AndroidQ 图形系统（7）GraphicBuffer内存分配与Grallocqq34211365的博客-

在前面dequeueBuffer函数说了，申请buffer时会首先从mFreeBuffers中取已经绑定了GraphicBuffer且状态为FREE的BufferSlot，如果没有则会从mFreeSlots中取还未绑定GraphicBuffer的BufferSlot，并且会设置BUFFER_NEEDS_REALLOCATION这个flag，之后就会给GraphicBuffer分配内存空间：

if (returnFlags & BUFFER_NEEDS_REALLOCATION) { BQ_LOGV("dequeueBuffer: allocating a new buffer for slot %d", *outSlot);         sp<GraphicBuffer> graphicBuffer = new GraphicBuffer(                 width, height, format, BQ_LAYER_COUNT, usage, {mConsumerName.string(), mConsumerName.size()}); ...... } 

并且我们发现不管是dequeueBuffer还是queueBuffer传递的都是BufferSlot的index，并没有传递真正GraphicBuffer，那如何做到同一个GraphicBuffer两个进程共享？这就用到了内存映射。

GraphicBuffer中有两个核心类用来处理内存分配（GraphicBufferAllocator）和内存映射（GraphicBufferMapper）。

GraphicBuffer父类中有个很重要的变量：

typedef struct ANativeWindowBuffer { ...... const native_handle_t* handle; ...... } ANativeWindowBuffer_t; 

这个native_handle_t最终就是GraphicBuffer句柄，handle的地址会随着allocate函数的调用向HAL层传递，native_handle_t定义在/system/core/libcutils/include/cutils/native_handle.h中：

typedef struct native_handle   { int version; /* sizeof(native_handle_t) */ int numFds; /* number of file-descriptors at &data[0] */ int numInts; /* number of ints at &data[numFds] */ int data[0]; /* numFds + numInts ints */ } native_handle_t; 

GraphicBuffer创建

dequeueBuffer中如果flag为BUFFER_NEEDS_REALLOCATION就会创建GraphicBuffer并未其分配内存，

if (returnFlags & BUFFER_NEEDS_REALLOCATION) { BQ_LOGV("dequeueBuffer: allocating a new buffer for slot %d", *outSlot);         sp<GraphicBuffer> graphicBuffer = new GraphicBuffer(                 width, height, format, BQ_LAYER_COUNT, usage, {mConsumerName.string(), mConsumerName.size()}); ...... } 

GraphicBuffer构造函数：

GraphicBuffer::GraphicBuffer(uint32_t inWidth, uint32_t inHeight, PixelFormat inFormat, uint32_t inLayerCount, uint64_t inUsage, std::string requestorName) : GraphicBuffer() {     mInitCheck = initWithSize(inWidth, inHeight, inFormat, inLayerCount, inUsage,                               std::move(requestorName)); } 

initWithSize

status_t GraphicBuffer::initWithSize(uint32_t inWidth, uint32_t inHeight,         PixelFormat inFormat, uint32_t inLayerCount, uint64_t inUsage,         std::string requestorName) {     GraphicBufferAllocator& allocator = GraphicBufferAllocator::get(); uint32_t outStride = 0;     status_t err = allocator.allocate(inWidth, inHeight, inFormat, inLayerCount,             inUsage, &handle, &outStride, mId,             std::move(requestorName)); if (err == NO_ERROR) {         mBufferMapper.getTransportSize(handle, &mTransportNumFds, &mTransportNumInts);          width = static_cast<int>(inWidth);         height = static_cast<int>(inHeight);         format = inFormat;         layerCount = inLayerCount;         usage = inUsage;         usage_deprecated = int(usage);         stride = static_cast<int>(outStride); } return err; } 

这里面创建了核心类之一的GraphicBufferAllocator，这是处理GraphicBuffer内存分配的类，是个单例类，通过get获取其对象，接着就调用其allocate函数，等下再看
先看看GraphicBufferAllocator构造函数：

