AndroidQ Surface與SurfaceControl創建分析

本篇文章分析Surface和SurfaceControl的創建流程，在window通過addView添加到WMS時會創建ViewRootImpl，ViewRootImpl創建好之後Surface，SurfaceControl都作爲全局變量被new了出來，但是僅僅是調用了它們無參構造函數創建了一個對象，其他什麼也沒做，那它們具體初始化在什麼地方呢?

ViewRootImpl的setView()方法中會調用requestLayout()準備進行View的測量，佈局和繪製，即在收到下一個Vsync時執行performTraversals()方法，此方法又會調用relayoutWindow()方法，然後通過Binder調用WMS的relayout方法，我們從此方法開始看

ViewRootImpl.relayoutWindow

private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
            boolean insetsPending) throws RemoteException {
            ......
			int relayoutResult = mWindowSession.relayout(mWindow, mSeq, params,
                (int) (mView.getMeasuredWidth() * appScale + 0.5f),
                (int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
                insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
                mTmpFrame, mPendingOverscanInsets, mPendingContentInsets, mPendingVisibleInsets,
                mPendingStableInsets, mPendingOutsets, mPendingBackDropFrame, mPendingDisplayCutout,
                mPendingMergedConfiguration, mSurfaceControl, mTempInsets);
           if (mSurfaceControl.isValid()) {
            mSurface.copyFrom(mSurfaceControl);
        } else {
            destroySurface();
        }
                ......

relayout方法傳遞了一大堆參數，我們這裏只關心mSurfaceControl，這個參數在AIDL文件中被定義爲out類型，意味着它需要由binder server端進行填充，所以此參數被傳遞到WMS端進行具體的初始化，然後注意relayout完成之後如果mSurfaceControl是有效的則通過mSurface的copyFrom來初始化Surface

好了我們首先就來看看SurfaceControl在WMS端的具體處理流程吧，mWindowSession.relayout中會調用WMS的relayoutWindow方法

WMS.relayoutWindow

 public int relayoutWindow(......
            SurfaceControl outSurfaceControl,......) {
            ......
			try {
                    result = createSurfaceControl(outSurfaceControl, result, win, winAnimator);
                } catch (Exception e) {
                	......
                    return 0;
                }

我們只關心SurfaceControl的創建，主要是通過createSurfaceControl方法，接着看

createSurfaceControl

 private int createSurfaceControl(SurfaceControl outSurfaceControl, int result, WindowState win,
            WindowStateAnimator winAnimator) {
		......
        WindowSurfaceController surfaceController;
        try {
            //步驟1
            surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type, win.mOwnerUid);
        } finally {
           	...
        }
        if (surfaceController != null) {
           //步驟2
            surfaceController.getSurfaceControl(outSurfaceControl);
            
        } else {
            ......
            outSurfaceControl.release();
        }
        return result;
    }

這個方法我們分爲兩步來看，首先看步驟1createSurfaceLocked方法

WindowStateAnimator.createSurfaceLocked

 WindowSurfaceController createSurfaceLocked(int windowType, int ownerUid) {
    //一個WindowStateAnimator對象只會創建一個WindowSurfaceController
	if (mSurfaceController != null) {
            return mSurfaceController;
        }
	......
	//這裏直接通過new的方式創建了一個WindowSurfaceController對象，
	//那麼這個對象和SurfaceController有什麼關係呢？
    mSurfaceController = new WindowSurfaceController(mSession.mSurfaceSession,
                    attrs.getTitle().toString(), width, height, format, flags, this,
                    windowType, ownerUid);

	return mSurfaceController;
}

上面通過new的方式創建了一個WindowSurfaceController對象，我們看看WindowSurfaceController的構造方法

WindowSurfaceController構造方法

public WindowSurfaceController(SurfaceSession s, String name, int w, int h, int format,
            int flags, WindowStateAnimator animator, int windowType, int ownerUid) {
        //省略一些賦值
		......
        final SurfaceControl.Builder b = win.makeSurface()
                .setParent(win.getSurfaceControl())
                .setName(name)
                .setBufferSize(w, h)
                .setFormat(format)
                .setFlags(flags)
                .setMetadata(METADATA_WINDOW_TYPE, windowType)
                .setMetadata(METADATA_OWNER_UID, ownerUid);
        mSurfaceControl = b.build();
        Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
    }

