIMEOUT = 10 * 1000 
BROADCAST_BG_TIMEOUT = 60 * 1000

后台广播的设计思想就是当前应用优先，尽可能多让收到广播的应用有充足的时间把事件做完。

而前台广播的目的是紧急通知，设计上就倾向于当前应用赶快处理完，尽快传给下一个。

也就是说在设计上前台广播主要用于响应性能较高的场景，因为ANR时间是10s，所以开发设计的时候应该尽可能少用。因为前台广播使用的比较少，所以队列相对空闲，响应速度快。

3、对照源码分析总结：

    (1) 前后台队列都有自己并行和有序广播队列，互相不影响；
    (2) 并行队列里是无序广播+动态注册接收者；
    (3) 有序队列里是有序广播+动态接收者和静态接收者，静态接收者默认就是有序的；
    (4) 有序广播+动态接收者执行优于静态接收者先执行，综合起来就是广播相同的情况下，动态接收器优于静态接收器；
    (5) Android版本高的，很多系统广播只支持动态注册，静态注册的话收不到广播，例如：息屏亮屏广播。因为静态注册的话，发广播的时候会把所有注册未启动的app全部拉起来，静态处理器又默认串行处理，增加了广播的处理时间。
 

知识点介绍:

1. instant app :谷歌推出的类似于微信小程序（或者说小程序类似于instant app）的一项技术，用户无须安装应用，用完就走，同时兼备h5的便捷和原生应用的优质体验。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/不正经/article/detail/308540
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号