GraphicBufferAllocator::GraphicBufferAllocator() : mMapper(GraphicBufferMapper::getInstance()) {     mAllocator = std::make_unique<const Gralloc3Allocator>( reinterpret_cast<const Gralloc3Mapper&>(mMapper.getGrallocMapper())); if (!mAllocator->isLoaded()) {         mAllocator = std::make_unique<const Gralloc2Allocator>( reinterpret_cast<const Gralloc2Mapper&>(mMapper.getGrallocMapper())); } if (!mAllocator->isLoaded()) { LOG_ALWAYS_FATAL("gralloc-allocator is missing"); } } 

这里面又创建了另一个核心类GraphicBufferMapper，用作映射内存，这也是个单例类，再看看GraphicBufferMapper构造函数：

GraphicBufferMapper::GraphicBufferMapper() {     mMapper = std::make_unique<const Gralloc3Mapper>(); if (!mMapper->isLoaded()) {         mMapper = std::make_unique<const Gralloc2Mapper>();         mMapperVersion = Version::GRALLOC_2; } else {         mMapperVersion = Version::GRALLOC_3; } if (!mMapper->isLoaded()) { LOG_ALWAYS_FATAL("gralloc-mapper is missing"); } } 

可以看到GraphicBufferAllocator和GraphicBufferMapper构造函数做的事情差不多的，它们分别创建了自己用来调HAL层函数的对象，以GraphicBufferAllocator为例来看看：

GraphicBufferAllocator::GraphicBufferAllocator() : mMapper(GraphicBufferMapper::getInstance()) {     mAllocator = std::make_unique<const Gralloc3Allocator>( reinterpret_cast<const Gralloc3Mapper&>(mMapper.getGrallocMapper())); if (!mAllocator->isLoaded()) {         mAllocator = std::make_unique<const Gralloc2Allocator>( reinterpret_cast<const Gralloc2Mapper&>(mMapper.getGrallocMapper())); } if (!mAllocator->isLoaded()) { LOG_ALWAYS_FATAL("gralloc-allocator is missing"); } } 

首先创建Gralloc3Allocator，如果不支持3.0版本则创建Gralloc2Allocator，2.0版本：

Gralloc3Allocator::Gralloc3Allocator(const Gralloc3Mapper& mapper) : mMapper(mapper) {     mAllocator = IAllocator::getService(); if (mAllocator == nullptr) { ALOGW("allocator 3.x is not supported"); return; } } bool Gralloc3Allocator::isLoaded() const { return mAllocator != nullptr; } 

IAllocator这就是HIDL接口3.0版本
using android::hardware::graphics::allocator::V3_0::IAllocator;

Android Q上并没有allocator3.0的默认实现，

同样mapper也没有3.0的默认实现，
所以GraphicBufferAllocator的mAllocator对应Gralloc2Allocator，
GraphicBufferMapper的mMapper对应Gralloc2Mapper。

Gralloc2Allocator和Gralloc2Mapper的实现都在Gralloc2.cpp中，它们相当于Gralloc模块在native层的HIDL客户端。

GraphicBufferAllocator::allocate

status_t GraphicBufferAllocator::allocate(uint32_t width, uint32_t height,         PixelFormat format, uint32_t layerCount, uint64_t usage,         buffer_handle_t* handle, uint32_t* stride, uint64_t /*graphicBufferId*/, std::string requestorName) { ......     status_t error =             mAllocator->allocate(width, height, format, layerCount, usage, 1, stride, handle); ...... return NO_MEMORY; } } 

继续调用Gralloc2Allocator的allocate函数，GraphicBuffer的handle也在往下传递。

Gralloc2Allocator::allocate

status_t Gralloc2Allocator::allocate(uint32_t width, uint32_t height, PixelFormat format, uint32_t layerCount, uint64_t usage, uint32_t bufferCount, uint32_t* outStride, buffer_handle_t* outBufferHandles) const {     IMapper::BufferDescriptorInfo descriptorInfo = {};     descriptorInfo.width = width;     descriptorInfo.height = height;     descriptorInfo.layerCount = layerCount;     descriptorInfo.format = static_cast<hardware::graphics::common::V1_1::PixelFormat>(format);     descriptorInfo.usage = usage;      BufferDescriptor descriptor;     status_t error = mMapper.createDescriptor(static_cast<void*>(&descriptorInfo), static_cast<void*>(&descriptor)); if (error != NO_ERROR) { return error; } auto ret = mAllocator->allocate(descriptor, bufferCount, [&](const auto& tmpError, const auto& tmpStride, const auto& tmpBuffers) {                                         error = static_cast<status_t>(tmpError); if (tmpError != Error::NONE) { return; } // import buffers for (uint32_t i = 0; i < bufferCount; i++) {                                             error = mMapper.importBuffer(tmpBuffers[i], &outBufferHandles[i]); if (error != NO_ERROR) { for (uint32_t j = 0; j < i; j++) {                                                     mMapper.freeBuffer(outBufferHandles[j]);                                                     outBufferHandles[j] = nullptr; } return; } } *outStride = tmpStride; }); // make sure the kernel driver sees BC_FREE_BUFFER and closes the fds now     hardware::IPCThreadState::self()->flushCommands(); return (ret.isOk()) ? error : static_cast<status_t>(kTransactionError); } 

