[Android禪修之路] Android圖形系統，從Activity到Surface
theme: channing-cyan
Android圖形系統，從Activity到Surface
1 從Activity到Surface
首先，我們最初見到應用程序，都是Activity界面，那麼Activity界面是如何顯示的呢，首先Activity的顯示是通過我們調用setContentView函數觸發的，這個函數會解析View的xml文件，創建View，然後每一個View樹都會有一個根View，它就是ViewRootImpl
雖然這個類名是ViewRootImpl，但是它並不是一個真正的View，它更多的是管理View的顯示刷新等邏輯，當我們界面需要刷新的時候，會調用ViewRootImpl的performTraversals函數，這個函數就會觸發對應的刷新邏輯（刷新相關的邏輯不是本篇的重點，這裏先略過，後續講刷新的時候再詳細説明）。
然後在performTraversals函數中，會調用一個很重要的函數relayoutWindow，這個函數中就會創建Surface
1.1 Surface的創建過程
首先看一下應用中Surface的創建過程
```java [frameworks/base/core/java/android/view/ViewRootImpl.java] public final class ViewRootImpl implements ViewParent, View.AttachInfo.Callbacks, ThreadedRenderer.DrawCallbacks { // 1 調用無參的構造方法創建Surface和SurfaceControl public final Surface mSurface = new Surface(); private final SurfaceControl mSurfaceControl = new SurfaceControl();
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
boolean insetsPending) throws RemoteException {
// 2 通過mWindowSession的relayout處理SurfaceControl
int relayoutResult = mWindowSession.relayout(mWindow, mSeq, params,
(int) (mView.getMeasuredWidth() * appScale + 0.5f),
(int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
mTmpFrame, mPendingOverscanInsets, mPendingContentInsets, mPendingVisibleInsets,
mPendingStableInsets, mPendingOutsets, mPendingBackDropFrame, mPendingDisplayCutout,
mPendingMergedConfiguration, mSurfaceControl, mTempInsets);
if (mSurfaceControl.isValid()) {
// 3 調用Surface的copyFrom，參數是SurfaceControl
mSurface.copyFrom(mSurfaceControl);
} else {
destroySurface();
}
}
} ```
Java層的Surface是在ViewRootImpl中創建的，創建的具體步驟如下
- 首先調用Surface的空參數構造函數，創建出一個Surface對象
- 然後調用SurfaceControl的空參數構造函數，創建出一個SurfaceControl的殼對象
- 調用mWindowSession的relayout填充這個SurfaceControl殼對象
- 調用Surface的copyFrom
1.2 Surface.java的定義
Surface中定義了一個native函數，它的真正實現是在native層
```java [frameworks/base/core/java/android/view/Surface.java] public class Surface implements Parcelable { long mNativeObject;
private static native long nativeGetFromSurfaceControl(long surfaceObject,
long surfaceControlNativeObject);
public void copyFrom(SurfaceControl other) {
...
long surfaceControlPtr = other.mNativeObject;
long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);
synchronized (mLock) {
if (newNativeObject == mNativeObject) {
return;
}
if (mNativeObject != 0) {
nativeRelease(mNativeObject);
}
setNativeObjectLocked(newNativeObject);
}
}
} ```
1.3 SurfaceControl.java的定義
Java層和Surface配對的還有一個SurfaceControl，它有幾個構造函數，如下
```java
[frameworks/base/core/java/android/view/SurfaceControl.java]
public final class SurfaceControl implements Parcelable {
// 這個構造函數是空構造函數，默認調用的是這個
public SurfaceControl() {
mCloseGuard.open("release");
}
public SurfaceControl(SurfaceControl other) {
mName = other.mName;
mWidth = other.mWidth;
mHeight = other.mHeight;
mNativeObject = other.mNativeObject;
other.mCloseGuard.close();
other.mNativeObject = 0;
mCloseGuard.open("release");
}
// 這個構造函數是真正工作的構造函數，它會調用native層的nativeCreate
private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
SurfaceControl parent, SparseIntArray metadata)
throws OutOfResourcesException, IllegalArgumentException {
if (name == null) {
throw new IllegalArgumentException("name must not be null");
}
if ((flags & SurfaceControl.HIDDEN) == 0) {
Log.w(TAG, "Surfaces should always be created with the HIDDEN flag set "
+ "to ensure that they are not made visible prematurely before "
+ "all of the surface's properties have been configured. "
+ "Set the other properties and make the surface visible within "
+ "a transaction. New surface name: " + name,
new Throwable());
}
mName = name;
mWidth = w;
mHeight = h;
Parcel metaParcel = Parcel.obtain();
try {
if (metadata != null && metadata.size() > 0) {
metaParcel.writeInt(metadata.size());
for (int i = 0; i < metadata.size(); ++i) {
metaParcel.writeInt(metadata.keyAt(i));
metaParcel.writeByteArray(
ByteBuffer.allocate(4).order(ByteOrder.nativeOrder())
.putInt(metadata.valueAt(i)).array());
}
metaParcel.setDataPosition(0);
}
mNativeObject = nativeCreate(session, name, w, h, format, flags,
parent != null ? parent.mNativeObject : 0, metaParcel);
} finally {
metaParcel.recycle();
}
if (mNativeObject == 0) {
throw new OutOfResourcesException(
"Couldn't allocate SurfaceControl native object");
}
mCloseGuard.open("release");
}
...
