下面主要针对第二种情况，install Provider和publish Provider
注意，从这里开始针对的是服务端了
ActivityThread#scheduleInstallProvider
服务端安装provider
1380 @Override
1381 public void scheduleInstallProvider(ProviderInfo provider) {
1382 sendMessage(H.INSTALL_PROVIDER, provider);
1383 }
1841 case INSTALL_PROVIDER:
1842 handleInstallProvider((ProviderInfo) msg.obj);
1843 break;
ActivityThread#handleInstallProvider
3159 public void handleInstallProvider(ProviderInfo info) {
3160 final StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskWrites();
3161 try {
3162 installContentProviders(mInitialApplication, Lists.newArrayList(info));
3163 } finally {
3164 StrictMode.setThreadPolicy(oldPolicy);
3165 }
3166 }
ActivityThread#installContentProviders
5937 private void installContentProviders(
5938 Context context, List providers) {
5939 final ArrayList results = new ArrayList<>();
5940
5941 for (ProviderInfo cpi : providers) {
5942 if (DEBUG_PROVIDER) {
5943 StringBuilder buf = new StringBuilder(128);
5944 buf.append("Pub ");
5945 buf.append(cpi.authority);
5946 buf.append(": ");
5947 buf.append(cpi.name);
5948 Log.i(TAG, buf.toString());
5949 }
//安装provider
5950 ContentProviderHolder cph = installProvider(context, null, cpi,
5951 false /*noisy*/, true /*noReleaseNeeded*/, true /*stable*/);
5952 if (cph != null) {
5953 cph.noReleaseNeeded = true;
5954 results.add(cph);
5955 }
5956 }
5957
5958 try {
//发布provider
5959 ActivityManager.getService().publishContentProviders(
5960 getApplicationThread(), results);
5961 } catch (RemoteException ex) {
5962 throw ex.rethrowFromSystemServer();
5963 }
5964 }
ActivityThread#installProvider
前半部分主要是针对服务端的，首次安装ContentProvider时创建实例，并调用onCreate
后半段主要针对客户端，创建客户端需要保存的ProviderRefCount，ContentProviderHolder，ProviderClientRecord等数据结构，并增加相应的引用计数
6367 * Installs the provider.
6368 *
6369 * Providers that are local to the process or that come from the system server
6370 * may be installed permanently which is indicated by setting noReleaseNeeded to true.
6371 * Other remote providers are reference counted. The initial reference count
6372 * for all reference counted providers is one. Providers that are not reference
6373 * counted do not have a reference count (at all).
6374 *
6375 * This method detects when a provider has already been installed. When this happens,
6376 * it increments the reference count of the existing provider (if appropriate)
6377 * and returns the existing provider. This can happen due to concurrent
6378 * attempts to acquire the same provider.
6379 */
6380 private ContentProviderHolder installProvider(Context context,
6381 ContentProviderHolder holder, ProviderInfo info,
6382 boolean noisy, boolean noReleaseNeeded, boolean stable) {
//当provider还没起来，用于安装provider时， ContentProviderHolder = null
6383 ContentProvider localProvider = null;
6384 IContentProvider provider;
//如果provider尚未实例化，则需要在这个宿主进程中进行”安装”
6385 if (holder == null || holder.provider == null) { //holder为null，holder中保存的IContentProvider为null，首次安装
6386 if (DEBUG_PROVIDER || noisy) {
6387 Slog.d(TAG, "Loading provider " + info.authority + ": "
6388 + info.name);
6389 }
6390 Context c = null;
6391 ApplicationInfo ai = info.applicationInfo;
6392 if (context.getPackageName().equals(ai.packageName)) {
6393 c = context;
6394 } else if (mInitialApplication != null &&
6395 mInitialApplication.getPackageName().equals(ai.packageName)) {
6396 c = mInitialApplication;
6397 } else {
6398 try {
6399 c = context.createPackageContext(ai.packageName,
6400 Context.CONTEXT_INCLUDE_CODE);
6401 } catch (PackageManager.NameNotFoundException e) {
6402 // Ignore
6403 }
6404 }
6405 if (c == null) {
//无法获取context对象则直接返回，用于通过反射创建ContentProvider对象实
6406 Slog.w(TAG, "Unable to get context for package " +
6407 ai.packageName +
6408 " while loading content provider " +
6409 info.name);
6410 return null;
6411 }
6412
6413 if (info.splitName != null) {
6414 try {
6415 c = c.createContextForSplit(info.splitName);
6416 } catch (NameNotFoundException e) {
6417 throw new RuntimeException(e);
6418 }
6419 }
6420
6421 try {
6422 final java.lang.ClassLoader cl = c.getClassLoader();
6423 localProvider = (ContentProvider)cl.
