AndroidO Treble架構（二）：CameraProvider 及其守護進程

AndroidO Treble 架構之 CameraProvider 分析
相關的文件以下：

hardware/interfaces/camera/provider/2.4/default/service.cpp
hardware/interfaces/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service.rc
hardware/interfaces/camera/provider/2.4/default/CameraProvider.cpp
out/soong/.intermediates/hardware/interfaces/camera/provider/2.4/android.hardware.camera.provider@2.4_genc++/gen/android/hardware/camera/provider/CameraProviderAll.cpp
一、啓動腳本
hardware/interfaces/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service.rc
service camera-provider-2-4 /vendor/bin/hw/android.hardware.camera.provider@2.4-service
    class hal
    user cameraserver
    group audio camera input drmrpc
    ioprio rt 4
    capabilities SYS_NICE
    writepid /dev/cpuset/camera-daemon/tasks /dev/stune/foreground/tasks

CameraProvider 守護進程由 init 進程啓動。

二、CameraProvider 守護進程啓動
2.1 main()
hardware/interfaces/camera/provider/2.4/default/service.cpp
int main()
{
    ALOGI("Camera provider Service is starting.");
    // The camera HAL may communicate to other vendor components via
    // /dev/vndbinder
    android::ProcessState::initWithDriver("/dev/vndbinder");
    /* 核心工做都在這個函數裏面，下面分析 */
    return defaultPassthroughServiceImplementation<ICameraProvider>("legacy/0", /*maxThreads*/ 6);
}

接下來咱們按照 main() 中註釋標明的順序分析那些函數的實現
defaultPassthroughServiceImplementation(「legacy/0」, /maxThreads/ 6)
2.2 defaultPassthroughServiceImplementation()
system/libhidl/transport/include/hidl/legacySupport.h
/* 模板函數，Interface = ICameraProvider */
template<class Interface>
__attribute__((warn_unused_result))
status_t defaultPassthroughServiceImplementation(std::string name, size_t maxThreads = 1) {
    /* 在上一篇分析過了，第一次執行這個函數會open(/dev/hwbinder) */
    configureRpcThreadpool(maxThreads, true);
    /* 
     * 核心在這個函數
     * 這個函數作了兩件事：
     * 一、獲得了 CameraProvider 實例化對象
     * 二、註冊 CameraProvider 實例化對象
     * 後面分析
     */
    status_t result = registerPassthroughServiceImplementation<Interface>(name);

    /* 
     * 上一篇一樣分析過這個，進入線程等待並處理binder消息
     * 固然這裏的流程跟HwServiceManager稍微有些不同
     * 後面 2.5 分析
     */
    joinRpcThreadpool();
    return 0;
}

/* 模板函數，Interface = ICameraProvider */
template<class Interface>
__attribute__((warn_unused_result))
status_t registerPassthroughServiceImplementation(std::string name = "default") {
    /*
     * 就是調用 ICameraProvider::getService()
     * getStub = ture 時，getservice 以 passthrough 模式打開 HAL 實現
     * 因此這個會獲得 CameraProvider 實例化對象(不是binder代理)
     * 後面 2.3 分析
     */
    sp<Interface> service = Interface::getService(name, true /* getStub */);

    /* 
     * 將 CameraProvider 註冊爲一個服務
     * 其餘進程須要使用 camera 的 hal 層時經過 binder 獲得 CameraProvider 代理類便可操做camera hal 層
     * 不須要像之前同樣每次都 dlopen(xxx.so)
     * 後面 2.4 分析
     */
    status_t status = service->registerAsService(name);

    return status;
}

2.3 獲得 CameraProvider 實例化對象的過程
out/soong/.intermediates/hardware/interfaces/camera/provider/2.4/android.hardware.camera.provider@2.4_genc++/gen/android/hardware/camera/provider/CameraProviderAll.cpp
hardware/interfaces/camera/provider/2.4/default/CameraProvider.cpp
system/libhidl/transport/ServiceManagement.cpp
// CameraProviderAll.cpp
::android::sp<ICameraProvider> ICameraProvider::getService(const std::string &serviceName, const bool getStub) {
    using ::android::hardware::defaultServiceManager;
    using ::android::hardware::details::waitForHwService;
    using ::android::hardware::getPassthroughServiceManager;
    using ::android::hardware::Return;
    using ::android::sp;
    using Transport = ::android::hidl::manager::V1_0::IServiceManager::Transport;

    sp<ICameraProvider> iface = nullptr;

    const sp<::android::hidl::manager::V1_0::IServiceManager> sm = defaultServiceManager();

    Return<Transport> transportRet = sm->getTransport(ICameraProvider::descriptor, serviceName);

    Transport transport = transportRet;
    const bool vintfHwbinder = (transport == Transport::HWBINDER);
    const bool vintfPassthru = (transport == Transport::PASSTHROUGH);

    #ifdef __ANDROID_TREBLE__

    #ifdef __ANDROID_DEBUGGABLE__
    const char* env = std::getenv("TREBLE_TESTING_OVERRIDE");
    const bool trebleTestingOverride =  env && !strcmp(env, "true");
    const bool vintfLegacy = (transport == Transport::EMPTY) && trebleTestingOverride;
    #else // __ANDROID_TREBLE__ but not __ANDROID_DEBUGGABLE__
    const bool trebleTestingOverride = false;
    const bool vintfLegacy = false;
    #endif // __ANDROID_DEBUGGABLE__

