SurfaceFlinger(2) service 和 client的操作

一. 3大接口和1个共享内存

    ISurfaceComposer, ISurfaceComposerClient,ISurface，SharedClient

 

  1. ISurfaceComposer (ISurfaceComposer.h)
    主要接口:
    /* retrieve the control block */
    virtual sp getCblk() const = 0;

    /* [un]freeze display. requires ACCESS_SURFACE_FLINGER permission */
    virtual status_t freezeDisplay(DisplayID dpy, uint32_t flags) = 0;
    virtual status_t unfreezeDisplay(DisplayID dpy, uint32_t flags) = 0;
    这两个接口应该和 earlysuspend时 关闭屏幕相关

    /* create connection with surface flinger, requires
     * ACCESS_SURFACE_FLINGER permission
     */
    virtual sp createConnection() = 0;
    建立与SurfaceFlinger service 的连接,并获得1个ISurfaceComposerClient
    接口

 

  2. ISurfaceComposerClient  (ISurfaceComposerClient.h)
    最重要的两个接口就是创建 和释放Surface
    /* Requires ACCESS_SURFACE_FLINGER permission
     */
    virtual sp createSurface( surface_data_t* data,
     int pid,const String8& name, DisplayID display,uint32_t w,
     uint32_t h, PixelFormat format, uint32_t flags) = 0;

    /* Requires ACCESS_SURFACE_FLINGER permission
     */
    virtual status_t    destroySurface(SurfaceID sid) = 0;
    
    为什么不在ISurfaceComposer中创建surface ,而是通过连接
    ISurfaceComposer获得ISurfaceComposerClient 来创建的原因在于
    在SurfaceFlinger service端可以有多个client 来连接service,
    通过类class Client : public BnSurfaceComposerClient来表示
    一个client连接

    通过 sp SurfaceFlinger::createConnection()
    可以看到每次通过ISurfaceComposer创建连接在service 端就会执行下面代码:
    sp client(new Client(this)); 
    返回时转换成父类指针,ISurfaceComposerClient

    service          -|-   client
    class Client     -|-   class  SurfaceComposerClient

 

    其中createSurface 接口在service 端的实现在(SurfaceFlinger.cpp):
    sp SurfaceFlinger::createSurface(const sp& client, int pid,
        const String8& name, ISurfaceComposerClient::surface_data_t* params,
        DisplayID d, uint32_t w, uint32_t h, PixelFormat format,
        uint32_t flags)
    它根据layer的类型(normal,dim,blur)来创建 sp layer;
    然后通过LayerBaseClient::getSurface->LayerBaseClient::createSurface
    new LayerBaseClient::Surface 对象返回,注意这个Surface是LayerBaseClient
    的嵌套类 :
    class Surface : public BnSurface  {

    从代码 new Surface(mFlinger, mIdentity,
            const_cast(this))
    可以看出创建的LayerBaseClient::Surface 时获得了mFlinger,且LayerBaseClient
    对象是他的owner
   
     LayerBaseClient 内置类Surface 是BnSurface的子类,
     所以这个内置类是LayerBaseClient用来做binder通讯

 

     这个图,网上找来的, 很好的表示了他们的关系:

 

 

  3. ISurface 接口

     主要接口如下:
     /*
     * requests a new buffer for the given index. If w, h, or format are
     * null the buffer is created with the parameters assigned to the
     * surface it is bound to. Otherwise the buffer's parameters are
     * set to those specified.
     */
    virtual sp requestBuffer(int bufferIdx,
    uint32_t w, uint32_t h, uint32_t format, uint32_t usage) = 0;

    virtual status_t registerBuffers(const BufferHeap& buffers) = 0;
    virtual void postBuffer(ssize_t offset) = 0; // one-way
    virtual void unregisterBuffers() = 0;
    virtual sp createOverlay(
       uint32_t w, uint32_t h, int32_t format, int32_t orientation) = 0;

    跟下BnSurface的onTransact 就可以了解具体在service端做了什么
    比如requestBuffer -> Layer::requestBuffer
    他就是用来请求2个GraphicBuffer中的1个,是由client端的Surface对象的
    dequeue()发起

    4. class SharedClient
    这个类是用来建立 client 和service 端的都可以访问的共享内存
    它被组合在SharedBufferClient 和SharedBufferServer的基类SharedBufferBase
    中,并在UserClient对象构造时被MemoryHeapBase 在ashmem 上创建
    class SharedClient 只有1个,但是内部的SharedBufferStack 最大可以有31个
    其中 volatile int32_t available; // number of dequeue-able buffers 

