AIDL Hal 开发指南 3 ———— AIDL HAL 实例分析1

我们还是以振动器的调用过程为主线，来分析振动器 HAL 的实现细节。

整体架构如下：

1. App 如何访问到硬件

Android12 及以后，App 中可以通过以下代码操作振动器：

        val vibratorManager = getSystemService(Context.VIBRATOR_MANAGER_SERVICE) as VibratorManager
        val vib = vibratorManager.defaultVibrator
        if (vib.hasVibrator()) {
            val vibrationEffect = VibrationEffect.createOneShot(500, VibrationEffect.DEFAULT_AMPLITUDE)
            vib.vibrate(vibrationEffect)
        }

当然执行代码之前需要在 AndroidManifest.xml 中申明振动器权限：

<uses-permission android:name="android.permission.VIBRATE" />

·

App 端代码分析

接下来我们来分析 App 端的代码。

getSystemService 的实现如下：

    // frameworks/base/core/java/android/app/Activity.java
    @Override
    public Object getSystemService(@ServiceName @NonNull String name) {
        if (getBaseContext() == null) {
            throw new IllegalStateException(
                    "System services not available to Activities before onCreate()");
        }

        if (WINDOW_SERVICE.equals(name)) {
            return mWindowManager;
        } else if (SEARCH_SERVICE.equals(name)) {
            ensureSearchManager();
            return mSearchManager;
        }
        return super.getSystemService(name);
    }

接着调用父类的 getSystemService 方法：

    // frameworks/base/core/java/android/view/ContextThemeWrapper.java
    @Override
    public Object getSystemService(String name) {
        if (LAYOUT_INFLATER_SERVICE.equals(name)) {
            if (mInflater == null) {
                mInflater = LayoutInflater.from(getBaseContext()).cloneInContext(this);
            }
            return mInflater;
        }
        return getBaseContext().getSystemService(name);
    }

getBaseContext 返回的是一个 ContextImpl 对象，这里接着调用 ContextImpl 对象的 getSystemService 方法：

    // frameworks/base/core/java/android/app/ContextImpl.java
    @Override
    public Object getSystemService(String name) {
        if (vmIncorrectContextUseEnabled()) {
            // Check incorrect Context usage.
            if (WINDOW_SERVICE.equals(name) && !isUiContext()) {
                final String errorMessage = "Tried to access visual service "
                        + SystemServiceRegistry.getSystemServiceClassName(name)
                        + " from a non-visual Context:" + getOuterContext();
                final String message = "WindowManager should be accessed from Activity or other "
                        + "visual Context. Use an Activity or a Context created with "
                        + "Context#createWindowContext(int, Bundle), which are adjusted to "
                        + "the configuration and visual bounds of an area on screen.";
                final Exception exception = new IllegalAccessException(errorMessage);
                StrictMode.onIncorrectContextUsed(message, exception);
                Log.e(TAG, errorMessage + " " + message, exception);
            }
        }
        return SystemServiceRegistry.getSystemService(this, name);
    }

接着调用 SystemServiceRegistry 的 static 方法 getSystemService：

// frameworks/base/core/java/android/app/SystemServiceRegistry.java

    private static final Map<String, ServiceFetcher<?>> SYSTEM_SERVICE_FETCHERS =
            new ArrayMap<String, ServiceFetcher<?>>();

        
    public static Object getSystemService(ContextImpl ctx, String name) {
        if (name == null) {
            return null;
        }
        final ServiceFetcher<?> fetcher = SYSTEM_SERVICE_FETCHERS.get(name);
        if (fetcher == null) {
            if (sEnableServiceNotFoundWtf) {
                Slog.wtf(TAG, "Unknown manager requested: " + name);
            }
            return null;
        }

        final Object ret = fetcher.getService(ctx);
        if (sEnableServiceNotFoundWtf && ret == null) {
            // Some services do return null in certain situations, so don't do WTF for them.
            switch (name) {
                case Context.CONTENT_CAPTURE_MANAGER_SERVICE:
                case Context.APP_PREDICTION_SERVICE:
                case Context.INCREMENTAL_SERVICE:
                case Context.ETHERNET_SERVICE:
                case Context.CONTEXTHUB_SERVICE:
                case Context.VIRTUALIZATION_SERVICE:
                case Context.VIRTUAL_DEVICE_SERVICE:
                    return null;
            }
            Slog.wtf(TAG, "Manager wrapper not available: " + name);
            return null;
        }
        return ret;
    }

getSystemService 方法中，会从 Map<String, ServiceFetcher<?>> SYSTEM_SERVICE_FETCHERS 获取到一个 ServiceFetcher 对象，然后调用 ServiceFetcher 对象的 getService 函数获取到服务并返回。

接下来的问题是 ServiceFetcher 对象是哪里来的？

在 SystemServiceRegistry 的静态块中，会调用 registerService 方法向 Map<String, ServiceFetcher<?>> SYSTEM_SERVICE_FETCHERS 注册 ServiceFetcher 对象。