} ```
2 SurfaceControl 的創建過程
SurfaceControl的創建分為兩步
- 創建一個空的SurfaceControl的Java對象
- 調用relayoutWindow將這個空殼傳遞進去
SurfaceControl創建的真正邏輯就在第二步的relayoutWindow中
2.1ViewRootImpl.relayoutWindow
```java [frameworks/base/core/java/android/view/ViewRootImpl.java] public final Surface mSurface = new Surface(); // 1 private final SurfaceControl mSurfaceControl = new SurfaceControl();
public ViewRootImpl(Context context, Display display) { mContext = context; // mWindowSession其實是WindowManagerService在app進程中的一個會話對象 // 這個Session是frameworks/base/services/core/java/com/android/server/wm/Session.java // 它在每個進程中都存在一個 mWindowSession = WindowManagerGlobal.getWindowSession(); }
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility, boolean insetsPending) throws RemoteException { // 2 調用Session的relayout函數，這個函數會調用WMS的relayoutWindow函數 int relayoutResult = mWindowSession.relayout(..., mSurfaceControl, mTempInsets); if (mSurfaceControl.isValid()) { // 3 調用Surface的copyFrom，這個函數會對Surface進行填充 mSurface.copyFrom(mSurfaceControl); } else { destroySurface(); } ```
2.2 Session的relayout
java
[frameworks/base/services/core/java/com/android/server/wm/Session.java]
public int relayout(...,SurfaceControl outBLASTSurfaceControl) {
// 這個函數就是調用WMS的relayoutWindow
int res = mService.relayoutWindow(this, window, seq, attrs,
requestedWidth, requestedHeight, viewFlags, flags, frameNumber,
outFrame, outContentInsets, outVisibleInsets,
outStableInsets, outBackdropFrame, cutout,
mergedConfiguration, outSurfaceControl, outInsetsState, outActiveControls,
outSurfaceSize, outBLASTSurfaceControl);
return res;
}
2.3 WindowManagerService.java
SurfaceControl在創建時調用的是一個空參數的構造函數，它實際上是一個空殼對象，真正的填充是通過WMS的createSurfaceControl函數中進行的
```java [frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java] public int relayoutWindow(..., SurfaceControl outSurfaceControl, InsetsState outInsetsState) { try { result = createSurfaceControl(outSurfaceControl, result, win, winAnimator); } catch (Exception e) { } }
private int createSurfaceControl(SurfaceControl outSurfaceControl, int result, WindowState win, WindowStateAnimator winAnimator) {
WindowSurfaceController surfaceController;
try {
// 1 調用winAnimator創建WindowSurfaceController對象，這個WindowSurfaceController
// 對象其實內部包含SurfaceController
// 這個winAnimator其實是WindowStateAnimator.java對象
surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type, win.mOwnerUid);
}
if (surfaceController != null) {
// 2 將 WindowSurfaceController 拷貝到SurfaceControl對象中，見 [3.2]
// 調用 WindowSurfaceController 的 getSurfaceControl
surfaceController.getSurfaceControl(outSurfaceControl);
} else {
outSurfaceControl.release();
}
return result;
} ```
2.4 WindowStateAnimator.java
```java [frameworks/base/services/core/java/com/android/server/wm/WindowStateAnimator.java] WindowSurfaceController createSurfaceLocked(int windowType, int ownerUid) { ... try { ... // 創建WindowSurfaceController對象 mSurfaceController = new WindowSurfaceController(attrs.getTitle().toString(), width, height, format, flags, this, windowType, ownerUid); mSurfaceController.setColorSpaceAgnostic((attrs.privateFlags & WindowManager.LayoutParams.PRIVATE_FLAG_COLOR_SPACE_AGNOSTIC) != 0); setOffsetPositionForStackResize(false); mSurfaceFormat = format; w.setHasSurface(true); } ...
