Android之ContentProvider的启动过程源码分析

ContentProvider组件一次传递的数据量可能非常大，如果直接使用Binder进程间通信机制来传递数据的话，传输效率是个问题。不同的应用程序进程可以通过匿名共享内存来传输大数据，因为无论多大的数据，对匿名共享内存来说，需要在进程间传递的仅仅是一个文件描述符而已。这样，结合Binder进程间通信机制和匿名共享内存机制，ContentProvider组件就可以实现高效的文件传输了。

ContentProvider中query方法返回的保存在cursor对象中的数据是通过匿名共享内存来传输的，call方法返回的数据是保存在Bundle对象中的，它直接使用Binder进程间通信机制来传输的。当传输的数据量比较小时，使用匿名共享内存就得不偿失了，因为它的创建过程和映射过程都是需要开销的。

Provider的启动过程大致分为几个步骤：

1.调用者通过URI访问目标Provider。

2.调用者所运行在的应用程序进程发现不存在要访问的目标Provider的代理对象，就会通过URI来请求ActivityManagerService返回一个用来访问目标Provider组件的代理对象。

3.AMS发现这个Provider组件还没有启动起来，就会先创建一个新的应用程序进程，然后在这个进程中启动目标Provider组件。

4.目标Provider组件启动起来后，就会将自己发布到AMS中，以便AMS可以将它的一个代理对象返回给调用者使用。

使用Provider时需要先调用getContentProvider()方法来获取ContentResolver对象，惯例先看时序图：



先看ContextWrapper类中的getContentResolver方法：

@Override
public ContentResolver getContentResolver() {
return mBase.getContentResolver();
}

调用到ContextImpl类中的getContentResolver方法：

private final ApplicationContentResolver mContentResolver;

private ContextImpl(ContextImpl container, ActivityThread mainThread,
LoadedApk packageInfo, IBinder activityToken, UserHandle user, boolean restricted,
Display display, Configuration overrideConfiguration, int createDisplayWithId) {

mMainThread = mainThread;
. . .

mContentResolver = new ApplicationContentResolver(this, mainThread, user);
}

@Override
public ContentResolver getContentResolver() {
return mContentResolver;
}

private static final class ApplicationContentResolver extends ContentResolver {
private final ActivityThread mMainThread;
private final UserHandle mUser;

public ApplicationContentResolver(
Context context, ActivityThread mainThread, UserHandle user) {
super(context);
mMainThread = Preconditions.checkNotNull(mainThread);
mUser = Preconditions.checkNotNull(user);
}

// 实现父类中的抽象方法，后面会调用
@Override
protected IContentProvider acquireProvider(Context context, String auth) {
return mMainThread.acquireProvider(context,
ContentProvider.getAuthorityWithoutUserId(auth),
resolveUserIdFromAuthority(auth), true);
}

// 实现父类中的抽象方法，后面会调用
@Override
public boolean releaseProvider(IContentProvider provider) {
return mMainThread.releaseProvider(provider, true);
}

/** @hide */
protected int resolveUserIdFromAuthority(String auth) {
return ContentProvider.getUserIdFromAuthority(auth, mUser.getIdentifier());
}
. . .

}

上面ApplicationContentResolver是ContextImpl的内部类。到这里调用者就获取到了ContentResolver对象。

获取到对象后，假设调用者要访问目标Provider的insert方法（其他方法的流程基本一致），先看下时序图：



先看ContentResolver类的insert方法：

public static final String SCHEME_CONTENT = "content";

public ContentResolver(Context context) {
mContext = context != null ? context : ActivityThread.currentApplication();
mPackageName = mContext.getOpPackageName();
}

public final @Nullable Uri insert(@NonNull Uri url, @Nullable ContentValues values) {
android.util.SeempLog.record_uri(37, url);
Preconditions.checkNotNull(url, "url");
// 获取provider
IContentProvider provider = acquireProvider(url);
if (provider == null) {
throw new IllegalArgumentException("Unknown URL " + url);
}
try {
long startTime = SystemClock.uptimeMillis();
// 执行插入操作
Uri createdRow = provider.insert(mPackageName, url, values);
long durationMillis = SystemClock.uptimeMillis() - startTime;
maybeLogUpdateToEventLog(durationMillis, url, "insert", null /* where */);
return createdRow;
} catch (RemoteException e) {
// Arbitrary and not worth documenting, as Activity
// Manager will kill this process shortly anyway.
return null;
} finally {
// 释放provider
releaseProvider(provider);
}
}

