devbox
天景科技苑
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

深入分析Android SensorService_android sensor hal sensorservice

作者：天景科技苑 | 2024-06-28 04:23:47

赞

踩

android sensor hal sensorservice

 

四个多月前就想写这个了文章了，一直没空写，今天把有空就写一下吧。本篇文章主要内容如下

目录

1，Android 各模块关系基本流程图

2， SensorService启动

3，  应用注册一个sensor流程

4， SensorService如何将sensor数据给到应用

5，  待机后SensorService行为

6，  融合sensor（SensorFusion）

7，  编译SensorService

8，  dumpsys sensorservice

9，  android sensor hal层启动

10，SensorManager 启动

(1)SystemSensorManager 启动流程

(2) native层 SensorManager 启动流程

 

本文分析的源码基于android 9.0

====================================================

1，Android 各模块关系基本流程图

整个android sensor模块的核心是SensorService，应用通过SensorManager与其交互，SensorService基本上管理sensor的所有行为，包括开关sensor，获取sensor数据给到应用，应用是否有权限获取sensor，待机后sensor的行为，sensor数据和开关记录缓存，还可以在这自定义虚拟sensor，等等。

到Android 9为止，SensorService一直跑在system server里边，所有只要SensorService挂了，整个系统就挂了（android 10貌似有做了改进，还没有去研究下），个人觉得google 如果把它做成和audio server那样会好一些，挂了3s之后重新拉起来。

 

2， SensorService启动

sensorservice是在system_server启动的时候，由system_server拉起来的，
如前面所说，跑在system_server进程里边，所以只要sensorservice 发生 crash，
会导致syste_server跟着挂掉重启，

  1. android/frameworks/base/services/java/com/android/server/SystemServer.java
  2.  
  3. private void startBootstrapServices() {
  4. 	//......
  5.      mSensorServiceStart = SystemServerInitThreadPool.get().submit(() -> {
  6.        TimingsTraceLog traceLog = new TimingsTraceLog(
  7.                SYSTEM_SERVER_TIMING_ASYNC_TAG, Trace.TRACE_TAG_SYSTEM_SERVER);
  8.        traceLog.traceBegin(START_SENSOR_SERVICE);
  9.        startSensorService();//调用JNI接口
  10.        traceLog.traceEnd();
  11.    }, START_SENSOR_SERVICE);
  12. 	
  13. 	//......
  14.  
  15. }

对应jni实现如下:

  1. /*
  2.  * JNI registration.
  3.  */
  4. static const JNINativeMethod gMethods[] = {
  5.     /* name, signature, funcPtr */
  6. 	//这边先将该接口注册，后面给system_server调用
  7.     { "startSensorService", "()V", (void*) android_server_SystemServer_startSensorService }
  8.     { "startHidlServices", "()V", (void*) android_server_SystemServer_startHidlServices },
  9. };
  10.  
  11. //在这儿创建sensorservice
  12. static void android_server_SystemServer_startSensorService(JNIEnv* /* env */, jobject /* clazz */) {
  13.     char propBuf[PROPERTY_VALUE_MAX];
  14.     property_get("system_init.startsensorservice", propBuf, "1");
  15.     if (strcmp(propBuf, "1") == 0) {
  16.         SensorService::instantiate();
  17.     }
  18.  
  19. }

用SensorService::instantiate()方式创建的sensorservice实例，
sensorservice继承了BinderService，所以是用BinderService::instantiate()来创建实例，如下;

  1. //这边SERVICE为SensorService类型
  2. template<typename SERVICE>
  3. class BinderService
  4. {
  5. //......
  6. public:
  7.     static status_t publish(bool allowIsolated = false,
  8.                             int dumpFlags = IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT) {
  9.         sp<IServiceManager> sm(defaultServiceManager());
  10. 	   //创建SensorService实例并且添加到ServiceManage
  11.         return sm->addService(String16(SERVICE::getServiceName()), new SERVICE(), allowIsolated,
  12.                               dumpFlags);
  13.     }
  14.  
  15.     static void instantiate() { publish(); }
  16.  
  17. //......
  18. };


看SensorService构造函数，其实构造函数没做什么事，主要是创建了UidPolicy对象，这个用来做待机sensor行为管理，后面分析
 

  1. SensorService::SensorService()
  2.     : mInitCheck(NO_INIT), mSocketBufferSize(SOCKET_BUFFER_SIZE_NON_BATCHED),
  3.       mWakeLockAcquired(false) {
  4.     mUidPolicy = new UidPolicy(this);
  5. }

接下来被调用的是onFirstRef()方法，
//onFirstRef()方法是在ServiceManager里边调用的
当前面创建的SensorService对象被提升为一个强指针时在 RefBase::incStrong(const void* id)里边被调用的，
如何被调用还得回到前面的BinderService::publish(),感兴趣的读者可以自行研究下。
=====================================
看onFirstRef()，

  1. void SensorService::onFirstRef() {
  2.     SensorDevice& dev(SensorDevice::getInstance());//创建并获取SensorDevice实例
  3.  
  4.     sHmacGlobalKeyIsValid = initializeHmacKey();
  5.  
  6.     if (dev.initCheck() == NO_ERROR) {
  7.         sensor_t const* list;
  8.         ssize_t count = dev.getSensorList(&list);//获取vendor层注册的sensor 数目
  9.         if (count > 0) {
  10.             ssize_t orientationIndex = -1;
  11.             bool hasGyro = false, hasAccel = false, hasMag = false;
  12.             uint32_t virtualSensorsNeeds =
  13.                     (1<<SENSOR_TYPE_GRAVITY) |
  14.                     (1<<SENSOR_TYPE_LINEAR_ACCELERATION) |
  15.                     (1<<SENSOR_TYPE_ROTATION_VECTOR) |
  16.                     (1<<SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR) |
  17.                     (1<<SENSOR_TYPE_GAME_ROTATION_VECTOR);
  18. 			//遍历每个sensor并将其注册到SensorList里边
  19.             for (ssize_t i=0 ; i<count ; i++) {
  20.                 bool useThisSensor=true;
  21.  
  22.                 switch (list[i].type) {
  23.                     case SENSOR_TYPE_ACCELEROMETER:
  24.                         hasAccel = true;
  25.                         break;
  26.                     case SENSOR_TYPE_MAGNETIC_FIELD:
  27.                         hasMag = true;
  28.                         break;
  29.                     case SENSOR_TYPE_ORIENTATION:
  30.                         orientationIndex = i;
  31.                         break;
  32.                     case SENSOR_TYPE_GYROSCOPE:
  33.                     case SENSOR_TYPE_GYROSCOPE_UNCALIBRATED:
  34.                         hasGyro = true;
  35.                         break;
  36.                     case SENSOR_TYPE_GRAVITY:
  37.                     case SENSOR_TYPE_LINEAR_ACCELERATION:
  38.                     case SENSOR_TYPE_ROTATION_VECTOR:
  39.                     case SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR:
  40.                     case SENSOR_TYPE_GAME_ROTATION_VECTOR:
  41.                         if (IGNORE_HARDWARE_FUSION) {
  42.                             useThisSensor = false;
  43.                         } else {
  44.                             virtualSensorsNeeds &= ~(1<<list[i].type);
  45.                         }
  46.                         break;
  47.                 }
  48.                 if (useThisSensor) {
  49. 				//将HAL层的sensor_t类型结构体，存在HardwareSensor类里边，
  50. 				//进而在SensorList类里边通过map将handle和HardwareSensor一起存储起来，
  51.                     registerSensor( new HardwareSensor(list[i]) );
  52.                 }
  53.             }
  54. 			
  55. 			
  56.             // it's safe to instantiate the SensorFusion object here
  57.             // (it wants to be instantiated after h/w sensors have been
  58.             // registered)
  59.             SensorFusion::getInstance();
  60. 			//融合虚拟sensor的一些逻辑处理，这些不是重点，可以先不管
  61. 			//所谓融合sensor，就是虚拟一个sensor，数据是拿一个或多个实际sensor的数据通过各种算法运算处理出来的,
  62. 			//比如手机里边的自动转屏功能，就是用加速度数据算出来的。
  63. 			//一般这些虚拟sensor需要一个算法一直在跑，若直接跑在AP端功耗很高，
  64. 			//手机厂家都是将其实现在协处理器里边，比如高通骁龙845、855的slpi，
  65. 			//而不是直接用google在framework实现的那套算法，
  66.             if (hasGyro && hasAccel && hasMag) {
  67.                 // Add Android virtual sensors if they're not already
  68.                 // available in the HAL
  69.                 bool needRotationVector =
  70.                         (virtualSensorsNeeds & (1<<SENSOR_TYPE_ROTATION_VECTOR)) != 0;
  71.  
  72.                 registerSensor(new RotationVectorSensor(), !needRotationVector, true);
  73.                 registerSensor(new OrientationSensor(), !needRotationVector, true);
  74.  
  75.                 bool needLinearAcceleration =
  76.                         (virtualSensorsNeeds & (1<<SENSOR_TYPE_LINEAR_ACCELERATION)) != 0;
  77.  
  78.                 registerSensor(new LinearAccelerationSensor(list, count),
  79.                                !needLinearAcceleration, true);
  80.  
  81.                 // virtual debugging sensors are not for user
  82.                 registerSensor( new CorrectedGyroSensor(list, count), true, true);
  83.                 registerSensor( new GyroDriftSensor(), true, true);
  84.             }
  85.  
  86.             if (hasAccel && hasGyro) {
  87.                 bool needGravitySensor = (virtualSensorsNeeds & (1<<SENSOR_TYPE_GRAVITY)) != 0;
  88.                 registerSensor(new GravitySensor(list, count), !needGravitySensor, true);
  89.  
  90.                 bool needGameRotationVector =
  91.                         (virtualSensorsNeeds & (1<<SENSOR_TYPE_GAME_ROTATION_VECTOR)) != 0;
  92.                 registerSensor(new GameRotationVectorSensor(), !needGameRotationVector, true);
  93.             }
  94.  
  95.             if (hasAccel && hasMag) {
  96.                 bool needGeoMagRotationVector =
  97.                         (virtualSensorsNeeds & (1<<SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR)) != 0;
  98.                 registerSensor(new GeoMagRotationVectorSensor(), !needGeoMagRotationVector, true);
  99.             }
  100.  
  101.  
  102.             mWakeLockAcquired = false;
  103.             mLooper = new Looper(false);
  104.             const size_t minBufferSize = SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT;
  105.             mSensorEventBuffer = new sensors_event_t[minBufferSize];//创建存储sensor数据的buffer,可以存储256个数据
  106.             mSensorEventScratch = new sensors_event_t[minBufferSize];//这个用来存储啥的还不知道
  107.             mMapFlushEventsToConnections = new wp<const SensorEventConnection> [minBufferSize];
  108.             mCurrentOperatingMode = NORMAL;
  109.  
  110.             mNextSensorRegIndex = 0;
  111.             for (int i = 0; i < SENSOR_REGISTRATIONS_BUF_SIZE; ++i) {
  112.                 mLastNSensorRegistrations.push();//这个用来保存应用开关sensor的记录，后面 dumpsys sensorservice dump出来方便debug问题
  113.             }
  114.  
  115.             mInitCheck = NO_ERROR;
  116. 			//创建并运行一个SensorEventAckReceiver 线程
  117. 			//这个loop线程用来不断检测是否需要持有wakelock
  118.             mAckReceiver = new SensorEventAckReceiver(this);
  119.             mAckReceiver->run("SensorEventAckReceiver", PRIORITY_URGENT_DISPLAY);
  120.             
  121.             //在run里边调用SensorEventAckReceiver::threadLoop()方法,
  122.             //至于threadLoop是如何被调用的，感兴趣的读者可以跟一下源码，
  123. 			//大概是在android/system/core/libutils/Threads.cpp 里边，
  124.             //通过pread_create() 创建一个线程运行thread::_threadLoop,
  125. 			//在这里边调用其子类（也就是SensorEventAckReceiver）的threadLoop,
  126.  
  127. 			
  128. 			//同理通过创建一个线程运行SensorService::threadLoop(),
  129.             run("SensorService", PRIORITY_URGENT_DISPLAY);
  130.  
  131.             // priority can only be changed after run
  132.             enableSchedFifoMode();//降低主线程调度优先级
  133.  
  134.             // Start watching UID changes to apply policy.
  135.             mUidPolicy->registerSelf();//这边mUidPolicy将自己注册到uid待机管理里边，后面应用待机行为发生变化时其接口会通过多态被回调
  136.         }
  137.     }
  138. }

