BLASTBufferQueue端的GraphicBuffer怎么和SurfaceFlinger端的BufferStateLayer关联上

BLASTBufferQueue端的GraphicBuffer怎么和SurfaceFlinger端的BufferStateLayer关联上

引言

在跟进hwc_layer是如何产生的，并如何被填充上GraphicBuffer的，怎么也找不到被填充的GraphicBuffer的来源，最终找到了，它的来源是客户端的BLASTBufferQueue传递过来的，我们这里跟进下这个流程。

这里使用的代码是Android 13 aosp！

一. BLASTBufferQueue是如何传递GraphicBuffer到SurfaceFlinger端的BufferStateLayer的

当BufferQueueProducer完成绘制调用queueBuffer后，会调用BLASTBufferQueue::onFrameAvailable。

///rameworks/native/libs/gui/BLASTBufferQueue.cpp
void BLASTBufferQueue::onFrameAvailable(const BufferItem& item) {
    ...
    acquireNextBufferLocked(mSyncTransaction)
    ...
}

void BLASTBufferQueue::acquireNextBufferLocked(
        const std::optional<SurfaceComposerClient::Transaction*> transaction) {
    ...
    status_t status =
            mBufferItemConsumer->acquireBuffer(&bufferItem, 0 /* expectedPresent */, false); 
    auto buffer = bufferItem.mGraphicBuffer;
    t->setBuffer(mSurfaceControl, buffer, fence, bufferItem.mFrameNumber, releaseBufferCallback);
    t->setApplyToken(mApplyToken).apply(false, true);
    ...
}

apply最终会通过Binder调用到SurfaceFlinger的>setTransactionState，我们接着往下看:

status_t SurfaceFlinger::setTransactionState(
        const FrameTimelineInfo& frameTimelineInfo, const Vector<ComposerState>& states,
        const Vector<DisplayState>& displays, uint32_t flags, const sp<IBinder>& applyToken,
        const InputWindowCommands& inputWindowCommands, int64_t desiredPresentTime,
        bool isAutoTimestamp, const client_cache_t& uncacheBuffer, bool hasListenerCallbacks,
        const std::vector<ListenerCallbacks>& listenerCallbacks, uint64_t transactionId) {
        
        ...
        queueTransaction(state);//将相关的transaction状态存起来
        ...
        
 }       

后续vsync会触发SurfaceFlinger执行如下逻辑:

MessageQueue::Handler::handleMessage
    compositor.commit
        SurfaceFlinger::commit
            flushTransactionQueues
                SurfaceFlinger::applyTransactionState
                    SurfaceFlinger::setClientStateLocked
                        layer->setBuffer
                        
 
 uint32_t SurfaceFlinger::setClientStateLocked(const FrameTimelineInfo& frameTimelineInfo,
                                              ComposerState& composerState,
                                              int64_t desiredPresentTime, bool isAutoTimestamp,
                                              int64_t postTime, uint32_t permissions) {
    layer_state_t& s = composerState.state;
    sp<Layer> layer = nullptr;
    layer = fromHandle(s.surface).promote();//关键点，这个layer是怎么获取的
    if (what & layer_state_t::eBufferChanged) {
        std::shared_ptr<renderengine::ExternalTexture> buffer =
                getExternalTextureFromBufferData(*s.bufferData, layer->getDebugName());//这里并不是真的纹理，而是命名像而已
        if (layer->setBuffer(buffer, *s.bufferData, postTime, desiredPresentTime, isAutoTimestamp,
                             dequeueBufferTimestamp, frameTimelineInfo)) {
            flags |= eTraversalNeeded;
        }
    }
}

这里我们看下fromHandle的实现:

//SurfaceFlinger.cpp
wp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) const {
    return Layer::fromHandle(handle);
}

//Layer.cpp
wp<Layer> Layer::fromHandle(const sp<IBinder>& handleBinder) {
    if (handleBinder == nullptr) {
        return nullptr;
    }

