Android(安卓)camera系统开发之IPC （三）

二，CameraSerivce服务的注册

同样在init.rc中能看到如下语句

service media /system/bin/mediaserver

user media

group system audio camera graphics inet net_bt net_bt_admin

这个服务的入口是Main_mediaservice.c中的main()函数。而且是在servicemanager服务之后才启动的。

2.1 CameraSerivce服务的注册入口

@Main_mediaservice.c）

int main(int argc, char** argv)
{
sp<ProcessState> proc(ProcessState::self());
sp<IServiceManager> sm = defaultServiceManager();//取得Service_Manager的代理句柄

AudioFlinger::instantiate(); //Audio 服务
MediaPlayerService::instantiate(); //mediaPlayer服务
CameraService::instantiate(); //Camera 服务
ProcessState::self()->startThreadPool(); //为进程开启缓冲池
IPCThreadState::self()->joinThreadPool(); //将进程加入到缓冲池
}

这个函数也比较简单，就是几个子服务的初始化。这里我们只

关心CameraService的初始化。最后这个函数将启动自己的线程，等待其他应用来请求服务。

2.2 Camera 服务的初始化

@CameraService.cpp
void CameraService::instantiate() {
defaultServiceManager()->addService(
String16("media.camera"), new CameraService());
}

这个函数非常简单，就是取得服务管理器的代理句柄，并调用他们的addServie服务函数，addService的参数要注意，一是”media.camera” 字符串，在获取的时候，就要输入这个字符串。在getService的时候将看到这一样的字符串。

另外第二个参数传入的是CameraService类的一个对象。

在我们获取这个服务的时候，将获得CameraService类的一个代理对象。

2.3 获取服务管理器的代理句柄

@IServiceManager.cpp
sp<IServiceManager> defaultServiceManager()
{
if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
{
if (gDefaultServiceManager == NULL)

{
gDefaultServiceManager = interface_cast<IServiceManager>(
ProcessState::self()->getContextObject(NULL));
}
}
return gDefaultServiceManager;
}

这个函数第一次被调用前gDefaultServiceManager为NULL，因此系统要调用ProcessState::self()获取一个ProcessState实例。该ProcessState会打开/dev/binder驱动供IPCThreadState使用，从而确保supportsProcesses()返回 true.

@ProcessState.cpp

sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller)

{// caller这个参数被忽略。

if (supportsProcesses()) {

return getStrongProxyForHandle(0);// caller这个参数被忽略，直接传入参数0

} else {

return getContextObject(String16("default"), caller);

}

@ProcessState.cpp

bool ProcessState::supportsProcesses() const

{ return mDriverFD >= 0; //表示如果有IBinder驱动，则返回为true.}

@ProcessState.cpp

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)

{

sp<IBinder> result;

handle_entry* e = lookupHandleLocked(handle);

if (e != NULL) {

IBinder* b = e->binder;

if (b == NULL || !e->refs->attemptIncWeak(this)) {

b = new BpBinder(handle);

e->binder = b;

if (b) e->refs = b->getWeakRefs();

result = b;

} else {

result.force_set(b);

e->refs->decWeak(this);

}

return result; //通过getContextObject返回一个BpBinder实例

}

在第一次调用时，b为NULL，因此会先创建一个BpBinder实例。

从以上调用关系可知ProcessState::self()->getContextObject(NULL)最终将返回一个BpBinder实例，这个函数的返回值将作为interface_cast<IServiceManager>(obj)的参数。

2.4 BpBinder实例转换为IServiceManager接口

interface_cast定义如下：

@IInterface.h

template<typename INTERFACE>

inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)

{

return INTERFACE::asInterface(obj);

