Android 13 Camera HAL启动流程(1)

文章目录

  • 前言
  • Android Camera整体架构
  • CameraProvider
    • getRawServiceInternal
      • PassthroughServiceManager.get
      • PassthroughServiceManager.openLibs
      • HIDL_FETCH_ICameraProvider

欢迎关注微信公众号 无限无羡

前言

不积跬步,无以至千里;不积小流,无以成江海。

本章将作为Android Camera系列的开篇,后续将会持续输出相关文章,尽可能的形成一个完整的系列内容。全部更新完毕时间可能会比较长,因为Camera的东西其实很多的,本人也需要不断的学习和深入。由于目前对Camera驱动的内容了解的不多,所以驱动的内容会放到最后来讲,还希望大家理解和耐心等待,如果文章中有错误或者大家有想交流的内容都可以直接跟我交流,我们一起学习!

我们会先介绍Camera相关服务的启动流程,然后再讲解Camera的业务调用流程。原因是系统开机时Camera服务会进行一系列的初始化,这样上层应用使用Camera功能时就可以节省一些时间和资源,从而加快整个Camera业务流程的效率。我们会先讲Camera HAL服务的启动流程,然后再讲解cameraserver服务的启动流程,最后从上层应用的调用流程来详细分析Camera每个业务(比如预览、拍照、录像等)的具体实现。

所以本章就从Camera HAL服务的启动流程开始,本想用一篇文章来介绍完Camera HAL启动流程的,结果越写越多,写的多了代码就不容易连贯,反而影响阅读体验,故而分为多个章节来介绍,希望能够讲透彻,讲条理,讲清楚。

Android Camera整体架构

Android 13 Camera HAL启动流程(1)_第1张图片

Camera的整体架构符合标准的Android架构,即App->FWK->HAL->Kernel,只不过在Android8.0之前HAL的so库是被System分区的服务动态加载的,对于camera hal来说就是被cameraserver进程动态加载,hal和cameraserver进程属于同一个进程。在Android8.0之后,Google加入了Treble机制,将HAL放到了独立的进程当中并且位于vendor分区,System服务通过binder访问vendor分区的HAL进程。对于camera来说就是cameraserver进程通过binder访问Camera HAL进程,后者在开机时通过init启动。这样就可以将厂商的私有实现与Google发布的aosp进行隔离,在系统升级时如果厂商的vendor分区没有修改的话,就可以不升级vendor分区,但是厂商必须按照Google定义的标准接口来实现HAL。

CameraProvider

Camera HAL运行在CameraProvider进程当中,目前已经到2.7版本,但是使用最多的是2.4版本,2.4是加入Treble机制后CameraProvider进程的第一个版本,所以我们先从这里开始。
CameraProvider进程是一个native服务,通过init.rc启动
(真正的进程名称是[email protected]_64,这里我们为了简写统一叫成CameraProvider进程)

// hardware/interfaces/camera/provider/2.4/default/[email protected]_64.rc
service vendor.camera-provider-2-4 /vendor/bin/hw/android.hardware.camera.provider@2.4-service_64
    interface android.hardware.camera.provider@2.4::ICameraProvider legacy/0
    class hal
    user cameraserver
    group audio camera input drmrpc
    ioprio rt 4
    capabilities SYS_NICE
    task_profiles CameraServiceCapacity MaxPerformance

由上可以看出,进程启动时执行的时二进制/vendor/bin/hw/[email protected]_64,下面我们从Android.bp中找到该二进制的入口文件和入口函数。

// hardware/interfaces/camera/provider/2.4/default/Android.bp
...
cc_binary {
    name: "[email protected]_64",
    defaults: ["camera_service_defaults"],
    compile_multilib: "64",
    init_rc: ["[email protected]_64.rc"],
}
cc_defaults {
    name: "camera_service_defaults",
    defaults: ["hidl_defaults"],
    proprietary: true,
    relative_install_path: "hw",
    srcs: ["service.cpp"], // 二进制入口肯定时service.cpp里面的main函数
    shared_libs: [
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "[email protected]",
        "libbinder",
        "libcamera_metadata",
        "libcutils",
        "libhardware",
        "libhidlbase",
        "liblog",
        "libutils",
    ],
    static_libs: [
        "[email protected]",
    ],
    header_libs: [
        "[email protected]_headers",
        "[email protected]_headers",
        "[email protected]_headers",
        "[email protected]_headers",
    ],
}
...