/**
* Returns the content provider for the given content URI.
*
* @param uri The URI to a content provider
* @return The ContentProvider for the given URI, or null if no content provider is found.
* @hide
*/
public final IContentProvider acquireProvider(Uri uri) {
// 判断scheme是否以content开头，如果不是说明这个uri不是用来访问provider的
if (!SCHEME_CONTENT.equals(uri.getScheme())) {
return null;
}
final String auth = uri.getAuthority();
if (auth != null) {
// 获取provider对象
return acquireProvider(mContext, auth);
}
return null;
}

// 抽象方法，由子类实现
/** @hide */
protected abstract IContentProvider acquireProvider(Context c, String name);

调用到这里，又回到了ContextImpl的内部类ApplicationContentResolver中的acquireProvider方法，该方法中又调用了ActivityThread类中的acquireProvider方法，看该方法之前，先看下传递的参数：

getUserIdFromAuthority方法获取userId：
/**
* Removes userId part from authority string. Expects format:
* userId@some.authority
* If there is no userId in the authority, it symply returns the argument
* @hide
*/
public static String getAuthorityWithoutUserId(String auth) {
if (auth == null) return null;
int end = auth.lastIndexOf('@');
// 截取authority
return auth.substring(end+1);
}

/** @hide */
public static int getUserIdFromAuthority(String auth, int defaultUserId) {
if (auth == null) return defaultUserId;
int end = auth.lastIndexOf('@');
if (end == -1) return defaultUserId;
// 截取userId
String userIdString = auth.substring(0, end);
try {
return Integer.parseInt(userIdString);
} catch (NumberFormatException e) {
Log.w(TAG, "Error parsing userId.", e);
return UserHandle.USER_NULL;
}
}

上面两个方法主要是截取不规则的authority和获取userId的。再接着看下后续的时序图：



根据上面时序图，先看下ActivityThread类中的acquireProvider方法：

public final IContentProvider acquireProvider(
Context c, String auth, int userId, boolean stable) {
// 调用acquireExistingProvider检查该provider代理对象是否已经存在
final IContentProvider provider = acquireExistingProvider(c, auth, userId, stable);
// 如果已经存在则直接返回
if (provider != null) {
return provider;
}

// There is a possible race here.  Another thread may try to acquire
// the same provider at the same time.  When this happens, we want to ensure
// that the first one wins.
// Note that we cannot hold the lock while acquiring and installing the
// provider since it might take a long time to run and it could also potentially
// be re-entrant in the case where the provider is in the same process.
IActivityManager.ContentProviderHolder holder = null;
try {
// 通过BInder代理对象调用AMS的getContentProvider方法获取到目标Provider的代理对象
holder = ActivityManagerNative.getDefault().getContentProvider(
getApplicationThread(), auth, userId, stable);
} catch (RemoteException ex) {
}
if (holder == null) {
Slog.e(TAG, "Failed to find provider info for " + auth);
return null;
}

// Install provider will increment the reference count for us, and break
// any ties in the race.
holder = installProvider(c, holder, holder.info,
true /*noisy*/, holder.noReleaseNeeded, stable);
return holder.provider;
}

// 用来保存当前应用程序进程中访问过的Content Provider组件代理对象
final ArrayMap<ProviderKey, ProviderClientRecord> mProviderMap
= new ArrayMap<ProviderKey, ProviderClientRecord>();
// 各Provider被引用次数map
final ArrayMap<IBinder, ProviderRefCount> mProviderRefCountMap
= new ArrayMap<IBinder, ProviderRefCount>();

public final IContentProvider acquireExistingProvider(
Context c, String auth, int userId, boolean stable) {
synchronized (mProviderMap) {
final ProviderKey key = new ProviderKey(auth, userId);
// 检查mProviderMap中是否已经有目标Provider代理对象
final ProviderClientRecord pr = mProviderMap.get(key);
// 如果没有则返回null
if (pr == null) {
return null;
}

IContentProvider provider = pr.mProvider;
IBinder jBinder = provider.asBinder();
// 判断目标Provider代理对象所运行在的进程是否还在运行
if (!jBinder.isBinderAlive()) {
// The hosting process of the provider has died; we can't
// use this one.
Log.i(TAG, "Acquiring provider " + auth + " for user " + userId
+ ": existing object's process dead");
handleUnstableProviderDiedLocked(jBinder, true);
return null;
}

// Only increment the ref count if we have one.  If we don't then the
// provider is not reference counted and never needs to be released.
ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
// 判断mProviderRefCountMap中是否有目标Provider，如果有则其引用次数加1
if (prc != null) {
incProviderRefLocked(prc, stable);
}
return provider;
}
}

