ContentProvider原理分析

基于Android10.0，分析ContentProvider原理

一、概述

ContentProvider用于提供数据的统一访问格式，封装具体的实现。对于数据的使用无需知道是数据库、文件、网络，只需要使用ContentProvider的数据操作接口，即增（insert）删（delete）改（update）查（query）。

1.1 ContentProvider

ContentProvider作为四大组件之一，没有Activity复杂的生命周期，只有简单的onCreate过程。ContentProvider是一个抽象类，当实现自己的ContentProvider类，需要继承ContentProvider，并且实现下面6个抽象即可：

insert(Uri, ContentValues)：插入新数据；
delete(Uri, String, String[])：删除已有数据；
update(Uri, ContentValues, String, String[])：更新数据；
query(Uri, String[], String, String[], String)：查询数据；
onCreate()：执行初始化工作；
getType(Uri)：获取数据MIME类型。

Uri数据格式如下：content://com.skytoby.articles/android/1

字段	含义	对应项
前缀	默认的固定开头格式	content://
授权	唯一表示provider	com.skytoby.articles
路径	数据类别以及数据项	/android/1

1.2 ContentResolver

其他进程想要操作ContentProvider，需要获取其对应的ContentResolver，利用ContentResolver类完成对数据的增删改查操作，下面列举一个查询的操作。

//获取ContentResolver
ContentResolver cr = getContentResolver();  
Uri uri = Uri.parse("content://com.skytoby.articles/android/1");
Cursor cursor = cr.query(uri, null, null, null, null);  //执行查询操作
...
cursor.close(); //关闭

1.3 类图

CPP和CPN是Binder通信的C/S两端

ACR（ApplicationContentResolver）继承于ContentResolver，是ContextImpl的内部类，ACR的实现通过调用其成员变量mMainThread来实现。

1.4 重要成员变量

类名	成员变量	含义
AMS	CONTENT_PROVIDER_PUBLISH_TIMEOUT	默认值为10s
AMS	mProviderMap	记录所有contentProvider
AMS	mLaunchingProviders	记录存在客户端等待publish的ContentProviderRecord
PR	pubProviders	该进程创建的ContentProviderRecord
PR	conProviders	该进程使用的ContentProviderConnection
AT	mLocalProviders	记录所有本地的ContentProvider，以IBinder以key
AT	mLocalProvidersByName	记录所有本地的ContentProvider，以组件名为key
AT	mProviderMap	记录该进程的contentProvider
AT	mProviderRefCountMap	记录所有对其他进程中的ContentProvider的引用计数

• CONTENT_PROVIDER_PUBLISH_TIMEOUT(10s): provider所在进程发布其ContentProvider的超时时长为10s，超过10s则会系统所杀;
• mProviderMap： AMS和AT都有一个同名的成员变量, AMS的数据类型为ProviderMap,而AT则是以ProviderKey为key的ArrayMap类型;
• mLaunchingProviders：记录的每一项是一个ContentProviderRecord对象, 所有的存在client等待其发布完成的contentProvider列表，一旦发布完成则相应的contentProvider便会从该列表移除；
• PR:ProcessRecord, AT: ActivityThread；
• mLocalProviders和mLocalProvidersByName：都是用于记录所有本地的ContentProvider,不同的只是key。

1.5 query流程图

二、发布ContentProvider

通过ContentProvider共享数据时，需要编写一个类继承ContentProvier，创建数据库，并在AndroidManifest声明该Provider，这样其他的进行就可以通过ContentResolver去查询共享的信息。先来看一下应用时如何发布ContentProvider，提供给其他应用使用。ContentProvider一般是在应用进程启动的时候启动，是四大组件中最早启动的。进程的启动在四大组件与进程启动那里有详细的分析。

发布ContentProvider分两种情况：Provider进程未启动，Provider进程已经启动但未发布。

• Provider进程未启动

  systemserver进程调用startProcessLocked创建provider进程，并attach到systemserver后，通过binder机制到Provider进程执行bindApplication方法，见2.1节。

• Provider进程已经启动但未发布

  如果发现provider进程已经存在且attach到systemserver，但对应的provider还没有发布，

  则通过binder机制到provider进程执行scheduleInstallProvider方法，见2.7节。

  这两种情况最后都会走到installProvider这个方法。

2.1 Provider进程未启动

2.1.1 AT.bindApplication

[->ActivityThread.java]

public final void bindApplication(String processName, ApplicationInfo appInfo,
              List<ProviderInfo> providers, ComponentName instrumentationName,
              ProfilerInfo profilerInfo, Bundle instrumentationArgs,
              IInstrumentationWatcher instrumentationWatcher,
              IUiAutomationConnection instrumentationUiConnection, int debugMode,
              boolean enableBinderTracking, boolean trackAllocation,
              boolean isRestrictedBackupMode, boolean persistent, Configuration config,
              CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
              String buildSerial, boolean autofillCompatibilityEnabled) {
              
          AppBindData data = new AppBindData();
          data.processName = processName;
          data.appInfo = appInfo;
          //provider
          data.providers = providers;
          ...
          sendMessage(H.BIND_APPLICATION, data);
      }

发送BIND_APPLICATION消息到主线程。

2.1.2 AT.handleMessage

[->ActivityThread.java]

public void handleMessage(Message msg) {
           if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
           switch (msg.what) {
               case BIND_APPLICATION:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                   AppBindData data = (AppBindData)msg.obj;
                   handleBindApplication(data);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               }
               ...
  }

主线程收到BIND_APPLICATION后，执行handleBindApplication方法。

2.1.3 AT.handleMessage

[->ActivityThread.java]

private void handleBindApplication(AppBindData data) {
        
       // send up app name; do this *before* waiting for debugger
       //设置进程名
       Process.setArgV0(data.processName);
       android.ddm.DdmHandleAppName.setAppName(data.processName,
                                               UserHandle.myUserId());
       VMRuntime.setProcessPackageName(data.appInfo.packageName);
       ...
       // Allow disk access during application and provider setup. This could
       // block processing ordered broadcasts, but later processing would
       // probably end up doing the same disk access.
       Application app;
       final StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
       final StrictMode.ThreadPolicy writesAllowedPolicy = StrictMode.getThreadPolicy();
       try {
       
           // If the app is being launched for full backup or restore, bring it up in
           // a restricted environment with the base application class.
           //实例化Application,会调用attachBaseContext方法
           app = data.info.makeApplication(data.restrictedBackupMode, null);
           
           // Propagate autofill compat state
           app.setAutofillCompatibilityEnabled(data.autofillCompatibilityEnabled);
           mInitialApplication = app;
           //不是限制备份模式
           // don't bring up providers in restricted mode; they may depend on the
           // app's custom Application class
           if (!data.restrictedBackupMode) {
               if (!ArrayUtils.isEmpty(data.providers)) {
                   //安装ContentProvider，见2.4节
                   installContentProviders(app, data.providers);
               }
           }
           try {
               //调用Application的onCreate方法
               mInstrumentation.callApplicationOnCreate(app);
           } catch (Exception e) {
               if (!mInstrumentation.onException(app, e)) {
                   throw new RuntimeException(
                     "Unable to create application " + app.getClass().getName()
                     + ": " + e.toString(), e);
               }
           }
       } 
       // 加载字体资源
       // Preload fonts resources
       FontsContract.setApplicationContextForResources(appContext);
       if (!Process.isIsolated()) {
           try {
               final ApplicationInfo info =
                       getPackageManager().getApplicationInfo(
                               data.appInfo.packageName,
                               PackageManager.GET_META_DATA /*flags*/,
                               UserHandle.myUserId());
               if (info.metaData != null) {
                   final int preloadedFontsResource = info.metaData.getInt(
                           ApplicationInfo.METADATA_PRELOADED_FONTS, 0);
                   if (preloadedFontsResource != 0) {
                       data.info.getResources().preloadFonts(preloadedFontsResource);
                   }
               }
           } catch (RemoteException e) {
               throw e.rethrowFromSystemServer();
           }
       }
   }

2.1.4 AT.installContentProviders

[->ActivityThread.java]

@UnsupportedAppUsage
    private void installContentProviders(
            Context context, List<ProviderInfo> providers) {
        final ArrayList<ContentProviderHolder> results = new ArrayList<>();

        for (ProviderInfo cpi : providers) {
            if (DEBUG_PROVIDER) {
                StringBuilder buf = new StringBuilder(128);
                buf.append("Pub ");
                buf.append(cpi.authority);
                buf.append(": ");
                buf.append(cpi.name);
                Log.i(TAG, buf.toString());
            }
            //安装provider，见2.1.5节
            ContentProviderHolder cph = installProvider(context, null, cpi,
                    false /*noisy*/, true /*noReleaseNeeded*/, true /*stable*/);
            if (cph != null) {
                cph.noReleaseNeeded = true;
                results.add(cph);
            }
        }

        try {
            //发布provider见2.2.1节
            ActivityManager.getService().publishContentProviders(
                getApplicationThread(), results);
        } catch (RemoteException ex) {
            throw ex.rethrowFromSystemServer();
        }
    }

