一、Android系统启动
Android设备从按下开机键到桌面显示画面，大致过程如下图流程：
开机显示桌面、从桌面点击 App 图标到 Activity显示在屏幕上的过程又是怎样的呢？下面介绍Android系统中的“画家” - SurfaceFlinger.
SurfaceFlinger 启动过程：
二、SurfaceFlinger代码剖析[Android 8.0]
代码路径：/frameworks/native/services/surfaceflinger/
SurfaceFlinger二进制分成surfaceflinger可执行文件（main入口）和libsurfaceflinger.so库文件（功能实现），由main_surfaceflinger.cpp文件编译而成，Android.mk代码模块编译配置如下：
1.【执行文件-surfaceflinger】
############################################################### # build surfaceflinger's executable include $(CLEAR_VARS) LOCAL_CLANG := true LOCAL_LDFLAGS_32 := -Wl,--version-script,art/sigchainlib/version-script32.txt -Wl,--export-dynamic LOCAL_LDFLAGS_64 := -Wl,--version-script,art/sigchainlib/version-script64.txt -Wl,--export-dynamic LOCAL_CFLAGS := -DLOG_TAG=\"SurfaceFlinger\" LOCAL_INIT_RC := surfaceflinger.rc ifeq ($(TARGET_USES_HWC2),true) LOCAL_CFLAGS += -DUSE_HWC2 endif LOCAL_SRC_FILES := \ main_surfaceflinger.cpp LOCAL_SHARED_LIBRARIES := \ android.frameworks.displayservice@1.0 \ android.hardware.configstore@1.0 \ android.hardware.configstore-utils \ android.hardware.graphics.allocator@2.0 \ libsurfaceflinger \ libcutils \ libdisplayservicehidl \ liblog \ libbinder \ libhidlbase \ libhidltransport \ libutils \ libui \ libgui \ libdl LOCAL_WHOLE_STATIC_LIBRARIES := libsigchain LOCAL_STATIC_LIBRARIES := libtrace_proto LOCAL_MODULE := surfaceflinger ifdef TARGET_32_BIT_SURFACEFLINGER LOCAL_32_BIT_ONLY := true endif LOCAL_CFLAGS += -Wall -Werror -Wunused -Wunreachable-code include $(BUILD_EXECUTABLE)
SurfaceFlinger可执行二进制文件surfaceflinger由main_surfaceflinger.cpp文件独立编译而成，主要负责搭建进程启动环境：
int main(int, char**) { // 从8.0开始，Android提供了hidl机制，将原先直接由JNI->Native->HAL的接口调用形式，统一规范成hidl service/client交互形式。
// 该方式从一方面规范和统一了Android Framework和HAL的调用机制，但实际上，从项目维度，这种调用方式对性能上开销，将比直接调用的方式要花费更多的时间。 startHidlServices(); signal(SIGPIPE, SIG_IGN); // When SF is launched in its own process, limit the number of // binder threads to 4. ProcessState::self()->setThreadPoolMaxThreadCount(4); // start the thread pool sp<ProcessState> ps(ProcessState::self()); ps->startThreadPool(); // 初始化SurfaceFlinger对象，由强指针指向。SurfaceFlinger继承RefBase类，所以此处一旦new出对象赋给sp指针后，将立刻出发SurfaceFlinger类的onFirstRef方法的调用。 // instantiate surfaceflinger sp<SurfaceFlinger> flinger = new SurfaceFlinger(); setpriority(PRIO_PROCESS, 0, PRIORITY_URGENT_DISPLAY); set_sched_policy(0, SP_FOREGROUND); // Put most SurfaceFlinger threads in the system-background cpuset // Keeps us from unnecessarily using big cores // Do this after the binder thread pool init if (cpusets_enabled()) set_cpuset_policy(0, SP_SYSTEM); // SurfaceFlinger类正式初始化 // initialize before clients can connect flinger->init(); // SurfaceFlinger向ServiceManager注册Binder服务，这样在其他进程中，可以通过getService+SERVICE_NAME来获取SurfaceFlinger服务，继而可以和SurfaceFlinger类进行Binder通信。 // publish surface flinger sp<IServiceManager> sm(defaultServiceManager()); sm->addService(String16(SurfaceFlinger::getServiceName()), flinger, false); // publish GpuService sp<GpuService> gpuservice = new GpuService(); sm->addService(String16(GpuService::SERVICE_NAME), gpuservice, false); struct sched_param param = {0}; param.sched_priority = 2; if (sched_setscheduler(0, SCHED_FIFO, ¶m) != 0) { ALOGE("Couldn't set SCHED_FIFO"); } // SurfaceFlinger类进入主循环（此处注意SurfaceFlinger类未继承Threads类，不遵循Threads类的接口执行顺序） // run surface flinger in this thread flinger->run(); return 0; }
startHidlServices();内容如下
static status_t startHidlServices() { using android::frameworks::displayservice::V1_0::implementation::DisplayService; using android::frameworks::displayservice::V1_0::IDisplayService; using android::hardware::configstore::getBool; using android::hardware::configstore::getBool; using android::hardware::configstore::V1_0::ISurfaceFlingerConfigs; hardware::configureRpcThreadpool(1 /* maxThreads */, false /* callerWillJoin */); status_t err; if (getBool<ISurfaceFlingerConfigs, &ISurfaceFlingerConfigs::startGraphicsAllocatorService>(false)) { err = startGraphicsAllocatorService(); if (err != OK) { return err; } } sp<IDisplayService> displayservice = new DisplayService(); //里面调用HIDL定义接口 Return<sp<IDisplayEventReceiver >> getEventReceiver() override; err = displayservice->registerAsService(); if (err != OK) { ALOGE("Could not register IDisplayService service."); } return err; }