// frameworks/base/core/java/android/app/SystemServiceRegistry.java
static {
  //......
        registerService(Context.VIBRATOR_MANAGER_SERVICE, VibratorManager.class,
                new CachedServiceFetcher<VibratorManager>() {
                    @Override
                    public VibratorManager createService(ContextImpl ctx) {
                        return new SystemVibratorManager(ctx);
                    }}); 
  //......
}

    private static final Map<Class<?>, String> SYSTEM_SERVICE_NAMES =
            new ArrayMap<Class<?>, String>();
    private static final Map<String, ServiceFetcher<?>> SYSTEM_SERVICE_FETCHERS =
            new ArrayMap<String, ServiceFetcher<?>>();
    private static final Map<String, String> SYSTEM_SERVICE_CLASS_NAMES = new ArrayMap<>();

    // 参数放到 Map 中
    private static <T> void registerService(@NonNull String serviceName,
            @NonNull Class<T> serviceClass, @NonNull ServiceFetcher<T> serviceFetcher) {
        SYSTEM_SERVICE_NAMES.put(serviceClass, serviceName);
        SYSTEM_SERVICE_FETCHERS.put(serviceName, serviceFetcher);
        SYSTEM_SERVICE_CLASS_NAMES.put(serviceName, serviceClass.getSimpleName());
    }

这里核心是注册了一个匿名对象 CachedServiceFetcher。

getSystemService 时会先获取到 CachedServiceFetcher 对象，然后调用其 getService 方法

// frameworks/base/core/java/android/app/SystemServiceRegistry.java
// SystemServiceRegistry 的静态内部类
   static abstract class CachedServiceFetcher<T> implements ServiceFetcher<T> {
        private final int mCacheIndex;

        CachedServiceFetcher() {
            // Note this class must be instantiated only by the static initializer of the
            // outer class (SystemServiceRegistry), which already does the synchronization,
            // so bare access to sServiceCacheSize is okay here.
            mCacheIndex = sServiceCacheSize++;
        }

        @Override
        @SuppressWarnings("unchecked")
        public final T getService(ContextImpl ctx) {
            final Object[] cache = ctx.mServiceCache;
            final int[] gates = ctx.mServiceInitializationStateArray;
            boolean interrupted = false;

            T ret = null;

            for (;;) {
                boolean doInitialize = false;
                synchronized (cache) {
                    // Return it if we already have a cached instance.
                    T service = (T) cache[mCacheIndex];
                    if (service != null) {
                        ret = service;
                        break; // exit the for (;;)
                    }

                    // If we get here, there's no cached instance.

                    // Grr... if gate is STATE_READY, then this means we initialized the service
                    // once but someone cleared it.
                    // We start over from STATE_UNINITIALIZED.
                    // Similarly, if the previous attempt returned null, we'll retry again.
                    if (gates[mCacheIndex] == ContextImpl.STATE_READY
                            || gates[mCacheIndex] == ContextImpl.STATE_NOT_FOUND) {
                        gates[mCacheIndex] = ContextImpl.STATE_UNINITIALIZED;
                    }

                    // It's possible for multiple threads to get here at the same time, so
                    // use the "gate" to make sure only the first thread will call createService().

                    // At this point, the gate must be either UNINITIALIZED or INITIALIZING.
                    if (gates[mCacheIndex] == ContextImpl.STATE_UNINITIALIZED) {
                        doInitialize = true;
                        gates[mCacheIndex] = ContextImpl.STATE_INITIALIZING;
                    }
                }

                if (doInitialize) {
                    // Only the first thread gets here.

                    T service = null;
                    @ServiceInitializationState int newState = ContextImpl.STATE_NOT_FOUND;
                    try {
                        // This thread is the first one to get here. Instantiate the service
                        // *without* the cache lock held.
                        //调用 createService 构建一个 Service 对象
                        service = createService(ctx);
                        newState = ContextImpl.STATE_READY;

                    } catch (ServiceNotFoundException e) {
                        onServiceNotFound(e);

                    } finally {
                        synchronized (cache) {
                            cache[mCacheIndex] = service;
                            gates[mCacheIndex] = newState;
                            cache.notifyAll();
                        }
                    }
                    ret = service;
                    break; // exit the for (;;)
                }
                // The other threads will wait for the first thread to call notifyAll(),
                // and go back to the top and retry.
                synchronized (cache) {
                    // Repeat until the state becomes STATE_READY or STATE_NOT_FOUND.
                    // We can't respond to interrupts here; just like we can't in the "doInitialize"
                    // path, so we remember the interrupt state here and re-interrupt later.
                    while (gates[mCacheIndex] < ContextImpl.STATE_READY) {
                        try {
                            // Clear the interrupt state.
                            interrupted |= Thread.interrupted();
                            cache.wait();
                        } catch (InterruptedException e) {
                            // This shouldn't normally happen, but if someone interrupts the
                            // thread, it will.
                            Slog.w(TAG, "getService() interrupted");
                            interrupted = true;
                        }
                    }
                }
            }
            if (interrupted) {
                Thread.currentThread().interrupt();
            }
            // 返回 createService 方法构建的对象
            return ret;
        }

