1. 简介
网上已经有很多兄弟对Android的显示系统做了深入解剖,很是佩服。可最近小弟在研究Android4.0时发现出入比较大,也许是Android4.0的修改比较多吧!因为小弟没有看Android4.0以前的代码。
面对这么复杂一个Android显示系统,如何入手呢? 根据以前的经验,不管它有多么复杂,其功能不就是以下三步曲吗?
1)显示系统的创建及初始化
2)画图
3)销毁
哪我的分析就从显示系统的创建及初始化开始吧!由于小弟对Java没有什么研究兴趣,所有重点就分析Native部分。当然Native的入口就在android_view_Surface.cpp中,此文件主要包含以下两部分给Java层调用:
1)gSurfaceSessionMethods: 操作SurfaceSession的方法
2)gSurfaceMethods:操作Surface的方法
2. android_view_Surface.cpp
2.1 SurfaceSession操作方法
- static JNINativeMethod gSurfaceSessionMethods[] = {
- {"init", "()V", (void*)SurfaceSession_init },
- {"destroy", "()V", (void*)SurfaceSession_destroy },
- {"kill", "()V", (void*)SurfaceSession_kill },
- };
2.1.1 SurfaceSession_init
其功能如下:
1)创建SurfaceComposerClient对象
2)调用SurfaceComposerClient::onFirstRef方法
现在已经进入到SurfaceComposerClient的地盘,根据其名字含义,它应该是一个进行Surface合成的客户端,通过它发命令给SurfaceFlinger来进行需要的操作。其初始化流程如下图所示:
![Android4.0.3 显示系统深入理解_第1张图片](http://img.e-com-net.com/image/info5/98defde163ff48e9bdbf5f6a587b2624.jpg)
2.1.2 SurfaceComposerClient.cpp中的宝贝
为了方便后面的理解,先看看SurfaceComposerClient中有些什么宝贝来完成这个任务。在其中定义了如下几个类:
2.1.2.1 ComposerService(获取SurfaceFlinger服务)
一看到名字为Service,应该是用于从SurfaceFlinger中获取Service以建立连接关系<它是一个单实例,一个进程有且只有一个实例对象>,然后供后面进行相关的操作。其构造函数代码如下:
- class ComposerService : public Singleton<ComposerService>
- {
-
-
- sp<ISurfaceComposer> mComposerService;
-
-
-
- sp<IMemoryHeap> mServerCblkMemory;
-
-
-
- surface_flinger_cblk_t volatile* mServerCblk;
- ComposerService();
- friend class Singleton<ComposerService>;
- public:
- static sp<ISurfaceComposer> getComposerService();
- static surface_flinger_cblk_t const volatile * getControlBlock();
- };
-
- ComposerService::ComposerService()
- : Singleton<ComposerService>() {
- const String16 name("SurfaceFlinger");
-
- while (getService(name, &mComposerService) != NO_ERROR) {
- usleep(250000);
- }
-
- mServerCblkMemory = mComposerService->getCblk();
-
- mServerCblk = static_cast<surface_flinger_cblk_t volatile *>(
- mServerCblkMemory->getBase());
- }
由此可见,ComposerService主要是获取SurfaceFlinger服务、获取在SurfaceFlinger::readyToRun中创建的共享内存块及其基地址。在Client中,谁要想与SurfaceFlinger通信,需要通过接口getComposerService来获取此BpSurfaceComposer。
此ComposerService是在调用ComposerService::getInstance时进行有且只有一个的实例化,因为前面讲过,它是一个单实例。
2.1.2.2 Composer
它也是一个单实例,管理并发送每个layer的ComposerState。其定义如下:
- struct ComposerState {
- sp<ISurfaceComposerClient> client;
- layer_state_t state;
- status_t write(Parcel& output) const;
- status_t read(const Parcel& input);
- };
-
- class Composer : public Singleton<Composer>
- {
- friend class Singleton<Composer>;
-
- mutable Mutex mLock;
-
- SortedVector<ComposerState> mStates;
- int mOrientation;
- Composer() : Singleton<Composer>(),
- mOrientation(ISurfaceComposer::eOrientationUnchanged) { }
-
- void closeGlobalTransactionImpl();
-
-
- layer_state_t* getLayerStateLocked(
- const sp<SurfaceComposerClient>& client, SurfaceID id);
-
- public:
-
