硬件廠商處于保護核心代碼，會將核心實現(xiàn)以so庫的形式出現(xiàn)在HAL層穷当，當需要時HAL會自動調(diào)用相關(guān)的共享庫。

共享庫的格式

<MODULE_ID>.variant.so

• id: 為硬件模塊的唯一編號
• variant：為變種名稱矛双。這個值從系統(tǒng)屬性中獲取牛哺。獲取順序保存在variant_keys數(shù)組中。

static const char *variant_keys[] = {
    "ro.hardware",  /* This goes first so that it can pick up a different
                       file on the emulator. */
    "ro.product.board",
    "ro.board.platform",
    "ro.arch"
};

流程
app通過jni調(diào)用hal層hw_get_module函數(shù)獲取硬件模塊篙耗，hw_get_module通過模塊ID查詢對應(yīng)的模塊的共享庫迫筑，調(diào)用load打開共享庫宪赶，獲取硬件結(jié)構(gòu)地址，根據(jù)固定符號HAL_MODULE_INFO_SYM查找結(jié)構(gòu)體hw_module_t脯燃，調(diào)用hw_module_methods_t中的open方法打開硬件搂妻。在open時傳入hw_device_t二級指針，將模塊的操作函數(shù)保存在hw_device_t中辕棚，實現(xiàn)與硬件的交互欲主。

hw_get_module

int hw_get_module_by_class(const char *class_id, const char *inst,
                           const struct hw_module_t **module)
{
    int i = 0;
    char prop[PATH_MAX] = {0};
    char path[PATH_MAX] = {0};
    char name[PATH_MAX] = {0};
    char prop_name[PATH_MAX] = {0};

    if (inst)
        snprintf(name, PATH_MAX, "%s.%s", class_id, inst);
    else
        strlcpy(name, class_id, PATH_MAX);

    /*
     * Here we rely on the fact that calling dlopen multiple times on
     * the same .so will simply increment a refcount (and not load
     * a new copy of the library).
     * We also assume that dlopen() is thread-safe.
     */

    /* First try a property specific to the class and possibly instance */
    snprintf(prop_name, sizeof(prop_name), "ro.hardware.%s", name);
    if (property_get(prop_name, prop, NULL) > 0) {  //??獲取屬相
        if (hw_module_exists(path, sizeof(path), name, prop) == 0) {    //檢測模塊是否存在
            goto found;
        }
    }

    //在hal層搜索動態(tài)共享庫的方式
    /* Loop through the configuration variants looking for a module */
    for (i=0 ; i<HAL_VARIANT_KEYS_COUNT; i++) {
        if (property_get(variant_keys[i], prop, NULL) == 0) {
            continue;
        }
        if (hw_module_exists(path, sizeof(path), name, prop) == 0) {
            goto found;
        }
    }

    //最后嘗試默認庫
    /* Nothing found, try the default */
    if (hw_module_exists(path, sizeof(path), name, "default") == 0) {
        goto found;
    }

    return -ENOENT;

found:
    /* load the module, if this fails, we're doomed, and we should not try
     * to load a different variant. */
    return load(class_id, path, module); ////裝載庫，得到module
}

//根據(jù)硬件id逝嚎，獲取id對應(yīng)的硬件模塊結(jié)構(gòu)體
int hw_get_module(const char *id, const struct hw_module_t **module)
{   
    //id將作為路徑一部分扁瓢，下面代碼的name
    return hw_get_module_by_class(id, NULL, module);
}

• hw_get_module 調(diào)用hw_get_module_by_class完成加載過程
• hw_get_module_by_class根據(jù)傳入的變量class_id,查詢ro.hardware.<id>獲取屬相值，如果存在作為variant值补君，調(diào)用hw_module_exit檢查目標共享庫是否存在引几，存在調(diào)用load加載
• 不存在，循環(huán)遍歷variant_keys數(shù)組定義的key獲取對應(yīng)的屬性值挽铁，并判斷是否存在對應(yīng)的共享庫伟桅，存在調(diào)用load加載，否則返回錯誤

hw_module_exists方法根據(jù)拼接的路徑path叽掘，去查詢是否存在共享庫楣铁。共享庫的路徑由HAL_LIBRARY_PATH1（系統(tǒng)存放路徑） ，id（moudle ID）更扁，variant(屬性)組成盖腕。

