Android14 显示系统剖析4 ———— 显示配置信息获取与 SurfaceControl 初始化

本文基于 android-14.0.0_r15 版本讲解。

1. 回顾

上一节，我们分析了 Native App 与 SurfaceFinger 建立 Binder 通信的过程:

• SurfaceFlinger 进程中提供了 SurfaceFlinger Binder 服务，SurfaceFlingerAIDL Binder 服务和一个名为 Client 的匿名 Binder 服务

整个 binder 通信通道的建立过程：

• App 向 ServiceManager 查询 SurfaceFlingerAIDL 服务，获取到服务的代理端对象
• 接着远程调用 SurfaceFlingerAIDL 服务的 createConnection 函数，获取到 Client 匿名服务的代理端对象
• App 想要调用 SurfaceFlinger 相关的功能，可以远程调用 Client 服务，Client 服务中具体的功能再委托给 SurfaceFlinger 来实现。

2. 整体流程

我们接着看后续的代码：

int main(int argc, char ** argv) {

    // ......


    // 获取到显示设备的 ID
    // 返回的是一个 vector，因为存在多屏或者投屏等情况
    const std::vector<PhysicalDisplayId> ids = SurfaceComposerClient::getPhysicalDisplayIds();
    if (ids.empty()) {
        ALOGE("Failed to get ID for any displays\n");
        return;
    }   

    //displayToken 是屏幕的索引
    sp<IBinder> displayToken = nullptr;
    
    // 示例仅考虑只有一个屏幕的情况
    displayToken = SurfaceComposerClient::getPhysicalDisplayToken(ids.front());
    
    // 获取屏幕相关参数
    ui::DisplayMode displayMode;
    err = SurfaceComposerClient::getActiveDisplayMode(displayToken, &displayMode);
    if (err != OK)
        return;    

    
    ui::Size resolution = displayMode.resolution; 
    resolution = limitSurfaceSize(resolution.width, resolution.height);

    // 创建 Surface
    sp<SurfaceControl> surfaceControl = surfaceComposerClient->createSurface(mName, resolution.getWidth(), 
                                                                             resolution.getHeight(), PIXEL_FORMAT_RGBA_8888,
                                                                             ISurfaceComposerClient::eFXSurfaceBufferState,
                                                                             /*parent*/ nullptr);

    // ......
}

上面的代码基本就以下几步：

• 1. 建立 App 到 SurfaceFlinger 的 Binder 通信通道（上一节已经分析）
• 2. 向 Client 匿名服务发起远程调用 SurfaceComposerClient::getPhysicalDisplayIds() 获取到显示设备的 ID，返回的是一个 vector，因为存在多屏或者投屏等情况
• 3. 发起远程调用 SurfaceComposerClient::getPhysicalDisplayToken(ids.front()) 获取到显示设备的索引 displayToken
• 4. 发起远程调用 SurfaceComposerClient::getActiveDisplayMode 获取到屏幕相关参数，返回的结果保存在 DisplayMode 对象中
• 5. 最后发起远程调用 surfaceComposerClient->createSurface 创建 Surface，这个就有的说了

第 1 步上一节已经分析了，

2,3,4 步发起远程调用获取一些屏幕相关的配置信息，不是重点，了解一下即可。

第 5 步创建一个 SurfaceControl，这个很重要

3. SurfaceControl 构建过程分析

3.1 图层概念回顾

图层的概念之前说过，我们这里在回顾一下：

（图片来自 www.jianshu.com/p/b0ef7c044…

在很多的图形相关的软件中都有图层的概念，那什么是图层呢？

简单的说，可以将每个图层理解为一张透明的纸，将图像的各部分绘制在不同的透明纸（图层）上。透过这层纸，可以看到纸后面的东西，而且每层纸都是独立的，无论在这层纸上如何涂画，都不会影响到其他图层中的图像。也就是说，每个图层可以独立编辑或修改，最后将透明纸叠加起来，从上向下俯瞰，即可得到并实时改变最终的合成效果。

