Android-SurfaceFlinger解析

基于Android 6.0源码进行分析

SurfaceFlinger是Android系统中最重要的图像消费者，Activity绘制的界面图像，都会传递到SurfaceFlinger中。

主要作用：接收图像缓冲区数据，然后交给HWComposer或OpenGL合成，合成完毕后再返回。

SurfaceFlinger执行流程

SurfaceFlinger初始化

init通过执行surfaceflinger.rc文件，然后就执行到了main_surfaceflinger.cpp开始初始化流程

//frameworks/native/services/surfaceflinger/main_surfaceflinger.cpp
int main(int, char**) {
    signal(SIGPIPE, SIG_IGN);

    hardware::configureRpcThreadpool(1 /* maxThreads */,
            false /* callerWillJoin */);

    startGraphicsAllocatorService();

   //设置支持最多 4个 binder线程执行
    ProcessState::self()->setThreadPoolMaxThreadCount(4);

    // start the thread pool
    sp<ProcessState> ps(ProcessState::self());
    ps->startThreadPool();

    //构建 Surfaceflinger实例
    sp<SurfaceFlinger> flinger = new SurfaceFlinger();

    // 执行初始化流程
    flinger->init();

    // 通过ServiceManager注册 SurfaceFlinger服务
    sp<IServiceManager> sm(defaultServiceManager());
    sm->addService(String16(SurfaceFlinger::getServiceName()), flinger, false,
                   IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL | IServiceManager::DUMP_FLAG_PROTO);

    startDisplayService(); // dependency on SF getting registered above

    // 开始运行
    flinger->run();

    return 0;
}

new SurfaceFlinger

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::onFirstRef()
{
    mEventQueue->init(this);
}

mEventQueue执行初始化

//frameworks/native/services/surfaceflinger/MessageQueue.cpp
void MessageQueue::init(const sp<SurfaceFlinger>& flinger) {
    mFlinger = flinger;
    mLooper = new Looper(true);
    mHandler = new Handler(*this);
}

初始化Handler

SurfaceFlinger#init

void SurfaceFlinger::init() {
    ALOGI(  "SurfaceFlinger's main thread ready to run. "
            "Initializing graphics H/W...");

    ALOGI("Phase offest NS: %" PRId64 "", vsyncPhaseOffsetNs);

    Mutex::Autolock _l(mStateLock);

    // start the EventThread
    mEventThreadSource =
            std::make_unique<DispSyncSource>(&mPrimaryDispSync, SurfaceFlinger::vsyncPhaseOffsetNs,
                                             true, "app");
    mEventThread = std::make_unique<impl::EventThread>(mEventThreadSource.get(),
                                                       [this]() { resyncWithRateLimit(); },
                                                       impl::EventThread::InterceptVSyncsCallback(),
                                                       "appEventThread");
    mSfEventThreadSource =
            std::make_unique<DispSyncSource>(&mPrimaryDispSync,
                                             SurfaceFlinger::sfVsyncPhaseOffsetNs, true, "sf");

    mSFEventThread =
            std::make_unique<impl::EventThread>(mSfEventThreadSource.get(),
                                                [this]() { resyncWithRateLimit(); },
                                                [this](nsecs_t timestamp) {
                                                    mInterceptor->saveVSyncEvent(timestamp);
                                                },
                                                "sfEventThread");
    mEventQueue->setEventThread(mSFEventThread.get());
    mVsyncModulator.setEventThread(mSFEventThread.get());

    // Get a RenderEngine for the given display / config (can't fail)
    getBE().mRenderEngine =
            RE::impl::RenderEngine::create(HAL_PIXEL_FORMAT_RGBA_8888,
                                           hasWideColorDisplay
                                                   ? RE::RenderEngine::WIDE_COLOR_SUPPORT
                                                   : 0);
  
    getBE().mHwc.reset(
            new HWComposer(std::make_unique<Hwc2::impl::Composer>(getBE().mHwcServiceName)));
    getBE().mHwc->registerCallback(this, getBE().mComposerSequenceId);
    // Process any initial hotplug and resulting display changes.
    processDisplayHotplugEventsLocked();
    LOG_ALWAYS_FATAL_IF(!getBE().mHwc->isConnected(HWC_DISPLAY_PRIMARY),
            "Registered composer callback but didn't create the default primary display");

    // make the default display GLContext current so that we can create textures
    // when creating Layers (which may happens before we render something)
    getDefaultDisplayDeviceLocked()->makeCurrent();

    mEventControlThread = std::make_unique<impl::EventControlThread>(
            [this](bool enabled) { setVsyncEnabled(HWC_DISPLAY_PRIMARY, enabled); });

    // initialize our drawing state
    mDrawingState = mCurrentState;

    // set initial conditions (e.g. unblank default device)
    initializeDisplays();

    getBE().mRenderEngine->primeCache();

    // Inform native graphics APIs whether the present timestamp is supported:
    if (getHwComposer().hasCapability(
            HWC2::Capability::PresentFenceIsNotReliable)) {
        mStartPropertySetThread = new StartPropertySetThread(false);
    } else {
        mStartPropertySetThread = new StartPropertySetThread(true);
    }

    if (mStartPropertySetThread->Start() != NO_ERROR) {
        ALOGE("Run StartPropertySetThread failed!");
    }

    mLegacySrgbSaturationMatrix = getBE().mHwc->getDataspaceSaturationMatrix(HWC_DISPLAY_PRIMARY,
            Dataspace::SRGB_LINEAR);

    ALOGV("Done initializing");
}

创建HWComposer

HWComposer代表着硬件显示设备。

//frameworks/native/services/surfaceflinger/DisplayHardware/HWComposer.cpp
HWComposer::HWComposer(
        const sp<SurfaceFlinger>& flinger,
        EventHandler& handler)
    : mFlinger(flinger),
      mFbDev(0), mHwc(0), mNumDisplays(1),
      mCBContext(new cb_context),
      mEventHandler(handler),
      mDebugForceFakeVSync(false)
{
    ...     
    bool needVSyncThread = true;

    // Note: some devices may insist that the FB HAL be opened before HWC.
    int fberr = loadFbHalModule();
    loadHwcModule();//加载HWComposer模块

    // these display IDs are always reserved
    for (size_t i=0 ; i<NUM_BUILTIN_DISPLAYS ; i++) {
        mAllocatedDisplayIDs.markBit(i);
    }

    if (mHwc) {
        ALOGI("Using %s version %u.%u", HWC_HARDWARE_COMPOSER,
              (hwcApiVersion(mHwc) >> 24) & 0xff,
              (hwcApiVersion(mHwc) >> 16) & 0xff);
        if (mHwc->registerProcs) {
            mCBContext->hwc = this;
            mCBContext->procs.invalidate = &hook_invalidate;
          //vsync信号回调方法
            mCBContext->procs.vsync = &hook_vsync;
            if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1))
                mCBContext->procs.hotplug = &hook_hotplug;
            else
                mCBContext->procs.hotplug = NULL;
            memset(mCBContext->procs.zero, 0, sizeof(mCBContext->procs.zero));
          //注册回调函数
            mHwc->registerProcs(mHwc, &mCBContext->procs);
        }

        // don't need a vsync thread if we have a hardware composer
        needVSyncThread = false;
        // always turn vsync off when we start
        eventControl(HWC_DISPLAY_PRIMARY, HWC_EVENT_VSYNC, 0);

        // the number of displays we actually have depends on the
        // hw composer version
        if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_3)) {
            // 1.3 adds support for virtual displays
            mNumDisplays = MAX_HWC_DISPLAYS;
        } else if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) {
            // 1.1 adds support for multiple displays
            mNumDisplays = NUM_BUILTIN_DISPLAYS;
        } else {
            mNumDisplays = 1;
        }
    }


    if (needVSyncThread) {
        // 不支持硬件Vsync的设备，则使用`VsyncThread`模拟发出Vsync信号
        mVSyncThread = new VSyncThread(*this);
    }
}

Vsync信号本身由显示驱动发出，如果不支持硬件Vsync，则使用VsyncThread模拟发出信号。

初始化显示设备

运行EventThread线程

EventThread主要用来接收Vsync信号。

void SurfaceFlinger::init() {
  ...
        // start the EventThread
    sp<VSyncSource> vsyncSrc = new DispSyncSource(&mPrimaryDispSync,
            vsyncPhaseOffsetNs, true, "app");
  //创建App的Vsync信号接收线程
    mEventThread = new EventThread(vsyncSrc);
    sp<VSyncSource> sfVsyncSrc = new DispSyncSource(&mPrimaryDispSync,
            sfVsyncPhaseOffsetNs, true, "sf");
   //创建Sf的Vsync信号接收线程
    mSFEventThread = new EventThread(sfVsyncSrc);
    mEventQueue.setEventThread(mSFEventThread);
...
}

DispSyncSource

DispSyncSource(DispSync* dispSync, nsecs_t phaseOffset, bool traceVsync,
    const char* label) :
        mValue(0),
        mTraceVsync(traceVsync),
        mVsyncOnLabel(String8::format("VsyncOn-%s", label)),
        mVsyncEventLabel(String8::format("VSYNC-%s", label)),
        mDispSync(dispSync),
        mCallbackMutex(),
        mCallback(),
        mVsyncMutex(),
        mPhaseOffset(phaseOffset),
        mEnabled(false) {}

EventThread

EventThread::EventThread(const sp<VSyncSource>& src)
    : mVSyncSource(src),
      mUseSoftwareVSync(false),
      mVsyncEnabled(false),
      mDebugVsyncEnabled(false),
      mVsyncHintSent(false) {

    for (int32_t i=0 ; i<DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES ; i++) {
        mVSyncEvent[i].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
        mVSyncEvent[i].header.id = 0;
        mVSyncEvent[i].header.timestamp = 0;
        mVSyncEvent[i].vsync.count =  0;
    }
    struct sigevent se;
    se.sigev_notify = SIGEV_THREAD;
    se.sigev_value.sival_ptr = this;
    se.sigev_notify_function = vsyncOffCallback;
    se.sigev_notify_attributes = NULL;
    timer_create(CLOCK_MONOTONIC, &se, &mTimerId);
}

void EventThread::onFirstRef() {
  //运行EventThread线程
    run("EventThread", PRIORITY_URGENT_DISPLAY + PRIORITY_MORE_FAVORABLE);
}

bool EventThread::threadLoop() {
    DisplayEventReceiver::Event event;
    Vector< sp<EventThread::Connection> > signalConnections;
  //等待事件发生
    signalConnections = waitForEvent(&event);

    const size_t count = signalConnections.size();
    for (size_t i=0 ; i<count ; i++) {
        const sp<Connection>& conn(signalConnections[i]);
        // 分发事件给所有的监听者
        status_t err = conn->postEvent(event);
        if (err == -EAGAIN || err == -EWOULDBLOCK) {
          
        } else if (err < 0) {
            removeDisplayEventConnection(signalConnections[i]);
        }
    }
    return true;
}

Vector< sp<EventThread::Connection> > EventThread::waitForEvent(
        DisplayEventReceiver::Event* event)
{
    Mutex::Autolock _l(mLock);
    Vector< sp<EventThread::Connection> > signalConnections;

    do {
        // Here we figure out if we need to enable or disable vsyncs
        if (timestamp && !waitForVSync) {
            disableVSyncLocked();
        } else if (!timestamp && waitForVSync) {
            enableVSyncLocked();
        }

        // note: !timestamp implies signalConnections.isEmpty(), because we
        // don't populate signalConnections if there's no vsync pending
        if (!timestamp && !eventPending) {
            // wait for something to happen
            if (waitForVSync) {
                bool softwareSync = mUseSoftwareVSync;
                nsecs_t timeout = softwareSync ? ms2ns(16) : ms2ns(1000);
                if (mCondition.waitRelative(mLock, timeout) == TIMED_OUT) {
                    if (!softwareSync) {
                        ALOGW("Timed out waiting for hw vsync; faking it");
                    }
                    mVSyncEvent[0].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
                    mVSyncEvent[0].header.id = DisplayDevice::DISPLAY_PRIMARY;
                    mVSyncEvent[0].header.timestamp = systemTime(SYSTEM_TIME_MONOTONIC);
                    mVSyncEvent[0].vsync.count++;
                }
            } else {
                mCondition.wait(mLock);
            }
        }
    } while (signalConnections.isEmpty());

    return signalConnections;
}

创建EventThread线程完毕后，执行threadLoop，通过waitForEvent()等待事件通知。

等待通过mCondition.wait()实现

MessaqeQueue#setEventThread

//frameworks/native/services/surfaceflinger/MessageQueue.cpp
void MessageQueue::setEventThread(const sp<EventThread>& eventThread)
{
    mEventThread = eventThread;
    mEvents = eventThread->createEventConnection();
    mEventTube = mEvents->getDataChannel();
    mLooper->addFd(mEventTube->getFd(), 0, Looper::EVENT_INPUT,
            MessageQueue::cb_eventReceiver, this);
}

主要执行了以下几步：

EventThread#createEventConnection

新建BitTube对象

//frameworks/native/services/surfaceflinger/EventThread.cpp
sp<EventThread::Connection> EventThread::createEventConnection() const {
    return new Connection(const_cast<EventThread*>(this));
}

EventThread::Connection::Connection(
        const sp<EventThread>& eventThread)
    : count(-1), mEventThread(eventThread), mChannel(new BitTube())
{
}

构建完成Connection对象，执行如下代码

void EventThread::Connection::onFirstRef() {
    // NOTE: mEventThread doesn't hold a strong reference on us
    mEventThread->registerDisplayEventConnection(this);
}

status_t EventThread::registerDisplayEventConnection(
        const sp<EventThread::Connection>& connection) {
    Mutex::Autolock _l(mLock);
    mDisplayEventConnections.add(connection);
    mCondition.broadcast();
    return NO_ERROR;
}

初始化Connection之后，将Connection对象添加到mDisplayEventConnections中。

mDisplayEventConnections主要负责保存接收Vsync信号的Connection的容器. 主要存储的是SurfaceFlinger与App的用来接收Vsync信号。

Connection#getDataChannel

获取BitTube对象

1
2
3

sp<BitTube> EventThread::Connection::getDataChannel() const {
    return mChannel;
}