HIDL接口介绍可以参考：https://source.android.google.cn/reference/hidl/
2.【动态库-libsurfaceflinger.so】
LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)
LOCAL_CLANG := true
LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
LOCAL_SRC_FILES := \
Client.cpp \
DisplayDevice.cpp \
DispSync.cpp \
EventControlThread.cpp \
StartBootAnimThread.cpp \
EventThread.cpp \
FrameTracker.cpp \
GpuService.cpp \
Layer.cpp \
LayerDim.cpp \
LayerRejecter.cpp \
LayerVector.cpp \
MessageQueue.cpp \
MonitoredProducer.cpp \
SurfaceFlingerConsumer.cpp \
SurfaceInterceptor.cpp \
Transform.cpp \
DisplayHardware/ComposerHal.cpp \ DisplayHardware/FramebufferSurface.cpp \ DisplayHardware/HWC2.cpp \ DisplayHardware/HWComposerBufferCache.cpp \ DisplayHardware/PowerHAL.cpp \ DisplayHardware/VirtualDisplaySurface.cpp \ Effects/Daltonizer.cpp \ EventLog/EventLogTags.logtags \ EventLog/EventLog.cpp \ RenderEngine/Description.cpp \ RenderEngine/Mesh.cpp \ RenderEngine/Program.cpp \ RenderEngine/ProgramCache.cpp \ RenderEngine/GLExtensions.cpp \ RenderEngine/RenderEngine.cpp \ RenderEngine/Texture.cpp \ RenderEngine/GLES20RenderEngine.cpp \ LOCAL_MODULE := libsurfaceflinger LOCAL_C_INCLUDES := \ frameworks/native/vulkan/include \ external/vulkan-validation-layers/libs/vkjson \ system/libhwbinder/fast_msgq/include \ LOCAL_CFLAGS := -DLOG_TAG=\"SurfaceFlinger\" LOCAL_CFLAGS += -DGL_GLEXT_PROTOTYPES -DEGL_EGLEXT_PROTOTYPES ifeq ($(TARGET_USES_HWC2),true) LOCAL_CFLAGS += -DUSE_HWC2 LOCAL_SRC_FILES += \ SurfaceFlinger.cpp \ DisplayHardware/HWComposer.cpp else LOCAL_SRC_FILES += \ SurfaceFlinger_hwc1.cpp \ DisplayHardware/HWComposer_hwc1.cpp endif LOCAL_CFLAGS += -fvisibility=hidden -Werror=format LOCAL_STATIC_LIBRARIES := \ libhwcomposer-command-buffer \ libtrace_proto \ libvkjson \ libvr_manager \ libvrflinger LOCAL_SHARED_LIBRARIES := \ android.frameworks.vr.composer@1.0 \ android.hardware.graphics.allocator@2.0 \ android.hardware.graphics.composer@2.1 \ android.hardware.configstore@1.0 \ android.hardware.configstore-utils \ libcutils \ liblog \ libdl \ libfmq \ libhardware \ libhidlbase \ libhidltransport \ libhwbinder \ libutils \ libEGL \ libGLESv1_CM \ libGLESv2 \ libbinder \ libui \ libgui \ libpowermanager \ libvulkan \ libsync \ libprotobuf-cpp-lite \ libbase \ android.hardware.power@1.0 LOCAL_EXPORT_SHARED_LIBRARY_HEADERS := \ android.hardware.graphics.allocator@2.0 \ android.hardware.graphics.composer@2.1 \ libhidlbase \ libhidltransport \ libhwbinder LOCAL_CFLAGS += -Wall -Werror -Wunused -Wunreachable-code include $(BUILD_SHARED_LIBRARY)
new SurfaceFlinger(); 会执行到：onFirstRef()
void SurfaceFlinger::onFirstRef() { mEventQueue.init(this); }
onFirstRef() 中会创建 Handler 并初始化:
//MessageQueue.cpp void MessageQueue::init(const sp<SurfaceFlinger>& flinger) { mFlinger = flinger; mLooper = new Looper(true); mHandler = new Handler(*this); }
然后会执行到 SurfaceFlinger::init()，该方法主要功能是：
- 初始化 EGL
- 创建 HWComposer
- 初始化非虚拟显示屏
- 启动 EventThread 线程
- 启动开机动画
void SurfaceFlinger::init() { ALOGI( "SurfaceFlinger's main thread ready to run. " "Initializing graphics H/W..."); Mutex::Autolock _l(mStateLock); // initialize EGL for the default display mEGLDisplay = eglGetDisplay(EGL_DEFAULT_DISPLAY); eglInitialize(mEGLDisplay, NULL, NULL); // start the EventThread sp<VSyncSource> vsyncSrc = new DispSyncSource(&mPrimaryDispSync, vsyncPhaseOffsetNs, true, "app"); mEventThread = new EventThread(vsyncSrc, *this, false); sp<VSyncSource> sfVsyncSrc = new DispSyncSource(&mPrimaryDispSync, sfVsyncPhaseOffsetNs, true, "sf"); mSFEventThread = new EventThread(sfVsyncSrc, *this, true); mEventQueue.setEventThread(mSFEventThread); // set EventThread and SFEventThread to SCHED_FIFO to minimize jitter struct sched_param param = {0}; param.sched_priority = 2; if (sched_setscheduler(mSFEventThread->getTid(), SCHED_FIFO, ¶m) != 0) { ALOGE("Couldn't set SCHED_FIFO for SFEventThread"); } if (sched_setscheduler(mEventThread->getTid(), SCHED_FIFO, ¶m) != 0) { ALOGE("Couldn't set SCHED_FIFO for EventThread"); } // Initialize