Android远程代理对象BpSurface的获取过程源码分析

在上一篇文章Android SurfaceFlinger服务代理对象获取过程源码分析中介绍了应用程序获取SurfaceFlinger中的各种远程Binder代理对象，SurfaceFlinger为每个应用程序创建Client对象来处理应用程序的Binder请求，同时返回Client的Binder代理对象给应用程序，这样应用程序就可以通过该Binder代理对象来请求SurfaceFlinger创建Surface了，本文在前面章节的基础上 分析Surface在服务端创建对应的Layer对象过程，并将BSurface远程代理对象返回给应用程序。

SurfaceComposerClient mSession = new SurfaceComposerClient();sp<SurfaceControl> control= mSession->createSurface(0, dinfo.h, dinfo.w, PIXEL_FORMAT_RGB_565);

首先在应用程序端构造SurfaceComposerClient对象，在构造过程中，通过ComposerService类查询到SurfaceFlinger服务的远程代理对象，并通过SurfaceFlinger的远程Binder代理对象连接SurfaceFlinger，获取SurfaceFlinger为应用程序创建的Client的远程代理对象，关于应用程序查询SurfaceFlinger服务代理对象，应用程序连接SurfaceFlinger的过程请查看Android SurfaceFlinger服务代理对象获取过程源码分析。得到SurfaceComposerClient对象后，就可以调用该对象的createSurface函数来创建Surface了，同时得到一个SurfaceControl对象。

sp<SurfaceControl> SurfaceComposerClient::createSurface(        DisplayID display, //显示屏ID        uint32_t w, //图像宽度        uint32_t h, //图像高度        PixelFormat format,//图形格式        uint32_t flags)//创建的Surface类型{    String8 name;    const size_t SIZE = 128;    char buffer[SIZE];    snprintf(buffer, SIZE, "<pid_%d>", getpid());//为当前创建的Surface格式化名称：<pid_%d>    name.append(buffer);    return SurfaceComposerClient::createSurface(name, display,w, h, format, flags);}

将当前进程的ID号格式化为<pid_%d>的字符串来命名当前创建的Surface，然后调用SurfaceComposerClient的另一个重载函数createSurface来创建Surface

sp<SurfaceControl> SurfaceComposerClient::createSurface(        const String8& name,        DisplayID display,        uint32_t w,        uint32_t h,        PixelFormat format,        uint32_t flags){    sp<SurfaceControl> result;    if (mStatus == NO_ERROR) {        ISurfaceComposerClient::surface_data_t data;//mClient为服务端Client的远程代理对象BpSurfaceComposerClient，这里请求服务端Client创建Surface        sp<ISurface> surface = mClient->createSurface(&data, name,display, w, h, format, flags);        if (surface != 0) {//根据服务端返回来的ISurface，surface_data_t及当前SurfaceComposerClient对象来构造SurfaceControl对象            result = new SurfaceControl(this, surface, data);        }    }    return result;}

在Android SurfaceFlinger服务代理对象获取过程源码分析中我们知道，应用程序获得Client的远程代理对象BpSurfaceComposerClient后，保存到成员变量mClient中，这里就是通过Client的远程代理对象BpSurfaceComposerClient向服务端的Client请求创建Surface，并得到BSurface的远程Binder代理对象BpSurface，接着利用得到的BpSurface对象及SurfaceComposerClient对象为应用程序创建一个SurfaceControl对象。ISurface也是基于Binder进程通信框架设计的，其在Binder通信框架中的类关系图如下：

由于ISurfaceComposerClient也是基于Binder通信框架的，因此BpSurfaceComposerClient向服务端的Client请求创建Surface的过程分为客户端进程和服务端进程。

客户端进程：

frameworks\native\libs\gui\ISurfaceComposerClient.cpp

virtual sp<ISurface> createSurface( surface_data_t* params,const String8& name,DisplayID display,uint32_t w,uint32_t h,PixelFormat format,uint32_t flags){Parcel data, reply;data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor());data.writeString8(name);data.writeInt32(display);data.writeInt32(w);data.writeInt32(h);data.writeInt32(format);data.writeInt32(flags);remote()->transact(CREATE_SURFACE, data, &reply);params->readFromParcel(reply);return interface_cast<ISurface>(reply.readStrongBinder());}