从以上Android.bp文件中可以看出,/vendor/bin/hw/[email protected]_64只包含了一个源文件service.cpp,那么入口函数肯定就是这个cpp里面的main函数了。

// hardware/interfaces/camera/provider/2.4/default/service.cpp
int main()
{
    ALOGI("[email protected] legacy service is starting.");
    // The camera HAL may communicate to other vendor components via
    // /dev/vndbinder
    // 这里表示Camera hal可以跟其他 vendor hal进程通过binder通信,否则不可以
    android::ProcessState::initWithDriver("/dev/vndbinder");

    // b/166675194
    if (property_get_bool("ro.vendor.camera.provider24.disable_mem_init", false)) {
        if (mallopt(M_BIONIC_ZERO_INIT, 0) == 0) {
            // Note - heap initialization is only present on devices with Scudo.
            // Devices with jemalloc don't have heap-init, and thus the mallopt
            // will fail. On these devices, you probably just want to remove the
            // property.
            ALOGE("Disabling heap initialization failed.");
        }
    }

    status_t status;
    if (kLazyService) {
        status = defaultLazyPassthroughServiceImplementation<ICameraProvider>("legacy/0",
                                                                              /*maxThreads*/ 6);
    } else {
    	// kLazyService就是会延迟初始化,我们这里不细讲,后面单出一个章节介绍一下
    	// 启动时会执行下面的函数,这里记下这里的泛型类型为ICameraProvider,还有两个参数,后面有用
        status = defaultPassthroughServiceImplementation<ICameraProvider>("legacy/0",
                                                                          /*maxThreads*/ 6);
    }
    return status;
}

defaultPassthroughServiceImplementation的实现如下:

// system/libhidl/transport/include/hidl/LegacySupport.h
// 这里的两个泛型参数都为ICameraProvider
template <class Interface, class ExpectInterface = Interface>
__attribute__((warn_unused_result)) status_t defaultPassthroughServiceImplementation(
        const std::string& name, size_t maxThreads = 1) {
    // 设置该进程中binder通信线程池的最大线程数,这里maxThreads=6
    configureRpcThreadpool(maxThreads, true);
    // 注意这里的泛型类型为ICameraProvider, 参数name为legacy/0
    status_t result = registerPassthroughServiceImplementation<Interface, ExpectInterface>(name);

    if (result != OK) {
        return result;
    }
	// 把当前线程也就是主线程加入binder线程池
    joinRpcThreadpool();
    return UNKNOWN_ERROR;
}

registerPassthroughServiceImplementation最终会执行到如下函数:

// system/libhidl/transport/include/hidl/LegacySupport.h
template <class Interface, class ExpectInterface = Interface>
__attribute__((warn_unused_result)) status_t registerPassthroughServiceImplementation(
        const std::string& name = "default") {
    // 这里Interface和ExpectInterface是ICameraProvider
    // ICameraProvider::descriptor为[email protected]::ICameraProvider
    // 至于ICameraProvider::descriptor的值哪里赋值的,后面细讲
    return registerPassthroughServiceImplementation(Interface::descriptor,
                                                    ExpectInterface::descriptor, name);
}
// system/libhidl/transport/LegacySupport.cpp
__attribute__((warn_unused_result)) status_t registerPassthroughServiceImplementation(
        const std::string& interfaceName, const std::string& expectInterfaceName,
        const std::string& serviceName) {
    // 这里前两个参数为[email protected]::ICameraProvider,
    // 第三个参数为lambda表达式的一个函数,该函数传入两个参数,然后执行registerAsServiceInternal
    // 第四个参数为legacy/0
    return details::registerPassthroughServiceImplementation(
            interfaceName, expectInterfaceName,
            [](const sp<IBase>& service, const std::string& name) {
                return details::registerAsServiceInternal(service, name);
            },
            serviceName);
}
// system/libhidl/transport/LegacySupport.cpp
// 这个函数主要干了两件事情
// 1. 打开camera hal的so库,初始化Camera Hal,比如获取camera numbers,在getRawServiceInternal里实现
// 2. 将camera hal注册为binder服务,在registerServiceCb里实现,也就是上一步的lamda函数,最终调用的是
// 	  registerAsServiceInternal
__attribute__((warn_unused_result)) status_t registerPassthroughServiceImplementation(
        const std::string& interfaceName, const std::string& expectInterfaceName,
        RegisterServiceCb registerServiceCb, const std::string& serviceName) {
    // 这是一个关键函数,第一个参数为[email protected]::ICameraProvider
    // 第二个参数为 legacy/0
    // 我们下面先分析这个函数,然后再继续
    sp<IBase> service =
            getRawServiceInternal(interfaceName, serviceName, true /*retry*/, true /*getStub*/);

