Android 已經從一個僅能運行應用的平臺，演進為能夠理解應用行為的平臺。一系列端側智能服務將用戶意圖與應用行為關聯起來：AppFunctions 框架允許助手通過強類型 RPC 契約調用應用的任意功能；計算機控制（Computer Control）為 AI 代理提供虛擬顯示器，可在其上完成點擊、滑動、截圖操作；OnDeviceIntelligence 在隔離沙箱中運行大機器學習模型 —— 大語言模型以及其他生成式或大規(guī)模推理負載；NNAPI 向所有原生工作負載暴露硬件加速器。結合 AppSearch、內容捕獲（Content Capture）、AdServices 以及聯邦學習，這些子系統(tǒng)共同構成了 Android 的 AI 神經體系。本章逐層梳理完整調用鏈路：從公開 SDK 類，經由 AIDL 接口、system_server 服務實現，一直到另一端沙箱進程或 HAL 進程。每一條代碼路徑均對應當前 AOSP 源碼樹中的真實源文件。51.1 AOSP AI 全景概覽在深入任一框架細節(jié)之前，先整體瀏覽 AOSP 全部 AI/ML 相關組件。下圖列出主要子系統(tǒng)、跨進程邊界以及組件之間的數據流。Mainline 模塊 HAL / 驅動進程 隔離 / 沙箱進程 目標應用進程 system_server 應用進程 Binder IPC bindService Binder IPC 隔離 bind 調用 Binder IPC Binder IPC Binder IPC Binder IPC Binder IPC第三方 / 系統(tǒng)應用 AppFunctionManager OnDeviceIntelligenceManager NNAPI C API ComputerControlExtensions AppSearchManager TextClassifierManager ContentCaptureManager AppPredictionManager TopicsManagerAppFunctionManagerServiceImpl OnDeviceIntelligenceManagerService VirtualDeviceManager ComputerControlSession Service ContentCaptureManagerService TextClassificationManagerService AppPredictionManagerServiceAppFunctionService OnDeviceSandboxedInferenceService IsolatedTrainingService NNAPI HAL (IDevice) GPU / DSP / NPUAppSearch 模塊 NeuralNetworks 模塊 OnDevicePersonalization 模塊 AdServices 模塊51.1.1 AOSP 智能子系統(tǒng)分類表子系統(tǒng)API 等級是否 Mainline 模塊用途AppFunctions16（引入），Android 17 趨于成熟否（框架內置）強類型跨應用函數調用，支持運行時注冊與狀態(tài)觀測Computer Control16（Android 16）否（框架 + 擴展庫）基于虛擬顯示器實現 AI 驅動的 UI 自動化OnDeviceIntelligence15 及以上NeuralNetworks 模塊沙箱化的大語言模型 / 機器學習推理NNAPI8.1 及以上NeuralNetworks 模塊神經網絡推理硬件加速AppSearch12 及以上AppSearch 模塊端側全文檢索與索引Content Capture10 及以上否（框架內置）為智能服務實時捕獲 UI 結構TextClassifier8.0 及以上否（框架內置）實體識別、語言檢測AppPrediction10 及以上否（框架內置）基于使用行為的應用排序OnDevicePersonalization14 及以上ODP 模塊聯邦計算、隔離訓練AdServices13 及以上AdServices 模塊隱私保護廣告定向（Topics、FLEDGE）51.1.2 跨子系統(tǒng)通用設計思路所有 AI 子系統(tǒng)都復用若干架構設計范式：進程隔離智能服務運行在隔離或沙箱進程。OnDeviceSandboxedInferenceService設置android:isolatedProcess="true"。IsolatedTrainingService在獨立進程加載 TFLite。即使 ComputerControlSession 也基于與主顯示器隔離的虛擬顯示器工作。優(yōu)先使用強類型契約，而非無約束 BundleAppFunctions 使用 AppSearch 提供的GenericDocument作為參數序列化格式。ODI 使用PersistableBundle承載特性與請求元數據。二者均鼓勵 SDK 層封裝強類型包裝類。AppSearch 作為通用元數據存儲AppFunction 元數據、應用預測數據、內容捕獲智能數據，全部匯聚到 AppSearch 完成索引與檢索。權限管控 + 白名單機制AppFunctions 執(zhí)行受EXECUTE_APP_FUNCTIONS（或EXECUTE_APP_FUNCTIONS_SYSTEM）權限約束，同時配合平臺AllowlistManager維護簽名代理白名單。Computer Control 需要ACCESS_COMPUTER_CONTROL權限。ODI 需要USE_ON_DEVICE_INTELLIGENCE。AdServices 需要ACCESS_ADSERVICES_TOPICS。支持取消信號傳遞幾乎全部異步 API 都會跨 Binder 傳遞ICancellationSignal，調用方可終止長時間推理或函數執(zhí)行。51.2 AppFunctions 框架AppFunctions 框架在 Android 16 以 Beta 特性面世，Android 17 正式廣泛可用。它提供一套標準化機制，讓 AI 助手（代理）可以發(fā)現并調用任意目標應用暴露的功能。例如助手收到指令 “把 XYZ 保存到我的筆記”，框架會將請求路由至對應的AppFunctionService實現，助手無需在編譯期依賴筆記應用。Android 17 對該框架做了大幅增強，不再局限于最初僅通過 Manifest 靜態(tài)聲明的模式。本章后續(xù)會詳細介紹以下核心新增能力：運行時（動態(tài)）函數注冊：應用可在 Activity 或 Service 中運行時注冊 AppFunction 回調，不再必須聲明獨立AppFunctionService組件（registerAppFunction，受FLAG_ENABLE_DYNAMIC_APP_FUNCTIONS標記控制）。完備的發(fā)現、狀態(tài)與觀測 API，新增至AppFunctionManager：searchAppFunctions、getAppFunctionStates、getAppFunctionActivityStates、observeAppFunctions。訪問管理框架：維護（代理，目標應用）二元組訪問狀態(tài)與標志位；提供面向用戶的管理 UI；代理白名單交由平臺AllowlistManager維護，不再使用 DeviceConfig 字符串。新增權限：DISCOVER_APP_FUNCTIONS（僅發(fā)現，不可執(zhí)行）、EXECUTE_APP_FUNCTIONS_SYSTEM（特權系統(tǒng)代理，繞過白名單校驗），保留原有EXECUTE_APP_FUNCTIONS。