前言

淘宝团队找到小米的三方团队来反馈一个问题，说只有在小米手机上会复现无法执行手淘的收藏功能的问题；经过手淘的加log调查，基本确认是bindService无法调起一个叫FavGoodService的服务，需要小米调查下原因；然后三方团队过来找AMS相关的人一起调研下

初步分析

一开始想的是绝对不可能是小米的问题啊，小米如何定制化都不能让一个服务起不来啊；但是淘宝说只有小米反馈了这个问题，因此就只能结合内部日志开看这个问题；

这一看，发现淘宝的服务问题很大啊，不只是FavGoodService这一个服务的问题

03-01 12:49:59.680 1000 1504 3613 W ActivityManager: Unable to start service Intent { act=com.taobao.dai.DAI_SERVICE pkg=com.taobao.taobao } U=0: not found

03-01 12:49:59.869 1000 1504 4477 W ActivityManager: Unable to start service Intent { act=mtopsdk.xstate.aidl.IXState cat=[android.intent.category.DEFAULT] pkg=com.taobao.taobao cmp=com.taobao.taobao/mtopsdk.xstate.XStateService } U=0: not found

03-01 12:50:00.253 1000 1504 4477 W ActivityManager: Unable to start service Intent { act=anetwork.channel.aidl.IRemoteNetworkGetter cat=[android.intent.category.DEFAULT] cmp=com.taobao.taobao/anetwork.channel.aidl.NetworkService } U=0: not found

03-01 12:50:09.663 1000 1504 3584 W ActivityManager: Unable to start service Intent { cmp=com.taobao.taobao/com.alibaba.analytics.AnalyticsService } U=0: not found

03-01 12:50:11.561 1000 1504 6898 W ActivityManager: Unable to start service Intent { act=com.taobao.accs.intent.action.RECEIVE pkg=com.taobao.taobao cmp=com.taobao.taobao/com.taobao.accs.data.MsgDistributeService (has extras) } U=0: not found

那么就需要结合fw代码来看这个问题了

报错的地方在ServiceLookupResult里面

  private ServiceLookupResult retrieveServiceLocked(Intent service,
            String resolvedType, String callingPackage, int callingPid, int callingUid, int userId,
            boolean createIfNeeded, boolean callingFromFg, boolean isBindExternal,
            boolean allowInstant) {
        ServiceRecord r = null;
        if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "retrieveServiceLocked: " + service
                + " type=" + resolvedType + " callingUid=" + callingUid);

        userId = mAm.mUserController.handleIncomingUser(callingPid, callingUid, userId, false,
                ActivityManagerService.ALLOW_NON_FULL_IN_PROFILE, "service", null);