    #else // not __ANDROID_TREBLE__
    const char* env = std::getenv("TREBLE_TESTING_OVERRIDE");
    const bool trebleTestingOverride =  env && !strcmp(env, "true");
    const bool vintfLegacy = (transport == Transport::EMPTY);

    #endif // __ANDROID_TREBLE__

    for (int tries = 0; !getStub && (vintfHwbinder || (vintfLegacy && tries == 0)); tries++) {
        /* 
         * getStub = flase 才走這個分支
         * getService 會先獲取 binder 服務，若是失敗了纔會獲取 passthrough 服務
         */
        if (vintfHwbinder && tries > 0) {
            /* 等待 HwServiceManager 成功啓動*/
            waitForHwService(ICameraProvider::descriptor, serviceName);
        }
        /* 獲取 CameraProvider 代理類對象(binder) */
        Return<sp<::android::hidl::base::V1_0::IBase>> ret = 
                sm->get(ICameraProvider::descriptor, serviceName);

        sp<::android::hidl::base::V1_0::IBase> base = ret;
        if (base == nullptr) {
            if (tries > 0) {
                ALOGW("ICameraProvider: found null hwbinder interface");
            }continue;
        }
        /* 轉換爲 BpHwCameraProvider 對象 */
        Return<sp<ICameraProvider>> castRet = ICameraProvider::castFrom(base, true /* emitError */);
        if (!castRet.isOk()) {
            if (castRet.isDeadObject()) {
                ALOGW("ICameraProvider: found dead hwbinder service");
                continue;
            } else {
                ALOGW("ICameraProvider: cannot call into hwbinder service: %s; No permission? Check for selinux denials.", castRet.description().c_str());
                break;
            }
        }
        iface = castRet;
        if (iface == nullptr) {
            ALOGW("ICameraProvider: received incompatible service; bug in hwservicemanager?");
            break;
        }
        /* 因此這裏返回的是 BpHwCameraProvider 對象 */
        return iface;
    }
    if (getStub || vintfPassthru || vintfLegacy) {
        /* 
         * getStub = true 時或者 binder 獲取失敗時走這個分支
         * getservice 以 passthrough 模式打開 HAL 實現
         */

        /*
         * 得到 Passthrough 模式的服務管理器
         * 其實就是 new PassthroughServiceManager 獲得實例化對象
         */
        const sp<::android::hidl::manager::V1_0::IServiceManager> pm = getPassthroughServiceManager();
        if (pm != nullptr) {
            /* 
             * 這裏會根據傳入的 descriptor 字符串，找到 CameraProvider.cpp 生成的 so 文件
             * 就是 android.hardware.camera.provider@2.4-impl.so
             * 而後使用這個庫中的 HIDL_FETCH_ICameraProvider() 函數獲得 CameraProvider 實例化對象
             * 後面會分析這個函數
             */
            Return<sp<::android::hidl::base::V1_0::IBase>> ret = 
                    pm->get(ICameraProvider::descriptor, serviceName);
            if (ret.isOk()) {
                sp<::android::hidl::base::V1_0::IBase> baseInterface = ret;
                if (baseInterface != nullptr) {
                    iface = ICameraProvider::castFrom(baseInterface);
                    if (!getStub || trebleTestingOverride) {
                        iface = new BsCameraProvider(iface);
                    }
                }
            }
        }
    }
    /* 因此這裏返回的就是 CameraProvider 實例化對象 */
    return iface;
}

/* 
 * ServiceManagement.cpp
 * pm->get(ICameraProvider::descriptor, serviceName);
 * ICameraProvider::descriptor = "android.hardware.camera.provider@2.4::ICameraProvider"
 */
Return<sp<IBase>> get(const hidl_string& fqName, const hidl_string& name) override {
    sp<IBase> ret = nullptr;

    /* 
    * 打開庫，openLibs 後面分析
    * 這裏使用了匿名回調函數
    */
    openLibs(fqName, [&](void* handle, const std::string &lib, const std::string &sym) {
        IBase* (*generator)(const char* name);
        /* 分析完 openLibs() 知道這裏就是獲得 HIDL_FETCH_ICameraProvider() 函數*/
        *(void **)(&generator) = dlsym(handle, sym.c_str());
        /* 調用 HIDL_FETCH_ICameraProvider() 函數獲得 CameraProvider 實例化對象
         * 後面分析 HIDL_FETCH_ICameraProvider() 函數
         */
        ret = (*generator)(name.c_str());

        registerReference(fqName, name);
        /*
         * 吐槽一下這個：false 居然代表成功...
         */
        return false;
    });
    /* 因此返回的是 CameraProvider 實例化對象 */
    return ret;
}

static void openLibs(const std::string& fqName,
    std::function<bool /* continue */(void* /* handle */,
        const std::string& /* lib */, const std::string& /* sym */)> eachLib) {
    //fqName looks like android.hardware.foo@1.0::IFoo
    /* fqName = "android.hardware.camera.provider@2.4::ICameraProvider" */
    size_t idx = fqName.find("::");