the H/W composer object. There may or may not be an // actual hardware composer underneath. mHwc = new HWComposer(this, *static_cast<HWComposer::EventHandler *>(this)); // get a RenderEngine for the given display / config (can't fail) mRenderEngine = RenderEngine::create(mEGLDisplay, mHwc->getVisualID()); // retrieve the EGL context that was selected/created mEGLContext = mRenderEngine->getEGLContext(); LOG_ALWAYS_FATAL_IF(mEGLContext == EGL_NO_CONTEXT, "couldn't create EGLContext"); // Inform native graphics APIs that the present timestamp is NOT supported: property_set(kTimestampProperty, "0"); // initialize our non-virtual displays for (size_t i=0 ; i<DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES ; i++) { DisplayDevice::DisplayType type((DisplayDevice::DisplayType)i); // set-up the displays that are already connected if (mHwc->isConnected(i) || type==DisplayDevice::DISPLAY_PRIMARY) { // All non-virtual displays are currently considered secure. bool isSecure = true; createBuiltinDisplayLocked(type); wp<IBinder> token = mBuiltinDisplays[i]; sp<IGraphicBufferProducer> producer; sp<IGraphicBufferConsumer> consumer; BufferQueue::createBufferQueue(&producer, &consumer); sp<FramebufferSurface> fbs = new FramebufferSurface(*mHwc, i, consumer); int32_t hwcId = allocateHwcDisplayId(type); sp<DisplayDevice> hw = new DisplayDevice(this, type, hwcId, mHwc->getFormat(hwcId), isSecure, token, fbs, producer, mRenderEngine->getEGLConfig(), false); if (i > DisplayDevice::DISPLAY_PRIMARY) { // FIXME: currently we don't get blank/unblank requests // for displays other than the main display, so we always // assume a connected display is unblanked. ALOGD("marking display %zu as acquired/unblanked", i); hw->setPowerMode(HWC_POWER_MODE_NORMAL); } mDisplays.add(token, hw); } } // make the GLContext current so that we can create textures when creating Layers // (which may happens before we render something) getDefaultDisplayDeviceLocked()->makeCurrent(mEGLDisplay, mEGLContext); mEventControlThread = new EventControlThread(this); mEventControlThread->run("EventControl", PRIORITY_URGENT_DISPLAY); // set a fake vsync period if there is no HWComposer if (mHwc->initCheck() != NO_ERROR) { mPrimaryDispSync.setPeriod(16666667); } // initialize our drawing state mDrawingState = mCurrentState; // set initial conditions (e.g. unblank default device) initializeDisplays(); mRenderEngine->primeCache(); mStartBootAnimThread = new StartBootAnimThread(); if (mStartBootAnimThread->Start() != NO_ERROR) { ALOGE("Run StartBootAnimThread failed!"); } ALOGV("Done initializing"); }
创建 HWComposer：
HWComposer::HWComposer( const sp<SurfaceFlinger>& flinger, EventHandler& handler) : mFlinger(flinger), mFbDev(0), mHwc(0), mNumDisplays(1), mCBContext(new cb_context), mEventHandler(handler), mDebugForceFakeVSync(false) { for (size_t i =0 ; i<MAX_HWC_DISPLAYS ; i++) { mLists[i] = 0; } for (size_t i=0 ; i<HWC_NUM_PHYSICAL_DISPLAY_TYPES ; i++) { mLastHwVSync[i] = 0; mVSyncCounts[i] = 0; } char value[PROPERTY_VALUE_MAX]; property_get("debug.sf.no_hw_vsync", value, "0"); mDebugForceFakeVSync = atoi(value); bool needVSyncThread = true; // Note: some devices may insist that the FB HAL be opened before HWC. int fberr = loadFbHalModule(); //加载 framebuffer 的 HAL 层模块 loadHwcModule(); //加载 HWComposer 模块 if (mFbDev && mHwc && hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) { // close FB HAL if we don't needed it. // FIXME: this is temporary until we're not forced to open FB HAL // before HWC. framebuffer_close(mFbDev); mFbDev = NULL; } // If we have no HWC, or a pre-1.1 HWC, an FB dev is mandatory. if ((!mHwc || !hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) && !mFbDev) { ALOGE("ERROR: failed to open framebuffer (%s), aborting", strerror(-fberr)); abort(); } // these display IDs are always reserved for (size_t i=0 ; i<NUM_BUILTIN_DISPLAYS ; i++) { mAllocatedDisplayIDs.markBit(i); } if (mHwc) { ALOGI("Using %s version %u.