}

查找INTERFACE::asInterface(obj)定义如下

@IInterface.h

#defineIMPLEMENT_META_INTERFACE(INTERFACE, NAME) /

const String16 I##INTERFACE::descriptor(NAME); /

const String16 &I##INTERFACE::getInterfaceDescriptor() const /

return I##INTERFACE::descriptor; /

} /

sp<I##INTERFACE> I##INTERFACE::asInterface(const sp<IBinder>& obj) /

{ /

sp<I##INTERFACE> intr; /

if(obj!=NULL) /

intr= static_cast<I##INTERFACE*>( / obj->queryLocalInterface( /

I##INTERFACE::descriptor).get()); /

if (intr==NULL) /

intr = new Bp##INTERFACE(obj); /

} /

return intr; /

} /

I##INTERFACE::I##INTERFACE(){} /

I##INTERFACE::~I##INTERFACE(){} /

将这个宏interface_cast<IServiceManager>(obj)扩展后最终得到的是：
sp<IServiceManager> IServiceManager::asInterface(const sp<IBinder>& obj)
{
sp<IServiceManager> intr;
if (obj != NULL) {
intr = static_cast<IServiceManager*>(
obj->queryLocalInterface(
IServiceManager::descriptor).get());
if (intr == NULL) {
intr = new BpServiceManager(obj);
}
}
return intr;
}

即返回一个BpServiceManager对象,这里obj就是前面创建的BpBInder对象

2.5 BpServiceManager对象与IServiceManager的关系

@IServiceManager.cpp

从class BpServiceManager定义就可知道，BpServiceManager是IServiceManager的基类，也就是IServiceManager的一个实现类。

class BpServiceManager : public BpInterface<IServiceManager>

{

public:

BpServiceManager(const sp<IBinder>& impl)

: BpInterface<IServiceManager>(impl)

{

}

2.6 Camera Service注册具体过程。

获得BpServiceManager对象后，

instantiate()函数会调用IServiceManager::addService (String16("media.camera"), new CameraService());

我们看到传递给IServiceManager::addService的参数是一个CameraService实例化地址，而CameraService继成于BnCameraService

BnCameraService继成于BnInterface，BnInterface继成于BBinder

BBinder继成于IBinder。

IServiceManager::addService将毁调用到BpServiceManager::addService

因为IServiceManager::addService是纯虚函数。

@IServiceManager.cpp

virtual status_t addService(const String16& name, const sp<IBinder>& service)

{Parcel data, reply; data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());

data.writeString16(name);

data.writeStrongBinder(service);

status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);

return err == NO_ERROR ? reply.readInt32() : err;

}

首先注意data.writeStrongBinder(service)

@Parcel.cpp

status_t Parcel::writeStrongBinder(const sp<IBinder>& val)

{

return flatten_binder(ProcessState::self(), val, this);

}

status_t flatten_binder(const sp<ProcessState>& proc,

const sp<IBinder>& binder, Parcel* out)

{

flat_binder_object obj;

obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;

if (binder != NULL) {

IBinder *local = binder->localBinder();

if (!local) {

BpBinder *proxy = binder->remoteBinder();

if (proxy == NULL) {

LOGE("null proxy");

}

const int32_t handle = proxy ? proxy->handle() : 0;

obj.type = BINDER_TYPE_HANDLE;

obj.handle = handle;

obj.cookie = NULL;

} else {//我们知道传进的是一个CameraService对象，所以会走到这个分支来

obj.type = BINDER_TYPE_BINDER;

//在binder_transaction()函数中会检查这个类型，并生成这个 binder对应的handle，系统有了handle后，通过readStrongBinder()àunflatten_binder()就可以生成对应的BpBinder对象。

obj.binder = local->getWeakRefs();

obj.cookie = local;

}

} else {

obj.type = BINDER_TYPE_BINDER;

obj.binder = NULL;

obj.cookie = NULL;

}

return finish_flatten_binder(binder, obj, out);

}

其次注意这里的remote()将返回我们前面得BpBinder对象

我们还记得intr = new BpServiceManager(obj);

@IServiceManager.cpp

而BpServiceManager(const sp<IBinder>& impl)

: BpInterface<IServiceManager>(impl)//基类BpInterface

{

}

@IInterface.h

template<typename INTERFACE>

inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)

: BpRefBase(remote) //基类BpRefBase

{

}

@ Binder.cpp

BpRefBase::BpRefBase(const sp<IBinder>& o)

: mRemote(o.get()), mRefs(NULL), mState(0)

{

extendObjectLifetime(OBJECT_LIFETIME_WEAK);

if (mRemote) {

mRemote->incStrong(this); // Removed on first IncStrong().

mRefs = mRemote->createWeak(this); // Held for our entire lifetime.