    /* 獲得 "android.hardware.camera.provider@2.4" 字符串 */
    std::string packageAndVersion = fqName.substr(0, idx);
    /* 獲得 "ICameraProvider" 字符串 */
    std::string ifaceName = fqName.substr(idx + strlen("::"));
    /* 獲得 "android.hardware.camera.provider@2.4-impl" 字符串 */
    const std::string prefix = packageAndVersion + "-impl";
    /* 獲得 "HIDL_FETCH_ICameraProvider" 字符串 */
    const std::string sym = "HIDL_FETCH_" + ifaceName;

    const int dlMode = RTLD_LAZY;
    void *handle = nullptr;

    dlerror(); // clear

    /* 在這四個目錄下搜索 "android.hardware.camera.provider@2.4-impl" */
    std::vector<std::string> paths = {HAL_LIBRARY_PATH_ODM, HAL_LIBRARY_PATH_VENDOR,
                                      HAL_LIBRARY_PATH_VNDK_SP, HAL_LIBRARY_PATH_SYSTEM};
    for (const std::string& path : paths) {
        std::vector<std::string> libs = search(path, prefix, ".so");

        for (const std::string &lib : libs) {
            const std::string fullPath = path + lib;

            /* 打開庫 */
            if (path != HAL_LIBRARY_PATH_SYSTEM) {
                handle = android_load_sphal_library(fullPath.c_str(), dlMode);
            } else {
                handle = dlopen(fullPath.c_str(), dlMode);
            }

            /* 調用回調函數。 這個回調是匿名的， 在上面 openLibs() 有說到 */
            if (!eachLib(handle, lib, sym)) {
                return;
            }
        }
    }
}

/* CameraProvider.cpp */
ICameraProvider* HIDL_FETCH_ICameraProvider(const char* name) {
    if (strcmp(name, kLegacyProviderName) != 0) {
        return nullptr;
    }
    /*
     * 很簡單，就是 new CameraProvider 實例
     * 可是要注意，在構造函數中打開了 HAL 層
     * CameraProvider 與 Camera HAL 聯繫了起來
     * 後面分析
     */
    CameraProvider* provider = new CameraProvider();
    /* 返回 CameraProvider 實例化對象 */
    return provider;
}

CameraProvider::CameraProvider() :
        /* 
         * 調用父類的構造函數
         * 這個回調會在後面使用到，請留意
         */
        camera_module_callbacks_t({sCameraDeviceStatusChange,
                                   sTorchModeStatusChange}) {
    /* 繼續分析 */
    mInitFailed = initialize();
}

bool CameraProvider::initialize() {
    camera_module_t *rawModule;
    /* 
     * 就是這裏了，打開 HAL 
     * 這裏就不分析了
     */
    int err = hw_get_module(CAMERA_HARDWARE_MODULE_ID,
            (const hw_module_t **)&rawModule);
    /*
     * 將獲得的 hw_module_t 結構體再封裝都、多一層
     * 以後會使用這個對象調用 HAL 層接口
     */
    mModule = new CameraModule(rawModule);
    /* 獲得一些 Camera 的基本信息 */
    err = mModule->init();

    // Setup callback now because we are going to try openLegacy next
    /* 
     * 設置回調，在 CameraProvider() 構造函數中構造的回調
     * class CameraProvider 繼承於 class camera_module_callbacks_t 因此能夠這樣調用
     * 看意思應該就是 camera 狀態改變的時候 HAL 層會調用這個回調通知 CameraProvider 
     */
    err = mModule->setCallbacks(this);

    mPreferredHal3MinorVersion = property_get_int32("ro.camera.wrapper.hal3TrebleMinorVersion", 3);
    switch(mPreferredHal3MinorVersion) {
        case 2:
        case 3:
            // OK
            break;
        default:
            mPreferredHal3MinorVersion = 3;
    }
    /* 獲得 camera 的個數 */
    mNumberOfLegacyCameras = mModule->getNumberOfCameras();
    for (int i = 0; i < mNumberOfLegacyCameras; i++) {
        struct camera_info info;
        /* 得到每個 camera 的信息 */
        auto rc = mModule->getCameraInfo(i, &info);

        if (checkCameraVersion(i, info) != OK) {
            ALOGE("%s: Camera version check failed!", __func__);
            mModule.clear();
            return true;
        }

        char cameraId[kMaxCameraIdLen];
        snprintf(cameraId, sizeof(cameraId), "%d", i);
        std::string cameraIdStr(cameraId);
        mCameraStatusMap[cameraIdStr] = CAMERA_DEVICE_STATUS_PRESENT;
        mCameraIds.add(cameraIdStr);

        // initialize mCameraDeviceNames and mOpenLegacySupported
        mOpenLegacySupported[cameraIdStr] = false;
        int deviceVersion = mModule->getDeviceVersion(i);
        mCameraDeviceNames.add(
                std::make_pair(cameraIdStr,
                               getHidlDeviceName(cameraIdStr, deviceVersion)));
        if (deviceVersion >= CAMERA_DEVICE_API_VERSION_3_2 &&
                mModule->isOpenLegacyDefined()) {
            // try open_legacy to see if it actually works
            struct hw_device_t* halDev = nullptr;
            int ret = mModule->openLegacy(cameraId, CAMERA_DEVICE_API_VERSION_1_0, &halDev);
            if (ret == 0) {
                mOpenLegacySupported[cameraIdStr] = true;
                halDev->close(halDev);
                mCameraDeviceNames.add(
                        std::make_pair(cameraIdStr,
                                getHidlDeviceName(cameraIdStr, CAMERA_DEVICE_API_VERSION_1_0)));
            } else if (ret == -EBUSY || ret == -EUSERS) {
                // Looks like this provider instance is not initialized during
                // system startup and there are other camera users already.
                // Not a good sign but not fatal.
                ALOGW("%s: open_legacy try failed!", __FUNCTION__);
            }
        }
    }

    return false; // mInitFailed
}

至此，咱們就徹底明白了 CameraProvider::getService(name, true) 是如何一步步獲得 CameraProvider 實例化對象的。

