SurfaceFlinger 上帧后 releaseBuffer 完整流程分析
概述
本文档详细分析 Android 14 (AOSP) 中 SurfaceFlinger 上帧后 releaseBuffer 的完整流程，涵盖 SurfaceFlinger 端和 App 端的整个链路。
流程概览图
┌─────────────────────────────────────────────────────────────────────────────────────────┐
│ App 进程 │
│ ┌──────────────┐ ┌────────────────────┐ ┌─────────────────────────────────────┐ │
│ │ Producer │───▶│ BLASTBufferQueue │───▶│ TransactionCompletedListener │ │
│ │ ( dequeue │ │ (releaseBufferCallback)│ │ (onReleaseBuffer callback) │ │
│ │ queueBuffer)│ └────────────────────┘ └─────────────────────────────────────┘ │
│ └──────────────┘ │
└─────────────────────────────────────────────────────────────────────────────────────────┘
│
│ Binder IPC (ITransactionCompletedListener)
▼
┌─────────────────────────────────────────────────────────────────────────────────────────┐
│ SurfaceFlinger 进程 │
│ ┌──────────────┐ ┌────────────────────┐ ┌─────────────────────────────────────┐ │
│ │ Layer │───▶│ TransactionCallback│───▶│ ITransactionCompletedListener │ │
│ │(onLayerDisplayed) │ Invoker │ │ (onReleaseBuffer) │ │
│ │(callReleaseBuffer │ (sendCallbacks) │ │ │ │
│ │ Callback) │ │ │ │ │
│ └──────────────┘ └────────────────────┘ └─────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ ┌────────────────────┐ ┌─────────────────────────────────────┐ │
│ │ BufferQueue │───▶│ BufferQueueConsumer│───▶│ IProducerListener │ │
│ │ (Core) │ │ (releaseBuffer) │ │ (onBufferReleased) │ │
│ └──────────────┘ └────────────────────┘ └─────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────────────────┘
第零部分：SurfaceFlinger 主循环完整流程
在深入 releaseBuffer 流程之前，先了解 SurfaceFlinger 的主循环，这对于理解 releaseBuffer 的触发时机至关重要。
0.1 主循环入口：Scheduler::onFrameSignal
SurfaceFlinger 的主循环由 VSync 信号驱动，当 VSync 到来时，Scheduler 会调用 onFrameSignal。
文件路径: frameworks/native/services/surfaceflinger/Scheduler/Scheduler.cpp
// 第 173-220 行
void Scheduler::onFrameSignal(ICompositor& compositor, VsyncId vsyncId,
TimePoint expectedVsyncTime) {
const FrameTargeter::BeginFrameArgs beginFrameArgs = {
.frameBeginTime = SchedulerClock::now(),
.vsyncId = vsyncId,
.expectedVsyncTime = expectedVsyncTime,
.sfWorkDuration = mVsyncModulator->getVsyncConfig().sfWorkDuration
};
// ... 省略部分代码 ...
// 第一步：commit - 处理 transaction，latch buffer
if (!compositor.commit(pacesetterId, targets)) return;
// 第二步：composite - 合成并输出到显示设备
const auto resultsPerDisplay = compositor.composite(pacesetterId, targeters);
// 第三步：sample - 采样统计
compositor.sample();
// ... 省略部分代码 ...
}
0.2 SurfaceFlinger::commit - 处理 Transaction 和 Latch Buffer
文件路径: frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
// 第 2337-2470 行
bool SurfaceFlinger::commit(PhysicalDisplayId pacesetterId,
const scheduler::FrameTargets& frameTargets) {
// ... 省略部分代码 ...
// 1. 处理 transactions
commitTransactions();
// 2. Latch buffers - 将新 buffer 从 Layer 的 drawing state 取出
latchBuffers();
// 3. 发送 onCommit 回调
if (transactionsAreEmpty) {
mTransactionCallbackInvoker.sendCallbacks(false /* onCommitOnly */);
} else {
mTransactionCallbackInvoker.sendCallbacks(true /* onCommitOnly */);
}
// ... 省略部分代码 ...
return mustComposite && CC_LIKELY(mBootStage != BootStage::BOOTLOADER);
}
0.3 SurfaceFlinger::latchBuffers - Latch Layer 的 Buffer
文件路径: frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
// 第 4080-4130 行
bool SurfaceFlinger::latchBuffers() {
ATRACE_CALL();
const nsecs_t latchTime = systemTime();
bool visibleRegions = false;
bool frameQueued = false;
bool newDataLatched = false;
// ... 省略部分代码 ...
// 对于有新帧的 layer，调用 latchBuffer
for (const auto& layer : mLayersWithQueuedFrames) {
if (layer->willReleaseBufferOnLatch()) {
mLayersWithBuffersRemoved.emplace(layer);
}
if (layer->latchBuffer(visibleRegions, latchTime)) {
mLayersPendingRefresh.push_back(layer);
newDataLatched = true;
}
layer->useSurfaceDamage();
}
// 对于离屏 layer，调用 latchAndReleaseBuffer 释放 buffer
for (Layer* offscreenLayer : mOffscreenLayers) {
offscreenLayer->traverse(LayerVector::StateSet::Drawing,
[&](Layer* l) { l->latchAndReleaseBuffer(); });
}
// ... 省略部分代码 ...
}
0.4 SurfaceFlinger::composite - 合成并显示
文件路径: frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
// 第 2530-2650 行
CompositeResultsPerDisplay SurfaceFlinger::composite(
PhysicalDisplayId pacesetterId, const scheduler::FrameTargeters& frameTargeters) {
// ... 省略部分代码 ...
// 构造 CompositionRefreshArgs
compositionengine::CompositionRefreshArgs refreshArgs;
// ... 填充 refreshArgs ...
// 调用 CompositionEngine::present 进行合成
mCompositionEngine->present(refreshArgs);
// ... 省略部分代码 ...
}
0.5 CompositionEngine::present - 遍历所有 Output 进行合成
文件路径: frameworks/native/services/surfaceflinger/CompositionEngine/src/CompositionEngine.cpp
// 第 103-120 行
void CompositionEngine::present(CompositionRefreshArgs& args) {
ATRACE_CALL();
preComposition(args);
{
LayerFESet latchedLayers;
for (const auto& output : args.outputs) {
output->prepare(args, latchedLayers);
}
}
// 对每个 Output 调用 present
for (const auto& output : args.outputs) {
output->present(args);
}
}
0.6 Output::present - 单个 Output 的合成流程
文件路径: frameworks/native/services/surfaceflinger/CompositionEngine/src/Output.cpp
// 第 432-460 行
void Output::present(const compositionengine::CompositionRefreshArgs& refreshArgs) {
ATRACE_FORMAT("%s for %s", __func__, mNamePlusId.c_str());
updateColorProfile(refreshArgs);
updateCompositionState(refreshArgs);
planComposition();
writeCompositionState(refreshArgs);
setColorTransform(refreshArgs);
beginFrame();
// ... GPU 合成相关 ...
