基于Android10渲染Surface的创建过程

目录

• 一、Surface 概述
  • 1.1 Android本地窗口简述
• 二、引出SurfaceSession
  • 2.1 从WindowManagerImpl的addView()说起
  • 2.2 IWindowSession.windowAddedLocked()
  • 2.3 SurfaceSession 创建过程
    • 2.3.1 构造方法
    • 2.3.2 SurfaceComposerClient
    • 2.3.3 SurfaceFlinger.createConnection()
  • 2.3 小结
• 三、Surface的创建
  • 3.1 Java层的Surface
  • 3.2 App端的 relayoutWindow()
  • 3.3 SurfaceControl空参构造
  • 3.4 小结
  • 3.5 WMS端 Session.relayout()
    • 3.5.1 winAnimator.createSurfaceLocked()
    • 3.5.2 WindowSurfaceController构造方法
  • 3.6 SF端 ISurfaceComposerClient.createSurface()
    • 3.6.1 SF.createBufferQueueLayer()
    • 3.6.2 SurfaceFlingerFactory.createBufferQueueLayer
    • 3.6.3 BufferQueueLayer 构造方法
    • 3.6.4 BufferQueueLayer.onFirstRef()
    • 3.6.5 BufferQueue::createBufferQueue()
  • 3.7 Client.attachLayer()
  • 3.6 小结
  • 3.7 WindowSurfaceController.getSurfaceControl()
  • 3.8 SurfaceControl.copyFrom()
    • 3.8.1 nativeCopyFromSurfaceControl()
    • 3.8.2 assignNativeObject()
  • 3.9 mSurface.copyFrom()
    • 3.9.1 nativeGetFromSurfaceControl()
    • 3.9.2 native层 SurfaceControl::getSurface()
    • 3.9.3 Surface.getSurface()
    • 3.9.4 BBQSurface
    • 3.10 小结
• 四、总结

一、Surface 概述

OpenGL ES/Skia定义了一组绘制接口的规范，为什么能够跨平台？ 本质上需要与对应平台上的本地窗口建立连接。也就是说OpenGL ES负责输入了绘制的命令，但是需要一个 "画布" 来承载输出结果，最终展示到屏幕。这个画布就是本地窗口。

因此，每个平台的有着不一样的本地窗口的实现。Android平台上是 ANativeWindow。

疑问：

• 那么如何将OpenGL本地化？ 通过 EGL来对OpenGL ES来进行配置。关键点就是提供本地化窗口。
• 本地化窗口的作用是什么？ 本地窗口是OpenGL ES和 物理屏幕之间的桥梁。

1.1 Android本地窗口简述

Android图形系统提供的本地窗口，可以分为两类：

• FrameBufferNativeWindow

面对SF(SurfaceFlinger)。它通过HAL层的Gralloc系统调用(alloc/free)来分配内核中的FrameBuffer帧缓冲区。 这个帧缓冲区就代表了物理屏幕(fb*驱动节点，*表示屏幕数。如fb0主屏幕、fb1等)。 FrameBuffer的数量一般情况下是2，也就是双缓冲。当然还有三倍缓冲。

• Surface

面向应用程序。对应的是内存中一块缓冲区，称为：GraphicBuffer。是由SF来进行分配。app从SF中获取一块GraphicBuffer， 通过OpenGL/Skia将图形数据绘制(软件/硬件)到GraphicBuffer上。最终SF会把各个应用的GraphicBuffer数据进行合成，最终 通过 FrameBufferNativeWindow 输出到屏幕上。

有了一个整体的概念，接下来就好理解很多。

二、引出SurfaceSession

2.1 从WindowManagerImpl的addView()说起

app：
WindowManagerImpl.addView()
  WindowManagerGlobal.addView()
    ViewRootImpl的setView()
      IWindowSession.addToDisplay()
      
WMS:
      new WindowState
        WindowState.attach()
          session.windowAddedLocked()
            new SurfaceSession()

view添加到window的过程中， 从WindowManagerImpl 的 addView()，到WindowManagerGlobal(构造方法中会在system server 进程中创建一个Session对象)的addView()。最后会调用 ViewRootImpl的setView()方法。 内部会调用 IWindowSession 的addToDisplay() 方法。IWindowSession是WMS提供的一个binder服务(实现类就是Session)。

2.2 IWindowSession.windowAddedLocked()

内部会创建一个WindowState 对象。 调用 WindowState的 attach()方法。最终调到Session中的windowAddedLocked()，会创建 一个SurfaceSession对象。这就是我们要找的的跟SurfaceFlinger建立联系的地方。

SurfaceSession mSurfaceSession;
void windowAddedLocked(String packageName) {
  mPackageName = packageName;
  mRelayoutTag = "relayoutWindow: " + mPackageName;
  if (mSurfaceSession == null) {
  // 一个进程只有一个session，因此也只创建一次 SurfaceSession 对象
      
      // 创建 SurfaceSession 对象
      mSurfaceSession = new SurfaceSession();
      