- status_t setPosition(const sp<SurfaceComposerClient>& client, SurfaceID id,
- float x, float y);
-
- status_t setSize(const sp<SurfaceComposerClient>& client, SurfaceID id,
- uint32_t w, uint32_t h);
-
- status_t setLayer(const sp<SurfaceComposerClient>& client, SurfaceID id,
- int32_t z);
-
- status_t setFlags(const sp<SurfaceComposerClient>& client, SurfaceID id,
- uint32_t flags, uint32_t mask);
-
- status_t setTransparentRegionHint(
- const sp<SurfaceComposerClient>& client, SurfaceID id,
- const Region& transparentRegion);
-
- status_t setAlpha(const sp<SurfaceComposerClient>& client, SurfaceID id,
- float alpha);
-
- status_t setMatrix(const sp<SurfaceComposerClient>& client, SurfaceID id,
- float dsdx, float dtdx, float dsdy, float dtdy);
-
- status_t setFreezeTint(
- const sp<SurfaceComposerClient>& client, SurfaceID id,
- uint32_t tint);
-
- status_t setOrientation(int orientation);
-
- static void closeGlobalTransaction() {
- Composer::getInstance().closeGlobalTransactionImpl();
- }
- }
把上面的comments看完就明白了,Composer管理每个SurfaceComposerClient中的每一个Surface的状态,并记录在ComposerState的layer_state_t中,然后调用者可以调用其closeGlobalTransaction方法把这些mStates发送给SurfaceFlinger处理(处理函数为:SurfaceFlinger::setTransactionState)。
谁来调用它的方法设置层的属性及发送mStates呢? -----答案是由SurfaceComposerClient来调用。
2.1.2.3 SurfaceComposerClient
前面介绍的两个类一个用于获取SurfaceFlinger服务;一个用于记录每个Layer的状态,且可按要求把这些CoposerState发送给SurfaceFlinger。这个类是不是来使用前面两个类提供的服务呢? --答案是肯定的。其定义及详细注释如下:
- #define NUM_DISPLAY_MAX 4 //最多支持四个显示屏
- struct display_cblk_t
- {
- uint16_t w;
- uint16_t h;
- uint8_t format;
- uint8_t orientation;
- uint8_t reserved[2];
- float fps;
- float density;
- float xdpi;
- float ydpi;
- uint32_t pad[2];
- };
-
- struct surface_flinger_cblk_t
- {
- uint8_t connected;
- uint8_t reserved[3];
- uint32_t pad[7];
- display_cblk_t displays[NUM_DISPLAY_MAX];
- };
-
- class SurfaceComposerClient : public RefBase
- {
- friend class Composer;
- public:
-
- SurfaceComposerClient();
- virtual ~SurfaceComposerClient();
-
-
-
-
-
- sp<SurfaceControl> createSurface(
- const String8& name,
- DisplayID display,
- uint32_t w,
- uint32_t h,
- PixelFormat format,
- uint32_t flags = 0
- );
-
-
-
-
-
-
-
- static void openGlobalTransaction();
-
-
-
- static void closeGlobalTransaction();
-
-
- static status_t freezeDisplay(DisplayID dpy, uint32_t flags = 0);
-
-
- static status_t unfreezeDisplay(DisplayID dpy, uint32_t flags = 0);
-
-
- static int setOrientation(DisplayID dpy, int orientation, uint32_t flags);
-
-
- static ssize_t getNumberOfDisplays();
-
-
- static status_t getDisplayInfo(DisplayID dpy, DisplayInfo* info);
- static ssize_t getDisplayWidth(DisplayID dpy);
- static ssize_t getDisplayHeight(DisplayID dpy);
- static ssize_t getDisplayOrientation(DisplayID dpy);
-
-
- status_t linkToComposerDeath(const sp<IBinder::DeathRecipient>& recipient,
- void* cookie = NULL, uint32_t flags = 0);
-
-
-
- status_t hide(SurfaceID id);
