1. 前言

本文將分析android系統原始碼，從frameworks層到hal層，暫不涉及app層和kernel層。由於某些函式比較複雜，在貼出程式碼時會適當對其進行簡化。本文屬於自己對原始碼的總結，僅僅是貫穿程式碼流程，不會深入分析各個細節。歡迎聯絡討論，QQ：1026656828

2. app層

從apk開始，簡單列出各個入口函式

private void initCamera()
{
    Camera mCamera = Camera.open();
    Camera.Parameters mParameters = mCamera.getParameters();
    mParameters.setPictureFormat(PixelFormat.JPEG);
    mCamera.setParameters(mParameters);
    mCamera.setPreviewDisplay(mSurfaceHolder);
    mCamera.startPreview();
    mCamera.takePicture(null, null , mJpegCallback);
}
 

3. frameworks層

這裡將重點介紹Camera.open函式，其餘函式將在後續博文分析。先來看看Camera.open函式在frameworks層的實現，程式碼路徑為: frameworks/base/core/java/android/hardware/Camera.java

public static Camera open() {
    if (!isPermissionGranted()) {
        return null;
    }    
    int numberOfCameras = getNumberOfCameras();
    CameraInfo cameraInfo = new CameraInfo();
    for (int i = 0; i < numberOfCameras; i++) {
        getCameraInfo(i, cameraInfo);
        if (cameraInfo.facing == CameraInfo.CAMERA_FACING_BACK) {
            return new Camera(i);
        }    
    }    
    return null;
}    
 

第5行, 通過getNumberOfCameras函式來獲取Camera的個數。從上一篇博文CameraService的啟動流程可以看出，這個資訊儲存在CameraService中。
第10行，需重點關注，構造一個Camera物件，並將它返回給app層。

3.1 getNumberOfCameras函式分析

getNumberOfCameras函式進入到CameraService獲取Camera個數的流程如下:

Camera.java呼叫的getNumberOfCameras函式是一個JNI介面，對應的函式是android_hardware_Camera.cpp裡的android_hardware_Camera_getNumberOfCameras函式

static jint android_hardware_Camera_getNumberOfCameras(JNIEnv *env, jobject thiz)
{
    return Camera::getNumberOfCameras();
}

這裡只是簡單呼叫了Camera.cpp的getNumberOfCameras函式，Camera繼承了CameraBase，該函式由它實現

template <typename TCam, typename TCamTraits>
int CameraBase<TCam, TCamTraits>::getNumberOfCameras() {
    const sp<ICameraService> cs = getCameraService();
    return cs->getNumberOfCameras();
}

第3行, getCameraService函式用來獲取ICameraService的Bp端，程式碼實現如下

const char* kCameraServiceName = "media.camera";

template <typename TCam, typename TCamTraits>
const sp<ICameraService>& CameraBase<TCam, TCamTraits>::getCameraService()
{   
    if (gCameraService.get() == 0) {
        sp<IServiceManager> sm = defaultServiceManager();
        sp<IBinder> binder;
        binder = sm->getService(String16(kCameraServiceName));       
        gCameraService = interface_cast<ICameraService>(binder);
    }
    return gCameraService;
}

Android的Binder通訊機制

第1行, 獲取的ServiceName為"media.camera"，結合上一篇博文CameraService的啟動流程可以看出Bn端的實現在CameraService.cpp

回到之前的getNumberOfCameras函式，在獲取到ICameraService的Bp端後，就可以開始和Bn端通訊了。在第4行，當呼叫cs->getNumberOfCameras函式時，將會進入CameraService.cpp的getNumberOfCameras函式

int32_t CameraService::getNumberOfCameras() {
    return mNumberOfCameras;
}

程式碼很簡單，返回上一篇博文講到的，千辛萬苦從hal層拿到的資料

3.2 Camera建構函式分析

回到最開始的Camera.open函式，在第10行，將會構造一個Camera物件

private int cameraInitVersion(int cameraId, int halVersion) {
    ......
    Looper looper;
    if ((looper = Looper.myLooper()) != null) {
        mEventHandler = new EventHandler(this, looper);
    } else if ((looper = Looper.getMainLooper()) != null) {
        mEventHandler = new EventHandler(this, looper);
    } else {
        mEventHandler = null;
    }

    String packageName = ActivityThread.currentPackageName();

    return native_setup(new WeakReference<Camera>(this), cameraId, halVersion, packageName);
}

private int cameraInitNormal(int cameraId) {
    return cameraInitVersion(cameraId, CAMERA_HAL_API_VERSION_NORMAL_CONNECT);
}

