HwBinder流程分析

    HwBinder与普通Binder是一样的,区别是前者是专门给硬件使用，后者是给一般的应用程序使用，为了不影响现有的binder，单独增加硬件的HwBinder来实现硬件相关进程的通信。

HwBinder也是有四部分组成：hwservermanager、server、client，driver，其中Driver部分与普通Binder是一样的，《Android图形显示系统》对Binder的原理进行过详细的介绍，这里主要介绍HwBinder与Binder不一样的地方。

服务管理进程

    首先是服务管理进程由HwServiceManager服务，主要流程如下：

/* system/hwservicemanager/service.cpp */ int main() {     ServiceManager *manager = new ServiceManager();     if (!manager->add(serviceName, manager)) {}     TokenManager *tokenManager = new TokenManager();     if (!manager->add(serviceName, tokenManager)) {} sp<BnHwServiceManager> service = new BnHwServiceManager(manager); IPCThreadState::self()->setTheContextObject(service); ProcessState::self()->becomeContextManager(nullptr, nullptr);     joinRpcThreadpool(); }

  HwServiceManager与ServiceManager不一样的地方是hwservicemanager有Binder节点，并把Binder节点通过setTheContextObject传给了驱动，并且使用IPCThreadState把主线程加入到线程池来循环处理请求。意味着HwServiceManager是支持并发访问的，可以同时处理多个请求，

服务进程

    Server的开发比较简单，service.cpp的实现比较简单，如下所示。

int main() {     return defaultPassthroughServiceImplementation<IDemo>(); }

   defaultPassthroughServiceImplementation的实现流程如下。

/* system\libhidl\transport\include\hidl\LegacySupport.h*/ template<class Interface> __attribute__((warn_unused_result)) status_t defaultPassthroughServiceImplementation(size_t maxThreads = 1) {     return defaultPassthroughServiceImplementation<Interface>("default", maxThreads); } template<class Interface> __attribute__((warn_unused_result)) status_t defaultPassthroughServiceImplementation(std::string name,                                             size_t maxThreads = 1) {     configureRpcThreadpool(maxThreads, true);     status_t result = registerPassthroughServiceImplementation<Interface>(name);     joinRpcThreadpool();      return UNKNOWN_ERROR; } template<class Interface> __attribute__((warn_unused_result)) status_t registerPassthroughServiceImplementation(         std::string name = "default") {     sp<Interface> service = Interface::getService(name, true /* getStub */);     status_t status = service->registerAsService(name);     return status; }

    最后调registerPassthroughServiceImplementation来注册服务，把Interface替换成IDemo得到以下。

__attribute__((warn_unused_result)) status_t registerPassthroughServiceImplementation(         std::string name = "default") {     sp<IDemo> service = IDemo::getService(name, true /* getStub */);     status_t status = service->registerAsService(name);     return status; }

    调用的是IDemo的接口getService得到IDemo节点，通过registerAsServie来添加到服务管理HwServiceManager。

IDemo::getService在DemoAll.cpp实现，该文件是自动生成的，路径如下

out/soong/.intermediates/hardware/interfaces/demo/1.0/android.hardware.demo@1.0_genc++/gen/android/hardware/demo/1.0/DemoAll.cpp  ::android::sp<IDemo> IDemo::getService(const std::string &serviceName, const bool getStub) { return ::android::hardware::details::getServiceInternal<BpHwDemo>( serviceName, true, getStub); }

getService主要通过getServiceInternal来实现，继续往下：

system\libhidl\transport\include\hidl\HidlTransportSupport.h template <typename BpType, typename IType = typename BpType::Pure,           typename = std::enable_if_t<std::is_same<i_tag, typename IType::_hidl_tag>::value>,           typename = std::enable_if_t<std::is_same<bphw_tag, typename BpType::_hidl_tag>::value>> sp<IType> getServiceInternal(const std::string& instance, bool retry, bool getStub) {     using ::android::hidl::base::V1_0::IBase;     sp<IBase> base = getRawServiceInternal(IType::descriptor, instance, retry, getStub);     if (base->isRemote()) {         // getRawServiceInternal guarantees we get the proper class         return sp<IType>(new BpType(toBinder<IBase>(base)));     }     return IType::castFrom(base); }

system\libhidl\transport\ServiceManagement.cpp sp<::android::hidl::base::V1_0::IBase> getRawServiceInternal(const std::string& descriptor,                                                   const std::string& instance,                                                   bool retry,  bool getStub) {     const sp<IServiceManager> pm = getPassthroughServiceManager();     sp<IBase> base = pm->get(descriptor, instance).withDefault(nullptr);     return base; } sp<IServiceManager1_0> getPassthroughServiceManager() {     return getPassthroughServiceManager1_1(); } sp<IServiceManager1_1> getPassthroughServiceManager1_1() {     static sp<PassthroughServiceManager> manager(new PassthroughServiceManager());     return manager; } struct PassthroughServiceManager : IServiceManager1_1 {     static void openLibs(         const std::string& fqName,         const std::function<bool /* continue */ (void* /* handle */, const std::string& /* lib */,                                                  const std::string& /* sym */)>& eachLib) {         const std::string sym = "HIDL_FETCH_" + ifaceName;/     }     Return<sp<IBase>> get(const hidl_string& fqName,                           const hidl_string& name) override {         sp<IBase> ret = nullptr;         openLibs(fqName, [&](void* handle, const std::string &lib, const std::string &sym) {             IBase* (*generator)(const char* name);             *(void **)(&generator) = dlsym(handle, sym.c_str());            ret = (*generator)(name.c_str());            using ::android::hardware::details::getDescriptor;            std::string actualFqName = getDescriptor(ret.get());            registerReference(actualFqName, name);         });         return ret;     } }