%u", HWC_HARDWARE_COMPOSER, (hwcApiVersion(mHwc) >> 24) & 0xff, (hwcApiVersion(mHwc) >> 16) & 0xff); if (mHwc->registerProcs) { mCBContext->hwc = this; mCBContext->procs.invalidate = &hook_invalidate; // VSYNC 信号的回调方法 mCBContext->procs.vsync = &hook_vsync; if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) mCBContext->procs.hotplug = &hook_hotplug; else mCBContext->procs.hotplug = NULL; memset(mCBContext->procs.zero, 0, sizeof(mCBContext->procs.zero)); // 注册回调函数 mHwc->registerProcs(mHwc, &mCBContext->procs); } // don't need a vsync thread if we have a hardware composer needVSyncThread = false; // always turn vsync off when we start eventControl(HWC_DISPLAY_PRIMARY, HWC_EVENT_VSYNC, 0); // the number of displays we actually have depends on the // hw composer version if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_3)) { // 1.3 adds support for virtual displays mNumDisplays = MAX_HWC_DISPLAYS; } else if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) { // 1.1 adds support for multiple displays mNumDisplays = NUM_BUILTIN_DISPLAYS; } else { mNumDisplays = 1; } } if (mFbDev) { ALOG_ASSERT(!(mHwc && hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)), "should only have fbdev if no hwc or hwc is 1.0"); DisplayData& disp(mDisplayData[HWC_DISPLAY_PRIMARY]); disp.connected = true; disp.format = mFbDev->format; DisplayConfig config = DisplayConfig(); config.width = mFbDev->width; config.height = mFbDev->height; config.xdpi = mFbDev->xdpi; config.ydpi = mFbDev->ydpi; config.refresh = nsecs_t(1e9 / mFbDev->fps); disp.configs.push_back(config); disp.currentConfig = 0; } else if (mHwc) { // here we're guaranteed to have at least HWC 1.1 for (size_t i =0 ; i<NUM_BUILTIN_DISPLAYS ; i++) { queryDisplayProperties(i); } } if (needVSyncThread) { // we don't have VSYNC support, we need to fake it : 不支持硬件的 VSYNC，则会创建线程来模拟定时 VSYNC 信号 mVSyncThread = new VSyncThread(*this); } }
HWComposer 代表着硬件显示设备，注册了 VSYNC 信号的回调。VSYNC 信号本身是由显示驱动产生的，在不支持硬件的 VSYNC，则会创建“VSyncThread”线程来模拟定时 VSYNC 信号。当硬件产生VSYNC信号时，则会发送消息，handler 收到消息进行处理。当 SurfaceFlinger 进程收到 VSync 信号后经层层调用，最终调用到该对象的 handleMessageRefresh() 方法。
- HSYNC 信号用于告诉电子枪该扫描下一行了, 即要转到下一行起始处了；
- VSYNC 信号告诉电子枪该显示下一帧了, 即该转回左上角起始处了；
// SurfaceFlinger.cpp void SurfaceFlinger::handleMessageRefresh() { ATRACE_CALL(); preComposition();//处理显示设备与 layers 的改变，更新光标 rebuildLayerStacks();//重建所有可见 Layer 列表，根据Z轴排序 setUpHWComposer();//更新 HWComposer 图层 doDebugFlashRegions(); doComposition();//生成 OpenGL 纹理图像 postComposition();//将图像传递到物理屏幕 }
3. 服务启动配置文件：/frameworks/native/services/surfaceflinger/surfaceflinger.rc
上面发现服务配置文件也在Android.mk中被加载：LOCAL_INIT_RC := surfaceflinger.rc
service surfaceflinger /system/bin/surfaceflinger
class core animation
user system
group graphics drmrpc readproc
onrestart restart zygote
writepid /dev/stune/foreground/tasks
socket pdx/system/vr/display/client stream 0666 system graphics u:object_r:pdx_display_client_endpoint_socket:s0 socket pdx/system/vr/display/manager stream 0666 system graphics u:object_r:pdx_display_manager_endpoint_socket:s0 socket pdx/system/vr/display/vsync stream 0666 system graphics u:object_r:pdx_display_vsync_endpoint_socket:s0
4. Surface 创建过程
Surface 创建的过程就是 Activity 显示的过程，在 ActivityThread.handleResumeActivity() 中调用了 Activity.makeVisible()具体实现：
void makeVisible() { if (!mWindowAdded) { ViewManager wm = getWindowManager();//此处 getWindowManager 获取的是 WindowManagerImpl 对象 wm.addView(mDecor, getWindow().getAttributes()); mWindowAdded = true; } mDecor.setVisibility(View.VISIBLE); }
WindowManagerImpl.java：
public void addView(@NonNull View view, @NonNull ViewGroup.LayoutParams params) { applyDefaultToken(params); mGlobal.addView(view, params, mDisplay, mParentWindow); }
WindowManagerGlobal.java：
public void addView(View view, ViewGroup.LayoutParams params, Display display, Window parentWindow) { ... final WindowManager.LayoutParams wparams = (WindowManager.LayoutParams) params; //创建 ViewRootImpl ViewRootImpl root = new ViewRootImpl(view.getContext(), display); view.setLayoutParams(wparams); mViews.add(view); mRoots.add(root); mParams.add(wparams); //设置 View root.setView(view, wparams, panelParentView); ... }
1
2
3
4
5
6
7
8
9
10
11
12
13
创建 ViewRootImpl：
public final class ViewRootImpl implements ViewParent,
View.AttachInfo.Callbacks, ThreadedRenderer.DrawCallbacks {
...
