// 程式碼片段1：PMS部分屬性的初始化
public PackageManagerService(Context context, Installer installer,
        boolean factoryTest, boolean onlyCore) {
    // 關鍵的Event日誌，PMS開始啟動了
    EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_START,
            SystemClock.uptimeMillis());

    mContext = context;
    mFactoryTest = factoryTest;
    mOnlyCore = onlyCore;
    // 如果是eng版，則延遲做DexOpt
    mLazyDexOpt = "eng".equals(SystemProperties.get("ro.build.type"));
    mMetrics = new DisplayMetrics();
    // Settings是包管理中一個很重要的資料結構，用於維護所有包的資訊
    mSettings = new Settings(mPackages);
    mSettings.addSharedUserLPw("android.uid.system", Process.SYSTEM_UID,
            ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
    mSettings.addSharedUserLPw("android.uid.phone", RADIO_UID,
            ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
    mSettings.addSharedUserLPw("android.uid.log", LOG_UID,
            ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
    mSettings.addSharedUserLPw("android.uid.nfc", NFC_UID,
            ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
    mSettings.addSharedUserLPw("android.uid.bluetooth", BLUETOOTH_UID,
            ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
    mSettings.addSharedUserLPw("android.uid.shell", SHELL_UID,
            ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);

    long dexOptLRUThresholdInMinutes;
    if (mLazyDexOpt) {
        dexOptLRUThresholdInMinutes = 30; // only last 30 minutes of apps for eng builds.
    } else {
        dexOptLRUThresholdInMinutes = 7 * 24 * 60; // apps used in the 7 days for users.
    }
    mDexOptLRUThresholdInMills = dexOptLRUThresholdInMinutes * 60 * 1000;
    ...
    mInstaller = installer;
    // DexOpt工具類
    mPackageDexOptimizer = new PackageDexOptimizer(this);
    mMoveCallbacks = new MoveCallbacks(FgThread.get().getLooper());
    mOnPermissionChangeListeners = new OnPermissionChangeListeners(
                FgThread.get().getLooper());
    getDefaultDisplayMetrics(context, mMetrics);
    // 讀取系統預設的許可權
    SystemConfig systemConfig = SystemConfig.getInstance();
    mGlobalGids = systemConfig.getGlobalGids();
    mSystemPermissions = systemConfig.getSystemPermissions();
    mAvailableFeatures = systemConfig.getAvailableFeatures();

    // 這裡上了兩把鎖: mInstallLock是安裝APK時需要用到的鎖；mPackage是更新APK資訊時需要的鎖
    synchronized (mInstallLock) {
    synchronized (mPackages) {
        // 構建一個後臺執行緒，並將執行緒的訊息佇列繫結到Handler
        mHandlerThread = new ServiceThread(TAG,
                Process.THREAD_PRIORITY_BACKGROUND, true /*allowIo*/);
        mHandlerThread.start();
        mHandler = new PackageHandler(mHandlerThread.getLooper());
        // 將PMS加入Watchdog的監控列表
        Watchdog.getInstance().addThread(mHandler, WATCHDOG_TIMEOUT);

        // 初始化一些檔案目錄
        File dataDir = Environment.getDataDirectory();
        mAppDataDir = new File(dataDir, "data");
        mAppInstallDir = new File(dataDir, "app");
        mAppLib32InstallDir = new File(dataDir, "app-lib");
        mAsecInternalPath = new File(dataDir, "app-asec").getPath();
        mUserAppDataDir = new File(dataDir, "user");
        mDrmAppPrivateInstallDir = new File(dataDir, "app-private");

        // 初始化系統許可權
        ArrayMap<String, SystemConfig.PermissionEntry> permConfig
                = systemConfig.getPermissions();
        for (int i=0; i<permConfig.size(); i++) {
            SystemConfig.PermissionEntry perm = permConfig.valueAt(i);
            BasePermission bp = mSettings.mPermissions.get(perm.name);
            if (bp == null) {
                bp = new BasePermission(perm.name, "android", BasePermission.TYPE_BUILTIN);
                mSettings.mPermissions.put(perm.name, bp);
            }
            if (perm.gids != null) {
                bp.setGids(perm.gids, perm.perUser);
            }
        }

        // 初始化PMS中的ShareLibraries
        ArrayMap<String, String> libConfig = systemConfig.getSharedLibraries();
        for (int i=0; i<libConfig.size(); i++) {
            mSharedLibraries.put(libConfig.keyAt(i),
                    new SharedLibraryEntry(libConfig.valueAt(i), null));
        }

        // 讀取mac_permission.xml檔案的內容
        mFoundPolicyFile = SELinuxMMAC.readInstallPolicy();

        mRestoredSettings = mSettings.readLPw(this, sUserManager.getUsers(false),
                mSdkVersion, mOnlyCore);
        String customResolverActivity = Resources.getSystem().getString(
                        R.string.config_customResolverActivity);

// 未完接程式碼片段2

//程式碼片段2：DexOpt處理，掃描系統檔案
    // 關鍵日誌，開始掃描系統APP
    EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_SYSTEM_SCAN_START,
            startTime);

    // 設定掃描引數
    final int scanFlags = SCAN_NO_PATHS | SCAN_DEFER_DEX | SCAN_BOOTING | SCAN_INITIAL;
    // 1. 構建陣列變數用於儲存已經做過DexOpt的檔案，後文中，會往這個陣列變數中新增元素
    final ArraySet<String> alreadyDexOpted = new ArraySet<String>();
    final String bootClassPath = System.getenv("BOOTCLASSPATH");
    final String systemServerClassPath = System.getenv("SYSTEMSERVERCLASSPATH");

    // BOOTCLASSPATH環境變數所定義的檔案已經做過DexOpt
    if (bootClassPath != null) {
        String[] bootClassPathElements = splitString(bootClassPath, ':');
        for (String element : bootClassPathElements) {
            alreadyDexOpted.add(element);
        }
    }

    // SYSTEMSERVERCLASSPATH環境變數所定義的檔案已經做過了DexOpt
    if (systemServerClassPath != null) {
        String[] systemServerClassPathElements = splitString(systemServerClassPath, ':');
        for (String element : systemServerClassPathElements) {
            alreadyDexOpted.add(element);
        }
    }

    // 獲取指令集，以便後續進行DexOpt
    final List<String> allInstructionSets = InstructionSets.getAllInstructionSets();
    final String[] dexCodeInstructionSets =
            getDexCodeInstructionSets(
                        allInstructionSets.toArray(new String[allInstructionSets.size()]));