最终通过遍历so加载得到符号HIDL_FETCH_IDemo，并调用得到Demo的对象，在Demo.h已经定义 extern "C" IDemo* HIDL_FETCH_IDemo(const char* name);  在函数前加extern “C”才能使用dlsym 加载到该方法的地址。

下一步Server通过registerAsService把Binder注册到ServiceManager的流程，实现还是在DemoAll.cpp里。

out/soong/.intermediates/hardware/interfaces/demo/1.0/android.hardware.demo@1.0_genc++/gen/android/hardware/demo/1.0/DemoAll.cpp ::android::status_t IDemo::registerAsService(const std::string &serviceName) {     const ::android::sp<::android::hidl::manager::V1_0::IServiceManager> sm             = ::android::hardware::defaultServiceManager();     ::android::hardware::Return<bool> ret = sm->add(serviceName.c_str(), this); }

这里也是通过defaultServiceManager找到ServiceManager的索引对象，然后调add接口来添加Demo的对象。

system/hwservicemanager/ServieManager.cpp Return<bool> ServiceManager::add(const hidl_string& name, const sp<IBase>& service) {     auto ret = service->interfaceChain([&](const auto &interfaceChain) {         for(size_t i = 0; i < interfaceChain.size(); i++) {             const std::string fqName = interfaceChain[i];             PackageInterfaceMap &ifaceMap = mServiceMap[fqName];             HidlService *hidlService = ifaceMap.lookup(name);             if (hidlService == nullptr) {                 ifaceMap.insertService(                     std::make_unique<HidlService>(fqName, name, service, pid));             } else {                 hidlService->setService(service, pid);             }             ifaceMap.sendPackageRegistrationNotification(fqName, name);         }     }); }

在HwServiceManager注册Binder的时候，也是需要name的，不过是通过interfaceChain来获取Demo Binder对象的name。最后把结果保存到ifaceMap里，这里跟ServiceManager只保存Binder的handle也是不一样的。

Server注册服务后，Client进程可以查找到Server的binder对象，并调用相关的接口来向Server请求服务了

客户进程

接下来是客户进程的流程，

int main() {     android::sp<IDemo> service = IDemo::getService();     service->sayHello("HIDL !!!", [&](hidl_string result) {                 printf("get from server %s\n", result.c_str()); });     return 0; }

Client进程主要先调IDemo::getService来得到binder对象，并调其方法sayHello，把请求发给Server。

Client进程也通过getService获取Demo索引对象，跟Server进程获取到的Demo节点对象是不太一样的。

out/soong/.intermediates/hardware/interfaces/demo/1.0/android.hardware.demo@1.0_genc++_headers/gen/android/hardware/demo/1.0/IDemo.h struct IDemo : public ::android::hidl::base::V1_0::IBase {     static ::android::sp<IDemo> getService(const std::string &serviceName="default", bool getStub=false); }

    Server进程的registerPassthroughServiceImplementation也使用过getService，只不过getStub为true，这里使用默认参数为false，主要是getRawServiceInternal有区别。

system\libhidl\transport\ServiceManagement.cpp sp<::android::hidl::base::V1_0::IBase> getRawServiceInternal(const std::string& descriptor,                                                              const std::string& instance,                                                              bool retry, bool getStub) {     const sp<IServiceManager1_1> sm = defaultServiceManager1_1();     for (int tries = 0; !getStub && (vintfHwbinder || vintfLegacy); tries++) {         Return<sp<IBase>> ret = sm->get(descriptor, instance);         sp<IBase> base = ret;         return base;     } }

getStub为false，会从ServiceManager来查找服务。

system/hwservicemanager/ServieManager.cpp Return<sp<IBase>> ServiceManager::get(const hidl_string& hidlFqName,                                       const hidl_string& hidlName) {     const std::string fqName = hidlFqName;     const std::string name = hidlName;     auto ifaceIt = mServiceMap.find(fqName);     const PackageInterfaceMap &ifaceMap = ifaceIt->second;     const HidlService *hidlService = ifaceMap.lookup(name);     sp<IBase> service = hidlService->getService();     return service; }

Client进程是从HwManager查询回来的索引对象。原理跟普通的binder一样。只不过这里封装的比普通的Binder要复杂。

上面结合一个简单的例子介绍了HIDL的用法，并解析了相关的代码，HIDL基于hwbinder进行进程间通信。