 

在看SensorService::threadLoop()之前，先来看下SensorDevice的构造函数，
SensorDevice是实际上与HAL层直接进行交互的类，通过hidl与
sensor在HAL层的服务建立连接（这边所指的HAL层只是指google实现的那部分，
即： android.hardware.sensors@1.0-service，这一层通过dlopen()，会调用第三方如芯片厂商，
手机厂商，开发者等实现的SO库，实际上这些都应该统称为HAL层，也可以统称vendor层）。

  1.  
  2. SensorDevice::SensorDevice()
  3.         : mHidlTransportErrors(20), mRestartWaiter(new HidlServiceRegistrationWaiter()) {
  4.  
  5.     //通过hidl与HAL层建立连接
  6.     if (!connectHidlService()) {
  7.         return;
  8.     }
  9.  
  10.     //获取开机时前面所说的第三方SO库注册的sensor，这个SO库一般就是直接与驱动进行通信对实际sensor进行开关和数据获取了，
  11. 	//比如高通骁龙855的sensors.ssc.so通过qmi与slpi进行通信。
  12. 	//后面所有与HAL层通信都是通过这个sp<hardware::sensors::V1_0::ISensors> mSensors
  13.     checkReturn(mSensors->getSensorsList(
  14.             [&](const auto &list) {
  15.                 const size_t count = list.size();
  16.  
  17.                 mActivationCount.setCapacity(count);
  18.                 Info model;
  19.                 for (size_t i=0 ; i < count; i++) {
  20.                     sensor_t sensor;
  21.                     convertToSensor(list[i], &sensor);
  22.                     // Sanity check and clamp power if it is 0 (or close)
  23.                     if (sensor.power < minPowerMa) {
  24.                         ALOGE("Reported power %f not deemed sane, clamping to %f",
  25.                               sensor.power, minPowerMa);
  26.                         sensor.power = minPowerMa;
  27.                     }
  28.                     mSensorList.push_back(sensor);//将HAL层注册的sensor保存起来，具体如何注册的，后面分析sensor HAL层部分再分析
  29. 					
  30. 					//保存该sensor的handle，这个现在还不知道做什么的，具体这个handle是在前面所说的第三方SO库决定的，一般按顺序叠加
  31.                     mActivationCount.add(list[i].sensorHandle, model);
  32.  
  33.                     checkReturn(mSensors->activate(list[i].sensorHandle, 0 /* disable */));//关闭该sensor，以防开着没用漏电
  34.                 }
  35.             }));
  36.  
  37. }

回过头来看SensorService::threadLoop(),

  1. bool SensorService::threadLoop() {
  2.     ALOGD("nuSensorService thread starting...");
  3.  
  4.     // each virtual sensor could generate an event per "real" event, that's why we need to size
  5.     // numEventMax much smaller than MAX_RECEIVE_BUFFER_EVENT_COUNT.  in practice, this is too
  6.     // aggressive, but guaranteed to be enough.
  7.     const size_t vcount = mSensors.getVirtualSensors().size();
  8.     const size_t minBufferSize = SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT;
  9.     const size_t numEventMax = minBufferSize / (1 + vcount);
  10.     //为何要这么做,再解释一下,比如说这边有vcount个虚拟的 sensor跑在framework,
  11.     //那么比较极端的情况下每从HAL取numEventMax个数据,这边vcount个sensor会各生成numEventMax个数据,
  12.     //而mSensorEventBuffer 最多只能容纳 MAX_RECEIVE_BUFFER_EVENT_COUNT个数据,
  13.     //所以 numEventMax = minBufferSize / (1 + vcount);
  14.  
  15.     SensorDevice& device(SensorDevice::getInstance());
  16.  
  17.     const int halVersion = device.getHalDeviceVersion();
  18.     do {
  19.         //通过SensorDevice往HAL层取数据, 若没有数据的时候就一直阻塞(这个由前面说的第三方SO库实现)
  20.         //一般在该so库的poll里边，可以采用c++标准实现的queue::pop(),来获取数据，没数据时就一直阻塞，
  21.         //当驱动有数据上来时，另外一个线程将sensor数据往这个队列里边queue::pop就行了
  22.         ssize_t count = device.poll(mSensorEventBuffer, numEventMax);
  23.         if (count < 0) {
  24.             ALOGE("sensor poll failed (%s)", strerror(-count));
  25.             break;
  26.  
  27.         }
  28.  
  29.         // Reset sensors_event_t.flags to zero for all events in the buffer.
  30.         for (int i = 0; i < count; i++) {
  31.              mSensorEventBuffer[i].flags = 0;
  32.         }
  33.  
  34.         // Make a copy of the connection vector as some connections may be removed during the course
  35.         // of this loop (especially when one-shot sensor events are present in the sensor_event
  36.         // buffer). Promote all connections to StrongPointers before the lock is acquired. If the
  37.         // destructor of the sp gets called when the lock is acquired, it may result in a deadlock
  38.         // as ~SensorEventConnection() needs to acquire mLock again for cleanup. So copy all the
  39.         // strongPointers to a vector before the lock is acquired.
  40.         SortedVector< sp<SensorEventConnection> > activeConnections;
  41.         populateActiveConnections(&activeConnections);
  42.  
  43.         Mutex::Autolock _l(mLock);
  44.         // Poll has returned. Hold a wakelock if one of the events is from a wake up sensor. The
  45.         // rest of this loop is under a critical section protected by mLock. Acquiring a wakeLock,
  46.         // sending events to clients (incrementing SensorEventConnection::mWakeLockRefCount) should
  47.         // not be interleaved with decrementing SensorEventConnection::mWakeLockRefCount and
  48.         // releasing the wakelock.
  49.         bool bufferHasWakeUpEvent = false;
  50.         for (int i = 0; i < count; i++) {
  51.             if (isWakeUpSensorEvent(mSensorEventBuffer[i])) {
  52.                 bufferHasWakeUpEvent = true;
  53.                 break;
  54.             }
  55.         }
  56. 		//若有wakeup 类型sensor上报的数据就持有wakelock
  57.         if (bufferHasWakeUpEvent && !mWakeLockAcquired) {
  58.             setWakeLockAcquiredLocked(true);
  59.         }
  60.         recordLastValueLocked(mSensorEventBuffer, count);//将事件保存下来,后面可以用dumpsys sensorservice dump出来方便分析问题
  61.  
  62.         // 暂时可先忽略handle virtual sensor，dynamic sensor部分不看
  63. 		
  64. 		
  65.         // Send our events to clients. Check the state of wake lock for each client and release the
  66.         // lock if none of the clients need it.
  67.         bool needsWakeLock = false;
  68.         size_t numConnections = activeConnections.size();
  69.         for (size_t i=0 ; i < numConnections; ++i) {
  70.             if (activeConnections[i] != 0) {
  71. 				//通过SensorEventConnection 将数据通过socket发送给应用
  72.                 activeConnections[i]->sendEvents(mSensorEventBuffer, count, mSensorEventScratch,
  73.                         mMapFlushEventsToConnections);
  74.                 needsWakeLock |= activeConnections[i]->needsWakeLock();
  75.                 // If the connection has one-shot sensors, it may be cleaned up after first trigger.
  76.                 // Early check for one-shot sensors.
  77.                 if (activeConnections[i]->hasOneShotSensors()) {
  78.                     cleanupAutoDisabledSensorLocked(activeConnections[i], mSensorEventBuffer,
  79.                             count);
  80.                 }
  81.             }
  82.         }
  83. 		
  84. 		//若还有wake up 类型的sensor报上来的数据的话，需要继续持有wakelock
  85.         if (mWakeLockAcquired && !needsWakeLock) {
  86.             setWakeLockAcquiredLocked(false);
  87.         }
  88.     } while (!Thread::exitPending());
  89.  
  90.     ALOGW("Exiting SensorService::threadLoop => aborting...");
  91.     abort();
  92.     return false;
  93. }

到此为此，sensorservice已经启动了，能够接收binder通信发过来的enable(), disable(), flush()等请求
也能够读取HAL层的数据给到应用。

=============================================================================

在看SensorService如何将数据给到应用之前，先分析一下以下几个比较关键的类

(1)SensorDevice

SensorDevice继承了Singleton类，设计成单例，后面要用的话用getinstance()的方式
为何用单例，是因为sensorservice会有多个线程与vendor层交互，若用多个的话，逻辑会比较混淆，并且也没有必要，节约一点内存哈哈。
里边保存着一个关键性的成员 ：sp<hardware::sensors::V1_0::ISensors> mSensors，
在构造的时候会获取到vendor层的sensor服务android.hardware.sensors@1.0-service，后面都是
通过这个mSensors调用Vendor层的接口的,代码如下，前面其实已经分析过了，为了不需要拉回去看，再贴一下

  1. SensorDevice::SensorDevice()
  2.         : mHidlTransportErrors(20), mRestartWaiter(new HidlServiceRegistrationWaiter()) {
  3.  
  4.     //通过hidl与HAL层建立连接
  5.     if (!connectHidlService()) {
  6.         return;
  7.     }
  8.  
  9.     //获取开机时前面所说的第三方SO库注册的sensor，这个SO库一般就是直接与驱动进行通信对实际sensor进行开关和数据获取了，
  10. 	//比如高通骁龙855的sensors.ssc.so通过qmi与slpi进行通信。
  11. 	//这些sensor_t 类型的结构体，需要第三方的so库里边自己实现，每个结构体对象存储一个sensor的信息
  12.     checkReturn(mSensors->getSensorsList(
  13.             [&](const auto &list) {
  14.                 const size_t count = list.size();
  15.  
  16.                 mActivationCount.setCapacity(count);
  17.                 Info model;
  18.                 for (size_t i=0 ; i < count; i++) {
  19.                     sensor_t sensor;
  20.                     convertToSensor(list[i], &sensor);
  21.                     // Sanity check and clamp power if it is 0 (or close)
  22.                     if (sensor.power < minPowerMa) {
  23.                         ALOGE("Reported power %f not deemed sane, clamping to %f",
  24.                               sensor.power, minPowerMa);
  25.                         sensor.power = minPowerMa;
  26.                     }
  27.                     mSensorList.push_back(sensor);//将HAL层注册的sensor保存起来，具体如何注册的，后面分析sensor HAL层部分再分析
  28. 					
  29. 					//保存该sensor的handle，具体数值是在前面所说的第三方SO库决定的，一般是从1开启按顺序叠加
  30.                     mActivationCount.add(list[i].sensorHandle, model);
  31.  
  32.                     checkReturn(mSensors->activate(list[i].sensorHandle, 0 /* disable */));//关闭该sensor，以防开着没用漏电
  33.                 }
  34.             }));
  35.  
  36. }
  37.  
  38. bool SensorDevice::connectHidlService() {
  39.     // SensorDevice will wait for HAL service to start if HAL is declared in device manifest.
  40.     size_t retry = 10;
  41.  
  42.     while (retry-- > 0) {
  43. 		//......
  44. 		
  45.         //通过hidl获取 android.hardware.sensors@1.0-service
  46.         mSensors = ISensors::getService();
  47.         if (mSensors == nullptr) {
  48.             // no sensor hidl service found
  49.             break;
  50.         }
  51. 		
  52. 		//.......
  53.     }
  54.     return (mSensors != nullptr);
  55. }