- status_t show(SurfaceID id, int32_t layer = -1);
- status_t freeze(SurfaceID id);
- status_t unfreeze(SurfaceID id);
- status_t setFlags(SurfaceID id, uint32_t flags, uint32_t mask);
-
- status_t setTransparentRegionHint(SurfaceID id, const Region& transparent);
-
- status_t setLayer(SurfaceID id, int32_t layer);
-
- status_t setAlpha(SurfaceID id, float alpha=1.0f);
-
- status_t setFreezeTint(SurfaceID id, uint32_t tint);
-
- status_t setMatrix(SurfaceID id, float dsdx, float dtdx, float dsdy, float dtdy);
-
- status_t setPosition(SurfaceID id, float x, float y);
-
- status_t setSize(SurfaceID id, uint32_t w, uint32_t h);
-
- status_t destroySurface(SurfaceID sid);
-
- private:
-
-
- virtual void onFirstRef();
- Composer& getComposer();
-
- mutable Mutex mLock;
- status_t mStatus;
-
- sp<ISurfaceComposerClient> mClient;
-
- Composer& mComposer;
- }
其功能列表如下:
1)获取BpSurfaceComposerClient(即mClient),在onFirstRef中实现
2)通过BpSurfaceComposerClient(即mClient)创建和销毁Surface
3)通过Composer来记录Surface和显示屏状态变化,及在Composer中通过BpSurfaceComposer把状态变化发给SurfaceFlinger处理
至此,SurfaceComposerClient功能已经分析清楚。可是从这三个类中,我们已经看到三个Bp(BpSurfaceComposer,BpSurfaceComposerClient和BpSurface)及三个对应的接口。下面总结一下,每个接口的功能,在客户端由谁使用,在服务器端谁来实现。
2.1.2.4 Surface相关接口总结
2.2 Surface操作
其相关接口如下:
- static JNINativeMethod gSurfaceMethods[] = {
- {"nativeClassInit", "()V", (void*)nativeClassInit },
- {"init", "(Landroid/view/SurfaceSession;ILjava/lang/String;IIIII)V", (void*)Surface_init },
- {"init", "(Landroid/os/Parcel;)V", (void*)Surface_initParcel },
- {"initFromSurfaceTexture", "(Landroid/graphics/SurfaceTexture;)V", (void*)Surface_initFromSurfaceTexture },
- {"getIdentity", "()I", (void*)Surface_getIdentity },
- {"destroy", "()V", (void*)Surface_destroy },
- {"release", "()V", (void*)Surface_release },
- {"copyFrom", "(Landroid/view/Surface;)V", (void*)Surface_copyFrom },
- {"isValid", "()Z", (void*)Surface_isValid },
- {"lockCanvasNative", "(Landroid/graphics/Rect;)Landroid/graphics/Canvas;", (void*)Surface_lockCanvas },
- {"unlockCanvasAndPost", "(Landroid/graphics/Canvas;)V", (void*)Surface_unlockCanvasAndPost },
- {"unlockCanvas", "(Landroid/graphics/Canvas;)V", (void*)Surface_unlockCanvas },
- {"openTransaction", "()V", (void*)Surface_openTransaction },
- {"closeTransaction", "()V", (void*)Surface_closeTransaction },
- {"setOrientation", "(III)V", (void*)Surface_setOrientation },
- {"freezeDisplay", "(I)V", (void*)Surface_freezeDisplay },
- {"unfreezeDisplay", "(I)V", (void*)Surface_unfreezeDisplay },
- {"screenshot", "(II)Landroid/graphics/Bitmap;", (void*)Surface_screenshotAll },
- {"screenshot", "(IIII)Landroid/graphics/Bitmap;", (void*)Surface_screenshot },
- {"setLayer", "(I)V", (void*)Surface_setLayer },
- {"setPosition", "(FF)V",(void*)Surface_setPosition },
- {"setSize", "(II)V",(void*)Surface_setSize },
- {"hide", "()V", (void*)Surface_hide },
- {"show", "()V", (void*)Surface_show },