//frameworks/native/libs/gui/BitTube.cpp
BitTube::BitTube(size_t bufsize) {
    // 创建socket pair，用于发送事件
    init(bufsize, bufsize);
}

void BitTube::init(size_t rcvbuf, size_t sndbuf) {
    int sockets[2];
    if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, sockets) == 0) {
        size_t size = DEFAULT_SOCKET_BUFFER_SIZE;
        // 设置socket buffer
        setsockopt(sockets[0], SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(rcvbuf));
        setsockopt(sockets[1], SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(sndbuf));
        // since we don't use the "return channel", we keep it small...
        setsockopt(sockets[0], SOL_SOCKET, SO_SNDBUF, &size, sizeof(size));
        setsockopt(sockets[1], SOL_SOCKET, SO_RCVBUF, &size, sizeof(size));
        fcntl(sockets[0], F_SETFL, O_NONBLOCK);
        fcntl(sockets[1], F_SETFL, O_NONBLOCK);
        // socket[0]用于接收端，最终通过Binder IPC返回给客户端应用
        mReceiveFd.reset(sockets[0]);
        // socket[1]用于发送端
        mSendFd.reset(sockets[1]);
    } else {
        mReceiveFd.reset();
        ALOGE("BitTube: pipe creation failed (%s)", strerror(errno));
    }
}

BitTube实际是一个Socket，所以EventThread实际通过Socket和MessageQueue通信。

Looper#addFd

监听BitTube，一旦收到数据调用cb_eventReceiver()

通过Looper监听BitTube的fd。

总结

这一步主要用于接收Vsync信号的初始化操作

init()中，创建了EventThread用来接收Vsync信号
通过MessageQueue.setEventThread()将EventThread与MessageQueue建立关联。实际内部通过BitTube(Socket)建立两者间的通信。
再通过addFd()监听BitTube的套接字fd，这样就可以监听到数据的变化。

SurfaceFlinger#run

最后执行SurfaceFlinger#run

void SurfaceFlinger::run() {
    do {
        waitForEvent();
    } while (true);
}

void SurfaceFlinger::waitForEvent() {
    mEventQueue.waitMessage();
}

//frameworks/native/services/surfaceflinger/MessageQueue.cpp
void MessageQueue::waitMessage() {
    do {
        IPCThreadState::self()->flushCommands();
        int32_t ret = mLooper->pollOnce(-1);
        switch (ret) {
            case Looper::POLL_WAKE:
            case Looper::POLL_CALLBACK:
                continue;
            case Looper::POLL_ERROR:
                ALOGE("Looper::POLL_ERROR");
            case Looper::POLL_TIMEOUT:
                // timeout (should not happen)
                continue;
            default:
                // should not happen
                ALOGE("Looper::pollOnce() returned unknown status %d", ret);
                continue;
        }
    } while (true);
}

通过waitMessage()等待消息的到来

Sf初始化

Vsync信号相关

接收Vsync

HWC#hook_vsync

Vsync信号都是由HWComposer发出的，需要从HWC进行分析

//frameworks/native/services/surfaceflinger/DisplayHardware/HWComposer.cpp
HWComposer::HWComposer(
        const sp<SurfaceFlinger>& flinger,
        EventHandler& handler)
    : mFlinger(flinger),
      mFbDev(0), mHwc(0), mNumDisplays(1),
      mCBContext(new cb_context),
      mEventHandler(handler),
      mDebugForceFakeVSync(false)
{
        ...
    if (mHwc) {
        if (mHwc->registerProcs) {
            mCBContext->hwc = this;
            mCBContext->procs.invalidate = &hook_invalidate; //invalidate事件回调
            mCBContext->procs.vsync = &hook_vsync;//Vsync回调
            if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1))
                mCBContext->procs.hotplug = &hook_hotplug;
            else
                mCBContext->procs.hotplug = NULL;
            memset(mCBContext->procs.zero, 0, sizeof(mCBContext->procs.zero));
            mHwc->registerProcs(mHwc, &mCBContext->procs);
        }          
}

通过hook_vsync处理Vsync信号

void HWComposer::hook_vsync(const struct hwc_procs* procs, int disp,
        int64_t timestamp) {
    cb_context* ctx = reinterpret_cast<cb_context*>(
            const_cast<hwc_procs_t*>(procs));
    ctx->hwc->vsync(disp, timestamp);
}

void HWComposer::vsync(int disp, int64_t timestamp) {
    if (uint32_t(disp) < HWC_NUM_PHYSICAL_DISPLAY_TYPES) {
        {
            Mutex::Autolock _l(mLock);

            mLastHwVSync[disp] = timestamp;
        }

        char tag[16];
        snprintf(tag, sizeof(tag), "HW_VSYNC_%1u", disp);
        mEventHandler.onVSyncReceived(disp, timestamp);
    }
}

当hook_vsync收到Vsync信号时，回调到vsync()，继续调用到mEventHandler.onVsyncReceived()

mEventHandler是在HWC初始化时赋值的，实际就是SurfaceFlinger

Sf#onVSyncReceived

void SurfaceFlinger::onVSyncReceived(int type, nsecs_t timestamp) {
    bool needsHwVsync = false;

    { // Scope for the lock
        Mutex::Autolock _l(mHWVsyncLock);
        if (type == 0 && mPrimaryHWVsyncEnabled) {
            needsHwVsync = mPrimaryDispSync.addResyncSample(timestamp);
        }
    }

    if (needsHwVsync) {
        enableHardwareVsync();
    } else {
        disableHardwareVsync(false);
    }
}

void SurfaceFlinger::init() {
    sp<VSyncSource> vsyncSrc = new DispSyncSource(&mPrimaryDispSync,
            vsyncPhaseOffsetNs, true, "app");
    mEventThread = new EventThread(vsyncSrc);
}

void SurfaceFlinger::enableHardwareVsync() {
    Mutex::Autolock _l(mHWVsyncLock);
    if (!mPrimaryHWVsyncEnabled && mHWVsyncAvailable) {
        mPrimaryDispSync.beginResync();
        //申请Vsync信号
        mEventControlThread->setVsyncEnabled(true);
        mPrimaryHWVsyncEnabled = true;
    }
}

DispSync#addResyncSample

//frameworks/native/services/surfaceflinger/DispSync.cpp
DispSync::DispSync() :
        mRefreshSkipCount(0),
        mThread(new DispSyncThread()) {
    //启动DispSyncThread
    mThread->run("DispSync", PRIORITY_URGENT_DISPLAY + PRIORITY_MORE_FAVORABLE);

    reset();
    beginResync();

    if (kTraceDetailedInfo) {
        if (!kIgnorePresentFences) {
            addEventListener(0, new ZeroPhaseTracer());
        }
    }
}

DispSyncThread#threadLoop

//frameworks/native/services/surfaceflinger/DispSync.cpp   
virtual bool threadLoop() {
  ...
       while (true) {
         ...
                if (mPeriod == 0) {
                    err = mCond.wait(mMutex);
                    if (err != NO_ERROR) {
                        ALOGE("error waiting for new events: %s (%d)",
                                strerror(-err), err);
                        return false;
                    }
                    continue;
                }        
               //收集Vsync信号回调的方法
                callbackInvocations = gatherCallbackInvocationsLocked(now);         
       }

            if (callbackInvocations.size() > 0) {
                fireCallbackInvocations(callbackInvocations);
            }  
    }

    void fireCallbackInvocations(const Vector<CallbackInvocation>& callbacks) {
        for (size_t i = 0; i < callbacks.size(); i++) {
          //回调callback的 onDispSyncEvent
            callbacks[i].mCallback->onDispSyncEvent(callbacks[i].mEventTime);
        }
    }

DispSyncThread通过mCond.wait()等待被唤醒，被唤醒之后回调到onDispSynvEvent()

bool DispSync::addResyncSample(nsecs_t timestamp) {
    Mutex::Autolock lock(mMutex);
    size_t idx = (mFirstResyncSample + mNumResyncSamples) % MAX_RESYNC_SAMPLES;
    mResyncSamples[idx] = timestamp;

    if (mNumResyncSamples < MAX_RESYNC_SAMPLES) {
        mNumResyncSamples++;
    } else {
        mFirstResyncSample = (mFirstResyncSample + 1) % MAX_RESYNC_SAMPLES;
    }
    updateModelLocked();

    return mPeriod == 0 || mError > kErrorThreshold;
}

void DispSync::updateModelLocked() {
    if (mNumResyncSamples >= MIN_RESYNC_SAMPLES_FOR_UPDATE) {
        ...
        mPeriod = durationSum / (mNumResyncSamples - 1);

        // Artificially inflate the period if requested.
        mPeriod += mPeriod * mRefreshSkipCount;

        mThread->updateModel(mPeriod, mPhase);
    }
}

DispsyncThread#updateModel

void updateModel(nsecs_t period, nsecs_t phase) {
    Mutex::Autolock lock(mMutex);
    mPeriod = period;
    mPhase = phase;
    mCond.signal();
}

执行updateModel()后，唤醒了DispSyncThread

在SurfaceFlinger.init()之后初始化设置的DispSyncSource就是callback，然后回调到onDispSyncEvent

Sf.DispSyncSource#onDispSyncEvent

virtual void onDispSyncEvent(nsecs_t when) {
    sp<VSyncSource::Callback> callback;
    {
        Mutex::Autolock lock(mCallbackMutex);
        callback = mCallback;

        if (mTraceVsync) {
            mValue = (mValue + 1) % 2;
            ATRACE_INT(mVsyncEventLabel.string(), mValue);
        }
    }

    if (callback != NULL) {
        callback->onVSyncEvent(when);
    }
}

这个callback是在EventThread初始化的时候设置的，所以mCallback就是EventThread

void EventThread::enableVSyncLocked() {
    if (!mUseSoftwareVSync) {
        // never enable h/w VSYNC when screen is off
        if (!mVsyncEnabled) {
            mVsyncEnabled = true;
            mVSyncSource->setCallback(static_cast<VSyncSource::Callback*>(this));
            mVSyncSource->setVSyncEnabled(true);
        }
    }
    mDebugVsyncEnabled = true;
    sendVsyncHintOnLocked();
}

通过setCallback()建立EventThread与DispSyncSource之间的关联

EventThread#onVsyncEvent

void EventThread::onVSyncEvent(nsecs_t timestamp) {
    Mutex::Autolock _l(mLock);
    mVSyncEvent[0].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
    mVSyncEvent[0].header.id = 0;
    mVSyncEvent[0].header.timestamp = timestamp;
    mVSyncEvent[0].vsync.count++;
    mCondition.broadcast();//唤醒EventThread
}

bool EventThread::threadLoop() {
    DisplayEventReceiver::Event event;
    Vector< sp<EventThread::Connection> > signalConnections;
  //等待事件发生
    signalConnections = waitForEvent(&event);

    const size_t count = signalConnections.size();
    for (size_t i=0 ; i<count ; i++) {
        const sp<Connection>& conn(signalConnections[i]);
        // 分发事件给所有的监听者
        status_t err = conn->postEvent(event);
        if (err == -EAGAIN || err == -EWOULDBLOCK) {
          
        } else if (err < 0) {
            removeDisplayEventConnection(signalConnections[i]);
        }
    }
    return true;
}

EventThread#threadLoop在被唤醒后会执行conn->postEvent()

ET.Connection#postEvent

status_t EventThread::Connection::postEvent(
        const DisplayEventReceiver::Event& event) {
    ssize_t size = DisplayEventReceiver::sendEvents(mChannel, &event, 1);
    return size < 0 ? status_t(size) : status_t(NO_ERROR);
}

//frameworks/native/libs/gui/DisplayEventReceiver.cpp
ssize_t DisplayEventReceiver::sendEvents(gui::BitTube* dataChannel,
        Event const* events, size_t count)
{
    return gui::BitTube::sendObjects(dataChannel, events, count);
}

通过BitTube发送消息，此时就会触发到MQ#cb_eventReceiver

MessageQueue#cb_eventReceiver

int MessageQueue::cb_eventReceiver(int fd, int events, void* data) {
    MessageQueue* queue = reinterpret_cast<MessageQueue *>(data);
    return queue->eventReceiver(fd, events);
}

int MessageQueue::eventReceiver(int /*fd*/, int /*events*/) {
    ssize_t n;
    DisplayEventReceiver::Event buffer[8];
    while ((n = DisplayEventReceiver::getEvents(mEventTube, buffer, 8)) > 0) {
        for (int i=0 ; i<n ; i++) {
            if (buffer[i].header.type == DisplayEventReceiver::DISPLAY_EVENT_VSYNC) {
#if INVALIDATE_ON_VSYNC
                mHandler->dispatchInvalidate();
#else
                mHandler->dispatchRefresh();
#endif
                break;
            }
        }
    }
    return 1;
}

void MessageQueue::Handler::dispatchRefresh() {
    if ((android_atomic_or(eventMaskRefresh, &mEventMask) & eventMaskRefresh) == 0) {
        mQueue.mLooper->sendMessage(this, Message(MessageQueue::REFRESH));
    }
}

void MessageQueue::Handler::dispatchInvalidate() {
    if ((android_atomic_or(eventMaskInvalidate, &mEventMask) & eventMaskInvalidate) == 0) {
        mQueue.mLooper->sendMessage(this, Message(MessageQueue::INVALIDATE));
    }
}

回调到MessageQueue.Handler的handleMessage()

void MessageQueue::Handler::handleMessage(const Message& message) {
    switch (message.what) {
        case INVALIDATE:
            android_atomic_and(~eventMaskInvalidate, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
        case REFRESH:
            android_atomic_and(~eventMaskRefresh, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
        case TRANSACTION:
            android_atomic_and(~eventMaskTransaction, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
    }
}

Sf#onMessageReceived

void SurfaceFlinger::onMessageReceived(int32_t what) {
    ATRACE_CALL();
    switch (what) {
        case MessageQueue::TRANSACTION: {
            handleMessageTransaction();
            break;
        }
        case MessageQueue::INVALIDATE: {
            bool refreshNeeded = handleMessageTransaction();
            refreshNeeded |= handleMessageInvalidate();
            refreshNeeded |= mRepaintEverything;
            if (refreshNeeded) {
                signalRefresh();
            }
            break;
        }
        case MessageQueue::REFRESH: {
            handleMessageRefresh();
            break;
        }
    }
}

总结

SF接收Vsync信号

接收Vsync信号主要分为以下几步：

HWC收到Vsync信号时，回调到hook_vsync，内部执行到sf#onVsyncReceived()
继续执行到DispSync#addResyncSample()，然后到DispSyncThread#updateModel()调用mCondition.broadcast()唤醒EventThread
唤醒之后执行到DispSyncSource.onDispSyncEvent()继续执行到EventThread.onVsyncEvent()，其中内部调用了DisplayEventReceiver.sendEvents() -> BitTube.sendObjects()发送消息，Looper监听到BitTube有数据流动，就会回调MessageQueue.cb_eventReceiver()
继续通过消息机制，回调到MessageQueue.handleMessage()，最后调用Sf.handleMessageReceived()

简化版：

Vsync信号由HWC产生，然后回调到DispSyncthread在继续回调到DispSyncSource，继续调用到了EventThread。最后EventThread通过BitTube(Socket)发送消息到MessageQueue，MessageQueue接收到消息后，在回调给SurfaceFlinger。

