Android : Camera2/HAL3 ????????????

Posted 2021-02-14

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Android : Camera2/HAL3 ????????????相关的知识，希望对你有一定的参考价值。

??????????????? ???????????? update ???????????? tst tap thread only dia

??????Android O??????Treble?????????

????????? android O ??????????????????????????????????????? CameraProvider ?????????????????? cameraserver ???????????????????????????????????????????????? [email protected] ???????????? camera HAL???cameraserver?????? HIDL ?????????camera provider???????????????HIDL????????? Android O ??????????????? Treble ????????????????????????????????? service ??? HAL ?????????????????? HAL ???????????????????????????????????? APP ??? Framework ????????? Binder ????????????????????????????????????????????????????????????????????????????????????????????? Local call ????????? Remote call??????????????????

??????????????????

??????

cameraserver ??? provider ???????????????????????????????????????????????????????????????

??????????????????

??????Camera HAL3??????????????????

???1.Camera HAL3 ??????????????????????????????????????????????????????????????????????????????????????????????????????

??????

???2.??? App ??? CameraService???????????????

????????? Application ????????? CameraService??????????????? Android ???????????????????????????App ??????Framework ??????Runtime ???????????????App ??????????????? Framework ??????????????????????????? Framework ??????????????? Binder ???????????? Runtime ??? CameraService ????????????
???????????????????????????????????????????????????????????????
??????

????????? App ?????????????????????????????????API??????:

CameraCharacteristics??????????????????????????????????????????????????????CameraManager???getCameraCharacteristics(@NonNull String cameraId)??????????????????
CameraDevice?????????????????????????????????????????????Camera???
CameraCaptureSession???Session????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? capture()??????
CaptureRequest???????????????????????????????????????????????????????????????????????????CaptureRequest??????????????????????????????????????????CameraRequest???????????????????????????
CaptureResult????????????????????????????????????

??????????????????camera???java?????????

???mCameraManager.openCamera(currentCameraId, stateCallback, backgroundHandler);

??????Camera2???????????????????????????

??????

???(1)Framework CameraManager ???/frameworks/base/core/java/android/hardware/camera2/CameraManager.java

??????????????????????????? CameraManager ??? openCamera ???????????????????????????????????????????????????????????? openCameraForUid ?????????

@RequiresPermission(android.Manifest.permission.CAMERA)
public void openCamera(@NonNull String cameraId,
        @NonNull final CameraDevice.StateCallback callback, @Nullable Handler handler)
        throws CameraAccessException {

    openCameraForUid(cameraId, callback, handler, USE_CALLING_UID);
}

??????????????????????????????????????????????????????????????????????????????????????? openCameraDeviceUserAsync ?????????

public void openCameraForUid(@NonNull String cameraId,
        @NonNull final CameraDevice.StateCallback callback, @Nullable Handler handler,
        int clientUid)
        throws CameraAccessException {
    /* Do something in*/
    ......
    /* Do something out*/
    openCameraDeviceUserAsync(cameraId, callback, handler, clientUid);
}

?????????????????????????????????

private CameraDevice openCameraDeviceUserAsync(String cameraId,
        CameraDevice.StateCallback callback, Handler handler, final int uid)
        throws CameraAccessException {
    CameraCharacteristics characteristics = getCameraCharacteristics(cameraId);
    CameraDevice device = null;

    synchronized (mLock) {

        ICameraDeviceUser cameraUser = null;

        android.hardware.camera2.impl.CameraDeviceImpl deviceImpl =   //??????????????? CameraDeviceImpl????????????????????? CameraDevice.StateCallback ?????? Handler???
                new android.hardware.camera2.impl.CameraDeviceImpl(  
                    cameraId,
                    callback,
                    handler,
                    characteristics,
                    mContext.getApplicationInfo().targetSdkVersion);

        ICameraDeviceCallbacks callbacks = deviceImpl.getCallbacks(); //?????? CameraDeviceCallback ??????????????????????????????????????? CameraDeviceImpl ????????????