这里把buffer相关信息封装到了IMapper::BufferDescriptorInfo中，这个结构体定义在IMapper.hal中，接着allocate就调到HAL层去了，IAllocator::getService即获取HIDL代理，具体实现是在HAL层的。

using android::hardware::graphics::allocator::V2_0::IAllocator; Gralloc2Allocator::Gralloc2Allocator(const Gralloc2Mapper& mapper) : mMapper(mapper) {     mAllocator = IAllocator::getService(); if (mAllocator == nullptr) { ALOGW("allocator 2.x is not supported"); return; } } 

HAL层和frameworks通过HIDL（hwbinder）连接，类似APP和frameworks之间通过AIDL（binder）连接。

Gralloc相关的HIDL接口实现在hardware/interfaces/graphics/下：

可以看到buffer内存分配，buffer内存映射，buffer合成的HIDL服务都在这下面。

allocator HIDL

我们来看allocator的HIDL接口，

先看接口文件IAllocator.hal

package android.hardware.graphics.allocator@2.0;  import android.hardware.graphics.mapper@2.0;  interface IAllocator { dumpDebugInfo() generates (string debugInfo); ...... allocate(BufferDescriptor descriptor, uint32_t count)         generates (Error error, uint32_t stride,                    vec<handle> buffers); }; 

对外提供了两个函数dumpDebugInfo和allocate，接着来看 IAllocator.hal的实现，在如下目录

在这个目录下并没有发现类似Allocator.cpp或者AllocatorImpl.cpp的IAllocator.hal实现类，来看看passthrough.cpp：

#include <allocator-passthrough/2.0/GrallocLoader.h> #include <android/hardware/graphics/allocator/2.0/IAllocator.h> using android::hardware::graphics::allocator::V2_0::IAllocator; using android::hardware::graphics::allocator::V2_0::passthrough::GrallocLoader; extern "C" IAllocator* HIDL_FETCH_IAllocator(const char* /* name */) { return GrallocLoader::load(); } 

发现了IAllocator的实现类是GrallocLoader::load()，接续跟，
allocator的GrallocLoader在
hardware/interfaces/graphics/allocator/2.0/utils/passthrough/include/allocator-passthrough/2.0：

class GrallocLoader { public: static IAllocator* load() { const hw_module_t* module = loadModule(); if (!module) { return nullptr; } auto hal = createHal(module); if (!hal) { return nullptr; } return createAllocator(std::move(hal)); } 

GrallocLoader的load函数中调用了三个关键函数，先来看loadModule，

loadModule

 // load the gralloc module static const hw_module_t* loadModule() { const hw_module_t* module; int error = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module); if (error) { ALOGE("failed to get gralloc module"); return nullptr; } return module; } 

这个函数加载了ID为GRALLOC_HARDWARE_MODULE_ID的gralloc HAL模块，首先看gralloc的HAL头文件，路径hardware/libhardware/include/hardware，这里定义了许多HAL模块的头文件，gralloc有两个：gralloc.h，gralloc1.h，我们来看gralloc1.h，这是它的gralloc1_device_t结构体

typedef struct gralloc1_device { /* Must be the first member of this struct, since a pointer to this struct      * will be generated by casting from a hw_device_t* */ struct hw_device_t common; void (*getCapabilities)(struct gralloc1_device* device, uint32_t* outCount, int32_t* /*gralloc1_capability_t*/ outCapabilities);                  gralloc1_function_pointer_t (*getFunction)(struct gralloc1_device* device, int32_t /*gralloc1_function_descriptor_t*/ descriptor); } gralloc1_device_t; 

