Android T(13) 源码分析 — 原生层 Surface 的创建

Android T(13) 源码分析 — 原生层 Surface 的创建

---

---

前言

该系列文章基于 Android T(13) 的源码进行分析，内容会逐渐丰富，欢迎大家点赞关注。

---

摘要

在 Android 系统中，Surface 是用于图形渲染的一个重要组件，它提供了一个可以绘制图形的缓冲区。Surface 的创建和管理涉及到多个层次的代码，包括 Java 层、JNI 层和原生层。本篇文章基于Android T(13)的源码，分析原生层的 Surface 创建过程。时序图如下：

---

一、SurfaceComposerClient 的 createSurfaceChecked 分析

JNI 层通过 nativeCreate 调用到原生层 SurfaceComposerClient 里面的 createSurfaceChecked 创建 Surface。这里需要留意一下，createSurfaceChecked 创建了一个 IGraphicBufferProducer，IGraphicBufferProducer 可以实现 Buffer 的申请，来存储绘制的信息。这里不做过多介绍，后面会单独另外介绍 Buffer Queue 相关内容。

//frameworks/native/libs/gui/SurfaceComposerClient.cpp
status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, uint32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
    sp<SurfaceControl> sur;
//...
        sp<IGraphicBufferProducer> gbp;
//...
        err = mClient->createSurface(name, w, h, format, flags, parentHandle, std::move(metadata),
                                     &handle, &gbp, &id, &transformHint);

//...
            *outSurface =
                    new SurfaceControl(this, handle, gbp, id, w, h, format, transformHint, flags);
//...
}

我们看一下 mClient 的定义：

//frameworks/native/libs/gui/SurfaceComposerClient.cpp
SurfaceComposerClient::SurfaceComposerClient(const sp<ISurfaceComposerClient>& client)
      : mStatus(NO_ERROR), mClient(client) {}

---

二、ISurfaceComposerClient 的 createSurface分析

这里我们看一下 ISurfaceComposerClient 的定义：

//frameworks/native/libs/gui/include/gui/ISurfaceComposerClient.h
class ISurfaceComposerClient : public IInterface {
public:
//...
    virtual status_t createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
                                   uint32_t flags, const sp<IBinder>& parent,
                                   LayerMetadata metadata, sp<IBinder>* handle,
                                   sp<IGraphicBufferProducer>* gbp, int32_t* outLayerId,
                                   uint32_t* outTransformHint) = 0;
//...

在 ISurfaceComposerClient 中，createSurface 是一个虚函数，具体的实现在 BpSurfaceComposerClient，BpSurfaceComposerClient 是 SurfaceComposerClient 的客户端实现：

//frameworks/native/libs/gui/ISurfaceComposerClient.cpp
class BpSurfaceComposerClient : public SafeBpInterface<ISurfaceComposerClient> {
public:
    explicit BpSurfaceComposerClient(const sp<IBinder>& impl)
          : SafeBpInterface<ISurfaceComposerClient>(impl, "BpSurfaceComposerClient") {}
//...

BpSurfaceComposerClient 中 createSurface 直接转到了服务端：

//frameworks/native/libs/gui/ISurfaceComposerClient.cpp
    status_t createSurface(const String8& name, uint32_t width, uint32_t height, PixelFormat format,
                           uint32_t flags, const sp<IBinder>& parent, LayerMetadata metadata,
                           sp<IBinder>* handle, sp<IGraphicBufferProducer>* gbp,
                           int32_t* outLayerId, uint32_t* outTransformHint) override {
        return callRemote<decltype(&ISurfaceComposerClient::createSurface)>(Tag::CREATE_SURFACE,
                                                                            name, width, height,
                                                                            format, flags, parent,
                                                                            std::move(metadata),
                                                                            handle, gbp, outLayerId,
                                                                            outTransformHint);
    }

接下来我们再看一下 SurfaceComposerClient 的服务端 BnSurfaceComposerClient：

//frameworks/native/libs/gui/include/gui/ISurfaceComposerClient.h
class BnSurfaceComposerClient : public SafeBnInterface<ISurfaceComposerClient> {
public:
    BnSurfaceComposerClient()
          : SafeBnInterface<ISurfaceComposerClient>("BnSurfaceComposerClient") {}

    status_t onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) override;
};

服务端的 createSurface 不在 gui 文件夹了，已经转到了 surfaceflinger：

//frameworks/native/services/surfaceflinger/Client.h
class Client : public BnSurfaceComposerClient
{
public:
    explicit Client(const sp<SurfaceFlinger>& flinger);
//...
private:
    // ISurfaceComposerClient interface
    virtual status_t createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
                                   uint32_t flags, const sp<IBinder>& parent,
                                   LayerMetadata metadata, sp<IBinder>* handle,
                                   sp<IGraphicBufferProducer>* gbp, int32_t* outLayerId,
                                   uint32_t* outTransformHint = nullptr);
//...

这里我们可以看到，Client 继承了 BnSurfaceComposerClient，也就是 SurfaceComposerClient 的服务端，具体的 createSurface 实现：

//frameworks/native/services/surfaceflinger/Client.cpp
status_t Client::createSurface(const String8& name, uint32_t /* w */, uint32_t /* h */,
                               PixelFormat /* format */, uint32_t flags,
                               const sp<IBinder>& parentHandle, LayerMetadata metadata,
                               sp<IBinder>* outHandle, sp<IGraphicBufferProducer>* /* gbp */,
                               int32_t* outLayerId, uint32_t* outTransformHint) {
    // We rely on createLayer to check permissions.
    LayerCreationArgs args(mFlinger.get(), this, name.c_str(), flags, std::move(metadata));
    return mFlinger->createLayer(args, outHandle, parentHandle, outLayerId, nullptr,
                                 outTransformHint);
}

mFlinger 就是 SurfaceFlinger ：

//frameworks/native/services/surfaceflinger/Client.cpp
Client::Client(const sp<SurfaceFlinger>& flinger)
    : mFlinger(flinger)
{
}

在 SurfaceFlinger 一侧，Surface 又有另外一个称呼 Layer。所以最终，Surface 是 Java 层提出申请创建，而最终是由 SurfaceFlinger 实现创建。

---

总结

至此，原生层的 Surface 流转过程已经分析完。简单总结一下，Java 层 relayoutWindow 发起 relyout，通过 JNI 向原生层提出申请创建 Surface，通过 ISurfaceComposerClient 最终通过 SurfaceFlinger 创建 Layer。在这个过程中，返回 Java 层的 Surface 也包含了 IGraphicBufferProducer（由 ISurfaceComposerClient 创建），进而帮助后面进行具体的 Buffer 申请。

---