   
    相关ShareBuffer类的关系如下:
    SharedBufferClient ,SharedBufferServer 都是继承SharedBufferBase
    SharedBufferBase 包含SharedClient
    SharedClient 可容纳31个SharedBufferStack (对应到layer),
    SharedBufferStack 对应1个layer, 每个layer 对应2个buffer,front和back

    这样surfaceflinger中的threadloop 就会在这最大31个layer上循环,
    draw backbuff 中属于本层layer的需要画的部分
    然后切换到frontbuff ,通过post显示出来

    galloc 中的map就是用来把GraphicBuffer map到 client 端,让ui 在这个
    buffer 上画图

上面大概了解了这4个client 和service 进行通讯的通路,3个使用binder,1个使用
share memory

 

 

二. ISurfaceComposer

   该接口client 端相关的类有:
   * class ComposerService : public Singleton
     一个单实例类,用来获得SurfaceFlinger服务,就是BpSurfaceComposer
     SurfaceComposer的proxy

   * class SurfaceComposerClient : public RefBase
     该类包含的sp  mClient;
     该对象就是通过上面的BpSurfaceComposer 代理createConnection
     获得的BpSurfaceComposerClient,有了它就可以向flinger service
     发createSuface命令

   * class Composer : public Singleton
     Composer 是 SurfaceComposerClient 的容器
     SurfaceComposerClient 与 surfacefling 端连接上后,
     Composer::addClient(this); this 是SurfaceComposerClient对象

     它整理并发送每个layer的ComposerState
     其中相关函数openGlobalTransaction,closeGlobalTransaction
     实际由SurfaceComposerClient调用,但是Composer对所有的client
     都执行一次open 或者close Transaction

   该接口Service 端相关的类有:
   * class BnSurfaceComposer : public BnInterface
     处理BpSurfaceComposer 发来的
     CREATE_CONNECTION,
     CREATE_CLIENT_CONNECTION,
     SET_ORIENTATION,
     FREEZE_DISPLAY,
     UNFREEZE_DISPLAY, 等命令

   接下通过 SurfaceSession_init (android_view_Surface.cpp)
   来看下整个过程:
   *   sp client = new SurfaceComposerClient
    
   * void SurfaceComposerClient::onFirstRef()具体代码如下:

void SurfaceComposerClient::onFirstRef()
{
 /* class ISurfaceComposer : public IInterface */
    sp<ISurfaceComposer> sm(getComposerService() );
/* getComposerService 返回BpSurfaceComposer */
/* ComposerService::getComposerService()
      -> return ComposerService::getInstance().mComposerService;
      注意 ComposerService::ComposerService() 的构造 */
/*
上面声明了一个ISurfaceComposer 的sp 强指针,
根据sp ISurfaceComposer 内部的指针指向BpSurfaceComposer对象
*/

/* 到这里 sp<ISurfaceComposer> mComposerService;
   已经在其构造函数中通过
   getService("SurfaceFlinger", &mComposerService) 获得了*/
/* 构造 调用的getService如下,访问的是ServiceManager
template<typename INTERFACE>
status_t getService(const String16& name, sp<INTERFACE>* outService)
{
    const sp<IServiceManager> sm = defaultServiceManager();
    if (sm != NULL) {
        *outService = interface_cast<INTERFACE>(sm->getService(name));
        if ((*outService) != NULL) return NO_ERROR;
    }
    return NAME_NOT_FOUND;
}
*/

    if (sm != 0) {
        sp<ISurfaceComposerClient> conn = sm->createConnection();
/* BpSurfaceComposer::createConnection 连接 service ,
   返回ISurfaceComposerClient !!! */
/* 虽然是sp<ISurfaceComposer> 强指针,
   实际call 到子类BpSurfaceComposer 的createConnection 如下:
 sp<ISurfaceComposerClient> SurfaceFlinger::createConnection()
{
    sp<ISurfaceComposerClient> bclient;
    sp<Client> client(new Client(this));
    status_t err = client->initCheck();
    if (err == NO_ERROR) {
        bclient = client;
    }
    return bclient;
}
*/

/* 到这里返回ISurfaceComposerClient 指针指向BpSurfaceComposerClient
   与 BnSurfaceComposerClient 连接上了 */

        if (conn != 0) {
            mClient = conn;
     /* 返回ISurfaceComposerClient 指针指向
       BpSurfaceComposerClient 并保存到SurfaceComposerClient
       的成员mClient */
            Composer::addClient(this);
 /* SurfaceComposerClient this , composer singleton 中
    SortedVector< wp<SurfaceComposerClient> > mActiveConnections;
    的向量数组用来存放SurfaceComposerClient */
            mPrebuiltLayerState = new layer_state_t;
            mStatus = NO_ERROR;
        }
    }
}

 