}

@include/binder/Binder.h

class BpRefBase : public virtual RefBase

{

protected:

BpRefBase(const sp<IBinder>& o);

virtual ~BpRefBase();

virtual void onFirstRef();

virtual void onLastStrongRef(const void* id);

virtual bool onIncStrongAttempted(uint32_t flags, const void* id);

inline IBinder* remote() { return mRemote; }

….

@BpBinder.cpp

status_t BpBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{

status_t status = IPCThreadState::self()->transact(
mHandle, code, data, reply, flags);

}

mHandle为0，BpBinder往下调用IPCThreadState:transact函数将数据发给与mHandle相关联的Service Manager Process。
status_t IPCThreadState::transact(int32_t handle,
uint32_t code, const Parcel& data,
Parcel* reply, uint32_t flags)
{
....

err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
if (reply) {
err = waitForResponse(reply);
} else {
Parcel fakeReply;
err = waitForResponse(&fakeReply);
}
....
}

IPCThreadState::transact首先调用writeTransactionData函数为binder内核驱动构造一个transaction结构。

@IPCThreadState.cpp

status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags, int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)

{

binder_transaction_data tr;

tr.target.handle = handle;

tr.code = code;

tr.flags = binderFlags;

const status_t err = data.errorCheck();

if (err == NO_ERROR) {

tr.data_size = data.ipcDataSize();

tr.data.ptr.buffer = data.ipcData();

tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);

tr.data.ptr.offsets = data.ipcObjects();

}

…

mOut.writeInt32(cmd);

mOut.write(&tr, sizeof(tr));

}

waitForResponse将调用talkWithDriver与对Binder kernel进行读写操作。当Binder kernel接收到数据后，service_mananger线程的ThreadPool就会启动

@IPCThreadState.cpp

status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
while (1) {
if ((err=talkWithDriver()) < NO_ERROR) break;

..............................................
}

@IPCThreadState.cpp

status_t IPCThreadState::talkWithDriver(bool doReceive)
{
....

if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
err = NO_ERROR;
...
}

系统分析到这里，事务数据已经发送到了binder驱动，下面将讨论binder驱动的相关处理过程。

@ drivers/misc/binder.c

static int binder_open(struct inode *nodp, struct file *filp)

{

struct binder_proc *proc;

if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)

proc = kzalloc(sizeof(*proc), GFP_KERNEL);

get_task_struct(current);

proc->tsk = current;

INIT_LIST_HEAD(&proc->todo);

init_waitqueue_head(&proc->wait);

proc->default_priority = task_nice(current);

mutex_lock(&binder_lock);

binder_stats.obj_created[BINDER_STAT_PROC]++;

hlist_add_head(&proc->proc_node, &binder_procs);

proc->pid = current->group_leader->pid;

INIT_LIST_HEAD(&proc->delivered_death);

filp->private_data = proc;

mutex_unlock(&binder_lock);

if (binder_proc_dir_entry_proc) {

char strbuf[11];

snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);

create_proc_read_entry(strbuf, S_IRUGO, binder_proc_dir_entry_proc, binder_read_proc_proc, proc);

}

return 0;

}

当任何进程打开/dev/binder驱动时，会分配相应的binder_proc结构（给进程）。因此当进行ioctl调用时，binder系统通过binder_proc结构知道应该和那个进程交换数据了。

Client与Binder Driver交互过程:

@ drivers/misc/binder.c

static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)

{

thread = binder_get_thread(proc); //根据当前caller进程消息获取该进程线程池数据结构

......