接着看下ActivityManagerService类中的getContentProvider方法：

@Override
public final ContentProviderHolder getContentProvider(
IApplicationThread caller, String name, int userId, boolean stable) {
enforceNotIsolatedCaller("getContentProvider");
if (caller == null) {
String msg = "null IApplicationThread when getting content provider "
+ name;
Slog.w(TAG, msg);
throw new SecurityException(msg);
}
// The incoming user check is now handled in checkContentProviderPermissionLocked() to deal
// with cross-user grant.
return getContentProviderImpl(caller, name, null, stable, userId);
}

final ProviderMap mProviderMap;

private final ContentProviderHolder getContentProviderImpl(IApplicationThread caller,
String name, IBinder token, boolean stable, int userId) {
// 在AMS中，每个已经启动的Provider组件都使用一个ContentProviderRecord对象来描述，并保存在mProviderMap中
ContentProviderRecord cpr;
ContentProviderConnection conn = null;
ProviderInfo cpi = null;

/*在这里可以准备自启动黑白名单的初始化操作*/

synchronized(this) {
long startTime = SystemClock.elapsedRealtime();

ProcessRecord r = null;
if (caller != null) {
// 获取目标Provider组件代理对象的应用程序进程的信息
r = getRecordForAppLocked(caller);
if (r == null) {
throw new SecurityException(
"Unable to find app for caller " + caller
+ " (pid=" + Binder.getCallingPid()
+ ") when getting content provider " + name);
}
}

boolean checkCrossUser = true;

// 判断从startTime到这里的操作是否超过1秒
checkTime(startTime, "getContentProviderImpl: getProviderByName");

// First check if this content provider has been published...
// mProviderMap在构造方法中初始化
cpr = mProviderMap.getProviderByName(name, userId);
// If that didn't work, check if it exists for user 0 and then
// verify that it's a singleton provider before using it.
if (cpr == null && userId != UserHandle.USER_OWNER) {
cpr = mProviderMap.getProviderByName(name, UserHandle.USER_OWNER);
if (cpr != null) {
cpi = cpr.info;
if (isSingleton(cpi.processName, cpi.applicationInfo,
cpi.name, cpi.flags)
&& isValidSingletonCall(r.uid, cpi.applicationInfo.uid)) {
userId = UserHandle.USER_OWNER;
checkCrossUser = false;
} else {
cpr = null;
cpi = null;
}
}
}

boolean providerRunning = cpr != null;
if (providerRunning) {
cpi = cpr.info;
String msg;
checkTime(startTime, "getContentProviderImpl: before checkContentProviderPermission");
// 检查权限
if ((msg = checkContentProviderPermissionLocked(cpi, r, userId, checkCrossUser))
!= null) {
throw new SecurityException(msg);
}
checkTime(startTime, "getContentProviderImpl: after checkContentProviderPermission");

// 判断目标Provider的android:multiprocess属性是否为true
if (r != null && cpr.canRunHere(r)) {
// This provider has been published or is in the process
// of being published...  but it is also allowed to run
// in the caller's process, so don't make a connection
// and just let the caller instantiate its own instance.
// 为true说明目标Provider可以运行在调用者所在进程，故这里不用建立连接，因为调用者可以自己实例化目标Provider
ContentProviderHolder holder = cpr.newHolder(null);
// don't give caller the provider object, it needs
// to make its own.
holder.provider = null;
return holder;
}

final long origId = Binder.clearCallingIdentity();

checkTime(startTime, "getContentProviderImpl: incProviderCountLocked");

// In this case the provider instance already exists, so we can
// return it right away.
// 获取连接
conn = incProviderCountLocked(r, cpr, token, stable);
// 如果稳定连接和不稳定连接之和为1
if (conn != null && (conn.stableCount+conn.unstableCount) == 1) {
if (cpr.proc != null && r.setAdj <= ProcessList.PERCEPTIBLE_APP_ADJ) {
// If this is a perceptible app accessing the provider,
// make sure to count it as being accessed and thus
// back up on the LRU list.  This is good because
// content providers are often expensive to start.
checkTime(startTime, "getContentProviderImpl: before updateLruProcess");
// 开启Provider成本较高，故这里做下备份以后续访问时减小开销
updateLruProcessLocked(cpr.proc, false, null);
checkTime(startTime, "getContentProviderImpl: after updateLruProcess");
}
}