服务端进程：

frameworks\native\libs\gui\ISurfaceComposerClient.cpp

status_t BnSurfaceComposerClient::onTransact(    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags){     switch(code) {        case CREATE_SURFACE: {            CHECK_INTERFACE(ISurfaceComposerClient, data, reply);            surface_data_t params;            String8 name = data.readString8();            DisplayID display = data.readInt32();            uint32_t w = data.readInt32();            uint32_t h = data.readInt32();            PixelFormat format = data.readInt32();            uint32_t flags = data.readInt32();            sp<ISurface> s = createSurface(¶ms, name, display, w, h,format, flags);            params.writeToParcel(reply);            reply->writeStrongBinder(s->asBinder());            return NO_ERROR;        } break;        default:            return BBinder::onTransact(code, data, reply, flags);    }}

createSurface函数在BnSurfaceComposerClient的子类Client中实现

frameworks\native\services\surfaceflinger\SurfaceFlinger.cpp

sp<ISurface> Client::createSurface(        ISurfaceComposerClient::surface_data_t* params,        const String8& name,        DisplayID display, uint32_t w, uint32_t h, PixelFormat format,        uint32_t flags){//构造一个MessageCreateSurface消息    sp<MessageBase> msg = new MessageCreateSurface(mFlinger.get(),params, name, this, display, w, h, format, flags);//将消息投递到SurfaceFlinger的mEventQueue队列中，并睡眠等待消息处理    mFlinger->postMessageSync(msg);//当消息得到处理后，线程唤醒，读取处理结果    return static_cast<MessageCreateSurface*>( msg.get() )->getResult();}

关于SurfaceFlinger的消息队列这里不做分析。MessageCreateSurface消息被投递到SurfaceFlinger的mEventQueue队列中后，MessageCreateSurface类的handler函数被调用，用来处理MessageCreateSurface消息。

virtual bool handler() {result = flinger->createSurface(params, name, client,display, w, h, format, flags);return true;}

这里又调用SurfaceFlinger的createSurface函数来创建Surface

sp<ISurface> SurfaceFlinger::createSurface(        ISurfaceComposerClient::surface_data_t* params,        const String8& name,        const sp<Client>& client,        DisplayID d, uint32_t w, uint32_t h, PixelFormat format,        uint32_t flags){    sp<LayerBaseClient> layer;    sp<ISurface> surfaceHandle;//图像的宽高必须大于0    if (int32_t(w|h) < 0) {        ALOGE("createSurface() failed, w or h is negative (w=%d, h=%d)",int(w), int(h));        return surfaceHandle;    }//根据flag来判断请求创建的Surface类型，实际创建的是LayerBaseClient对象    sp<Layer> normalLayer;    switch (flags & eFXSurfaceMask) {        case eFXSurfaceNormal:            normalLayer = createNormalSurface(client, d, w, h, flags, format);            layer = normalLayer;            break;        case eFXSurfaceBlur:            // for now we treat Blur as Dim, until we can implement it            // efficiently.        case eFXSurfaceDim:            layer = createDimSurface(client, d, w, h, flags);            break;        case eFXSurfaceScreenshot:            layer = createScreenshotSurface(client, d, w, h, flags);            break;    }    if (layer != 0) {//初始化LayerBaseClient对象        layer->initStates(w, h, flags);        layer->setName(name);        ssize_t token = addClientLayer(client, layer);//从LayerBaseClient对象中取出BSurface本地对象        surfaceHandle = layer->getSurface();        if (surfaceHandle != 0) {//初始化参数params            params->token = token;            params->identity = layer->getIdentity();            if (normalLayer != 0) {                Mutex::Autolock _l(mStateLock);                mLayerMap.add(layer->getSurfaceBinder(), normalLayer);            }        }        setTransactionFlags(eTransactionNeeded);    }    return surfaceHandle;}

该函数首先根据应用程序发送过来的参数来读取请求创建Surface的类型，目前Android系统定义了4种类型的Layer，即eFXSurfaceNormal、eFXSurfaceBlur、eFXSurfaceDim、eFXSurfaceScreenshot。构造完并初始化LayerBaseClient对象，最后从LayerBaseClient对象中取得BSurface本地对象，然后将BSurface对象的远程Binder代理对象返回给应用程序。

sp<Layer> SurfaceFlinger::createNormalSurface(        const sp<Client>& client, DisplayID display,        uint32_t w, uint32_t h, uint32_t flags,        PixelFormat& format){    // initialize the surfaces    switch (format) { // TODO: take h/w into account    case PIXEL_FORMAT_TRANSPARENT:    case PIXEL_FORMAT_TRANSLUCENT:        format = PIXEL_FORMAT_RGBA_8888;        break;    case PIXEL_FORMAT_OPAQUE:#ifdef NO_RGBX_8888        format = PIXEL_FORMAT_RGB_565;#else        format = PIXEL_FORMAT_RGBX_8888;#endif        break;    }#ifdef NO_RGBX_8888    if (format == PIXEL_FORMAT_RGBX_8888)        format = PIXEL_FORMAT_RGBA_8888;#endif//构造Layer对象    sp<Layer> layer = new Layer(this, display, client);    status_t err = layer->setBuffers(w, h, format, flags);    if (CC_LIKELY(err != NO_ERROR)) {        ALOGE("createNormalSurfaceLocked() failed (%s)", strerror(-err));        layer.clear();    }    return layer;}