mLastHidden = true;
return mSurfaceController;
} ```
2.5 WindowSurfaceController.java
java
[frameworks/base/services/core/java/com/android/server/wm/WindowSurfaceController.java]
WindowSurfaceController(String name, int w, int h, int format,
int flags, WindowStateAnimator animator, int windowType, int ownerUid) {
...
final SurfaceControl.Builder b = win.makeSurface()
.setParent(win.getSurfaceControl())
.setName(name)
.setBufferSize(w, h)
.setFormat(format)
.setFlags(flags)
.setMetadata(METADATA_WINDOW_TYPE, windowType)
.setMetadata(METADATA_OWNER_UID, ownerUid);
mSurfaceControl = b.build();
...
}
所以前面一連串的調用，最後其實就是調用到了 Java 層的 SurfaceControl 的構造函數，而 Java 層的 SurfaceControl 的構造函數，會調用到 native 層的構造函數。
2.6 SurfaceControl.build
java
[frameworks/base/core/java/android/view/SurfaceControl.java]
public SurfaceControl build() {
if (mWidth < 0 || mHeight < 0) {
throw new IllegalStateException(
"width and height must be positive or unset");
}
if ((mWidth > 0 || mHeight > 0) && (isColorLayerSet() || isContainerLayerSet())) {
throw new IllegalStateException(
"Only buffer layers can set a valid buffer size.");
}
//這裏調用的構造函數就是真正工作的構造函數
return new SurfaceControl(
mSession, mName, mWidth, mHeight, mFormat, mFlags, mParent, mMetadata);
}
2.7 SurfaceControl的構造函數
```java
[frameworks/base/core/java/android/view/SurfaceControl.java]
private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
SurfaceControl parent, SparseIntArray metadata, WeakReference
// 調用 native 層的構造函數 nativeCreate，拿到的 mNativeObject
// 是一個 SurfaceControl 的指針地址
mNativeObject = nativeCreate(session, name, w, h, format, flags,
parent != null ? parent.mNativeObject : 0, metaParcel);
} finally {
metaParcel.recycle();
}
if (mNativeObject == 0) {
throw new OutOfResourcesException(
"Couldn't allocate SurfaceControl native object");
}
// 通過 SurfaceControl 指針地址，拿到對應的 SurfaceControl 的 IBinder 對象
mNativeHandle = nativeGetHandle(mNativeObject);
mCloseGuard.openWithCallSite("release", callsite);
} ```
到此，SurfaceControl 的構造函數最後拿到了一個 Java 層的 IBinder 對象。
2.8 getSurfaceControl
這裏又調用了一個copyFrom，不過傳入的參數是mSurfaceControl，這個mSurfaceControl是哪裏來的呢，原來它就是WindowSurfaceController初始化build時的SurfaceControl (見2.5)。
```java [frameworks/base/services/core/java/com/android/server/wm/WindowSurfaceController.java] void getSurfaceControl(SurfaceControl outSurfaceControl) { outSurfaceControl.copyFrom(mSurfaceControl); }
[frameworks/base/core/java/android/view/SurfaceControl.java] public void copyFrom(SurfaceControl other) { mName = other.mName; mWidth = other.mWidth; mHeight = other.mHeight; assignNativeObject(nativeCopyFromSurfaceControl(other.mNativeObject)); } ```
3 native層的構造函數
3.1 nativeCreate
從 [2.7] 中的構造函數，我們可以看到會調用到 native。然後在 native 中，會創建一個 SurfaceComposerClient。
```cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
jobject metadataParcel) {
ScopedUtfChars name(env, nameStr);
sp
// sessionObj 是從 Java 層傳遞下來的，單進程唯一，見 [2.1]
// 如果有 sessionObj 就從 sessionObj 中取，如果沒有，
// 就取 SurfaceComposerClient 默認的
if (sessionObj != NULL) {
client = android_view_SurfaceSession_getClient(env, sessionObj);
} else {
client = SurfaceComposerClient::getDefault();
}
// 將 Java 層傳遞過來的指針地址，還原成 SurfaceControl 指針
SurfaceControl *parent = reinterpret_cast<SurfaceControl*>(parentObject);
sp<SurfaceControl> surface;
LayerMetadata metadata;
...