(2)SensorEventConnection

这个类主要是用来给应用发送sensor数据的，通过socket进行通信，
当应用注册sensor时，SensorManager.cpp里边会通过调用 SensorService::createSensorEventConnection()来生成属于该应用的connection，
一个应用拥有多少个SensorEventConnection，取决于应用创建多少个SensorEventListerner，
可能有的应用开发者注册多个sensor时，喜欢只创建一个SensorEventListerner，然后在onSensorChanged()里边做类型区分，
有的喜欢一个sensor一个SensorEventListerner，从性能的角度考虑建议一个应用创建一个SensorEventListerner就够了，
毕竟每创建一个，就要新建立一个socket连接，多一个poll去等待数据。

看下构造函数，

  1. SensorService::SensorEventConnection::SensorEventConnection(
  2.         const sp<SensorService>& service, uid_t uid, String8 packageName, bool isDataInjectionMode,
  3.         const String16& opPackageName, bool hasSensorAccess)
  4.     : mService(service), mUid(uid), mWakeLockRefCount(0), mHasLooperCallbacks(false),
  5.       mDead(false), mDataInjectionMode(isDataInjectionMode), mEventCache(NULL),
  6.       mCacheSize(0), mMaxCacheSize(0), mPackageName(packageName), mOpPackageName(opPackageName),
  7.       mDestroyed(false), mHasSensorAccess(hasSensorAccess) {
  8.     mChannel = new BitTube(mService->mSocketBufferSize);
  9. #if DEBUG_CONNECTIONS
  10.     mEventsReceived = mEventsSentFromCache = mEventsSent = 0;
  11.     mTotalAcksNeeded = mTotalAcksReceived = 0;
  12. #endif
  13. }

主要是保存应用的信息，
2个package名字，分别表示，
packageName：应用包名；
opPackageName：java vm的名字，
在android/frameworks/base/services/core/jni/com_android_server_SystemServer.cpp 
android_server_SystemServer_startHidlServices()里边获取并传进来的。

该类的重点在于其SensorEventConnection::sendEvents() 函数，在这边将数据发送给应用，所以如果遇到应用获取不到sensor数据的问题，也可以在这里边debug，包括

a，多个应用注册同一个sensor，有的应用收到数据，有的没有；

b，所有应用都没有收到某些sensor数据；

c，所有sensor都没有数据；

都可以将mPackageName和sensor type， sensor data，sensor timestamp在这打印出来，或者统一存储后dump sensorservice出来。

(3)SensorEventQueue

SensorEventQueue有多个类实现，这边主要说的是SensorService里边用到的SensorEventQueue，定义在 android/frameworks/native/libs/sensor/里边，
当应用注册sensor时，会在SystemSensorManager里边创建一个java类SensorEventQueue，这里边再去创建咱们要讲的那个c++类SensorEventQueue，
当sensor数据到来时，SensorEventQueue会通过回调应用实现的onSensorChanged()接口而将数据给到应用，

  1. //在这儿创建，android/frameworks/native/libs/sensor/SensorManager.cpp
  2. sp<SensorEventQueue> SensorManager::createEventQueue(String8 packageName, int mode) {
  3.     sp<SensorEventQueue> queue;
  4.  
  5.     Mutex::Autolock _l(mLock);
  6.     while (assertStateLocked() == NO_ERROR) {
  7. 		//向SensorService请求创建connection，最后调用 SensorService::createSensorEventConnection()
  8.         sp<ISensorEventConnection> connection =
  9.                 mSensorServer->createSensorEventConnection(packageName, mode, mOpPackageName);
  10.         if (connection == NULL) {
  11.             // SensorService just died or the app doesn't have required permissions.
  12.             ALOGE("createEventQueue: connection is NULL.");
  13.             return NULL;
  14.         }
  15. 		//将前边创建的SensorEventConnection，作为SensorEventQueue构造函数的参数传进去，
  16. 		//创建SensorEventQueue
  17.         queue = new SensorEventQueue(connection);
  18.         break;
  19.     }
  20.     return queue;
  21. }

在什么情况下创建，创建流程，在 应用注册一个sensor 流程 里边讲。

  1. //接下来看下构造函数，
  2. SensorEventQueue::SensorEventQueue(const sp<ISensorEventConnection>& connection)
  3.     : mSensorEventConnection(connection), mRecBuffer(NULL), mAvailable(0), mConsumed(0),
  4.       mNumAcksToSend(0) {
  5.     mRecBuffer = new ASensorEvent[MAX_RECEIVE_BUFFER_EVENT_COUNT];
  6. }

构造函数很简单，创建mRecBuffer，用来存从SensorEventConnection发送过来的数据，

其中的
SensorEventQueue::write()用来给SensorEventConnection发送数据，
SensorEventQueue::read()用来读取数据给应用，

  1. ssize_t SensorEventQueue::write(const sp<BitTube>& tube,
  2.         ASensorEvent const* events, size_t numEvents) {
  3.     return BitTube::sendObjects(tube, events, numEvents);
  4. }
  5. ssize_t SensorEventQueue::read(ASensorEvent* events, size_t numEvents) {
  6.     if (mAvailable == 0) {
  7.         ssize_t err = BitTube::recvObjects(mSensorChannel,
  8.                 mRecBuffer, MAX_RECEIVE_BUFFER_EVENT_COUNT);
  9.         if (err < 0) {
  10.             return err;
  11.         }
  12.         mAvailable = static_cast<size_t>(err);
  13.         mConsumed = 0;
  14.     }
  15.     size_t count = min(numEvents, mAvailable);
  16.     memcpy(events, mRecBuffer + mConsumed, count * sizeof(ASensorEvent));
  17.     mAvailable -= count;
  18.     mConsumed += count;
  19.     return static_cast<ssize_t>(count);
  20. }

3，  应用注册一个sensor流程

先看下应用简单注册一个sensor的代码，

  1.  
  2.     private SensorManager mSensorManager;
  3.     private Sensor mSensor;
  4.     //获取sensorManager      
  5.     mSensorManager = (SensorManager) getSystemService(Context.SENSOR_SERVICE);
  6.     mSensor = mSensorManager.getDefaultSensor(Sensor.TYPE_ACCELEROMETER);//申请的为加速度传感器
  7.     mSensorManager.registerListener(mSensorEventListener,mSensor,SensorManager.SENSOR_DELAY_NORMAL);
  8.     final SensorEventListener mSensorEventListener = new SensorEventListener() {
  9.         @Override
  10.         public void onSensorChanged(SensorEvent sensorEvent) {
  11.          //有数据时该接口被回调，在这边使用sensor数据
  12.             Log.i(TAG,"sensorEvent.sensor.getType():" + sensorEvent.sensor.getType());
  13.             if(sensorEvent.sensor.getType() == Sensor.TYPE_ACCELEROMETER){
  14.                 //add you code
  15.             }
  16.  
  17.         }
  18.         @Override
  19.         public void onAccuracyChanged(Sensor sensor, int i) {
  20.             //add your code
  21.  
  22.         }
  23.

先看 registerListener()，这个google实现了好几个供应用开发者使用，咱们随便拿一个开始跟就行了，因为最后都是调用了SystemSensorManager::registerListenerImpl()这个接口，

android/frameworks/base/core/java/android/hardware/SensorManager.java

  1. public boolean registerListener(SensorEventListener listener, Sensor sensor,
  2.         int samplingPeriodUs, int maxReportLatencyUs, Handler handler) {
  3.     int delayUs = getDelay(samplingPeriodUs);
  4.     return registerListenerImpl(listener, sensor, delayUs, handler, maxReportLatencyUs, 0);
  5. }
  1. //接着看
  2. //android/frameworks/base/core/java/android/hardware/SystemSensorManager.java
  3.     protected boolean registerListenerImpl(SensorEventListener listener, Sensor sensor,
  4.             int delayUs, Handler handler, int maxBatchReportLatencyUs, int reservedFlags) {
  5.         android.util.SeempLog.record_sensor_rate(381, sensor, delayUs);
  6.         if (listener == null || sensor == null) {
  7.             Log.e(TAG, "sensor or listener is null");
  8.             return false;
  9.         }
  10.  
  11.         // Invariants to preserve:
  12.         // - one Looper per SensorEventListener
  13.         // - one Looper per SensorEventQueue
  14.         //一个SensorEventListener对应一个SensorEventQueue
  15.         // We map SensorEventListener to a SensorEventQueue, which holds the looper
  16.         synchronized (mSensorListeners) {
  17.             SensorEventQueue queue = mSensorListeners.get(listener);
  18.             if (queue == null) {
  19.                 Looper looper = (handler != null) ? handler.getLooper() : mMainLooper;
  20.                 final String fullClassName =
  21.                         listener.getClass().getEnclosingClass() != null
  22.                             ? listener.getClass().getEnclosingClass().getName()
  23.                             : listener.getClass().getName();
  24.                 //这边创建SensorEventQueue
  25.                 //并装在hashmap mSensorListeners里边
  26.                 queue = new SensorEventQueue(listener, looper, this, fullClassName);
  27.                 if (!queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs)) {
  28.                     queue.dispose();
  29.                     return false;
  30.                 }
  31.                 mSensorListeners.put(listener, queue);
  32.                 return true;
  33.             } else {
  34.                 return queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs);
  35.             }
  36.         }
  37.     }

若之前该SensorEventListener（由应用自己创建）没有创建过SensorEventQueue，那么创建一个，并和SensorEventListener一起添加到mSensorListeners，
对于sensor数据是如何从底层给上来并回调应用的onSensorChanged()，重点就在这边，当创建SensorEventQueue时，会同时构造一个其父类对象BaseEventQueue，接着在其nativeInitBaseEventQueue()方法里边，
通过jni调用
android/frameworks/base/core/jni/android_hardware_SensorManager.cpp nativeInitSensorEventQueue()
来创建一个接收数据的Receiver对象，这个之后分析数据如何给上来再详细分析。

