Android14 显示系统剖 10 ———— SurfaceFlinger 图层合成过程分析中

4. commit 合成数据预处理

本节将对 commit 阶段预处理数据的过程进行详细解析。

4.1 回顾：预处理的数据都来自哪里？

commit 预处理合成相关的数据，需要预处理的数据主要来自三个方面：

1. App 调用 createSurface，创建图层，SurfaceFlinger 进程构建 Layer 对象
2. App 发起远程事务，配置图层，Transaction
3. App 通过 Transaction 提交渲染好的 buffer

接下来，我们逐一回顾这些数据的构建过程：

4.1.1 App 调用 createSurface

App 端的实现：

tring8 name("displaydemo");
    sp<SurfaceControl> surfaceControl = 
            surfaceComposerClient->createSurface(name, resolution.getWidth(), 
                                                    resolution.getHeight(), PIXEL_FORMAT_RGBA_8888,
                                                    ISurfaceComposerClient::eFXSurfaceBufferState,/*parent*/ nullptr);

createSurface 的实现如下：

// /frameworks/native/libs/gui/SurfaceComposerClient.cpp

sp<SurfaceControl> SurfaceComposerClient::createSurface(const String8& name, uint32_t w, uint32_t h,
                                                        PixelFormat format, int32_t flags,
                                                        const sp<IBinder>& parentHandle,
                                                        LayerMetadata metadata,
                                                        uint32_t* outTransformHint) {
    sp<SurfaceControl> s;
    createSurfaceChecked(name, w, h, format, &s, flags, parentHandle, std::move(metadata),
                         outTransformHint);
    return s;
}

接着调用 createSurfaceChecked：

// /frameworks/native/libs/gui/SurfaceComposerClient.cpp
status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, int32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
    sp<SurfaceControl> sur;
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        gui::CreateSurfaceResult result;
      
        // 发起远程调用
        // 创建 Layer
        // Layer 相关的信息通过参数 result 返回
        // 重点关注 result 中的 handle 成员
        binder::Status status = mClient->createSurface(std::string(name.string()), flags,
                                                       parentHandle, std::move(metadata), &result);
        err = statusTFromBinderStatus(status);
        if (outTransformHint) {
            *outTransformHint = result.transformHint;
        }
        ALOGE_IF(err, "SurfaceComposerClient::createSurface error %s", strerror(-err));
        if (err == NO_ERROR) {
          
            // 通过 Result 的参数 new 一个 SurfaceControl
            // 重点是 handle
            *outSurface = new SurfaceControl(this, result.handle, result.layerId,
                                             toString(result.layerName), w, h, format,
                                             result.transformHint, flags);
        }
    }
    return err;
}

mClient 是匿名 Binder 服务 Client 的代理端对象，这里远程调用到 SurfaceFlinger 进程中的 createSurface 函数，最终会调用到服务端 Client 类的 createSurface 函数中。

// /frameworks/native/services/surfaceflinger/Client.h
sp<SurfaceFlinger> mFlinger;

// /frameworks/native/services/surfaceflinger/Client.cpp
binder::Status Client::createSurface(const std::string& name, int32_t flags,
                                     const sp<IBinder>& parent, const gui::LayerMetadata& metadata,
                                     gui::CreateSurfaceResult* outResult) {

    // We rely on createLayer to check permissions.
    sp<IBinder> handle;
    LayerCreationArgs args(mFlinger.get(), sp<Client>::fromExisting(this), name.c_str(),
                           static_cast<uint32_t>(flags), std::move(metadata));
    // handle 放到了 LayerCreationArgs 中，这个 handle 是我们即将要创建的 Layer 的父 Layer 的索引
    // 需要注意的是 CreateSurfaceResult 中也有一个 handle，这个是我们要创建的 Layer 的索引
    args.parentHandle = parent;
    // 接着调用 SurfaceFlinger 的 createLayer 函数
    const status_t status = mFlinger->createLayer(args, *outResult);
    return binderStatusFromStatusT(status);
}

SurfaceFlinger 的 createLayer 函数实现如下：

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

status_t SurfaceFlinger::createLayer(LayerCreationArgs& args, gui::CreateSurfaceResult& outResult) {
    status_t result = NO_ERROR;

    sp<Layer> layer;

    // flags 的值为  ISurfaceComposerClient::eFXSurfaceBufferState
    switch (args.flags & ISurfaceComposerClient::eFXSurfaceMask) {
        case ISurfaceComposerClient::eFXSurfaceBufferQueue:
        case ISurfaceComposerClient::eFXSurfaceContainer:
        case ISurfaceComposerClient::eFXSurfaceBufferState:    // 走这个 case 
            args.flags |= ISurfaceComposerClient::eNoColorFill;  
            FMT_FALLTHROUGH;
        case ISurfaceComposerClient::eFXSurfaceEffect: { // 上面没有 break，这个 case 也会走
            // 关注点 1
            // 创建 Layer 对象
            // args 中有个 handle 
            // 第二个参数也是一个 handle
            result = createBufferStateLayer(args, &outResult.handle, &layer);
            std::atomic<int32_t>* pendingBufferCounter = layer->getPendingBufferCounter();
            if (pendingBufferCounter) {
                std::string counterName = layer->getPendingBufferCounterName();
                mBufferCountTracker.add(outResult.handle->localBinder(), counterName,
                                        pendingBufferCounter);
            }
        } break;
        default:
            result = BAD_VALUE;
            break;
    }

    if (result != NO_ERROR) {
        return result;
    }

    args.addToRoot = args.addToRoot && callingThreadHasUnscopedSurfaceFlingerAccess();
    // We can safely promote the parent layer in binder thread because we have a strong reference
    // to the layer's handle inside this scope.
    // 使用 args.parentHandle 索引找到 Layer 的父节点
    sp<Layer> parent = LayerHandle::getLayer(args.parentHandle.promote());
    if (args.parentHandle != nullptr && parent == nullptr) {
        ALOGE("Invalid parent handle %p", args.parentHandle.promote().get());
        args.addToRoot = false;
    }

    uint32_t outTransformHint;

    // add a layer to SurfaceFlinger
    // 关注点 2
    // 把 Layer 对象添加到 SurfaceFlinger 中去
    result = addClientLayer(args, outResult.handle, layer, parent, &outTransformHint);
    if (result != NO_ERROR) {
        return result;
    }

    outResult.transformHint = static_cast<int32_t>(outTransformHint);
    outResult.layerId = layer->sequence;
    outResult.layerName = String16(layer->getDebugName());
    return result;
}

关注点 1 处，通过工厂模式初始化一个 Layer 对象，实际跟进代码就是 new 一个 Layer 对象。

关注点 2 处，把刚 new 的 Layer 对象添加到 SurfaceFlinger 中，具体实现如下：

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.h
    std::vector<LayerCreatedState> mCreatedLayers GUARDED_BY(mCreatedLayersLock);
    std::vector<std::unique_ptr<frontend::RequestedLayerState>> mNewLayers;
    std::vector<LayerCreationArgs> mNewLayerArgs;

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::addClientLayer(LayerCreationArgs& args, const sp<IBinder>& handle,
                                        const sp<Layer>& layer, const wp<Layer>& parent,
                                        uint32_t* outTransformHint) {

    if (mNumLayers >= MAX_LAYERS) { // Layer 过多的处理
        // ......
    }

    layer->updateTransformHint(mActiveDisplayTransformHint);
    if (outTransformHint) {
        *outTransformHint = mActiveDisplayTransformHint;
    }
    args.parentId = LayerHandle::getLayerId(args.parentHandle.promote());
    args.layerIdToMirror = LayerHandle::getLayerId(args.mirrorLayerHandle.promote());
    {
        std::scoped_lock<std::mutex> lock(mCreatedLayersLock);
        // layer 相关信息放到这里，下次 VSync 信号到来，读取这些数据
        mCreatedLayers.emplace_back(layer, parent, args.addToRoot);
        // 创建 Layer 的参数
        mNewLayers.emplace_back(std::make_unique<frontend::RequestedLayerState>(args));
        args.mirrorLayerHandle.clear();
        args.parentHandle.clear();
        mNewLayerArgs.emplace_back(std::move(args));
    }

    setTransactionFlags(eTransactionNeeded); // 0x01
    return NO_ERROR;   
}

核心就是把创建的 Layer 以及创建过程中的参数保存到 SurfaceFlinger 的 mCreatedLayers mNewLayers mNewLayerArgs 三个成员中。

后续合成过程会使用到这三个参数来构建 Layer 树。

4.1.2 App 发起远程事务

App 示例代码中开启了一个事务：

  // 构建事务对象并提交
    SurfaceComposerClient::Transaction{}
            .setLayer(surfaceControl, std::numeric_limits<int32_t>::max())
            .show(surfaceControl)
            .setBackgroundColor(surfaceControl, half3{0, 0, 0}, 1.0f, ui::Dataspace::UNKNOWN) // black background
            .setAlpha(surfaceControl, 1.0f)
            .setLayerStack(surfaceControl, ui::LayerStack::fromValue(mLayerStack))
            .apply();

这里会先 new 一个 SurfaceComposerClient::Transaction 对象，Transaction 有一个重要的成员 mComposerStates：

    class Transaction : public Parcelable {
        // .....
        std::unordered_map<sp<IBinder>, ComposerState, IBinderHash> mComposerStates;

        std::unordered_map<sp<ITransactionCompletedListener>, CallbackInfo, TCLHash>
                mListenerCallbacks;
        // ......
    }

mComposerStates 是一个 map，key 是 Layer 的 token, value 是 ComposerState，用于保存 Layer 相关的信息：

class ComposerState {
public:
    layer_state_t state;
    status_t write(Parcel& output) const;
    status_t read(const Parcel& input);
};

layer_state_t 是一个结构体，用于在 SurfaceFlinger 与 app 之间交换 layer 相关的数据。

struct layer_state_t {

// ......
    sp<IBinder> surface;
    int32_t layerId;
    uint64_t what;
    float x;
    float y;
    int32_t z;
    ui::LayerStack layerStack = ui::DEFAULT_LAYER_STACK;
    uint32_t flags;
    uint32_t mask;
    uint8_t reserved;
    matrix22_t matrix;
    float cornerRadius;
    uint32_t backgroundBlurRadius;

    sp<SurfaceControl> relativeLayerSurfaceControl;

    sp<SurfaceControl> parentSurfaceControlForChild;

    half4 color;

    // non POD must be last. see write/read
    Region transparentRegion;
    uint32_t bufferTransform;
    bool transformToDisplayInverse;
    Rect crop;
    std::shared_ptr<BufferData> bufferData = nullptr;
    ui::Dataspace dataspace;
    HdrMetadata hdrMetadata;
    Region surfaceDamageRegion;
    int32_t api;
    sp<NativeHandle> sidebandStream;
    mat4 colorTransform;
    std::vector<BlurRegion> blurRegions;

    sp<gui::WindowInfoHandle> windowInfoHandle = sp<gui::WindowInfoHandle>::make();

    LayerMetadata metadata;

    // The following refer to the alpha, and dataspace, respectively of
    // the background color layer
    half4 bgColor;
    ui::Dataspace bgColorDataspace;
// .....

