SurfaceControl及SurfaceFlinger中的Layer创建过程深入剖析

SurfaceComposerClient创建

SurfaceComposerClient对象是在哪里创建的呢?是在SurfaceSession构造时候创建
frameworks/base/core/jni/android_view_SurfaceSession.cpp

static jlong nativeCreate(JNIEnv* env, jclass clazz) {
    SurfaceComposerClient* client = new SurfaceComposerClient();
    client->incStrong((void*)nativeCreate);
    return reinterpret_cast<jlong>(client);
}

这里的SurfaceSession是在哪里创建的呢？这里直接上堆栈

实际是在ViewRootImpl构造期间就创建
这个是纯app ViewRootImpl角度构造情况，但是更多其实是在WMS中会创建对应SurfaceSession

12-20 15:34:27.090   573  1477 I lsm888888: new SurfaceSession android.view.SurfaceSession@2284788
12-20 15:34:27.090   573  1477 I lsm888888: java.lang.Exception
12-20 15:34:27.090   573  1477 I lsm888888: 	at android.view.SurfaceSession.<init>(SurfaceSession.java:40)
12-20 15:34:27.090   573  1477 I lsm888888: 	at com.android.server.wm.Session.onWindowAdded(Session.java:773)
12-20 15:34:27.090   573  1477 I lsm888888: 	at com.android.server.wm.WindowManagerService.addWindow(WindowManagerService.java:1821)
12-20 15:34:27.090   573  1477 I lsm888888: 	at com.android.server.wm.Session.addToDisplayAsUser(Session.java:257)
12-20 15:34:27.090   573  1477 I lsm888888: 	at android.view.IWindowSession$Stub.onTransact(IWindowSession.java:640)
12-20 15:34:27.090   573  1477 I lsm888888: 	at com.android.server.wm.Session.onTransact(Session.java:206)
12-20 15:34:27.090   573  1477 I lsm888888: 	at android.os.Binder.execTransactInternal(Binder.java:1500)
12-20 15:34:27.090   573  1477 I lsm888888: 	at android.os.Binder.execTransact(Binder.java:1444)

可以看出在addWindow后会调用Session.onWindowAdded让创建SurfaceSession，后续用这个SurfaceSession创建对应的SurfaceControl图层

SurfaceComposerClient的mClient初始化

这里的mClient是谁呢？类型是
sp mClient;
看得出是一个接口

看下SurfaceComposerClient构造时候会与sf进行跨进程createConnection创建链接，返回的对象就是Client对象。

void SurfaceComposerClient::onFirstRef() {
    sp<ISurfaceComposer> sf(ComposerService::getComposerService());
    if (sf != nullptr && mStatus == NO_INIT) {
        sp<ISurfaceComposerClient> conn;
        conn = sf->createConnection();
        if (conn != nullptr) {
            mClient = conn;
            mStatus = NO_ERROR;
        }
    }
}

这里又出现了ComposerService::getComposerService()
frameworks/native/libs/gui/SurfaceComposerClient.cpp

sp<ISurfaceComposer> ComposerService::getComposerService() {
    ComposerService& instance = ComposerService::getInstance();
    if (instance.mComposerService == nullptr) {
        if (ComposerService::getInstance().connectLocked()) {
            WindowInfosListenerReporter::getInstance()->reconnect(instance.mComposerService);
        }
    }
    return instance.mComposerService;
}
//connectLocked实现
bool ComposerService::connectLocked() {
    const String16 name("SurfaceFlinger");
    //就是获取sf的bp代理，赋值给mComposerService
    mComposerService = waitForService<ISurfaceComposer>(name);
    return true;
}

所以上面onFirstRef中sf->createConnection()调用到sf了，sf代码如下
frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

sp<ISurfaceComposerClient> SurfaceFlinger::createConnection() {
    const sp<Client> client = new Client(this);
    return client->initCheck() == NO_ERROR ? client : nullptr;
}

sf端就是简单创建了一个Client对象，这里来看看
其实Client本质是一个Binder对象的BpBinder即跨进程的代理，远端的BnBinder在SurfaceFlinger的Client.cpp
思考为啥有了sf代理，还需要Client：
哈哈，其实这里主要是为了帮助sf进行解耦一部分工作