接着看注册流程，然后，通过BaseEventQueue::addSensor()将注册一个sensor的流程继续往下走，

  1. public boolean addSensor(
  2.         Sensor sensor, int delayUs, int maxBatchReportLatencyUs) {
  3.     // Check if already present.
  4.     int handle = sensor.getHandle();
  5.     if (mActiveSensors.get(handle)) return false; 
  6.  
  7.     // Get ready to receive events before calling enable.
  8.     mActiveSensors.put(handle, true);
  9.     addSensorEvent(sensor);
  10.     if (enableSensor(sensor, delayUs, maxBatchReportLatencyUs) != 0) {
  11.         // Try continuous mode if batching fails.
  12.         if (maxBatchReportLatencyUs == 0
  13.                 || maxBatchReportLatencyUs > 0 && enableSensor(sensor, delayUs, 0) != 0) {
  14.             removeSensor(sensor, false);
  15.             return false;
  16.         }
  17.     }
  18.     return true;
  19. }

通过BaseEventQueue::enableSensor()继续往下走，
接着看，

  1. private int enableSensor(
  2.         Sensor sensor, int rateUs, int maxBatchReportLatencyUs) {
  3.     if (mNativeSensorEventQueue == 0) throw new NullPointerException();
  4.     if (sensor == null) throw new NullPointerException();
  5.     return nativeEnableSensor(mNativeSensorEventQueue, sensor.getHandle(), rateUs,
  6.             maxBatchReportLatencyUs);
  7.  
  8.  
  9. }

通过jni调用C++的接口，
接着看，

android/frameworks/base/core/jni/android_hardware_SensorManager.cpp

  1. static jint nativeEnableSensor(JNIEnv *env, jclass clazz, jlong eventQ, jint handle, jint rate_us,
  2.                                jint maxBatchReportLatency) {
  3.     sp<Receiver> receiver(reinterpret_cast<Receiver *>(eventQ));
  4.     return receiver->getSensorEventQueue()->enableSensor(handle, rate_us, maxBatchReportLatency,
  5.                                                          0);
  6. }

接下来到了 
android/frameworks/native/libs/sensor/SensorEventQueue.cpp
SensorEventQueue::enableSensor()

这里边有重载了好几个，只是参数不同而已，咱们拿其中一个看就可以，（TO DO： 这块是如何启动的后面分析 sensor数据是如何给上来的再说，先直接跟一下流程）

  1. status_t SensorEventQueue::enableSensor(int32_t handle, int32_t samplingPeriodUs,
  2.                                         int64_t maxBatchReportLatencyUs, int reservedFlags) const {
  3.     return mSensorEventConnection->enableDisable(handle, true, us2ns(samplingPeriodUs),
  4.                                                  us2ns(maxBatchReportLatencyUs), reservedFlags);
  5. }

接着就到了 
android/frameworks/native/services/sensorservice/SensorEventConnection.cpp
SensorService::SensorEventConnection::enableDisable()

  1. status_t SensorService::SensorEventConnection::enableDisable(
  2.         int handle, bool enabled, nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs,
  3.         int reservedFlags)
  4. {
  5.     status_t err;
  6.     if (enabled) {
  7.         err = mService->enable(this, handle, samplingPeriodNs, maxBatchReportLatencyNs,
  8.                                reservedFlags, mOpPackageName);
  9.  
  10.     } else {
  11.         err = mService->disable(this, handle);
  12.     }
  13.     return err;
  14. }

接下去就是SensorService::enable()了

  1. status_t SensorService::enable(const sp<SensorEventConnection>& connection,
  2.         int handle, nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs, int reservedFlags,
  3.         const String16& opPackageName) {
  4.     if (mInitCheck != NO_ERROR)
  5.         return mInitCheck;
  6.  
  7.     //获取到HardwareSensor,里边存储HAL层注册的sensor_t 类型结构体
  8.     sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
  9.  
  10.     //检查应用是否有权限获取sensor数据
  11.     if (sensor == nullptr ||
  12.         !canAccessSensor(sensor->getSensor(), "Tried enabling", opPackageName)) {
  13.         return BAD_VALUE;
  14.     }
  15.  
  16.     Mutex::Autolock _l(mLock);
  17.     if (mCurrentOperatingMode != NORMAL
  18.            && !isWhiteListedPackage(connection->getPackageName())) {
  19.         return INVALID_OPERATION;
  20.     }
  21.     //将来自应用的SensorEventConnection保存在SensorRecord,若之前没有一个应用开启该sensor,则创建SensorRecord,
  22.     //将该SensorRecord和对应的sensor handle保存在mActiveSensors里边记录下来,
  23.     SensorRecord* rec = mActiveSensors.valueFor(handle);
  24.     if (rec == 0) {
  25.         rec = new SensorRecord(connection);
  26.         mActiveSensors.add(handle, rec);
  27.         if (sensor->isVirtual()) {
  28.             mActiveVirtualSensors.emplace(handle);
  29.         }
  30.     } else {
  31.         if (rec->addConnection(connection)) {
  32.             // this sensor is already activated, but we are adding a connection that uses it.
  33.             // Immediately send down the last known value of the requested sensor if it's not a
  34.             // "continuous" sensor.
  35.             if (sensor->getSensor().getReportingMode() == AREPORTING_MODE_ON_CHANGE) {
  36.                 // NOTE: The wake_up flag of this event may get set to
  37.                 // WAKE_UP_SENSOR_EVENT_NEEDS_ACK if this is a wake_up event.
  38.  
  39.                 auto logger = mRecentEvent.find(handle);
  40.                 if (logger != mRecentEvent.end()) {
  41.                     sensors_event_t event;
  42.                     // It is unlikely that this buffer is empty as the sensor is already active.
  43.                     // One possible corner case may be two applications activating an on-change
  44.                     // sensor at the same time.
  45.                     if(logger->second->populateLastEvent(&event)) {
  46.                         event.sensor = handle;
  47.                         if (event.version == sizeof(sensors_event_t)) {
  48.                             if (isWakeUpSensorEvent(event) && !mWakeLockAcquired) {
  49.                                 setWakeLockAcquiredLocked(true);
  50.                             }
  51.                             //若该sensor之前已经有其他应用注册着了,并且是on change类型的sensor,比如 proximity,
  52.                             //那么将最新的一次事件送给应用
  53.                             connection->sendEvents(&event, 1, NULL);
  54.                             if (!connection->needsWakeLock() && mWakeLockAcquired) {
  55.                                 checkWakeLockStateLocked();
  56.                             }
  57.                         }
  58.                     }
  59.                 }
  60.             }
  61.         }
  62.     }
  63.  
  64.     if (connection->addSensor(handle)) {
  65.         BatteryService::enableSensor(connection->getUid(), handle);
  66.         // the sensor was added (which means it wasn't already there)
  67.         // so, see if this connection becomes active
  68.         if (mActiveConnections.indexOf(connection) < 0) {
  69.             mActiveConnections.add(connection);//若该connection还没有保存在mActiveConnections,保存一下
  70.         }
  71.     } else {
  72.         ALOGW("sensor %08x already enabled in connection %p (ignoring)",
  73.             handle, connection.get());
  74.     }
  75.  
  76.     // Check maximum delay for the sensor.
  77.     nsecs_t maxDelayNs = sensor->getSensor().getMaxDelay() * 1000LL;
  78.     if (maxDelayNs > 0 && (samplingPeriodNs > maxDelayNs)) {
  79.         samplingPeriodNs = maxDelayNs;
  80.     }
  81.  
  82.     nsecs_t minDelayNs = sensor->getSensor().getMinDelayNs();
  83.     if (samplingPeriodNs < minDelayNs) {
  84.         samplingPeriodNs = minDelayNs;
  85.     }
  86.  
  87.     ALOGD_IF(DEBUG_CONNECTIONS, "Calling batch handle==%d flags=%d"
  88.                                 "rate=%" PRId64 " timeout== %" PRId64"",
  89.              handle, reservedFlags, samplingPeriodNs, maxBatchReportLatencyNs);
  90.     ///enable sensor的时候先batch和翻录是一下,目的是清除一下数据?
  91.     status_t err = sensor->batch(connection.get(), handle, 0, samplingPeriodNs,
  92.                                  maxBatchReportLatencyNs);
  93.  
  94.     // Call flush() before calling activate() on the sensor. Wait for a first
  95.     // flush complete event before sending events on this connection. Ignore
  96.     // one-shot sensors which don't support flush(). Ignore on-change sensors
  97.     // to maintain the on-change logic (any on-change events except the initial
  98.     // one should be trigger by a change in value). Also if this sensor isn't
  99.     // already active, don't call flush().
  100.     if (err == NO_ERROR &&
  101.             sensor->getSensor().getReportingMode() == AREPORTING_MODE_CONTINUOUS &&
  102.             rec->getNumConnections() > 1) {
  103.         connection->setFirstFlushPending(handle, true);
  104.         status_t err_flush = sensor->flush(connection.get(), handle);
  105.         // Flush may return error if the underlying h/w sensor uses an older HAL.
  106.         if (err_flush == NO_ERROR) {
  107.             rec->addPendingFlushConnection(connection.get());
  108.         } else {
  109.             connection->setFirstFlushPending(handle, false);
  110.         }
  111.     }
  112.  
  113.     //关键就在这儿
  114.     //调用 HardwareSensor::activate() ==> SensorDevice::activate()
  115.     if (err == NO_ERROR) {
  116.         ALOGD_IF(DEBUG_CONNECTIONS, "Calling activate on %d", handle);
  117.         err = sensor->activate(connection.get(), true);
  118.     }
  119. 	
  120.     if (err == NO_ERROR) {
  121.         connection->updateLooperRegistration(mLooper);
  122. 		//记录调用者和对应sensor信息，后面可用dumpsys sensorservice dump出来debug问题
  123.         mLastNSensorRegistrations.editItemAt(mNextSensorRegIndex) =
  124.                 SensorRegistrationInfo(handle, connection->getPackageName(),
  125.                                        samplingPeriodNs, maxBatchReportLatencyNs, true);
  126.         mNextSensorRegIndex = (mNextSensorRegIndex + 1) % SENSOR_REGISTRATIONS_BUF_SIZE;
  127.     }
  128. 	
  129. 	//若调用失败，则将与应用的链接直接清掉
  130.     if (err != NO_ERROR) {
  131.         // batch/activate has failed, reset our state.
  132.         cleanupWithoutDisableLocked(connection, handle);
  133.     }
  134.     return err;
  135. }

接下来看SensorDevice::activate()