2.1.5 AT.installProvider

[->ActivityThread.java]

private ContentProviderHolder installProvider(Context context,
          ContentProviderHolder holder, ProviderInfo info,
          boolean noisy, boolean noReleaseNeeded, boolean stable) {
      ContentProvider localProvider = null;
      IContentProvider provider;
      if (holder == null || holder.provider == null) {
          if (DEBUG_PROVIDER || noisy) {
              Slog.d(TAG, "Loading provider " + info.authority + ": "
                      + info.name);
          }
          Context c = null;
          ApplicationInfo ai = info.applicationInfo;
          //赋值context
          if (context.getPackageName().equals(ai.packageName)) {
              c = context;
          } else if (mInitialApplication != null &&
                  mInitialApplication.getPackageName().equals(ai.packageName)) {
              c = mInitialApplication;
          } else {
              try {
                  c = context.createPackageContext(ai.packageName,
                          Context.CONTEXT_INCLUDE_CODE);
              } catch (PackageManager.NameNotFoundException e) {
                  // Ignore
              }
          }
          //无法获取context则直接返回
          if (c == null) {
              Slog.w(TAG, "Unable to get context for package " +
                    ai.packageName +
                    " while loading content provider " +
                    info.name);
              return null;
          }

          if (info.splitName != null) {
              try {
                  c = c.createContextForSplit(info.splitName);
              } catch (NameNotFoundException e) {
                  throw new RuntimeException(e);
              }
          }

          try {
              final java.lang.ClassLoader cl = c.getClassLoader();
              LoadedApk packageInfo = peekPackageInfo(ai.packageName, true);
              if (packageInfo == null) {
                  // System startup case.
                  packageInfo = getSystemContext().mPackageInfo;
              }
              //通过反射，创建目标ContentProvider对象
              localProvider = packageInfo.getAppFactory()
                      .instantiateProvider(cl, info.name);
              //获取contentprovider        
              provider = localProvider.getIContentProvider();
              if (provider == null) {
                  Slog.e(TAG, "Failed to instantiate class " +
                        info.name + " from sourceDir " +
                        info.applicationInfo.sourceDir);
                  return null;
              }
              if (DEBUG_PROVIDER) Slog.v(
                  TAG, "Instantiating local provider " + info.name);
              // XXX Need to create the correct context for this provider.
              //回调目标 ContentProvider.this.onCreate()方法
              localProvider.attachInfo(c, info);
          } catch (java.lang.Exception e) {
              if (!mInstrumentation.onException(null, e)) {
                  throw new RuntimeException(
                          "Unable to get provider " + info.name
                          + ": " + e.toString(), e);
              }
              return null;
          }
      } else {
          provider = holder.provider;
          if (DEBUG_PROVIDER) Slog.v(TAG, "Installing external provider " + info.authority + ": "
                  + info.name);
      }
      
      //retHolder赋值，用于将contentProvider放入缓存
      ContentProviderHolder retHolder;

      synchronized (mProviderMap) {
          if (DEBUG_PROVIDER) Slog.v(TAG, "Checking to add " + provider
                  + " / " + info.name);
          IBinder jBinder = provider.asBinder();
          if (localProvider != null) {
              ComponentName cname = new ComponentName(info.packageName, info.name);
              ProviderClientRecord pr = mLocalProvidersByName.get(cname);
              if (pr != null) {
                  if (DEBUG_PROVIDER) {
                      Slog.v(TAG, "installProvider: lost the race, "
                              + "using existing local provider");
                  }
                  provider = pr.mProvider;
              } else {
                  holder = new ContentProviderHolder(info);
                  holder.provider = provider;
                  holder.noReleaseNeeded = true;
                  pr = installProviderAuthoritiesLocked(provider, localProvider, holder);
                  mLocalProviders.put(jBinder, pr);
                  mLocalProvidersByName.put(cname, pr);
              }
              retHolder = pr.mHolder;
          } else {
              ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
              if (prc != null) {
                  if (DEBUG_PROVIDER) {
                      Slog.v(TAG, "installProvider: lost the race, updating ref count");
                  }
                  // We need to transfer our new reference to the existing
                  // ref count, releasing the old one...  but only if
                  // release is needed (that is, it is not running in the
                  // system process).
                  //不再需要则remove
                  if (!noReleaseNeeded) {
                      incProviderRefLocked(prc, stable);
                      try {
                          ActivityManager.getService().removeContentProvider(
                                  holder.connection, stable);
                      } catch (RemoteException e) {
                          //do nothing content provider object is dead any way
                      }
                  }
              } else {
                  ProviderClientRecord client = installProviderAuthoritiesLocked(
                          provider, localProvider, holder);
                  if (noReleaseNeeded) {
                      prc = new ProviderRefCount(holder, client, 1000, 1000);
                  } else {
                      prc = stable
                              ? new ProviderRefCount(holder, client, 1, 0)
                              : new ProviderRefCount(holder, client, 0, 1);
                  }
                  mProviderRefCountMap.put(jBinder, prc);
              }
              retHolder = prc.holder;
          }
      }
      return retHolder;
  }

这里主要是通过反射获取获取contentprovider，并回调其onCreate方法，最后对ContentProviderHolder进行赋值并返回。

2.1.6 AMS.publishContentProviders

[->ActivityManagerService.java]

public final void publishContentProviders(IApplicationThread caller,
            List<ContentProviderHolder> providers) {
        if (providers == null) {
            return;
        }

        enforceNotIsolatedCaller("publishContentProviders");
        synchronized (this) {
            final ProcessRecord r = getRecordForAppLocked(caller);
            if (DEBUG_MU) Slog.v(TAG_MU, "ProcessRecord uid = " + r.uid);
            if (r == null) {
                throw new SecurityException(
                        "Unable to find app for caller " + caller
                      + " (pid=" + Binder.getCallingPid()
                      + ") when publishing content providers");
            }

            final long origId = Binder.clearCallingIdentity();

            final int N = providers.size();
            for (int i = 0; i < N; i++) {
                ContentProviderHolder src = providers.get(i);
                if (src == null || src.info == null || src.provider == null) {
                    continue;
                }
                ContentProviderRecord dst = r.pubProviders.get(src.info.name);
                if (DEBUG_MU) Slog.v(TAG_MU, "ContentProviderRecord uid = " + dst.uid);
                if (dst != null) {
                    ComponentName comp = new ComponentName(dst.info.packageName, dst.info.name);
                    //将该provider添加到mProviderMap
                    mProviderMap.putProviderByClass(comp, dst);
                    String names[] = dst.info.authority.split(";");
                    for (int j = 0; j < names.length; j++) {
                        mProviderMap.putProviderByName(names[j], dst);
                    }

                    int launchingCount = mLaunchingProviders.size();
                    int j;
                    boolean wasInLaunchingProviders = false;
                    for (j = 0; j < launchingCount; j++) {
                        if (mLaunchingProviders.get(j) == dst) {
                            mLaunchingProviders.remove(j);
                            wasInLaunchingProviders = true;
                            j--;
                            launchingCount--;
                        }
                    }
                    if (wasInLaunchingProviders) {
                        //移除超时消息
                        mHandler.removeMessages(CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG, r);
                    }
                    synchronized (dst) {
                        dst.provider = src.provider;
                        dst.proc = r;
                        //唤醒客户端的wait等待方法
                        dst.notifyAll();
                    }
                    //更新adj
                    updateOomAdjLocked(r, true);
                    maybeUpdateProviderUsageStatsLocked(r, src.info.packageName,
                            src.info.authority);
                }
            }

            Binder.restoreCallingIdentity(origId);
        }
    }

ContentProviders一旦publish成功，则会移除超时发布的消息，并调用notifyAll来唤醒所有等待client端进程。

2.2 Provider进程启动但未发布

下面在看下Provider进程未发布的情况，。。。。。。。。。。。。。。。。。。。。。。

2.2.1 AT.scheduleInstallProvider

[->ActivityThread.java]

@Override
public void scheduleInstallProvider(ProviderInfo provider) {
    sendMessage(H.INSTALL_PROVIDER, provider);
}
public void handleMessage(Message msg) {
      ...
      case INSTALL_PROVIDER:
            handleInstallProvider((ProviderInfo) msg.obj);
            break;
      ...
 }