该函数首先判断图像格式，然后构造一个Layer对象，接着为该Layer对象设置缓冲区buffer，上图显示了Layer类的继承关系，在构造Layer对象时，其父类的构造函数会被依次调用。

Layer::Layer(SurfaceFlinger* flinger,        DisplayID display, const sp<Client>& client)    :   LayerBaseClient(flinger, display, client),        mTextureName(-1U),        mQueuedFrames(0),        mCurrentTransform(0),        mCurrentScalingMode(NATIVE_WINDOW_SCALING_MODE_FREEZE),        mCurrentOpacity(true),        mRefreshPending(false),        mFrameLatencyNeeded(false),        mFrameLatencyOffset(0),        mFormat(PIXEL_FORMAT_NONE),        mGLExtensions(GLExtensions::getInstance()),        mOpaqueLayer(true),        mNeedsDithering(false),        mSecure(false),        mProtectedByApp(false){    mCurrentCrop.makeInvalid();    glGenTextures(1, &mTextureName);}

Layer的父类LayerBaseClient构造过程：

LayerBaseClient::LayerBaseClient(SurfaceFlinger* flinger, DisplayID display,        const sp<Client>& client)    : LayerBase(flinger, display),      mHasSurface(false),      mClientRef(client),      mIdentity(uint32_t(android_atomic_inc(&sIdentity))){}

LayerBaseClient的父类LayerBase的构造过程：

LayerBase::LayerBase(SurfaceFlinger* flinger, DisplayID display)    : dpy(display), contentDirty(false),      sequence(uint32_t(android_atomic_inc(&sSequence))),      mFlinger(flinger), mFiltering(false),      mNeedsFiltering(false),      mOrientation(0),      mPlaneOrientation(0),      mTransactionFlags(0),      mPremultipliedAlpha(true), mName("unnamed"), mDebug(false){    const DisplayHardware& hw(flinger->graphicPlane(0).displayHardware());    mFlags = hw.getFlags();}

由于Layer继承于RefBase类，同时实现了该类的onFirstRef函数，在前面就介绍了，当第一次强引用RefBase的子类对象，并且该子类对象实现了onFirstRef函数，onFirstRef函数会被自动调用，Layer对象也不例外：

void Layer::onFirstRef(){    LayerBaseClient::onFirstRef();    // Creates a custom BufferQueue for SurfaceTexture to use    sp<BufferQueue> bq = new SurfaceTextureLayer();    mSurfaceTexture = new SurfaceTexture(mTextureName, true,GL_TEXTURE_EXTERNAL_OES, false, bq);    mSurfaceTexture->setConsumerUsageBits(getEffectiveUsage(0));    mSurfaceTexture->setFrameAvailableListener(new FrameQueuedListener(this));    mSurfaceTexture->setSynchronousMode(true);#ifdef TARGET_DISABLE_TRIPLE_BUFFERING#warning "disabling triple buffering"    mSurfaceTexture->setBufferCountServer(2);#else    mSurfaceTexture->setBufferCountServer(3);#endif}

SurfaceTextureLayer也是基于Binder通信框架设计的：

这里就是为当前创建的Layer构造并初始化SurfaceTexture对象，该SurfaceTexture对象用来管理BufferQueue。回到SurfaceFlinger的创建 普通Surface函数createNormalSurface，构造完Layer对象后，还需根据图像大小，格式来设置Layer对象中的buffer

