Camera2架构学习（二）——CameraServer和CameraProvider的启动初始化
上一章讲的是从Framework下发命令，通过AIDL连接到相机设备服务。这一章讲服务的注册与启动。
服务层位于Camera Framework与Camera Provider之间，作为一个独立进程存在于Android系统中，在系统启动初期会运行起来，它封装了Camera AIDL跨进程接口，提供给Framework进行调用，进而接收来自Framework的图像请求，同时内部维护着关于请求在该层的处理逻辑，最终通过调用Camera HIDL跨进程接口将请求再次下发到Camera Provider中，并且等待结果的回传，进而将结果上传至Framework中。
一、调用逻辑图
二、CameraServer
2.1 Camera AIDL 接口
在介绍Camera AIDL之前，不妨来简单了解下何为AIDL，谷歌为什么要实现这么一套机制？
在Android系统中，两个进程通常无法相互访问对方的内存，为了解决该问题，谷歌提出了Messager/广播以及后来的Binder，来解决这个问题，但是如果某个进程需要对另一个进程中进行多线程的并发访问，Messager和广播效果往往不是很好，所以Binder会作为主要实现方式，但是Binder的接口使用起来比较复杂，对开发者特别是初学者并不是很友好，所以为了降低跨进程开发门槛，谷歌开创性地提出了AIDL(自定义语言)机制，主动封装了Binder的实现细节，提供给开发者较为简单的使用接口，极大地提升了广大开发者的开发效率。
按照谷歌的针对AIDL机制的要求，需要服务端创建一系列*.aidl文件，并在其中定义需要提供给客户端的公共接口，并且予以实现，接下来我们来看下几个主要的aidl文件。
ICameraService.aidl定义了ICameraService 接口，实现主要通过CameraService类来实现，主要接口如下：
- getNumberOfCameras： 获取系统中支持的Camera 个数
- connectDevice()：打开一个Camera 设备
- addListener(): 添加针对Camera 设备以及闪光灯的监听对象
ICameraDeviceCallbacks.aidl文件中定义了ICameraDeviceCallbacks接口，其实现主要由Framework中的CameraDeviceCallbacks类进行实现，主要接口如下：
- onResultReceived： 一旦Service收到结果数据，便会调用该接口发送至Framework
- onCaptureStarted()： 一旦开始进行图像的采集，便调用该接口将部分信息以及时间戳上传至Framework
- onDeviceError(): 一旦发生了错误，通过调用该接口通知Framework
ICameraDeviceUser.aidl定义了ICameraDeviceUser接口，由CameraDeviceClient最终实现，主要接口如下：
- disconnect： 关闭Camera 设备
- submitRequestList：发送request
- beginConfigure： 开始配置Camera 设备，需要在所有关于数据流的操作之前
- endConfigure： 结束关于Camera 设备的配置，该接口需要在所有Request下发之前被调用
- createDefaultRequest： 创建一个具有默认配置的Request
ICameraServiceListener.aidl定义了ICameraServiceListener接口，由Framework中的CameraManagerGlobal类实现，主要接口如下：
- onStatusChanged： 用于告知当前Camera 设备的状态的变更
2.2 CameraService进程的启动及注册
1.手机开机后，会走init.rc流程，init.rc会启动cameraserver.rc
service cameraserver /system/bin/cameraserver
class main
user cameraserver
group audio camera input drmrpc
ioprio rt 4
writepid /dev/cpuset/camera-daemon/tasks /dev/stune/top-app/tasks
2.cameraserver的main函数位于frameworks/base/media/mediaserver/main_mediaserver.cpp中。在Main_MediaServer.cpp的main函数中，CameraService完成了注册
int main(int argc __unused, char** argv __unused)
{
signal(SIGPIPE, SIG_IGN);
// Set 3 threads for HIDL calls
hardware::configureRpcThreadpool(3, /*willjoin*/ false);
sp<ProcessState> proc(ProcessState::self());
sp<IServiceManager> sm = defaultServiceManager();
ALOGI("ServiceManager: %p", sm.get());
CameraService::instantiate();
ProcessState::self()->startThreadPool();
IPCThreadState::self()->joinThreadPool();
}
3.instantiate的实现在CameraService的父类BinderService中，将CameraService放入总的ServiceManager中管理
class BinderService
{
public:
static status_t publish(bool allowIsolated = false,
int dumpFlags = IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT) {
sp<IServiceManager> sm(defaultServiceManager());
return sm->addService(String16(SERVICE::getServiceName()), new SERVICE(), allowIsolated,
dumpFlags);
}
static void publishAndJoinThreadPool(
bool allowIsolated = false,
int dumpFlags = IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT) {
publish(allowIsolated, dumpFlags);
joinThreadPool();
}
static void instantiate() { publish(); }
static status_t shutdown() { return NO_ERROR; }
private:
static void joinThreadPool() {
sp<ProcessState> ps(ProcessState::self());
ps->startThreadPool();
ps->giveThreadPoolName();
IPCThreadState::self()->joinThreadPool();
}
};
这样，Camera就在ServiceManager完成服务注册，提供给client随时使用。
2.3 CameraServer进程的实例化
CameraServer进程启动会调用自身的onFirstRef()函数进行初始化
当系统启动的时候会首先运行main_cameraserver程序，紧接着调用了CameraService的instantiate方法（上一节有讲过），该方法最终会调用到CameraService的onFirstRef方法，在这个方法里面便开始了整个CameraService的初始化工作。
而在onFirstRef方法内又调用了enumerateProviders方法，该方法中主要做了两个工作：
- 一个是实例化一个CameraProviderManager对象，该对象管理着有关Camera Provider的一些资源。
- 一个是调用CameraProviderManager的initialize方法对其进行初始化工作
2.4 CameraProviderManager的初始化
CameraProviderManager调用initialize初始化
（1）CameraProviderManager::initialize
//第二个参数就是远程代理类。这个参数已经是默认赋值了，实际类HardwareServiceInteractionProxy
status_t CameraProviderManager::initialize(wp<CameraProviderManager::StatusListener> listener,
ServiceInteractionProxy* proxy) {
/* Do something in */
......
