Android图形体系，从Activity到Surface

Android禅修之路

1 从Activity到Surface

首要，咱们最初见到应用程序，都是Activity界面，那么Activity界面是怎么显现的呢，首要Activity的显现是经过咱们调用setContentView函数触发的，这个函数会解析View的xml文件，创立View，然后每一个View树都会有一个根View，它便是ViewRootImpl

尽管这个类名是ViewRootImpl，但是它并不是一个真实的View，它更多的是管理View的显现改写等逻辑，当咱们界面需要改写的时分，会调用ViewRootImpl的performTraversals函数，这个函数就会触发对应的改写逻辑（改写相关的逻辑不是本篇的重点，这儿先略过，后续讲改写的时分再详细阐明）。

然后在performTraversals函数中，会调用一个很重要的函数relayoutWindow，这个函数中就会创立Surface

1.1 Surface的创立进程

首要看一下应用中Surface的创立进程

[frameworks/base/core/java/android/view/ViewRootImpl.java]
public final class ViewRootImpl implements ViewParent,
        View.AttachInfo.Callbacks, ThreadedRenderer.DrawCallbacks {
    // 1 调用无参的结构办法创立Surface和SurfaceControl
    public final Surface mSurface = new Surface();
    private final SurfaceControl mSurfaceControl = new SurfaceControl();
    private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
            boolean insetsPending) throws RemoteException {
		// 2 经过mWindowSession的relayout处理SurfaceControl
        int relayoutResult = mWindowSession.relayout(mWindow, mSeq, params,
                (int) (mView.getMeasuredWidth() * appScale + 0.5f),
                (int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
                insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
                mTmpFrame, mPendingOverscanInsets, mPendingContentInsets, mPendingVisibleInsets,
                mPendingStableInsets, mPendingOutsets, mPendingBackDropFrame, mPendingDisplayCutout,
                mPendingMergedConfiguration, mSurfaceControl, mTempInsets);
        if (mSurfaceControl.isValid()) {
            // 3 调用Surface的copyFrom，参数是SurfaceControl
            mSurface.copyFrom(mSurfaceControl);
        } else {
            destroySurface();
        }	
	}
}

Java层的Surface是在ViewRootImpl中创立的，创立的详细步骤如下

  1. 首要调用Surface的空参数结构函数，创立出一个Surface目标
  2. 然后调用SurfaceControl的空参数结构函数，创立出一个SurfaceControl的壳目标
  3. 调用mWindowSession的relayout填充这个SurfaceControl壳目标
  4. 调用Surface的copyFrom

1.2 Surface.java的界说

Surface中界说了一个native函数，它的真实完成是在native层

[frameworks/base/core/java/android/view/Surface.java]
public class Surface implements Parcelable {
    long mNativeObject; 
    private static native long nativeGetFromSurfaceControl(long surfaceObject,
            long surfaceControlNativeObject);
	public void copyFrom(SurfaceControl other) {
		...
		long surfaceControlPtr = other.mNativeObject;
		long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);
		synchronized (mLock) {
			if (newNativeObject == mNativeObject) {
				return;
			}
			if (mNativeObject != 0) {
				nativeRelease(mNativeObject);
			}
			setNativeObjectLocked(newNativeObject);
		}
	}
}