共享庫存放的路徑

#if defined(__LP64__)
#define HAL_LIBRARY_PATH1 "/system/lib64/hw"
#define HAL_LIBRARY_PATH2 "/vendor/lib64/hw"
#else
#define HAL_LIBRARY_PATH1 "/system/lib/hw"
#define HAL_LIBRARY_PATH2 "/vendor/lib/hw"
#endif

• 共享庫存放的位置位于 /system/lib64/hw，/system/lib/hw 和/vendor/lib64/hw 疯潭，/vendor/lib/hw 路徑下
• 共享庫以<MODULE_ID>.variant.so命名，id為模塊名稱面殖，variant為變種名稱竖哩，隨系統(tǒng)平臺變化。

load

static int load(const char *id,
        const char *path,
        const struct hw_module_t **pHmi)
{
    int status = -EINVAL;
    void *handle = NULL;
    struct hw_module_t *hmi = NULL;

    /*
     * load the symbols resolving undefined symbols before
     * dlopen returns. Since RTLD_GLOBAL is not or'd in with
     * RTLD_NOW the external symbols will not be global
     */
     //調(diào)用dlopen打開path定義的目標共享庫脊僚，得到庫文件的句柄handle
    handle = dlopen(path, RTLD_NOW);
    if (handle == NULL) {
        char const *err_str = dlerror();
        ALOGE("load: module=%s\n%s", path, err_str?err_str:"unknown");
        status = -EINVAL;
        goto done;
    }

    /* Get the address of the struct hal_module_info. */
    const char *sym = HAL_MODULE_INFO_SYM_AS_STR;
    //調(diào)用dlsym獲取符號HAL_MODULE_INFO_SYM_AS_STR的地址相叁，賦值給hmi
    hmi = (struct hw_module_t *)dlsym(handle, sym);
    if (hmi == NULL) {
        ALOGE("load: couldn't find symbol %s", sym);
        status = -EINVAL;
        goto done;
    }

    /* Check that the id matches */
    if (strcmp(id, hmi->id) != 0) {
        ALOGE("load: id=%s != hmi->id=%s", id, hmi->id);
        status = -EINVAL;
        goto done;
    }
    //保存共享庫句柄
    hmi->dso = handle;

    /* success */
    status = 0;

    done:
    if (status != 0) {
        hmi = NULL;
        if (handle != NULL) {
            dlclose(handle);
            handle = NULL;
        }
    } else {
        ALOGV("loaded HAL id=%s path=%s hmi=%p handle=%p",
                id, path, *pHmi, handle);
    }

    //返回得到的hw_module_t結(jié)構(gòu)體的指針
    *pHmi = hmi;

    return status;
}

• load 函數(shù)調(diào)用dlopen打開目標模塊共享庫，使用dlsym獲取HMI地址（HMI為模塊hw_module_t結(jié)構(gòu)體的名字）辽幌，得到對應(yīng)模塊hw_module_t指針增淹；通過hw_module_t指針，可以對硬件進行操作乌企。

通過dlopen和dlsym獲取模塊hw_module_t指針虑润，操作硬件。

藍牙HAL加載

硬件抽象層中每個模塊必須自定義一個硬件抽象層模塊結(jié)構(gòu)加酵，第一個成員必須是hw_module_t拳喻，其次才是模塊的一此相關(guān)信息哭当；還必須包含HAL_MODULE_INFO_SYM 。

藍牙HAL加載在 com_android_bluetooth_btservice_AdapterService.cpp的classInitNative方法中冗澈，

static void classInitNative(JNIEnv* env, jclass clazz) {
    int err;
    hw_module_t* module;
    // ........中間省略.....
    char value[PROPERTY_VALUE_MAX];
    property_get("bluetooth.mock_stack", value, "");

    const char *id = (strcmp(value, "1")? BT_STACK_MODULE_ID : BT_STACK_TEST_MODULE_ID);

