Surface 的创建是一个从应用进程发起,经过系统服务,最终由底层 SurfaceFlinger 完成的复杂跨进程过程。
这个过程的起点是 ViewRootImpl,核心是 WindowManagerService (WMS),终点是 SurfaceFlinger。通常,Surface 的创建或更新在 ViewRootImpl.performTraversals() 中调用 relayoutWindow() 时触发。
创建Surface主要步骤
-
应用进程:发起请求 (
ViewRootImpl)ViewRootImpl在构造时就会new Surface()创建一个空的Java层Surface对象作为占位符。- 在
performTraversals()中,应用通过 Binder 调用WMS的relayoutWindow()方法,并将这个空SurfaceControl对象作为输出参数传入。WMS会负责“填充”这个对象。
//frameworks/base/core/java/android/view/ViewRootImpl.java
public final Surface mSurface = new Surface();
private final SurfaceControl mSurfaceControl = new SurfaceControl();
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
boolean insetsPending) throws RemoteException {
...
//调用WMS.relayoutWindow()
int relayoutResult = mWindowSession.relayout(mWindow, params,
(int) (mView.getMeasuredWidth() * appScale + 0.5f),
(int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
mTmpFrames, mPendingMergedConfiguration, mSurfaceControl, mTempInsets,
mTempControls, mSurfaceSize);
mPendingBackDropFrame.set(mTmpFrames.backdropFrame);
//relayoutWindow之后填充Surface
if (mSurfaceControl.isValid()) {
if (!useBLAST()) {
mSurface.copyFrom(mSurfaceControl);
} else {
if (blastSurface != null) {
mSurface.transferFrom(blastSurface);
}
}
}
...
}
-
系统服务:核心创建 (
WindowManagerService)relayoutWindow: WMS 根据窗口信息找到对应的WindowState。createSurfaceControl: 该方法会调用WindowStateAnimator.createSurfaceLocked()来真正执行创建。WindowStateAnimator.createSurfaceLocked: 重置窗口状态为DRAW_PENDING,并实例化WindowSurfaceController。WindowSurfaceController构造: 在其构造过程中,会创建一个SurfaceControl对象。
//frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
public int relayoutWindow(Session session, IWindow client, LayoutParams attrs,
int requestedWidth, int requestedHeight, int viewVisibility, int flags,
long frameNumber, ClientWindowFrames outFrames, MergedConfiguration mergedConfiguration,
SurfaceControl outSurfaceControl, InsetsState outInsetsState,
InsetsSourceControl[] outActiveControls, Point outSurfaceSize) {
...
if (shouldRelayout) {
try {
//创建 `SurfaceControl` 对象
result = createSurfaceControl(outSurfaceControl, result, win, winAnimator);
} catch (Exception e) {
...
return 0;
}
}
...
}
//创建 `SurfaceControl` 对象
private int createSurfaceControl(SurfaceControl outSurfaceControl, int result,
WindowState win, WindowStateAnimator winAnimator) {
...
WindowSurfaceController surfaceController;
try {
// winAnimator = WindowStateAnimator
surfaceController = winAnimator.createSurfaceLocked(win.mAttrs.type);
} finally {
}
if (surfaceController != null) {
//创建成功,将其复制到客户端的 SurfaceControl 对象
surfaceController.getSurfaceControl(outSurfaceControl);
} else {
//创建失败则释放
outSurfaceControl.release();
}
return result;
}
//frameworks/base/services/core/java/com/android/server/wm/WindowStateAnimator.java
WindowSurfaceController createSurfaceLocked(int windowType) {
final WindowState w = mWin;
//如果已存在SurfaceController ,直接返回
if (mSurfaceController != null) {
return mSurfaceController;
}
//标记窗口尚未拥有 Surface。
w.setHasSurface(false);
//将绘制状态重置为 `DRAW_PENDING`(等待绘制)
resetDrawState();
//如果系统正在执行屏幕冻结(如旋转或切换),确保该窗口被正确处理。
mService.makeWindowFreezingScreenIfNeededLocked(w);
...