处理Vsync

主要在Sf#onMessageReceived()处理Vsync信号

void SurfaceFlinger::onMessageReceived(int32_t what) {
        case MessageQueue::INVALIDATE: {
            bool refreshNeeded = handleMessageTransaction();
            refreshNeeded |= handleMessageInvalidate();
            refreshNeeded |= mRepaintEverything;
            if (refreshNeeded) {
                signalRefresh();
            }
            break;
        }  
        case MessageQueue::REFRESH: {
            handleMessageRefresh();
            break;
        }
}

在接受到Vsync信号后，就会回调到MessageQueue::INVALIDATE，继续向下执行到signalRefresh()

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::signalRefresh() {
    mEventQueue.refresh();
}

//frameworks/native/services/surfaceflinger/MessageQueue.cpp
void MessageQueue::refresh() {
#if INVALIDATE_ON_VSYNC
    mHandler->dispatchRefresh();
#else
    mEvents->requestNextVsync();
#endif
}	

void MessageQueue::Handler::dispatchRefresh() {
    if ((android_atomic_or(eventMaskRefresh, &mEventMask) & eventMaskRefresh) == 0) {
        mQueue.mLooper->sendMessage(this, Message(MessageQueue::REFRESH));
    }
}

Sf#handleMessageRefresh

最后还是执行到了handleMessageRefresh()

void SurfaceFlinger::handleMessageRefresh() {
    ATRACE_CALL();
    preComposition();
    rebuildLayerStacks();
    setUpHWComposer();
    doDebugFlashRegions();
    doComposition();
    postComposition();
}

preComposition-合成前预处理

void SurfaceFlinger::preComposition()
{
    //是否需要刷新布局
    bool needExtraInvalidate = false;
    const LayerVector& layers(mDrawingState.layersSortedByZ);
    const size_t count = layers.size();
    for (size_t i=0 ; i<count ; i++) {
       //当前Layer发生了变化
        if (layers[i]->onPreComposition()) {
            needExtraInvalidate = true;
        }
    }
    if (needExtraInvalidate) {
      //申请下一个Vsync信号
        signalLayerUpdate();
    }
}

//frameworks/native/services/surfaceflinger/Layer.cpp
bool Layer::onPreComposition() {
    mRefreshPending = false;
   //有待处理的Buffer帧，
    return mQueuedFrames > 0 || mSidebandStreamChanged;
}

preComposition()需要先判断Layer是否发生了变化，没发生变化不需要申请下一次Vsync信号，否则执行signalLayerUpdate()申请下一次Vsync信号。

signalLayerUpdate

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::signalLayerUpdate() {
    mEventQueue.invalidate();
}

//frameworks/native/services/surfaceflinger/MessageQueue.cpp
void MessageQueue::invalidate() {
#if INVALIDATE_ON_VSYNC
    mEvents->requestNextVsync();
#else
    mHandler->dispatchInvalidate();
#endif
}

//frameworks/native/services/surfaceflinger/EventThread.cpp
void EventThread::requestNextVsync(
        const sp<EventThread::Connection>& connection) {
    Mutex::Autolock _l(mLock);
    if (connection->count < 0) {
        connection->count = 0;
        mCondition.broadcast();
    }
}

唤醒了EventThread，返回Vsync信号通知。

rebuildLayerStacks-重建Layer

遍历Layer，计算和存储每个Layer的dirtyRegion，如果dirtyRegion显示在设备的显示区域内，就表示Layer需要重新绘制。

void SurfaceFlinger::rebuildLayerStacks() {
    // rebuild the visible layer list per screen
    if (CC_UNLIKELY(mVisibleRegionsDirty)) {
        ATRACE_CALL();
        mVisibleRegionsDirty = false;
        invalidateHwcGeometry();

        const LayerVector& layers(mDrawingState.layersSortedByZ);
      //遍历所有显示设备，计算显示设备中dirtyRegion和 opaqueRegion
        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            Region opaqueRegion;//非透明区域
            Region dirtyRegion;//变化区域，需要刷新
            Vector< sp<Layer> > layersSortedByZ;
            const sp<DisplayDevice>& hw(mDisplays[dpy]);
            const Transform& tr(hw->getTransform());
            const Rect bounds(hw->getBounds());
            if (hw->isDisplayOn()) {
              //计算Layer的 dirtyRegion和 opaqueRegion
                SurfaceFlinger::computeVisibleRegions(layers,
                        hw->getLayerStack(), dirtyRegion, opaqueRegion);

                const size_t count = layers.size();
                for (size_t i=0 ; i<count ; i++) {
                    const sp<Layer>& layer(layers[i]);
                    const Layer::State& s(layer->getDrawingState());
                    if (s.layerStack == hw->getLayerStack()) {
                        Region drawRegion(tr.transform(
                                layer->visibleNonTransparentRegion));
                        drawRegion.andSelf(bounds);
                        if (!drawRegion.isEmpty()) {
                            layersSortedByZ.add(layer);
                        }
                    }
                }
            }
          //按照Z轴由小到大排序
            hw->setVisibleLayersSortedByZ(layersSortedByZ);
            hw->undefinedRegion.set(bounds);
            hw->undefinedRegion.subtractSelf(tr.transform(opaqueRegion));
            hw->dirtyRegion.orSelf(dirtyRegion);
        }
    }
}

最重要的是computeVisibleRegions-对Layer的dirtyRegion和opaqueRegion的计算。

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::computeVisibleRegions(
        const LayerVector& currentLayers, uint32_t layerStack,
        Region& outDirtyRegion, Region& outOpaqueRegion)
{
 size_t i = currentLayers.size();
    while (i--) {
        const sp<Layer>& layer = currentLayers[i];

        // start with the whole surface at its current location
        const Layer::State& s(layer->getDrawingState());

        // only consider the layers on the given layer stack
        if (s.layerStack != layerStack)
            continue;
      //非透明区域
        Region opaqueRegion;
      //可见区域
        Region visibleRegion;
      //被遮盖区域
        Region coveredRegion;
      //透明区域
        Region transparentRegion;

        // handle hidden surfaces by setting the visible region to empty
        if (CC_LIKELY(layer->isVisible())) {
            const bool translucent = !layer->isOpaque(s);
            Rect bounds(s.transform.transform(layer->computeBounds()));
            visibleRegion.set(bounds);
            if (!visibleRegion.isEmpty()) {
                // Remove the transparent area from the visible region
                if (translucent) {
                    const Transform tr(s.transform);
                    if (tr.transformed()) {
                        if (tr.preserveRects()) {
                            // transform the transparent region
                            transparentRegion = tr.transform(s.activeTransparentRegion);
                        } else {
                            // transformation too complex, can't do the
                            // transparent region optimization.
                            transparentRegion.clear();
                        }
                    } else {
                        transparentRegion = s.activeTransparentRegion;
                    }
                }

                // compute the opaque region
                const int32_t layerOrientation = s.transform.getOrientation();
                if (s.alpha==255 && !translucent &&
                        ((layerOrientation & Transform::ROT_INVALID) == false)) {
                    // the opaque region is the layer's footprint
                    opaqueRegion = visibleRegion;
                }
            }
        }

        // Clip the covered region to the visible region
        coveredRegion = aboveCoveredLayers.intersect(visibleRegion);

        // 累加当前Layer和上层Layer的可见区域
        aboveCoveredLayers.orSelf(visibleRegion);

        // 可见区域减去非透明区域
        visibleRegion.subtractSelf(aboveOpaqueLayers);

        // 计算脏区
        if (layer->contentDirty) {
            // we need to invalidate the whole region
            dirty = visibleRegion;
            // as well, as the old visible region
            dirty.orSelf(layer->visibleRegion);
            layer->contentDirty = false;
        } else {
            const Region newExposed = visibleRegion - coveredRegion;
            const Region oldVisibleRegion = layer->visibleRegion;
            const Region oldCoveredRegion = layer->coveredRegion;
            const Region oldExposed = oldVisibleRegion - oldCoveredRegion;
            dirty = (visibleRegion&oldCoveredRegion) | (newExposed-oldExposed);
        }
        dirty.subtractSelf(aboveOpaqueLayers);
       //累加脏区
        outDirtyRegion.orSelf(dirty);
       //添加非透明区域
        aboveOpaqueLayers.orSelf(opaqueRegion);
       //存储可见区域
        layer->setVisibleRegion(visibleRegion);
        layer->setCoveredRegion(coveredRegion);
        layer->setVisibleNonTransparentRegion(
                visibleRegion.subtract(transparentRegion));
    }

    outOpaqueRegion = aboveOpaqueLayers;
}

按照上述源码，界面显示区域分为如下几种：

opaqueRegion：非透明区域——表示不完全透明的区域
dirtyRegion：需要重绘的区域
visibleRegion：可见区域——表示完全不透明的区域
coveredRegion：被覆盖区域——被完全不透明区域覆盖的区域
transparentRegion：完全透明的区域——一般需要从合成列表中移除
aboveOpaqueLayers：所有非透明区域的叠加
aboveCoveredLayers：所有可见区域的叠加

以平常的应用界面来举例。

opaqueRegion：状态栏通常都是半透明的，可以看到时间等信息

visibleRegion：当前显示的应用界面，就完全遮盖了后面的内容

coveredRegion：桌面应用设置的壁纸。

computeVisibleRegions主要完成了以下几步：

在Layer的Z轴从上向下遍历该显示设备中的Layer

计算被覆盖区域：aboveCoveredLayers与opaqueRegion的交集

计算可见区域：去除opaqueRegion和aboveOpaqueLayers的交集

计算脏区域

保存到Layer中

setUpHWComposer-构造硬件合成的任务

Layer交给HWComposer去做图层混合。

void SurfaceFlinger::setUpHWComposer() {
  
    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        bool dirty = !mDisplays[dpy]->getDirtyRegion(false).isEmpty();
        bool empty = mDisplays[dpy]->getVisibleLayersSortedByZ().size() == 0;
        bool wasEmpty = !mDisplays[dpy]->lastCompositionHadVisibleLayers;
       //没有脏区域或者可见的Layer，就不需要进行合成
        bool mustRecompose = dirty && !(empty && wasEmpty);
      
        mDisplays[dpy]->beginFrame(mustRecompose);

        if (mustRecompose) {
            mDisplays[dpy]->lastCompositionHadVisibleLayers = !empty;
        }      
    }
  
  //构造HWComposer硬件任务
    HWComposer& hwc(getHwComposer());
    if (hwc.initCheck() == NO_ERROR) {
        // build the h/w work list
        if (CC_UNLIKELY(mHwWorkListDirty)) {
            mHwWorkListDirty = false;
            for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
                sp<const DisplayDevice> hw(mDisplays[dpy]);
                const int32_t id = hw->getHwcDisplayId();
                if (id >= 0) {
                    const Vector< sp<Layer> >& currentLayers(
                        hw->getVisibleLayersSortedByZ());
                    const size_t count = currentLayers.size();
                  //在HWC创建任务列表
                    if (hwc.createWorkList(id, count) == NO_ERROR) {
                        HWComposer::LayerListIterator cur = hwc.begin(id);
                        const HWComposer::LayerListIterator end = hwc.end(id);
                        for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
                            const sp<Layer>& layer(currentLayers[i]);
                            layer->setGeometry(hw, *cur);
                            if (mDebugDisableHWC || mDebugRegion || mDaltonize || mHasColorMatrix) {
                                cur->setSkip(true);
                            }
                        }
                    }
                }
            }
        }

        // 设置每帧的数据
        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            sp<const DisplayDevice> hw(mDisplays[dpy]);
            const int32_t id = hw->getHwcDisplayId();
            if (id >= 0) {
                const Vector< sp<Layer> >& currentLayers(
                    hw->getVisibleLayersSortedByZ());
                const size_t count = currentLayers.size();
                HWComposer::LayerListIterator cur = hwc.begin(id);
                const HWComposer::LayerListIterator end = hwc.end(id);
                for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
                    const sp<Layer>& layer(currentLayers[i]);
                    layer->setPerFrameData(hw, *cur);
                }
            }
        }

        status_t err = hwc.prepare();
        ALOGE_IF(err, "HWComposer::prepare failed (%s)", strerror(-err));

        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            sp<const DisplayDevice> hw(mDisplays[dpy]);
            hw->prepareFrame(hwc);
        }
    }  
  
}

doComposition-执行合成任务

前面已经准备好了合成Layer任务和需要合成的数据，现在就需要做图像的混合工作。

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::doComposition() {
    ATRACE_CALL();
    const bool repaintEverything = android_atomic_and(0, &mRepaintEverything);
    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        const sp<DisplayDevice>& hw(mDisplays[dpy]);
        if (hw->isDisplayOn()) {
            // transform the dirty region into this screen's coordinate space
            const Region dirtyRegion(hw->getDirtyRegion(repaintEverything));

            // repaint the framebuffer (if needed)
            doDisplayComposition(hw, dirtyRegion);
        }
    }
    postFramebuffer();
}

doComposition()主要执行以下两步

doDisplayComposition

void SurfaceFlinger::doDisplayComposition(const sp<const DisplayDevice>& hw,
        const Region& inDirtyRegion)
{
  //是否硬件绘制
    bool isHwcDisplay = hw->getHwcDisplayId() >= 0;
    if (!isHwcDisplay && inDirtyRegion.isEmpty()) {
        return;
    }
  
  ...
    //进行合成
       if (!doComposeSurfaces(hw, dirtyRegion)) return;  
  ...
    