        ServiceMap smap = getServiceMapLocked(userId);
        final ComponentName comp = service.getComponent();
        if (comp != null) {
            r = smap.mServicesByName.get(comp);
            if (DEBUG_SERVICE && r != null) Slog.v(TAG_SERVICE, "Retrieved by component: " + r);
        }
        if (r == null && !isBindExternal) {
            Intent.FilterComparison filter = new Intent.FilterComparison(service);
            r = smap.mServicesByIntent.get(filter);
            if (DEBUG_SERVICE && r != null) Slog.v(TAG_SERVICE, "Retrieved by intent: " + r);
        }
        if (r != null && (r.serviceInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0
                && !callingPackage.equals(r.packageName)) {
            // If an external service is running within its own package, other packages
            // should not bind to that instance.
            r = null;
            if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Whoops, can't use existing external service");
        }
        if (r == null) {
            try {
                int flags = ActivityManagerService.STOCK_PM_FLAGS
                        | PackageManager.MATCH_DEBUG_TRIAGED_MISSING;
                if (allowInstant) {
                    flags |= PackageManager.MATCH_INSTANT;
                }
                // TODO: come back and remove this assumption to triage all services
                ResolveInfo rInfo = mAm.getPackageManagerInternalLocked().resolveService(service,
                        resolvedType, flags, userId, callingUid);
                ServiceInfo sInfo =
                    rInfo != null ? rInfo.serviceInfo : null;
                if (sInfo == null) { //在这里会打出上面的log
                    Slog.w(TAG_SERVICE, "Unable to start service " + service + " U=" + userId +
                          ": not found");
                    return null;
                }
                ComponentName name = new ComponentName(
                        sInfo.applicationInfo.packageName, sInfo.name);
                if ((sInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0) {
                    if (isBindExternal) {
                        if (!sInfo.exported) {
                            throw new SecurityException("BIND_EXTERNAL_SERVICE failed, " + name +
                                    " is not exported");
                        }
                        if ((sInfo.flags & ServiceInfo.FLAG_ISOLATED_PROCESS) == 0) {
                            throw new SecurityException("BIND_EXTERNAL_SERVICE failed, " + name +
                                    " is not an isolatedProcess");
                        }
                        // Run the service under the calling package's application.
                        ApplicationInfo aInfo = AppGlobals.getPackageManager().getApplicationInfo(
                                callingPackage, ActivityManagerService.STOCK_PM_FLAGS, userId);
                        if (aInfo == null) {
                            throw new SecurityException("BIND_EXTERNAL_SERVICE failed, " +
                                    "could not resolve client package " + callingPackage);
                        }
                        sInfo = new ServiceInfo(sInfo);
                        sInfo.applicationInfo = new ApplicationInfo(sInfo.applicationInfo);
                        sInfo.applicationInfo.packageName = aInfo.packageName;
                        sInfo.applicationInfo.uid = aInfo.uid;
                        name = new ComponentName(aInfo.packageName, name.getClassName());
                        service.setComponent(name);
                    } else {
                        throw new SecurityException("BIND_EXTERNAL_SERVICE required for " +
                                name);
                    }
                } else if (isBindExternal) {
                    throw new SecurityException("BIND_EXTERNAL_SERVICE failed, " + name +
                            " is not an externalService");
                }
                if (userId > 0) {
                    if (mAm.isSingleton(sInfo.processName, sInfo.applicationInfo,
                            sInfo.name, sInfo.flags)
                            && mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) {
                        userId = 0;
                        smap = getServiceMapLocked(0);
                    }
                    sInfo = new ServiceInfo(sInfo);
                    sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId);
                }
                r = smap.mServicesByName.get(name);
                if (DEBUG_SERVICE && r != null) Slog.v(TAG_SERVICE,
                        "Retrieved via pm by intent: " + r);
                if (r == null && createIfNeeded) {
                    final Intent.FilterComparison filter
                            = new Intent.FilterComparison(service.cloneFilter());
                    final ServiceRestarter res = new ServiceRestarter();
                    final BatteryStatsImpl.Uid.Pkg.Serv ss;
                    final BatteryStatsImpl stats = mAm.mBatteryStatsService.getActiveStatistics();
                    synchronized (stats) {
                        ss = stats.getServiceStatsLocked(
                                sInfo.applicationInfo.uid, sInfo.packageName,
                                sInfo.name);
                    }
                    r = new ServiceRecord(mAm, ss, name, filter, sInfo, callingFromFg, res);
                    res.setService(r);
                    smap.mServicesByName.put(name, r);
                    smap.mServicesByIntent.put(filter, r);

                    // Make sure this component isn't in the pending list.
                    for (int i=mPendingServices.size()-1; i>=0; i--) {
                        final ServiceRecord pr = mPendingServices.get(i);
                        if (pr.serviceInfo.applicationInfo.uid == sInfo.applicationInfo.uid
                                && pr.name.equals(name)) {
                            if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Remove pending: " + pr);
                            mPendingServices.remove(i);
                        }
                    }
                    if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Retrieve created new service: " + r);
                }
            } catch (RemoteException ex) {
                // pm is in same process, this will never happen.
            }
        }
        if (r != null) {
          ...//下面是非第一次启动的逻辑，与我们这里关系不大
       }
    }

会打出上面的log，说明第一次启动服务时PMS没有找到对应的服务；但看了下相应的机器，服务明明已经在manifest的服务里面了，那么是怎么回事呢，只能看解析流程；即

ResolveInfo rInfo = mAm.getPackageManagerInternalLocked().resolveService(service,

resolvedType, flags, userId, callingUid);

