1 App

应用代码一般在开发者的项目目录下，packages/apps/YourApp/，比如app/src/main/java目录下

对于系统应用，源代码可能位于packages/apps/目录下，例如packages/apps/Settings。

用户安装的应用（从Google Play或其他来源安装的APK）位于设备的/data/app/目录

系统应用（预装应用）位于/system/app/或/system/priv-app/目录

应用在Dalvik或ART虚拟机上运行

直接使用Framework服务

import android.myframeworkservice.IMyFrameworkService;
import android.os.ServiceManager;
import android.os.RemoteException;public class MyActivity extends Activity {private IMyFrameworkService mFrameworkService;@Overrideprotected void onCreate(Bundle savedInstanceState) {super.onCreate(savedInstanceState);setContentView(R.layout.activity_main);mFrameworkService = IMyFrameworkService.Stub.asInterface(ServiceManager.getService("myframeworkservice"));if (mFrameworkService != null) {try {mFrameworkService.myFrameworkMethod();} catch (RemoteException e) {e.printStackTrace();}}}
}

2 Framework层

Framework服务的源代码主要位于frameworks/base/services/目录

Framework服务的代码编译后成为framework.jar和其他相关JAR文件，位于设备的/system/framework/目录

Framework服务在system_server进程中运行。system_server是由Zygote进程启动的，它包含了大部分系统服务，如ActivityManagerService、PackageManagerService等。

首先增加aidl

// IMyFrameworkService.aidl
package android.myframeworkservice;interface IMyFrameworkService {void myFrameworkMethod();
}

用Java实现

// MyFrameworkService.java
package com.android.server;import android.content.Context;
import android.hardware.myhal.IMyHalService;
import android.os.IBinder;
import android.os.RemoteException;
import android.util.Slog;
import android.myframeworkservice.IMyFrameworkService;
import android.os.ServiceManager;public class MyFrameworkService extends IMyFrameworkService.Stub {private static final String TAG = "MyFrameworkService";private final Context mContext;private final IMyHalService mHalService;public MyFrameworkService(Context context) {mContext = context;mHalService = IMyHalService.Stub.asInterface(ServiceManager.getService("myhalservice"));}@Overridepublic void myFrameworkMethod() throws RemoteException {if (mHalService != null) {mHalService.myHalMethod();} else {Slog.e(TAG, "HAL service not available");}}
}

在system manager中注册

import com.android.server.MyFrameworkService;public class SystemServer {// Existing code...private void startOtherServices() {// Existing code...try {Slog.i("SystemServer", "MyFrameworkService");ServiceManager.addService("myframeworkservice", new MyFrameworkService(context));} catch (Throwable e) {reportWtf("starting MyFrameworkService", e);}// Existing code...}// Existing code...
}

3 HAL层

HAL服务的源代码通常位于hardware/interfaces/或vendor/目录

HAL模块通常以共享库（.so文件）的形式存在，位于/vendor/lib/hw/或/system/lib/hw/目录中。

定义服务

package android.hardware.myhal;interface IMyHalService {void myHalMethod();
}

实现HAL服务，用C++

// MyHalService.cpp
#include <android/hardware/myhal/IMyHalService.h>
#include <hidl/LegacySupport.h>
#include <log/log.h>using android::hardware::myhal::V1_0::IMyHalService;
using android::hardware::configureRpcThreadpool;
using android::hardware::joinRpcThreadpool;
using android::sp;struct MyHalService : public IMyHalService {Return<void> myHalMethod() override {ALOGI("myHalMethod called");return Void();}
};int main() {configureRpcThreadpool(1, true /*callerWillJoin*/);android::sp<IMyHalService> service = new MyHalService();if (service->registerAsService() != android::OK) {ALOGE("Failed to register MyHalService");return 1;}joinRpcThreadpool();return 0;
}

其实HAL也可以不封成AIDL。直接使用JNI，貌似也是可以的，各有利弊。