Android 17 源碼目錄概覽：frameworks/base/core/java/android/app/appfunctions/ AppFunctionManager.java -- 客戶端系統(tǒng)服務入口 AppFunctionService.java -- 靜態(tài)目標應用抽象基類 AppFunction.java -- 運行時函數回調接口 RegisterAppFunctionRequest.java -- 運行時注冊請求Parcelable ExecuteAppFunctionRequest.java -- 執(zhí)行請求Parcelable ExecuteAppFunctionResponse.java -- 執(zhí)行響應Parcelable AppFunctionException.java -- 分層異常錯誤體系 AppFunctionMetadata.java -- 靜態(tài)+運行時函數元數據 AppFunctionName.java -- (包名,標識符)函數唯一標識 AppFunctionState.java -- 運行時啟用/可見狀態(tài) AppFunctionActivityId.java -- Activity作用域函數鍵值 AppFunctionSearchSpec.java -- 檢索查詢條件 AppFunctionObserver.java -- 變更觀測回調 AppFunctionAccessServiceInterface.java -- 訪問校驗本地服務 IAppFunctionManager.aidl -- system_server AIDL接口 IAppFunctionService.aidl -- 靜態(tài)目標應用AIDL（oneway） IAppFunctionExecutor.aidl -- 動態(tài)注冊執(zhí)行器AIDL IExecuteAppFunctionCallback.aidl -- 異步結果回調AIDL ICancellationCallback.aidl -- 取消信號傳輸AIDL ... frameworks/base/services/appfunctions/ java/com/android/server/appfunctions/ AppFunctionManagerService.java -- SystemService封裝 AppFunctionManagerServiceImpl.java -- IAppFunctionManager.Stub實現 RemoteServiceCallerImpl.java -- Service綁定邏輯 CallerValidatorImpl.java -- 權限+白名單校驗 MetadataSyncAdapter.java -- AppSearch元數據同步 AppFunctionsLoggerWrapper.java -- statsd埋點日志 allowlist/SystemAppFunctionAllowlistReader.java -- AllowlistManager白名單讀取 dynamic/MultiUserDynamicAppFunctionRegistry.java -- 運行時注冊管理 reader/AppFunctionMetadataReader.java -- 靜態(tài)/動態(tài)元數據讀取 observer/AppFunctionMetadataObserver.java -- AppSearch變更觀測器 ... frameworks/base/services/permission/java/com/android/server/permission/access/appfunction/ AppFunctionAccessService.kt -- 持久化(代理,目標)訪問狀態(tài)51.2.1 架構概覽51.2.2 客戶端：AppFunctionManagerAppFunctionManager以系統(tǒng)服務注冊，服務名稱Context.APP_FUNCTION_SERVICE。@FlaggedApi(FLAG_ENABLE_APP_FUNCTION_MANAGER) @SystemService(Context.APP_FUNCTION_SERVICE) public final class AppFunctionManager {核心 API 為executeAppFunction()，接收四個入參。Android17 要求調用方具備兩項執(zhí)行權限之一；應用調用自身暴露的函數無需權限。@FlaggedApi(FLAG_ENABLE_APP_FUNCTION_PERMISSION_V2) @RequiresPermission( anyOf = { Manifest.permission.EXECUTE_APP_FUNCTIONS, Manifest.permission.EXECUTE_APP_FUNCTIONS_SYSTEM }, conditional = true) @UserHandleAware public void executeAppFunction( @NonNull ExecuteAppFunctionRequest request, @NonNull @CallbackExecutor Executor executor, @NonNull CancellationSignal cancellationSignal, @NonNull OutcomeReceiverExecuteAppFunctionResponse, AppFunctionException callback) {內部實現會將上層請求封裝為ExecuteAppFunctionAidlRequest，補充調用者身份、時間戳信息。ExecuteAppFunctionAidlRequest aidlRequest = new ExecuteAppFunctionAidlRequest( request, mContext.getUser(), mContext.getPackageName(), /* requestTime= */ SystemClock.elapsedRealtime(), /* requestWallTime= */ System.currentTimeMillis());Binder 調用返回ICancellationSignal傳輸對象，綁定至客戶端CancellationSignal，實現跨進程取消。ICancellationSignal cancellationTransport = mService.executeAppFunction( aidlRequest, new IExecuteAppFunctionCallback.Stub() { @Override public void onSuccess(ExecuteAppFunctionResponse result) { executor.execute(() - callback.onResult(result)); } @Override public void onError(AppFunctionException exception) { executor.execute(() - callback.onError(exception)); } }); if (cancellationTransport != null) { cancellationSignal.setRemote(cancellationTransport); }51.2.3 啟用狀態(tài)管理每個 AppFunction 具備三態(tài)生命周期：常量數值含義APP_FUNCTION_STATE_DEFAULT0恢復默認狀態(tài)（通常為啟用）APP_FUNCTION_STATE_ENABLED1顯式啟用APP_FUNCTION_STATE_DISABLED2顯式禁用應用通過setAppFunctionEnabled()控制自身函數狀態(tài)。