devOptRepaintFlash(refreshArgs);
finishFrame(std::move(result));
// 关键：postFramebuffer 会触发 release fence 的传递
postFramebuffer();
renderCachedSets(refreshArgs);
}
第一部分：SurfaceFlinger 端的 releaseBuffer 流程
1.1 触发点：Output::postFramebuffer
当 SurfaceFlinger 完成一帧的合成后，会调用 Output::postFramebuffer，在这里会触发 release fence 的传递。
文件路径: frameworks/native/services/surfaceflinger/CompositionEngine/src/Output.cpp
// 第 1523-1575 行
void Output::postFramebuffer() {
ATRACE_FORMAT("%s for %s", __func__, mNamePlusId.c_str());
if (!getState().isEnabled) {
return;
}
auto& outputState = editState();
outputState.dirtyRegion.clear();
// 获取这一帧的 fence
auto frame = presentAndGetFrameFences();
mRenderSurface->onPresentDisplayCompleted();
// 对于每个显示的 Layer，传递 release fence
for (auto* layer : getOutputLayersOrderedByZ()) {
sp<Fence> releaseFence = Fence::NO_FENCE;
// 从 HWC 获取 release fence
if (auto hwcLayer = layer->getHwcLayer()) {
if (auto f = frame.layerFences.find(hwcLayer); f != frame.layerFences.end()) {
releaseFence = f->second;
}
}
// 如果使用客户端合成，需要合并 client target acquire fence
if (outputState.usesClientComposition) {
releaseFence = Fence::merge("LayerRelease", releaseFence,
frame.clientTargetAcquireFence);
}
// 关键调用：通知 LayerFE 已显示完成，传递 release fence
layer->getLayerFE()
.onLayerDisplayed(ftl::yield<FenceResult>(std::move(releaseFence)).share(),
outputState.layerFilter.layerStack);
}
// 对于已释放的 Layer，传递 present fence
for (auto& weakLayer : mReleasedLayers) {
if (const auto layer = weakLayer.promote()) {
layer->onLayerDisplayed(ftl::yield<FenceResult>(frame.presentFence).share(),
outputState.layerFilter.layerStack);
}
}
mReleasedLayers.clear();
}
1.2 LayerFE::onLayerDisplayed - 存储 Release Fence
LayerFE (Layer Front-End) 接收 release fence 并存储到 CompositionResult 中。
文件路径: frameworks/native/services/surfaceflinger/LayerFE.cpp
// 第 328-332 行
void LayerFE::onLayerDisplayed(ftl::SharedFuture<FenceResult> futureFenceResult,
ui::LayerStack layerStack) {
// 将 release fence 存储到 CompositionResult 中
mCompositionResult.releaseFences.emplace_back(std::move(futureFenceResult), layerStack);
}
1.3 SurfaceFlinger::composite 中处理 CompositionResult
在 SurfaceFlinger::composite 中，调用 mCompositionEngine->present 后，会处理每个 Layer 的 CompositionResult，将 release fence 传递给 Layer。
文件路径: frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
// 第 2606-2620 行
mCompositionEngine->present(refreshArgs);
moveSnapshotsFromCompositionArgs(refreshArgs, layers);
// 处理每个 Layer 的 CompositionResult
for (auto [layer, layerFE] : layers) {
CompositionResult compositionResult{layerFE->stealCompositionResult()};
layer->onPreComposition(compositionResult.refreshStartTime);
// 关键：将 release fence 传递给 Layer
for (auto& [releaseFence, layerStack] : compositionResult.releaseFences) {
Layer* clonedFrom = layer->getClonedFrom().get();
auto owningLayer = clonedFrom ? clonedFrom : layer;
owningLayer->onLayerDisplayed(std::move(releaseFence), layerStack);
}
if (compositionResult.lastClientCompositionFence) {
layer->setWasClientComposed(compositionResult.lastClientCompositionFence);
}
}
1.4 Layer::onLayerDisplayed - 关联 Release Fence 到 CallbackHandle
Layer 接收到 release fence 后，会将其关联到对应的 CallbackHandle。
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 2839-2895 行
void Layer::onLayerDisplayed(ftl::SharedFuture<FenceResult> futureFenceResult,
ui::LayerStack layerStack) {
// 处理多显示情况下的 client composition fence
if (mClearClientCompositionFenceOnLayerDisplayed) {
mLastClientCompositionFence = nullptr;
} else {
mClearClientCompositionFenceOnLayerDisplayed = true;
}
// 查找需要 release fence 的 callback handle
// releasePreviousBuffer 标志表示这个 transaction 需要前一个 buffer 的 release fence
sp<CallbackHandle> ch;
for (auto& handle : mDrawingState.callbackHandles) {
if (handle->releasePreviousBuffer &&
mPreviousReleaseBufferEndpoint == handle->listener) {
ch = handle;
break;
}
}
// 防止重复追踪
if (mPreviousFrameNumber != mPreviousReleasedFrameNumber) {
mPreviousReleasedFrameNumber = mPreviousFrameNumber;
}
if (ch != nullptr) {
// 将 release fence 关联到 callback handle
ch->previousReleaseCallbackId = mPreviousReleaseCallbackId;
ch->previousReleaseFences.emplace_back(std::move(futureFenceResult));
ch->name = mName;
}
mPreviouslyPresentedLayerStacks.push_back(layerStack);
}
1.5 SurfaceFlinger::postComposition - 调用 releasePendingBuffer
在 SurfaceFlinger::composite 完成后，会调用 postComposition，在这里会调用 Layer::releasePendingBuffer。
文件路径: frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
// 第 2796-2900 行
void SurfaceFlinger::postComposition(PhysicalDisplayId pacesetterId,
const scheduler::FrameTargeters& frameTargeters,
TimePoint presentTime) {
// ... 省略部分代码 ...
// 处理 mLayersWithBuffersRemoved (buffer 被移除的 layer)
for (auto layer : mLayersWithBuffersRemoved) {
std::vector<ui::LayerStack> previouslyPresentedLayerStacks =
std::move(layer->mPreviouslyPresentedLayerStacks);
layer->mPreviouslyPresentedLayerStacks.clear();
for (auto layerStack : previouslyPresentedLayerStacks) {
auto optDisplay = layerStackToDisplay.get(layerStack);
if (optDisplay && !optDisplay->get()->isVirtual()) {
auto fence = getHwComposer().getPresentFence(optDisplay->get()->getPhysicalId());
layer->onLayerDisplayed(ftl::yield<FenceResult>(fence).share(),
ui::INVALID_LAYER_STACK);
}
}
// 关键调用：释放 pending buffer
layer->releasePendingBuffer(presentTime.ns());
}
mLayersWithBuffersRemoved.clear();
// 处理 mLayersWithQueuedFrames (有新帧的 layer)
for (const auto& layer: mLayersWithQueuedFrames) {
layer->onPostComposition(pacesetterDisplay.get(), pacesetterGpuCompositionDoneFenceTime,
pacesetterPresentFenceTime, compositorTiming);
// 关键调用：释放 pending buffer
layer->releasePendingBuffer(presentTime.ns());
}
// ... 省略部分代码 ...
// 发送回调给客户端
mTransactionCallbackInvoker.sendCallbacks(false /* onCommitOnly */);
mTransactionCallbackInvoker.clearCompletedTransactions();
}
1.6 Layer::releasePendingBuffer - 发送 Callback 给 TransactionCallbackInvoker
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 2908-2935 行
void Layer::releasePendingBuffer(nsecs_t dequeueReadyTime) {
// 设置 callback handle 的各种信息
for (const auto& handle : mDrawingState.callbackHandles) {
if (mFlinger->mLayerLifecycleManagerEnabled) {
handle->transformHint = mTransformHint;
} else {
handle->transformHint = mSkipReportingTransformHint
? std::nullopt
: std::make_optional<uint32_t>(mTransformHintLegacy);
}
handle->dequeueReadyTime = dequeueReadyTime;
handle->currentMaxAcquiredBufferCount =
mFlinger->getMaxAcquiredBufferCountForCurrentRefreshRate(mOwnerUid);
ATRACE_FORMAT_INSTANT("releasePendingBuffer %s - %" PRIu64, getDebugName(),
handle->previousReleaseCallbackId.framenumber);
}
// 处理 releasePreviousBuffer 的情况
for (auto& handle : mDrawingState.callbackHandles) {
if (handle->releasePreviousBuffer &&
mPreviousReleaseBufferEndpoint == handle->listener) {
handle->previousReleaseCallbackId = mPreviousReleaseCallbackId;
break;
}
}
// 收集 jank 数据
std::vector<JankData> jankData;
transferAvailableJankData(mDrawingState.callbackHandles, jankData);
// 关键调用：将 callback handles 发送给 TransactionCallbackInvoker
mFlinger->getTransactionCallbackInvoker().addCallbackHandles(mDrawingState.callbackHandles,
jankData);
mDrawingState.callbackHandles = {};
}
1.7 TransactionCallbackInvoker::addCallbackHandle - 添加回调信息
文件路径: frameworks/native/services/surfaceflinger/TransactionCallbackInvoker.cpp
// 第 112-170 行
status_t TransactionCallbackInvoker::addCallbackHandle(const sp<CallbackHandle>& handle,
const std::vector<JankData>& jankData) {
// 查找或创建 TransactionStats
TransactionStats* transactionStats;
status_t err = findOrCreateTransactionStats(handle->listener, handle->callbackIds,
&transactionStats);
if (err != NO_ERROR) {
return err;
}
transactionStats->latchTime = handle->latchTime;
sp<IBinder> surfaceControl = handle->surfaceControl.promote();
if (surfaceControl) {
sp<Fence> prevFence = nullptr;
// 合并多个 release fence
for (const auto& future : handle->previousReleaseFences) {
sp<Fence> currentFence = future.get().value_or(Fence::NO_FENCE);
// ... 合并逻辑 ...