/* Do something out */
// Registering will trigger notifications for all already-known providers
bool success = mServiceProxy->registerForNotifications(
/* instance name, empty means no filter */ "",
this);
/* Do something in */
......
/* Do something out */
// See if there's a passthrough HAL, but let's not complain if there's not
addProviderLocked(kLegacyProviderName, /*expected*/ false);
addProviderLocked(kExternalProviderName, /*expected*/ false);
return OK;
}
addProviderLocked主要做了三件事：
- 首先通过getService方法获取ICameraProvider代理。
- 随后实例化了一个ProviderInfo对象，之后调用其initialize方法进行初始化。
- 最后将ProviderInfo加入到一个内部容器中进行管理。
status_t CameraProviderManager::addProviderLocked(const std::string& newProvider, bool expected) {
/* Do something in */
......
/* Do something out */
//这里是通过名字来获取hal的ICameraProvider
sp<provider::V2_4::ICameraProvider> interface;
interface = mServiceProxy->getService(newProvider);
/* Do something in */
......
/* Do something out */
//创建和初始化providerInfo
sp<ProviderInfo> providerInfo =
new ProviderInfo(newProvider, interface, this);
status_t res = providerInfo->initialize();
if (res != OK) {
return res;
}
mProviders.push_back(providerInfo);
return OK;
}
（2）getService
获取ICameraProvider代理，最终会调用到frameworks/av/services/camera/libcameraservice/common/ CameraProviderManager.h
//初始化代理类的时候已经获取service了，前面会调用这里的getService方法
struct HardwareServiceInteractionProxy : public ServiceInteractionProxy {
virtual bool registerForNotifications(
const std::string &serviceName,
const sp<hidl::manager::V1_0::IServiceNotification>
¬ification) override {
return hardware::camera::provider::V2_4::ICameraProvider::registerForNotifications(
serviceName, notification);
}
virtual sp<hardware::camera::provider::V2_4::ICameraProvider> getService(
const std::string &serviceName) override {
return hardware::camera::provider::V2_4::ICameraProvider::getService(serviceName);
}
};
ICameraProvider::getService：最终会通过HIDL通信调用到CameraProvider.cpp中的HIDL_FETCH_ICameraProvider函数中，详情见3.2.4
（3）ProviderInfo
在CameraProviderManager.h中查看ProviderInfo结构体，providerInfo用来保存camera provider信息
ProviderInfo继承了 hardware::provider::V2_4::ICameraProviderCallback 与 hardware::hidl_death_recipient，其中ProviderInfo 第 2个参数就是camera service与cameraprovider通信的IPC接口.
Cameraserver 与Cameraprovider通信都是通过ProviderInfo
//ProviderInfo结构体
struct ProviderInfo :
virtual public hardware::camera::provider::V2_4::ICameraProviderCallback,
virtual public hardware::hidl_death_recipient
{
/* Do something in */
......
/* Do something out */
status_t initialize();
/* Do something in */
......
/* Do something out */
// ICameraProviderCallbacks interface - these lock the parent mInterfaceMutex
virtual hardware::Return<void> cameraDeviceStatusChange(
const hardware::hidl_string& cameraDeviceName,
hardware::camera::common::V1_0::CameraDeviceStatus newStatus) override;
virtual hardware::Return<void> torchModeStatusChange(
const hardware::hidl_string& cameraDeviceName,
hardware::camera::common::V1_0::TorchModeStatus newStatus) override;
// hidl_death_recipient interface - this locks the parent mInterfaceMutex
virtual void serviceDied(uint64_t cookie, const wp<hidl::base::V1_0::IBase>& who) override;
/* Do something in */
......
/* Do something out */
// HALv3-specific camera fields, including the actual device interface
struct DeviceInfo3 : public DeviceInfo {
typedef hardware::camera::device::V3_2::ICameraDevice InterfaceT;
const sp<InterfaceT> mInterface;
virtual status_t setTorchMode(bool enabled) override;
virtual status_t getCameraInfo(hardware::CameraInfo *info) const override;
virtual bool isAPI1Compatible() const override;
virtual status_t dumpState(int fd) const override;
virtual status_t getCameraCharacteristics(
CameraMetadata *characteristics) const override;
DeviceInfo3(const std::string& name, const metadata_vendor_id_t tagId,
const std::string &id, uint16_t minorVersion,
const hardware::camera::common::V1_0::CameraResourceCost& resourceCost,
sp<InterfaceT> interface);
virtual ~DeviceInfo3();
private:
CameraMetadata mCameraCharacteristics;
};
};
A. ProviderInfo 初始化
而在调用ProviderInfo的initialize方法进行初始化过程中存在如下几个动作：
- 首先接收了来自CameraProviderManager获取的ICameraProvider代理并将其存入内部成员变量中。
- 其次由于ProviderInfo实现了ICameraProviderCallback接口，所以紧接着调用了ICameraProvider的setCallback将自身注册到Camera Provider中，接收来自Provider的事件回调。
- 再然后，通过调用ICameraProvider代理的getCameraDeviceInterface_V3_X接口，获取Provider端的ICameraDevice代理，并且将这个代理作为参数加入到DeviceInfo3对象实例化方法中，而在实例化DeviceInfo3对象的过程中会通过ICameraDevice代理的getCameraCharacteristics方法获取该设备对应的属性配置，并且保存在内部成员变量中。
- 最后ProviderInfo会将每一个DeviceInfo3存入内部的一个容器中进行统一管理，至此整个初始化的工作已经完成。
status_t CameraProviderManager::ProviderInfo::initialize() {
........
//调用了ICameraProvider的setCallback将自身注册到Camera Provider中，接收来自Provider的事件回调。
hardware::Return<Status> status = mInterface->setCallback(this);
........
//设置死亡代理
hardware::Return<bool> linked = mInterface->linkToDeath(this, /*cookie*/ mId);
.........