1.3 SurfaceControl.java的界说

Java层和Surface配对的还有一个SurfaceControl，它有几个结构函数，如下

[frameworks/base/core/java/android/view/SurfaceControl.java]
public final class SurfaceControl implements Parcelable {  
    // 这个结构函数是空结构函数，默许调用的是这个
    public SurfaceControl() {
        mCloseGuard.open("release");
    }
    public SurfaceControl(SurfaceControl other) {
        mName = other.mName;
        mWidth = other.mWidth;
        mHeight = other.mHeight;
        mNativeObject = other.mNativeObject;
        other.mCloseGuard.close();
        other.mNativeObject = 0;
        mCloseGuard.open("release");
    }
    // 这个结构函数是真实作业的结构函数，它会调用native层的nativeCreate
    private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
        SurfaceControl parent, SparseIntArray metadata)
                throws OutOfResourcesException, IllegalArgumentException {
	    if (name == null) {
	        throw new IllegalArgumentException("name must not be null");
	    }
	    if ((flags & SurfaceControl.HIDDEN) == 0) {
	        Log.w(TAG, "Surfaces should always be created with the HIDDEN flag set "
	                + "to ensure that they are not made visible prematurely before "
	                + "all of the surface's properties have been configured.  "
	                + "Set the other properties and make the surface visible within "
	                + "a transaction.  New surface name: " + name,
	                new Throwable());
	    }
	    mName = name;
	    mWidth = w;
	    mHeight = h;
	    Parcel metaParcel = Parcel.obtain();
	    try {
	        if (metadata != null && metadata.size() > 0) {
	            metaParcel.writeInt(metadata.size());
	            for (int i = 0; i < metadata.size(); ++i) {
	                metaParcel.writeInt(metadata.keyAt(i));
	                metaParcel.writeByteArray(
	                        ByteBuffer.allocate(4).order(ByteOrder.nativeOrder())
	                                .putInt(metadata.valueAt(i)).array());
	            }
	            metaParcel.setDataPosition(0);
	        }
	        mNativeObject = nativeCreate(session, name, w, h, format, flags,
	                parent != null ? parent.mNativeObject : 0, metaParcel);
	    } finally {
	        metaParcel.recycle();
	    }
	    if (mNativeObject == 0) {
	        throw new OutOfResourcesException(
	                "Couldn't allocate SurfaceControl native object");
	    }
	    mCloseGuard.open("release");
	}
	...
}

2 SurfaceControl 的创立进程

SurfaceControl的创立分为两步

  1. 创立一个空的SurfaceControl的Java目标
  2. 调用relayoutWindow将这个空壳传递进去

SurfaceControl创立的真实逻辑就在第二步的relayoutWindow中

2.1ViewRootImpl.relayoutWindow

[frameworks/base/core/java/android/view/ViewRootImpl.java]
public final Surface mSurface = new Surface();
// 1
private final SurfaceControl mSurfaceControl = new SurfaceControl();
public ViewRootImpl(Context context, Display display) {
    mContext = context;
    // mWindowSession其实是WindowManagerService在app进程中的一个会话目标
    // 这个Session是frameworks/base/services/core/java/com/android/server/wm/Session.java
    // 它在每个进程中都存在一个
    mWindowSession = WindowManagerGlobal.getWindowSession();
}
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
        boolean insetsPending) throws RemoteException {
    // 2 调用Session的relayout函数，这个函数会调用WMS的relayoutWindow函数
    int relayoutResult = mWindowSession.relayout(..., mSurfaceControl, mTempInsets);
    if (mSurfaceControl.isValid()) {
        // 3 调用Surface的copyFrom，这个函数会对Surface进行填充
        mSurface.copyFrom(mSurfaceControl);
    } else {
        destroySurface();
    }

2.2 Session的relayout

[frameworks/base/services/core/java/com/android/server/wm/Session.java]
public int relayout(...,SurfaceControl outBLASTSurfaceControl) {
    // 这个函数便是调用WMS的relayoutWindow
    int res = mService.relayoutWindow(this, window, seq, attrs,
            requestedWidth, requestedHeight, viewFlags, flags, frameNumber,
            outFrame, outContentInsets, outVisibleInsets,
            outStableInsets, outBackdropFrame, cutout,
            mergedConfiguration, outSurfaceControl, outInsetsState, outActiveControls,
            outSurfaceSize, outBLASTSurfaceControl);
    return res;
}

2.3 WindowManagerService.java

SurfaceControl在创立时调用的是一个空参数的结构函数，它实际上是一个空壳目标，真实的填充是经过WMS的createSurfaceControl函数中进行的

[frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java]
public int relayoutWindow(..., SurfaceControl outSurfaceControl, InsetsState outInsetsState) {
    try {
        result = createSurfaceControl(outSurfaceControl, result, win, winAnimator);
    } catch (Exception e) {
    }
}
private int createSurfaceControl(SurfaceControl outSurfaceControl, int result, WindowState win,
        WindowStateAnimator winAnimator) {
    WindowSurfaceController surfaceController;
    try {
        // 1 调用winAnimator创立WindowSurfaceController目标，这个WindowSurfaceController
        // 目标其实内部包括SurfaceController
        // 这个winAnimator其实是WindowStateAnimator.java目标
        surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type, win.mOwnerUid);
    }
    if (surfaceController != null) {
        // 2 将 WindowSurfaceController 拷贝到SurfaceControl目标中，见 [3.2]
        // 调用 WindowSurfaceController 的 getSurfaceControl
        surfaceController.getSurfaceControl(outSurfaceControl);
    } else {
        outSurfaceControl.release();
    }
    return result;
}

2.4 WindowStateAnimator.java

[frameworks/base/services/core/java/com/android/server/wm/WindowStateAnimator.java]
WindowSurfaceController createSurfaceLocked(int windowType, int ownerUid) {
    ...
    try {
        ...
        // 创立WindowSurfaceController目标
        mSurfaceController = new WindowSurfaceController(attrs.getTitle().toString(), width,
                height, format, flags, this, windowType, ownerUid);
        mSurfaceController.setColorSpaceAgnostic((attrs.privateFlags
                & WindowManager.LayoutParams.PRIVATE_FLAG_COLOR_SPACE_AGNOSTIC) != 0);
        setOffsetPositionForStackResize(false);
        mSurfaceFormat = format;
        w.setHasSurface(true);
    } ...
    mLastHidden = true;
    return mSurfaceController;
}

2.5 WindowSurfaceController.java

[frameworks/base/services/core/java/com/android/server/wm/WindowSurfaceController.java]
WindowSurfaceController(String name, int w, int h, int format,
        int flags, WindowStateAnimator animator, int windowType, int ownerUid) {
    ...
    final SurfaceControl.Builder b = win.makeSurface()
            .setParent(win.getSurfaceControl())
            .setName(name)
            .setBufferSize(w, h)
            .setFormat(format)
            .setFlags(flags)
            .setMetadata(METADATA_WINDOW_TYPE, windowType)
            .setMetadata(METADATA_OWNER_UID, ownerUid);
    mSurfaceControl = b.build();
    ...
}

所以前面一连串的调用，最终其实便是调用到了 Java 层的 SurfaceControl 的结构函数，而 Java 层的 SurfaceControl 的结构函数，会调用到 native 层的结构函数。

2.6 SurfaceControl.build

[frameworks/base/core/java/android/view/SurfaceControl.java]
public SurfaceControl build() {
    if (mWidth < 0 || mHeight < 0) {
        throw new IllegalStateException(
                "width and height must be positive or unset");
    }
    if ((mWidth > 0 || mHeight > 0) && (isColorLayerSet() || isContainerLayerSet())) {
        throw new IllegalStateException(
                "Only buffer layers can set a valid buffer size.");
    }
    //这儿调用的结构函数便是真实作业的结构函数
    return new SurfaceControl(
            mSession, mName, mWidth, mHeight, mFormat, mFlags, mParent, mMetadata);
}

2.7 SurfaceControl的结构函数

[frameworks/base/core/java/android/view/SurfaceControl.java]
private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
        SurfaceControl parent, SparseIntArray metadata, WeakReference<View> localOwnerView,
        String callsite)
                throws OutOfResourcesException, IllegalArgumentException {
    ...
    try {
        if (metadata != null && metadata.size() > 0) {
            metaParcel.writeInt(metadata.size());
            for (int i = 0; i < metadata.size(); ++i) {
                metaParcel.writeInt(metadata.keyAt(i));
                metaParcel.writeByteArray(
                        ByteBuffer.allocate(4).order(ByteOrder.nativeOrder())
                                .putInt(metadata.valueAt(i)).array());
            }
            metaParcel.setDataPosition(0);
        }
	// 调用 native 层的结构函数 nativeCreate，拿到的 mNativeObject
	// 是一个 SurfaceControl 的指针地址
        mNativeObject = nativeCreate(session, name, w, h, format, flags,
                parent != null ? parent.mNativeObject : 0, metaParcel);
    } finally {
        metaParcel.recycle();
    }
    if (mNativeObject == 0) {
        throw new OutOfResourcesException(
                "Couldn't allocate SurfaceControl native object");
    }
    // 经过 SurfaceControl 指针地址，拿到对应的 SurfaceControl 的 IBinder 目标
    mNativeHandle = nativeGetHandle(mNativeObject);
    mCloseGuard.openWithCallSite("release", callsite);
}