      // 每个session 都存入WMS中的         
      mService.mSessions.add(this);
      
      if (mLastReportedAnimatorScale != mService.getCurrentAnimatorScale()) {
          mService.dispatchNewAnimatorScaleLocked(this);
      }
  }
  mNumWindow++; // 进程中所有窗口的数量+1
}

一个应用进程对应一个Session对象，一个Session对象对应一个SurfaceSession。 WMS会把 这个Session 存储起来。也就是说WMS 会把所有跟SurfaceFlinger保持连接状态的应用Session存储起来。

2.3 SurfaceSession 创建过程

这个类的实例代表了和SurfaceFlinger的一个连接。我们可以通过它 创建一个或多个 Surface 对象。

2.3.1 构造方法

> SurfaceSession.java
private long mNativeClient; // SurfaceComposerClient*

public SurfaceSession() {
    //native 方法
    mNativeClient = nativeCreate();
}

> frameworks/base/core/jni/android_view_SurfaceSession.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz) {
    // 新建一个 SurfaceComposerClient 对象
    SurfaceComposerClient* client = new SurfaceComposerClient();
    client->incStrong((void*)nativeCreate);
    //返回SurfaceComposerClient对象的引用到java层。
    return reinterpret_cast<jlong>(client);
}

SurfaceComposerClient 是什么呢？

2.3.2 SurfaceComposerClient

在 SurfaceComposerClient第一次被引用的时候会走onFirstRef()方法。

> frameworks/native/libs/gui/SurfaceComposerClient.cpp
void SurfaceComposerClient::onFirstRef() {
    //创建sf代理binder对象sf，类型为 ISurfaceComposer
    sp<ISurfaceComposer> sf(ComposerService::getComposerService());
    if (sf != nullptr && mStatus == NO_INIT) {
        sp<ISurfaceComposerClient> conn;
        //创建一个 ISurfaceComposerClient 对象，用来跨进程调用
        conn = sf->createConnection();
        if (conn != nullptr) {
            mClient = conn;
            mStatus = NO_ERROR;
        }
    }
}

• ISurfaceComposer 实现类就是 SurfaceFlinger对象。在server进程的代理对象是 ComposerService。This class defines the Binder IPC interface for accessing various SurfaceFlinger features.
• 通过SF.createConnection(),创建一个 ISurfaceComposerClient 对象 mClient，用来跨进程调用。

那么 ISurfaceComposerClient的实现类是哪个呢？ 继续看看 SF.createConnection()。

2.3.3 SurfaceFlinger.createConnection()

注意，此时是在SF进程。

> frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
sp<ISurfaceComposerClient> SurfaceFlinger::createConnection() {
    // new client对象。
    return initClient(new Client(this));
}
static sp<ISurfaceComposerClient> initClient(const sp<Client>& client) {
    status_t err = client->initCheck();
    if (err == NO_ERROR) {
        // 返回该对象
        return client;
    }
    return nullptr;
}
> frameworks/native/services/surfaceflinger/Client.h
class Client : public BnSurfaceComposerClient{...
  class BnSurfaceComposerClient : public SafeBnInterface<ISurfaceComposerClient> {...

原来，ISurfaceComposerClient的实现类就是 SF中定义的 Client。也是一个binder服务。 我们回到 SurfaceComposerClient 类，它持有 ISurfaceComposerClient的binder引用 mClient。通过 mClient实现与SF通信。

2.3 小结

• Session 类中，创建了一个 SurfaceSession 对象，内部引用c++层的 SurfaceComposerClient 对象。
• SurfaceComposerClient 对象是通过SF创建的另一个binder服务。减轻SF的工作量。
• SurfaceComposerClient 对象则通过 mClient成员(ISurfaceComposerClient)代理binder，后续用来创建 Surface。

到目前为止，WMS中应用进程对应的Session对象已经建立了与SF的联系。

三、Surface的创建

3.1 Java层的Surface

ViewRootImpl 类成员变量 ：

ViewRootImpl.java

// 任何线程都可以访问这个对象，只需要加锁就可以了。
public final Surface mSurface = new Surface();

调用的是空参构造，因此 此时的Surface只是Java层的空壳而已。

3.2 App端的 relayoutWindow()

当SF收到vsync信号后，通过Choreographer监听，分发到app进程。app收到vsync信号后doFrame()，再到主线程调用 doTraversal() ->performTraversals():

> ViewRootImpl.java
private void performTraversals() {
    // 调用 relayoutWindow 
    relayoutResult = relayoutWindow(params, viewVisibility, insetsPending);
    //...
    