}

bool SurfaceFlinger::doComposeSurfaces(const sp<const DisplayDevice>& hw, const Region& dirty)
{
  ...
    const Vector< sp<Layer> >& layers(hw->getVisibleLayersSortedByZ());
    const size_t count = layers.size();
    const Transform& tr = hw->getTransform();
    if (cur != end) {
        // 使用硬件合成
        for (size_t i=0 ; i<count && cur!=end ; ++i, ++cur) {
            const sp<Layer>& layer(layers[i]);
            const Region clip(dirty.intersect(tr.transform(layer->visibleRegion)));
            if (!clip.isEmpty()) {
                switch (cur->getCompositionType()) {
                    case HWC_CURSOR_OVERLAY:
                    case HWC_OVERLAY: {
                        const Layer::State& state(layer->getDrawingState());
                        if ((cur->getHints() & HWC_HINT_CLEAR_FB)
                                && i
                                && layer->isOpaque(state) && (state.alpha == 0xFF)
                                && hasGlesComposition) {
                            // never clear the very first layer since we're
                            // guaranteed the FB is already cleared
                            layer->clearWithOpenGL(hw, clip);
                        }
                        break;
                    }
                    case HWC_FRAMEBUFFER: {
                        layer->draw(hw, clip);
                        break;
                    }
                    case HWC_FRAMEBUFFER_TARGET: {
                        // this should not happen as the iterator shouldn't
                        // let us get there.
                        ALOGW("HWC_FRAMEBUFFER_TARGET found in hwc list (index=%zu)", i);
                        break;
                    }
                }
            }
            layer->setAcquireFence(hw, *cur);
        }
    } else {
        // 不使用硬件合成
        for (size_t i=0 ; i<count ; ++i) {
            const sp<Layer>& layer(layers[i]);
            const Region clip(dirty.intersect(
                    tr.transform(layer->visibleRegion)));
            if (!clip.isEmpty()) {
                layer->draw(hw, clip);
            }
        }
    }    
}

postFrameBuffer

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::postFramebuffer()
{
    ATRACE_CALL();

    const nsecs_t now = systemTime();
    mDebugInSwapBuffers = now;

    HWComposer& hwc(getHwComposer());
    if (hwc.initCheck() == NO_ERROR) {
        if (!hwc.supportsFramebufferTarget()) {
            // EGL spec says:
            //   "surface must be bound to the calling thread's current context,
            //    for the current rendering API."
            getDefaultDisplayDevice()->makeCurrent(mEGLDisplay, mEGLContext);
        }
        hwc.commit();
    }

    getDefaultDisplayDevice()->makeCurrent(mEGLDisplay, mEGLContext);

    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        sp<const DisplayDevice> hw(mDisplays[dpy]);
        const Vector< sp<Layer> >& currentLayers(hw->getVisibleLayersSortedByZ());
        hw->onSwapBuffersCompleted(hwc);
        const size_t count = currentLayers.size();
        int32_t id = hw->getHwcDisplayId();
        if (id >=0 && hwc.initCheck() == NO_ERROR) {
            HWComposer::LayerListIterator cur = hwc.begin(id);
            const HWComposer::LayerListIterator end = hwc.end(id);
            for (size_t i = 0; cur != end && i < count; ++i, ++cur) {
                currentLayers[i]->onLayerDisplayed(hw, &*cur);
            }
        } else {
            for (size_t i = 0; i < count; i++) {
                currentLayers[i]->onLayerDisplayed(hw, NULL);
            }
        }
    }

    mLastSwapBufferTime = systemTime() - now;
    mDebugInSwapBuffers = 0;

    uint32_t flipCount = getDefaultDisplayDevice()->getPageFlipCount();
    if (flipCount % LOG_FRAME_STATS_PERIOD == 0) {
        logFrameStats();
    }
}

doComposition

doDisplayComposition：重绘FrameBuffer，并进行合成
postFrameBuffer：将数据写入到FrameBuffer然后完成物理屏幕的图像显示

postComposition-合成图形结束后的处理

此时图层已经混合完成，图像数据也被送到了帧缓冲(FrameBuffer)，并且已经显示在屏幕上了，由postComposition()进行一些收尾工作的处理。

//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::postComposition()
{
    const LayerVector& layers(mDrawingState.layersSortedByZ);
    const size_t count = layers.size();
    for (size_t i=0 ; i<count ; i++) {
        layers[i]->onPostComposition();
    }
  ...
    //更新 swapBuffer 记录时间
    nsecs_t currentTime = systemTime();
    if (mHasPoweredOff) {
        mHasPoweredOff = false;
    } else {
        nsecs_t period = mPrimaryDispSync.getPeriod();
        nsecs_t elapsedTime = currentTime - mLastSwapTime;
        size_t numPeriods = static_cast<size_t>(elapsedTime / period);
        if (numPeriods < NUM_BUCKETS - 1) {
            mFrameBuckets[numPeriods] += elapsedTime;
        } else {
            mFrameBuckets[NUM_BUCKETS - 1] += elapsedTime;
        }
        mTotalTime += elapsedTime;
    }
    mLastSwapTime = currentTime;    
  
}

总结

SF处理Vsync信号

Android图形缓冲区

Android的图形缓冲区主要由以下几部分组成：

Surface
Layer
GraphicBuffer
BufferQueue

Surface相关

Surface是提供给图形生产者控制缓冲区的

在软件绘制中，调用drawSoftware(surface)传入Surface缓冲区到native层的SkiaCanvas

在硬件绘制中，调用ThreadedRenderer.initalize(surface)传入Surface缓冲区到OpenGL中进行渲染。

当得到Surface缓冲区后，就可以存入需要绘制的内容到Surface中。

Surface内部持有BufferQueue中的GraphicBufferProducer，主要负责创建或获取可用的GraphicBuffer以及提交绘制后的GraphicBuffer。

Layer相关

Layer是提供给图形消费者获取缓冲区的

在SurfaceFlinger需要消费图形数据，进行图层混合时，在rebuildLayerStacks()进行Layer遍历，取出Layer中的图形数据，进行数据合成处理。

Layer内部持有BufferQueue中的GraphicBufferConsumer，主要负责获取和释放GraphicBuffer

GraphicBuffer

真正被分配内存，并能存储图形数据的缓冲区。

BufferQueue

存放GraphicBuffer的数组结构，最多可以存储64个GraphicBuffer

BufferQueue执行流程

当绘制图像时，首先去创建Surface和Layer，

然后图像生产者通过Surface调用dequeue()申请一块GraphicBuffer，在其上绘制图像

绘制完毕后，通过Surface调用queue()把绘制好的GraphicBuffer返回到BufferQueue中。

收到HWComposer发出的Vsync信号后，SurfaceFlinger通过Layer调用acquire()获取绘制好的GraphicBuffer进行合成与处理

处理完毕后通过Layer调用release()释放GraphicBuffer并返回到BufferQueue中。

缓冲区创建流程

Activity创建图形缓冲区

其中最常见的场景在ViewRootImpl的创建过程中，在其中执行了Surface的创建。

//ViewRootImpl.java
public final class ViewRootImpl implements ViewParent,
        View.AttachInfo.Callbacks, ThreadedRenderer.DrawCallbacks {
          ...
    public final Surface mSurface = new Surface();
          
        }

主要在WindowManagerGlobal.addView()构造的ViewRootImpl对象。

此时创建的只是Java层的Surface，还需要绑定Native层的Surface。

//ViewRootImpl.java
public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
               //执行绘制流程 测量-布局-绘制
                requestLayout();
                if ((mWindowAttributes.inputFeatures
                        & WindowManager.LayoutParams.INPUT_FEATURE_NO_INPUT_CHANNEL) == 0) {
                  //触摸事件回调
                    mInputChannel = new InputChannel();
                }
                mForceDecorViewVisibility = (mWindowAttributes.privateFlags
                        & PRIVATE_FLAG_FORCE_DECOR_VIEW_VISIBILITY) != 0;
                try {
                    mOrigWindowType = mWindowAttributes.type;
                    mAttachInfo.mRecomputeGlobalAttributes = true;
                    collectViewAttributes();
                   //添加窗口
                    res = mWindowSession.addToDisplay(mWindow, mSeq, mWindowAttributes,
                            getHostVisibility(), mDisplay.getDisplayId(), mWinFrame,
                            mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
                            mAttachInfo.mOutsets, mAttachInfo.mDisplayCutout, mInputChannel);
                } catch (RemoteException e) {
                   ...
                } finally {
                    if (restore) {
                        attrs.restore();
                    }
                }      
    }

setView()主要做了两件事情：

requestLayout：主要是执行到relayoutWindow创建了Surface和Layer
addToDisplay：创建了SurfaceComponentClient

requestLayout需要在addToDisplay执行完毕后才可以执行。

WS#addToDisplay

WS#addToDisplay()执行过程

WindowSession表示Java层的Window和WMS通信的对象。

//com.android.server.wm.Session
class Session extends IWindowSession.Stub implements IBinder.DeathRecipient {
    @Override
    public int addToDisplayWithoutInputChannel(IWindow window, int seq, WindowManager.LayoutParams attrs,
            int viewVisibility, int displayId, Rect outContentInsets, Rect outStableInsets) {
        return mService.addWindow(this, window, seq, attrs, viewVisibility, displayId,
                new Rect() /* outFrame */, outContentInsets, outStableInsets, null /* outOutsets */,
                new DisplayCutout.ParcelableWrapper() /* cutout */, null /* outInputChannel */);
    }  
}

mService表示的就是WindowManagerService

//WindowManagerService.java
    public int addWindow(Session session, IWindow client, int seq,
            LayoutParams attrs, int viewVisibility, int displayId, Rect outFrame,
            Rect outContentInsets, Rect outStableInsets, Rect outOutsets,
            DisplayCutout.ParcelableWrapper outDisplayCutout, InputChannel outInputChannel) {
      ...      
      synchronized(mWindowMap) {
            AppWindowToken atoken = null;
            final boolean hasParent = parentWindow != null;
          //创建WindowToken
            WindowToken token = displayContent.getWindowToken(
                    hasParent ? parentWindow.mAttrs.token : attrs.token);        
        ...
          //创建WindowState对象
            final WindowState win = new WindowState(this, session, client, token, parentWindow,
                    appOp[0], seq, attrs, viewVisibility, session.mUid,
                    session.mCanAddInternalSystemWindow); 
        ...
          //附加窗口
            win.attach();
            mWindowMap.put(client.asBinder(), win);          
      }
    }

这里重点关注WindowState#attach

//WindowState.java
    void attach() {
        if (localLOGV) Slog.v(TAG, "Attaching " + this + " token=" + mToken);
        mSession.windowAddedLocked(mAttrs.packageName);
    }

//Session.java
    void windowAddedLocked(String packageName) {
        mPackageName = packageName;
        mRelayoutTag = "relayoutWindow: " + mPackageName;
        if (mSurfaceSession == null) {
            if (WindowManagerService.localLOGV) Slog.v(
                TAG_WM, "First window added to " + this + ", creating SurfaceSession");
            mSurfaceSession = new SurfaceSession();
          ...
        }
        mNumWindow++;
    }

//SurfaceSession.java
public SurfaceSession() {
        mNativeClient = nativeCreate();
    }

//android_view_SurfaceSession.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz) {
    SurfaceComposerClient* client = new SurfaceComposerClient();
    client->incStrong((void*)nativeCreate);
    return reinterpret_cast<jlong>(client);
}

经过上述步骤最后创建了SurfaceComponentClient

addToDisplay执行完毕后，回调到performTraversals()

WS#relayoutWindow

//ViewRootImpl.java
    private void performTraversals() {
        boolean layoutRequested = mLayoutRequested && (!mStopped || mReportNextDraw);
      ...
        final int surfaceGenerationId = mSurface.getGenerationId();

        final boolean isViewVisible = viewVisibility == View.VISIBLE;
        final boolean windowRelayoutWasForced = mForceNextWindowRelayout;
        if (mFirst || windowShouldResize || insetsChanged ||
                viewVisibilityChanged || params != null || mForceNextWindowRelayout) {
            mForceNextWindowRelayout = false;
          ...
            try {            
             relayoutResult = relayoutWindow(params, viewVisibility, insetsPending);
              ...
            }catch(RemoteException e){
              
            }
            if (!mStopped || mReportNextDraw) {
                boolean focusChangedDueToTouchMode = ensureTouchModeLocally(
                        (relayoutResult&WindowManagerGlobal.RELAYOUT_RES_IN_TOUCH_MODE) != 0);
                if (focusChangedDueToTouchMode || mWidth != host.getMeasuredWidth()
                        || mHeight != host.getMeasuredHeight() || contentInsetsChanged ||
                        updatedConfiguration) {
                    int childWidthMeasureSpec = getRootMeasureSpec(mWidth, lp.width);
                    int childHeightMeasureSpec = getRootMeasureSpec(mHeight, lp.height);
                  //执行测量流程
                    performMeasure(childWidthMeasureSpec, childHeightMeasureSpec);  
                  ...
                }
            }
          
        final boolean didLayout = layoutRequested && (!mStopped || mReportNextDraw);
        if (didLayout) {
          //执行布局过程
            performLayout(lp, mWidth, mHeight);
        }
      }
        boolean cancelDraw = mAttachInfo.mTreeObserver.dispatchOnPreDraw() || !isViewVisible;
        if (!cancelDraw && !newSurface) {
            if (mPendingTransitions != null && mPendingTransitions.size() > 0) {
                for (int i = 0; i < mPendingTransitions.size(); ++i) {
                    mPendingTransitions.get(i).startChangingAnimations();
                }
                mPendingTransitions.clear();
            }
           //执行绘制流程
            performDraw();
        } 
      ...
    }

performTraversals()主要做了以下几步：

relayoutWindow——创建Surface和Layout
performMeasure——测量过程
performLayout——布局过程
performDraw——绘制过程

接下来主要分析relayoutWindow

//ViewRootImpl.java
    private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
            boolean insetsPending) throws RemoteException {
      ...
        int relayoutResult = mWindowSession.relayout(mWindow, mSeq, params,
                (int) (mView.getMeasuredWidth() * appScale + 0.5f),
                (int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
                insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
                mWinFrame, mPendingOverscanInsets, mPendingContentInsets, mPendingVisibleInsets,
                mPendingStableInsets, mPendingOutsets, mPendingBackDropFrame, mPendingDisplayCutout,
                mPendingMergedConfiguration, mSurface);      
    }

//Session.java
    @Override
    public int relayout(IWindow window, int seq, WindowManager.LayoutParams attrs,
            int requestedWidth, int requestedHeight, int viewFlags, int flags, long frameNumber,
            Rect outFrame, Rect outOverscanInsets, Rect outContentInsets, Rect outVisibleInsets,
            Rect outStableInsets, Rect outsets, Rect outBackdropFrame,
            DisplayCutout.ParcelableWrapper cutout, MergedConfiguration mergedConfiguration,
            Surface outSurface) {
      ...
        int res = mService.relayoutWindow(this, window, seq, attrs,
                requestedWidth, requestedHeight, viewFlags, flags, frameNumber,
                outFrame, outOverscanInsets, outContentInsets, outVisibleInsets,
                outStableInsets, outsets, outBackdropFrame, cutout,
                mergedConfiguration, outSurface);
      ...
        return res;
    }

//WindowManagerService.java
    public int relayoutWindow(Session session, IWindow client, int seq, LayoutParams attrs,
            int requestedWidth, int requestedHeight, int viewVisibility, int flags,
            long frameNumber, Rect outFrame, Rect outOverscanInsets, Rect outContentInsets,
            Rect outVisibleInsets, Rect outStableInsets, Rect outOutsets, Rect outBackdropFrame,
            DisplayCutout.ParcelableWrapper outCutout, MergedConfiguration mergedConfiguration,
            Surface outSurface) {
      ...
            final boolean shouldRelayout = viewVisibility == View.VISIBLE &&
                    (win.mAppToken == null || win.mAttrs.type == TYPE_APPLICATION_STARTING
                            || !win.mAppToken.isClientHidden());        
            if (shouldRelayout) {
                try {
                  //创建SurfaceControl
                    result = createSurfaceControl(outSurface, result, win, winAnimator);
                } catch (Exception e) {
                  ...
                }              
            }
      
