Android6.0 显示系统（三） 管理图像缓冲区
上篇博客最后分析到MonitoredProducer对象，这个对象只是一个代理，真正实是BufferQueueProducer类，这个对象和BufferQueueCore有关联，可以管理最多达64块的缓冲区。Surface可以理解为一张画布，那么Surface为何要和一个缓冲区队列相关呢？在播放动画时，美妙至少要播放24帧画面才能形成比较真实的动画效果。而这些数据是通过cpu解码得到的，准备他们需要时间。对于图像显示设备而言，刷新周期是固定的，我们必须要在它需要数据的时候把数据准备好。视频播放的每一帧也需要在指定的时间播放，因此解码器会提前准备好一批数据，这些数据保存在解码器内存的缓冲区中，当时间到达是，解码器会把内部缓冲区的图像复制到Surface中，但是显示设备并不是立刻就把数据取走的，因此Surface也需要缓冲区来临时保存数据。
一、BufferQueueCore BufferQueueProducer BufferQueueConsumer
上篇博客在Layer的onFirstRef函数中，调用了下面函数，创建了3个对象BufferQueueCore BufferQueueProducer BufferQueueConsumer。其中BufferCore是核心，把BufferQueueProducer和BufferQueueConsumer对象连接在一起。
void BufferQueue::createBufferQueue(sp* outProducer,
sp* outConsumer,
const sp& allocator) {
sp core(new BufferQueueCore(allocator));
sp producer(new BufferQueueProducer(core));
sp consumer(new BufferQueueConsumer(core));
*outProducer = producer;
*outConsumer = consumer;
} 1.1 生产者和core的联系
IGraphicBufferProducer 的大致接口如下，BufferQueueProducer类是接口IGraphicBufferProducer 的实现，使用BufferQueueProducer之前先要调用connect函数，使用结束后调用disconnect断开连接。
class IGraphicBufferProducer : public IInterface
{
public:
virtual status_t requestBuffer(int slot, sp* buf) = 0;
virtual status_t setBufferCount(int bufferCount) = 0;
virtual status_t dequeueBuffer(int* slot, sp* fence, bool async,
uint32_t w, uint32_t h, PixelFormat format, uint32_t usage) = 0;
virtual status_t detachBuffer(int slot) = 0;
virtual status_t detachNextBuffer(sp* outBuffer,
sp* outFence) = 0;
virtual status_t attachBuffer(int* outSlot,
const sp& buffer) = 0;
virtual status_t queueBuffer(int slot,
const QueueBufferInput& input, QueueBufferOutput* output) = 0;
virtual void cancelBuffer(int slot, const sp& fence) = 0;
virtual int query(int what, int* value) = 0;
virtual status_t connect(const sp& listener,
int api, bool producerControlledByApp, QueueBufferOutput* output) = 0;
virtual status_t disconnect(int api) = 0;
virtual status_t setSidebandStream(const sp& stream) = 0;
virtual void allocateBuffers(bool async, uint32_t width, uint32_t height,
PixelFormat format, uint32_t usage) = 0;
virtual status_t allowAllocation(bool allow) = 0;
virtual status_t setGenerationNumber(uint32_t generationNumber) = 0;
virtual String8 getConsumerName() const = 0;
};
在BufferQueueCore类中定义了一个64项的数据mSlots。
BufferQueueDefs::SlotsType mSlots;typedef BufferSlot SlotsType[NUM_BUFFER_SLOTS];每个缓冲区的类型是BufferSlot类型。它有两个重要的成员变量，mGraphicBuffer是指向图像缓冲区GraphicBuffer的指针，mBufferState表示图像缓冲区的状态。
sp mGraphicBuffer;
......