    // 公共庫是定義在 etc/sysconfig 和 etc/permissions 資料夾下的XML檔案中
    // 需要這些公共庫進行DexOpt處理
    if (mSharedLibraries.size() > 0) {
        for (String dexCodeInstructionSet : dexCodeInstructionSets) {
            for (SharedLibraryEntry libEntry : mSharedLibraries.values()) {
                final String lib = libEntry.path;
                if (lib == null) {
                    continue;
                }
                try {
                    int dexoptNeeded = DexFile.getDexOptNeeded(lib, null, dexCodeInstructionSet, false);
                    if (dexoptNeeded != DexFile.NO_DEXOPT_NEEDED) {
                        alreadyDexOpted.add(lib);
                        mInstaller.dexopt(lib, Process.SYSTEM_UID, true, dexCodeInstructionSet, dexoptNeeded);
                    }
                } catch (...)
            }
        }
    }

    File frameworkDir = new File(Environment.getRootDirectory(), "framework");
    alreadyDexOpted.add(frameworkDir.getPath() + "/framework-res.apk");
    alreadyDexOpted.add(frameworkDir.getPath() + "/core-libart.jar");

    // system/framework目錄下，除了framework-res.apk和core-libart.jar這兩個檔案外
    // 其他的APK和JAR檔案都需要進行DexOpt處理
    String[] frameworkFiles = frameworkDir.list();
    if (frameworkFiles != null) {
        for (String dexCodeInstructionSet : dexCodeInstructionSets) {
            for (int i=0; i<frameworkFiles.length; i++) {
                File libPath = new File(frameworkDir, frameworkFiles[i]);
                String path = libPath.getPath();
                if (alreadyDexOpted.contains(path)) {
                    continue;
                }
                if (!path.endsWith(".apk") && !path.endsWith(".jar")) {
                    continue;
                }
                try {
                    int dexoptNeeded = DexFile.getDexOptNeeded(path, null, dexCodeInstructionSet, false);
                    if (dexoptNeeded != DexFile.NO_DEXOPT_NEEDED) {
                        mInstaller.dexopt(path, Process.SYSTEM_UID, true, dexCodeInstructionSet, dexoptNeeded);
                    }
                } catch(...)
            }
        }
    }

    // 2. Android M的APK授權機制有了變化，此處是與授權相關的版本相容處理
    final VersionInfo ver = mSettings.getInternalVersion();
    mIsUpgrade = !Build.FINGERPRINT.equals(ver.fingerprint);
    mPromoteSystemApps =
            mIsUpgrade && ver.sdkVersion <= Build.VERSION_CODES.LOLLIPOP_MR1;
    if (mPromoteSystemApps) {
        Iterator<PackageSetting> pkgSettingIter = mSettings.mPackages.values().iterator();
        while (pkgSettingIter.hasNext()) {
            PackageSetting ps = pkgSettingIter.next();
            if (isSystemApp(ps)) {
                mExistingSystemPackages.add(ps.name);
            }
        }
    }

    // 3. 掃描系統檔案
    File vendorOverlayDir = new File(VENDOR_OVERLAY_DIR);
    // 掃描 /vendor/overlay 目錄下的檔案
    scanDirLI(vendorOverlayDir, PackageParser.PARSE_IS_SYSTEM
            | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags | SCAN_TRUSTED_OVERLAY, 0);
    // 掃描 /system/framework 目錄下的檔案
    scanDirLI(frameworkDir, PackageParser.PARSE_IS_SYSTEM
            | PackageParser.PARSE_IS_SYSTEM_DIR
            | PackageParser.PARSE_IS_PRIVILEGED,
            scanFlags | SCAN_NO_DEX, 0);
    // 掃描 /system/priv-app 目錄下的檔案
    final File privilegedAppDir = new File(Environment.getRootDirectory(), "priv-app");
    scanDirLI(privilegedAppDir, PackageParser.PARSE_IS_SYSTEM
            | PackageParser.PARSE_IS_SYSTEM_DIR
            | PackageParser.PARSE_IS_PRIVILEGED, scanFlags, 0);
    // 掃描 /system/app 目錄下的檔案
    final File systemAppDir = new File(Environment.getRootDirectory(), "app");
    scanDirLI(systemAppDir, PackageParser.PARSE_IS_SYSTEM
            | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags, 0);
    // 掃描 /vendor/app 目錄下的檔案
    File vendorAppDir = new File("/vendor/app");
    try {
        vendorAppDir = vendorAppDir.getCanonicalFile();
    } catch (IOException e) {}
    scanDirLI(vendorAppDir, PackageParser.PARSE_IS_SYSTEM
            | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags, 0);
    // 掃描 /oem/app 目錄下的檔案
    final File oemAppDir = new File(Environment.getOemDirectory(), "app");
    scanDirLI(oemAppDir, PackageParser.PARSE_IS_SYSTEM
            | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags, 0);
    mInstaller.moveFiles();

    // 4. 對掃描到的系統檔案善後處理
    final List<String> possiblyDeletedUpdatedSystemApps = new ArrayList<String>();
    if (!mOnlyCore) {
        Iterator<PackageSetting> psit = mSettings.mPackages.values().iterator();
        while (psit.hasNext()) {
            PackageSetting ps = psit.next();
            if ((ps.pkgFlags & ApplicationInfo.FLAG_SYSTEM) == 0) {
                continue;
            }
            final PackageParser.Package scannedPkg = mPackages.get(ps.name);
            if (scannedPkg != null) {
                if (mSettings.isDisabledSystemPackageLPr(ps.name)) {
                    removePackageLI(ps, true);
                    mExpectingBetter.put(ps.name, ps.codePath);
                }
                continue;
            }

            if (!mSettings.isDisabledSystemPackageLPr(ps.name)) {
                psit.remove();
                removeDataDirsLI(null, ps.name);
            } else {
                final PackageSetting disabledPs = mSettings.getDisabledSystemPkgLPr(ps.name);
                if (disabledPs.codePath == null || !disabledPs.codePath.exists()) {
                    possiblyDeletedUpdatedSystemApps.add(ps.name);
                }
            }
        }
    }

    ArrayList<PackageSetting> deletePkgsList = mSettings.getListOfIncompleteInstallPackagesLPr();
    for(int i = 0; i < deletePkgsList.size(); i++) {
        cleanupInstallFailedPackage(deletePkgsList.get(i));
    }
    deleteTempPackageFiles();
    mSettings.pruneSharedUsersLPw();
// 未完接程式碼片段3