  1. status_t SensorDevice::activate(void* ident, int handle, int enabled) {
  2.     if (mSensors == nullptr) return NO_INIT;
  3.  
  4.     status_t err(NO_ERROR);
  5.     bool actuateHardware = false;
  6.  
  7.     Mutex::Autolock _l(mLock);
  8.     ssize_t activationIndex = mActivationCount.indexOfKey(handle);
  9.     if (activationIndex < 0) {
  10.         ALOGW("Handle %d cannot be found in activation record", handle);
  11.         return BAD_VALUE;
  12.     }
  13.     Info& info(mActivationCount.editValueAt(activationIndex));//从这里边获取到Info
  14.  
  15.     ALOGD_IF(DEBUG_CONNECTIONS,
  16.              "SensorDevice::activate: ident=%p, handle=0x%08x, enabled=%d, count=%zu",
  17.              ident, handle, enabled, info.batchParams.size());
  18.  
  19.     if (enabled) {
  20.         ALOGD_IF(DEBUG_CONNECTIONS, "enable index=%zd", info.batchParams.indexOfKey(ident));
  21.  
  22.         if (isClientDisabledLocked(ident)) {
  23.             ALOGE("SensorDevice::activate, isClientDisabledLocked(%p):true, handle:%d",
  24.                     ident, handle);
  25.             return INVALID_OPERATION;
  26.         }
  27.  
  28.         if (info.batchParams.indexOfKey(ident) >= 0) {
  29. 		  //若是第一个注册该sensor的应用，那么需要调用HAL层的activate()
  30.           if (info.numActiveClients() == 1) {
  31.               // This is the first connection, we need to activate the underlying h/w sensor.
  32.               actuateHardware = true;
  33.           }
  34.         } else {
  35.             // Log error. Every activate call should be preceded by a batch() call.
  36.             ALOGE("\t >>>ERROR: activate called without batch");
  37.         }
  38.     } else {
  39.         ALOGD_IF(DEBUG_CONNECTIONS, "disable index=%zd", info.batchParams.indexOfKey(ident));
  40.  
  41.         // If a connected dynamic sensor is deactivated, remove it from the
  42.         // dictionary.
  43.         auto it = mConnectedDynamicSensors.find(handle);
  44.         if (it != mConnectedDynamicSensors.end()) {
  45.             delete it->second;
  46.             mConnectedDynamicSensors.erase(it);
  47.         }
  48.  
  49.         if (info.removeBatchParamsForIdent(ident) >= 0) {
  50. 			//若是最后一个反注册该sensor的应用，那么需要调用HAL层的activate()，
  51. 			//否则就重新batch一下
  52.             if (info.numActiveClients() == 0) {
  53.                 // This is the last connection, we need to de-activate the underlying h/w sensor.
  54.                 actuateHardware = true;
  55.             } else {
  56.                 // Call batch for this sensor with the previously calculated best effort
  57.                 // batch_rate and timeout. One of the apps has unregistered for sensor
  58.                 // events, and the best effort batch parameters might have changed.
  59.                 ALOGD_IF(DEBUG_CONNECTIONS,
  60.                          "\t>>> actuating h/w batch 0x%08x %" PRId64 " %" PRId64, handle,
  61.                          info.bestBatchParams.mTSample, info.bestBatchParams.mTBatch);
  62.                 checkReturn(mSensors->batch(
  63.                         handle, info.bestBatchParams.mTSample, info.bestBatchParams.mTBatch));
  64.             }
  65.         } else {
  66.             // sensor wasn't enabled for this ident
  67.         }
  68.  
  69.         if (isClientDisabledLocked(ident)) {
  70.             return NO_ERROR;
  71.         }
  72.     }
  73.  
  74.     if (actuateHardware) {
  75.         ALOGD_IF(DEBUG_CONNECTIONS, "\t>>> actuating h/w activate handle=%d enabled=%d", handle,
  76.                  enabled);
  77. 		//这儿通过hidl调用HAL层的接口，源码在/android/hardware/interfaces/sensors/1.0，
  78.         err = StatusFromResult(checkReturn(mSensors->activate(handle, enabled)));
  79.         ALOGE_IF(err, "Error %s sensor %d (%s)", enabled ? "activating" : "disabling", handle,
  80.                  strerror(-err));
  81.  
  82.         if (err != NO_ERROR && enabled) {
  83.             // Failure when enabling the sensor. Clean up on failure.
  84.             info.removeBatchParamsForIdent(ident);
  85.         }
  86.     }
  87.  
  88.     return err;
  89. }

接下来通过hidl，到了HAL，先到android 自己实现的hal层，就称它为android sensor hal吧，后面再往下手机厂家自己实现的hal层称为oem sensor hal 咯，

这边也是直接往下看流程，后面会再分析一下android sensor hal的启动，

android/hardware/interfaces/sensors/1.0/default/Sensors.cpp

  1. Return<Result> Sensors::activate(
  2.         int32_t sensor_handle, bool enabled) {
  3.     return ResultFromStatus(
  4.             mSensorDevice->activate(
  5.                 reinterpret_cast<sensors_poll_device_t *>(mSensorDevice),
  6.                 sensor_handle,
  7.                 enabled));
  8. }

接着到了

android/hardware/libhardware/modules/sensors/multihal.cpp

  1. static int device__activate(struct sensors_poll_device_t *dev, int handle,
  2.         int enabled) {
  3. //留意这边有个强转，其实dev就是sensors_poll_context_t*类型，只是后面为了方便存储，
  4. //就只是存了一个第一个成员变量首地址，通过这个地址可以获取到其父类，父类的父类的地址，
  5.     sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
  6.     return ctx->activate(handle, enabled);
  7. }

 接下来是

  1. int sensors_poll_context_t::activate(int handle, int enabled) {
  2.     int retval = -EINVAL;
  3.     ALOGV("activate");
  4.     int local_handle = get_local_handle(handle);
  5.     sensors_poll_device_t* v0 = this->get_v0_device_by_handle(handle);
  6.  
  7.     if (halIsCompliant(this, handle) && local_handle >= 0 && v0) {
  8.         retval = v0->activate(v0, local_handle, enabled);
  9.  
  10.     } else {
  11.         ALOGE("IGNORING activate(enable %d) call to non-API-compliant sensor handle=%d !",
  12.                 enabled, handle);
  13.     }
  14.     ALOGV("retval %d", retval);
  15.     return retval;
  16. }

这边再下去就是手机厂家自己实现的接口了，android的部分到此为止

4， SensorService如何将sensor数据给到应用

简单来讲，SensorService这边使用SensorEventConnection作为数据发送端，应用那边用SensorEventListerner作为数据接收端，通过unix socket传送数据，咱们可以分别从2端分析，

先从SensorService这边看下发送端，SensorService在构造后创建了一个线程threadLoop()一直不断运行，通过poll往hal层取sensor数据（该poll只是与linux c 标准函数poll()同名，且功能类似而以，不是调用了linux c标准的那个poll（）函数)，当没有sensor数据时就不断阻塞等待（该阻塞功能由HAL层实现），当有数据上来时，通过做一些处理和判断后发送给应用，

其中处理判断包括是否应该丢弃数据，保存数据到一个vector实现的缓存里边方便后面dump出来debug，是否是flush数据，是否要将数据给到融合sensor，应用是否已经关闭该sensor，应用是否已经进入idle等等。

  1. //从SensorService::threadLoop()开始看，
  2. bool SensorService::threadLoop() {
  3.     ALOGD("nuSensorService thread starting...");
  4.  
  5.     // each virtual sensor could generate an event per "real" event, that's why we need to size
  6.     // numEventMax much smaller than MAX_RECEIVE_BUFFER_EVENT_COUNT.  in practice, this is too
  7.     // aggressive, but guaranteed to be enough.
  8.     const size_t vcount = mSensors.getVirtualSensors().size();
  9.     const size_t minBufferSize = SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT;
  10.     const size_t numEventMax = minBufferSize / (1 + vcount);
  11.     //为何要这么做,再解释一下,比如说这边有vcount个虚拟的 sensor跑在framework,
  12.     //那么比较极端的情况下每从HAL取numEventMax个数据,这边vcount个sensor会各生成numEventMax个数据,
  13.     //而mSensorEventBuffer 最多只能容纳 MAX_RECEIVE_BUFFER_EVENT_COUNT个数据,
  14.     //所以 numEventMax = minBufferSize / (1 + vcount);
  15.  
  16.     SensorDevice& device(SensorDevice::getInstance());
  17.  
  18.     const int halVersion = device.getHalDeviceVersion();
  19.     do {
  20.         //通过SensorDevice往HAL层取数据, 若没有数据的时候就一直阻塞(这个由前面说的HAL层实现)
  21.         //当有数据时该函数就会返回
  22.         ssize_t count = device.poll(mSensorEventBuffer, numEventMax);
  23.         if (count < 0) {
  24.             ALOGE("sensor poll failed (%s)", strerror(-count));
  25.             break;
  26.  
  27.         }
  28.  
  29.         // Reset sensors_event_t.flags to zero for all events in the buffer.
  30.         for (int i = 0; i < count; i++) {
  31.              mSensorEventBuffer[i].flags = 0;
  32.         }
  33.  
  34.         // Make a copy of the connection vector as some connections may be removed during the course
  35.         // of this loop (especially when one-shot sensor events are present in the sensor_event
  36.         // buffer). Promote all connections to StrongPointers before the lock is acquired. If the
  37.         // destructor of the sp gets called when the lock is acquired, it may result in a deadlock
  38.         // as ~SensorEventConnection() needs to acquire mLock again for cleanup. So copy all the
  39.         // strongPointers to a vector before the lock is acquired.
  40.         SortedVector< sp<SensorEventConnection> > activeConnections;
  41.         populateActiveConnections(&activeConnections);
  42.  
  43.         Mutex::Autolock _l(mLock);
  44.         // Poll has returned. Hold a wakelock if one of the events is from a wake up sensor. The
  45.         // rest of this loop is under a critical section protected by mLock. Acquiring a wakeLock,
  46.         // sending events to clients (incrementing SensorEventConnection::mWakeLockRefCount) should
  47.         // not be interleaved with decrementing SensorEventConnection::mWakeLockRefCount and
  48.         // releasing the wakelock.
  49.         bool bufferHasWakeUpEvent = false;
  50.         for (int i = 0; i < count; i++) {
  51.             if (isWakeUpSensorEvent(mSensorEventBuffer[i])) {
  52.                 bufferHasWakeUpEvent = true;
  53.                 break;
  54.             }
  55.         }
  56. 		//若有wakeup 类型sensor上报的数据就持有wakelock
  57.         if (bufferHasWakeUpEvent && !mWakeLockAcquired) {
  58.             setWakeLockAcquiredLocked(true);
  59.         }
  60.         recordLastValueLocked(mSensorEventBuffer, count);//将事件保存下来,后面可以用dumpsys sensorservice dump出来方便分析问题
  61.  
  62.         // 暂时可先忽略handle virtual sensor，dynamic sensor部分不看
  63. 		
  64. 		
  65.         // Send our events to clients. Check the state of wake lock for each client and release the
  66.         // lock if none of the clients need it.
  67.         bool needsWakeLock = false;
  68.         size_t numConnections = activeConnections.size();
  69.         for (size_t i=0 ; i < numConnections; ++i) {
  70.             if (activeConnections[i] != 0) {
  71.             //通过SensorEventConnection 将数据给到每个应用，每个应用都有自己的SensorEventConnection，好就是这里，再跟进去
  72.                 activeConnections[i]->sendEvents(mSensorEventBuffer, count, mSensorEventScratch,
  73.                         mMapFlushEventsToConnections);
  74.                 needsWakeLock |= activeConnections[i]->needsWakeLock();
  75.                 // If the connection has one-shot sensors, it may be cleaned up after first trigger.
  76.                 // Early check for one-shot sensors.
  77.                 if (activeConnections[i]->hasOneShotSensors()) {
  78.                     cleanupAutoDisabledSensorLocked(activeConnections[i], mSensorEventBuffer,
  79.                             count);
  80.                 }
  81.             }
  82.         }
  83. 		
  84. 		//若还有wake up 类型的sensor报上来的数据的话，需要继续持有wakelock
  85.        
  86.         if (mWakeLockAcquired && !needsWakeLock) {
  87.             setWakeLockAcquiredLocked(false);
  88.         }
  89.     } while (!Thread::exitPending());
  90.  
  91.     ALOGW("Exiting SensorService::threadLoop => aborting...");
  92.     abort();
  93.     return false;
  94. }

也就是说， SensorService::threadLoop() 通过SensorDevice从hal层取到sensor数据，

同过  SensorService::SensorEventConnection::sendEvents()来将数据进一步处理并发送，这边请注意有多个SensorEventConnection各属于不同应用，到了sendEvents()里边就是各个应用处理各自的了，