@UserHandleAware public void setAppFunctionEnabled( @NonNull String functionIdentifier, @EnabledState int newEnabledState, @NonNull Executor executor, @NonNull OutcomeReceiverVoid, Exception callback) {啟用狀態(tài)以AppFunctionRuntimeMetadata文檔持久化在 AppSearch，與描述函數 Schema 的AppFunctionStaticMetadata相互獨立。setAppFunctionEnabled()僅對靜態(tài)AppFunctionService對應的函數生效。通過registerAppFunction注冊的運行時函數，生命周期與注冊會話綁定，啟用狀態(tài)由registerAppFunction/AppFunctionRegistration.unregister控制；對動態(tài)函數調用本方法會拋出IllegalArgumentException。Android17 完整對外暴露運行時狀態(tài)，不僅僅是啟用位。AppFunctionStateParcelable 包含AppFunctionName、啟用標記、可見性；可通過AppFunctionManager.getAppFunctionStates(...)批量讀取。51.2.4 訪問控制模型AppFunctions 訪問模型分為三層校驗：訪問標志位是以（代理，目標應用）為單位存儲的位掩碼，常量定義在AppFunctionManager。標志位數值含義ACCESS_FLAG_PREGRANTED1系統(tǒng)預授權訪問ACCESS_FLAG_UPGRADE_GRANTED1 1系統(tǒng)版本升級時授予ACCESS_FLAG_USER_GRANTED1 2用戶通過 UI 顯式授權ACCESS_FLAG_USER_DENIED1 3用戶通過 UI 顯式拒絕（優(yōu)先級高于 PREGRANTED）ACCESS_FLAG_OTHER_GRANTED1 4ADB 或其他方式授權ACCESS_FLAG_OTHER_DENIED1 5ADB 或主動撤銷拒絕Android17 代理白名單不再使用 DeviceConfig 字符串，改為平臺AllowlistManager。它以SignedPackage（包名 + 證書摘要）為 Key，記錄該代理允許訪問的目標包集合，支持通配符代表全部目標包。AppFunctions 服務通過SystemAppFunctionAllowlistReader讀取，內部使用 LruCache 按代理緩存結果。public class SystemAppFunctionAllowlistReader implements AppFunctionAllowlistReader { private final LruCacheSignedPackage, ArraySetString mCache; private final AllowlistManager mAllowlistManager; @Override public CompletableFutureBoolean isAllowlisted( String agentPackage, String targetPackageName, int userId) { ... } }CallerValidatorImpl執(zhí)行前同時校驗運行時權限與白名單。持有EXECUTE_APP_FUNCTIONS_SYSTEM的特權系統(tǒng)代理會跳過白名單；僅持有EXECUTE_APP_FUNCTIONS的代理必須出現在目標應用對應的白名單內。51.2.5 AIDL 接口定義框架定義兩組 AIDL 接口：一組面向客戶端，一組面向目標應用。IAppFunctionManager（客戶端 → system_server）Android17 接口大幅擴充，增加發(fā)現、觀測、運行時注冊、訪問管理相關接口。interface IAppFunctionManager { ICancellationSignal executeAppFunction( in ExecuteAppFunctionAidlRequest request, in IExecuteAppFunctionCallback callback); // 發(fā)現與觀測 void observeAppFunctions( in AppFunctionAidlSearchSpec aidlSearchSpec, in IObserveAppFunctionChangesCallback callback); void unregisterAppFunctionObserver( in String callingPackage, in UserHandle userHandle, in IObserveAppFunctionChangesCallback callback); void getAppFunctionStates( in ListAppFunctionName appFunctionNames, in String callingPackageName, int targetUserId, in IGetAppFunctionStatesCallback callback); void getAppFunctionActivityStates( in ListAppFunctionActivityId activityIds, in String callingPackageName, int targetUserId, in IGetAppFunctionActivityStatesCallback callback); // 啟用狀態(tài)生命周期 void isAppFunctionEnabled( in String callingPackage, in String targetPackage, in String functionIdentifier, in UserHandle userHandle, in IIsAppFunctionEnabledCallback callback); void setAppFunctionEnabled( in String callingPackage, in String functionIdentifier, in UserHandle userHandle, int enabledState, in ISetAppFunctionEnabledCallback callback); // 運行時動態(tài)注冊 void registerAppFunctions(in String packageName, in ListString functionIds, in IAppFunctionExecutor executor, in IBinder activityToken); void unregisterAppFunctions(in String packageName, in ListString functionIds, in IAppFunctionExecutor executor); // 訪問管理 int getAccessRequestState(in String agentPackageName, int agentUserId, in String targetPackageName, int targetUserId); int getAccessFlags(in String agentPackageName, int agentUserId, in String targetPackageName, int targetUserId); boolean updateAccessFlags(in String agentPackageName, int agentUserId, in String targetPackageName, int targetUserId, int flagMask, int flags); void revokeSelfAccess(in String targetPackageName); ListString getValidAgents(int userId); ListString getValidTargets(int targetUserId); Intent createRequestAccessIntent(in String targetPackageName); void addOnAccessChangedListener(IOnAppFunctionAccessChangeListener listener, int userId); void removeOnAccessChangedListener(IOnAppFunctionAccessChangeListener listener, int userId); }注意區(qū)分查詢回調IIsAppFunctionEnabledCallback和修改回調ISetAppFunctionEnabledCallback。