WindowSurfaceController構造方法中其實就是通過SurfaceControl的內部Builder類來創建SurfaceControl對象的，並且將SurfaceControl的Name，BufferSize，Format，Flags等等一併保存到內部Builder中

SurfaceControl.Builder.build

public SurfaceControl build() {
            if (mWidth < 0 || mHeight < 0) {
                throw new IllegalStateException(
                        "width and height must be positive or unset");
            }
            if ((mWidth > 0 || mHeight > 0) && (isColorLayerSet() || isContainerLayerSet())) {
                throw new IllegalStateException(
                        "Only buffer layers can set a valid buffer size.");
            }
            return new SurfaceControl(
                    mSession, mName, mWidth, mHeight, mFormat, mFlags, mParent, mMetadata);
        }

直接通過new的方式創建SurfaceControl，接着看SurfaceControl的構造方法

private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
            SurfaceControl parent, SparseIntArray metadata)
                    throws OutOfResourcesException, IllegalArgumentException {
       	......
        mName = name;
        mWidth = w;
        mHeight = h;
        Parcel metaParcel = Parcel.obtain();
        try {
            if (metadata != null && metadata.size() > 0) {
                metaParcel.writeInt(metadata.size());
                for (int i = 0; i < metadata.size(); ++i) {
                    metaParcel.writeInt(metadata.keyAt(i));
                    metaParcel.writeByteArray(
                            ByteBuffer.allocate(4).order(ByteOrder.nativeOrder())
                                    .putInt(metadata.valueAt(i)).array());
                }
                metaParcel.setDataPosition(0);
            }
            mNativeObject = nativeCreate(session, name, w, h, format, flags,
                    parent != null ? parent.mNativeObject : 0, metaParcel);
        } finally {
            metaParcel.recycle();
        }
        if (mNativeObject == 0) {
            throw new OutOfResourcesException(
                    "Couldn't allocate SurfaceControl native object");
        }

        mCloseGuard.open("release");
    }

這裏面核心就是調用nativeCreate方法，並將window的各種數據一併傳遞到native層處理，對應的native類是android_view_SurfaceControl

nativeCreate

static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
        jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
        jobject metadataParcel) {
    ScopedUtfChars name(env, nameStr);
    //這個對象前面文章分析過，作爲應用層訪問SurfaceFlinger的client端
    sp<SurfaceComposerClient> client;
    //這裏的sessionObj是java層傳遞下來的SurfaceSession對象，
    //如果不爲空就從此對象中獲取SurfaceComposerClient，否則重新創建一個
    if (sessionObj != NULL) {
        client = android_view_SurfaceSession_getClient(env, sessionObj);
    } else {
        client = SurfaceComposerClient::getDefault();
    }
    //parentObject是java層傳遞下來的SurfaceControl，將其強轉爲native
    //層SurfaceControl，parentObject有可能爲空的
    SurfaceControl *parent = reinterpret_cast<SurfaceControl*>(parentObject);
    //創建當前窗口的SurfaceControl
    sp<SurfaceControl> surface;
    LayerMetadata metadata;
    Parcel* parcel = parcelForJavaObject(env, metadataParcel);
    if (parcel && !parcel->objectsCount()) {
        status_t err = metadata.readFromParcel(parcel);
        if (err != NO_ERROR) {
          jniThrowException(env, "java/lang/IllegalArgumentException",
                            "Metadata parcel has wrong format");
        }
    }
    //此函數是具體初始化SurfaceControl的函數
    status_t err = client->createSurfaceChecked(
            String8(name.c_str()), w, h, format, &surface, flags, parent, std::move(metadata));
    if (err == NAME_NOT_FOUND) {
        jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
        return 0;
    } else if (err != NO_ERROR) {
        jniThrowException(env, OutOfResourcesException, NULL);
        return 0;
    }
    //增加引用計數
    surface->incStrong((void *)nativeCreate);
    //將創建完成的native層SurfaceControl返回到java層
    return reinterpret_cast<jlong>(surface.get());
}