if (cpr.proc != null) {
if (false) {
if (cpr.name.flattenToShortString().equals(
"com.android.providers.calendar/.CalendarProvider2")) {
Slog.v(TAG, "****************** KILLING "
+ cpr.name.flattenToShortString());
Process.killProcess(cpr.proc.pid);
}
}
checkTime(startTime, "getContentProviderImpl: before updateOomAdj");
// 更新目标Provider所在进程的Adj值，如果返回false说明进程被杀
boolean success = updateOomAdjLocked(cpr.proc);
// 更新目标Provider最近使用时间
maybeUpdateProviderUsageStatsLocked(r, cpr.info.packageName, name);
checkTime(startTime, "getContentProviderImpl: after updateOomAdj");
if (DEBUG_PROVIDER) Slog.i(TAG_PROVIDER, "Adjust success: " + success);
// NOTE: there is still a race here where a signal could be
// pending on the process even though we managed to update its
// adj level.  Not sure what to do about this, but at least
// the race is now smaller.
if (!success) {
// Uh oh...  it looks like the provider's process
// has been killed on us.  We need to wait for a new
// process to be started, and make sure its death
// doesn't kill our process.
Slog.i(TAG, "Existing provider " + cpr.name.flattenToShortString()
+ " is crashing; detaching " + r);
// 连接数减1后是否还有连接，如果没有则为true
boolean lastRef = decProviderCountLocked(conn, cpr, token, stable);
checkTime(startTime, "getContentProviderImpl: before appDied");
appDiedLocked(cpr.proc);
checkTime(startTime, "getContentProviderImpl: after appDied");
if (!lastRef) {
// This wasn't the last ref our process had on
// the provider...  we have now been killed, bail.
return null;
}
providerRunning = false;
conn = null;
}
}

Binder.restoreCallingIdentity(origId);
}

boolean singleton;
// 目标Provider没有在运行中
if (!providerRunning) {
try {
checkTime(startTime, "getContentProviderImpl: before resolveContentProvider");
// 到PMS中查找android:authorities属性值等于name的Provider组件的信息
cpi = AppGlobals.getPackageManager().
resolveContentProvider(name,
STOCK_PM_FLAGS | PackageManager.GET_URI_PERMISSION_PATTERNS, userId);
checkTime(startTime, "getContentProviderImpl: after resolveContentProvider");
} catch (RemoteException ex) {
}
// cpi为null说明没有任何应用提供该Provider
if (cpi == null) {
return null;
}
// If the provider is a singleton AND
// (it's a call within the same user || the provider is a
// privileged app)
// Then allow connecting to the singleton provider
singleton = isSingleton(cpi.processName, cpi.applicationInfo,
cpi.name, cpi.flags)
&& isValidSingletonCall(r.uid, cpi.applicationInfo.uid);
if (singleton) {
userId = UserHandle.USER_OWNER;
}else{
//SmartContainer modified begin
if (!SmartContainerConfig.WITH_OUT_VIRTUAL_BOX){
userId = UserHandle.getUserId(cpi.applicationInfo.uid);
}
//SmartContainer modified end
}
cpi.applicationInfo = getAppInfoForUser(cpi.applicationInfo, userId);
checkTime(startTime, "getContentProviderImpl: got app info for user");

String msg;
checkTime(startTime, "getContentProviderImpl: before checkContentProviderPermission");
// 检查权限
if ((msg = checkContentProviderPermissionLocked(cpi, r, userId, !singleton))
!= null) {
throw new SecurityException(msg);
}
checkTime(startTime, "getContentProviderImpl: after checkContentProviderPermission");

if (!mProcessesReady && !mDidUpdate && !mWaitingUpdate
&& !cpi.processName.equals("system")) {
// If this content provider does not run in the system
// process, and the system is not yet ready to run other
// processes, then fail fast instead of hanging.
throw new IllegalArgumentException(
"Attempt to launch content provider before system ready");
}

// Make sure that the user who owns this provider is running.  If not,
// we don't want to allow it to run.
if (!isUserRunningLocked(userId, false)) {
Slog.w(TAG, "Unable to launch app "
+ cpi.applicationInfo.packageName + "/"
+ cpi.applicationInfo.uid + " for provider "
+ name + ": user " + userId + " is stopped");
return null;
}

// cpi.name是Provider组件的类名
ComponentName comp = new ComponentName(cpi.packageName, cpi.name);
checkTime(startTime, "getContentProviderImpl: before getProviderByClass");
// 根据从PMS中查询到的Provider类名到mProviderMap查找是否有与类名一致的cpr对象
cpr = mProviderMap.getProviderByClass(comp, userId);
checkTime(startTime, "getContentProviderImpl: after getProviderByClass");
final boolean firstClass = cpr == null;
// firstClass为true说明目标Provider组件还没有启动起来
if (firstClass) {
final long ident = Binder.clearCallingIdentity();
try {
checkTime(startTime, "getContentProviderImpl: before getApplicationInfo");
// 到PMS中查找目标Provider所属应用程序的信息
ApplicationInfo ai =
AppGlobals.getPackageManager().
getApplicationInfo(
cpi.applicationInfo.packageName,
STOCK_PM_FLAGS, userId);
checkTime(startTime, "getContentProviderImpl: after getApplicationInfo");
// 如果为null说明不存在，直接返回null
if (ai == null) {
Slog.w(TAG, "No package info for content provider "
+ cpi.name);
return null;
}
ai = getAppInfoForUser(ai, userId);
// 将cpi、ai等信息封装成一个cpr对象，用来描述即将要启动的Provider组件
cpr = new ContentProviderRecord(this, cpi, ai, comp, singleton);
} catch (RemoteException ex) {
// pm is in same process, this will never happen.
} finally {
Binder.restoreCallingIdentity(ident);
}
}

checkTime(startTime, "getContentProviderImpl: now have ContentProviderRecord");