// 程式碼片段3：掃描Data分割槽檔案，更新公共庫資訊
    if (!mOnlyCore) {
        // 關鍵日誌，PMS對Data分割槽的檔案掃描開始了
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_DATA_SCAN_START,
                SystemClock.uptimeMillis());
        // 1. 掃描Data分割槽的檔案目錄
        scanDirLI(mAppInstallDir, 0, scanFlags | SCAN_REQUIRE_KNOWN, 0);
        scanDirLI(mDrmAppPrivateInstallDir, PackageParser.PARSE_FORWARD_LOCK,
                scanFlags | SCAN_REQUIRE_KNOWN, 0);
        // 2. 掃描完Data分割槽後，處理“可能被刪除的系統應用”
        for (String deletedAppName : possiblyDeletedUpdatedSystemApps) {
            PackageParser.Package deletedPkg = mPackages.get(deletedAppName);
            mSettings.removeDisabledSystemPackageLPw(deletedAppName);
            String msg;
            if (deletedPkg == null) {
                removeDataDirsLI(null, deletedAppName);
            } else {
               deletedPkg.applicationInfo.flags &= ~ApplicationInfo.FLAG_SYSTEM;
               PackageSetting deletedPs = mSettings.mPackages.get(deletedAppName);
               deletedPs.pkgFlags &= ~ApplicationInfo.FLAG_SYSTEM;
            }
        }
        // 3. 處理有版本更新的系統應用
        for (int i = 0; i < mExpectingBetter.size(); i++) {
            final String packageName = mExpectingBetter.keyAt(i);
            if (!mPackages.containsKey(packageName)) {
                final File scanFile = mExpectingBetter.valueAt(i);
                final int reparseFlags;
                // 設定重新掃描的解析引數
                if (FileUtils.contains(privilegedAppDir, scanFile)) {
                    reparseFlags = PackageParser.PARSE_IS_SYSTEM
                            | PackageParser.PARSE_IS_SYSTEM_DIR
                            | PackageParser.PARSE_IS_PRIVILEGED;
                } else {...}

                // 將原來的系統應用重新置為Enable狀態
                mSettings.enableSystemPackageLPw(packageName);
                try {
                    scanPackageLI(scanFile, reparseFlags, scanFlags, 0, null);
                } catch (PackageManagerException e) { ... }
            }
        }
    } // end of "if (!mOnlyCore)"
    mExpectingBetter.clear();

    // 4. 處理公共庫
    updateAllSharedLibrariesLPw();
    for (SharedUserSetting setting : mSettings.getAllSharedUsersLPw()) {
         adjustCpuAbisForSharedUserLPw(setting.packages, null /* scanned package */,
                 false /* force dexopt */, false /* defer dexopt */);
    }

    mPackageUsage.readLP();
    // 關鍵日誌，PMS掃描結束了
    EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_SCAN_END,
            SystemClock.uptimeMillis());
// 未完接程式碼片段4

// 程式碼片段4：收尾工作
    // 授權
    int updateFlags = UPDATE_PERMISSIONS_ALL;
    if (ver.sdkVersion != mSdkVersion) {
        updateFlags |= UPDATE_PERMISSIONS_REPLACE_PKG | UPDATE_PERMISSIONS_REPLACE_ALL;
    }
    updatePermissionsLPw(null, null, updateFlags);
    ver.sdkVersion = mSdkVersion;

    // 多使用者場景下的版本相容處理
    if (!onlyCore && (mPromoteSystemApps || !mRestoredSettings)) {
        for (UserInfo user : sUserManager.getUsers(true)) {
            mSettings.applyDefaultPreferredAppsLPw(this, user.id);
            applyFactoryDefaultBrowserLPw(user.id);
            primeDomainVerificationsLPw(user.id);
        }
    }

    // 如果是升級新版本，則需要清除已有的Code cache目錄
    if (mIsUpgrade && !onlyCore) {
        for (int i = 0; i < mSettings.mPackages.size(); i++) {
            final PackageSetting ps = mSettings.mPackages.valueAt(i);
            if (Objects.equals(StorageManager.UUID_PRIVATE_INTERNAL, ps.volumeUuid)) {
                deleteCodeCacheDirsLI(ps.volumeUuid, ps.name);
            }
        }
        ver.fingerprint = Build.FINGERPRINT;
    }
    checkDefaultBrowser();
    mExistingSystemPackages.clear();
    mPromoteSystemApps = false;
    ver.databaseVersion = Settings.CURRENT_DATABASE_VERSION;
    mSettings.writeLPr();

    // 關鍵日誌，PMS已經啟動完畢了
    EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_READY,
            SystemClock.uptimeMillis());

    mRequiredVerifierPackage = getRequiredVerifierLPr();
    mRequiredInstallerPackage = getRequiredInstallerLPr();
    // 初始化包安裝服務
    mInstallerService = new PackageInstallerService(context, this);
    mIntentFilterVerifierComponent = getIntentFilterVerifierComponentNameLPr();
    mIntentFilterVerifier = new IntentVerifierProxy(mContext,
            mIntentFilterVerifierComponent);
    } // synchronized (mPackages)
    } // synchronized (mInstallLock)

    Runtime.getRuntime().gc();
    LocalServices.addService(PackageManagerInternal.class, new PackageManagerInternalImpl());
} // PMS建構函式完結

private void scanDirLI(File dir, int parseFlags, int scanFlags, long currentTime) {
    final File[] files = dir.listFiles();
    if (ArrayUtils.isEmpty(files)) {
         return;
    }

    for (File file : files) {
        final boolean isPackage = (isApkFile(file) || file.isDirectory())
            && !PackageInstallerService.isStageName(file.getName());
        if (!isPackage) {
            continue;
        }
        try {
            scanPackageLI(file, parseFlags | PackageParser.PARSE_MUST_BE_APK,
                    scanFlags, currentTime, null);
        } catch (PackageManagerException e) {
            if ((parseFlags & PackageParser.PARSE_IS_SYSTEM) == 0 &&
                    e.error == PackageManager.INSTALL_FAILED_INVALID_APK) {
                // 如果掃描Data分割槽的APK失敗，則刪除Data分割槽掃描失敗的檔案
                if (file.isDirectory()) {
                    mInstaller.rmPackageDir(file.getAbsolutePath());
                } else {
                    file.delete();
                }
            }
        }
    }
}

private PackageParser.Package scanPackageLI(File scanFile, int parseFlags, int scanFlags,
        long currentTime, UserHandle user) throws PackageManagerException {
    parseFlags |= mDefParseFlags;
    // 初始化PackageParser物件，用於解析包
    PackageParser pp = new PackageParser();
    pp.setSeparateProcesses(mSeparateProcesses);
    pp.setOnlyCoreApps(mOnlyCore);
    pp.setDisplayMetrics(mMetrics);

    if ((scanFlags & SCAN_TRUSTED_OVERLAY) != 0) {
        parseFlags |= PackageParser.PARSE_TRUSTED_OVERLAY;
    }

    final PackageParser.Package pkg;
    try {
        // 2. 解析包得到一個PackageParser.Package物件
        pkg = pp.parsePackage(scanFile, parseFlags);
    } catch(...)