// 調用 SurfaceComposerClient 的 createSurfaceChecked。見小節[4]
status_t err = client->createSurfaceChecked(
String8(name.c_str()), w, h, format, &surface, flags, parent, std::move(metadata));
if (err == NAME_NOT_FOUND) {
jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
return 0;
} else if (err != NO_ERROR) {
jniThrowException(env, OutOfResourcesException, NULL);
return 0;
}
surface->incStrong((void *)nativeCreate);
return reinterpret_cast<jlong>(surface.get());
} ```
3.2 WindowSurfaceController.getSurfaceControl
獲取 SurfaceControl，在[2.3]中最後會調用到此處。而它其實調用的是 SurfaceControl 的 copyFrom。也就是將原本的 mSurfaceControl 拷貝到傳入的 outSurfaceControl。
cpp
void getSurfaceControl(SurfaceControl outSurfaceControl) {
outSurfaceControl.copyFrom(mSurfaceControl,
"WindowSurfaceController.getSurfaceControl");
}
3.3 SurfaceControl.copyFrom
到這裏，SurfaceControl 的創建算是結束了。
cpp
public void copyFrom(@NonNull SurfaceControl other, String callsite) {
mName = other.mName;
mWidth = other.mWidth;
mHeight = other.mHeight;
mLocalOwnerView = other.mLocalOwnerView;
assignNativeObject(nativeCopyFromSurfaceControl(other.mNativeObject), callsite);
}
3.4 nativeCopyFromSurfaceControl
```cpp
static jlong nativeCopyFromSurfaceControl(JNIEnv* env, jclass clazz, jlong surfaceControlNativeObj) {
sp
sp<SurfaceControl> newSurface = new SurfaceControl(surface);
newSurface->incStrong((void *)nativeCreate);
return reinterpret_cast<jlong>(newSurface.get());
} ```
3.5 Surface.copyFrom
接下來，我們回到 [1.1] 再來看看 Surface 的 copyFrom。同樣，是通過 native 實現的，具體的實現方式我們應該已經可以猜出來，和 SurfaceControl 類似了。
java
[frameworks/base/core/java/android/view/Surface.java]
public void copyFrom(SurfaceControl other) {
...
//調用native層的實現函數
long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);
...
}
3.6 nativeGetFromSurfaceControl
```cpp
[frameworks/base/core/jni/android_view_Surface.cpp]
static jlong nativeGetFromSurfaceControl(JNIEnv env, jclass clazz,
jlong nativeObject,
jlong surfaceControlNativeObj) {
// 從java層傳入的兩個參數，分別保存着native層Surface，SurfaceControl的指針
Surface self(reinterpret_cast
// 如果這兩個指針對象的GBP相同，就什麼也不做
if (self != nullptr &&
IInterface::asBinder(self->getIGraphicBufferProducer()) ==
IInterface::asBinder(ctrl->getIGraphicBufferProducer())) {
return nativeObject;
}
// 否則就創建一個native層的surface，調用SurfaceControl.getSurface
sp<Surface> surface(ctrl->getSurface());
if (surface != NULL) {
surface->incStrong(&sRefBaseOwner);
}
return reinterpret_cast<jlong>(surface.get());
} ```
3.7 SurfaceControl的getSurface
```cpp
[frameworks/native/libs/gui/SurfaceControl.cpp]
sp
sp
最後，調用到了Surface的構造函數。
cpp
[frameworks/native/libs/gui/Surface.cpp]
Surface::Surface(const sp<IGraphicBufferProducer>& bufferProducer, bool controlledByApp)
: mGraphicBufferProducer(bufferProducer),
...