// 启动之前先检查先检查multiprocess属性是否为true
if (r != null && cpr.canRunHere(r)) {
// If this is a multiprocess provider, then just return its
// info and allow the caller to instantiate it.  Only do
// this if the provider is the same user as the caller's
// process, or can run as root (so can be in any process).
return cpr.newHolder(null);
}

if (DEBUG_PROVIDER) Slog.w(TAG_PROVIDER, "LAUNCHING REMOTE PROVIDER (myuid "
+ (r != null ? r.uid : null) + " pruid " + cpr.appInfo.uid + "): "
+ cpr.info.name + " callers=" + Debug.getCallers(6));

// This is single process, and our app is now connecting to it.
// See if we are already in the process of launching this
// provider.
// AMS把所有正在启动的Provider组件都保存在mLaunchingProviders中
final int N = mLaunchingProviders.size();
int i;
// 遍历查找要启动的Provider是否正在启动中
for (i = 0; i < N; i++) {
if (mLaunchingProviders.get(i) == cpr) {
break;
}
}

// If the provider is not already being launched, then get it
// started.
// i >= N说明要启动的Provider没有在启动中
if (i >= N) {
final long origId = Binder.clearCallingIdentity();

try {
// Content provider is now in use, its package can't be stopped.
try {
checkTime(startTime, "getContentProviderImpl: before set stopped state");
AppGlobals.getPackageManager().setPackageStoppedState(
cpr.appInfo.packageName, false, userId);
checkTime(startTime, "getContentProviderImpl: after set stopped state");
} catch (RemoteException e) {
} catch (IllegalArgumentException e) {
Slog.w(TAG, "Failed trying to unstop package "
+ cpr.appInfo.packageName + ": " + e);
}

// Use existing process if already started
checkTime(startTime, "getContentProviderImpl: looking for process record");
ProcessRecord proc = getProcessRecordLocked(
cpi.processName, cpr.appInfo.uid, false);
// 如果要启动的Provider所在的进程已经启动，则直接在进程中安装该Provider即可
if (proc != null && proc.thread != null) {
if (DEBUG_PROVIDER) Slog.d(TAG_PROVIDER,
"Installing in existing process " + proc);
// 判断目标Provider是否已经发布
if (!proc.pubProviders.containsKey(cpi.name)) {
checkTime(startTime, "getContentProviderImpl: scheduling install");
// 把目标Provider保存在pubProviders中
proc.pubProviders.put(cpi.name, cpr);
try {
// 都有ActivityThread类中的scheduleInstallProvider方法安装模板Provider
proc.thread.scheduleInstallProvider(cpi);
} catch (RemoteException e) {
}
}
// 目标Provider所运行在的进程还没有启动，则需要先启动进程再安装Provider
} else {

/*下面要启动进程了，故这里可以增加禁止自启动的判断*/

checkTime(startTime, "getContentProviderImpl: before start process");
// 启动进程
proc = startProcessLocked(cpi.processName,
cpr.appInfo, false, 0, "content provider",
new ComponentName(cpi.applicationInfo.packageName,
cpi.name), false, false, false);
checkTime(startTime, "getContentProviderImpl: after start process");
if (proc == null) {
Slog.w(TAG, "Unable to launch app "
+ cpi.applicationInfo.packageName + "/"
+ cpi.applicationInfo.uid + " for provider "
+ name + ": process is bad");
return null;
}
}
cpr.launchingApp = proc;
// 把cpr放到正在启动的Provider列表中
mLaunchingProviders.add(cpr);
} finally {
Binder.restoreCallingIdentity(origId);
}
}

checkTime(startTime, "getContentProviderImpl: updating data structures");

// Make sure the provider is published (the same provider class
// may be published under multiple names).
if (firstClass) {
// 保存cpr对象
mProviderMap.putProviderByClass(comp, cpr);
}

// 保存cpr对象
mProviderMap.putProviderByName(name, cpr);
// 获取连接
conn = incProviderCountLocked(r, cpr, token, stable);
if (conn != null) {
// 因为目标Provider组件需要等待进程启动后才能启动，故需要等待进程启动完成
conn.waiting = true;
}
}
checkTime(startTime, "getContentProviderImpl: done!");
}