- {"freeze", "()V", (void*)Surface_freeze },
- {"unfreeze", "()V", (void*)Surface_unfreeze },
- {"setFlags", "(II)V",(void*)Surface_setFlags },
- {"setTransparentRegionHint","(Landroid/graphics/Region;)V", (void*)Surface_setTransparentRegion },
- {"setAlpha", "(F)V", (void*)Surface_setAlpha },
- {"setMatrix", "(FFFF)V", (void*)Surface_setMatrix },
- {"setFreezeTint", "(I)V", (void*)Surface_setFreezeTint },
- {"readFromParcel", "(Landroid/os/Parcel;)V", (void*)Surface_readFromParcel },
- {"writeToParcel", "(Landroid/os/Parcel;I)V", (void*)Surface_writeToParcel },
- };
2.2.1 Surface_init调用流程
在SurfaceFlinger端创建BSurface,在客户端返回SurfaceControl,同时在SurfaceControl中拥有了BpSurface用于与BSurface交互。
![Android4.0.3 显示系统深入理解_第3张图片](http://img.e-com-net.com/image/info5/8692d6df42c44001998a547aa9e28fe4.jpg)
2.2.1.1 调用流程分析
BpSurfaceComposerClient->createSurface返回BpSurface。且通过参数返回ISurfaceComposerClient::surface_data_t,其定义如下:
其中token在SurfaceComposerClient的函数参数中,对应于SurfaceID。即在客户端,它就是SurfaceID。
token: 加入到Client::mLayers中的序号,在Client中单调递增,初始值为:1,一个Layer创建一个BSurface
identity: LayerBaseClient中的mIdentity,在所有的Layer中单调递增,初始值为:1
- struct surface_data_t {
- int32_t token;
- int32_t identity;
- status_t readFromParcel(const Parcel& parcel);
- status_t writeToParcel(Parcel* parcel) const;
- };
2.2.1.2 创建真正的Surface
在Layer::createSurface中创建真正的BSurface,在SurfaceFlinger::createSurface中调用layer->getSurface时创建的。此BSurface定义如下:
- sp<ISurface> Layer::createSurface()
- {
- class BSurface : public BnSurface, public LayerCleaner {
- wp<const Layer> mOwner;
- virtual sp<ISurfaceTexture> getSurfaceTexture() const {
- sp<ISurfaceTexture> res;
- sp<const Layer> that( mOwner.promote() );
- if (that != NULL) {
- res = that->mSurfaceTexture;
- }
- return res;
- }
- public:
- BSurface(const sp<SurfaceFlinger>& flinger,
- const sp<Layer>& layer)
- : LayerCleaner(flinger, layer), mOwner(layer) { }
- };
- sp<ISurface> sur(new BSurface(mFlinger, this));
- return sur;
- }
在此BSurface中实现了ISurface的接口getSurfaceTexture,在此接口中返回Layer::mSurfaceTexture(类型为:SurfaceTextureLayer,它才是真正操作内存的东东),此成员在Layer::onFirstRef中创建,SurfaceTextureLayer是SurfaceTexture的派生类,代码如下:
- void Layer::onFirstRef()
- {
- LayerBaseClient::onFirstRef();
-
- struct FrameQueuedListener : public SurfaceTexture::FrameAvailableListener {
- FrameQueuedListener(Layer* layer) : mLayer(layer) { }
- private:
- wp<Layer> mLayer;
- virtual void onFrameAvailable() {
- sp<Layer> that(mLayer.promote());
- if (that != 0) {
- that->onFrameQueued();
- }
- }
- };
- mSurfaceTexture = new SurfaceTextureLayer(mTextureName, this);
- mSurfaceTexture->setFrameAvailableListener(new FrameQueuedListener(this));
- mSurfaceTexture->setSynchronousMode(true);
- mSurfaceTexture->setBufferCountServer(2);
- }
2.2.1.3 不得不说的SurfaceControl
本来Surface_init调用SurfaceComposerClient::createSurface创建一个Surface,可却返回了一个SurfaceControl,下面看看SurfaceCotrol到底做了些什么,以及如何做的?
