前言

在本系列上一篇文章Android9.0 PM机制系列（一）PackageInstaller初始化解析中我们学习了PackageInstaller是如何初始化的，这一篇文章我们接着学习PackageInstaller是如何安装APK的。本系列文章的源码基于Android9.0。

1.PackageInstaller中的处理

紧接着上一篇的内容，在PackageInstallerActivity调用startInstallConfirm方法初始化安装确认界面后，这个安装确认界面就会呈现给用户，用户如果想要安装这个应用程序就会点击确定按钮，就会调用PackageInstallerActivity的onClick方法，如下所示。

packages/apps/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java

public void onClick(View v) {if (v == mOk) {if (mOk.isEnabled()) {if (mOkCanInstall || mScrollView == null) {if (mSessionId != -1) {//初始化时mSessionId = -1mInstaller.setPermissionsResult(mSessionId, true);finish();} else {startInstall();//1}} else {mScrollView.pageScroll(View.FOCUS_DOWN);}}} else if (v == mCancel) {...finish();}}

onClick方法中分别对确定和取消按钮做处理，主要查看对确定按钮的处理，注释1处调用了startInstall方法：

private void startInstall() {Intent newIntent = new Intent();newIntent.putExtra(PackageUtil.INTENT_ATTR_APPLICATION_INFO,mPkgInfo.applicationInfo);newIntent.setData(mPackageURI);//1newIntent.setClass(this, InstallInstalling.class);String installerPackageName = getIntent().getStringExtra(Intent.EXTRA_INSTALLER_PACKAGE_NAME);if (mOriginatingURI != null) {newIntent.putExtra(Intent.EXTRA_ORIGINATING_URI, mOriginatingURI);}...if(localLOGV) Log.i(TAG, "downloaded app uri="+mPackageURI);startActivity(newIntent);finish();}

startInstall方法用于跳转到InstallInstalling这个Activity，并关闭掉当前的PackageInstallerActivity。InstallInstalling主要用于向包管理器发送包的信息并处理包管理的回调。 InstallInstalling的onCreate方法如下所示。

packages/apps/PackageInstaller/src/com/android/packageinstaller/InstallInstalling.java

@Overrideprotected void onCreate(@Nullable Bundle savedInstanceState) {super.onCreate(savedInstanceState);setContentView(R.layout.install_installing);ApplicationInfo appInfo = getIntent().getParcelableExtra(PackageUtil.INTENT_ATTR_APPLICATION_INFO);mPackageURI = getIntent().getData();if ("package".equals(mPackageURI.getScheme())) {try {getPackageManager().installExistingPackage(appInfo.packageName);launchSuccess();} catch (PackageManager.NameNotFoundException e) {launchFailure(PackageManager.INSTALL_FAILED_INTERNAL_ERROR, null);}} else {//根据mPackageURI创建一个对应的File final File sourceFile = new File(mPackageURI.getPath());PackageUtil.initSnippetForNewApp(this, PackageUtil.getAppSnippet(this, appInfo,sourceFile), R.id.app_snippet);//如果savedInstanceState不为null，获取此前保存的mSessionId和mInstallId if (savedInstanceState != null) {//1mSessionId = savedInstanceState.getInt(SESSION_ID);mInstallId = savedInstanceState.getInt(INSTALL_ID);//向InstallEventReceiver注册一个观察者try {InstallEventReceiver.addObserver(this, mInstallId,this::launchFinishBasedOnResult);//2} catch (EventResultPersister.OutOfIdsException e) {}} else {PackageInstaller.SessionParams params = new PackageInstaller.SessionParams(PackageInstaller.SessionParams.MODE_FULL_INSTALL);//3params.installFlags = PackageManager.INSTALL_FULL_APP; //9.0新增params.referrerUri = getIntent().getParcelableExtra(Intent.EXTRA_REFERRER);params.originatingUri = getIntent().getParcelableExtra(Intent.EXTRA_ORIGINATING_URI);params.originatingUid = getIntent().getIntExtra(Intent.EXTRA_ORIGINATING_UID,UID_UNKNOWN);params.installerPackageName =getIntent().getStringExtra(Intent.EXTRA_INSTALLER_PACKAGE_NAME);//9.0新增File file = new File(mPackageURI.getPath());//4try {PackageParser.PackageLite pkg = PackageParser.parsePackageLite(file, 0);//5params.setAppPackageName(pkg.packageName);params.setInstallLocation(pkg.installLocation);params.setSize(PackageHelper.calculateInstalledSize(pkg, false, params.abiOverride));} catch (PackageParser.PackageParserException e) {...}try {mInstallId = InstallEventReceiver.addObserver(this, EventResultPersister.GENERATE_NEW_ID,this::launchFinishBasedOnResult);//6} catch (EventResultPersister.OutOfIdsException e) {launchFailure(PackageManager.INSTALL_FAILED_INTERNAL_ERROR, null);}try {mSessionId = getPackageManager().getPackageInstaller().createSession(params);//7} catch (IOException e) {launchFailure(PackageManager.INSTALL_FAILED_INTERNAL_ERROR, null);}}...mSessionCallback = new InstallSessionCallback();}}