接下來分析如何將 CameraProvider 實例化對象註冊爲一個服務。

2.4 註冊 CameraProvider 實例化對象
out/soong/.intermediates/hardware/interfaces/camera/provider/2.4/android.hardware.camera.provider@2.4_genc++/gen/android/hardware/camera/provider/CameraProviderAll.cpp
hardware/interfaces/camera/provider/2.4/default/CameraProvider.cpp
system/libhidl/transport/ServiceManagement.cpp
out/soong/.intermediates/system/libhidl/transport/manager/1.1/android.hidl.manager@1.1_genc++/gen/android/hidl/manager/1.1/ServiceManagerAll.cpp
/* CameraProviderAll.cpp */
::android::status_t ICameraProvider::registerAsService(const std::string &serviceName) {
    ::android::hardware::details::onRegistration("android.hardware.camera.provider@2.4", "ICameraProvider", serviceName);

    /* 
     * 獲得 BpHwServiceManager 對象
     * 就是 HwServiceManager 對象的 binder 代理
     * 後面會分析如何獲得 BpHwServiceManager 對象
     */
    const ::android::sp<::android::hidl::manager::V1_0::IServiceManager> sm
            = ::android::hardware::defaultServiceManager();
    /* 
     * 調用 BpHwServiceManager::add() 註冊服務
     * 後面分析
     */
    ::android::hardware::Return<bool> ret = sm->add(serviceName.c_str(), this);
    return ret.isOk() && ret ? ::android::OK : ::android::UNKNOWN_ERROR;
}

/* 分析如何獲得 BpHwServiceManager 對象 */
/* ServiceManagement.cpp */
sp<IServiceManager1_0> defaultServiceManager() {
    return defaultServiceManager1_1();
}

/* 分析如何獲得 BpHwServiceManager 對象 */
/* ServiceManagement.cpp */
sp<IServiceManager1_1> defaultServiceManager1_1() {
    {
        AutoMutex _l(details::gDefaultServiceManagerLock);
        /* 若是不是第一次調用這個函數的話直接返回以前獲得的 gDefaultServiceManager */
        if (details::gDefaultServiceManager != NULL) {
            return details::gDefaultServiceManager;
        }
        /*
         * 等待 HwServiceManager 服務啓動完畢， 上一篇介紹過這個 
         * 是經過 "hwservicemanager.ready" 屬性的值判斷的
         */
        waitForHwServiceManager();

        while (details::gDefaultServiceManager == NULL) {
            /*
             * 獲得 BpHwServiceManager
             * 須要注意 ProcessState::self()->getContextObject(NULL) 它就是獲得 Handle = 0 的 HwBinder 對象
             * 由這個 HwBinder 對象構造出了 BpHwServiceManager 對象
             */
            details::gDefaultServiceManager =
                    fromBinder<IServiceManager1_1, BpHwServiceManager, BnHwServiceManager>(
                        ProcessState::self()->getContextObject(NULL));
        }
    }
    /* 返回 BpHwServiceManager 對象 */
    return details::gDefaultServiceManager;
}

/* 分析如何註冊 CameraProvider 對象 */
/* ServiceManagerAll.cpp */
::android::hardware::Return<bool> BpHwServiceManager::add(const ::android::hardware::hidl_string& name, const ::android::sp<::android::hidl::base::V1_0::IBase>& service){
    /* 接着分析 */
    ::android::hardware::Return<bool>  _hidl_out = ::android::hidl::manager::V1_0::BpHwServiceManager::_hidl_add(this, this, name, service);

    return _hidl_out;
}

/* 分析如何註冊 CameraProvider 對象 */
/* ServiceManagerAll.cpp */
::android::hardware::Return<bool> BpHwServiceManager::_hidl_add(::android::hardware::IInterface *_hidl_this, ::android::hardware::details::HidlInstrumentor *_hidl_this_instrumentor, const ::android::hardware::hidl_string& name, const ::android::sp<::android::hidl::base::V1_0::IBase>& service) {
    /* 這個是用來發送數據的 */
    ::android::hardware::Parcel _hidl_data;
    /* 這個是用來接收返回數據的 */
    ::android::hardware::Parcel _hidl_reply;
    ::android::status_t _hidl_err;
    ::android::hardware::Status _hidl_status;

    bool _hidl_out_success;

    /* 構造要發送的數據，寫入一個固定的字符串 */
    _hidl_err = _hidl_data.writeInterfaceToken(BpHwServiceManager::descriptor);
    if (_hidl_err != ::android::OK) { goto _hidl_error; }

    size_t _hidl_name_parent;
    /* 構造要發送的數據，寫入要註冊服務的名字 */
    _hidl_err = _hidl_data.writeBuffer(&name, sizeof(name), &_hidl_name_parent);