總結一下上面函數做的事情：

獲取應用層訪問SurfaceFlinger進程的的client端對象SurfaceComposerClient
得到父窗口的SurfaceControl以及創建當前窗口的SurfaceControl(僅僅是創建出來，沒有做任何其他操作)
調用SurfaceComposerClient的createSurfaceChecked函數，將java層傳遞下來的各種窗口參數以及上一步創建的SurfaceControl傳遞進去，進行具體初始化
將上一步創建好的SurfaceControl返回給java層

重點就是第三步createSurfaceChecked函數

createSurfaceChecked

status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, uint32_t flags,
                                                     SurfaceControl* parent,
                                                     LayerMetadata metadata) {
    sp<SurfaceControl> sur;
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        sp<IBinder> handle;
        sp<IBinder> parentHandle;
        sp<IGraphicBufferProducer> gbp;

        if (parent != nullptr) {
            parentHandle = parent->getHandle();
        }
     
        err = mClient->createSurface(name, w, h, format, flags, parentHandle, std::move(metadata),
                                     &handle, &gbp);
        if (err == NO_ERROR) {
            *outSurface = new SurfaceControl(this, handle, gbp, true /* owned */);
        }
    }
    return err;
}

這個函數有兩個重點，1.調用mClient的createSurface函數，mClient在之前文章AndroidQ window和SurfaceFlinger建立連接分析中分析過，它是ISurfaceComposerClient的Binder Bp端，Bn端則是SurfaceFlinger進程中的Client對象

2.通過new的方式創建native層SurfaceControl對象

還有一個重要的對象就是sp<IGraphicBufferProducer> gbp，它是SurfaceFlinger BufferQueue生產者消費者模型中的生產者，它會在createSurface進行初始化

接着看mClient->createSurface，我們直接看它在SurfaceFlinger進程的具體實現

Client::createSurface

status_t Client::createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
                               uint32_t flags, const sp<IBinder>& parentHandle,
                               LayerMetadata metadata, sp<IBinder>* handle,
                               sp<IGraphicBufferProducer>* gbp) {
    // We rely on createLayer to check permissions.
    return mFlinger->createLayer(name, this, w, h, format, flags, std::move(metadata), handle, gbp,
                                 parentHandle);
}

mFlinger是SurfaceFlinger，所以Client的具體實現還是依靠的SurfaceFlinger，並且注意，在應用層的Surface在SurfaceFlinger進程名叫Layer

SurfaceFlinger::createLayer

status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& client, uint32_t w,
                                     uint32_t h, PixelFormat format, uint32_t flags,
                                     LayerMetadata metadata, sp<IBinder>* handle,
                                     sp<IGraphicBufferProducer>* gbp,
                                     const sp<IBinder>& parentHandle,
                                     const sp<Layer>& parentLayer) {
    //寬高合法檢查
    if (int32_t(w|h) < 0) {
        ALOGE("createLayer() failed, w or h is negative (w=%d, h=%d)",
                int(w), int(h));
        return BAD_VALUE;
    }


    status_t result = NO_ERROR;
    //layer
    sp<Layer> layer;