到此，SurfaceControl 的结构函数最终拿到了一个 Java 层的 IBinder 目标。

2.8 getSurfaceControl

这儿又调用了一个copyFrom，不过传入的参数是mSurfaceControl，这个mSurfaceControl是哪里来的呢，本来它便是WindowSurfaceController初始化build时的SurfaceControl (见2.5)。

[frameworks/base/services/core/java/com/android/server/wm/WindowSurfaceController.java]
void getSurfaceControl(SurfaceControl outSurfaceControl) {
    outSurfaceControl.copyFrom(mSurfaceControl);
}
[frameworks/base/core/java/android/view/SurfaceControl.java]
public void copyFrom(SurfaceControl other) {
    mName = other.mName;
    mWidth = other.mWidth;
    mHeight = other.mHeight;
    assignNativeObject(nativeCopyFromSurfaceControl(other.mNativeObject));
}

3 native层的结构函数

3.1 nativeCreate

从 [2.7] 中的结构函数，咱们能够看到会调用到 native。然后在 native 中，会创立一个 SurfaceComposerClient。

static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
        jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
        jobject metadataParcel) {
    ScopedUtfChars name(env, nameStr);
    sp<SurfaceComposerClient> client;
	// sessionObj 是从 Java 层传递下来的，单进程仅有，见 [2.1]
	// 假如有 sessionObj 就从 sessionObj 中取，假如没有，
	// 就取 SurfaceComposerClient 默许的
    if (sessionObj != NULL) {
        client = android_view_SurfaceSession_getClient(env, sessionObj);
    } else {
        client = SurfaceComposerClient::getDefault();
    }
	// 将 Java 层传递过来的指针地址，还原成 SurfaceControl 指针
    SurfaceControl *parent = reinterpret_cast<SurfaceControl*>(parentObject);
    sp<SurfaceControl> surface;
    LayerMetadata metadata;
    ...
	// 调用 SurfaceComposerClient 的 createSurfaceChecked。见小节[4]
    status_t err = client->createSurfaceChecked(
            String8(name.c_str()), w, h, format, &surface, flags, parent, std::move(metadata));
    if (err == NAME_NOT_FOUND) {
        jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
        return 0;
    } else if (err != NO_ERROR) {
        jniThrowException(env, OutOfResourcesException, NULL);
        return 0;
    }
    surface->incStrong((void *)nativeCreate);
    return reinterpret_cast<jlong>(surface.get());
}

3.2 WindowSurfaceController.getSurfaceControl

获取 SurfaceControl，在[2.3]中最终会调用到此处。而它其实调用的是 SurfaceControl 的 copyFrom。也便是将本来的 mSurfaceControl 拷贝到传入的 outSurfaceControl。

void getSurfaceControl(SurfaceControl outSurfaceControl) {
	outSurfaceControl.copyFrom(mSurfaceControl,
	"WindowSurfaceController.getSurfaceControl");
}

3.3 SurfaceControl.copyFrom

到这儿，SurfaceControl 的创立算是完毕了。

    public void copyFrom(@NonNull SurfaceControl other, String callsite) {
        mName = other.mName;
        mWidth = other.mWidth;
        mHeight = other.mHeight;
        mLocalOwnerView = other.mLocalOwnerView;
        assignNativeObject(nativeCopyFromSurfaceControl(other.mNativeObject), callsite);
    }

3.4 nativeCopyFromSurfaceControl

static jlong nativeCopyFromSurfaceControl(JNIEnv* env, jclass clazz, jlong surfaceControlNativeObj) {
    sp<SurfaceControl> surface(reinterpret_cast<SurfaceControl *>(surfaceControlNativeObj));
    if (surface == nullptr) {
        return 0;
    }
    sp<SurfaceControl> newSurface = new SurfaceControl(surface);
    newSurface->incStrong((void *)nativeCreate);
    return reinterpret_cast<jlong>(newSurface.get());
}

