BLASTBufferQueue端的GraphicBuffer怎么和SurfaceFlinger端的BufferStateLayer关联上

BLASTBufferQueue端的GraphicBuffer怎么和SurfaceFlinger端的BufferStateLayer关联上

引言

在跟进hwc_layer是如何产生的，并如何被填充上GraphicBuffer的，怎么也找不到被填充的GraphicBuffer的来源，最终找到了，它的来源是客户端的BLASTBufferQueue传递过来的，我们这里跟进下这个流程。

这里使用的代码是Android 13 aosp！

一. BLASTBufferQueue是如何传递GraphicBuffer到SurfaceFlinger端的BufferStateLayer的

当BufferQueueProducer完成绘制调用queueBuffer后，会调用BLASTBufferQueue::onFrameAvailable。

///rameworks/native/libs/gui/BLASTBufferQueue.cpp
void BLASTBufferQueue::onFrameAvailable(const BufferItem& item) {...acquireNextBufferLocked(mSyncTransaction)...
}void BLASTBufferQueue::acquireNextBufferLocked(const std::optional<SurfaceComposerClient::Transaction*> transaction) {...status_t status =mBufferItemConsumer->acquireBuffer(&bufferItem, 0 /* expectedPresent */, false); auto buffer = bufferItem.mGraphicBuffer;t->setBuffer(mSurfaceControl, buffer, fence, bufferItem.mFrameNumber, releaseBufferCallback);t->setApplyToken(mApplyToken).apply(false, true);...
}

apply最终会通过Binder调用到SurfaceFlinger的>setTransactionState，我们接着往下看:

status_t SurfaceFlinger::setTransactionState(const FrameTimelineInfo& frameTimelineInfo, const Vector<ComposerState>& states,const Vector<DisplayState>& displays, uint32_t flags, const sp<IBinder>& applyToken,const InputWindowCommands& inputWindowCommands, int64_t desiredPresentTime,bool isAutoTimestamp, const client_cache_t& uncacheBuffer, bool hasListenerCallbacks,const std::vector<ListenerCallbacks>& listenerCallbacks, uint64_t transactionId) {...queueTransaction(state);//将相关的transaction状态存起来...}       

后续vsync会触发SurfaceFlinger执行如下逻辑:

MessageQueue::Handler::handleMessagecompositor.commitSurfaceFlinger::commitflushTransactionQueuesSurfaceFlinger::applyTransactionStateSurfaceFlinger::setClientStateLockedlayer->setBufferuint32_t SurfaceFlinger::setClientStateLocked(const FrameTimelineInfo& frameTimelineInfo,ComposerState& composerState,int64_t desiredPresentTime, bool isAutoTimestamp,int64_t postTime, uint32_t permissions) {layer_state_t& s = composerState.state;sp<Layer> layer = nullptr;layer = fromHandle(s.surface).promote();//关键点，这个layer是怎么获取的if (what & layer_state_t::eBufferChanged) {std::shared_ptr<renderengine::ExternalTexture> buffer =getExternalTextureFromBufferData(*s.bufferData, layer->getDebugName());//这里并不是真的纹理，而是命名像而已if (layer->setBuffer(buffer, *s.bufferData, postTime, desiredPresentTime, isAutoTimestamp,dequeueBufferTimestamp, frameTimelineInfo)) {flags |= eTraversalNeeded;}}
}

这里我们看下fromHandle的实现:

//SurfaceFlinger.cpp
wp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) const {return Layer::fromHandle(handle);
}//Layer.cpp
wp<Layer> Layer::fromHandle(const sp<IBinder>& handleBinder) {if (handleBinder == nullptr) {return nullptr;}BBinder* b = handleBinder->localBinder();if (b == nullptr || b->getInterfaceDescriptor() != Handle::kDescriptor) {return nullptr;}// We can safely cast this binder since its local and we verified its interface descriptor.sp<Handle> handle = static_cast<Handle*>(handleBinder.get());return handle->owner;
}

那么这个Layer对应的Handle是什么时候被构建的呢，是什么时候呢。

status_t SurfaceFlinger::createLayer(LayerCreationArgs& args, sp<IBinder>* outHandle,const sp<IBinder>& parentHandle, int32_t* outLayerId,const sp<Layer>& parentLayer, uint32_t* outTransformHint) {...sp<Layer> layer;       createBufferStateLayer(args, outHandle, &layer)...
}    status_t SurfaceFlinger::createBufferStateLayer(LayerCreationArgs& args, sp<IBinder>* handle,sp<Layer>* outLayer) {args.textureName = getNewTexture();*outLayer = getFactory().createBufferStateLayer(args);*handle = (*outLayer)->getHandle();return NO_ERROR;
}//frameworks/native/services/surfaceflinger/Layer.cpp
sp<IBinder> Layer::getHandle() {Mutex::Autolock _l(mLock);if (mGetHandleCalled) {ALOGE("Get handle called twice" );return nullptr;}mGetHandleCalled = true;return new Handle(mFlinger, this);
}//frameworks/native/services/surfaceflinger/Layer.h
class Handle : public BBinder, public LayerCleaner {
public:Handle(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer): LayerCleaner(flinger, layer, this), owner(layer) {}const String16& getInterfaceDescriptor() const override { return kDescriptor; }static const String16 kDescriptor;wp<Layer> owner;
};
...
}