        // 由子类实现
        public abstract T createService(ContextImpl ctx) throws ServiceNotFoundException;
    }

可以看出 getService 中会调用 createService 创建服务对象并返回，createService 是一个抽象方法，由子类返回。

对于振动器服务，返回的是一个 SystemVibratorManager 对象：

public class SystemVibratorManager  extends VibratorManager {
    private static final String TAG = "VibratorManager";

    private final IVibratorManagerService mService;
    private final Context mContext;
    private final Binder mToken = new Binder();
    private final Object mLock = new Object();
    @GuardedBy("mLock")
    private int[] mVibratorIds;
    @GuardedBy("mLock")
    private final SparseArray<Vibrator> mVibrators = new SparseArray<>();

    @GuardedBy("mLock")
    private final ArrayMap<Vibrator.OnVibratorStateChangedListener,
            OnVibratorStateChangedListenerDelegate> mListeners = new ArrayMap<>();

    /**
     * @hide to prevent subclassing from outside of the framework
     */
    public SystemVibratorManager(Context context) {
        super(context);
        mContext = context;
        // 获取到 IVibratorManagerService 服务的客户代理端
        // 其他方法的功能都是通过 mService 来实现的
        mService = IVibratorManagerService.Stub.asInterface(
                ServiceManager.getService(Context.VIBRATOR_MANAGER_SERVICE));
    }

    @NonNull
    @Override
    public int[] getVibratorIds() {
        synchronized (mLock) {
            if (mVibratorIds != null) {
                return mVibratorIds;
            }
            try {
                if (mService == null) {
                    Log.w(TAG, "Failed to retrieve vibrator ids; no vibrator manager service.");
                } else {
                    return mVibratorIds = mService.getVibratorIds();
                }
            } catch (RemoteException e) {
                e.rethrowFromSystemServer();
            }
            return new int[0];
        }
    }

    @NonNull
    @Override
    public Vibrator getVibrator(int vibratorId) {
        synchronized (mLock) {
            Vibrator vibrator = mVibrators.get(vibratorId);
            if (vibrator != null) {
                return vibrator;
            }
            VibratorInfo info = null;
            try {
                if (mService == null) {
                    Log.w(TAG, "Failed to retrieve vibrator; no vibrator manager service.");
                } else {
                    info = mService.getVibratorInfo(vibratorId);
                }
            } catch (RemoteException e) {
                e.rethrowFromSystemServer();
            }
            if (info != null) {
                vibrator = new SingleVibrator(info);
                mVibrators.put(vibratorId, vibrator);
            } else {
                vibrator = NullVibrator.getInstance();
            }
            return vibrator;
        }
    }

    @NonNull
    @Override
    public Vibrator getDefaultVibrator() {
        return mContext.getSystemService(Vibrator.class);
    }

    @Override
    public boolean setAlwaysOnEffect(int uid, String opPkg, int alwaysOnId,
            @Nullable CombinedVibration effect, @Nullable VibrationAttributes attributes) {
        if (mService == null) {
            Log.w(TAG, "Failed to set always-on effect; no vibrator manager service.");
            return false;
        }
        try {
            return mService.setAlwaysOnEffect(uid, opPkg, alwaysOnId, effect, attributes);
        } catch (RemoteException e) {
            Log.w(TAG, "Failed to set always-on effect.", e);
        }
        return false;
    }

    @Override
    public void vibrate(int uid, String opPkg, @NonNull CombinedVibration effect,
            String reason, @Nullable VibrationAttributes attributes) {
        if (mService == null) {
            Log.w(TAG, "Failed to vibrate; no vibrator manager service.");
            return;
        }
        try {
            mService.vibrate(uid, mContext.getAssociatedDisplayId(), opPkg, effect, attributes,
                    reason, mToken);
        } catch (RemoteException e) {
            Log.w(TAG, "Failed to vibrate.", e);
        }
    }

    @Override
    public void cancel() {
        cancelVibration(VibrationAttributes.USAGE_FILTER_MATCH_ALL);
    }

    @Override
    public void cancel(int usageFilter) {
        cancelVibration(usageFilter);
    }

    private void cancelVibration(int usageFilter) {
        if (mService == null) {
            Log.w(TAG, "Failed to cancel vibration; no vibrator manager service.");
            return;
        }
        try {
            mService.cancelVibrate(usageFilter, mToken);
        } catch (RemoteException e) {
            Log.w(TAG, "Failed to cancel vibration.", e);
        }
    }

    /** Listener for vibrations on a single vibrator. */
    private static class OnVibratorStateChangedListenerDelegate extends
            IVibratorStateListener.Stub {
        private final Executor mExecutor;
        private final Vibrator.OnVibratorStateChangedListener mListener;