}

先看 setLayer 的实现：

// /frameworks/native/libs/gui/SurfaceComposerClient.cpp

SurfaceComposerClient::Transaction& SurfaceComposerClient::Transaction::setLayer(
        const sp<SurfaceControl>& sc, int32_t z) {
    layer_state_t* s = getLayerState(sc);
    if (!s) {
        mStatus = BAD_INDEX;
        return *this;
    }
    s->what |= layer_state_t::eLayerChanged;
    s->what &= ~layer_state_t::eRelativeLayerChanged;
    s->z = z;

    registerSurfaceControlForCallback(sc);
    return *this;
}

std::unordered_map<sp<IBinder>, ComposerState, IBinderHash> mComposerStates;

layer_state_t* SurfaceComposerClient::Transaction::getLayerState(const sp<SurfaceControl>& sc) {
  
    // Layer 的 token
    auto handle = sc->getLayerStateHandle();

    if (mComposerStates.count(handle) == 0) {
        // we don't have it, add an initialized layer_state to our list
        ComposerState s;

        s.state.surface = handle;
        s.state.layerId = sc->getLayerId();

        mComposerStates[handle] = s;
    }

    return &(mComposerStates[handle].state);
}

实际就是把配置信息写到 mComposerStates 的 layer_state_t state; 成员中。

setPosition 的实现：

SurfaceComposerClient::Transaction& SurfaceComposerClient::Transaction::setPosition(
        const sp<SurfaceControl>& sc, float x, float y) {
    layer_state_t* s = getLayerState(sc);
 
    s->what |= layer_state_t::ePositionChanged;
    s->x = x;
    s->y = y;
 
    return *this;
}

别的设置属性的实现基本都差不多，都是把数据存储到 layer_state_t 中，不再一一阐述。数据的关系如下图所示：

设置完一堆参数后，调用 apply 发起远程调用：

// 两个参数默认是 false
status_t SurfaceComposerClient::Transaction::apply(bool synchronous, bool oneWay) {
   // ......
    // 关键
    // 主要数据在 composerStates 中
    sf->setTransactionState(mFrameTimelineInfo, composerStates, displayStates, flags, applyToken,
                            mInputWindowCommands, mDesiredPresentTime, mIsAutoTimestamp,
                            mUncacheBuffers, hasListenerCallbacks, listenerCallbacks, mId,
  
    // .....
    return NO_ERROR;
}

这里 sf->setTransactionState 发起远程调用，最终会 Binder 远程调用到 SurfaceFlinger 的 setTransactionState：

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::setTransactionState(
        const FrameTimelineInfo& frameTimelineInfo, Vector<ComposerState>& states,
        const Vector<DisplayState>& displays, uint32_t flags, const sp<IBinder>& applyToken,
        InputWindowCommands inputWindowCommands, int64_t desiredPresentTime, bool isAutoTimestamp,
        const std::vector<client_cache_t>& uncacheBuffers, bool hasListenerCallbacks,
        const std::vector<ListenerCallbacks>& listenerCallbacks, uint64_t transactionId,
        const std::vector<uint64_t>& mergedTransactionIds) {
   

    // ......

    // 关注点1
    // ComposerState 转换为 ResolvedComposerState
    std::vector<ResolvedComposerState> resolvedStates;
    resolvedStates.reserve(states.size());
    for (auto& state : states) {
        resolvedStates.emplace_back(std::move(state));
        auto& resolvedState = resolvedStates.back();
        if (resolvedState.state.hasBufferChanges() && resolvedState.state.hasValidBuffer() &&
            resolvedState.state.surface) {
            sp<Layer> layer = LayerHandle::getLayer(resolvedState.state.surface);
            std::string layerName = (layer) ?
                    layer->getDebugName() : std::to_string(resolvedState.state.layerId);
            resolvedState.externalTexture =
                    getExternalTextureFromBufferData(*resolvedState.state.bufferData,
                                                     layerName.c_str(), transactionId);
            mBufferCountTracker.increment(resolvedState.state.surface->localBinder());
        }
        resolvedState.layerId = LayerHandle::getLayerId(resolvedState.state.surface);
        if (resolvedState.state.what & layer_state_t::eReparent) {
            resolvedState.parentId =
                    getLayerIdFromSurfaceControl(resolvedState.state.parentSurfaceControlForChild);
        }
        if (resolvedState.state.what & layer_state_t::eRelativeLayerChanged) {
            resolvedState.relativeParentId =
                    getLayerIdFromSurfaceControl(resolvedState.state.relativeLayerSurfaceControl);
        }
        if (resolvedState.state.what & layer_state_t::eInputInfoChanged) {
            wp<IBinder>& touchableRegionCropHandle =
                    resolvedState.state.windowInfoHandle->editInfo()->touchableRegionCropHandle;
            resolvedState.touchCropId =
                    LayerHandle::getLayerId(touchableRegionCropHandle.promote());
        }
    }

    // 关注点 2
    // 构建一个 TransactionState
    TransactionState state{frameTimelineInfo,
                           resolvedStates,
                           displays,
                           flags,
                           applyToken,
                           std::move(inputWindowCommands),
                           desiredPresentTime,
                           isAutoTimestamp,
                           std::move(uncacheBufferIds),
                           postTime,
                           hasListenerCallbacks,
                           listenerCallbacks,
                           originPid,
                           originUid,
                           transactionId,
                           mergedTransactionIds};


    if (mTransactionTracing) {
        mTransactionTracing->addQueuedTransaction(state);
    }

    const auto schedule = [](uint32_t flags) {
        if (flags & eEarlyWakeupEnd) return TransactionSchedule::EarlyEnd;
        if (flags & eEarlyWakeupStart) return TransactionSchedule::EarlyStart;
        return TransactionSchedule::Late;
    }(state.flags);

    // 关注点3
    const auto frameHint = state.isFrameActive() ? FrameHint::kActive : FrameHint::kNone;
    mTransactionHandler.queueTransaction(std::move(state));
    setTransactionFlags(eTransactionFlushNeeded, schedule, applyToken, frameHint);
    return NO_ERROR;
}

关注点 1，将参数传入的 ComposerState 转换为 ResolvedComposerState 关注点 2，通过传入的参数构建一个 TransactionState 对象。 关注点 3，将 TransactionState 对象保存在 mTransactionHandler 的 mLocklessTransactionQueue 成员中。

看下 关注点3 的实现：

// /frameworks/native/services/surfaceflinger/FrontEnd/TransactionHandler.h
LocklessQueue<TransactionState> mLocklessTransactionQueue;

// /frameworks/native/services/surfaceflinger/FrontEnd/TransactionHandler.cpp
void TransactionHandler::queueTransaction(TransactionState&& state) {
    mLocklessTransactionQueue.push(std::move(state));
    mPendingTransactionCount.fetch_add(1);
    ATRACE_INT("TransactionQueue", static_cast<int>(mPendingTransactionCount.load()));
}

小结：事务对象的成员经过简单的处理，构建为 TransactionState 对象并保存在 mLocklessTransactionQueue 中。

4.1.3 App 提交渲染好的 buffer

前面我们分析过，App 端渲染好 buffer 以后，会通过层层的回调调用到 acquireNextBufferLocked 函数：

status_t BLASTBufferQueue::acquireNextBufferLocked(
        const std::optional<SurfaceComposerClient::Transaction*> transaction) {
   
    //......

    // 准备事务对象 Transaction
    SurfaceComposerClient::Transaction localTransaction;
    bool applyTransaction = true;
    SurfaceComposerClient::Transaction* t = &localTransaction;
    if (transaction) {
        t = *transaction;
        applyTransaction = false;
    }

    // 调用 acquireBuffer 函数 从队列中获取到一个 BufferItem 对象
    BufferItem bufferItem;

    // 关注点1
    status_t status =
            mBufferItemConsumer->acquireBuffer(&bufferItem, 0 /* expectedPresent */, false);
  
    //......

    auto buffer = bufferItem.mGraphicBuffer;
    mNumFrameAvailable--;
  
    // ......

    mNumAcquired++;
    mLastAcquiredFrameNumber = bufferItem.mFrameNumber;
    ReleaseCallbackId releaseCallbackId(buffer->getId(), mLastAcquiredFrameNumber);
    mSubmitted[releaseCallbackId] = bufferItem;

    bool needsDisconnect = false;
    mBufferItemConsumer->getConnectionEvents(bufferItem.mFrameNumber, &needsDisconnect);

    // if producer disconnected before, notify SurfaceFlinger
    if (needsDisconnect) {
        t->notifyProducerDisconnect(mSurfaceControl);
    }

    // Ensure BLASTBufferQueue stays alive until we receive the transaction complete callback.
    incStrong((void*)transactionCallbackThunk);

    // Only update mSize for destination bounds if the incoming buffer matches the requested size.
    // Otherwise, it could cause stretching since the destination bounds will update before the
    // buffer with the new size is acquired.
    if (mRequestedSize == getBufferSize(bufferItem) ||
        bufferItem.mScalingMode != NATIVE_WINDOW_SCALING_MODE_FREEZE) {
        mSize = mRequestedSize;
    }
    Rect crop = computeCrop(bufferItem);
    mLastBufferInfo.update(true /* hasBuffer */, bufferItem.mGraphicBuffer->getWidth(),
                           bufferItem.mGraphicBuffer->getHeight(), bufferItem.mTransform,
                           bufferItem.mScalingMode, crop);

    // 构造一个回调对象
    auto releaseBufferCallback =
            std::bind(releaseBufferCallbackThunk, wp<BLASTBufferQueue>(this) /* callbackContext */,
                      std::placeholders::_1, std::placeholders::_2, std::placeholders::_3);
  
    // 这里会同时拿到 bufferItem 中的 fence 对象
    sp<Fence> fence = bufferItem.mFence ? new Fence(bufferItem.mFence->dup()) : Fence::NO_FENCE;
    // t 是准备提交给 SurfaceFlinger 的事务对象
    // 根据 bufferItem 来配置

    // 关注点2
    // 注意这里传入了回调对象
    t->setBuffer(mSurfaceControl, buffer, fence, bufferItem.mFrameNumber, mProducerId,
                 releaseBufferCallback);
    t->setDataspace(mSurfaceControl, static_cast<ui::Dataspace>(bufferItem.mDataSpace));
    t->setHdrMetadata(mSurfaceControl, bufferItem.mHdrMetadata);
    t->setSurfaceDamageRegion(mSurfaceControl, bufferItem.mSurfaceDamage);
    t->addTransactionCompletedCallback(transactionCallbackThunk, static_cast<void*>(this));

    mSurfaceControlsWithPendingCallback.push(mSurfaceControl);

    if (mUpdateDestinationFrame) {
        t->setDestinationFrame(mSurfaceControl, Rect(mSize));
    } else {
        const bool ignoreDestinationFrame =
                bufferItem.mScalingMode == NATIVE_WINDOW_SCALING_MODE_FREEZE;
        t->setFlags(mSurfaceControl,
                    ignoreDestinationFrame ? layer_state_t::eIgnoreDestinationFrame : 0,
                    layer_state_t::eIgnoreDestinationFrame);
    }
    t->setBufferCrop(mSurfaceControl, crop);
    t->setTransform(mSurfaceControl, bufferItem.mTransform);
    t->setTransformToDisplayInverse(mSurfaceControl, bufferItem.mTransformToDisplayInverse);
    t->setAutoRefresh(mSurfaceControl, bufferItem.mAutoRefresh);
    if (!bufferItem.mIsAutoTimestamp) {
        t->setDesiredPresentTime(bufferItem.mTimestamp);
    }

    // Drop stale frame timeline infos
    while (!mPendingFrameTimelines.empty() &&
           mPendingFrameTimelines.front().first < bufferItem.mFrameNumber) {
        ATRACE_FORMAT_INSTANT("dropping stale frameNumber: %" PRIu64 " vsyncId: %" PRId64,
                              mPendingFrameTimelines.front().first,
                              mPendingFrameTimelines.front().second.vsyncId);
        mPendingFrameTimelines.pop();
    }

    if (!mPendingFrameTimelines.empty() &&
        mPendingFrameTimelines.front().first == bufferItem.mFrameNumber) {
        ATRACE_FORMAT_INSTANT("Transaction::setFrameTimelineInfo frameNumber: %" PRIu64
                              " vsyncId: %" PRId64,
                              bufferItem.mFrameNumber,
                              mPendingFrameTimelines.front().second.vsyncId);
        t->setFrameTimelineInfo(mPendingFrameTimelines.front().second);
        mPendingFrameTimelines.pop();
    }