switch (cmd) {

case BINDER_WRITE_READ: {

struct binder_write_read bwr;

if (size != sizeof(struct binder_write_read)) {

ret = -EINVAL;

goto err;

}

if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {

ret = -EFAULT;

goto err;

}

if (bwr.write_size > 0) {

ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed);

if (ret < 0) {

bwr.read_consumed = 0;

if (copy_to_user(ubuf, &bwr, sizeof(bwr)))

ret = -EFAULT;

goto err;

}

if (bwr.read_size > 0) {

ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK);

if (!list_empty(&proc->todo))

wake_up_interruptible(&proc->wait);// 恢复挂起的caller进程

if (ret < 0) {

if (copy_to_user(ubuf, &bwr, sizeof(bwr)))

ret = -EFAULT;

goto err;

}

if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {

ret = -EFAULT;

goto err;

}

break;

}

......

}

驱动首先处理写，然后读。让我们先看看binder_thread_write()函数。该函数的核心是一个从写缓冲中解析命令并执行该命令。

@ drivers/misc/binder.c

Int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,void __user *buffer, int size, signed long *consumed)

{

uint32_t cmd;

void __user *ptr = buffer + *consumed;

void __user *end = buffer + size;

while (ptr < end && thread->return_error == BR_OK) {

if (get_user(cmd, (uint32_t __user *)ptr))

return -EFAULT;

ptr += sizeof(uint32_t);

if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {

binder_stats.bc[_IOC_NR(cmd)]++;

proc->stats.bc[_IOC_NR(cmd)]++;

thread->stats.bc[_IOC_NR(cmd)]++;

}

switch (cmd) {

case BC_INCREFS:

…

case BC_TRANSACTION://IPCThreadState通过writeTransactionData()设置该cmd
case BC_REPLY: {
struct binder_transaction_data tr;

if (copy_from_user(&tr, ptr, sizeof(tr)))
return -EFAULT;
ptr += sizeof(tr);
binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
break;

default:

…

}

*consumed = ptr - buffer;

}

return 0;

}

在binder_transaction ()中，首先设置target_node，target_proc和target_thread，并将请求放入链表，并唤醒binder_thread_read()中的等待线程。

@ drivers/misc/binder.c

static void binder_transaction(struct binder_proc *proc, struct binder_thread *thread, struct binder_transaction_data *tr, int reply)

{

target_node = binder_context_mgr_node;

e->to_node = target_node->debug_id;

target_proc = target_node->proc;

…

struct binder_transaction *tmp;

tmp = thread->transaction_stack;

while (tmp) {

if (tmp->from && tmp->from->proc == target_proc)

target_thread = tmp->from;

tmp = tmp->from_parent;

}

…

switch (fp->type) {

case BINDER_TYPE_BINDER:// writeStrongBinder()àflatten_binder()

会设置这个type

case BINDER_TYPE_WEAK_BINDER: {

struct binder_ref *ref;

struct binder_node *node = binder_get_node(proc, fp->binder);

if (node == NULL) {

node = binder_new_node(proc, fp->binder, fp->cookie);

…

}

ref = binder_get_ref_for_node(target_proc, node);

if (fp->type == BINDER_TYPE_BINDER)

fp->type = BINDER_TYPE_HANDLE;

else

fp->type = BINDER_TYPE_WEAK_HANDLE;

fp->handle = ref->desc;//生成handle,以后通过他创建BpBinder

} break;

......

t->work.type = BINDER_WORK_TRANSACTION;

list_add_tail(&t->work.entry, target_list);

tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;

list_add_tail(&tcomplete->entry, &thread->todo);

if (target_wait)

wake_up_interruptible(target_wait);//唤醒服务器中的线程

return;

......

}

这样数据就写入binder Driver中，service_manager的读将获得数据

从而binder_thread_read()将数据读给service_manager.

@ drivers/misc/binder.c

static int binder_thread_read(struct binder_proc *proc, struct binder_thread *thread, void __user *buffer, int size, signed long *consumed, int non_block)

{

......