它里面最重要的就是getFunction这个函数，通过传递的gralloc1_function_descriptor_t获取对应函数指针，gralloc1_function_descriptor_t有如下这些

typedef enum {     GRALLOC1_FUNCTION_INVALID = 0,     GRALLOC1_FUNCTION_DUMP = 1,     GRALLOC1_FUNCTION_CREATE_DESCRIPTOR = 2,     GRALLOC1_FUNCTION_DESTROY_DESCRIPTOR = 3,     GRALLOC1_FUNCTION_SET_CONSUMER_USAGE = 4,     GRALLOC1_FUNCTION_SET_DIMENSIONS = 5,     GRALLOC1_FUNCTION_SET_FORMAT = 6,     GRALLOC1_FUNCTION_SET_PRODUCER_USAGE = 7,     GRALLOC1_FUNCTION_GET_BACKING_STORE = 8,     GRALLOC1_FUNCTION_GET_CONSUMER_USAGE = 9,     GRALLOC1_FUNCTION_GET_DIMENSIONS = 10,     GRALLOC1_FUNCTION_GET_FORMAT = 11,     GRALLOC1_FUNCTION_GET_PRODUCER_USAGE = 12,     GRALLOC1_FUNCTION_GET_STRIDE = 13,     GRALLOC1_FUNCTION_ALLOCATE = 14,     GRALLOC1_FUNCTION_RETAIN = 15,     GRALLOC1_FUNCTION_RELEASE = 16,     GRALLOC1_FUNCTION_GET_NUM_FLEX_PLANES = 17,     GRALLOC1_FUNCTION_LOCK = 18,     GRALLOC1_FUNCTION_LOCK_FLEX = 19,     GRALLOC1_FUNCTION_UNLOCK = 20,     GRALLOC1_FUNCTION_SET_LAYER_COUNT = 21,     GRALLOC1_FUNCTION_GET_LAYER_COUNT = 22,     GRALLOC1_FUNCTION_VALIDATE_BUFFER_SIZE = 23,     GRALLOC1_FUNCTION_GET_TRANSPORT_SIZE = 24,     GRALLOC1_FUNCTION_IMPORT_BUFFER = 25,     GRALLOC1_LAST_FUNCTION = 25, } gralloc1_function_descriptor_t; 

我们先暂时不管gralloc1对应的HAL的module是哪一个，接着看如下函数中的createHal

static IAllocator* load() { const hw_module_t* module = loadModule(); if (!module) { return nullptr; } auto hal = createHal(module); if (!hal) { return nullptr; } return createAllocator(std::move(hal)); } 

createHal(module)

// create an AllocatorHal instance static std::unique_ptr<hal::AllocatorHal> createHal(const hw_module_t* module) { int major = getModuleMajorApiVersion(module); switch (major) { case 1: { auto hal = std::make_unique<Gralloc1Hal>(); return hal->initWithModule(module) ? std::move(hal) : nullptr; } case 0: { auto hal = std::make_unique<Gralloc0Hal>(); return hal->initWithModule(module) ? std::move(hal) : nullptr; } default: ALOGE("unknown gralloc module major version %d", major); return nullptr; } } 

gralloc1.h对应的应该是Gralloc1Hal，真正使用的其实是Gralloc1Hal的子类Gralloc1HalImpl,
我们看Gralloc1HalImpl的initWithModule函数：

Gralloc1HalImpl::initWithModule

bool initWithModule(const hw_module_t* module) { int result = gralloc1_open(module, &mDevice); if (result) { ALOGE("failed to open gralloc1 device: %s", strerror(-result));             mDevice = nullptr; return false; } initCapabilities(); if (!initDispatch()) { gralloc1_close(mDevice);             mDevice = nullptr; return false; } return true; } 