 	......
    //根據不同flag創建不同layer
    switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceBufferQueue:
            result = createBufferQueueLayer(client, uniqueName, w, h, flags, std::move(metadata),
                                            format, handle, gbp, &layer);

            break;
        case ISurfaceComposerClient::eFXSurfaceBufferState:
            result = createBufferStateLayer(client, uniqueName, w, h, flags, std::move(metadata),
                                            handle, &layer);
            break;
        case ISurfaceComposerClient::eFXSurfaceColor:
            // check if buffer size is set for color layer.
            if (w > 0 || h > 0) {
                ALOGE("createLayer() failed, w or h cannot be set for color layer (w=%d, h=%d)",
                      int(w), int(h));
                return BAD_VALUE;
            }

            result = createColorLayer(client, uniqueName, w, h, flags, std::move(metadata), handle,
                                      &layer);
            break;
        case ISurfaceComposerClient::eFXSurfaceContainer:
            // check if buffer size is set for container layer.
            if (w > 0 || h > 0) {
                ALOGE("createLayer() failed, w or h cannot be set for container layer (w=%d, h=%d)",
                      int(w), int(h));
                return BAD_VALUE;
            }
            result = createContainerLayer(client, uniqueName, w, h, flags, std::move(metadata),
                                          handle, &layer);
            break;
        default:
            result = BAD_VALUE;
            break;
    }

    .......
    return result;
}

上面函數的核心代碼就是根據應用請求不同的flag創建不同的顯示Layer，
從上面代碼看創建的Layer有四種類型，我們看看系統中大多數界面的Layer ，flage 爲eFXSurfaceBufferQueueyer，我們就大致看看createBufferQueueLayer函數

createBufferQueueLayer

status_t SurfaceFlinger::createBufferQueueLayer(const sp<Client>& client, const String8& name,
                                                uint32_t w, uint32_t h, uint32_t flags,
                                                LayerMetadata metadata, PixelFormat& format,
                                                sp<IBinder>* handle,
                                                sp<IGraphicBufferProducer>* gbp,
                                                sp<Layer>* outLayer) {
    // initialize the surfaces
    switch (format) {
    case PIXEL_FORMAT_TRANSPARENT:
    case PIXEL_FORMAT_TRANSLUCENT:
        format = PIXEL_FORMAT_RGBA_8888;
        break;
    case PIXEL_FORMAT_OPAQUE:
        format = PIXEL_FORMAT_RGBX_8888;
        break;
    }

    sp<BufferQueueLayer> layer = getFactory().createBufferQueueLayer(
            LayerCreationArgs(this, client, name, w, h, flags, std::move(metadata)));
    status_t err = layer->setDefaultBufferProperties(w, h, format);
    if (err == NO_ERROR) {
        *handle = layer->getHandle();
        *gbp = layer->getProducer();
        *outLayer = layer;
    }

    return err;
}

可以看到上面函數的核心是調用
getFactory().createBufferQueueLayer，最終創建的是Layer的子類BufferQueueLayer，如果沒有出現錯誤還會進行如下賦值：
handle = layer->getHandle(); *gbp = layer->getProducer(); *outLayer = layer;

createBufferQueueLayer

sp<BufferQueueLayer> createBufferQueueLayer(const LayerCreationArgs& args) override {
            return new BufferQueueLayer(args);
        }

SurfaceFlingerFactory的createBufferQueueLayer函數只是new了一個BufferQueueLayer，繼續看BufferQueueLayer構造函數，

BufferQueueLayer::BufferQueueLayer(const LayerCreationArgs& args) 
: BufferLayer(args) {}

它的構造函數中其實沒做什麼事情，但是別忘了這個類終極父類是RefBase，所以再看看他的onFirstRef函數

onFirstRef

void BufferQueueLayer::onFirstRef() {
    BufferLayer::onFirstRef();

    // Creates a custom BufferQueue for SurfaceFlingerConsumer to use
    sp<IGraphicBufferProducer> producer;
    sp<IGraphicBufferConsumer> consumer;
    BufferQueue::createBufferQueue(&producer, &consumer, true);
    mProducer = new MonitoredProducer(producer, mFlinger, this);
    {
        // Grab the SF state lock during this since it's the only safe way to access RenderEngine
        Mutex::Autolock lock(mFlinger->mStateLock);
        mConsumer =
                new BufferLayerConsumer(consumer, mFlinger->getRenderEngine(), mTextureName, this);
    }
    mConsumer->setConsumerUsageBits(getEffectiveUsage(0));
    mConsumer->setContentsChangedListener(this);
    mConsumer->setName(mName);