2.2.2 AT.handleInstallProvider

[->ActivityThread.java]

public void handleInstallProvider(ProviderInfo info) {
       final StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskWrites();
       try {
           installContentProviders(mInitialApplication, Arrays.asList(info));
       } finally {
           StrictMode.setThreadPolicy(oldPolicy);
       }
   }

这个方法之后就是2.1.4节的流程installContentProviders

三、查询ContentResolver

一般用ContentProvider的时候，会先得到ContentResolver，之后通过uri可以获取相应的信息，下面就从查询方法开始，分析这个过程的源码流程。

ContentResolver contentResolver = getContentResolver();
Uri uri = Uri.parse("content://com.skytoby.articles/android/1");
Cursor cursor = contentResolver.query(uri, null, null, null, null);

3.1 CI.getContentResolver

[->ContextImpl.java]

@Override
public ContentResolver getContentResolver() {
    return mContentResolver;
}

private ContextImpl(@Nullable ContextImpl container, @NonNull ActivityThread mainThread,
        @NonNull LoadedApk packageInfo, @Nullable String splitName,
        @Nullable IBinder activityToken, @Nullable UserHandle user, int flags,
        @Nullable ClassLoader classLoader) {
    ...
    mContentResolver = new ApplicationContentResolver(this, mainThread);
}

Context中调用getContentResolver，经过层层调用到ContextImpl，返回是在ContextImpl对象创建过程中完成赋值的。下面看下查询的操作。

3.2 CR.query

[->ContentResolver.java]

public final @Nullable Cursor query(@RequiresPermission.Read @NonNull Uri uri,
        @Nullable String[] projection, @Nullable String selection,
        @Nullable String[] selectionArgs, @Nullable String sortOrder) {
    return query(uri, projection, selection, selectionArgs, sortOrder, null);
}

public final @Nullable Cursor query(final @RequiresPermission.Read @NonNull Uri uri,
        @Nullable String[] projection, @Nullable Bundle queryArgs,
        @Nullable CancellationSignal cancellationSignal) {
    Preconditions.checkNotNull(uri, "uri");
    //获取unstableProvider见3.3节
    IContentProvider unstableProvider = acquireUnstableProvider(uri);
    if (unstableProvider == null) {
        return null;
    }
    IContentProvider stableProvider = null;
    Cursor qCursor = null;
    try {
        long startTime = SystemClock.uptimeMillis();

        ICancellationSignal remoteCancellationSignal = null;
        if (cancellationSignal != null) {
            cancellationSignal.throwIfCanceled();
            remoteCancellationSignal = unstableProvider.createCancellationSignal();
            cancellationSignal.setRemote(remoteCancellationSignal);
        }
        try {
            //执行查询操作
            qCursor = unstableProvider.query(mPackageName, uri, projection,
                    queryArgs, remoteCancellationSignal);
        } catch (DeadObjectException e) {
            // The remote process has died...  but we only hold an unstable
            // reference though, so we might recover!!!  Let's try!!!!
            // This is exciting!!1!!1!!!!1
            //远程进程死亡，处理unstableProvider死亡过程
            unstableProviderDied(unstableProvider);
            //unstable类型死亡后，在创建stable类型的provider，见3.5节
            stableProvider = acquireProvider(uri);
            if (stableProvider == null) {
                return null;
            }
            //再次执行查询操作
            qCursor = stableProvider.query(
                    mPackageName, uri, projection, queryArgs, remoteCancellationSignal);
        }
        if (qCursor == null) {
            return null;
        }
        //强制执行操作，可能会失败并抛出RuntimeException
        // Force query execution.  Might fail and throw a runtime exception here.
        qCursor.getCount();
        long durationMillis = SystemClock.uptimeMillis() - startTime;
        maybeLogQueryToEventLog(durationMillis, uri, projection, queryArgs);
      
        //创建CursorWrapperInner对象
        // Wrap the cursor object into CursorWrapperInner object.
        final IContentProvider provider = (stableProvider != null) ? stableProvider
                : acquireProvider(uri);
        final CursorWrapperInner wrapper = new CursorWrapperInner(qCursor, provider);
        stableProvider = null;
        qCursor = null;
        return wrapper;
    } catch (RemoteException e) {
        // Arbitrary and not worth documenting, as Activity
        // Manager will kill this process shortly anyway.
        return null;
    } finally {
        if (qCursor != null) {
            qCursor.close();
        }
        if (cancellationSignal != null) {
            cancellationSignal.setRemote(null);
        }
        if (unstableProvider != null) {
            releaseUnstableProvider(unstableProvider);
        }
        if (stableProvider != null) {
            releaseProvider(stableProvider);
        }
    }
}

一般获取unstable的Provider：调用acquireUnstableProvider，尝试获取unstable的ContentProvider；然后执行query操作

当执行query操作过程中抛出DeadObjectException，即ContentProvider所在的进程死亡，则尝试获取stable的ContentProvider:

1.先调用unstableProviderDied，清理刚创建的unstable的ContentProvider

2.调用acquireProvider，尝试获取stable的ContentProvider，此时当ContentProvider进程死亡，则会杀掉该ContentProvider的客户端进程；

3.执行query操作。

stable和unstable的区别：

采用unstable类型的ContentProvider的应用不会因为远程ContentProvider进程的死亡而被杀。

采用stable类型的ContentProvider的应用会因为远程ContentProvider进程的死亡而被杀。

对于应用无法决定创建的ContentProvider是stable还是unstable的，也无法知道自己的进程是否依赖于远程进程的生死。

3.3 CR.acquireUnstableProvider

[->ContentResolver.java]

/**
    * Returns the content provider for the given content URI.
    *
    * @param uri The URI to a content provider
    * @return The ContentProvider for the given URI, or null if no content provider is found.
    * @hide
    */
   public final IContentProvider acquireUnstableProvider(Uri uri) {
       if (!SCHEME_CONTENT.equals(uri.getScheme())) {
           return null;
       }
       String auth = uri.getAuthority();
       if (auth != null) {
           //获取UnstableProvider,见3.4节
           return acquireUnstableProvider(mContext, uri.getAuthority());
       }
       return null;
   }

3.4 ACR.acquireUnstableProvider

[->ContextImpl.java::ApplicationContentResolver]

private static final class ApplicationContentResolver extends ContentResolver {
     ...
    private static final class ApplicationContentResolver extends ContentResolver {
        @UnsupportedAppUsage
        private final ActivityThread mMainThread;
        ...
        //stable provider
        @Override
        @UnsupportedAppUsage
        protected IContentProvider acquireProvider(Context context, String auth) {
            return mMainThread.acquireProvider(context,
                    ContentProvider.getAuthorityWithoutUserId(auth),
                    resolveUserIdFromAuthority(auth), true);
        }
        //unstable provider
        @Override
        protected IContentProvider acquireUnstableProvider(Context c, String auth) {
            return mMainThread.acquireProvider(c,
                    ContentProvider.getAuthorityWithoutUserId(auth),
                    resolveUserIdFromAuthority(auth), false);
        }
    }
}

从上面可以看出，无论是acquireProvider还是acquireUnstableProvider方法，最后调用的都市ActivityThread的同一个方法的acquireProvider。getAuthorityWithoutUserId是字符截断过程，即去掉auth中的userid信息，比如com.skytoby.article@666,经过该方法则变成了com.skytoby.article。

3.5 AT.acquireProvider

[->ActivityThread.java]

public final IContentProvider acquireProvider(
          Context c, String auth, int userId, boolean stable) {
      //获取已经存在的provider    
      final IContentProvider provider = acquireExistingProvider(c, auth, userId, stable);
      if (provider != null) {
          //成功则返回
          return provider;
      }

      // There is a possible race here.  Another thread may try to acquire
      // the same provider at the same time.  When this happens, we want to ensure
      // that the first one wins.
      // Note that we cannot hold the lock while acquiring and installing the
      // provider since it might take a long time to run and it could also potentially
      // be re-entrant in the case where the provider is in the same process.
      ContentProviderHolder holder = null;
      try {
          synchronized (getGetProviderLock(auth, userId)) {
              //见3.6节
              holder = ActivityManager.getService().getContentProvider(
                      getApplicationThread(), auth, userId, stable);
          }
      } catch (RemoteException ex) {
          throw ex.rethrowFromSystemServer();
      }
      if (holder == null) {
          Slog.e(TAG, "Failed to find provider info for " + auth);
          return null;
      }
      
      // 安装provider将会增加引用计数，见3.8节
      // Install provider will increment the reference count for us, and break
      // any ties in the race.
      holder = installProvider(c, holder, holder.info,
              true /*noisy*/, holder.noReleaseNeeded, stable);
      return holder.provider;
  }