        OnVibratorStateChangedListenerDelegate(
                @NonNull Vibrator.OnVibratorStateChangedListener listener,
                @NonNull Executor executor) {
            mExecutor = executor;
            mListener = listener;
        }

        @Override
        public void onVibrating(boolean isVibrating) {
            mExecutor.execute(() -> mListener.onVibratorStateChanged(isVibrating));
        }
    }

    /** Controls vibrations on a single vibrator. */
    private final class SingleVibrator extends Vibrator {
        private final VibratorInfo mVibratorInfo;

        SingleVibrator(@NonNull VibratorInfo vibratorInfo) {
            mVibratorInfo = vibratorInfo;
        }

        @Override
        protected VibratorInfo getInfo() {
            return mVibratorInfo;
        }

        @Override
        public boolean hasVibrator() {
            return true;
        }

        @Override
        public boolean hasAmplitudeControl() {
            return mVibratorInfo.hasAmplitudeControl();
        }

        @Override
        public boolean setAlwaysOnEffect(int uid, String opPkg, int alwaysOnId,
                @Nullable VibrationEffect effect, @Nullable VibrationAttributes attrs) {
            CombinedVibration combined = CombinedVibration.startParallel()
                    .addVibrator(mVibratorInfo.getId(), effect)
                    .combine();
            return SystemVibratorManager.this.setAlwaysOnEffect(uid, opPkg, alwaysOnId, combined,
                    attrs);
        }

        @Override
        public void vibrate(int uid, String opPkg, @NonNull VibrationEffect vibe, String reason,
                @NonNull VibrationAttributes attributes) {
            CombinedVibration combined = CombinedVibration.startParallel()
                    .addVibrator(mVibratorInfo.getId(), vibe)
                    .combine();
            SystemVibratorManager.this.vibrate(uid, opPkg, combined, reason, attributes);
        }

        @Override
        public void cancel() {
            SystemVibratorManager.this.cancel();
        }

        @Override
        public void cancel(int usageFilter) {
            SystemVibratorManager.this.cancel(usageFilter);
        }

        @Override
        public boolean isVibrating() {
            if (mService == null) {
                Log.w(TAG, "Failed to check status of vibrator " + mVibratorInfo.getId()
                        + "; no vibrator service.");
                return false;
            }
            try {
                return mService.isVibrating(mVibratorInfo.getId());
            } catch (RemoteException e) {
                e.rethrowFromSystemServer();
            }
            return false;
        }

        @Override
        public void addVibratorStateListener(@NonNull OnVibratorStateChangedListener listener) {
            Objects.requireNonNull(listener);
            if (mContext == null) {
                Log.w(TAG, "Failed to add vibrate state listener; no vibrator context.");
                return;
            }
            addVibratorStateListener(mContext.getMainExecutor(), listener);
        }

        @Override
        public void addVibratorStateListener(
                @NonNull @CallbackExecutor Executor executor,
                @NonNull OnVibratorStateChangedListener listener) {
            Objects.requireNonNull(listener);
            Objects.requireNonNull(executor);
            if (mService == null) {
                Log.w(TAG,
                        "Failed to add vibrate state listener to vibrator " + mVibratorInfo.getId()
                                + "; no vibrator service.");
                return;
            }
            synchronized (mLock) {
                // If listener is already registered, reject and return.
                if (mListeners.containsKey(listener)) {
                    Log.w(TAG, "Listener already registered.");
                    return;
                }
                try {
                    OnVibratorStateChangedListenerDelegate delegate =
                            new OnVibratorStateChangedListenerDelegate(listener, executor);
                    if (!mService.registerVibratorStateListener(mVibratorInfo.getId(), delegate)) {
                        Log.w(TAG, "Failed to add vibrate state listener to vibrator "
                                + mVibratorInfo.getId());
                        return;
                    }
                    mListeners.put(listener, delegate);
                } catch (RemoteException e) {
                    e.rethrowFromSystemServer();
                }
            }
        }

        @Override
        public void removeVibratorStateListener(@NonNull OnVibratorStateChangedListener listener) {
            Objects.requireNonNull(listener);
            if (mService == null) {
                Log.w(TAG, "Failed to remove vibrate state listener from vibrator "
                        + mVibratorInfo.getId() + "; no vibrator service.");
                return;
            }
            synchronized (mLock) {
                // Check if the listener is registered, otherwise will return.
                if (mListeners.containsKey(listener)) {
                    OnVibratorStateChangedListenerDelegate delegate = mListeners.get(listener);
                    try {
                        if (!mService.unregisterVibratorStateListener(mVibratorInfo.getId(),
                                delegate)) {
                            Log.w(TAG, "Failed to remove vibrate state listener from vibrator "
                                    + mVibratorInfo.getId());
                            return;
                        }
                        mListeners.remove(listener);
                    } catch (RemoteException e) {
                        e.rethrowFromSystemServer();
                    }
                }
            }
        }
    }
}