Camera(int cameraId) {
    int err = cameraInitNormal(cameraId);
    ......
}

第14行, native_setup同樣是個JNI介面，對應android_hardware_Camera.cpp裡的android_hardware_Camera_native_setup函式

static jint android_hardware_Camera_native_setup(JNIEnv *env, jobject thiz,
    jobject weak_this, jint cameraId, jint halVersion, jstring clientPackageName)
{
    camera = Camera::connect(cameraId, clientName, Camera::USE_CALLING_UID);

#if 1 // defined(MTK_CAMERA_BSP_SUPPORT)
    sp<JNICameraContext> context = new MtkJNICameraContext(env, weak_this, clazz, camera);
#else
    sp<JNICameraContext> context = new JNICameraContext(env, weak_this, clazz, camera);
#endif
}

第4行, 呼叫了Camera.cpp的connect函式，同時返回一個Camera物件，儲存在JNICameraContext當中

sp<Camera> Camera::connect(int cameraId, const String16& clientPackageName,
        int clientUid)
{
    return CameraBaseT::connect(cameraId, clientPackageName, clientUid);
}

先來看看Camera和CameraBase的類定義

/* ---------- Camera.h ---------- */
template <>
struct CameraTraits<Camera>
{
    ......
    static TCamConnectService fnConnectService;
};

class Camera : public CameraBase<Camera>
{
    ......
}
/* -------- CameraBase.h -------- */
<pre name="code" class="cpp">template <typename TCam>
struct CameraTraits {
};

template <typename TCam, typename TCamTraits = CameraTraits<TCam>>
class CameraBase
{
    ......
    typedef CameraBase<TCam>    CameraBaseT;
}

這裡使用了C++模版，其實就是呼叫CameraBase::connect函式

CameraTraits<Camera>::TCamConnectService CameraTraits<Camera>::fnConnectService = &ICameraService::connect;

template <typename TCam, typename TCamTraits>
sp<TCam> CameraBase<TCam, TCamTraits>::connect(int cameraId,
                                               const String16& clientPackageName,
                                               int clientUid)
{
    sp<TCam> c = new TCam(cameraId);
    sp<TCamCallbacks> cl = c;

    const sp<ICameraService>& cs = getCameraService();
    if (cs != 0) {
        TCamConnectService fnConnectService = TCamTraits::fnConnectService;
        status = (cs.get()->*fnConnectService)(cl, cameraId, clientPackageName, clientUid,
                                             /*out*/ c->mCamera);
    }

    return c;
}

第1行, 將CameraTraits::fnConnectService賦為ICameraService::connect

第7行, 構造一個Camera物件

第10行, 獲取ICameraService的Bp端

第13行, 從上面的解釋可以看出，實際就是呼叫CameraService.cpp的connect函式

第17行, 將Camera物件返回給JNI層

status_t CameraService::connectHelperLocked(
        /*out*/
        sp<Client>& client,
        /*in*/
        const sp<ICameraClient>& cameraClient,
        int cameraId,
        const String16& clientPackageName,
        int clientUid,
        int callingPid,
        int halVersion,
        bool legacyMode) {
    ......
    int deviceVersion = getDeviceVersion(cameraId, &facing);

    switch(deviceVersion) {
        case CAMERA_DEVICE_API_VERSION_1_0:
            client = new CameraClient(this, cameraClient,
                    clientPackageName, cameraId,
                    facing, callingPid, clientUid, getpid(), legacyMode);
            break;
        case CAMERA_DEVICE_API_VERSION_2_0:
        case CAMERA_DEVICE_API_VERSION_2_1:
        case CAMERA_DEVICE_API_VERSION_3_0:
        case CAMERA_DEVICE_API_VERSION_3_1:
        case CAMERA_DEVICE_API_VERSION_3_2:
            client = new Camera2Client(this, cameraClient,
                    clientPackageName, cameraId,
                    facing, callingPid, clientUid, getpid(), legacyMode);
            break;
    }

    status_t status = connectFinishUnsafe(client, client->getRemote());
    mClient[cameraId] = client;
}

status_t CameraService::connect(
        const sp<ICameraClient>& cameraClient,
        int cameraId,
        const String16& clientPackageName,
        int clientUid,
        /*out*/
        sp<ICamera>& device) {
    ......
    sp<Client> client;
    status = connectHelperLocked(/*out*/client,
                                 cameraClient,
                                 cameraId,
                                 clientPackageName,
                                 clientUid,
                                 callingPid);
    device = client;
    return OK;
}