       try {
            if (supportsCamera2ApiLocked(cameraId)) {  //HAL3 ????????????????????????????????????????????? CameraManagerGlobal ????????? CameraService ???????????????????????????????????????????????? Binder ????????? connectDevice ??????????????????????????????
????????????????????????????????????????????????????????????????????????????????????????????????//??????????????? cameraUser ??????????????????????????? CameraDeviceClient ??????????????????
                // Use cameraservice???s cameradeviceclient implementation for HAL3.2+ devices
                ICameraService cameraService = CameraManagerGlobal.get().getCameraService();
                if (cameraService == null) {
                    throw new ServiceSpecificException(
                        ICameraService.ERROR_DISCONNECTED,
                        "Camera service is currently unavailable");
                }
                cameraUser = cameraService.connectDevice(callbacks, cameraId,
                        mContext.getOpPackageName(), uid);
            } else {
                // Use legacy camera implementation for HAL1 devices
                int id;
                try {
                    id = Integer.parseInt(cameraId);
                } catch (NumberFormatException e) {
                    throw new IllegalArgumentException("Expected cameraId to be numeric, but it was: "
                            + cameraId);
                }

                Log.i(TAG, "Using legacy camera HAL.");
                cameraUser = CameraDeviceUserShim.connectBinderShim(callbacks, id);
            }
        } catch (ServiceSpecificException e) {
            /* Do something in */
            ......
            /* Do something out */
        }

        // TODO: factor out callback to be non-nested, then move setter to constructor
        // For now, calling setRemoteDevice will fire initial
        // onOpened/onUnconfigured callbacks.
        // This function call may post onDisconnected and throw CAMERA_DISCONNECTED if
        // cameraUser dies during setup.
        deviceImpl.setRemoteDevice(cameraUser); //??? CameraDeviceClient ????????? CameraDeviceImpl ??????????????????
        device = deviceImpl;
    }

    return device;
}

???(2)CameraDeviceImpl : /frameworks/base/core/java/android/hardware/camera2/Impl/CameraDeviceImpl.java

????????????????????????????????????????????????????????????????????????????????? CameraDeviceImpl ??????setRemoteDevice ????????????????????????????????????????????????????????????

/**
 * Set remote device, which triggers initial onOpened/onUnconfigured callbacks
 *
 * <p>This function may post onDisconnected and throw CAMERA_DISCONNECTED if remoteDevice dies
 * during setup.</p>
 *
 */
public void setRemoteDevice(ICameraDeviceUser remoteDevice) throws CameraAccessException {
    synchronized(mInterfaceLock) {
        // TODO: Move from decorator to direct binder-mediated exceptions
        // If setRemoteFailure already called, do nothing
        if (mInError) return;

        mRemoteDevice = new ICameraDeviceUserWrapper(remoteDevice); //?????? ICameraDeviceUserWrapper ??????????????????????????????????????????

        IBinder remoteDeviceBinder = remoteDevice.asBinder(); //?????? Binder ??????????????????????????????
        // For legacy camera device, remoteDevice is in the same process, and
        // asBinder returns NULL.
        if (remoteDeviceBinder != null) {
            try {
                remoteDeviceBinder.linkToDeath(this, /*flag*/ 0); //????????????binder????????????????????????????????????????????????
            } catch (RemoteException e) {
                CameraDeviceImpl.this.mDeviceHandler.post(mCallOnDisconnected);

                throw new CameraAccessException(CameraAccessException.CAMERA_DISCONNECTED,
                        "The camera device has encountered a serious error");
            }
        }

        mDeviceHandler.post(mCallOnOpened); //??????????????? onOpened ??? onUnconfigured ?????????????????????????????????????????? mDeviceHandler ????????????????????????????????????
        mDeviceHandler.post(mCallOnUnconfigured);
    }
}

??????3???Runtime????????? Binder ?????????????????????????????? connectDevice ???????????? C++ ????????????????????????????????????????????????????????????????????????????????? CameraService ?????????

??????4???CameraService???/frameworks/av/services/camera/libcameraservice/CameraService.cpp

Status CameraService::connectDevice(
        const sp<hardware::camera2::ICameraDeviceCallbacks>& cameraCb,
        const String16& cameraId,
        const String16& clientPackageName,
        int clientUid,
        /*out*/
        sp<hardware::camera2::ICameraDeviceUser>* device) {

    ATRACE_CALL();
    Status ret = Status::ok();
    String8 id = String8(cameraId);
    sp<CameraDeviceClient> client = nullptr;