// Wait for the provider to be published...
synchronized (cpr) {
// 循环等待cpr所描述的Provider组件启动完成
while (cpr.provider == null) {
if (cpr.launchingApp == null) {
Slog.w(TAG, "Unable to launch app "
+ cpi.applicationInfo.packageName + "/"
+ cpi.applicationInfo.uid + " for provider "
+ name + ": launching app became null");
EventLog.writeEvent(EventLogTags.AM_PROVIDER_LOST_PROCESS,
UserHandle.getUserId(cpi.applicationInfo.uid),
cpi.applicationInfo.packageName,
cpi.applicationInfo.uid, name);
return null;
}
try {
if (DEBUG_MU) Slog.v(TAG_MU,
"Waiting to start provider " + cpr
+ " launchingApp=" + cpr.launchingApp);
if (conn != null) {
conn.waiting = true;
}
cpr.wait();
} catch (InterruptedException ex) {
} finally {
if (conn != null) {
conn.waiting = false;
}
}
}
}
return cpr != null ? cpr.newHolder(conn) : null;
}

// 判断每个操作是否超过1秒
private void checkTime(long startTime, String where) {
long now = SystemClock.elapsedRealtime();
if ((now-startTime) > 1000) {
// If we are taking more than a second, log about it.
Slog.w(TAG, "Slow operation: " + (now-startTime) + "ms so far, now at " + where);
}
}

下面看ActivityThread类中的scheduleInstallProvider方法：

@Override
public void scheduleInstallProvider(ProviderInfo provider) {
sendMessage(H.INSTALL_PROVIDER, provider);
}

private class H extends Handler {

public static final int INSTALL_PROVIDER        = 145;
. . .

public void handleMessage(Message msg) {
switch (msg.what) {
. . .
case INSTALL_PROVIDER:
handleInstallProvider((ProviderInfo) msg.obj);
break;
}
}
}

public void handleInstallProvider(ProviderInfo info) {
final StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskWrites();
try {
installContentProviders(mInitialApplication, Lists.newArrayList(info));
} finally {
StrictMode.setThreadPolicy(oldPolicy);
}
}

private void installContentProviders(
Context context, List<ProviderInfo> providers) {
final ArrayList<IActivityManager.ContentProviderHolder> results =
new ArrayList<IActivityManager.ContentProviderHolder>();

// 循环调用installProvider方法在当前应用程序进程中启动保存在providers列表中的所有Provider组件
for (ProviderInfo cpi : providers) {
if (DEBUG_PROVIDER) {
StringBuilder buf = new StringBuilder(128);
buf.append("Pub ");
buf.append(cpi.authority);
buf.append(": ");
buf.append(cpi.name);
Log.i(TAG, buf.toString());
}
IActivityManager.ContentProviderHolder cph = installProvider(context, null, cpi,
false /*noisy*/, true /*noReleaseNeeded*/, true /*stable*/);
if (cph != null) {
cph.noReleaseNeeded = true;
results.add(cph);
}
}

try {
// 将所有的cph对象传递给AMS，以便AMS可以获取到它们所描述的Provider组件的一个访问接口
ActivityManagerNative.getDefault().publishContentProviders(
getApplicationThread(), results);
} catch (RemoteException ex) {
}
}

接下来先分析installProvider方法在当前应用程序进程中启动一个Provider组件的过程，然后再分析AMS的publishContentProviders方法将启动完成之后的Provider组件发布到AMS中的过程：