  看下ComposerService的构造函数,只会执行1次

ComposerService::ComposerService()
: Singleton<ComposerService>() {
    const String16 name("SurfaceFlinger");
/* 这个getService 是IServiceManager.h中的全局模板函数,
  status_t getService(const String16& name, sp<INTERFACE>* outService)
  下面调用时传入参数是sp<ISurfaceComposer> mComposerService;
  所以模板展开时的<INTERFACE> => < ISurfaceComposer>
*/
    while (getService(name, &mComposerService) != NO_ERROR) {
    /* 从service manager 获得SurfaceFlinger service !!! */
    /* getService是返回的一个相关代理的Binder，
 通过interface_cast方法将这个binder转换为BpXXXService。
 所以得到的是bp。客户端只能看得到代理类

       这个SurfaceFlinger 是在
          => sm->addService(String16(SurfaceFlinger::getServiceName()),
     new SurfaceFlinger()) 注册到 Service
            注意 flatten_binder 中的代码
*/

        usleep(250000);
    }
  // 获取共享内存块 sp<IMemoryHeap> SurfaceFlinger::getCblk() const
  // {
  // return mServerHeap;
  //}
    mServerCblkMemory = mComposerService->getCblk();
   //获取共享内存块基地址,这个是display的共享内存块不是shareclient 部分的
    mServerCblk = static_cast<surface_flinger_cblk_t volatile *>(
            mServerCblkMemory->getBase());
}

 

    对应到service(SurfaceFlinger.cpp)端的createConnection如下:

sp<ISurfaceComposerClient> SurfaceFlinger::createConnection()
/* 现在在Service 端,就是前面的client向ISurfaceComposer 请求的连接,
返回指向Client:BnSurfaceComposerClient 对象的ISurfaceComposerClient 指针*/
{
    sp<ISurfaceComposerClient> bclient;
    sp<Client> client(new Client(this));
    /* new 一个Client 类,class Client : public BnSurfaceComposerClient*/
    /* 1. 在createConnection阶段，SurfaceFlinger创建Client对象
       2. Client 对象通过构造赋值mFlinger(flinger),将SurfaceFlinger和
           Client 对象关联起来
    */

    status_t err = client->initCheck();
/* class BnSurfaceComposerClient : public BnInterface<ISurfaceComposerClient> */
    if (err == NO_ERROR) {
        bclient = client;
    }
    return bclient; /* 返回时转换成父类指针,ISurfaceComposerClient */
}

   到这里new了一个SurfaceComposerClient的对象,并且获得BpSurfaceComposerClient

 

三. ISurfaceComposerClient
   1. 该接口client 端相关的类有:
     * class SurfaceControl : public RefBase
       包含:
       sp   mClient;
       sp                mSurface;                      
       /* 一个已经创建的并返回给client的ISurface ,由surfaceControl管理 */
      
        mutable sp         mSurfaceData;
       /* 这个Surface 需要到lock canvas 时通过getSurface()
          来生成 client Surface类对象!!! */
     
      * class ISurface : public IInterface 
        client 对应到 BpSurface

 

      ISurfaceComposerClient 创建surface 时,其实还没有创建client 端的Surface 对象
      要等等到lock canvas 中通过getSurface 来创建,这时候new Surface时构造
      中 获得SurfaceClient Singleton 类的mClient(SurfaceClient::getInstance()),
      然后再 createClientConnection ,再serivce 端分配共享块,
      这个client Surface 和service 端的layer对应,他们并不矛盾,因为共享块只分配1次
      所以SurfaceClient 是Singleton
     
      但是先列下该client Surface类:

      * class Surface : public
               EGLNativeBase
         包含:
        SurfaceClient&              mClient;                           
     /* 注意这个类和service 的userclient 相关
     在改类的构造中通过ISurfaceComposer调用createClientConnection
     然后service new UserClient
     建立前面说的那个最大31K 的ShareClient控制块
     */
       SharedBufferClient*         mSharedBufferClient;
       new SharedBufferClient 时通过 mClient.getSharedClient()
    

       将 下面 mControl地址 传给mSharedBufferClient

     * class SurfaceClient : public Singleton
        通过接口IMemoryHeap 获得Bp 端的31K layer control 共享块地址
        放到成员 SharedClient* mControl;
        用Singleton,因为共享块地址地址就1个

 

   2. 该接口service 端相关的类有:
      * class Client : public BnSurfaceComposerClient
        包含:
         DefaultKeyedVector< size_t, wp > mLayers;
        /* 可以有多个client ,每个client 又有多个layer , layer vector */

        sp mFlinger; 在Client 可以找到SurfaceFlinger
   
      * class LayerBase : public RefBase

 

      * class LayerBaseClient : public LayerBase
        包含: 内置类 class Surface : public BnSurface

 