//据窗口属性(`LayoutParams`)计算出 Surface 的宽高
w.calculateSurfaceBounds(attrs, mTmpSize);
final int width = mTmpSize.width();
final int height = mTmpSize.height();
try {
//硬件加速窗口强制使用透明像素格式(`TRANSLUCENT`)
final boolean isHwAccelerated = (attrs.flags & FLAG_HARDWARE_ACCELERATED) != 0;
final int format = isHwAccelerated ? PixelFormat.TRANSLUCENT : attrs.format;
//创建 SurfaceController
mSurfaceController = new WindowSurfaceController(attrs.getTitle().toString(), width,
height, format, flags, this, windowType);
...
//标记窗口已拥有 Surface
w.setHasSurface(true);
//强制更新输入窗口句柄,确保触摸事件可正确传递给新 Surface
w.mInputWindowHandle.forceChange();
}
...
//需确保后续调用 `showSurface()` 才会让窗口可见
mLastHidden = true;
return mSurfaceController;
}
//frameworks/base/services/core/java/com/android/server/wm/WindowSurfaceController.java
WindowSurfaceController(String name, int w, int h, int format,
int flags, WindowStateAnimator animator, int windowType) {
final SurfaceControl.Builder b = win.makeSurface()
.setParent(win.getSurfaceControl())
...
//调用 build创建SurfaceControl
mSurfaceControl = b.build();
}
//frameworks/base/core/java/android/view/SurfaceControl.java
public SurfaceControl build() {
...
return new SurfaceControl(
mSession, mName, mWidth, mHeight, mFormat, mFlags, mParent, mMetadata,
mLocalOwnerView, mCallsite);
}
-
底层实现:与
SurfaceFlinger交互 (SurfaceControl)-
SurfaceControl的 native 创建:SurfaceControl的构造方法最终会调用nativeCreate。- 建立会话: 仅在应用需要显示第一个窗口时(即调用
WindowManagerService.addWindow时),通过WindowState.attach()触发。 - 请求创建 Layer: 通过
SurfaceComposerClient调用createSurface(),向SurfaceFlinger发送创建Layer的请求。SurfaceFlinger处理请求并创建一个Layer对象。 - 获取生产者:
SurfaceFlinger创建Layer后,会返回一个IGraphicBufferProducer接口。应用将通过它向SurfaceFlinger的缓冲区队列提供绘制好的图像数据。
- 建立会话: 仅在应用需要显示第一个窗口时(即调用
-
//frameworks/base/core/java/android/view/SurfaceControl.java
private SurfaceControl(SurfaceSession session, String name, int w, int h, int format, int flags,
SurfaceControl parent, SparseIntArray metadata, WeakReference<View> localOwnerView,
String callsite)
throws OutOfResourcesException, IllegalArgumentException {
...
try {
...
