frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
frameworks/base/services/core/java/com/android/server/pm/ComponentResolver.java
frameworks/base/services/core/java/com/android/server/am/BroadcastQueue.java
frameworks/base/services/core/java/com/android/server/am/BroadcastRecord.java

frameworks/base/core/java/android/app/ContextImpl.java

@Override
public void sendBroadcast(Intent intent) {
    warnIfCallingFromSystemProcess();
    String resolvedType = intent.resolveTypeIfNeeded(getContentResolver());
 
    intent.prepareToLeaveProcess(this);
    ActivityManager.getService().broadcastIntent(
            mMainThread.getApplicationThread(), intent, resolvedType, null,
            Activity.RESULT_OK, null, null, null, AppOpsManager.OP_NONE, null, false, false, getUserId());
}

public final int broadcastIntent(IApplicationThread caller,
        Intent intent, String resolvedType, IIntentReceiver resultTo,
        int resultCode, String resultData, Bundle resultExtras,
        String[] requiredPermissions, int appOp, Bundle bOptions,
        boolean serialized, boolean sticky, int userId) {
    enforceNotIsolatedCaller("broadcastIntent");
    synchronized(this) {
        intent = verifyBroadcastLocked(intent);
 
        final ProcessRecord callerApp = getRecordForAppLocked(caller);
        final int callingPid = Binder.getCallingPid();
        final int callingUid = Binder.getCallingUid();
 
        final long origId = Binder.clearCallingIdentity();
        try {
            return broadcastIntentLocked(callerApp,
                    callerApp != null ? callerApp.info.packageName : null,
                    intent, resolvedType, resultTo, resultCode, resultData, resultExtras,
                    requiredPermissions, appOp, bOptions, serialized, sticky,
                    callingPid, callingUid, callingUid, callingPid, userId);
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
    }
}

final int broadcastIntentLocked(ProcessRecord callerApp,
        String callerPackage, Intent intent, String resolvedType,
        IIntentReceiver resultTo, int resultCode, String resultData,
        Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions,
        boolean ordered, boolean sticky, int callingPid, int callingUid, int realCallingUid,
        int realCallingPid, int userId) {
    return broadcastIntentLocked(callerApp, callerPackage, intent, resolvedType, resultTo,
        resultCode, resultData, resultExtras, requiredPermissions, appOp, bOptions, ordered,
        sticky, callingPid, callingUid, realCallingUid, realCallingPid, userId,
        false /* allowBackgroundActivityStarts */);
}

final int broadcastIntentLocked(ProcessRecord callerApp,
        String callerPackage, Intent intent, String resolvedType,
        IIntentReceiver resultTo, int resultCode, String resultData,
        Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions,
        boolean ordered, boolean sticky, int callingPid, int callingUid, int realCallingUid,
        int realCallingPid, int userId, boolean allowBackgroundActivityStarts) {
    intent = new Intent(intent);
 
    // 1.根据各种限制设置intent的flags: 比如Instant App不能使用FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS, 广播不会发送到杀死的进程, 系统还没启动不允许启动新进程
    // 2.检查接收广播的userId是否正在运行
    // 3.权限和限制检查: 如CHANGE_DEVICE_IDLE_TEMP_WHITELIST权限, START_ACTIVITIES_FROM_BACKGROUND权限, OP_RUN_ANY_IN_BACKGROUND操作权限
    // 4.非系统用户不允许发送ProtectedBroadcast, 系统用户指(ROOT_UID/SYSTEM_UID/PHONE_UID/BLUETOOTH_UID/NFC_UID/SE_UID/NETWORK_STACK_UID)
    ...
 
    userId = mUserController.handleIncomingUser(callingPid, callingUid, userId, true, ALLOW_NON_FULL, "broadcast", callerPackage);
    boolean timeoutExempt = false;
    final String action = intent.getAction();
    if (action != null) {
        // 如果action所属Intent需要发送给未启动的或后台的进程, 则Intent添加flags为FLAG_RECEIVER_INCLUDE_BACKGROUND
        if (getBackgroundLaunchBroadcasts().contains(action)) {
            intent.addFlags(Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
        }
 
        // 包管理器发出的和包移除相关的action的处理，如ACTION_UID_REMOVED/ACTION_PACKAGE_REMOVED/ACTION_PACKAGE_CHANGED/...
        ...
    }
    // sticky广播处理, 常规的sendBroadcast发送的都是非sticky广播, 走不到这里
    if (sticky) {
        // 权限和条件检查包括: Manifest.permission.BROADCAST_STICKY权限检查, requiredPermissions和Component为空检查, mStickyBroadcasts重复广播检查
        ...
 