}
handle->previousReleaseFence = prevFence;
handle->previousReleaseFences.clear();
// 构造 SurfaceStats，包含 release fence
FrameEventHistoryStats eventStats(...);
transactionStats->surfaceStats.emplace_back(
surfaceControl,
handle->acquireTimeOrFence,
handle->previousReleaseFence, // release fence
handle->transformHint,
handle->currentMaxAcquiredBufferCount,
eventStats,
jankData,
handle->previousReleaseCallbackId);
}
return NO_ERROR;
}
1.8 TransactionCallbackInvoker::sendCallbacks - 发送回调给客户端
文件路径: frameworks/native/services/surfaceflinger/TransactionCallbackInvoker.cpp
// 第 179-243 行
void TransactionCallbackInvoker::sendCallbacks(bool onCommitOnly) {
auto completedTransactionsItr = mCompletedTransactions.begin();
BackgroundExecutor::Callbacks callbacks;
while (completedTransactionsItr != mCompletedTransactions.end()) {
auto& [listener, transactionStatsDeque] = *completedTransactionsItr;
ListenerStats listenerStats;
listenerStats.listener = listener;
auto transactionStatsItr = transactionStatsDeque.begin();
while (transactionStatsItr != transactionStatsDeque.end()) {
auto& transactionStats = *transactionStatsItr;
if (onCommitOnly && !containsOnCommitCallbacks(transactionStats.callbackIds)) {
transactionStatsItr++;
continue;
}
// 设置 present fence
if (transactionStats.latchTime >= 0 &&
!containsOnCommitCallbacks(transactionStats.callbackIds)) {
transactionStats.presentFence = mPresentFence;
}
listenerStats.transactionStats.push_back(std::move(transactionStats));
transactionStatsItr = transactionStatsDeque.erase(transactionStatsItr);
}
// 发送回调给客户端
if (!listenerStats.transactionStats.empty()) {
if (listener->isBinderAlive()) {
callbacks.emplace_back([stats = std::move(listenerStats)]() {
// 通过 Binder IPC 调用客户端的 onTransactionCompleted
interface_cast<ITransactionCompletedListener>(stats.listener)
->onTransactionCompleted(stats);
});
}
}
completedTransactionsItr++;
}
// 在后台线程执行回调
BackgroundExecutor::getInstance().sendCallbacks(std::move(callbacks));
}
1.9 Layer::callReleaseBufferCallback - 直接释放 Buffer
当需要单独释放 buffer 时（如 buffer 被覆盖、layer 销毁等），会直接调用此方法，不经过 TransactionCallbackInvoker。
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 2825-2837 行
void Layer::callReleaseBufferCallback(const sp<ITransactionCompletedListener>& listener,
const sp<GraphicBuffer>& buffer, uint64_t framenumber,
const sp<Fence>& releaseFence) {
if (!listener) {
return;
}
ATRACE_FORMAT_INSTANT("callReleaseBufferCallback %s - %" PRIu64, getDebugName(), framenumber);
uint32_t currentMaxAcquiredBufferCount =
mFlinger->getMaxAcquiredBufferCountForCurrentRefreshRate(mOwnerUid);
// 通过 Binder IPC 直接调用客户端的 onReleaseBuffer
listener->onReleaseBuffer({buffer->getId(), framenumber},
releaseFence ? releaseFence : Fence::NO_FENCE,
currentMaxAcquiredBufferCount);
}
1.10 调用 callReleaseBufferCallback 的场景
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 场景1: setBuffer 时发现已有 buffer 且将被覆盖 (第 3090-3105 行)
bool Layer::setBuffer(const sp<GraphicBuffer>& buffer, ...) {
if (mDrawingState.buffer) {
mReleasePreviousBuffer = true;
if (!mBufferInfo.mBuffer ||
(!mDrawingState.buffer->hasSameBuffer(*mBufferInfo.mBuffer) ||
mDrawingState.frameNumber != mBufferInfo.mFrameNumber)) {
// 前一个 buffer 被丢弃，立即释放
callReleaseBufferCallback(mDrawingState.releaseBufferListener,
mDrawingState.buffer->getBuffer(),
mDrawingState.frameNumber,
mDrawingState.acquireFence);
decrementPendingBufferCount();
// ...
}
}
// ...
}
// 场景2: Layer 销毁时 (第 230-240 行)
Layer::~Layer() {
if (mBufferInfo.mBuffer != nullptr) {
callReleaseBufferCallback(mDrawingState.releaseBufferListener,
mBufferInfo.mBuffer->getBuffer(),
mBufferInfo.mFrameNumber,
mBufferInfo.mFence);
}
// ...
}
// 场景3: latchAndReleaseBuffer - 用于离屏 layer (第 4129-4137 行)
void Layer::latchAndReleaseBuffer() {
if (hasReadyFrame()) {
bool ignored = false;
latchBuffer(ignored, systemTime());
}
releasePendingBuffer(systemTime());
}
第二部分：App 端的 releaseBuffer 回调处理
2.0 ReleaseBufferCallback 的注册流程（关键前置步骤）
在理解 onTransactionCompleted 和 onReleaseBuffer 之前，必须先了解 ReleaseBufferCallback 是如何注册的。
2.0.1 App 端调用 Transaction::setBuffer 时注册回调
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 1686-1710 行
SurfaceComposerClient::Transaction& SurfaceComposerClient::Transaction::setBuffer(
const sp<SurfaceControl>& sc, const sp<GraphicBuffer>& buffer,
const std::optional<sp<Fence>>& fence, const std::optional<uint64_t>& optFrameNumber,
uint32_t producerId, ReleaseBufferCallback callback) {
layer_state_t* s = getLayerState(sc);
if (!s) {
mStatus = BAD_INDEX;
return *this;
}
releaseBufferIfOverwriting(*s);
std::shared_ptr<BufferData> bufferData = std::make_shared<BufferData>();
bufferData->buffer = buffer;
if (buffer) {
uint64_t frameNumber = sc->resolveFrameNumber(optFrameNumber);
bufferData->frameNumber = frameNumber;
bufferData->producerId = producerId;
// ... 设置其他字段 ...
// 关键：设置 releaseBufferEndpoint，用于标识回调接收端
bufferData->releaseBufferEndpoint =
IInterface::asBinder(TransactionCompletedListener::getIInstance());
// 关键：注册 release buffer callback
setReleaseBufferCallback(bufferData.get(), callback);
}
// ...
}
2.0.2 setReleaseBufferCallback 的实现
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 1753-1767 行
void SurfaceComposerClient::Transaction::setReleaseBufferCallback(BufferData* bufferData,
ReleaseBufferCallback callback) {
if (!callback) {
return;
}
if (!bufferData->buffer) {
ALOGW("Transaction::setReleaseBufferCallback ignored trying to set a callback on a null buffer.");
return;
}
// 关键步骤1：设置 releaseBufferListener 为 TransactionCompletedListener
// 这个 listener 会被传递到 SurfaceFlinger，用于发送回调
bufferData->releaseBufferListener = TransactionCompletedListener::getIInstance();
// 关键步骤2：在 TransactionCompletedListener 中注册 callback
// 使用 ReleaseCallbackId (bufferId + frameNumber) 作为 key
auto listener = TransactionCompletedListener::getInstance();
listener->setReleaseBufferCallback(bufferData->generateReleaseCallbackId(), callback);
}
2.0.3 TransactionCompletedListener::setReleaseBufferCallback - 存储回调
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 298-301 行
void TransactionCompletedListener::setReleaseBufferCallback(const ReleaseCallbackId& callbackId,
ReleaseBufferCallback listener) {
std::scoped_lock<std::mutex> lock(mMutex);
// 关键：将 callback 存储在 map 中，key 是 ReleaseCallbackId
mReleaseBufferCallbacks[callbackId] = listener;
}
2.0.4 ReleaseCallbackId 的生成
文件路径: frameworks/native/libs/gui/include/gui/LayerState.h
// BufferData 中的方法
ReleaseCallbackId generateReleaseCallbackId() const {
return ReleaseCallbackId(buffer->getId(), frameNumber);
}
关键理解：
ReleaseCallbackId=bufferId+frameNumber- 这个 ID 在 App 端生成并注册到
mReleaseBufferCallbacksmap - 同时通过 Transaction 传递给 SurfaceFlinger
- SurfaceFlinger 在释放 buffer 时，会使用这个 ID 来标识要释放的是哪个 buffer
2.1 SurfaceFlinger 端如何设置 previousReleaseCallbackId
2.1.1 Layer::gatherBufferInfo - 记录前一个 buffer 的 ReleaseCallbackId
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 3512-3525 行
void Layer::gatherBufferInfo() {
// 关键：在 latch 新 buffer 之前，先记录当前 buffer 的 ReleaseCallbackId
// 这个 ID 对应的是"即将被释放的 buffer"
mPreviousReleaseCallbackId = {getCurrentBufferId(), mBufferInfo.mFrameNumber};
mPreviousReleaseBufferEndpoint = mBufferInfo.mReleaseBufferEndpoint;
if (!mDrawingState.buffer) {
mBufferInfo = {};
return;
}
// 更新 mBufferInfo 为新 latch 的 buffer
mBufferInfo.mBuffer = mDrawingState.buffer;
mBufferInfo.mReleaseBufferEndpoint = mDrawingState.releaseBufferEndpoint;
// ...