分析代码之前，我们先了解 SurfaceControl 创建过程中涉及到的类：

• Surface 对象用于在 Native App 中描述一个图层，每一个 Surface 对象都是由一个 SurfaceControl 对象来创建的，可以认为 Surface 和 SurfaceControl 是等价的
• Layer 对象用于在 SurfaceFlinger 中描述一个图层。
• 一个 Surface 对应一个 Layer

SurfaceFlinger 是一个独立的 Service， 它接收 Surface 作为输入，根据 Z-Order， 透明度，大小，位置等参数，构建一个对应的 Layer 对象，计算出每个 Layer 在最终合成图像中的位置，然后交由 HWComposer 或 OpenGL 生成最终的显示 Buffer, 然后显示到特定的显示设备上。

3.2 Layer 构建过程分析

我们的示例程序中使用如下的代码构建一个 SurfaceControl 对象：

    // 创建 Surface
    sp<SurfaceControl> surfaceControl = surfaceComposerClient->createSurface(mName, resolution.getWidth(), 
                                                                             resolution.getHeight(), PIXEL_FORMAT_RGBA_8888,
                                                                             ISurfaceComposerClient::eFXSurfaceBufferState,
                                                                             /*parent*/ nullptr);

createSurface 是一个远程调用函数，会调用到 SurfaceFligner 进程中 Client 对象的 createSurface 函数。

函数会返回一个 SurfaceControl 对象，SurfaceControl 用于构建一个 Surface，SurfaceControl/Surface 在 App 端代表了一个图层，它的定义如下：

class SurfaceControl : public RefBase
{

// ......

private:
    // can't be copied
    SurfaceControl& operator = (SurfaceControl& rhs);
    SurfaceControl(const SurfaceControl& rhs);

    friend class SurfaceComposerClient;
    friend class Surface;

    ~SurfaceControl();

    sp<Surface> generateSurfaceLocked();
    status_t validate() const;

    // 应用创建的SurfaceComposerClient对象指针，里面封装了和SurfaceFlinger通信的Binder客户端对象
    sp<SurfaceComposerClient>   mClient;  
    // layer handle
    // 对应的 SF 进程中的 Layer 的索引
    sp<IBinder> mHandle;
    mutable Mutex               mLock;
    // SurfaceControl 对应的 Surface
    mutable sp<Surface>         mSurfaceData;  
    // BLASTBufferQueue 实例
    mutable sp<BLASTBufferQueue> mBbq; 
    // SurfaceControl 的子节点，用树的方式管理图层
    mutable sp<SurfaceControl> mBbqChild;
    int32_t mLayerId = 0;
    std::string mName;
    uint32_t mTransformHint = 0;
    uint32_t mWidth = 0;
    uint32_t mHeight = 0;
    PixelFormat mFormat = PIXEL_FORMAT_NONE;
    uint32_t mCreateFlags = 0;
    uint64_t mFallbackFrameNumber = 100;
    std::shared_ptr<Choreographer> mChoreographer;
};

这里关心它的几个重要成员，在注释中已做说明。

接下来我们来看 createSurface 函数的执行过程

// /frameworks/native/libs/gui/SurfaceComposerClient.cpp

sp<SurfaceControl> SurfaceComposerClient::createSurface(const String8& name, uint32_t w, uint32_t h,
                                                        PixelFormat format, int32_t flags,
                                                        const sp<IBinder>& parentHandle,
                                                        LayerMetadata metadata,
                                                        uint32_t* outTransformHint) {
    sp<SurfaceControl> s;
    createSurfaceChecked(name, w, h, format, &s, flags, parentHandle, std::move(metadata),
                         outTransformHint);
    return s;
}

接着调用 createSurfaceChecked：

// /frameworks/native/libs/gui/include/gui/SurfaceComposerClient.h
sp<ISurfaceComposerClient>  mClient;

// /frameworks/native/libs/gui/SurfaceComposerClient.cpp
status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, int32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
    sp<SurfaceControl> sur;
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        gui::CreateSurfaceResult result;
        