接着看，

  1. status_t SensorService::SensorEventConnection::sendEvents(
  2.         sensors_event_t const* buffer, size_t numEvents,
  3.         sensors_event_t* scratch,
  4.         wp<const SensorEventConnection> const * mapFlushEventsToConnections) {
  5.     // filter out events not for this connection
  6.  
  7.     sensors_event_t* sanitizedBuffer = nullptr;
  8.  
  9.     int count = 0;
  10.     Mutex::Autolock _l(mConnectionLock); 
  11.     if (scratch) {
  12.         size_t i=0;
  13.         while (i<numEvents) {
  14.             //每个数据琢一处理
  15.             int32_t sensor_handle = buffer[i].sensor;
  16.             if (buffer[i].type == SENSOR_TYPE_META_DATA) {
  17.                 ALOGD_IF(DEBUG_CONNECTIONS, "flush complete event sensor==%d ",
  18.                         buffer[i].meta_data.sensor);
  19.                 // Setting sensor_handle to the correct sensor to ensure the sensor events per
  20.                 // connection are filtered correctly.  buffer[i].sensor is zero for meta_data
  21.                 // events.
  22.                 sensor_handle = buffer[i].meta_data.sensor;
  23.             }
  24.  
  25.             ssize_t index = mSensorInfo.indexOfKey(sensor_handle);
  26.             //enable 一个sensor时,会保存该sensor的handle
  27.             //确认一下若该sensor已经被disable了,那么就没有必要将该sensor的数据给到应用了
  28.             //或者该应用没有注册该sensor的话，也是直接过滤掉
  29.             // Check if this connection has registered for this sensor. If not continue to the
  30.             // next sensor_event.
  31.             if (index < 0) {
  32.                 ++i;
  33.                 continue;
  34.             }
  35.  
  36.             FlushInfo& flushInfo = mSensorInfo.editValueAt(index);
  37.             // Check if there is a pending flush_complete event for this sensor on this connection.
  38.             if (buffer[i].type == SENSOR_TYPE_META_DATA && flushInfo.mFirstFlushPending == true &&
  39.                     mapFlushEventsToConnections[i] == this) {
  40.                 flushInfo.mFirstFlushPending = false;
  41.                 ALOGD_IF(DEBUG_CONNECTIONS, "First flush event for sensor==%d ",
  42.                         buffer[i].meta_data.sensor);
  43.                 ++i;
  44.                 continue;
  45.             }
  46.  
  47.             // If there is a pending flush complete event for this sensor on this connection,
  48.             // ignore the event and proceed to the next.
  49.             if (flushInfo.mFirstFlushPending) {
  50.                 ++i;
  51.                 continue;
  52.             }
  53.  
  54.             //过滤掉flush的数据后,将要给到应用的数据拷到scratch
  55.             do {
  56.                 // Keep copying events into the scratch buffer as long as they are regular
  57.                 // sensor_events are from the same sensor_handle OR they are flush_complete_events
  58.                 // from the same sensor_handle AND the current connection is mapped to the
  59.                 // corresponding flush_complete_event.
  60.                 if (buffer[i].type == SENSOR_TYPE_META_DATA) {
  61.                     if (mapFlushEventsToConnections[i] == this) {
  62.                         scratch[count++] = buffer[i];
  63.                     }
  64.                 } else {
  65.                     // Regular sensor event, just copy it to the scratch buffer.
  66. 					//若为false，即应用进入idle，那么就不将数据装进scratch在通过scratch给到应用,
  67.                     //否则就装进去
  68.                     if (mHasSensorAccess) {
  69.                         scratch[count++] = buffer[i];
  70.                     }
  71.                 }
  72.                 i++;
  73.             } while ((i<numEvents) && ((buffer[i].sensor == sensor_handle &&
  74.                                         buffer[i].type != SENSOR_TYPE_META_DATA) ||
  75.                                        (buffer[i].type == SENSOR_TYPE_META_DATA  &&
  76.                                         buffer[i].meta_data.sensor == sensor_handle)));
  77.         }
  78.     } else {
  79. 	    //这边不会走到不用管，感觉google这段代码有点多余哈哈
  80.         if (mHasSensorAccess) {
  81.             scratch = const_cast<sensors_event_t *>(buffer);
  82.             count = numEvents;
  83.         } else {
  84.             scratch = sanitizedBuffer = new sensors_event_t[numEvents];
  85.             for (size_t i = 0; i < numEvents; i++) {
  86.                 if (buffer[i].type == SENSOR_TYPE_META_DATA) {
  87.                     scratch[count++] = buffer[i++];
  88.                 }
  89.             }
  90.         }
  91.     }
  92.  
  93.     sendPendingFlushEventsLocked();
  94.     // Early return if there are no events for this connection.
  95.     if (count == 0) {
  96.         delete sanitizedBuffer;//可能遇到空指针?  free 已经做了判断了
  97.         return status_t(NO_ERROR);
  98.     }
  99.  
  100.  
  101.  
  102. #if DEBUG_CONNECTIONS
  103.      mEventsReceived += count;
  104. #endif
  105. //将最新的数据缓存到mEventCache，后面可以dump出来debug
  106.     if (mCacheSize != 0) {
  107.         // There are some events in the cache which need to be sent first. Copy this buffer to
  108.         // the end of cache.
  109.         if (mCacheSize + count <= mMaxCacheSize) {
  110.             memcpy(&mEventCache[mCacheSize], scratch, count * sizeof(sensors_event_t));
  111.             mCacheSize += count;
  112.         } else {
  113.             // Check if any new sensors have registered on this connection which may have increased
  114.             // the max cache size that is desired.
  115.             if (mCacheSize + count < computeMaxCacheSizeLocked()) {
  116.                 reAllocateCacheLocked(scratch, count);
  117.                 delete sanitizedBuffer;
  118.                 return status_t(NO_ERROR);
  119.             }
  120.             // Some events need to be dropped.
  121.             int remaningCacheSize = mMaxCacheSize - mCacheSize;
  122.             if (remaningCacheSize != 0) {
  123.                 memcpy(&mEventCache[mCacheSize], scratch,
  124.                                                 remaningCacheSize * sizeof(sensors_event_t));
  125.             }
  126.             int numEventsDropped = count - remaningCacheSize;
  127.             countFlushCompleteEventsLocked(mEventCache, numEventsDropped);
  128.             // Drop the first "numEventsDropped" in the cache.
  129.             memmove(mEventCache, &mEventCache[numEventsDropped],
  130.                     (mCacheSize - numEventsDropped) * sizeof(sensors_event_t));
  131.  
  132.             // Copy the remainingEvents in scratch buffer to the end of cache.
  133.             memcpy(&mEventCache[mCacheSize - numEventsDropped], scratch + remaningCacheSize,
  134.                                             numEventsDropped * sizeof(sensors_event_t));
  135.         }
  136.         delete sanitizedBuffer;
  137.         return status_t(NO_ERROR);
  138.     }
  139.  
  140.     int index_wake_up_event = -1;
  141.     if (mHasSensorAccess) {
  142.         index_wake_up_event = findWakeUpSensorEventLocked(scratch, count);
  143.         if (index_wake_up_event >= 0) {
  144.             scratch[index_wake_up_event].flags |= WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
  145.             ++mWakeLockRefCount;
  146. #if DEBUG_CONNECTIONS
  147.             ++mTotalAcksNeeded;
  148. #endif
  149.         }
  150.     }
  151.  
  152.     // NOTE: ASensorEvent and sensors_event_t are the same type.
  153. 	
  154.  
  155.     //重点在这边，把scratch里边的数据发出去，
  156. 	
  157.     ssize_t size = SensorEventQueue::write(mChannel,
  158.                                     reinterpret_cast<ASensorEvent const*>(scratch), count);
  159.     if (size < 0) {
  160.         // Write error, copy events to local cache.
  161.         if (index_wake_up_event >= 0) {
  162.             // If there was a wake_up sensor_event, reset the flag.
  163.             scratch[index_wake_up_event].flags &= ~WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
  164.             if (mWakeLockRefCount > 0) {
  165.                 --mWakeLockRefCount;
  166.             }
  167. #if DEBUG_CONNECTIONS
  168.             --mTotalAcksNeeded;
  169. #endif
  170.         }
  171.         if (mEventCache == NULL) {
  172.             mMaxCacheSize = computeMaxCacheSizeLocked();
  173.             mEventCache = new sensors_event_t[mMaxCacheSize];
  174.             mCacheSize = 0;
  175.         }
  176.         memcpy(&mEventCache[mCacheSize], scratch, count * sizeof(sensors_event_t));
  177.         mCacheSize += count;
  178.  
  179.         // Add this file descriptor to the looper to get a callback when this fd is available for
  180.         // writing.
  181.         updateLooperRegistrationLocked(mService->getLooper());
  182.         delete sanitizedBuffer;
  183.         return size;
  184.     }
  185.  
  186. }

接下来跟一下 
ssize_t SensorEventQueue::write(const sp<BitTube>& tube, ASensorEvent const* events, size_t numEvents)
看看如何把数据通过onSensorChange()接口给到应用，

android/frameworks/native/libs/sensor/SensorEventQueue.cpp

  1. ssize_t SensorEventQueue::write(const sp<BitTube>& tube,
  2.         ASensorEvent const* events, size_t numEvents) {
  3.     return BitTube::sendObjects(tube, events, numEvents);
  4. }

看一下 
ssize_t BitTube::sendObjects(const sp<BitTube>& tube, void const* events, size_t count, size_t objSize)

android/frameworks/native/libs/sensor/BitTube.cpp

  1. ssize_t BitTube::sendObjects(const sp<BitTube>& tube,
  2.         void const* events, size_t count, size_t objSize)
  3. {
  4.     //SensorService::SensorEventConnection::mChannel::write()
  5.     //mChannel 为 BitTube 对象
  6.     const char* vaddr = reinterpret_cast<const char*>(events);
  7.     ssize_t size = tube->write(vaddr, count*objSize);
  8.  
  9.     // should never happen because of SOCK_SEQPACKET
  10.     LOG_ALWAYS_FATAL_IF((size >= 0) && (size % static_cast<ssize_t>(objSize)),
  11.             "BitTube::sendObjects(count=%zu, size=%zu), res=%zd (partial events were sent!)",
  12.             count, objSize, size);
  13.  
  14.     //ALOGE_IF(size<0, "error %d sending %d events", size, count);

那么就到了BitTube::write(void const* vaddr, size_t size)，接着看

  1. ssize_t BitTube::write(void const* vaddr, size_t size)
  2. {
  3.     ssize_t err, len;
  4.     do {
  5. 	//这边通过 unix域套接字 发出去
  6.         len = ::send(mSendFd, vaddr, size, MSG_DONTWAIT | MSG_NOSIGNAL);
  7.         // cannot return less than size, since we're using SOCK_SEQPACKET
  8.         err = len < 0 ? errno : 0;
  9.     } while (err == EINTR);
  10.     return err == 0 ? len : -err;
  11. }

接下来需要从接收端来分析了，看看在哪去接收的(android_hardware_SensorManager.cpp Receiver里边去接收的),
具体流程如何，就需要回到 从应用通过SensorManager注册一个sensor那边说起了,

