1 Android HAL HIDL
1.1 Android中查看有哪些HIDL HAL
HIDL是Treble Interface的一部分。
adb root
adb shell
# lshal
1.2 Android打印C++调用栈
#include <utils/CallStack.h>
在需要打印的地方加如下的定义。
android::CallStack stack("oem");
logcat | grep oem
1.3 GNSS和Sensors
Refer to gnss and sensors
hardware/interfaces/gnss/1.0/default
hardware/interfaces/sensors/1.0/default
1.4 产生HAL框架步骤
1）生成androidmk和hidl-gen
在Android项目根目录下：
. build/envsetup.sh
lunch
make blueprint_tools
make hidl-gen
make c2hal // 将传统HAL .h头文件转换成hidl .hal文件工具
2）产生.cpp和.h文件
mkdir -p hardware/interfaces/oem1/1.0/default
路径中出现的1.0表示HAL当前版本
仿照GNSS或者Sensors增加一个IOem1.hal
in hardware/interfaces/oem1/1.0/IOem1.hal
在Android项目源码根目录下编写脚本my_oem1.sh，调用hidl-gen产生.cpp和.h文件
in my_oem1.sh
PACKAGE=android.hardware.oem1@1.0
LOC=hardware/interfaces/oem1/1.0/default
hidl-gen -o $LOC -Lc++-impl -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport $PACKAGE
hidl-gen -o $LOC -Landroidbp-impl -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport $PACKAGE
执行：
./my_oem1.sh
3）产生.bp和.mk文件
执行：
./hardware/interfaces/update-makefiles.sh
4）
编译最终在out/target/common/gen/JAVA_LIBRARIES目录下生成Java源文件。
1.5 mk文件转换为bp文件
. build/envsetup.sh
make blueprint_tools
androidmk Android.mk > Android.bp
1.6 Java HIDL
[28th-Mar-2022]
./hardware/interfaces/update-makefiles.sh
Android.mk
LOCAL_STATIC_JAVA_LIBRARIES += \
android.hardware.foo-V1.0-java
Android.bp
static_libs: [
"android.hardware.foo-V1.0-java",
],
// out/target/common/gen/JAVA_LIBRARIES
import android.hardware.foo.V1_0.IFoo;
IFoo server = IFoo.getService();
2 VTS测试步骤
1) 安装必须的python工具和adb - Linux需要
apt-get install android-tools-adb
2)
source build/envsetup.sh
lunch
make vts
3) 编译完成后
in out/host/linux-x86/vts/
$cd android-vts/tools
$vts-tradefed
> run vts
or
> run vts-hal
or
> run vts-kernel
如果要在Windows上测试，需要将文件夹android-vts拷贝到windows下 - 待完善
4) 测试完成后
查看测试结果
android-vts/results
android-vts/logs
3 LinkToDeath
3.1 Principle
Client很容易监控Service的died；但是Service监控Client的died，需要Client实现使用IBinder接口的ICallback，传给Service，然后Service可以监控这个使用IBinder接口的ICallback的died，这样就实现了监控Client的died。
1）一个BpBinder可以注册多个死亡回调；但Kernel只允许注册一个死亡通知（ref->death只能为空或者指向一个指针）
2）BC_REQUEST_DEATH_NOTIFICATION - linkToDeath()
3）BC_CLEAR_DEATH_NOTIFICATION - unlinkToDeath()
4）当process exit时会触发系统关闭该进程已经打开的文件节点/dev/hwbinder，从而调用binder_node_release()；通知died - BINDER_WORK_DEAD_BINDER
5）
echo 0x18 > /sys/module/binder/parameters/debug_mask
dmesg -C
dmesg -w | grep binder &
kill -9 $PID
6）ftrace as shown below
echo 0 > /d/tracing/tracing_on
echo nop > /d/tracing/current_tracer
echo function_graph > /d/tracing/current_tracer
#echo function > /d/tracing/current_tracer
echo funcgraph-proc > /d/tracing/trace_options
echo binder_cleanup_ref_olocked > /d/tracing/set_graph_function
echo 1 > /d/tracing/tracing_on
cat /d/tracing/trace
debuggerd -b $PID
3.2 JAVA实施步骤
import android.os.IHwBinder.DeathRecipient;
private class xxxDeathRecipient implements DeathRecipient {
@Override
public void serviceDied(long cookie) {
Log.i(TAG, "serviceDied, re-connect XXX");
if (xxxService != null) {
xxxService.unlinkToDeath(this);
}
// TODO: 重连service
}
};
xxxDeathRecipient mxxxDeathRecipient = new xxxDeathRecipient();
获取xxxService成功后：
try {
xxxService.linkToDeath(mxxxDeathRecipient, 0);
} catch (RemoteException e) {
e.printStackTrace();
}
3.3 CPP实施步骤
using android::hardware::hidl_death_recipient;
class MyDeathRecipient : public android::hardware::hidl_death_recipient {