    // BufferQueueCore::mMaxDequeuedBufferCount is default to 1
    if (!mFlinger->isLayerTripleBufferingDisabled()) {
        mProducer->setMaxDequeuedBufferCount(2);
    }

    if (const auto display = mFlinger->getDefaultDisplayDevice()) {
        updateTransformHint(display);
    }

    if (mFlinger->mLayerExt) {
        mLayerType = mFlinger->mLayerExt->getLayerClass(mName.string());
    }
}

這個函數做的事情就非常複雜了，它初始化了SurfaceFlinger進程的生產者消費者模型架構，我們這篇文章就不具體分析了，後面單獨分析BufferQueue和生產者消費者模式

好了SurfaceFlinger進程的Layer已經創建完成了，再回到SurfaceComposerClient中

status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, uint32_t flags,
                                                     SurfaceControl* parent,
                                                     LayerMetadata metadata) {
    sp<SurfaceControl> sur;
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        sp<IBinder> handle;
        sp<IBinder> parentHandle;
        sp<IGraphicBufferProducer> gbp;

        if (parent != nullptr) {
            parentHandle = parent->getHandle();
        }

        err = mClient->createSurface(name, w, h, format, flags, parentHandle, std::move(metadata),
                                     &handle, &gbp);
        if (err == NO_ERROR) {
            *outSurface = new SurfaceControl(this, handle, gbp, true /* owned */);
        }
    }
    return err;
}

SurfaceFlinger進程的Layer創建好之後，接着通過new創建SurfaceControl，參數handle持有創建的Layer的引用，gbp是BufferQueue的生產者

SurfaceControl構造函數

SurfaceControl::SurfaceControl(
        const sp<SurfaceComposerClient>& client,
        const sp<IBinder>& handle,
        const sp<IGraphicBufferProducer>& gbp,
        bool owned)
    : mClient(client), mHandle(handle), mGraphicBufferProducer(gbp), mOwned(owned),
      mExtension(mHandle, &mGraphicBufferProducer, mOwned)
{
}

構造函數中只是將handle和gbp保存爲全局變量，沒做其他操作，到目前爲止還沒看到Surface在哪裏創建

繼續分析代碼，SurfaceComposerClient的createSurfaceChecked函數已經看完了，回到android_view_SurfaceControl的nativeCreate函數，最終將創建的native層的SurfaceControl返回給java層，

回到java層SurfaceControl中

  private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
            SurfaceControl parent, SparseIntArray metadata)
                    throws OutOfResourcesException, IllegalArgumentException {
            ......
            mNativeObject = nativeCreate(session, name, w, h, format, flags,
                    parent != null ? parent.mNativeObject : 0, metaParcel);
        } finally {
            metaParcel.recycle();
        }
        if (mNativeObject == 0) {
            throw new OutOfResourcesException(
                    "Couldn't allocate SurfaceControl native object");
        }

        mCloseGuard.open("release");
    }

java層SurfaceControl的成員變量mNativeObject保存了native層SurfaceControl的指針

主要注意此時只是創建好了native層和WMS進程的SurfaceControl，最終是需要將WMS進程的SurfaceControl返回給應用進程，我們再看看這一過程實現，之前分析WMS的createSurfaceControl方法時分了兩步：

 private int createSurfaceControl(SurfaceControl outSurfaceControl, int result, WindowState win,
            WindowStateAnimator winAnimator) {
		......
        WindowSurfaceController surfaceController;
        try {
            //步驟1
            surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type, win.mOwnerUid);
        } finally {
           	...
        }
        if (surfaceController != null) {
           //步驟2
            surfaceController.getSurfaceControl(outSurfaceControl);
            
        } else {
            ......
            outSurfaceControl.release();
        }
        return result;
    }

步驟1已經分析完了，現在來看步驟2，outSurfaceControl就是最終返回給應用進程的SurfaceControl對象，來看看getSurfaceControl方法