    _hidl_err = ::android::hardware::writeEmbeddedToParcel(
            name,
            &_hidl_data,
            _hidl_name_parent,
            0 /* parentOffset */);

    if (service == nullptr) {
        _hidl_err = _hidl_data.writeStrongBinder(nullptr);
    } else {
        /* toBinder() 會根據傳入的 CameraProvider 對象構造出一個 BnHwCameraProvider 對象
         * 以後會開啓線程等待其餘進程使用 CameraProvider 服務，而具體如何處理這些服務請求就是由 BnHwCameraProvider 對象來執行的
         * 固然，最終仍是會調用到 CameraProvider 對象上
         * BnHwCameraProvider 對象就是一箇中轉站
         */
        ::android::sp<::android::hardware::IBinder> _hidl_binder = ::android::hardware::toBinder<
                ::android::hidl::base::V1_0::IBase>(service);
        if (_hidl_binder.get() != nullptr) {
            /*
             * 把獲得的 BnHwCameraProvider 對象的地址寫入 _hidl_data 
             * 以後接收到其餘進程的請求時，會從內核中獲得這個地址，根據這個地址獲得 BnHwCameraProvider，而後作一些處理
             */
            _hidl_err = _hidl_data.writeStrongBinder(_hidl_binder);
        } else {
            _hidl_err = ::android::UNKNOWN_ERROR;
        }
    }
    if (_hidl_err != ::android::OK) { goto _hidl_error; }

    /*
     * 開啓新的線程， 這個線程就是 CameraProvider 服務了
     * 就想上面說的那樣，在這個線程裏面會等待其餘進程使用 CameraProvider 服務
     * 當接收到請求以後，從內核中獲得 BnHwCameraProvider 的地址，經過 BnHwCameraProvider 處理請求
     */
    ::android::hardware::ProcessState::self()->startThreadPool();
    /*
     * 發送數據， binder 進程間調用
     * 最終就經過 binder 調用了 ServiceManager::add()
     * 後面分析
     */
    _hidl_err = ::android::hardware::IInterface::asBinder(_hidl_this)->transact(2 /* add */, _hidl_data, &_hidl_reply);
    if (_hidl_err != ::android::OK) { goto _hidl_error; }

    _hidl_err = ::android::hardware::readFromParcel(&_hidl_status, _hidl_reply);

    _hidl_err = _hidl_reply.readBool(&_hidl_out_success);

    atrace_end(ATRACE_TAG_HAL);

    _hidl_status.setFromStatusT(_hidl_err);
    return ::android::hardware::Return<bool>(_hidl_out_success);

_hidl_error:
    _hidl_status.setFromStatusT(_hidl_err);
    return ::android::hardware::Return<bool>(_hidl_status);
}

/* ServiceManager.cpp */
Return<bool> ServiceManager::add(const hidl_string& name, const sp<IBase>& service) {
    bool isValidService = false;

    /* 調用進程的PID */
    pid_t pid = IPCThreadState::self()->getCallingPid();
    auto context = mAcl.getContext(pid);

    auto ret = service->interfaceChain([&](const auto &interfaceChain) {

        for(size_t i = 0; i < interfaceChain.size(); i++) {
            std::string fqName = interfaceChain[i];

            if (!mAcl.canAdd(fqName, context, pid)) {
                return;
            }
        }

        for(size_t i = 0; i < interfaceChain.size(); i++) {
            std::string fqName = interfaceChain[i];

            PackageInterfaceMap &ifaceMap = mServiceMap[fqName];
            HidlService *hidlService = ifaceMap.lookup(name);

            if (hidlService == nullptr) {
                /* 註冊 HwServiceManager 走這個分支 */
                ifaceMap.insertService(
                    std::make_unique<HidlService>(fqName, name, service, pid));
            } else {
                if (hidlService->getService() != nullptr) {
                    auto ret = hidlService->getService()->unlinkToDeath(this);
                    ret.isOk(); // ignore
                }
                /*
                 * 註冊 CameraProvider 等服務走這個分支
                 * 其實就是插入一個map裏面，當須要的時候從map中取出
                 * service 裏面保留的是 CameraProvider 服務的一些信息：Handle 之類的
                 */
                hidlService->setService(service, pid);
            }

            ifaceMap.sendPackageRegistrationNotification(fqName, name);
        }
        /*
         * 鏈接死亡通知
         * 當 CameraProvider 服務掛掉的時候會通知 HwServiceManager 作清理工做
         */
        auto linkRet = service->linkToDeath(this, 0 /*cookie*/);
        linkRet.isOk();

        isValidService = true;
    });

    if (!ret.isOk()) {
        LOG(ERROR) << "Failed to retrieve interface chain.";
        return false;
    }

    return isValidService;
}

至此，咱們徹底明白註冊 CameraProvider 服務的流程了。

接下來分析 CameraProvider 服務如何處理請求

2.5 CameraProvider 服務等待請求並處理
system/libhidl/transport/HidlTransportSupport.cpp
由 2.2 咱們知道，獲得 CameraProvider 實例化對象以後立刻就註冊了 CameraProvider 實例化對象，而後調用 joinRpcThreadpool() 函數進入循環等待請求。固然，其實在註冊 CameraProvider 實例化對象的時候調用了 startThreadPool() 函數就已經有線程在等待了，startThreadPool()會調用 joinRpcThreadpool() 函數。而這裏的 joinRpcThreadpool() 其實就是把主線程也放入線程池中等待請求，防止這個進程退出。

/* HidlTransportSupport.cpp */
void joinRpcThreadpool() {
    joinBinderRpcThreadpool();
}

/* HidlTransportSupport.cpp */
void joinBinderRpcThreadpool() {
    IPCThreadState::self()->joinThreadPool();
}