virtual void serviceDied(uint64_t cookie,
const android::wp<::android::hidl::base::V1_0::IBase>& who) {
// Deal with the fact that the service died
}
}
MyDeathRecipient mDeathRecipient = new MyDeathRecipient();
获取xxxService成功后：
xxxService->linkToDeath(mDeathRecipient, 0);
4 strace解析binder驱动数据插件
4.1 知识
A进程给B进程发送数据：A进程使用BC_TRANSACTION发送，经过binder驱动转换，B进程接收到是BR_TRANSACTION
B进程给A进程回复数据：B进程使用BC_REPLY发送，经过binder驱动转换，A进程接收到是BR_REPLY。
4.2 代码
#include "defs.h"
#include <linux/android/binder.h>
static inline unsigned int get_my_le32(
const unsigned char *p)
{
return p[0] | p[1] << 8 | p[2] << 16 | p[3] << 24;
}
static const char *cmd_to_str(unsigned int cmd)
{
switch(cmd) {
case BC_TRANSACTION:
return "BC_TRANSACTION";
break;
case BC_REPLY:
return "BC_REPLY";
break;
case BR_TRANSACTION:
return "BR_TRANSACTION";
break;
case BR_REPLY:
return "BR_REPLY";
break;
}
return "UNDEFINED";
}
/*
* bc: binder command, from userland to driver
* br: binder return, from driver to userland
*/
static void handle_bx_transaction(
struct tcb *const tcp,
struct binder_write_read *bwr,
struct binder_transaction_data *txn)
{
binder_size_t txn_data_size = 0;
binder_size_t txn_offsets_size = 0;
#if defined (FEATURE_PRINT_DETAIL)
int n = 0;
unsigned char buf[256], buf_offsets[256];
#else
binder_uintptr_t txn_buffer;
binder_uintptr_t txn_offsets;
#endif
txn_data_size = txn->data_size;
txn_offsets_size = txn->offsets_size;
tprintf("handle=%d, ptr=%llx, "
"target_cookie=0x%llx,\n"
"code=%d, flags=0x%02x, "
"sender_pid=%d, sender_euid=%d",
txn->target.handle,
txn->target.ptr,
txn->cookie,
txn->code,
txn->flags,
txn->sender_pid,
txn->sender_euid);
if (txn_data_size <= 8) {
tprintf(", data_size=%llu, "
"%02x %02x %02x %02x "
"%02x %02x %02x %02x\n",
txn_data_size,
txn->data.buf[0], txn->data.buf[1],
txn->data.buf[2], txn->data.buf[3],
txn->data.buf[4], txn->data.buf[5],
txn->data.buf[6], txn->data.buf[7]);
} else {
#if defined (FEATURE_PRINT_DETAIL)
txn_data_size = (txn_data_size > 256) ?
256 : txn_data_size;
if (umoven(tcp,
txn->data.ptr.buffer,
txn_data_size, buf) < 0)
return;
txn_offsets_size = (txn_offsets_size > 256) ?
256 : txn_offsets_size;
if (umoven(tcp,
txn->data.ptr.offsets,
txn_offsets_size,
buf_offsets) < 0)
return;
for (; n < (txn_offsets_size /
sizeof(binder_size_t)); n++)
{
struct flat_binder_object* pbinder =
(struct flat_binder_object*)((char*)buf +
((int*)(buf_offsets))[n]);
unsigned long type = pbinder->type;
switch (type)
{
case BINDER_TYPE_BINDER:
case BINDER_TYPE_WEAK_BINDER:
tprintf("binder=0x%llx, "
"cookie=0x%llx\n",
pbinder->binder,
pbinder->cookie);
break;
case BINDER_TYPE_HANDLE:
case BINDER_TYPE_WEAK_HANDLE:
tprintf("handle=0x%08x\n",
pbinder->handle);
break;
default:
break;
}
}
#else
txn_buffer = txn->data.ptr.buffer;
txn_offsets = txn->data.ptr.offsets;
tprintf(", \ndata_size=%llu, "
"txn_buffer=0x%llx\n",
txn_data_size, txn_buffer);
dumpstr(tcp,
(long) txn_buffer,
txn_data_size);
tprintf("\noffsets_size=%llu, "
"txn_offsets=0x%llx\n",
txn_offsets_size, txn_offsets);
dumpstr(tcp,
(long) txn_offsets,
txn_offsets_size);
#endif
}
}
/*
* mRemote.transact(GET_SERVICE_TRANSACTION, data, reply, 0);
* GET_SERVICE_TRANSACTION <-> struct binder_transaction_data.code
* data <-> struct binder_transaction_data.data
*
* write_bufer: CMD + binder_transaction_data + CMD + binder_transaction_data...
