Android 已經(jīng)從一個(gè)僅能運(yùn)行應(yīng)用的平臺(tái)，演進(jìn)為能夠理解應(yīng)用行為的平臺(tái)。一系列端側(cè)智能服務(wù)將用戶意圖與應(yīng)用行為關(guān)聯(lián)起來：AppFunctions 框架允許助手通過強(qiáng)類型 RPC 契約調(diào)用應(yīng)用的任意功能；計(jì)算機(jī)控制（Computer Control）為 AI 代理提供虛擬顯示器，可在其上完成點(diǎn)擊、滑動(dòng)、截圖操作；OnDeviceIntelligence 在隔離沙箱中運(yùn)行大機(jī)器學(xué)習(xí)模型 —— 大語言模型以及其他生成式或大規(guī)模推理負(fù)載；NNAPI 向所有原生工作負(fù)載暴露硬件加速器。結(jié)合 AppSearch、內(nèi)容捕獲（Content Capture）、AdServices 以及聯(lián)邦學(xué)習(xí)，這些子系統(tǒng)共同構(gòu)成了 Android 的 AI 神經(jīng)體系。本章逐層梳理完整調(diào)用鏈路：從公開 SDK 類，經(jīng)由 AIDL 接口、system_server 服務(wù)實(shí)現(xiàn)，一直到另一端沙箱進(jìn)程或 HAL 進(jìn)程。每一條代碼路徑均對(duì)應(yīng)當(dāng)前 AOSP 源碼樹中的真實(shí)源文件。51.1 AOSP AI 全景概覽在深入任一框架細(xì)節(jié)之前，先整體瀏覽 AOSP 全部 AI/ML 相關(guān)組件。下圖列出主要子系統(tǒng)、跨進(jìn)程邊界以及組件之間的數(shù)據(jù)流。Mainline 模塊 HAL / 驅(qū)動(dòng)進(jìn)程 隔離 / 沙箱進(jìn)程 目標(biāo)應(yīng)用進(jìn)程 system_server 應(yīng)用進(jìn)程 Binder IPC bindService Binder IPC 隔離 bind 調(diào)用 Binder IPC Binder IPC Binder IPC Binder IPC Binder IPC第三方 / 系統(tǒng)應(yīng)用 AppFunctionManager OnDeviceIntelligenceManager NNAPI C API ComputerControlExtensions AppSearchManager TextClassifierManager ContentCaptureManager AppPredictionManager TopicsManagerAppFunctionManagerServiceImpl OnDeviceIntelligenceManagerService VirtualDeviceManager ComputerControlSession Service ContentCaptureManagerService TextClassificationManagerService AppPredictionManagerServiceAppFunctionService OnDeviceSandboxedInferenceService IsolatedTrainingService NNAPI HAL (IDevice) GPU / DSP / NPUAppSearch 模塊 NeuralNetworks 模塊 OnDevicePersonalization 模塊 AdServices 模塊51.1.1 AOSP 智能子系統(tǒng)分類表子系統(tǒng)API 等級(jí)是否 Mainline 模塊用途AppFunctions16（引入），Android 17 趨于成熟否（框架內(nèi)置）強(qiáng)類型跨應(yīng)用函數(shù)調(diào)用，支持運(yùn)行時(shí)注冊(cè)與狀態(tài)觀測(cè)Computer Control16（Android 16）否（框架 + 擴(kuò)展庫）基于虛擬顯示器實(shí)現(xiàn) AI 驅(qū)動(dòng)的 UI 自動(dòng)化OnDeviceIntelligence15 及以上NeuralNetworks 模塊沙箱化的大語言模型 / 機(jī)器學(xué)習(xí)推理NNAPI8.1 及以上NeuralNetworks 模塊神經(jīng)網(wǎng)絡(luò)推理硬件加速AppSearch12 及以上AppSearch 模塊端側(cè)全文檢索與索引Content Capture10 及以上否（框架內(nèi)置）為智能服務(wù)實(shí)時(shí)捕獲 UI 結(jié)構(gòu)TextClassifier8.0 及以上否（框架內(nèi)置）實(shí)體識(shí)別、語言檢測(cè)AppPrediction10 及以上否（框架內(nèi)置）基于使用行為的應(yīng)用排序OnDevicePersonalization14 及以上ODP 模塊聯(lián)邦計(jì)算、隔離訓(xùn)練AdServices13 及以上AdServices 模塊隱私保護(hù)廣告定向（Topics、FLEDGE）51.1.2 跨子系統(tǒng)通用設(shè)計(jì)思路所有 AI 子系統(tǒng)都復(fù)用若干架構(gòu)設(shè)計(jì)范式：進(jìn)程隔離智能服務(wù)運(yùn)行在隔離或沙箱進(jìn)程。OnDeviceSandboxedInferenceService設(shè)置android:isolatedProcess="true"。IsolatedTrainingService在獨(dú)立進(jìn)程加載 TFLite。即使 ComputerControlSession 也基于與主顯示器隔離的虛擬顯示器工作。優(yōu)先使用強(qiáng)類型契約，而非無約束 BundleAppFunctions 使用 AppSearch 提供的GenericDocument作為參數(shù)序列化格式。ODI 使用PersistableBundle承載特性與請(qǐng)求元數(shù)據(jù)。二者均鼓勵(lì) SDK 層封裝強(qiáng)類型包裝類。AppSearch 作為通用元數(shù)據(jù)存儲(chǔ)AppFunction 元數(shù)據(jù)、應(yīng)用預(yù)測(cè)數(shù)據(jù)、內(nèi)容捕獲智能數(shù)據(jù)，全部匯聚到 AppSearch 完成索引與檢索。權(quán)限管控 + 白名單機(jī)制AppFunctions 執(zhí)行受EXECUTE_APP_FUNCTIONS（或EXECUTE_APP_FUNCTIONS_SYSTEM）權(quán)限約束，同時(shí)配合平臺(tái)AllowlistManager維護(hù)簽名代理白名單。Computer Control 需要ACCESS_COMPUTER_CONTROL權(quán)限。ODI 需要USE_ON_DEVICE_INTELLIGENCE。AdServices 需要ACCESS_ADSERVICES_TOPICS。支持取消信號(hào)傳遞幾乎全部異步 API 都會(huì)跨 Binder 傳遞ICancellationSignal，調(diào)用方可終止長(zhǎng)時(shí)間推理或函數(shù)執(zhí)行。51.2 AppFunctions 框架AppFunctions 框架在 Android 16 以 Beta 特性面世，Android 17 正式廣泛可用。它提供一套標(biāo)準(zhǔn)化機(jī)制，讓 AI 助手（代理）可以發(fā)現(xiàn)并調(diào)用任意目標(biāo)應(yīng)用暴露的功能。例如助手收到指令 “把 XYZ 保存到我的筆記”，框架會(huì)將請(qǐng)求路由至對(duì)應(yīng)的AppFunctionService實(shí)現(xiàn)，助手無需在編譯期依賴筆記應(yīng)用。Android 17 對(duì)該框架做了大幅增強(qiáng)，不再局限于最初僅通過 Manifest 靜態(tài)聲明的模式。本章后續(xù)會(huì)詳細(xì)介紹以下核心新增能力：運(yùn)行時(shí)（動(dòng)態(tài)）函數(shù)注冊(cè)：應(yīng)用可在 Activity 或 Service 中運(yùn)行時(shí)注冊(cè) AppFunction 回調(diào)，不再必須聲明獨(dú)立AppFunctionService組件（registerAppFunction，受FLAG_ENABLE_DYNAMIC_APP_FUNCTIONS標(biāo)記控制）。