status_t Layer::setBuffers( uint32_t w, uint32_t h,                            PixelFormat format, uint32_t flags){    // this surfaces pixel format    PixelFormatInfo info;    status_t err = getPixelFormatInfo(format, &info);    if (err) {        ALOGE("unsupported pixelformat %d", format);        return err;    }    // the display's pixel format    const DisplayHardware& hw(graphicPlane(0).displayHardware());    uint32_t const maxSurfaceDims = min(hw.getMaxTextureSize(), hw.getMaxViewportDims());    // never allow a surface larger than what our underlying GL implementation    // can handle.    if ((uint32_t(w)>maxSurfaceDims) || (uint32_t(h)>maxSurfaceDims)) {        ALOGE("dimensions too large %u x %u", uint32_t(w), uint32_t(h));        return BAD_VALUE;    }    PixelFormatInfo displayInfo;    getPixelFormatInfo(hw.getFormat(), &displayInfo);    const uint32_t hwFlags = hw.getFlags();        mFormat = format;    mSecure = (flags & ISurfaceComposer::eSecure) ? true : false;    mProtectedByApp = (flags & ISurfaceComposer::eProtectedByApp) ? true : false;    mOpaqueLayer = (flags & ISurfaceComposer::eOpaque);    mCurrentOpacity = getOpacityForFormat(format);    mSurfaceTexture->setDefaultBufferSize(w, h);    mSurfaceTexture->setDefaultBufferFormat(format);    mSurfaceTexture->setConsumerUsageBits(getEffectiveUsage(0));    // we use the red index    int displayRedSize = displayInfo.getSize(PixelFormatInfo::INDEX_RED);    int layerRedsize = info.getSize(PixelFormatInfo::INDEX_RED);    mNeedsDithering = layerRedsize > displayRedSize;    return NO_ERROR;}

最后返回到SurfaceFlinger的createSurface函数设置Layer的当前状态及名称，同时将当前创建的Layer添加到Client的窗口列表及SurfaceFlinger维护的Z秩序列表中

layer->initStates(w, h, flags);layer->setName(name);ssize_t token = addClientLayer(client, layer);

将当前Layer添加的Client及SurfaceFlinger维护的列表中

ssize_t SurfaceFlinger::addClientLayer(const sp<Client>& client,const sp<LayerBaseClient>& lbc){    // attach this layer to the client    size_t name = client->attachLayer(lbc);    Mutex::Autolock _l(mStateLock);    // add this layer to the current state list    addLayer_l(lbc);    return ssize_t(name);}

函数调用attachLayer将当前Layer添加到当前应用程序在SurfaceFlinger中的Client的mLayers列表中

DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;size_t Client::attachLayer(const sp<LayerBaseClient>& layer){    Mutex::Autolock _l(mLock);    size_t name = mNameGenerator++;    mLayers.add(name, layer);    return name;}

接着调用函数addLayer_l将当前创建的Layer添加到SurfaceFlinger中

status_t SurfaceFlinger::addLayer_l(const sp<LayerBase>& layer){    ssize_t i = mCurrentState.layersSortedByZ.add(layer);    return (i < 0) ? status_t(i) : status_t(NO_ERROR);}

完成Layer对象的创建及设置后，调用当前创建的Layer对象的getSurface()函数来创建一个BSurface对象，getSurface()函数实现在Layer的父类LayerBaseClient中

sp<ISurface> LayerBaseClient::getSurface(){    sp<ISurface> s;    Mutex::Autolock _l(mLock);    LOG_ALWAYS_FATAL_IF(mHasSurface,"LayerBaseClient::getSurface() has already been called");    mHasSurface = true;    s = createSurface();    mClientSurfaceBinder = s->asBinder();    return s;}

createSurface()用于创建一个BSurface对象，同时将创建的BSurface的Binder本地对象保存到LayerBaseClient的父类LayerBase的成员变量mClientSurfaceBinder中。

sp<ISurface> LayerBaseClient::createSurface(){    sp<ISurface> sur(new BSurface(mFlinger, this));    return sur;}

层层返回到SurfaceFlinger的createSurface函数，该函数最终返回一个BSurface对象，最后在BnSurfaceComposerClient的onTransact函数中通过writeStrongBinder(s->asBinder())将BSurface的Binder本地对象写入到Binder驱动中，应用程序端BpSurfaceComposerClient通过reply.readStrongBinder()从Binder驱动中读取BSurface的Binder远程代理对象，并通过interface_cast<ISurface>创建BSurface的远程代理对象BpSurface，到此Surface就创建完成了，现在来总结一下Surface的整个创建过程：

1.应用程序进程通过SurfaceComposerClient对象向SurfaceFlinger请求创建Surface；

2.SurfaceComposerClient对象借助Client的远程代理对象BpSurfaceComposerClient向Client请求创建Surface；

3.Client接收到BpSurfaceComposerClient的CREATE_SURFACE请求后，向SurfaceFlinger的事件队列发送MessageCreateSurface消息；

4.MessageCreateSurface消息处理过程中，使用SurfaceFlinger来创建Surface；

5.SurfaceFlinger根据参数创建并初始化Layer对象；

6.创建BSurface对象，并将该对象的Binder远程对象返回给应用程序进程。