1 App

應用代碼一般在開發者的項目目錄下，packages/apps/YourApp/，比如app/src/main/java目錄下

對于系統應用，源代碼可能位于packages/apps/目錄下，例如packages/apps/Settings。

用戶安裝的應用（從Google Play或其他來源安裝的APK）位于設備的/data/app/目錄

系統應用（預裝應用）位于/system/app/或/system/priv-app/目錄

應用在Dalvik或ART虛擬機上運行

直接使用Framework服務

import android.myframeworkservice.IMyFrameworkService;
import android.os.ServiceManager;
import android.os.RemoteException;public class MyActivity extends Activity {private IMyFrameworkService mFrameworkService;@Overrideprotected void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);setContentView(R.layout.activity_main);mFrameworkService = IMyFrameworkService.Stub.asInterface(ServiceManager.getService("myframeworkservice"));if (mFrameworkService != null) {try {mFrameworkService.myFrameworkMethod();} catch (RemoteException e) {e.printStackTrace();}}}
}

2 Framework層

Framework服務的源代碼主要位于frameworks/base/services/目錄

Framework服務的代碼編譯后成為framework.jar和其他相關JAR文件，位于設備的/system/framework/目錄

Framework服務在system_server進程中運行。system_server是由Zygote進程啟動的，它包含了大部分系統服務，如ActivityManagerService、PackageManagerService等。

首先增加aidl

// IMyFrameworkService.aidl
package android.myframeworkservice;interface IMyFrameworkService {void myFrameworkMethod();
}

用Java實現

// MyFrameworkService.java
package com.android.server;import android.content.Context;
import android.hardware.myhal.IMyHalService;
import android.os.IBinder;
import android.os.RemoteException;
import android.util.Slog;
import android.myframeworkservice.IMyFrameworkService;
import android.os.ServiceManager;public class MyFrameworkService extends IMyFrameworkService.Stub {private static final String TAG = "MyFrameworkService";private final Context mContext;private final IMyHalService mHalService;public MyFrameworkService(Context context) {mContext = context;mHalService = IMyHalService.Stub.asInterface(ServiceManager.getService("myhalservice"));}@Overridepublic void myFrameworkMethod() throws RemoteException {if (mHalService != null) {mHalService.myHalMethod();} else {Slog.e(TAG, "HAL service not available");}}
}

在system manager中注冊

import com.android.server.MyFrameworkService;public class SystemServer {// Existing code...private void startOtherServices() {// Existing code...try {Slog.i("SystemServer", "MyFrameworkService");ServiceManager.addService("myframeworkservice", new MyFrameworkService(context));} catch (Throwable e) {reportWtf("starting MyFrameworkService", e);}// Existing code...}// Existing code...
}

3 HAL層

HAL服務的源代碼通常位于hardware/interfaces/或vendor/目錄

HAL模塊通常以共享庫（.so文件）的形式存在，位于/vendor/lib/hw/或/system/lib/hw/目錄中。

定義服務

package android.hardware.myhal;interface IMyHalService {void myHalMethod();
}

實現HAL服務，用C++

// MyHalService.cpp
#include <android/hardware/myhal/IMyHalService.h>
#include <hidl/LegacySupport.h>
#include <log/log.h>using android::hardware::myhal::V1_0::IMyHalService;
using android::hardware::configureRpcThreadpool;
using android::hardware::joinRpcThreadpool;
using android::sp;struct MyHalService : public IMyHalService {Return<void> myHalMethod() override {ALOGI("myHalMethod called");return Void();}
};int main() {configureRpcThreadpool(1, true /*callerWillJoin*/);android::sp<IMyHalService> service = new MyHalService();if (service->registerAsService() != android::OK) {ALOGE("Failed to register MyHalService");return 1;}joinRpcThreadpool();return 0;
}

其實HAL也可以不封成AIDL。直接使用JNI，貌似也是可以的，各有利弊。