    }

接下来执行到createSurfaceControl

WMS#createSurfaceControl

private int createSurfaceControl(Surface outSurface, int result, WindowState win,
        WindowStateAnimator winAnimator) {
    if (!win.mHasSurface) {
        result |= RELAYOUT_RES_SURFACE_CHANGED;
    }

    WindowSurfaceController surfaceController;
    try {
        Trace.traceBegin(TRACE_TAG_WINDOW_MANAGER, "createSurfaceControl");
      //创建SurfaceControl
        surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type, win.mOwnerUid);
    } finally {
        Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
    }
    if (surfaceController != null) {
      //创建Surface
        surfaceController.getSurface(outSurface);
        if (SHOW_TRANSACTIONS) Slog.i(TAG_WM, "  OUT SURFACE " + outSurface + ": copied");
    } else {
        // For some reason there isn't a surface.  Clear the
        // caller's object so they see the same state.
        Slog.w(TAG_WM, "Failed to create surface control for " + win);
        outSurface.release();
    }

    return result;
}

createSurfaceControl()主要执行了两步：

createSurfaceLocked——创建Layer
SurfaceControl#getSurface——创建Surface

WMS#createSurfaceLocked

//com/android/server/wm/WindowStateAnimator.java
    WindowSurfaceController createSurfaceLocked(int windowType, int ownerUid) {
      ...
            mSurfaceController = new WindowSurfaceController(mSession.mSurfaceSession,
                    attrs.getTitle().toString(), width, height, format, flags, this,
                    windowType, ownerUid);      
      ...
    }

//WindowSurfaceController.java
    public WindowSurfaceController(SurfaceSession s, String name, int w, int h, int format,
            int flags, WindowStateAnimator animator, int windowType, int ownerUid) {
      ...
        final SurfaceControl.Builder b = win.makeSurface()
                .setParent(win.getSurfaceControl())
                .setName(name)
                .setSize(w, h)
                .setFormat(format)
                .setFlags(flags)
                .setMetadata(windowType, ownerUid);
        mSurfaceControl = b.build();      
      ...
    }

//SurfaceControl.java
    public static class Builder {
      ...
        public SurfaceControl build() {
            if (mWidth <= 0 || mHeight <= 0) {
                throw new IllegalArgumentException(
                        "width and height must be set");
            }
            return new SurfaceControl(mSession, mName, mWidth, mHeight, mFormat,
                    mFlags, mParent, mWindowType, mOwnerUid);
        }      
    }

    private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
            SurfaceControl parent, int windowType, int ownerUid)
                    throws OutOfResourcesException, IllegalArgumentException {
      ...
        mNativeObject = nativeCreate(session, name, w, h, format, flags,
            parent != null ? parent.mNativeObject : 0, windowType, ownerUid);
      ...
    }

执行nativeCreate切换到Native层执行

//base/core/jni/android_view_SurfaceControl.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
        jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
        jint windowType, jint ownerUid) {
    ScopedUtfChars name(env, nameStr);
    sp<SurfaceComposerClient> client(android_view_SurfaceSession_getClient(env, sessionObj));
    SurfaceControl *parent = reinterpret_cast<SurfaceControl*>(parentObject);
    sp<SurfaceControl> surface;
    status_t err = client->createSurfaceChecked(
            String8(name.c_str()), w, h, format, &surface, flags, parent, windowType, ownerUid);
  ...

    surface->incStrong((void *)nativeCreate);
    return reinterpret_cast<jlong>(surface.get());
}

在createSurfaceChecked()后续的流程会创建Layer

SurfaceControl#getSurface

//WindowSurfaceController.java
    void getSurface(Surface outSurface) {
        outSurface.copyFrom(mSurfaceControl);
    }

//Surface.java
    public void copyFrom(SurfaceControl other) {
      ...
        //创建Surface
        long newNativeObject = nativeGetFromSurfaceControl(surfaceControlPtr);

    }

在nativeGetFromSurfaceControl()创建Surface

总结

先执行ViewRootImpl#setView()，其中会执行

requestLayout

内部执行ViewRootImpl#performTraversals()，接下去执行WMS#relayoutWindow()，然后是WMS#createSurfaceControl，分为两步：

createSurfaceLocked：创建SurfaceControl，内部执行android_view_surfaceControl#nativeCreate，执行SurfaceComponentClient#createSurface，创建Layer对象。

WindowSurfaceController#getSurface：执行到Surface#copyFrom()，调用到nativeGetFromSurfaceControl()，内部调用到SurfaceControl#getSurface()去创建Surface

创建Surface和Layer完毕后，继续执行View的绘制流程measure->layout->draw

WindowSession#addToDisplay()

执行到WMS#addWindow()，继续到Session#windowAddedLocked()，切换到Native层执行android_view_surfaceSession#native_create()在其中创建了SurfaceComponentClient。

SF-Surface/Layer创建准备

Surface、Layer的创建

根据上节源码分析可以知道，Surface、Layer的创建主要分为以下几步

创建SurfaceComponentClient

App进程与SurfaceFlinger沟通的桥梁。

//native/libs/gui/SurfaceComposerClient.cpp
void SurfaceComposerClient::onFirstRef() {
    sp<ISurfaceComposer> sf(ComposerService::getComposerService());
    if (sf != 0 && mStatus == NO_INIT) {
        auto rootProducer = mParent.promote();
        sp<ISurfaceComposerClient> conn;
        conn = (rootProducer != nullptr) ? sf->createScopedConnection(rootProducer) :
                sf->createConnection();
      ...
    }
}

其中ComposerService就是SurfaceFlinger的Binder代理对象，SurfaceComponentClient通过ComposerService与SurfaceFlinger进行通信。

ComposerService

//native/libs/gui/SurfaceComposerClient.cpp
/*static*/ sp<ISurfaceComposer> ComposerService::getComposerService() {
    ComposerService& instance = ComposerService::getInstance();
    if (instance.mComposerService == NULL) {
        ComposerService::getInstance().connectLocked();
    }
    return instance.mComposerService;
}

void ComposerService::connectLocked() {
    const String16 name("SurfaceFlinger");
  //获取SurfaceFlinger 服务
    while (getService(name, &mComposerService) != NO_ERROR) {
        usleep(250000);
    }
    assert(mComposerService != NULL);
}

//native/libs/binder/include/binder/IServiceManager.h
status_t getService(const String16& name, sp<INTERFACE>* outService)
{
    const sp<IServiceManager> sm = defaultServiceManager();
    if (sm != NULL) {
        *outService = interface_cast<INTERFACE>(sm->getService(name));
        if ((*outService) != NULL) return NO_ERROR;
    }
    return NAME_NOT_FOUND;
}

SurfaceFlinger#createConnection

//native/services/surfaceflinger/SurfaceFlinger.cpp
sp<ISurfaceComposerClient> SurfaceFlinger::createConnection() {
    return initClient(new Client(this));
}

static sp<ISurfaceComposerClient> initClient(const sp<Client>& client) {
  //检查Client是否合法
    status_t err = client->initCheck();
    if (err == NO_ERROR) {
        return client;
    }
    return nullptr;
}

其中Client内部封装的是创建和销毁Layer和Surface的操作函数。

Client实现了ISurfaceComposerClient接口，SurfaceComposerClient通过Client和SurfaceFlinger进行通讯。

除此之外还可以创建Surface以及维护Layer对象。

创建SurfaceControl并创建Layer

status_t SurfaceComposerClient::createSurfaceChecked(
        const String8& name,
        uint32_t w,
        uint32_t h,
        PixelFormat format,
        sp<SurfaceControl>* outSurface,
        uint32_t flags,
        SurfaceControl* parent,
        int32_t windowType,
        int32_t ownerUid)
{
    sp<SurfaceControl> sur;
    status_t err = mStatus;
      
        err = mClient->createSurface(name, w, h, format, flags, parentHandle,
                windowType, ownerUid, &handle, &gbp);
        if (err == NO_ERROR) {
            *outSurface = new SurfaceControl(this, handle, gbp, true /* owned */);
        }
    }
    return err;
}

Client#createSurface

//native/services/surfaceflinger/Client.cpp
status_t Client::createSurface(
        const String8& name,
        uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
        const sp<IBinder>& parentHandle, int32_t windowType, int32_t ownerUid,
        sp<IBinder>* handle,
        sp<IGraphicBufferProducer>* gbp)
{
    class MessageCreateLayer : public MessageBase {
        SurfaceFlinger* flinger;
        Client* client;
        sp<IBinder>* handle;
        sp<IGraphicBufferProducer>* gbp;
        status_t result;
        const String8& name;
        uint32_t w, h;
        PixelFormat format;
        uint32_t flags;
        sp<Layer>* parent;
        int32_t windowType;
        int32_t ownerUid;
    public:
        virtual bool handler() {
            result = flinger->createLayer(name, client, w, h, format, flags,
                    windowType, ownerUid, handle, gbp, parent);
            return true;
        }
    };
  
    sp<MessageBase> msg = new MessageCreateLayer(mFlinger.get(),
            name, this, w, h, format, flags, handle,
            windowType, ownerUid, gbp, &parent);
    mFlinger->postMessageSync(msg);
    return static_cast<MessageCreateLayer*>( msg.get() )->getResult();  
}

通过postMessageSync()发送消息，处理后回调到handler()，继续执行createLayer()

//native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::createLayer(
        const String8& name,
        const sp<Client>& client,
        uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
        int32_t windowType, int32_t ownerUid, sp<IBinder>* handle,
        sp<IGraphicBufferProducer>* gbp, sp<Layer>* parent)
{
  ...
    switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceNormal:
            result = createBufferLayer(client,
                    uniqueName, w, h, flags, format,
                    handle, gbp, &layer);

            break;
        case ISurfaceComposerClient::eFXSurfaceColor:
            result = createColorLayer(client,
                    uniqueName, w, h, flags,
                    handle, &layer);
            break;
        default:
            result = BAD_VALUE;
            break;
    }
  ...  
  
}

status_t SurfaceFlinger::createBufferLayer(const sp<Client>& client,
        const String8& name, uint32_t w, uint32_t h, uint32_t flags, PixelFormat& format,
        sp<IBinder>* handle, sp<IGraphicBufferProducer>* gbp, sp<Layer>* outLayer)
{
 ...
   //创建Layer对象
    sp<BufferLayer> layer = new BufferLayer(this, client, name, w, h, flags);   
 ...
}

createSurface执行到最后，构建出Layer对象。

new SurfaceControl

SurfaceControl主要作用就是维护Surface。

//native/libs/gui/SurfaceControl.cpp
SurfaceControl::SurfaceControl(
        const sp<SurfaceComposerClient>& client,
        const sp<IBinder>& handle,
        const sp<IGraphicBufferProducer>& gbp,
        bool owned)
    : mClient(client), mHandle(handle), mGraphicBufferProducer(gbp), mOwned(owned)
{
}

创建SurfaceControl之后，仅仅是设置了mClient以及创建了GraphicBufferProducer对象。

通过SurfaceControl创建Surface

此时已经创建完毕Surfacecontrol和Layer对象。

//
sp<Surface> SurfaceControl::getSurface() const
{
    Mutex::Autolock _l(mLock);
    if (mSurfaceData == 0) {
        return generateSurfaceLocked();
    }
    return mSurfaceData;
}

sp<Surface> SurfaceControl::generateSurfaceLocked() const
{
  //构造Surface对象
    mSurfaceData = new Surface(mGraphicBufferProducer, false);

    return mSurfaceData;
}

Native层的Surface创建完毕后，返回到Java层进行赋值。

SF-Buffer、Layer创建过程

BufferQueue的创建

在创建Layer完成后，后续就会继续去创建BufferQueue

//BufferLayer.cpp
void BufferLayer::onFirstRef() {
    // Creates a custom BufferQueue for SurfaceFlingerConsumer to use
    sp<IGraphicBufferProducer> producer;
    sp<IGraphicBufferConsumer> consumer;
  //创建BufferQueue对象
    BufferQueue::createBufferQueue(&producer, &consumer, true);
    mProducer = new MonitoredProducer(producer, mFlinger, this);
    mConsumer = new BufferLayerConsumer(consumer,
            mFlinger->getRenderEngine(), mTextureName, this);
    mConsumer->setConsumerUsageBits(getEffectiveUsage(0));
    mConsumer->setContentsChangedListener(this);
    mConsumer->setName(mName);

    if (mFlinger->isLayerTripleBufferingDisabled()) {
        mProducer->setMaxDequeuedBufferCount(2);
    }

    const sp<const DisplayDevice> hw(mFlinger->getDefaultDisplayDevice());
    updateTransformHint(hw);
}

//native/libs/gui/BufferQueue.cpp
void BufferQueue::createBufferQueue(sp<IGraphicBufferProducer>* outProducer,
        sp<IGraphicBufferConsumer>* outConsumer,
        bool consumerIsSurfaceFlinger) {
  //创建BufferQueueCore
    sp<BufferQueueCore> core(new BufferQueueCore());
  //创建BufferQueueProducer
    sp<IGraphicBufferProducer> producer(new BufferQueueProducer(core, consumerIsSurfaceFlinger));
  //创建BufferQueueConsumer
    sp<IGraphicBufferConsumer> consumer(new BufferQueueConsumer(core));
  
    *outProducer = producer;
    *outConsumer = consumer;
}

createBufferQueue主要创建以下三个对象：

BufferQueueCore
BufferQueueProducer
BufferQueueConsumer

BufferQueueCore

主要用来存放GraphicBuffer，并且存放最多64个。

//native/libs/gui/include/gui/BufferQueueCore.h
class BufferQueueCore : public virtual RefBase {

    friend class BufferQueueProducer;
    friend class BufferQueueConsumer;
public:
  ...
private:
  ...
    BufferQueueDefs::SlotsType mSlots;
    Fifo mQueue;
    std::set<int> mFreeSlots;
    std::list<int> mFreeBuffers;
    std::list<int> mUnusedSlots;
    std::set<int> mActiveBuffers;
  ...
}

主要有以下几个对象：

mSlots：大小为NUM_BUFFER_SLOTS(64)的数组，存储数据为BufferSlot
mQueue：以先进先出对了存放生产者生产的数据-BufferItem，保证按照顺序取出
mFreeSlots：尚未绑定GraphicBuffer且state = FREE的BufferSlot的index集合
mFreeBuffers：已经绑定了GraphicBuffer且state = FREE的BufferSlot的index集合
mActiveBuffers：已经绑定了GraphicBuffer且state!=FREE的BufferSlot的index集合
mUnusedSlots：没有绑定GraphicBuffer且没有状态的BufferSlot的index集合