    // Ask host how big it wants to be
    // 三大流程
    performMeasure(childWidthMeasureSpec, childHeightMeasureSpec);
    //...
    performLayout(lp, mWidth, mHeight);
    //```
    performDraw();
    //...
}
    > ViewRootImpl.java
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
    boolean insetsPending) throws RemoteException {
    //...
    // 1  mWindowSession是 IWindowSession 对象，调用relayout()
     int relayoutResult = mWindowSession.relayout(mWindow, mSeq, params,
                (int) (mView.getMeasuredWidth() * appScale + 0.5f),
                (int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
                insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
                mTmpFrame, mPendingOverscanInsets, mPendingContentInsets, mPendingVisibleInsets,
                mPendingStableInsets, mPendingOutsets, mPendingBackDropFrame, mPendingDisplayCutout,
                 // 此处传入的  mSurfaceControl对象 
                mPendingMergedConfiguration, mSurfaceControl, mTempInsets);
                
        if (mSurfaceControl.isValid()) {
            // 2 从 mSurfaceControl 中复制 surface 
            mSurface.copyFrom(mSurfaceControl);
        } else {
            // 无效，则销毁
            destroySurface();
        }
        
     //... 
    return relayoutResult;
}

• relayout() 传入 mSurfaceControl，跨进程调用到了WMS端。
• copyFrom() ，从 mSurfaceControl 中获取 Surface。

SurfaceControl 是啥？

SurfaceControl 可以控制一个被合成系统管理的、正在屏幕上显示的surface。它是Buffer数据和窗口的metadata的链接器。 通过这个 SurfaceControl构造的surface，app可以直接提交buffer数据到合成系统进行合成。此外还可以通过SurfaceControl.Transaction 来修改buffer的被显示的属性。如旋转、平移、裁剪。

3.3 SurfaceControl空参构造

是 ViewRootImpl 类成员变量：

private final SurfaceControl mSurfaceControl = new SurfaceControl();

SurfaceControl 的空参构造方法，啥都没干！目前也是个空壳。

3.4 小结

目前可以看出，在开始绘制时，调用了WMS的session.relayout(SurfaceControl mSurfaceControl)方法之后。就可以从SurfaceControl中得到 Surface对象。

那 session.relayout() 内部是如何做到的呢？ 继续看 Session.relayout()。

3.5 WMS端 Session.relayout()

>Session.java
@Override
public int relayout(IWindow window, int seq, WindowManager.LayoutParams attrs,
        int requestedWidth, int requestedHeight, int viewFlags, int flags, long frameNumber,
        Rect outFrame, Rect outOverscanInsets, Rect outContentInsets, Rect outVisibleInsets,
        Rect outStableInsets, Rect outsets, Rect outBackdropFrame,
        DisplayCutout.ParcelableWrapper cutout, MergedConfiguration mergedConfiguration,
        SurfaceControl outSurfaceControl, InsetsState outInsetsState) {
        
    // 继续调用 WMS的 relayoutWindow()
    int res = mService.relayoutWindow(this, window, seq, attrs,
            requestedWidth, requestedHeight, viewFlags, flags, frameNumber,
            outFrame, outOverscanInsets, outContentInsets, outVisibleInsets,
            outStableInsets, outsets, outBackdropFrame, cutout,
            mergedConfiguration, outSurfaceControl, outInsetsState);
    return res;
}
 > WMS.java
outSurfaceControl 从app进程传递到了WMS进程。 表示结果接收。它实现了parcelable接口，跨进程传递到了WMS中。
public int relayoutWindow(Session session, IWindow client, int seq, LayoutParams attrs,
        int requestedWidth, int requestedHeight, int viewVisibility, int flags,
        long frameNumber, Rect outFrame, Rect outOverscanInsets, Rect outContentInsets,
        Rect outVisibleInsets, Rect outStableInsets, Rect outOutsets, Rect outBackdropFrame,
        DisplayCutout.ParcelableWrapper outCutout, MergedConfiguration mergedConfiguration,
        SurfaceControl outSurfaceControl, InsetsState outInsetsState) {
        //...
        try {
            //调用 createSurfaceControl
            result = createSurfaceControl(outSurfaceControl, result, win, winAnimator);
        } catch (Exception e) {
            ...
        }
        //...
        
}           
> WMS.java
private int createSurfaceControl(SurfaceControl outSurfaceControl, int result, WindowState win,
        WindowStateAnimator winAnimator) {
    if (!win.mHasSurface) {
        result |= RELAYOUT_RES_SURFACE_CHANGED;
    }
    // 声明一个 WindowSurfaceController
    WindowSurfaceController surfaceController;
    
    try {
        //1  创建 WindowSurfaceController 对象
        surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type, win.mOwnerUid);
    } finally {
    }
    if (surfaceController != null) {
        // 2 从得到 WindowSurfaceController 对象中，获取 SurfaceController
        surfaceController.getSurfaceControl(outSurfaceControl);
    } else {
        // For some reason there isn't a surface.  Clear the
        // caller's object so they see the same state.
        Slog.w(TAG_WM, "Failed to create surface control for " + win);
        outSurfaceControl.release();
    }

    return result;
}

最终：

• winAnimator.createSurfaceLocked()得到WindowSurfaceController对象
• 从得到 WindowSurfaceController 对象中，获取 SurfaceController，返回给outSurfaceControl。

winAnimator 是 WindowStateAnimator类型。

3.5.1 winAnimator.createSurfaceLocked()