    //獲取藍牙模塊hw_module_t指針
    err = hw_get_module(id, (hw_module_t const**)&module);

    if (err == 0) {
        hw_device_t* abstraction;
    //調(diào)用open方法钦勘，獲取藍牙設(shè)備hw_device_t指針
        err = module->methods->open(module, id, &abstraction);
        if (err == 0) {
            //藍牙實現(xiàn)中將藍牙設(shè)備bluetooth_device_t 和 bluetooth_module_t 定義成同一個值
            bluetooth_module_t* btStack = (bluetooth_module_t *)abstraction;
      //獲取藍牙模塊interface接口，通過sBluetoothInterface操作藍牙設(shè)備
            sBluetoothInterface = btStack->get_bluetooth_interface();
        } else {
           ALOGE("Error while opening Bluetooth library");
        }
    } else {
        ALOGE("No Bluetooth Library found");
    }
}

BT_STACK_MODULE_ID 定義在bluetooth.h文件中亚亲，

 #define BT_HARDWARE_MODULE_ID "bluetooth"
#define BT_STACK_MODULE_ID "bluetooth"

hw_get_module獲取藍牙模塊hw_module_t指針彻采，
藍牙自定義硬件模塊hw_module_t定義

struct hw_module_t HAL_MODULE_INFO_SYM = {
    .tag = HARDWARE_MODULE_TAG,
    .version_major = 1,
    .version_minor = 0,
    .id = BT_HARDWARE_MODULE_ID,
    .name = "Bluetooth Stack",
    .author = "The Android Open Source Project",
    .methods = &bt_stack_module_methods
};

藍牙調(diào)用自定義模塊hw_module_t中open方法，獲取hw_device_t指針捌归，

static struct hw_module_methods_t bt_stack_module_methods = {
    .open = open_bluetooth_stack,
};

static int open_bluetooth_stack(const struct hw_module_t *module, UNUSED_ATTR char const *name, struct hw_device_t **abstraction) {
  //給bluetooth_device_t賦值
  static bluetooth_device_t device = {
    //common變量賦值
    .common = {     
      .tag = HARDWARE_DEVICE_TAG,
      .version = 0,
      .close = close_bluetooth_stack,
    },
    //獲取藍牙模塊接口
    .get_bluetooth_interface = bluetooth__get_bluetooth_interface
  };

  device.common.module = (struct hw_module_t *)module;
  //將bluetooth_device_t指針強制轉(zhuǎn)換為hw_device_t指針賦值給abstraction
  *abstraction = (struct hw_device_t *)&device;
  return 0;
}

open_bluetooth_stack創(chuàng)建bluetooth_device_t 結(jié)構(gòu)體肛响，初始化，轉(zhuǎn)換成hw_device_t陨溅。module->methods->open得到bluetooth_device_t 結(jié)構(gòu)體的指針终惑，也是bluetooth_module_t結(jié)構(gòu)體的指針。

typedef struct {
    struct hw_device_t common;
    const bt_interface_t* (*get_bluetooth_interface)();
} bluetooth_device_t;

typedef bluetooth_device_t bluetooth_module_t;

bluetooth_device_t 包含hw_device_t门扇；bluetooth_device_t 重命名為bluetooth_module_t雹有。

open方法（open_bluetooth_stack）獲取藍牙設(shè)備hw_device_t指針，轉(zhuǎn)化為bluetooth_module_t 指針臼寄，在open_bluetooth_stack中將bluetooth_get_bluetooth_interface賦值給get_bluetooth_interface霸奕，再賦值給sBluetoothInterface。

bluetooth_get_bluetooth_interface定義了藍牙模塊的基本接口吉拳，bluetooth_get_bluetooth_interface最后賦值給sBluetoothInterface质帅，調(diào)用sBluetoothInterface可以操作藍牙模塊，與硬件交互留攒。具體接口實現(xiàn)和平臺相關(guān)煤惩。

參考

• http://www.cnblogs.com/microliang/p/3427322.html