在 SystemVibratorManager 构造函数中，会获取到 IVibratorManagerService binder 服务的客户端代理类对象，SystemVibratorManager 对象的对外功能都是通过这个客户端代理类对象实现的。

接下来，我们就来看看这个 binder 服务的服务端实现。

服务端

我们先看看 IVibratorManagerService 的服务端在哪里注册的。

如果你对系统启动过程有所了解，应该知道，这类系统传感器类的服务通常在 SystemServer 的 startOtherServices 方法中完成注册：

// frameworks/base/services/java/com/android/server/SystemServer.java

    private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
      // ......
            t.traceBegin("StartVibratorManagerService");
            mSystemServiceManager.startService(VibratorManagerService.Lifecycle.class);
            t.traceEnd();     
      //......
    }

startService 的实现如下：

  // frameworks/base/services/core/java/com/android/server/SystemServiceManager.java
    public <T extends SystemService> T startService(Class<T> serviceClass) {
        try {
            final String name = serviceClass.getName();
            Slog.i(TAG, "Starting " + name);
            Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, "StartService " + name);

            // Create the service.
            if (!SystemService.class.isAssignableFrom(serviceClass)) {
                throw new RuntimeException("Failed to create " + name
                        + ": service must extend " + SystemService.class.getName());
            }
            final T service;
            try {
                // 反射调用构造函数
                Constructor<T> constructor = serviceClass.getConstructor(Context.class);
                service = constructor.newInstance(mContext);
            } catch (InstantiationException ex) {
                throw new RuntimeException("Failed to create service " + name
                        + ": service could not be instantiated", ex);
            } catch (IllegalAccessException ex) {
                throw new RuntimeException("Failed to create service " + name
                        + ": service must have a public constructor with a Context argument", ex);
            } catch (NoSuchMethodException ex) {
                throw new RuntimeException("Failed to create service " + name
                        + ": service must have a public constructor with a Context argument", ex);
            } catch (InvocationTargetException ex) {
                throw new RuntimeException("Failed to create service " + name
                        + ": service constructor threw an exception", ex);
            }

            startService(service);
            return service;
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
        }
    }

这里使用反射调用了传入的 VibratorManagerService.Lifecycle.class 的构造函数，接着构造函数返回的对象传入另一个 startService 重载。

    public void startService(@NonNull final SystemService service) {
        // Check if already started
        String className = service.getClass().getName();
        if (mServiceClassnames.contains(className)) {
            Slog.i(TAG, "Not starting an already started service " + className);
            return;
        }
        mServiceClassnames.add(className);

        // Register it.
        mServices.add(service);

        // Start it.
        long time = SystemClock.elapsedRealtime();
        try {
            service.onStart(); // 调用 SystemService 的 onStart 方法
        } catch (RuntimeException ex) {
            throw new RuntimeException("Failed to start service " + service.getClass().getName()
                    + ": onStart threw an exception", ex);
        }
        warnIfTooLong(SystemClock.elapsedRealtime() - time, service, "onStart");
    }    

这里会调用传入的 SystemService 的 onStart 方法。

接下来看 VibratorManagerService.Lifecycle 类中的 onStart 方法：

public class VibratorManagerService extends IVibratorManagerService.Stub {
    //......
        public static class Lifecycle extends SystemService {
        private VibratorManagerService mService;

        public Lifecycle(Context context) {
            super(context);
        }

        @Override
        public void onStart() {
            mService = new VibratorManagerService(getContext(), new Injector());
            publishBinderService(Context.VIBRATOR_MANAGER_SERVICE, mService);
        }

        @Override
        public void onBootPhase(int phase) {
            if (phase == SystemService.PHASE_SYSTEM_SERVICES_READY) {
                mService.systemReady();
            }
        }
    }
    //......
}

在 onStart 中，会 new 一个 VibratorManagerService 对象，VibratorManagerService 继承自 IVibratorManagerService.Stub, 是 IVibratorManagerService binder 服务的服务端实现。接着调用 publishBinderService 方法：

    protected final void publishBinderService(@NonNull String name, @NonNull IBinder service) {
        publishBinderService(name, service, false);
    }

    protected final void publishBinderService(@NonNull String name, @NonNull IBinder service,
            boolean allowIsolated) {
        publishBinderService(name, service, allowIsolated, DUMP_FLAG_PRIORITY_DEFAULT);
    }

    protected final void publishBinderService(String name, IBinder service,
            boolean allowIsolated, int dumpPriority) {
        ServiceManager.addService(name, service, allowIsolated, dumpPriority);
    }  

绕了一大圈，实际就是 addService. 向 ServiceManager 注册一个 binder 服务。

接下来的问题就是 VibratorManagerService 怎么访问到 HAL 层。

VibratorManagerService 如何访问到 HAL 层

先看下 VibratorManagerService 的构造函数：

    VibratorManagerService(Context context, Injector injector) {
        // ......
        mNativeWrapper = injector.getNativeWrapper();
        mNativeWrapper.init(listener);
        // .....
    }