	// 这里我们把后面的代码先省略掉,等getRawServiceInternal函数讲完之后再继续往下分析
    ...
}

getRawServiceInternal

// system/libhidl/transport/ServiceManagement.cpp
// 第一个参数为[email protected]::ICameraProvider
//  第二个参数为 legacy/0
// 后两个参数都为true
sp<::android::hidl::base::V1_0::IBase> getRawServiceInternal(const std::string& descriptor,
                                                             const std::string& instance,
                                                             bool retry, bool getStub) {
    using Transport = IServiceManager1_0::Transport;
    sp<Waiter> waiter;

    sp<IServiceManager1_1> sm;
    Transport transport = Transport::EMPTY;
    if (kIsRecovery) {
        transport = Transport::PASSTHROUGH;
    } else {
        sm = defaultServiceManager1_1();
        if (sm == nullptr) {
            ALOGE("getService: defaultServiceManager() is null");
            return nullptr;
        }
		// 这里最终会去读取/vendor/etc/vintf/manifest.xml文件来获取当前transport类型
		// 初始文件在device/xxx/manifest.xml,编译时跟其他manifest
		// 一起写入/vendor/etc/vintf/manifest.xml,定义如下:
		/*
		
    		
        		android.hardware.camera.provider
        		hwbinder
        		@2.4::ICameraProvider/legacy/0
    		
		
		*/
		// transport类型决定了当前HAL是绑定式还是直通式
        Return<Transport> transportRet = sm->getTransport(descriptor, instance);

        if (!transportRet.isOk()) {
            ALOGE("getService: defaultServiceManager()->getTransport returns %s",
                  transportRet.description().c_str());
            return nullptr;
        }
        transport = transportRet;
    }

    const bool vintfHwbinder = (transport == Transport::HWBINDER); // true
    const bool vintfPassthru = (transport == Transport::PASSTHROUGH); // false
    const bool trebleTestingOverride = isTrebleTestingOverride(); // false
    const bool allowLegacy = !kEnforceVintfManifest || (trebleTestingOverride && isDebuggable()); // false
    const bool vintfLegacy = (transport == Transport::EMPTY) && allowLegacy; // false

    if (!kEnforceVintfManifest) {
        ALOGE("getService: Potential race detected. The VINTF manifest is not being enforced. If "
              "a HAL server has a delay in starting and it is not in the manifest, it will not be "
              "retrieved. Please make sure all HALs on this device are in the VINTF manifest and "
              "enable PRODUCT_ENFORCE_VINTF_MANIFEST on this device (this is also enabled by "
              "PRODUCT_FULL_TREBLE). PRODUCT_ENFORCE_VINTF_MANIFEST will ensure that no race "
              "condition is possible here.");
        sleep(1);
    }

	// 因为参数getStub为true,所以这里的for循环不进入,不执行
    for (int tries = 0; !getStub && (vintfHwbinder || vintfLegacy); tries++) {
        if (waiter == nullptr && tries > 0) {
            waiter = new Waiter(descriptor, instance, sm);
        }
        if (waiter != nullptr) {
            waiter->reset();  // don't reorder this -- see comments on reset()
        }
        Return<sp<IBase>> ret = sm->get(descriptor, instance);
        if (!ret.isOk()) {
            ALOGE("getService: defaultServiceManager()->get returns %s for %s/%s.",
                  ret.description().c_str(), descriptor.c_str(), instance.c_str());
            break;
        }
        sp<IBase> base = ret;
        if (base != nullptr) {
            Return<bool> canCastRet =
                details::canCastInterface(base.get(), descriptor.c_str(), true /* emitError */);

            if (canCastRet.isOk() && canCastRet) {
                if (waiter != nullptr) {
                    waiter->done();
                }
                return base; // still needs to be wrapped by Bp class.
            }

            if (!handleCastError(canCastRet, descriptor, instance)) break;
        }

        // In case of legacy or we were not asked to retry, don't.
        if (vintfLegacy || !retry) break;

        if (waiter != nullptr) {
            ALOGI("getService: Trying again for %s/%s...", descriptor.c_str(), instance.c_str());
            waiter->wait(true /* timeout */);
        }
    }

    if (waiter != nullptr) {
        waiter->done();
    }

	// getStub为true,进入这里的if语句
    if (getStub || vintfPassthru || vintfLegacy) {
    	// getPassthroughServiceManager 返回new PassthroughServiceManager()
        const sp<IServiceManager1_0> pm = getPassthroughServiceManager();
        if (pm != nullptr) {
        	// 下面单独分析PassthroughServiceManager的get函数
            sp<IBase> base = pm->get(descriptor, instance).withDefault(nullptr);
            // getStub为true, trebleTestingOverride为false,这里的if进不去
            if (!getStub || trebleTestingOverride) {
                base = wrapPassthrough(base);
            }
            return base;
        }
    }
	
    return nullptr;
}

PassthroughServiceManager.get

// system/libhidl/transport/ServiceManagement.cpp
// descriptor: [email protected]::ICameraProvider
// instance:  legacy/0
sp<IBase> base = pm->get(descriptor, instance)
Return<sp<IBase>> get(const hidl_string& fqName,
                        const hidl_string& name) override {
    sp<IBase> ret = nullptr;