6424 loadClass(info.name).newInstance();
6425 provider = localProvider.getIContentProvider(); //创建ContentProvider实例，并得到其binder代理对象
6426 if (provider == null) {
6427 Slog.e(TAG, "Failed to instantiate class " +
6428 info.name + " from sourceDir " +
6429 info.applicationInfo.sourceDir);
6430 return null;
6431 }
6432 if (DEBUG_PROVIDER) Slog.v(
6433 TAG, "Instantiating local provider " + info.name);
6434 // XXX Need to create the correct context for this provider.
6435 localProvider.attachInfo(c, info);
//设置ContentProvider的成员变量，并调用其onCreate
6436 } catch (java.lang.Exception e) {
6438 UserManager userManager = (UserManager)c.getSystemService(Context.USER_SERVICE);
6439 if (!userManager.isUserUnlockingOrUnlocked(c.getUserId())
6440 && !info.directBootAware) {
6441 Slog.w(TAG, "Current user Id = " + c.getUserId() + " is stopped, "
6442 + "kill this process!");
//将ContentProvider的宿主进程杀掉
6443 Process.killProcess(Process.myPid());
6444 }
6446 if (!mInstrumentation.onException(null, e)) {
6447 throw new RuntimeException(
6448 "Unable to get provider " + info.name
6449 + ": " + e.toString(), e);
6450 }
6451 return null;
6452 }
6453 } else {
6454 provider = holder.provider;
6455 if (DEBUG_PROVIDER) Slog.v(TAG, "Installing external provider " + info.authority + ": "
6456 + info.name);
6457 }
6458
6459 ContentProviderHolder retHolder;
6460 //进行引用方面的操纵；在宿主进程进行provider的缓存
//在宿主进程中创建相关的数据结构，进行provider的相关缓存
6461 synchronized (mProviderMap) {
//前面是服务端创建ContentProvider实例及对应的IContentProvider操作
//下面是关于ProviderClientRecord对象，是用来存储访问过该ContentProvider的客户端的对象
//ContentProvider宿主进程(服务端进程)需要保存访问其的客户端进程，这是用于连带死亡时的逻辑
//类似于ServiceRecord中的final ArrayMap> connections
6462 if (DEBUG_PROVIDER) Slog.v(TAG, "Checking to add " + provider
6463 + " / " + info.name);
// 获取provider代理
6464 IBinder jBinder = provider.asBinder();
// 如果这个provider在上一个操作刚被创建
6465 if (localProvider != null) {
6466 ComponentName cname = new ComponentName(info.packageName, info.name);
6467 ProviderClientRecord pr = mLocalProvidersByName.get(cname);
// 本地缓存
6468 if (pr != null) {
6469 if (DEBUG_PROVIDER) {
6470 Slog.v(TAG, "installProvider: lost the race, "
6471 + "using existing local provider");
6472 }
6473 provider = pr.mProvider;
6474 } else {
6475 holder = new ContentProviderHolder(info);
6476 holder.provider = provider;
6477 holder.noReleaseNeeded = true;
// 根据Uri authority name进行分类缓存
6478 pr = installProviderAuthoritiesLocked(provider, localProvider, holder);
6479 mLocalProviders.put(jBinder, pr);
6480 mLocalProvidersByName.put(cname, pr);
6481 }
6482 retHolder = pr.mHolder;
6483 } else {
6484 ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
6485 if (prc != null) {
6486 if (DEBUG_PROVIDER) {
6487 Slog.v(TAG, "installProvider: lost the race, updating ref count");
6488 }
6489 // We need to transfer our new reference to the existing
6490 // ref count, releasing the old one... but only if
6491 // release is needed (that is, it is not running in the
6492 // system process).