完備的發(fā)現(xiàn)、狀態(tài)與觀測(cè) API，新增至AppFunctionManager：searchAppFunctions、getAppFunctionStates、getAppFunctionActivityStates、observeAppFunctions。訪問管理框架：維護(hù)（代理，目標(biāo)應(yīng)用）二元組訪問狀態(tài)與標(biāo)志位；提供面向用戶的管理 UI；代理白名單交由平臺(tái)AllowlistManager維護(hù)，不再使用 DeviceConfig 字符串。新增權(quán)限：DISCOVER_APP_FUNCTIONS（僅發(fā)現(xiàn)，不可執(zhí)行）、EXECUTE_APP_FUNCTIONS_SYSTEM（特權(quán)系統(tǒng)代理，繞過白名單校驗(yàn)），保留原有EXECUTE_APP_FUNCTIONS。Android 17 源碼目錄概覽：frameworks/base/core/java/android/app/appfunctions/ AppFunctionManager.java -- 客戶端系統(tǒng)服務(wù)入口 AppFunctionService.java -- 靜態(tài)目標(biāo)應(yīng)用抽象基類 AppFunction.java -- 運(yùn)行時(shí)函數(shù)回調(diào)接口 RegisterAppFunctionRequest.java -- 運(yùn)行時(shí)注冊(cè)請(qǐng)求Parcelable ExecuteAppFunctionRequest.java -- 執(zhí)行請(qǐng)求Parcelable ExecuteAppFunctionResponse.java -- 執(zhí)行響應(yīng)Parcelable AppFunctionException.java -- 分層異常錯(cuò)誤體系 AppFunctionMetadata.java -- 靜態(tài)+運(yùn)行時(shí)函數(shù)元數(shù)據(jù) AppFunctionName.java -- (包名,標(biāo)識(shí)符)函數(shù)唯一標(biāo)識(shí) AppFunctionState.java -- 運(yùn)行時(shí)啟用/可見狀態(tài) AppFunctionActivityId.java -- Activity作用域函數(shù)鍵值 AppFunctionSearchSpec.java -- 檢索查詢條件 AppFunctionObserver.java -- 變更觀測(cè)回調(diào) AppFunctionAccessServiceInterface.java -- 訪問校驗(yàn)本地服務(wù) IAppFunctionManager.aidl -- system_server AIDL接口 IAppFunctionService.aidl -- 靜態(tài)目標(biāo)應(yīng)用AIDL（oneway） IAppFunctionExecutor.aidl -- 動(dòng)態(tài)注冊(cè)執(zhí)行器AIDL IExecuteAppFunctionCallback.aidl -- 異步結(jié)果回調(diào)AIDL ICancellationCallback.aidl -- 取消信號(hào)傳輸AIDL ... frameworks/base/services/appfunctions/ java/com/android/server/appfunctions/ AppFunctionManagerService.java -- SystemService封裝 AppFunctionManagerServiceImpl.java -- IAppFunctionManager.Stub實(shí)現(xiàn) RemoteServiceCallerImpl.java -- Service綁定邏輯 CallerValidatorImpl.java -- 權(quán)限+白名單校驗(yàn) MetadataSyncAdapter.java -- AppSearch元數(shù)據(jù)同步 AppFunctionsLoggerWrapper.java -- statsd埋點(diǎn)日志 allowlist/SystemAppFunctionAllowlistReader.java -- AllowlistManager白名單讀取 dynamic/MultiUserDynamicAppFunctionRegistry.java -- 運(yùn)行時(shí)注冊(cè)管理 reader/AppFunctionMetadataReader.java -- 靜態(tài)/動(dòng)態(tài)元數(shù)據(jù)讀取 observer/AppFunctionMetadataObserver.java -- AppSearch變更觀測(cè)器 ... frameworks/base/services/permission/java/com/android/server/permission/access/appfunction/ AppFunctionAccessService.kt -- 持久化(代理,目標(biāo))訪問狀態(tài)51.2.1 架構(gòu)概覽51.2.2 客戶端：AppFunctionManagerAppFunctionManager以系統(tǒng)服務(wù)注冊(cè)，服務(wù)名稱Context.APP_FUNCTION_SERVICE。@FlaggedApi(FLAG_ENABLE_APP_FUNCTION_MANAGER) @SystemService(Context.APP_FUNCTION_SERVICE) public final class AppFunctionManager {核心 API 為executeAppFunction()，接收四個(gè)入?yún)?。Android17 要求調(diào)用方具備兩項(xiàng)執(zhí)行權(quán)限之一；應(yīng)用調(diào)用自身暴露的函數(shù)無需權(quán)限。@FlaggedApi(FLAG_ENABLE_APP_FUNCTION_PERMISSION_V2) @RequiresPermission( anyOf = { Manifest.permission.EXECUTE_APP_FUNCTIONS, Manifest.permission.EXECUTE_APP_FUNCTIONS_SYSTEM }, conditional = true) @UserHandleAware public void executeAppFunction( @NonNull ExecuteAppFunctionRequest request, @NonNull @CallbackExecutor Executor executor, @NonNull CancellationSignal cancellationSignal, @NonNull OutcomeReceiverExecuteAppFunctionResponse, AppFunctionException callback) {內(nèi)部實(shí)現(xiàn)會(huì)將上層請(qǐng)求封裝為ExecuteAppFunctionAidlRequest，補(bǔ)充調(diào)用者身份、時(shí)間戳信息。ExecuteAppFunctionAidlRequest aidlRequest = new ExecuteAppFunctionAidlRequest( request, mContext.getUser(), mContext.getPackageName(), /* requestTime= */ SystemClock.elapsedRealtime(), /* requestWallTime= */ System.currentTimeMillis());Binder 調(diào)用返回ICancellationSignal傳輸對(duì)象，綁定至客戶端CancellationSignal，實(shí)現(xiàn)跨進(jìn)程取消。