/* IPCThreadState.cpp */
void IPCThreadState::joinThreadPool(bool isMain)
{

    mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);

    status_t result;
    do {
        /* 循環處理請求 */

        processPendingDerefs();
        /*
         * 獲得請求命令，並處理它
         * 後面分析
         */
        result = getAndExecuteCommand();

    } while (result != -ECONNREFUSED && result != -EBADF);

    /*
     * 若是走到這代表出現了一些錯誤
     * 須要告訴驅動這個線程再也不處理消息了，既退出 LOOPER
     */
    mOut.writeInt32(BC_EXIT_LOOPER);
    talkWithDriver(false);
}

status_t IPCThreadState::getAndExecuteCommand()
{
    status_t result;
    int32_t cmd;

    /* 
     * 這個函數會調用 ioctl() 讀取請求，並放入 mIn 中 
     * 後面分析
     */
    result = talkWithDriver();
    if (result >= NO_ERROR) {
        size_t IN = mIn.dataAvail();
        /* 取出 cmd */
        cmd = mIn.readInt32();
        /* 
         * 處理 cmd
         * 後面分析
         */
        result = executeCommand(cmd);

    return result;
}

/* 默認 doReceive = true 表示是讀 binder */
status_t IPCThreadState::talkWithDriver(bool doReceive)
{

    binder_write_read bwr;

    // Is the read buffer empty?
    const bool needRead = mIn.dataPosition() >= mIn.dataSize();

    // We don't want to write anything if we are still reading
    // from data left in the input buffer and the caller
    // has requested to read the next data.
    const size_t outAvail = (!doReceive || needRead) ? mOut.dataSize() : 0;

    bwr.write_size = outAvail;
    bwr.write_buffer = (uintptr_t)mOut.data();

    // This is what we'll read.
    if (doReceive && needRead) {
        bwr.read_size = mIn.dataCapacity();
        /* 將讀到的數據放到這個 buf 中 */
        bwr.read_buffer = (uintptr_t)mIn.data();
    } else {
        bwr.read_size = 0;
        bwr.read_buffer = 0;
    }

    bwr.write_consumed = 0;
    bwr.read_consumed = 0;
    status_t err;
    do {
        /*
         * 調用 ioctl() 得到請求
         * 數據保存在 bwr
         */
        if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
            err = NO_ERROR;
        else
            err = -errno;
    } while (err == -EINTR);

    if (err >= NO_ERROR) {
        if (bwr.write_consumed > 0) {
            if (bwr.write_consumed < mOut.dataSize())
                mOut.remove(0, bwr.write_consumed);
            else
                mOut.setDataSize(0);
        }
        /* 咱們走的是 read 分支 */
        if (bwr.read_consumed > 0) {
            /* 獲得數據的大小 */
            mIn.setDataSize(bwr.read_consumed);
            mIn.setDataPosition(0);
        }
        return NO_ERROR;
    }

    return err;
}

status_t IPCThreadState::executeCommand(int32_t cmd)
{
    BHwBinder* obj;
    RefBase::weakref_type* refs;
    status_t result = NO_ERROR;
    switch ((uint32_t)cmd) {
    ......
    /*
     * 咱們只關注這個 cmd
     * 其它 cmd 都與咱們無關的
     */
    case BR_TRANSACTION:
        {
            binder_transaction_data tr;
            /* 取出數據 */
            result = mIn.read(&tr, sizeof(tr));

            Parcel buffer;
            buffer.ipcSetDataReference(
                reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                tr.data_size,
                reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                tr.offsets_size/sizeof(binder_size_t), freeBuffer, this);

            const pid_t origPid = mCallingPid;
            const uid_t origUid = mCallingUid;
            const int32_t origStrictModePolicy = mStrictModePolicy;
            const int32_t origTransactionBinderFlags = mLastTransactionBinderFlags;

            mCallingPid = tr.sender_pid;
            mCallingUid = tr.sender_euid;
            mLastTransactionBinderFlags = tr.flags;

            Parcel reply;
            status_t error;
            bool reply_sent = false;

            /* 構造一個匿名回調函數，返回值使用這個回調函數發送 */
            auto reply_callback = [&] (auto &replyParcel) {
                reply_sent = true;
                if ((tr.flags & TF_ONE_WAY) == 0) {
                    replyParcel.setError(NO_ERROR);
                    /* 經過 binder 將調用結果返回 */
                    sendReply(replyParcel, 0);
                } else {
                    ALOGE("Not sending reply in one-way transaction");
                }
            };

            if (tr.target.ptr) {
                /* tr.cookie 裏面保存的就是以前說的 BnHwCameraProvider 的地址  */
                if (reinterpret_cast<RefBase::weakref_type*>(
                        tr.target.ptr)->attemptIncStrong(this)) {
                    /* 調用 BnHwCameraProvider::transact() 函數 */
                    error = reinterpret_cast<BHwBinder*>(tr.cookie)->transact(tr.code, buffer,
                            &reply, tr.flags, reply_callback);
                    reinterpret_cast<BHwBinder*>(tr.cookie)->decStrong(this);
                } else {
                    error = UNKNOWN_TRANSACTION;
                }

            } else {
                /* 上一篇分析過這個， 這裏是 HwServiceManager 走的分支 */
                error = mContextObject->transact(tr.code, buffer, &reply, tr.flags, reply_callback);
            }

        }
        break;

