04 深入探究waitForService＜ISurfaceComposer＞

前面分析《构造surfaceComposerClient》里有这样一段代码

bool ComposerService::connectLocked() {
    const String16 name("SurfaceFlinger");
    mComposerService = waitForService<ISurfaceComposer>(name);
    if (mComposerService == nullptr) {
        return false; // fatal error or permission problem
    }
... ...
}

waitForService，本篇来深入看下其实现。

android12\frameworks\native\libs\binder\include\binder\IServiceManager.h
template<typename INTERFACE>
sp<INTERFACE> waitForService(const String16& name) {
    const sp<IServiceManager> sm = defaultServiceManager();
    return interface_cast<INTERFACE>(sm->waitForService(name));
}

android12\frameworks\native\libs\binder\include\binder\IInterface.h
template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
    return INTERFACE::asInterface(obj);
}

看不出来，将模板类替换成ISurfaceComposer

sp<ISurfaceComposer> waitForService(const String16& name) {
    const sp<IServiceManager> sm = defaultServiceManager();
    return interface_cast<ISurfaceComposer>(sm->waitForService(name));
}

inline sp<ISurfaceComposer> interface_cast(const sp<IBinder>& obj)
{
    return ISurfaceComposer::asInterface(obj);
}

赶紧找一下ISurfaceComposer的asInterface的实现。

找了半天没找到，，，，又找了半天终于找到了，原来是用宏藏起来了

android12\frameworks\native\libs\gui\include\gui\ISurfaceComposer.h
class ISurfaceComposer: public IInterface {
public:
    DECLARE_META_INTERFACE(SurfaceComposer)
... ...
}

把宏展开之后是这个样子

#define DECLARE_META_INTERFACE(INTERFACE)                               \
public:                                                                 \
    static const ::android::String16 descriptor;                        \
    static ::android::sp<ISurfaceComposer> asInterface(                     \
            const ::android::sp<::android::IBinder>& obj);              \
    virtual const ::android::String16& getInterfaceDescriptor() const;  \
    ISurfaceComposer();                                                     \
    virtual ~ISurfaceComposer();                                            \
    static bool setDefaultImpl(std::unique_ptr<ISurfaceComposer> impl);     \
    static const std::unique_ptr<ISurfaceComposer>& getDefaultImpl();       \
private:                                                                \
    static std::unique_ptr<ISurfaceComposer> default_impl;                  \
public:                                                                 \

看起来这里只是声明，然后继续找。。。。。。

终于在android12\frameworks\native\libs\gui\ISurfaceComposer.cpp中发现了

IMPLEMENT_META_INTERFACE(SurfaceComposer, "android.ui.ISurfaceComposer");

展开宏之后可以看到如下实现：

    ::android::sp<ISurfaceComposer> ISurfaceComposer::asInterface(              \
            const ::android::sp<::android::IBinder>& obj)               \
    {                                                                   \
        ::android::sp<ISurfaceComposer> intr;                               \
        if (obj != nullptr) {                                           \
            intr = ::android::sp<ISurfaceComposer>::cast(                   \
                obj->queryLocalInterface(ISurfaceComposer::descriptor));    \
            if (intr == nullptr) {                                      \
                intr = ::android::sp<BpSurfaceComposer>::make(obj);         \
            }                                                           \
        }                                                               \
        return intr;                                                    \
    }                                                                   \

哦豁，重点，，原来使用interface_cast会使用binder指针创建一个BpSurfaceComposer。

来看下BpSurfaceComposer

BpSurfaceComposer实现了很多接口，来和BnSurfaceComposer交互。以createConnection为例

android12\frameworks\native\libs\gui\ISurfaceComposer.cpp
class BpSurfaceComposer : public BpInterface<ISurfaceComposer>
{
public:
    explicit BpSurfaceComposer(const sp<IBinder>& impl)
        : BpInterface<ISurfaceComposer>(impl)
    {
    }

    virtual ~BpSurfaceComposer();

    virtual sp<ISurfaceComposerClient> createConnection()
    {
        Parcel data, reply;
        data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
        remote()->transact(BnSurfaceComposer::CREATE_CONNECTION, data, &reply);
        return interface_cast<ISurfaceComposerClient>(reply.readStrongBinder());
    }
    ... ...
}

《构造surfaceComposerClient》里conn = sf->createConnection()；

没有详细介绍，在这里介绍一下：

conn = sf->createConnection()；这里实际会调用到BpSurfaceComposer::createConnection()；

通过binder，发送远程调用BnSurfaceComposer::CREATE_CONNECTION；

BnSurfaceComposer::onTransact中会收到CREATE_CONNECTION；并执行createConnection()。

status_t BnSurfaceComposer::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch(code) {
        case CREATE_CONNECTION: {
            CHECK_INTERFACE(ISurfaceComposer, data, reply);
            sp<IBinder> b = IInterface::asBinder(createConnection());
            reply->writeStrongBinder(b);
            return NO_ERROR;
        }
}

因为SurfaceFlinger继承BnSurfaceComposer，所以这里调用的是SurfaceFlinger::createConnection()。

class SurfaceFlinger : public BnSurfaceComposer,
                       public PriorityDumper,
                       private IBinder::DeathRecipient,
                       private HWC2::ComposerCallback,
                       private ISchedulerCallback {
... ...
}

将创建的Client进行转换并通过Binder返回。

回过头来在看sp<ISurfaceComposerClient> createConnection()

    virtual sp<ISurfaceComposerClient> createConnection()
    {
        Parcel data, reply;
        data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
        remote()->transact(BnSurfaceComposer::CREATE_CONNECTION, data, &reply);
        return interface_cast<ISurfaceComposerClient>(reply.readStrongBinder());
    }

用返回的binder指针，创建BpSurfaceComposerClient，这个过程和本次分析的一致。

总结：

本文梳理了一下waitForService的内部机制，和Bpxxx/Bnxxx的调用过程，这样做应该是为了代码重用。

有了BpSurfaceComposer就可以远程调用SurfaceFlinger的各种接口。

如下图

创造不易，欢迎点赞收藏。