ICancellationSignal cancellationTransport = mService.executeAppFunction( aidlRequest, new IExecuteAppFunctionCallback.Stub() { @Override public void onSuccess(ExecuteAppFunctionResponse result) { executor.execute(() - callback.onResult(result)); } @Override public void onError(AppFunctionException exception) { executor.execute(() - callback.onError(exception)); } }); if (cancellationTransport != null) { cancellationSignal.setRemote(cancellationTransport); }51.2.3 啟用狀態(tài)管理每個(gè) AppFunction 具備三態(tài)生命周期：常量數(shù)值含義APP_FUNCTION_STATE_DEFAULT0恢復(fù)默認(rèn)狀態(tài)（通常為啟用）APP_FUNCTION_STATE_ENABLED1顯式啟用APP_FUNCTION_STATE_DISABLED2顯式禁用應(yīng)用通過setAppFunctionEnabled()控制自身函數(shù)狀態(tài)。@UserHandleAware public void setAppFunctionEnabled( @NonNull String functionIdentifier, @EnabledState int newEnabledState, @NonNull Executor executor, @NonNull OutcomeReceiverVoid, Exception callback) {啟用狀態(tài)以AppFunctionRuntimeMetadata文檔持久化在 AppSearch，與描述函數(shù) Schema 的AppFunctionStaticMetadata相互獨(dú)立。setAppFunctionEnabled()僅對(duì)靜態(tài)AppFunctionService對(duì)應(yīng)的函數(shù)生效。通過registerAppFunction注冊(cè)的運(yùn)行時(shí)函數(shù)，生命周期與注冊(cè)會(huì)話綁定，啟用狀態(tài)由registerAppFunction/AppFunctionRegistration.unregister控制；對(duì)動(dòng)態(tài)函數(shù)調(diào)用本方法會(huì)拋出IllegalArgumentException。Android17 完整對(duì)外暴露運(yùn)行時(shí)狀態(tài)，不僅僅是啟用位。AppFunctionStateParcelable 包含AppFunctionName、啟用標(biāo)記、可見性；可通過AppFunctionManager.getAppFunctionStates(...)批量讀取。51.2.4 訪問控制模型AppFunctions 訪問模型分為三層校驗(yàn)：訪問標(biāo)志位是以（代理，目標(biāo)應(yīng)用）為單位存儲(chǔ)的位掩碼，常量定義在AppFunctionManager。標(biāo)志位數(shù)值含義ACCESS_FLAG_PREGRANTED1系統(tǒng)預(yù)授權(quán)訪問ACCESS_FLAG_UPGRADE_GRANTED1 1系統(tǒng)版本升級(jí)時(shí)授予ACCESS_FLAG_USER_GRANTED1 2用戶通過 UI 顯式授權(quán)ACCESS_FLAG_USER_DENIED1 3用戶通過 UI 顯式拒絕（優(yōu)先級(jí)高于 PREGRANTED）ACCESS_FLAG_OTHER_GRANTED1 4ADB 或其他方式授權(quán)ACCESS_FLAG_OTHER_DENIED1 5ADB 或主動(dòng)撤銷拒絕Android17 代理白名單不再使用 DeviceConfig 字符串，改為平臺(tái)AllowlistManager。它以SignedPackage（包名 + 證書摘要）為 Key，記錄該代理允許訪問的目標(biāo)包集合，支持通配符代表全部目標(biāo)包。AppFunctions 服務(wù)通過SystemAppFunctionAllowlistReader讀取，內(nèi)部使用 LruCache 按代理緩存結(jié)果。public class SystemAppFunctionAllowlistReader implements AppFunctionAllowlistReader { private final LruCacheSignedPackage, ArraySetString mCache; private final AllowlistManager mAllowlistManager; @Override public CompletableFutureBoolean isAllowlisted( String agentPackage, String targetPackageName, int userId) { ... } }CallerValidatorImpl執(zhí)行前同時(shí)校驗(yàn)運(yùn)行時(shí)權(quán)限與白名單。持有EXECUTE_APP_FUNCTIONS_SYSTEM的特權(quán)系統(tǒng)代理會(huì)跳過白名單；僅持有EXECUTE_APP_FUNCTIONS的代理必須出現(xiàn)在目標(biāo)應(yīng)用對(duì)應(yīng)的白名單內(nèi)。51.2.5 AIDL 接口定義框架定義兩組 AIDL 接口：一組面向客戶端，一組面向目標(biāo)應(yīng)用。IAppFunctionManager（客戶端 → system_server）Android17 接口大幅擴(kuò)充，增加發(fā)現(xiàn)、觀測(cè)、運(yùn)行時(shí)注冊(cè)、訪問管理相關(guān)接口。interface IAppFunctionManager { ICancellationSignal executeAppFunction( in ExecuteAppFunctionAidlRequest request, in IExecuteAppFunctionCallback callback); // 發(fā)現(xiàn)與觀測(cè) void observeAppFunctions( in AppFunctionAidlSearchSpec aidlSearchSpec, in IObserveAppFunctionChangesCallback callback); void unregisterAppFunctionObserver( in String callingPackage, in UserHandle userHandle, in IObserveAppFunctionChangesCallback callback); void getAppFunctionStates( in ListAppFunctionName appFunctionNames, in String callingPackageName, int targetUserId, in IGetAppFunctionStatesCallback callback); void getAppFunctionActivityStates( in ListAppFunctionActivityId activityIds, in String callingPackageName, int targetUserId, in IGetAppFunctionActivityStatesCallback callback); // 啟用狀態(tài)生命周期 void isAppFunctionEnabled( in String callingPackage, in String targetPackage, in String functionIdentifier, in UserHandle userHandle, in IIsAppFunctionEnabledCallback callback); void setAppFunctionEnabled( in String callingPackage, in String functionIdentifier, in UserHandle userHandle, int enabledState, in ISetAppFunctionEnabledCallback callback); // 運(yùn)行時(shí)動(dòng)態(tài)注冊(cè) void registerAppFunctions(in String packageName, in ListString functionIds, in IAppFunctionExecutor