BufferState mBufferState; BufferState的状态有下面几个
enum BufferState {
FREE = 0,//空闲
DEQUEUED = 1,//生产状态，被生产者拥有
QUEUED = 2,//保存数据状态，被BufferQueue拥有
ACQUIRED = 3//消费状态，被消费者拥有
};BufferQueueProducer的dequeueBuffer函数用来向BufferQueueCore申请一个空闲的slot，这个slot可能已经有缓冲区，也可能没有，如果没有缓冲区，dequeueBuffer函数会分配一块新的缓冲区。得到空闲的slot后，还需要调用requestBuffer函数来取得一块缓冲区。得到缓冲区，如果不需要了，可以使用cancelBuffer函数来释放这个slot。调用dequeueBuffer函数之后，缓冲区的拥有者是生产者，缓冲区处于DEQUEUED状态。一旦缓冲区复制数据完成，通过queueBuffer函数把缓冲区的控制权交还给BufferQueueCore，这时候缓冲区将处于QUEUED状态。
1.2 消费者和core的联系
下面是IGraphicBufferComsumer接口的几个主要函数：
virtual status_t acquireBuffer(BufferItem* outBuffer,
nsecs_t expectedPresent, uint64_t maxFrameNumber = 0) override;
......
virtual status_t releaseBuffer(int slot, uint64_t frameNumber,
const sp& releaseFence, EGLDisplay display,
EGLSyncKHR fence);
virtual status_t connect(const sp& consumerListener,
bool controlledByApp);
virtual status_t disconnect(); 取走数据的时候，需要调用acquireBuffer函数，将缓冲区状态变成ACQUIRED，使用完之后调用releaseBuffer函数可以吧缓冲区数据归还给BufferQueueCore，这样缓冲区就变成FREE。
1.3 三者联系
对象BufferQueueProducer和BufferQueueConsumer好像没有直接联系，其实都是通过共同的BufferQueueCore对象连接在一起的，很多操作时直接使用BufferQueueCore对象的成员变量而不是函数来完成的。
二、GraphicBuffer对象的创建
对Surface而言，图像缓冲区是一个重要的数据结构，它是用户进程和图像显示器之间的纽带，下面我们来看看Surface的图像缓冲区是如何创建的。
2.1 内存缓冲区的创建
前面介绍了过dequeueBuffer函数，图像缓冲区GraphicBuffer就是在这个函数中创建的，当从BufferQueueCore中获取到空间的slot时，如果这个slot没有缓冲区就要新建一个。
下面是dequeueBuffer函数的部分代码，在从BufferQueueCore中获取到slot的时候，如果需要重新分配图像缓冲区就会调用mCore->mAllocator->createGraphicBuffer函数来重新创建一个图像缓冲区。
......
*outSlot = found;//found复制到outslot
ATRACE_BUFFER_INDEX(found);
attachedByConsumer = mSlots[found].mAttachedByConsumer;
mSlots[found].mBufferState = BufferSlot::DEQUEUED;//slot的状态修改变成生产状态
const sp& buffer(mSlots[found].mGraphicBuffer);
if ((buffer == NULL) ||//为空，或者需要重新分配
buffer->needsReallocation(width, height, format, usage))
{
mSlots[found].mAcquireCalled = false;
mSlots[found].mGraphicBuffer = NULL;
mSlots[found].mRequestBufferCalled = false;
mSlots[found].mEglDisplay = EGL_NO_DISPLAY;
mSlots[found].mEglFence = EGL_NO_SYNC_KHR;
mSlots[found].mFence = Fence::NO_FENCE;
mCore->mBufferAge = 0;
returnFlags |= BUFFER_NEEDS_REALLOCATION;//需要重启分配缓冲区
} else {
// We add 1 because that will be the frame number when this buffer
// is queued
mCore->mBufferAge =
mCore->mFrameCounter + 1 - mSlots[found].mFrameNumber;
}
BQ_LOGV("dequeueBuffer: setting buffer age to %" PRIu64,
mCore->mBufferAge);
if (CC_UNLIKELY(mSlots[found].mFence == NULL)) {
BQ_LOGE("dequeueBuffer: about to return a NULL fence - "
"slot=%d w=%d h=%d format=%u",
found, buffer->width, buffer->height, buffer->format);
}
eglDisplay = mSlots[found].mEglDisplay;
eglFence = mSlots[found].mEglFence;
*outFence = mSlots[found].mFence;
mSlots[found].mEglFence = EGL_NO_SYNC_KHR;
mSlots[found].mFence = Fence::NO_FENCE;
mCore->validateConsistencyLocked();
} // Autolock scope