> WindowStateAnimator.java
WindowSurfaceController createSurfaceLocked(int windowType, int ownerUid) {
    final WindowState w = mWin;

    if (mSurfaceController != null) {
        // 如果有，则返回
        return mSurfaceController;
    }
    //...
    // Set up surface control with initial size.
    try {
        // 否则创建一个 WindowSurfaceController
        mSurfaceController = new WindowSurfaceController(mSession.mSurfaceSession,
                attrs.getTitle().toString(), width, height, format, flags, this,
                windowType, ownerUid);
        // ...
    } catch (OutOfResourcesException e) {
     //...
     }
    return mSurfaceController;
}

createSurfaceLocked() 就是创建了一个 WindowSurfaceController 对象。WindowSurfaceController的构造方法中会创建一个SurfaceControl对象。

3.5.2 WindowSurfaceController构造方法

> WindowSurfaceController.java
public WindowSurfaceController(SurfaceSession s, String name, int w, int h, int format,
        int flags, WindowStateAnimator animator, int windowType, int ownerUid) {
    mAnimator = animator;
    mSurfaceW = w;
    mSurfaceH = h;

    title = name;
    mService = animator.mService;
    final WindowState win = animator.mWin;
    mWindowType = windowType;
    mWindowSession = win.mSession;

    Trace.traceBegin(TRACE_TAG_WINDOW_MANAGER, "new SurfaceControl");
    // 1 调用的是 WindowState的 makeSurface()方法
    final SurfaceControl.Builder b = win.makeSurface()
            .setParent(win.getSurfaceControl())
            .setName(name)
            .setBufferSize(w, h)
            .setFormat(format)
            .setFlags(flags)
            .setMetadata(METADATA_WINDOW_TYPE, windowType)
            .setMetadata(METADATA_OWNER_UID, ownerUid);
            // 2 创建SurfaceControl对象 
    mSurfaceControl = b.build();
    Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
}
  >SurfaceControl.java 
  public SurfaceControl build() {
            if (mWidth < 0 || mHeight < 0) {
                throw new IllegalStateException(
                        "width and height must be positive or unset");
            }
            if ((mWidth > 0 || mHeight > 0) && (isColorLayerSet() || isContainerLayerSet())) {
                throw new IllegalStateException(
                        "Only buffer layers can set a valid buffer size.");
            }
            // 创建对象 ，调用了 SurfaceControl的有参构造方法。
            return new SurfaceControl(
                    mSession, mName, mWidth, mHeight, mFormat, mFlags, mParent, mMetadata);
        }

调用SurfaceControl的有参构造方法，构造了一个SurfaceControl对象。 还记得在3. 3，ViewRootImpl的成员变量mSurfaceControl，调用的是空参构造，啥都没做。

但是，现在SurfaceControl的有参构造做了什么呢？ 我们深入看看。

SurfaceControl的有参构造：

long mNativeObject; // package visibility only for Surface.java access
private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
        SurfaceControl parent, SparseIntArray metadata)
                throws OutOfResourcesException, IllegalArgumentException {
                //... 
                
                //注意这里第一个参数是  SurfaceSession
        mNativeObject = nativeCreate(session, name, w, h, format, flags,
                            parent != null ? parent.mNativeObject : 0, metaParcel);
}

>frameworks/base/core/jni/android_view_SurfaceControl.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
        jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
        jobject metadataParcel) {
    ScopedUtfChars name(env, nameStr);
    //这个就是之前创建 SurfaceSession创建时候的 SurfaceComposerClient对象。SF的代理服务。
    sp<SurfaceComposerClient> client;
    if (sessionObj != NULL) {
        // 之前创建的 mClient
        client = android_view_SurfaceSession_getClient(env, sessionObj);
    } else {
        
        client = SurfaceComposerClient::getDefault();
    }
    // 父 SurfaceControl
    SurfaceControl *parent = reinterpret_cast<SurfaceControl*>(parentObject);
    // 声明 SurfaceControl
    sp<SurfaceControl> surface;
    // 窗口的 metadata。 因为SurfaceControl 本身就是 surface和 metadata的接合器。
    LayerMetadata metadata;
    
    Parcel* parcel = parcelForJavaObject(env, metadataParcel);
    if (parcel && !parcel->objectsCount()) {
        status_t err = metadata.readFromParcel(parcel);
        if (err != NO_ERROR) {
          jniThrowException(env, "java/lang/IllegalArgumentException",
                            "Metadata parcel has wrong format");
        }
    }
    // 调用SF进程的 createSurfaceChecked()，创建surface对象 
    status_t err = client->createSurfaceChecked(
            String8(name.c_str()), w, h, format, &surface, flags, parent, std::move(metadata));
    if (err == NAME_NOT_FOUND) {
        jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
        return 0;
    } else if (err != NO_ERROR) {
        jniThrowException(env, OutOfResourcesException, NULL);
        return 0;
    }

    surface->incStrong((void *)nativeCreate);
    // 返回 SurfaceControl的 jlong 引用 
    return reinterpret_cast<jlong>(surface.get());
}