        // 发起远程调用
        // 创建 Layer
        // Layer 相关的信息通过参数 result 返回
        // 重点关注 result 中的 handle 成员
        binder::Status status = mClient->createSurface(std::string(name.string()), flags,
                                                       parentHandle, std::move(metadata), &result);
        err = statusTFromBinderStatus(status);
        if (outTransformHint) {
            *outTransformHint = result.transformHint;
        }
        ALOGE_IF(err, "SurfaceComposerClient::createSurface error %s", strerror(-err));
        if (err == NO_ERROR) {
            
            // 通过 Result 的参数 new 一个 SurfaceControl
            // 重点是 handle
            *outSurface = new SurfaceControl(this, result.handle, result.layerId,
                                             toString(result.layerName), w, h, format,
                                             result.transformHint, flags);
        }
    }
    return err;
}

mClient 是匿名 Binder 服务 Client 的代理端对象，这里远程调用到 SurfaceFlinger 进程中的 createSurface 函数，最终会调用到服务端 Client 类的 createSurface 函数中。

远程调用 createSurface 会返回一个 gui::CreateSurfaceResult result 对象，接着会用这个对象中的成员构造一个 SurfaceControl 对象并返回。

接下来我们来看服务端的 createSurface 函数：

// /frameworks/native/services/surfaceflinger/Client.h
sp<SurfaceFlinger> mFlinger;

// /frameworks/native/services/surfaceflinger/Client.cpp
binder::Status Client::createSurface(const std::string& name, int32_t flags,
                                     const sp<IBinder>& parent, const gui::LayerMetadata& metadata,
                                     gui::CreateSurfaceResult* outResult) {

    // We rely on createLayer to check permissions.
    sp<IBinder> handle;
    LayerCreationArgs args(mFlinger.get(), sp<Client>::fromExisting(this), name.c_str(),
                           static_cast<uint32_t>(flags), std::move(metadata));
    // handle 放到了 LayerCreationArgs 中，这个 handle 是我们即将要创建的 Layer 的父 Layer 的索引
    // 需要注意的是 CreateSurfaceResult 中也有一个 handle，这个是我们要创建的 Layer 的索引
    args.parentHandle = parent;
    // 接着调用 SurfaceFlinger 的 createLayer 函数
    const status_t status = mFlinger->createLayer(args, *outResult);
    return binderStatusFromStatusT(status);
}

createSruface 中会接着调用 SurfaceFlinger 的 createLayer 函数，createlayer 函数的两个参数分别是 LayerCreationArgs 和 CreateSurfaceResult

LayerCreationArgs 是创建 Layer 相关的参数。

CreateSurfaceResult 用于保存即将创建的 Layer 的相关信息，继承自 Parcelable，可以通过 Binder 传输。

class CreateSurfaceResult : public ::android::Parcelable {
}

createSurface 函数中的 CreateSurfaceResult 以参数的形式返回给客户端。

SurfaceFlinger 的 createLayer 函数实现如下：

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

status_t SurfaceFlinger::createLayer(LayerCreationArgs& args, gui::CreateSurfaceResult& outResult) {
    status_t result = NO_ERROR;

    sp<Layer> layer;

    // flags 的值为  ISurfaceComposerClient::eFXSurfaceBufferState
    switch (args.flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceBufferQueue:
        case ISurfaceComposerClient::eFXSurfaceContainer:
        case ISurfaceComposerClient::eFXSurfaceBufferState:    // 走这个 case 
            args.flags |= ISurfaceComposerClient::eNoColorFill;  
            FMT_FALLTHROUGH;
        case ISurfaceComposerClient::eFXSurfaceEffect: { // 上面没有 break，这个 case 也会走
            // 创建 Layer 对象
            // args 中有个 handle 
            // 第二个参数也是一个 handle
            result = createBufferStateLayer(args, &outResult.handle, &layer);
            std::atomic<int32_t>* pendingBufferCounter = layer->getPendingBufferCounter();
            if (pendingBufferCounter) {
                std::string counterName = layer->getPendingBufferCounterName();
                mBufferCountTracker.add(outResult.handle->localBinder(), counterName,
                                        pendingBufferCounter);
            }
        } break;
        default:
            result = BAD_VALUE;
            break;
    }