    ......
    default:
        result = UNKNOWN_ERROR;
        break;
    }

    if (result != NO_ERROR) {
        mLastError = result;
    }

    return result;
}

/*
 * BnHwCameraProvider::transact()
 * BnHwCameraProvider 沒有實現這個函數
 * 因此調用父類的 transact()
 * Binder.cpp
 */
status_t BHwBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags, TransactCallback callback)
{
    data.setDataPosition(0);

    status_t err = NO_ERROR;
    switch (code) {
        default:
            /* 直接調用 onTransact(), BnHwCameraProvider 實現了這個函數 */
            err = onTransact(code, data, reply, flags,
                    [&](auto &replyParcel) {
                        replyParcel.setDataPosition(0);
                        if (callback != NULL) {
                            /* 經過回調函數，返回進程間調用的結果 */
                            callback(replyParcel);
                        }
                    });
            break;
    }

    return err;
}

/* 這裏就不詳細分析了， 總之最後掉調用到 CameraProvider 提供的接口 */
::android::status_t BnHwCameraProvider::onTransact(
        uint32_t _hidl_code,
        const ::android::hardware::Parcel &_hidl_data,
        ::android::hardware::Parcel *_hidl_reply,
        uint32_t _hidl_flags,
        TransactCallback _hidl_cb) {
    ::android::status_t _hidl_err = ::android::OK;

    switch (_hidl_code) {
        case 1 /* setCallback */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hardware::camera::provider::V2_4::BnHwCameraProvider::_hidl_setCallback(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 2 /* getVendorTags */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hardware::camera::provider::V2_4::BnHwCameraProvider::_hidl_getVendorTags(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 3 /* getCameraIdList */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hardware::camera::provider::V2_4::BnHwCameraProvider::_hidl_getCameraIdList(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 4 /* isSetTorchModeSupported */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hardware::camera::provider::V2_4::BnHwCameraProvider::_hidl_isSetTorchModeSupported(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 5 /* getCameraDeviceInterface_V1_x */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hardware::camera::provider::V2_4::BnHwCameraProvider::_hidl_getCameraDeviceInterface_V1_x(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 6 /* getCameraDeviceInterface_V3_x */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hardware::camera::provider::V2_4::BnHwCameraProvider::_hidl_getCameraDeviceInterface_V3_x(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 256067662 /* interfaceChain */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_interfaceChain(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 256131655 /* debug */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_debug(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 256136003 /* interfaceDescriptor */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_interfaceDescriptor(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 256398152 /* getHashChain */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_getHashChain(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 256462420 /* setHALInstrumentation */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != true) {
                return ::android::UNKNOWN_ERROR;
            }

            configureInstrumentation();
            break;
        }

        case 256660548 /* linkToDeath */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            break;
        }

        case 256921159 /* ping */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_ping(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 257049926 /* getDebugInfo */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_getDebugInfo(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 257120595 /* notifySyspropsChanged */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != true) {
                return ::android::UNKNOWN_ERROR;
            }

            _hidl_err = ::android::hidl::base::V1_0::BnHwBase::_hidl_notifySyspropsChanged(this, _hidl_data, _hidl_reply, _hidl_cb);
            break;
        }

        case 257250372 /* unlinkToDeath */:
        {
            bool _hidl_is_oneway = _hidl_flags & ::android::hardware::IBinder::FLAG_ONEWAY;
            if (_hidl_is_oneway != false) {
                return ::android::UNKNOWN_ERROR;
            }

            break;
        }

        default:
        {
            return ::android::hidl::base::V1_0::BnHwBase::onTransact(
                    _hidl_code, _hidl_data, _hidl_reply, _hidl_flags, _hidl_cb);
        }
    }

    if (_hidl_err == ::android::UNEXPECTED_NULL) {
        _hidl_err = ::android::hardware::writeToParcel(
                ::android::hardware::Status::fromExceptionCode(::android::hardware::Status::EX_NULL_POINTER),
                _hidl_reply);
    }return _hidl_err;
}

至此，CameraProvider 服務如何獲得請求和處理請求的過程也很是清楚了

接下來看一下是哪一個進程會使用到 CameraProvider 服務

2.6 CameraService 使用 CameraProvider 服務
frameworks/av/camera/cameraserver/cameraserver.rc
frameworks/av/camera/cameraserver/main_cameraserver.cpp
service cameraserver /system/bin/cameraserver
    class main
    user cameraserver
    group audio camera input drmrpc
    ioprio rt 4
    writepid /dev/cpuset/camera-daemon/tasks /dev/stune/top-app/tasks

int main(int argc __unused, char** argv __unused)
{
    signal(SIGPIPE, SIG_IGN);

    // Set 3 threads for HIDL calls
    /*
     * 見了不少次了，可是這裏open(/dev/binder)不是open(/dev/hwbinder)
     * 雖然這兩個節點用的是同一套驅動代碼，可是使用途徑不同
     * 固然原理是如出一轍的
     */
    hardware::configureRpcThreadpool(3, /*willjoin*/ false);

    sp<ProcessState> proc(ProcessState::self());
    /*
     * 得到 ServiceManager 的代理類 BpServiceManager, 注意不是 HwServiceManager 的代理類
     * ServiceManager 這個服務管理器是用來跟上層交互的
     * 原理跟 HwServiceManager 同樣就不分析了
     */
    sp<IServiceManager> sm = defaultServiceManager();
    ALOGI("ServiceManager: %p", sm.get());
    /*
     * 作了兩件事
     * 一、獲得 CameraService 實例化對象
     * 二、註冊 CameraService 實例化對象
     * 後面分析
     */
    CameraService::instantiate();
    /* 見過不少次了， 就不分析了 */
    ProcessState::self()->startThreadPool();
    IPCThreadState::self()->joinThreadPool();
}

