Android P之Camera HAL3流程分析（0）

目录

参考文献

注册CameraProvider服务

注册cameraserver服务

类和服务调用

---

参考文献

[Android O] Camera 服务启动流程简析
[Android O] HAL3 之 Open Camera2 流程（零）—— 概览
[Android O] HAL3 之 Open Camera2 流程（一）—— 从 App 到 CameraService
[Android O] HAL3 之 Open Camera2 流程（二）—— 从 CameraService 到 HAL Service
[Android O] HAL3 之 Open Camera2 流程（三，完结）—— 从 HAL Service 到 Camera HAL

 

android6.0源码分析之Camera API2.0简介
android6.0源码分析之Camera2 HAL分析
android6.0源码分析之Camera API2.0下的初始化流程分析
android6.0源码分析之Camera API2.0下的Preview(预览)流程分析
android6.0源码分析之Camera API2.0下的Capture流程分析
android6.0源码分析之Camera API2.0下的video流程分析
 

Camera API2.0的应用

Android Camera:总结

Android camera子系统HAL层介绍集锦

Android 8.0系统源码分析--相机createCaptureSession创建过程源码分析

高通平台

Camera2 数据流从framework到Hal源码分析

mm-camera层frame数据流源码分析

在 Android O 中，系统启动时，就会启动 CameraProvider 服务。它将 Camera HAL 从 cameraserver 进程中分离出来，作为一个独立进程 [email protected] 来控制 HAL。这两个进程之间通过 HIDL 机制进行通信。

这样的改动源自于 Android O 版本加入的 Treble 机制，它的主要功能（如下图所示）是将 service 与 HAL 隔离，以方便 HAL 部分进行独立升级。这其实和 APP 与 Framework 之间的 Binder 机制类似，通过引入一个进程间通信机制而针对不同层级进行解耦（从 Local call 变成了 Remote call）。

 

注册CameraProvider服务

创建服务端的 CameraProviderImpl 对象，后续client端会调用。
hardware/interfaces/camera/provider/2.4/default/[email protected]_64.rc
service vendor.camera-provider-2-4 /vendor/bin/hw/[email protected]_64

    class hal
    user cameraserver
    group audio camera input drmrpc
    ioprio rt 4
    capabilities SYS_NICE
    writepid /dev/cpuset/camera-daemon/tasks /dev/stune/top-app/tasks

hardware/interfaces/camera/provider/2.4/default/service.cpp
int main()
{
    android::ProcessState::initWithDriver("/dev/vndbinder"); //打开vndservicemanager服务，可以和其它vendor进程通信
    return defaultPassthroughServiceImplementation("legacy/0", /*maxThreads*/ 6);
}
system/libhidl/transport/include/hidl/LegacySupport.h
template /* 模板函数，Interface = ICameraProvider */
status_t defaultPassthroughServiceImplementation(std::string name, size_t maxThreads = 1) {
     /* 第一次执行这个函数会open(/dev/hwbinder) */
     configureRpcThreadpool(maxThreads, true);
     /* 这个函数做了两件事：
     * 1、得到了 CameraProvider 实例化对象
     * 2、注册 CameraProvider 实例化对象 */
    status_t result = registerPassthroughServiceImplementation(name);
     joinRpcThreadpool();
}
template
status_t registerPassthroughServiceImplementation(std::string name = "default") {
    
     /* 就是调用 ICameraProvider::getService()
     * getStub = ture 时，getservice 以 passthrough 模式打开 HAL 实现
     * 所以这个会得到CameraProvider实例化对象(不是binder代理)
    */
     sp service = Interface::getService(name, true /* getStub */);
     /*将 CameraProvider 注册为一个服务
     * 其他进程需要使用 camera HAL层时通过binder得到CameraProvider代理类即可操作camera HAL层
     * 不需要像以前一样每次都 dlopen(xxx.so)
    */
     status_t status = service->registerAsService(name);
 }
-----------------------------------------------------------------------------------------------------------------------------------
/* CameraProviderAll.cpp */
::android::status_t ICameraProvider::registerAsService(const std::string &serviceName) {
    ::android::hardware::details::onRegistration("[email protected]", "ICameraProvider", serviceName);
     /*
     * 得到 BpHwServiceManager 对象
     * 就是 HwServiceManager 对象的 binder 代理
     * 后面会分析如何得到 BpHwServiceManager 对象
    */
    const ::android::sp<::android::hidl::manager::V1_0::IServiceManager> sm
            = ::android::hardware::defaultServiceManager();
     /*
     * 调用 BpHwServiceManager::add() 注册服务
     * 后面分析
     */
    ::android::hardware::Return ret = sm->add(serviceName.c_str(), this);
    return ret.isOk() && ret ? ::android::OK : ::android::UNKNOWN_ERROR;
}
CameraProviderAll.cpp来自hardware/interfaces/camera/provider/2.4/ICameraProvider.hal