WindowSurfaceController.getSurfaceControl

void getSurfaceControl(SurfaceControl outSurfaceControl) {
        outSurfaceControl.copyFrom(mSurfaceControl);
    }

mSurfaceControl是步驟1創建的，它的成員變量mNativeObject持有native層的SurfaceControl的指針

來看看SurfaceControl的copyFrom方法

SurfaceControl.copyFrom

  public void copyFrom(SurfaceControl other) {
        mName = other.mName;
        mWidth = other.mWidth;
        mHeight = other.mHeight;
        assignNativeObject(nativeCopyFromSurfaceControl(other.mNativeObject));
    }

nativeCopyFromSurfaceControl這個native函數其實僅僅通過native層SurfaceControl的拷貝構造函數重新深拷貝了一個SurfaceControl，然後assignNativeObject如下所示，將這個深拷貝的SurfaceControl對象指針賦值給了我們應用進程傳遞過來的outSurfaceControl的成員變量mNativeObject

  private void assignNativeObject(long nativeObject) {
        if (mNativeObject != 0) {
            release();
        }
        mNativeObject = nativeObject;
    }

最後再回到ViewRootImpl的relayoutWindow方法

private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
            boolean insetsPending) throws RemoteException {
            ......
			int relayoutResult = mWindowSession.relayout(mWindow, mSeq, params,
                (int) (mView.getMeasuredWidth() * appScale + 0.5f),
                (int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
                insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
                mTmpFrame, mPendingOverscanInsets, mPendingContentInsets, mPendingVisibleInsets,
                mPendingStableInsets, mPendingOutsets, mPendingBackDropFrame, mPendingDisplayCutout,
                mPendingMergedConfiguration, mSurfaceControl, mTempInsets);
           if (mSurfaceControl.isValid()) {
            mSurface.copyFrom(mSurfaceControl);
        } else {
            destroySurface();
        }
                ......

我們前面說過，relayout完成之後如果mSurfaceControl是有效的則通過mSurface的copyFrom來初始化Surface，我們來看看mSurface.copyFrom方法

Surface.copyFrom

public void copyFrom(SurfaceControl other) {
        if (other == null) {
            throw new IllegalArgumentException("other must not be null");
        }

        long surfaceControlPtr = other.mNativeObject;
        if (surfaceControlPtr == 0) {
            throw new NullPointerException(
                    "null SurfaceControl native object. Are you using a released SurfaceControl?");
        }
        long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);

        synchronized (mLock) {
            if (newNativeObject == mNativeObject) {
                return;
            }
            if (mNativeObject != 0) {
                nativeRelease(mNativeObject);
            }
            setNativeObjectLocked(newNativeObject);
        }
    }

這個方法中做了如下幾件事：

surfaceControlPtr會保存SurfaceControl的native指針
調用native方法nativeGetFromSurfaceControl創建Surface的native對象並將其指針保存到newNativeObject
如果步驟2重新獲取的Surface指針和之前保存的不是同一個則調用setNativeObjectLocked方法重新保存

我們主要看看nativeGetFromSurfaceControl方法創建native層Surface的過程，這個方法接收的參數是native層Surface的指針和native層SurfaceControl的指針

nativeGetFromSurfaceControl

static jlong nativeGetFromSurfaceControl(JNIEnv* env, jclass clazz,
        jlong nativeObject,
        jlong surfaceControlNativeObj) {
    Surface* self(reinterpret_cast<Surface *>(nativeObject));
    sp<SurfaceControl> ctrl(reinterpret_cast<SurfaceControl *>(surfaceControlNativeObj));

