Android 源码 图形系统之 WindowState attach

在 《Android 源码 图形系统之窗口添加》 一节中提到 WindowManagerService 类
addWindow 方法首先创建了 WindowState 对象，然后调用了其 attach() 方法进行附着，现在继续分析其后续流程。

WindowState 类 attach() 方法中仅仅调用了 Session 类的 windowAddedLocked() 方法。

frameworks/base/services/core/java/com/android/server/wm/WindowState.java

final class WindowState implements WindowManagerPolicy.WindowState {
    ......
    final Session mSession;    
    ......
    WindowState(WindowManagerService service, Session s, IWindow c, WindowToken token,
           WindowState attachedWindow, int appOp, int seq, WindowManager.LayoutParams a,
           int viewVisibility, final DisplayContent displayContent) {
        mService = service;
        mSession = s;
        ......
    }
    ......
    void attach() {
        if (WindowManagerService.localLOGV) Slog.v(
            TAG, "Attaching " + this + " token=" + mToken
            + ", list=" + mToken.windows);
        mSession.windowAddedLocked();
    }
    ......
}

1. 创建了 SurfaceSession 对象
2. 将 Session 对象添加到 WindowManagerService 类 mSessions 成员（代表与客户端的所有当前活动会话）ArraySet 中

frameworks/base/services/core/java/com/android/server/wm/Session.java

final class Session extends IWindowSession.Stub
        implements IBinder.DeathRecipient {
    ......
    void windowAddedLocked() {
        if (mSurfaceSession == null) {
            if (WindowManagerService.localLOGV) Slog.v(
                WindowManagerService.TAG, "First window added to " + this + ", creating SurfaceSession");
            mSurfaceSession = new SurfaceSession();
            if (WindowManagerService.SHOW_TRANSACTIONS) Slog.i(
                    WindowManagerService.TAG, "  NEW SURFACE SESSION " + mSurfaceSession);
            mService.mSessions.add(this);
            ......
        }
        mNumWindow++;
    }
    ......
}

SurfaceSession 类的一个实例表示到 surface flinger 的连接，我们可以从该连接创建一个或多个将组合到屏幕的 Surface 实例。到这里总算和 surface flinger 有了联系了。SurfaceSession 类无参构造函数内部调用了 nativeCreate() 方法，此方法是一个 JNI 方法，其返回值代表 SurfaceComposerClient* 指针。

frameworks/base/core/java/android/view/SurfaceSession.java

public final class SurfaceSession {
    private long mNativeClient; // SurfaceComposerClient*

    private static native long nativeCreate();
    ......
    /** 创建一个和 surface flinger 的新连接 */
    public SurfaceSession() {
        mNativeClient = nativeCreate();
    }
    ......
}

new 出来 SurfaceComposerClient 对象，强引用计数加1，然后将 SurfaceComposerClient* 类型指针 client 强转为 jlong 返回到 Java。

frameworks/base/core/jni/android_view_SurfaceSession.cpp

static jlong nativeCreate(JNIEnv* env, jclass clazz) {
    SurfaceComposerClient* client = new SurfaceComposerClient();
    client->incStrong((void*)nativeCreate);
    return reinterpret_cast<jlong>(client);
}

SurfaceComposerClient 类无参构造函数内是个空实现，不过在初始化列表上初始化了 mComposer 成员变量。Composer 看样子是个单例类。

frameworks/native/libs/gui/SurfaceComposerClient.cpp

SurfaceComposerClient::SurfaceComposerClient()
    : mStatus(NO_INIT), mComposer(Composer::getInstance())
{
}

Composer 类构造器仅初始化了三个成员变量。

frameworks/native/libs/gui/SurfaceComposerClient.cpp

class Composer : public Singleton<Composer>
{
    ......
    uint32_t                    mForceSynchronous;
    uint32_t                    mTransactionNestCount;
    bool                        mAnimation;

    Composer() : Singleton<Composer>(),
        mForceSynchronous(0), mTransactionNestCount(0),
        mAnimation(false)
    { }
    ......
}

接着 nativeCreate(…) 方法中强引用计数加1，这会触发 SurfaceComposerClient 类 onFirstRef() 方法调用。

1. 调用 ComposerService 类 getComposerService() 方法获取 SurfaceComposer 代理对象 BpSurfaceComposer
2. 调用 SurfaceComposer 代理对象 createConnection() 方法获取 SurfaceComposerClient 代理对象 BpSurfaceComposerClient

frameworks/native/libs/gui/SurfaceComposerClient.cpp

void SurfaceComposerClient::onFirstRef() {
    sp<ISurfaceComposer> sm(ComposerService::getComposerService());
    if (sm != 0) {
        sp<ISurfaceComposerClient> conn = sm->createConnection();
        if (conn != 0) {
            mClient = conn;
            mStatus = NO_ERROR;
        }
    }
}

ANDROID_SINGLETON_STATIC_INSTANCE(ComposerService) 宏展开后得到 ComposerService 类 getInstance() 实现，返回一个 ComposerService 单例。