>frameworks/native/libs/gui/SurfaceComposerClient.cpp
status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, uint32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
    sp<SurfaceControl> sur;
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        // 
        sp<IBinder> handle;
        // gpb,buffer数据的生产者
        sp<IGraphicBufferProducer> gbp;

        uint32_t transformHint = 0;
        int32_t id = -1;
        // mClient 具体实现类是 SF的Client服务 。来创建surface
        err = mClient->createSurface(name, w, h, format, flags, parentHandle, std::move(metadata),
                                     &handle, &gbp, &id, &transformHint);

        if (outTransformHint) {
            *outTransformHint = transformHint;
        }
        ALOGE_IF(err, "SurfaceComposerClient::createSurface error %s", strerror(-err));
        if (err == NO_ERROR) {
            // 终于创建了一个native层的 SurfaceControl对象。注意，此时是native层的有参构造！！
            *outSurface =
                    new SurfaceControl(this, handle, gbp, id, w, h, format, transformHint, flags);
        }
    }
    return err;
}
继续看native层的有参构造： 
>frameworks/native/libs/gui/SurfaceControl.cpp
SurfaceControl::SurfaceControl(
        const sp<SurfaceComposerClient>& client,
        const sp<IBinder>& handle,
        const sp<IGraphicBufferProducer>& gbp,
        bool owned)
    : mClient(client), mHandle(handle), mGraphicBufferProducer(gbp), mOwned(owned)
    //赋值了一些成员变量
{
}

总结：

• WMS 的relayout() 通过 WindowSurfaceControl对象来创建 SurfaceControl 对象。此时的 SurfaceControl对象，不仅仅存在java层，也会在native层创建一个SurfaceControl对象。
• native层中，内部会通过之前建立连接surfaceSession来向SF请求buffer、metadata等信息，给SurfaceControl对象赋值。

注意，以上的逻辑还是在WMS的native层。 而跨进程的 createSurface()调用到底干了啥？

3.6 SF端 ISurfaceComposerClient.createSurface()

此时进入SF进程。 Client 就是 ISurfaceComposerClient 的实现类。

frameworks/native/services/surfaceflinger/Client.cpp
status_t Client::createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
                               uint32_t flags, const sp<IBinder>& parentHandle,
                               LayerMetadata metadata, sp<IBinder>* handle,
                               sp<IGraphicBufferProducer>* gbp) {
    // We rely on createLayer to check permissions.
    // 终于调用了SF。 创建一个layer
    return mFlinger->createLayer(name, this, w, h, format, flags, std::move(metadata), handle, gbp,
                                 parentHandle);
}
> frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp 
status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& client, uint32_t w,
                                     uint32_t h, PixelFormat format, uint32_t flags,
                                     LayerMetadata metadata, sp<IBinder>* handle,
                                     sp<IGraphicBufferProducer>* gbp,
                                     const sp<IBinder>& parentHandle,
                                     const sp<Layer>& parentLayer) {
    if (int32_t(w|h) < 0) {
       // 宽高不能为负数
        return BAD_VALUE;
    }
    status_t result = NO_ERROR;
    // 声明一个 layer对象
    sp<Layer> layer; 

    String8 uniqueName = getUniqueLayerName(name);
    // metadata
    if (metadata.has(METADATA_WINDOW_TYPE)) {
        int32_t windowType = metadata.getInt32(METADATA_WINDOW_TYPE, 0);
        if (windowType == 441731) {
            metadata.setInt32(METADATA_WINDOW_TYPE, InputWindowInfo::TYPE_NAVIGATION_BAR_PANEL);
            primaryDisplayOnly = true;
        }
    }
    // 根据flag 创建不同的layer对象。
    switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceBufferQueue:
            // 1 创建bufferQueue,只看这一种
            result = createBufferQueueLayer(client, uniqueName, w, h, flags, std::move(metadata),
                                            format, handle, gbp, &layer);
            break;
        case ISurfaceComposerClient::eFXSurfaceBufferState:
            result = createBufferStateLayer(client, uniqueName, w, h, flags, std::move(metadata),
                                            handle, &layer);
            break;
        case ISurfaceComposerClient::eFXSurfaceColor:
        case ISurfaceComposerClient::eFXSurfaceContainer:
           ...
        default:
            result = BAD_VALUE;
            break;
    }
   ...
    // 2 继续调用 addClientLayer
    result = addClientLayer(client, *handle, *gbp, layer, parentHandle, parentLayer,
                            addToCurrentState);
    ...
    return result;
}

• 创建了 BufferQueueLayer 对象，里面持有 sp<BufferLayerConsumer> mConsumer和 sp<IGraphicBufferProducer> mProducer，也就是GraphicBuffer的生产者和消费者对象。
• 加入到 layers 全局的集合中。