主要介绍BufferSlot，BufferQueueCore基本是BufferSlot的各种集合

//
struct BufferSlot {

    BufferSlot()
    : mGraphicBuffer(nullptr),
      mBufferState(),
  ...
   //绑定的 GraphicBuffer
    sp<GraphicBuffer> mGraphicBuffer;
   //绑定的BufferSlot 状态
    BufferState mBufferState;
}

struct BufferState {

    // All slots are initially FREE (not dequeued, queued, acquired, or shared).
    BufferState()
    : mDequeueCount(0),
      mQueueCount(0),
      mAcquireCount(0),
      mShared(false) {
    }
  
    //         | mShared | mDequeueCount | mQueueCount | mAcquireCount |
    // --------|---------|---------------|-------------|---------------|
    // FREE    |  false  |       0       |      0      |       0       |
    // DEQUEUED|  false  |       1       |      0      |       0       |
    // QUEUED  |  false  |       0       |      1      |       0       |
    // ACQUIRED|  false  |       0       |      0      |       1       |
    // SHARED  |  true   |      any      |     any     |      any      |      
}

主要由两部分构成：

mGraphicBuffer：BufferSlot所绑定的GraphicBuffer
mBufferState：表示当前BufferSlot的状态，主要有以下几种状态：
- FREE：空闲状态，存入mFreeSlots
- DEQUEUED：被生产者获取，待绘制数据
- QUEUED：被BufferQueue获取，待消费者获取。
- ACQUIRED：被消费者获取，待获取绘制数据
- SHARED：处于共享状态。

BufferQueueCore设置了这么多的BufferSlot集合，主要为了分类BufferSlot时更高效。

SF-BufferQueueCore

BufferQueueProducer

Surface中持有BufferQueueProducer的BP代理对象-IGraphicBufferProducer。

//native/libs/gui/BufferQueueProducer.cpp
BufferQueueProducer::BufferQueueProducer(const sp<BufferQueueCore>& core,
        bool consumerIsSurfaceFlinger) :
    mCore(core),
    mSlots(core->mSlots),
...
}

status_t BufferQueueProducer::dequeueBuffer(int* outSlot, sp<android::Fence>* outFence,
                                            uint32_t width, uint32_t height, PixelFormat format,
                                            uint64_t usage, uint64_t* outBufferAge,
                                            FrameEventHistoryDelta* outTimestamps) {
 ... 
}

status_t BufferQueueProducer::queueBuffer(int slot,
        const QueueBufferInput &input, QueueBufferOutput *output) {
  ...
}

初始化了mCore和mSlots对象

graph TD
A(new <br>BufferQueueProducer)
B(赋值BufferQueueCore到mCore)
C(赋值mSlots)
A--->B
A--->C

dequeueBuffer

向BufferQueue申请一块GraphicBuffer。

标记BufferSlot的BufferState为DEQUEUED。

//native/libs/gui/BufferQueueProducer.cpp
status_t BufferQueueProducer::dequeueBuffer(int* outSlot, sp<android::Fence>* outFence,
                                            uint32_t width, uint32_t height, PixelFormat format,
                                            uint64_t usage, uint64_t* outBufferAge,
                                            FrameEventHistoryDelta* outTimestamps) {
        while (found == BufferItem::INVALID_BUFFER_SLOT) {
            status_t status = waitForFreeSlotThenRelock(FreeSlotCaller::Dequeue,
                    &found);
           ...     
        }
      //判断寻找的 BufferSlot是否与 申请的宽高、格式一致
        const sp<GraphicBuffer>& buffer(mSlots[found].mGraphicBuffer);
        if (mCore->mSharedBufferSlot == found &&
                buffer->needsReallocation(width, height, format, BQ_LAYER_COUNT, usage)) {
            BQ_LOGE("dequeueBuffer: cannot re-allocate a shared"
                    "buffer");

            return BAD_VALUE;
        }  
  ...
        if (mCore->mSharedBufferSlot != found) {
          //添加 GraphicBuffer 的index到 mActiveBuffers
            mCore->mActiveBuffers.insert(found);
        }
        *outSlot = found;  
  ...
      //标记 选中的BufferSlot状态为 DEQUEUED
        mSlots[found].mBufferState.dequeue();

      //找到了空的 GraphicBuffer，就进行初始化。
        if ((buffer == NULL) ||
                buffer->needsReallocation(width, height, format, BQ_LAYER_COUNT, usage))
        {
            mSlots[found].mAcquireCalled = false;
            mSlots[found].mGraphicBuffer = NULL;
            mSlots[found].mRequestBufferCalled = false;
            mSlots[found].mEglDisplay = EGL_NO_DISPLAY;
            mSlots[found].mEglFence = EGL_NO_SYNC_KHR;
            mSlots[found].mFence = Fence::NO_FENCE;
            mCore->mBufferAge = 0;
            mCore->mIsAllocating = true;

            returnFlags |= BUFFER_NEEDS_REALLOCATION;
        } 
      ...
    if (returnFlags & BUFFER_NEEDS_REALLOCATION) {
        sp<GraphicBuffer> graphicBuffer = new GraphicBuffer(
                width, height, format, BQ_LAYER_COUNT, usage,u
                {mConsumerName.string(), mConsumerName.size()});
      {
            if (error == NO_ERROR && !mCore->mIsAbandoned) {
                graphicBuffer->setGenerationNumber(mCore->mGenerationNumber);
              //将新创建的GraphicBuffer放到 BufferSlot中
                mSlots[*outSlot].mGraphicBuffer = graphicBuffer;
            }      
      }
    }
  
}

status_t BufferQueueProducer::waitForFreeSlotThenRelock(FreeSlotCaller caller,
        int* found) const {
  ...
        const int maxBufferCount = mCore->getMaxBufferCountLocked();
       //请求是否太多
        bool tooManyBuffers = mCore->mQueue.size()
                            > static_cast<size_t>(maxBufferCount);
        if (tooManyBuffers) {
          //请求过多时，就会进入阻塞状态
            BQ_LOGV("r%s: queue size is %zu, waiting", callerString,
                    mCore->mQueue.size());
        } else {
            if (mCore->mSharedBufferMode && mCore->mSharedBufferSlot !=
                    BufferQueueCore::INVALID_BUFFER_SLOT) {
                *found = mCore->mSharedBufferSlot;
            } else {
                if (caller == FreeSlotCaller::Dequeue) {
                    // 寻找已经绑定GraphicBuffer 但 State = FREE的 BufferSlot
                    int slot = getFreeBufferLocked();
                    if (slot != BufferQueueCore::INVALID_BUFFER_SLOT) {
                        *found = slot;
                    } else if (mCore->mAllowAllocation) {
                        *found = getFreeSlotLocked();
                    }
                } else
                    // 寻找尚未绑定GraphicBuffer 但 State = FREE 的BufferSlot
                    int slot = getFreeSlotLocked();
                    if (slot != BufferQueueCore::INVALID_BUFFER_SLOT) {
                        *found = slot;
                    } else {
                        *found = getFreeBufferLocked();
                    }
                }
            }
        }
  ...
}

edequeueBuffer主要做了以下几步：

通过waitForFreeSlotThenRelock寻找空闲的BufferSlot，需要判断当前是否与申请width、height、format一致，不一致则需要重新请求

waitForFreeSlotThenRelock主要实现了以下几步：
- getFreeBufferLocked：直接使用已经绑定的GraphicBuffer
- getFreeSlotLocked：需要新建一个GraphicBuffer与其绑定
把找到的BufferSlot的index放到mActiveSlots中
如果找到的BufferSlot中的GraphicBuffer为null，需要初始化BufferSlot
如果需要重新创建GraphicBuffer，并把新建的GraphicBuffer放在找到的BufferSlot中

尝试寻找一个BufferSlot，并且width,height,format都符合要求，如果没有绑定GraphicBuffer，就需要新建一个并且进行绑定，然后设置BufferSlot的BufferState为DEQUEUED，最后返回在mSlots的index回去。

SF-BufferQueue-dequeueBuffer

queueBuffer

在生产者填充数据到GraphicBuffer完毕后，通过queueBuffer把GraphicBuffer放回到BufferQueue。

标记BufferSlot的BufferState标记为QUEUED。

//native/libs/gui/BufferQueueProducer.cpp
status_t BufferQueueProducer::queueBuffer(int slot,
        const QueueBufferInput &input, QueueBufferOutput *output) {
  ...
    //消费者回调
    sp<IConsumerListener> frameAvailableListener;
    sp<IConsumerListener> frameReplacedListener;
    int callbackTicket = 0;
    uint64_t currentFrameNumber = 0;
  //需要插入mQueue的 数据结构
    BufferItem item;
  ...
  {
    ...
        const sp<GraphicBuffer>& graphicBuffer(mSlots[slot].mGraphicBuffer);    
        mSlots[slot].mBufferState.queue();
       //构造BufferItem对象
        item.mAcquireCalled = mSlots[slot].mAcquireCalled;
        item.mGraphicBuffer = mSlots[slot].mGraphicBuffer;
        item.mCrop = crop;
        item.mTransform = transform &
                ~static_cast<uint32_t>(NATIVE_WINDOW_TRANSFORM_INVERSE_DISPLAY);
        item.mTransformToDisplayInverse =
                (transform & NATIVE_WINDOW_TRANSFORM_INVERSE_DISPLAY) != 0;
        item.mScalingMode = static_cast<uint32_t>(scalingMode);
        item.mTimestamp = requestedPresentTimestamp;
        item.mIsAutoTimestamp = isAutoTimestamp;
        item.mDataSpace = dataSpace;
        item.mHdrMetadata = hdrMetadata;
        item.mFrameNumber = currentFrameNumber;
        item.mSlot = slot;
        item.mFence = acquireFence;
        item.mFenceTime = acquireFenceTime;
        item.mIsDroppable = mCore->mAsyncMode ||
                mCore->mDequeueBufferCannotBlock ||
                (mCore->mSharedBufferMode && mCore->mSharedBufferSlot == slot);
        item.mSurfaceDamage = surfaceDamage;
        item.mQueuedBuffer = true;
        item.mAutoRefresh = mCore->mSharedBufferMode && mCore->mAutoRefresh;
        item.mApi = mCore->mConnectedApi;    
    
        if (mCore->mQueue.empty()) {
          //添加BufferItem
            mCore->mQueue.push_back(item);
            frameAvailableListener = mCore->mConsumerListener;
        } else {
            const BufferItem& last = mCore->mQueue.itemAt(
                    mCore->mQueue.size() - 1);
            if (last.mIsDroppable) {
              //替换mQueue最后一位 为新的BufferItem
                mCore->mQueue.editItemAt(mCore->mQueue.size() - 1) = item;
                frameReplacedListener = mCore->mConsumerListener;
            } else {
              //添加 BufferItem
                mCore->mQueue.push_back(item);
                frameAvailableListener = mCore->mConsumerListener;
            }               
        }
    ...
      
        if (frameAvailableListener != NULL) {
          //回调 onFrameAvaliaable 通知消费者有新的数据入队
            frameAvailableListener->onFrameAvailable(item);
        } else if (frameReplacedListener != NULL) {
            frameReplacedListener->onFrameReplaced(item);
        }      
  }
}

queueBuffer主要执行了以下几步：

根据传入的slot从mSlots获取对应的BufferSlot，并设置对应的BufferState为QUEUED
根据获取的BufferSlot构造出BufferItem，并添加到mQueues中
最后回调到frameAvaliableListener.onFrameAvaliable()通知消费者有新数据入队，可以进行获取。

graph TD
A(queueBuffer)
B("获取mSlots[slot].mGraphicBuffer")
C("mSlots[slot].mBufferState.queue()")
A-->B
A--->C
D("设置BufferState状态为QUEUED")
D---C
E("组装BufferItem")
B-->E
F{"last<br>.mIsDroppable"}
E--->F
G("mQueue.push_back(item)")
H("mQueue.editItemAt(last)==item")
F-->|Y| H
F-->|N| G
J("frameAvailableListener->onFrameAvailable(item)")
H-->J
G-->J
I("通知消费者有数据入队，消费者可以获取数据")
K("最后一条数据是否有效？")
K---F
I---J

BufferQueueConsumer

SurfaceFlinger通过BufferQueueConsumer来获取以及释放GraphicBuffer

//native/libs/gui/BufferQueueConsumer.cpp
BufferQueueConsumer::BufferQueueConsumer(const sp<BufferQueueCore>& core) :
    mCore(core),
    mSlots(core->mSlots),
    mConsumerName() {}

BufferQueueConsumer只是设置了mCore和mSlots的两个参数。

acquireBuffer

消费者向BufferQueue申请已被填充数据的GraphicBuffer进行消费。

标记BufferSlot的BufferState标记为ACQUIRED。

//native/libs/gui/BufferQueueConsumer.cpp
status_t BufferQueueConsumer::acquireBuffer(BufferItem* outBuffer,
        nsecs_t expectedPresent, uint64_t maxFrameNumber) {
 ... 
      //生产者注册回调
       sp<IProducerListener> listener;
   //如果队列为空则返回空
        if (mCore->mQueue.empty() && !sharedBufferAvailable) {
            return NO_BUFFER_AVAILABLE;
        }
    //获取队列的第一条数据
        BufferQueueCore::Fifo::iterator front(mCore->mQueue.begin()); 
        if (sharedBufferAvailable && mCore->mQueue.empty()) {
            //共享Buffer模式
        } else {
            //从front获取对应的slot
            slot = front->mSlot;
            *outBuffer = *front;
        }
  ...
                if (!front->mIsStale) {
                    // Front buffer is still in mSlots, so mark the slot as free
                    mSlots[front->mSlot].mBufferState.freeQueued();
                  //存在已经被消费的BufferSlot
                    listener = mCore->mConnectedProducerListener;                  
                }
        if (!outBuffer->mIsStale) {
            mSlots[slot].mAcquireCalled = true;
            // Don't decrease the queue count if the BufferItem wasn't
            // previously in the queue. This happens in shared buffer mode when
            // the queue is empty and the BufferItem is created above.
            if (mCore->mQueue.empty()) {
                mSlots[slot].mBufferState.acquireNotInQueue();
            } else {
              //更新BufferState 为 ACQUIRED
                mSlots[slot].mBufferState.acquire();
            }
            mSlots[slot].mFence = Fence::NO_FENCE;
        }    
       //从队列中移除
        mCore->mQueue.erase(front);   
  
      if (listener != NULL) {
        for (int i = 0; i < numDroppedBuffers; ++i) {
          //回调生产者 有数据被消费
            listener->onBufferReleased();
        }
    }
}

acquireBuffer主要有以下几步：

从mQueue中获取第一个元素
改变第一个BufferSlot的BufferState为ACQUIRED
再将该BufferSlot从mQueue中移除
如果存在已被消费的数据则回调onBufferReleased

graph TB
A("acquireBuffer()")
C{"mQueue.empty()"}
A-->C
D("NO_BUFFER_AVALIABLE")
C--->|Y| D
E("front = <br>mCore->mQueue.begin()")
F("获取第一条BufferSlot")
F---E
C--->|N| E
G("mSlots[slot].mBufferState.acquire()")
H("slot = front->mSlot")
E-->H
H--->G
J("设置BufferSlot的BufferState状态为ACQUIRED")
J---G
K("mCore->mQueue.erase(front)")
L("从mQueue中移除front")
L---K
G-->K

releaseBuffer

消费者消费完毕后，通知BufferQueueCore已消费完毕，并返回空GraphicBuffer到BufferQueue

标记BufferSlot的BufferState标记为FREE。

//native/libs/gui/BufferQueueConsumer.cpp
status_t BufferQueueConsumer::releaseBuffer(int slot, uint64_t frameNumber,
        const sp<Fence>& releaseFence, EGLDisplay eglDisplay,
        EGLSyncKHR eglFence) {
  ...
    sp<IProducerListener> listener;
    { // Autolock scope
      ...
        mSlots[slot].mEglDisplay = eglDisplay;
        mSlots[slot].mEglFence = eglFence;
        mSlots[slot].mFence = releaseFence;
      //设置 BufferSlot状态为 FREE
        mSlots[slot].mBufferState.release();     
      ...
        if (!mSlots[slot].mBufferState.isShared()) {
            mCore->mActiveBuffers.erase(slot);
          //将BufferSlot放入 mFreeBuffers
            mCore->mFreeBuffers.push_back(slot);
        }

        listener = mCore->mConnectedProducerListener;        
    }
    if (listener != NULL) {
      //通知生产者有数据被消费
        listener->onBufferReleased();
    }  
}

releaseBuffer主要有以下几步：

将使用完的BufferSlot的BufferState转换为FREE
被消费完的BufferSlot的index放回到mFreeBuffers供后续的生产者继续获取
最后通知生产者有数据被消费，生产者可以准备生产数据。

graph TD
A("releaseBuffer()")
B("mSlots[slot].mBufferState.release()")
C("mFreeBuffers.push_back(slot)")
D("listener->onBufferReleased")