    {
        std::lock_guard _lock{mTimestampMutex};
        auto dequeueTime = mDequeueTimestamps.find(buffer->getId());
        if (dequeueTime != mDequeueTimestamps.end()) {
            Parcel p;
            p.writeInt64(dequeueTime->second);
            t->setMetadata(mSurfaceControl, gui::METADATA_DEQUEUE_TIME, p);
            mDequeueTimestamps.erase(dequeueTime);
        }
    }

    mergePendingTransactions(t, bufferItem.mFrameNumber);
    if (applyTransaction) { // 进入分支
        // All transactions on our apply token are one-way. See comment on mAppliedLastTransaction
        // 关注点 3
        // 提交事务
        t->setApplyToken(mApplyToken).apply(false, true);
        mAppliedLastTransaction = true;
        mLastAppliedFrameNumber = bufferItem.mFrameNumber;
    } else {
        // 设置 barrier
        t->setBufferHasBarrier(mSurfaceControl, mLastAppliedFrameNumber);
        mAppliedLastTransaction = false;
    }

    BQA_LOGV("acquireNextBufferLocked size=%dx%d mFrameNumber=%" PRIu64
             " applyTransaction=%s mTimestamp=%" PRId64 "%s mPendingTransactions.size=%d"
             " graphicBufferId=%" PRIu64 "%s transform=%d",
             mSize.width, mSize.height, bufferItem.mFrameNumber, boolToString(applyTransaction),
             bufferItem.mTimestamp, bufferItem.mIsAutoTimestamp ? "(auto)" : "",
             static_cast<uint32_t>(mPendingTransactions.size()), bufferItem.mGraphicBuffer->getId(),
             bufferItem.mAutoRefresh ? " mAutoRefresh" : "", bufferItem.mTransform);
    return OK;
}

关注点 1，调用 acquireBuffer 获取到 BufferItem 关注点 2，构建事务对象 Transaction 关注点 3，apply 提交事务对象

apply 部分和上一小节一样，提交的事务对象最终会转换为 TransactionState 对象并保存在 mLocklessTransactionQueue 中。流程都是一样的，就不再分析了。差异主要是在构建的 Transaction 对象上。

4.2 commit 处理数据过程分析

commit 执行之前，以下的数据们都准备好了：

SurfaceFlinger 对象中的 LayerCreatedState 成员：

std::vector<LayerCreatedState> mCreatedLayers

SurfaceFlinger 中有一个成员 TransactionHandler，它有一个 mLocklessTransactionQueue 成员：

LocklessQueue<TransactionState> mLocklessTransactionQueue;

提交的配置事务，渲染好的 buffer 都保存在里面。

接下来我们来看 commit 的具体实现：

bool SurfaceFlinger::commit(TimePoint frameTime, VsyncId vsyncId, TimePoint expectedVsyncTime)
        FTL_FAKE_GUARD(kMainThreadContext) {

    // ......

    bool mustComposite = mMustComposite.exchange(false);
    {
        mFrameTimeline->setSfWakeUp(vsyncId.value, frameTime.ns(),
                                    Fps::fromPeriodNsecs(vsyncPeriod.ns()));


        const bool flushTransactions = clearTransactionFlags(eTransactionFlushNeeded);

        // 预处理后的信息放到一个结构体 Update 中
        frontend::Update updates;
        if (flushTransactions) {
            // 关注点1
            updates = flushLifecycleUpdates();
            //tracing
        }
        bool transactionsAreEmpty;
        // mLegacyFrontEndEnabled和mLayerLifecycleManagerEnabled只有一个为ture，
        // 应该是两套算法逻辑，会根据一个系统属性来决定，都是更新layer中的Snapshot的
        // 因为我看我的手机的属性应该是走的mLegacyFrontEndEnabled true的逻辑，我们这里就看这条线
        if (mLegacyFrontEndEnabled) {
            // 关注点 2
            mustComposite |= updateLayerSnapshotsLegacy(vsyncId, updates, flushTransactions,
                                                        transactionsAreEmpty);
        }
        if (mLayerLifecycleManagerEnabled) {
            mustComposite |=
                    updateLayerSnapshots(vsyncId, updates, flushTransactions, transactionsAreEmpty);
        }

        if (transactionFlushNeeded()) {
            setTransactionFlags(eTransactionFlushNeeded);
        }

        // 回调通知,在releasePendingBuffer时候，会addCallbackHandles，然后这里会回调client侧，然后client进行BufferRelease
        if (transactionsAreEmpty) {
            mTransactionCallbackInvoker.sendCallbacks(false /* onCommitOnly */);
        } else {
            mTransactionCallbackInvoker.sendCallbacks(true /* onCommitOnly */);
        }
    }

    // 处理刷新率更新
    {
        Mutex::Autolock lock(mStateLock);
        mScheduler->chooseRefreshRateForContent();
        setActiveModeInHwcIfNeeded();
    }

    updateCursorAsync();
    // 更新inputFlinger focused窗口
    updateInputFlinger(vsyncId, frameTime);
    // 。。。

    persistDisplayBrightness(mustComposite);
    // 返回是否需要合成
    return mustComposite && CC_LIKELY(mBootStage != BootStage::BOOTLOADER);
}

代码非常多，我们主要关注两点：

• 关注点 1， flushLifecycleUpdates：Layer 相关数据收集
• 关注点2，updateLayerSnapshotsLegacy：Layer 相关数据基本处理

4.2.1 flushLifecycleUpdates 数据处理过程分析

flushLifecycleUpdates 的实现如下：

struct Update {
    std::vector<TransactionState> transactions;

    std::vector<LayerCreatedState> layerCreatedStates;
  
    std::vector<std::unique_ptr<frontend::RequestedLayerState>> newLayers;
  
    std::vector<LayerCreationArgs> layerCreationArgs;
  
    std::vector<uint32_t> destroyedHandles;
};

frontend::Update SurfaceFlinger::flushLifecycleUpdates() {
    frontend::Update update;
    // 处理之前 setTransactionState 放入队列的任务
    // 会把所有 Ready 状态的 TransactionState 返回回来，然后存在 update.transactions
    update.transactions = mTransactionHandler.flushTransactions();
  
    {
        // 当client侧通过binder请求SurfaceFlinger，SurfaceFlinger会将参数放到mNewLayers，mCreatedLayers里
        // 这里会把参数都提取出来，全部都放到Update里面
        std::scoped_lock<std::mutex> lock(mCreatedLayersLock);
        update.layerCreatedStates = std::move(mCreatedLayers);
        mCreatedLayers.clear();
        update.newLayers = std::move(mNewLayers);
        mNewLayers.clear();
        update.layerCreationArgs = std::move(mNewLayerArgs);
        mNewLayerArgs.clear();
        update.destroyedHandles = std::move(mDestroyedHandles);
        mDestroyedHandles.clear();
    }
    return update;
}

• flushTransactions 用于过滤 mLocklessTransactionQueue 中的数据
• 接着把 mCreatedLayers mNewLayers mNewLayerArgs mDestroyedHandles 这些成员保存到 Update 对象中，这些数据主要来自 App 端，Surface 的添加或者删除

接下来来看 flushTransactions() 如何过滤数据：

LocklessQueue<TransactionState> mLocklessTransactionQueue;

std::unordered_map<sp<IBinder>, std::queue<TransactionState>, IListenerHash> mPendingTransactionQueues;

std::vector<TransactionState> TransactionHandler::flushTransactions() {

    // 关注点1
    // 第一次筛选  mLocklessTransactionQueue -> mPendingTransactionQueues
    while (!mLocklessTransactionQueue.isEmpty()) {
        // 之前讲 Transaction 到章节最后我们提到，Transaction 里面的内容被封装成 TransactionState，通过 queueTransaction 放到队列中
        // 就是放在了 mLocklessTransactionQueue 中
        // 这里取出来的就是 TransactionState
        auto maybeTransaction = mLocklessTransactionQueue.pop();
        // 过滤异常的 State
        if (!maybeTransaction.has_value()) {
            break;
        }
        auto transaction = maybeTransaction.value();
        // 把有效的 TransactionState 放到 mPendingTransactionQueues 中。
        mPendingTransactionQueues[transaction.applyToken].emplace(std::move(transaction));
    }

    std::vector<TransactionState> transactions;
    TransactionFlushState flushState;
    flushState.queueProcessTime = systemTime();
    // 循环执行 flushPendingTransactionQueues，这里需要循环的原因上面已经说了，主要是处理有 barrier 的 Transaction。
    int lastTransactionsPendingBarrier = 0;
    int transactionsPendingBarrier = 0;

    // 关注点2
    // 第二次筛选 mPendingTransactionQueues -> transactions
    // 直到两次 flushPendingTransactionQueues 的返回值相同才跳出循环
    do {
        // 这里比较两次flushPendingTransactionQueues后由于barrier未就绪的Transaction个数，如果一样说明不需要再继续执行flushPendingTransactionQueues
        lastTransactionsPendingBarrier = transactionsPendingBarrier;
        // 会把所有ready状态的TransactionState存储到transactions
        transactionsPendingBarrier = flushPendingTransactionQueues(transactions, flushState);
    } while (lastTransactionsPendingBarrier != transactionsPendingBarrier);

    applyUnsignaledBufferTransaction(transactions, flushState);

    mPendingTransactionCount.fetch_sub(transactions.size());
    ATRACE_INT("TransactionQueue", static_cast<int>(mPendingTransactionCount.load()));
    return transactions;
}

• 关注点 1，遍历 mLocklessTransactionQueue 中保存的 TransactionState，剔除没有数据的，剩余的数据保存到 mPendingTransactionQueues 中
• 关注点 2，调用 flushPendingTransactionQueues，进一步筛选 TransactionState，筛选后符合要求的数据会被保存在参数 transactions 中。

关注点 2 处比较特别的是，循环调用了 flushPendingTransactionQueues，flushPendingTransactionQueues 本身就会遍历所有的 TransactionState，这里之所以还要加一个循环是因为有屏障逻辑。是因为在 acquireNextBufferLocked 的时候如果没有立刻将 Transaction 传给 SurfaceFlinger 的情况，就会设置一个 barrier，表示新的这个 Transaction 的处理必须要依赖上一个 Transaction 的完成。

status_t BLASTBufferQueue::acquireNextBufferLocked(
        const std::optional<SurfaceComposerClient::Transaction*> transaction) {
   
    //......