運行時注冊傳遞IAppFunctionExecutor，由系統(tǒng)直接調用，不再綁定獨立組件。IAppFunctionService（system_server → 目標應用，oneway）oneway interface IAppFunctionService { void executeAppFunction( in ExecuteAppFunctionRequest request, in String callingPackage, in android.content.pm.SigningInfo callingPackageSigningInfo, in ICancellationCallback cancellationCallback, in IExecuteAppFunctionCallback callback); }oneway修飾至關重要：system_server 不會阻塞等待目標應用執(zhí)行完成，結果全部經由IExecuteAppFunctionCallback回調返回。51.2.6 目標端：AppFunctionService目標應用繼承AppFunctionService，實現唯一抽象方法：@MainThread public abstract void onExecuteFunction( @NonNull ExecuteAppFunctionRequest request, @NonNull String callingPackage, @NonNull SigningInfo callingPackageSigningInfo, @NonNull CancellationSignal cancellationSignal, @NonNull OutcomeReceiverExecuteAppFunctionResponse, AppFunctionException callback);服務內部做調用者校驗：僅擁有BIND_APP_FUNCTION_SERVICE權限的 system_server 可以調用。if (context.checkCallingPermission(BIND_APP_FUNCTION_SERVICE) == PERMISSION_DENIED) { throw new SecurityException("Can only be called by the system server."); }Manifest 聲明示例，必須指定綁定權限：service android:name=".YourService" android:permission="android.permission.BIND_APP_FUNCTION_SERVICE" intent-filter action android:name="android.app.appfunctions.AppFunctionService" / /intent-filter /service51.2.7 請求與響應序列化格式ExecuteAppFunctionRequest與ExecuteAppFunctionResponse均使用 AppSearch 的GenericDocument作為參數載體。該設計使函數參數可以用 Schema 描述，而 AppSearch 原生支持索引與查詢該 Schema。請求結構體：public final class ExecuteAppFunctionRequest implements Parcelable { @NonNull private final String mTargetPackageName; @NonNull private final String mFunctionIdentifier; @NonNull private final Bundle mExtras; @NonNull private final GenericDocumentWrapper mParameters; @Nullable private final AppInteractionAttribution mAttribution;響應結構體：public final class ExecuteAppFunctionResponse implements Parcelable { public static final String PROPERTY_RETURN_VALUE = "androidAppfunctionsReturnValue"; @NonNull private final GenericDocumentWrapper mResultDocumentWrapper; @NonNull private final Bundle mExtras; @NonNull private final ListAppFunctionUriGrant mUriGrants;返回值存放在結果GenericDocument的PROPERTY_RETURN_VALUE鍵。Jetpack AppFunction SDK 提供強類型封裝，負責打包、解析該文檔。51.2.8 歸因與交互日志每一次執(zhí)行可以攜帶AppInteractionAttribution，描述觸發(fā)本次調用的交互來源。Android17 將該類型從 appfunctions 包提升至android.app包，供整個應用交互 API 復用，開關標記為FLAG_ENABLE_APP_INTERACTION_API。public static final int INTERACTION_TYPE_OTHER = 0; // 需要自定義字符串 public static final int INTERACTION_TYPE_USER_QUERY = 1; public static final int INTERACTION_TYPE_USER_SCHEDULED = 2;歸因包含交互類型、可選自定義類型字符串（類型為INTERACTION_TYPE_OTHER時使用）、可選交互 Uri，指向原始上下文。隱私 UI 依靠該信息向用戶解釋函數執(zhí)行緣由。Android17 不會持久化每次調用的歷史數據庫，而是把每一次執(zhí)行寫入平臺 metrics 流水線 statsd。system_server 中的AppFunctionsLoggerWrapper運行在共享后臺執(zhí)行器，為每一次成功或失敗輸出結構化事件，歸一化處理歸因常量并標記函數類型。