      * class Layer : public LayerBaseClient
        Layer 是LayerBaseClient 的子类
        有内置类:   
          class SurfaceLayer : public LayerBaseClient::Surface , 
          class ClientRef , 
          class BufferManager
        这个就是nomal layer,

        其他class LayerBlur : public LayerBaseClient就不分析了
        这个类比较复杂,后续代码中再讨论

   3. 通过 Surface_init(android_view_Surface.cpp)
      分析下在这步Service 和client 如何实现CreatSurface

 

      * SurfaceComposerClient::createSurface 代码如下:

sp<SurfaceControl> SurfaceComposerClient::createSurface(
        int pid, const String8& name,
        DisplayID display, uint32_t w,
        uint32_t h, PixelFormat format,
        uint32_t flags)
{
    sp<SurfaceControl> result;
    if (mStatus == NO_ERROR) {
        ISurfaceComposerClient::surface_data_t data;
/* mClient 是 sm->createConnection() (BpSurfaceComposer::createConnection)
   返回ISurfaceComposerClient 指针指向 BpSurfaceComposerClient
   且它与 BnSurfaceComposerClient 连接上了
    call BpSurfaceComposerClient createSurface ,binder 通讯层面上的*/
        /* BpSurfaceComposerClient 层creatSurface ,binder 调用*/
        sp<ISurface> surface = mClient->createSurface(&data, pid, name,
                display, w, h, format, flags);
 /* 返回BpSurface !!! ,server端 已经创建了surface */
        if (surface != 0) { /* BpSurface */
    /*
     并把返回的BpSurface和当前的SurfaceComposerClient
     保存在SurfaceControl中, 然后返回此SurfaceControl
    */
            result = new SurfaceControl(this, surface, data, w, h, format,
             flags);
    /* 通过SurfaceControl 的构造函数: 传入
    mClient(client), 就是this (SurfaceComposerClient)
    mSurface(surface), 就是 BpSurface (ISurface)
    */
        }
    }
    return result;
}

         client 端比较简单,到目前获得了ISurface 接口的代理类BpSurface,
  并且生成了SurfaceControl类,其实还看不出SurfaceControl目前的作用
  等到lock canvas 时 就要用到它的getSurface来建立C/S双方的shareclient
  时,就有用了

 

      * createSurface 的Service 端比较复杂先看下SurfaceFlinger.cpp 中:
 

      sp SurfaceFlinger::createSurface(const sp& client, int pid,
        const String8& name, ISurfaceComposerClient::surface_data_t* params,
        DisplayID d, uint32_t w, uint32_t h, PixelFormat format,
        uint32_t flags)
  

     都拿normal layer 说事:

     a.创建normal layer:
        normalLayer = createNormalSurface(client, d, w, h, flags, format);
         -> new Layer(this, display, client);  注意构造中init的成员变量
         -> getBuffer:
            layer 成员变量的init
            mSurface = new SurfaceLayer(mFlinger, this);  

 

     b.addClientLayer(client, layer);
       1. layer 加入到Client 对象的
          DefaultKeyedVector< size_t, wp > mLayers
       2. 按Z-order排序,加入到SurfaceFlinger 的State成员的layersSortedByZ
          mCurrentState.layersSortedByZ.add(layer);

 

     c. surfaceHandle = layer->getSurface();   
          注意surfaceflinger的createsurface ->
                               layer getSuface ->
                                layer createSurface -> 
          最后生成LayerBaseClient::Surface 内置类对象如下:
          new Surface(mFlinger, mIdentity, const_cast(this));

 

     d. mLayerMap.add(surfaceHandle->asBinder()/*BnSurface pointer*/,normalLayer);   
        这里将所有的创建的普通的Layer保存起来，以便Client Surface在请求实现Buffer时能够
        根据 Client Surface(BpSurface)找到对应的Layer!!!

 

      e. setTransactionFlags(eTransactionNeeded);  去触发 thread_loop event

      

      f.最后返回 surfaceHandle 就是BnSurface

 

    service端执行到这里时layer有了,但是3个内置类中只有Surface建立了,而clientRef
    BufferManager 中相关buffer的操作,在那里做的??? 下面ISuface部分继续看

  

四. ISuface  
    1. 该接口client 端相关的类有:
      *  class Surface:public EGLNativeBase
         该类对象包含在SurfaceControl的mutable sp mSurfaceData;
     
         该类内容丰富,主要有下面部分:
         struct SurfaceInfo 其中的bit就是buffer在client端的vaddr地址

 

         class BufferInfo 内置类

 

         SurfaceClient&  mClient;/* 注意这个类和userclient 相对应*/

         Vector< sp > mBuffers;/* GraphicBuffer 的vector,

         下面会讲如何获得它*/

 