}
关键理解：
mPreviousReleaseCallbackId记录的是当前正在显示的 buffer（即将被释放）- 当新 buffer 被 latch 时，当前显示的 buffer 就变成了"前一个 buffer"
- 这个 ID 会被传递给客户端，用于查找对应的 callback
2.1.2 Layer::releasePendingBuffer - 传递 previousReleaseCallbackId
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 2908-2935 行
void Layer::releasePendingBuffer(nsecs_t dequeueReadyTime) {
// ... 设置其他字段 ...
// 关键：将 previousReleaseCallbackId 传递给 callback handle
for (auto& handle : mDrawingState.callbackHandles) {
if (handle->releasePreviousBuffer &&
mPreviousReleaseBufferEndpoint == handle->listener) {
handle->previousReleaseCallbackId = mPreviousReleaseCallbackId;
break;
}
}
// 发送给 TransactionCallbackInvoker
mFlinger->getTransactionCallbackInvoker().addCallbackHandles(mDrawingState.callbackHandles,
jankData);
mDrawingState.callbackHandles = {};
}
2.2 TransactionCompletedListener::onTransactionCompleted - 处理回调
App 端通过 ITransactionCompletedListener 接收 transaction 完成回调，其中包含 release fence 和 previousReleaseCallbackId。
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 336-460 行
void TransactionCompletedListener::onTransactionCompleted(ListenerStats listenerStats) {
// 构建回调 map
std::unordered_map<CallbackId, CallbackTranslation, CallbackIdHash> callbacksMap;
std::multimap<int32_t, sp<JankDataListener>> jankListenersMap;
{
std::lock_guard<std::mutex> lock(mMutex);
callbacksMap = mCallbacks;
jankListenersMap = mJankListeners;
// 清理已处理的 callback
for (const auto& transactionStats : listenerStats.transactionStats) {
for (auto& callbackId : transactionStats.callbackIds) {
mCallbacks.erase(callbackId);
}
}
}
// 处理每个 transaction
for (const auto& transactionStats : listenerStats.transactionStats) {
for (auto callbackId : transactionStats.callbackIds) {
if (callbackId.type != CallbackId::Type::ON_COMPLETE) {
continue;
}
// ... 处理 transaction callback ...
// 处理每个 surface 的统计信息
for (const auto& surfaceStats : transactionStats.surfaceStats) {
// ... 构造 SurfaceControlStats ...
// 关键：检查是否有 release buffer callback 需要处理
// previousReleaseCallbackId 标识了需要释放的 buffer
if (surfaceStats.previousReleaseCallbackId != ReleaseCallbackId::INVALID_ID) {
ReleaseBufferCallback callback;
{
std::scoped_lock<std::mutex> lock(mMutex);
// 关键：从 mReleaseBufferCallbacks map 中查找对应的 callback
// 使用 SurfaceFlinger 传来的 previousReleaseCallbackId 作为 key
callback = popReleaseBufferCallbackLocked(
surfaceStats.previousReleaseCallbackId);
}
if (callback) {
// 找到 callback，直接调用
// 这是一个性能优化：避免额外的 IPC 调用
callback(surfaceStats.previousReleaseCallbackId,
surfaceStats.previousReleaseFence
? surfaceStats.previousReleaseFence
: Fence::NO_FENCE,
surfaceStats.currentMaxAcquiredBufferCount);
}
}
}
}
}
}
关键理解：
surfaceStats.previousReleaseCallbackId是 SurfaceFlinger 传来的，标识需要释放的 buffer- 使用这个 ID 从
mReleaseBufferCallbacksmap 中查找对应的 callback - 如果找到，直接在
onTransactionCompleted中调用，避免额外的 IPC
2.3 TransactionCompletedListener::onReleaseBuffer - 单独的释放路径
当 SurfaceFlinger 直接调用 onReleaseBuffer 时（通过 Layer::callReleaseBufferCallback），会走这个路径。
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 511-530 行
void TransactionCompletedListener::onReleaseBuffer(ReleaseCallbackId callbackId,
sp<Fence> releaseFence,
uint32_t currentMaxAcquiredBufferCount) {
ReleaseBufferCallback callback;
{
std::scoped_lock<std::mutex> lock(mMutex);
// 同样从 mReleaseBufferCallbacks map 中查找 callback
callback = popReleaseBufferCallbackLocked(callbackId);
}
if (!callback) {
ALOGE("Could not call release buffer callback, buffer not found %s",
callbackId.to_string().c_str());
return;
}
std::optional<uint32_t> optionalMaxAcquiredBufferCount =
currentMaxAcquiredBufferCount == UINT_MAX
? std::nullopt
: std::make_optional<uint32_t>(currentMaxAcquiredBufferCount);
// 执行回调
callback(callbackId, releaseFence, optionalMaxAcquiredBufferCount);
}
2.4 popReleaseBufferCallbackLocked - 从 map 中取出回调
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 531-540 行
ReleaseBufferCallback TransactionCompletedListener::popReleaseBufferCallbackLocked(
const ReleaseCallbackId& callbackId) {
ReleaseBufferCallback callback;
// 在 mReleaseBufferCallbacks map 中查找
auto itr = mReleaseBufferCallbacks.find(callbackId);
if (itr == mReleaseBufferCallbacks.end()) {
return nullptr; // 没找到，可能已经被处理过
}
callback = itr->second;
// 取出后从 map 中删除，避免重复调用
mReleaseBufferCallbacks.erase(itr);
return callback;
}
2.5 两种 Release 路径的对比
┌─────────────────────────────────────────────────────────────────────────────────────┐
│ ReleaseBufferCallback 的两条路径 │
├─────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ 路径1: 通过 onTransactionCompleted (正常流程，性能优化) │
│ ───────────────────────────────────────────────────────────────────────────────── │
│ │
│ SurfaceFlinger: │
│ Layer::gatherBufferInfo() → 设置 mPreviousReleaseCallbackId │
│ Layer::releasePendingBuffer() → 传递 previousReleaseCallbackId 到 CallbackHandle │
│ TransactionCallbackInvoker → 将 previousReleaseCallbackId 放入 SurfaceStats │
│ sendCallbacks() → 调用 onTransactionCompleted │
│ │
│ App: │
│ onTransactionCompleted() → 检查 surfaceStats.previousReleaseCallbackId │
│ → popReleaseBufferCallbackLocked(previousReleaseCallbackId) │
│ → 直接调用 callback (避免额外 IPC) │
│ │
├─────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ 路径2: 通过 onReleaseBuffer (快速路径，用于 buffer 被覆盖等场景) │
│ ───────────────────────────────────────────────────────────────────────────────── │
│ │
│ SurfaceFlinger: │
│ Layer::setBuffer() 发现 buffer 被覆盖 │
│ → callReleaseBufferCallback() → 直接调用 onReleaseBuffer │
│ │
│ App: │
│ onReleaseBuffer() → popReleaseBufferCallbackLocked(callbackId) │
│ → 调用 callback │
│ │
└─────────────────────────────────────────────────────────────────────────────────────┘
为什么需要两条路径？
-
路径1 (onTransactionCompleted)：
- 正常的 buffer 显示完成后释放
- release fence 和 transaction callback 一起发送，减少 IPC 次数
- 性能优化：一次 IPC 完成两件事
-
路径2 (onReleaseBuffer)：
- buffer 被覆盖、layer 销毁等异常场景
- 没有 transaction callback 关联
- 需要单独的 IPC 调用
2.6 BLASTBufferQueue::releaseBufferCallback
BLASTBufferQueue 是 App 端管理 buffer 的核心类，它注册了 releaseBuffer callback。
文件路径: frameworks/native/libs/gui/BLASTBufferQueue.cpp
// 第 392-420 行
// 静态回调函数
static void releaseBufferCallbackThunk(wp<BLASTBufferQueue> context,
const ReleaseCallbackId& id,
const sp<Fence>& releaseFence,
std::optional<uint32_t> currentMaxAcquiredBufferCount) {
sp<BLASTBufferQueue> blastBufferQueue = context.promote();
if (blastBufferQueue) {
