在前一篇文章Camera Client/Server的binder IPC机制中阐述了Android进程间通信binder IPC机制基础，Android Camera基于这个基础设计了Camera Framework Client/Server架构，文中给出了其类图设计。本文从Android 4.4 版本源码入手，分析Camera App向Camera Service请求服务与返回的过程。服务请求的过程从上到下依次要经过三个大的过程：1. Camera App调用Framework Camera类Java API；2. Camera类Java API通过JNI调用JNI层的C++接口函数；3. 基于binder通信设计的Camera IPC通信过程。下面结合代码分析整个服务请求过程。
Camera应用调用Framework Camera类API
在Android Kitkat原生Camera2应用（packages/apps/Camera2/）的PhotoModule, VideoModule, WideAnglePanoramaModule类中用CameraUtil.open()方法来打开Camera。然后依次调用：CameraHolder的open()方法，AndroidCameraManagerImpl的cameraOpen()方法，CameraHandler的handleMessage()【message为OPEN_CAMERA】，直到调用Framework Camera类（frameworks/base/core/java/android/hardware/Camera.java）的open()方法。在这里，Camera2应用程序暂不做分析，我们着重看程序向下调用的服务请求过程。
mCameraDevice = CameraUtil.openCamera( mActivity, mCameraId, mHandler, mActivity.getCameraOpenErrorCallback()); // (1)
public class CameraUtil { public static CameraManager.CameraProxy openCamera( Activity activity, final int cameraId, Handler handler, final CameraManager.CameraOpenErrorCallback cb) { try { throwIfCameraDisabled(activity); return CameraHolder.instance().open(handler, cameraId, cb); // (2) } catch (CameraDisabledException ex) { handler.post(new Runnable() { @Override public void run() { cb.onCameraDisabled(cameraId); } }); } return null; } }
public class CameraHolder { public synchronized CameraProxy open( Handler handler, int cameraId, CameraManager.CameraOpenErrorCallback cb) { ………… if (mCameraDevice == null) { Log.v(TAG, "open camera " + cameraId); if (mMockCameraInfo == null) { mCameraDevice = CameraManagerFactory .getAndroidCameraManager().cameraOpen(handler, cameraId, cb); // (3) ………… } else { ………… } mCameraOpened = true; mHandler.removeMessages(RELEASE_CAMERA); ………… return mCameraDevice; } }
class AndroidCameraManagerImpl implements CameraManager { public CameraManager.CameraProxy cameraOpen( Handler handler, int cameraId, CameraOpenErrorCallback callback) { mCameraHandler.obtainMessage(OPEN_CAMERA, cameraId, 0, CameraOpenErrorCallbackForward.getNewInstance( handler, callback)).sendToTarget(); // (4) ………… } }
private class CameraHandler extends Handler { @Override public void handleMessage(final Message msg) { try { switch (msg.what) { case OPEN_CAMERA: mCamera = android.hardware.Camera.open(msg.arg1); // (5) ………… return; } } } }
JNI层调用
Framework
Camera类API调用本地方法，而本地方法被注册到JNI，因此通过JNI调用android_hardware_Camera.cpp（/framworks/base/core/jni/）中对应的方法。在打开相机的过程中，Framework
Camera类的open()方法调用本地方法native_setup()。native_setup()被注册到JNI，通过JNI调用android_hardware_Camera_native_setup()方法。再通过android_hardware_Camera_native_setup()调用Camera::connect()函数（frameworks/av/camera/Camera.cpp）请求连接CameraService服务。
public class Camera { public static Camera open(int cameraId) { return new Camera(cameraId); } Camera(int cameraId) { ………… String packageName = ActivityThread.currentPackageName(); native_setup(new WeakReference<Camera>(this), cameraId, packageName); } }
JNI层注册native_setup方法
static JNINativeMethod camMethods[] = { { "native_setup", "(Ljava/lang/Object;ILjava/lang/String;)V", (void*)android_hardware_Camera_native_setup } …… };
// connect to camera service static void android_hardware_Camera_native_setup(JNIEnv *env, jobject thiz, jobject weak_this, jint cameraId, jstring clientPackageName) { ………… sp<Camera> camera = Camera::connect(cameraId, clientName, Camera::USE_CALLING_UID); ………… }
CameraService服务连接（IPC通信）
JNI调用Camera::connect()请求CameraService服务。Camera类继承模板类CameraBase<Camera>和BnCameraClient。首先调用模板类的connect()函数，在函数中向ServiceManager获取Camera服务信息，并生成CameraService服务代理BpCameraService（/frameworks/av/camera/ICameraService.cpp），然后通过Binder通信发送CONNECT命令，当BnCameraService收到CONNECT命令后调用CameraService的connect()成员函数来做相应的处理。
template <typename TCam, typename TCamTraits> sp<TCam> CameraBase<TCam, TCamTraits>::connect(int cameraId, const String16& clientPackageName, int clientUid) { sp<TCam> c = new TCam(cameraId); // BnCameraClient sp<TCamCallbacks> cl = c; status_t status = NO_ERROR; const sp<ICameraService>& cs = getCameraService(); // return BpCameraService if (cs != 0) { TCamConnectService fnConnectService = TCamTraits::fnConnectService; status = (cs.get()->*fnConnectService)(cl, cameraId, clientPackageName, clientUid, /*out*/ c->mCamera); } if (status == OK && c->mCamera != 0) { c->mCamera->asBinder()->linkToDeath(c); c->mStatus = NO_ERROR; } else { ALOGW("An error occurred while connecting to camera: %d", cameraId); c.clear(); } return c; }