         方法:
         static int dequeueBuffer(ANativeWindow* window,
                           android_native_buffer_t** buffer);
          static int cancelBuffer(ANativeWindow* window,
                           android_native_buffer_t* buffer);

      
     *  class SharedBufferClient : public SharedBufferBase

 

     *  class SurfaceClient : public Singleton

       这两个类和共享控制块相关

      
    2. 该接口Service 端相关的类有:
       class UserClient : public BnSurfaceComposerClient

 

    3. 通过 Surface_lockCanvas(android_view_Surface.cpp)
      分析下在这步Service 和client 如何实现buffer的管理

      a. 从sp SurfaceControl::getSurface()开始
          mSurfaceData = new Surface(const_cast(this));

 

      b. Surface 的构造如下:

Surface::Surface(const sp<SurfaceControl>& surface) /* getsurface */
    : mBufferMapper(GraphicBufferMapper::get()),
      mClient(SurfaceClient::getInstance()),
      mSharedBufferClient(NULL),
      mInitCheck(NO_INIT),
      mSurface(surface->mSurface),
      mIdentity(surface->mIdentity),
      mFormat(surface->mFormat), mFlags(surface->mFlags),
      mWidth(surface->mWidth), mHeight(surface->mHeight)
{
    init(); /* 在构造中init */
}

      mBufferMapper 也是个单实例类,获得它是为了访问galloc的lock,unlock

      mClient 是单实例类SurfaceClient的对象,前面已经讲过SurfaceClient
      是用ISurfaceComposer来createClientConnection(在service端建立
      shareclient 共享控制块的),每个SurfaceControl 只有1个
      所以只需要第1次SurfaceClient 类对象建立时做1次,所以这里用Singleton

 

      mSurface (surface->mSurface) 将SurfaceControl获得的ISurface 传给Surface

 

      mIdentity(surface->mIdentity) SurfaceControl 和其包含的Surface
      的Identity 一样,所以SurfaceControl与Surface是1对1关系

    c. 看下SurfaceClient 类对象的mClient的构造：

SurfaceClient()
        : Singleton<SurfaceClient>(), mStatus(NO_INIT)
    {
        sp<ISurfaceComposer> sf(ComposerService::getComposerService());
        mComposerService = sf;
        mClient = sf->createClientConnection();
 /* service 端的serclient 在这时创建,下面具体再看*/
        if (mClient != NULL) {
            mControlMemory = mClient->getControlBlock();
            if (mControlMemory != NULL) {
                mControl = static_cast<SharedClient *>(
                        mControlMemory->getBase());
/* 在这里获得Bp 端的31K layer control 共享块地址 并放到SurfaceClient
   成员 mControl 中去 */
                if (mControl) {
                    mStatus = NO_ERROR;
                }
            }
        }
    }

 

     d.  createClientConnection 在service端的代码:

sp<ISurfaceComposerClient> SurfaceFlinger::createClientConnection()
{
    sp<ISurfaceComposerClient> bclient;
    /* 一样都是ISurfaceComposerClient 接口*/
    sp<UserClient> client(new UserClient(this));
    /* 在这里new 一个UserClient ,接下来看其构造*/
    status_t err = client->initCheck();
    if (err == NO_ERROR) {
        bclient = client;
    }
    return bclient;
}

     e. Service 端的UserClient的构造:

UserClient::UserClient(const sp<SurfaceFlinger>& flinger)
    : ctrlblk(0), mBitmap(0), mFlinger(flinger)
{
    const int pgsize = getpagesize();
    const int cblksize = ((sizeof(SharedClient)+(pgsize-1))&~(pgsize-1));
    mCblkHeap = new MemoryHeapBase(cblksize, 0,
            "SurfaceFlinger Client control-block");
    /* 31 layer 的control blk 在UserClient 中创建*/
    ctrlblk = static_cast<SharedClient *>(mCblkHeap->getBase());
    if (ctrlblk) { // construct the shared structure in-place.
        new(ctrlblk) SharedClient;
/* UserClient 中成员 SharedClient* ctrlblk, pointer to this client's control block ;
   到这里 UserClient的成员 SharedClient* ctrlblk;获得了share memory 的地址 */
    }
}

   
     f. 回到Surface的init 继续：

void Surface::init()
{
   ......
    if (mSurface != 0 && mClient.initCheck() == NO_ERROR) {
        int32_t token = mClient.getTokenForSurface(mSurface);
        if (token >= 0) {
 /* client surface 类的init中new sharedbufferClient */
            mSharedBufferClient = new SharedBufferClient(
                    mClient.getSharedClient(), token, 2, mIdentity);
/* SharedBufferClient 构造参数mClient.getSharedClient()
   把前面SurfaceClient 中mContrl (控制块的client端map的地址)
   传给它的Base class SharedBufferBase的成员mSharedClient
*/
            mInitCheck = mClient.getSharedClient()->validate(token);
     /* SharedBufferClient 装ShareBufferStack */
        }
    }
 ......