-----------------------------------------------------------------------------------------------------------------------------------
Camera HAL的实现
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/depend/Android.mk
LOCAL_MODULE := [email protected]

alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/depend/instance.cpp
ICameraProvider*
HIDL_FETCH_ICameraProvider(const char* name){
    return createICameraProvider_V2_4(name, getCameraDeviceManager());
}
ICameraProvider*
createICameraProvider_V2_4(const char* providerName, NSCam::ICameraDeviceManager* manager){
    auto provider = new CameraProviderImpl(providerName, manager);
    provider->initialize();
    return provider;
}
获得CameraDeviceManager对象
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/depend/instance.cpp
NSCam::ICameraDeviceManager*
getCameraDeviceManager(){
    static NSCam::CameraDeviceManagerImpl singleton(getProviderType().c_str());
    static bool init = singleton.initialize();
    return &singleton;
}
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/CameraDeviceManagerBase.cpp
CameraDeviceManagerBase::
initialize(){
    auto loadDeviceFactory = [](char const* libname, char const* symbol) {
        VirtEnumDeviceFactory item;
        item.mLibHandle = ::dlopen(libname, RTLD_NOW);
        *(void **)(&item.mCreateVirtualCameraDevice) = ::dlsym(item.mLibHandle, symbol);
        return item;
    };
    //从动态库中加载 createVirtualCameraDevice 函数的实现赋值给 mCreateVirtualCameraDevice
    mVirtEnumDeviceFactoryMap[3] = loadDeviceFactory("libmtkcam_device3.so", "createVirtualCameraDevice");
    enumerateDevicesLocked();
}
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/CameraDeviceManagerBase_camera.cpp
CameraDeviceManagerBase::
enumerateDevicesLocked(){
    onEnumerateDevicesLocked();
}
CameraDeviceManagerImpl::
onEnumerateDevicesLocked(){
    IHalLogicalDeviceList* pHalDeviceList;
    //加载libmtkcam_modulefactory_utils.so
    pHalDeviceList = MAKE_HalLogicalDeviceList();
    size_t const deviceNum = pHalDeviceList->searchDevices();
    mVirtEnumDeviceMap.setCapacity(deviceNum*2);
    //构造多个CameraDevice3Impl并保存到mVirtEnumDeviceMap中，通过instanceId区别
    for (size_t instanceId = 0; instanceId < deviceNum; instanceId++)
    {
        sp pMetadataProvider;
        //创建MetadataProvider
        pMetadataProvider = IMetadataProvider::create(instanceId);
        NSMetadataProviderManager::add(instanceId, pMetadataProvider.get());
        // 获得对应deviceid的元数据信息
        addVirtualDevicesLocked(instanceId, pMetadataProvider);
    }
}
-----------------------------------------------------------------------------------------------------------------------------------
//创建MetadataProvider
alps/vendor/mediatek/proprietary/hardware/mtkcam/utils/metastore/metadataprovider/MetadataProvider.cpp
IMetadataProvider*
IMetadataProvider::
create( int32_t const   i4OpenId ){
    MetadataProvider* p = new MetadataProvider(i4OpenId);
    //初始化
    p->onCreate();
    return  p;
}
MetadataProvider::
MetadataProvider( int32_t const   i4OpenId ){
    IHalLogicalDeviceList* pHalDeviceList;
    pHalDeviceList = MAKE_HalLogicalDeviceList();
    int32_t sensorType = pHalDeviceList->queryType(i4OpenId);
    int32_t sensorDev = pHalDeviceList->querySensorDevIdx(i4OpenId);
    const char* sensorDrvName = pHalDeviceList->queryDriverName(i4OpenId);
    mInfo = Info(i4OpenId, sensorDev, sensorType, sensorDrvName);
    showCustInfo();
}
MetadataProvider::
onCreate(){
    IMetadataTagSet mtagInfo;
   //根据IMetadataTagSet获得IMetadataConverter用于解析，定义了宏 _IMP_TAGCONVERT_  使用宏填充数据
    setTagInfo(mtagInfo);

    //构造IMetadataConverter对象
    sp pMetadataConverter = IMetadataConverter::createInstance(mtagInfo);
    //使用IMetadataConverter初始化camera_metadata和IMetadata
    status = constructStaticMetadata(pMetadataConverter, mpStaticCharacteristics, mpHALMetadata);
}
bool setTagInfo(IMetadataTagSet &rtagInfo){
    #define _IMP_SECTION_INFO_(...)
    #define _IMP_TAG_INFO_(_tag_, _type_, _name_) \
        rtagInfo.addTag(_tag_, _name_, Type2TypeEnum<_type_>::typeEnum);

    #include //具体实现
    #include

    #define _IMP_TAGCONVERT_(_android_tag_, _mtk_tag_) \
        rtagInfo.addTagMap(_android_tag_, _mtk_tag_);

    //调用TagMap.h定义的宏,由于已经定义了_IMP_TAGCONVERT_所以执行rtagInfo.addTagMap方法
    ADD_ALL_MEMBERS;
}
IMetadataConverter::
createInstance(IMetadataTagSet const &pTagInfo){
    return new MetadataConverter(pTagInfo);
}
MetadataConverter::
MetadataConverter(IMetadataTagSet const &pTagInfo)
    : mpTagInfo(pTagInfo){
}
//constructStaticMetadata的实现
MetadataProvider::
constructStaticMetadata(sp pConverter, camera_metadata*& rpDstMetadata, IMetadata& mtkMetadata){
    impConstructStaticMetadata(mtkMetadata)
    //从IHalSensorList 获得IMetadata
    IMetadata sensorMetadata = MAKE_HalLogicalDeviceList()->queryStaticInfo(mInfo.getDeviceId());
    auto pHalDeviceList = MAKE_HalLogicalDeviceList();
    auto physicIdsList = pHalDeviceList->getSensorId(mInfo.getDeviceId());
    auto pDngInfo = MAKE_DngInfo(LOG_TAG, physicIdsList[0]);
    IMetadata rDngMeta = pDngInfo->getStaticMetadata();