final Surface mSurface = new Surface(); //创建 Surface，此时 Surface 创建完什么都没有，详见下面分析
...
public ViewRootImpl(Context context, Display display) {
mContext = context;
//获取 IWindowSession 的代理类
mWindowSession = WindowManagerGlobal.getWindowSession();
mDisplay = display;
mThread = Thread.currentThread(); //主线程
mWindow = new W(this);
mChoreographer = Choreographer.getInstance();
...
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
WindowManagerGlobal.java：
public static IWindowSession getWindowSession() {
synchronized (WindowManagerGlobal.class) {
if (sWindowSession == null) {
try {
//获取 IMS 的代理类
InputMethodManager imm = InputMethodManager.getInstance();
//获取 WMS 的代理类
IWindowManager windowManager = getWindowManagerService();
//经过 Binder 调用，最终调用 WMS
sWindowSession = windowManager.openSession(
new IWindowSessionCallback.Stub() {...},
imm.getClient(), imm.getInputContext());
} catch (RemoteException e) {
...
}
}
return sWindowSession
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
WindowManagerService.openSession：
public IWindowSession openSession(IWindowSessionCallback callback, IInputMethodClient client, IInputContext inputContext) {
//创建 Session 对象
Session session = new Session(this, callback, client, inputContext);
return session;
}
1
2
3
4
5
再次经过 Binder 将数据写回 app 进程，则获取的便是 Session 的代理对象 IWindowSession。
创建完 ViewRootImpl 对象后，接下来调用该对象的 setView() 方法。
ViewRootImpl：
public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
synchronized (this) {
requestLayout(); //详见下面分析
...
//通过 Binder调用，进入 system 进程的 Session
res = mWindowSession.addToDisplay(mWindow, mSeq, mWindowAttributes,
getHostVisibility(), mDisplay.getDisplayId(),
mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
mAttachInfo.mOutsets, mInputChannel);
...
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
final class Session extends IWindowSession.Stub implements IBinder.DeathRecipient {
public int addToDisplay(IWindow window, int seq, WindowManager.LayoutParams attrs, int viewVisibility, int displayId, Rect outContentInsets, Rect outStableInsets, Rect outOutsets, InputChannel outInputChannel) {
//调用 WMS.addWindow
return mService.addWindow(this, window, seq, attrs, viewVisibility, displayId,
outContentInsets, outStableInsets, outOutsets, outInputChannel);
}
}
1
2
3
4
5
6
7
8
WindowManagerService.java：
public int addWindow(Session session, IWindow client, int seq, WindowManager.LayoutParams attrs, int viewVisibility, int displayId, Rect outContentInsets, Rect outStableInsets, Rect outOutsets, InputChannel outInputChannel) {
...
WindowToken token = mTokenMap.get(attrs.token);
//创建 WindowState
WindowState win = new WindowState(this, session, client, token,
attachedWindow, appOp[0], seq, attrs, viewVisibility, displayContent);
...
//调整 WindowManager 的 LayoutParams 参数
mPolicy.adjustWindowParamsLw(win.mAttrs);
res = mPolicy.prepareAddWindowLw(win, attrs);
addWindowToListInOrderLocked(win, true);
// 设置 input
mInputManager.registerInputChannel(win.mInputChannel, win.mInputWindowHandle);
//详见下面分析
win.attach();
mWindowMap.put(client.asBinder(), win);
if (win.canReceiveKeys()) {
//当该窗口能接收按键事件，则更新聚焦窗口
focusChanged = updateFocusedWindowLocked(UPDATE_FOCUS_WILL_ASSIGN_LAYERS,
false /*updateInputWindows*/);
}
assignLayersLocked(displayContent.getWindowList());
...