    PackageSetting ps = null;
    PackageSetting updatedPkg;

    // 3. 判定系統APK是否需要更新
    synchronized (mPackages) {
        String oldName = mSettings.mRenamedPackages.get(pkg.packageName);
        if (pkg.mOriginalPackages != null && pkg.mOriginalPackages.contains(oldName)) {
            ps = mSettings.peekPackageLPr(oldName);
        }
        if (ps == null) {
            ps = mSettings.peekPackageLPr(pkg.packageName);
        }
        updatedPkg = mSettings.getDisabledSystemPkgLPr(ps != null ? ps.name : pkg.packageName);
    }

    boolean updatedPkgBetter = false;
    if (updatedPkg != null && (parseFlags&PackageParser.PARSE_IS_SYSTEM) != 0) {
        ...
        if (ps != null && !ps.codePath.equals(scanFile)) {
            if (pkg.mVersionCode <= ps.versionCode) {
                ...
                throw new PackageManagerException(INSTALL_FAILED_DUPLICATE_PACKAGE,
                        "Package " + ps.name + " at " + scanFile
                        + " ignored: updated version " + ps.versionCode
                        + " better than this " + pkg.mVersionCode);
            } else {
                ...
                InstallArgs args = createInstallArgsForExisting(packageFlagsToInstallFlags(ps),
                        ps.codePathString, ps.resourcePathString, getAppDexInstructionSets(ps));
                synchronized (mInstallLock) {
                    args.cleanUpResourcesLI();
                }
                synchronized (mPackages) {
                    mSettings.enableSystemPackageLPw(ps.name);
                }
                updatedPkgBetter = true;
            }
        }
    }
    ...
    // 4. 獲取APK的簽名資訊
    collectCertificatesLI(pp, ps, pkg, scanFile, parseFlags);

    // 5. 在Data分割槽存在一個應用，與當前掃描的系統APK包名相同
    boolean shouldHideSystemApp = false;
    if (updatedPkg == null && ps != null
        && (parseFlags & PackageParser.PARSE_IS_SYSTEM_DIR) != 0 && !isSystemApp(ps)) {
        if (compareSignatures(ps.signatures.mSignatures, pkg.mSignatures)
                != PackageManager.SIGNATURE_MATCH) {
            // 簽名不匹配
            deletePackageLI(pkg.packageName, null, true, null, null, 0, null, false);
            ps = null;
        } else {
           if (pkg.mVersionCode <= ps.versionCode) {
               shouldHideSystemApp = true;
           } else {
               InstallArgs args = createInstallArgsForExisting(packageFlagsToInstallFlags(ps),
                       ps.codePathString, ps.resourcePathString, getAppDexInstructionSets(ps));
               synchronized (mInstallLock) {
                   args.cleanUpResourcesLI();
               }
           }
        }
    }
    ...
    // 6. 呼叫另外一個scanPackageLI()函式，對包進行掃描
    PackageParser.Package scannedPkg = scanPackageLI(pkg, parseFlags, scanFlags
            | SCAN_UPDATE_SIGNATURE, currentTime, user);

    if (shouldHideSystemApp) {
        synchronized (mPackages) {
            mSettings.disableSystemPackageLPw(pkg.packageName);
        }
    }
    return scannedPkg;
}

private PackageParser.Package scanPackageLI(PackageParser.Package pkg, int parseFlags,
        int scanFlags, long currentTime, UserHandle user) throws PackageManagerException {
    boolean success = false;
    try {
        final PackageParser.Package res = scanPackageDirtyLI(pkg, parseFlags, scanFlags,
            currentTime, user);
        success = true;
        return res;
    } finally {
        if (!success && (scanFlags & SCAN_DELETE_DATA_ON_FAILURES) != 0) {
            removeDataDirsLI(pkg.volumeUuid, pkg.packageName);
        }
    }
}

private PackageParser.Package scanPackageDirtyLI(PackageParser.Package pkg, int parseFlags,
int scanFlags, long currentTime, UserHandle user) throws PackageManagerException {
    ...
    // 1. 針對包名為“android”的APK進行處理
    if (pkg.packageName.equals("android")) {
        ...
        mPlatformPackage = pkg;
        pkg.mVersionCode = mSdkVersion;
        mAndroidApplication = pkg.applicationInfo;
        ...
    }
    ...
    // 2. 鎖上mPacakges物件，意味著要對這個資料結構進行寫操作，裡面儲存的就是已經解析出來的包資訊
    synchronized (mPackages) {
        // 如果有定義ShareUserId，則建立一個ShareUserSetting物件
        if (pkg.mSharedUserId != null) {
            suid = mSettings.getSharedUserLPw(pkg.mSharedUserId, 0, 0, true);
            if (suid == null) {
                throw new PackageManagerException(INSTALL_FAILED_INSUFFICIENT_STORAGE,
                "Creating application package " + pkg.packageName
                + " for shared user failed");
            }
        }
        ...
        // 生成PackageSetting物件，對應的資料結構將序列化在/data/system/packags.xml檔案中
        pkgSetting = mSettings.getPackageLPw(pkg, origPackage, realName, suid, destCodeFile,
                destResourceFile, pkg.applicationInfo.nativeLibraryRootDir,
                pkg.applicationInfo.primaryCpuAbi,
                pkg.applicationInfo.secondaryCpuAbi,
                pkg.applicationInfo.flags, pkg.applicationInfo.privateFlags,
                user, false);
         ...
         // 打上SELinux標籤
         if (mFoundPolicyFile) {
             SELinuxMMAC.assignSeinfoValue(pkg);
         }
         ...
         // 簽名驗證
         if (shouldCheckUpgradeKeySetLP(pkgSetting, scanFlags)) {
             if (checkUpgradeKeySetLP(pkgSetting, pkg)) {
                 pkgSetting.signatures.mSignatures = pkg.mSignatures;
             }
             ...
         } else {
             verifySignaturesLP(pkgSetting, pkg);
             ...
         }
    }