3.6.1 SF.createBufferQueueLayer()

frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

status_t SurfaceFlinger::createBufferQueueLayer(const sp<Client>& client, const String8& name,
                                                uint32_t w, uint32_t h, uint32_t flags,
                                                LayerMetadata metadata, PixelFormat& format,
                                                sp<IBinder>* handle,
                                                sp<IGraphicBufferProducer>* gbp,
                                                sp<Layer>* outLayer) {
    // initialize the surfaces
    // 格式
    switch (format) {
    case PIXEL_FORMAT_TRANSPARENT:
    case PIXEL_FORMAT_TRANSLUCENT:
        format = PIXEL_FORMAT_RGBA_8888;
        break;
    case PIXEL_FORMAT_OPAQUE:
        format = PIXEL_FORMAT_RGBX_8888;
        break;
    }
    // 创建layer
    sp<BufferQueueLayer> layer = getFactory().createBufferQueueLayer(
            LayerCreationArgs(this, client, name, w, h, flags, std::move(metadata)));
    status_t err = layer->setDefaultBufferProperties(w, h, format);
    if (err == NO_ERROR) {
        // 赋值 gbp生产者 
        *handle = layer->getHandle();
        *gbp = layer->getProducer();
        *outLayer = layer;
    }
    ALOGE_IF(err, "createBufferQueueLayer() failed (%s)", strerror(-err));
    return err;
}

3.6.2 SurfaceFlingerFactory.createBufferQueueLayer

frameworks/native/services/surfaceflinger/SurfaceFlingerFactory.cpp

sp<BufferQueueLayer> createBufferQueueLayer(const LayerCreationArgs& args) override {
            return new BufferQueueLayer(args);
        }

3.6.3 BufferQueueLayer 构造方法

继承关系：

class BufferQueueLayer : public BufferLayer, public BufferLayerConsumer::ContentsChangedListener 
{...
class BufferLayer : public Layer {...

3.6.4 BufferQueueLayer.onFirstRef()

void BufferQueueLayer::onFirstRef() {
    BufferLayer::onFirstRef();

    // Creates a custom BufferQueue for SurfaceFlingerConsumer to use
    // 声明生产者和消费者 
    sp<IGraphicBufferProducer> producer;
    sp<IGraphicBufferConsumer> consumer;
    // BufferQueue 初始化
    BufferQueue::createBufferQueue(&producer, &consumer, true);
    // MonitoredProducer分装了 producer，方便SF监听
    mProducer = new MonitoredProducer(producer, mFlinger, this);
    {
        // Grab the SF state lock during this since it's the only safe way to access RenderEngine
        Mutex::Autolock lock(mFlinger->mStateLock);
        // 封装了BufferLayerConsumer封装了 consumer
        mConsumer =
           new BufferLayerConsumer(consumer, mFlinger->getRenderEngine(), mTextureName, this);
    }
    mConsumer->setConsumerUsageBits(getEffectiveUsage(0));
    mConsumer->setContentsChangedListener(this);
    mConsumer->setName(mName);

    // BufferQueueCore::mMaxDequeuedBufferCount is default to 1
    if (!mFlinger->isLayerTripleBufferingDisabled()) {
      //设置为2
        mProducer->setMaxDequeuedBufferCount(2);
    }

    if (const auto display = mFlinger->getDefaultDisplayDevice()) {
        updateTransformHint(display);
    }
}

重点：

• 声明了 sp<IGraphicBufferProducer> producer; sp<IGraphicBufferConsumer> consumer;
• 调用 BufferQueue::createBufferQueue(&producer, &consumer, true);来创建这两个对象。

3.6.5 BufferQueue::createBufferQueue()

frameworks/native/libs/gui/BufferQueue.cpp

void BufferQueue::createBufferQueue(sp<IGraphicBufferProducer>* outProducer,
        sp<IGraphicBufferConsumer>* outConsumer,
        bool consumerIsSurfaceFlinger) {
    // BufferQueueCore 对象
    sp<BufferQueueCore> core(new BufferQueueCore());
    //BufferQueueProducer 生产对象
    sp<IGraphicBufferProducer> producer(new BufferQueueProducer(core, consumerIsSurfaceFlinger));
    // BufferQueueConsumer 消费对象
    sp<IGraphicBufferConsumer> consumer(new BufferQueueConsumer(core));

    *outProducer = producer;
    *outConsumer = consumer;
}
 static constexpr int NUM_BUFFER_SLOTS = 64;

因此，producer和consumer 真正的实现者就是 BufferQueueProducer 和 BufferQueueConsumer。

3.7 Client.attachLayer()

最终，加入全局的mLayers中。

>frameworks/native/services/surfaceflinger/Client.cpp
void Client::attachLayer(const sp<IBinder>& handle, const sp<Layer>& layer)
{
Mutex::Autolock _l(mLock);
mLayers.add(handle, layer);
}

至此，SF创建了 layer 对象，并且加入了Client服务的 mLayers列表中。layer中持有 sp<IGraphicBufferProducer> producer和 sp<IGraphicBufferConsumer> consumer;两个对象。具体的实现者就是 BufferQueueProducer 和 BufferQueueConsumer。