    if (result != NO_ERROR) {
        return result;
    }

    args.addToRoot = args.addToRoot && callingThreadHasUnscopedSurfaceFlingerAccess();
    // We can safely promote the parent layer in binder thread because we have a strong reference
    // to the layer's handle inside this scope.
    // 使用 args.parentHandle 索引2134如图， 上4吗， 11 ·1其;..Ywdx/找到 Layer 的父节点
    sp<Layer> parent = LayerHandle::getLayer(args.parentHandle.promote());
    if (args.parentHandle != nullptr && parent == nullptr) {
        ALOGE("Invalid parent handle %p", args.parentHandle.promote().get());
        args.addToRoot = false;
    }

    uint32_t outTransformHint;

    // 使用树结构管理 Layer
    // layer 插入到树中
    result = addClientLayer(args, outResult.handle, layer, parent, &outTransformHint);
    if (result != NO_ERROR) {
        return result;
    }

    outResult.transformHint = static_cast<int32_t>(outTransformHint);
    outResult.layerId = layer->sequence;
    outResult.layerName = String16(layer->getDebugName());
    return result;
}

这里主要关注 createBufferStateLayer 的过程：

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::createBufferStateLayer(LayerCreationArgs& args, sp<IBinder>* handle,
                                                sp<Layer>* outLayer) {
    args.textureName = getNewTexture();
    *outLayer = getFactory().createBufferStateLayer(args);
    *handle = (*outLayer)->getHandle();
    return NO_ERROR;
}

这里通过工厂模式创建 BufferStateLayer，分析代码实现之前我们先看看 Layer 相关的类，这些类设计都比较复杂，直接分析代码会比较懵。

先看 Layer 的定义，

// /frameworks/native/services/surfaceflinger/Layer.h
class Layer : public virtual RefBase {
    // ......
    void onFirstRef() override;
    // .....
}

Layer 用于在 SurfaceFlinger 中表示一个图层，Layer 类继承自 RefBase 类，可以使用 Android 平台的 sp wp 管理 Layer 指针。其内部定义了 onFirstRef 对象，在首次引用时会被调用

Layer 中还有个重要的内部类 State，从名字就可以看出，State 用于描述一个 Layer 对象的状态。

State 内部参数很多，我们挑重要的讲：

    struct State {

        // z 坐标轴的值
        int32_t z;
        /*
         Android 系统支持多种显示设备，比如说，输出到手机屏幕，或者通过WiFi 投射到电视屏幕。Android用DisplayDevice类来表示这样的设备。不是所有的Layer都会输出到所有的Display, 比如说，我们可以只将Video Layer投射到电视， 而非整个屏幕。LayerStack 就是为此设计，LayerStack 是一个Display 对象的一个数值， 而类Layer里成员State结构体也有成员变量mLayerStack， 只有两者的mLayerStack 值相同，Layer才会被输出到给该Display设备。所以LayerStack 决定了每个Display设备上可以显示的Layer数目。   
        */
        ui::LayerStack layerStack;
        uint32_t flags;
        // / Layer 的序列号，每次图元的属性发生改变时，这个序列号都需要自增
        int32_t sequence; // changes when visible regions can change
        bool modified;
        // Crop is expressed in layer space coordinate.
        Rect crop;
        LayerMetadata metadata;
        // If non-null, a Surface this Surface's Z-order is interpreted relative to.
        wp<Layer> zOrderRelativeOf;
        bool isRelativeOf{false};