忽略細節之後connect函式就只是呼叫connectHelperLocked函式

第13行, 獲取api版本資訊，這個函式比較簡單，不細說。這裡的版本為CAMERA_DEVICE_API_VERSION_1_0

第15-30行, 根據不同的api版本選擇構造CameraClient或Camera2Client，這裡是CameraClient

第32行, 呼叫connectFinishUnsafe函式，實現如下

status_t CameraService::connectFinishUnsafe(const sp<BasicClient>& client,
                                            const sp<IBinder>& remoteCallback) {
    status_t status = client->initialize(mModule);
}

這裡的client就是上一個函式的CameraClient，mModule就是在上一篇博文CameraService的啟動流程裡提到的hal層的介面

status_t CameraClient::initialize(camera_module_t *module) {
    mHardware = new CameraHardwareInterface(camera_device_name);
    res = mHardware->initialize(&module->common);
    mHardware->setCallbacks(notifyCallback,
            dataCallback,
            dataCallbackTimestamp,
            (void *)(uintptr_t)mCameraId);
    return OK;
}

構造一個CameraHardwareInterface物件，並呼叫它的initalize函式，直接看initalize函式

status_t initialize(hw_module_t *module)
{
    module->methods->open(module, mName.string(), (hw_device_t **)&mDevice)
    initHalPreviewWindow();
}

第4行, 從這裡進入到了hal層，hal層主要對Camera硬體進行初始化，並將操作集儲存在mDevice當中

4. hal層-基於MTK平臺

hal層對Camera硬體進行初始化以及返回Device操作集的流程如下

4.1 open函式分析

這裡再看一次module的定義

static
hw_module_methods_t*
get_module_methods()
{
    static
    hw_module_methods_t
    _methods =
    {
        open: open_device
    };

    return  &_methods;
}

static
camera_module
get_camera_module()
{
    camera_module module = {
        common:{
             tag                    : HARDWARE_MODULE_TAG,
             #if (PLATFORM_SDK_VERSION >= 21)
             module_api_version     : CAMERA_MODULE_API_VERSION_2_3,
             #else
             module_api_version     : CAMERA_DEVICE_API_VERSION_1_0,
             #endif
             hal_api_version        : HARDWARE_HAL_API_VERSION,
             id                     : CAMERA_HARDWARE_MODULE_ID,
             name                   : "MediaTek Camera Module",
             author                 : "MediaTek",
             methods                : get_module_methods(),
             dso                    : NULL,
             reserved               : {0},
        },
        get_number_of_cameras       : get_number_of_cameras,
        get_camera_info             : get_camera_info,
        set_callbacks               : set_callbacks,
        get_vendor_tag_ops          : get_vendor_tag_ops,
        #if (PLATFORM_SDK_VERSION >= 21)
        open_legacy                 : open_legacy,
        #endif
        reserved                    : {0},
    };
    return  module;
};

通過module->methods獲取到的函式為open_device，

static
int
open_device(hw_module_t const* module, const char* name, hw_device_t** device)
{
    return  NSCam::getCamDeviceManager()->open(device, module, name);
}

CamDeviceManagerImp 繼承了 CamDeviceManagerBase。這裡直接呼叫了CamDeviceManagerBase的open()

status_t
CamDeviceManagerBase::
openDeviceLocked(
    hw_device_t** device,
    hw_module_t const* module,
    int32_t const i4OpenId,
    uint32_t device_version
)
{
    // [2] get platform
    IPlatform*const pPlatform = getPlatform();
    pDevice = pPlatform->createCam1Device(s8ClientAppMode.string(), i4OpenId);
    *device = const_cast<hw_device_t*>(pDevice->get_hw_device());
}

status_t
CamDeviceManagerBase::
open(
    hw_device_t** device,
    hw_module_t const* module,
    char const* name,
    uint32_t device_version
)
{
    return  openDeviceLocked(device, module, i4OpenId, device_version);
}

第11行, getPlatform函式用來載入libcam_platform.so，並獲取PlatformEntry介面

第12行, 構造一個Cam1Device物件，並呼叫它的init函式

第13行, 獲取camera device的操作集

4.2 getPlatform函式分析

static PlatformEntry g_PlatformEntry;

IPlatform*
getHandleToPlatform()
{
    return &g_PlatformEntry;
}

IPlatform*
CamDeviceManagerBase::
getPlatform()
{
    char const szModulePath[] = "libcam_platform.so";
    char const szEntrySymbol[] = "getHandleToPlatform";
    void* pfnEntry = NULL;
    IPlatform* pIPlatform = NULL;

    mpLibPlatform = ::dlopen(szModulePath, RTLD_NOW);
    pfnEntry = ::dlsym(mpLibPlatform, szEntrySymbol);
    pIPlatform = reinterpret_cast<IPlatform*(*)()>(pfnEntry)();
    gIPlatform = pIPlatform;

    return gIPlatform;
}

第18行, 載入libcam_platform.so

第19 20行, 獲取getHandleToPlatform函式入口，並呼叫，最後返回PlatformEntry介面

4.3 pPlatform->createCam1Device函式分析

NSCam::Cam1Device*
createCam1Device(
    String8 const   s8ClientAppMode,
    int32_t const   i4OpenId
)
{
    NSCam::Cam1Device* pdev = NULL;