    // If the underlying IGBP's are the same, we don't need to do anything.
    if (self != nullptr &&
            IInterface::asBinder(self->getIGraphicBufferProducer()) ==
            IInterface::asBinder(ctrl->getIGraphicBufferProducer())) {
        return nativeObject;
    }

    sp<Surface> surface(ctrl->getSurface());
    if (surface != NULL) {
        surface->incStrong(&sRefBaseOwner);
    }

    return reinterpret_cast<jlong>(surface.get());
}

這個函數邏輯就比較簡單了，如果self不爲空，並且Surface的生產者和SurfaceControl的生產者是同一個則之前返回剛java層傳遞下來的nativeObject，不需要再重複創建，我們假設Surface首次創建，則調用SurfaceControl的getSurface函數創建Surface

SurfaceControl::getSurface

sp<Surface> SurfaceControl::getSurface() const
{
    Mutex::Autolock _l(mLock);
    if (mSurfaceData == nullptr) {
        return generateSurfaceLocked();
    }
    return mSurfaceData;
}

繼續調用generateSurfaceLocked函數

SurfaceControl::generateSurfaceLocked

sp<Surface> SurfaceControl::generateSurfaceLocked() const
{
    // This surface is always consumed by SurfaceFlinger, so the
    // producerControlledByApp value doesn't matter; using false.
    mExtension.init();
    mSurfaceData = new Surface(mGraphicBufferProducer, false);

    return mSurfaceData;
}

直接new了一個native層Surface，mGraphicBufferProducer是前面SurfaceFlinger進程創建的生產者，所以Surface和SurfaceControl持有同一個生產者的引用，Surface構造函數中僅僅做了一系列變量的初始化，就不貼代碼了

到這裏Surface和SurfaceControl的創建已經分析完了

我們總結一下整個流程：

首先應用進程會new一個java層SurfaceControl，什麼都沒做，然後傳遞到WMS進程，因爲SurfaceControl在AIDL中是out類型，所以在WMS進程賦值
WMS在創建java層SurfaceControl的同時通過nativeCreate方法到native層做一系列初始化
在SurfaceComposerClient的createSurfaceChecked函數中通過ISurfaceComposerClient的Bp端mClient向SurfaceFlinger進程請求創建Surface，即調用createSurface函數，而在SurfaceFlinger進程Surface對應的是Layer
在第一次創建Layer的子類BufferQueueLayer的過程中，即在BufferQueueLayer的onFirstRef函數中會創建生產者消費者模型架構
SurfaceFlinger進程的任務完成之後會直接new一個SurfaceControl，並將SurfaceFlinger進程創建的Layer引用和生產者保存到SurfaceControl中，最後將native層SurfaceControl指針保存到java層SurfaceControl
native層SurfaceControl創建好了之後就可以通過此對象創建native層的Surface對象，最後將native層Surface指針保存到java層Surface，最終java層和native層的Surface和SurfaceControl都創建完畢

AndroidQ Surface與SurfaceControl創建分析

ViewRootImpl.relayoutWindow

WMS.relayoutWindow

createSurfaceControl

WindowStateAnimator.createSurfaceLocked

WindowSurfaceController構造方法

SurfaceControl.Builder.build

nativeCreate

createSurfaceChecked

Client::createSurface

SurfaceFlinger::createLayer

createBufferQueueLayer

createBufferQueueLayer

onFirstRef

SurfaceControl構造函數

WindowSurfaceController.getSurfaceControl

SurfaceControl.copyFrom

Surface.copyFrom

nativeGetFromSurfaceControl

SurfaceControl::getSurface

SurfaceControl::generateSurfaceLocked

一個開源且全面的C#算法實戰教程

C語言--右移左移

12款高效開源Wiki系統推薦，打造團隊知識管理利器

dotnet 基於 DirectML 控制檯運行 Phi-3 模型

常用的 Git 指令

sm4加密工具類

AndroidQ 圖形系統（10）SurfaceView實現原理之surface創建和繪製原理

AndroidQ 圖形系統（9）SurfaceView實現原理之設置透明區域

AndroidQ FrameLayout的測量流程

AndroidQ 應用層Vsync信號的註冊與接收（上）

AppWindowToken和WindowToken的添加流程和排序規則

Mac下配置sublime實現LaTeX

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結