A--->B
B--->C
C--->D

E("设置BufferSlot状态为FREE")
F("存入mFreeBuffers待使用")
G("通知 生产者 数据被消费，可以准备生产数据")

E---B
F---C
G---D

总结

BufferSlot状态转变过程

GraphicBuffer的创建

GraphicBuffer是基本单元，所有的交互都是基于它进行的。

//native/libs/gui/BufferQueueProducer.cpp
status_t BufferQueueProducer::dequeueBuffer(int* outSlot, sp<android::Fence>* outFence,
                                            uint32_t width, uint32_t height, PixelFormat format,
                                            uint64_t usage, uint64_t* outBufferAge,
                                            FrameEventHistoryDelta* outTimestamps) {
  ...
        sp<GraphicBuffer> graphicBuffer = new GraphicBuffer(
                width, height, format, BQ_LAYER_COUNT, usage,
                {mConsumerName.string(), mConsumerName.size()});
  ...
  
}

主要在dequeueBuffer进行的创建过程。在生产者的使用场景下

//native/libs/ui/GraphicBuffer.cpp
GraphicBuffer::GraphicBuffer(uint32_t inWidth, uint32_t inHeight,
        PixelFormat inFormat, uint32_t inLayerCount, uint64_t usage, std::string requestorName)
    : GraphicBuffer()
{
    mInitCheck = initWithSize(inWidth, inHeight, inFormat, inLayerCount,
            usage, std::move(requestorName));
}

status_t GraphicBuffer::initWithSize(uint32_t inWidth, uint32_t inHeight,
        PixelFormat inFormat, uint32_t inLayerCount, uint64_t inUsage,
        std::string requestorName)
{
  //GraphicBuffer的内存分配器
    GraphicBufferAllocator& allocator = GraphicBufferAllocator::get();
    uint32_t outStride = 0;
  //为GraphicBuffer分配内存
    status_t err = allocator.allocate(inWidth, inHeight, inFormat, inLayerCount,
            inUsage, &handle, &outStride, mId,
            std::move(requestorName));
    if (err == NO_ERROR) {
        mBufferMapper.getTransportSize(handle, &mTransportNumFds, &mTransportNumInts);

        width = static_cast<int>(inWidth);
        height = static_cast<int>(inHeight);
        format = inFormat;
        layerCount = inLayerCount;
        usage = inUsage;
        usage_deprecated = int(usage);
        stride = static_cast<int>(outStride);
    }
    return err;
}

GraphicBuffer创建过程主要执行了以下几步：

获取GraphicBufferAllocator，这个是GraphicBuffer的内存分配器
再调用allocate()进行内存分配

其中GraphicBufferAllocator的实现如下：

//native/libs/ui/GraphicBufferAllocator.cpp
GraphicBufferAllocator::GraphicBufferAllocator()
  : mMapper(GraphicBufferMapper::getInstance()),
    mAllocator(std::make_unique<Gralloc2::Allocator>(
                mMapper.getGrallocMapper()))
{
}

status_t GraphicBufferAllocator::allocate(uint32_t width, uint32_t height,
        PixelFormat format, uint32_t layerCount, uint64_t usage,
        buffer_handle_t* handle, uint32_t* stride,
        uint64_t /*graphicBufferId*/, std::string requestorName)
{
    ATRACE_CALL();

    // make sure to not allocate a N x 0 or 0 x N buffer, since this is
    // allowed from an API stand-point allocate a 1x1 buffer instead.
    if (!width || !height)
        width = height = 1;

    // Ensure that layerCount is valid.
    if (layerCount < 1)
        layerCount = 1;

    Gralloc2::IMapper::BufferDescriptorInfo info = {};
    info.width = width;
    info.height = height;
    info.layerCount = layerCount;
    info.format = static_cast<Gralloc2::PixelFormat>(format);
    info.usage = usage;

    Gralloc2::Error error = mAllocator->allocate(info, stride, handle);
    if (error == Gralloc2::Error::NONE) {
        Mutex::Autolock _l(sLock);
        KeyedVector<buffer_handle_t, alloc_rec_t>& list(sAllocList);
        uint32_t bpp = bytesPerPixel(format);
        alloc_rec_t rec;
        rec.width = width;
        rec.height = height;
        rec.stride = *stride;
        rec.format = format;
        rec.layerCount = layerCount;
        rec.usage = usage;
        rec.size = static_cast<size_t>(height * (*stride) * bpp);
        rec.requestorName = std::move(requestorName);
        list.add(*handle, rec);

        return NO_ERROR;
    } else {
        ALOGE("Failed to allocate (%u x %u) layerCount %u format %d "
                "usage %" PRIx64 ": %d",
                width, height, layerCount, format, usage,
                error);
        return NO_MEMORY;
    }
}

//TODO 对GraphicBufferAllocator进行分析

图形缓冲区在`图像生产者`的使用

Android中的图像生产者如Skia、OpenGL、Vulkan。负责将绘制的数据放在图形缓冲区中

Android中的图像绘制分为以下两种，主要区别在于是否开启硬件加速。

未开启就是软件绘制，若开启就执行硬件绘制流程。

软件绘制

软件绘制的入口函数位于ViewRootImpl

//ViewRootImpl.java
    private boolean drawSoftware(Surface surface, AttachInfo attachInfo, int xoff, int yoff,
            boolean scalingRequired, Rect dirty, Rect surfaceInsets) {
        final Canvas canvas;
           //从surface获取Canvas
            canvas = mSurface.lockCanvas(dirty);
           //在canvas上进行绘制
            mView.draw(canvas);
           //将绘制内容提交给SF进行合成
            surface.unlockCanvasAndPost(canvas);      
      
    }

drawSoftware()主要分为以下几步：

graph LR
classDef someclass fill:#f96;
A("drawSoftware()<br>软件绘制")
B("lockCanvas()<br>获取Canvas")
C("draw(canvas)<br>在Canvas进行绘制")
D("unlockCanvasAndPost()<br>提交绘制完成的GraphicBuffer<br>到SurfaceFlinger进行合成")
A-->B:::someclass
A-->C
A-->D:::someclass

lockCanvas

获取Canvas

//Surface.java
    public Canvas lockCanvas(Rect inOutDirty)
            throws Surface.OutOfResourcesException, IllegalArgumentException {
        synchronized (mLock) {
            checkNotReleasedLocked();
            if (mLockedObject != 0) {
                throw new IllegalArgumentException("Surface was already locked");
            }
            mLockedObject = nativeLockCanvas(mNativeObject, mCanvas, inOutDirty);
            return mCanvas;
        }
    }

//base/core/jni/android_view_Surface.cpp
static jlong nativeLockCanvas(JNIEnv* env, jclass clazz,
        jlong nativeObject, jobject canvasObj, jobject dirtyRectObj) {
    sp<Surface> surface(reinterpret_cast<Surface *>(nativeObject));
  ...
    Rect dirtyRect(Rect::EMPTY_RECT);
    Rect* dirtyRectPtr = NULL;

    if (dirtyRectObj) {
        dirtyRect.left   = env->GetIntField(dirtyRectObj, gRectClassInfo.left);
        dirtyRect.top    = env->GetIntField(dirtyRectObj, gRectClassInfo.top);
        dirtyRect.right  = env->GetIntField(dirtyRectObj, gRectClassInfo.right);
        dirtyRect.bottom = env->GetIntField(dirtyRectObj, gRectClassInfo.bottom);
        dirtyRectPtr = &dirtyRect;
    }

    ANativeWindow_Buffer outBuffer;
  //获取绘制图形的GraphicBuffer
    status_t err = surface->lock(&outBuffer, dirtyRectPtr);  
  ...
    SkImageInfo info = SkImageInfo::Make(outBuffer.width, outBuffer.height,
                                         convertPixelFormat(outBuffer.format),
                                         outBuffer.format == PIXEL_FORMAT_RGBX_8888
                                                 ? kOpaque_SkAlphaType : kPremul_SkAlphaType,
                                         GraphicsJNI::defaultColorSpace());

    SkBitmap bitmap;
    ssize_t bpr = outBuffer.stride * bytesPerPixel(outBuffer.format);
    bitmap.setInfo(info, bpr);
    if (outBuffer.width > 0 && outBuffer.height > 0) {
        bitmap.setPixels(outBuffer.bits);
    } else {
        // be safe with an empty bitmap.
        bitmap.setPixels(NULL);
    }
   //新建Canvas对象
    Canvas* nativeCanvas = GraphicsJNI::getNativeCanvas(env, canvasObj);
    nativeCanvas->setBitmap(bitmap);    
  
    sp<Surface> lockedSurface(surface);
    lockedSurface->incStrong(&sRefBaseOwner);
   //返回最后的Canvas对象
    return (jlong) lockedSurface.get();
}

主要通过surface#lock获取GraphicBuffer

//native/libs/gui/Surface.cpp
status_t Surface::lock(
        ANativeWindow_Buffer* outBuffer, ARect* inOutDirtyBounds)
{
  ...
    status_t err = dequeueBuffer(&out, &fenceFd);
  ...
  
}

最后通过dequeueBuffer获取GraphicBuffer

//native/libs/gui/Surface.cpp
int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) {
  ...
    //申请一块GraphicBuffer
    status_t result = mGraphicBufferProducer->dequeueBuffer(&buf, &fence, reqWidth, reqHeight,
                                                            reqFormat, reqUsage, &mBufferAge,
                                                            enableFrameTimestamps ? &frameTimestamps
                                                                                  : nullptr);    
  ...
    if ((result & IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION) || gbuf == nullptr) {
        if (mReportRemovedBuffers && (gbuf != nullptr)) {
            mRemovedBuffers.push_back(gbuf);
        }
      //映射 GraphicBuffer
        result = mGraphicBufferProducer->requestBuffer(buf, &gbuf);
        if (result != NO_ERROR) {
            ALOGE("dequeueBuffer: IGraphicBufferProducer::requestBuffer failed: %d", result);
            mGraphicBufferProducer->cancelBuffer(buf, fence);
            return result;
        }
    }    
  
}

主要执行了以下两步：

dequeueBuffer：申请GraphicBuffer
requestBuffer：使用GraphicBuffer

其中requestBuffer通过共享内存方式获取GraphicBuffer数据

graph TB

 E("nativeLockCanvas()")
 F("Surface->lock()")
 G("Surface::dequeueBuffer()<br>获取待绘制的GraphicBuffer")
 H("mGraphicProducer<br>.requestBuffer()<br>使用GraphicBuffer")
 E-->F
 F-->G
 G-->J
 J-->H
J("mGraphicProducer<br>.dequeueBuffer()")

draw(Canvas)

在Canvas上绘制图形

unlockCanvasAndPost()

提交绘制完成的GraphicBuffer到SurfaceFlinger进行合成

//Surface.java
    public void unlockCanvasAndPost(Canvas canvas) {
        synchronized (mLock) {
            checkNotReleasedLocked();

            if (mHwuiContext != null) {
                mHwuiContext.unlockAndPost(canvas);
            } else {
              //软件绘制提交
                unlockSwCanvasAndPost(canvas);
            }
        }
    }

    private void unlockSwCanvasAndPost(Canvas canvas) {
        try {
            nativeUnlockCanvasAndPost(mLockedObject, canvas);
        } finally {
            nativeRelease(mLockedObject);
            mLockedObject = 0;
        }
    }

//base/core/jni/android_view_Surface.cpp
static void nativeUnlockCanvasAndPost(JNIEnv* env, jclass clazz,
        jlong nativeObject, jobject canvasObj) {
    sp<Surface> surface(reinterpret_cast<Surface *>(nativeObject));
    if (!isSurfaceValid(surface)) {
        return;
    }

    // detach the canvas from the surface
    Canvas* nativeCanvas = GraphicsJNI::getNativeCanvas(env, canvasObj);
    nativeCanvas->setBitmap(SkBitmap());

    // unlock surface
    status_t err = surface->unlockAndPost();
    if (err < 0) {
        doThrowIAE(env);
    }
}

继续通过Surface#unlockAndPost()执行提交过程

//native/libs/gui/Surface.cpp
status_t Surface::unlockAndPost()
{
    if (mLockedBuffer == 0) {
        ALOGE("Surface::unlockAndPost failed, no locked buffer");
        return INVALID_OPERATION;
    }

    int fd = -1;
    status_t err = mLockedBuffer->unlockAsync(&fd);

    err = queueBuffer(mLockedBuffer.get(), fd);
    return err;
}

int Surface::queueBuffer(android_native_buffer_t* buffer, int fenceFd) {
  ...
    //根据传入的GraphicBufer 获取对应的 BufferSlot位置
    int i = getSlotFromBufferLocked(buffer);
  ...
    //把获取到的数据 放回到BufferQueue中
    status_t err = mGraphicerProducer->queueBuffer(i, input, &output);    
  ...
}