    //往参数IMetadata里添加数据
    sensorMetadata += rDngMeta;
    for (size_t i = 0; i < sensorMetadata.count(); i++)
    {
        IMetadata::Tag_t mTag = sensorMetadata.entryAt(i).tag();
        mtkMetadata.update(mTag, sensorMetadata.entryAt(i));
    }
  
    updateData(mtkMetadata);
    //调用参数pConverter的方法继续对IMetadata和camera_metadata处理
    pConverter->convert(mtkMetadata, rpDstMetadata);
    ::sort_camera_metadata(rpDstMetadata);
}

alps/vendor/mediatek/proprietary/hardware/mtkcam/utils/metadata/conversion/TypeConvert.androidMetadata.cpp
convert函数主要实现转化IMetadata --> camera_metadata
MetadataConverter::
  convert(const IMetadata &rMetadata, camera_metadata* &pDstMetadata, size_t* pDstSize)

后续可以通过MetadataProvider对象获得camera_metadata
alps/vendor/mediatek/proprietary/hardware/mtkcam/utils/metastore/metadataprovider/MetadataProvider.h
camera_metadata const*  getStaticCharacteristics()  const   { return mpStaticCharacteristics; }

-----------------------------------------------------------------------------------------------------------------------------------

addVirtualDevicesLocked的实现
将创建的CameraDevice3Impl对象封装成VirtEnumDevice对象，保存在 mVirtEnumDeviceMap
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/CameraDeviceManagerBase_camera.cpp
CameraDeviceManagerBase::
addVirtualDevicesLocked(uint32_t const instanceId,  ::android::sp pMetadataProvider)
{
    auto add_virtual_device = [&](IVirtualDevice* pVirtualDevice){
            if ( pVirtualDevice != nullptr ) {
                if  ( auto pInfo = new VirtEnumDevice ) {
                    if ( pVirtualDevice->hasFlashUnit() ) {
                        mIsSetTorchModeSupported = true;
                        pInfo->mTorchModeStatus = (uint32_t)ETorchModeStatus::AVAILABLE_OFF;
                    }
                    pInfo->mVirtDevice = pVirtualDevice;
                    pInfo->mInstanceId = pVirtualDevice->getInstanceId();
                    mVirtEnumDeviceMap.add(pVirtualDevice->getInstanceName(), pInfo);
                }
            }
        };

    auto create_and_add_virtual_device = [&](uint32_t majorVersion){
            //调用 createVirtualCameraDevice 函数创建 CameraDevice3Impl
            auto create_device = mVirtEnumDeviceFactoryMap[majorVersion].mCreateVirtualCameraDevice;
            CreateVirtualCameraDeviceParams param = {
                .instanceId = static_cast(instanceId),
                .deviceType = mType.c_str(),
                .pMetadataProvider = pMetadataProvider.get(),
                .pDeviceManager = this,
            };
            //调用CameraDevice3Factory获得CameraDevice3Impl
            auto new_device = create_device(¶m);
            //将CameraDevice3Impl保存在数组中
            add_virtual_device(new_device);
        };
    create_and_add_virtual_device(3);

}

-----------------------------------------------------------------------------------------------------------------------------------

create_device的具体实现
创建CameraDevice3Impl对象
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/device/3.x/device/CameraDevice3Factory.cpp
createVirtualCameraDevice(CreateVirtualCameraDeviceParams* params){
    auto pDevice = new CameraDevice3Impl(
        params->pDeviceManager,
        params->pMetadataProvider,
        params->deviceType,
        params->instanceId
    );
    //CameraDevice3Impl提供mStaticDeviceInfo和mMetadataConverter
    NSCam::ICameraDevice3Session::CreationInfo const info = {
        .mDeviceManager     = params->pDeviceManager,
        .mStaticDeviceInfo  = pDevice->getStaticDeviceInfo(),
        .mMetadataProvider  = params->pMetadataProvider,
        .mMetadataConverter = pDevice->getMetadataConverter(),
    };
    //初始化CameraDevice3Impl，同时构造CameraDevice3SessionImpl
    bool bInitSuccess = pDevice->initialize(createCameraDevice3Session(info));
    return pDevice;
}
CameraDevice3Impl的构造函数，继承ICameraDevice，保存变量mMetadataProvider，mMetadataConverter，mStaticDeviceInfo
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/device/3.x/device/CameraDevice3Impl.cpp
CameraDevice3Impl::
CameraDevice3Impl(
    ICameraDeviceManager* deviceManager,
    IMetadataProvider* metadataProvider,
    char const* deviceType,
    int32_t instanceId
)   : ICameraDevice()
    , mDeviceManager(deviceManager)
    , mMetadataProvider(metadataProvider)
    , mMetadataConverter(IMetadataConverter::createInstance(IDefaultMetadataTagSet::singleton()->getTagSet()))
{
    mStaticDeviceInfo = std::make_shared();
    if (mStaticDeviceInfo != nullptr) {
        mStaticDeviceInfo->mInstanceId      = instanceId;
        mStaticDeviceInfo->mMajorVersion    = kMajorDeviceVersion;
        mStaticDeviceInfo->mMinorVersion    = kMinorDeviceVersion;
        mStaticDeviceInfo->mHasFlashUnit    = metadataProvider->getDeviceHasFlashLight();
    }
}
createCameraDevice3Session的实现
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/device/3.x/device/CameraDevice3SessionImpl.cpp
NSCam::ICameraDevice3Session*
createCameraDevice3Session(
    NSCam::ICameraDevice3Session::CreationInfo const& info ){
    return new NSCam::v3::CameraDevice3SessionImpl(info);
}
CameraDevice3SessionImpl的构造函数，继承ICameraDevice3Session，将相机的底层信息保存在mStaticInfo中
CameraDevice3SessionImpl(CreationInfo const& info)
    : ICameraDevice3Session()
    , mStaticInfo(info)
    , mAppStreamManagerErrorState(std::make_shared(15, 25))
    , mAppStreamManagerWarningState(std::make_shared(25, 15))
    , mAppStreamManagerDebugState(std::make_shared())
{
}
构造CameraDevice3SessionImpl之后用来初始化CameraDevice3Impl
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/device/3.x/device/CameraDevice3Impl.cpp
CameraDevice3Impl::
initialize(
    const ::android::sp& session
){
    mSession = session;//保存CameraDevice3SessionImpl，后续作为CameraDevice3Impl的代理
    return true;
}