/*
 * BinderService 是 CameraService 的父類
 * 模板類 SERVICE = CameraService
 */
template<typename SERVICE>
class BinderService
{
public:
    /* 類屬性的， 因此能夠直接調用 */
    static void instantiate() {
        /* 接着分析 */
        publish();
    }

    static status_t publish(bool allowIsolated = false) {
        /* 獲得 ServiceManager 的代理類 BpServiceManager */
        sp<IServiceManager> sm(defaultServiceManager());
        /*
         * SERVICE = CameraService 
         * 註冊 CameraService 實例化對象
         */
        return sm->addService(
                String16(SERVICE::getServiceName()),
                /* new CameraService() 獲得實例化對象，智能指針第一次引用回調用 onFirstRef() 函數, 後面分析 */
                new SERVICE(), allowIsolated);
    }
};

/* CameraService.cpp */
void CameraService::onFirstRef()
{
    BnCameraService::onFirstRef();

    BatteryNotifier& notifier(BatteryNotifier::getInstance());
    notifier.noteResetCamera();
    notifier.noteResetFlashlight();

    status_t res = INVALID_OPERATION;
    /* 核心在這， 接着分析 */
    res = enumerateProviders();
    if (res == OK) {
        mInitialized = true;
    }

    CameraService::pingCameraServiceProxy();
}

status_t CameraService::enumerateProviders() {
    status_t res;
    Mutex::Autolock l(mServiceLock);

    if (nullptr == mCameraProviderManager.get()) {
        /* 第一次執行走這 */
        mCameraProviderManager = new CameraProviderManager();
        /* 接着分析 */
        res = mCameraProviderManager->initialize(this);
    }

    mNumberOfCameras = mCameraProviderManager->getCameraCount();
    mNumberOfNormalCameras =
            mCameraProviderManager->getAPI1CompatibleCameraCount();

    mCameraProviderManager->setUpVendorTags();
    if (nullptr == mFlashlight.get()) {
        mFlashlight = new CameraFlashlight(mCameraProviderManager, this);
    }

    res = mFlashlight->findFlashUnits();

    for (auto& cameraId : mCameraProviderManager->getCameraDeviceIds()) {
        String8 id8 = String8(cameraId.c_str());
        bool cameraFound = false;
        {

            Mutex::Autolock lock(mCameraStatesLock);
            auto iter = mCameraStates.find(id8);
            if (iter != mCameraStates.end()) {
                cameraFound = true;
            }
        }

        onDeviceStatusChanged(id8, CameraDeviceStatus::PRESENT);

        if (mFlashlight->hasFlashUnit(id8)) {
            mTorchStatusMap.add(id8, TorchModeStatus::AVAILABLE_OFF);
        }
    }

    return OK;
}

/* CameraProviderManager.cpp */
status_t CameraProviderManager::initialize(wp<CameraProviderManager::StatusListener> listener,
        /* proxy 是默認值， proxy = sHardwareServiceInteractionProxy */
        ServiceInteractionProxy* proxy) {
    std::lock_guard<std::mutex> lock(mInterfaceMutex);

    /* listener = CameraService 對象 */
    mListener = listener;
    /* proxy = sHardwareServiceInteractionProxy */
    mServiceProxy = proxy;

    bool success = mServiceProxy->registerForNotifications(
        /* instance name, empty means no filter */ "",
        this);

    /* 接着分析 */
    addProviderLocked(kLegacyProviderName, /*expected*/ false);

    return OK;
}

/* CameraProviderManager.cpp */
status_t CameraProviderManager::addProviderLocked(const std::string& newProvider, bool expected) {

    sp<provider::V2_4::ICameraProvider> interface;
    /*
     * 上面分析過 mServiceProxy = sHardwareServiceInteractionProxy
     * 這裏 getService(newProvider) 其實就是獲得 CameraProvider 的代理類
     * 因此 CameraService 與 CameraProvider 聯繫起來了
     * 接着分析這個函數 HardwareServiceInteractionProxy::getService()
     */
    interface = mServiceProxy->getService(newProvider);

    sp<ProviderInfo> providerInfo =
            new ProviderInfo(newProvider, interface, this);
    status_t res = providerInfo->initialize();
    if (res != OK) {
        return res;
    }

    mProviders.push_back(providerInfo);

    return OK;
}

virtual sp<hardware::camera::provider::V2_4::ICameraProvider> getService(
         const std::string &serviceName) override {
     /*
      * 調用了 ICameraProvider::getService()
      * 且 getStub 爲默認值 getStub = flase
      * 以前分析過，getStub = flase 會獲得 CameraProvider 的代理類(binder)
      */
     return hardware::camera::provider::V2_4::ICameraProvider::getService(serviceName);
 }

至此，咱們發現 CameraService 會使用 CameraProvider 服務。

2.7 總結 同上上述分析，顯然上層 framework 經過 ServiceManager( /dev/binder ) 獲得 CameraService 服務，而 CameraService 經過 HwServiceManager( /dev/hwbinder ) 獲得 CameraProvider 服務，而 CameraProvider 與 Camera HAL 綁定。這樣上層 framework 就可以訪問 Camera HAL 層了