gralloc1_open会打开module下的device，现在还没确认module是哪一个，先不管，接着看看initDispatch()函数：

Gralloc1HalImpl::initDispatch

virtual bool initDispatch() { if (!initDispatch(GRALLOC1_FUNCTION_DUMP, &mDispatch.dump) || !initDispatch(GRALLOC1_FUNCTION_CREATE_DESCRIPTOR, &mDispatch.createDescriptor) || !initDispatch(GRALLOC1_FUNCTION_DESTROY_DESCRIPTOR, &mDispatch.destroyDescriptor) || !initDispatch(GRALLOC1_FUNCTION_SET_DIMENSIONS, &mDispatch.setDimensions) || !initDispatch(GRALLOC1_FUNCTION_SET_FORMAT, &mDispatch.setFormat) || !initDispatch(GRALLOC1_FUNCTION_SET_CONSUMER_USAGE, &mDispatch.setConsumerUsage) || !initDispatch(GRALLOC1_FUNCTION_SET_PRODUCER_USAGE, &mDispatch.setProducerUsage) || !initDispatch(GRALLOC1_FUNCTION_GET_STRIDE, &mDispatch.getStride) || !initDispatch(GRALLOC1_FUNCTION_ALLOCATE, &mDispatch.allocate) || !initDispatch(GRALLOC1_FUNCTION_RELEASE, &mDispatch.release)) { return false; } if (mCapabilities.layeredBuffers) { if (!initDispatch(GRALLOC1_FUNCTION_SET_LAYER_COUNT, &mDispatch.setLayerCount)) { return false; } } return true; } 

initDispatch里面调用了一系列带参数的initDispatch函数：

template <typename T> bool initDispatch(gralloc1_function_descriptor_t desc, T* outPfn) { auto pfn = mDevice->getFunction(mDevice, desc); if (pfn) { *outPfn = reinterpret_cast<T>(pfn); return true; } else { ALOGE("failed to get gralloc1 function %d", desc); return false; } } 

可以看到最终还是调到Gralloc模块下的device的getFunction去获取对应函数指针，获取到的函数指针会放入mDispatch中，mDispatch结构体如下：

struct {         GRALLOC1_PFN_DUMP dump;         GRALLOC1_PFN_CREATE_DESCRIPTOR createDescriptor;         GRALLOC1_PFN_DESTROY_DESCRIPTOR destroyDescriptor;         GRALLOC1_PFN_SET_DIMENSIONS setDimensions;         GRALLOC1_PFN_SET_FORMAT setFormat;         GRALLOC1_PFN_SET_LAYER_COUNT setLayerCount;         GRALLOC1_PFN_SET_CONSUMER_USAGE setConsumerUsage;         GRALLOC1_PFN_SET_PRODUCER_USAGE setProducerUsage;         GRALLOC1_PFN_GET_STRIDE getStride;         GRALLOC1_PFN_ALLOCATE allocate;         GRALLOC1_PFN_RELEASE release; } mDispatch = {}; 

mDispatch中的GRALLOC1_PFN_xxx全部是定义在gralloc1.h的函数指针，这样就完成了gralloc1.h的函数的赋值，现在只需要有一个实现getFunction的device就行了。

Gralloc模块的HAL各个厂商有自己的实现，我们这里看看高通平台的Gralloc HAL，目录/hardware/qcom/display/msm8996/libgralloc1/gr_device_impl.cpp

struct gralloc_module_t HAL_MODULE_INFO_SYM = { .common = { .tag = HARDWARE_MODULE_TAG, .module_api_version = GRALLOC_MODULE_API_VERSION_1_0, .hal_api_version    = HARDWARE_HAL_API_VERSION, .id = GRALLOC_HARDWARE_MODULE_ID, .name = "Graphics Memory Module", .author = "Code Aurora Forum", .methods = &gralloc_module_methods, .dso = 0, .reserved = {0}, }, }; 

先看打开设备的函数：
gralloc_module_methods:

static struct hw_module_methods_t gralloc_module_methods = {.open = gralloc_device_open}; 

gralloc_device_open:

int gralloc_device_open(const struct hw_module_t *module, const char *name, hw_device_t **device) { int status = -EINVAL; if (!strcmp(name, GRALLOC_HARDWARE_MODULE_ID)) {     gralloc1::GrallocImpl * /*gralloc1_device_t*/ dev = gralloc1::GrallocImpl::GetInstance(module); *device = reinterpret_cast<hw_device_t *>(dev); if (dev) {       status = 0; } else { ALOGE("Fatal error opening gralloc1 device"); } } return status; } 