        // 将发送的广播Intent替换或插入到mStickyBroadcasts队列中相应位置
        ArrayMap<String, ArrayList<Intent>> stickies = mStickyBroadcasts.get(userId);
        if (stickies == null) {
            stickies = new ArrayMap<>();
            mStickyBroadcasts.put(userId, stickies);
        }
        ArrayList<Intent> list = stickies.get(intent.getAction());
        if (list == null) {
            list = new ArrayList<>();
            stickies.put(intent.getAction(), list);
        }
        final int stickiesCount = list.size();
        int i;
        for (i = 0; i < stickiesCount; i++) {
            if (intent.filterEquals(list.get(i))) {
                // This sticky already exists, replace it.
                list.set(i, new Intent(intent));
                break;
            }
        }
        if (i >= stickiesCount) {
            list.add(new Intent(intent));
        }
    }
 
    // 设置广播的目标用户数组users
    int[] users;
    if (userId == UserHandle.USER_ALL) {
        // 所有启动用户
        users = mUserController.getStartedUserArray();
    } else {
        // 特定用户
        users = new int[] {userId};
    }
 
    // Figure out who all will receive this broadcast.
 
    // 收集receivers列表组件信息. 参考【第3.3节】
    List receivers = null;
    if ((intent.getFlags() & Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
        receivers = collectReceiverComponents(intent, resolvedType, callingUid, users);
    }
 
    // 通过IntentResolver收集已注册的Receiver列表registeredReceivers
    List<BroadcastFilter> registeredReceivers = null;
    if (intent.getComponent() == null) {
        if (userId == UserHandle.USER_ALL && callingUid == SHELL_UID) {
            for (int i = 0; i < users.length; i++) {
                // 过滤Shell限制的用户
                ...
 
                List<BroadcastFilter> registeredReceiversForUser =
                        mReceiverResolver.queryIntent(intent, resolvedType, false /*defaultOnly*/, users[i]);
                if (registeredReceivers == null) {
                    registeredReceivers = registeredReceiversForUser;
                } else if (registeredReceiversForUser != null) {
                    registeredReceivers.addAll(registeredReceiversForUser);
                }
            }
        } else {
            registeredReceivers = mReceiverResolver.queryIntent(intent, resolvedType, false /*defaultOnly*/, userId);
        }
    }
 
    final boolean replacePending = (intent.getFlags()&Intent.FLAG_RECEIVER_REPLACE_PENDING) != 0;
 
    // 整体逻辑: 将新发送的无序广播入队列
    int NR = registeredReceivers != null ? registeredReceivers.size() : 0;
    if (!ordered && NR > 0) {
        // If we are not serializing this broadcast, then send the
        // registered receivers separately so they don't wait for the
        // components to be launched.
        if (isCallerSystem) {
            checkBroadcastFromSystem(intent, callerApp, callerPackage, callingUid, isProtectedBroadcast, registeredReceivers);
        }
        final BroadcastQueue queue = broadcastQueueForIntent(intent);
        BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
                callerPackage, callingPid, callingUid, callerInstantApp, resolvedType,
                requiredPermissions, appOp, brOptions, registeredReceivers, resultTo,
                resultCode, resultData, resultExtras, ordered, sticky, false, userId,
                allowBackgroundActivityStarts, timeoutExempt);
        final boolean replaced = replacePending && (queue.replaceParallelBroadcastLocked(r) != null);
        if (!replaced) {
            queue.enqueueParallelBroadcastLocked(r);
            queue.scheduleBroadcastsLocked();
        }
        registeredReceivers = null;
        NR = 0;
    }
 
    // Merge into one list receivers.
    // 1.receivers中移除如下action对应的广播: ACTION_PACKAGE_ADDED/ACTION_PACKAGE_RESTARTED/ACTION_PACKAGE_DATA_CLEARED/ACTION_EXTERNAL_APPLICATIONS_AVAILABLE
    // 2.将registeredReceivers列表合并到receivers列表
    ...
    if (isCallerSystem) {
        checkBroadcastFromSystem(intent, callerApp, callerPackage, callingUid, isProtectedBroadcast, receivers);
    }
 