主要过程：1.获取已经存在的provider,如果存在则返回，否则继续执行；

​ 2.通过AMS获取provider，无法获取则返回，否则继续执行；

​ 3.通过installProvider方法安装provider，并增加该provider的引用计数。

3.5.1 AT.acquireExistingProvider

[->ActivityThread.java]

@UnsupportedAppUsage
public final IContentProvider acquireExistingProvider(
        Context c, String auth, int userId, boolean stable) {
    synchronized (mProviderMap) {
        final ProviderKey key = new ProviderKey(auth, userId);
        //从mProviderMap中查询是否存在，在2.1.6节发布时将provider添加到了mProviderMap
        final ProviderClientRecord pr = mProviderMap.get(key);
        if (pr == null) {
            return null;
        }

        IContentProvider provider = pr.mProvider;
        IBinder jBinder = provider.asBinder();
        if (!jBinder.isBinderAlive()) {
            // The hosting process of the provider has died; we can't
            // use this one.
            Log.i(TAG, "Acquiring provider " + auth + " for user " + userId
                    + ": existing object's process dead");
            //当provider所在的进程已经死亡则返回        
            handleUnstableProviderDiedLocked(jBinder, true);
            return null;
        }

        // Only increment the ref count if we have one.  If we don't then the
        // provider is not reference counted and never needs to be released.
        ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
        if (prc != null) {
            //增加引用计数
            incProviderRefLocked(prc, stable);
        }
        return provider;
    }
}

查询mProviderMap是否存在provider，如果不存在则直接返回。如果存在判断provider的进程是否死亡，死亡则返回null。如果provider所在的进程还在，则增加引用计数。

3.6 AMS.getContentProvider

[->ActivityManagerService.java]

@Override
   public final ContentProviderHolder getContentProvider(
           IApplicationThread caller, String name, int userId, boolean stable) {
       enforceNotIsolatedCaller("getContentProvider");
       if (caller == null) {
           String msg = "null IApplicationThread when getting content provider "
                   + name;
           Slog.w(TAG, msg);
           throw new SecurityException(msg);
       }
       // The incoming user check is now handled in checkContentProviderPermissionLocked() to deal
       // with cross-user grant.
       return getContentProviderImpl(caller, name, null, stable, userId);
   }

3.7 AMS.getContentProviderImpl

[->ActivityManagerService.java]

private ContentProviderHolder getContentProviderImpl(IApplicationThread caller,
          String name, IBinder token, boolean stable, int userId) {
      ContentProviderRecord cpr;
      ContentProviderConnection conn = null;
      ProviderInfo cpi = null;
      boolean providerRunning = false;

      synchronized(this) {
          long startTime = SystemClock.uptimeMillis();

          ProcessRecord r = null;
          if (caller != null) {
              //获取调用者的进程记录
              r = getRecordForAppLocked(caller);
              if (r == null) {
                  throw new SecurityException(
                          "Unable to find app for caller " + caller
                        + " (pid=" + Binder.getCallingPid()
                        + ") when getting content provider " + name);
              }
          }

          boolean checkCrossUser = true;

          checkTime(startTime, "getContentProviderImpl: getProviderByName");
          
          //从mProviderMap中获取ContentProviderRecord
          // First check if this content provider has been published...
          cpr = mProviderMap.getProviderByName(name, userId);
          // If that didn't work, check if it exists for user 0 and then
          // verify that it's a singleton provider before using it.
          if (cpr == null && userId != UserHandle.USER_SYSTEM) {
              //从USER_SYSTEM获取，这里的name是componentName
              cpr = mProviderMap.getProviderByName(name, UserHandle.USER_SYSTEM);
              if (cpr != null) {
                  cpi = cpr.info;
                  if (isSingleton(cpi.processName, cpi.applicationInfo,
                          cpi.name, cpi.flags)
                          && isValidSingletonCall(r.uid, cpi.applicationInfo.uid)) {
                      userId = UserHandle.USER_SYSTEM;
                      checkCrossUser = false;
                  } else {
                      cpr = null;
                      cpi = null;
                  }
              }
          }

          if (cpr != null && cpr.proc != null) {
              providerRunning = !cpr.proc.killed;

              // Note if killedByAm is also set, this means the provider process has just been
              // killed by AM (in ProcessRecord.kill()), but appDiedLocked() hasn't been called
              // yet. So we need to call appDiedLocked() here and let it clean up.
              // (See the commit message on I2c4ba1e87c2d47f2013befff10c49b3dc337a9a7 to see
              // how to test this case.)
              //目标provider进程死亡
              if (cpr.proc.killed && cpr.proc.killedByAm) {
                  checkTime(startTime, "getContentProviderImpl: before appDied (killedByAm)");
                  final long iden = Binder.clearCallingIdentity();
                  try {
                      appDiedLocked(cpr.proc);
                  } finally {
                      Binder.restoreCallingIdentity(iden);
                  }
                  checkTime(startTime, "getContentProviderImpl: after appDied (killedByAm)");
              }
          }
         //目标provider存在的情况，见3.7.1
         if (providerRunning) {
            ....
         }
         //目标provider不存在的情况，见3.7.2
         if (!providerRunning) {
            ....
         }
        //循环等待provider发布完成，见3.7.3
         synchronized (cpr) {
             while (cpr.provider == null) {
                 ....
              }
         }
   }
     return super.onTransact(code, data, reply, flags);
}

这个方法比较长，主要分为三个部分：

目标provider存在的情况；目标provider不存在的情况；循环等待目标provider发布完成。

3.7.1 目标provider存在

if (providerRunning) {
           cpi = cpr.info;
           String msg;
           checkTime(startTime, "getContentProviderImpl: before checkContentProviderPermission");
           //检查权限
           if ((msg = checkContentProviderPermissionLocked(cpi, r, userId, checkCrossUser))
                   != null) {
               throw new SecurityException(msg);
           }
           checkTime(startTime, "getContentProviderImpl: after checkContentProviderPermission");

           if (r != null && cpr.canRunHere(r)) {
               //当允许运行在调用者进程，且已经发布，则直接返回
               // This provider has been published or is in the process
               // of being published...  but it is also allowed to run
               // in the caller's process, so don't make a connection
               // and just let the caller instantiate its own instance.
               ContentProviderHolder holder = cpr.newHolder(null);
               // don't give caller the provider object, it needs
               // to make its own.
               holder.provider = null;
               return holder;
           }
           // Don't expose providers between normal apps and instant apps
           try {
               if (AppGlobals.getPackageManager()
                       .resolveContentProvider(name, 0 /*flags*/, userId) == null) {
                   return null;
               }
           } catch (RemoteException e) {
           }

           final long origId = Binder.clearCallingIdentity();

           checkTime(startTime, "getContentProviderImpl: incProviderCountLocked");
           // 增加引用计数，见3.8.1节
           // In this case the provider instance already exists, so we can
           // return it right away.
           conn = incProviderCountLocked(r, cpr, token, stable);
           if (conn != null && (conn.stableCount+conn.unstableCount) == 1) {
               if (cpr.proc != null && r.setAdj <= ProcessList.PERCEPTIBLE_APP_ADJ) {
                   // If this is a perceptible app accessing the provider,
                   // make sure to count it as being accessed and thus
                   // back up on the LRU list.  This is good because
                   // content providers are often expensive to start.
                   //更新进程LRU队列
                   checkTime(startTime, "getContentProviderImpl: before updateLruProcess");
                   updateLruProcessLocked(cpr.proc, false, null);
                   checkTime(startTime, "getContentProviderImpl: after updateLruProcess");
               }
           }

           checkTime(startTime, "getContentProviderImpl: before updateOomAdj");
           final int verifiedAdj = cpr.proc.verifiedAdj;
           //更新进程adj
           boolean success = updateOomAdjLocked(cpr.proc, true);
           // XXX things have changed so updateOomAdjLocked doesn't actually tell us
           // if the process has been successfully adjusted.  So to reduce races with
           // it, we will check whether the process still exists.  Note that this doesn't
           // completely get rid of races with LMK killing the process, but should make
           // them much smaller.
           if (success && verifiedAdj != cpr.proc.setAdj && !isProcessAliveLocked(cpr.proc)) {
               success = false;
           }
           maybeUpdateProviderUsageStatsLocked(r, cpr.info.packageName, name);
           checkTime(startTime, "getContentProviderImpl: after updateOomAdj");
           if (DEBUG_PROVIDER) Slog.i(TAG_PROVIDER, "Adjust success: " + success);
           // NOTE: there is still a race here where a signal could be
           // pending on the process even though we managed to update its
           // adj level.  Not sure what to do about this, but at least
           // the race is now smaller.
           if (!success) {
               //provider进程被杀死，则减少应用计数，见3.8.3节
               // Uh oh...  it looks like the provider's process
               // has been killed on us.  We need to wait for a new
               // process to be started, and make sure its death
               // doesn't kill our process.
               Slog.i(TAG, "Existing provider " + cpr.name.flattenToShortString()
                       + " is crashing; detaching " + r);
               boolean lastRef = decProviderCountLocked(conn, cpr, token, stable);
               checkTime(startTime, "getContentProviderImpl: before appDied");
               appDiedLocked(cpr.proc);
               checkTime(startTime, "getContentProviderImpl: after appDied");
               if (!lastRef) {
                   // This wasn't the last ref our process had on
                   // the provider...  we have now been killed, bail.
                   return null;
               }
               providerRunning = false;
               conn = null;
           } else {
               cpr.proc.verifiedAdj = cpr.proc.setAdj;
           }