实际是一个GrallocImpl类，这是gralloc1_device_t的子类，定义在gr_device_impl.h 中：

class GrallocImpl : public gralloc1_device_t { public: static int CloseDevice(hw_device_t *device); static void GetCapabilities(struct gralloc1_device *device, uint32_t *out_count, int32_t * /*gralloc1_capability_t*/ out_capabilities); static gralloc1_function_pointer_t GetFunction( struct gralloc1_device *device, int32_t /*gralloc1_function_descriptor_t*/ descriptor); static GrallocImpl* GetInstance(const struct hw_module_t *module) { static GrallocImpl *instance = new GrallocImpl(module); if (instance->IsInitialized()) { return instance; } else { return nullptr; } } 

GrallocImpl构造函数中做了一些初始化：

GrallocImpl::GrallocImpl(const hw_module_t *module) {   common.tag = HARDWARE_DEVICE_TAG;   common.version = GRALLOC_MODULE_API_VERSION_1_0;   common.module = const_cast<hw_module_t *>(module);   common.close = CloseDevice;   getFunction = GetFunction;   getCapabilities = GetCapabilities;    initalized_ = Init(); } 

getFunction被赋值为了GrallocImpl::GetFunction：

gralloc1_function_pointer_t GrallocImpl::GetFunction(gralloc1_device_t *device, int32_t function) { if (!device) { return NULL; } switch (function) { case GRALLOC1_FUNCTION_DUMP: return reinterpret_cast<gralloc1_function_pointer_t>(Dump); case GRALLOC1_FUNCTION_CREATE_DESCRIPTOR: return reinterpret_cast<gralloc1_function_pointer_t>(CreateBufferDescriptor); case GRALLOC1_FUNCTION_DESTROY_DESCRIPTOR: return reinterpret_cast<gralloc1_function_pointer_t>(DestroyBufferDescriptor); case GRALLOC1_FUNCTION_SET_CONSUMER_USAGE: return reinterpret_cast<gralloc1_function_pointer_t>(SetConsumerUsage); case GRALLOC1_FUNCTION_SET_DIMENSIONS: return reinterpret_cast<gralloc1_function_pointer_t>(SetBufferDimensions); case GRALLOC1_FUNCTION_SET_FORMAT: return reinterpret_cast<gralloc1_function_pointer_t>(SetColorFormat); case GRALLOC1_FUNCTION_SET_LAYER_COUNT: return reinterpret_cast<gralloc1_function_pointer_t>(SetLayerCount); case GRALLOC1_FUNCTION_SET_PRODUCER_USAGE: return reinterpret_cast<gralloc1_function_pointer_t>(SetProducerUsage); case GRALLOC1_FUNCTION_GET_BACKING_STORE: return reinterpret_cast<gralloc1_function_pointer_t>(GetBackingStore); case GRALLOC1_FUNCTION_GET_CONSUMER_USAGE: return reinterpret_cast<gralloc1_function_pointer_t>(GetConsumerUsage); case GRALLOC1_FUNCTION_GET_DIMENSIONS: return reinterpret_cast<gralloc1_function_pointer_t>(GetBufferDimensions); case GRALLOC1_FUNCTION_GET_FORMAT: return reinterpret_cast<gralloc1_function_pointer_t>(GetColorFormat); case GRALLOC1_FUNCTION_GET_LAYER_COUNT: return reinterpret_cast<gralloc1_function_pointer_t>(GetLayerCount); case GRALLOC1_FUNCTION_GET_PRODUCER_USAGE: return reinterpret_cast<gralloc1_function_pointer_t>(GetProducerUsage); case GRALLOC1_FUNCTION_GET_STRIDE: return reinterpret_cast<gralloc1_function_pointer_t>(GetBufferStride); case GRALLOC1_FUNCTION_ALLOCATE: return reinterpret_cast<gralloc1_function_pointer_t>(AllocateBuffers); case GRALLOC1_FUNCTION_RETAIN: return reinterpret_cast<gralloc1_function_pointer_t>(RetainBuffer); case GRALLOC1_FUNCTION_RELEASE: return reinterpret_cast<gralloc1_function_pointer_t>(ReleaseBuffer); case GRALLOC1_FUNCTION_GET_NUM_FLEX_PLANES: return reinterpret_cast<gralloc1_function_pointer_t>(GetNumFlexPlanes); case GRALLOC1_FUNCTION_LOCK: return reinterpret_cast<gralloc1_function_pointer_t>(LockBuffer); case GRALLOC1_FUNCTION_LOCK_FLEX: return reinterpret_cast<gralloc1_function_pointer_t>(LockFlex); case GRALLOC1_FUNCTION_UNLOCK: return reinterpret_cast<gralloc1_function_pointer_t>(UnlockBuffer); case GRALLOC1_FUNCTION_PERFORM: return reinterpret_cast<gralloc1_function_pointer_t>(Gralloc1Perform); case GRALLOC1_FUNCTION_VALIDATE_BUFFER_SIZE: return reinterpret_cast<gralloc1_function_pointer_t>(validateBufferSize); case GRALLOC1_FUNCTION_GET_TRANSPORT_SIZE: return reinterpret_cast<gralloc1_function_pointer_t>(getTransportSize); case GRALLOC1_FUNCTION_IMPORT_BUFFER: return reinterpret_cast<gralloc1_function_pointer_t>(importBuffer); default: ALOGE("%s:Gralloc Error. Client Requested for unsupported function", __FUNCTION__); return NULL; } return NULL; } 