3.5 Surface.copyFrom

接下来，咱们回到 [1.1] 再来看看 Surface 的 copyFrom。相同，是经过 native 完成的，详细的完成方法咱们应该现已能够猜出来，和 SurfaceControl 相似了。

[frameworks/base/core/java/android/view/Surface.java]
public void copyFrom(SurfaceControl other) {
    ...
    //调用native层的完成函数
    long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);
    ...
}

3.6 nativeGetFromSurfaceControl

[frameworks/base/core/jni/android_view_Surface.cpp]
static jlong nativeGetFromSurfaceControl(JNIEnv* env, jclass clazz,
        jlong nativeObject,
        jlong surfaceControlNativeObj) {
    // 从java层传入的两个参数，别离保存着native层Surface，SurfaceControl的指针
    Surface* self(reinterpret_cast<Surface *>(nativeObject));
    sp<SurfaceControl> ctrl(reinterpret_cast<SurfaceControl *>(surfaceControlNativeObj));
    // 假如这两个指针目标的GBP相同，就什么也不做
    if (self != nullptr &&
            IInterface::asBinder(self->getIGraphicBufferProducer()) ==
            IInterface::asBinder(ctrl->getIGraphicBufferProducer())) {
        return nativeObject;
    }
    // 否则就创立一个native层的surface，调用SurfaceControl.getSurface
    sp<Surface> surface(ctrl->getSurface());
    if (surface != NULL) {
        surface->incStrong(&sRefBaseOwner);
    }
    return reinterpret_cast<jlong>(surface.get());
}

3.7 SurfaceControl的getSurface

[frameworks/native/libs/gui/SurfaceControl.cpp]
sp<Surface> SurfaceControl::getSurface() const
{
    Mutex::Autolock _l(mLock);
    if (mSurfaceData == nullptr) {
        // 真实的创立目标的函数
        return generateSurfaceLocked();
    }
    return mSurfaceData;
}
sp<Surface> SurfaceControl::generateSurfaceLocked() const
{
    // 创立了一个Surface目标，调用了结构函数，传入了一个mGraphicBufferProducer
    mSurfaceData = new Surface(mGraphicBufferProducer, false);
    return mSurfaceData;
}

最终，调用到了Surface的结构函数。

[frameworks/native/libs/gui/Surface.cpp]
Surface::Surface(const sp<IGraphicBufferProducer>& bufferProducer, bool controlledByApp)
      : mGraphicBufferProducer(bufferProducer),
	  ...

到这儿，Surface的创立进程算是开始完成了，这儿面出现了一个很重要的目标mGraphicBufferProducer，它是经过SurfaceControl调用Surface结构函数传递进去的。详细 GraphicBufferProducer 的介绍能够看 解读SurfaceFlinger中的BufferQueue

4 SurfaceComposerClient

接下来，咱们再来说说[3.1]的最终一部分，SurfaceComposerClient 的 createSurfaceChecked。

4.1 SurfaceComposerClient

前面聊到了在SurfaceComposerClient。现在咱们就 SurfaceComposerClient 详细聊一聊它在图形体系中的作用。

首要，因为体系中有多个应用程序，而只要一个 SurfaceFlinger 通讯，为了能够区分 SurfaceFlinger 中的应用程序，所以有了 SurfaceComposerClient。

首要看到 Client 后缀，咱们下意思的想到便是 C/S 模型，关于 SurfaceComposerClient，它在图形体系中的承继关系如下。

[Android禅修之路] Android图形系统，从Activity到Surface

ISurfaceComposer 是服务端 (SurfaceFlinger后边简称SF) 的接口，它的完成类别离有

  • BpSurfaceComposer：它是署理类，用于客户端 App 向服务端SF 通讯。
  • BnSurfaceComposer：它是完成类，真实的完成者便是 SF。