executor, in IBinder activityToken); void unregisterAppFunctions(in String packageName, in ListString functionIds, in IAppFunctionExecutor executor); // 訪問管理 int getAccessRequestState(in String agentPackageName, int agentUserId, in String targetPackageName, int targetUserId); int getAccessFlags(in String agentPackageName, int agentUserId, in String targetPackageName, int targetUserId); boolean updateAccessFlags(in String agentPackageName, int agentUserId, in String targetPackageName, int targetUserId, int flagMask, int flags); void revokeSelfAccess(in String targetPackageName); ListString getValidAgents(int userId); ListString getValidTargets(int targetUserId); Intent createRequestAccessIntent(in String targetPackageName); void addOnAccessChangedListener(IOnAppFunctionAccessChangeListener listener, int userId); void removeOnAccessChangedListener(IOnAppFunctionAccessChangeListener listener, int userId); }注意區(qū)分查詢回調(diào)IIsAppFunctionEnabledCallback和修改回調(diào)ISetAppFunctionEnabledCallback。運(yùn)行時(shí)注冊(cè)傳遞IAppFunctionExecutor，由系統(tǒng)直接調(diào)用，不再綁定獨(dú)立組件。IAppFunctionService（system_server → 目標(biāo)應(yīng)用，oneway）oneway interface IAppFunctionService { void executeAppFunction( in ExecuteAppFunctionRequest request, in String callingPackage, in android.content.pm.SigningInfo callingPackageSigningInfo, in ICancellationCallback cancellationCallback, in IExecuteAppFunctionCallback callback); }oneway修飾至關(guān)重要：system_server 不會(huì)阻塞等待目標(biāo)應(yīng)用執(zhí)行完成，結(jié)果全部經(jīng)由IExecuteAppFunctionCallback回調(diào)返回。51.2.6 目標(biāo)端：AppFunctionService目標(biāo)應(yīng)用繼承AppFunctionService，實(shí)現(xiàn)唯一抽象方法：@MainThread public abstract void onExecuteFunction( @NonNull ExecuteAppFunctionRequest request, @NonNull String callingPackage, @NonNull SigningInfo callingPackageSigningInfo, @NonNull CancellationSignal cancellationSignal, @NonNull OutcomeReceiverExecuteAppFunctionResponse, AppFunctionException callback);服務(wù)內(nèi)部做調(diào)用者校驗(yàn)：僅擁有BIND_APP_FUNCTION_SERVICE權(quán)限的 system_server 可以調(diào)用。if (context.checkCallingPermission(BIND_APP_FUNCTION_SERVICE) == PERMISSION_DENIED) { throw new SecurityException("Can only be called by the system server."); }Manifest 聲明示例，必須指定綁定權(quán)限：service android:name=".YourService" android:permission="android.permission.BIND_APP_FUNCTION_SERVICE" intent-filter action android:name="android.app.appfunctions.AppFunctionService" / /intent-filter /service51.2.7 請(qǐng)求與響應(yīng)序列化格式ExecuteAppFunctionRequest與ExecuteAppFunctionResponse均使用 AppSearch 的GenericDocument作為參數(shù)載體。該設(shè)計(jì)使函數(shù)參數(shù)可以用 Schema 描述，而 AppSearch 原生支持索引與查詢?cè)?Schema。請(qǐng)求結(jié)構(gòu)體：public final class ExecuteAppFunctionRequest implements Parcelable { @NonNull private final String mTargetPackageName; @NonNull private final String mFunctionIdentifier; @NonNull private final Bundle mExtras; @NonNull private final GenericDocumentWrapper mParameters; @Nullable private final AppInteractionAttribution mAttribution;響應(yīng)結(jié)構(gòu)體：public final class ExecuteAppFunctionResponse implements Parcelable { public static final String PROPERTY_RETURN_VALUE = "androidAppfunctionsReturnValue"; @NonNull private final GenericDocumentWrapper mResultDocumentWrapper; @NonNull private final Bundle mExtras; @NonNull private final ListAppFunctionUriGrant mUriGrants;返回值存放在結(jié)果GenericDocument的PROPERTY_RETURN_VALUE鍵。Jetpack AppFunction SDK 提供強(qiáng)類型封裝，負(fù)責(zé)打包、解析該文檔。51.2.8 歸因與交互日志每一次執(zhí)行可以攜帶AppInteractionAttribution，描述觸發(fā)本次調(diào)用的交互來源。Android17 將該類型從 appfunctions 包提升至android.app包，供整個(gè)應(yīng)用交互 API 復(fù)用，開關(guān)標(biāo)記為FLAG_ENABLE_APP_INTERACTION_API。public static final int INTERACTION_TYPE_OTHER = 0; // 需要自定義字符串 public static final int INTERACTION_TYPE_USER_QUERY = 1; public static final int INTERACTION_TYPE_USER_SCHEDULED = 2;歸因包含交互類型、可選自定義類型字符串（類型為INTERACTION_TYPE_OTHER時(shí)使用）、可選交互 Uri，指向原始上下文。