这里我们要怎么理解这个Handle呢，它是对Layer的一个封装，不管是BufferStateLayer还是其它的，通过它可以让Layer在Binder中传递。

我们接着继续往下看，layer->setBuffer会调用子类的setBuffer，子类是BufferStateLayer

//frameworks/native/services/surfaceflinger/BufferStateLayer.cpp
bool BufferStateLayer::setBuffer(std::shared_ptr<renderengine::ExternalTexture>& buffer,const BufferData& bufferData, nsecs_t postTime,nsecs_t desiredPresentTime, bool isAutoTimestamp,std::optional<nsecs_t> dequeueTime,const FrameTimelineInfo& info) {...mDrawingState.frameNumber = frameNumber;mDrawingState.releaseBufferListener = bufferData.releaseBufferListener;mDrawingState.buffer = std::move(buffer);mDrawingState.clientCacheId = bufferData.cachedBuffer;setTransactionFlags(eTransactionNeeded);...
}

这里只是把buffer赋值给mDrawingState.buffer了，肯定有地方把mDrawingState.buffer赋值mBufferInfo.mBuffer；

接着找，在updateActiveBuffer找到了mBufferInfo.mBuffer = s.buffer。updateActiveBuffer又是在哪里调用的呢？

status_t BufferStateLayer::updateActiveBuffer() {const State& s(getDrawingState());...mBufferInfo.mBuffer = s.buffer;mBufferInfo.mFence = s.acquireFence;mBufferInfo.mFrameNumber = s.frameNumber;...
}

在BufferStateLayer的父类BufferLayer::latchBuffer里调用:

bool BufferLayer::latchBuffer(bool& recomputeVisibleRegions, nsecs_t latchTime,nsecs_t expectedPresentTime) {
... ...status_t err = updateTexImage(recomputeVisibleRegions, latchTime, expectedPresentTime);err = updateActiveBuffer();err = updateFrameNumber(latchTime);

接下来看下latchBuffer是在哪里调用的:

MessageQueue::Handler::handleMessagecompositor.commitSurfaceFlinger::commitlatchBuffers()for (const auto& layer : mLayersWithQueuedFrames) {if (layer->latchBuffer(visibleRegions, latchTime, expectedPresentTime)) {mLayersPendingRefresh.push_back(layer);newDataLatched = true;}layer->useSurfaceDamage();}            

二. BufferStateLayer的GraphicBuffer怎么传递到hwc_layer中去的

这个我们要知道的是BufferStateLayer的GraphicBuffer最终传递到hwc_layer中，是要经过OputputLayer的，通过前面我们知道此时的GraphicBuffer存储在BufferInfo中，如下:

class BufferLayer : public Layer {...struct BufferInfo {nsecs_t mDesiredPresentTime;std::shared_ptr<FenceTime> mFenceTime;sp<Fence> mFence;uint32_t mTransform{0};ui::Dataspace mDataspace{ui::Dataspace::UNKNOWN};Rect mCrop;uint32_t mScaleMode{NATIVE_WINDOW_SCALING_MODE_FREEZE};Region mSurfaceDamage;HdrMetadata mHdrMetadata;int mApi;PixelFormat mPixelFormat{PIXEL_FORMAT_NONE};bool mTransformToDisplayInverse{false};std::shared_ptr<renderengine::ExternalTexture> mBuffer;//存放GraphicBufferuint64_t mFrameNumber;int mBufferSlot{BufferQueue::INVALID_BUFFER_SLOT};bool mFrameLatencyNeeded{false};};    BufferInfo mBufferInfo;...}

我们先看怎么传递到OutputLayer的:

MessageQueue::Handler::handleMessage(...)compositor.composite(...)SurfaceFlinger::composite(...)mCompositionEngine->present(...)//CompositionEngine.cppupdateLayerStateFromFE(args)output->updateLayerStateFromFE(args)//Output.cppfor (auto* layer : getOutputLayersOrderedByZ()) {layer->getLayerFE().prepareCompositionState(args.updatingGeometryThisFrame ? LayerFE::StateSubset::GeometryAndContent: LayerFE::StateSubset::Content);}                    //frameworks/native/services/surfaceflinger/Layer.cppvoid Layer::prepareCompositionState(compositionengine::LayerFE::StateSubset subset) {using StateSubset = compositionengine::LayerFE::StateSubset;switch (subset) {case StateSubset::BasicGeometry:prepareBasicGeometryCompositionState();break;case StateSubset::GeometryAndContent:prepareBasicGeometryCompositionState();prepareGeometryCompositionState();preparePerFrameCompositionState();//调用子类BufferLayer的break;case StateSubset::Content:preparePerFrameCompositionState();break;case StateSubset::Cursor:prepareCursorCompositionState();break;}
}  //frameworks/native/services/surfaceflinger/BufferLayer.cpp
void BufferLayer::preparePerFrameCompositionState() {Layer::preparePerFrameCompositionState();...compositionState->buffer = getBuffer();compositionState->bufferSlot = (mBufferInfo.mBufferSlot == BufferQueue::INVALID_BUFFER_SLOT)? 0: mBufferInfo.mBufferSlot;compositionState->acquireFence = mBufferInfo.mFence;compositionState->frameNumber = mBufferInfo.mFrameNumber;compositionState->sidebandStreamHasFrame = false;
}

分析layer是否参与合成

最简单的SurfaceFlinger应用程序

Android14 SurfaceFlinger-BLASTBufferQueue的创建

Android 14 SurfaceFlinger-Layer visibleRegion的计算过程

SurfaceFlinger的commit/handleTransaction分析

这里重点关注各种State！