到這裏，Surface的創建過程算是初步完成了，這裏面出現了一個很重要的對象mGraphicBufferProducer，它是通過SurfaceControl調用Surface構造函數傳遞進去的。具體 GraphicBufferProducer 的介紹可以看 解讀SurfaceFlinger中的BufferQueue
4 SurfaceComposerClient
接下來，我們再來説説[3.1]的最後一部分，SurfaceComposerClient 的 createSurfaceChecked。
4.1 SurfaceComposerClient
前面聊到了在SurfaceComposerClient。現在我們就 SurfaceComposerClient 詳細聊一聊它在圖形系統中的作用。
首先，由於系統中有多個應用程序，而只有一個 SurfaceFlinger 通信，為了能夠區分 SurfaceFlinger 中的應用程序，所以有了 SurfaceComposerClient。
首先看到 Client 後綴，我們下意思的想到就是 C/S 模型，關於 SurfaceComposerClient，它在圖形系統中的繼承關係如下。
ISurfaceComposer 是服務端 (SurfaceFlinger後面簡稱SF) 的接口，它的實現類分別有 * BpSurfaceComposer：它是代理類，用於客户端 App 向服務端SF 通信。 * BnSurfaceComposer：它是實現類，真正的實現者就是 SF。
ISurfaceComposerClient 是代表客户端在 SF 中的代理，它的實現類分別有 * BpSurfaceComposerClient：它是代理類，用於客户端 App 向服務端的 Client 通信。 * BnSurfaceComposerClient：它是是實現類，真正的實現者就是 Client。
每一個客户的 App 都會在 SF 中對應存在一個 Client，而每一個 Client 都會包含一個 mFlinger 對象，用來和 SF 通信。App 會先拿到 SF 的代理對象 BpSurfaceComposer，然後通過它與 SF 建立連接拿到代理類 BpSurfaceComposerClient。
最終通過 BpSurfaceComposerClient -> Client -> SF 的方式進行通信。
如圖所示，就是所有 Client 提供的 api，通過這些 api，我們就可以在 App 端調用到 SF 中。
所以上圖在多 App 時可以簡化為
```cpp
[frameworks/native/libs/gui/ISurfaceComposer.cpp]
class BpSurfaceComposer : public BpInterface
[frameworks/native/libs/gui/include/gui/ISurfaceComposer.h]
class BnSurfaceComposer: public BnInterface
ISurfaceComposerClient 代表的是 App，ISurfaceComposer 代表的是 SF。 接下來我們會關注兩點 1. 它們是如何創建的 2. 它們是如何建立連接的
接下來看一下這個mClient是如何創建的。
在[3.1]中，SurfaceComposerClient 的創建方式有兩種，它們分別是 * SurfaceComposerClient::getDefault() * android_view_SurfaceSession_getClient()
4.2 SurfaceComposerClient::getDefault()
getDefault 創建的方式很簡單，就是一個單例。
cpp
sp<SurfaceComposerClient> SurfaceComposerClient::getDefault() {
// 這裏其實就是通過一個單例來創建 SurfaceComposerClient
return DefaultComposerClient::getComposerClient();
}
4.3 onFirstRef
然後，Android 的 framework 層，涉及到 Binder 通信時一般都會繼承 RefBase，這時我們就要注意 onFirstRef 這個函數。
由於它是 Binder 通信，所以一定會有一個建立連接的過程，而這裏的 onFirstRef 做的就是建立連接。
```cpp [frameworks/native/libs/gui/SurfaceComposerClient.cpp] void SurfaceComposerClient::onFirstRef() {
//1. 通過 ComposerService 拿到了一個 ISurfaceComposer
sp<ISurfaceComposer> sf(ComposerService::getComposerService());
if (sf != nullptr && mStatus == NO_INIT) {
sp<ISurfaceComposerClient> conn;
// 調用 ISurfaceComposer 的 createConnection
conn = sf->createConnection();
if (conn != nullptr) {
// 對 mClient 進行賦值
mClient = conn;
mStatus = NO_ERROR;
}
}
} ```
ComposerService 它是一個單例，這裏通過 getComposerService 拿到一個 sp\<ISurfaceComposer> 對象。這是一個 ISurfaceComposer 的強智能指針。
前面我們已經介紹了 ISurfaceComposer，它是 SF 的藉口，在 App 端會有它的代理對象。
4.4 ComposerService 的構造函數
我們先看它的構造函數，它裏面只調用了 connectLocked。
cpp
[frameworks/native/libs/gui/SurfaceComposerClient.cpp]
ComposerService::ComposerService()
: Singleton<ComposerService>() {
Mutex::Autolock _l(mLock);
connectLocked();
}
4.5 ComposerService::connectLocked
```cpp void ComposerService::connectLocked() { const String16 name("SurfaceFlinger");
// getService 是 ServiceManager 的函數
// 定義在 [frameworks/native/cmds/servicemanager/ServiceManager.cpp]
// 它其實就是獲取 SurfaceFlinger 的 Binder 對象
// 通過Binder獲取SurfaceFlinger的Binder對象
while (getService(name, &mComposerService) != NO_ERROR) {
usleep(250000);
}
// Create the death listener.