相关数据结构如下图所示:
![Android4.0.3 显示系统深入理解_第4张图片](http://img.e-com-net.com/image/info5/decc8a0d45474e1f96bca393c47ee72c.jpg)
SurfaceControl定义如下:
- class SurfaceControl : public RefBase
- {
- public:
-
- void clear();
-
-
-
- status_t setLayer(int32_t layer);
- status_t setPosition(int32_t x, int32_t y);
- status_t setSize(uint32_t w, uint32_t h);
- status_t hide();
- status_t show(int32_t layer = -1);
- status_t freeze();
- status_t unfreeze();
- status_t setFlags(uint32_t flags, uint32_t mask);
- status_t setTransparentRegionHint(const Region& transparent);
- status_t setAlpha(float alpha=1.0f);
- status_t setMatrix(float dsdx, float dtdx, float dsdy, float dtdy);
- status_t setFreezeTint(uint32_t tint);
-
-
- static status_t writeSurfaceToParcel(
- const sp<SurfaceControl>& control, Parcel* parcel);
-
-
-
-
-
- sp<Surface> getSurface() const;
-
- private:
- SurfaceControl(
- const sp<SurfaceComposerClient>& client,
- const sp<ISurface>& surface,
- const ISurfaceComposerClient::surface_data_t& data);
-
- ~SurfaceControl();
-
- void destroy();
-
- sp<SurfaceComposerClient> mClient;
- sp<ISurface> mSurface;
- SurfaceID mToken;
- uint32_t mIdentity;
- mutable Mutex mLock;
-
- mutable sp<Surface> mSurfaceData;
- }
从其定义中可以看出,在getSurface中将有新花样,其它操作函数都是直接以mToken作为SurfaceID,直接调用SurfaceComposerClient中对应方法。 经过这样一分析,SurfaceControl也没什么神秘的了。但它的getSurface到有点神秘
2.2.2 getSurface流程
getSurface在客户端返回Surface(派生于SurfaceTextureClient),并在Surface的mSurfaceTexture域中保存了BpSurfaceTexture。
前面Surface初始化之后,就可以getSurface了。getSurface流程如下图所示:
![Android4.0.3 显示系统深入理解_第5张图片](http://img.e-com-net.com/image/info5/d89894465bfd42c49c457f63181ffef9.jpg)
有了Surface,且在Surface中又有了BpSurfaceTexture,下一步就操作GraphicBuffer了。
3. 画图流程
对于画图流程,可以从ViewRootImpl(ViewRootImpl.java)的draw函数看起,在画图之间,它要调用java层的surface.lockCanvas,画完图之后调用surface.unlockCanvasAndPost来提交显示。
surface.lockCanvas->
lockCanvasNative(Java)->
(C++)Surface_lockCanvas<android_view_Surface.cpp>
surface.unlockCanvasAndPost(Java)->
(C++)Surface_unlockCanvasAndPost<android_view_Surface.cpp>
本章主要分析这两个函数到底做了些什么>
3.1 Surface_lockCanvas
Android图形系统中一个重要的概念是surface。View及其子类(如TextView, Button)要画在surface上。每个surface创建一个Canvas对象(但属性时常改变),用来管理view在surface上的绘图操作,如画点画线。每个canvas对象对应一个bitmap,存储画在surface上的内容。
3.1.1 相关数据结构定义
3.1.1.1 ANativeWindow_Buffer
- typedef struct ANativeWindow_Buffer {
-
- int32_t width;
-
-
- int32_t height;
-
-
-
- int32_t stride;
-
-
- int32_t format;
-
-
- void* bits;
-
-
- uint32_t reserved[6];
- } ANativeWindow_Buffer;
3.1.1.2 SurfaceInfo
- struct SurfaceInfo {
- uint32_t w;
- uint32_t h;
- uint32_t s;
- uint32_t usage;
- PixelFormat format;
- void* bits;
- uint32_t reserved[2];
- };
3.1.1.3 二者对应关系
- SurfaceInfo* other;
- ANativeWindow_Buffer outBuffer;
- other->w = uint32_t(outBuffer.width);
- other->h = uint32_t(outBuffer.height);
- other->s = uint32_t(outBuffer.stride);
- other->usage = GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_OFTEN;
- other->format = uint32_t(outBuffer.format);
- other->bits = outBuffer.bits;
3.1.1.4 GraphicBuffer
在分析下面的流程时, 不得不对GraphicBuffer进行深入了解,特别是其Flattenable interface,这是实现画图buffer的关键。其相关定义如下:
- typedef struct native_handle
- {
- int version;
- int numFds;
- int numInts;
- int data[0];
- } native_handle_t;
-
- typedef const native_handle_t* buffer_handle_t;
-
- class GraphicBuffer
- : public EGLNativeBase<
- ANativeWindowBuffer,
- GraphicBuffer,
- LightRefBase<GraphicBuffer> >, public Flattenable
- {
- ...