    // 将新发送的有序广播入队列
    if ((receivers != null && receivers.size() > 0) || resultTo != null) {
        BroadcastQueue queue = broadcastQueueForIntent(intent);
        BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
                callerPackage, callingPid, callingUid, callerInstantApp, resolvedType,
                requiredPermissions, appOp, brOptions, receivers, resultTo, resultCode,
                resultData, resultExtras, ordered, sticky, false, userId,
                allowBackgroundActivityStarts, timeoutExempt);
 
        final BroadcastRecord oldRecord = replacePending ? queue.replaceOrderedBroadcastLocked(r) : null;
        if (oldRecord != null) {
            // Replaced, fire the result-to receiver.
            if (oldRecord.resultTo != null) {
                final BroadcastQueue oldQueue = broadcastQueueForIntent(oldRecord.intent);
                oldQueue.performReceiveLocked(oldRecord.callerApp, oldRecord.resultTo,
                        oldRecord.intent, Activity.RESULT_CANCELED, null, null, false, false, oldRecord.userId);
            }
        } else {
            queue.enqueueOrderedBroadcastLocked(r);
            queue.scheduleBroadcastsLocked();
        }
    } else {
        // 该广播没有广播接收器, 说明是隐式广播, 记录一下即可
        if (intent.getComponent() == null && intent.getPackage() == null
                && (intent.getFlags()&Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
            addBroadcastStatLocked(intent.getAction(), callerPackage, 0, 0, 0);
        }
    }
 
    return ActivityManager.BROADCAST_SUCCESS;
}

private List<ResolveInfo> collectReceiverComponents(Intent intent, String resolvedType, int callingUid, int[] users) {
    List<ResolveInfo> receivers = null;
    try {
        for (int user : users) {
            // 过滤掉有Shell限制的用户
            ...
 
            List<ResolveInfo> newReceivers = AppGlobals.getPackageManager()
                    .queryIntentReceivers(intent, resolvedType, pmFlags, user).getList();
 
            // 如果目标不是系统用户, 过滤掉newReceivers列表中所有仅系统用户可见的广播
            ...
 
            if (receivers == null) {
                receivers = newReceivers;
            } else if (newReceivers != null) {
                // 遍历receivers和newReceivers列表, 将flags为ActivityInfo.FLAG_SINGLE_USER的广播添加到singleUserReceivers和receivers列表
                ...
            }
        }
    } catch (RemoteException ex) {
        // pm is in same process, this will never happen.
    }
    return receivers;
}

@Override
public @NonNull ParceledListSlice<ResolveInfo> queryIntentReceivers(Intent intent,
        String resolvedType, int flags, int userId) {
    return new ParceledListSlice<>(
            queryIntentReceiversInternal(intent, resolvedType, flags, userId, false /*allowDynamicSplits*/));
}

private @NonNull List<ResolveInfo> queryIntentReceiversInternal(Intent intent,
        String resolvedType, int flags, int userId, boolean allowDynamicSplits) {
    // 检查userId在用户管理服务中是否能找到
    if (!sUserManager.exists(userId)) return Collections.emptyList();
 
    final int callingUid = Binder.getCallingUid();
    // 请求只能来自系统用户或具备INTERACT_ACROSS_USERS/INTERACT_ACROSS_USERS_FULL权限的用户, 否则抛异常
    mPermissionManager.enforceCrossUserPermission(callingUid, userId,
            false /*requireFullPermission*/, false /*checkShell*/, "query intent receivers");
 
    // 更新flags 
    flags = updateFlagsForResolve(flags, userId, intent, callingUid, false /*includeInstantApps*/);
    // 获取Component
    ComponentName comp = intent.getComponent();
    if (comp == null) {
        if (intent.getSelector() != null) {
            intent = intent.getSelector();
            comp = intent.getComponent();
        }
    }
 
    final String instantAppPkgName = getInstantAppPackageName(callingUid);
    if (comp != null) {
        final List<ResolveInfo> list = new ArrayList<>(1);
        final ActivityInfo ai = getReceiverInfo(comp, flags, userId);
        if (ai != null) {
            // 如下两种情况Activity不能使用. blockResolution为true
            // 1) the calling package is normal and the activity is within an instant application or
            // 2) the calling package is ephemeral and the activity is not visible to instant applications.
            ...
 
            if (!blockResolution) {
                ResolveInfo ri = new ResolveInfo();
                ri.activityInfo = ai;
                list.add(ri);
            }
        }
        // 过滤掉list中的临时的BroadcastReceiver组件
        return applyPostResolutionFilter(list, instantAppPkgName, allowDynamicSplits, callingUid, false, userId, intent);
    }
 
    synchronized (mPackages) {
        String pkgName = intent.getPackage();
        if (pkgName == null) {
            // 通过组件解析器ComponentResolver解析出符合条件的组件信息列表
            final List<ResolveInfo> result = mComponentResolver.queryReceivers(intent, resolvedType, flags, userId);
            // 过滤掉临时的Activity
            return applyPostResolutionFilter(result, instantAppPkgName, allowDynamicSplits, callingUid, false, userId, intent);
        }
        // 获取包解析信息
        final PackageParser.Package pkg = mPackages.get(pkgName);
        if (pkg != null) {
            // 通过组件解析器ComponentResolver解析出符合条件的组件信息列表
            final List<ResolveInfo> result = mComponentResolver.queryReceivers(intent, resolvedType, flags, pkg.receivers, userId);
            // 过滤掉临时的Activity
            return applyPostResolutionFilter(result, instantAppPkgName, allowDynamicSplits, callingUid, false, userId, intent);
        }
        return Collections.emptyList();
    }
}