-----------------------------------------------------------------------------------------------------------------------------------

经过以上步骤实现了将多个CameraDevice3Impl并保存到CameraDeviceManager的数组mVirtEnumDeviceMap中，而CameraProvider会保存CameraDeviceManager，这样client端可以通过调用CameraProvider->CameraDeviceManager->CameraDevice3Impl->CameraDevice3SessionImpl->mStaticInfo。
=================================================================================================

 

注册cameraserver服务

CameraService会创建CameraProviderManager对象，然后进行initialize
alps/frameworks/av/camera/cameraserver/cameraserver.rc
service cameraserver /system/bin/cameraserver
    class main
    user cameraserver
    group audio camera input drmrpc
    ioprio rt 4
    writepid /dev/cpuset/camera-daemon/tasks /dev/stune/top-app/tasks

alps/frameworks/av/camera/cameraserver/main_cameraserver.cpp
域名 android
int main(int argc __unused, char** argv __unused){
     // Set 3 threads for HIDL calls
     /* open(/dev/binder)，用于和BnServiceManager通信
     *  open(/dev/hwbinder)，用于和BnHwServiceManager通信
    */
     hardware::configureRpcThreadpool(3, /*willjoin*/ false);
     sp proc(ProcessState::self());
     /* 获得 ServiceManager 的代理类 BpServiceManager, 注意不是 HwServiceManager 的代理类
     * ServiceManager 这个服务管理器是用来跟上层交互的，原理跟 HwServiceManager一样
    */
    sp sm = defaultServiceManager();//对应android:defaultServiceManager
    CameraService::instantiate();
}
-----------------------------------------------------------------------------------------------------------------------------------
hardware::configureRpcThreadpool的实现，打开/dev/hwbinder
域名 android:hardware
可以打开/dev/hwbinder
system/libhidl/transport/HidlTransportSupport.cpp
void configureRpcThreadpool(size_t maxThreads, bool callerWillJoin) {
    configureBinderRpcThreadpool(maxThreads, callerWillJoin);
}
system/libhidl/transport/HidlBinderSupport.cpp
void configureBinderRpcThreadpool(size_t maxThreads, bool callerWillJoin) {
    ProcessState::self()->setThreadPoolConfiguration(maxThreads, callerWillJoin /*callerJoinsPool*/);
}

域名 android:hardware
system/libhwbinder/ProcessState.cpp
sp ProcessState::self()
{
    if (gProcess != NULL) {
        return gProcess;
    }
    gProcess = new ProcessState(DEFAULT_BINDER_VM_SIZE);
    return gProcess;
}
ProcessState::ProcessState(size_t mmap_size)
    : mDriverFD(open_driver()){
    if (mDriverFD >= 0) {
        // mmap the binder, providing a chunk of virtual address space to receive transactions.
        mVMStart = mmap(0, mMmapSize, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
    }
}
static int open_driver(){
    int fd = open("/dev/hwbinder", O_RDWR | O_CLOEXEC);
    if (fd >= 0) {
        int vers = 0;
        status_t result = ioctl(fd, BINDER_VERSION, &vers);
        size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
    }
    return fd;
}
-----------------------------------------------------------------------------------------------------------------------------------
ProcessState::self()的实现，打开/dev/binder
域名 android
支持打开/dev/binder和/dev/vndbinder，未指定时，默认打开/dev/binder
/frameworks/native/libs/binder/ProcessState.cpp
sp ProcessState::self()
{
    if (gProcess != NULL) {
        return gProcess;
    }
    gProcess = new ProcessState("/dev/binder");
    return gProcess;
}
-----------------------------------------------------------------------------------------------------------------------------------
defaultServiceManager()的实现
defaultServiceManager的实现容易混淆，系统中有两个实现，在调用时需要注意方法所在的域，

• android:defaultServiceManager可以获的BpServiceManager，
• android:hardware:defaultServiceManager可以获的BpHwServiceManager，之后介绍

frameworks/native/libs/binder/IServiceManager.cpp
namespace android
sp defaultServiceManager(){
    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
    {
        while (gDefaultServiceManager == NULL) {
            gDefaultServiceManager = interface_cast(
                ProcessState::self()->getContextObject(NULL));
            if (gDefaultServiceManager == NULL)
                sleep(1);
        }
    }
    return gDefaultServiceManager;
}
-----------------------------------------------------------------------------------------------------------------------------------
CameraService::instantiate()的实现，将CameraService注册到ServiceManager
/*BinderService 是 CameraService 的父类，模板类 SERVICE = CameraService*/
template
class BinderService {
    static void instantiate() {/* 类属性的， 所以可以直接调用 */
        publish();
    }
    static status_t publish(bool allowIsolated = false) {
         /* 得到ServiceManager的代理类BpServiceManager
         */
         sp sm(defaultServiceManager());//对应android:defaultServiceManager
         /* SERVICE = CameraService， 注册CameraService 实例化对象
        */
        return sm->addService( String16(SERVICE::getServiceName()),
        /*new CameraService() 得到实例化对象，智能指针第一次引用回调用 onFirstRef() 函数, 后面分析
        */
        new SERVICE(), allowIsolated);
    }
};
-----------------------------------------------------------------------------------------------------------------------------------
onFirstRef的实现，流程比较长，所以放在后面来分析。
void CameraService::onFirstRef(){
    BnCameraService::onFirstRef();
    enumerateProviders();
    CameraService::pingCameraServiceProxy();
}
status_t CameraService::enumerateProviders() {
    status_t res;
    std::vector deviceIds;
    {
        mCameraProviderManager = new CameraProviderManager();
        mCameraProviderManager->initialize(this);//初始化
        mCameraProviderManager->setUpVendorTags();