blastBufferQueue->releaseBufferCallback(id, releaseFence, currentMaxAcquiredBufferCount);
}
}
// 第 412-420 行
void BLASTBufferQueue::releaseBufferCallback(
const ReleaseCallbackId& id, const sp<Fence>& releaseFence,
std::optional<uint32_t> currentMaxAcquiredBufferCount) {
std::lock_guard _lock{mMutex};
BBQ_TRACE();
releaseBufferCallbackLocked(id, releaseFence, currentMaxAcquiredBufferCount,
false /* fakeRelease */);
}
// 第 421-470 行
void BLASTBufferQueue::releaseBufferCallbackLocked(
const ReleaseCallbackId& id, const sp<Fence>& releaseFence,
std::optional<uint32_t> currentMaxAcquiredBufferCount, bool fakeRelease) {
ATRACE_CALL();
BQA_LOGV("releaseBufferCallback %s", id.to_string().c_str());
// 计算 EGL 客户端需要持有的 buffer 数量
const auto it = mSubmitted.find(id);
const bool isEGL = it != mSubmitted.end() && it->second.mApi == NATIVE_WINDOW_API_EGL;
if (currentMaxAcquiredBufferCount) {
mCurrentMaxAcquiredBufferCount = *currentMaxAcquiredBufferCount;
}
const uint32_t numPendingBuffersToHold =
isEGL ? std::max(0, mMaxAcquiredBuffers - (int32_t)mCurrentMaxAcquiredBufferCount) : 0;
// 将 buffer 加入待释放队列
auto rb = ReleasedBuffer{id, releaseFence};
if (std::find(mPendingRelease.begin(), mPendingRelease.end(), rb) == mPendingRelease.end()) {
mPendingRelease.emplace_back(rb);
}
// 释放超出持有数量的 buffer
while (mPendingRelease.size() > numPendingBuffersToHold) {
const auto releasedBuffer = mPendingRelease.front();
mPendingRelease.pop_front();
releaseBuffer(releasedBuffer.callbackId, releasedBuffer.releaseFence);
if (mSyncedFrameNumbers.empty()) {
acquireNextBufferLocked(std::nullopt);
}
}
}
2.4 BLASTBufferQueue::releaseBuffer - 实际释放 Buffer
文件路径: frameworks/native/libs/gui/BLASTBufferQueue.cpp
// 第 471-485 行
void BLASTBufferQueue::releaseBuffer(const ReleaseCallbackId& callbackId,
const sp<Fence>& releaseFence) {
// 从 mSubmitted map 中查找对应的 buffer
auto it = mSubmitted.find(callbackId);
if (it == mSubmitted.end()) {
BQA_LOGE("ERROR: releaseBufferCallback without corresponding submitted buffer %s",
callbackId.to_string().c_str());
return;
}
mNumAcquired--;
BBQ_TRACE("frame=%" PRIu64, callbackId.framenumber);
BQA_LOGV("released %s", callbackId.to_string().c_str());
// 关键调用：通过 BufferItemConsumer 释放 buffer
mBufferItemConsumer->releaseBuffer(it->second, releaseFence);
mSubmitted.erase(it);
mSyncedFrameNumbers.erase(callbackId.framenumber);
}
2.5 BufferItemConsumer::releaseBuffer
BufferItemConsumer 封装了 buffer 的释放操作。
文件路径: frameworks/native/libs/gui/BufferItemConsumer.cpp
// 第 88-105 行
status_t BufferItemConsumer::releaseBuffer(const BufferItem &item,
const sp<Fence>& releaseFence) {
status_t err;
Mutex::Autolock _l(mMutex);
// 添加 release fence
err = addReleaseFenceLocked(item.mSlot, item.mGraphicBuffer, releaseFence);
if (err != OK) {
BI_LOGE("Failed to addReleaseFenceLocked");
}
// 调用父类的 releaseBufferLocked
err = releaseBufferLocked(item.mSlot, item.mGraphicBuffer, EGL_NO_DISPLAY,
EGL_NO_SYNC_KHR);
if (err != OK && err != IGraphicBufferConsumer::STALE_BUFFER_SLOT) {
BI_LOGE("Failed to release buffer: %s (%d)",
strerror(-err), err);
}
return err;
}
2.6 ConsumerBase::releaseBufferLocked
ConsumerBase 是 BufferItemConsumer 的父类，实现了通用的 buffer 释放逻辑。
文件路径: frameworks/native/libs/gui/ConsumerBase.cpp
// 第 480-510 行
status_t ConsumerBase::releaseBufferLocked(
int slot, const sp<GraphicBuffer> graphicBuffer,
EGLDisplay display, EGLSyncKHR eglFence) {
if (mAbandoned) {
CB_LOGE("releaseBufferLocked: ConsumerBase is abandoned!");
return NO_INIT;
}
// 检查是否仍在跟踪这个 buffer
if (!stillTracking(slot, graphicBuffer)) {
return OK;
}
CB_LOGV("releaseBufferLocked: slot=%d/%" PRIu64,
slot, mSlots[slot].mFrameNumber);
// 关键调用：通过 IGraphicBufferConsumer 释放 buffer
status_t err = mConsumer->releaseBuffer(slot, mSlots[slot].mFrameNumber,
display, eglFence, mSlots[slot].mFence);
if (err == IGraphicBufferConsumer::STALE_BUFFER_SLOT) {
freeBufferLocked(slot);
}
mPrevFinalReleaseFence = mSlots[slot].mFence;
mSlots[slot].mFence = Fence::NO_FENCE;
return err;
}
2.7 BufferQueueConsumer::releaseBuffer - 归还 Buffer 给 Producer
BufferQueueConsumer 是 BufferQueue 的消费者端，负责将 buffer 归还给生产者。
文件路径: frameworks/native/libs/gui/BufferQueueConsumer.cpp
// 第 443-505 行
status_t BufferQueueConsumer::releaseBuffer(int slot, uint64_t frameNumber,
const sp<Fence>& releaseFence, EGLDisplay eglDisplay,
EGLSyncKHR eglFence) {
ATRACE_CALL();
ATRACE_BUFFER_INDEX(slot);
if (slot < 0 || slot >= BufferQueueDefs::NUM_BUFFER_SLOTS ||
releaseFence == nullptr) {
BQ_LOGE("releaseBuffer: slot %d out of range or fence %p NULL", slot,
releaseFence.get());
return BAD_VALUE;
}
sp<IProducerListener> listener;
{
std::lock_guard<std::mutex> lock(mCore->mMutex);
// 检查 frame number 是否匹配
if (frameNumber != mSlots[slot].mFrameNumber &&
!mSlots[slot].mBufferState.isShared()) {
return STALE_BUFFER_SLOT;
}
if (!mSlots[slot].mBufferState.isAcquired()) {
BQ_LOGE("releaseBuffer: attempted to release buffer slot %d "
"but its state was %s", slot,
mSlots[slot].mBufferState.string());
return BAD_VALUE;
}
// 更新 slot 状态
mSlots[slot].mEglDisplay = eglDisplay;
mSlots[slot].mEglFence = eglFence;
mSlots[slot].mFence = releaseFence;
mSlots[slot].mBufferState.release(); // ACQUIRED -> RELEASED
// 处理 shared buffer mode
if (!mCore->mSharedBufferMode && mSlots[slot].mBufferState.isFree()) {
mSlots[slot].mBufferState.mShared = false;
}
// 将 slot 从 active 移到 free
if (!mSlots[slot].mBufferState.isShared()) {
mCore->mActiveBuffers.erase(slot);
mCore->mFreeBuffers.push_back(slot);
}
// 获取 producer listener
if (mCore->mBufferReleasedCbEnabled) {
listener = mCore->mConnectedProducerListener;
}
BQ_LOGV("releaseBuffer: releasing slot %d", slot);
// 通知等待 dequeue 的线程
mCore->mDequeueCondition.notify_all();
}
// 在锁外调用回调，通知 Producer buffer 已释放
if (listener != nullptr) {
listener->onBufferReleased();
}
return NO_ERROR;
}
第三部分：mDequeueCondition.notify_all() 的作用详解
3.1 核心问题解答
是的，mCore->mDequeueCondition.notify_all() 表示这个 buffer 又可以被 dequeue 了。
当 Consumer 调用 releaseBuffer 释放 buffer 后，这个 buffer 从 ACQUIRED 状态变为 FREE 状态，并被加入到 mFreeBuffers 列表中。此时调用 notify_all() 会唤醒正在等待的 Producer 线程，让它们可以 dequeueBuffer 获取这个 buffer。
3.2 mDequeueCondition 的定义
文件路径: frameworks/native/libs/gui/include/gui/BufferQueueCore.h
// 第 218-220 行
// mDequeueCondition is a condition variable used for dequeueBuffer in
// synchronous mode.