     到这里 ShareClient 共享内存块建立了, ShareClient 的client 端
     的类SharedBufferClient 对象建立了,map share mem在client 端地址也有了
     但有两个问题:
      1.SharedBufferServer类在那里创建的?
      2.前面创建surface 时的layer 如何和ShareClient 扯上关系的?

    带着这两个问题看下上面init中的这句话:
     int32_t token = mClient.getTokenForSurface(mSurface);
     通过ISurfaceComposerClient到service 端执行下面函数:

ssize_t UserClient::getTokenForSurface(const sp<ISurface>& sur) const
{
    int32_t name = NAME_NOT_FOUND;
    /* 根据ISurface 找到layer ,是否记得前面createSurface时创建layer时
       加到一个ISurface和 layer对应的map的这句话:
       mLayerMap.add(surfaceHandle->asBinder()/*BnSurface pointer*/
            , normalLayer);
    */
    sp<Layer> layer(mFlinger->getLayer(sur));
    if (layer == 0) return name;
    /* 下面第1次肯定不成立,从来没有setToken,让它那里去get */
    // if this layer already has a token, just return it
    name = layer->getToken();
    if ((name >= 0) && (layer->getClient() == this))
        return name;
    /* 走到这里*/
    name = 0;
    do {
        int32_t mask = 1LU<<name;
        if ((android_atomic_or(mask, &mBitmap) & mask) == 0) {
 /* 有车位,赶紧占个位置,调用layer->setToken,注意参数
   name 应该为0-31中某1个,UserClient有着落了 ,ctrlblk
   前面Userclient 构造时通过
   ctrlblk = static_cast<SharedClient *>(mCblkHeap->getBase());
   也要传入
   但是 layer对setToken只是挂个名,交给内置类ClientRef去做 SetToken
   也不能说完全挂名,new ShareclientServer 还是由layer的setToken完成:
   status_t Layer::setToken(const sp<UserClient>& userClient,
           SharedClient* sharedClient, int32_t token)
          {
              sp<SharedBufferServer> lcblk = new SharedBufferServer(
            sharedClient, token, mBufferManager.getDefaultBufferCount(),
            getIdentity());
            status_t err = mUserClientRef.setToken(userClient, lcblk, token);
     ......
    }
 */
            // we found and locked that name
            status_t err = layer->setToken(
                    const_cast<UserClient*>(this), ctrlblk, name);
            if (err != NO_ERROR) {
                // free the name
                android_atomic_and(~mask, &mBitmap);
                name = err;
            }
            break;
        }
        if (++name >= SharedBufferStack::NUM_LAYERS_MAX)
            name = NO_MEMORY;
    } while(name >= 0);
    //LOGD("getTokenForSurface(%p) => %d (client=%p, bitmap=%08lx)",
    // sur->asBinder().get(), name, this, mBitmap);
    return name;
}

    跟到layer内置类ClientRef的setToken如下:

status_t Layer::ClientRef::setToken(const sp<UserClient>& uc,
        const sp<SharedBufferServer>& sharedClient, int32_t token) {
    Mutex::Autolock _l(mLock);
    { // scope for strong mUserClient reference
        sp<UserClient> userClient(mUserClient.promote());
        if (mUserClient != 0 && mControlBlock != 0) {
            mControlBlock->setStatus(NO_INIT);
        }
    }
    mUserClient = uc;
    mToken = token;
    mControlBlock = sharedClient;
  /* 其实也没做什么,设置ClientRef的mToken,为刚获得的name 号,
     设置 ClientRef 的mUserClient
     shareClient 就是 ShareClientServer的地址
     看起来layer, token ,ShareClientServer
       以后layer 层可以通过ClientRef内置类来获得这3个元素
       到这里可知道layer通过ClientRef内置类与ShareClient扯上关系
       ClientRef中的函数:
        inline SharedBufferServer* get() const { return mControlBlock.get(); }
       再次认同了这个说法
    */

    return NO_ERROR;
}

 

  g.   Surface::init 的结束标志这getSurface 完成
    C/S 双方的shareClient ,client 的Surface和 Service的layer 都关联起来了
    回到开头的Surface_lockCanvas去看下面2句:
    Surface::SurfaceInfo info;
    status_t err = surface->lock(&info, &dirtyRegion);