-
- size_t getFlattenedSize() const;
- size_t getFdCount() const;
- status_t flatten(void* buffer, size_t size,
- int fds[], size_t count) const;
- status_t unflatten(void const* buffer, size_t size,
- int fds[], size_t count);
- ...
- buffer_handle_t handle;
- };
3.1.1.5 Flattenable interface
下面看看每个Flattenable interface是如何实现的:
3.1.1.5.1 getFlattenedSize
- size_t GraphicBuffer::getFlattenedSize() const {
- return (8 + (handle ? handle->numInts : 0))*sizeof(int);
- }
3.1.1.5.2 getFdCount
- size_t GraphicBuffer::getFdCount() const {
- return handle ? handle->numFds : 0;
- }
3.1.1.5.3 flatten
- status_t GraphicBuffer::flatten(void* buffer, size_t size,
- int fds[], size_t count) const
- {
- size_t sizeNeeded = GraphicBuffer::getFlattenedSize();
- if (size < sizeNeeded) return NO_MEMORY;
-
- size_t fdCountNeeded = GraphicBuffer::getFdCount();
- if (count < fdCountNeeded) return NO_MEMORY;
-
- int* buf = static_cast<int*>(buffer);
- buf[0] = 'GBFR';
- buf[1] = width;
- buf[2] = height;
- buf[3] = stride;
- buf[4] = format;
- buf[5] = usage;
- buf[6] = 0;
- buf[7] = 0;
-
- if (handle) {
- buf[6] = handle->numFds;
- buf[7] = handle->numInts;
- native_handle_t const* const h = handle;
- memcpy(fds, h->data, h->numFds*sizeof(int));
- memcpy(&buf[8], h->data + h->numFds, h->numInts*sizeof(int));
- }
-
- return NO_ERROR;
- }
把handle中的numFds拷贝到fds中,把handle中的numInts拷贝到buffer中。
3.1.1.5.4 unflatten
- status_t GraphicBuffer::unflatten(void const* buffer, size_t size,
- int fds[], size_t count)
- {
- if (size < 8*sizeof(int)) return NO_MEMORY;
-
- int const* buf = static_cast<int const*>(buffer);
- if (buf[0] != 'GBFR') return BAD_TYPE;
-
- const size_t numFds = buf[6];
- const size_t numInts = buf[7];
-
- const size_t sizeNeeded = (8 + numInts) * sizeof(int);
- if (size < sizeNeeded) return NO_MEMORY;
-
- size_t fdCountNeeded = 0;
- if (count < fdCountNeeded) return NO_MEMORY;
-
- if (handle) {
-
- free_handle();
- }
-
- if (numFds || numInts) {
- width = buf[1];
- height = buf[2];
- stride = buf[3];
- format = buf[4];
- usage = buf[5];
- native_handle* h = native_handle_create(numFds, numInts);
- memcpy(h->data, fds, numFds*sizeof(int));
- memcpy(h->data + numFds, &buf[8], numInts*sizeof(int));
- handle = h;
- } else {
- width = height = stride = format = usage = 0;
- handle = NULL;
- }
-
- mOwner = ownHandle;
-
- if (handle != 0) {
- mBufferMapper.registerBuffer(handle);
- }
-
- return NO_ERROR;
- }
把width,height,stride,format和usage保存到成员变量中,并创建一个native_handle,然后把numFds和numInts拷贝到handle的data中。同时把此handle注册到mBufferMapper中,mBufferMapper的注册函数实现代码如下:
- status_t GraphicBufferMapper::registerBuffer(buffer_handle_t handle)
- {
- status_t err;
-
- err = mAllocMod->registerBuffer(mAllocMod, handle);
-
- LOGW_IF(err, "registerBuffer(%p) failed %d (%s)",
- handle, err, strerror(-err));
- return err;
- }