隱私 UI 依靠該信息向用戶解釋函數(shù)執(zhí)行緣由。Android17 不會(huì)持久化每次調(diào)用的歷史數(shù)據(jù)庫，而是把每一次執(zhí)行寫入平臺(tái) metrics 流水線 statsd。system_server 中的AppFunctionsLoggerWrapper運(yùn)行在共享后臺(tái)執(zhí)行器，為每一次成功或失敗輸出結(jié)構(gòu)化事件，歸一化處理歸因常量并標(biāo)記函數(shù)類型。static final int FUNCTION_TYPE_UNSPECIFIED = 0; static final int FUNCTION_TYPE_STATIC = 1; // AppFunctionService實(shí)現(xiàn) static final int FUNCTION_TYPE_DYNAMIC_GLOBAL = 2; // registerAppFunction（Service/全局） static final int FUNCTION_TYPE_DYNAMIC_ACTIVITY = 3;// registerAppFunction（Activity作用域） void logAppFunctionSuccess( ExecuteAppFunctionAidlRequest request, ExecuteAppFunctionResponse response, int callingUid, long executionStartTimeMillis, @AppFunctionMetadata.AppFunctionType int appFunctionType) { ... }日志事件記錄調(diào)用 UID、目標(biāo)包、請(qǐng)求中提取的交互類型、函數(shù)類型（靜態(tài) / 動(dòng)態(tài)、全局 / Activity 域）、響應(yīng)碼，以及綁定服務(wù)完成之后統(tǒng)計(jì)的執(zhí)行耗時(shí)。51.2.9 錯(cuò)誤處理AppFunctionException定義了分類錯(cuò)誤碼體系：// 請(qǐng)求類錯(cuò)誤 1000?1999 public static final int ERROR_DENIED = 1000; public static final int ERROR_INVALID_ARGUMENT = 1001; public static final int ERROR_DISABLED = 1002; public static final int ERROR_FUNCTION_NOT_FOUND = 1003; // 系統(tǒng)類錯(cuò)誤 2000?2999 public static final int ERROR_SYSTEM_ERROR = 2000; public static final int ERROR_CANCELLED = 2001; public static final int ERROR_ENTERPRISE_POLICY_DISALLOWED = 2002; // 應(yīng)用類錯(cuò)誤 3000?3999 public static final int ERROR_APP_UNKNOWN_ERROR = 3000;getErrorCategory()將錯(cuò)誤碼區(qū)間映射為錯(cuò)誤分類：public int getErrorCategory() { if (mErrorCode = 1000 mErrorCode 2000) return ERROR_CATEGORY_REQUEST_ERROR; if (mErrorCode = 2000 mErrorCode 3000) return ERROR_CATEGORY_SYSTEM; if (mErrorCode = 3000 mErrorCode 4000) return ERROR_CATEGORY_APP; return ERROR_CATEGORY_UNKNOWN; }51.2.10 System Server 實(shí)現(xiàn)薄的SystemService：AppFunctionManagerService.java，負(fù)責(zé)發(fā)布 Binder 服務(wù)到Context.APP_FUNCTION_SERVICE，轉(zhuǎn)發(fā)用戶生命周期。業(yè)務(wù)邏輯主體在AppFunctionManagerServiceImpl，繼承IAppFunctionManager.Stub，協(xié)調(diào)各個(gè)協(xié)作類。public class AppFunctionManagerServiceImpl extends IAppFunctionManager.Stub { private final RemoteServiceCallerIAppFunctionService mRemoteServiceCaller; private final CallerValidator mCallerValidator; private final AppFunctionsLoggerWrapper mLoggerWrapper; private final IUriGrantsManager mUriGrantsManager; private final UriGrantsManagerInternal mUriGrantsManagerInternal; private final MultiUserDynamicAppFunctionRegistry mDynamicAppFunctionRegistry; private final AppFunctionMetadataReader mAppFunctionMetadataReader; private final AppFunctionMetadataObserver mAppFunctionMetadataObserver; private final VisibilityHelper mVisibilityHelper; private final ActivityTaskManagerInternal mActivityTaskManagerInternal; // 訪問校驗(yàn)委托給權(quán)限子系統(tǒng) private final AppFunctionAccessServiceInterface mAppFunctionAccessService; ...關(guān)鍵支撐類說明：類名職責(zé)RemoteServiceCallerImpl綁定目標(biāo)AppFunctionService，管理連接生命周期CallerValidatorImpl強(qiáng)制校驗(yàn)EXECUTE_APP_FUNCTIONS/EXECUTE_APP_FUNCTIONS_SYSTEM權(quán)限，校驗(yàn)白名單MetadataSyncAdapter應(yīng)用包變更時(shí)，同步靜態(tài)函數(shù)元數(shù)據(jù)至 AppSearchAppFunctionPackageMonitor監(jiān)聽?wèi)?yīng)用安裝 / 更新 / 卸載事件MultiUserDynamicAppFunctionRegistry保存每個(gè)用戶下registerAppFunction運(yùn)行時(shí)注冊(cè)項(xiàng)AppFunctionMetadataReader讀取靜態(tài)（AppSearch）與動(dòng)態(tài)元數(shù)據(jù)，用于發(fā)現(xiàn)與狀態(tài)查詢AppFunctionMetadataObserver基于 AppSearch 變更事件驅(qū)動(dòng)observeAppFunctions回調(diào)SystemAppFunctionAllowlistReader通過AllowlistManager解析簽名代理白名單AppFunctionsLoggerWrapper為每一次執(zhí)行輸出 statsd 埋點(diǎn)事件AppFunctionAccessService（權(quán)限子系統(tǒng)）持久化（代理，目標(biāo)）訪問狀態(tài)與標(biāo)志位51.2.11 通過 AppSearch 實(shí)現(xiàn)函數(shù)發(fā)現(xiàn)應(yīng)用安裝、更新或設(shè)備開機(jī)時(shí)，MetadataSyncAdapter從目標(biāo)應(yīng)用AppFunctionService提取函數(shù)元數(shù)據(jù)，作為AppFunctionStaticMetadata文檔索引存入 AppSearch。