//执行到CameraProvider::getCameraIdList
// Get initial list of camera devices, if any
std::vector<std::string> devices;
hardware::Return<void> ret = mInterface->getCameraIdList([&status, &devices](
Status idStatus,
const hardware::hidl_vec<hardware::hidl_string>& cameraDeviceNames) {
status = idStatus;
if (status == Status::OK) {
for (size_t i = 0; i < cameraDeviceNames.size(); i++) {
devices.push_back(cameraDeviceNames[i]);
}
} });
........
//添加DeviceInfo3对象，详情见initializeDeviceInfo方法
status_t res = addDevice(device,
hardware::camera::common::V1_0::CameraDeviceStatus::PRESENT, &id);
}
}
**---注：
mInterface类
定义：const sp<hardware::camera::provider::V2_4::ICameraProvider> mInterface;
CameraProvider是继承ICameraProvider的，所以之前addProviderLocked就是把hal的两个CameraProvider保存mInterface
**
B. addDevice：添加相机设备deviceInfo
status_t CameraProviderManager::ProviderInfo::addDevice(const std::string& name,
CameraDeviceStatus initialStatus, /*out*/ std::string* parsedId) {
/* Do something in */
......
/* Do something out */
//a.先创建然后添加结构
std::unique_ptr<DeviceInfo> deviceInfo;
deviceInfo = initializeDeviceInfo<DeviceInfo3>(name, mProviderTagid,id, minor);
mDevices.push_back(std::move(deviceInfo));
mUniqueCameraIds.insert(id);
/* Do something in */
......
/* Do something out */
}
-------------------------------------------------------------------------
template<class DeviceInfoT>
std::unique_ptr<CameraProviderManager::ProviderInfo::DeviceInfo>
CameraProviderManager::ProviderInfo::initializeDeviceInfo(
const std::string &name, const metadata_vendor_id_t tagId,
const std::string &id, uint16_t minorVersion) const {
Status status;
/*调用ICameraProvider代理的getCameraDeviceInterface_V3_X接口，获取Provider端的ICameraDevice代理，
并且将这个代理作为参数加入到DeviceInfo3对象实例化方法中，
而在实例化DeviceInfo3对象的过程中会通过ICameraDevice代理的getCameraCharacteristics方法获取该设备对应的属性配置，
并且保存在内部成员变量中*/
auto cameraInterface =
getDeviceInterface<typename DeviceInfoT::InterfaceT>(name);
if (cameraInterface == nullptr) return nullptr;
CameraResourceCost resourceCost;
cameraInterface->getResourceCost([&status, &resourceCost](
Status s, CameraResourceCost cost) {
status = s;
resourceCost = cost;
});
return std::unique_ptr<DeviceInfo>(
new DeviceInfoT(name, tagId, id, minorVersion, resourceCost,
cameraInterface));
}
C. DeviceInfo3结构体：通过调用获取信息，存入ProviderInfo结构体里
// HALv3-specific camera fields, including the actual device interface
struct DeviceInfo3 : public DeviceInfo {
typedef hardware::camera::device::V3_2::ICameraDevice InterfaceT;
const sp<InterfaceT> mInterface;
virtual status_t setTorchMode(bool enabled) override;
virtual status_t getCameraInfo(hardware::CameraInfo *info) const override;
virtual bool isAPI1Compatible() const override;
virtual status_t dumpState(int fd) const override;
virtual status_t getCameraCharacteristics(
CameraMetadata *characteristics) const override;
DeviceInfo3(const std::string& name, const metadata_vendor_id_t tagId,
const std::string &id, uint16_t minorVersion,
const hardware::camera::common::V1_0::CameraResourceCost& resourceCost,
sp<InterfaceT> interface);
virtual ~DeviceInfo3();
private:
CameraMetadata mCameraCharacteristics;
};
三、CmeraProvider
3.1 CameraProvider的启动与注册
(1)在系统初始化的时候，系统会去运行[email protected]程序启动Provider进程，并加入HW Service Manager中接受统一管理，在该过程中实例化了一个LegacyCameraProviderImpl_2_4对象，并在其构造函数中通过hw_get_module标准方法获取HAL的camera_module_t结构体,并将其存入CameraModule对象中，之后通过调用该camera_modult_t结构体的init方法初始化HAL Module，紧接着调用其get_number_of_camera方法获取当前HAL支持的Camera数量，最后通过调用其set_callbacks方法将LegcyCameraProviderImpl_2a_4（LegcyCameraProviderImpl_2_4继承了camera_modult_callback_t）作为参数传入CamX-CHI中，接受来自CamX-CHI中的数据以及事件，当这一系列动作完成了之后，Camera Provider进程便一直便存在于系统中，监听着来自Camera Service的调用。
service camera-provider-2-4 /vendor/bin/hw/android.hardware.camera.provider@2.4-service
class hal
user cameraserver
group audio camera input drmrpc inet
ioprio rt 4
capabilities SYS_NICE
writepid /dev/cpuset/camera-daemon/tasks /dev/stune/top-app/tasks
(2) 注册该 CameraProvider：为了在 CameraServer 启动时能找到它。需要注意的是，此时 CameraProvider 还未实例化与初始化。代码位置：hardware/interfaces/camera/provider/2.4/default。入口在service.cpp中的main函数
int main()
{
ALOGI("Camera provider Service is starting.");
// The camera HAL may communicate to other vendor components via
// /dev/vndbinder
//初始化binder通信驱动节点，打开binder设备
android::ProcessState::initWithDriver("/dev/vndbinder");
//创建默认为直通模式（Passthrough）的CameraProvider服务实现
return defaultPassthroughServiceImplementation<ICameraProvider>("legacy/0", /*maxThreads*/ 6);
}
------------------------------------------------------------
/**
* Registers passthrough service implementation.模板函数，Interface = ICameraProvider
*/
template<class Interface>
__attribute__((warn_unused_result))
status_t registerPassthroughServiceImplementation(
std::string name = "default") {
/* 获得CameraProvider实例化对象（不是Binder代理）,（此处的name为 “legacy/0”） */
sp<Interface> service = Interface::getService(name, true /* getStub */);
if (service == nullptr) {
ALOGE("Could not get passthrough implementation for %s/%s.",
Interface::descriptor, name.c_str());
return EXIT_FAILURE;
}
LOG_FATAL_IF(service->isRemote(), "Implementation of %s/%s is remote!",
Interface::descriptor, name.c_str());
/* 将 CameraProvider 注册为一个服务，其他进程需要使用camera HAL层时，通过Binder
* 得到 CameraProvider 代理类即可操作 camera HAL层，不需要每次都dlopen(HAL.so)
* */