3.6 小结

在回顾下总体流程：

• App端 调用WMS的 relayoutWindow(MSurfaceControl)，传入的是一个空SurfaceControl对象-A(空参构造)。
• WMS端生成了java层的另一个SurfaceControl对象-B(有参构造)。同时在native层也生成了一个SurfaceControl对象。 内部通过IComposerClient对象，调用了SF的createSurface()方法。同时持有 IGraphicBufferProducer gbp的引用。
• SF端生成了Layer对象，同时生成了buffer生产者sp<IGraphicBufferProducer>和buffer消费者的sp<IGraphicBufferConsumer>。

接下来，从app端传过来的 SurfaceControl-A如何跟 SurfaceControl-B关联起来呢？当然是通过getSurfaceControl()方法了。

3.7 WindowSurfaceController.getSurfaceControl()

WindowSurfaceController.java

void getSurfaceControl(SurfaceControl outSurfaceControl) {
    outSurfaceControl.copyFrom(mSurfaceControl);
}

mSurfaceControl 就是 WindowSurfaceController 中持有之前创建的 SurfaceControl-B对象。 当前的 outSurfaceControl 是app传递过来的。 继续看 copyFrom():

3.8 SurfaceControl.copyFrom()

>SurfaceControl.java
public void copyFrom(SurfaceControl other) {
    mName = other.mName;
    mWidth = other.mWidth;
    mHeight = other.mHeight;
    assignNativeObject(nativeCopyFromSurfaceControl(other.mNativeObject));
}

3.8.1 nativeCopyFromSurfaceControl()

>frameworks/base/core/jni/android_view_SurfaceControl.cpp
static jlong nativeCopyFromSurfaceControl(JNIEnv* env, jclass clazz, jlong surfaceControlNativeObj) {
    // 根据引用值，得到native层的 SurfaceControl。此时是WMS的SurfaceControl对象-B
    sp<SurfaceControl> surface(reinterpret_cast<SurfaceControl *>(surfaceControlNativeObj));
    if (surface == nullptr) {
        return 0;
    }
    // 创建一个新的native的SurfaceControl对象C，调用的是有参构造方法
    sp<SurfaceControl> newSurface = new SurfaceControl(surface);
    newSurface->incStrong((void *)nativeCreate);
    return reinterpret_cast<jlong>(newSurface.get());
}

// 有参构造
SurfaceControl::SurfaceControl(const sp<SurfaceControl>& other) {
    mClient = other->mClient;
    mHandle = other->mHandle;
    mGraphicBufferProducer = other->mGraphicBufferProducer;
    mTransformHint = other->mTransformHint;
    mLayerId = other->mLayerId;
    mWidth = other->mWidth;
    mHeight = other->mHeight;
    mCreateFlags = other->mCreateFlags;
}

在native层创建了一个新的SurfaceControl对象。

3.8.2 assignNativeObject()

SurfaceControl.java

private void assignNativeObject(long nativeObject) {
// 传入的是 上一步新创建的native层的 SurfaceControl对象C。
    if (mNativeObject != 0) {
        // 释放之前的 
        release();
    }
    // 持有引用。
    mNativeObject = nativeObject;
}

至此，app端的Java层的SurfaceControl对象就与native层的SurfaceControl对象联系了起来。创建完成后，返回到app端 ViewRootImpl 的relayoutWindow()方法中。

3.9 mSurface.copyFrom()

Surface.java

public void copyFrom(SurfaceControl other) {
    // 从surfaceControl 拷贝
    if (other == null) {
        throw new IllegalArgumentException("other must not be null");
    }
    // 获取 SurfaceControl的 native对象引用
    long surfaceControlPtr = other.mNativeObject;
    if (surfaceControlPtr == 0) {
        throw new NullPointerException(
                "null SurfaceControl native object. Are you using a released SurfaceControl?");
    }
    // 从native层获取surface对象的引用 
    long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);
    
    //上锁
    synchronized (mLock) {
        // 同一个对象，则不做操作
        if (newNativeObject == mNativeObject) {
            return;
        }
        if (mNativeObject != 0) {
            // 释放之前的
            nativeRelease(mNativeObject);
        }
        // 设置新的引用
        setNativeObjectLocked(newNativeObject);
    }
}

3.9.1 nativeGetFromSurfaceControl()

frameworks/base/core/jni/android_view_Surface.cpp

static jlong nativeGetFromSurfaceControl(JNIEnv* env, jclass clazz,
        jlong nativeObject,
        jlong surfaceControlNativeObj) {
    //拿到 java层引用的c++ surface对象
    Surface* self(reinterpret_cast<Surface *>(nativeObject));
    // 获取c++层的 SurfaceControl对象
    sp<SurfaceControl> ctrl(reinterpret_cast<SurfaceControl *>(surfaceControlNativeObj));