...
// 下面是很常見的 Binder 連接的代碼
mDeathObserver = new DeathObserver(*const_cast<ComposerService*>(this));
IInterface::asBinder(mComposerService)->linkToDeath(mDeathObserver);
} ```
4.6 SurfaceFlinger::createConnection
再回到 [1.2]，當通過 ServiceManager 拿到 SF 的Binder 對象之後，就通過 Binder 對象和 SF 建立連接。
接下來看createConnection返回的具體對象
```cpp
[frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp]
sp
static sp
createConnection函數也很簡單，就是返回了一個Client對象，這個Client的定義如下
c
[frameworks/native/services/surfaceflinger/Client.h]
class Client : public BnSurfaceComposerClient
還記得我們一開始説的那4個對象嗎，這個 BnSurfaceComposerClient ，其實就是 App 端對應的 ISurfaceComposerClient 的實現類。
所以，在 SurfaceComposerClient 的 onFirstRef 中創建的 mClient 對象，其實就是系統進程中的 BnSurfaceComposerClient。而它的實現類，就是 Client。
4.7 SurfaceComposerClient.createSurface
接下來再看 mClient->createSurface，它其實就是調用的 Client 的 createSurface。
cpp
[frameworks/native/services/surfaceflinger/Client.cpp]
status_t Client::createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
uint32_t flags, const sp<IBinder>& parentHandle,
LayerMetadata metadata, sp<IBinder>* handle,
sp<IGraphicBufferProducer>* gbp) {
// 這個mFlinger就是SurfaceFlinger
return mFlinger->createLayer(name, this, w, h, format, flags, std::move(metadata), handle, gbp,
parentHandle);
}
createLayer其實就是創建Layer，在SurfaceFlinger中有許多種Layer，這裏我們來看其中的一種比較常見的eFXSurfaceBufferQueue
cpp
[frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp]
status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& client, uint32_t w,
uint32_t h, PixelFormat format, uint32_t flags,
LayerMetadata metadata, sp<IBinder>* handle,
sp<IGraphicBufferProducer>* gbp,
const sp<IBinder>& parentHandle,
const sp<Layer>& parentLayer) {
...
switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
case ISurfaceComposerClient::eFXSurfaceBufferQueue:
result = createBufferQueueLayer(client, uniqueName, w, h, flags, std::move(metadata),
format, handle, gbp, &layer);
...
}
它調用了createBufferQueueLayer，在這個裏面對gbp進行了初始化
```cpp
[frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp]
status_t SurfaceFlinger::createBufferQueueLayer(const sp
sp<BufferQueueLayer> layer = getFactory().createBufferQueueLayer(
LayerCreationArgs(this, client, name, w, h, flags, std::move(metadata)));
status_t err = layer->setDefaultBufferProperties(w, h, format);
if (err == NO_ERROR) {
// 初始化gbp
*handle = layer->getHandle();
*gbp = layer->getProducer();
*outLayer = layer;
}
return err;
} ```
到這裏，我們終於理清了從 Activity 到 Surface 的邏輯，並且看到了 Layer 的創建。大致細節有： * SurfaceControl 的創建和 Surface 的創建 * SurfaceControl 中 SurfaceComposerClient 的創建 * SurfaceComposerClient 的 C/S 模型 * SurfaceComposerClient 中 App 端和 SF 端的通信 * SurfaceComposerClient 通過 Binder 通信的方式，調用 SF 創建 Layer
- Activity啟動源碼解析（Android12）
- 從MediaServer看Binder的使用方式（一）
- 從MediaServer看Binder的使用方式（二）
- [Android禪修之路] 解讀Layer
- [Android禪修之路] Android圖形系統，從Activity到Surface
- [Android禪修之路] 解讀 GraphicBuffer 之 Framework 層
- [Android禪修之路] 解讀SurfaceFlinger中的BufferQueue
- [Android禪修之路] SurfaceFlinger 合成中的工作
- [Android禪修之路] SurfaceFlinger 中的一些對象
- [Android禪修之路] SurfaceFlinger 合成前的預處理
- [Android禪修之路] SurfaceFlinger合成總覽
- [Android禪修之路] SurfaceFlinger的啟動過程
- [Android禪修之路] Android 圖形系統開篇