status_t status = service->registerAsService(name);
if (status == OK) {
ALOGI("Registration complete for %s/%s.",
Interface::descriptor, name.c_str());
} else {
ALOGE("Could not register service %s/%s (%d).",
Interface::descriptor, name.c_str(), status);
}
return status;
}
上一篇中简单的讲了下 ICameraProvider::getService，最终会通过HIDL通信调用到CameraProvider.cpp中的HIDL_FETCH_ICameraProvider函数中：
hardware/interfaces/camera/provider/2.4/default/CameraProvider.cpp，这里详细讲下
3.2 CameraProvider 实例化对象的过程
3.2.1 Interface::getService (ICameraProvider::getService)
文件路径：CameraProviderAll.cpp (out\soong.intermediates\hardware\interfaces\camera\provider\2.4\[email protected]_genc++\gen\android\hardware\camera\provider\2.4)
---------------------------------------------------------------------------------------------------------
::android::sp<ICameraProvider> ICameraProvider::getService(const std::string &serviceName, const bool getStub) {
return ::android::hardware::details::getServiceInternal<BpHwCameraProvider>(serviceName, true, getStub);
}
---------------------------------------------------------------------------------------------------------
// HidlTransportSupport.h (system\libhidl\transport\include\hidl)
template <typename BpType, typename IType = typename BpType::Pure,
typename = std::enable_if_t<std::is_same<i_tag, typename IType::_hidl_tag>::value>,
typename = std::enable_if_t<std::is_same<bphw_tag, typename BpType::_hidl_tag>::value>>
sp<IType> getServiceInternal(const std::string& instance, bool retry, bool getStub) {
using ::android::hidl::base::V1_0::IBase;
// IType::descriptor = [email protected]::ICameraProvider
// instance = "legacy/0"
sp<IBase> base = getRawServiceInternal(IType::descriptor, instance, retry, getStub);
if (base == nullptr) {
return nullptr;
}
if (base->isRemote()) {
// getRawServiceInternal guarantees we get the proper class
// 我们上面拿到的是BnHwBase类，通过toBinder转换为BnHwCameraProvider类
return sp<IType>(new BpType(toBinder<IBase>(base)));
}
return IType::castFrom(base);
}
---------------------------------------------------------------------------------------------------------
sp<::android::hidl::base::V1_0::IBase> getRawServiceInternal(const std::string& descriptor,
const std::string& instance,
bool retry, bool getStub) {
using Transport = ::android::hidl::manager::V1_0::IServiceManager::Transport;
using ::android::hidl::base::V1_0::IBase;
using ::android::hidl::manager::V1_0::IServiceManager;
sp<Waiter> waiter;
// 获取 hwservicemanager 服务， 用于获取Service的client端即BpXXX代理类，详情见3.2.2
const sp<IServiceManager1_1> sm = defaultServiceManager1_1();
........
/* getStub = false 时，走此流程，拿到 cameraprovider
用于其他服务获取cameraprovider服务
比如cameraservice 获取 cameraprovider时，拿到>，之后会New BpHwCameraProvider
通过 BpHwCameraProvider类调用HIDL通信，详见下面client端分析 3.2.2
*/
for (int tries = 0; !getStub && (vintfHwbinder || vintfLegacy); tries++) {
if (waiter == nullptr && tries > 0) {
waiter = new Waiter(descriptor, instance, sm);
}
if (waiter != nullptr) {
waiter->reset(); // don't reorder this -- see comments on reset()
}
// 调用 ServiceManager::get
// 返回的是 Bp端 CameraProvider 代理类
Return<sp<IBase>> ret = sm->get(descriptor, instance);
...............
if (getStub || vintfPassthru || vintfLegacy) {
/* getStub = true 时或者 binder 获取失败时走这个分支
* getservice 以 passthrough 模式打开 HAL 实现
*/
/* 获得 Passthrough 模式的服务管理器
* 其实就是 new PassthroughServiceManager 得到实例化对象
*/
const sp<IServiceManager> pm = getPassthroughServiceManager();
if (pm != nullptr) {
/*
* 这里会根据传入的 descriptor 字符串，找到 CameraProvider.cpp 生成的 so 文件
* 就是 [email protected]
* 然后使用这个库中的 HIDL_FETCH_ICameraProvider() 函数得到 CameraProvider 实例化对象
*/
sp<IBase> base = pm->get(descriptor, instance).withDefault(nullptr);
if (!getStub || trebleTestingOverride) {
base = wrapPassthrough(base);
}
return base;
}
}
return nullptr;
}
3.2.2 client端流程分析
实例化Cameraprovider，用于其他服务获取cameraprovider服务
比如cameraservice 获取 cameraprovider时，拿到，之后会New BpHwCameraProvider
通过 BpHwCameraProvider类调用HIDL通信
// 默认模式，即绑定模式获取服务的调用接口
sp<IServiceManager1_1> defaultServiceManager1_1() {
{
AutoMutex _l(details::gDefaultServiceManagerLock);
// 如果不是第一次调用，即gDefaultServiceManager ！= nullptr
// 则直接返回 gDefaultServiceManager
if (details::gDefaultServiceManager != nullptr) {
return details::gDefaultServiceManager;
}
if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {
// HwBinder not available on this device or not accessible to
// this process.
return nullptr;
}
// 等待HwServiceManager启动
// 通过判断 hwservicemanager.ready 属性值
waitForHwServiceManager();
while (details::gDefaultServiceManager == nullptr) {
/*
* 得到 BpHwServiceManager
* 需要注意 ProcessState::self()->getContextObject(NULL) 它就是得到 Handle = 0 的 HwBinder 对象
* 由这个 HwBinder 对象构造出了 BpHwServiceManager 对象
*/
details::gDefaultServiceManager =
// getContextObject 返回 handle 是 0 的服务，即 HwServiceManager
fromBinder<IServiceManager1_1, BpHwServiceManager, BnHwServiceManager>(
ProcessState::self()->getContextObject(nullptr));
if (details::gDefaultServiceManager == nullptr) {
LOG(ERROR) << "Waited for hwservicemanager, but got nullptr.";
sleep(1);
}
}
}
/* 返回 BpHwServiceManager 对象 */
return details::gDefaultServiceManager;
}
---------------------------------------------------------------------------------------------------------
返回Bp端 CameraProvider 代理类
// Methods from ::android::hidl::manager::V1_0::IServiceManager follow.