mNativeObject = nativeCreate(session, name, w, h, format, flags,
parent != null ? parent.mNativeObject : 0, metaParcel);
} finally {
metaParcel.recycle();
}
if (mNativeObject == 0) {
throw new OutOfResourcesException(
"Couldn't allocate SurfaceControl native object");
}
mNativeHandle = nativeGetHandle(mNativeObject);
mCloseGuard.openWithCallSite("release", callsite);
}
//frameworks/base/core/jni/android_view_SurfaceControl.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
jstring nameStr, jint w, jint h, jint format, jint flags, jlong parentObject,
jobject metadataParcel) {
ScopedUtfChars name(env, nameStr);
//`SurfaceComposerClient` 是应用进程与 SurfaceFlinger 通信的客户端代理
sp<SurfaceComposerClient> client;
//sessionOb就是`SurfaceSession`
if (sessionObj != NULL) {
//从SurfaceSession取出SurfaceComposerClient
client = android_view_SurfaceSession_getClient(env, sessionObj);
} else {
//否则使用默认的全局 Client
client = SurfaceComposerClient::getDefault();
}
//`parentObject` 是从 Java 层传入的 `SurfaceControl` 对象指针
//每个 `SurfaceControl` 在 Native 层对应一个 `IBinder` 句柄,SurfaceFlinger 用它来识别父图层
//父 Surface 用于构建 Z-Order 层级关系
SurfaceControl *parent = reinterpret_cast<SurfaceControl*>(parentObject);
sp<SurfaceControl> surface;
//`LayerMetadata` 是 Android 12+ 引入的,用于传递 BLAST 相关的额外参数
LayerMetadata metadata;
Parcel* parcel = parcelForJavaObject(env, metadataParcel);
if (parcel && !parcel->objectsCount()) {
//通过 `Parcel` 从 Java 层传递到 Native 层
status_t err = metadata.readFromParcel(parcel);
if (err != NO_ERROR) {
jniThrowException(env, "java/lang/IllegalArgumentException",
"Metadata parcel has wrong format");
}
}
sp<IBinder> parentHandle;
if (parent != nullptr) {
parentHandle = parent->getHandle();
}
//BpSurfaceComposerClient调用createSurfaceChecked,
//通过 Binder 驱动发起远程调用
//remote()->transact(CREATE_SURFACE, data, &reply);
//服务端响应:`BnSurfaceComposerClient::onTransact`
//class Client : public BnSurfaceComposerClient
status_t err = client->createSurfaceChecked(String8(name.c_str()), w, h, format, &surface,
flags, parentHandle,
...
//增加强引用计数,防止被释放
surface->incStrong((void *)nativeCreate);
return reinterpret_cast<jlong>(surface.get());
}
//class Client : public BnSurfaceComposerClient
//frameworks/native/services/surfaceflinger/Client.cpp
status_t Client::createSurface(const String8& name, uint32_t w, uint32_t h, PixelFormat format,
uint32_t flags, const sp<IBinder>& parentHandle,
LayerMetadata metadata, sp<IBinder>* handle,
sp<IGraphicBufferProducer>* gbp, int32_t* outLayerId,
uint32_t* outTransformHint) {
//调用SurfaceFinger创建Layer
return mFlinger->createLayer(name, this, w, h, format, flags, std::move(metadata), handle, gbp,
parentHandle, outLayerId, nullptr, outTransformHint);
}
//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& client, uint32_t w,
uint32_t h, PixelFormat format, uint32_t flags,
LayerMetadata metadata, sp<IBinder>* handle,
sp<IGraphicBufferProducer>* gbp,
const sp<IBinder>& parentHandle, int32_t* outLayerId,
const sp<Layer>& parentLayer, uint32_t* outTransformHint) {
...
status_t result = NO_ERROR;
sp<Layer> layer;
std::string uniqueName = getUniqueLayerName(name.string());
switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
case ISurfaceComposerClient::eFXSurfaceBufferQueue:
case ISurfaceComposerClient::eFXSurfaceBufferState: {
//创建BufferStateLayer
result = createBufferStateLayer(client, std::move(uniqueName), w, h, flags,
break;
case ISurfaceComposerClient::eFXSurfaceEffect:
//创建EffectLayer
result = createEffectLayer(client, std::move(uniqueName), w, h, flags,
std::move(metadata), handle, &layer);
break;
case ISurfaceComposerClient::eFXSurfaceContainer:
//创建ContainerLayer
result = createContainerLayer(client, std::move(uniqueName), w, h, flags,
std::move(metadata), handle, &layer);
break;
default:
result = BAD_VALUE;
break;
}
if (result != NO_ERROR) {
return result;
}
bool addToRoot = callingThreadHasUnscopedSurfaceFlingerAccess();
//创建 LayerHandle (Binder 句柄)
//创建 BufferQueue (IGraphicBufferProducer)
//插入层级树 (parent 或 root)
result = addClientLayer(client, *handle, *gbp, layer, parentHandle, parentLayer, addToRoot,
outTransformHint);
if (result != NO_ERROR) {
return result;
}
//mInterceptor用于调试/监控(如 Systrace 跟踪 Layer 创建事件)
mInterceptor->saveSurfaceCreation(layer);
//**标记需要应用事务**,触发 SurfaceFlinger 在下一次合成时重新计算图层属性
setTransactionFlags(eTransactionNeeded);
//分配 Layer ID
*outLayerId = layer->sequence;
return result;
}
四种图层:
**ContainerLayer是容器,用于组织和管理其他图层;BufferStateLayer是具体的绘图表面,承载应用内容;EffectLayer则用于实现各种视觉特效**,
**`BufferQueueLayer` 是基于 BufferQueue 机制的传统图层类型,在 Android 12 之前是应用窗口的默认实现,12以后已被BufferStateLayer替代。**
sp<ContainerLayer> DefaultFactory::createContainerLayer(const LayerCreationArgs& args) {
return new ContainerLayer(args);
}
sp<BufferQueueLayer> DefaultFactory::createBufferQueueLayer(const LayerCreationArgs& args) {
return new BufferQueueLayer(args);
}
sp<BufferStateLayer> DefaultFactory::createBufferStateLayer(const LayerCreationArgs& args) {
return new BufferStateLayer(args);
}
sp<EffectLayer> DefaultFactory::createEffectLayer(const LayerCreationArgs& args) {
return new EffectLayer(args);
}
//**创建新图层(Layer)并将其添加到系统中**
status_t SurfaceFlinger::addClientLayer(const sp<Client>& client, const sp<IBinder>& handle,
const sp<IGraphicBufferProducer>& gbc, const sp<Layer>& lbc,
const sp<IBinder>& parentHandle,
const sp<Layer>& parentLayer, bool addToRoot,
uint32_t* outTransformHint) {
...
wp<IBinder> initialProducer;
if (gbc != nullptr) {
// 从 `IGraphicBufferProducer` 获取其 Binder 引用
//用于后续跟踪图层的缓冲区生产者
initialProducer = IInterface::asBinder(gbc);
}
//设置图层创建状态,内部记录图层的创建信息,建立图层与父图层、生产者之间的关联
setLayerCreatedState(handle, lbc, parentHandle, parentLayer, initialProducer, addToRoot);
Vector<ComposerState> states;
Vector<DisplayState> displays;
ComposerState composerState;
//构建事务,告知 SurfaceFlinger 这是一个新图层创建操作
composerState.state.what = layer_state_t::eLayerCreated;
composerState.state.surface = handle;
states.add(composerState);
//为图层设置默认的显示变换提示(如旋转方向),用于优化图层合成时的变换处理
lbc->updateTransformHint(mDefaultDisplayTransformHint);
if (outTransformHint) {
*outTransformHint = mDefaultDisplayTransformHint;
}
//将图层对象与客户端绑定,使得客户端可以后续操作该图层
client->attachLayer(handle, lbc);
//将事务提交给 SurfaceFlinger 处理
//实际完成图层的添加和显示更新
return setTransactionState(FrameTimelineInfo{}, states, displays, 0 /* flags */, nullptr,
InputWindowCommands{}, -1 /* desiredPresentTime */,
true /* isAutoTimestamp */, {}, false /* hasListenerCallbacks */, {},
0 /* Undefined transactionId */);
-
数据返回:填充
Surface对象- Native 层的
SurfaceControl创建完成后,WMS 会调用Surface.copyFrom()方法,将 Native 层的Surface指针和IGraphicBufferProducer等信息关联到最初应用传入的那个空Java层Surface对象上。 - 此时,应用进程中的
Surface对象才成为一个真正可用的绘图表面。
- Native 层的
//frameworks/base/core/java/android/view/ViewRootImpl.java
private int relayoutWindow(WindowManager.LayoutParams params, int viewVisibility,
boolean insetsPending) throws RemoteException {
...