        mFlashlight = new CameraFlashlight(mCameraProviderManager, this);//构造闪光灯
        mFlashlight->findFlashUnits();
        deviceIds = mCameraProviderManager->getCameraDeviceIds();//遍历mProviders
    }
    for (auto& cameraId : deviceIds) {
        String8 id8 = String8(cameraId.c_str());
        onDeviceStatusChanged(id8, CameraDeviceStatus::PRESENT);
    }
}
alps/frameworks/av/services/camera/libcameraservice/common/CameraProviderManager.cpp
const std::string kLegacyProviderName("legacy/0");
const std::string kExternalProviderName("external/0");

跨进程调用CameraProvider服务，configureRpcThreadpool中已打开/dev/hwbinder节点
status_t CameraProviderManager::initialize(wp listener,
        ServiceInteractionProxy* proxy) {
    mListener = listener; /* listener = CameraService 对象 */
    mServiceProxy = proxy;  //默认值proxy=sHardwareServiceInteractionProxy

    bool success = mServiceProxy->registerForNotifications(this);

    addProviderLocked(kLegacyProviderName, /*expected*/ false);
    addProviderLocked(kExternalProviderName, /*expected*/ false);
}
-----------------------------------------------------------------------------------------------------------------------------------
mServiceProxy的赋值，上面是CameraProviderManager的初始化过程，CameraProviderManager就是管理camera Service与camera provider之间通信的工程管理类，两个参数，其中第二个参数就是远程代理类。这个参数已经是默认赋值了。

status_t initialize(wp listener,
            ServiceInteractionProxy *proxy = &sHardwareServiceInteractionProxy);

这是定义，默认值就是 sHardwareServiceInteractionProxy，这个sHardwareServiceInteractionProxy是HardwareServiceInteractionProxy的实例，可以看出在HardwareServiceInteractionProxy定义中，已经直接调用了ICameraProvider--->getService()了。

frameworks/av/services/camera/libcameraservice/common/CameraProviderManager.h
    struct HardwareServiceInteractionProxy : public ServiceInteractionProxy {
        virtual bool registerForNotifications(
                const std::string &serviceName,
                const sp
                ¬ification) override {
            return hardware::camera::provider::V2_4::ICameraProvider::registerForNotifications(
                    serviceName, notification);
        }
        virtual sp getService(
                const std::string &serviceName) override {
            /* 调用了 ICameraProvider::getService()
            * 且 getStub 为默认值 getStub = flase，会得到 CameraProvider 的代理类(binder)
            */
            return hardware::camera::provider::V2_4::ICameraProvider::getService(serviceName);
        }
    };

out/soong/.intermediates/hardware/interfaces/camera/provider/2.4/[email protected]_genc++/gen/android/hardware/camera/provider/CameraProviderAll.cpp

::android::sp ICameraProvider::getService(const std::string &serviceName, const bool getStub) {
    using ::android::hardware::defaultServiceManager;//指定了域
    using ::android::hardware::details::waitForHwService;
    using Transport = ::android::hidl::manager::V1_0::IServiceManager::Transport;

    const sp<::android::hidl::manager::V1_0::IServiceManager> sm = defaultServiceManager();//获的BpHwServiceManager
    Return transportRet = sm->getTransport(ICameraProvider::descriptor, serviceName);

    Transport transport = transportRet;
    for (int tries = 0; !getStub && (vintfHwbinder || (vintfLegacy && tries == 0)); tries++) {
        /*
         * getStub = flase 才走这个分支
         * getService 会先获取 binder 服务，如果失败了才会获取 passthrough 服务
         */
        /* 获取 CameraProvider 代理类对象(binder) */
        Return> ret =
                sm->get(ICameraProvider::descriptor, serviceName);
        sp<::android::hidl::base::V1_0::IBase> base = ret;
        /* 转换为 BpHwCameraProvider 对象 */
        Return> castRet = ICameraProvider::castFrom(base, true /* emitError */);
        iface = castRet;
        /* 所以这里返回的是 BpHwCameraProvider 对象 */
        return iface;
    }
}

android:hardware:defaultServiceManager可以获的BpHwServiceManager
sp defaultServiceManager() {
    return defaultServiceManager1_1();
}
sp defaultServiceManager1_1() {
    {
        if (details::gDefaultServiceManager != nullptr) {
            return details::gDefaultServiceManager;
        }

        if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {
            // HwBinder not available on this device or not accessible to this process.
            return nullptr;
        }
        while (details::gDefaultServiceManager == nullptr) {
            details::gDefaultServiceManager =
                    fromBinder(
                        ProcessState::self()->getContextObject(nullptr));
            if (details::gDefaultServiceManager == nullptr) {
                LOG(ERROR) << "Waited for hwservicemanager, but got nullptr.";
                sleep(1);
            }
        }
    }
    return details::gDefaultServiceManager;
}
这里通过sm->get(ICameraProvider::descriptor, serviceName)查询ICameraProvider这个hidl服务，得到IBase对象后，在通过ICameraProvider::castFrom转换为ICameraProvider对象。