        // A list of surfaces whose Z-order is interpreted relative to ours.
        SortedVector<wp<Layer>> zOrderRelatives;
        half4 color;
        float cornerRadius;
        int backgroundBlurRadius;
        gui::WindowInfo inputInfo;
        wp<Layer> touchableRegionCrop;

        ui::Dataspace dataspace;

        uint64_t frameNumber;
        // high watermark framenumber to use to check for barriers to protect ourselves
        // from out of order transactions
        uint64_t barrierFrameNumber;
        ui::Transform transform;

        uint32_t producerId = 0;
        // high watermark producerId to use to check for barriers to protect ourselves
        // from out of order transactions
        uint32_t barrierProducerId = 0;

        uint32_t bufferTransform;
        bool transformToDisplayInverse;
        Region transparentRegionHint;
        std::shared_ptr<renderengine::ExternalTexture> buffer;
        sp<Fence> acquireFence;
        std::shared_ptr<FenceTime> acquireFenceTime;
        HdrMetadata hdrMetadata;
        Region surfaceDamageRegion;
        int32_t api;
        sp<NativeHandle> sidebandStream;
        mat4 colorTransform;
        bool hasColorTransform;
        // pointer to background color layer that, if set, appears below the buffer state layer
        // and the buffer state layer's children.  Z order will be set to
        // INT_MIN
        sp<Layer> bgColorLayer;

        // The deque of callback handles for this frame. The back of the deque contains the most
        // recent callback handle.
        std::deque<sp<CallbackHandle>> callbackHandles;
        bool colorSpaceAgnostic;
        nsecs_t desiredPresentTime = 0;
        bool isAutoTimestamp = true;

        // Length of the cast shadow. If the radius is > 0, a shadow of length shadowRadius will
        // be rendered around the layer.
        float shadowRadius;

        // Layer regions that are made of custom materials, like frosted glass
        std::vector<BlurRegion> blurRegions;

        // Priority of the layer assigned by Window Manager.
        int32_t frameRateSelectionPriority;

        // Default frame rate compatibility used to set the layer refresh rate votetype.
        FrameRateCompatibility defaultFrameRateCompatibility;
        FrameRate frameRate;

        // The combined frame rate of parents / children of this layer
        FrameRate frameRateForLayerTree;

        // Set by window manager indicating the layer and all its children are
        // in a different orientation than the display. The hint suggests that
        // the graphic producers should receive a transform hint as if the
        // display was in this orientation. When the display changes to match
        // the layer orientation, the graphic producer may not need to allocate
        // a buffer of a different size. ui::Transform::ROT_INVALID means the
        // a fixed transform hint is not set.
        ui::Transform::RotationFlags fixedTransformHint;

        // The vsync info that was used to start the transaction
        FrameTimelineInfo frameTimelineInfo;

        // When the transaction was posted
        nsecs_t postTime;
        sp<ITransactionCompletedListener> releaseBufferListener;
        // SurfaceFrame that tracks the timeline of Transactions that contain a Buffer. Only one
        // such SurfaceFrame exists because only one buffer can be presented on the layer per vsync.
        // If multiple buffers are queued, the prior ones will be dropped, along with the
        // SurfaceFrame that's tracking them.
        std::shared_ptr<frametimeline::SurfaceFrame> bufferSurfaceFrameTX;
        // A map of token(frametimelineVsyncId) to the SurfaceFrame that's tracking a transaction
        // that contains the token. Only one SurfaceFrame exisits for transactions that share the
        // same token, unless they are presented in different vsyncs.
        std::unordered_map<int64_t, std::shared_ptr<frametimeline::SurfaceFrame>>
                bufferlessSurfaceFramesTX;
        // An arbitrary threshold for the number of BufferlessSurfaceFrames in the state. Used to
        // trigger a warning if the number of SurfaceFrames crosses the threshold.
        static constexpr uint32_t kStateSurfaceFramesThreshold = 25;

        // Stretch effect to apply to this layer
        StretchEffect stretchEffect;

        // Whether or not this layer is a trusted overlay for input
        bool isTrustedOverlay;
        Rect bufferCrop;
        Rect destinationFrame;
        sp<IBinder> releaseBufferEndpoint;
        gui::DropInputMode dropInputMode;
        bool autoRefresh = false;
        bool dimmingEnabled = true;
        float currentHdrSdrRatio = 1.f;
        float desiredHdrSdrRatio = 1.f;
        gui::CachingHint cachingHint = gui::CachingHint::Enabled;
        int64_t latchedVsyncId = 0;
        bool useVsyncIdForRefreshRateSelection = false;
    };