  1.  protected boolean registerListenerImpl(SensorEventListener listener, Sensor sensor,
  2.             int delayUs, Handler handler, int maxBatchReportLatencyUs, int reservedFlags) {
  3.         android.util.SeempLog.record_sensor_rate(381, sensor, delayUs);
  4.         if (listener == null || sensor == null) {
  5.             Log.e(TAG, "sensor or listener is null");
  6.             return false;
  7.         }
  8.  
  9.         // Invariants to preserve:
  10.         // - one Looper per SensorEventListener
  11.         // - one Looper per SensorEventQueue
  12. 		//一个SensorEventListener对应一个SensorEventQueue，并装在hashmap mSensorListeners里边
  13.         // We map SensorEventListener to a SensorEventQueue, which holds the looper
  14.         synchronized (mSensorListeners) {
  15.             SensorEventQueue queue = mSensorListeners.get(listener);
  16.             if (queue == null) {
  17.                 Looper looper = (handler != null) ? handler.getLooper() : mMainLooper;
  18.                 final String fullClassName =
  19.                         listener.getClass().getEnclosingClass() != null
  20.                             ? listener.getClass().getEnclosingClass().getName()
  21.                             : listener.getClass().getName();
  22.                 queue = new SensorEventQueue(listener, looper, this, fullClassName);
  23.                 if (!queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs)) {
  24.                     queue.dispose();
  25.                     return false;
  26.                 }
  27.                 mSensorListeners.put(listener, queue);
  28.                 return true;
  29.             } else {
  30.                 return queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs);
  31.             }
  32.         }
  33.     }

若之前该SensorEventListener（由应用自己创建）没有创建过SensorEventQueue，那么创建一个，并和SensorEventListener一起添加到mSensorListeners，
重点就在这边，当创建SensorEventQueue时，会同时构造一个其父类对象BaseEventQueue，接着在其nativeInitBaseEventQueue()方法里边，
通过jni调用
android/frameworks/base/core/jni/android_hardware_SensorManager.cpp nativeInitSensorEventQueue()
来创建一个接收数据的Receiver对象，

  1. static jlong nativeInitSensorEventQueue(JNIEnv *env, jclass clazz, jlong sensorManager,
  2.         jobject eventQWeak, jobject msgQ, jstring packageName, jint mode) {
  3.     SensorManager* mgr = reinterpret_cast<SensorManager*>(sensorManager);
  4.     ScopedUtfChars packageUtf(env, packageName);
  5.     String8 clientName(packageUtf.c_str());
  6.     sp<SensorEventQueue> queue(mgr->createEventQueue(clientName, mode));
  7.  
  8.     if (queue == NULL) {
  9.         jniThrowRuntimeException(env, "Cannot construct native SensorEventQueue.");
  10.         return 0;
  11.     }
  12.  
  13.     sp<MessageQueue> messageQueue = android_os_MessageQueue_getMessageQueue(env, msgQ);//获取MessageQueue
  14.     if (messageQueue == NULL) {
  15.         jniThrowRuntimeException(env, "MessageQueue is not initialized.");
  16.         return 0;
  17.     }
  18.  
  19.     sp<Receiver> receiver = new Receiver(queue, messageQueue, eventQWeak);
  20.     receiver->incStrong((void*)nativeInitSensorEventQueue);
  21.     return jlong(receiver.get());
  22. }

根据clientName创建一个SensorEventQueue，接着创建Receiver，看下其构造函数，

  1. Receiver(const sp<SensorEventQueue>& sensorQueue,
  2.         const sp<MessageQueue>& messageQueue,
  3.         jobject receiverWeak) {
  4.     JNIEnv* env = AndroidRuntime::getJNIEnv();
  5. 	//保存传进来的2个比较关键的对象引用
  6.     mSensorQueue = sensorQueue;
  7.     mMessageQueue = messageQueue;
  8. 	
  9.     mReceiverWeakGlobal = env->NewGlobalRef(receiverWeak);
  10.  
  11.     mIntScratch = (jintArray) env->NewGlobalRef(env->NewIntArray(16));
  12.     mFloatScratch = (jfloatArray) env->NewGlobalRef(env->NewFloatArray(16));
  13. }

再看onFirstRef()

  1. virtual void onFirstRef() {
  2.     LooperCallback::onFirstRef();
  3.     //获取套接字fd
  4.     mMessageQueue->getLooper()->addFd(mSensorQueue->getFd(), 0,
  5.             ALOOPER_EVENT_INPUT, this, mSensorQueue.get());
  6.  
  7. }

//这边获取到创建的SensorEventQueue==>BitTube 里边通过unix socket创建的mReceiveFd,
添加到looper里边,
在 android/system/core/libutils/Looper.cpp  Looper::pollInner()
里边,会通过epoll监听该fd,当有事件时,就会回调Receiver::handleEvent(),接着看

  1. virtual int handleEvent(int fd, int events, void* data) {
  2.         JNIEnv* env = AndroidRuntime::getJNIEnv();
  3.         sp<SensorEventQueue> q = reinterpret_cast<SensorEventQueue *>(data);
  4.         ScopedLocalRef<jobject> receiverObj(env, jniGetReferent(env, mReceiverWeakGlobal));
  5.         ssize_t n;
  6.         ASensorEvent buffer[16];
  7.         //这边最后是通过标准的socket接口recv将数据读取出来,代码在以下位置:
  8.         //android/frameworks/native/libs/sensor
  9.         //SensorEventQueue::read() ==> BitTube::recvObjects()==>BitTube::read()
  10.         while ((n = q->read(buffer, 16)) > 0) {
  11.             for (int i=0 ; i<n ; i++) {
  12.                 if (buffer[i].type == SENSOR_TYPE_STEP_COUNTER) {
  13.                     // step-counter returns a uint64, but the java API only deals with floats
  14.                     float value = float(buffer[i].u64.step_counter);
  15.                     env->SetFloatArrayRegion(mFloatScratch, 0, 1, &value);
  16.                 } else if (buffer[i].type == SENSOR_TYPE_DYNAMIC_SENSOR_META) {
  17.                     float value[2];
  18.                     value[0] = buffer[i].dynamic_sensor_meta.connected ? 1.f: 0.f;
  19.                     value[1] = float(buffer[i].dynamic_sensor_meta.handle);
  20.                     env->SetFloatArrayRegion(mFloatScratch, 0, 2, value);
  21.                 } else if (buffer[i].type == SENSOR_TYPE_ADDITIONAL_INFO) {
  22.                     env->SetIntArrayRegion(mIntScratch, 0, 14,
  23.                                            buffer[i].additional_info.data_int32);
  24.                     env->SetFloatArrayRegion(mFloatScratch, 0, 14,
  25.                                              buffer[i].additional_info.data_float);
  26.                 } else {
  27.                     env->SetFloatArrayRegion(mFloatScratch, 0, 16, buffer[i].data);
  28.                 }
  29.  
  30.                 if (buffer[i].type == SENSOR_TYPE_META_DATA) {
  31.                     // This is a flush complete sensor event. Call dispatchFlushCompleteEvent
  32.                     // method.
  33.                     if (receiverObj.get()) {
  34.                         env->CallVoidMethod(receiverObj.get(),
  35.                                             gBaseEventQueueClassInfo.dispatchFlushCompleteEvent,
  36.                                             buffer[i].meta_data.sensor);
  37.                     }
  38.                 } else if (buffer[i].type == SENSOR_TYPE_ADDITIONAL_INFO) {
  39.                     // This is a flush complete sensor event. Call dispatchAdditionalInfoEvent
  40.                     // method.
  41.                     if (receiverObj.get()) {
  42.                         int type = buffer[i].additional_info.type;
  43.                         int serial = buffer[i].additional_info.serial;
  44.                         env->CallVoidMethod(receiverObj.get(),
  45.                                             gBaseEventQueueClassInfo.dispatchAdditionalInfoEvent,
  46.                                             buffer[i].sensor,
  47.                                             type, serial,
  48.                                             mFloatScratch,
  49.                                             mIntScratch,
  50.                                             buffer[i].timestamp);
  51.                     }
  52.                 }else {
  53.                     int8_t status;
  54.                     switch (buffer[i].type) {
  55.                     case SENSOR_TYPE_ORIENTATION:
  56.                     case SENSOR_TYPE_MAGNETIC_FIELD:
  57.                     case SENSOR_TYPE_ACCELEROMETER:
  58.                     case SENSOR_TYPE_GYROSCOPE:
  59.                     case SENSOR_TYPE_GRAVITY:
  60.                     case SENSOR_TYPE_LINEAR_ACCELERATION:
  61.                         status = buffer[i].vector.status;
  62.                         break;
  63.                     case SENSOR_TYPE_HEART_RATE:
  64.                         status = buffer[i].heart_rate.status;
  65.                         break;
  66.                     default:
  67.                         status = SENSOR_STATUS_ACCURACY_HIGH;
  68.                         break;
  69.                     }
  70.             //关键就在这里,这边通过jni回调SystemSensorManager::dispatchSensorEvent(),将数据给SensorManager
  71. 					
  72. 					
  73.                     if (receiverObj.get()) {
  74.                         env->CallVoidMethod(receiverObj.get(),
  75.                                             gBaseEventQueueClassInfo.dispatchSensorEvent, 
  76.                                             buffer[i].sensor,
  77.                                             mFloatScratch,
  78.                                             status,
  79.                                             buffer[i].timestamp);
  80.                     }
  81.                 }
  82.                 if (env->ExceptionCheck()) {
  83.                     mSensorQueue->sendAck(buffer, n);
  84.                     ALOGE("Exception dispatching input event.");
  85.                     return 1;
  86.                 }
  87.             }
  88. 			//对SensorService::SensorEventConnection发送确认,
  89. 			//SensorService::SensorEventConnection::handleEvent()接收并确认
  90.             mSensorQueue->sendAck(buffer, n);
  91.         }
  92. 		        if (n<0 && n != -EAGAIN) {
  93.             // FIXME: error receiving events, what to do in this case?
  94.         }
  95.         return 1;
  96.     }
  97. };
  1. protected void dispatchSensorEvent(int handle, float[] values, int inAccuracy,
  2.                 long timestamp) {
  3.             final Sensor sensor = mManager.mHandleToSensor.get(handle);
  4.             if (sensor == null) {
  5.                 // sensor disconnected
  6.                 return;
  7.             }
  8.  
  9.             SensorEvent t = null;
  10.             synchronized (mSensorsEvents) {
  11.                 t = mSensorsEvents.get(handle);
  12.             }
  13.  
  14.             if (t == null) {
  15.                 // This may happen if the client has unregistered and there are pending events in
  16.                 // the queue waiting to be delivered. Ignore.
  17.                 return;
  18.             }
  19.             // Copy from the values array.
  20.             System.arraycopy(values, 0, t.values, 0, t.values.length);
  21.             t.timestamp = timestamp;
  22.             t.accuracy = inAccuracy;
  23.             t.sensor = sensor;
  24.  
  25.             // call onAccuracyChanged() only if the value changes
  26.             final int accuracy = mSensorAccuracies.get(handle);
  27.             if ((t.accuracy >= 0) && (accuracy != t.accuracy)) {
  28.                 mSensorAccuracies.put(handle, t.accuracy);
  29.                 mListener.onAccuracyChanged(t.sensor, t.accuracy);
  30.             }
  31.             mListener.onSensorChanged(t);//在这边,通过多态回调应用开发者自己实现的onSensorChanged(),将sensor事件给到应用
  32.         }