    // 准备事务对象 Transaction
    SurfaceComposerClient::Transaction localTransaction;
    bool applyTransaction = true;
    SurfaceComposerClient::Transaction* t = &localTransaction;
    if (transaction) {
        t = *transaction;
        applyTransaction = false;
    }

    // ......
    if (applyTransaction) { 
     
        t->setApplyToken(mApplyToken).apply(false, true);
        mAppliedLastTransaction = true;
        mLastAppliedFrameNumber = bufferItem.mFrameNumber;
    } else { // 参数 transaction 不为空
        // 关注点：设置 barrier，且没有 apply
        t->setBufferHasBarrier(mSurfaceControl, mLastAppliedFrameNumber);
        mAppliedLastTransaction = false;
    }

    BQA_LOGV("acquireNextBufferLocked size=%dx%d mFrameNumber=%" PRIu64
             " applyTransaction=%s mTimestamp=%" PRId64 "%s mPendingTransactions.size=%d"
             " graphicBufferId=%" PRIu64 "%s transform=%d",
             mSize.width, mSize.height, bufferItem.mFrameNumber, boolToString(applyTransaction),
             bufferItem.mTimestamp, bufferItem.mIsAutoTimestamp ? "(auto)" : "",
             static_cast<uint32_t>(mPendingTransactions.size()), bufferItem.mGraphicBuffer->getId(),
             bufferItem.mAutoRefresh ? " mAutoRefresh" : "", bufferItem.mTransform);
    return OK;
}

接着我们来看 flushPendingTransactionQueues 的实现：

int TransactionHandler::flushPendingTransactionQueues(std::vector<TransactionState>& transactions, TransactionFlushState& flushState) {

        int transactionsPendingBarrier = 0;
        // 遍历所有 TransactionState
        auto it = mPendingTransactionQueues.begin();
        while (it != mPendingTransactionQueues.end()) {
            auto& [applyToken, queue] = *it;
            while (!queue.empty()) {
                auto& transaction = queue.front();
                flushState.transaction = &transaction;
                // 判断Transaction当前是否ready，比如有barrier的，依赖的前置Transaction是否已经执行了
                // 或者是期望的时间还没有到
                auto ready = applyFilters(flushState);
                if (ready == TransactionReadiness::NotReadyBarrier) {
                    // 统计barrier没有就绪的个数，如果两次循环执行flushPendingTransactionQueues这个数量未改变，
                    // 就不用再继续循环了，需要等下一帧再处理
                    transactionsPendingBarrier++;
                    break;
                } else if (ready == TransactionReadiness::NotReady) {
                    break;
                } else if (ready == TransactionReadiness::NotReadyUnsignaled) {
                    flushState.queueWithUnsignaledBuffer = applyToken;
                    break;
                }
                // 走到这的Transaction就是已经处于ready状态了
                popTransactionFromPending(transactions, flushState, queue);
            }

            if (queue.empty()) {
                it = mPendingTransactionQueues.erase(it);
            } else {
                it = std::next(it, 1);
            }
        }
        // 返回由于barrier未就绪导致未处理的Transcaion个数
        return transactionsPendingBarrier;
}

通过 applyFilters 逐个判断 TrasactionState 是否 ready，主要是判断两个点：

1.时间，通过 SurfaceFlinger::transactionReadyTimelineCheck 判断 2.barrier 是否就绪，通过 SurfaceFlinger::transactionReadyBufferCheck 判断

applyFilters：

TransactionHandler::TransactionReadiness TransactionHandler::applyFilters(
        TransactionFlushState& flushState) {
    auto ready = TransactionReadiness::Ready;
    for (auto& filter : mTransactionReadyFilters) {
        auto perFilterReady = filter(flushState);
        switch (perFilterReady) {
            case TransactionReadiness::NotReady:
            case TransactionReadiness::NotReadyBarrier:
                return perFilterReady;

            case TransactionReadiness::NotReadyUnsignaled:
                // If one of the filters allows latching an unsignaled buffer, latch this ready
                // state.
                ready = perFilterReady;
                break;
            case TransactionReadiness::Ready:
                continue;
        }
    }
    return ready;
}

mTransactionReadyFilters 什么时候初始化？

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::init() FTL_FAKE_GUARD(kMainThreadContext) {
    ALOGI(  "SurfaceFlinger's main thread ready to run. "
            "Initializing graphics H/W...");
    addTransactionReadyFilters();
    Mutex::Autolock lock(mStateLock);
    //......
}

void SurfaceFlinger::addTransactionReadyFilters() {
    mTransactionHandler.addTransactionReadyFilter(
            std::bind(&SurfaceFlinger::transactionReadyTimelineCheck, this, std::placeholders::_1));
    mTransactionHandler.addTransactionReadyFilter(
            std::bind(&SurfaceFlinger::transactionReadyBufferCheck, this, std::placeholders::_1));
}

// /frameworks/native/services/surfaceflinger/FrontEnd/TransactionHandler.cpp
void TransactionHandler::addTransactionReadyFilter(TransactionFilter&& filter) {
    mTransactionReadyFilters.emplace_back(std::move(filter));
}

所以这里有两个回调是 SurfaceFlinger::transactionReadyTimelineCheck 和 SurfaceFlinger::transactionReadyBufferCheck。

经过两个回调的处理，TransactionState 就符合要求了，接着调用 popTransactionFromPending 将 ready 的 TransactionState 存到 transactions 集合中。

void TransactionHandler::popTransactionFromPending(std::vector<TransactionState>& transactions,
                                                TransactionFlushState& flushState,
                                                std::queue<TransactionState>& queue) {
    auto& transaction = queue.front();
    // Transaction is ready move it from the pending queue.
    flushState.firstTransaction = false;
    removeFromStalledTransactions(transaction.id);
    // 将TransactionState加到transactions队列里。
    transactions.emplace_back(std::move(transaction));
    queue.pop();

    auto& readyToApplyTransaction = transactions.back();
    readyToApplyTransaction.traverseStatesWithBuffers([&](const layer_state_t& state) {
        const bool frameNumberChanged =
                state.bufferData->flags.test(BufferData::BufferDataChange::frameNumberChanged);
        // bufferLayersReadyToPresent是一个map，key是窗口的handle，value是帧号。
        if (frameNumberChanged) {
            flushState.bufferLayersReadyToPresent.emplace_or_replace(state.surface.get(),
                                                                    state.bufferData->frameNumber);
        } else {
            flushState.bufferLayersReadyToPresent
                    .emplace_or_replace(state.surface.get(), std::numeric_limits<uint64_t>::max());
        }
    });
}

层层返回以后，最后符合要求的 TransactionState 都保存在了 update.transactions 中。

4.2.2 updateLayerSnapshotsLegacy 数据处理过程分析

bool SurfaceFlinger::updateLayerSnapshotsLegacy(VsyncId vsyncId, frontend::Update& update,
                                                bool transactionsFlushed,
                                                bool& outTransactionsAreEmpty) {
    bool needsTraversal = false;
    if (transactionsFlushed) {
        // 其他进程通过mirrorDisplay请求SurfaceFlinger创建镜像屏，就在这里处理，一般mirror屏幕用于录屏之类
        // 这里主要做的就是会创建一套和原来一模一样结构的layer树结构，名字后面会带mirror后缀。细节就不详细看了，感兴趣的可以自己看一下
        needsTraversal |= commitMirrorDisplays(vsyncId);
        // 处理创建layer相关的任务，如果有新增的layer返回true
        needsTraversal |= commitCreatedLayers(vsyncId, update.layerCreatedStates);
        // 处理TransactionState
        needsTraversal |= applyTransactions(update.transactions, vsyncId);
    }

    outTransactionsAreEmpty = !needsTraversal;
    const bool shouldCommit = (getTransactionFlags() & ~eTransactionFlushNeeded) || needsTraversal;
    if (shouldCommit) {
        // 关键是处理 buffer 相关的信息
        commitTransactions();
    }
    // latchBuffers
    bool mustComposite = latchBuffers() || shouldCommit;
    updateLayerGeometry();
    return mustComposite;
}

updateLayerSnapshotsLegacy 会进一步处理，App 那边传递过来的数据，我们主要关注以下几点：

• 调用 commitCreatedLayers 处理添加 layer 的请求
• 调用 applyTransactions 处理通过 Transactions 请求 layer 的属性变化
• 调用 commitTransactions，处理一些存储在 pending 变量里的 layer 增删旋转等操作，还会将我们前面存储在临时变量的属性（比如 mCurrentState）同步到当前使用的属性中去（比如mDrawingState）
• 调用了 latchBuffers 去获取了所有新的 buffer（如果layer有内容更新则需要获取新buffer），存到 BufferInfo 中。

先看 commitCreatedLayers 的实现：

bool SurfaceFlinger::commitCreatedLayers(VsyncId vsyncId,
                                        std::vector<LayerCreatedState>& createdLayers) {
    if (createdLayers.size() == 0) {
        return false;
    }

    Mutex::Autolock _l(mStateLock);
    for (const auto& createdLayer : createdLayers) {
        // 遍历所有新建的 layer，调用 handleLayerCreatedLocked 来做添加操作
        handleLayerCreatedLocked(createdLayer, vsyncId);
    }
    mLayersAdded = true;
    return mLayersAdded;
}

遍历 createdLayers，调用 handleLayerCreatedLocked 做实际的添加操作：

struct LayerCreatedState {
    LayerCreatedState(const wp<Layer>& layer, const wp<Layer>& parent, bool addToRoot)
          : layer(layer), initialParent(parent), addToRoot(addToRoot) {}
    wp<Layer> layer;
    // Indicates the initial parent of the created layer, only used for creating layer in
    // SurfaceFlinger. If nullptr, it may add the created layer into the current root layers.
    wp<Layer> initialParent;
    // Indicates whether the layer getting created should be added at root if there's no parent
    // and has permission ACCESS_SURFACE_FLINGER. If set to false and no parent, the layer will
    // be added offscreen.
    bool addToRoot;
};

void SurfaceFlinger::handleLayerCreatedLocked(const LayerCreatedState& state, VsyncId vsyncId) {
    // ...... 检查LayerCreatedState里的layer是否有效

    // 获取 state 的 initialParent，存放在 parent
    sp<Layer> parent;
    bool addToRoot = state.addToRoot;
    if (state.initialParent != nullptr) {
        parent = state.initialParent.promote();
        if (parent == nullptr) {
            ALOGD("Parent was destroyed soon after creation %p", state.initialParent.unsafe_get());
            addToRoot = false;
        }
    }
    // 如果有parent就通过addChild添加到layer树内，如果是root节点，添加到mCurrentState.layersSortedByZ数组。
    if (parent == nullptr && addToRoot) {
        layer->setIsAtRoot(true);
        mCurrentState.layersSortedByZ.add(layer);
    } else if (parent == nullptr) {
        layer->onRemovedFromCurrentState();
    } else if (parent->isRemovedFromCurrentState()) {
        parent->addChild(layer);
        layer->onRemovedFromCurrentState();
    } else {
        parent->addChild(layer);
    }

    // layerStack 我们在 Transaction 章节有提过，他代表 layer 显示在哪个屏幕上。
    ui::LayerStack layerStack = layer->getLayerStack(LayerVector::StateSet::Current);
    sp<const DisplayDevice> hintDisplay; // layer 应该显示的屏幕
    // 这里根据layerStack找到对应的屏幕
    for (const auto& [token, display] : mDisplays) {
        if (display->getLayerStack() == layerStack) {
            hintDisplay = display;
            break;
        }
    }
    // 给 layer 设置屏幕的 Transform 配置(旋转状况)
    if (hintDisplay) {
        layer->updateTransformHint(hintDisplay->getTransformHint());
    }
}

handleLayerCreatedLocked 中，会根据 LayerCreatedState 的参数，将 layer 添加到 layer 树上。如果是根节点，就添加到 mCurrentState.layersSortedByZ，否则就找到对应的父节点，然后通过 addChild 添加。最后会根据 layerStack 获取对应的 display，根据屏幕的旋转状态通过 updateTransformHint 给 layer 设置旋转状态。

接着再看 applyTransactions 函数的实现：

bool SurfaceFlinger::applyTransactions(std::vector<TransactionState>& transactions,
                                    VsyncId vsyncId) {
    Mutex::Autolock lock(mStateLock);
    return applyTransactionsLocked(transactions, vsyncId);
}

加锁后，接着调用 applyTransactionsLocked：

bool SurfaceFlinger::applyTransactionsLocked(std::vector<TransactionState>& transactions,
                                         VsyncId vsyncId) {
    bool needsTraversal = false;
    // Now apply all transactions.
    for (auto& transaction : transactions) {
        // 每个 Transaction 都调用 applyTransactionState
        needsTraversal |=
                applyTransactionState(transaction.frameTimelineInfo, transaction.states,
                                    transaction.displays, transaction.flags,
                                    transaction.inputWindowCommands,
                                    transaction.desiredPresentTime, transaction.isAutoTimestamp,
                                    std::move(transaction.uncacheBufferIds), transaction.postTime,
                                    transaction.hasListenerCallbacks,
                                    transaction.listenerCallbacks, transaction.originPid,
                                    transaction.originUid, transaction.id);
    }
    return needsTraversal;
}

applyTransactionsLocked 就是遍历所有 TransactionState ，然后调用 applyTransactionState 函数并传入 TransactionState 的各个成员。

applyTransactionState 的实现如下：

bool SurfaceFlinger::applyTransactionState(const FrameTimelineInfo& frameTimelineInfo,
                                        std::vector<ResolvedComposerState>& states,
                                        Vector<DisplayState>& displays, uint32_t flags,
                                        const InputWindowCommands& inputWindowCommands,
                                        const int64_t desiredPresentTime, bool isAutoTimestamp,
                                        const std::vector<uint64_t>& uncacheBufferIds,
                                        const int64_t postTime, bool hasListenerCallbacks,
                                        const std::vector<ListenerCallbacks>& listenerCallbacks,
                                        int originPid, int originUid, uint64_t transactionId) {

    uint32_t transactionFlags = 0;