ISurfaceComposerClient 是代表客户端在 SF 中的署理，它的完成类别离有

  • BpSurfaceComposerClient：它是署理类，用于客户端 App 向服务端的 Client 通讯。
  • BnSurfaceComposerClient：它是是完成类，真实的完成者便是 Client。

每一个客户的 App 都会在 SF 中对应存在一个 Client，而每一个 Client 都会包括一个 mFlinger 目标，用来和 SF 通讯。App 会先拿到 SF 的署理目标 BpSurfaceComposer，然后经过它与 SF 树立衔接拿到署理类 BpSurfaceComposerClient。

最终经过 BpSurfaceComposerClient -> Client -> SF 的方法进行通讯。

如图所示，便是所有 Client 提供的 api，经过这些 api，咱们就能够在 App 端调用到 SF 中。

[Android禅修之路] Android图形系统，从Activity到Surface

所以上图在多 App 时能够简化为

[Android禅修之路] Android图形系统，从Activity到Surface

[frameworks/native/libs/gui/ISurfaceComposer.cpp]
class BpSurfaceComposer : public BpInterface<ISurfaceComposer>
[frameworks/native/libs/gui/include/gui/ISurfaceComposer.h]
class BnSurfaceComposer: public BnInterface<ISurfaceComposer> {

ISurfaceComposerClient 代表的是 App，ISurfaceComposer 代表的是 SF。 接下来咱们会关注两点

  1. 它们是怎么创立的
  2. 它们是怎么树立衔接的

接下来看一下这个mClient是怎么创立的。

在[3.1]中，SurfaceComposerClient 的创立方法有两种，它们别离是

  • SurfaceComposerClient::getDefault()
  • android_view_SurfaceSession_getClient()

4.2 SurfaceComposerClient::getDefault()

getDefault 创立的方法很简单，便是一个单例。

sp<SurfaceComposerClient> SurfaceComposerClient::getDefault() {
    // 这儿其实便是经过一个单例来创立 SurfaceComposerClient
    return DefaultComposerClient::getComposerClient();
}

4.3 onFirstRef

然后，Android 的 framework 层，涉及到 Binder 通讯时一般都会承继 RefBase，这时咱们就要留意 onFirstRef 这个函数。

因为它是 Binder 通讯，所以必定会有一个树立衔接的进程，而这儿的 onFirstRef 做的便是树立衔接。

[frameworks/native/libs/gui/SurfaceComposerClient.cpp]
void SurfaceComposerClient::onFirstRef() {
    //1. 经过 ComposerService 拿到了一个 ISurfaceComposer
    sp<ISurfaceComposer> sf(ComposerService::getComposerService());
    if (sf != nullptr && mStatus == NO_INIT) {
        sp<ISurfaceComposerClient> conn;
        // 调用 ISurfaceComposer 的 createConnection
        conn = sf->createConnection();
        if (conn != nullptr) {
            // 对 mClient 进行赋值
            mClient = conn;
            mStatus = NO_ERROR;
        }
    }
}

ComposerService 它是一个单例，这儿经过 getComposerService 拿到一个 sp<ISurfaceComposer> 目标。这是一个 ISurfaceComposer 的强智能指针。

前面咱们现已介绍了 ISurfaceComposer，它是 SF 的托言，在 App 端会有它的署理目标。

4.4 ComposerService 的结构函数

咱们先看它的结构函数，它里边只调用了 connectLocked。

[frameworks/native/libs/gui/SurfaceComposerClient.cpp]
ComposerService::ComposerService()
: Singleton<ComposerService>() {
    Mutex::Autolock _l(mLock);
    connectLocked();
}

4.5 ComposerService::connectLocked

void ComposerService::connectLocked() {
    const String16 name("SurfaceFlinger");
    // getService 是 ServiceManager 的函数
    // 界说在 [frameworks/native/cmds/servicemanager/ServiceManager.cpp]
    // 它其实便是获取 SurfaceFlinger 的 Binder 目标
    // 经过Binder获取SurfaceFlinger的Binder目标
    while (getService(name, &mComposerService) != NO_ERROR) {
        usleep(250000);
    }
    // Create the death listener.
    ...
    // 下面是很常见的 Binder 衔接的代码
    mDeathObserver = new DeathObserver(*const_cast<ComposerService*>(this));
    IInterface::asBinder(mComposerService)->linkToDeath(mDeathObserver);
}