           Binder.restoreCallingIdentity(origId);
       }

当ContentProvider所在的进程已经存在：

检查权限；当允许运行在调用者进程且已经发布，则直接返回

增加引用计数；更新进程LRU队列；更新adj

当provider进程被杀时，则奸商引用计数并调用appDiedLocked，设置provider为未发布状态。

3.7.2 目标provider不存在

  if (!providerRunning) {
        try {
            checkTime(startTime, "getContentProviderImpl: before resolveContentProvider");
            //获取ProviderInfo对象
            cpi = AppGlobals.getPackageManager().
                resolveContentProvider(name,
                    STOCK_PM_FLAGS | PackageManager.GET_URI_PERMISSION_PATTERNS, userId);
            checkTime(startTime, "getContentProviderImpl: after resolveContentProvider");
        } catch (RemoteException ex) {
        }
        if (cpi == null) {
            return null;
        }
        //provider是否是单例
        // If the provider is a singleton AND
        // (it's a call within the same user || the provider is a
        // privileged app)
        // Then allow connecting to the singleton provider
        boolean singleton = isSingleton(cpi.processName, cpi.applicationInfo,
                cpi.name, cpi.flags)
                && isValidSingletonCall(r.uid, cpi.applicationInfo.uid);
        if (singleton) {
            userId = UserHandle.USER_SYSTEM;
        }
        cpi.applicationInfo = getAppInfoForUser(cpi.applicationInfo, userId);
        checkTime(startTime, "getContentProviderImpl: got app info for user");

        String msg;
        checkTime(startTime, "getContentProviderImpl: before checkContentProviderPermission");
        //权限检查
        if ((msg = checkContentProviderPermissionLocked(cpi, r, userId, !singleton))
                != null) {
            throw new SecurityException(msg);
        }
        checkTime(startTime, "getContentProviderImpl: after checkContentProviderPermission");

        if (!mProcessesReady
                && !cpi.processName.equals("system")) {
            // If this content provider does not run in the system
            // process, and the system is not yet ready to run other
            // processes, then fail fast instead of hanging.
            throw new IllegalArgumentException(
                    "Attempt to launch content provider before system ready");
        }

        // If system providers are not installed yet we aggressively crash to avoid
        // creating multiple instance of these providers and then bad things happen!
        if (!mSystemProvidersInstalled && cpi.applicationInfo.isSystemApp()
                && "system".equals(cpi.processName)) {
            throw new IllegalStateException("Cannot access system provider: '"
                    + cpi.authority + "' before system providers are installed!");
        }
        
        //拥有该provider的用户没有运行，则直接返回
        // Make sure that the user who owns this provider is running.  If not,
        // we don't want to allow it to run.
        if (!mUserController.isUserRunning(userId, 0)) {
            Slog.w(TAG, "Unable to launch app "
                    + cpi.applicationInfo.packageName + "/"
                    + cpi.applicationInfo.uid + " for provider "
                    + name + ": user " + userId + " is stopped");
            return null;
        }

        ComponentName comp = new ComponentName(cpi.packageName, cpi.name);
        checkTime(startTime, "getContentProviderImpl: before getProviderByClass");
        cpr = mProviderMap.getProviderByClass(comp, userId);
        checkTime(startTime, "getContentProviderImpl: after getProviderByClass");
        final boolean firstClass = cpr == null;
        if (firstClass) {
            final long ident = Binder.clearCallingIdentity();

            // If permissions need a review before any of the app components can run,
            // we return no provider and launch a review activity if the calling app
            // is in the foreground.
            if (mPermissionReviewRequired) {
                if (!requestTargetProviderPermissionsReviewIfNeededLocked(cpi, r, userId)) {
                    return null;
                }
            }

            try {
                checkTime(startTime, "getContentProviderImpl: before getApplicationInfo");
                ApplicationInfo ai =
                    AppGlobals.getPackageManager().
                        getApplicationInfo(
                                cpi.applicationInfo.packageName,
                                STOCK_PM_FLAGS, userId);
                checkTime(startTime, "getContentProviderImpl: after getApplicationInfo");
                if (ai == null) {
                    Slog.w(TAG, "No package info for content provider "
                            + cpi.name);
                    return null;
                }
                ai = getAppInfoForUser(ai, userId);
                cpr = new ContentProviderRecord(this, cpi, ai, comp, singleton);
            } catch (RemoteException ex) {
                // pm is in same process, this will never happen.
            } finally {
                Binder.restoreCallingIdentity(ident);
            }
        }

        checkTime(startTime, "getContentProviderImpl: now have ContentProviderRecord");
        //见3.7.4节
        if (r != null && cpr.canRunHere(r)) {
            // If this is a multiprocess provider, then just return its
            // info and allow the caller to instantiate it.  Only do
            // this if the provider is the same user as the caller's
            // process, or can run as root (so can be in any process).
            return cpr.newHolder(null);
        }

        if (DEBUG_PROVIDER) Slog.w(TAG_PROVIDER, "LAUNCHING REMOTE PROVIDER (myuid "
                    + (r != null ? r.uid : null) + " pruid " + cpr.appInfo.uid + "): "
                    + cpr.info.name + " callers=" + Debug.getCallers(6));
        
        //从mLaunchingProviders中查询
        // This is single process, and our app is now connecting to it.
        // See if we are already in the process of launching this
        // provider.
        final int N = mLaunchingProviders.size();
        int i;
        for (i = 0; i < N; i++) {
            if (mLaunchingProviders.get(i) == cpr) {
                break;
            }
        }

       //如果mLaunchingProviders中没有该provider，则启动它
        // If the provider is not already being launched, then get it
        // started.
        if (i >= N) {
            final long origId = Binder.clearCallingIdentity();

            try {
                // Content provider is now in use, its package can't be stopped.
                try {
                    checkTime(startTime, "getContentProviderImpl: before set stopped state");
                    AppGlobals.getPackageManager().setPackageStoppedState(
                            cpr.appInfo.packageName, false, userId);
                    checkTime(startTime, "getContentProviderImpl: after set stopped state");
                } catch (RemoteException e) {
                } catch (IllegalArgumentException e) {
                    Slog.w(TAG, "Failed trying to unstop package "
                            + cpr.appInfo.packageName + ": " + e);
                }

                // Use existing process if already started
                checkTime(startTime, "getContentProviderImpl: looking for process record");
                //查询进程记录
                ProcessRecord proc = getProcessRecordLocked(
                        cpi.processName, cpr.appInfo.uid, false);
                if (proc != null && proc.thread != null && !proc.killed) {
                    if (DEBUG_PROVIDER) Slog.d(TAG_PROVIDER,
                            "Installing in existing process " + proc);
                    if (!proc.pubProviders.containsKey(cpi.name)) {
                        checkTime(startTime, "getContentProviderImpl: scheduling install");
                        proc.pubProviders.put(cpi.name, cpr);
                        try {
                             //发布provider，见2.2.1节
                            proc.thread.scheduleInstallProvider(cpi);
                        } catch (RemoteException e) {
                        }
                    }
                } else {
                    checkTime(startTime, "getContentProviderImpl: before start process");
                    //启动进程
                    proc = startProcessLocked(cpi.processName,
                            cpr.appInfo, false, 0, "content provider",
                            new ComponentName(cpi.applicationInfo.packageName,
                                    cpi.name), false, false, false);
                    checkTime(startTime, "getContentProviderImpl: after start process");
                    if (proc == null) {
                        Slog.w(TAG, "Unable to launch app "
                                + cpi.applicationInfo.packageName + "/"
                                + cpi.applicationInfo.uid + " for provider "
                                + name + ": process is bad");
                        return null;
                    }
                }
                cpr.launchingApp = proc;
                //将cpr添加到mLaunchingProviders
                mLaunchingProviders.add(cpr);
            } finally {
                Binder.restoreCallingIdentity(origId);
            }
        }

        checkTime(startTime, "getContentProviderImpl: updating data structures");