Layer 中有一个 State mDrawingState; 成员，用于描述 Layer 的 State

回过头来在分析创建 Layer 的过程

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::createBufferStateLayer(LayerCreationArgs& args, sp<IBinder>* handle,
                                                sp<Layer>* outLayer) {
    args.textureName = getNewTexture();
    *outLayer = getFactory().createBufferStateLayer(args);
    *handle = (*outLayer)->getHandle();
    return NO_ERROR;
}

surfaceflinger::Factory& getFactory() { return mFactory; }

mFactory 在哪里初始化呢？

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

SurfaceFlinger::SurfaceFlinger(Factory& factory, SkipInitializationTag)
      : mFactory(factory), // 这里赋值
        mPid(getpid()),
        mTimeStats(std::make_shared<impl::TimeStats>()),
        mFrameTracer(mFactory.createFrameTracer()),
        mFrameTimeline(mFactory.createFrameTimeline(mTimeStats, mPid)),
        mCompositionEngine(mFactory.createCompositionEngine()),
        mHwcServiceName(base::GetProperty("debug.sf.hwc_service_name"s, "default"s)),
        mTunnelModeEnabledReporter(sp<TunnelModeEnabledReporter>::make()),
        mEmulatedDisplayDensity(getDensityFromProperty("qemu.sf.lcd_density", false)),
        mInternalDisplayDensity(
                getDensityFromProperty("ro.sf.lcd_density", !mEmulatedDisplayDensity)),
        mPowerAdvisor(std::make_unique<Hwc2::impl::PowerAdvisor>(*this)),
        mWindowInfosListenerInvoker(sp<WindowInfosListenerInvoker>::make()) {
    ALOGI("Using HWComposer service: %s", mHwcServiceName.c_str());
}

那 SurfaceFliger 又在哪里初始化呢？

// /frameworks/native/services/surfaceflinger/main_surfaceflinger.cpp
int main(int, char**) {
    // ......
    // instantiate surfaceflinger
    sp<SurfaceFlinger> flinger = surfaceflinger::createSurfaceFlinger();
    // ......
}

// /frameworks/native/services/surfaceflinger/SurfaceFlingerFactory.cpp
sp<SurfaceFlinger> createSurfaceFlinger() {
    static DefaultFactory factory;

    return sp<SurfaceFlinger>::make(factory);
}

终于找到了，传入的是 DefaultFactory 对象， 接下来看 DefaultFactory 的实现：

sp<Layer> DefaultFactory::createBufferStateLayer(const LayerCreationArgs& args) {
    return sp<Layer>::make(args);
}

就是简单 new 一个 layer，layer 的构造函数实现如下：

// /frameworks/native/services/surfaceflinger/Layer.cpp

Layer::Layer(const LayerCreationArgs& args)
      : sequence(args.sequence),
        mFlinger(sp<SurfaceFlinger>::fromExisting(args.flinger)),
        mName(base::StringPrintf("%s#%d", args.name.c_str(), sequence)),
        mClientRef(args.client),
        mWindowType(static_cast<WindowInfo::Type>(
                args.metadata.getInt32(gui::METADATA_WINDOW_TYPE, 0))),
        mLayerCreationFlags(args.flags),
        mBorderEnabled(false),
        mTextureName(args.textureName),
        mLegacyLayerFE(args.flinger->getFactory().createLayerFE(mName)) {

    ALOGV("Creating Layer %s", getDebugName());