mutable std::condition_variable mDequeueCondition;
关键数据结构：
// 第 193-210 行
// mFreeSlots contains all of the slots which are FREE and do not currently
// have a buffer attached.
std::set<int> mFreeSlots;
// mFreeBuffers contains all of the slots which are FREE and currently have
// a buffer attached.
std::list<int> mFreeBuffers;
// mActiveBuffers contains all slots which have a non-FREE buffer attached.
std::set<int> mActiveBuffers;
3.3 Producer 端：dequeueBuffer 等待 Free Buffer
文件路径: frameworks/native/libs/gui/BufferQueueProducer.cpp
// 第 281-380 行
status_t BufferQueueProducer::waitForFreeSlotThenRelock(FreeSlotCaller caller,
std::unique_lock<std::mutex>& lock, int* found) const {
auto callerString = (caller == FreeSlotCaller::Dequeue) ?
"dequeueBuffer" : "attachBuffer";
bool tryAgain = true;
while (tryAgain) {
// ... 检查 buffer 状态 ...
*found = BufferQueueCore::INVALID_BUFFER_SLOT;
// 检查是否 too many buffers queued
const int maxBufferCount = mCore->getMaxBufferCountLocked();
bool tooManyBuffers = mCore->mQueue.size()
> static_cast<size_t>(maxBufferCount);
if (tooManyBuffers) {
BQ_LOGV("%s: queue size is %zu, waiting", callerString,
mCore->mQueue.size());
} else {
// 尝试从 mFreeBuffers 获取一个 free buffer
if (caller == FreeSlotCaller::Dequeue) {
int slot = getFreeBufferLocked();
if (slot != BufferQueueCore::INVALID_BUFFER_SLOT) {
*found = slot;
} else if (mCore->mAllowAllocation) {
*found = getFreeSlotLocked();
}
}
// ...
}
// 关键：如果没有找到 free buffer，或者 too many buffers，则等待
// 注释明确说明：wait for a buffer to be acquired or released
tryAgain = (*found == BufferQueueCore::INVALID_BUFFER_SLOT) ||
tooManyBuffers;
if (tryAgain) {
// 非阻塞模式直接返回
if ((mCore->mDequeueBufferCannotBlock || mCore->mAsyncMode) &&
(acquiredCount <= mCore->mMaxAcquiredBufferCount)) {
return WOULD_BLOCK;
}
// 关键：等待 mDequeueCondition
// 当 Consumer releaseBuffer 时会被唤醒
if (mDequeueTimeout >= 0) {
std::cv_status result = mCore->mDequeueCondition.wait_for(lock,
std::chrono::nanoseconds(mDequeueTimeout));
if (result == std::cv_status::timeout) {
return TIMED_OUT;
}
} else {
// 无限等待，直到被 notify
mCore->mDequeueCondition.wait(lock);
}
}
} // while (tryAgain)
return NO_ERROR;
}
3.4 getFreeBufferLocked - 从 mFreeBuffers 获取 Free Buffer
文件路径: frameworks/native/libs/gui/BufferQueueProducer.cpp
// 第 265-272 行
int BufferQueueProducer::getFreeBufferLocked() const {
if (mCore->mFreeBuffers.empty()) {
return BufferQueueCore::INVALID_BUFFER_SLOT; // 没有 free buffer
}
// 从 mFreeBuffers 列表头部取出一个 slot
int slot = mCore->mFreeBuffers.front();
mCore->mFreeBuffers.pop_front();
return slot;
}
3.5 Consumer 端：releaseBuffer 释放 Buffer 并唤醒等待者
文件路径: frameworks/native/libs/gui/BufferQueueConsumer.cpp
// 第 443-505 行
status_t BufferQueueConsumer::releaseBuffer(int slot, uint64_t frameNumber,
const sp<Fence>& releaseFence, EGLDisplay eglDisplay,
EGLSyncKHR eglFence) {
ATRACE_CALL();
ATRACE_BUFFER_INDEX(slot);
// ... 参数检查 ...
sp<IProducerListener> listener;
{
std::lock_guard<std::mutex> lock(mCore->mMutex);
// ... 状态检查 ...
// 关键步骤1：更新 buffer 状态
// BufferState::release() 会减少 mAcquireCount
// 当 mAcquireCount 变为 0 时，isAcquired() 返回 false
// 此时 isFree() 返回 true（因为 !isAcquired() && !isDequeued() && !isQueued()）
mSlots[slot].mBufferState.release();
// 关键步骤2：处理 shared buffer mode
if (!mCore->mSharedBufferMode && mSlots[slot].mBufferState.isFree()) {
mSlots[slot].mBufferState.mShared = false;
}
// 关键步骤3：将 slot 从 mActiveBuffers 移到 mFreeBuffers
// 这样 dequeueBuffer 就可以获取这个 buffer 了
if (!mSlots[slot].mBufferState.isShared()) {
mCore->mActiveBuffers.erase(slot); // 从 active 移除
mCore->mFreeBuffers.push_back(slot); // 加入 free 列表
}
if (mCore->mBufferReleasedCbEnabled) {
listener = mCore->mConnectedProducerListener;
}
BQ_LOGV("releaseBuffer: releasing slot %d", slot);
// 关键步骤4：通知等待 dequeue 的线程
// 这会唤醒在 waitForFreeSlotThenRelock 中 wait 的 Producer 线程
mCore->mDequeueCondition.notify_all();
VALIDATE_CONSISTENCY();
} // Autolock scope
// 在锁外调用回调，通知 Producer buffer 已释放
if (listener != nullptr) {
listener->onBufferReleased();
}
return NO_ERROR;
}
3.6 BufferState::release() - 状态转换
文件路径: frameworks/native/libs/gui/include/gui/BufferSlot.h
// 第 100-110 行
// ACQUIRED indicates that the buffer has been acquired by the consumer. As
// with QUEUED, the contents must not be accessed by the consumer until the
// acquire fence is signaled. The slot is "owned" by the consumer. It
// transitions to FREE when releaseBuffer (or detachBuffer) is called. A
// detached buffer can also enter the ACQUIRED state via attachBuffer.