GetFunction函数中才真正给gralloc1.h中定义的函数赋了具体实现，实现都在GrallocImpl中，最终gralloc_device_open方法打开了设备，将GrallocImpl作为gralloc1_device_t的子类返回到了Gralloc1HalImpl中，保存在mDevice中。

再回到前面：

static IAllocator* load() { const hw_module_t* module = loadModule(); if (!module) { return nullptr; } auto hal = createHal(module); if (!hal) { return nullptr; } return createAllocator(std::move(hal)); } 

最后再来看createAllocator函数

createAllocator

 // create an IAllocator instance static IAllocator* createAllocator(std::unique_ptr<hal::AllocatorHal> hal) { auto allocator = std::make_unique<hal::Allocator>(); return allocator->init(std::move(hal)) ? allocator.release() : nullptr; } 

创建了一个hal::Allocator，并调用了其init函数，将createHal的到Gralloc1Hal传了过去，
Allocator定义在Allocator.h中：

using Allocator = detail::AllocatorImpl<IAllocator, AllocatorHal>; 

其实例为AllocatorImpl。

template <typename Interface, typename Hal> class AllocatorImpl : public Interface { } 

这是个模板类继承IAllocator，这就是IAllocator.hal的具体实现类，我们前面在SurfaceFlinger进程中的对于内存分配的调用首先就是到这里，它的init函数其实就是将Gralloc1Hal保存在了AllocatorImpl的mHal中

bool init(std::unique_ptr<Hal> hal) {           mHal = std::move(hal); return true; } 

现在我们终于知道了前面Gralloc2Allocator的allocate函数具体是调到哪里去了，就是IAllocator.hal的实现server端AllocatorImpl，

AllocatorImpl::allocate

Return<void> allocate(const BufferDescriptor& descriptor, uint32_t count,                             IAllocator::allocate_cb hidl_cb) override { uint32_t stride;           std::vector<const native_handle_t*> buffers;           Error error = mHal->allocateBuffers(descriptor, count, &stride, &buffers); if (error != Error::NONE) { hidl_cb(error, 0, hidl_vec<hidl_handle>()); return Void(); }              hidl_vec<hidl_handle> hidlBuffers(buffers.cbegin(), buffers.cend()); hidl_cb(Error::NONE, stride, hidlBuffers); // free the local handles           mHal->freeBuffers(buffers); return Void(); } 

记得吗，Gralloc2Allocator的allocate函数传了一个callback过来，上面这个函数先调用mHal->allocateBuffers之后得到会通过callback将stride，hidlBuffers传回去。

我们刚刚已经知道了mHal就是Gralloc1Hal，继续看mHal->allocateBuffers函数，注意，这里将一个native_handle_t的vector地址传了过去，可以为多个buffer分配内存取决与上层传递的bufferCount

