adb shell service命令与SurfaceFlinger调试

01 基本用法

• 首先看一下使用说明，带上参数-h 或 -？

$ adb shell service -h
Usage: service [-h|-?]
       service list
       service check SERVICE
       service call SERVICE CODE [i32 N | i64 N | f N | d N | s16 STR | null | fd f | nfd n | afd f ] ...
Options:
   i32: Write the 32-bit integer N into the send parcel.
   i64: Write the 64-bit integer N into the send parcel.
     f: Write the 32-bit single-precision number N into the send parcel.
     d: Write the 64-bit double-precision number N into the send parcel.
   s16: Write the UTF-16 string STR into the send parcel.
  null: Write a null binder into the send parcel.
    fd: Write a file descriptor for the file f into the send parcel.
   nfd: Write the file descriptor n into the send parcel.
   afd: Write an ashmem file descriptor for a region containing the data from
          file f into the send parcel.

• 使用 service list 列出所有系统服务

$ adb shell service list
Found 303 services:
0       DockObserver: []
1       SurfaceFlinger: [android.ui.ISurfaceComposer]
2       SurfaceFlingerAIDL: [android.gui.ISurfaceComposer]
3       accessibility: [android.view.accessibility.IAccessibilityManager]
4       account: [android.accounts.IAccountManager]
5       activity: [android.app.IActivityManager]
6       activity_task: [android.app.IActivityTaskManager]
7       adb: [android.debug.IAdbManager]
8       adservices_manager: [android.app.adservices.IAdServicesManager]
9       alarm: [android.app.IAlarmManager]
....

• 使用check service 检查服务是否存在

$ adb shell service check SurfaceFlinger
Service SurfaceFlinger: found

• 使用call service 调用服务

service call SERVICE CODE [i32 N | i64 N | f N | d N | s16 STR | null | fd f | nfd n | afd f ] ...

• SERVICE 就是list查询到的系统服务的名字；

• CODE就是就是binder机制中，onTransact函数中的第一个参数；

• 后面是要传递的参数，参数类型+参数值

02 用法举例

我们用一个例子来说明，如何通过service命令和系统服务互动。

打开SurfaceFlinger刷新率并显示在屏幕上，传递一个int32_t类型的参数，值1打开，值0是关闭：

$ adb shell service call SurfaceFlinger 1034 i32 1
Result: Parcel(NULL)

会看到如下效果：

可以看下源码（下面我截取的是Android 14的源码来解析的）：

/frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

status_t SurfaceFlinger::onTransact(uint32_t code, const Parcel& data, Parcel* reply,
                                    uint32_t flags) {
...
            case 1034: {
                auto future = mScheduler->schedule(
                        [&]() FTL_FAKE_GUARD(mStateLock) FTL_FAKE_GUARD(kMainThreadContext) {
                            switch (n = data.readInt32()) {
                                case 0:
                                case 1:
                                    enableRefreshRateOverlay(static_cast<bool>(n));
                                    break;
                                default:
                                    reply->writeBool(isRefreshRateOverlayEnabled());
                            }
                        });
 
                future.wait();
                return NO_ERROR;
            }
...
}