static final int FUNCTION_TYPE_UNSPECIFIED = 0; static final int FUNCTION_TYPE_STATIC = 1; // AppFunctionService實現 static final int FUNCTION_TYPE_DYNAMIC_GLOBAL = 2; // registerAppFunction（Service/全局） static final int FUNCTION_TYPE_DYNAMIC_ACTIVITY = 3;// registerAppFunction（Activity作用域） void logAppFunctionSuccess( ExecuteAppFunctionAidlRequest request, ExecuteAppFunctionResponse response, int callingUid, long executionStartTimeMillis, @AppFunctionMetadata.AppFunctionType int appFunctionType) { ... }日志事件記錄調用 UID、目標包、請求中提取的交互類型、函數類型（靜態(tài) / 動態(tài)、全局 / Activity 域）、響應碼，以及綁定服務完成之后統(tǒng)計的執(zhí)行耗時。51.2.9 錯誤處理AppFunctionException定義了分類錯誤碼體系：// 請求類錯誤 1000?1999 public static final int ERROR_DENIED = 1000; public static final int ERROR_INVALID_ARGUMENT = 1001; public static final int ERROR_DISABLED = 1002; public static final int ERROR_FUNCTION_NOT_FOUND = 1003; // 系統(tǒng)類錯誤 2000?2999 public static final int ERROR_SYSTEM_ERROR = 2000; public static final int ERROR_CANCELLED = 2001; public static final int ERROR_ENTERPRISE_POLICY_DISALLOWED = 2002; // 應用類錯誤 3000?3999 public static final int ERROR_APP_UNKNOWN_ERROR = 3000;getErrorCategory()將錯誤碼區(qū)間映射為錯誤分類：public int getErrorCategory() { if (mErrorCode = 1000 mErrorCode 2000) return ERROR_CATEGORY_REQUEST_ERROR; if (mErrorCode = 2000 mErrorCode 3000) return ERROR_CATEGORY_SYSTEM; if (mErrorCode = 3000 mErrorCode 4000) return ERROR_CATEGORY_APP; return ERROR_CATEGORY_UNKNOWN; }51.2.10 System Server 實現薄的SystemService：AppFunctionManagerService.java，負責發(fā)布 Binder 服務到Context.APP_FUNCTION_SERVICE，轉發(fā)用戶生命周期。業(yè)務邏輯主體在AppFunctionManagerServiceImpl，繼承IAppFunctionManager.Stub，協調各個協作類。public class AppFunctionManagerServiceImpl extends IAppFunctionManager.Stub { private final RemoteServiceCallerIAppFunctionService mRemoteServiceCaller; private final CallerValidator mCallerValidator; private final AppFunctionsLoggerWrapper mLoggerWrapper; private final IUriGrantsManager mUriGrantsManager; private final UriGrantsManagerInternal mUriGrantsManagerInternal; private final MultiUserDynamicAppFunctionRegistry mDynamicAppFunctionRegistry; private final AppFunctionMetadataReader mAppFunctionMetadataReader; private final AppFunctionMetadataObserver mAppFunctionMetadataObserver; private final VisibilityHelper mVisibilityHelper; private final ActivityTaskManagerInternal mActivityTaskManagerInternal; // 訪問校驗委托給權限子系統(tǒng) private final AppFunctionAccessServiceInterface mAppFunctionAccessService; ...關鍵支撐類說明：類名職責RemoteServiceCallerImpl綁定目標AppFunctionService，管理連接生命周期CallerValidatorImpl強制校驗EXECUTE_APP_FUNCTIONS/EXECUTE_APP_FUNCTIONS_SYSTEM權限，校驗白名單MetadataSyncAdapter應用包變更時，同步靜態(tài)函數元數據至 AppSearchAppFunctionPackageMonitor監(jiān)聽應用安裝 / 更新 / 卸載事件MultiUserDynamicAppFunctionRegistry保存每個用戶下registerAppFunction運行時注冊項AppFunctionMetadataReader讀取靜態(tài)（AppSearch）與動態(tài)元數據，用于發(fā)現與狀態(tài)查詢AppFunctionMetadataObserver基于 AppSearch 變更事件驅動observeAppFunctions回調SystemAppFunctionAllowlistReader通過AllowlistManager解析簽名代理白名單AppFunctionsLoggerWrapper為每一次執(zhí)行輸出 statsd 埋點事件AppFunctionAccessService（權限子系統(tǒng)）持久化（代理，目標）訪問狀態(tài)與標志位51.2.11 通過 AppSearch 實現函數發(fā)現應用安裝、更新或設備開機時，MetadataSyncAdapter從目標應用AppFunctionService提取函數元數據，作為AppFunctionStaticMetadata文檔索引存入 AppSearch。代理應用通過查詢 AppSearch 完成函數發(fā)現。51.2.12 SafeOneTimeExecuteAppFunctionCallback關鍵防御封裝，保證回調有且僅有一次被交付。