最终会调用到PMS的resolveService

@Override
public ResolveInfo resolveService(Intent intent, String resolvedType, int flags, int userId) {
    final int callingUid = Binder.getCallingUid();
    return resolveServiceInternal(intent, resolvedType, flags, userId, callingUid);
}

private ResolveInfo resolveServiceInternal(Intent intent, String resolvedType, int flags,
        int userId, int callingUid) {
    if (!sUserManager.exists(userId)) return null;
    flags = updateFlagsForResolve(
            flags, userId, intent, callingUid, false /*includeInstantApps*/);
    List<ResolveInfo> query = queryIntentServicesInternal(
            intent, resolvedType, flags, userId, callingUid, false /*includeInstantApps*/);
    if (query != null) {
        if (query.size() >= 1) {
            // If there is more than one service with the same priority,
            // just arbitrarily pick the first one.
            return query.get(0);
        }
    }
    return null;
}

    private @NonNull List<ResolveInfo> queryIntentServicesInternal(Intent intent,
            String resolvedType, int flags, int userId, int callingUid,
            boolean includeInstantApps) {
        if (!sUserManager.exists(userId)) return Collections.emptyList();
        mPermissionManager.enforceCrossUserPermission(callingUid, userId,
                false /*requireFullPermission*/, false /*checkShell*/,
                "query intent receivers");
        final String instantAppPkgName = getInstantAppPackageName(callingUid);
        flags = updateFlagsForResolve(flags, userId, intent, callingUid, includeInstantApps);
        ComponentName comp = intent.getComponent();
        if (comp == null) {
            if (intent.getSelector() != null) {
                intent = intent.getSelector();
                comp = intent.getComponent();
            }
        }
        //前面都是一些权限检查，不会有问题的，关键看getServiceInfo
        if (comp != null) {
            final List<ResolveInfo> list = new ArrayList<ResolveInfo>(1);
            final ServiceInfo si = getServiceInfo(comp, flags, userId);
            if (si != null) {
                // When specifying an explicit component, we prevent the service from being
                // used when either 1) the service is in an instant application and the
                // caller is not the same instant application or 2) the calling package is
                // ephemeral and the activity is not visible to ephemeral applications.
                final boolean matchInstantApp =
                        (flags & PackageManager.MATCH_INSTANT) != 0;
                final boolean matchVisibleToInstantAppOnly =
                        (flags & PackageManager.MATCH_VISIBLE_TO_INSTANT_APP_ONLY) != 0;
                final boolean isCallerInstantApp =
                        instantAppPkgName != null;
                final boolean isTargetSameInstantApp =
                        comp.getPackageName().equals(instantAppPkgName);
                final boolean isTargetInstantApp =
                        (si.applicationInfo.privateFlags
                                & ApplicationInfo.PRIVATE_FLAG_INSTANT) != 0;
                final boolean isTargetHiddenFromInstantApp =
                        (si.flags & ServiceInfo.FLAG_VISIBLE_TO_INSTANT_APP) == 0;
                final boolean blockResolution =
                        !isTargetSameInstantApp
                        && ((!matchInstantApp && !isCallerInstantApp && isTargetInstantApp)
                                || (matchVisibleToInstantAppOnly && isCallerInstantApp
                                        && isTargetHiddenFromInstantApp));
                if (!blockResolution) {
                    final ResolveInfo ri = new ResolveInfo();
                    ri.serviceInfo = si;
                    list.add(ri);
                }
            }
            return list;
        }

        // reader
        synchronized (mPackages) {
            String pkgName = intent.getPackage();
            if (pkgName == null) {
                return applyPostServiceResolutionFilter(
                        mServices.queryIntent(intent, resolvedType, flags, userId),
                        instantAppPkgName);
            }
            final PackageParser.Package pkg = mPackages.get(pkgName);
            if (pkg != null) {
                return applyPostServiceResolutionFilter(
                        mServices.queryIntentForPackage(intent, resolvedType, flags, pkg.services,
                                userId),
                        instantAppPkgName);
            }
            return Collections.emptyList();
        }
    }