    uint32_t layerFlags = 0;
    if (args.flags & ISurfaceComposerClient::eHidden) layerFlags |= layer_state_t::eLayerHidden;
    if (args.flags & ISurfaceComposerClient::eOpaque) layerFlags |= layer_state_t::eLayerOpaque;
    if (args.flags & ISurfaceComposerClient::eSecure) layerFlags |= layer_state_t::eLayerSecure;
    if (args.flags & ISurfaceComposerClient::eSkipScreenshot)
        layerFlags |= layer_state_t::eLayerSkipScreenshot;
    mDrawingState.flags = layerFlags;
    mDrawingState.crop.makeInvalid();
    mDrawingState.z = 0;
    mDrawingState.color.a = 1.0f;
    mDrawingState.layerStack = ui::DEFAULT_LAYER_STACK;
    mDrawingState.sequence = 0;
    mDrawingState.transform.set(0, 0);
    mDrawingState.frameNumber = 0;
    mDrawingState.barrierFrameNumber = 0;
    mDrawingState.producerId = 0;
    mDrawingState.barrierProducerId = 0;
    mDrawingState.bufferTransform = 0;
    mDrawingState.transformToDisplayInverse = false;
    mDrawingState.crop.makeInvalid();
    mDrawingState.acquireFence = sp<Fence>::make(-1);
    mDrawingState.acquireFenceTime = std::make_shared<FenceTime>(mDrawingState.acquireFence);
    mDrawingState.dataspace = ui::Dataspace::V0_SRGB;
    mDrawingState.hdrMetadata.validTypes = 0;
    mDrawingState.surfaceDamageRegion = Region::INVALID_REGION;
    mDrawingState.cornerRadius = 0.0f;
    mDrawingState.backgroundBlurRadius = 0;
    mDrawingState.api = -1;
    mDrawingState.hasColorTransform = false;
    mDrawingState.colorSpaceAgnostic = false;
    mDrawingState.frameRateSelectionPriority = PRIORITY_UNSET;
    mDrawingState.metadata = args.metadata;
    mDrawingState.shadowRadius = 0.f;
    mDrawingState.fixedTransformHint = ui::Transform::ROT_INVALID;
    mDrawingState.frameTimelineInfo = {};
    mDrawingState.postTime = -1;
    mDrawingState.destinationFrame.makeInvalid();
    mDrawingState.isTrustedOverlay = false;
    mDrawingState.dropInputMode = gui::DropInputMode::NONE;
    mDrawingState.dimmingEnabled = true;
    mDrawingState.defaultFrameRateCompatibility = FrameRateCompatibility::Default;

    if (args.flags & ISurfaceComposerClient::eNoColorFill) {
        // Set an invalid color so there is no color fill.
        mDrawingState.color.r = -1.0_hf;
        mDrawingState.color.g = -1.0_hf;
        mDrawingState.color.b = -1.0_hf;
    }

    mFrameTracker.setDisplayRefreshPeriod(
            args.flinger->mScheduler->getPacesetterVsyncPeriod().ns());

    mOwnerUid = args.ownerUid;
    mOwnerPid = args.ownerPid;

    mPremultipliedAlpha = !(args.flags & ISurfaceComposerClient::eNonPremultiplied);
    mPotentialCursor = args.flags & ISurfaceComposerClient::eCursorWindow;
    mProtectedByApp = args.flags & ISurfaceComposerClient::eProtectedByApp;

    mSnapshot->sequence = sequence;
    mSnapshot->name = getDebugName();
    mSnapshot->textureName = mTextureName;
    mSnapshot->premultipliedAlpha = mPremultipliedAlpha;
    mSnapshot->parentTransform = {};
}

构造函数主要就是给 mDrawingState 成员初始化，mDrawingState 用于表示 Layer 的状态。

还有个很重要的点，调用 Layer 的 getHandle 函数，返回一个 handle 给客户端:

sp<IBinder> Layer::getHandle() {
    Mutex::Autolock _l(mLock);
    if (mGetHandleCalled) {
        ALOGE("Get handle called twice" );
        return nullptr;
    }
    mGetHandleCalled = true;
    mHandleAlive = true;
    return sp<LayerHandle>::make(mFlinger, sp<Layer>::fromExisting(this));
}

这里 new 一个 LayerHandle 返回， LayerHandle 的实现如下：

// /frameworks/native/services/surfaceflinger/FrontEnd/LayerHandle.h
class LayerHandle : public BBinder {
public:
    LayerHandle(const sp<android::SurfaceFlinger>& flinger, const sp<android::Layer>& layer);
    // for testing
    LayerHandle(uint32_t layerId) : mFlinger(nullptr), mLayer(nullptr), mLayerId(layerId) {}
    ~LayerHandle();