onCreate方法中会分别对package和content协议的Uri进行处理，我们来看content协议的Uri处理部分。

注释1处如果savedInstanceState不为null，获取此前保存的mSessionId和mInstallId，其中mSessionId是安装包的会话id，mInstallId是等待的安装事件id。注释2处根据mInstallId向InstallEventReceiver注册一个观察者，launchFinishBasedOnResult会接收到安装事件的回调，无论安装成功或者失败都会关闭当前的Activity(InstallInstalling)。如果savedInstanceState为null，代码的逻辑也是类似的。注释3处创建SessionParams，它用来代表安装会话的参数。注释4、5处根据mPackageUri对包（APK）进行轻量级的解析，并将解析的参数赋值给SessionParams。注释6处和注释2处类似向InstallEventReceiver注册一个观察者返回一个新的mInstallId，其中InstallEventReceiver继承自BroadcastReceiver，用于接收安装事件并回调给EventResultPersister。注释7处PackageInstaller的createSession方法内部会通过IPackageInstaller与PackageInstallerService进行进程间通信，最终调用的是PackageInstallerService的createSession方法来创建并返回mSessionId。只要mInstallId 或者mSessionId 创建失败就会调出安装失败界面。

InstallInstalling的onCreate方法就分析到这，接着查看InstallInstalling的onResume方法：

packages/apps/PackageInstaller/src/com/android/packageinstaller/InstallInstalling.java

@Overrideprotected void onResume() {super.onResume();if (mInstallingTask == null) {PackageInstaller installer = getPackageManager().getPackageInstaller();PackageInstaller.SessionInfo sessionInfo = installer.getSessionInfo(mSessionId);//1if (sessionInfo != null && !sessionInfo.isActive()) {//2mInstallingTask = new InstallingAsyncTask();mInstallingTask.execute();} else {mCancelButton.setEnabled(false);setFinishOnTouchOutside(false);}}}

注释1处根据mSessionId得到SessionInfo，SessionInfo代表安装会话的详细信息。注释2处如果sessionInfo不为Null并且不是活动的，就创建并执行InstallingAsyncTask。InstallingAsyncTask的doInBackground方法中会根据包(APK)的Uri，将APK的信息通过IO流的形式写入到PackageInstaller.Session中。InstallingAsyncTask的onPostExecute方法如下所示。

packages/apps/PackageInstaller/src/com/android/packageinstaller/InstallInstalling.java