publishContentProviders方法将启动完成之后的Provider组件发布到AMS中的过程：
/**
* Installs the provider.
*
* Providers that are local to the process or that come from the system server
* may be installed permanently which is indicated by setting noReleaseNeeded to true.
* Other remote providers are reference counted.  The initial reference count
* for all reference counted providers is one.  Providers that are not reference
* counted do not have a reference count (at all).
*
* This method detects when a provider has already been installed.  When this happens,
* it increments the reference count of the existing provider (if appropriate)
* and returns the existing provider.  This can happen due to concurrent
* attempts to acquire the same provider.
*/
private IActivityManager.ContentProviderHolder installProvider(Context context,
IActivityManager.ContentProviderHolder holder, ProviderInfo info,
boolean noisy, boolean noReleaseNeeded, boolean stable) {
ContentProvider localProvider = null;
IContentProvider provider;
if (holder == null || holder.provider == null) {
if (DEBUG_PROVIDER || noisy) {
Slog.d(TAG, "Loading provider " + info.authority + ": "
+ info.name);
}
Context c = null;
ApplicationInfo ai = info.applicationInfo;
if (context.getPackageName().equals(ai.packageName)) {
c = context;
} else if (mInitialApplication != null &&
mInitialApplication.getPackageName().equals(ai.packageName)) {
c = mInitialApplication;
} else {
try {
c = context.createPackageContext(ai.packageName,
Context.CONTEXT_INCLUDE_CODE);
} catch (PackageManager.NameNotFoundException e) {
// Ignore
}
}
if (c == null) {
Slog.w(TAG, "Unable to get context for package " +
ai.packageName +
" while loading content provider " +
info.name);
return null;
}
try {
final java.lang.ClassLoader cl = c.getClassLoader();
// info.name描述了要在当前进程中启动的Provider组件的类名
// 这里根据类名在进程中创建了一个Provider组件的实例
localProvider = (ContentProvider)cl.
loadClass(info.name).newInstance();
// 获得一个IContentProvider接口，该接口是要发布到AMS中的，以便AMS可以将它返回给那些需要
// 访问它所描述的Provider组件的应用程序进程
provider = localProvider.getIContentProvider();
if (provider == null) {
Slog.e(TAG, "Failed to instantiate class " +
info.name + " from sourceDir " +
info.applicationInfo.sourceDir);
return null;
}
if (DEBUG_PROVIDER) Slog.v(
TAG, "Instantiating local provider " + info.name);
// XXX Need to create the correct context for this provider.
// 进一步初始化创建的Provider组件
localProvider.attachInfo(c, info);
} catch (java.lang.Exception e) {
if (!mInstrumentation.onException(null, e)) {
throw new RuntimeException(
"Unable to get provider " + info.name
+ ": " + e.toString(), e);
}
return null;
}
} else {
provider = holder.provider;
if (DEBUG_PROVIDER) Slog.v(TAG, "Installing external provider " + info.authority + ": "
+ info.name);
}

IActivityManager.ContentProviderHolder retHolder;

synchronized (mProviderMap) {
if (DEBUG_PROVIDER) Slog.v(TAG, "Checking to add " + provider
+ " / " + info.name);
IBinder jBinder = provider.asBinder();
if (localProvider != null) {
ComponentName cname = new ComponentName(info.packageName, info.name);
// 根据组件名到mLocalProvidersByName中查询是否已经存在
ProviderClientRecord pr = mLocalProvidersByName.get(cname);
if (pr != null) {
if (DEBUG_PROVIDER) {
Slog.v(TAG, "installProvider: lost the race, "
+ "using existing local provider");
}
provider = pr.mProvider;
} else {
holder = new IActivityManager.ContentProviderHolder(info);
holder.provider = provider;
holder.noReleaseNeeded = true;
// 将provider组件封装成一个pr对象
pr = installProviderAuthoritiesLocked(provider, localProvider, holder);
// 对一个应用程序进程来说，它所访问的Provider组件有可能是在当前应用程序进程中运行，也有可能是在
// 其他应用程序进程中运行。为了区分这两种情况，用mLocalProviders变量来保存运行在当前进程中的Provider
mLocalProviders.put(jBinder, pr);
mLocalProvidersByName.put(cname, pr);
}
retHolder = pr.mHolder;
} else {
// 根据Provider的Binder对象获取prc对象
ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
if (prc != null) {
if (DEBUG_PROVIDER) {
Slog.v(TAG, "installProvider: lost the race, updating ref count");
}
// We need to transfer our new reference to the existing
// ref count, releasing the old one...  but only if
// release is needed (that is, it is not running in the
// system process).
if (!noReleaseNeeded) {
// Provider的引用数量加1
incProviderRefLocked(prc, stable);
try {
ActivityManagerNative.getDefault().removeContentProvider(
holder.connection, stable);
} catch (RemoteException e) {
//do nothing content provider object is dead any way
}
}
} else {
// 如果prc对象为null，说明不存在目标Provider对象，需要创建
ProviderClientRecord client = installProviderAuthoritiesLocked(
provider, localProvider, holder);
if (noReleaseNeeded) {
prc = new ProviderRefCount(holder, client, 1000, 1000);
} else {
prc = stable
? new ProviderRefCount(holder, client, 1, 0)
: new ProviderRefCount(holder, client, 0, 1);
}
mProviderRefCountMap.put(jBinder, prc);
}
retHolder = prc.holder;
}
}

return retHolder;
}

private ProviderClientRecord installProviderAuthoritiesLocked(IContentProvider provider,
ContentProvider localProvider, IActivityManager.ContentProviderHolder holder) {
// authority描述了android:authorities属性值，它是一个多值属性
final String auths[] = holder.info.authority.split(";");
final int userId = UserHandle.getUserId(holder.info.applicationInfo.uid);