ComposerService 保持了我们与 Composer Service（即 SurfaceFlinger）的连接。如果远端断开，我们将重新建立连接。该类的用户不应该长期保留 getComposerService() 的值。

frameworks/native/libs/gui/SurfaceComposerClient.cpp

/*static*/ sp<ISurfaceComposer> ComposerService::getComposerService() {
    ComposerService& instance = ComposerService::getInstance();
    Mutex::Autolock _l(instance.mLock);
    if (instance.mComposerService == NULL) {
        ComposerService::getInstance().connectLocked();
        assert(instance.mComposerService != NULL);
        ALOGD("ComposerService reconnected");
    }
    return instance.mComposerService;
}

当第一次获取 ComposerService 类单例的时候，就会调用 connectLocked() 方法和远端的 SurfaceFlinger 进行连接，以后再次调用 getComposerService() 时，如果 ComposerService 类 mComposerService 成员变量被释放，则重新调用 connectLocked() 方法进行连接。

connectLocked() 方法中首先查询名为 “SurfaceFlinger” 的服务，也就是 SurfaceFlinger，接着我们就拿到了 BpSurfaceComposer 代理对象 mComposerService。如果没拿到就一直 while 循环，直到拿到为止。接着创建了 SurfaceFlinger 死亡监听器，在 SurfaceFlinger 服务死亡的时候，ComposerService 做一些善后工作，主要是将成员变量 mComposerService 和 mDeathObserver 赋值为 NULL。

frameworks/native/libs/gui/SurfaceComposerClient.cpp

ComposerService::ComposerService()
: Singleton<ComposerService>() {
    Mutex::Autolock _l(mLock);
    connectLocked();
}

void ComposerService::connectLocked() {
    const String16 name("SurfaceFlinger");
    while (getService(name, &mComposerService) != NO_ERROR) {
        usleep(250000);
    }
    assert(mComposerService != NULL);

    // 创建死亡监听器
    class DeathObserver : public IBinder::DeathRecipient {
        ComposerService& mComposerService;
        virtual void binderDied(const wp<IBinder>& who) {
            ALOGW("ComposerService remote (surfaceflinger) died [%p]",
                  who.unsafe_get());
            mComposerService.composerServiceDied();
        }
     public:
        DeathObserver(ComposerService& mgr) : mComposerService(mgr) { }
    };

    mDeathObserver = new DeathObserver(*const_cast<ComposerService*>(this));
    IInterface::asBinder(mComposerService)->linkToDeath(mDeathObserver);
}

......

void ComposerService::composerServiceDied()
{
    Mutex::Autolock _l(mLock);
    mComposerService = NULL;
    mDeathObserver = NULL;
}

调用 SurfaceComposer 代理对象 createConnection() 方法获取 SurfaceComposerClient 代理对象 BpSurfaceComposerClient，createConnection() 发送消息 BnSurfaceComposer::CREATE_CONNECTION 到 Bn 端。

frameworks/native/libs/gui/ISurfaceComposer.cpp

class BpSurfaceComposer : public BpInterface<ISurfaceComposer>
{
public:
    BpSurfaceComposer(const sp<IBinder>& impl)
        : BpInterface<ISurfaceComposer>(impl)
    {
    }

    virtual ~BpSurfaceComposer();

    virtual sp<ISurfaceComposerClient> createConnection()
    {
        Parcel data, reply;
        data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
        remote()->transact(BnSurfaceComposer::CREATE_CONNECTION, data, &reply);
        return interface_cast<ISurfaceComposerClient>(reply.readStrongBinder());
    }
    ......
}

首先在 Bn 端 onTransact(…) 函数中接收到 CREATE_CONNECTION 消息，然后调用 createConnection() 方法，并将其返回值作为 IInterface::asBinder(…) 方法的入参，最后写入这个 StrongBinder 到 Bp 端。

frameworks/native/libs/gui/ISurfaceComposer.cpp

status_t BnSurfaceComposer::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch(code) {
        case CREATE_CONNECTION: {
            CHECK_INTERFACE(ISurfaceComposer, data, reply);
            sp<IBinder> b = IInterface::asBinder(createConnection());
            reply->writeStrongBinder(b);
            return NO_ERROR;
        }
        ......
    }
}

Bn 端实现位于 SurfaceFlinger 中。SurfaceFlinger 类 createConnection() 创建了 Client 对象，它继承自 BnSurfaceComposerClient 类。initCheck() 方法什么也没做，直接返回了 NO_ERROR，因此 createConnection() 中最终返回的对象正是 BnSurfaceComposerClient。

frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

sp<ISurfaceComposerClient> SurfaceFlinger::createConnection()
{
    sp<ISurfaceComposerClient> bclient;
    sp<Client> client(new Client(this));
    status_t err = client->initCheck();
    if (err == NO_ERROR) {
        bclient = client;
    }
    return bclient;
}

mFlinger 指向 SurfaceFlinger。

frameworks/native/services/surfaceflinger/Client.cpp

Client::Client(const sp<SurfaceFlinger>& flinger)
    : mFlinger(flinger)
{
}

......

status_t Client::initCheck() const {
    return NO_ERROR;
}