4.6 SurfaceFlinger::createConnection

再回到 [1.2]，当经过 ServiceManager 拿到 SF 的Binder 目标之后，就经过 Binder 目标和 SF 树立衔接。

接下来看createConnection回来的详细目标

[frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp]
sp<ISurfaceComposerClient> SurfaceFlinger::createConnection() {
    return initClient(new Client(this));
}
static sp<ISurfaceComposerClient> initClient(const sp<Client>& client) {
    status_t err = client->initCheck();
    if (err == NO_ERROR) {
        return client;
    }
    return nullptr;
}

createConnection函数也很简单，便是回来了一个Client目标，这个Client的界说如下

[frameworks/native/services/surfaceflinger/Client.h]
class Client : public BnSurfaceComposerClient

还记得咱们一开始说的那4个目标吗，这个 BnSurfaceComposerClient ，其实便是 App 端对应的 ISurfaceComposerClient 的完成类。

所以，在 SurfaceComposerClient 的 onFirstRef 中创立的 mClient 目标，其实便是体系进程中的 BnSurfaceComposerClient。而它的完成类，便是 Client。

4.7 SurfaceComposerClient.createSurface

接下来再看 mClient->createSurface，它其实便是调用的 Client 的 createSurface。

[frameworks/native/services/surfaceflinger/Client.cpp]
status_t Client::createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
                               uint32_t flags, const sp<IBinder>& parentHandle,
                               LayerMetadata metadata, sp<IBinder>* handle,
                               sp<IGraphicBufferProducer>* gbp) {
    // 这个mFlinger便是SurfaceFlinger
    return mFlinger->createLayer(name, this, w, h, format, flags, std::move(metadata), handle, gbp,
                                 parentHandle);
}

createLayer其实便是创立Layer，在SurfaceFlinger中有许多种Layer，这儿咱们来看其间的一种比较常见的eFXSurfaceBufferQueue

[frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp]
status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& client, uint32_t w,
                                     uint32_t h, PixelFormat format, uint32_t flags,
                                     LayerMetadata metadata, sp<IBinder>* handle,
                                     sp<IGraphicBufferProducer>* gbp,
                                     const sp<IBinder>& parentHandle,
                                     const sp<Layer>& parentLayer) {
    ...
    switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceBufferQueue:
            result = createBufferQueueLayer(client, uniqueName, w, h, flags, std::move(metadata),
                                            format, handle, gbp, &layer);
    ...
}

它调用了createBufferQueueLayer，在这个里边对gbp进行了初始化

[frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp]
status_t SurfaceFlinger::createBufferQueueLayer(const sp<Client>& client, const String8& name,
                                                uint32_t w, uint32_t h, uint32_t flags,
                                                LayerMetadata metadata, PixelFormat& format,
                                                sp<IBinder>* handle,
                                                sp<IGraphicBufferProducer>* gbp,
                                                sp<Layer>* outLayer) {
    ...
    sp<BufferQueueLayer> layer = getFactory().createBufferQueueLayer(
            LayerCreationArgs(this, client, name, w, h, flags, std::move(metadata)));
    status_t err = layer->setDefaultBufferProperties(w, h, format);
    if (err == NO_ERROR) {
        // 初始化gbp
        *handle = layer->getHandle();
        *gbp = layer->getProducer();
        *outLayer = layer;
    }
    return err;
}

到这儿，咱们终于理清了从 Activity 到 Surface 的逻辑，并且看到了 Layer 的创立。大致细节有：

  • SurfaceControl 的创立和 Surface 的创立
  • SurfaceControl 中 SurfaceComposerClient 的创立
  • SurfaceComposerClient 的 C/S 模型
  • SurfaceComposerClient 中 App 端和 SF 端的通讯
  • SurfaceComposerClient 经过 Binder 通讯的方法，调用 SF 创立 Layer