if (returnFlags & BUFFER_NEEDS_REALLOCATION) {//如果需要重启分配图像缓冲区
status_t error;
BQ_LOGV("dequeueBuffer: allocating a new buffer for slot %d", *outSlot);
sp graphicBuffer(mCore->mAllocator->createGraphicBuffer(//创建图像缓冲区
width, height, format, usage, &error));
if (graphicBuffer == NULL) {
BQ_LOGE("dequeueBuffer: createGraphicBuffer failed");
return error;
}
{ // Autolock scope
Mutex::Autolock lock(mCore->mMutex);
if (mCore->mIsAbandoned) {
BQ_LOGE("dequeueBuffer: BufferQueue has been abandoned");
return NO_INIT;
}
graphicBuffer->setGenerationNumber(mCore->mGenerationNumber);
mSlots[*outSlot].mGraphicBuffer = graphicBuffer;
} // Autolock scope
}
...... mAllocator的类型是IGraphicBufferAlloc，也是一个Binder对象，它是在BufferQueueCore的构造函数中得到的，这个时候allocator为空的，具体要从Layer的构造函数中调用BufferQueue::createBufferQueue函数是，那个时候allocator参数就为空。然后通过getComposerService来调用createGraphicBufferAlloc函数来创建这个mAllocator对象。
之前的博客分析过getComposerService返回的是和SurfaceFlinger进程的Binder对象，因此最后是到SurfaceFlinger的createGraphicBufferAlloc函数中去了（但是这里有点搞不明白明明是在一个进程中为什么要用Binder呢？）。
......
if (allocator == NULL) {
sp composer(ComposerService::getComposerService());
mAllocator = composer->createGraphicBufferAlloc();
if (mAllocator == NULL) {
BQ_LOGE("createGraphicBufferAlloc failed");
}
}
...... 下面我们来看SurfaceFlinger的createGraphicBufferAlloc函数。
sp SurfaceFlinger::createGraphicBufferAlloc()
{
sp gba(new GraphicBufferAlloc());
return gba;
} 因此最后BufferQueueProducer中的dequeueBuffer函数中调用mCore->mAllocator的createGraphicBuffer函数就是调用了GraphicBufferAlloc的createGraphicBufferAlloc函数。
sp GraphicBufferAlloc::createGraphicBuffer(uint32_t width,
uint32_t height, PixelFormat format, uint32_t usage, status_t* error) {
sp graphicBuffer(
new GraphicBuffer(width, height, format, usage));
status_t err = graphicBuffer->initCheck();
*error = err;
......//错误处理
return graphicBuffer;
} 我们来看下GraphicBuffer对象的构造函数中调用了initSize函数。
GraphicBuffer::GraphicBuffer(uint32_t inWidth, uint32_t inHeight,
PixelFormat inFormat, uint32_t inUsage)
: BASE(), mOwner(ownData), mBufferMapper(GraphicBufferMapper::get()),
mInitCheck(NO_ERROR), mId(getUniqueId())
{
......
mInitCheck = initSize(inWidth, inHeight, inFormat, inUsage);
}在initSize函数中调用GraphicBufferAllocator的alloc来分配内存。
status_t GraphicBuffer::initSize(uint32_t inWidth, uint32_t inHeight,
PixelFormat inFormat, uint32_t inUsage)
{
GraphicBufferAllocator& allocator = GraphicBufferAllocator::get();
uint32_t outStride = 0;
status_t err = allocator.alloc(inWidth, inHeight, inFormat, inUsage,
&handle, &outStride);
if (err == NO_ERROR) {
width = static_cast(inWidth);
height = static_cast(inHeight);
format = inFormat;
usage = static_cast(inUsage);
stride = static_cast(outStride);
}
return err;
} status_t GraphicBufferAllocator::alloc(uint32_t width, uint32_t height,
PixelFormat format, uint32_t usage, buffer_handle_t* handle,
uint32_t* stride)
{
......