int relayoutResult = mWindowSession.relayout(mWindow, params,
(int) (mView.getMeasuredWidth() * appScale + 0.5f),
(int) (mView.getMeasuredHeight() * appScale + 0.5f), viewVisibility,
insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0, frameNumber,
mTmpFrames, mPendingMergedConfiguration, mSurfaceControl, mTempInsets,
mTempControls, mSurfaceSize);
mPendingBackDropFrame.set(mTmpFrames.backdropFrame);
//relayoutWindow之后填充Surface
if (mSurfaceControl.isValid()) {
if (!useBLAST()) {
mSurface.copyFrom(mSurfaceControl);
} else {
if (blastSurface != null) {
mSurface.transferFrom(blastSurface);
}
}
}
...
}
//frameworks/base/core/java/android/view/Surface.java
public void copyFrom(SurfaceControl other) {
...
long newNativeObject = nativeGetFromSurfaceControl(mNativeObject, surfaceControlPtr);
...
}
//从 `SurfaceControl` 对象中获取一个关联的 `Surface` 对象,并返回其 native 指针
//frameworks/base/core/jni/android_view_Surface.cpp
static jlong nativeGetFromSurfaceControl(JNIEnv* env, jclass clazz,
jlong nativeObject,
jlong surfaceControlNativeObj) {
//从 jlong 还原为 C++ 对象
Surface* self(reinterpret_cast<Surface *>(nativeObject));
sp<SurfaceControl> ctrl(reinterpret_cast<SurfaceControl *>(surfaceControlNativeObj));
//比较两个对象的 `IGraphicBufferProducer`(图形缓冲区生产者)的 Binder
//句柄是否相同
//如果相同,说明 `Surface` 和 `SurfaceControl` 指向同一底层 BufferQueue,
//无需重建,直接返回原指针。
if (self != nullptr &&
IInterface::asBinder(self->getIGraphicBufferProducer()) ==
IInterface::asBinder(ctrl->getIGraphicBufferProducer())) {
return nativeObject;
}
//从 SurfaceControl 获取新的 Surface
sp<Surface> surface(ctrl->getSurface());
if (surface != NULL) {
//增加强引用计数,因为返回给 Java 层后,Java 层会持有这个指针,
//需要防止 C++ 对象被提前释放。
surface->incStrong(&sRefBaseOwner);
}
return reinterpret_cast<jlong>(surface.get());
}
//从 `SurfaceControl` 中创建一个新的 `Surface` 对象(或返回已缓存的)
//frameworks/native/libs/gui/SurfaceControl.cpp
sp<Surface> SurfaceControl::getSurface()
{
Mutex::Autolock _l(mLock);
if (mSurfaceData == nullptr) {
return generateSurfaceLocked();
}
return mSurfaceData;
}
SurfaceSession 通信会话的建立时机
- 建立时机:仅在应用需要显示第一个窗口时(即调用
WindowManagerService.addWindow时),通过WindowState.attach()触发。 - 延迟创建:系统不会在应用启动时预建,而是在
attach()中执行到Session.windowAddedLocked()时,检查如果当前Session尚未创建SurfaceSession,才通过new SurfaceSession()创建。当SurfaceSession被创建时,其无参构造函数会通过 JNI 调用nativeCreate()。这会在 Native 层创建一个SurfaceComposerClient对象,它是与SurfaceFlinger进行底层通信的直接入口。 - 唯一性:一个应用进程(一个
Session)只拥有一个SurfaceSession实例。后续添加新窗口(如Dialog、PopupWindow)会复用已有的SurfaceSession,不会再新建底层会话。
//frameworks/base/services/core/java/com/android/server/wm/WindowState.java
void attach() {
mSession.windowAddedLocked();
}
//frameworks/base/services/core/java/com/android/server/wm/Session.java
void windowAddedLocked() {
if (mPackageName == null) {
...