上述分析，显然上层 framework 通过 ServiceManager( /dev/binder ) 得到 CameraService 服务，而
CameraService 通过 HwServiceManager( /dev/hwbinder ) 得到 CameraProvider 服务，而 CameraProvider 与 Camera HAL 绑定。这样上层 framework 就能够访问 Camera HAL 层了
-----------------------------------------------------------------------------------------------------------------------------------

status_t CameraProviderManager::addProviderLocked(const std::string& newProvider, bool expected) {
    sp interface;
    interface = mServiceProxy->getService(newProvider);//获取服务端的 interface = CameraProviderImpl

    sp providerInfo = new ProviderInfo(newProvider, interface, this);
    status_t res = providerInfo->initialize();
    mProviders.push_back(providerInfo);
}
CameraProviderManager::ProviderInfo::ProviderInfo(
        const std::string &providerName,
        sp& interface,
        CameraProviderManager *manager) :
        mProviderName(providerName),
        mInterface(interface),
        mManager(manager) {
}
status_t CameraProviderManager::ProviderInfo::initialize() {
    status_t res = parseProviderName(mProviderName, &mType, &mId); //获得CameraProviderImpl的类型和ID
    hardware::Return status = mInterface->setCallback(this);//设置回调函数
    std::vector devices;
    //回调函数作为形参，回调函数的形参为idStatus和cameraDeviceNames，返回值status和devices
    hardware::Return ret = mInterface->getCameraIdList([&status, &devices](
            Status idStatus,
            const hardware::hidl_vec& cameraDeviceNames) {
        status = idStatus;
        if (status == Status::OK) {
            for (size_t i = 0; i < cameraDeviceNames.size(); i++) {
                devices.push_back(cameraDeviceNames[i]);
            }
        } });

    sp listener = mManager->getStatusListener();
    for (auto& device : devices) {
        std::string id;
        status_t res = addDevice(device,
                hardware::camera::common::V1_0::CameraDeviceStatus::PRESENT, &id);
    }
    return OK;
}
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/provider/2.4/CameraProviderImpl.cpp
CameraProviderImpl::
getCameraIdList(getCameraIdList_cb _hidl_cb){
    std::vector deviceNameList;
    auto status = mManager->getDeviceNameList(deviceNameList);//需要确认

    hidl_vec hidlDeviceNameList;
    hidlDeviceNameList.resize(deviceNameList.size());
    for (size_t i = 0; i < deviceNameList.size(); i++) {
        hidlDeviceNameList[i] = deviceNameList[i];
    }
    _hidl_cb(mapToHidlCameraStatus(status), hidlDeviceNameList);
    return Void();
}
获的deviceNames
status_t CameraProviderManager::ProviderInfo::addDevice(const std::string& name,
        CameraDeviceStatus initialStatus, /*out*/ std::string* parsedId) {
    //根据设备名称获的设备号和类型
    status_t res = parseDeviceName(name, &major, &minor, &type, &id);
    //遍历mProviders验证设备是否已经存在，每个mProviders中包含多个设备
    if (mManager->isValidDeviceLocked(id, major)) {
        return BAD_VALUE;
    }
    std::unique_ptr deviceInfo;
    switch (major) {
        case 1:
            deviceInfo = initializeDeviceInfo(name, mProviderTagid,
                    id, minor);
            break;
        case 3:
            deviceInfo = initializeDeviceInfo(name, mProviderTagid,
                    id, minor);
            break;
    }
    //将DeviceInfo保存在mDevices数组中
    mDevices.push_back(std::move(deviceInfo));
    return OK;
}
std::unique_ptr
    CameraProviderManager::ProviderInfo::initializeDeviceInfo(
        const std::string &name, const metadata_vendor_id_t tagId,
        const std::string &id, uint16_t minorVersion){
    auto cameraInterface = getDeviceInterface(name);

    //其中 cameraInterface 等于CameraDevice3Impl
    return std::unique_ptr(
        new DeviceInfoT(name, tagId, id, minorVersion, resourceCost, cameraInterface));
}
DeviceInfoT的构造函数？
mInterface = CameraDevice3Impl

sp
CameraProviderManager::ProviderInfo::getDeviceInterface
        (const std::string &name) const {
    sp cameraInterface;
    //name和回调函数为实参，回调函数的返回值status和cameraInterface，回调函数的参数s和interface
    ret = mInterface->getCameraDeviceInterface_V3_x(name, [&status, &cameraInterface](
        Status s, sp interface) {
                status = s;
                cameraInterface = interface; //interface = CameraDevice3Impl
            });
    return cameraInterface;
}

跨进程调用CameraProviderImpl
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/provider/2.4/CameraProviderImpl.cpp
class CameraProviderImpl
    : public ICameraProvider
    , public android::hardware::hidl_death_recipient
    , public NSCam::ICameraDeviceManager::Callback

CameraProviderImpl::
getCameraDeviceInterface_V3_x(
    const hidl_string& cameraDeviceName,
    getCameraDeviceInterface_V3_x_cb _hidl_cb){
    getCameraDeviceInterface<::android::hardware::camera::device::V3_2::ICameraDevice>(cameraDeviceName, _hidl_cb);
    return Void();
}
CameraProviderImpl::
getCameraDeviceInterface(
    const hidl_string& cameraDeviceName,
    InterfaceCallbackT _hidl_cb
){
    ::android::sp pBaseDevice(nullptr);
    auto status = mManager->getDeviceInterface(cameraDeviceName, pBaseDevice);
    auto pICameraDevice = ::android::sp(static_cast(pBaseDevice.get()));
    _hidl_cb(mapToHidlCameraStatus(status), pICameraDevice);//调用回调函数赋值 cameraInterface = pICameraDevice
}