}
//WindowState.java
void attach() {
mSession.windowAddedLocked();
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
创建 SurfaceSession 对象，并将当前 Session 添加到 WMS.mSessions 成员变量。
Session.java：
void windowAddedLocked() {
if (mSurfaceSession == null) {
mSurfaceSession = new SurfaceSession();
mService.mSessions.add(this);
if (mLastReportedAnimatorScale != mService.getCurrentAnimatorScale()) {
mService.dispatchNewAnimatorScaleLocked(this);
}
}
mNumWindow++;
}
1
2
3
4
5
6
7
8
9
10
SurfaceSession 的创建会调用 JNI，在 JNI 调用 nativeCreate()。
android_view_SurfaceSession.cpp：
static jlong nativeCreate(JNIEnv* env, jclass clazz) {
SurfaceComposerClient* client = new SurfaceComposerClient();
client->incStrong((void*)nativeCreate);
return reinterpret_cast<jlong>(client);
}
1
2
3
4
5
创建 SurfaceComposerClient 对象， 作为跟 SurfaceFlinger 通信的代理对象。
SurfaceComposerClient::SurfaceComposerClient() {
//getComposerService() 将返回 SF 的 Binder 代理端的 BpSurfaceFlinger 对象
sp<ISurfaceComposer> sm(getComposerService());
//先调用 SF 的 createConnection()，再调用_init
_init(sm, sm->createConnection());
if(mClient != 0) {
Mutex::Autolock _l(gLock);
//gActiveConnections 是全局变量，把刚才创建的 client 保存到这个 map 中去
gActiveConnections.add(mClient->asBinder(), this);
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
SurfaceFlinger.cpp：
sp<ISurfaceFlingerClient>SurfaceFlinger::createConnection() {
Mutex::Autolock _l(mStateLock);
uint32_t token = mTokens.acquire();
//先创建一个Client
sp<Client> client = new Client(token, this);
//把这个Client对象保存到mClientsMap中，token是它的标识。
status_t err = mClientsMap.add(token, client);
/*
创建一个用于 Binder 通信的 BClient，BClient 派生于 ISurfaceFlingerClient，
它的作用是接受客户端的请求，然后把处理提交给 SF，注意，并不是提交给 Client。
Client 会创建一块共享内存，该内存由 getControlBlockMemory 函数返回。
*/
sp<BClient> bclient = new BClient(this, token,client->getControlBlockMemory());
return bclient;
}
Client::Client(ClientID clientID, constsp<SurfaceFlinger>& flinger):ctrlblk(0), cid(clientID), mPid(0), mBitmap(0), mFlinger(flinger) {
const int pgsize = getpagesize();
//下面这个操作会使 cblksize 为页的大小，目前是4096字节
constint cblksize = ((sizeof(SharedClient)+(pgsize-1))&~(pgsize-1));
mCblkHeap = new MemoryHeapBase(cblksize, 0, "SurfaceFlinger Clientcontrol-block");
ctrlblk = static_cast<SharedClient *>(mCblkHeap->getBase());
if(ctrlblk) {
new(ctrlblk) SharedClient;//原来 Surface 的 CB 对象就是在共享内存中创建的这个 SharedClient 对象
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
SharedClient：
class SharedClient {
public:
SharedClient();
~SharedClient();
status_t validate(size_t token) const;
uint32_t getIdentity(size_t token) const;
private:
Mutexlock;
Condition cv; //支持跨进程的同步对象
//NUM_LAYERS_MAX 为 31，SharedBufferStack 是什么？
SharedBufferStack surfaces[ NUM_LAYERS_MAX ];
};
//SharedClient的构造函数，没什么新意，不如Audio的CB对象复杂
SharedClient::SharedClient():lock(Mutex::SHARED), cv(Condition::SHARED) {
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
一个 Client 最多支持 31 个显示层。每一个显示层的生产/消费步调都由会对应的 SharedBufferStack 来控制。而它内部就用了几个成员变量来控制读写位置。
SharedBufferStack.h：
class SharedBufferStack{
......
//Buffer 是按块使用的，每个 Buffer 都有自己的编号，其实就是数组中的索引号。
volatile int32_t head; //FrontBuffer 的编号
volatile int32_t available; //空闲 Buffer 的个数
volatile int32_t queued; //脏 Buffer 的个数，脏 Buffer 表示有新数据的 Buffer
volatile int32_t inUse; //SF 当前正在使用的 Buffer 的编号
volatilestatus_t status; //状态码
......
}
1
2
3
4
5
6
7
8
9
10
SF 的一个 Client 分配一个跨进程共享的 SharedClient 对象。这个对象有31个 SharedBufferStack 元素，每一个 SharedBufferStack 对应于一个显示层。
一个显示层将创建两个 Buffer，后续的 PageFlipping 就是基于这两个 Buffer 展开的。
接着看 SurfaceComposerClient 中这个_init函数：
void SurfaceComposerClient::_init(
const sp<ISurfaceComposer>& sm, constsp<ISurfaceFlingerClient>& conn) {
mPrebuiltLayerState = 0;
mTransactionOpen = 0;
mStatus = NO_ERROR;
mControl = 0;
mClient = conn;// mClient 就是 BClient 的客户端
mControlMemory =mClient->getControlBlock();
mSignalServer = sm;// mSignalServer 就是 BpSurfaceFlinger
//mControl 就是那个创建于共享内存之中的 SharedClient
mControl = static_cast<SharedClient*>(mControlMemory->getBase());
}
1
2
3
4
5
6
7
8
9
10
11
12
13
创建完 ViewRootImpl 对象后，接下来调用该对象的 setView() 方法。在 setView() 中调用了 requestLayout() 方法我们来看下这个方法：
public void requestLayout() {
checkThread();
mLayoutRequested = true;
scheduleTraversals();
}
public void scheduleTraversals() {
if(!mTraversalScheduled) {
mTraversalScheduled = true;
sendEmptyMessage(DO_TRAVERSAL); //发送 DO_TRAVERSAL 消息
}
}
public void handleMessage(Message msg) {
switch (msg.what) {
......
case DO_TRAVERSAL:
......
performTraversals();//调用 performTraversals()
......
break;
......