Gralloc1Hal::allocateBuffers

Error allocateBuffers(const BufferDescriptor& descriptor, uint32_t count, uint32_t* outStride,                           std::vector<const native_handle_t*>* outBuffers) override { ......         gralloc1_buffer_descriptor_t desc;         Error error = createDescriptor(descriptorInfo, &desc);         std::vector<const native_handle_t*> buffers;         buffers.reserve(count); // allocate the buffers for (uint32_t i = 0; i < count; i++) { const native_handle_t* tmpBuffer; uint32_t tmpStride;             error = allocateOneBuffer(desc, &tmpBuffer, &tmpStride); if (error != Error::NONE) { break; }              buffers.push_back(tmpBuffer); if (stride == 0) {                 stride = tmpStride; } else if (stride != tmpStride) { // non-uniform strides                 error = Error::UNSUPPORTED; break; } } ..... *outStride = stride; *outBuffers = std::move(buffers); return Error::NONE; } 

上面函数继续调用allocateOneBuffer函数：

allocateOneBuffer

Error allocateOneBuffer(gralloc1_buffer_descriptor_t descriptor, const native_handle_t** outBuffer, uint32_t* outStride) { const native_handle_t* buffer = nullptr; int32_t error = mDispatch.allocate(mDevice, 1, &descriptor, &buffer); if (error != GRALLOC1_ERROR_NONE && error != GRALLOC1_ERROR_NOT_SHARED) { return toError(error); } uint32_t stride = 0;         error = mDispatch.getStride(mDevice, buffer, &stride); if (error != GRALLOC1_ERROR_NONE && error != GRALLOC1_ERROR_UNDEFINED) {             mDispatch.release(mDevice, buffer); return toError(error); } *outBuffer = buffer; *outStride = stride; return Error::NONE; } 

allocateOneBuffer函数中接着调用mDispatch.allocate，前面已经分析过了mDispatch结构体一系列函数指针的赋值了，mDispatch.allocate的赋值函数如下：

initDispatch(GRALLOC1_FUNCTION_ALLOCATE, &mDispatch.allocate) 

对应到GrallocImpl的这一条：

  gralloc1_function_pointer_t GrallocImpl::GetFunction(gralloc1_device_t *device, int32_t function) { ... switch (function) { ...... case GRALLOC1_FUNCTION_ALLOCATE: return reinterpret_cast<gralloc1_function_pointer_t>(AllocateBuffers); ...... } 

即对应的HAL实现为AllocateBuffers函数：

GrallocImpl::AllocateBuffers

gralloc1_error_t GrallocImpl::AllocateBuffers(gralloc1_device_t *device, uint32_t num_descriptors, const gralloc1_buffer_descriptor_t *descriptors,                                                 buffer_handle_t *out_buffers) { if (!num_descriptors || !descriptors) { return GRALLOC1_ERROR_BAD_DESCRIPTOR; }        GrallocImpl const *dev = GRALLOC_IMPL(device);     gralloc1_error_t status = dev->buf_mgr_->AllocateBuffers(num_descriptors, descriptors,                                                             out_buffers); return status; } 

buf_mgr_是一个BufferManager对象，写到这里就不准备往下看了，能力不足，等到驱动对内存分配完毕之后还需要调用GraphicBufferMapper的importBuffer函数进一步处理handle才能使用，importBuffer最终也会调到HAL层。
到此还是不知道GraphicBuffer内存具体是怎么分配的，但我们了解了从framework到HAL的流程。

总结一下：

1. Gralloc2Allocator初始化中会获取IAllocator.hal的HIDL client端，通过client端调用allocate函数。
2. 接着调到IAllocator.hal具体实现AllocatorImpl中。
3. AllocatorImpl初始化时会加载Gralloc模块，用的是gralloc1.h，并创建Gralloc1Hal，具体实现是Gralloc1HalImpl对象。
4. Gralloc1HalImpl的initWithModule会打开Gralloc下的具体设备，这个设备是GrallocImpl，这是gralloc1_device_t子类。
5. GrallocImpl中实现了gralloc1.h的函数，是通过调用其内部GetFunction函数给gralloc1.h的函数指针赋值的。
6. GrallocImpl有一个BufferManager，用来管理Buffer，负责具体的buffer内存分配。