    // 处理 displays
    // displays 和 mCurrentState 里面的 displays 对比，如果有变化就更新，标记 flag 的 eDisplayTransactionNeeded 位。
    if (!mLayerLifecycleManagerEnabled) {
        for (DisplayState& display : displays) {
            transactionFlags |= setDisplayStateLocked(display);
        }
    }

    for (const auto& listener : listenerCallbacks) {
        mTransactionCallbackInvoker.addEmptyTransaction(listener);
    }

    uint32_t clientStateFlags = 0;
    for (auto& resolvedState : states) {
        // 我们看 mLegacyFrontEndEnabled 为 true 的这个逻辑
        // 这个参数的值来自系统配置，我手上的 pixel6 是 true
        if (mLegacyFrontEndEnabled) {
            // 根据ResolvedComposerState更新layer，这里主要就是通过layer_state_t的what标识位判断需要更新的变量，然后更新layer里面的变量
            // 如果更新了layer的变量就会返回相关的flag，几乎都有eTraversalNeeded。
            clientStateFlags |=
                    setClientStateLocked(frameTimelineInfo, resolvedState, desiredPresentTime,
                                        isAutoTimestamp, postTime, transactionId);

        } else /*mLayerLifecycleManagerEnabled*/ {
            clientStateFlags |= updateLayerCallbacksAndStats(frameTimelineInfo, resolvedState,
                                                            desiredPresentTime, isAutoTimestamp,
                                                            postTime, transactionId);
        }

        // 如果是执行动画过程，调用 recordLayerHistoryAnimationTx 记录一些属性。（用于选择刷新率）
        if ((flags & eAnimation) && resolvedState.state.surface) {
            if (const auto layer = LayerHandle::getLayer(resolvedState.state.surface)) {
                const auto layerProps = scheduler::LayerProps{
                        .visible = layer->isVisible(),
                        .bounds = layer->getBounds(),
                        .transform = layer->getTransform(),
                        .setFrameRateVote = layer->getFrameRateForLayerTree(),
                        .frameRateSelectionPriority = layer->getFrameRateSelectionPriority(),
                };
                layer->recordLayerHistoryAnimationTx(layerProps);
            }
        }
    }

    transactionFlags |= clientStateFlags;
    // 将inputWindowCommands和SurfaceFlinger里面mInputWindowCommands merge
    transactionFlags |= addInputWindowCommands(inputWindowCommands);

    for (uint64_t uncacheBufferId : uncacheBufferIds) {
        mBufferIdsToUncache.push_back(uncacheBufferId);
    }

    // 如果是没有任何改变，空动画事务可以用于模拟背压，所以也可以强制执行
    if (transactionFlags == 0 && (flags & eAnimation)) {
        transactionFlags = eTransactionNeeded;
    }

    bool needsTraversal = false;
    if (transactionFlags) {
        // 清理标志位，设needsTraversal为true，表示要进行这次合成。
        if (transactionFlags & eTraversalNeeded) {
            transactionFlags = transactionFlags & (~eTraversalNeeded);
            needsTraversal = true;
        }
        if (transactionFlags) {
            setTransactionFlags(transactionFlags);
        }
    }

    return needsTraversal;
}

applyTransactionState 将 TranscationState 里面的所有变化信息都更新到对应变量里，然后根据是否有更新，返回对应 flag。

对于我们的 Demo， 我们主要关心三类信息的处理，配置信息，buffe 信息，回调信息, Fence 锁，这些信息都在 ResolvedComposerState 中。这里信息都是通过 setClientStateLocked 函数来处理。这个函数巨长，我们就看我们关心的点：

uint32_t SurfaceFlinger::setClientStateLocked(const FrameTimelineInfo& frameTimelineInfo,
                                              ResolvedComposerState& composerState,
                                              int64_t desiredPresentTime, bool isAutoTimestamp,
                                              int64_t postTime, uint64_t transactionId) {
    layer_state_t& s = composerState.state;

    // ......

    if (layer == nullptr) {
        for (auto& [listener, callbackIds] : s.listeners) {
            mTransactionCallbackInvoker.addCallbackHandle(sp<CallbackHandle>::make(listener,
                                                                                   callbackIds,
                                                                                   s.surface),
                                                          std::vector<JankData>());
        }
        return 0;
    }
    MUTEX_ALIAS(mStateLock, layer->mFlinger->mStateLock);

    ui::LayerStack oldLayerStack = layer->getLayerStack(LayerVector::StateSet::Current);

    // Only set by BLAST adapter layers
    if (what & layer_state_t::eProducerDisconnect) {
        layer->onDisconnect();
    }

    if (what & layer_state_t::ePositionChanged) {
        if (layer->setPosition(s.x, s.y)) {
            flags |= eTraversalNeeded;
        }
    }

    // ......

    if (what & layer_state_t::eBufferChanged) {
        // 我们关心的信息都在 bufferData 里面，这里设置给了 layer
        if (layer->setBuffer(composerState.externalTexture, *s.bufferData, postTime,
                             desiredPresentTime, isAutoTimestamp, dequeueBufferTimestamp,
                             frameTimelineInfo)) {
            flags |= eTraversalNeeded;
        }
    } else if (frameTimelineInfo.vsyncId != FrameTimelineInfo::INVALID_VSYNC_ID) {
        layer->setFrameTimelineVsyncForBufferlessTransaction(frameTimelineInfo, postTime);
    }

    if ((what & layer_state_t::eBufferChanged) == 0) {
        layer->setDesiredPresentTime(desiredPresentTime, isAutoTimestamp);
    }

    // ......

    return flags;
}

我们关心的信息都在 composerState 里面，这里调用了 setBuffer 将这些信息存储在 Layer 对象中。

看下 Layer 的 setBuffer 实现：

bool Layer::setBuffer(std::shared_ptr<renderengine::ExternalTexture>& buffer,
                      const BufferData& bufferData, nsecs_t postTime, nsecs_t desiredPresentTime,
                      bool isAutoTimestamp, std::optional<nsecs_t> dequeueTime,
                      const FrameTimelineInfo& info) {
    ATRACE_FORMAT("setBuffer %s - hasBuffer=%s", getDebugName(), (buffer ? "true" : "false"));

  

    // ......

    // releaseBuffer 回调
    mDrawingState.releaseBufferListener = bufferData.releaseBufferListener;
    // buffer
    mDrawingState.buffer = std::move(buffer);
    // app 绘制的 fence
    mDrawingState.acquireFence = bufferData.flags.test(BufferData::BufferDataChange::fenceChanged)
            ? bufferData.acquireFence
            : Fence::NO_FENCE;
    mDrawingState.acquireFenceTime = std::make_unique<FenceTime>(mDrawingState.acquireFence);
  
    // ......

    mDrawingState.releaseBufferEndpoint = bufferData.releaseBufferEndpoint;
    return true;
}

可以看出，这些信息都保存在了 Layer 的 mDrawingState 成员中。

接下来，我们继续分析 commitTransactions 函数的实现

void SurfaceFlinger::commitTransactions() {
    // ......
    State drawingState(mDrawingState);
    Mutex::Autolock lock(mStateLock);
    commitTransactionsLocked(clearTransactionFlags(eTransactionMask));
}

加了锁以后调用 commitTransactionsLocked:

void SurfaceFlinger::commitTransactionsLocked(uint32_t transactionFlags) {
    // Commit display transactions.
    const bool displayTransactionNeeded = transactionFlags & eDisplayTransactionNeeded;
    mFrontEndDisplayInfosChanged = displayTransactionNeeded;
    if (displayTransactionNeeded && !mLayerLifecycleManagerEnabled) {
        // 应用 display 相关的配置，比如旋转，屏幕大小等。会更新相关的变量，比如 DisplayDeviceState 和 DisplayDevice
        processDisplayChangesLocked();
        mFrontEndDisplayInfos.clear();
        for (const auto& [_, display] : mDisplays) {
            mFrontEndDisplayInfos.try_emplace(display->getLayerStack(), display->getFrontEndInfo());
        }
    }
    mForceTransactionDisplayChange = displayTransactionNeeded;
    // 如果有子节点变化，设置 mVisibleRegionsDirtymUpdateInputInfo为true
    if (mSomeChildrenChanged) {
        mVisibleRegionsDirty = true;
        mSomeChildrenChanged = false;
        mUpdateInputInfo = true;
    }

    // 更新transform hint（旋转相关）
    if (transactionFlags & (eTransformHintUpdateNeeded | eDisplayTransactionNeeded)) {
        sp<const DisplayDevice> hintDisplay;
        ui::LayerStack layerStack;

        mCurrentState.traverse([&](Layer* layer) REQUIRES(mStateLock) {
            // 遍历所有layer，根据layer的LayerStack获取他对应的屏幕，根据屏幕的transform hint更新layer的transform hint
            // 前面提过transform hint是代表旋转的情况。
            if (const auto filter = layer->getOutputFilter(); layerStack != filter.layerStack) {
                layerStack = filter.layerStack;
                hintDisplay = nullptr;

                // Find the display that includes the layer.
                for (const auto& [token, display] : mDisplays) {
                    if (!display->getCompositionDisplay()->includesLayer(filter)) {
                        continue;
                    }

                    // Pick the primary display if another display mirrors the layer.
                    if (hintDisplay) {
                        hintDisplay = nullptr;
                        break;
                    }

                    hintDisplay = display;
                }
            }

            if (!hintDisplay) {

                ALOGV("Skipping reporting transform hint update for %s", layer->getDebugName());
                layer->skipReportingTransformHint();
            } else {
                layer->updateTransformHint(hintDisplay->getTransformHint());
            }
        });
    }
    // 如果添加了layer，设置 mVisibleRegionsDirty 和mUpdateInputInfo为true
    if (mLayersAdded) {
        mLayersAdded = false;
        // Layers have been added.
        mVisibleRegionsDirty = true;
        mUpdateInputInfo = true;
    }

    // 如果有layer被删除，需要更新display的state对应dirtyRegion变量，表示区域需要刷新。
    if (mLayersRemoved) {
        mLayersRemoved = false;
        mVisibleRegionsDirty = true;
        mUpdateInputInfo = true;
        mDrawingState.traverseInZOrder([&](Layer* layer) {
            if (mLayersPendingRemoval.indexOf(sp<Layer>::fromExisting(layer)) >= 0) {
                // this layer is not visible anymore
                Region visibleReg;
                visibleReg.set(layer->getScreenBounds());
                invalidateLayerStack(layer->getOutputFilter(), visibleReg);
            }
        });
    }

    if (transactionFlags & eInputInfoUpdateNeeded) {
        mUpdateInputInfo = true;
    }
  
    doCommitTransactions();
}

commitTransactionsLocked 先更新了屏幕相关的配置，然后遍历 layer，利用 layer 里面的 LayerStack 找到 layer 对应的屏，根据屏幕的旋转更新 layer 的旋转

如果有增加或者删除 layer，标记 mVisibleRegionsDirty 和 mUpdateInputInfo 为 true,遍历要删除的所有 layer，将他们的可见区域重叠，这些区域是需要刷新的。