err = mAllocDev->alloc(mAllocDev, static_cast(width),
static_cast(height), format, static_cast(usage), handle,
&outStride); 在GraphicBufferAllocator的构造函数中装载了Gralloc模块，因此mAllocDev指向了Gralloc模块。这个会在后面的博客中分析
GraphicBufferAllocator::GraphicBufferAllocator()
: mAllocDev(0)
{
hw_module_t const* module;
int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
ALOGE_IF(err, "FATAL: can't find the %s module", GRALLOC_HARDWARE_MODULE_ID);
if (err == 0) {
gralloc_open(module, &mAllocDev);
}
}这里调用alloc分配了一块共享的内存缓冲区，alloc函数将返回共享区的fd和缓冲区的指针。既然GraphicBuffer中的缓冲区是共享内存，我们知道使用共享内存需要传递共享内存的句柄fd。下面我们看看是如何传到客户进程的。
2.2 内存缓冲区的fd传递到客户进程
GraphicBuffer类从模板类Flattenable派生，这个派生类可以通过Parcel传递，通常派生类需要重载flatten和unflatten方法，用于对象的序列化和反序列化。
class GraphicBuffer
: public ANativeObjectBase< ANativeWindowBuffer, GraphicBuffer, RefBase >,
public Flattenable我们先来看下flatten函数，fds参数用来传递文件句柄，函数把handle中的句柄复制到fds中，因此这些句柄就能通过binder传递到目标进程中去。
status_t GraphicBuffer::flatten(void*& buffer, size_t& size, int*& fds, size_t& count) const {
size_t sizeNeeded = GraphicBuffer::getFlattenedSize();
if (size < sizeNeeded) return NO_MEMORY;
size_t fdCountNeeded = GraphicBuffer::getFdCount();
if (count < fdCountNeeded) return NO_MEMORY;
int32_t* buf = static_cast(buffer);
buf[0] = 'GBFR';
buf[1] = width;
buf[2] = height;
buf[3] = stride;
buf[4] = format;
buf[5] = usage;
buf[6] = static_cast(mId >> 32);
buf[7] = static_cast(mId & 0xFFFFFFFFull);
buf[8] = static_cast(mGenerationNumber);
buf[9] = 0;
buf[10] = 0;
if (handle) {
buf[9] = handle->numFds;
buf[10] = handle->numInts;
memcpy(fds, handle->data,//把handle中的中复制到fds中
static_cast(handle->numFds) * sizeof(int));
memcpy(&buf[11], handle->data + handle->numFds,
static_cast(handle->numInts) * sizeof(int));
}
buffer = static_cast(static_cast(buffer) + sizeNeeded);
size -= sizeNeeded;
if (handle) {
fds += handle->numFds;
count -= static_cast(handle->numFds);
}
return NO_ERROR;
} status_t GraphicBuffer::unflatten(
void const*& buffer, size_t& size, int const*& fds, size_t& count) {
......
if (handle != 0) {
status_t err = mBufferMapper.registerBuffer(handle);
......
}
buffer = static_cast(static_cast(buffer) + sizeNeeded);
size -= sizeNeeded;
fds += numFds;
count -= numFds;
return NO_ERROR;
} status_t GraphicBufferMapper::registerBuffer(buffer_handle_t handle)
{
ATRACE_CALL();
status_t err;
err = mAllocMod->registerBuffer(mAllocMod, handle);
ALOGW_IF(err, "registerBuffer(%p) failed %d (%s)",
handle, err, strerror(-err));
return err;
}在硬件设备支持Framebuffer缓冲区的情况下，Surface中绘制图形的缓冲区就是Framebuffer的缓冲区，绘制完成后，如果不需要进行图像合成，只需要flip操作就能完成图像的输出，中间完全不用复制的过程，很高效。