Return<sp<IBase>> ServiceManager::get(const hidl_string& hidlFqName,
const hidl_string& hidlName) {
const std::string fqName = hidlFqName;
const std::string name = hidlName;
if (!mAcl.canGet(fqName, getBinderCallingContext())) {
return nullptr;
}
// 在map中查找服务是否已经启动
// 若没有启动的话，调用tryStartService
// 实际上就是跑进去设置一个属性值，SetProperty("ctl.interface_start", fqName + "/" + name)
auto ifaceIt = mServiceMap.find(fqName);
if (ifaceIt == mServiceMap.end()) {
tryStartService(fqName, hidlName);
return nullptr;
}
const PackageInterfaceMap &ifaceMap = ifaceIt->second;
// 在 ifaceMap 查找此服务
const HidlService *hidlService = ifaceMap.lookup(name);
if (hidlService == nullptr) {
tryStartService(fqName, hidlName);
return nullptr;
}
// 获取Service启动时注册到HwServiceManager中的服务
sp<IBase> service = hidlService->getService();
if (service == nullptr) {
tryStartService(fqName, hidlName);
return nullptr;
}
return service;
}
3.2.3 server端流程分析
// getPassthroughServiceManager 过程
sp<IServiceManager1_0> getPassthroughServiceManager() {
return getPassthroughServiceManager1_1();
}
sp<IServiceManager1_1> getPassthroughServiceManager1_1() {
// PassthroughServiceManager 是 IServiceManager1_1 的子类，重写了get等方法
// 后面就是调用此get方法
static sp<PassthroughServiceManager> manager(new PassthroughServiceManager());
return manager;
}
---------------------------------------------------------------------------------------------------------
// sp base = pm->get(descriptor, instance).withDefault(nullptr);语句解析
/*
* ServiceManagement.cpp
* pm->get(ICameraProvider::descriptor, serviceName);
* ICameraProvider::descriptor = "[email protected]::ICameraProvider"
*/
Return<sp<IBase>> get(const hidl_string& fqName,
const hidl_string& name) override {
sp<IBase> ret = nullptr;
// open lib
openLibs(fqName, /*匿名函数作为形参*/[&](void* handle, const std::string &lib, const std::string &sym) {
// 这是一个匿名函数
// openLibs 中调用 eachLib 即调用此函数
IBase* (*generator)(const char* name);
/* 分析完 openLibs() 知道这里就是得到 HIDL_FETCH_ICameraProvider() 函数*/
*(void **)(&generator) = dlsym(handle, sym.c_str());
............
/* 调用 HIDL_FETCH_ICameraProvider() 函数得到 CameraProvider 实例化对象
* 后面分析 HIDL_FETCH_ICameraProvider() 函数------见3.2.4
*/
ret = (*generator)(name.c_str());
if (ret == nullptr) {
dlclose(handle);
return true; // this module doesn't provide this instance name
}
............
});
// 返回CameraProvider实例
return ret;
}
----------------------------------------------------------------------------------------------------------
static void openLibs(
const std::string& fqName,
const std::function<bool /* continue */ (void* /* handle */, const std::string& /* lib */,
const std::string& /* sym */)>& eachLib) {
//fqName looks like [email protected]::IFoo
/* fqName = [email protected]::ICameraProvider */
size_t idx = fqName.find("::"); // 获取 :: 位置
if (idx == std::string::npos ||
idx + strlen("::") + 1 >= fqName.size()) {
LOG(ERROR) << "Invalid interface name passthrough lookup: " << fqName;
return;
}
/* 得到 "[email protected]" 字符串 */
std::string packageAndVersion = fqName.substr(0, idx);
/* 得到 "ICameraProvider" 字符串 */
std::string ifaceName = fqName.substr(idx + strlen("::"));
/* 得到 "[email protected]" 字符串 */
const std::string prefix = packageAndVersion + "-impl";
// 函数名HIDL_FETCH_ICameraProvider
const std::string sym = "HIDL_FETCH_" + ifaceName;
..........
// 调用匿名函数
if (!eachLib(handle, lib, sym)) {
return;
}
}
3.2.4 HIDL_FETCH_ICameraProvider
hardware/interfaces/camera/provider/2.4/default/CameraProvider.cpp
ICameraProvider* HIDL_FETCH_ICameraProvider(const char* name) {
if (strcmp(name, kLegacyProviderName) == 0) {
/*
* new CameraProvider 实例
* 但是要注意，在构造函数中打开了 HAL 层
* CameraProvider 与 Camera HAL 联系了起来
* 后面分析
*/
CameraProvider* provider = new CameraProvider();
/* Do something in */
......
/* Do something out */
return provider;
}
...............................................................................................................
//CameraProvider的构造函数
CameraProvider::CameraProvider() :
/*
* 调用父类的构造函数
* 这个回调会在后面使用到，请留意
*/
camera_module_callbacks_t({sCameraDeviceStatusChange,
sTorchModeStatusChange}) {
mInitFailed = initialize();
}
...............................................................................................................