代理應(yīng)用通過查詢 AppSearch 完成函數(shù)發(fā)現(xiàn)。51.2.12 SafeOneTimeExecuteAppFunctionCallback關(guān)鍵防御封裝，保證回調(diào)有且僅有一次被交付。public class SafeOneTimeExecuteAppFunctionCallback { private final AtomicBoolean mOnResultCalled = new AtomicBoolean(false); @NonNull private final IExecuteAppFunctionCallback mCallback; @Nullable private final CompletionCallback mCompletionCallback; @Nullable private final BeforeCompletionCallback mBeforeCompletionCallback; private final AtomicLong mExecutionStartTimeAfterBindMillis = new AtomicLong(); public void onResult(@NonNull ExecuteAppFunctionResponse result) { if (!mOnResultCalled.compareAndSet(false, true)) { Log.w(TAG, "Ignore subsequent calls to onResult/onError()"); return; } try { if (mBeforeCompletionCallback != null) { mBeforeCompletionCallback.beforeOnSuccess(result); } mCallback.onSuccess(result); if (mCompletionCallback != null) { mCompletionCallback.finalizeOnSuccess( result, mExecutionStartTimeAfterBindMillis.get()); } } catch (RemoteException ex) { Log.w(TAG, "Failed to invoke the callback", ex); } } public void onError(@NonNull AppFunctionException error) { if (!mOnResultCalled.compareAndSet(false, true)) { Log.w(TAG, "Ignore subsequent calls to onResult/onError()"); return; } try { mCallback.onError(error); if (mCompletionCallback != null) { mCompletionCallback.finalizeOnError( error, mExecutionStartTimeAfterBindMillis.get()); } } catch (RemoteException ex) { Log.w(TAG, "Failed to invoke the callback", ex); } }該設(shè)計(jì)模式必要性：目標(biāo)應(yīng)用屬于第三方代碼，可能錯(cuò)誤多次調(diào)用回調(diào)。AtomicBoolean.compareAndSet()保證僅第一次調(diào)用生效。捕獲RemoteException：如果回調(diào)進(jìn)程在結(jié)果返回前已死亡，異常僅打日志，不會(huì)崩潰 system_server。完成鉤子：BeforeCompletionCallback與CompletionCallback允許 system_server 在回調(diào)交付前后執(zhí)行附加邏輯（埋點(diǎn)日志、URI 授權(quán)、訪問歷史記錄）。public interface CompletionCallback { void finalizeOnSuccess( ExecuteAppFunctionResponse result, long executionStartTimeMillis); void finalizeOnError( AppFunctionException error, long executionStartTimeMillis); } public interface BeforeCompletionCallback { void beforeOnSuccess(ExecuteAppFunctionResponse result); }耗時(shí)統(tǒng)計(jì)：mExecutionStartTimeAfterBindMillis記錄服務(wù)綁定完成之后的執(zhí)行開始時(shí)刻，區(qū)分綁定開銷與真正業(yè)務(wù)執(zhí)行耗時(shí)。禁用機(jī)制：提供disable()，請(qǐng)求被取消或超時(shí)時(shí)阻止后續(xù)回調(diào)交付。51.2.13 executeAppFunction 實(shí)現(xiàn)深度解析system_server 的executeAppFunction是整個(gè)框架最核心路徑，逐行解析從 AIDL 入口到綁定目標(biāo)服務(wù)的完整鏈路。步驟 1：入口與初始校驗(yàn)@Override public ICancellationSignal executeAppFunction( @NonNull ExecuteAppFunctionAidlRequest requestInternal, @NonNull IExecuteAppFunctionCallback executeAppFunctionCallback) { int callingUid = Binder.getCallingUid(); int callingPid = Binder.getCallingPid(); final SafeOneTimeExecuteAppFunctionCallback safeExecuteAppFunctionCallback = initializeSafeExecuteAppFunctionCallback( requestInternal, executeAppFunctionCallback, callingUid); String validatedCallingPackage; try { validatedCallingPackage = mCallerValidator.validateCallingPackage(requestInternal.getCallingPackage()); mCallerValidator.verifyTargetUserHandle( requestInternal.getUserHandle(), validatedCallingPackage); } catch (SecurityException exception) { safeExecuteAppFunctionCallback.onError( new AppFunctionException( AppFunctionException.ERROR_DENIED, exception.getMessage())); return null; }SafeOneTimeExecuteAppFunctionCallback包裝，保證無論目標(biāo)應(yīng)用多次應(yīng)答還是崩潰，只返回一次成功 / 錯(cuò)誤。步驟 2：線程池異步執(zhí)行，不阻塞 Binder 線程ICancellationSignal localCancelTransport = CancellationSignal.createTransport(); THREAD_POOL_EXECUTOR.execute( () - { try { executeAppFunctionInternal( requestInternal, callingUid, callingPid, localCancelTransport, safeExecuteAppFunctionCallback, executeAppFunctionCallback.asBinder()); } catch (Exception e) { safeExecuteAppFunctionCallback.onError( mapExceptionToExecuteAppFunctionResponse(e)); } }); return localCancelTransport; }任務(wù)提交至THREAD_POOL_EXECUTOR，避免占用 Binder 線程池。