    String8 const s8LibPath = String8::format("libcam.device1.so");
    void *handle = ::dlopen(s8LibPath.string(), RTLD_GLOBAL);

    String8 const s8CamDeviceInstFactory = String8::format("createCam1Device_Default");
    void* pCreateInstance = ::dlsym(handle, s8CamDeviceInstFactory.string());
    pdev = reinterpret_cast<NSCam::Cam1Device* (*)(String8 const&, int32_t const)>
                    (pCreateInstance)(s8ClientAppMode, i4OpenId);

    pdev->initialize();
}

ICamDevice*
PlatformEntry::
createCam1Device( 
    char const*         szClientAppMode,
    int32_t const       i4OpenId
)
{
    return  ::createCam1Device(String8(szClientAppMode), i4OpenId);
}

pPlatform->createCam1Device函式呼叫的是Cam1DeviceFactory.cpp裡的createCam1Device函式

第10行, 載入libcam.device1.so

第12-15行, 獲取createCam1Device_Default函式入口並呼叫

第17行, Cam1Device初始化

先來看createCam1Device_Default函式，以及類的繼承關係

class Cam1DeviceBase : public Cam1Device
{
}

class DefaultCam1Device : public Cam1DeviceBase
{
}

NSCam::Cam1Device*
createCam1Device_Default(
    String8 const&          rDevName, 
    int32_t const           i4OpenId
)
{
    return new DefaultCam1Device(rDevName, i4OpenId);
}

接著看DefaultCam1Device的建構函式

Cam1Device::
Cam1Device()
{   
    ::memset(&mDevice, 0, sizeof(mDevice));
    mDevice.priv    = this;
    mDevice.common  = gHwDevice;
    mDevice.ops     = (camera_device_ops*)&mDeviceOps;
    mDeviceOps      = gCameraDevOps;
}  

Cam1DeviceBase::
Cam1DeviceBase(
    String8 const&          rDevName,
    int32_t const           i4OpenId
)
    : Cam1Device()
    , mDevName(rDevName)
    , mi4OpenId(i4OpenId)
{
    MY_LOGD("");
}

DefaultCam1Device::
DefaultCam1Device(
    String8 const&          rDevName,
    int32_t const           i4OpenId
)
    : Cam1DeviceBase(rDevName, i4OpenId)
{
} 

刪除了一些暫不關注的程式碼，DefaultCam1Device的建構函式會不斷呼叫父類的建構函式，需要關注的是它的父類Cam1Device的建構函式。其中的gCameraDevOps結構體很重要，是Camera Device的操作集，預覽、拍照、錄影都是通過它來操作，來看下它的定義

static mtk_camera_device_ops const
gCameraDevOps =
{
    #define OPS(name) name: camera_##name

    {
        OPS(set_preview_window),
        OPS(set_callbacks), 
        OPS(enable_msg_type),
        OPS(disable_msg_type),
        OPS(msg_type_enabled), 
        OPS(start_preview),
        OPS(stop_preview), 
        OPS(preview_enabled), 
        OPS(store_meta_data_in_buffers),
        OPS(start_recording), 
        OPS(stop_recording), 
        OPS(recording_enabled),
        OPS(release_recording_frame),
        OPS(auto_focus), 
        OPS(cancel_auto_focus),
        OPS(take_picture),
        OPS(cancel_picture), 
        OPS(set_parameters), 
        OPS(get_parameters), 
        OPS(put_parameters), 
        OPS(send_command),
        OPS(release),
        OPS(dump)
    },
    OPS(mtk_set_callbacks),

    #undef  OPS
};

回到createCam1Device函式，最後呼叫了pdev->initialize函式，這個函式過程比較複雜，在它的父類Cam1DeviceBase中實現

bool
DefaultCam1Device::
onInit()
{
    //  (1) power on sensor
    if( pthread_create(&mThreadHandle, NULL, doThreadInit, this) != 0 )
    {
        goto lbExit;
    }

    //  (2) Open 3A
    mpHal3a = NS3A::IHal3A::createInstance(
            NS3A::IHal3A::E_Camera_1,
            getOpenId(),
            LOG_TAG);