private final class InstallingAsyncTask extends AsyncTask<Void, Void,327 PackageInstaller.Session> {328 volatile boolean isDone;329330 @Override331 protected PackageInstaller.Session doInBackground(Void... params) {332 PackageInstaller.Session session;333 try {334session = getPackageManager().getPackageInstaller().openSession(mSessionId);335 } catch (IOException e) {336return null;337 }338339 session.setStagingProgress(0);340341 try {342File file = new File(mPackageURI.getPath());343344try (InputStream in = new FileInputStream(file)) {345long sizeBytes = file.length();346try (OutputStream out = session347 .openWrite("PackageInstaller", 0, sizeBytes)) {//8.0 是 byte[] buffer = new byte[4096];348 byte[] buffer = new byte[1024 * 1024];349 while (true) {350 int numRead = in.read(buffer);351352 if (numRead == -1) {353 session.fsync(out);354 break;355 }356357 if (isCancelled()) {358 session.close();359 break;360 }361362 out.write(buffer, 0, numRead);363 if (sizeBytes > 0) {364 float fraction = ((float) numRead / (float) sizeBytes);365 session.addProgress(fraction);366 }367 }368}369}370371return session;372 } catch (IOException | SecurityException e) {373Log.e(LOG_TAG, "Could not write package", e);374375session.close();376377return null;378 } finally {379synchronized (this) {380isDone = true;381notifyAll();382}383 }384 }385386 @Override387 protected void onPostExecute(PackageInstaller.Session session) {388 if (session != null) {389Intent broadcastIntent = new Intent(BROADCAST_ACTION);/*9.0新增这行，AMS构造方法中构造了两个队列，一个前台队列，一个后台队列。结合其构造方法可知，两者区别在于一个是设置的广播超时时间不同，前台是10s，后台是60s，另外一个是是否要等待后台服务处理完，前台广播是不用等待的，后台广播需要等待。想要让广播能放到前台队列中，只需调用Intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND)即可*/390broadcastIntent.setFlags(Intent.FLAG_RECEIVER_FOREGROUND);391broadcastIntent.setPackage(392 getPackageManager().getPermissionControllerPackageName());393broadcastIntent.putExtra(EventResultPersister.EXTRA_ID, mInstallId);394395PendingIntent pendingIntent = PendingIntent.getBroadcast(396 InstallInstalling.this,397 mInstallId,398 broadcastIntent,399 PendingIntent.FLAG_UPDATE_CURRENT);400401mit(pendingIntent.getIntentSender());402mCancelButton.setEnabled(false);403setFinishOnTouchOutside(false);404 } else {405getPackageManager().getPackageInstaller().abandonSession(mSessionId);406407if (!isCancelled()) {408launchFailure(PackageManager.INSTALL_FAILED_INVALID_APK, null);409}410 }411 }412 }```创建了一个PendingIntent，并将该PendingIntent的IntentSender通过注释1处的PackageInstaller.Session的commit方法发送出去，发送去哪了呢？接着查看PackageInstaller.Session的commit方法。**frameworks/base/core/java/android/content/pm/PackageInstaller.java**```javapublic void commit(@NonNull IntentSender statusReceiver) {try {mit(statusReceiver);} catch (RemoteException e) {throw e.rethrowFromSystemServer();}}

mSession的类型为IPackageInstallerSession，这说明要通过IPackageInstallerSession来进行进程间的通信，最终会调用PackageInstallerSession的commit方法，这样代码逻辑就到了Java框架层的。

2.Java框架层的处理

frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java

@Overridepublic void commit(IntentSender statusReceiver) {Preconditions.checkNotNull(statusReceiver);...mActiveCount.incrementAndGet();final PackageInstallObserverAdapter adapter = new PackageInstallObserverAdapter(mContext,statusReceiver, sessionId, mIsInstallerDeviceOwner, userId);/*8.0 : mHandler.obtainMessage(MSG_COMMIT, adapter.getBinder()).sendToTarget();在Handler处理的时候才对mRemoteObserver进行赋值9.0 直接在这里对mRemoteObserver进行赋值*/mRemoteObserver = adapter.getBinder();if (!mSealed) {try {//验证apk有效性，并给pkgInfo appInfo 赋值等，8.0是放到Handler处理的sealAndValidateLocked();} catch (IOException e) {...}}mHandler.obtainMessage(MSG_COMMIT).sendToTarget();//1}