- GraphicBufferMapper::GraphicBufferMapper()
- : mAllocMod(0)
- {
- hw_module_t const* module;
- int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
- LOGE_IF(err, "FATAL: can't find the %s module", GRALLOC_HARDWARE_MODULE_ID);
- if (err == 0) {
- mAllocMod = (gralloc_module_t const *)module;
- }
- }
3.1.1.5.4 GRALLOC_HARDWARE_MODULE_ID实例
对于GRALLOC_HARDWARE_MODULE_ID,以hardware/msm7k/libgralloc/gralloc.cpp为例进行分析。其registerBuffer实现函数:gralloc_register_buffer(hardware/msm7k/libgralloc/mapper.cpp),其相关代码如下:
- int gralloc_register_buffer(gralloc_module_t const* module,
- buffer_handle_t handle)
- {
- if (private_handle_t::validate(handle) < 0)
- return -EINVAL;
-
-
- int err = 0;
- private_handle_t* hnd = (private_handle_t*)handle;
- if (hnd->pid != getpid()) {
- hnd->base = NULL;
- if (!(hnd->flags & private_handle_t::PRIV_FLAGS_USES_GPU)) {
- void *vaddr;
- err = gralloc_map(module, handle, &vaddr);
- }
- }
- return err;
- }
-
- static int gralloc_map(gralloc_module_t const* module,
- buffer_handle_t handle,
- void** vaddr)
- {
- private_handle_t* hnd = (private_handle_t*)handle;
- if (!(hnd->flags & private_handle_t::PRIV_FLAGS_FRAMEBUFFER)) {
- size_t size = hnd->size;
- #if PMEM_HACK
- size += hnd->offset;
- #endif
- void* mappedAddress = mmap(0, size,
- PROT_READ|PROT_WRITE, MAP_SHARED, hnd->fd, 0);
- if (mappedAddress == MAP_FAILED) {
- LOGE("Could not mmap handle %p, fd=%d (%s)",
- handle, hnd->fd, strerror(errno));
- hnd->base = 0;
- return -errno;
- }
- hnd->base = intptr_t(mappedAddress) + hnd->offset;
-
-
- }
- *vaddr = (void*)hnd->base;
- return 0;
- }
从gralloc_map可以看出,这个registerBuffer主要做了一件事:
1)根据handle中传过来的fd和size进行mmap映射(把kernel中的内存映射到用户空间),映射之后的地址再加上hnd->offset便获得hnd->base供后面使用。
从这里可以初步看出,这个图形buffer数据并不是真正的从client传递到server,而是在lock是从server把fd传递给client,由客户端进行mmap,然后进行使用。关于这个是怎么实现的,后面将详细分析其实现过程。
对于如何从native_handle转换为private_handle_t,且在private_handle_t中可以获取fd和offset? 看一下其数据结构和flatten的实现方式就可以得知:
native_handle:
- typedef struct native_handle
- {
- int version;
- int numFds;
- int numInts;
- int data[0];
- } native_handle_t;
这个data[0]是关键,虽然分配了哪么多buffer,但实质上native_handle只占了3个int.其它的数据由包含它的数据结构来解析。
private_handle_t:
- struct private_handle_t {
- native_handle_t nativeHandle;
- #endif
-
- enum {
- PRIV_FLAGS_FRAMEBUFFER = 0x00000001,
- PRIV_FLAGS_USES_PMEM = 0x00000002,
- PRIV_FLAGS_USES_GPU = 0x00000004,
- };
-
-
- int fd;
-
- int magic;
- int flags;
- int size;
- int offset;
- int gpu_fd;
-
-
- int base;
- int map_offset;
- int pid;
-
- #ifdef __cplusplus
- static const int sNumInts = 8;
- static const int sNumFds = 1;
- static const int sMagic = 'gmsm';
-
- private_handle_t(int fd, int size, int flags) :
- fd(fd), magic(sMagic), flags(flags), size(size), offset(0),
- base(0), pid(getpid())
- {
- version = sizeof(native_handle);
- numInts = sNumInts;
- numFds = sNumFds;
- }
- ~private_handle_t() {
- magic = 0;