最后调用 doCommitTransactions

void SurfaceFlinger::doCommitTransactions() {
    ATRACE_CALL();

    if (!mLayersPendingRemoval.isEmpty()) {
        // 处理需要删除的layer，释放buffer，如果是root layer，从mCurrentState.layersSortedByZ中移除
        for (const auto& l : mLayersPendingRemoval) {
            // 锁存并释放buffer
            if (l->isRemovedFromCurrentState()) {
                l->latchAndReleaseBuffer();
            }
            // 根节点会挂在mCurrentState.layersSortedByZ，如果要移除则需要从这个数组remove
            if (l->isAtRoot()) {
                l->setIsAtRoot(false);
                mCurrentState.layersSortedByZ.remove(l);
            }

            // 如果没有父节点，移除后我们就无法拿到这个layer了。将它存在mOffscreenLayers
            if (!l->getParent()) {
                mOffscreenLayers.emplace(l.get());
            }
        }
        mLayersPendingRemoval.clear();
    }
    // 将mCurrentState赋值给mDrawingState
    mDrawingState = mCurrentState;

    mCurrentState.colorMatrixChanged = false;

    // 递归调用所有layer commitChildList，里面主要是将 mDrawingChildren 和 mDrawingParent 更新成 mCurrentChildren，mCurrentParent
    if (mVisibleRegionsDirty) {
        for (const auto& rootLayer : mDrawingState.layersSortedByZ) {
            rootLayer->commitChildList();
        }
    }
    // 遍历所有上面加入mOffscreenLayers的layer，这些layer不在layer树上，所以上面递归遍历不到
    // 对每个layer调用doTransaction和commitChildList，doTransaction后面再介绍
    commitOffscreenLayers();
    if (mLayerMirrorRoots.size() > 0) {
        // 。。。同步更新mirrorlayer
    }
}

doCommitTransactions 先处理需要删除的 layer，如果是 root layer，就将它从 layersSortedByZ 删除，没有父节点的就加到 mOffscreenLayers，防止后面需要遍历的时候我们拿不到他们了。

currentState/currentChildren/currentParent 都相当于中间变量，我们的改变都先配置在他们上，当要去使用它，让它生效时，就会赋值到 DrawingXXX 上。

commitChildList 会递归所有 child，然后将每个 layer 的将 mDrawingChildren 和 mDrawingParent 更新成 mCurrentChildren，mCurrentParent。最后同步更新 mirrorlayer 里面的属性

我们的示例代码并没有涉及到这部分内容，了解一下。

最后看 latchBuffers 的实现：

bool SurfaceFlinger::latchBuffers() {
    // ......
    mDrawingState.traverse([&](Layer* layer) {
        if (layer->clearTransactionFlags(eTransactionNeeded) || mForceTransactionDisplayChange) {
            // 调用 layer 的 doTransaction
            const uint32_t flags = layer->doTransaction(0);
            if (flags & Layer::eVisibleRegion) {
                mVisibleRegionsDirty = true;
            }
        }
        // 存储需要更新的 layer 到 mLayersWithQueuedFrames
        // 要不就是有变化的 layer，要不就是需要锁存并且释放 buffer 的 layer（mDrawingState.buffer为空且mBufferInfo.mBuffer不为空）
        if (layer->hasReadyFrame() || layer->willReleaseBufferOnLatch()) {
            frameQueued = true;
            mLayersWithQueuedFrames.emplace(sp<Layer>::fromExisting(layer));
        } else {
            layer->useEmptyDamage();
            if (!layer->hasBuffer()) {
                layer->updateLastLatchTime(latchTime);
            }
        }
    });

    mForceTransactionDisplayChange = false;

    // mOffscreenLayers里面存储到是被移除的layer，客户端还可以继续提交buffer，只是因为不在layer树上，不会显示在屏幕上，
    // 所以我们需要锁存并且释放 buffer  
    // latchAndReleaseBuffer 方法里面也调用了 latchBuffer，我们两个方法一起看了。
    for (Layer* offscreenLayer : mOffscreenLayers) {
        offscreenLayer->traverse(LayerVector::StateSet::Drawing,
                                        [&](Layer* l) { l->latchAndReleaseBuffer(); });
    }

    if (!mLayersWithQueuedFrames.empty()) {
        Mutex::Autolock lock(mStateLock);

        for (const auto& layer : mLayersWithQueuedFrames) {
            // 需要锁存并且释放 buffer 的 layer 存到 mLayersWithBuffersRemoved
            if (layer->willReleaseBufferOnLatch()) {
                mLayersWithBuffersRemoved.emplace(layer);
            }
            // latchBuffer，锁存 buffer，latchAndReleaseBuffer 里面也调用了该方法
            if (layer->latchBuffer(visibleRegions, latchTime)) {
                mLayersPendingRefresh.push_back(layer);
                newDataLatched = true;
            }
            layer->useSurfaceDamage();
        }
    }

    mVisibleRegionsDirty |= visibleRegions;

    if (frameQueued && (mLayersWithQueuedFrames.empty() || !newDataLatched)) {
        scheduleCommit(FrameHint::kNone);
    }

    // 启动动画
    if (CC_UNLIKELY(mBootStage == BootStage::BOOTLOADER && newDataLatched)) {
        ALOGI("Enter boot animation");
        mBootStage = BootStage::BOOTANIMATION;
    }

    // 更新 mirror layer
    if (mLayerMirrorRoots.size() > 0) {
        mDrawingState.traverse([&](Layer* layer) { layer->updateCloneBufferInfo(); });
    }

    // 如果有需要更新的 frame 并且 layer 锁成功了
    return !mLayersWithQueuedFrames.empty() && newDataLatched;
}

SurfaceFlinger::latchBuffers 主要有以下几个点需要关注：

• 此时 mDrawingState 已经是更新过的 mDrawState，遍历更新过的 layer，根据 TransactionFlag 有变化的layer，执行 doTransaction。
• 如果 layer 有变化，或者新的 buffer 被设置为空，需要释放旧的 buffer 的 layer，都添加到 mLayersWithQueuedFrames，然后遍历这个数组，调用里面每个 layer 的 latchBuffer。把需要更新的 Layer 存到 mLayersPendingRefresh，需要 release 的 Layer 存到 mLayersWithBuffersRemoved 中
• 遍历 mOffscreenLayers 调用每个 layer 的 latchAndReleaseBuffer，虽然这些 layer 已经不会在屏幕上显示了，但是 client 依旧可以提交 buffer，而且之前的 buffer 也需要 release

doTransaction 的实现如下：

uint32_t Layer::doTransaction(uint32_t flags) {
    // ......

    // 调用 updateGeometry 重新计算 Transform 信息（和buffer的大小缩放和平移关系）
    if (updateGeometry()) {
        flags |= Layer::eVisibleRegion;
    }

    if (s.sequence != mLastCommittedTxSequence) {
        mLastCommittedTxSequence = s.sequence;
        flags |= eVisibleRegion;
        this->contentDirty = true;

        mNeedsFiltering = getActiveTransform(s).needsBilinearFiltering();
    }

    if (!mPotentialCursor && (flags & Layer::eVisibleRegion)) {
        mFlinger->mUpdateInputInfo = true;
    }
    // 更新 mFrameTimeline，记录作用就不看了。
    commitTransaction(mDrawingState);

    return flags;
}

调用 updateGeometry 重新计算 buffer 的大小缩放和平移关系（Transform），然后还调用了commitTransaction，记录 frame 时间信息。

Layer::latchBuffer 的实现如下：

bool Layer::latchBuffer(bool& recomputeVisibleRegions, nsecs_t latchTime) {
    const bool bgColorOnly = mDrawingState.bgColorLayer != nullptr;
    return latchBufferImpl(recomputeVisibleRegions, latchTime, bgColorOnly);
}

进一步调用 latchBufferImpl：

bool Layer::latchBufferImpl(bool& recomputeVisibleRegions, nsecs_t latchTime, bool bgColorOnly) {
    // ......
    // 回调 client 侧的 ON_COMMIT 的 callback
    updateTexImage(latchTime, bgColorOnly);

    BufferInfo oldBufferInfo = mBufferInfo;
    const bool oldOpacity = isOpaque(mDrawingState);
    mPreviousFrameNumber = mCurrentFrameNumber;
    mCurrentFrameNumber = mDrawingState.frameNumber;
    // 构建 BufferInfo，将 mDrawingState 里 buffer 相关的信息存入
    gatherBufferInfo();

    if (mBufferInfo.mBuffer) {
        mPreviouslyPresentedLayerStacks.clear();
    }

    // 。。。对比新旧BufferInfo的一些参数变化，如果宽高等变化设置recomputeVisibleRegions为true，表示需要重新计算脏区域。

    return true;
}

latchBufferImpl 中：

• 通过 updateTexImage 回调 client 侧 ON_COMMIT 的 callback。
• 通过 gatherBufferInfo 构建新的 BufferInfo

updateTexImage 的实现如下：

void Layer::updateTexImage(nsecs_t latchTime, bool bgColorOnly) {
    const State& s(getDrawingState());

    // ......

    // 回调 ON_COMMIT 的 callback
    std::deque<sp<CallbackHandle>> remainingHandles;
    mFlinger->getTransactionCallbackInvoker()
            .addOnCommitCallbackHandles(mDrawingState.callbackHandles, remainingHandles);
    mDrawingState.callbackHandles = remainingHandles;

    mDrawingStateModified = false;
}

gatherBufferInfo 的实现如下：

void Layer::gatherBufferInfo() {

    // 处理上一个bufferInfo，mPreviousReleaseBufferEndpoint关联了client侧releaseBufferBuffer的回调。
    // 后续调用 mPreviousReleaseBufferEndpoint 回调就可以释放上一个 BufferInfo 的 Buffer 了。
    mPreviousReleaseCallbackId = {getCurrentBufferId(), mBufferInfo.mFrameNumber};
    mPreviousReleaseBufferEndpoint = mBufferInfo.mReleaseBufferEndpoint;
    if (!mDrawingState.buffer) {
        mBufferInfo = {};
        return;
    }

    if ((!mBufferInfo.mBuffer || !mDrawingState.buffer->hasSameBuffer(*mBufferInfo.mBuffer))) {
        decrementPendingBufferCount();
    }