List<ResolveInfo> queryReceivers(Intent intent, String resolvedType, int flags, int userId) {
    synchronized (mLock) {
        return mReceivers.queryIntent(intent, resolvedType, flags, userId);
    }
}

private static final class ActivityIntentResolver extends IntentResolver<PackageParser.ActivityIntentInfo, ResolveInfo> {
    @Override
    public List<ResolveInfo> queryIntent(Intent intent, String resolvedType, boolean defaultOnly, int userId) {
        if (!sUserManager.exists(userId)) return null;
        mFlags = (defaultOnly ? PackageManager.MATCH_DEFAULT_ONLY : 0);
        return super.queryIntent(intent, resolvedType, defaultOnly, userId);
    }
 
    List<ResolveInfo> queryIntent(Intent intent, String resolvedType, int flags, int userId) {
        if (!sUserManager.exists(userId)) {
            return null;
        }
        mFlags = flags;
        return super.queryIntent(intent, resolvedType, (flags & PackageManager.MATCH_DEFAULT_ONLY) != 0, userId);
    }
 
    public List<R> queryIntent(Intent intent, String resolvedType, boolean defaultOnly, int userId) {
        String scheme = intent.getScheme();
 
        ArrayList<R> finalList = new ArrayList<R>();
 
        F[] firstTypeCut = null;
        F[] secondTypeCut = null;
        F[] thirdTypeCut = null;
        F[] schemeCut = null;
 
 
        // 找出和MIME Type匹配的所有filter
        if (resolvedType != null) {
            int slashpos = resolvedType.indexOf('/');
            if (slashpos > 0) {
                final String baseType = resolvedType.substring(0, slashpos);
                if (!baseType.equals("*")) {
                    if (resolvedType.length() != slashpos+2 || resolvedType.charAt(slashpos+1) != '*') {
                        firstTypeCut = mTypeToFilter.get(resolvedType);
                        secondTypeCut = mWildTypeToFilter.get(baseType);
                    } else {
                        firstTypeCut = mBaseTypeToFilter.get(baseType);
                        secondTypeCut = mWildTypeToFilter.get(baseType);
                    }
                    thirdTypeCut = mWildTypeToFilter.get("*");
                } else if (intent.getAction() != null) {
                    firstTypeCut = mTypedActionToFilter.get(intent.getAction());
                }
            }
        }
 
        // 找出和scheme匹配的所有filter
        if (scheme != null) {
            schemeCut = mSchemeToFilter.get(scheme);
        }
 
        // 找出和action匹配的所有filter
        if (resolvedType == null && scheme == null && intent.getAction() != null) {
            firstTypeCut = mActionToFilter.get(intent.getAction());
        }
 
        // 过滤掉以上各filter组中不符合条件的元素, 将其封装为ResolveInfo对象添加到finalList
        FastImmutableArraySet<String> categories = getFastIntentCategories(intent);
        if (firstTypeCut != null) {
            buildResolveList(intent, categories, debug, defaultOnly, resolvedType,
                    scheme, firstTypeCut, finalList, userId);
        }
        if (secondTypeCut != null) {
            buildResolveList(intent, categories, debug, defaultOnly, resolvedType,
                    scheme, secondTypeCut, finalList, userId);
        }
        if (thirdTypeCut != null) {
            buildResolveList(intent, categories, debug, defaultOnly, resolvedType,
                    scheme, thirdTypeCut, finalList, userId);
        }
        if (schemeCut != null) {
            buildResolveList(intent, categories, debug, defaultOnly, resolvedType,
                    scheme, schemeCut, finalList, userId);
        }
        filterResults(finalList);
        // 按优先级降序排列
        sortResults(finalList);
 
        return finalList;
    }
}

List<ResolveInfo> queryIntentForPackage(Intent intent, String resolvedType,
        int flags, List<PackageParser.Activity> packageActivities, int userId) {
    if (!sUserManager.exists(userId)) {
        return null;
    }
    if (packageActivities == null) {
        return null;
    }
    mFlags = flags;
    final boolean defaultOnly = (flags & PackageManager.MATCH_DEFAULT_ONLY) != 0;
    final int activitiesSize = packageActivities.size();
    ArrayList<PackageParser.ActivityIntentInfo[]> listCut = new ArrayList<>(activitiesSize);
 