//CameraProvider初始化
bool CameraProvider::initialize() {
camera_module_t *rawModule;
/*
* 就是这里了，打开 HAL
*/
int err = hw_get_module(CAMERA_HARDWARE_MODULE_ID,
(const hw_module_t **)&rawModule);
/*
* 将得到的 hw_module_t 结构体再封装都、多一层
* 之后会使用这个对象调用 HAL 层接口
*/
mModule = new CameraModule(rawModule);
/* 得到一些 Camera 的基本信息 */
err = mModule->init();
// Setup callback now because we are going to try openLegacy next
/*
* 设置回调，在 CameraProvider() 构造函数中构造的回调
* class CameraProvider 继承于 class camera_module_callbacks_t 所以可以这样调用
* 看意思应该就是 camera 状态改变的时候 HAL 层会调用这个回调通知 CameraProvider
*/
err = mModule->setCallbacks(this);
..........
/* 得到 camera 的个数 */
mNumberOfLegacyCameras = mModule->getNumberOfCameras();
for (int i = 0; i < mNumberOfLegacyCameras; i++) {
struct camera_info info;
/* 获得每一个 camera 的信息 */
auto rc = mModule->getCameraInfo(i, &info);
}
return false; // mInitFailed
}
Provider通过hw_get_module调用动态链接库获取硬件的信息，并包装到CameraModule中。与HAL通信。至此，CameraProvider初始化完成
3.3 注册 CameraProvider 实例化对象
3.3.1 service->registerAsService(name)
// status_t status = service->registerAsService(name);
::android::status_t ICameraProvider::registerAsService(const std::string &serviceName) {
::android::hardware::details::onRegistration("[email protected]", "ICameraProvider", serviceName);
// 获取 HwServiceManager
/*
* 得到 BpHwServiceManager 对象
* 就是 HwServiceManager 对象的 binder 代理
* 后面会分析如何得到 BpHwServiceManager 对象
*/
const ::android::sp<::android::hidl::manager::V1_0::IServiceManager> sm
= ::android::hardware::defaultServiceManager();
if (sm == nullptr) {
return ::android::INVALID_OPERATION;
}
/*
* 调用 BpHwServiceManager::add() 注册服务
* 后面分析
*/
::android::hardware::Return<bool> ret = sm->add(serviceName.c_str(), this);
return ret.isOk() && ret ? ::android::OK : ::android::UNKNOWN_ERROR;
}
---------------------------------------------------------------------------------------------------------------
// _hidl_add
::android::hardware::Return<bool> BpHwServiceManager::_hidl_add(::android::hardware::IInterface *_hidl_this, ::android::hardware::details::HidlInstrumentor *_hidl_this_instrumentor, const ::android::hardware::hidl_string& name, const ::android::sp<::android::hidl::base::V1_0::IBase>& service) {
.........
if (service == nullptr) {
_hidl_err = _hidl_data.writeStrongBinder(nullptr);
} else {
// toBinder 会通过传入的 IBase 构造出 BnCameraProvider
::android::sp<::android::hardware::IBinder> _hidl_binder = ::android::hardware::toBinder<
::android::hidl::base::V1_0::IBase>(service);
if (_hidl_binder.get() != nullptr) {
// 将_hidl_binder放入_hidl_data
_hidl_err = _hidl_data.writeStrongBinder(_hidl_binder);
} else {
_hidl_err = ::android::UNKNOWN_ERROR;
}
}
if (_hidl_err != ::android::OK) { goto _hidl_error; }
// 开启线程
::android::hardware::ProcessState::self()->startThreadPool();
// 进程间通信
// 通过binder，调用ServiceManager.cpp(HwServiceManager服务于) 中的 add 函数
_hidl_err = ::android::hardware::IInterface::asBinder(_hidl_this)->transact(2 /* add */, _hidl_data, &_hidl_reply);
...........
// ServiceManager.cpp
Return<bool> ServiceManager::add(const hidl_string& name, const sp<IBase>& service) {
bool isValidService = false;
if (service == nullptr) {
return false;
}
auto callingContext = getBinderCallingContext();
auto ret = service->interfaceChain([&](const auto &interfaceChain) {
if (interfaceChain.size() == 0) {
return;
}
// First, verify you're allowed to add() the whole interface hierarchy
for(size_t i = 0; i < interfaceChain.size(); i++) {
const std::string fqName = interfaceChain[i];
if (!mAcl.canAdd(fqName, callingContext)) {
return;
}
}
{
// For IBar extends IFoo if IFoo/default is being registered, remove
// IBar/default. This makes sure the following two things are equivalent
// 1). IBar::castFrom(IFoo::getService(X))
// 2). IBar::getService(X)
// assuming that IBar is declared in the device manifest and there
// is also not an IBaz extends IFoo.