// 第 130-140 行
inline bool isFree() const {
return !isAcquired() && !isDequeued() && !isQueued();
}
inline bool isAcquired() const {
return mAcquireCount > 0;
}
// 第 165-170 行
inline void release() {
if (mAcquireCount > 0) {
mAcquireCount--;
}
}
3.7 完整的 Buffer 状态流转图
┌─────────────────────────────────────────────────────────────────────────────────────┐
│ Buffer 状态流转 │
├─────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────┐ dequeueBuffer ┌──────────┐ queueBuffer ┌──────────┐ │
│ │ FREE │ ─────────────────▶ │ DEQUEUED │ ───────────────▶ │ QUEUED │ │
│ └──────────┘ └──────────┘ └──────────┘ │
│ ▲ │ │
│ │ │ │
│ │ cancelBuffer │ │
│ └────────────────────────────────────────────────────────────────┘ │
│ │ │ │
│ │ ▼ │
│ │ ┌──────────┐ │
│ │ │ ACQUIRED │ │
│ │ └──────────┘ │
│ │ │ │
│ │ releaseBuffer │ │
│ └────────────────────────────────────────────────────────────────┘ │
│ │
│ 关键操作： │
│ - releaseBuffer: ACQUIRED → FREE │
│ 1. mBufferState.release() → mAcquireCount-- │
│ 2. mActiveBuffers.erase(slot) │
│ 3. mFreeBuffers.push_back(slot) │
│ 4. mDequeueCondition.notify_all() ← 唤醒等待的 dequeueBuffer │
│ │
└─────────────────────────────────────────────────────────────────────────────────────┘
3.8 时序图：releaseBuffer 唤醒 dequeueBuffer
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Producer │ │ BufferQueue │ │ Consumer │
│ (App 端) │ │ (Core) │ │ (SurfaceFlinger)│
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
│ │ │
│ dequeueBuffer() │ │
│─────────────────────────────────────▶│ │
│ │ │
│ │ mFreeBuffers.empty()? │
│ │ ────┐ │
│ │ │ 是 → wait(mDequeueCondition) │
│ │ <───┘ │
│ │ │
│ (Producer 线程阻塞等待) │ │
│ │ │
│ │ acquireBuffer() │
│ │◀─────────────────────────────────────│
│ │ │
│ │ ... 显示 buffer ... │
│ │ │
│ │ releaseBuffer() │
│ │◀─────────────────────────────────────│
│ │ │
│ │ mBufferState.release() │
│ │ → mAcquireCount-- │
│ │ │
│ │ mActiveBuffers.erase(slot) │
│ │ mFreeBuffers.push_back(slot) │
│ │ │
│ │ mDequeueCondition.notify_all() │
│ │ ────┐ │
│◀─────────────────────────────────────│ │ 唤醒等待的 Producer 线程 │
│ │ <───┘ │
│ │ │
│ 从 mFreeBuffers 获取 slot │ │
│◀─────────────────────────────────────│ │
│ │ │
│ 返回 free buffer slot │ │
│ │ │
3.9 为什么需要 notify_all 而不是 notify_one？
使用 notify_all() 而不是 notify_one() 的原因：
-
可能有多个 Producer 线程在等待：在多线程应用中，可能有多个线程同时尝试 dequeue buffer
-
条件变量唤醒后需要重新检查条件：被唤醒的线程会重新检查
mFreeBuffers.empty()和其他条件，只有真正有 free buffer 的线程才能继续执行 -
其他状态变化也需要通知：
mDequeueCondition不仅用于 buffer 释放，还用于：setMaxDequeuedBufferCount改变时setAsyncMode改变时disconnect时- buffer allocation 完成时
3.10 其他调用 mDequeueCondition.notify_all() 的场景
文件路径: frameworks/native/libs/gui/BufferQueueConsumer.cpp
// 场景1: connect (第 299 行)
status_t BufferQueueConsumer::connect(...) {
// ...
mCore->mDequeueCondition.notify_all();
}
// 场景2: disconnect (第 553 行)
status_t BufferQueueConsumer::disconnect() {
// ...
mCore->mIsAbandoned = true;
mCore->mQueue.clear();
mCore->freeAllBuffersLocked();
mCore->mDequeueCondition.notify_all(); // 唤醒等待的线程，让它们返回错误
}
文件路径: frameworks/native/libs/gui/BufferQueueProducer.cpp
// 场景3: setMaxDequeuedBufferCount (第 200 行)
status_t BufferQueueProducer::setMaxDequeuedBufferCount(...) {
// ...
mCore->mDequeueCondition.notify_all();
}
// 场景4: setAsyncMode (第 252 行)
status_t BufferQueueProducer::setAsyncMode(...) {
// ...
mCore->mDequeueCondition.notify_all();
}
// 场景5: queueBuffer (第 702 行)
status_t BufferQueueProducer::queueBuffer(...) {
// ...
mCore->mDequeueCondition.notify_all();
}
// 场景6: cancelBuffer (第 1039 行)
status_t BufferQueueProducer::cancelBuffer(...) {
// ...
mCore->mDequeueCondition.notify_all();
}
// 场景7: disconnect (第 1176 行)
status_t BufferQueueProducer::disconnect(...) {
// ...
mCore->mDequeueCondition.notify_all();
}
第四部分：完整流程时序图
┌──────────────┐ ┌────────────┐ ┌───────────────┐ ┌──────────────┐ ┌──────────────┐ ┌─────────────┐
│ VSync │ │ Scheduler │ │SurfaceFlinger │ │ Output │ │ Layer │ │ App Process│
│ Signal │ │ │ │ │ │ │ │ │ │ │
└──────┬───────┘ └─────┬──────┘ └──────┬────────┘ └──────┬───────┘ └──────┬───────┘ └──────┬──────┘
│ │ │ │ │ │
│ VSync │ │ │ │ │
│──────────────▶│ │ │ │ │
│ │ │ │ │ │
│ │ onFrameSignal │ │ │ │
│ │──────────────▶│ │ │ │
│ │ │ │ │ │
│ │ │ commit() │ │ │
│ │ │────────────────▶│ │ │
│ │ │ │ │ │
│ │ │ │ latchBuffer() │ │
│ │ │ │───────────────▶│ │
│ │ │ │ │ │
│ │ │ composite() │ │ │
│ │ │────────────────▶│ │ │
│ │ │ │ │ │
│ │ │ │ present() │ │
│ │ │ │───────────────▶│ │
│ │ │ │ │ │
│ │ │ │ postFramebuffer() │
│ │ │ │───────────────▶│ │
│ │ │ │ │ │
│ │ │ │ onLayerDisplayed() │
│ │ │ │───────────────▶│ │
│ │ │ │ │ │
│ │ │ postComposition() │ │
│ │ │─────────────────────────────────▶│ │
│ │ │ │ │ │
│ │ │ │ │ releasePendingBuffer()
│ │ │ │ │────────────────▶
│ │ │ │ │ │
│ │ │ │ │ TransactionCallbackInvoker
│ │ │ │ │ .sendCallbacks()│
│ │ │ │ │────────────────▶
│ │ │ │ │ │
│ │ │ │ │ │ ▼
│ │ │ │ │ │ onTransactionCompleted
│ │ │ │ │ │ (with release fence)
│ │ │ │ │ │
│ │ │ │ │ │ ▼
│ │ │ │ │ │ BLASTBufferQueue
│ │ │ │ │ │ .releaseBufferCallback
│ │ │ │ │ │
│ │ │ │ │ │ ▼
│ │ │ │ │ │ BufferItemConsumer
│ │ │ │ │ │ .releaseBuffer
│ │ │ │ │ │
│ │ │ │ │ │ ▼
│ │ │ │ │ │ BufferQueueConsumer
│ │ │ │ │ │ .releaseBuffer
│ │ │ │ │ │
│ │ │ │ │ │ ▼
│ │ │ │ │ │ IProducerListener
│ │ │ │ │ │ .onBufferReleased
│ │ │ │ │ │
│ │ │ │ │ │ ▼
│ │ │ │ │ │ Producer can
│ │ │ │ │ │ dequeueBuffer
第四部分：关键数据结构
4.1 ReleaseCallbackId
文件路径: frameworks/native/libs/gui/include/gui/ITransactionCompletedListener.h
struct ReleaseCallbackId {
uint64_t bufferId;
uint64_t framenumber;
ReleaseCallbackId() : bufferId(0), framenumber(0) {}
ReleaseCallbackId(uint64_t bufferId, uint64_t framenumber)
: bufferId(bufferId), framenumber(framenumber) {}
std::string to_string() const {
return "bufferId:" + std::to_string(bufferId) +
" framenumber:" + std::to_string(framenumber);
}
};
4.2 CallbackHandle
文件路径: frameworks/native/services/surfaceflinger/Layer.h
class CallbackHandle {
public:
sp<IBinder> listener; // ITransactionCompletedListener
std::vector<CallbackId> callbackIds;
wp<IBinder> surfaceControl;
// Release buffer 相关字段
ReleaseCallbackId previousReleaseCallbackId;
sp<Fence> previousReleaseFence;
std::vector<ftl::SharedFuture<FenceResult>> previousReleaseFences;
bool releasePreviousBuffer = false;
// 其他字段
nsecs_t latchTime = -1;
std::variant<nsecs_t, sp<Fence>> acquireTimeOrFence;
std::optional<uint32_t> transformHint;
uint32_t currentMaxAcquiredBufferCount = 0;
nsecs_t dequeueReadyTime = -1;
uint64_t frameNumber = 0;
std::string name;
};
4.3 Layer::State 中的 releaseBuffer 相关字段
文件路径: frameworks/native/services/surfaceflinger/Layer.h
struct State {
// ... 其他字段 ...