实际代码很多，我们先关注一下 mNativeWrapper：

        NativeWrapper getNativeWrapper() {
          // 默认构造函数
            return new NativeWrapper();
        }

这里就是简单 new 一个 NativeWrapper 对象。

接会调用 NativeWrapper 对象的 init 方法：

    public static class NativeWrapper {

        private long mNativeServicePtr = 0;

        /** Returns native pointer to newly created controller and connects with HAL service. */
        public void init(OnSyncedVibrationCompleteListener listener) {
            mNativeServicePtr = nativeInit(listener);
            // ......
        }
    // ......
    }

init 方法中会调用到 nativeInit 方法，nativeInit 是一个 native 方法，对应的 JNI 函数是：

// frameworks/base/services/core/jni/com_android_server_vibrator_VibratorManagerService.cpp
static vibrator::ManagerHalController* gManager GUARDED_BY(gManagerMutex) = nullptr;

static jlong nativeInit(JNIEnv* env, jclass /* clazz */, jobject callbackListener) {
    std::unique_ptr<NativeVibratorManagerService> service =
            std::make_unique<NativeVibratorManagerService>(env, callbackListener);
    {
        std::lock_guard<std::mutex> lock(gManagerMutex);
        gManager = service->hal();
    }
    return reinterpret_cast<jlong>(service.release());
}

初始化一个指针 NativeVibratorManagerService，然后拿到内部的 hal 成员保存在 gManager 中，最后返回 NativeVibratorManagerService 指针地址给 Java 层，Java 层把这个地址保存在 mNativeServicePtr 成员中。

接下来我们来看 NativeVibratorManagerService 的内部实现：

// frameworks/base/services/core/jni/com_android_server_vibrator_VibratorManagerService.cpp
class NativeVibratorManagerService {
public:
    NativeVibratorManagerService(JNIEnv* env, jobject callbackListener)
          : mHal(std::make_unique<vibrator::ManagerHalController>()),
            mCallbackListener(env->NewGlobalRef(callbackListener)) {
        LOG_ALWAYS_FATAL_IF(mHal == nullptr, "Unable to find reference to vibrator manager hal");
        LOG_ALWAYS_FATAL_IF(mCallbackListener == nullptr,
                            "Unable to create global reference to vibration callback handler");
    }

    ~NativeVibratorManagerService() {
        auto jniEnv = GetOrAttachJNIEnvironment(sJvm);
        jniEnv->DeleteGlobalRef(mCallbackListener);
    }

    vibrator::ManagerHalController* hal() const { return mHal.get(); }

    std::function<void()> createCallback(jlong vibrationId) {
        return [vibrationId, this]() {
            auto jniEnv = GetOrAttachJNIEnvironment(sJvm);
            jniEnv->CallVoidMethod(mCallbackListener, sMethodIdOnComplete, vibrationId);
        };
    }

private:
    const std::unique_ptr<vibrator::ManagerHalController> mHal;
    const jobject mCallbackListener;
};

我们重点关注成员 mHal， mHal 在构造函数中，被初始化为一个 ManagerHalController 对象。

到这里，初始化过程就分析完了，整体的类关系如下图所示：

App 端振动器相关的功能最终都会调用到 ManagerHalController 中的方法，比如 getCapabilities 方法,用于获取振动器的能力范围：

HalResult<ManagerCapabilities> ManagerHalController::getCapabilities() {
    hal_fn<ManagerCapabilities> getCapabilitiesFn = [](std::shared_ptr<ManagerHalWrapper> hal) {
        return hal->getCapabilities();
    };
    return apply(getCapabilitiesFn, "getCapabilities");
}

构建一个 lamda 表达式然后传入 apply 方法：

template <typename T>
HalResult<T> ManagerHalController::apply(ManagerHalController::hal_fn<T>& halFn,
                                         const char* functionName) {
    std::shared_ptr<ManagerHalWrapper> hal = nullptr;
    {
        std::lock_guard<std::mutex> lock(mConnectedHalMutex);
        if (mConnectedHal == nullptr) {
            // Init was never called, so connect to HAL for the first time during this call.
            mConnectedHal = mConnector(mCallbackScheduler);

            if (mConnectedHal == nullptr) {
                ALOGV("Skipped %s because VibratorManager HAL is not available", functionName);
                return HalResult<T>::unsupported();
            }
        }
        hal = mConnectedHal;
    }

    HalResult<T> ret = processHalResult(halFn(hal), functionName);
    for (int i = 0; i < MAX_RETRIES && ret.isFailed(); i++) {
        ret = processHalResult(halFn(hal), functionName);
    }

    return ret;
}

先调用 mConnector 方法，mConnector 在构造函数中初始化为 connectManagerHal 函数：

ManagerHalController 构造函数：

    ManagerHalController()
          : ManagerHalController(std::make_shared<CallbackScheduler>(), &connectManagerHal) {}