commit方法中会将包的信息封装为PackageInstallObserverAdapter ，它在PMS中被定义。在注释1处会向Handler发送一个类型为MSG_COMMIT的消息，其中adapter.getBinder()会得到IPackageInstallObserver2.Stub类型的观察者，从类型就知道这个观察者是可以跨进程进行回调的。处理该消息的代码如下所示。

frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java

private final Handler.Callback mHandlerCallback = new Handler.Callback() {@Overridepublic boolean handleMessage(Message msg) {switch (msg.what) {case MSG_COMMIT:synchronized (mLock) {try {commitLocked();//1} catch (PackageManagerException e) {final String completeMsg = ExceptionUtils.getCompleteMessage(e);Slog.e(TAG, "Commit of session " + sessionId + " failed: " + completeMsg);destroyInternal();dispatchSessionFinished(e.error, completeMsg, null);//2}}break;case MSG_ON_PACKAGE_INSTALLED:final SomeArgs args = (SomeArgs) msg.obj;final String packageName = (String) args.arg1;final String message = (String) args.arg2;final Bundle extras = (Bundle) args.arg3;final IPackageInstallObserver2 observer = (IPackageInstallObserver2) args.arg4;final int returnCode = args.argi1;args.recycle();try {observer.onPackageInstalled(packageName, returnCode, message, extras);} catch (RemoteException ignored) {}break;}};

注释1处的commitLocked方法如下所示。

private void commitLocked()throws PackageManagerException {...// We've reached point of no return; call into PMS to install the stage.// Regardless of success or failure we always destroy session.final IPackageInstallObserver2 localObserver = new IPackageInstallObserver2.Stub() {@Overridepublic void onUserActionRequired(Intent intent) {throw new IllegalStateException();}@Overridepublic void onPackageInstalled(String basePackageName, int returnCode, String msg,Bundle extras) {destroyInternal();//安装完毕后的回调，很多地方都会调这个方法！然后会一直回调到最开始处，然后发广播给客户端dispatchSessionFinished(returnCode, msg, extras);//2}};mPm.installStage(mPackageName, stageDir, stageCid, localObserver, params,installerPackageName, installerUid, user, mCertificates);}

commitLocked方法比较长，这里截取最主要的信息，会调用PMS的installStage方法，这样代码逻辑就进入了PMS中。

在Android 9.0 PM机制系列（三）PMS处理APK的安装文章中说到，如果安装完成，就会调用到注释2处。

同样，回到mHandlerCallback的handleMessage方法，如果commitLocked方法出现PackageManagerException异常，就会调用注释2处的dispatchSessionFinished方法。

同理，它的实现如下所示：

frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java

private void dispatchSessionFinished(int returnCode, String msg, Bundle extras) {1546 final IPackageInstallObserver2 observer;1547 final String packageName;1548 synchronized (mLock) {1549 mFinalStatus = returnCode;1550 mFinalMessage = msg;15511552 observer = mRemoteObserver;1553 packageName = mPackageName;1554 }15551556 if (observer != null) {1557 // Execute observer.onPackageInstalled on different tread as we don't want callers1558 // inside the system server have to worry about catching the callbacks while they are1559 // calling into the session1560 final SomeArgs args = SomeArgs.obtain();1561 args.arg1 = packageName;1562 args.arg2 = msg;1563 args.arg3 = extras;1564 args.arg4 = observer;1565 args.argi1 = returnCode;15661567 mHandler.obtainMessage(MSG_ON_PACKAGE_INSTALLED, args).sendToTarget();//11568 }15691570 final boolean success = (returnCode == PackageManager.INSTALL_SUCCEEDED);15711572 // Send broadcast to default launcher only if it's a new install1573 final boolean isNewInstall = extras == null || !extras.getBoolean(Intent.EXTRA_REPLACING);1574 if (success && isNewInstall) {1575 mPm.sendSessionCommitBroadcast(generateInfo(), userId);1576 }15771578 mCallback.onSessionFinished(this, success);1579 }