最后通过queueBuffer提交GraphicBuffer。

graph TB
A("unlockCanvasAndPost()")
B("unlockSwCanvasAndPost()")
C("Surface::unlockAndPost")
A-->B
B--"nativeUnlockCanvasAndPost()"-->C
D("Surface::queueBuffer")
C-->D
E("i = <br>getSlotFromBufferLocked()")
G("根据传入的Buffer获取对应mSlots中的index")
G---E
D--->E
F("mGraphicProducer<br>.queueBuffer(i)")
H("通过queueBuffer放回数据")
E-->F
H---F

硬件绘制

具体执行流程可以参考Android硬件加速

//base/libs/hwui/renderthread/CanvasContext.cpp
void CanvasContext::draw() {
  ...
    //获取GraphicBuffer
    Frame frame = mRenderPipeline->getFrame();
  ...
    //绘制图形到 GraphicBuffer上
    bool drew = mRenderPipeline->draw(frame, windowDirty, dirty, mLightGeometry, &mLayerUpdateQueue,
                                      mContentDrawBounds, mOpaque, mWideColorGamut, mLightInfo,
                                      mRenderNodes, &(profiler()));    
  ...
    //提交绘制完成的GraphicBuffer到 SurfaceFlinger进行合成
    bool requireSwap = false;
    bool didSwap =
            mRenderPipeline->swapBuffers(frame, drew, windowDirty, mCurrentFrameInfo, &requireSwap);    
  
}

OpenGLPipeline#getFrame

从BufferQueue获取GraphicBuffer准备绘制图形

//base/libs/hwui/renderthread/OpenGLPipeline.cpp
Frame OpenGLPipeline::getFrame() {
    return mEglManager.beginFrame(mEglSurface);
}

//base/libs/hwui/renderthread/EglManager.cpp
Frame EglManager::beginFrame(EGLSurface surface) {
    makeCurrent(surface);  
}

bool EglManager::makeCurrent(EGLSurface surface, EGLint* errOut) {
  ...
    if (!eglMakeCurrent(mEglDisplay, surface, surface, mEglContext)) {
        if (errOut) {
            *errOut = eglGetError();
        }
    }
    mCurrentSurface = surface; 
  ...
}

//native/opengl/libagl/egl.cpp
EGLBoolean eglMakeCurrent(  EGLDisplay dpy, EGLSurface draw,
                            EGLSurface read, EGLContext ctx)
{
  ...
    if (ctx == EGL_NO_CONTEXT) {
        // if we're detaching, we need the current context
        current_ctx = (EGLContext)getGlThreadSpecific();
    } else {
        egl_surface_t* d = (egl_surface_t*)draw;
        egl_surface_t* r = (egl_surface_t*)read;
    }  
  ...
            if (d) {
              //创建GraphicBuffer
                if (d->connect() == EGL_FALSE) {
                    return EGL_FALSE;
                }
                d->ctx = ctx;
                d->bindDrawSurface(gl);
            }
  ...
}

EGLBoolean egl_window_surface_v2_t::connect() 
{
      // dequeue a buffer
    int fenceFd = -1;
   //Surface是 ANativeWindow 的子类，实际调用的就是Surface#dequeueBuffer
    if (nativeWindow->dequeueBuffer(nativeWindow, &buffer,
            &fenceFd) != NO_ERROR) {
        return setError(EGL_BAD_ALLOC, EGL_FALSE);
    }
}

OpenGLPipeline#getFrame()最后通过Surface#dequeueBuffer()获取GraphicBuffer

OpenGLPipeline#draw

将图像绘制到获取的GraphicBuffer上

OpenGLPipeline#swapBuffers

//base/libs/hwui/renderthread/OpenGLPipeline.cpp
bool OpenGLPipeline::swapBuffers(const Frame& frame, bool drew, const SkRect& screenDirty,
                                 FrameInfo* currentFrameInfo, bool* requireSwap) {

  ...
    if (*requireSwap && (CC_UNLIKELY(!mEglManager.swapBuffers(frame, screenDirty)))) {
        return false;
    }

    return *requireSwap;
}

在向下执行到EglManager#swapBuffers()

//base/libs/hwui/renderthread/EglManager.cpp
bool EglManager::swapBuffers(const Frame& frame, const SkRect& screenDirty) {
    if (CC_UNLIKELY(Properties::waitForGpuCompletion)) {
        ATRACE_NAME("Finishing GPU work");
        fence();
    }

    EGLint rects[4];
    frame.map(screenDirty, rects);
    eglSwapBuffersWithDamageKHR(mEglDisplay, frame.mSurface, rects, screenDirty.isEmpty() ? 0 : 1);

    return false;
}

//native/opengl/libs/EGL/eglApi.cpp
EGLBoolean eglSwapBuffersWithDamageKHR(EGLDisplay dpy, EGLSurface draw,
        EGLint *rects, EGLint n_rects)
{
  ...
    if (n_rects == 0) {
        return s->cnx->egl.eglSwapBuffers(dp->disp.dpy, s->surface);
    }
  ...
    if (s->cnx->egl.eglSwapBuffersWithDamageKHR) {
      //调用自身
        return s->cnx->egl.eglSwapBuffersWithDamageKHR(dp->disp.dpy, s->surface,
                rects, n_rects);
    } else {
        return s->cnx->egl.eglSwapBuffers(dp->disp.dpy, s->surface);
    }  
 
}

//native/opengl/libagl/egl.cpp
EGLBoolean eglSwapBuffers(EGLDisplay dpy, EGLSurface draw)
{
    // post the surface
    d->swapBuffers();
   ...
    return EGL_TRUE;
}

EGLBoolean egl_window_surface_v2_t::swapBuffers()
{
  ...
    unlock(buffer);
    previousBuffer = buffer;
  //提交GraphicBuffer
    nativeWindow->queueBuffer(nativeWindow, buffer, -1);
    buffer = 0;
  ...
    //重新申请 GraphicBuffer
    if (nativeWindow->dequeueBuffer(nativeWindow, &buffer, &fenceFd) == NO_ERROR) {
        sp<Fence> fence(new Fence(fenceFd));
      ...
    }
}

swapBuffers()主要执行以下两步：

Surface#queueBuffer：提交GraphicBuffer到BufferQueue中
Surface#dequeueBuffer：从BufferQueue中获取空闲的BufferQueue并获取其中的GraphicBuffer进行图像绘制

//TODO 流程图

总结

图像缓冲区的使用场景主要有两种：软件绘制和硬件绘制。

主要执行以下几步：

dequeueBuffer获取GraphicBuffer
进行GraphicBuffer内存绑定操作
- 软件绘制：GBQ#requestBuffer
- 硬件绘制：egl#lock
在GraphicBuffer进行图像绘制
queueBuffer提交GraphicBuffer到BufferQueue中

图形缓冲区在`图像消费者`的使用

图像消费者主要就是SurfaceFlinger

主要执行流程参考Vsync信号相关

收到Vsync信号会回调到SurfaceFlinger中

//native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::onMessageReceived(int32_t what) {
    switch (what) {
        case MessageQueue::INVALIDATE: {
          //判断是否有丢帧
            bool frameMissed = !mHadClientComposition &&
                    mPreviousPresentFence != Fence::NO_FENCE &&
                    (mPreviousPresentFence->getSignalTime() ==
                            Fence::SIGNAL_TIME_PENDING);
            if (frameMissed) {
                mTimeStats.incrementMissedFrames();
                if (mPropagateBackpressure) {
                  //需要执行 申请Vsync信号过程
                    signalLayerUpdate();
                    break;
                }
            }

          //需要重新刷新
            bool refreshNeeded = handleMessageTransaction();
            refreshNeeded |= handleMessageInvalidate();
            refreshNeeded |= mRepaintEverything;
            if (refreshNeeded) {
              //执行刷新过程
                signalRefresh();
            }
            break;
        }
        case MessageQueue::REFRESH: {
            handleMessageRefresh();
            break;
        }
    }  
}

handleMessageRefresh流程在上面的处理Vsync已经介绍过，包括signalLayerUpdate()以及signalRefresh()都有相关的介绍。

在SurfaceFlinger与BufferQueue相关的操作都位于handleMessageInvalidate()中

SF#handleMessageInvalidate

bool SurfaceFlinger::handleMessageInvalidate() {
    return handlePageFlip();
}

bool SurfaceFlinger::handlePageFlip()
{
  ...
    for (auto& layer : mLayersWithQueuedFrames) {
        const Region dirty(layer->latchBuffer(visibleRegions, latchTime));
        layer->useSurfaceDamage();
        invalidateLayerStack(layer, dirty);
        if (layer->isBufferLatched()) {
            newDataLatched = true;
        }
    }
  ...
}

其中layer的实现为BufferLayer

//native/services/surfaceflinger/BufferLayer.cpp
Region BufferLayer::latchBuffer(bool& recomputeVisibleRegions, nsecs_t latchTime) {
  ...
    bool queuedBuffer = false;
    status_t updateResult =
            mConsumer->updateTexImage(&r, mFlinger->mPrimaryDispSync,
                                                    &mAutoRefresh, &queuedBuffer,
                                                    mLastFrameNumberReceived);  
  ...
}

mConsumer指的对象为BufferLayerConsumer

BufferLayerConsumer#updateTexImage

//native/services/surfaceflinger/BufferLayerConsumer.cpp
status_t BufferLayerConsumer::updateTexImage(BufferRejecter* rejecter, const DispSync& dispSync,
                                             bool* autoRefresh, bool* queuedBuffer,
                                             uint64_t maxFrameNumber) {
  ...
    BufferItem item;

    // Acquire the next buffer.
    // In asynchronous mode the list is guaranteed to be one buffer
    // deep, while in synchronous mode we use the oldest buffer.
    // 从BufferQueue获取已绘制完成的 GraphicBuffer
    status_t err = acquireBufferLocked(&item, computeExpectedPresent(dispSync), maxFrameNumber);
  
    // Release the previous buffer.
    //释放已经使用完成的 GraphicBuffer并返回到BufferQueue
    err = updateAndReleaseLocked(item, &mPendingRelease);
}

updateTexImage主要执行以下两步：

acquireBufferLocked

status_t BufferLayerConsumer::acquireBufferLocked(BufferItem* item, nsecs_t presentWhen,
                                                  uint64_t maxFrameNumber) {
    status_t err = ConsumerBase::acquireBufferLocked(item, presentWhen, maxFrameNumber);
    return NO_ERROR;
}

//native/libs/gui/ConsumerBase.cpp
status_t ConsumerBase::acquireBufferLocked(BufferItem *item,
        nsecs_t presentWhen, uint64_t maxFrameNumber) {
   
    status_t err = mConsumer->acquireBuffer(item, presentWhen, maxFrameNumber);

    if (item->mGraphicBuffer != NULL) {
        if (mSlots[item->mSlot].mGraphicBuffer != NULL) {
            freeBufferLocked(item->mSlot);
        }
        mSlots[item->mSlot].mGraphicBuffer = item->mGraphicBuffer;
    }

    mSlots[item->mSlot].mFrameNumber = item->mFrameNumber;
    mSlots[item->mSlot].mFence = item->mFence;

    return OK;
}

最后是通过acquireBuffer从BufferQueue获取已绘制完成的GraphicBuffer

updateAndReleaseLocked

status_t BufferLayerConsumer::updateAndReleaseLocked(const BufferItem& item,
                                                     PendingRelease* pendingRelease) {
  ...
    if (mCurrentTexture != BufferQueue::INVALID_BUFFER_SLOT) {
        if (pendingRelease == nullptr) {
            status_t status =
                    releaseBufferLocked(mCurrentTexture, mCurrentTextureImage->graphicBuffer());
        }
    }
  ...
}

//native/libs/gui/ConsumerBase.cpp
status_t ConsumerBase::releaseBufferLocked(
        int slot, const sp<GraphicBuffer> graphicBuffer,
        EGLDisplay display, EGLSyncKHR eglFence) {
  ...
    status_t err = mConsumer->releaseBuffer(slot, mSlots[slot].mFrameNumber,
            display, eglFence, mSlots[slot].mFence);
    if (err == IGraphicBufferConsumer::STALE_BUFFER_SLOT) {
      //重置BufferSlot数据
        freeBufferLocked(slot);
    }
  ...
}

最后是通过releaseBuffer()把使用完成的GraphicBuffer返回到BufferQueue中

参考链接

SurfaceFlinger 解读

掌握Android图像显示原理-上

#Android

Android-SurfaceFlinger解析

https://leo-wxy.github.io/2020/12/21/Android-SurfaceFlinger解析/

作者

Leo-Wxy

发布于

2020年12月21日

许可协议

Ubuntu18.04 双系统安装笔记上一篇

Android性能优化-自动内存分析下一篇

Android-SurfaceFlinger解析

SurfaceFlinger初始化

new SurfaceFlinger

SurfaceFlinger#init

创建HWComposer

初始化显示设备

运行EventThread线程

DispSyncSource

EventThread

MessaqeQueue#setEventThread

EventThread#createEventConnection

Connection#getDataChannel

Looper#addFd

总结

SurfaceFlinger#run

Vsync信号相关

接收Vsync

HWC#hook_vsync

Sf#onVSyncReceived

DispSync#addResyncSample

DispSyncThread#threadLoop

DispsyncThread#updateModel

Sf.DispSyncSource#onDispSyncEvent

EventThread#onVsyncEvent

ET.Connection#postEvent

MessageQueue#cb_eventReceiver

Sf#onMessageReceived

总结

处理Vsync

Sf#handleMessageRefresh

preComposition-合成前预处理

signalLayerUpdate

rebuildLayerStacks-重建Layer

setUpHWComposer-构造硬件合成的任务

doComposition-执行合成任务

doDisplayComposition

postFrameBuffer

postComposition-合成图形结束后的处理

总结

Android图形缓冲区

Surface相关

Layer相关

GraphicBuffer

BufferQueue

缓冲区创建流程

Activity创建图形缓冲区

WS#addToDisplay

WS#relayoutWindow

WMS#createSurfaceControl

WMS#createSurfaceLocked

SurfaceControl#getSurface

总结

Surface、Layer的创建

创建SurfaceComponentClient

ComposerService

SurfaceFlinger#createConnection

创建SurfaceControl并创建Layer

Client#createSurface

new SurfaceControl

通过SurfaceControl创建Surface

BufferQueue的创建

BufferQueueCore

BufferQueueProducer

dequeueBuffer

queueBuffer

BufferQueueConsumer

acquireBuffer

releaseBuffer

总结

GraphicBuffer的创建

图形缓冲区在图像生产者的使用

软件绘制

lockCanvas

draw(Canvas)

unlockCanvasAndPost()

硬件绘制

OpenGLPipeline#getFrame

OpenGLPipeline#draw

OpenGLPipeline#swapBuffers

总结

图形缓冲区在`图像生产者`的使用

图形缓冲区在`图像消费者`的使用