const std::string childFqName = interfaceChain[0];
const PackageInterfaceMap &ifaceMap = mServiceMap[childFqName];
const HidlService *hidlService = ifaceMap.lookup(name);
if (hidlService != nullptr) {
const sp<IBase> remove = hidlService->getService();
if (remove != nullptr) {
const std::string instanceName = name;
removeService(remove, &instanceName /* restrictToInstanceName */);
}
}
}
for(size_t i = 0; i < interfaceChain.size(); i++) {
const std::string fqName = interfaceChain[i];
PackageInterfaceMap &ifaceMap = mServiceMap[fqName];
HidlService *hidlService = ifaceMap.lookup(name);
if (hidlService == nullptr) {
ifaceMap.insertService(
std::make_unique<HidlService>(fqName, name, service, callingContext.pid));
} else {
hidlService->setService(service, callingContext.pid);
}
ifaceMap.sendPackageRegistrationNotification(fqName, name);
}
bool linkRet = service->linkToDeath(this, kServiceDiedCookie).withDefault(false);
if (!linkRet) {
LOG(ERROR) << "Could not link to death for " << interfaceChain[0] << "/" << name;
}
isValidService = true;
});
if (!ret.isOk()) {
LOG(ERROR) << "Failed to retrieve interface chain.";
return false;
}
return isValidService;
}
3.4 Provider
接下来以上图为例简单介绍下Provider中几个重要流程：
- Camera Service通过调用ICameraProvider的getCameraDeviceInterface_v3_x接口获取ICameraDevice，在此过程中，Provider会去实例化一个CameraDevice对象，并且将之前存有camera_modult_t结构体的CameraModule对象传入CameraDevice中，这样就可以在CameraDevice内部通过CameraModule访问到camera_module_t的相关资源，然后将CameraDevice内部类TrampolineDeviceInterface_3_2（该类继承并实现了ICameraDevice接口）返回给Camera Service。
- Camera Service通过之前获取的ICameraDevice，调用其open方法来打开Camera设备，接着在Provider中会去调用CameraDevice对象的open方法，在该方法内部会去调用camera_module_t结构体的open方法，从而获取到HAL部分的camera3_device_t结构体，紧接着Provider会实例化一个CameraDeviceSession对象，并且将刚才获取到的camera3_device_t结构体以参数的方式传入
CameraDeviceSession中，在CameraDeviceSession的构造方法中又会调用CameraDeviceSession的initialize方法，在该方法内部又会去调用camera3_device_t结构体的ops内的initialize方法开始HAL部分的初始化工作，最后CameraDeviceSession对象被作为camera3_callback_ops的实现传入HAL，接收来自HAL的数据或者具体事件，当一切动作都完成后，Provider会将CameraDeviceSession::TrampolineSessionInterface_3_2（该类继承并实现了ICameraDeviceSession接口）对象通过HIDL回调的方法返回给Camera Service中。 - Camera Service通过调用ICameraDevcieSession的configureStreams_3_5接口进行数据流的配置，在Provider中，最终会通过调用之前获取的camera3_device_t结构体内ops的configure_streams方法下发到HAL中进行处理。
- Camera Service通过调用ICameraDevcieSession的processCaptureRequest_3_4接口下发request请求到Provider中，在Provider中，最终依然会通过调用获取的camera3_device_t结构体内ops中的process_capture_request方法将此次请求下发到HAL中进行处理。
从整个流程不难看出，这几个接口最终对应的是HAL3的接口，并且Provider并没有经过太多复杂的额外的处理。
六、处理APP的请求
而在打开相机时，该层的完整连路会被创建出来，主要调用逻辑如下图：
（1）CameraDeviceClient
frameworks\av\services\camera\libcameraservice\api2\CameraDeviceClient.cpp
CameraService 在创建 CameraDeviceClient 之后，会调用它的初始化函数
//对外提供调用的初始化函数接口 initialize。
status_t CameraDeviceClient::initialize(sp<CameraProviderManager> manager) {
return initializeImpl(manager);
}
//初始化的具体实现函数，模板 TProviderPtr 在此处即是 CameraProviderManager 类。
template<typename TProviderPtr>
//首先将父类初始化，注意此处传入了 CameraProviderManager。
status_t CameraDeviceClient::initializeImpl(TProviderPtr providerPtr) {
ATRACE_CALL();
status_t res;
res = Camera2ClientBase::initialize(providerPtr);
if (res != OK) {
return res;
}
//这里是关于 FrameProcessor 的创建与初始化配置等等
String8 threadName;
mFrameProcessor = new FrameProcessorBase(mDevice);
threadName = String8::format("CDU-%s-FrameProc", mCameraIdStr.string());
mFrameProcessor->run(threadName.string());
mFrameProcessor->registerListener(FRAME_PROCESSOR_LISTENER_MIN_ID,
FRAME_PROCESSOR_LISTENER_MAX_ID,
/*listener*/this,
/*sendPartials*/true);
return OK;
}
（2）Camera2ClientBase
frameworks\av\services\camera\libcameraservice\common\Camera2ClientBase.cpp
template <typename TClientBase> //模板 TClientBase，在 CameraDeviceClient 继承 Camera2ClientBase 时被指定为 CameraDeviceClientBase。
Camera2ClientBase<TClientBase>::Camera2ClientBase( //构造的相关参数，以及初始化列表，这里面需要注意 TCamCallbacks 在 CameraDeviceClientBase 中被指定为了 ICameraDeviceCallbacks。
const sp<CameraService>& cameraService,
const sp<TCamCallbacks>& remoteCallback,
const String16& clientPackageName,
const String8& cameraId,
int cameraFacing,
int clientPid,
uid_t clientUid,
int servicePid):
TClientBase(cameraService, remoteCallback, clientPackageName,
cameraId, cameraFacing, clientPid, clientUid, servicePid),
mSharedCameraCallbacks(remoteCallback),
mDeviceVersion(cameraService->getDeviceVersion(TClientBase::mCameraIdStr)),
mDeviceActive(false)
{
ALOGI("Camera %s: Opened. Client: %s (PID %d, UID %d)", cameraId.string(),
String8(clientPackageName).string(), clientPid, clientUid);
mInitialClientPid = clientPid;
mDevice = new Camera3Device(cameraId); //创建了一个 Camera3Device。
LOG_ALWAYS_FATAL_IF(mDevice == 0, "Device should never be NULL here.");
}
//初始化方法
template <typename TClientBase> //初始化函数接口，真正的实现部分在 initializeImpl 中。
status_t Camera2ClientBase<TClientBase>::initialize(sp<CameraProviderManager> manager) {
return initializeImpl(manager);
}
//TClientBase 对应 CameraDeviceClientBase，而 TProviderPtr 对应的是 CameraProviderManager。
template <typename TClientBase>
template <typename TProviderPtr>
status_t Camera2ClientBase<TClientBase>::initializeImpl(TProviderPtr providerPtr) {
ATRACE_CALL();
ALOGV("%s: Initializing client for camera %s", __FUNCTION__,