    pkg.applicationInfo.processName = fixProcessName(
            pkg.applicationInfo.packageName,
            pkg.applicationInfo.processName,
            pkg.applicationInfo.uid);
    // 3. 生成APK的data目錄
    File dataPath;
    if (mPlatformPackage == pkg) {
        // framework-res.apk的data目錄是 /data/system
        dataPath = new File(Environment.getDataDirectory(), "system");
        pkg.applicationInfo.dataDir = dataPath.getPath();
    } else {
        // 其他APK的data目錄是 /data/data/packageName
        dataPath = Environment.getDataUserPackageDirectory(pkg.volumeUuid,
                UserHandle.USER_OWNER, pkg.packageName);
        boolean uidError = false;
        if (dataPath.exists()) {
            // APK的data目錄已經存在
            ...
        } else {
            // APK的data目錄不存在，則通過Installd建立之
            int ret = createDataDirsLI(pkg.volumeUuid, pkgName, pkg.applicationInfo.uid,
                    pkg.applicationInfo.seinfo);
            if (ret < 0) {
                throw new PackageManagerException(INSTALL_FAILED_INSUFFICIENT_STORAGE,
                        "Unable to create data dirs [errorCode=" + ret + "]");
            }
            ...
        }
    }
    ...
    // 4. 設定Native Library
    if ((scanFlags & SCAN_NEW_INSTALL) == 0) {
        derivePackageAbi(pkg, scanFile, cpuAbiOverride, true /* extract libs */);
        if (isSystemApp(pkg) && !pkg.isUpdatedSystemApp() &&
                pkg.applicationInfo.primaryCpuAbi == null) {
            setBundledAppAbisAndRoots(pkg, pkgSetting);
            setNativeLibraryPaths(pkg);
        }
    } else {
        ...
        setNativeLibraryPaths(pkg);
    }
    ...
    // 5. 填充PMS中的資料
    synchronized (mPackages) {
        mSettings.insertPackageSettingLPw(pkgSetting, pkg);
        mPackages.put(pkg.applicationInfo.packageName, pkg);
        ...
        int N = pkg.providers.size();
        for (i=0; i<N; i++) {
            PackageParser.Provider p = pkg.providers.get(i);
            p.info.processName = fixProcessName(pkg.applicationInfo.processName,
                    p.info.processName, pkg.applicationInfo.uid);
            mProviders.addProvider(p);
            ...
        }

        N = pkg.services.size();
        for (i=0; i<N; i++) {
            PackageParser.Service s = pkg.services.get(i);
            s.info.processName = fixProcessName(pkg.applicationInfo.processName,
                    s.info.processName, pkg.applicationInfo.uid);
            mServices.addService(s);
            ...
        }

        N = pkg.receivers.size();
        for (i=0; i<N; i++) {
            PackageParser.Activity a = pkg.receivers.get(i);
            a.info.processName = fixProcessName(pkg.applicationInfo.processName,
                    a.info.processName, pkg.applicationInfo.uid);
            mReceivers.addActivity(a, "receiver");
            ...
        }

        N = pkg.activities.size();
        for (i=0; i<N; i++) {
            PackageParser.Activity a = pkg.activities.get(i);
            a.info.processName = fixProcessName(pkg.applicationInfo.processName,
                    a.info.processName, pkg.applicationInfo.uid);
            mActivities.addActivity(a, "activity");
        }
        ...
    }

    return pkg;
}

private void updatePermissionsLPw(String changingPkg,
        PackageParser.Package pkgInfo, int flags) {
    ... // 此處省略大段邏輯。需要刪除沒有歸屬的BasePermission，
    // 如果一個BasePermission找不到其關聯的包，則需要刪除之

    // 遍歷包掃描的結果，依次對每個包進行授權。
    // PMS初始化呼叫該函式時，傳入的pkgInfo為null。
    if ((flags&UPDATE_PERMISSIONS_ALL) != 0) {
        for (PackageParser.Package pkg : mPackages.values()) {
            if (pkg != pkgInfo) {
                grantPermissionsLPw(pkg, (flags&UPDATE_PERMISSIONS_REPLACE_ALL) != 0,
                        changingPkg);
            }
        }
    }

    if (pkgInfo != null) {
        grantPermissionsLPw(pkgInfo, (flags&UPDATE_PERMISSIONS_REPLACE_PKG) != 0, changingPkg);
    }
}

private void grantPermissionsLPw(PackageParser.Package pkg, boolean replace,
        String packageOfInterest) {
    // 1. 初始化授權相關的資料
    final PackageSetting ps = (PackageSetting) pkg.mExtras;
    if (ps == null) {
        return;
    }
    // 申請者的授權狀態PermissionsState，在後文的邏輯中，會以origPermissions這個變數來表示
    PermissionsState permissionsState = ps.getPermissionsState();
    PermissionsState origPermissions = permissionsState;
    ...
    if (replace) {
        // 如果replace為true，表示包許可權需要更新
        // PackageSettings.installPermissionsFixed這個布林變數表示
        // 包的**install**型別的許可權已經確定下來，在安裝成功後，該變數會被置為true
        // 此處，需要重新更新許可權，故又將其置為false
        ps.installPermissionsFixed = false;
        if (!ps.isSharedUser()) {
            origPermissions = new PermissionsState(permissionsState);
            permissionsState.reset();
        }
    }
    ...
    // 2. 遍歷所有申請的許可權，依次判斷是否授權
    final int N = pkg.requestedPermissions.size();
    for (int i=0; i<N; i++) {
        // name表示待申請的許可權名
        final String name = pkg.requestedPermissions.get(i);
        // bp表示待申請許可權的資料結構，bp根據name從已有的許可權列表中獲取的
        final BasePermission bp = mSettings.mPermissions.get(name);
        if (bp == null || bp.packageSetting == null) {
            // 如果沒有匹配到bp，則說明當前系統中還不存在name指定的許可權
            if (packageOfInterest == null || packageOfInterest.equals(pkg.packageName)) {
                Slog.w(TAG, "Unknown permission " + name
                        + " in package " + pkg.packageName);
            }
            continue;
        }

        final String perm = bp.name;
        boolean allowedSig = false;
        int grant = GRANT_DENIED;
        ...
        // 根據所申請許可權的保護級別，確定授權型別
        final int level = bp.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE;
        switch (level) {
            case PermissionInfo.PROTECTION_NORMAL: {
                grant = GRANT_INSTALL;
            } break;

            case PermissionInfo.PROTECTION_DANGEROUS: {
                if (pkg.applicationInfo.targetSdkVersion <= Build.VERSION_CODES.LOLLIPOP_MR1) {
                    grant = GRANT_INSTALL_LEGACY;
                } else if (origPermissions.hasInstallPermission(bp.name)) {
                    grant = GRANT_UPGRADE;
                } else if (mPromoteSystemApps
                        && isSystemApp(ps)
                        && mExistingSystemPackages.contains(ps.name)) {
                    grant = GRANT_UPGRADE;
                } else {
                    grant = GRANT_RUNTIME;
                }
            } break;

            case PermissionInfo.PROTECTION_SIGNATURE: {
                allowedSig = grantSignaturePermission(perm, pkg, bp, origPermissions);
                if (allowedSig) {
                    grant = GRANT_INSTALL;
                }
            } break;
        }