    BBinder* b = handleBinder->localBinder();
    if (b == nullptr || b->getInterfaceDescriptor() != Handle::kDescriptor) {
        return nullptr;
    }

    // We can safely cast this binder since its local and we verified its interface descriptor.
    sp<Handle> handle = static_cast<Handle*>(handleBinder.get());
    return handle->owner;
}

那么这个Layer对应的Handle是什么时候被构建的呢，是什么时候呢。

status_t SurfaceFlinger::createLayer(LayerCreationArgs& args, sp<IBinder>* outHandle,
                                     const sp<IBinder>& parentHandle, int32_t* outLayerId,
                                     const sp<Layer>& parentLayer, uint32_t* outTransformHint) {
    ...
    sp<Layer> layer;       
    createBufferStateLayer(args, outHandle, &layer)
    ...
}    

status_t SurfaceFlinger::createBufferStateLayer(LayerCreationArgs& args, sp<IBinder>* handle,
                                                sp<Layer>* outLayer) {
    args.textureName = getNewTexture();
    *outLayer = getFactory().createBufferStateLayer(args);
    *handle = (*outLayer)->getHandle();
    return NO_ERROR;
}


//frameworks/native/services/surfaceflinger/Layer.cpp
sp<IBinder> Layer::getHandle() {
    Mutex::Autolock _l(mLock);
    if (mGetHandleCalled) {
        ALOGE("Get handle called twice" );
        return nullptr;
    }
    mGetHandleCalled = true;
    return new Handle(mFlinger, this);
}


//frameworks/native/services/surfaceflinger/Layer.h
class Handle : public BBinder, public LayerCleaner {
public:
    Handle(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer)
          : LayerCleaner(flinger, layer, this), owner(layer) {}
    const String16& getInterfaceDescriptor() const override { return kDescriptor; }

    static const String16 kDescriptor;
    wp<Layer> owner;
};
...
}

这里我们要怎么理解这个Handle呢，它是对Layer的一个封装，不管是BufferStateLayer还是其它的，通过它可以让Layer在Binder中传递。

我们接着继续往下看，layer->setBuffer会调用子类的setBuffer，子类是BufferStateLayer

//frameworks/native/services/surfaceflinger/BufferStateLayer.cpp
bool BufferStateLayer::setBuffer(std::shared_ptr<renderengine::ExternalTexture>& buffer,
                                 const BufferData& bufferData, nsecs_t postTime,
                                 nsecs_t desiredPresentTime, bool isAutoTimestamp,
                                 std::optional<nsecs_t> dequeueTime,
                                 const FrameTimelineInfo& info) {
    ...
     mDrawingState.frameNumber = frameNumber;
    mDrawingState.releaseBufferListener = bufferData.releaseBufferListener;
    mDrawingState.buffer = std::move(buffer);
    mDrawingState.clientCacheId = bufferData.cachedBuffer;
    setTransactionFlags(eTransactionNeeded);
    ...
}

这里只是把buffer赋值给mDrawingState.buffer了，肯定有地方把mDrawingState.buffer赋值mBufferInfo.mBuffer；

接着找，在updateActiveBuffer找到了mBufferInfo.mBuffer = s.buffer。updateActiveBuffer又是在哪里调用的呢？

status_t BufferStateLayer::updateActiveBuffer() {
    const State& s(getDrawingState());

    ...
    mBufferInfo.mBuffer = s.buffer;
    mBufferInfo.mFence = s.acquireFence;
    mBufferInfo.mFrameNumber = s.frameNumber;
    ...
}

在BufferStateLayer的父类BufferLayer::latchBuffer里调用:

bool BufferLayer::latchBuffer(bool& recomputeVisibleRegions, nsecs_t latchTime,
                              nsecs_t expectedPresentTime) {
... ...
    status_t err = updateTexImage(recomputeVisibleRegions, latchTime, expectedPresentTime);
 
    err = updateActiveBuffer();
 
    err = updateFrameNumber(latchTime);

接下来看下latchBuffer是在哪里调用的:

MessageQueue::Handler::handleMessage
    compositor.commit
        SurfaceFlinger::commit
            latchBuffers()
            for (const auto& layer : mLayersWithQueuedFrames) {
                if (layer->latchBuffer(visibleRegions, latchTime, expectedPresentTime)) {
                    mLayersPendingRefresh.push_back(layer);
                    newDataLatched = true;
                }
                layer->useSurfaceDamage();
            }            

二. BufferStateLayer的GraphicBuffer怎么传递到hwc_layer中去的

这个我们要知道的是BufferStateLayer的GraphicBuffer最终传递到hwc_layer中，是要经过OputputLayer的，通过前面我们知道此时的GraphicBuffer存储在BufferInfo中，如下:

class BufferLayer : public Layer {
    ...
    struct BufferInfo {
        nsecs_t mDesiredPresentTime;
        std::shared_ptr<FenceTime> mFenceTime;
        sp<Fence> mFence;
        uint32_t mTransform{0};
        ui::Dataspace mDataspace{ui::Dataspace::UNKNOWN};
        Rect mCrop;
        uint32_t mScaleMode{NATIVE_WINDOW_SCALING_MODE_FREEZE};
        Region mSurfaceDamage;
        HdrMetadata mHdrMetadata;
        int mApi;
        PixelFormat mPixelFormat{PIXEL_FORMAT_NONE};
        bool mTransformToDisplayInverse{false};

        std::shared_ptr<renderengine::ExternalTexture> mBuffer;//存放GraphicBuffer
        uint64_t mFrameNumber;
        int mBufferSlot{BufferQueue::INVALID_BUFFER_SLOT};

        bool mFrameLatencyNeeded{false};
    };    
    
    BufferInfo mBufferInfo;
    ...
    
}

我们先看怎么传递到OutputLayer的:

MessageQueue::Handler::handleMessage(...)
    compositor.composite(...)
    SurfaceFlinger::composite(...)
        mCompositionEngine->present(...)//CompositionEngine.cpp
            updateLayerStateFromFE(args)
                output->updateLayerStateFromFE(args)//Output.cpp
                    for (auto* layer : getOutputLayersOrderedByZ()) {
                        layer->getLayerFE().prepareCompositionState(
                                args.updatingGeometryThisFrame ? LayerFE::StateSubset::GeometryAndContent
                                                               : LayerFE::StateSubset::Content);
                    }                    
 
 //frameworks/native/services/surfaceflinger/Layer.cpp
 void Layer::prepareCompositionState(compositionengine::LayerFE::StateSubset subset) {
    using StateSubset = compositionengine::LayerFE::StateSubset;

    switch (subset) {
        case StateSubset::BasicGeometry:
            prepareBasicGeometryCompositionState();
            break;

        case StateSubset::GeometryAndContent:
            prepareBasicGeometryCompositionState();
            prepareGeometryCompositionState();
            preparePerFrameCompositionState();//调用子类BufferLayer的
            break;

        case StateSubset::Content:
            preparePerFrameCompositionState();
            break;

        case StateSubset::Cursor:
            prepareCursorCompositionState();
            break;
    }
}  

//frameworks/native/services/surfaceflinger/BufferLayer.cpp
void BufferLayer::preparePerFrameCompositionState() {
    Layer::preparePerFrameCompositionState();
    ...
    compositionState->buffer = getBuffer();
    compositionState->bufferSlot = (mBufferInfo.mBufferSlot == BufferQueue::INVALID_BUFFER_SLOT)
            ? 0
            : mBufferInfo.mBufferSlot;
    compositionState->acquireFence = mBufferInfo.mFence;
    compositionState->frameNumber = mBufferInfo.mFrameNumber;
    compositionState->sidebandStreamHasFrame = false;
}

分析layer是否参与合成

最简单的SurfaceFlinger应用程序

Android14 SurfaceFlinger-BLASTBufferQueue的创建

Android 14 SurfaceFlinger-Layer visibleRegion的计算过程

SurfaceFlinger的commit/handleTransaction分析

这里重点关注各种State！