public class SafeOneTimeExecuteAppFunctionCallback { private final AtomicBoolean mOnResultCalled = new AtomicBoolean(false); @NonNull private final IExecuteAppFunctionCallback mCallback; @Nullable private final CompletionCallback mCompletionCallback; @Nullable private final BeforeCompletionCallback mBeforeCompletionCallback; private final AtomicLong mExecutionStartTimeAfterBindMillis = new AtomicLong(); public void onResult(@NonNull ExecuteAppFunctionResponse result) { if (!mOnResultCalled.compareAndSet(false, true)) { Log.w(TAG, "Ignore subsequent calls to onResult/onError()"); return; } try { if (mBeforeCompletionCallback != null) { mBeforeCompletionCallback.beforeOnSuccess(result); } mCallback.onSuccess(result); if (mCompletionCallback != null) { mCompletionCallback.finalizeOnSuccess( result, mExecutionStartTimeAfterBindMillis.get()); } } catch (RemoteException ex) { Log.w(TAG, "Failed to invoke the callback", ex); } } public void onError(@NonNull AppFunctionException error) { if (!mOnResultCalled.compareAndSet(false, true)) { Log.w(TAG, "Ignore subsequent calls to onResult/onError()"); return; } try { mCallback.onError(error); if (mCompletionCallback != null) { mCompletionCallback.finalizeOnError( error, mExecutionStartTimeAfterBindMillis.get()); } } catch (RemoteException ex) { Log.w(TAG, "Failed to invoke the callback", ex); } }該設計模式必要性：目標應用屬于第三方代碼，可能錯誤多次調用回調。AtomicBoolean.compareAndSet()保證僅第一次調用生效。捕獲RemoteException：如果回調進程在結果返回前已死亡，異常僅打日志，不會崩潰 system_server。完成鉤子：BeforeCompletionCallback與CompletionCallback允許 system_server 在回調交付前后執(zhí)行附加邏輯（埋點日志、URI 授權、訪問歷史記錄）。public interface CompletionCallback { void finalizeOnSuccess( ExecuteAppFunctionResponse result, long executionStartTimeMillis); void finalizeOnError( AppFunctionException error, long executionStartTimeMillis); } public interface BeforeCompletionCallback { void beforeOnSuccess(ExecuteAppFunctionResponse result); }耗時統(tǒng)計：mExecutionStartTimeAfterBindMillis記錄服務綁定完成之后的執(zhí)行開始時刻，區(qū)分綁定開銷與真正業(yè)務執(zhí)行耗時。禁用機制：提供disable()，請求被取消或超時時阻止后續(xù)回調交付。51.2.13 executeAppFunction 實現深度解析system_server 的executeAppFunction是整個框架最核心路徑，逐行解析從 AIDL 入口到綁定目標服務的完整鏈路。步驟 1：入口與初始校驗@Override public ICancellationSignal executeAppFunction( @NonNull ExecuteAppFunctionAidlRequest requestInternal, @NonNull IExecuteAppFunctionCallback executeAppFunctionCallback) { int callingUid = Binder.getCallingUid(); int callingPid = Binder.getCallingPid(); final SafeOneTimeExecuteAppFunctionCallback safeExecuteAppFunctionCallback = initializeSafeExecuteAppFunctionCallback( requestInternal, executeAppFunctionCallback, callingUid); String validatedCallingPackage; try { validatedCallingPackage = mCallerValidator.validateCallingPackage(requestInternal.getCallingPackage()); mCallerValidator.verifyTargetUserHandle( requestInternal.getUserHandle(), validatedCallingPackage); } catch (SecurityException exception) { safeExecuteAppFunctionCallback.onError( new AppFunctionException( AppFunctionException.ERROR_DENIED, exception.getMessage())); return null; }SafeOneTimeExecuteAppFunctionCallback包裝，保證無論目標應用多次應答還是崩潰，只返回一次成功 / 錯誤。步驟 2：線程池異步執(zhí)行，不阻塞 Binder 線程ICancellationSignal localCancelTransport = CancellationSignal.createTransport(); THREAD_POOL_EXECUTOR.execute( () - { try { executeAppFunctionInternal( requestInternal, callingUid, callingPid, localCancelTransport, safeExecuteAppFunctionCallback, executeAppFunctionCallback.asBinder()); } catch (Exception e) { safeExecuteAppFunctionCallback.onError( mapExceptionToExecuteAppFunctionResponse(e)); } }); return localCancelTransport; }任務提交至THREAD_POOL_EXECUTOR，避免占用 Binder 線程池。