从mVirtEnumDeviceMap取出VirtEnumDevice对象，然后获得CameraDevice3Impl对象
alps/vendor/mediatek/proprietary/hardware/mtkcam3/main/hal/devicemgr/CameraDeviceManagerBase.cpp
CameraDeviceManagerBase::
getDeviceInterface(
    const std::string& deviceName,
    ::android::sp& rpDevice
){
    auto const& pInfo = mVirtEnumDeviceMap.valueFor(deviceName);
    auto const& pDevice = pInfo->mVirtDevice; //CameraDevice3Impl
    us_t status = pDevice->getDeviceInterfaceBase(rpDevice);
}
CameraDevice3Impl::
getDeviceInterfaceBase(
    ::android::sp& rpDevice
){
    rpDevice = const_cast(static_cast(this));
    return android::OK;
}
通过以上流程cameraserver包含CameraProviderManager，CameraProviderManager包含mProviders，mProviders包含ProviderInfo，ProviderInfo包含mDevices，mDevices包含DeviceInfo，DeviceInfo包含DeviceInfoT，DeviceInfoT包含CameraDevice3Impl。

总体逻辑顺序：

1. provider 进程启动，注册；
2. cameraserver 进程启动，注册，初始化；
3. cameraserver 获取远端 provider（此时实例化 CameraProvider 并初始化）。

类和服务调用

CameraService的类继承关系
frameworks/av/camera/aidl/android/hardware/ICameraService.aidl

./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/ICameraService.h./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/BnCameraService.hframeworks/av/services/camera/libcameraservice/CameraService.h
class CameraService :
    public BinderService,
    public virtual ::android::hardware::BnCameraService,
    public virtual IBinder::DeathRecipient,
    public virtual CameraProviderManager::StatusListener
注册CameraService服务
alps/frameworks/av/camera/cameraserver/main_cameraserver.cpp
int main(int argc __unused, char** argv __unused){
    sp sm = defaultServiceManager();
    CameraService::instantiate();
}
获取CameraService服务
alps/frameworks/base/core/java/android/hardware/camera2/CameraManager.java
    private CameraDevice openCameraDeviceUserAsync(String cameraId,
            CameraDevice.StateCallback callback, Executor executor, final int uid)
            ICameraDeviceUser cameraUser = null;
            try {
                ICameraService cameraService = CameraManagerGlobal.get().getCameraService();
            }
    }
    private static final class CameraManagerGlobal extends ICameraServiceListener.Stub
        public ICameraService getCameraService() {
            IBinder cameraServiceBinder = ServiceManager.getService(CAMERA_SERVICE_BINDER_NAME);
            ICameraService cameraService = ICameraService.Stub.asInterface(cameraServiceBinder);
            mCameraService = cameraService;
            return mCameraService;
        }
}
通过以上注册服务和调用服务的流程，实现C++层服务cameraService 注册到ServiceManager，java层服务跨进程调用C++层服务。

其中继承BnCameraDeviceUser使其具有了跨进程通信的能力，所以实例化CameraDeviceClient时，这一系列类的构造函数都会被调用。
Cameraservice 在系统框架中的层次结构

CameraDeviceUser的类继承关系
frameworks/av/camera/aidl/android/hardware/camera2/ICameraDeviceUser.aidl

ICameraDeviceUser.aidl文件会自动生成：
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/camera2/ICameraDeviceUser.h

class ICameraDeviceUser : public ::android::IInterface {
  virtual ::android::binder::Status createStream(const ::android::hardware::camera2::params::OutputConfiguration& outputConfiguration, int32_t* _aidl_return) = 0;
};

./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/camera2/BnCameraDeviceUser.h

class BnCameraDeviceUser : public ::android::BnInterface<ICameraDeviceUser> {
  ::android::status_t onTransact(uint32_t _aidl_code, const ::android::Parcel& _aidl_data, ::android::Parcel* _aidl_reply, uint32_t _aidl_flags = 0) override;
};

frameworks/av/services/camera/libcameraservice/api2/CameraDeviceClient.h
struct CameraDeviceClientBase :
         public CameraService::BasicClient,
         public hardware::camera2::BnCameraDeviceUser

CameraDeviceClientBase::CameraDeviceClientBase() :
    mRemoteCallback(remoteCallback) {
}

template
class Camera2ClientBase :
        public TClientBase,
        public CameraDeviceBase::NotificationListener

Camera2ClientBase::Camera2ClientBase(){
    mInitialClientPid = clientPid;
    mDevice = new Camera3Device(cameraId);
}

class CameraDeviceClient :
        public Camera2ClientBase<CameraDeviceClientBase>,
        public camera2::FrameProcessorBase::FilteredListener

客户端通过CameraService服务获取AIDL对象CameraDeviceClient
alps/frameworks/base/core/java/android/hardware/camera2/CameraManager.java
    private CameraDevice openCameraDeviceUserAsync(String cameraId,
            CameraDevice.StateCallback callback, Executor executor, final int uid)
            ICameraDeviceUser cameraUser = null;
            try {
                ICameraService cameraService = CameraManagerGlobal.get().getCameraService();
                cameraUser = cameraService.connectDevice(callbacks, cameraId,
                        mContext.getOpPackageName(), uid);
            }
            deviceImpl.setRemoteDevice(cameraUser);
    }
跨进程调用，返回值ICameraDeviceUser
alps/frameworks/av/services/camera/libcameraservice/CameraService.cpp
Status CameraService::connectDevice(
        const sp& cameraCb,
        sp* device) {
    sp client = nullptr;
    ret = connectHelper(cameraCb, id, client);