TClientBase::mCameraIdStr.string());
status_t res;
// Verify ops permissions
res = TClientBase::startCameraOps(); //调用 CameraDeviceClientBase 的 startCameraOps 方法，检查 ops 的权限。
if (res != OK) {
return res;
}
if (mDevice == NULL) {
ALOGE("%s: Camera %s: No device connected",
__FUNCTION__, TClientBase::mCameraIdStr.string());
return NO_INIT;
}
res = mDevice->initialize(providerPtr); //初始化 Camera3Device 的实例，注意此处传入了 CameraProviderManager。
if (res != OK) {
ALOGE("%s: Camera %s: unable to initialize device: %s (%d)",
__FUNCTION__, TClientBase::mCameraIdStr.string(), strerror(-res), res);
return res;
}
//在 Camera3Device 实例中设置 Notify 回调。
wp<CameraDeviceBase::NotificationListener> weakThis(this);
res = mDevice->setNotifyCallback(weakThis);
return OK;
}
（3）Camera3Device
frameworks\av\services\camera\libcameraservice\device3\Camera3Device.cpp
Camera3Device::Camera3Device(const String8 &id): //构造方法
mId(id),
mOperatingMode(NO_MODE),
mIsConstrainedHighSpeedConfiguration(false),
mStatus(STATUS_UNINITIALIZED),
mStatusWaiters(0),
mUsePartialResult(false),
mNumPartialResults(1),
mTimestampOffset(0),
mNextResultFrameNumber(0),
mNextReprocessResultFrameNumber(0),
mNextShutterFrameNumber(0),
mNextReprocessShutterFrameNumber(0),
mListener(NULL),
mVendorTagId(CAMERA_METADATA_INVALID_VENDOR_ID)
{
ATRACE_CALL();
//在这个观察构造函数中设定了两个回调接口：
camera3_callback_ops::notify = &sNotify;
camera3_callback_ops::process_capture_result = &sProcessCaptureResult;
ALOGV("%s: Created device for camera %s", __FUNCTION__, mId.string());
}
//初始化方法
status_t Camera3Device::initialize(sp<CameraProviderManager> manager) {
ATRACE_CALL();
Mutex::Autolock il(mInterfaceLock);
Mutex::Autolock l(mLock);
ALOGV("%s: Initializing HIDL device for camera %s", __FUNCTION__, mId.string());
if (mStatus != STATUS_UNINITIALIZED) {
CLOGE("Already initialized!");
return INVALID_OPERATION;
}
if (manager == nullptr) return INVALID_OPERATION;
sp<ICameraDeviceSession> session;
ATRACE_BEGIN("CameraHal::openSession");
status_t res = manager->openSession(mId.string(), this, //调用CameraProviderManager的openSession方法，开启了远端的Session
/*out*/ &session);
ATRACE_END();
if (res != OK) {
SET_ERR_L("Could not open camera session: %s (%d)", strerror(-res), res);
return res;
}
/* Do something in */
......
/* Do something out */
return initializeCommonLocked();
}
（4）CameraProviderManager
frameworks\av\services\camera\libcameraservice\common\CameraProviderManager.cpp
status_t CameraProviderManager::openSession(const std::string &id,
const sp<hardware::camera::device::V3_2::ICameraDeviceCallback>& callback,
/*out*/
sp<hardware::camera::device::V3_2::ICameraDeviceSession> *session) {
std::lock_guard<std::mutex> lock(mInterfaceMutex);
auto deviceInfo = findDeviceInfoLocked(id, //首先调用 findDeviceInfoLocked，获取 HAL3 相关的 DeviceInfo3
/*minVersion*/ {3,0}, /*maxVersion*/ {4,0});
if (deviceInfo == nullptr) return NAME_NOT_FOUND;
auto *deviceInfo3 = static_cast<ProviderInfo::DeviceInfo3*>(deviceInfo);
Status status;
hardware::Return<void> ret;
//通过远端调用 CameraDevice 的 open 方法，创建 CameraDeviceSession 实例并将其本地调用接口通过入参 session 返回。
ret = deviceInfo3->mInterface->open(callback, [&status, &session]
(Status s, const sp<device::V3_2::ICameraDeviceSession>& cameraSession) {
status = s;
if (status == Status::OK) {
*session = cameraSession;
}
});
if (!ret.isOk()) {
ALOGE("%s: Transaction error opening a session for camera device %s: %s",
__FUNCTION__, id.c_str(), ret.description().c_str());
return DEAD_OBJECT;
}
return mapToStatusT(status);
}
（5）CameraDevice
hardware\interfaces\camera\device\3.2\default\CameraDevice.cpp
CameraDevice 的实例实际上在初始化 HAL Service 之后就存在了。 前面说到，通过 CameraProviderManager 中的 deviceInfo 接口，调用远端 CameraDevice 实例的 open 方法，下面就来看看它的代码实现：
Return<void> CameraDevice::open(const sp<ICameraDeviceCallback>& callback, open_cb _hidl_cb) {
Status status = initStatus();
sp<CameraDeviceSession> session = nullptr;
if (callback == nullptr) {
ALOGE("%s: cannot open camera %s. callback is null!",
__FUNCTION__, mCameraId.c_str());
_hidl_cb(Status::ILLEGAL_ARGUMENT, nullptr);
return Void();
}
if (status != Status::OK) {
/* Do something in */
......
/* Do something out */
} else {
mLock.lock();
/* Do something in */
......
/* Do something out */
/** Open HAL device */
status_t res;
camera3_device_t *device;
ATRACE_BEGIN("camera3->open");
res = mModule->open(mCameraId.c_str(), //注意 mModule 是在 HAL Service 初始化时就已经配置好的，它对从libhardware库中加载的 Camera HAL 接口进行了一层封装，从这里往下就会一路走到 QCamera3HWI 的构造流程去。
reinterpret_cast<hw_device_t**>(&device));
ATRACE_END();
/* Do something in */
......
/* Do something out */
//创建 session 并让内部成员 mSession 持有，具体实现的函数为 creatSession。
session = createSession(
device, info.static_camera_characteristics, callback);
/* Do something in */
......
/* Do something out */
mSession = session;
IF_ALOGV() {
session->getInterface()->interfaceChain([](
::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
ALOGV("Session interface chain:");
for (auto iface : interfaceChain) {
ALOGV(" %s", iface.c_str());
}
});
}
mLock.unlock();
}
_hidl_cb(status, session->getInterface());
return Void();
}
而 creatSession 中直接创建了一个 CameraDeviceSession。当然在其构造函数中会调用内部的初始化函数，然后会进入 HAL 接口层 QCamera3HWI 的初始化流程，至此，从 CameraService 到 HAL Service 这一部分的打开相机流程就基本走通了。