    这个lock 操作就是为了为了获得这个info中的bits

    lock代码:(其中展开的函数用斜体)

status_t Surface::lock(SurfaceInfo* other, Region* dirtyIn, bool blocking)
{
    ......
    ssize_t bufIdx = mSharedBufferClient->dequeue();
    /* 这句也很关键,在这里面获得bufIdx ,看下该函数:
    ssize_t SharedBufferClient::dequeue(){
        DequeueCondition condition(this);
    status_t err = waitForCondition(condition);
    /* waitForCondition 判断并等待SharedBufferStack.available(最大=2)
       不为0
    */
    if (err != NO_ERROR)
        return ssize_t(err);
    /* 跑到这里表示ShareBufferStack上有可用buffer */
    DequeueUpdate update(this);
    updateCondition( update );
    /* 进入后DequeueUpdate 的update obj 调用重载的() operator,
    android_atomic_dec(&stack.available)
     将 available 递减 ,

     注意available 加1并不是在 unlockandpost中做的
     看起来应该是在
     thread loop 的 lockPageFlip 中
     ssize_t buf = lcblk->retireAndLock();
     那么是什么情况会导致available 没有被inc 回来导致available=0
     然后
     waitForCondition 时,没available的buffer可用,所以可能看到过这样的msg:
W/SharedBufferStack( 2634): waitForCondition(LockCondition) timed out (identity=8, status=0). CPU may be pegged. trying again.
W/SharedBufferStack( 2634): waitForCondition(LockCondition) timed out (identity=8, status=0). CPU may be pegged. trying again.

     */

    */
    ......
    android_native_buffer_t* out;
    status_t err = dequeueBuffer(&out);
/* 看下删节的dequeueBuffer
int Surface::dequeueBuffer(android_native_buffer_t** buffer)
{
    ......
    uint32_t w, h, format, usage;
    if (needNewBuffer(bufIdx, &w, &h, &format, &usage)) {
        err = getBufferLocked(bufIdx, w, h, format, usage);
 /* 到这里new graphic buffer ,可能分析的是2.3.4
   其他贴子上是在CreateSurface 时就new GraphicBuffer了
比如http://www.360doc.com/content/11/0722/11/11192_135158837.shtml
中图1
 */
        LOGE_IF(err, "getBufferLocked(%ld, %u, %u, %u, %08x) failed (%s)",
                bufIdx, w, h, format, usage, strerror(-err));
        if (err == NO_ERROR) {
            // reset the width/height with the what we get from the buffer
            const sp<GraphicBuffer>& backBuffer(mBuffers[bufIdx]);
     /* getBufferLocked 中已经把mBuffers的bufIdx对应的GraphicBuffer准备好了
        mmap到client ,下面会再列下getBufferLocked的代码,具体看下就知道
     */
            mWidth = uint32_t(backBuffer->width);
            mHeight = uint32_t(backBuffer->height);
        }
    }
    ......
    return err;
}
*/
    LOGE_IF(err, "dequeueBuffer failed (%s)", strerror(-err));
    if (err == NO_ERROR) {
        sp<GraphicBuffer> backBuffer(GraphicBuffer::getSelf(out));
 /* 由out 构建GraphicBuffer 类对象backbuffer */
        /* wait condition 测试*/
        err = lockBuffer(backBuffer.get());
 /*
 注意这个lockcondtion 如下:
bool SharedBufferClient::LockCondition::operator()() const {
    // NOTE: if stack.head is messed up, we could crash the client
    // or cause some drawing artifacts. This is okay, as long as it is
    // limited to the client.
    return (buf != stack.index[stack.head]);
}
这个表示不能等于head,因为head总是用来做front的,back 总是用tail
不知道这个描述是否有问题
 */

        LOGE_IF(err, "lockBuffer (idx=%d) failed (%s)",
                getBufferIndex(backBuffer), strerror(-err));
        if (err == NO_ERROR) {
            const Rect bounds(backBuffer->width, backBuffer->height);
            const Region boundsRegion(bounds);
            Region scratch(boundsRegion);
            Region& newDirtyRegion(dirtyIn ? *dirtyIn : scratch);
            newDirtyRegion &= boundsRegion;
            // figure out if we can copy the frontbuffer back
            const sp<GraphicBuffer>& frontBuffer(mPostedBuffer);
            const bool canCopyBack = (frontBuffer != 0 &&
                    backBuffer->width == frontBuffer->width &&
                    backBuffer->height == frontBuffer->height &&
                    backBuffer->format == frontBuffer->format &&
                    !(mFlags & ISurfaceComposer::eDestroyBackbuffer));
/* 判断能够copy 的条件是否满足,前后size一样大,格式都一样时才copy*/
            // the dirty region we report to surfaceflinger is the one
            // given by the user (as opposed to the one *we* return to the
            // user).
            mDirtyRegion = newDirtyRegion;
            if (canCopyBack) {
                // copy the area that is invalid and not repainted this round
                const Region copyback(mOldDirtyRegion.subtract(newDirtyRegion));
                if (!copyback.isEmpty())
                    copyBlt(backBuffer, frontBuffer, copyback);
      /* 把front copy 到back ,这样不用从头画了*/
            } else {
                // if we can't copy-back anything, modify the user's dirty
                // region to make sure they redraw the whole buffer
                newDirtyRegion = boundsRegion;
            }
            // keep track of the are of the buffer that is "clean"
            // (ie: that will be redrawn)
            mOldDirtyRegion = newDirtyRegion;
            void* vaddr;
            status_t res = backBuffer->lock(
               GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_OFTEN,
               newDirtyRegion.bounds(), &vaddr);
            /* backBuffer 中取出它在client 端的vaddr !!! */