        // 3. 根據授權型別，更新包的PermissionsState
        if (grant != GRANT_DENIED) {
            // 小插曲，對於Data分割槽的應用而言，原則上是不會授予新的install型別的許可權
            if (!isSystemApp(ps) && ps.installPermissionsFixed) {
                if (!allowedSig && !origPermissions.hasInstallPermission(perm)) {
                    if (!isNewPlatformPermissionForPackage(perm, pkg)) {
                        grant = GRANT_DENIED;
                    }
                }
            }

            switch (grant) {
                case GRANT_INSTALL: {
                    // 收回所有已授予的runtime許可權。因為runtime可能在新版本中變成install型別
                    // runtime是面向多使用者的，所以涉及到runtime授權時，都會有一個迴圈遍歷所有的使用者
                    for (int userId : UserManagerService.getInstance().getUserIds()) {
                        if (origPermissions.getRuntimePermissionState(
                                bp.name, userId) != null) {
                            origPermissions.revokeRuntimePermission(bp, userId);
                            origPermissions.updatePermissionFlags(bp, userId,
                                  PackageManager.MASK_PERMISSION_FLAGS, 0);
                            changedRuntimePermissionUserIds = ArrayUtils.appendInt(
                                    changedRuntimePermissionUserIds, userId);
                        }
                    }
                    // 授予install型別的許可權
                    if (permissionsState.grantInstallPermission(bp) !=
                            PermissionsState.PERMISSION_OPERATION_FAILURE) {
                        changedInstallPermission = true;
                    }
                } break;

                case GRANT_INSTALL_LEGACY: {
                    if (permissionsState.grantInstallPermission(bp) !=
                            PermissionsState.PERMISSION_OPERATION_FAILURE) {
                        changedInstallPermission = true;
                    }
                } break;

                case GRANT_RUNTIME: {
                    for (int userId : UserManagerService.getInstance().getUserIds()) {
                        PermissionState permissionState = origPermissions
                                .getRuntimePermissionState(bp.name, userId);
                        final int flags = permissionState != null
                            ? permissionState.getFlags() : 0;
                        if (origPermissions.hasRuntimePermission(bp.name, userId)) {
                            if (permissionsState.grantRuntimePermission(bp, userId) ==
                                    PermissionsState.PERMISSION_OPERATION_FAILURE) {
                                changedRuntimePermissionUserIds = ArrayUtils.appendInt(
                                    changedRuntimePermissionUserIds, userId);
                            }
                        }
                        permissionsState.updatePermissionFlags(bp, userId, flags, flags);
                }
               } break;

               case GRANT_UPGRADE: {
                   // 先回收之前授予的install許可權，再重新授予runtime許可權
                   ...
               }

               default: {
                   // 如果進入這個分支，表示並沒有拒絕授權，但許可權又沒有真正授予給申請者
                   // 因為當時申請的許可權還不存在，即便後來有了待申請的許可權，也不會授予給申請者
                   if (packageOfInterest == null
                           || packageOfInterest.equals(pkg.packageName)) {
                       Slog.w(TAG, "Not granting permission " + perm
                               + " to package " + pkg.packageName
                               + " because it was previously installed without");
                   }
               } break;
           }
       else {
           // 拒絕授權，則需要回收已經授予的許可權
           ...
       }
    }
    if ((changedInstallPermission || replace) && !ps.installPermissionsFixed &&
            !isSystemApp(ps) || isUpdatedSystemApp(ps)){
        ps.installPermissionsFixed = true;
    }
    for (int userId : changedRuntimePermissionUserIds) {
        mSettings.writeRuntimePermissionsForUserLPr(userId, false);
    }
}

// 獲取一個PackageManager的物件例項
PackageManager pm = context.getPackageManager();
// 通過PackageManager物件獲取指定包名的包資訊
PackageInfo pi = pm.getPackageInfo("com.android.contacts", 0);

// frameworks/base/core/java/android/app/ContextImpl.java
public PackageManager getPackageManager() {
    if (mPackageManager != null) {
        return mPackageManager;
    }

    // 從ActivityThread獲取了PackageManager物件
    IPackageManager pm = ActivityThread.getPackageManager();
    if (pm != null) {
        // 通過ApplicationPackageManager對進行了一層封裝
        return (mPackageManager = new ApplicationPackageManager(this, pm));
    }

    return null;
}

// frameworks/base/core/java/android/app/ActivityThread.java
public static IPackageManager getPackageManager() {
    if (sPackageManager != null) {
        return sPackageManager;
    }
    // 早在系統程式(SystemServer)啟動PMS時，就將PMS新增到了系統服務中
    // 因此，通過ServiceManager便可以獲取到包服務。
    IBinder b = ServiceManager.getService("package");
    sPackageManager = IPackageManager.Stub.asInterface(b);
    return sPackageManager;
}

public List<ResolveInfo> queryIntentActivities(Intent intent,
        String resolvedType, int flags, int userId) {
    if (!sUserManager.exists(userId)) return Collections.emptyList();
    enforceCrossUserPermission(Binder.getCallingUid(), userId, false, false, "query intent activities");
    // 1. 解析“顯式”的Intent
    ComponentName comp = intent.getComponent();
    if (comp == null) {
        if (intent.getSelector() != null) {
            intent = intent.getSelector();
            comp = intent.getComponent();
        }
    }
    if (comp != null) {
        final List<ResolveInfo> list = new ArrayList<ResolveInfo>(1);
        final ActivityInfo ai = getActivityInfo(comp, flags, userId);
        if (ai != null) {
            final ResolveInfo ri = new ResolveInfo();
            ri.activityInfo = ai;
            list.add(ri);
        }
        return list;
    }
    // 2. 解析“隱式”的Intent
    synchronized (mPackages) {
        ... // 省略多使用者情況下CrossProfileIntentFilter相關的程式碼
        List<ResolveInfo> result = mActivities.queryIntent(
                intent, resolvedType, flags, userId);
        ...
        return result;
    }
}

public void installPackageAsUser(String originPath, IPackageInstallObserver2 observer,
        int installFlags, String installerPackageName, VerificationParams verificationParams,
        String packageAbiOverride, int userId) {
   // 判斷是否具備包安裝許可權：INSTALL_PACKAGES
   mContext.enforceCallingOrSelfPermission(android.Manifest.permission.INSTALL_PACKAGES, null);
   final int callingUid = Binder.getCallingUid();
   enforceCrossUserPermission(callingUid, userId, true, true, "installPackageAsUser");
   if (isUserRestricted(userId, UserManager.DISALLOW_INSTALL_APPS)) {
       // 如果使用者安裝受限，則退出安裝過程
       // 在多使用者的場景下，有些使用者可能被禁止安裝
       ...
       return;
   }