6493 if (!noReleaseNeeded) {
6494 incProviderRefLocked(prc, stable);
6495 try {
6496 ActivityManager.getService().removeContentProvider(
6497 holder.connection, stable);
6498 } catch (RemoteException e) {
6499 //do nothing content provider object is dead any way
6500 }
6501 }
6502 } else {
6503 ProviderClientRecord client = installProviderAuthoritiesLocked(
6504 provider, localProvider, holder);
6505 if (noReleaseNeeded) {
6506 prc = new ProviderRefCount(holder, client, 1000, 1000);
6507 } else {
6508 prc = stable
6509 ? new ProviderRefCount(holder, client, 1, 0)
6510 : new ProviderRefCount(holder, client, 0, 1);
6511 }
6512 mProviderRefCountMap.put(jBinder, prc);
6513 }
6514 retHolder = prc.holder;
6515 }
6516 }
6517 return retHolder;
6518 }
ActivityThread#installProviderAuthoritiesLocked
6329 private ProviderClientRecord installProviderAuthoritiesLocked(IContentProvider provider,
6330 ContentProvider localProvider, ContentProviderHolder holder) {
6331 final String auths[] = holder.info.authority.split(";");
6332 final int userId = UserHandle.getUserId(holder.info.applicationInfo.uid);
6333
6334 if (provider != null) {
6335 // If this provider is hosted by the core OS and cannot be upgraded,
6336 // then I guess we're okay doing blocking calls to it.
6337 for (String auth : auths) {
6338 switch (auth) {
6339 case ContactsContract.AUTHORITY:
6340 case CallLog.AUTHORITY:
6341 case CallLog.SHADOW_AUTHORITY:
6342 case BlockedNumberContract.AUTHORITY:
6343 case CalendarContract.AUTHORITY:
6344 case Downloads.Impl.AUTHORITY:
6345 case "telephony":
6346 Binder.allowBlocking(provider.asBinder());
6347 }
6348 }
6349 }
6350
6351 final ProviderClientRecord pcr = new ProviderClientRecord(
6352 auths, provider, localProvider, holder);
6353 for (String auth : auths) {
6354 final ProviderKey key = new ProviderKey(auth, userId);
6355 final ProviderClientRecord existing = mProviderMap.get(key);
6356 if (existing != null) {
6357 Slog.w(TAG, "Content provider " + pcr.mHolder.info.name
6358 + " already published as " + auth);
6359 } else {
6360 mProviderMap.put(key, pcr);
6361 }
6362 }
6363 return pcr;
6364 }
相当于客户端和服务端都有机会走到installProvider，服务端调用时，都保存了相关的数据结构ProviderClientRecord，ProviderRefCount
5950 ContentProviderHolder cph = installProvider(context, null, cpi,
5951 false /*noisy*/, true /*noReleaseNeeded*/, true /*stable*/);
客户端调用时(aquireProvider中)
//如果ContentProvider install过了，这个功能只是增加引用计数
5872 holder = installProvider(c, holder, holder.info,
5873 true /*noisy*/, holder.noReleaseNeeded, stable);
这样是为了使installProvider这个函数公用，客户端主要是用其来增加
引用计数，服务端是用来创建ContentProvider实例的
ActivityManagerService#publishContentProviders
将创建的ContentProviderRecord这种数据结构保存在AMS中的mProviderMap和ProcessRecord.pubProviders
12302 public final void publishContentProviders(IApplicationThread caller,
12303 List providers) {
12304 if (providers == null) {
12305 return;
12306 }
12307
12308 enforceNotIsolatedCaller("publishContentProviders");
12309 synchronized (this) {
12310 final ProcessRecord r = getRecordForAppLocked(caller);