步驟 3：權(quán)限與狀態(tài)基礎(chǔ)校驗(yàn)（工作線程）@WorkerThread private void executeAppFunctionInternal(...) { // 企業(yè)策略校驗(yàn) if (!mCallerValidator.verifyEnterprisePolicyIsAllowed(callingUser, targetUser)) { safeExecuteAppFunctionCallback.onError( new AppFunctionException( AppFunctionException.ERROR_ENTERPRISE_POLICY_DISALLOWED, ...)); return; } // 目標(biāo)包名校驗(yàn)非空 if (TextUtils.isEmpty(targetPackageName)) { safeExecuteAppFunctionCallback.onError( new AppFunctionException( AppFunctionException.ERROR_INVALID_ARGUMENT, ...)); return; }步驟 4：鏈?zhǔn)?Future 完成權(quán)限校驗(yàn) + AppSearch 讀取啟用狀態(tài)實(shí)現(xiàn)使用AndroidFuture.thenCompose()做非阻塞權(quán)限校驗(yàn)，緊接著查詢 AppSearch 獲取函數(shù)啟用狀態(tài)。mCallerValidator .verifyCallerCanExecuteAppFunction( callingUid, callingPid, targetUser, requestInternal.getCallingPackage(), targetPackageName, requestInternal.getClientRequest().getFunctionIdentifier()) .thenCompose(canExecuteResult - { if (canExecuteResult == CAN_EXECUTE_APP_FUNCTIONS_DENIED) { return AndroidFuture.failedFuture( new SecurityException("Caller does not have permission")); } return isAppFunctionEnabled( functionIdentifier, targetPackageName, getAppSearchManagerAsUser(userHandle), THREAD_POOL_EXECUTOR) .thenApply(isEnabled - { if (!isEnabled) { throw new DisabledAppFunctionException("Disabled"); } return canExecuteResult; }); })步驟 5：服務(wù)解析與綁定.thenAccept(canExecuteResult - { int bindFlags = Context.BIND_AUTO_CREATE; if (canExecuteResult == CAN_EXECUTE_APP_FUNCTIONS_ALLOWED_HAS_PERMISSION) { bindFlags |= Context.BIND_FOREGROUND_SERVICE; } Intent serviceIntent = mInternalServiceHelper.resolveAppFunctionService( targetPackageName, targetUser); // 授予隱式可見性，允許目標(biāo)看到調(diào)用方 mPackageManagerInternal.grantImplicitAccess( grantRecipientUserId, serviceIntent, grantRecipientAppId, callingUid, /* direct= */ true); bindAppFunctionServiceUnchecked( requestInternal, serviceIntent, targetUser, localCancelTransport, safeExecuteAppFunctionCallback, bindFlags, callerBinder, callingUid); })關(guān)鍵點(diǎn)：調(diào)用方具備EXECUTE_APP_FUNCTIONS權(quán)限時(shí)，使用BIND_FOREGROUND_SERVICE提升目標(biāo)服務(wù)進(jìn)程優(yōu)先級(jí)。自調(diào)用（同一包名）不會(huì)獲得該優(yōu)先級(jí)提升。51.2.14 RemoteServiceCaller 模式RemoteServiceCallerImpl實(shí)現(xiàn)一次性 Service 綁定模式：public class RemoteServiceCallerImplT implements RemoteServiceCallerT { public boolean runServiceCall( Intent intent, int bindFlags, UserHandle userHandle, long cancellationTimeoutMillis, CancellationSignal cancellationSignal, RunServiceCallCallbackT callback, IBinder callerBinder) { OneOffServiceConnection serviceConnection = new OneOffServiceConnection(intent, bindFlags, userHandle, cancellationTimeoutMillis, cancellationSignal, callback, callerBinder); return serviceConnection.bindAndRun(); }OneOffServiceConnection是自定義ServiceConnection，行為：調(diào)用Context.bindServiceAsUser()連接目標(biāo)服務(wù)設(shè)置取消監(jiān)聽器，超時(shí)后執(zhí)行 unbind監(jiān)聽調(diào)用方 Binder 死亡，調(diào)用方進(jìn)程死亡則自動(dòng)取消回調(diào)完成后自動(dòng)解綁private class OneOffServiceConnection implements ServiceConnection, ServiceUsageCompleteListener { public boolean bindAndRun() { boolean bindServiceResult = mContext.bindServiceAsUser(mIntent, this, mFlags, mUserHandle); if (bindServiceResult) { mCancellationSignal.setOnCancelListener(() - { mCallback.onCancelled(); mHandler.postDelayed(mCancellationTimeoutRunnable, mCancellationTimeoutMillis); }); mDirectServiceVulture = () - { Slog.w(TAG, "Caller process onDeath signal received"); mCancellationSignal.cancel(); }; mCallerBinder.linkToDeath(mDirectServiceVulture, 0); } return bindServiceResult; }該模式保證資源一定被清理，無論調(diào)用方崩潰、目標(biāo)應(yīng)用崩潰或者用戶主動(dòng)取消。51.2.15 多用戶支持實(shí)現(xiàn)完整支持多用戶。