}
}
private void performTraversals() {
finalView host = mView;//还记得这mView吗？它就是 DecorView
booleaninitialized = false;
booleancontentInsetsChanged = false;
booleanvisibleInsetsChanged;
try {
relayoutResult= // 1. 关键函数relayoutWindow
relayoutWindow(params, viewVisibility,insetsPending);
}
......
draw(fullRedrawNeeded);// 2. 开始绘制
......
}
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility, boolean insetsPending)throws RemoteException {
//原来是调用 IWindowSession 的 relayout()，暂且记住这个调用
int relayoutResult = sWindowSession.relayout(mWindow, params, (int) (mView.mMeasuredWidth * appScale + 0.5f), (int) (mView.mMeasuredHeight * appScale + 0.5f), viewVisibility, insetsPending, mWinFrame, mPendingContentInsets, mPendingVisibleInsets, mPendingConfiguration, mSurface); //mSurface 做为参数传进去了。
}
......
}
private void draw(boolean fullRedrawNeeded) {
Surface surface = mSurface;//mSurface 是 ViewRoot 的成员变量
......
Canvascanvas;
try {
int left = dirty.left;
int top = dirty.top;
int right = dirty.right;
int bottom = dirty.bottom;
//从 mSurface 中 lock 一块 Canvas
canvas = surface.lockCanvas(dirty);
......
mView.draw(canvas);//调用 DecorView 的 draw 函数，canvas 就是画布
......
//unlock 画布，屏幕上马上就能看到 View 的样子了
surface.unlockCanvasAndPost(canvas);
}
......
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
在 ViewRoot 构造时，会创建一个 Surface，它使用无参构造函数，代码如下所示：
final Surface mSurface = new Surface();
1
此时创建完的 Surface 是空的，什么都没有。接着继续分析 relayoutWindow()，在 relayoutWindow() 中会调用 IWindowSession 的 relayout()，这是一个跨进程方法会调用到 WMS 中的 Session.relayout()，最后调用到 WindowManagerService.relayoutWindow()。
public int relayoutWindow(Session session,IWindow client,
WindowManager.LayoutParams attrs, int requestedWidth,
int requestedHeight, int viewVisibility, boolean insetsPending,
Rect outFrame, Rect outContentInsets, Rect outVisibleInsets,
Configuration outConfig, SurfaceoutSurface){
.....
try {
//win 就是 WinState，这里将创建一个本地的 Surface 对象
Surfacesurface = win.createSurfaceLocked();
if(surface != null) {
//先创建一个本地 surface，然后在 outSurface 的对象上调用 copyFrom
//将本地 Surface 的信息拷贝到 outSurface 中，为什么要这么麻烦呢？
outSurface.copyFrom(surface);
......
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
WindowManagerService.java::WindowState：
Surface createSurfaceLocked() {
......
try {
//mSurfaceSession 就是在 Session 上创建的 SurfaceSession 对象
//这里，以它为参数，构造一个新的 Surface 对象
mSurface = new Surface(mSession.mSurfaceSession, mSession.mPid, mAttrs.getTitle().toString(), 0, w, h, mAttrs.format, flags);
}
Surface.openTransaction();//打开一个事务处理
......
Surface.closeTransaction();//关闭一个事务处理
......
}
1
2
3
4
5
6
7
8
9
10
11
12
构造 Surface 对象：
public Surface(SurfaceSession s,//传入一个SurfaceSession对象
int pid, String name, int display, int w, int h, int format, int flags) throws OutOfResourcesException {
......
mCanvas = new CompatibleCanvas();
//又一个 native 函数
init(s,pid,name,display,w,h,format,flags);
mName = name;
}
1
2
3
4
5
6
7
8
static void Surface_init(JNIEnv*env, jobject clazz, jobject session, jint pid, jstring jname, jint dpy, jint w, jint h, jint format, jintflags) {
//从 SurfaceSession 对象中取出之前创建的那个 SurfaceComposerClient 对象
SurfaceComposerClient* client = (SurfaceComposerClient*)env->GetIntField(session, sso.client);
sp<SurfaceControl> surface;//注意它的类型是 SurfaceControl
if (jname == NULL) {
//调用 SurfaceComposerClient 的 createSurface 函数，返回的 surface 是一个 SurfaceControl 类型
surface = client->createSurface(pid, dpy, w, h, format, flags);
} else{
......
}
//把这个 surfaceControl 对象设置到 Java 层的 Surface 对象中
setSurfaceControl(env, clazz, surface);
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
在 createSurface 内部会使用 Binder 通信将请求发给 SurfaceFlinger：
sp<ISurface>SurfaceFlinger::createSurface(ClientID clientId, int pid, const String8& name, ISurfaceFlingerClient::surface_data_t* params, DisplayID d, uint32_t w, uint32_t h, PixelFormat format, uint32_t flags) {
sp<LayerBaseClient> layer;//LayerBaseClient 是 Layer 家族的基类
//这里又冒出一个 LayerBaseClient 的内部类，它也叫Surface
sp<LayerBaseClient::Surface> surfaceHandle;
Mutex::Autolock _l(mStateLock);
//根据 clientId 找到 createConnection 时加入的那个 Client 对象
sp<Client> client = mClientsMap.valueFor(clientId);
......