//获取provider宿主进程
12311 if (DEBUG_MU) Slog.v(TAG_MU, "ProcessRecord uid = " + r.uid);
12312 if (r == null) {
12313 throw new SecurityException(
12314 "Unable to find app for caller " + caller
12315 + " (pid=" + Binder.getCallingPid()
12316 + ") when publishing content providers");
12317 }
12318
12319 final long origId = Binder.clearCallingIdentity();
12320
12321 final int N = providers.size();
12322 for (int i = 0; i < N; i++) {
12323 ContentProviderHolder src = providers.get(i);
12324 if (src == null || src.info == null || src.provider == null) {
12325 continue;
12326 }
12327 ContentProviderRecord dst = r.pubProviders.get(src.info.name); //从服务端进程得到ContentProviderRecord
12328 if (DEBUG_MU) Slog.v(TAG_MU, "ContentProviderRecord uid = " + dst.uid);
12329 if (dst != null) {
12330 ComponentName comp = new ComponentName(dst.info.packageName, dst.info.name);
//将ContentProviderRecord加入到mProviderMap中
12331 mProviderMap.putProviderByClass(comp, dst);
12332 String names[] = dst.info.authority.split(";");
12333 for (int j = 0; j < names.length; j++) {
12334 mProviderMap.putProviderByName(names[j], dst);
12335 }
12336 //将服务端创建的ContentProviderRecord结构添加到AMS中，相当于publish
12337 int launchingCount = mLaunchingProviders.size();
12338 int j;
12339 boolean wasInLaunchingProviders = false;
12340 for (j = 0; j < launchingCount; j++) {
12341 if (mLaunchingProviders.get(j) == dst) {
//正式publish之后，从mLaunchingProviders移除相关ContentProviderRecord
12342 mLaunchingProviders.remove(j);
12343 wasInLaunchingProviders = true;
12344 j--;
12345 launchingCount--;
12346 }
12347 }
12348 if (wasInLaunchingProviders) {
12349 mHandler.removeMessages(CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG, r);
//对应发送的地方在attachApplicationLocked中，对应宿主进程启动的地方
12350 }
12351 synchronized (dst) {
12352 dst.provider = src.provider;
12353 dst.proc = r;
12354 dst.notifyAll(); //唤醒AMS中的wait方法，在getContentProviderImpl中等待
12355 }
12356 updateOomAdjLocked(r, true);
12357 maybeUpdateProviderUsageStatsLocked(r, src.info.packageName,
12358 src.info.authority);
12359 }
12360 }
12361
12362 Binder.restoreCallingIdentity(origId);
12363 }
12364 }
AMS缓存ContentProviderRecord后，客户端也会缓存ContentProviderRecord,在acquireExistingProvider中就已获得IContentProvider，后续无需通过AMS，而是直接通过IContentProvider binder proxy来调用ContentProvider实例的override函数，类似bindService中的onServiceConnected的IBinder，代表Service binder proxy
这里最后理一下ContentProvider客户端操作时的大致流程：
1.首先有一个进程A需要使用B进程的Provider，通过binder call到system_server查询；在system_server中进行判断要请求的provider是否已经正在运行，也就是要请求的provider是否由B进程已经publish过了
2.1 如果要请求的provider已经在运行，那么就建立A和B之间的链接，并返回一个ContentProviderHolder
2.2 如果要请求的provider不在运行，那么首先需要启动B进程，并把需要provider增加到mLaunchingProviders中
2.2.1 B进程在启动过程中attach到system_server的时候会设置一个10s的定时消息，然后在bindApplication中客户端执行installProvider
2.2.2 B进程installProvider成功之后，会publish provider到system_server，并移除上面的10s的定时消息
2.3 因为启动进程的过程是异步的，所以在等待对方进程启动并publish的时候，通过A进程binder call到system_server的线程一直会处在wait状态，直到等待的provider被publish或者由于进程被杀/启动超时等原因被remove掉
ContentProvider_query.png