    *device = client;
    return ret;
}
template
Status CameraService::connectHelper(const sp& cameraCb, const String8& cameraId,
        /*out*/sp& device) {
        makeClient(this, cameraCb, clientPackageName, &tmp));
        client = static_cast(tmp.get());  //转换BasicClient类型为CLIENT=CameraDeviceClient
}
CameraDeviceClient继承了BpCameraDeviceUser
Status CameraService::makeClient(const sp& cameraService,
        /*out*/sp* client) {
        sp tmp =
            static_cast(cameraCb.get());
            *client = new CameraDeviceClient(cameraService, tmp, packageName, cameraId,
                    facing, clientPid, clientUid, servicePid);
}

使用AIDL对象CameraDeviceClient的方法
alps/frameworks/base/core/java/android/hardware/camera2/impl/ICameraDeviceUserWrapper.java
public class ICameraDeviceUserWrapper {
    private final ICameraDeviceUser mRemoteDevice;
    public ICameraDeviceUserWrapper(ICameraDeviceUser remoteDevice) {
        mRemoteDevice = remoteDevice;
    }
    public SubmitInfo submitRequest(CaptureRequest request, boolean streaming){
        return mRemoteDevice.submitRequest(request, streaming);//跨进程调用
    }
}
CameraDeviceClient方法的具体实现
alps/frameworks/av/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
binder::Status CameraDeviceClient::submitRequest(
        const hardware::camera2::CaptureRequest& request,
        bool streaming,
        hardware::camera2::utils::SubmitInfo *submitInfo) {
    std::vector requestList = { request };
    return submitRequestList(requestList, streaming, submitInfo);
}
通过以上流程，可以实现通过ServiceManager获得cameraService服务，之后通过cameraService服务获得AIDL对象CameraDeviceClient，之后通过CameraDeviceClient跨进程调用AIDL接口。

CameraDevice 在系统中的层次结构

ICameraServiceProxy.aidl
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/ICameraServiceProxy.h
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/BnCameraServiceProxy.h

AIDL的服务实现
alps/frameworks/base/services/core/java/com/android/server/camera/CameraServiceProxy.java
public static final String CAMERA_SERVICE_PROXY_BINDER_NAME = "media.camera.proxy";
public class CameraServiceProxy extends SystemService
        implements Handler.Callback, IBinder.DeathRecipient {
frameworks/base/services/core/java/com/android/server/camera/CameraServiceProxy.java
    private final ICameraServiceProxy.Stub mCameraServiceProxy = new ICameraServiceProxy.Stub() {
        public void pingForUserUpdate() {
            notifySwitchWithRetries(30);
        }
    };
    public void onStart() {
        publishBinderService(CAMERA_SERVICE_PROXY_BINDER_NAME, mCameraServiceProxy);
        publishLocalService(CameraServiceProxy.class, this);
        CameraStatsJobService.schedule(mContext);
    }
}
启动服务
public final class SystemServer {
    private void startOtherServices() {
        if (!disableCameraService) {
            traceBeginAndSlog("StartCameraServiceProxy");
            mSystemServiceManager.startService(CameraServiceProxy.class);
        }
    }
}
AIDL服务的使用
alps/frameworks/av/services/camera/libcameraservice/CameraService.cpp
sp CameraService::getCameraServiceProxy() {
    sp proxyBinder = nullptr;
    sp sm = defaultServiceManager();
    sp binder = sm->checkService(String16("media.camera.proxy"));
    proxyBinder = interface_cast(binder);
    return proxyBinder;
}
void CameraService::pingCameraServiceProxy() {
    sp proxyBinder = getCameraServiceProxy();
    proxyBinder->pingForUserUpdate();//跨进程调用
}
通过以上注册服务和调用服务的流程，实现java服务注册到ServiceManager，C++层服务跨进程调用java层服务。

ICameraDeviceCallbacks.aidl
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/camera2/ICameraDeviceCallbacks.h
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/camera2/BnCameraDeviceCallbacks.h

frameworks/av/camera/ndk/impl/ACameraDevice.h
class ServiceCallback : public hardware::camera2::BnCameraDeviceCallbacks

ICameraServiceListener.aidl
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/ICameraServiceListener.h
./out/soong/.intermediates/frameworks/av/camera/libcamera_client/android_arm_armv7-a-neon_core_shared_platform/gen/aidl/android/hardware/BnCameraServiceListener.h

frameworks/base/core/java/android/hardware/camera2/CameraManager.java
static final String CAMERA_SERVICE_BINDER_NAME = "media.camera";
    private static final class CameraManagerGlobal extends ICameraServiceListener.Stub
            implements IBinder.DeathRecipient {
        private void connectCameraServiceLocked() {
            IBinder cameraServiceBinder = ServiceManager.getService(CAMERA_SERVICE_BINDER_NAME);
            ICameraService cameraService = ICameraService.Stub.asInterface(cameraServiceBinder);
            try {
                CameraStatus[] cameraStatuses = cameraService.addListener(this);//注册监听对象
                mCameraService = cameraService;
            }
        }
    }
alps/frameworks/av/services/camera/libcameraservice/CameraService.cpp
跨进程调用，参数listener，返回值cameraStatuses
Status CameraService::addListener(const sp& listener,
        std::vector *cameraStatuses) {
    for (size_t i = 0; i < mTorchStatusMap.size(); i++ ) {
        String16 id = String16(mTorchStatusMap.keyAt(i).string());
        listener->onTorchStatusChanged(mapToInterface(mTorchStatusMap.valueAt(i)), id);//跨进程回调监听函数
    }
}
通过以上注册服务和调用服务的流程，实现将java服务作为监听对象注册到C++层服务，C++层服务跨进程回调java层服务。

Java层要想与C++层的CameraService层进行通信，都是通过Java层的IPC Binder进制进行的，主要包括ICameraService.aidl以及ICameraDeviceUser.aidl两个接口来实现，其会在Java层维护一个CameraDeviceImpl即Camera设备的代理。