?????? //??????????????? connectHelper ???????????????????????????????????????HAL1 ???????????????????????????????????????????????????????????????????????????????????? ICameraDeviceCallbacks ?????? CameraDeviceClient???
    ret = connectHelper<hardware::camera2::ICameraDeviceCallbacks,CameraDeviceClient>(cameraCb, id,
            CAMERA_HAL_API_VERSION_UNSPECIFIED, clientPackageName,
            clientUid, USE_CALLING_PID, API_2,
            /*legacyMode*/ false, /*shimUpdateOnly*/ false,
            /*out*/client);

    if(!ret.isOk()) {
        logRejected(id, getCallingPid(), String8(clientPackageName),
                ret.toString8());
        return ret;
    }

    *device = client; //client ?????????????????? CameraDeviceClient??????????????????????????????????????????
    return ret;
}

??????connectHelper ???????????????????????????????????????????????????????????????

template<class CALLBACK, class CLIENT>
Status CameraService::connectHelper(const sp<CALLBACK>& cameraCb, const String8& cameraId,
        int halVersion, const String16& clientPackageName, int clientUid, int clientPid,
        apiLevel effectiveApiLevel, bool legacyMode, bool shimUpdateOnly,
        /*out*/sp<CLIENT>& device) {
    binder::Status ret = binder::Status::ok();

    String8 clientName8(clientPackageName);

    /* Do something in */
    ......
    /* Do something out */

        sp<BasicClient> tmp = nullptr;
        //?????? makeClient ?????? CameraDeviceClient ?????????
        if(!(ret = makeClient(this, cameraCb, clientPackageName, cameraId, facing, clientPid,
                clientUid, getpid(), legacyMode, halVersion, deviceVersion, effectiveApiLevel,
                /*out*/&tmp)).isOk()) {
            return ret;
        }
        //????????? CLIENT ???????????????????????????????????? CLIENT ?????? CameraDeviceClient?????????????????? mCameraProviderManager ????????? HAL service ????????? 
        client = static_cast<CLIENT*>(tmp.get());

        LOG_ALWAYS_FATAL_IF(client.get() == nullptr, "%s: CameraService in invalid state",
                __FUNCTION__);

        err = client->initialize(mCameraProviderManager);

    /* Do something in */
    ......
    /* Do something out */

    // Important: release the mutex here so the client can call back into the service from its
    // destructor (can be at the end of the call)
    device = client;
    return ret;
}

??????makeClient ??????????????? API ???????????? HAL ?????????????????????????????? Client ?????????Client ????????????????????????????????????????????? CameraDeviceImpl ???????????????????????? mRemoteDevice???

Status CameraService::makeClient(const sp<CameraService>& cameraService,
        const sp<IInterface>& cameraCb, const String16& packageName, const String8& cameraId,
        int facing, int clientPid, uid_t clientUid, int servicePid, bool legacyMode,
        int halVersion, int deviceVersion, apiLevel effectiveApiLevel,
        /*out*/sp<BasicClient>* client) {

    if (halVersion < 0 || halVersion == deviceVersion) {
        // Default path: HAL version is unspecified by caller, create CameraClient
        // based on device version reported by the HAL.
        switch(deviceVersion) {
          case CAMERA_DEVICE_API_VERSION_1_0:
            /* Do something in */
            ......
            /* Do something out */
          case CAMERA_DEVICE_API_VERSION_3_0:
          case CAMERA_DEVICE_API_VERSION_3_1:
          case CAMERA_DEVICE_API_VERSION_3_2:
          case CAMERA_DEVICE_API_VERSION_3_3:
          case CAMERA_DEVICE_API_VERSION_3_4:
            if (effectiveApiLevel == API_1) { // Camera1 API route
                sp<ICameraClient> tmp = static_cast<ICameraClient*>(cameraCb.get());
                *client = new Camera2Client(cameraService, tmp, packageName, cameraIdToInt(cameraId),
                        facing, clientPid, clientUid, servicePid, legacyMode);
            } else { // Camera2 API route : ???????????? CameraDeviceClient ????????? Client?????????????????????????????? ICameraDeviceCallbacks?????????????????? CameraDeviceImpl ??????????????????
                sp<hardware::camera2::ICameraDeviceCallbacks> tmp =
                        static_cast<hardware::camera2::ICameraDeviceCallbacks*>(cameraCb.get());
                *client = new CameraDeviceClient(cameraService, tmp, packageName, cameraId,
                        facing, clientPid, clientUid, servicePid);
            }
            break;
          default:
            // Should not be reachable
            ALOGE("Unknown camera device HAL version: %d", deviceVersion);
            return STATUS_ERROR_FMT(ERROR_INVALID_OPERATION,
                    "Camera device "%s" has unknown HAL version %d",
                    cameraId.string(), deviceVersion);
        }
    } else {
        /* Do something in */
        ......
        /* Do something out */
    }
    return Status::ok();
}

?????????????????????????????????????????? App ??? CameraService ??????????????????????????????????????????