        // Make sure the provider is published (the same provider class
        // may be published under multiple names).
        if (firstClass) {
            mProviderMap.putProviderByClass(comp, cpr);
        }

        mProviderMap.putProviderByName(name, cpr);
        conn = incProviderCountLocked(r, cpr, token, stable);
        if (conn != null) {
            conn.waiting = true;
        }
    }
    checkTime(startTime, "getContentProviderImpl: done!");

    grantEphemeralAccessLocked(userId, null /*intent*/,
            cpi.applicationInfo.uid, UserHandle.getAppId(Binder.getCallingUid()));
}

当ContentProvider所在的进程不存在：

根据authority获取ProviderInfo对象；权限检查；

当系统不是运行在system进程，且系统未准备好，则抛出异常；

当拥有该provider的用户没有运行，则直接返回；

当允许运行在调用者进程且ProcessRecord不为空，则直接返回；

当provider并没有在mLaunchingProviders队列，则启动它：

• 当ProcessRecord不为空，则直接加入到pubProviders队列，并安装provider

• 当ProcessRecord为空，则启动进程

增加引用计数

3.7.3 等待目标provider发布

【ContentProviderRecord

static final int CONTENT_PROVIDER_WAIT_TIMEOUT = 20 * 1000;
// Wait for the provider to be published...
final long timeout = SystemClock.uptimeMillis() + CONTENT_PROVIDER_WAIT_TIMEOUT;
synchronized (cpr) {
    //
    while (cpr.provider == null) {
        if (cpr.launchingApp == null) {
            Slog.w(TAG, "Unable to launch app "
                    + cpi.applicationInfo.packageName + "/"
                    + cpi.applicationInfo.uid + " for provider "
                    + name + ": launching app became null");
            EventLog.writeEvent(EventLogTags.AM_PROVIDER_LOST_PROCESS,
                    UserHandle.getUserId(cpi.applicationInfo.uid),
                    cpi.applicationInfo.packageName,
                    cpi.applicationInfo.uid, name);
            return null;
        }
        try {
            final long wait = Math.max(0L, timeout - SystemClock.uptimeMillis());
            if (DEBUG_MU) Slog.v(TAG_MU,
                    "Waiting to start provider " + cpr
                    + " launchingApp=" + cpr.launchingApp + " for " + wait + " ms");
            if (conn != null) {
                conn.waiting = true;
            }
            cpr.wait(wait);
            if (cpr.provider == null) {
                Slog.wtf(TAG, "Timeout waiting for provider "
                        + cpi.applicationInfo.packageName + "/"
                        + cpi.applicationInfo.uid + " for provider "
                        + name
                        + " providerRunning=" + providerRunning);
                return null;
            }
        } catch (InterruptedException ex) {
        } finally {
            if (conn != null) {
                conn.waiting = false;
            }
        }
    }
}
return cpr != null ? cpr.newHolder(conn) : null;

循环等待20s，直到发布完成才退出。

3.7.4 CPR.canRunHere

[->ContentProviderRecord.java]

public boolean canRunHere(ProcessRecord app) {
      return (info.multiprocess || info.processName.equals(app.processName))
              && uid == app.info.uid;
  }

ContentProvider是否能运行在调用者所在的进程需要满足以下条件

1.ContentProvider在AndroidManifest.xml文件配置中multiprocess=true；或者调用者进程和ContentProvider在同一进程

2.ContentProvider进程跟调用者所在的进程是同一个uid。

3.8 AT.installProvider

[->ActivityThread.java]

private ContentProviderHolder installProvider(Context context,
            ContentProviderHolder holder, ProviderInfo info,
            boolean noisy, boolean noReleaseNeeded, boolean stable) {
        ContentProvider localProvider = null;
        IContentProvider provider;
        if (holder == null || holder.provider == null) {
            //从packageInfo中获取provider
            if (DEBUG_PROVIDER || noisy) {
                Slog.d(TAG, "Loading provider " + info.authority + ": "
                        + info.name);
            }
            Context c = null;
            ApplicationInfo ai = info.applicationInfo;
            if (context.getPackageName().equals(ai.packageName)) {
                c = context;
            } else if (mInitialApplication != null &&
                    mInitialApplication.getPackageName().equals(ai.packageName)) {
                c = mInitialApplication;
            } else {
                try {
                    c = context.createPackageContext(ai.packageName,
                            Context.CONTEXT_INCLUDE_CODE);
                } catch (PackageManager.NameNotFoundException e) {
                    // Ignore
                }
            }
            if (c == null) {
                Slog.w(TAG, "Unable to get context for package " +
                      ai.packageName +
                      " while loading content provider " +
                      info.name);
                return null;
            }

            if (info.splitName != null) {
                try {
                    c = c.createContextForSplit(info.splitName);
                } catch (NameNotFoundException e) {
                    throw new RuntimeException(e);
                }
            }

            try {
                final java.lang.ClassLoader cl = c.getClassLoader();
                LoadedApk packageInfo = peekPackageInfo(ai.packageName, true);
                if (packageInfo == null) {
                    // System startup case.
                    packageInfo = getSystemContext().mPackageInfo;
                }
                localProvider = packageInfo.getAppFactory()
                        .instantiateProvider(cl, info.name);
                provider = localProvider.getIContentProvider();
                if (provider == null) {
                    Slog.e(TAG, "Failed to instantiate class " +
                          info.name + " from sourceDir " +
                          info.applicationInfo.sourceDir);
                    return null;
                }
                if (DEBUG_PROVIDER) Slog.v(
                    TAG, "Instantiating local provider " + info.name);
                // XXX Need to create the correct context for this provider.
                localProvider.attachInfo(c, info);
            } catch (java.lang.Exception e) {
                if (!mInstrumentation.onException(null, e)) {
                    throw new RuntimeException(
                            "Unable to get provider " + info.name
                            + ": " + e.toString(), e);
                }
                return null;
            }
        } else {
            provider = holder.provider;
            if (DEBUG_PROVIDER) Slog.v(TAG, "Installing external provider " + info.authority + ": "
                    + info.name);
        }

        ContentProviderHolder retHolder;

        synchronized (mProviderMap) {
            if (DEBUG_PROVIDER) Slog.v(TAG, "Checking to add " + provider
                    + " / " + info.name);
            IBinder jBinder = provider.asBinder();
            if (localProvider != null) {
                ComponentName cname = new ComponentName(info.packageName, info.name);
                ProviderClientRecord pr = mLocalProvidersByName.get(cname);
                if (pr != null) {
                    if (DEBUG_PROVIDER) {
                        Slog.v(TAG, "installProvider: lost the race, "
                                + "using existing local provider");
                    }
                    provider = pr.mProvider;
                } else {
                    holder = new ContentProviderHolder(info);
                    holder.provider = provider;
                    holder.noReleaseNeeded = true;
                    pr = installProviderAuthoritiesLocked(provider, localProvider, holder);
                    mLocalProviders.put(jBinder, pr);
                    mLocalProvidersByName.put(cname, pr);
                }
                retHolder = pr.mHolder;
            } else {
                //查询ProviderRefCount
                ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
                if (prc != null) {
                    if (DEBUG_PROVIDER) {
                        Slog.v(TAG, "installProvider: lost the race, updating ref count");
                    }
                    // We need to transfer our new reference to the existing
                    // ref count, releasing the old one...  but only if
                    // release is needed (that is, it is not running in the
                    // system process).
                    if (!noReleaseNeeded) {
                        //增加引用计数,通过AMS，见3.8.4
                        incProviderRefLocked(prc, stable);
                        try {
                            
                            ActivityManager.getService().removeContentProvider(
                                    holder.connection, stable);
                        } catch (RemoteException e) {
                            //do nothing content provider object is dead any way
                        }
                    }
                } else {
                    //见3.8.5节
                    ProviderClientRecord client = installProviderAuthoritiesLocked(
                            provider, localProvider, holder);
                    if (noReleaseNeeded) {
                       //见3.8.6节
                        prc = new ProviderRefCount(holder, client, 1000, 1000);
                    } else {
                        prc = stable
                                ? new ProviderRefCount(holder, client, 1, 0)
                                : new ProviderRefCount(holder, client, 0, 1);
                    }
                    mProviderRefCountMap.put(jBinder, prc);
                }
                retHolder = prc.holder;
            }
        }
        return retHolder;
    }

3.8.1 AMS.incProviderCountLocked

[->ActivityManagerService.java]