下面我们来分析BpCameraService的connect()成员函数。首先将传递过来的Camera对象转换成IBinder类型，将调用的参数写到Parcel中，通过BpBinder的transact()函数发送消息，然后由BnCameraService去响应该连接，最后就是等待服务端返回，如果成功这里为我们生成一个BpCamera实例。
class BpCameraService: public BpInterface<ICameraService> { // connect to camera service (android.hardware.Camera) virtual status_t connect(const sp<ICameraClient>& cameraClient, int cameraId, const String16 &clientPackageName, int clientUid, /*out*/ sp<ICamera>& device) { Parcel data, reply; data.writeInterfaceToken(ICameraService::getInterfaceDescriptor()); data.writeStrongBinder(cameraClient->asBinder()); data.writeInt32(cameraId); data.writeString16(clientPackageName); data.writeInt32(clientUid); remote()->transact(BnCameraService::CONNECT, data, &reply); // BpBinder的transact()函数向IPCThreadState实例发送消息，通知其有消息要发送给binder driver if (readExceptionCode(reply)) return -EPROTO; status_t status = reply.readInt32(); if (reply.readInt32() != 0) { device = interface_cast<ICamera>(reply.readStrongBinder()); // client端读出server返回的binder } return status; } }
BnCameraService的onTransact()函数负责解包收到的Parcel并执行client端的请求的方法。服务端收到CONNECT命令之后，
(1)
使用Camera的Binder对象生成Camera客户代理BpCameraClient实例；
(2)
将生成的BpCameraClient对象作为参数传递到CameraService（/frameworks/av/services/camera/libcameraservice/CameraService.cpp）的connect()函数中，该函数会返回一个BpCamera实例；
(3)
将在(2)中返回的实例对象以IBinder的形式打包到Parcel中返回。
status_t BnCameraService::onTransact( uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) { switch(code) { case CONNECT: { CHECK_INTERFACE(ICameraService, data, reply); sp<ICameraClient> cameraClient = interface_cast<ICameraClient>(data.readStrongBinder()); // （1） int32_t cameraId = data.readInt32(); const String16 clientName = data.readString16(); int32_t clientUid = data.readInt32(); sp<ICamera> camera; status_t status = connect(cameraClient, cameraId, clientName, clientUid, /*out*/ camera); // （2） reply->writeNoException(); reply->writeInt32(status); if (camera != NULL) { reply->writeInt32(1); reply->writeStrongBinder(camera->asBinder()); // （3） } else { reply->writeInt32(0); } return NO_ERROR; } break; } }
接下来看CameraService::connect()函数，该函数返回一个BpCamera实例。
status_t CameraService::connect( const sp<ICameraClient>& cameraClient, int cameraId, const String16& clientPackageName, int clientUid, /*out*/ sp<ICamera>& device) { String8 clientName8(clientPackageName); int callingPid = getCallingPid(); LOG1("CameraService::connect E (pid %d \"%s\", id %d)", callingPid, clientName8.string(), cameraId); status_t status = validateConnect(cameraId, /*inout*/clientUid); if (status != OK) { return status; } sp<Client> client; { Mutex::Autolock lock(mServiceLock); sp<BasicClient> clientTmp; if (!canConnectUnsafe(cameraId, clientPackageName, cameraClient->asBinder(), /*out*/clientTmp)) { return -EBUSY; } else if (client.get() != NULL) { device = static_cast<Client*>(clientTmp.get()); return OK; } int facing = -1; int deviceVersion = getDeviceVersion(cameraId, &facing); // If there are other non-exclusive users of the camera, // this will tear them down before we can reuse the camera if (isValidCameraId(cameraId)) { // transition from PRESENT -> NOT_AVAILABLE updateStatus(ICameraServiceListener::STATUS_NOT_AVAILABLE, cameraId); } /* 根据HAL不同API的版本创建不同的client实例 */ switch(deviceVersion) { case CAMERA_DEVICE_API_VERSION_1_0: client = new CameraClient(this, cameraClient, clientPackageName, cameraId, facing, callingPid, clientUid, getpid()); break; case CAMERA_DEVICE_API_VERSION_2_0: case CAMERA_DEVICE_API_VERSION_2_1: case CAMERA_DEVICE_API_VERSION_3_0: client = new Camera2Client(this, cameraClient, clientPackageName, cameraId, facing, callingPid, clientUid, getpid(), deviceVersion); break; case -1: ALOGE("Invalid camera id %d", cameraId); return BAD_VALUE; default: ALOGE("Unknown camera device HAL version: %d", deviceVersion); return INVALID_OPERATION; } status_t status = connectFinishUnsafe(client, client->getRemote()); if (status != OK) { // this is probably not recoverable.. maybe the client can try again // OK: we can only get here if we were originally in PRESENT state updateStatus(ICameraServiceListener::STATUS_PRESENT, cameraId); return status; } mClient[cameraId] = client; // every camera is a Client class LOG1("CameraService::connect X (id %d, this pid is %d)", cameraId, getpid()); } // important: release the mutex here so the client can call back // into the service from its destructor (can be at the end of the call) device = client; // 返回的camera device实例 return OK; }
至此，一次Framework层的Camera服务请求过程完成。