??????????????????:

??????

??????Ps???

CameraManagerGlobal ?????????????????????????????? JAVA ?????? CameraService ?????????????????????????????????????????????
CameraDeviceImpl ??????????????????????????????????????? Android N ????????? JNI ??????

???3.??? CameraService ??? HAL Service

???????????? Android O ???????????? Treble ?????????CameraServer ??????????????? CameraService??????????????????????????? Provider service??????????????????????????? CameraProviderManager ??????????????????????????????????????????????????????????????????
????????? Provider service ?????????????????? CameraProvider??????????????????????????????????????? libhardware ??? Camera HAL ?????????????????? CameraModule ??????????????????
???????????????????????????????????? “??????” ?????????????????????????????????????????? QCamera3HWI ?????????????????????????????????????????????
??????

??????

?????????????????????????????????????????????????????????????????????????????????????????????????????????

??????

?????????????????????????????? CameraService::makeClient ???????????????????????? CameraDeviceClient????????????????????????????????????????????????????????????????????????????????????
??????????????????????????????????????? Runtime ?????????????????? CameraService ??? HAL Service ??????????????????

?????????1???CameraDeviceClient ???frameworksavservicescameralibcameraserviceapi2CameraDeviceClient.cpp

CameraDeviceClient::CameraDeviceClient(const sp<CameraService>& cameraService,
        const sp<hardware::camera2::ICameraDeviceCallbacks>& remoteCallback,
        const String16& clientPackageName,
        const String8& cameraId,
        int cameraFacing,
        int clientPid,
        uid_t clientUid,
        int servicePid) :
    Camera2ClientBase(cameraService, remoteCallback, clientPackageName,
                cameraId, cameraFacing, clientPid, clientUid, servicePid),  //?????????????????? Camera2ClientBase 
    mInputStream(),
    mStreamingRequestId(REQUEST_ID_NONE),
    mRequestIdCounter(0),
    mPrivilegedClient(false) {

    char value[PROPERTY_VALUE_MAX];
    property_get("persist.camera.privapp.list", value, "");
    String16 packagelist(value);
    if (packagelist.contains(clientPackageName.string())) {
        mPrivilegedClient = true;
    }

    ATRACE_CALL();
    ALOGI("CameraDeviceClient %s: Opened", cameraId.string());
}

??????CameraService ????????? CameraDeviceClient ??????????????????????????????????????????

//?????????????????????????????????????????? initialize???
status_t CameraDeviceClient::initialize(sp<CameraProviderManager> manager) {
    return initializeImpl(manager);
}

//??????????????????????????????????????? TProviderPtr ??????????????? CameraProviderManager ??????
template<typename TProviderPtr>
//???????????????????????????????????????????????? CameraProviderManager???
status_t CameraDeviceClient::initializeImpl(TProviderPtr providerPtr) {
    ATRACE_CALL();
    status_t res;

    res = Camera2ClientBase::initialize(providerPtr);
    if (res != OK) {
        return res;
    }

    //??????????????? FrameProcessor ?????????????????????????????????
    String8 threadName;
    mFrameProcessor = new FrameProcessorBase(mDevice);
    threadName = String8::format("CDU-%s-FrameProc", mCameraIdStr.string());
    mFrameProcessor->run(threadName.string());

    mFrameProcessor->registerListener(FRAME_PROCESSOR_LISTENER_MIN_ID,
                                      FRAME_PROCESSOR_LISTENER_MAX_ID,
                                      /*listener*/this,
                                      /*sendPartials*/true);

    return OK;
}

以上是关于Android : Camera2/HAL3 ????????????的主要内容，如果未能解决你的问题，请参考以下文章

Android逆向系列文章— Android基础逆向

Android 逆向Android 权限 ( Android 逆向中使用的 android.permission 权限 | Android 系统中的 Linux 用户权限 )

android 21 是啥版本

Android逆向-Android基础逆向（2-2）

【Android笔记】android Toast