    // 构建 BufferInfo，将 mDrawingState 内 Buffer 相关的信息放到 BufferInfo 内。
    mBufferInfo.mBuffer = mDrawingState.buffer;
    mBufferInfo.mReleaseBufferEndpoint = mDrawingState.releaseBufferEndpoint;
    mBufferInfo.mFence = mDrawingState.acquireFence;
    mBufferInfo.mFrameNumber = mDrawingState.frameNumber;
    mBufferInfo.mPixelFormat =
            !mBufferInfo.mBuffer ? PIXEL_FORMAT_NONE : mBufferInfo.mBuffer->getPixelFormat();
    mBufferInfo.mFrameLatencyNeeded = true;
    mBufferInfo.mDesiredPresentTime = mDrawingState.desiredPresentTime;
    mBufferInfo.mFenceTime = std::make_shared<FenceTime>(mDrawingState.acquireFence);
    mBufferInfo.mFence = mDrawingState.acquireFence;
    mBufferInfo.mTransform = mDrawingState.bufferTransform;
    auto lastDataspace = mBufferInfo.mDataspace;
    mBufferInfo.mDataspace = translateDataspace(mDrawingState.dataspace);
    if (mBufferInfo.mBuffer != nullptr) {
        auto& mapper = GraphicBufferMapper::get();
        ui::Dataspace dataspace = ui::Dataspace::UNKNOWN;
        status_t err = OK;
        {
            ATRACE_NAME("getDataspace");
            err = mapper.getDataspace(mBufferInfo.mBuffer->getBuffer()->handle, &dataspace);
        }
        if (err != OK || dataspace != mBufferInfo.mDataspace) {
            {
                ATRACE_NAME("setDataspace");
                err = mapper.setDataspace(mBufferInfo.mBuffer->getBuffer()->handle,
                                        static_cast<ui::Dataspace>(mBufferInfo.mDataspace));
            }
            static const int32_t kVendorVersion =
                    base::GetIntProperty("ro.vndk.version", __ANDROID_API_FUTURE__);
            if (const auto format =
                        static_cast<aidl::android::hardware::graphics::common::PixelFormat>(
                                mBufferInfo.mBuffer->getPixelFormat());
                err == OK && kVendorVersion < __ANDROID_API_U__ &&
                (format ==
                        aidl::android::hardware::graphics::common::PixelFormat::
                                IMPLEMENTATION_DEFINED ||
                format == aidl::android::hardware::graphics::common::PixelFormat::YCBCR_420_888 ||
                format == aidl::android::hardware::graphics::common::PixelFormat::YV12 ||
                format == aidl::android::hardware::graphics::common::PixelFormat::YCBCR_P010)) {
                mBufferInfo.mBuffer->remapBuffer();
            }
        }
    }
    if (lastDataspace != mBufferInfo.mDataspace) {
        mFlinger->mHdrLayerInfoChanged = true;
    }
    if (mBufferInfo.mDesiredHdrSdrRatio != mDrawingState.desiredHdrSdrRatio) {
        mBufferInfo.mDesiredHdrSdrRatio = mDrawingState.desiredHdrSdrRatio;
        mFlinger->mHdrLayerInfoChanged = true;
    }
    mBufferInfo.mCrop = computeBufferCrop(mDrawingState);
    mBufferInfo.mScaleMode = NATIVE_WINDOW_SCALING_MODE_SCALE_TO_WINDOW;
    mBufferInfo.mSurfaceDamage = mDrawingState.surfaceDamageRegion;
    mBufferInfo.mHdrMetadata = mDrawingState.hdrMetadata;
    mBufferInfo.mApi = mDrawingState.api;
    mBufferInfo.mTransformToDisplayInverse = mDrawingState.transformToDisplayInverse;
}

先将上一个 BufferInfo 的 mReleaseBufferEndpoint 记录到 mPreviousReleaseBufferEndpoint。接着构建新的 BufferInfo，将 mDrawingState 内 Buffer 相关的信息放到 BufferInfo 内。

小结一下：

• 回顾了 App 端生成关键数据的几个片段涉及的流程
• commit 主要是进行数据的预处理，为后续的 composite 合成做准备。
• 最终，这些数据经过层层处理，其中几个关键的数据需要我们有一些印象：
  • SurfaceFlinger 的 mDrawingState 成员有一个 LayerVector layersSortedByZ; 成员，该成员保存了所有的 Layer，这些 Layer 通过树关系链接在一起
  • Layer 的 BufferInfo mBufferInfo; 成员中有 Buffer 以及 App 绘制阶段的 fence 等信息

5. composite 合成图层整体分析

composite 的实现如下：

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.h

// mDisplays 是一个 map 的数据容器，在 SurfaceFlinger 启动时初始化
// DisplayDevice 代表了一个屏幕
// IBinder 是 DisplayDevice 的 token 索引
display::DisplayMap<wp<IBinder>, const sp<DisplayDevice>> mDisplays GUARDED_BY(mStateLock);

// /frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::composite(TimePoint frameTime, VsyncId vsyncId)
        FTL_FAKE_GUARD(kMainThreadContext) {
  
    // 准备后续合成需要的参数，这些参数都保存在 refreshArgs
    compositionengine::CompositionRefreshArgs refreshArgs;

    // 这里前面的一大段逻辑都是构建 refreshArgs，填充里面的变量，我们只看几个比较关键的
    // refreshArgs.outputs是一个 Output 数组，
    // SurfaceFlinger 记录屏幕的类 DisplayDevice，而里面包含一个 Display 就是继承 Output 的，这个类是 SurfaceFlinger 和 HWC 交互屏幕信息的关键类。

    // FTL_FAKE_GUARD 就是加 mStateLock 锁，然后返回 mDisplays
    const auto& displays = FTL_FAKE_GUARD(mStateLock, mDisplays);

    // outputs 的数量与屏幕数量一致
    refreshArgs.outputs.reserve(displays.size());
  
    std::vector<DisplayId> displayIds;
  
    for (const auto& [_, display] : displays) { // 遍历每一个 DisplayDevice
        bool dropFrame = false;
        if (display->isVirtual()) { // 虚拟屏幕，不用管
            Fps refreshRate = display->getAdjustedRefreshRate();
            using fps_approx_ops::operator>;
            dropFrame = (refreshRate > 0_Hz) && !mScheduler->isVsyncInPhase(frameTime, refreshRate);
        }
        if (!dropFrame) {
            // 关注点 1  refreshArgs.outputs
            // getCompositionDisplay 返回 DispalyDevice 的 Display 成员，output 是 Display 的父类
            refreshArgs.outputs.push_back(display->getCompositionDisplay());
        }
        display->tracePowerMode();
        displayIds.push_back(display->getId());
    }

    mPowerAdvisor->setDisplays(displayIds);

    // 如果需要的话，更新layerMetadata。里面是一些layer给上层使用的信息，比如layer所属的uid，layer的task_id,layer是否是游戏模式等等。
    const bool updateTaskMetadata = mCompositionEngine->getFeatureFlags().test(
            compositionengine::Feature::kSnapshotLayerMetadata);
    if (updateTaskMetadata && (mVisibleRegionsDirty || mLayerMetadataSnapshotNeeded)) {
        updateLayerMetadataSnapshot();
        mLayerMetadataSnapshotNeeded = false;
    }

    // 这里通过 SurfaceFlinger 里面记录的信息（包括 SurfaceFlinger.mDrawingState 里面的信息），还有 layer 里面的信息来填充 CompositionRefreshArgs
    if (DOES_CONTAIN_BORDER) {
        refreshArgs.borderInfoList.clear();
        mDrawingState.traverse([&refreshArgs](Layer* layer) {
            if (layer->isBorderEnabled()) {
                compositionengine::BorderRenderInfo info;
                info.width = layer->getBorderWidth();
                info.color = layer->getBorderColor();
                layer->traverse(LayerVector::StateSet::Drawing, [&info](Layer* ilayer) {
                    info.layerIds.push_back(ilayer->getSequence());
                });
                refreshArgs.borderInfoList.emplace_back(std::move(info));
            }
        });
    }

    refreshArgs.bufferIdsToUncache = std::move(mBufferIdsToUncache);


    // 关注点2 refreshArgs.layersWithQueuedFrames
    // commit 时会将有 Buffer 有变化的 layer 都放在 mLayersWithQueuedFrames 里。这里放到 refreshArgs 参数内的并不是 layer，而是 layerFE
    // layerFE 中有 mSnapshot 变量，类型是 LayerFECompositionState，里面包含后续合成需要的信息。
    refreshArgs.layersWithQueuedFrames.reserve(mLayersWithQueuedFrames.size());
    for (auto layer : mLayersWithQueuedFrames) {
        if (auto layerFE = layer->getCompositionEngineLayerFE())
            refreshArgs.layersWithQueuedFrames.push_back(layerFE);
    }

    const auto presentTime = systemTime();
    // 关注点3，调用 moveSnapshotsToCompositionArgs 来更新所有的 layerFE 的 mSnapshot
    // 所有的 layerFE 会被存储在 refreshArgs.layers 中
    std::vector<std::pair<Layer*, LayerFE*>> layers =
            moveSnapshotsToCompositionArgs(refreshArgs, /*cursorOnly=*/false, vsyncId.value);

    // 关注点4，合成的方法,
    mCompositionEngine->present(refreshArgs);

   // ......
}

代码很繁琐，但整体流程还是很好把握：

• 数据准备阶段：准备后续合成需要的数据 compositionengine::CompositionRefreshArgs refreshArgs，这些数据很多，我们主要关注几个比较重要：
  • 关注点 1 的 refreshArgs.outputs
  • 关注点 2 的 refreshArgs.layersWithQueuedFrames
  • 关注点 3，更新所有 LayerFE 的 mSnapshot，并将 LayerFE 对象保存在 refreshArgs.layers 中
• 合成实施阶段：关注点 4，mCompositionEngine->present(refreshArgs) 发起图层的合成

接下来我们详细分析以上主要流程。

6. 数据准备阶段

合成需要的数据都会保存在 compositionengine::CompositionRefreshArgs refreshArgs 中，接下来我们分析其中比较重要的几个成员。

6.1 refreshArgs.outputs 的赋值过程分析

相关代码如下：

    // FTL_FAKE_GUARD 就是加 mStateLock 锁，然后返回 mDisplays
    const auto& displays = FTL_FAKE_GUARD(mStateLock, mDisplays);

    // outputs 的数量与屏幕数量一致
    refreshArgs.outputs.reserve(displays.size());
  
    std::vector<DisplayId> displayIds;
  
    for (const auto& [_, display] : displays) { // 遍历每一个 DisplayDevice
        bool dropFrame = false;
        if (display->isVirtual()) { // 虚拟屏幕，不用管
            Fps refreshRate = display->getAdjustedRefreshRate();
            using fps_approx_ops::operator>;
            dropFrame = (refreshRate > 0_Hz) && !mScheduler->isVsyncInPhase(frameTime, refreshRate);
        }
        if (!dropFrame) {
            // 关注点  refreshArgs.outputs
            // getCompositionDisplay 返回 DispalyDevice 的 Display 成员，output 是 Display 的父类
            refreshArgs.outputs.push_back(display->getCompositionDisplay());
        }
        display->tracePowerMode();
        displayIds.push_back(display->getId());
    }

mDisplay 是一个存有 DisplayDevice 的 map 集合：

display::DisplayMap<wp<IBinder>, const sp<DisplayDevice>> mDisplays GUARDED_BY(mStateLock);

内部保存的是 DisplayDevice 对象，DisplayDevice 是显示设备的抽象，Android 中定义了下面三种类型的显示设备：

• Display Primary: 主显示设备，通常是 LCD 显示屏
• Display External: 扩展显示设备，通过 HDMI 输出显示内容
• Display Virtual: 虚拟显示设备，一般通过网络输出画面

这里会遍历每一个 mDisplay 拿到每一个 DisplayDevice 对象，然后调用 getCompositionDisplay 返回 DispalyDevice 的 Display 成员（Output 是 Display 的父类），最后把 Display 保存到 refreshArgs.outputs 中。

那 mDisplays 是什么时候初始化的？DispalyDevice 的 Display 成员是如何初始化的？

SurfaceFlinger 进程启动时，会调用到 SurfaceFlinger::init() 函数：

void SurfaceFlinger::init() FTL_FAKE_GUARD(kMainThreadContext) {
    // ......
    processDisplayAdded(token, state);
    // ......
}

进一步会调用到 processDisplayAdded 函数。

void SurfaceFlinger::processDisplayAdded(const wp<IBinder>& displayToken,
                                         const DisplayDeviceState& state) {
    ui::Size resolution(0, 0);
    ui::PixelFormat pixelFormat = static_cast<ui::PixelFormat>(PIXEL_FORMAT_UNKNOWN);
    if (state.physical) {
        resolution = state.physical->activeMode->getResolution();
        pixelFormat = static_cast<ui::PixelFormat>(PIXEL_FORMAT_RGBA_8888);
    } else if (state.surface != nullptr) {
        int status = state.surface->query(NATIVE_WINDOW_WIDTH, &resolution.width);
        ALOGE_IF(status != NO_ERROR, "Unable to query width (%d)", status);
        status = state.surface->query(NATIVE_WINDOW_HEIGHT, &resolution.height);
        ALOGE_IF(status != NO_ERROR, "Unable to query height (%d)", status);
        int format;
        status = state.surface->query(NATIVE_WINDOW_FORMAT, &format);
        ALOGE_IF(status != NO_ERROR, "Unable to query format (%d)", status);
        pixelFormat = static_cast<ui::PixelFormat>(format);
    } else {
        // Virtual displays without a surface are dormant:
        // they have external state (layer stack, projection,
        // etc.) but no internal state (i.e. a DisplayDevice).
        return;
    }

    compositionengine::DisplayCreationArgsBuilder builder;
    if (const auto& physical = state.physical) {
        builder.setId(physical->id);
    } else {
        builder.setId(acquireVirtualDisplay(resolution, pixelFormat));
    }

    builder.setPixels(resolution);
    builder.setIsSecure(state.isSecure);
    builder.setPowerAdvisor(mPowerAdvisor.get());
    builder.setName(state.displayName);

