lspd holds a global monitor for ~15 s during boot, causing 15+ app processes to miss AMS's 10 s start timeout #1050

Steps to reproduce/复现步骤

Android 11 device with LSPosed 7912 + Zygisk Next, several Xposed modules installed (list below).
2. Reboot, then 20–40 s after boot run:

adb shell logcat -b all | grep -E "failed to attach|start timeout"

3. Every boot produces a batch of 15–16 lines like:

   W ActivityManager: Process ProcessRecord{... 3000:com.miui.miwallpaper.snowmountain:snowmountainSuperWallpaper/u0a292} failed to attach
   I ActivityManager: Killing 3000:...:snowmountainSuperWallpaper/u0a292 (adj -10000): start timeout
   

   Each kill happens exactly 10.0 s after the corresponding Start proc.
4. dumpsys activity exit-info (persists across reboots) confirms:

   reason      = 7 (INITIALIZATION FAILURE)
   description = start timeout
   

5. Reproduced on every recorded boot (8 boots between 2026-10-06 and 2026-10-17). Disabling the Vector module (Magisk disable flag) → 0 occurrences, boot to screen 19.8 s instead of 34–38 s.

Expected behaviour/预期行为

Processes started by AMS during boot should attach within the 10 s window. The Xposed daemon's own initialization should not block application process startup.

Actual behaviour/实际行为

During boot, lspd's Thread-2 holds a global monitor for 15.335 s. The zygote-side hook has to talk to ILSPApplicationService for every process it forks (a 1389 ms sample of exactly that call was recorded in an earlier boot: binder_sample: [org.lsposed.lspd.service.ILSPApplicationService,1,1389,zygote64,100]), so the processes forked in this window all block past AMS's 10 s PROC_START_TIMEOUT and get SIGKILLed.

/data/adb/lspd/log/verbose_*.log (one boot):

[18:00:37.808  1921: 1921 W/ServiceManager   ] Waited one second for package
[18:00:38.809  1921: 1921 W/ServiceManager   ] Waited one second for package
[18:00:39.809  1921: 1921 W/ServiceManager   ] Waited one second for package
[18:00:40.810  1921: 1921 W/ServiceManager   ] Waited one second for package
[18:00:41.124  1921: 1921 I/LSPosed          ] dex2oat mode: bind mount
[18:00:41.409  1921: 1921 I/LSPosed          ] mount dex2oat /apex/com.android.art/bin/dex2oat32
[18:00:44.762  2921: 2921 I/zn-zygisk-companion32] spawning companion for zygisk_lsposed
                     ← 15.4 s with no log output at all →
[18:01:00.206  1921: 2014 I/LSPosedService   ] manager is not installed
[18:01:00.206  1921: 2193 W/lspd             ] Long monitor contention with owner Thread-2 (2014)
                                               at void j7.a()(...) waiters=0 in void j7.b() for 15.335s

AMS side, same boot:

18:00:45.033 I ActivityManager: Start proc 3000:...:snowmountainSuperWallpaper ...
18:00:55.034 I ActivityManager: Killing 3000 ... start timeout        ← exactly 10.0 s later
18:01:01.532 I boot_progress_enable_screen: 33887

Affected processes per boot (15–16): com.android.bluetooth, com.android.systemui, com.miui.home,
com.android.phone, org.codeaurora.ims, com.android.se, .qtidataservices ×2,
com.xiaomi.finddevice, com.qualcomm.qti.*, com.android.settings:remote,
com.google.android.ext.services, and the MIUI super-wallpaper WallpaperService
(user-visible symptom: wallpaper stays black until it is re-applied manually).

It is not caused by any Xposed module. In a boot where no module was scoped to system,
system_server logged [framework,Native] skipped system server, /proc/<system_server>/maps
had 0 hits for any module, and the Xposed module log contained no (system)[...] lines —
yet the same 16-process batch still occurred.

Measured comparison (same device/ROM, only the Vector side changed):

Xposed Module List/Xposed 模块列表

| module | version | enabled | scope |
|---|---|---|---|
| com.tsng.hidemyapplist (HMA) | 3.8.3.r520.9605640 | yes | system |
| io.github.chimio.inxlocker | 1.6 | yes | system |
| com.coderstory.toolkit | 4.9 | no | system |
| top.hookvip.pro | 4.1.7 | yes | apps |
| io.github.jhl337.qqhook | 1.4 | yes | apps |
| io.github.qauxv | 1.6.1.r3000.5310e4c | yes | apps |
| lin.xposed | 0.8.2 | yes | apps |
| io.github.yangyiyu08.taplusext | 1.1.8 | yes | apps |
| com.install.appinstall.xl | 2.1.55 | no | — |
| icu.freedomIntrovert.biliSendCommAntifraud | 6.3.5 | yes | apps |
| cn.wankkoree.xp.portrait2landscape | v2.0.13.293b2bd | yes | apps |
| com.jiguro.bettervia | 2.2.1 | yes | apps |
| me.yxp.qfun | 1.3.4 | yes | apps |

(The problem also reproduces with **all** of these disabled for `system` scope, see above.)

Root implementation/Root 方案

Magisk Alpha 31000

System Module List/系统模块列表

| module | version |
|---|---|
| zygisk_lsposed (Vector) | v2.2.1 (7912) |
| zygisksu (Zygisk Next) | 1.5.0 (843-5217106-release) |
| playintegrityfix (Play Integrity Fork) | v18 |
| tricky_store | v1.4.1 (245-72b2e84-release) |
| data_mountopt_fix | 1.0 |
| raphael_proximity_fix | v1.1.0 |
| vpn_guard | v1.0 |
| miwallpaper_repair | v1.1 |
| zn_magisk_compat | generated (disabled) |

Vector version/Vector 版本

7912

Android version/Android 版本

Android 11 (SDK 30), MIUI V12.5.6.0.RFKCNXM (official Xiaomi ROM, not AOSP/custom),

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

Vector-logs-2026-10-31.zip