//注意这个 id，它的值表示 Client 创建的是第几个显示层
//同时也表示将使用 SharedBufferStatck 数组的第 id 个元素
int32_t id = client->generateId(pid);
//一个 Client 不能创建多于 NUM_LAYERS_MAX 个的Layer
if(uint32_t(id) >= NUM_LAYERS_MAX) {
return surfaceHandle;
}
//根据 flags 参数来创建不同类型的显示层
switch(flags & eFXSurfaceMask) {
case eFXSurfaceNormal:
if (UNLIKELY(flags & ePushBuffers)) {
//创建 PushBuffer 类型的显示层
layer = createPushBuffersSurfaceLocked(client, d, id, w, h, flags);
} else {
//创建 Normal 类型的显示层
layer = createNormalSurfaceLocked(client, d, id, w, h, flags, format);
}
break;
case eFXSurfaceBlur:
//创建 Blur 类型的显示层
layer = createBlurSurfaceLocked(client, d, id, w, h, flags);
break;
case eFXSurfaceDim:
//创建 Dim 类型的显示层
layer = createDimSurfaceLocked(client, d, id, w, h, flags);
break;
}
if(layer != 0) {
layer->setName(name);
setTransactionFlags(eTransactionNeeded);
//从显示层对象中取出一个 ISurface 对象赋值给 SurfaceHandle
surfaceHandle = layer->getSurface();
if(surfaceHandle != 0) {
params->token = surfaceHandle->getToken();
params->identity = surfaceHandle->getIdentity();
params->width = w;
params->height = h;
params->format = format;
}
}
return surfaceHandle;//ISurface 的 Bn 端就是这个对象
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
sp<LayerBaseClient>SurfaceFlinger::createNormalSurfaceLocked(const sp<Client>& client, DisplayID display, int32_t id, uint32_t w, uint32_t h, uint32_t flags, PixelFormat& format) {
switch(format) { //一些图像方面的参数设置，可以不去管它
case PIXEL_FORMAT_TRANSPARENT:
case PIXEL_FORMAT_TRANSLUCENT:
format = PIXEL_FORMAT_RGBA_8888;
break;
case PIXEL_FORMAT_OPAQUE:
format = PIXEL_FORMAT_RGB_565;
break;
}
//创建一个 Layer 类型的对象
sp<Layer> layer = new Layer(this, display,client, id);
//设置 Buffer
status_t err = layer->setBuffers(w, h, format, flags);
if (LIKELY(err == NO_ERROR)) {
//初始化这个新 layer 的一些状态
layer->initStates(w, h, flags);
//下面这个函数把这个 layer 加入到 Z 轴集合中
addLayer_l(layer);
}
......
return layer;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
createNormalSurfaceLocked 函数有三个关键点，它们是：
构造一个Layer对象。
调用Layer对象的setBuffers函数。
调用SF的addLayer_l函数。
当跨进程的 createSurface() 执行完返回一个 ISurface 对象，接下来会创建 SurfaceControl 对象：
SurfaceControl::SurfaceControl(
const sp<SurfaceComposerClient>& client,
const sp<ISurface>& surface,
const ISurfaceFlingerClient::surface_data_t& data,
uint32_t w, uint32_t h, PixelFormat format, uint32_t flags)
//mClient 为 SurfaceComposerClient，而 mSurface 指向跨进程 createSurface() 调用返回的 ISurface 对象
:mClient(client), mSurface(surface),
mToken(data.token), mIdentity(data.identity),
mWidth(data.width), mHeight(data.height), mFormat(data.format),
mFlags(flags){
......
}
1
2
3
4
5
6
7
8
9
10
11
12
SurfaceControl 类可以看作是一个 wrapper 类，它封装了一些函数，通过这些函数可以方便地调用 mClient 或 ISurface 提供的函数。
最后会执行 copyFrom() 返回给 App 客户端：
static void Surface_copyFrom(JNIEnv* env,jobject clazz, jobject other) {
//根据JNI函数的规则，clazz 是 copyFrom 的调用对象，而 other 是 copyFrom 的参数。
//目标对象此时还没有设置 SurfaceControl，而源对象在前面已经创建了 SurfaceControl
constsp<SurfaceControl>& surface = getSurfaceControl(env, clazz);
constsp<SurfaceControl>& rhs = getSurfaceControl(env, other);
if (!SurfaceControl::isSameSurface(surface, rhs)) {
//把源 SurfaceControl 对象设置到目标 Surface 中
setSurfaceControl(env, clazz, rhs);
}
}
1
2
3
4
5
6
7
8
9
10
copyFrom 期间一共有三个关键对象，它们分别是：
SurfaceComposerClient
SurfaceControl
Surface，这个 Surface 对象属于 Native 层，和 Java 层的 Surface 相对应
其中转移到 ViewRoot 成员变量 mSurface 中的，就是最后这个 Surface 对象了。
在 SurfaceFlinger 进程中，Client 的一个 Layer 将使用 SharedBufferStack 数组中的一个成员，并通过 SharedBufferServer 结构来控制这个成员，我们知道 SurfaceFlinger 是消费者，所以可由 SharedBufferServer 来控制数据的读取。
与之相对应，客户端的进程也会有一个对象来使用这个 SharedBufferStack，可它是通过另外一个叫 SharedBufferClient 的结构来控制的。客户端为 SurfaceFlinger 提供数据，所以可由 SharedBufferClient 控制数据的写入。