   // 根據安裝來源修正安裝引數
   if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) {
       // 通過adb install來安裝，就會帶上INSTALL_FROM_ADB這個安裝引數
       installFlags |= PackageManager.INSTALL_FROM_ADB;
   } else {
       installFlags &= ~PackageManager.INSTALL_FROM_ADB;
       installFlags &= ~PackageManager.INSTALL_ALL_USERS;
   }

   UserHandle user;
   if ((installFlags & PackageManager.INSTALL_ALL_USERS) != 0) {
       user = UserHandle.ALL;
   } else {
       user = new UserHandle(userId);
   }

   if ((installFlags & PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS) != 0
           && mContext.checkCallingOrSelfPermission(Manifest.permission
           .INSTALL_GRANT_RUNTIME_PERMISSIONS) == PackageManager.PERMISSION_DENIED) {
       throw new SecurityException("You need the "
               + "android.permission.INSTALL_GRANT_RUNTIME_PERMISSIONS permission "
               + "to use the PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS flag");
   }

   verificationParams.setInstallerUid(callingUid);
   final File originFile = new File(originPath);
   // 生成OriginInfo物件，包含APK的原始路徑等資訊
   final OriginInfo origin = OriginInfo.fromUntrustedFile(originFile);
   final Message msg = mHandler.obtainMessage(INIT_COPY);
   // 將安裝資訊封裝成一個InstallParams物件
   msg.obj = new InstallParams(origin, null, observer, installFlags, installerPackageName,
           null, verificationParams, user, packageAbiOverride, null);
   // 向訊息佇列發出**INIT_COPY**訊息
   mHandler.sendMessage(msg);
}

void doHandleMessage(Message msg) {
    switch (msg.what) {
        case INIT_COPY: {
            HandlerParams params = (HandlerParams) msg.obj;
            int idx = mPendingInstalls.size();
            if (!mBound) {
                if (!connectToService()) {
                    params.serviceError();
                    return;
                } else {
                    mPendingInstalls.add(idx, params);
                }
            } else {
                mPendingInstalls.add(idx, params);
                if (idx == 0) {
                    mHandler.sendEmptyMessage(MCS_BOUND);
                }
            }
        }
        break;
    }
}

    case MCS_BOUND: {
        if (msg.obj != null) {
            mContainerService = (IMediaContainerService) msg.obj;
        }
        if (mContainerService == null) {
            if (!mBound) {
                ... // DefaultContainerService連線失敗，清除安裝佇列
                mPendingInstalls.clear();
            } else {
               // 繼續等待連線
            }
        } else if (mPendingInstalls.size() > 0) {
            HandlerParams params = mPendingInstalls.get(0);
            if (params != null) {
                if (params.startCopy()) {
                    if (mPendingInstalls.size() > 0) {
                        mPendingInstalls.remove(0);
                    }
                }
                if (mPendingInstalls.size() == 0) {
                    if (mBound) {
                        // 所有APK已經安裝完成，需要斷開與DefaultContainerService連線
                        removeMessages(MCS_UNBIND);
                        Message ubmsg = obtainMessage(MCS_UNBIND);
                        sendMessageDelayed(ubmsg, 10000);
                    }
                } else {
                    // 還有待安裝的APK，繼續處理MSC_BOUND訊息
                    mHandler.sendEmptyMessage(MCS_BOUND);
                }
            }
        }
    }

final boolean startCopy() {
    boolean res;
    try {
        if (++mRetries > MAX_RETRIES) {
            mHandler.sendEmptyMessage(MCS_GIVE_UP);
            handleServiceError();
            return false;
        } else {
            handleStartCopy();
            res = true;
        }
    } catch {...}

    handleReturnCode();
    return res;
}

public void handleStartCopy() throws RemoteException {
    int ret = PackageManager.INSTALL_SUCCEEDED;
    if (origin.staged) {
        ... // 安裝一個新APK時，staged為false
    }

    // 確定APK的安裝位置，onSd表示安裝到SD卡上，onInt表示安裝到內部儲存，即Data分割槽
    final boolean onSd = (installFlags & PackageManager.INSTALL_EXTERNAL) != 0;
    final boolean onInt = (installFlags & PackageManager.INSTALL_INTERNAL) != 0;

    PackageInfoLite pkgLite = null;
    if (onInt && onSd) {
        // APK不能同時安裝在SD卡和Data分割槽
        ret = PackageManager.INSTALL_FAILED_INVALID_INSTALL_LOCATION;
    } else {
        // 1. 獲取APK的包資訊PackageInfoLite，此處還只是獲取一些少量的包資訊，所以叫Lite
        pkgLite = mContainerService.getMinimalPackageInfo(origin.resolvedPath, installFlags,
                packageAbiOverride);
        if (!origin.staged && pkgLite.recommendedInstallLocation
                == PackageHelper.RECOMMEND_FAILED_INSUFFICIENT_STORAGE) {
            ... // 儲存空間不足，則需要釋放Cache的一些空間
        }
        if (ret == PackageManager.INSTALL_SUCCEEDED) {
            int loc = pkgLite.recommendedInstallLocation;
            // 2. 判定安裝位置
            if (loc == PackageHelper.RECOMMEND_FAILED_INVALID_LOCATION) {
                ret = PackageManager.INSTALL_FAILED_INVALID_INSTALL_LOCATION;
            }
            ...
        }
    }
    // 3. 根據安裝位置建立InstallArgs物件
    final InstallArgs args = createInstallArgs(this);
    mArgs = args;
    if (ret == PackageManager.INSTALL_SUCCEEDED) {
        // 重新調整INSTALL_FROM_ADB的user標識，用做APK的檢查
        int userIdentifier = getUser().getIdentifier();
        if (userIdentifier == UserHandle.USER_ALL
                && ((installFlags & PackageManager.INSTALL_FROM_ADB) != 0)) {
            userIdentifier = UserHandle.USER_OWNER;
        }
        final int requiredUid = mRequiredVerifierPackage == null ? -1
                : getPackageUid(mRequiredVerifierPackage, userIdentifier);
        if (!origin.existing && requiredUid != -1
                && isVerificationEnabled(userIdentifier, installFlags)) {
            ... // 此處省略大段APK的檢查邏輯。
            // 目前，Android只是定義了檢查邏輯，並沒實現真正的檢查器，所以改段邏輯都不會執行
        } else {
            // 4. 呼叫InstallArgs.copyApk函式
            ret = args.copyApk(mContainerService, true);
        }
    }

    mRet = ret;
}

int copyApk(IMediaContainerService imcs, boolean temp) throws RemoteException {
    if (origin.staged) {
        ... // 對於新安裝的APK，staged為false
    }
    try {
        // 1. 生成臨時目錄，譬如: /data/app/vmdl239812321.tmp
        final File tempDir = mInstallerService.allocateStageDirLegacy(volumeUuid);
        codeFile = tempDir;
        resourceFile = tempDir;
    } catch (IOException e) {
        // 空間不足，退出安裝流程
        return PackageManager.INSTALL_FAILED_INSUFFICIENT_STORAGE;
    }