步驟 3：權限與狀態(tài)基礎校驗（工作線程）@WorkerThread private void executeAppFunctionInternal(...) { // 企業(yè)策略校驗 if (!mCallerValidator.verifyEnterprisePolicyIsAllowed(callingUser, targetUser)) { safeExecuteAppFunctionCallback.onError( new AppFunctionException( AppFunctionException.ERROR_ENTERPRISE_POLICY_DISALLOWED, ...)); return; } // 目標包名校驗非空 if (TextUtils.isEmpty(targetPackageName)) { safeExecuteAppFunctionCallback.onError( new AppFunctionException( AppFunctionException.ERROR_INVALID_ARGUMENT, ...)); return; }步驟 4：鏈式 Future 完成權限校驗 + AppSearch 讀取啟用狀態(tài)實現使用AndroidFuture.thenCompose()做非阻塞權限校驗，緊接著查詢 AppSearch 獲取函數啟用狀態(tài)。mCallerValidator .verifyCallerCanExecuteAppFunction( callingUid, callingPid, targetUser, requestInternal.getCallingPackage(), targetPackageName, requestInternal.getClientRequest().getFunctionIdentifier()) .thenCompose(canExecuteResult - { if (canExecuteResult == CAN_EXECUTE_APP_FUNCTIONS_DENIED) { return AndroidFuture.failedFuture( new SecurityException("Caller does not have permission")); } return isAppFunctionEnabled( functionIdentifier, targetPackageName, getAppSearchManagerAsUser(userHandle), THREAD_POOL_EXECUTOR) .thenApply(isEnabled - { if (!isEnabled) { throw new DisabledAppFunctionException("Disabled"); } return canExecuteResult; }); })步驟 5：服務解析與綁定.thenAccept(canExecuteResult - { int bindFlags = Context.BIND_AUTO_CREATE; if (canExecuteResult == CAN_EXECUTE_APP_FUNCTIONS_ALLOWED_HAS_PERMISSION) { bindFlags |= Context.BIND_FOREGROUND_SERVICE; } Intent serviceIntent = mInternalServiceHelper.resolveAppFunctionService( targetPackageName, targetUser); // 授予隱式可見性，允許目標看到調用方 mPackageManagerInternal.grantImplicitAccess( grantRecipientUserId, serviceIntent, grantRecipientAppId, callingUid, /* direct= */ true); bindAppFunctionServiceUnchecked( requestInternal, serviceIntent, targetUser, localCancelTransport, safeExecuteAppFunctionCallback, bindFlags, callerBinder, callingUid); })關鍵點：調用方具備EXECUTE_APP_FUNCTIONS權限時，使用BIND_FOREGROUND_SERVICE提升目標服務進程優(yōu)先級。自調用（同一包名）不會獲得該優(yōu)先級提升。51.2.14 RemoteServiceCaller 模式RemoteServiceCallerImpl實現一次性 Service 綁定模式：public class RemoteServiceCallerImplT implements RemoteServiceCallerT { public boolean runServiceCall( Intent intent, int bindFlags, UserHandle userHandle, long cancellationTimeoutMillis, CancellationSignal cancellationSignal, RunServiceCallCallbackT callback, IBinder callerBinder) { OneOffServiceConnection serviceConnection = new OneOffServiceConnection(intent, bindFlags, userHandle, cancellationTimeoutMillis, cancellationSignal, callback, callerBinder); return serviceConnection.bindAndRun(); }OneOffServiceConnection是自定義ServiceConnection，行為：調用Context.bindServiceAsUser()連接目標服務設置取消監(jiān)聽器，超時后執(zhí)行 unbind監(jiān)聽調用方 Binder 死亡，調用方進程死亡則自動取消回調完成后自動解綁private class OneOffServiceConnection implements ServiceConnection, ServiceUsageCompleteListener { public boolean bindAndRun() { boolean bindServiceResult = mContext.bindServiceAsUser(mIntent, this, mFlags, mUserHandle); if (bindServiceResult) { mCancellationSignal.setOnCancelListener(() - { mCallback.onCancelled(); mHandler.postDelayed(mCancellationTimeoutRunnable, mCancellationTimeoutMillis); }); mDirectServiceVulture = () - { Slog.w(TAG, "Caller process onDeath signal received"); mCancellationSignal.cancel(); }; mCallerBinder.linkToDeath(mDirectServiceVulture, 0); } return bindServiceResult; }該模式保證資源一定被清理，無論調用方崩潰、目標應用崩潰或者用戶主動取消。51.2.15 多用戶支持實現完整支持多用戶。