	// 主要就是执行了openLibs函数,我们先把参数理一下,然后在进入openLibs函数进行分析
	// 第一个参数fqName: [email protected]::ICameraProvider
	// 第二个参数是一个lamda函数,这个函数有三个参数,这里主要是这个lamda函数的实现,
	// 这里我们先省略,到调用的时候再详细讲
    openLibs(fqName, [&](void* handle, const std::string &lib, const std::string &sym) {
    ...
    }
}

PassthroughServiceManager.openLibs

// system/libhidl/transport/ServiceManagement.cpp
// openLibs函数实现
static void openLibs(
	// fqName:  [email protected]::ICameraProvider
    const std::string& fqName,
    // eachLib: 就是上面提到的lamda函数
    const std::function<bool /* continue */ (void* /* handle */, const std::string& /* lib */,
                                                const std::string& /* sym */)>& eachLib) {
    //fqName looks like [email protected]::IFoo
    // 用::符号将参数分割为[email protected]和ICameraProvider
    size_t idx = fqName.find("::");

    if (idx == std::string::npos ||
            idx + strlen("::") + 1 >= fqName.size()) {
        LOG(ERROR) << "Invalid interface name passthrough lookup: " << fqName;
        return;
    }

	// 这里拿到的就是[email protected]
    std::string packageAndVersion = fqName.substr(0, idx);
    // 这里拿到的就是 ICameraProvider
    std::string ifaceName = fqName.substr(idx + strlen("::"));

	// prefix为[email protected]
    const std::string prefix = packageAndVersion + "-impl";
    // sym为 HIDL_FETCH_ICameraProvider
    const std::string sym = "HIDL_FETCH_" + ifaceName;

	// 到此,上面参数已经解析完毕,下面根据prefix和sym来执行

    constexpr int dlMode = RTLD_LAZY;
    void* handle = nullptr;

    dlerror(); // clear

    static std::string halLibPathVndkSp = details::getVndkSpHwPath();
    std::vector<std::string> paths = {
        HAL_LIBRARY_PATH_ODM, HAL_LIBRARY_PATH_VENDOR, halLibPathVndkSp,
#ifndef __ANDROID_VNDK__
        HAL_LIBRARY_PATH_SYSTEM,
#endif
    };
    // 这里翻译下上面的paths变量:
        std::vector<std::string> paths = {
        "/odm/lib64/hw/", "/vendor/lib64/hw/", "/apex/com.android.vndk.v33/lib64/hw/",
#ifndef __ANDROID_VNDK__
        "/system/lib64/hw/",
#endif
    };
	// 条件为false,不进入
    if (details::isTrebleTestingOverride()) {
        // Load HAL implementations that are statically linked
        handle = dlopen(nullptr, dlMode);
        if (handle == nullptr) {
            const char* error = dlerror();
            LOG(ERROR) << "Failed to dlopen self: "
                        << (error == nullptr ? "unknown error" : error);
        } else if (!eachLib(handle, "SELF", sym)) {
            return;
        }
    }
	// 在paths的几个路径中寻找[email protected]文件
	// 我们到设备里查看一下,发现在/vendor/lib64/hw目录下,因为是64位系统,所以/vendor/lib/hw/是不会遍历的
	// 130|emulator_car_x86_64:/ # find . -name [email protected]                                                                                                        
	// ./vendor/lib/hw/[email protected]
	// ./vendor/lib64/hw/[email protected]
    for (const std::string& path : paths) {
        std::vector<std::string> libs = findFiles(path, prefix, ".so");

        for (const std::string &lib : libs) {
        	// fullPath=/vendor/lib64/hw/[email protected]
            const std::string fullPath = path + lib;

            if (kIsRecovery || path == HAL_LIBRARY_PATH_SYSTEM) {
                handle = dlopen(fullPath.c_str(), dlMode);
            } else {
#if !defined(__ANDROID_RECOVERY__) && defined(__ANDROID__)
				// 最终执行这里,load so库,拿到handle
                handle = android_load_sphal_library(fullPath.c_str(), dlMode);
#endif
            }

            if (handle == nullptr) {
                const char* error = dlerror();
                LOG(ERROR) << "Failed to dlopen " << lib << ": "
                            << (error == nullptr ? "unknown error" : error);
                continue;
            }
			// 还记得eachLib函数吗,就是上面省略掉的lamda函数,下面开始分析
            if (!eachLib(handle, lib, sym)) {
                return;
            }
        }
    }
}