}
if (mSurfaceSession == null) {
//创建SurfaceSession
mSurfaceSession = new SurfaceSession();
//将当前 `Session` 添加到 `WindowManagerService` 的会话
//列表 `mSessions` 中
mService.mSessions.add(this);
...
}
//用于跟踪此 `Session` 关联的窗口数量
mNumWindow++;
}
//frameworks/base/core/java/android/view/SurfaceSession.java
public SurfaceSession() {
mNativeClient = nativeCreate();
}
//frameworks/base/core/jni/android_view_SurfaceSession.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz) {
// 创建SurfaceComposerClient
SurfaceComposerClient* client = new SurfaceComposerClient();
//增加强引用计数会触发`SurfaceComposerClient` 的 `onFirstRef()`方法
client->incStrong((void*)nativeCreate);
return reinterpret_cast<jlong>(client);
}
//frameworks/native/libs/gui/SurfaceComposerClient.cpp
void SurfaceComposerClient::onFirstRef() {
//通过 Binder 获取 SurfaceFlinger 进程的 `ISurfaceComposer`
//接口代理BpSurfaceComposer
sp<ISurfaceComposer> sf(ComposerService::getComposerService());
if (sf != nullptr && mStatus == NO_INIT) {
sp<ISurfaceComposerClient> conn;
//创建连接
conn = sf->createConnection();
if (conn != nullptr) {
mClient = conn;
mStatus = NO_ERROR;
}
}
}
//frameworks/native/libs/gui/ISurfaceComposer.cpp
//class BpSurfaceComposer : public BpInterface<ISurfaceComposer>
virtual sp<ISurfaceComposerClient> createConnection()
{
Parcel data, reply;
data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
//通过 Binder 驱动向 SurfaceFlinger 发送 `CREATE_CONNECTION` 跨进程事务请求
remote()->transact(BnSurfaceComposer::CREATE_CONNECTION, data, &reply);
return interface_cast<ISurfaceComposerClient>(reply.readStrongBinder());
}
//服务端(SurfaceFlinger 进程),处理客户端跨进程请求的入口
status_t BnSurfaceComposer::onTransact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
switch(code) {
case CREATE_CONNECTION: {
//检查客户端传递的接口描述符是否匹配,防止 Binder 调用错乱
CHECK_INTERFACE(ISurfaceComposer, data, reply);
//调用子类(实际是 `SurfaceFlinger` 类)实现的 `createConnection()`,
//返回 `sp<ISurfaceComposerClient>`
//将 `ISurfaceComposerClient` 接口对象转为 `IBinder*`(
//实际类型是 `BnSurfaceComposerClient` 的 Binder 引用
sp<IBinder> b = IInterface::asBinder(createConnection());
//将 Binder 对象写入回复包,客户端将获得该 Binder 的
//代理(`BpSurfaceComposerClient`)
reply->writeStrongBinder(b);
return NO_ERROR;
}
...
}
//SurfaceFlinger 服务端创建客户端连接的核心方法
//frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
sp<ISurfaceComposerClient> SurfaceFlinger::createConnection() {
//创建 Client 对象
const sp<Client> client = new Client(this);
//验证 Client 对象是否正确初始化(如 Binder 引用、内部资源等)
return client->initCheck() == NO_ERROR ? client : nullptr;
}
//`Client` 是 SurfaceFlinger 内部的一个重要类,继承自 `BnSurfaceComposerClient`
//Client.h -> class Client : public BnSurfaceComposerClient
- 代表一个客户端会话(通常是应用进程或系统服务)
- 管理该客户端创建的所有图层(Layer)
- 处理来自客户端的请求(创建 Surface、销毁 Surface、设置图层属性等)
- 资源清理:客户端异常退出时,释放其拥有的图层和资源
//frameworks/native/services/surfaceflinger/Client.cpp
Client::Client(const sp<SurfaceFlinger>& flinger)
: mFlinger(flinger)
{
}