ContentProviderConnection incProviderCountLocked(ProcessRecord r,
           final ContentProviderRecord cpr, IBinder externalProcessToken, boolean stable) {
       if (r != null) {
           for (int i=0; i<r.conProviders.size(); i++) {
               //从当前进程所使用的provider中查询与目标provider一致的信息
               ContentProviderConnection conn = r.conProviders.get(i);
               if (conn.provider == cpr) {
                   if (DEBUG_PROVIDER) Slog.v(TAG_PROVIDER,
                           "Adding provider requested by "
                           + r.processName + " from process "
                           + cpr.info.processName + ": " + cpr.name.flattenToShortString()
                           + " scnt=" + conn.stableCount + " uscnt=" + conn.unstableCount);
                   if (stable) {
                       conn.stableCount++;
                       conn.numStableIncs++;
                   } else {
                       conn.unstableCount++;
                       conn.numUnstableIncs++;
                   }
                   return conn;
               }
           }
           //查不到则新建provider连接对象
           ContentProviderConnection conn = new ContentProviderConnection(cpr, r);
           if (stable) {
               conn.stableCount = 1;
               conn.numStableIncs = 1;
           } else {
               conn.unstableCount = 1;
               conn.numUnstableIncs = 1;
           }
           cpr.connections.add(conn);
           r.conProviders.add(conn);
           startAssociationLocked(r.uid, r.processName, r.curProcState,
                   cpr.uid, cpr.name, cpr.info.processName);
           return conn;
       }
       cpr.addExternalProcessHandleLocked(externalProcessToken);
       return null;
   }

3.8.2 AMS.removeContentProvider

[->ActivityManagerService.java]

/**
    * Drop a content provider from a ProcessRecord's bookkeeping
    */
   public void removeContentProvider(IBinder connection, boolean stable) {
       enforceNotIsolatedCaller("removeContentProvider");
       long ident = Binder.clearCallingIdentity();
       try {
           synchronized (this) {
               ContentProviderConnection conn;
               try {
                   conn = (ContentProviderConnection)connection;
               } catch (ClassCastException e) {
                   String msg ="removeContentProvider: " + connection
                           + " not a ContentProviderConnection";
                   Slog.w(TAG, msg);
                   throw new IllegalArgumentException(msg);
               }
               if (conn == null) {
                   throw new NullPointerException("connection is null");
               }
               //见3.8.3节
               if (decProviderCountLocked(conn, null, null, stable)) {
                   updateOomAdjLocked();
               }
           }
       } finally {
           Binder.restoreCallingIdentity(ident);
       }
   }

3.8.3 AMS.decProviderCountLocked

[->ActivityManagerService.java]

boolean decProviderCountLocked(ContentProviderConnection conn,
            ContentProviderRecord cpr, IBinder externalProcessToken, boolean stable) {
        if (conn != null) {
            cpr = conn.provider;
            if (DEBUG_PROVIDER) Slog.v(TAG_PROVIDER,
                    "Removing provider requested by "
                    + conn.client.processName + " from process "
                    + cpr.info.processName + ": " + cpr.name.flattenToShortString()
                    + " scnt=" + conn.stableCount + " uscnt=" + conn.unstableCount);
            if (stable) {
                conn.stableCount--;
            } else {
                conn.unstableCount--;
            }
            //当provider连接的stable和unstable的引用次数为01时，则移除连接对象信息
            if (conn.stableCount == 0 && conn.unstableCount == 0) {
                cpr.connections.remove(conn);
                conn.client.conProviders.remove(conn);
                if (conn.client.setProcState < ActivityManager.PROCESS_STATE_LAST_ACTIVITY) {
                    // The client is more important than last activity -- note the time this
                    // is happening, so we keep the old provider process around a bit as last
                    // activity to avoid thrashing it.
                    if (cpr.proc != null) {
                        cpr.proc.lastProviderTime = SystemClock.uptimeMillis();
                    }
                }
                stopAssociationLocked(conn.client.uid, conn.client.processName, cpr.uid, cpr.name);
                return true;
            }
            return false;
        }
        cpr.removeExternalProcessHandleLocked(externalProcessToken);
        return false;
    }

3.8.4 AT.incProviderRefLocked

[->ActivityThread.java]

private final void incProviderRefLocked(ProviderRefCount prc, boolean stable) {
       //stable provider
       if (stable) {
           prc.stableCount += 1;
           if (prc.stableCount == 1) {
               //数量为1，状态为removePending，发送REMOVE_PROVIDER信息
               // We are acquiring a new stable reference on the provider.
               int unstableDelta;
               if (prc.removePending) {
                   // We have a pending remove operation, which is holding the
                   // last unstable reference.  At this point we are converting
                   // that unstable reference to our new stable reference.
                   unstableDelta = -1;
                   // Cancel the removal of the provider.
                   if (DEBUG_PROVIDER) {
                       Slog.v(TAG, "incProviderRef: stable "
                               + "snatched provider from the jaws of death");
                   }
                   prc.removePending = false;
                   // There is a race! It fails to remove the message, which
                   // will be handled in completeRemoveProvider().
                   mH.removeMessages(H.REMOVE_PROVIDER, prc);
               } else {
                   unstableDelta = 0;
               }
               try {
                   if (DEBUG_PROVIDER) {
                       Slog.v(TAG, "incProviderRef Now stable - "
                               + prc.holder.info.name + ": unstableDelta="
                               + unstableDelta);
                   }
                   //调用AMS方法
                   ActivityManager.getService().refContentProvider(
                           prc.holder.connection, 1, unstableDelta);
               } catch (RemoteException e) {
                   //do nothing content provider object is dead any way
               }
           }
       } else {
           prc.unstableCount += 1;
           if (prc.unstableCount == 1) {
               // We are acquiring a new unstable reference on the provider.
               if (prc.removePending) {
                   // Oh look, we actually have a remove pending for the
                   // provider, which is still holding the last unstable
                   // reference.  We just need to cancel that to take new
                   // ownership of the reference.
                   if (DEBUG_PROVIDER) {
                       Slog.v(TAG, "incProviderRef: unstable "
                               + "snatched provider from the jaws of death");
                   }
                   prc.removePending = false;
                   mH.removeMessages(H.REMOVE_PROVIDER, prc);
               } else {
                   // First unstable ref, increment our count in the
                   // activity manager.
                   try {
                       if (DEBUG_PROVIDER) {
                           Slog.v(TAG, "incProviderRef: Now unstable - "
                                   + prc.holder.info.name);
                       }
                       ActivityManager.getService().refContentProvider(
                               prc.holder.connection, 0, 1);
                   } catch (RemoteException e) {
                       //do nothing content provider object is dead any way
                   }
               }
           }
       }
   }

3.8.5 AT.installProviderAuthoritiesLocked

[->ActivityThread.java]

private ProviderClientRecord installProviderAuthoritiesLocked(IContentProvider provider,
           ContentProvider localProvider, ContentProviderHolder holder) {
       final String auths[] = holder.info.authority.split(";");
       final int userId = UserHandle.getUserId(holder.info.applicationInfo.uid);

       if (provider != null) {
           // If this provider is hosted by the core OS and cannot be upgraded,
           // then I guess we're okay doing blocking calls to it.
           for (String auth : auths) {
               switch (auth) {
                   case ContactsContract.AUTHORITY:
                   case CallLog.AUTHORITY:
                   case CallLog.SHADOW_AUTHORITY:
                   case BlockedNumberContract.AUTHORITY:
                   case CalendarContract.AUTHORITY:
                   case Downloads.Impl.AUTHORITY:
                   case "telephony":
                       Binder.allowBlocking(provider.asBinder());
               }
           }
       }

       final ProviderClientRecord pcr = new ProviderClientRecord(
               auths, provider, localProvider, holder);
       for (String auth : auths) {
           final ProviderKey key = new ProviderKey(auth, userId);
           final ProviderClientRecord existing = mProviderMap.get(key);
           if (existing != null) {
               Slog.w(TAG, "Content provider " + pcr.mHolder.info.name
                       + " already published as " + auth);
           } else {
               //发布
               mProviderMap.put(key, pcr);
           }
       }
       return pcr;
   }

3.8.6 ProviderRefCount

[->ActivityThread.java::ProviderRefCount]

private static final class ProviderRefCount {
      public final ContentProviderHolder holder;
      public final ProviderClientRecord client;
      public int stableCount;
      public int unstableCount;
      
      //当该标记设置时，stableCount和unstableCount引用都会设置为0
      // When this is set, the stable and unstable ref counts are 0 and
      // we have a pending operation scheduled to remove the ref count
      // from the activity manager.  On the activity manager we are still
      // holding an unstable ref, though it is not reflected in the counts
      // here.
      public boolean removePending;

      ProviderRefCount(ContentProviderHolder inHolder,
              ProviderClientRecord inClient, int sCount, int uCount) {
          holder = inHolder;
          client = inClient;
          stableCount = sCount;
          unstableCount = uCount;
      }
  }

获取到Provider后，就可以进行查询操作了。

3.9 CPP.query

[->ContentProviderNative.java::ContentProviderProxy]