下面的语句将client的写缓冲区的数据拷贝到service_manager的读缓冲区。

tr.data_size = t->buffer->data_size;

tr.offsets_size = t->buffer->offsets_size;

tr.data.ptr.buffer = (void *)((void *)t->buffer->data + proc->user_buffer_offset);

tr.data.ptr.offsets = tr.data.ptr.buffer + ALIGN(t->buffer->data_size, sizeof(void *));

if (put_user(cmd, (uint32_t __user *)ptr))

return -EFAULT;

ptr += sizeof(uint32_t);

if (copy_to_user(ptr, &tr, sizeof(tr)))

return -EFAULT;

ptr += sizeof(tr);

…

}

到现在为止，service_manager已经得到了一个从client发送过来的BR_TRANSACTION类型的数据包，service_manager将通过binder_parse()来分析这些数据包并作相应处理.最后通过binder_send_reply()返回处理结果.

binder_loop()函数

@Service_manager.c
void binder_loop(struct binder_state *bs, binder_handler func)
{
…
binder_write(bs, readbuf, sizeof(unsigned));

for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (unsigned) readbuf;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr); //如果没有要处理的请求进程将挂起
if (res < 0) {
LOGE("binder_loop: ioctl failed (%s)/n", strerror(errno));
break;
}
res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);//这里func就是
//svcmgr_handler

…
}
}

@ frameworks/base/cmds/servicemanager/binder.c

int binder_parse(struct binder_state *bs, struct binder_io *bio,

uint32_t *ptr, uint32_t size, binder_handler func)

{

......

case BR_TRANSACTION: {

struct binder_txn *txn = (void *) ptr;

binder_dump_txn(txn);

if (func) {

unsigned rdata[256/4];

struct binder_io msg;

struct binder_io reply;

int res;

bio_init(&reply, rdata, sizeof(rdata), 4);

bio_init_from_txn(&msg, txn);

res = func(bs, txn, &msg, &reply); // 即svcmgr_handler()

binder_send_reply(bs, &reply, txn->data, res);

}

ptr += sizeof(*txn) / sizeof(uint32_t);

break;

}

......

}

binder_parse会调用svcmgr_handler（也就是参数func）,按照BpServerManager相反的步骤处理BR_TRANSACTION数据包。这里binder_txn结构实际上与binder_transaction_data结构是一样的。在本文的例子中，事务码（transaction code）为SVC_MGR_ADD_SERVICE。

@/frameworks/base/cmds/servicemanager/binder.c

int svcmgr_handler(struct binder_state *bs,

struct binder_txn *txn,

struct binder_io *msg,

struct binder_io *reply)

{

…

s = bio_get_string16(msg, &len);

…

switch(txn->code) {

case SVC_MGR_GET_SERVICE:

case SVC_MGR_CHECK_SERVICE:

s = bio_get_string16(msg, &len);

ptr = do_find_service(bs, s, len);

bio_put_ref(reply, ptr);

return 0;

case SVC_MGR_ADD_SERVICE:

s = bio_get_string16(msg, &len);

ptr = bio_get_ref(msg);

if (do_add_service(bs, s, len, ptr, txn->sender_euid))

return -1;

break;

default:

return -1;

}

bio_put_uint32(reply, 0);

return 0;

}

于是service_manager通过bio_get_ref()获取到这个服务的相关信息。并进行注册处理.

@frameworks/base/cmds/servicemanager/binder.c

void *bio_get_ref(struct binder_io *bio)

{

struct binder_object *obj;

obj = _bio_get_obj(bio);

if (obj->type == BINDER_TYPE_HANDLE)

return obj->pointer;

return 0;

}

svcmgr_handler()返回后将通过binder_send_reply()将反馈结果给 client的Binder driver,最后返回到IPCThreadState::waitForResponse(),并退回到IPCThreadState::transact(),

再退回到BpBinder::transact(),再退回到BpServiceManager ::addService(),CameraService::instantiate(),最后退回到main()@main_mediaserver.cpp,从而完成CameraService的注册

更多相关文章

随机推荐