每個用戶擁有：獨立 AppSearch 數據庫，保存靜態(tài)函數元數據獨立PackageMonitor監(jiān)聽包變更MultiUserDynamicAppFunctionRegistry中獨立分片保存運行時注冊項權限子系統(tǒng)持久化獨立的（代理，目標）訪問狀態(tài)與標志位public void onUserUnlocked(TargetUser user) { if (enableDynamicAppFunctions()) { mAppFunctionMetadataObserver.registerAppSearchObserverForUser(user); } else { registerAppSearchObserver(user); } trySyncRuntimeMetadata(user.getUserHandle(), ...); PackageMonitor pkgMonitorForUser = AppFunctionPackageMonitor.registerPackageMonitorForUser( mContext, user, mAppFunctionMetadataObserver); mPackageMonitors.append(user.getUserIdentifier(), pkgMonitorForUser); mDynamicAppFunctionRegistry.onUserUnlocked(user, ...); } public void onUserStopping(@NonNull TargetUser user) { if (enableDynamicAppFunctions()) { mAppFunctionMetadataObserver.unregisterAppSearchObserverForUser(user); } else { MetadataSyncPerUser.removeUserSyncAdapter(user.getUserHandle()); } mPackageMonitors.get(user.getUserIdentifier()).unregister(); mPackageMonitors.delete(user.getUserIdentifier()); } public void onUserStopped(@NonNull TargetUser user) { mDynamicAppFunctionRegistry.onUserStopped(user); }動態(tài)函數標記開啟時，每個用戶的 AppSearch 觀察者由AppFunctionMetadataObserver持有，變更事件同時分發(fā)給內部元數據緩存以及客戶端observeAppFunctions回調。運行時注冊表以 userId 為 key；當用戶停止，該用戶下全部注冊項被銷毀。51.2.16 代理白名單架構Android17 代理白名單不再是 DeviceConfig 與 Settings.Secure 字符串拼接，改用平臺AllowlistManager，白名單 ID 為ALLOWLIST_ID_APP_FUNCTION。輸入簽名代理包，返回該代理可訪問的目標包集合。AppFunctions 服務通過SystemAppFunctionAllowlistReader消費該能力。讀取器將代理最新簽名證書哈希封裝為SignedPackage，向AllowlistManager查詢合法目標包；查詢結果放入 LruCache 緩存，相同代理重復執(zhí)行可省去一次 IPC。@Override public CompletableFutureBoolean isAllowlisted( String agentPackageName, String targetPackageName, int userId) { if (agentPackageName.equals(targetPackageName)) { return AndroidFuture.completedFuture(true); // 自身函數永遠允許 } SignedPackage agentSignedPackage = new SignedPackage(agentPackageName, /* certificate digest */ ...); maybeStartAllowlistListener(); return getValidTargetPackages(agentSignedPackage) .thenApply(allowlistTargets - allowlistTargets.contains(WILDCARD_PACKAGE_NAME) || allowlistTargets.contains(targetPackageName)); }三條關鍵行為：自訪問隱式放行：代理與目標包相同，應用永遠可以調用自身函數。通配符目標：白名單配置通配符包名，代理可訪問全部目標。變更監(jiān)聽：首次使用注冊OnAllowlistChangedListener；白名單更新時緩存自動失效，不再只在開機階段讀取配置字符串。51.2.17 AppFunction 響應中的 URI 授權當目標應用在響應中返回 content URI，框架可以為調用代理授予臨時 URI 權限。private final IUriGrantsManager mUriGrantsManager; private final UriGrantsManagerInternal mUriGrantsManagerInternal; private final IBinder mPermissionOwner; // 構造函數中初始化 mPermissionOwner = mUriGrantsManagerInternal.newUriPermissionOwner("appfunctions");響應中的AppFunctionUriGrant指明需要向代理授予哪些 URI。授權經由mUriGrantsManager.grantUriPermissionFromOwner完成，綁定到 AppFunctions 專屬 permission owner。權限有效期直到 owner 釋放或者設備重啟。51.2.18 Shell 命令支持服務實現onShellCommand()，用于開發(fā)者調試。@Override public void onShellCommand( FileDescriptor in, FileDescriptor out, FileDescriptor err, @NonNull String[] args, ShellCallback callback, @NonNull ResultReceiver resultReceiver) { new AppFunctionManagerServiceShellCommand(mContext, this) .exec(this, in, out, err, args, callback, resultReceiver); }adb 命令：adb shell cmd app_function51.2.19 服務啟動與生命周期本框架屬于SystemService。AppFunctionManagerService.onStart()，當AppFunctionManagerConfiguration.isSupported(context)為 true 時，把 Binder 服務發(fā)布到Context.APP_FUNCTION_SERVICE；開啟 App Interaction API 標記時，額外發(fā)布本地服務AppInteractionService。@Override public void onStart() { if (AppFunctionManagerConfiguration.isSupported(getContext())) { publishBinderService(Context.APP_FUNCTION_SERVICE, mServiceImpl); } if (Flags.enableAppInteractionApi()) { publishLocalService(AppInte