SurfaceControl，Layer创建

frameworks/base/core/jni/android_view_SurfaceControl.cpp

static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
        jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
        jobject metadataParcel) {
    sp<SurfaceComposerClient> client;
  
    status_t err = client->createSurfaceChecked(String8(name.c_str()), w, h, format, &surface,
                                                flags, parentHandle, std::move(metadata));
  
    surface->incStrong((void *)nativeCreate);
    return reinterpret_cast<jlong>(surface.get());
}

主要调用到了SurfaceComposerClient的createSurfaceChecked。

下面看看 SurfaceComposerClient::createSurfaceChecked方法

status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, uint32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
 
        err = mClient->createSurface(name, w, h, format, flags, parentHandle, std::move(metadata),
                                     &handle, &gbp, &id, &transformHint);
    } 
        if (err == NO_ERROR) {
            *outSurface =
                    new SurfaceControl(this, handle, gbp, id, w, h, format, transformHint, flags);
        }
    return err;
}

最后会调用到Client的createSurface
frameworks/native/services/surfaceflinger/Client.cpp

status_t Client::createSurface(const String8& name, uint32_t /* w */, uint32_t /* h */,
                               PixelFormat /* format */, uint32_t flags,
                               const sp<IBinder>& parentHandle, LayerMetadata metadata,
                               sp<IBinder>* outHandle, sp<IGraphicBufferProducer>* /* gbp */,
                               int32_t* outLayerId, uint32_t* outTransformHint) {
    // We rely on createLayer to check permissions.
    LayerCreationArgs args(mFlinger.get(), this, name.c_str(), flags, std::move(metadata));
    return mFlinger->createLayer(args, outHandle, parentHandle, outLayerId, nullptr,
                                 outTransformHint);
}

接下来就是跨进程到了Sf端

status_t SurfaceFlinger::createLayer(LayerCreationArgs& args, sp<IBinder>* outHandle,
                                     const sp<IBinder>& parentHandle, int32_t* outLayerId,
                                     const sp<Layer>& parentLayer, uint32_t* outTransformHint) {
  
    sp<Layer> layer;
	//根据不同的flags创建不同的Layer，常见情况：有buffer数据的一般是createBufferStateLayer，没有buffer的就是createContainerLayer
    switch (args.flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceBufferQueue:
        case ISurfaceComposerClient::eFXSurfaceBufferState: {
            result = createBufferStateLayer(args, outHandle, &layer);
            std::atomic<int32_t>* pendingBufferCounter = layer->getPendingBufferCounter();
            if (pendingBufferCounter) {
                std::string counterName = layer->getPendingBufferCounterName();
                mBufferCountTracker.add((*outHandle)->localBinder(), counterName,
                                        pendingBufferCounter);
            }
        } break;
        case ISurfaceComposerClient::eFXSurfaceEffect:
            result = createEffectLayer(args, outHandle, &layer);
            break;
        case ISurfaceComposerClient::eFXSurfaceContainer:
            result = createContainerLayer(args, outHandle, &layer);
            break;
        default:
            result = BAD_VALUE;
            break;
    }
    int parentId = -1;
    sp<Layer> parentSp = parent.promote();
    if (parentSp != nullptr) {
        parentId = parentSp->getSequence();
    }
    //调用到addClientLayer方法
    result = addClientLayer(args.client, *outHandle, layer, parent, addToRoot, outTransformHint);
    if (result != NO_ERROR) {
        return result;
    }

    *outLayerId = layer->sequence;
    return result;
}

status_t SurfaceFlinger::addClientLayer(const sp<Client>& client, const sp<IBinder>& handle,
                                        const sp<Layer>& layer, const wp<Layer>& parent,
                                        bool addToRoot, uint32_t* outTransformHint) {


    {
     //放入到mCreatedLayers集合中
        std::scoped_lock<std::mutex> lock(mCreatedLayersLock);
        mCreatedLayers.emplace_back(layer, parent, addToRoot);
    }

    if (client != nullptr) {
    /client与layer会进行绑定
        client->attachLayer(handle, layer);
    }
//设置事物flag
    setTransactionFlags(eTransactionNeeded);
    return NO_ERROR;
}

简单总结图：

更多framework干货请关注“千里马学框架”