// 创建一个pcr对象
final ProviderClientRecord pcr = new ProviderClientRecord(
auths, provider, localProvider, holder);
// 循环根据auth创建ProviderKey对象并保存在mProviderMap中
for (String auth : auths) {
final ProviderKey key = new ProviderKey(auth, userId);
final ProviderClientRecord existing = mProviderMap.get(key);
if (existing != null) {
Slog.w(TAG, "Content provider " + pcr.mHolder.info.name
+ " already published as " + auth);
} else {
mProviderMap.put(key, pcr);
}
}
return pcr;
}

每一个Provider组件内部都有一个类型为Transport的Binder本地对象，这个Binder本地对象是用来传递给AMS的，然后AMS再将引用了它的一个Binder代理对象返回给需要访问该Provider组件的其他应用程序进程。这样，其他应用程序进程就可以通过这个Binder代理对象来间接地访问一个Provider组件中的数据了。

下面看ContentProvider类中的getIContentProvider方法和attachInfo方法：

private Transport mTransport = new Transport();

/**
* Binder object that deals with remoting.
* @hide
*/
class Transport extends ContentProviderNative {
. . .
}

/**
* Returns the Binder object for this provider.
* @hide
*/
public IContentProvider getIContentProvider() {
return mTransport;
}

/**
* After being instantiated, this is called to tell the content provider
* about itself.
*/
public void attachInfo(Context context, ProviderInfo info) {
attachInfo(context, info, false);
}

private void attachInfo(Context context, ProviderInfo info, boolean testing) {
mNoPerms = testing;

/*
* Only allow it to be set once, so after the content service gives
* this to us clients can't change it.
*/
if (mContext == null) {
mContext = context;
if (context != null) {
mTransport.mAppOpsManager = (AppOpsManager) context.getSystemService(
Context.APP_OPS_SERVICE);
}
mMyUid = Process.myUid();
if (info != null) {
// 将Provider的访问权限保存
setReadPermission(info.readPermission);
setWritePermission(info.writePermission);
setPathPermissions(info.pathPermissions);
mExported = info.exported;
mSingleUser = (info.flags & ProviderInfo.FLAG_SINGLE_USER) != 0;
setAuthorities(info.authority);
}
// 回调ContentProvider的onCreate方法
ContentProvider.this.onCreate();
}
}

最后看AMS中的publishContentProviders方法：

public final void publishContentProviders(IApplicationThread caller,
List<ContentProviderHolder> providers) {
if (providers == null) {
return;
}

enforceNotIsolatedCaller("publishContentProviders");
synchronized (this) {
final ProcessRecord r = getRecordForAppLocked(caller);
if (DEBUG_MU) Slog.v(TAG_MU, "ProcessRecord uid = " + r.uid);
if (r == null) {
throw new SecurityException(
"Unable to find app for caller " + caller
+ " (pid=" + Binder.getCallingPid()
+ ") when publishing content providers");
}

final long origId = Binder.clearCallingIdentity();

final int N = providers.size();
// 循环取出保存在providers中的每一个ContentProviderHolder对象src,
// 然后在AMS中找到与它对应的ContentProviderHolder对象dst
for (int i = 0; i < N; i++) {
ContentProviderHolder src = providers.get(i);
if (src == null || src.info == null || src.provider == null) {
continue;
}
ContentProviderRecord dst = r.pubProviders.get(src.info.name);
if (DEBUG_MU) Slog.v(TAG_MU, "ContentProviderRecord uid = " + dst.uid);
if (dst != null) {
ComponentName comp = new ComponentName(dst.info.packageName, dst.info.name);
mProviderMap.putProviderByClass(comp, dst);
String names[] = dst.info.authority.split(";");
for (int j = 0; j < names.length; j++) {
mProviderMap.putProviderByName(names[j], dst);
}

int launchingCount = mLaunchingProviders.size();
int j;
boolean wasInLaunchingProviders = false;
for (j = 0; j < launchingCount; j++) {
if (mLaunchingProviders.get(j) == dst) {
mLaunchingProviders.remove(j);
wasInLaunchingProviders = true;
j--;
launchingCount--;
}
}
if (wasInLaunchingProviders) {
mHandler.removeMessages(CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG, r);
}
synchronized (dst) {
// 将src所描述的一个Provider组件的一个IContentProvider访问接口保存在dst的成员变量provider中
dst.provider = src.provider;
dst.proc = r;
dst.notifyAll();
}
updateOomAdjLocked(r);
maybeUpdateProviderUsageStatsLocked(r, src.info.packageName,
src.info.authority);
}
}

Binder.restoreCallingIdentity(origId);
}
}

到这里Provider已经启动完成了，并且将它的一个代理对象即一个类型为Transport的Binder代理对象发布到AMS中了。

内容有理解错误或偏差之处，请包涵指正，谢谢！