下面开始讲解eachLib lamda实现

	// fqName: [email protected]::ICameraProvider
	// name:  legacy/0 
    Return<sp<IBase>> get(const hidl_string& fqName,
                          const hidl_string& name) override {
        sp<IBase> ret = nullptr;
		// 这里的handle为dlopen /vendor/lib64/hw/[email protected]后的handle
		// lib参数为[email protected]
		// sym参数为HIDL_FETCH_ICameraProvider
        openLibs(fqName, [&](void* handle, const std::string &lib, const std::string &sym) {
            IBase* (*generator)(const char* name);
            // 通过dlsym在[email protected]中找到HIDL_FETCH_ICameraProvider的地址
            *(void **)(&generator) = dlsym(handle, sym.c_str());
            if(!generator) {
                const char* error = dlerror();
                LOG(ERROR) << "Passthrough lookup opened " << lib << " but could not find symbol "
                           << sym << ": " << (error == nullptr ? "unknown error" : error)
                           << ". Keeping library open.";

                // dlclose too problematic in multi-threaded environment
                // dlclose(handle);

                return true;  // continue
            }
			// 执行HIDL_FETCH_ICameraProvider函数,参数为legacy/0 
            ret = (*generator)(name.c_str());

            if (ret == nullptr) {
                LOG(ERROR) << "Could not find instance '" << name.c_str() << "' in library " << lib
                           << ". Keeping library open.";

                // dlclose too problematic in multi-threaded environment
                // dlclose(handle);

                // this module doesn't provide this particular instance
                return true;  // continue
            }

            // Actual fqname might be a subclass.
            // This assumption is tested in vts_treble_vintf_test
            using ::android::hardware::details::getDescriptor;
            std::string actualFqName = getDescriptor(ret.get());
            CHECK(actualFqName.size() > 0);
            registerReference(actualFqName, name);
            return false;
        });

        return ret;
    }

HIDL_FETCH_ICameraProvider

// hardware/interfaces/camera/provider/2.4/default/CameraProvider_2_4.cpp
// 参数name为legacy/0 
ICameraProvider* HIDL_FETCH_ICameraProvider(const char* name) {
    using namespace android::hardware::camera::provider::V2_4::implementation;
    ICameraProvider* provider = nullptr;
    if (strcmp(name, kLegacyProviderName) == 0) {
    	// 执行这里
        provider = getProviderImpl<LegacyCameraProviderImpl_2_4>();
    } else if (strcmp(name, kExternalProviderName) == 0) {
        provider = getProviderImpl<ExternalCameraProviderImpl_2_4>();
    } else {
        ALOGE("%s: unknown instance name: %s", __FUNCTION__, name);
    }

    return provider;
}

// 创建CameraProvider对象并返回,在CameraProvider的构造函数中,会执行IMPL的构造函数,
// 也就是LegacyCameraProviderImpl_2_4的构造函数
template<typename IMPL>
CameraProvider<IMPL>* getProviderImpl() {
    CameraProvider<IMPL> *provider = new CameraProvider<IMPL>();
    if (provider == nullptr) {
        ALOGE("%s: cannot allocate camera provider!", __FUNCTION__);
        return nullptr;
    }
    if (provider->isInitFailed()) {
        ALOGE("%s: camera provider init failed!", __FUNCTION__);
        delete provider;
        return nullptr;
    }
    return provider;
} 

LegacyCameraProviderImpl_2_4的构造函数实现

// hardware/interfaces/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.cpp
LegacyCameraProviderImpl_2_4::LegacyCameraProviderImpl_2_4() :
        camera_module_callbacks_t({sCameraDeviceStatusChange,
                                   sTorchModeStatusChange}) {
    mInitFailed = initialize();
}

上面创建了LegacyCameraProviderImpl_2_4对象,并执行了其初始化函数initialize()。

总结一句其实就是CameraProvider进程启动时加载[email protected]库并执行LegacyCameraProviderImpl_2_4的初始化函数。

好的,本节就先介绍到这里,下节继续接着讲解。

你可能感兴趣的:(#,Android,Camera,Android系统开发,android)