    ManagerHalController(std::shared_ptr<CallbackScheduler> callbackScheduler, Connector connector)
          : mConnector(connector), mCallbackScheduler(callbackScheduler), mConnectedHal(nullptr) {}

connectManagerHal 函数的具体实现：

std::shared_ptr<ManagerHalWrapper> connectManagerHal(std::shared_ptr<CallbackScheduler> scheduler) {
    static bool gHalExists = true;
    if (gHalExists) {
        sp<Aidl::IVibratorManager> hal = waitForVintfService<Aidl::IVibratorManager>();
        if (hal) {
            ALOGV("Successfully connected to VibratorManager HAL AIDL service.");
            return std::make_shared<AidlManagerHalWrapper>(std::move(scheduler), hal);
        }
    }

    gHalExists = false;
    return std::make_shared<LegacyManagerHalWrapper>();
}

接着看 waitForVintfService 函数的具体实现：

template<typename INTERFACE>
sp<INTERFACE> waitForVintfService(
        const String16& instance = String16("default")) {
    return waitForDeclaredService<INTERFACE>(
        INTERFACE::descriptor + String16("/") + instance);
}

template<typename INTERFACE>
sp<INTERFACE> waitForDeclaredService(const String16& name) {
    const sp<IServiceManager> sm = defaultServiceManager();
    if (!sm->isDeclared(name)) return nullptr;
    return interface_cast<INTERFACE>(sm->waitForService(name));
}

实际就是调用 waitForService 获取 aidl hal 服务，返回 aidl hal 服务的客户端代理对象。

接着就会执行传入的 lamda 回调，在回调中通过 aidl hal 服务的客户端代理对象发起远程调用。

到目前为止，整体的类结构如下：

HAL 层

Google 给出了振动器的实现：

hardware/interfaces/vibrator

给出了 HAL 层实现的整体框架，也给出了实例，实例并没有真的访问驱动，只是返回一些假数据。

先看最顶层的 Android.bp：

// hardware/interfaces/vibrator/aidl/Android.bp

package {
    default_applicable_licenses: ["hardware_interfaces_license"],
}

aidl_interface {
    name: "android.hardware.vibrator",
    vendor_available: true,
    host_supported: true,
    srcs: [
        "android/hardware/vibrator/*.aidl",
    ],
    stability: "vintf",
    backend: {
        java: {
            sdk_version: "system_current",
        },
    },
    versions: [
        "1",
        "2",
    ],
}

这里定义一个 aidl_interface 类型，aidl 文件需要配置在 srcs 中。

配置完成后，编译系统会帮助我们生成 C++/JAVA/NDK/RUST 四种服务端代码。

Google 推荐使用 NDK 类型的代码。

主要几点原因：

• HAL 使用 C++ 语言实现更方便，因为要访问驱动。
• C++ 类型的代码会依赖 vndk 中的 libbinder 库，Google 的文档说这个库的内部实现和对外接口都不稳定
• NDK 类型的代码依赖 libbinder_ndk，这个库基于 libbinder 库构建，不同的是，它的对外接口稳定。

接着看 hardware/interfaces/vibrator/aidl/default/Android.bp：

package {
    // See: http://go/android-license-faq
    // A large-scale-change added 'default_applicable_licenses' to import
    // all of the 'license_kinds' from "hardware_interfaces_license"
    // to get the below license kinds:
    //   SPDX-license-identifier-Apache-2.0
    default_applicable_licenses: ["hardware_interfaces_license"],
}

cc_library_static {
    name: "libvibratorexampleimpl",
    vendor_available: true,
    host_supported: true,
    shared_libs: [
        "libbase",
        "libbinder_ndk",
        "android.hardware.vibrator-V2-ndk",
    ],
    export_include_dirs: ["include"],
    srcs: [
        "Vibrator.cpp",
        "VibratorManager.cpp",
    ],
    visibility: [
        ":__subpackages__",
        "//hardware/interfaces/tests/extension/vibrator:__subpackages__",
    ],
    target: {
        darwin: {
            enabled: false,
        },
    },
}

filegroup {
    name: "android.hardware.vibrator.xml",
    srcs: ["android.hardware.vibrator.xml"],
}

cc_binary {
    name: "android.hardware.vibrator-service.example",
    relative_install_path: "hw",
    init_rc: ["vibrator-default.rc"],
    vintf_fragments: [":android.hardware.vibrator.xml"],
    vendor: true,
    shared_libs: [
        "libbase",
        "libbinder_ndk",
        "android.hardware.vibrator-V2-ndk",
    ],
    static_libs: [
        "libvibratorexampleimpl",
    ],
    srcs: ["main.cpp"],
}

cc_fuzz {
    name: "android.hardware.vibrator-service.example_fuzzer",
    host_supported: true,
    defaults: ["service_fuzzer_defaults"],
    static_libs: [
        "android.hardware.vibrator-V2-ndk",
        "liblog",
        "libvibratorexampleimpl",
    ],
    srcs: ["fuzzer.cpp"],
    fuzz_config: {
        cc: [
            "smoreland@google.com",
        ],
    },
}

libvibratorexampleimpl 是一个静态库，包含了 Vibrator.cpp VibratorManager.cpp 源码。源码中主要是对 aidl hal 服务端对象的具体实现。

android.hardware.vibrator-service.example 是一个 native 可执行程序，源码是 main.cpp：

#include "vibrator-impl/Vibrator.h"
#include "vibrator-impl/VibratorManager.h"