* byte 0-3: command, offset0 - nr, offset1 - magic 'c' = 0x63
* byte 4-7: target
*
* read_bufer: BR_NOOP + CMD + binder_transaction_data + CMD + binder_transaction_data...
* byte 0-3: BR_NOOP, 0c 72 00 00, offset0 - nr, offset1 - magic 'r' = 0x72
*
*/
static void decode_bwr(struct tcb *const tcp,
const kernel_ulong_t addr)
{
struct binder_write_read bwr;
struct binder_transaction_data *txn;
int read_len, write_len, offset;
unsigned char buf[256], *p;
unsigned int cmd, cmd_data_len;
static int ioctl_count = 1;
if (umove_or_printaddr(tcp, addr, &bwr))
return;
if (abbrev(tcp)) {
tprints(", ");
tprintf("{BC_TRANS=0x%08x, "
"BR_REPLY=0x%08x, "
"write_size=%llu, "
"write_consumed=%llu, "
"read_size=%llu, "
"read_consumed=%llu}",
BC_TRANSACTION, BR_REPLY,
bwr.write_size, bwr.write_consumed,
bwr.read_size, bwr.read_consumed);
return;
}
/* VERBOSE mode */
tprints(",\n");
tprintf("%d) ### WRITE ###\n",
ioctl_count++);
tprintf("write_size=%llu, "
"write_consumed=%llu, "
"write_buffer=\n",
bwr.write_size,
bwr.write_consumed);
write_len = (bwr.write_size > 256) ?
256 : bwr.write_size;
if (umoven(tcp,
bwr.write_buffer,
write_len, buf) < 0)
goto out;
offset = 0;
while (offset < write_len) {
cmd = get_my_le32(buf + offset);
cmd_data_len = _IOC_SIZE(cmd);
switch (cmd) {
case BC_TRANSACTION:
case BC_REPLY:
tprintf("%s--->\n", cmd_to_str(cmd));
p = buf + offset + 4;
txn = (struct binder_transaction_data *)p;
handle_bx_transaction(tcp, &bwr, txn);
break;
}
offset += (4 + cmd_data_len);
}
dumpstr(tcp,
(long) bwr.write_buffer,
bwr.write_size);
tprints("\n");
tprintf("%d) ### READ ###\n",
ioctl_count++);
tprintf("read_size=%llu, "
"read_consumed=%llu,\n",
bwr.read_size,
bwr.read_consumed);
read_len = (bwr.read_size > 256) ?
256 : bwr.read_size;
if (umoven(tcp,
bwr.read_buffer,
read_len, buf) < 0)
goto out;
offset = 0;
while (offset < read_len) {
cmd = get_my_le32(buf + offset);
cmd_data_len = _IOC_SIZE(cmd);
switch (cmd) {
case BR_TRANSACTION:
case BR_REPLY:
tprintf("%s--->\n", cmd_to_str(cmd));
p = buf + offset + 4;
txn = (struct binder_transaction_data *)p;
handle_bx_transaction(tcp, &bwr, txn);
break;
}
offset += (4 + cmd_data_len);
}
tprints("\n");
dumpstr(tcp,
(long) bwr.read_buffer,
bwr.read_size);
out:
tprints("}");
}
int binder_ioctl(struct tcb *const tcp,
const unsigned int code,
const kernel_ulong_t arg)
{
switch (code) {
case BINDER_WRITE_READ:
decode_bwr(tcp, arg);
break;
default:
return RVAL_DECODED;
}
return RVAL_DECODED | 1;
}
4.3 查看hwbinder的数据
ps -A| grep hwservicemanager
strace -tt -T -x -v -p $PID 2>&1 |grep -vE "writev|futex|getuid|ppoll"
5 Abbreviations
VTS：Vendor Test Suite