// Release buffer listener - 用于接收 buffer 释放通知
sp<ITransactionCompletedListener> releaseBufferListener;
// Release buffer endpoint - 用于标识回调的接收端
sp<IBinder> releaseBufferEndpoint;
};
4.4 SurfaceStats - 包含 release fence 的统计信息
文件路径: frameworks/native/libs/gui/include/gui/ITransactionCompletedListener.h
class SurfaceStats : public Parcelable {
public:
sp<IBinder> surfaceControl;
std::variant<nsecs_t, sp<Fence>> acquireTimeOrFence = -1;
sp<Fence> previousReleaseFence; // release fence
std::optional<uint32_t> transformHint = 0;
uint32_t currentMaxAcquiredBufferCount = 0;
FrameEventHistoryStats eventStats;
std::vector<JankData> jankData;
ReleaseCallbackId previousReleaseCallbackId; // 用于匹配 callback
};
第五部分：ReleaseBufferCallback 的注册流程
5.1 App 端注册回调
文件路径: frameworks/native/libs/gui/SurfaceComposerClient.cpp
// 第 1753-1767 行
void SurfaceComposerClient::Transaction::setReleaseBufferCallback(BufferData* bufferData,
ReleaseBufferCallback callback) {
if (!callback) {
return;
}
if (!bufferData->buffer) {
ALOGW("Transaction::setReleaseBufferCallback"
"ignored trying to set a callback on a null buffer.");
return;
}
// 设置 releaseBufferListener 为 TransactionCompletedListener
bufferData->releaseBufferListener = TransactionCompletedListener::getIInstance();
// 在 TransactionCompletedListener 中注册回调
auto listener = TransactionCompletedListener::getInstance();
listener->setReleaseBufferCallback(bufferData->generateReleaseCallbackId(), callback);
}
5.2 BLASTBufferQueue 注册回调
文件路径: frameworks/native/libs/gui/BLASTBufferQueue.cpp
// 第 589-594 行
auto releaseBufferCallback =
std::bind(releaseBufferCallbackThunk, wp<BLASTBufferQueue>(this) /* callbackContext */,
std::placeholders::_1, std::placeholders::_2, std::placeholders::_3);
// 在 setBuffer 时注册回调
t->setBuffer(mSurfaceControl, buffer, fence, bufferItem.mFrameNumber, mProducerId,
releaseBufferCallback);
第六部分：特殊情况处理
6.1 Buffer 被覆盖时的立即释放
当一个 buffer 还没被显示就被新的 buffer 覆盖时，会立即释放。
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 3090-3105 行
if (mDrawingState.buffer) {
mReleasePreviousBuffer = true;
if (!mBufferInfo.mBuffer ||
(!mDrawingState.buffer->hasSameBuffer(*mBufferInfo.mBuffer) ||
mDrawingState.frameNumber != mBufferInfo.mFrameNumber)) {
// Buffer 被丢弃，立即调用 release callback
callReleaseBufferCallback(mDrawingState.releaseBufferListener,
mDrawingState.buffer->getBuffer(),
mDrawingState.frameNumber,
mDrawingState.acquireFence);
decrementPendingBufferCount();
}
}
6.2 离屏 Layer 的 Buffer 释放
对于不在屏幕上显示的 Layer，需要主动释放 buffer 以避免 dequeueBuffer 阻塞。
文件路径: frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
// 第 4115-4120 行
for (Layer* offscreenLayer : mOffscreenLayers) {
offscreenLayer->traverse(LayerVector::StateSet::Drawing,
[&](Layer* l) { l->latchAndReleaseBuffer(); });
}
6.3 Layer 销毁时的 Buffer 释放
文件路径: frameworks/native/services/surfaceflinger/Layer.cpp
// 第 230-240 行
Layer::~Layer() {
if (mBufferInfo.mBuffer != nullptr) {
callReleaseBufferCallback(mDrawingState.releaseBufferListener,
mBufferInfo.mBuffer->getBuffer(),
mBufferInfo.mFrameNumber,
mBufferInfo.mFence);
}
// ...
}
第七部分：关键文件路径汇总
SurfaceFlinger 端
| 文件 | 路径 | 主要功能 |
|---|---|---|
| SurfaceFlinger.cpp | frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp | 主流程控制，commit/composite/postComposition |
| Scheduler.cpp | frameworks/native/services/surfaceflinger/Scheduler/Scheduler.cpp | VSync 驱动，onFrameSignal |
| Output.cpp | frameworks/native/services/surfaceflinger/CompositionEngine/src/Output.cpp | 合成输出，postFramebuffer 触发 release fence |
| CompositionEngine.cpp | frameworks/native/services/surfaceflinger/CompositionEngine/src/CompositionEngine.cpp | 合成引擎，present 遍历 Output |
| Layer.cpp | frameworks/native/services/surfaceflinger/Layer.cpp | Layer 状态管理，release callback 处理 |
| LayerFE.cpp | frameworks/native/services/surfaceflinger/LayerFE.cpp | Layer Front-End，接收 release fence |
| TransactionCallbackInvoker.cpp | frameworks/native/services/surfaceflinger/TransactionCallbackInvoker.cpp | 回调管理，发送回调给客户端 |
App 端 (libs/gui)
| 文件 | 路径 | 主要功能 |
|---|---|---|
| SurfaceComposerClient.cpp | frameworks/native/libs/gui/SurfaceComposerClient.cpp | 客户端接口，回调注册和处理 |
| BLASTBufferQueue.cpp | frameworks/native/libs/gui/BLASTBufferQueue.cpp | Buffer 队列管理，release callback 处理 |
| BufferItemConsumer.cpp | frameworks/native/libs/gui/BufferItemConsumer.cpp | Buffer 消费者封装 |
| ConsumerBase.cpp | frameworks/native/libs/gui/ConsumerBase.cpp | 消费者基类 |
| BufferQueueConsumer.cpp | frameworks/native/libs/gui/BufferQueueConsumer.cpp | BufferQueue 消费者端实现 |
| ITransactionCompletedListener.cpp | frameworks/native/libs/gui/ITransactionCompletedListener.cpp | Binder 接口定义 |
头文件
| 文件 | 路径 |
|---|---|
| Layer.h | frameworks/native/services/surfaceflinger/Layer.h |
| ITransactionCompletedListener.h | frameworks/native/libs/gui/include/gui/ITransactionCompletedListener.h |
| SurfaceComposerClient.h | frameworks/native/libs/gui/include/gui/SurfaceComposerClient.h |
| BLASTBufferQueue.h | frameworks/native/libs/gui/include/gui/BLASTBufferQueue.h |
| BufferQueueConsumer.h | frameworks/native/libs/gui/include/gui/BufferQueueConsumer.h |
第八部分：总结
ReleaseBuffer 流程核心要点
-
触发时机：
- 正常流程：Buffer 显示完成后，通过 present fence 触发
- 异常流程：Buffer 被覆盖、Layer 销毁、离屏 Layer 处理
-
核心调用链：
VSync Signal → Scheduler::onFrameSignal → SurfaceFlinger::commit → latchBuffers → SurfaceFlinger::composite → CompositionEngine::present → Output::present → Output::postFramebuffer → LayerFE::onLayerDisplayed (存储 release fence) → 处理 CompositionResult → Layer::onLayerDisplayed (关联 release fence 到 CallbackHandle) → SurfaceFlinger::postComposition → Layer::releasePendingBuffer → TransactionCallbackInvoker::addCallbackHandles → TransactionCallbackInvoker::sendCallbacks → ITransactionCompletedListener::onTransactionCompleted (Binder IPC) -
App 端处理链：
TransactionCompletedListener::onTransactionCompleted → ReleaseBufferCallback → BLASTBufferQueue::releaseBufferCallback → BLASTBufferQueue::releaseBuffer → BufferItemConsumer::releaseBuffer → ConsumerBase::releaseBufferLocked → BufferQueueConsumer::releaseBuffer → IProducerListener::onBufferReleased -
Buffer 状态流转：
- ACQUIRED → RELEASED → FREE
- 释放后 Producer 可以重新 dequeue 该 buffer
-
两种 Release 路径：
- 正常路径：通过 TransactionCallbackInvoker，在 onTransactionCompleted 中携带 release fence
- 快速路径：通过 callReleaseBufferCallback，直接调用 onReleaseBuffer（用于 buffer 被覆盖等场景）