    // Static functions to access the layer and layer id safely from an incoming binder.
    static sp<LayerHandle> fromIBinder(const sp<IBinder>& handle);
    static sp<android::Layer> getLayer(const sp<IBinder>& handle);
    static uint32_t getLayerId(const sp<IBinder>& handle);
    static const String16 kDescriptor;

    const String16& getInterfaceDescriptor() const override { return kDescriptor; }

private:
    sp<android::SurfaceFlinger> mFlinger;
    sp<android::Layer> mLayer;
    const uint32_t mLayerId;
};

handle 的类型是 LayerHandle，是一个 Binder 服务端对象。这个 handle 最终会返回给 App 端，是一个索引，用于传递给 sf 找到对应的 Layer。

Layer 创建完成后，就会逐步返回到 createSurfaceChecked 函数中

// /frameworks/native/libs/gui/include/gui/SurfaceComposerClient.h
sp<ISurfaceComposerClient>  mClient;

// /frameworks/native/libs/gui/SurfaceComposerClient.cpp
status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, int32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
    sp<SurfaceControl> sur;
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        gui::CreateSurfaceResult result;
        
        // 创建 Layer
        // Layer 相关的信息通过参数 result 返回，result 中保存了 layer 相关的信息，最重要的是 handle ，handle 是一个索引，能找到对应的 Layer 对象
        binder::Status status = mClient->createSurface(std::string(name.string()), flags,
                                                       parentHandle, std::move(metadata), &result);
        err = statusTFromBinderStatus(status);
        if (outTransformHint) {
            *outTransformHint = result.transformHint;
        }
        ALOGE_IF(err, "SurfaceComposerClient::createSurface error %s", strerror(-err));
        if (err == NO_ERROR) {
            
            // 通过 Result 中的信息创建 SurfaceControl
            *outSurface = new SurfaceControl(this, result.handle, result.layerId,
                                             toString(result.layerName), w, h, format,
                                             result.transformHint, flags);
        }
    }
    return err;
}

接着通过 Result 中的信息创建 SurfaceControl：

SurfaceControl::SurfaceControl(const sp<SurfaceComposerClient>& client, const sp<IBinder>& handle,
                               int32_t layerId, const std::string& name, uint32_t w, uint32_t h,
                               PixelFormat format, uint32_t transform, uint32_t flags)
      : mClient(client),
        mHandle(handle),
        mLayerId(layerId),
        mName(name),
        mTransformHint(transform),
        mWidth(w),
        mHeight(h),
        mFormat(format),
        mCreateFlags(flags) {}

到这里呢，在 sf 进程中就创建好了 Layer 对象，在 App 进程中创建好了 SurfaceControl 对象，SurfaceControl 中有一个 mHandle 成员可以索引到对应的 Layer 对象中

接着看后面的代码：

    SurfaceComposerClient::Transaction{}
            .setLayer(surfaceControl, std::numeric_limits<int32_t>::max())
            .show(surfaceControl)
            .setBackgroundColor(surfaceControl, half3{0, 0, 0}, 1.0f, ui::Dataspace::UNKNOWN) // black background
            .setAlpha(surfaceControl, 1.0f)
            .setLayerStack(surfaceControl, ui::LayerStack::fromValue(mLayerStack))
            .apply();

开启一个事务，设置 Layer。

实际就是给 Layer 设置参数，参数传递到 sf 进程，然后通过 handle 找到对应的 layer 修改之

总结

• 远程调用获取显示配置信息
• App 向 SF 发起远程调用，SF 中创建一个 Layer 对象，App 中创建一个 SurfaceControl 对象，SurfaceControl 对象中有一个 mHandle 成员，该成员可以索引到 Layer 对象
• 远程调用，配置 Layer

参考资料

• 01 Android12 surfaceflinger详解
• Android P 图像显示系统（二）GraphicBuffer和Gralloc分析
• BufferQueue 学习总结（内附动态图）