            LOGW_IF(res, "failed locking buffer (handle = %p)",
                    backBuffer->handle);
            mLockedBuffer = backBuffer;
            other->w = backBuffer->width;
            other->h = backBuffer->height;
            other->s = backBuffer->stride;
            other->usage = backBuffer->usage;
            other->format = backBuffer->format;
            other->bits = vaddr;
     /* bits 就是surface buffer 的虚地址,vaddr 传给handle ->bits */
        }
    }
    mApiLock.unlock();
    return err;
}

    最后回到static jobject Surface_lockCanvas
    看下其中代码:

status_t err = surface->lock(&info, &dirtyRegion);
    /* 回来时info 中的bits已经有内容了*/
    ......
    if (info.w > 0 && info.h > 0) {
        bitmap.setPixels(info.bits);
/* Canvas的Bitmap设备设置了Client Surface的显示Buffer
为其Bitmap pixel存储空间。 设置bits 的地方在Surface::lock */
    } else {
   ......

    搞个地址画图 真是不容易!

lock canvas的sequnce图:

摘自

 

 

前面提到的 getBufferLocked 函数代码如下:

status_t Surface::getBufferLocked(int index,
        uint32_t w, uint32_t h, uint32_t format, uint32_t usage) /* called by dequeueBuffer */
{
    sp<ISurface> s(mSurface);
    if (s == 0) return NO_INIT;
    status_t err = NO_MEMORY;
    // free the current buffer
    sp<GraphicBuffer>& currentBuffer(mBuffers.editItemAt(index));
    /* currentBuffer 引用了mBuffers index 的那个 GraphicBuffer*/
    if (currentBuffer != 0) {
        getBufferMapper().unregisterBuffer(currentBuffer->handle);
        currentBuffer.clear();
    }
    sp<GraphicBuffer> buffer = s->requestBuffer(index, w, h, format, usage);
/* 调用到service 端的sp<GraphicBuffer> Layer::requestBuffer
  返回时已经获得framebuffer mmap vadder 并放到了
 GraphicBuffer 的base class android_native_buffer_t 的 handle中*/
    ......
    if (buffer != 0) { // this should never happen by construction
        LOGE_IF(buffer->handle == NULL,
                "Surface (identity=%d) requestBuffer(%d, %u, %u, %u, %08x) "
                "returned a buffer with a null handle",
                mIdentity, index, w, h, format, usage);
        err = mSharedBufferClient->getStatus();
        LOGE_IF(err, "Surface (identity=%d) state = %d", mIdentity, err);
        if (!err && buffer->handle != NULL) {
            err = getBufferMapper().registerBuffer(buffer->handle);
          /*上面获得handle 还没client端地址, 只是service 端的地址有了,
   所以call registerBuffer
          把他再通过gralloc_map map 到client 端,何其繁杂,都是mmu惹的祸
  */
            LOGW_IF(err, "registerBuffer(...) failed %d (%s)",
                    err, strerror(-err));
            if (err == NO_ERROR) {
                currentBuffer = buffer;
                currentBuffer->setIndex(index);
            }
        } else {
            err = err<0 ? err : status_t(NO_MEMORY);
        }
    }
    return err;
}

  4. unlockAndPost 简单列下代码:
  status_t Surface::unlockAndPost()  (android_view_Surface.cpp)
  {
    if (mLockedBuffer == 0) {
        LOGE("Surface::unlockAndPost failed, no locked buffer");
        return INVALID_OPERATION;
    }

    status_t err = mLockedBuffer->unlock();
    LOGE_IF(err, "failed unlocking buffer (%p)", mLockedBuffer->handle);
   
    err = queueBuffer(mLockedBuffer.get());
    LOGE_IF(err, "queueBuffer (idx=%d) failed (%s)",
            getBufferIndex(mLockedBuffer), strerror(-err));

    mPostedBuffer = mLockedBuffer;
    mLockedBuffer = 0;
    return err;
}