    //  (3) Init Base.
    if  ( ! Cam1DeviceBase::onInit() )
    {
        goto lbExit;
    }
}

status_t
Cam1DeviceBase::
initialize()
{
    onInit();
    return  OK;  
}

initialize函式只是簡單的回調了onInit函式，如註釋所示，主要做了3件事情。其中(2)和(3)主要是初始化3A和CamClient，這兩個這裡暫時不會關注，所以暫時不進行分析。重點關注(1)，也就是doThreadInit函式

bool
DefaultCam1Device::
powerOnSensor()
{
    IHalSensorList* pHalSensorList = IHalSensorList::get();
    mpHalSensor = pHalSensorList->createSensor(USER_NAME, getOpenId());
    sensorIdx = getOpenId();
    if( !mpHalSensor->powerOn(USER_NAME, 1, &sensorIdx) )
    {
        MY_LOGE("sensor power on failed: %d", sensorIdx);
        goto lbExit;
    }
    ......
}

void*   
DefaultCam1Device::
doThreadInit(void* arg)
{
    DefaultCam1Device* pSelf = reinterpret_cast<DefaultCam1Device*>(arg);
    pSelf->mRet = pSelf->powerOnSensor();
    pthread_exit(NULL);
    return NULL;
}

doThreadInit函式只是回撥自身的了powerOnSensor函式，而powerOnSensor函式先呼叫pHalSensorList->createSensor函式建立一個HalSensor例項，然後再呼叫它的PowerOn函式來開始相關的硬體操作，來看powerOn的實現

MBOOL
HalSensor::
powerOn(
    char const* szCallerName,
    MUINT const uCountOfIndex,
    MUINT const*pArrayOfIndex
)
{
    ......
    ret = mpSeninfDrv->init();
    ret = mpSensorDrv->init(sensorDev);
    ret = setTgPhase(sensorDev, pcEn);
    ret = setSensorIODrivingCurrent(sensorDev);
    ret = mpSensorDrv->open(sensorDev);
    ......
}

powerOn函式比較長，這裡暫時只關注SensorDrv的init和open函式

MINT32
ImgSensorDrv::init(MINT32 sensorIdx)
{
    m_fdSensor = ::open("dev/kd_camera_hw", O_RDWR);

    //set driver
    ret = ioctl(m_fdSensor, KDIMGSENSORIOC_X_SET_DRIVER,sensorDrvInit);

    //init resolution
    pSensorResInfo[0] = &m_SenosrResInfo[0];
    pSensorResInfo[1] = &m_SenosrResInfo[1];
    ret = getResolution(pSensorResInfo);

    if(SENSOR_MAIN & sensorIdx ) {
        sensorDevId = SENSOR_MAIN;

        FeatureParaLen = sizeof(MUINTPTR);
        ret = featureControl((CAMERA_DUAL_CAMERA_SENSOR_ENUM)sensorDevId, SENSOR_FEATURE_GET_PIXEL_CLOCK_FREQ,  (MUINT8*)&FeaturePara32,(MUINT32*)&FeatureParaLen);

        FeatureParaLen = sizeof(pFeaturePara16);
        ret = featureControl((CAMERA_DUAL_CAMERA_SENSOR_ENUM)sensorDevId, SENSOR_FEATURE_GET_PERIOD,  (MUINT8*)pFeaturePara16,(MUINT32*)&FeatureParaLen);
    }
    ......
}

MINT32
ImgSensorDrv::open(MINT32 sensorIdx)
{
    MINT32 err = SENSOR_NO_ERROR;

    ......
    err = ioctl(m_fdSensor, KDIMGSENSORIOC_X_SET_CURRENT_SENSOR, &sensorIdx);
    err = ioctl(m_fdSensor, KDIMGSENSORIOC_T_OPEN);

    return err;
}

這兩個函式邏輯比較簡單，就是通過ioctl進入到kernel層來對sensor硬體進行初始化和獲取硬體相關的資訊。kernel層的程式碼暫不分析

4.4 get_hw_device函式分析

回到4.1的openDeviceLocked函式，最後呼叫了pDevice->get_hw_device函式，並將它的返回值賦給*device

class Cam1Device : public ICamDevice
{
    virtual hw_device_t const*      get_hw_device() const { return &mDevice.common; }
}

這個函式很簡單，就是獲取4.3裡面提到的mDevice，這個mDevice最終將被儲存在frameworks層的CameraHardwareInterface.h的mDevice變數當中，以便日後訪問

5. 總結

Camera開啟流程的重點工作在4.3和4.4章節，也就是對Camera硬體進行初始化和將gCameraDevOps操作集返回給frameworks層。