    @Override
    public ServiceInfo getServiceInfo(ComponentName component, int flags, int userId) {
        if (!sUserManager.exists(userId)) return null;
        final int callingUid = Binder.getCallingUid();
        flags = updateFlagsForComponent(flags, userId, component);
        mPermissionManager.enforceCrossUserPermission(callingUid, userId,
                false /* requireFullPermission */, false /* checkShell */, "get service info");
        synchronized (mPackages) {
            PackageParser.Service s = mServices.mServices.get(component);
            if (DEBUG_PACKAGE_INFO) Log.v(
                TAG, "getServiceInfo " + component + ": " + s);
            if (s != null && mSettings.isEnabledAndMatchLPr(s.info, flags, userId)) {
                PackageSetting ps = mSettings.mPackages.get(component.getPackageName());
                if (ps == null) return null;
                if (filterAppAccessLPr(ps, callingUid, component, TYPE_SERVICE, userId)) {
                    return null;
                }
                return PackageParser.generateServiceInfo(
                        s, flags, ps.readUserState(userId), userId);
            }
        }
        return null;
    }

可以看到关键点在isEnabledAndMatchLPr，如果这里返回false，那么就会直接返回null

然后调用到pm相关数据结构Settings里面的函数isEnabledAndMatchLPr

boolean isEnabledAndMatchLPr(ComponentInfo componentInfo, int flags, int userId) {
    final PackageSetting ps = mPackages.get(componentInfo.packageName);
    if (ps == null) return false;

    final PackageUserState userState = ps.readUserState(userId);
    return userState.isMatch(componentInfo, flags);
}

可以看到userState.isMatch(componentInfo, flags);决定了返回值

PackageUserState

   /**
     * Test if the given component is considered installed, enabled and a match
     * for the given flags.
     *
     * <p>
     * Expects at least one of {@link PackageManager#MATCH_DIRECT_BOOT_AWARE} and
     * {@link PackageManager#MATCH_DIRECT_BOOT_UNAWARE} are specified in {@code flags}.
     * </p>
     */
    public boolean isMatch(ComponentInfo componentInfo, int flags) {
        final boolean isSystemApp = componentInfo.applicationInfo.isSystemApp();
        final boolean matchUninstalled = (flags & PackageManager.MATCH_KNOWN_PACKAGES) != 0;
        if (!isAvailable(flags)
                && !(isSystemApp && matchUninstalled)) return false;
        if (!isEnabled(componentInfo, flags)) return false;

        if ((flags & MATCH_SYSTEM_ONLY) != 0) {
            if (!isSystemApp) {
                return false;
            }
        }

        final boolean matchesUnaware = ((flags & MATCH_DIRECT_BOOT_UNAWARE) != 0)
                && !componentInfo.directBootAware;
        final boolean matchesAware = ((flags & MATCH_DIRECT_BOOT_AWARE) != 0)
                && componentInfo.directBootAware;
        return matchesUnaware || matchesAware;
    }

最有可能返回false的地方isEnabled(componentInfo, flags)

/**
 * Test if the given component is considered enabled.
 */
public boolean isEnabled(ComponentInfo componentInfo, int flags) {
    if ((flags & MATCH_DISABLED_COMPONENTS) != 0) {
        return true;
    }

    // First check if the overall package is disabled; if the package is
    // enabled then fall through to check specific component
    switch (this.enabled) {
        case COMPONENT_ENABLED_STATE_DISABLED:
        case COMPONENT_ENABLED_STATE_DISABLED_USER:
            return false;
        case COMPONENT_ENABLED_STATE_DISABLED_UNTIL_USED:
            if ((flags & MATCH_DISABLED_UNTIL_USED_COMPONENTS) == 0) {
                return false;
            }
        case COMPONENT_ENABLED_STATE_DEFAULT:
            if (!componentInfo.applicationInfo.enabled) {
                return false;
            }
        case COMPONENT_ENABLED_STATE_ENABLED:
            break;
    }