每個(gè)用戶擁有：獨(dú)立 AppSearch 數(shù)據(jù)庫，保存靜態(tài)函數(shù)元數(shù)據(jù)獨(dú)立PackageMonitor監(jiān)聽包變更MultiUserDynamicAppFunctionRegistry中獨(dú)立分片保存運(yùn)行時(shí)注冊(cè)項(xiàng)權(quán)限子系統(tǒng)持久化獨(dú)立的（代理，目標(biāo)）訪問狀態(tài)與標(biāo)志位public void onUserUnlocked(TargetUser user) { if (enableDynamicAppFunctions()) { mAppFunctionMetadataObserver.registerAppSearchObserverForUser(user); } else { registerAppSearchObserver(user); } trySyncRuntimeMetadata(user.getUserHandle(), ...); PackageMonitor pkgMonitorForUser = AppFunctionPackageMonitor.registerPackageMonitorForUser( mContext, user, mAppFunctionMetadataObserver); mPackageMonitors.append(user.getUserIdentifier(), pkgMonitorForUser); mDynamicAppFunctionRegistry.onUserUnlocked(user, ...); } public void onUserStopping(@NonNull TargetUser user) { if (enableDynamicAppFunctions()) { mAppFunctionMetadataObserver.unregisterAppSearchObserverForUser(user); } else { MetadataSyncPerUser.removeUserSyncAdapter(user.getUserHandle()); } mPackageMonitors.get(user.getUserIdentifier()).unregister(); mPackageMonitors.delete(user.getUserIdentifier()); } public void onUserStopped(@NonNull TargetUser user) { mDynamicAppFunctionRegistry.onUserStopped(user); }動(dòng)態(tài)函數(shù)標(biāo)記開啟時(shí)，每個(gè)用戶的 AppSearch 觀察者由AppFunctionMetadataObserver持有，變更事件同時(shí)分發(fā)給內(nèi)部元數(shù)據(jù)緩存以及客戶端observeAppFunctions回調(diào)。運(yùn)行時(shí)注冊(cè)表以 userId 為 key；當(dāng)用戶停止，該用戶下全部注冊(cè)項(xiàng)被銷毀。51.2.16 代理白名單架構(gòu)Android17 代理白名單不再是 DeviceConfig 與 Settings.Secure 字符串拼接，改用平臺(tái)AllowlistManager，白名單 ID 為ALLOWLIST_ID_APP_FUNCTION。輸入簽名代理包，返回該代理可訪問的目標(biāo)包集合。AppFunctions 服務(wù)通過SystemAppFunctionAllowlistReader消費(fèi)該能力。讀取器將代理最新簽名證書哈希封裝為SignedPackage，向AllowlistManager查詢合法目標(biāo)包；查詢結(jié)果放入 LruCache 緩存，相同代理重復(fù)執(zhí)行可省去一次 IPC。@Override public CompletableFutureBoolean isAllowlisted( String agentPackageName, String targetPackageName, int userId) { if (agentPackageName.equals(targetPackageName)) { return AndroidFuture.completedFuture(true); // 自身函數(shù)永遠(yuǎn)允許 } SignedPackage agentSignedPackage = new SignedPackage(agentPackageName, /* certificate digest */ ...); maybeStartAllowlistListener(); return getValidTargetPackages(agentSignedPackage) .thenApply(allowlistTargets - allowlistTargets.contains(WILDCARD_PACKAGE_NAME) || allowlistTargets.contains(targetPackageName)); }三條關(guān)鍵行為：自訪問隱式放行：代理與目標(biāo)包相同，應(yīng)用永遠(yuǎn)可以調(diào)用自身函數(shù)。通配符目標(biāo)：白名單配置通配符包名，代理可訪問全部目標(biāo)。變更監(jiān)聽：首次使用注冊(cè)O(shè)nAllowlistChangedListener；白名單更新時(shí)緩存自動(dòng)失效，不再只在開機(jī)階段讀取配置字符串。51.2.17 AppFunction 響應(yīng)中的 URI 授權(quán)當(dāng)目標(biāo)應(yīng)用在響應(yīng)中返回 content URI，框架可以為調(diào)用代理授予臨時(shí) URI 權(quán)限。private final IUriGrantsManager mUriGrantsManager; private final UriGrantsManagerInternal mUriGrantsManagerInternal; private final IBinder mPermissionOwner; // 構(gòu)造函數(shù)中初始化 mPermissionOwner = mUriGrantsManagerInternal.newUriPermissionOwner("appfunctions");響應(yīng)中的AppFunctionUriGrant指明需要向代理授予哪些 URI。授權(quán)經(jīng)由mUriGrantsManager.grantUriPermissionFromOwner完成，綁定到 AppFunctions 專屬 permission owner。權(quán)限有效期直到 owner 釋放或者設(shè)備重啟。51.2.18 Shell 命令支持服務(wù)實(shí)現(xiàn)onShellCommand()，用于開發(fā)者調(diào)試。@Override public void onShellCommand( FileDescriptor in, FileDescriptor out, FileDescriptor err, @NonNull String[] args, ShellCallback callback, @NonNull ResultReceiver resultReceiver) { new AppFunctionManagerServiceShellCommand(mContext, this) .exec(this, in, out, err, args, callback, resultReceiver); }adb 命令：adb shell cmd app_function51.2.19 服務(wù)啟動(dòng)與生命周期本框架屬于SystemService。AppFunctionManagerService.onStart()，當(dāng)AppFunctionManagerConfiguration.isSupported(context)為 true 時(shí)，把 Binder 服務(wù)發(fā)布到Context.APP_FUNCTION_SERVICE；開啟 App Interaction API 標(biāo)記時(shí)，額外發(fā)布本地服務(wù)AppInteractionService。@Override public void onStart() { if (AppFunctionManagerConfiguration.isSupported(getContext())) { publishBinderService(Context.APP_FUNCTION_SERVICE, mServiceImpl); } if (Flags.enableAppInteractionApi()) { publishLocalService(AppInte