    ArrayList<PackageParser.ActivityIntentInfo> intentFilters;
    for (int i = 0; i < activitiesSize; ++i) {
        intentFilters = packageActivities.get(i).intents;
        if (intentFilters != null && intentFilters.size() > 0) {
            PackageParser.ActivityIntentInfo[] array = new PackageParser.ActivityIntentInfo[intentFilters.size()];
            intentFilters.toArray(array);
            listCut.add(array);
        }
    }
    return super.queryIntentFromList(intent, resolvedType, defaultOnly, listCut, userId);
}

public List<R> queryIntentFromList(Intent intent, String resolvedType, boolean defaultOnly,
        ArrayList<F[]> listCut, int userId) {
    ArrayList<R> resultList = new ArrayList<R>();
 
    final boolean debug = localLOGV || ((intent.getFlags() & Intent.FLAG_DEBUG_LOG_RESOLUTION) != 0);
 
    FastImmutableArraySet<String> categories = getFastIntentCategories(intent);
    final String scheme = intent.getScheme();
    int N = listCut.size();
    for (int i = 0; i < N; ++i) {
        buildResolveList(intent, categories, debug, defaultOnly, resolvedType, scheme, listCut.get(i), resultList, userId);
    }
    filterResults(resultList);
    sortResults(resultList);
    return resultList;
}

private void buildResolveList(Intent intent, FastImmutableArraySet<String> categories,
        boolean debug, boolean defaultOnly, String resolvedType, String scheme,
        F[] src, List<R> dest, int userId) {
    final String action = intent.getAction();
    final Uri data = intent.getData();
    final String packageName = intent.getPackage();
 
    final boolean excludingStopped = intent.isExcludingStopped();
 
    final int N = src != null ? src.length : 0;
    boolean hasNonDefaults = false;
    F filter;
    for (int i=0; i<N && (filter=src[i]) != null; i++) {
        int match;
 
        // 过滤掉target为stopped状态的filter
        if (excludingStopped && isFilterStopped(filter, userId)) {
            continue;
        }
 
        // 过滤掉packageName不匹配的filter
        if (packageName != null && !isPackageForFilter(packageName, filter)) {
            continue;
        }
 
        // 过滤掉重复filter
        if (!allowFilterResult(filter, dest)) {
            continue;
        }
 
        // filter各属性匹配
        match = filter.match(action, resolvedType, scheme, data, categories, TAG);
        if (match >= 0) {
            if (!defaultOnly || filter.hasCategory(Intent.CATEGORY_DEFAULT)) {
                // 匹配成功, 将filter信息封装成ResolveInfo并添加到dest列表
                final R oneResult = newResult(filter, match, userId);
                if (oneResult != null) {
                    dest.add(oneResult);
                }
            } else {
                hasNonDefaults = true;
            }
        }
    }
}
 
 
@Override
protected ResolveInfo newResult(PackageParser.ActivityIntentInfo info, int match, int userId) {
    // 各种边界条件检查包括: userId是否存在, Component和flag是否可用和匹配, PackageSetting是否为空, instant app和ephemeral app相关检查
    ...
     
    // 创建ResolveInfo对象并设置各属性
    final ResolveInfo res = new ResolveInfo();
    res.activityInfo = ai;
    if ((mFlags & PackageManager.GET_RESOLVED_FILTER) != 0) {
        res.filter = info;
    }
    res.handleAllWebDataURI = info.handleAllWebDataURI();
    res.priority = info.getPriority();
    res.preferredOrder = activity.owner.mPreferredOrder;
    res.match = match;
    res.isDefault = info.hasDefault;
    res.labelRes = info.labelRes;
    res.nonLocalizedLabel = info.nonLocalizedLabel;
    if (sPackageManagerInternal.userNeedsBadging(userId)) {
        res.noResourceId = true;
    } else {
        res.icon = info.icon;
    }
    res.iconResourceId = info.icon;
    res.system = res.activityInfo.applicationInfo.isSystemApp();
    res.isInstantAppAvailable = userState.instantApp;
    return res;
}

BroadcastQueue broadcastQueueForIntent(Intent intent) {
    if (isOnOffloadQueue(intent.getFlags())) {
        return mOffloadBroadcastQueue;
    }
 
    final boolean isFg = (intent.getFlags() & Intent.FLAG_RECEIVER_FOREGROUND) != 0;
    return (isFg) ? mFgBroadcastQueue : mBgBroadcastQueue;
}