    // 2. 建立一個用於跨程式傳遞的檔案描述符
    final IParcelFileDescriptorFactory target = new IParcelFileDescriptorFactory.Stub() {
        @Override
        public ParcelFileDescriptor open(String name, int mode) throws RemoteException {
            if (!FileUtils.isValidExtFilename(name)) {
                throw new IllegalArgumentException("Invalid filename: " + name);
            }
            try {
                final File file = new File(codeFile, name);
                final FileDescriptor fd = Os.open(file.getAbsolutePath(),
                        O_RDWR | O_CREAT, 0644);
                Os.chmod(file.getAbsolutePath(), 0644);
                return new ParcelFileDescriptor(fd);
            } catch (ErrnoException e) {
                throw new RemoteException("Failed to open: " + e.getMessage());
            }
        }
    };

    int ret = PackageManager.INSTALL_SUCCEEDED;
    // 3. 跨程式呼叫DefaultContainerService程式中的copyPackage()函式
    ret = imcs.copyPackage(origin.file.getAbsolutePath(), target);
    if (ret != PackageManager.INSTALL_SUCCEEDED) {
        return ret;
    }

    // 4. 拷貝Native庫
    final File libraryRoot = new File(codeFile, LIB_DIR_NAME);
    NativeLibraryHelper.Handle handle = null;
    try {
        handle = NativeLibraryHelper.Handle.create(codeFile);
        ret = NativeLibraryHelper.copyNativeBinariesWithOverride(handle, libraryRoot,
                abiOverride);
    } catch (IOException e) {...}

    return ret;
}

void handleReturnCode() {
    if (mArgs != null) {
        processPendingInstall(mArgs, mRet);
    }
}

private void processPendingInstall(final InstallArgs args, final int currentStatus) {
    // 往訊息佇列丟擲一個可執行任務，完成接下來的安裝過程
    mHandler.post(new Runnable() {
        public void run() {
            mHandler.removeCallbacks(this);
            PackageInstalledInfo res = new PackageInstalledInfo();
            res.returnCode = currentStatus;
            res.uid = -1;
            res.pkg = null;
            res.removedInfo = new PackageRemovedInfo();
            if (res.returnCode == PackageManager.INSTALL_SUCCEEDED) {
                args.doPreInstall(res.returnCode);
                synchronized (mInstallLock) {
                    // 安裝一個包
                    installPackageLI(args, res);
                }
                args.doPostInstall(res.returnCode, res.uid);
            }
            ...
        }
    }
}

private void installPackageLI(InstallArgs args, PackageInstalledInfo res) {
    // 1. 準備安裝引數
    final int installFlags = args.installFlags;
    final String installerPackageName = args.installerPackageName;
    final String volumeUuid = args.volumeUuid;
    final File tmpPackageFile = new File(args.getCodePath());
    ...
    // 2. 解析APK
    PackageParser pp = new PackageParser();
    pp.setSeparateProcesses(mSeparateProcesses);
    pp.setDisplayMetrics(mMetrics);
    final PackageParser.Package pkg;
    try {
        pkg = pp.parsePackage(tmpPackageFile, parseFlags);
    } catch (PackageParserException e) {
        res.setError("Failed parse during installPackageLI", e);
        return;
    }
    ...
    // 3. 獲取簽名和MD5值
    try {
        pp.collectCertificates(pkg, parseFlags);
        pp.collectManifestDigest(pkg);
    } catch (PackageParserException e) {
        res.setError("Failed collect during installPackageLI", e);
        return;
    }
    ...
    synchronized (mPackages) {
        // 4. 判定是否需要覆蓋安裝
        if ((installFlags & PackageManager.INSTALL_REPLACE_EXISTING) != 0) {
            ... // 如果待安裝的APK已經存在，則會將replace變數設定為true，表示需要覆蓋安裝
        }

        // 5. 如果Settings中已經記錄了待安裝的APK資訊，需要驗證APK的簽名
        PackageSetting ps = mSettings.mPackages.get(pkgName);
        if (ps != null) {
            ...
        }

        // 6. 檢查待安裝的APK是否有定義新的許可權
        int N = pkg.permissions.size();
        for (int i = N-1; i >= 0; i--) {
            ...
        }
        ...
    }

    // 7. 將之前的臨時檔名vmdl239812321.tmp重名為正式的名字
    if (!args.doRename(res.returnCode, pkg, oldCodePath)) {
        ...
    }
    // 8. 通過PackageHandler發起START_INTENT_FILTER_VERIFICATIONS訊息
    startIntentFilterVerifications(args.user.getIdentifier(), replace, pkg);
    // 9. 替換升級或者安裝一個新的APK
    if (replace) {
        replacePackageLI(pkg, parseFlags, scanFlags | SCAN_REPLACING, args.user,
                installerPackageName, volumeUuid, res);
    } else {
        installNewPackageLI(pkg, parseFlags, scanFlags | SCAN_DELETE_DATA_ON_FAILURES,
                args.user, installerPackageName, volumeUuid, res);
    }
    // 10. 更新APK的所屬使用者
    synchronized (mPackages) {
        final PackageSetting ps = mSettings.mPackages.get(pkgName);
        if (ps != null) {
            res.newUsers = ps.queryInstalledUsers(sUserManager.getUserIds(), true);
        }
    }
}

private void installNewPackageLI(PackageParser.Package pkg, int parseFlags, int scanFlags,
        UserHandle user, String installerPackageName, String volumeUuid,
        PackageInstalledInfo res) {
    ...
    // 判斷是否存在APK的資料。如果一個APK不是經過正常的解除安裝流程，那其歷史資料是可能還保留下來的
    final boolean dataDirExists = Environment
            .getDataUserPackageDirectory(volumeUuid, UserHandle.USER_OWNER, pkgName).exists();
    ...
    try {
        // APK掃描
        PackageParser.Package newPackage = scanPackageLI(pkg, parseFlags, scanFlags,
                System.currentTimeMillis(), user);
        // 更新PMS的Settings
        updateSettingsLI(newPackage, installerPackageName, volumeUuid, null, null, res, user);
        if (res.returnCode != PackageManager.INSTALL_SUCCEEDED) {
            // 如果安裝失敗，則需要刪除APK的資料目錄
            deletePackageLI(pkgName, UserHandle.ALL, false, null, null,
                    dataDirExists ? PackageManager.DELETE_KEEP_DATA : 0,
                            res.removedInfo, true);
        }
    } catch (PackageManagerException e) {...}
}