#include <android-base/logging.h>
#include <android/binder_manager.h>
#include <android/binder_process.h>

using aidl::android::hardware::vibrator::Vibrator;
using aidl::android::hardware::vibrator::VibratorManager;

int main() {
    ABinderProcess_setThreadPoolMaxThreadCount(0);

    // make a default vibrator service
    auto vib = ndk::SharedRefBase::make<Vibrator>();
    binder_status_t status = AServiceManager_addService(
            vib->asBinder().get(), Vibrator::makeServiceName("default").c_str());
    CHECK_EQ(status, STATUS_OK);

    // make the vibrator manager service with a different vibrator
    auto managedVib = ndk::SharedRefBase::make<Vibrator>();
    auto vibManager = ndk::SharedRefBase::make<VibratorManager>(std::move(managedVib));
    status = AServiceManager_addService(vibManager->asBinder().get(),
                                        VibratorManager::makeServiceName("default").c_str());
    CHECK_EQ(status, STATUS_OK);

    ABinderProcess_joinThreadPool();
    return EXIT_FAILURE;  // should not reach
}

这里就是通过 AServiceManager_addService 函数来向 ServiceManager 注册 aidl hal 服务端。

这里注册了两个服务 Vibrator VibratorManager，Vibrator 是为了兼容老的 api，VibratorManager 是新 API 实现的基础。

补充

在 Google 给的 Vibrator hal 实现中，还有一个 App 端的示例：

hardware/interfaces/vibrator/aidl/default/example_java_client

其中核心的 hardware/interfaces/vibrator/aidl/default/example_java_client/example/vib/MyActivity.java 的实现如下：

package example.vib;

import android.app.Activity;
import android.hardware.vibrator.IVibrator;
import android.os.Bundle;
import android.os.IBinder;
import android.os.RemoteException;

public class MyActivity extends Activity {
    private static native IBinder gimme(String name);

    @Override
    public void onCreate(Bundle b) {
        super.onCreate(b);
        System.loadLibrary("example_vib_getter");

        IVibrator v =
                IVibrator.Stub.asInterface(gimme("android.hardware.vibrator.IVibrator/default"));

        try {
            v.on(100 /*ms*/, null /*cb*/);
        } catch (RemoteException e) {
            throw new RuntimeException(e);
        }

        finish();
    }
}

可以看出在 App 中可以直接访问到 HAL 层的 aidl HAL 服务。省略 Framework 中冗长的逻辑。提供了一种全新的硬件访问方式。

这样固然更快更简单，但是硬件如果存在多个进程同时使用的情况，建议还是通过 Framework 中系统服务来使用，系统服务统一协调管理来自多个进程的访问。

App 其对应的 hardware/interfaces/vibrator/aidl/default/example_java_client/Android.bp:

cc_library {
    name: "libexample_vib_getter",
    srcs: ["getter.cpp"],
    product_available: true,
    vendor_available: true,
    shared_libs: [
        "liblog",
        "libbinder_ndk",
    ],
    header_libs: ["jni_headers"],
    stl: "c++_shared",
    visibility: [":__subpackages__"],
}

android_app {
    name: "ExampleVibratorJavaVendorClient",
    vendor: true,
    static_libs: ["android.hardware.vibrator-V1-java"],
    jni_libs: ["libexample_vib_getter"],
    use_embedded_native_libs: true,
    jarjar_rules: "jarjar.txt",
    stl: "c++_shared",
    srcs: ["example/vib/MyActivity.java"],
    sdk_version: "system_current",
    visibility: [":__subpackages__"],
}

android_app {
    name: "ExampleVibratorJavaProductClient",
    product_specific: true,
    static_libs: ["android.hardware.vibrator-V1-java"],
    jni_libs: ["libexample_vib_getter"],
    use_embedded_native_libs: true,
    jarjar_rules: "jarjar.txt",
    stl: "c++_shared",
    srcs: ["example/vib/MyActivity.java"],
    sdk_version: "system_current",
    visibility: [":__subpackages__"],
    // If PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE is not true, product apps
    // may use unstable APIs. jni_uses_platform_apis must set to use the
    // non-SDK jni libs in this case.
    // This is not required if PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE is
    // set to true.
    jni_uses_platform_apis: true,
}

这里给了两个 App 的构建，一个在 Vendor 分区，一个在 Product 分区。他们都需要 android.hardware.vibrator-V1-java 和 libexample_vib_getter 库的支持.

其中 libexample_vib_getter 库有依赖于 libbinder_ndk 库。android.hardware.vibrator-V1-java 是 aidl 文件生成的 java 支持。