注释1处最终会调用IPackageInstallObserver2的onPackageInstalled方法，具体是实现在PackageInstallObserver类中：

frameworks/base/core/java/android/app/PackageInstallObserver.java

public class PackageInstallObserver {private final IPackageInstallObserver2.Stub mBinder = new IPackageInstallObserver2.Stub() {...@Overridepublic void onPackageInstalled(String basePackageName, int returnCode,String msg, Bundle extras) {PackageInstallObserver.this.onPackageInstalled(basePackageName, returnCode, msg,extras);//1}};public IPackageInstallObserver2 getBinder() {return mBinder;}}

注释1处调用了PackageInstallObserver的onPackageInstalled方法，实现这个方法的类为PackageInstallObserver的子类、前面提到的PackageInstallObserverAdapter。

/frameworks/base/services/core/java/com/android/server/pm/PackageInstallerService.java

static class PackageInstallObserverAdapter extends PackageInstallObserver {private final Context mContext;private final IntentSender mTarget;private final int mSessionId;private final boolean mShowNotification;private final int mUserId;public PackageInstallObserverAdapter(Context context, IntentSender target, int sessionId,boolean showNotification, int userId) {mContext = context;mTarget = target;mSessionId = sessionId;mShowNotification = showNotification;mUserId = userId;}...@Overridepublic void onPackageInstalled(String basePackageName, int returnCode, String msg,Bundle extras) {if (PackageManager.INSTALL_SUCCEEDED == returnCode && mShowNotification) {boolean update = (extras != null) && extras.getBoolean(Intent.EXTRA_REPLACING);Notification notification = buildSuccessNotification(mContext,mContext.getResources().getString(update ? R.string.package_updated_device_owner :R.string.package_installed_device_owner),basePackageName,mUserId);if (notification != null) {NotificationManager notificationManager = (NotificationManager)mContext.getSystemService(Context.NOTIFICATION_SERVICE);notificationManager.notify(basePackageName,SystemMessage.NOTE_PACKAGE_STATE,notification);}}final Intent fillIn = new Intent();fillIn.putExtra(PackageInstaller.EXTRA_PACKAGE_NAME, basePackageName);fillIn.putExtra(PackageInstaller.EXTRA_SESSION_ID, mSessionId);fillIn.putExtra(PackageInstaller.EXTRA_STATUS,PackageManager.installStatusToPublicStatus(returnCode));fillIn.putExtra(PackageInstaller.EXTRA_STATUS_MESSAGE,PackageManager.installStatusToString(returnCode, msg));fillIn.putExtra(PackageInstaller.EXTRA_LEGACY_STATUS, returnCode);if (extras != null) {final String existing = extras.getString(PackageManager.EXTRA_FAILURE_EXISTING_PACKAGE);if (!TextUtils.isEmpty(existing)) {fillIn.putExtra(PackageInstaller.EXTRA_OTHER_PACKAGE_NAME, existing);}}try {mTarget.sendIntent(mContext, 0, fillIn, null, null); //1} catch (SendIntentException ignored) {}}}

最终回调到应用层接受广播和安装的结果。

总结一下就是dispatchSessionFinished方法会通过mRemoteObserver的onPackageInstalled方法，将Complete方法出现的PackageManagerException的异常信息回调给PackageInstallObserverAdapter。

3.总结

本篇文章讲解了PackageInstaller安装APK的过程，简单来说就两步：

将APK的信息通过IO流的形式写入到PackageInstaller.Session中。调用PackageInstaller.Session的commit方法，将APK的信息交由PMS处理。

由于PMS中对APK安装的处理比较复杂，因此关于PMS的处理部分会在本系列的下一篇文章进行讲解。