    // Check if component has explicit state before falling through to
    // the manifest default
    if (ArrayUtils.contains(this.enabledComponents, componentInfo.name)) {
        return true;
    }
    if (ArrayUtils.contains(this.disabledComponents, componentInfo.name)) {
        return false;
    }

    return componentInfo.enabled;
}

然后我们看一下相应package的dump信息，可以发现

disabledComponents:

com.laiwang.protocol.android.LWPService

com.taobao.activelocation.service.aidl.TBLocationServiceImpl

com.taobao.activelocation.report.service.ActiveReportService

com.taobao.acds.compact.ACDSBusinessService

com.taobao.accs.EventReceiver

com.taobao.taobao.TaobaoIntentService

com.taobao.agoo.AgooCommondReceiver

com.taobao.passivelocation.aidl.PassiveLocationServiceImpl

com.taobao.passivelocation.report.service.LocationReportService

com.taobao.accs.data.MsgDistributeService

com.taobao.wireless.bcportserver.PortServerReceiver

com.laiwang.protocol.android.LwpAccsService

anetwork.channel.aidl.NetworkService

com.xiaomi.push.service.XMPushService

com.alibaba.analytics.AnalyticsService

com.amap.api.location.APSService

com.taobao.favorites.service.FavGoodService

com.taobao.wireless.bcportserver.PortsService

com.taobao.alivfssdk.monitor.AVFSMonitorService

org.android.agoo.accs.AgooService

mtopsdk.xstate.XStateService

com.taobao.passivelocation.gathering.service.LocationGatheringService

com.taobao.orange.service.OrangeApiService

androidx.work.impl.background.systemalarm.SystemAlarmService

com.taobao.accs.internal.AccsJobService

com.taobao.acds.compact.AccsACDSService

com.taobao.accs.ServiceReceiver

enabledComponents:

com.taobao.accs.ChannelService

androidx.work.impl.background.systemjob.SystemJobService

淘宝很多的Service，Receiver组件被disable掉了，所以自然无法找到，也启动不了

直到这里，终于确认了无法启动Service的原因，组件被disable；但是只能到这一步了，因为从log里根本无法看出是什么原因被disable的

问题确认

被disable有三种可能

1.小米安全中心disable

2.用户root

3.淘宝自己disable

问了下安全中心的同事，原来有disable app的功能，后来也删了；且disable app的表现形式不是如上的log，故排除；而用户提供的bugreport里面没有root的属性，因此也不是root导致的；那么只能怀疑淘宝自己调用了相关接口,setComponentEnabledSetting；淘宝查了下，说没有会调这里的地方；至此，似乎没有办法继续查下去了；

感谢三方的同事，看了多份log之后，发现了一个规律；用户bugreport里面的淘宝都是从预装版本上升级上来的，会不会是预装版本的问题？

试一下，点开预装版本，从应用商店升级，果然复现了；知道复现路径就好办了，赶紧调试一下；我们在PMS的setComponentEnabledSetting处加上条件断点(startWith("com.taobao"))；奇怪，断不住，难道还有其他接口？ 全局查一下代码，不会有其他接口；那么怎么会断不住呢；

经过多次复现，找规律，终于找到了复现路径；从预装版本一点开就会disable，挂上了，调试结果如图：

taobao_调试结果1.png taobao_调试结果2.png taobao_调试结果3.png taobao_调试结果4.png

对端进程是淘宝，还是淘宝调用的；淘宝的调用栈(kill -3)是

taobao_调试结果5.png

果然与预装应用有关；

猜测一种情况是这样的，在预装版本上有这样一个逻辑，点淘宝时先将一些Service disable；然后用户点同意的时候再重新enable；但是有可能用户点开了第一个界面，没有点同步，直接回到桌面；然后后面想起来用的时候从应用商店升级到最新版本，但是该版本没有预装版本的逻辑了，所以用户没有点同意的机会了；disable的服务就一直保留了下来；复现条件比较苛刻，这也解释了概率不高的原因；

经过和淘宝的再次沟通，果然如此，这是淘宝正式版本和预装版本的逻辑不能完美自恰导致的问题；淘宝团队反映会在下一个版本修复；也总算为小米甩出一个锅；

总结

1.原来没有意识到disableComponents会在Service的查找启动阶段就会起作用，以后又了解多了一种服务起不来的可能性；

2.这个问题本身原因不复杂，但调查过程有点曲折，且不属于小米定制化错误导致的问题，因此记录下；