    // If the underlying IGBP's are the same, we don't need to do anything.
    // 如果 surface对象和 SurfaceControl对象的 gbp一样，则不需要重新设值。
    if (self != nullptr &&
            IInterface::asBinder(self->getIGraphicBufferProducer()) ==
            IInterface::asBinder(ctrl->getIGraphicBufferProducer())) {
            // 返回即可
        return nativeObject;
    }
    // 如果gbp不一样，在重新构造一个
    sp<Surface> surface(ctrl->getSurface());
    if (surface != NULL) {
        surface->incStrong(&sRefBaseOwner);
    }
    // 返回引用
    return reinterpret_cast<jlong>(surface.get());
}

逻辑已经注释清楚了。问题是 SurfaceControl 的getSurface()如何工作的？

3.9.2 native层 SurfaceControl::getSurface()

frameworks/native/libs/gui/SurfaceControl.cpp

sp<Surface> SurfaceControl::getSurface()
{
    Mutex::Autolock _l(mLock);
    if (mSurfaceData == nullptr) {
        // 创建一个Surface
        return generateSurfaceLocked();
    }
    return mSurfaceData;
}
mutable sp<SurfaceControl> mBbqChild;
sp<Surface> SurfaceControl::generateSurfaceLocked()
{
    uint32_t ignore;
    auto flags = mCreateFlags & (ISurfaceComposerClient::eCursorWindow |
                                 ISurfaceComposerClient::eOpaque);
     // 通过 ISurfaceComposerClient，调用到SF进程中                            
    mBbqChild = mClient->createSurface(String8("bbq-wrapper"), 0, 0, mFormat,
                                       flags, mHandle, {}, &ignore);
     // mbbq是 SurfaceControl                                  
    mBbq = sp<BLASTBufferQueue>::make("bbq-adapter", mBbqChild, mWidth, mHeight, mFormat);

    // This surface is always consumed by SurfaceFlinger, so the
    // producerControlledByApp value doesn't matter; using false.
    // 创建 surface
    mSurfaceData = mBbq->getSurface(true);
    return mSurfaceData;
}

3.9.3 Surface.getSurface()

frameworks/native/libs/gui/BLASTBufferQueue.cpp

sp<Surface> BLASTBufferQueue::getSurface(bool includeSurfaceControlHandle) {
    std::unique_lock _lock{mMutex};
    sp<IBinder> scHandle = nullptr;
    if (includeSurfaceControlHandle && mSurfaceControl) {
        scHandle = mSurfaceControl->getHandle();
    }
    return new BBQSurface(mProducer, true, scHandle, this);
}

3.9.4 BBQSurface

// 继承了surface 
class BBQSurface : public Surface {
private:
    std::mutex mMutex;
    sp<BLASTBufferQueue> mBbq;
    bool mDestroyed = false;
public:
    BBQSurface(const sp<IGraphicBufferProducer>& igbp, bool controlledByApp,
               const sp<IBinder>& scHandle, const sp<BLASTBufferQueue>& bbq)
          : Surface(igbp, controlledByApp, scHandle), mBbq(bbq) {}

    void allocateBuffers() override {
        uint32_t reqWidth = mReqWidth ? mReqWidth : mUserWidth;
        uint32_t reqHeight = mReqHeight ? mReqHeight : mUserHeight;
        auto gbp = getIGraphicBufferProducer();
        std::thread ([reqWidth, reqHeight, gbp=getIGraphicBufferProducer(),
                      reqFormat=mReqFormat, reqUsage=mReqUsage] () {
            // 请求 allocateBuffers          
            gbp->allocateBuffers(reqWidth, reqHeight,
                                 reqFormat, reqUsage);

        }).detach();
    }

3.10 小结

在app端的SurfaceControl与native层的 SurfaceControl对象建立联系后。 app端Java层的Surface通过 copyFrom()方法，从native层的 SurfaceControl中拿到了 native层的 Surface对象，内部持有 IGraphicProducer gbp对象。可以和SF通信。

四、总结

• App端 调用WMS的 relayoutWindow(MSurfaceControl)，传入的是一个空SurfaceControl对象-A(空参构造)。
• WMS端生成了java层的另一个SurfaceControl对象-B(有参构造)。同时在native层也生成了一个 SurfaceControl 对象。内部通过IComposerClient对象，调用了SF的createSurface()方法。同时持有 IGraphicBufferProducer gbp的引用。
• SF端生成了Layer对象，同时生成了buffer生产者sp<IGraphicBufferProducer>和buffer消费者的sp<IGraphicBufferConsumer>。
• WMS端通过copy()方法让 App端传递过来的 SurfaceControl-A对象也引用到了SF的 IGraphicBufferProducer。
• 在App端的 SurfaceControl-A对象呗赋值后，再通过Surface对象的copyFrom()方法，让 Java层Surface与Native层的Surface建立联系。最终，也就是和SF的IGraphicBufferProducer 建立了联系。

到此这篇关于基于Android10渲染Surface的创建过程的文章就介绍到这了,更多相关Android Surface内容请搜索三水点靠木以前的文章或继续浏览下面的相关文章希望大家以后多多支持三水点靠木！