public class ShowRefreshRatePreferenceController extends DeveloperOptionsPreferenceController
        implements Preference.OnPreferenceChangeListener, PreferenceControllerMixin {
    ......
    private static final int SETTING_VALUE_QUERY = 2;
    private static final int SETTING_VALUE_ON = 1;
    private static final int SETTING_VALUE_OFF = 0;
    @VisibleForTesting
    static final String SURFACE_FLINGER_SERVICE_KEY = "SurfaceFlinger";
    @VisibleForTesting
    static final int SURFACE_FLINGER_CODE = 1034;
    private static final String SURFACE_COMPOSER_INTERFACE_KEY = "android.ui.ISurfaceComposer";
    private final IBinder mSurfaceFlinger;
    ......
    @Override
    public boolean onPreferenceChange(Preference preference, Object newValue) {
        final boolean isEnabled = (Boolean) newValue;
        writeShowRefreshRateSetting(isEnabled);
        return true;
    }
    @Override
    public void updateState(Preference preference) {
        updateShowRefreshRateSetting();
    }
    ......
    @VisibleForTesting
    void updateShowRefreshRateSetting() {
        // magic communication with surface flinger.
        try {
            if (mSurfaceFlinger != null) {
                final Parcel data = Parcel.obtain();
                final Parcel reply = Parcel.obtain();
                data.writeInterfaceToken(SURFACE_COMPOSER_INTERFACE_KEY);
                data.writeInt(SETTING_VALUE_QUERY);
                mSurfaceFlinger.transact(SURFACE_FLINGER_CODE, data, reply, 0 /* flags */); // 調(diào)用 SurfaceFlinger::onTransact 中 1034 方法
                final boolean enabled = reply.readBoolean();    // 通過 SurfaceFlinger 獲取 mRefreshRateOverlay != null判斷顯示是否打開
                ((SwitchPreference) mPreference).setChecked(enabled);
                reply.recycle();
                data.recycle();
            }
        } catch (RemoteException ex) {
            // intentional no-op
        }
    }
    @VisibleForTesting
    void writeShowRefreshRateSetting(boolean isEnabled) {   // 設置打開顯示刷新頻率
        try {
            if (mSurfaceFlinger != null) {
                final Parcel data = Parcel.obtain();
                data.writeInterfaceToken(SURFACE_COMPOSER_INTERFACE_KEY);
                final int showRefreshRate = isEnabled ? SETTING_VALUE_ON : SETTING_VALUE_OFF;
                data.writeInt(showRefreshRate);
                mSurfaceFlinger.transact(SURFACE_FLINGER_CODE, data,
                        null /* reply */, 0 /* flags */);
                data.recycle();
            }
        } catch (RemoteException ex) {
            // intentional no-op
        }
        updateShowRefreshRateSetting();
    }
}

namespace {
    ......
status_t SurfaceFlinger::onTransact(uint32_t code, const Parcel& data, Parcel* reply,
                                    uint32_t flags) {
    if (const status_t error = CheckTransactCodeCredentials(code); error != OK) {
        return error;
    }
    status_t err = BnSurfaceComposer::onTransact(code, data, reply, flags);
    if (err == UNKNOWN_TRANSACTION || err == PERMISSION_DENIED) {
        CHECK_INTERFACE(ISurfaceComposer, data, reply);
        IPCThreadState* ipc = IPCThreadState::self();
        const int uid = ipc->getCallingUid();
        if(code == 8002) {
            reply->writeInt32(mScheduler->getDfrcFps());
            return NO_ERROR;
        }
        if (CC_UNLIKELY(uid != AID_SYSTEM
                && !PermissionCache::checkCallingPermission(sHardwareTest))) {
            const int pid = ipc->getCallingPid();
            ALOGE("Permission Denial: "
                    "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
            return PERMISSION_DENIED;
        }
        int n;
        switch (code) {
            ......
            case 1034: {
                auto future = mScheduler->schedule([&] {
                    switch (n = data.readInt32()) {
                        case 0:
                        case 1:
                            FTL_FAKE_GUARD(mStateLock,
                                           enableRefreshRateOverlay(static_cast<bool>(n)));
                            break;
                        default: {
                            reply->writeBool(
                                    FTL_FAKE_GUARD(mStateLock, isRefreshRateOverlayEnabled()));
                        }
                    }
                });
                future.wait();
                return NO_ERROR;
            }
            ......
void SurfaceFlinger::enableRefreshRateOverlay(bool enable)
{
    for (const auto& [ignored, display] : mDisplays) {
        if (display->isInternal() && !display->isVirtual()) {
            if (enable) {
                auto fpsRange = display->refreshRateConfigs().getSupportedRefreshRateRange();
                mRefreshRateOverlay = std::make_shared<RefreshRateOverlay>(fpsRange, mRefreshRateOverlaySpinner);
            } else {
                mRefreshRateOverlay.reset(); //disable RefreshRateOverlay
            }
            display->enableRefreshRateOverlay(mRefreshRateOverlay);
        }
    }
}
            ......

RefreshRateOverlay::RefreshRateOverlay(FpsRange fpsRange, bool showSpinner)
      : mFpsRange(fpsRange),
        mShowSpinner(showSpinner),
        mSurfaceControl(SurfaceComposerClient::getDefault()
                                ->createSurface(String8("RefreshRateOverlay"), kBufferWidth,
                                                kBufferHeight, PIXEL_FORMAT_RGBA_8888,
                                                ISurfaceComposerClient::eFXSurfaceBufferState)) {
    if (!mSurfaceControl) {
        ALOGE("%s: Failed to create buffer state layer", __func__);
        return;
    }
    createTransaction(mSurfaceControl)
            .setLayer(mSurfaceControl, INT32_MAX - 2)
            .setTrustedOverlay(mSurfaceControl, true)
            .apply();
}