- }
-
- static int validate(const native_handle* h) {
- const private_handle_t* hnd = (const private_handle_t*)h;
- if (!h || h->version != sizeof(native_handle) ||
- h->numInts != sNumInts || h->numFds != sNumFds ||
- hnd->magic != sMagic)
- {
- LOGE("invalid gralloc handle (at %p)", h);
- return -EINVAL;
- }
- return 0;
- }
- #endif
- }
3.1.2 Surface_lockCanvas执行流程
查看高清大图
![Android4.0.3 显示系统深入理解_第6张图片](http://img.e-com-net.com/image/info5/63ca083351af456a9ee554ba7b6ee084.jpg)
3.1.3 Surface_lockCanvas总结
功能:Surface_lockCanvas获取显示buffer在本进程用户空间的地址,并据此创建一个SkBitmap给Java使用。
关键技术:BINDER_TYPE_FD类型的Binder、mmap、gralloc硬件抽象层
3.1.4 SurfaceTexture::dequeueBuffer如何创建GraphicBuffer
相关代码如下:
- const sp<GraphicBuffer>& buffer(mSlots[buf].mGraphicBuffer);
- if ((buffer == NULL) ||
- (uint32_t(buffer->width) != w) ||
- (uint32_t(buffer->height) != h) ||
- (uint32_t(buffer->format) != format) ||
- ((uint32_t(buffer->usage) & usage) != usage))
- {
- usage |= GraphicBuffer::USAGE_HW_TEXTURE;
- status_t error;
- sp<GraphicBuffer> graphicBuffer(
- mGraphicBufferAlloc->createGraphicBuffer(
- w, h, format, usage, &error));
- if (graphicBuffer == 0) {
- ST_LOGE("dequeueBuffer: SurfaceComposer::createGraphicBuffer "
- "failed");
- return error;
- }
- if (updateFormat) {
- mPixelFormat = format;
- }
- mSlots[buf].mGraphicBuffer = graphicBuffer;
- mSlots[buf].mRequestBufferCalled = false;
- if (mSlots[buf].mEglImage != EGL_NO_IMAGE_KHR) {
- eglDestroyImageKHR(mSlots[buf].mEglDisplay, mSlots[buf].mEglImage);
- mSlots[buf].mEglImage = EGL_NO_IMAGE_KHR;
- mSlots[buf].mEglDisplay = EGL_NO_DISPLAY;
- }
- returnFlags |= ISurfaceTexture::BUFFER_NEEDS_REALLOCATION;
- }
mGraphicBufferAlloc也是通过调用BpSurfaceComposer->createGraphicBufferAlloc而获取,它对应的服务器为SufaceFlinger中的GraphicBufferAlloc。
mGraphicBufferAlloc实质为一个BpGraphicBufferAlloc,它真正创建GraphicBuffer的代码位于GraphicBufferAlloc::createGraphicBuffer中。代码关键调用流程如下:
new GraphicBuffer(w, h, format, usage)->
initSize(w, h, reqFormat, reqUsage)->
GraphicBufferAllocator::get()->
allocator.alloc(w, h, format, reqUsage, &handle, &stride)->
返回handle,此handle为ANativeWindowBuffer成员,类型为native_handle。
GraphicBufferAllocator::alloc->
mAllocDev->alloc->
mAllocDev类型为alloc_device_t,它通过gralloc_open向
GRALLOC_HARDWARE_MODULE_ID获取,根据上面的实例msm7k,
它最终执行gralloc_device_open而获取gralloc_context_t.device.common,
alloc的实现函数为gralloc_alloc.
gralloc_alloc->
gralloc_alloc_buffer->
1)获取GPU内存(调用SimpleBestFitAllocator::allocate进行分配)
2)fd = open("/dev/null", O_RDONLY)获取fd
3)根据fd、size和flags创建private_handle_t,其相关代码如下:
- private_handle_t* hnd = new private_handle_t(fd, size, flags);
- if (base == NULL) {...
- }
- } else {
- private_module_t* m = reinterpret_cast<private_module_t*>(
- dev->common.module);
- hnd->offset = offset;
- hnd->base = int(base)+offset;
- hnd->gpu_fd = gpu_fd;
- hnd->map_offset = m->fb_map_offset;
- *pHandle = hnd;
- }