@Override
  public Cursor query(String callingPkg, Uri url, @Nullable String[] projection,
          @Nullable Bundle queryArgs, @Nullable ICancellationSignal cancellationSignal)
          throws RemoteException {
      BulkCursorToCursorAdaptor adaptor = new BulkCursorToCursorAdaptor();
      Parcel data = Parcel.obtain();
      Parcel reply = Parcel.obtain();
      try {
          data.writeInterfaceToken(IContentProvider.descriptor);

          data.writeString(callingPkg);
          url.writeToParcel(data, 0);
          int length = 0;
          if (projection != null) {
              length = projection.length;
          }
          data.writeInt(length);
          for (int i = 0; i < length; i++) {
              data.writeString(projection[i]);
          }
          data.writeBundle(queryArgs);
          data.writeStrongBinder(adaptor.getObserver().asBinder());
          data.writeStrongBinder(
                  cancellationSignal != null ? cancellationSignal.asBinder() : null);
          //发送给binder服务
          mRemote.transact(IContentProvider.QUERY_TRANSACTION, data, reply, 0);

          DatabaseUtils.readExceptionFromParcel(reply);

          if (reply.readInt() != 0) {
              BulkCursorDescriptor d = BulkCursorDescriptor.CREATOR.createFromParcel(reply);
              Binder.copyAllowBlocking(mRemote, (d.cursor != null) ? d.cursor.asBinder() : null);
              adaptor.initialize(d);
          } else {
              adaptor.close();
              adaptor = null;
          }
          return adaptor;
      } catch (RemoteException ex) {
          adaptor.close();
          throw ex;
      } catch (RuntimeException ex) {
          adaptor.close();
          throw ex;
      } finally {
          data.recycle();
          reply.recycle();
      }
  }

3.10 CPN.onTransact

[->ContentProviderNative.java]

@Override
 public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
         throws RemoteException {
     try {
         switch (code) {
             case QUERY_TRANSACTION:
             {
                 data.enforceInterface(IContentProvider.descriptor);

                 String callingPkg = data.readString();
                 Uri url = Uri.CREATOR.createFromParcel(data);

                 // String[] projection
                 int num = data.readInt();
                 String[] projection = null;
                 if (num > 0) {
                     projection = new String[num];
                     for (int i = 0; i < num; i++) {
                         projection[i] = data.readString();
                     }
                 }

                 Bundle queryArgs = data.readBundle();
                 IContentObserver observer = IContentObserver.Stub.asInterface(
                         data.readStrongBinder());
                 ICancellationSignal cancellationSignal = ICancellationSignal.Stub.asInterface(
                         data.readStrongBinder());
                 //见3.11节      
                 Cursor cursor = query(callingPkg, url, projection, queryArgs, cancellationSignal);
                 if (cursor != null) {
                     CursorToBulkCursorAdaptor adaptor = null;

                     try {
                         adaptor = new CursorToBulkCursorAdaptor(cursor, observer,
                                 getProviderName());
                         cursor = null;

                         BulkCursorDescriptor d = adaptor.getBulkCursorDescriptor();
                         adaptor = null;

                         reply.writeNoException();
                         reply.writeInt(1);
                         d.writeToParcel(reply, Parcelable.PARCELABLE_WRITE_RETURN_VALUE);
                     } finally {
                         // Close cursor if an exception was thrown while constructing the adaptor.
                         if (adaptor != null) {
                             adaptor.close();
                         }
                         if (cursor != null) {
                             cursor.close();
                         }
                     }
                 } else {
                     reply.writeNoException();
                     reply.writeInt(0);
                 }

                 return true;
             }

             case GET_TYPE_TRANSACTION:
             case INSERT_TRANSACTION:
             case BULK_INSERT_TRANSACTION： 
             case APPLY_BATCH_TRANSACTION:
             case DELETE_TRANSACTION:
             case UPDATE_TRANSACTION:
             ...
         }
     } catch (Exception e) {
         DatabaseUtils.writeExceptionToParcel(reply, e);
         return true;
     }

3.11 Transport.query

[->ContentProvider.java::Transport]

public Cursor query(String callingPkg, Uri uri, @Nullable String[] projection,
              @Nullable Bundle queryArgs, @Nullable ICancellationSignal cancellationSignal) {
          uri = validateIncomingUri(uri);
          uri = maybeGetUriWithoutUserId(uri);
          if (enforceReadPermission(callingPkg, uri, null) != AppOpsManager.MODE_ALLOWED) {
              // The caller has no access to the data, so return an empty cursor with
              // the columns in the requested order. The caller may ask for an invalid
              // column and we would not catch that but this is not a problem in practice.
              // We do not call ContentProvider#query with a modified where clause since
              // the implementation is not guaranteed to be backed by a SQL database, hence
              // it may not handle properly the tautology where clause we would have created.
              if (projection != null) {
                  return new MatrixCursor(projection, 0);
              }

              // Null projection means all columns but we have no idea which they are.
              // However, the caller may be expecting to access them my index. Hence,
              // we have to execute the query as if allowed to get a cursor with the
              // columns. We then use the column names to return an empty cursor.
              Cursor cursor = ContentProvider.this.query(
                      uri, projection, queryArgs,
                      CancellationSignal.fromTransport(cancellationSignal));
              if (cursor == null) {
                  return null;
              }

              // Return an empty cursor for all columns.
              return new MatrixCursor(cursor.getColumnNames(), 0);
          }
          final String original = setCallingPackage(callingPkg);
          try {
              //调用目标provider的query方法
              return ContentProvider.this.query(
                      uri, projection, queryArgs,
                      CancellationSignal.fromTransport(cancellationSignal));
          } finally {
              setCallingPackage(original);
          }
      }

四、总结

本文通过分析了发布ContentProvider的过程，并分析query过程，先获取provider在安装provider信息，最后才查询。而查询操作主要分为两种情况：

4.1 进程未启动

provider进程不存在，需要创建进程并发布相关的provider

1.client进程：通过Binder向systemserver进程请求相应的provider

2.systemserver进程：如果目标进程未启动，则调用startProcessLocked启动进程，当启动完成，当cpr.provider ==null，则systemserver进入wait阶段，等待目标provider发布；

3.provider进程：进程启动后执行attach到systemserver，而后bindApplication，在这个过程会installProvider和PublishContentProviders,再binder到systemserver进程；

4.systemserver进程：回到systemserver发布provider信息，并且通过notify机制唤醒当前处于wait状态的binder线程，并将结果返回给client进程；

5.client进程：回到client进程，执行installProvider操作，安装provider

关于CONTENT_PROVIDER_PUBLISH_TIMEOUT超时机制所统计的时机区间是指在startProcessLocked之后会调用AMS.attachApplicationLocked为起点，一直到AMS.publishContentProviders的过程。

4.2 进程已启动

provider进程已启动但未发布，需要发布相关的provider

Client进程：获取provider发现cpr为空，则调用scheduleInstallProvider来向provider所在的进程发出一个oneway的binder请求，进入wait状态；

provider进程：安装完成provider信息后，通过notify机制唤醒当前处于wait状态的binder线程。

如果provider在publish之后，这是在请求provider则没用最右边的过程，直接AMS.getContentProvierImpl之后便进入AT.installProvider的过程，而不会再进入wait过程。

4.3 引用计数

provider分为stable provider和unstable provider,主要在于引用计数的不同。

provider引用计数的增加与减少关系，removePending是指即将被移除的引用，lastRef表示当前引用为0。

方法	stableCount	unstableCount	条件
acquireProvider	+1	0	removePending=false
acquireProvider	+1	-1	removePending=true
acquireUnstableProvider	0	+1	removePending=false
acquireUnstableProvider	0	0	removePending=true
releaseProvider	-1	0	lastRef=false
releaseProvider	-1	1	lastRef=true
releaseUnstableProvider	0	-1	lastRef=false
releaseUnstableProvider	0	0	lastRef=true

当Client进程存在对某个provider的引用时，Provider进程死亡则会根据provider类型进行不同的处理：

• 对于stable provider,会杀掉所有和该provider建立stable连接的非persistent进程；

• 对于unstable provider，不会导致client进程被级联所杀，会回调unstableProviderDied来清理相关信息。

当stable和unstable引用计数都为0则移除connection信息

• AMS.removeContentProvider过程移除connection相关所有信息。

附录

源码路径

frameworks/base/core/java/android/app/ActivityThread.java
frameworks/base/core/java/android/app/ContextImpl.java
frameworks/base/core/java/android/app/ActivityThread.java
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
frameworks/base/core/java/android/content/ContentResolver.java
frameworks/base/core/java/android/content/ContentProviderNative.java
frameworks/base/services/core/java/com/android/server/am/ContentProviderRecord.java