    // 关注点1 Display 初始化
    // Display 初始化
    auto compositionDisplay = getCompositionEngine().createDisplay(builder.build());
    compositionDisplay->setLayerCachingEnabled(mLayerCachingEnabled);

    sp<compositionengine::DisplaySurface> displaySurface;
    sp<IGraphicBufferProducer> producer;
    sp<IGraphicBufferProducer> bqProducer;
    sp<IGraphicBufferConsumer> bqConsumer;
    getFactory().createBufferQueue(&bqProducer, &bqConsumer, /*consumerIsSurfaceFlinger =*/false);

    if (state.isVirtual()) {
        const auto displayId = VirtualDisplayId::tryCast(compositionDisplay->getId());
        LOG_FATAL_IF(!displayId);
        auto surface = sp<VirtualDisplaySurface>::make(getHwComposer(), *displayId, state.surface,
                                                       bqProducer, bqConsumer, state.displayName);
        displaySurface = surface;
        producer = std::move(surface);
    } else {
        ALOGE_IF(state.surface != nullptr,
                 "adding a supported display, but rendering "
                 "surface is provided (%p), ignoring it",
                 state.surface.get());
        const auto displayId = PhysicalDisplayId::tryCast(compositionDisplay->getId());
        LOG_FATAL_IF(!displayId);
        // buffer 消费者
        displaySurface =
                sp<FramebufferSurface>::make(getHwComposer(), *displayId, bqConsumer,
                                             state.physical->activeMode->getResolution(),
                                             ui::Size(maxGraphicsWidth, maxGraphicsHeight));
        producer = bqProducer;
    }

    LOG_FATAL_IF(!displaySurface);

    // 关注点2 DisplayDevice 初始化
    auto display = setupNewDisplayDeviceInternal(displayToken, std::move(compositionDisplay), state,
                                                 displaySurface, producer);

    if (mScheduler && !display->isVirtual()) {
        const auto displayId = display->getPhysicalId();
        {
            // TODO(b/241285876): Annotate `processDisplayAdded` instead.
            ftl::FakeGuard guard(kMainThreadContext);

            // For hotplug reconnect, renew the registration since display modes have been reloaded.
            mScheduler->registerDisplay(displayId, display->holdRefreshRateSelector());
        }

        dispatchDisplayHotplugEvent(displayId, true);
    }

    if (display->isVirtual()) {
        display->adjustRefreshRate(mScheduler->getPacesetterRefreshRate());
    }

    // 关注点3 
    mDisplays.try_emplace(displayToken, std::move(display));
}

• 关注点1，初始化 Display 对象
• 关注点2，初始化 DisplayDevice
• 关注点3，把 DisplayDevice 保存到 mDisplays 中

这部分内容我们在本文的第三节已经分析过了，这里再次回顾一下。

6.2 refreshArgs.layersWithQueuedFrames 的赋值过程分析

    // 关注点2 refreshArgs.layersWithQueuedFrames
    // commit 时会将有 Buffer 有变化的 layer 都放在 mLayersWithQueuedFrames 里。这里放到 refreshArgs 参数内的并不是 layer，而是 layerFE
    // layerFE 中有 mSnapshot 变量，类型是 LayerFECompositionState，里面包含后续合成需要的信息。
    refreshArgs.layersWithQueuedFrames.reserve(mLayersWithQueuedFrames.size());
    for (auto layer : mLayersWithQueuedFrames) {
        if (auto layerFE = layer->getCompositionEngineLayerFE())
            refreshArgs.layersWithQueuedFrames.push_back(layerFE);
    }

commit 时会将有 Buffer 有变化的 layer 都放在 mLayersWithQueuedFrames 里，回顾一下代码：

bool SurfaceFlinger::latchBuffers() {
    // ......
    mDrawingState.traverse([&](Layer* layer) {
        if (layer->clearTransactionFlags(eTransactionNeeded) || mForceTransactionDisplayChange) {
            // 调用 layer 的 doTransaction
            const uint32_t flags = layer->doTransaction(0);
            if (flags & Layer::eVisibleRegion) {
                mVisibleRegionsDirty = true;
            }
        }
        // 存储需要更新的 layer 到 mLayersWithQueuedFrames
        // 要不就是有变化的 layer，要不就是需要锁存并且释放 buffer 的 layer（mDrawingState.buffer为空且mBufferInfo.mBuffer不为空）
        if (layer->hasReadyFrame() || layer->willReleaseBufferOnLatch()) {
            frameQueued = true;
            mLayersWithQueuedFrames.emplace(sp<Layer>::fromExisting(layer));
        } else {
            layer->useEmptyDamage();
            if (!layer->hasBuffer()) {
                layer->updateLastLatchTime(latchTime);
            }
        }
    });

    //......

这里会把 mLayersWithQueuedFrames 中 Layer 的 layerFE 成员保存到 refreshArgs.layersWithQueuedFrames 中去。

6.3 refreshArgs.layers 的赋值过程分析

    // 关注点3，调用 moveSnapshotsToCompositionArgs 来更新 layerFE 的 mSnapshot
    // 所有的 layerFE 会被存储在 refreshArgs.layers 中
    std::vector<std::pair<Layer*, LayerFE*>> layers =
            moveSnapshotsToCompositionArgs(refreshArgs, /*cursorOnly=*/false, vsyncId.value);

moveSnapshotsToCompositionArgs 函数更新 layerFE 内 mSnapshot，更新后会将所有的 layerFE 存储在 refreshArgs.layers 中。

LayerFE，这个是合成过程中使用的 layer，和 layer 的关系有点类似双缓冲区，合成的时候不使用 layer 自身，而使用其中的 LayerFE，里面也有一个Snapshot，记录合成时候需要的信息。

接下来，我们来看 moveSnapshotsToCompositionArgs 的实现：

std::vector<std::pair<Layer*, LayerFE*>> SurfaceFlinger::moveSnapshotsToCompositionArgs(
        compositionengine::CompositionRefreshArgs& refreshArgs, bool cursorOnly, int64_t vsyncId) {
  
    std::vector<std::pair<Layer*, LayerFE*>> layers;
    // 这里 mLegacyFrontEndEnabled 和 mLayerLifecycleManagerEnabled 只有一个为 true，是不同的策略
    // 我的手机上走的是 mLegacyFrontEndEnabled 为 true 的逻辑
    if (mLayerLifecycleManagerEnabled) {
        // ......
    }
  
    if (mLegacyFrontEndEnabled && !mLayerLifecycleManagerEnabled) { // 走这个 case
        // 定义 moveSnapshots 方法，后面对所有 layer 都要调用这个方法。
        auto moveSnapshots = [&layers, &refreshArgs, cursorOnly](Layer* layer) {
            if (const auto& layerFE = layer->getCompositionEngineLayerFE()) {
                if (cursorOnly &&
                    layer->getLayerSnapshot()->compositionType !=
                            aidl::android::hardware::graphics::composer3::Composition::CURSOR)
                    return;
                // 调用 layer 的 updateSnapshot 更新 snapshot，
                layer->updateSnapshot(refreshArgs.updatingGeometryThisFrame);
                // 将 layer 内的 snapshot 移到 layerFE 内
                layerFE->mSnapshot = layer->stealLayerSnapshot();
                // 将layerFE存储到refreshArgs内，作为后续合成的参数。
                refreshArgs.layers.push_back(layerFE);
                layers.emplace_back(layer, layerFE.get());
            }
        };

        // 如果经过前面 commit 的预处理，mVisibleRegionsDirty 为 false，说明没有新增 layer，就只需要重新处理上一次 layer
        if (cursorOnly || !mVisibleRegionsDirty) {
            for (sp<Layer> layer : mPreviouslyComposedLayers) {
                moveSnapshots(layer.get());
            }
        } else {
            // 否则就需要遍历mDrawingState所有layer，调用moveSnapshots，moveSnapshots是上面定义的这方法
            mPreviouslyComposedLayers.clear();
            mDrawingState.traverseInZOrder(
                    [&moveSnapshots](Layer* layer) { moveSnapshots(layer); });
            mPreviouslyComposedLayers.reserve(layers.size());
            for (auto [layer, _] : layers) {
                mPreviouslyComposedLayers.push_back(sp<Layer>::fromExisting(layer));
            }
        }
    }

    return layers;
}

这里会把之前 commit 时候，Transaction 同步到 layer 的变换信息全部同步到 snapshot 上，snapshot 是一个 LayerSnapshot 结构体，继承自 LayerFECompositionState，里面有大量 layer 的合成时候需要使用的信息。

void Layer::updateSnapshot(bool updateGeometry) {
    if (!getCompositionEngineLayerFE()) {
        return;
    }
    // 获取 snapshot，这里 snapshot 是一个 LayerSnapshot，继承自 LayerFECompositionState
    // 这个结构里面有大量layer相关的数据
    // 我们前面在commit的流程中已经将Transaction内包含等变化信息同步到layer上了，这里就是通过layer内的变量更新snapshot
    auto* snapshot = editLayerSnapshot();
    if (updateGeometry) {
        prepareBasicGeometryCompositionState();
        prepareGeometryCompositionState();
        snapshot->roundedCorner = getRoundedCornerState();
        snapshot->stretchEffect = getStretchEffect();
        snapshot->transformedBounds = mScreenBounds;
        if (mEffectiveShadowRadius > 0.f) {
            snapshot->shadowSettings = mFlinger->mDrawingState.globalShadowSettings;
            snapshot->shadowSettings.boundaries = mBounds;

            const float casterAlpha = snapshot->alpha;
            const bool casterIsOpaque =
                    ((mBufferInfo.mBuffer != nullptr) && isOpaque(mDrawingState));
            snapshot->shadowSettings.casterIsTranslucent = !casterIsOpaque || (casterAlpha < 1.0f);
            snapshot->shadowSettings.ambientColor *= casterAlpha;
            snapshot->shadowSettings.spotColor *= casterAlpha;
        }
        snapshot->shadowSettings.length = mEffectiveShadowRadius;
    }
    snapshot->contentOpaque = isOpaque(mDrawingState);
    snapshot->layerOpaqueFlagSet =
            (mDrawingState.flags & layer_state_t::eLayerOpaque) == layer_state_t::eLayerOpaque;
    snapshot->isHdrY410 = isHdrY410();
    sp<Layer> p = mDrawingParent.promote();
    if (p != nullptr) {
        snapshot->parentTransform = p->getTransform();
    } else {
        snapshot->parentTransform.reset();
    }
    snapshot->bufferSize = getBufferSize(mDrawingState);
    // buffer 
    snapshot->externalTexture = mBufferInfo.mBuffer;
    snapshot->hasReadyFrame = hasReadyFrame();
    preparePerFrameCompositionState();
}

小结一下：

• refreshArgs.outputs 中准备好了 Display 相关信息
• refreshArgs.layersWithQueuedFrames 中准备好了 LayerFE，这些 LayerFE 要么是要更新 buffer，要么是要 release buffer
• refreshArgs.layers 中准备好了所有的 LayerFE，且 LayerFE 的 mSnapshot 成员已更新，里面保存了合成需要的内容。

数据流向 App -> Layer -> LayerFE -> LayerSnapshot