到这，sensor数据就给到应用的onSensorChanged()接口了。

5，  待机后SensorService行为

主要的相关类为SensorService::UidPolicy，相关接口为 SensorService::setSensorAccess()和SensorEventConnection::setSensorAccess(),

大致逻辑是SensorService会通过UidPolicy进而通过ActivityManager来监听有哪些新创建的应用，哪些应用进入idle，哪些应用退出，然后当应用注册sensor并且进入idle后，就不将数据发送给应用。

  1.     class UidPolicy : public BnUidObserver {
  2.         public:
  3.             explicit UidPolicy(wp<SensorService> service)
  4.                     : mService(service) {}
  5.             void registerSelf();
  6.             void unregisterSelf();
  7.  
  8.             bool isUidActive(uid_t uid);
  9. 			
  10. 			//这三个接口重载实现了IUidObserver 声明的接口，
  11. 			//后面通过多态被调用
  12.             void onUidGone(uid_t uid, bool disabled);
  13.             void onUidActive(uid_t uid);
  14.             void onUidIdle(uid_t uid, bool disabled);
  15.  
  16.  
  17.             void addOverrideUid(uid_t uid, bool active);
  18.             void removeOverrideUid(uid_t uid);
  19.         private:
  20.             bool isUidActiveLocked(uid_t uid);
  21.             void updateOverrideUid(uid_t uid, bool active, bool insert);
  22.  
  23.             Mutex mUidLock;
  24.             wp<SensorService> mService;
  25.             std::unordered_set<uid_t> mActiveUids;
  26.             std::unordered_map<uid_t, bool> mOverrideUids;
  27.     };

这个类做的事情很简单，在分析它之前，先看下 SensorService::setSensorAccess()和SensorEventConnection::setSensorAccess()
 

  1. void SensorService::setSensorAccess(uid_t uid, bool hasAccess) {
  2.     SortedVector< sp<SensorEventConnection> > activeConnections;
  3.     populateActiveConnections(&activeConnections);
  4.     {
  5.         Mutex::Autolock _l(mLock);
  6.         for (size_t i = 0 ; i < activeConnections.size(); i++) {
  7. 		     //获取到该uid对应的SensorEventConnection
  8.             //每个应用有各自的SensorEventConnection,在创建 SensorEventListerner的时候创建,
  9.             //有一个或多个,具体有几个取决于应用创建多少个SensorEventListerner
  10.             if (activeConnections[i] != 0 && activeConnections[i]->getUid() == uid) {
  11.                 activeConnections[i]->setSensorAccess(hasAccess);
  12.             }
  13.         }
  14.     }
  15. }
  16.  
  17. void SensorService::SensorEventConnection::setSensorAccess(const bool hasAccess) {
  18.     Mutex::Autolock _l(mConnectionLock);
  19.     mHasSensorAccess = hasAccess;//将mHasSensorAccess置成true/false
  20. }

之后该应用的SensorEventConnection::mHasSensorAccess为false，那么就不会将数据发送给对应的应用，

  1. status_t SensorService::SensorEventConnection::sendEvents(
  2.         sensors_event_t const* buffer, size_t numEvents,
  3.         sensors_event_t* scratch,
  4.         wp<const SensorEventConnection> const * mapFlushEventsToConnections) {
  5.  
  6. 	//......
  7.     if (mHasSensorAccess) {
  8.         scratch[count++] = buffer[i];
  9.     
  10. 	}
  11.  
  12. 	//......
  13. 		
  14. }

接着看，

  1. void SensorService::UidPolicy::registerSelf() {
  2.     ActivityManager am;
  3.     am.registerUidObserver(this, ActivityManager::UID_OBSERVER_GONE
  4.             | ActivityManager::UID_OBSERVER_IDLE
  5.             | ActivityManager::UID_OBSERVER_ACTIVE,
  6.             ActivityManager::PROCESS_STATE_UNKNOWN,
  7.             String16("android"));
  8. }

在SensorService::onFirstRef()里边被调用，前面分析SensorService启动的时候有说了下，
注册后开始监听应用的待机状态（应用进程的创建，销毁，进入idle）

应用进入idle后该接口被回调，传入其对应的uid
可通过该指令 am make-uid-idle com.example.applicationtestproject  强行让应用进入idle进行调试

  1. void SensorService::UidPolicy::onUidIdle(uid_t uid, __unused bool disabled) {
  2.     ALOGI("%s , uid : %x", __FUNCTION__, (int)uid);
  3.     bool deleted = false;
  4.     {
  5.         Mutex::Autolock _l(mUidLock);
  6.         if (mActiveUids.erase(uid) > 0) {
  7.             deleted = true;
  8.         }
  9.     }
  10.     if (deleted) {
  11.         sp<SensorService> service = mService.promote();
  12.         if (service != nullptr) {
  13.             service->setSensorAccess(uid, false);
  14. 			//应用进入idle后，这边设置对应 mHasSensorAccess 为false，那么之后sensor数据就不给应用了
  15.         }
  16.     }
  17. }

 

  1. void SensorService::UidPolicy::onUidActive(uid_t uid) {
  2.     ALOGI("%s , uid : %x", __FUNCTION__, (int)uid);
  3.     {
  4.         Mutex::Autolock _l(mUidLock);
  5.         mActiveUids.insert(uid);
  6.     }
  7.     sp<SensorService> service = mService.promote();
  8.     if (service != nullptr) {
  9.         service->setSensorAccess(uid, true);//置对应 mHasSensorAccess 为 true
  10.     }
  11. }

应用退出idle后该接口被ActivityManager回调

简单来讲，google在android9 的SensorService实现的待机相关机制就是，应用进入idle后，
就不将sensor数据给到应用，保证用户隐私不被获取。
对于手机厂家，为了节省功耗，其实还可以在这边做一个优化，就是当持有该sensor的所有应用都进入idle后，
就关闭所有sensor。

6，  融合sensor（SensorFusion）

SensorFusion大概是在这可以虚拟出sensor，取多个sensor的数据，可以再结合其他信息作为输入，通过算法处理最后输出虚拟sensor数据，
基本上对于手机厂商是不会用到的，原因一个是为了降低功耗所以做到驱动里边，另一个原因是用户刷第三方rom后该功能就没了，所以如果不做在驱动层也会做到vendor层，在这不做分析了。


7，  编译SensorService

android/frameworks/native/service/SensorService 目录下直接 mm，

编译完后，out目录下生成libsensorservice.so ，system/lib system/lib64各有一个，push到手机对应的目录即可,

adb root

adb remount

adb push out/....../system/lib/libsensorservice.so /system/lib

adb push out/....../system/lib64/libsensorservice.so /system/lib64

8，  dumpsys sensorservice

SensorService 实现了dump接口，debug问题时，可以通过 adb shell dumpsys sensorservice 
将sensor信息dump出来协助分析，目前的dump接口主要包含以下几个信息：
（1）应用在手机上所有可获得的sensor，包括android定义的sensor以及厂商自定义的sensor
（2）目前有几个sensor被应用开启，对应应用包名
（3）最近的sensor数据；
（4）最近的sensor开关记录，和对应应用包名

9，  android sensor hal层启动

 

android实现的sensor hal层是作为一个守护进程的service在跑的, 通过hidl被调用,
代码位置:android/hardware/interfaces/sensors/1.0,  android/hardware/libhardware/modules/sensors
对外提供的接口定义在ISensors.hal里边,主要有
getSensorsList()//获取所有sensor链表
activate()//开启/关闭一个sensor
poll()//获取sensor数据
batch()//设置采样率
flush()//刷新缓冲区

从Android.bp 可以看到,

  1. cc_binary {
  2.     name: "android.hardware.sensors@1.0-service",
  3.     relative_install_path: "hw",
  4.     vendor: true,
  5.     init_rc: ["android.hardware.sensors@1.0-service.rc"],
  6.     defaults: ["hidl_defaults"],
  7.     srcs: ["service.cpp"],
  8.  
  9.     shared_libs: [
  10.         "liblog",
  11.         "libcutils",
  12.         "libdl",
  13.         "libbase",
  14.         "libutils",
  15.         "libhidlbase",
  16.         "libhidltransport",
  17.         "android.hardware.sensors@1.0",
  18.         "libhwbinder",
  19.     ],
  20.     arch: {
  21.         arm: {
  22.             cflags: ["-DARCH_ARM_32"],
  23.         },
  24.     },
  25. }

该service名字为android.hardware.sensors@1.0-service,

将service.cpp编译成bin程序,通过android.hardware.sensors@1.0-service.rc启动,
service vendor.sensors-hal-1-0 /vendor/bin/hw/android.hardware.sensors@1.0-service
    class hal
    user system
    group system wakelock input
    capabilities BLOCK_SUSPEND
    rlimit rtprio 10 10

看下service.cpp

  1. int main() {
  2. #ifdef ARCH_ARM_32
  3.     android::hardware::ProcessState::initWithMmapSize((size_t)getHWBinderMmapSize());
  4. #endif
  5.     /* Sensors framework service needs at least two threads.
  6.      * One thread blocks on a "poll"
  7.      * The second thread is needed for all other HAL methods.
  8.      */
  9.     return defaultPassthroughServiceImplementation<ISensors>(2);
  10. }

通过defaultPassthroughServiceImplementation(),将自己注册为一个服务到ServiceManager里边,

从Sensors.cpp开始看,
//接下来最先被ServiceManager调用的是这个函数

  1. ISensors *HIDL_FETCH_ISensors(const char * /* hal */) {
  2.     Sensors *sensors = new Sensors;
  3.     LOG(ERROR) << "=======>lkh HIDL_FETCH_ISensors";
  4.     android::CallStack stack("=======>lkh ");
  5.     if (sensors->initCheck() != OK) {
  6.         delete sensors;
  7.         sensors = nullptr;
  8.  
  9.         return nullptr;
  10.     }
  11.  
  12.     return sensors;
  13. }

创建一个Sensors实例,之后所有通过hidl调用sensor hal的接口,都会调用Sensors实现的接口

  1. Sensors::Sensors()
  2.     : mInitCheck(NO_INIT),
  3.       mSensorModule(nullptr),
  4.       mSensorDevice(nullptr) {
  5.     status_t err = OK;
  6.     //若文件/vendor/etc/sensors/hals.conf存在, 
  7.     //打开哪些库就根据这个配置文件里边的库的名字来打开,
  8.     //供应商要开发自己sensor库的话,也可以将自己的库名字添加进去,
  9.     //比如高通骁龙845 855,hal层库名字叫sensors-hal,直接在hals.conf 填下 sensors-hal就ok了,
  10.     LOG(ERROR) << "=======>lkh Sensors construct";
  11.     android::CallStack stack("=======>lkh ");
  12.     if (UseMultiHal()) {
  13.         mSensorModule = ::get_multi_hal_module_info();
  14.     } else {
  15.         err = hw_get_module(
  16.             SENSORS_HARDWARE_MODULE_ID,
  17.             (hw_module_t const **)&mSensorModule);
  18.     }
  19.     if (mSensorModule == NULL) {
  20.         err = UNKNOWN_ERROR;
  21.     }
  22.  
  23.     if (err != OK) {
  24.         LOG(ERROR) << "Couldn't load "
  25.                    << SENSORS_HARDWARE_MODULE_ID
  26.                    << " module ("
  27.                    << strerror(-err)
  28.                    << ")";
  29.  
  30.         mInitCheck = err;
  31.         return;
  32.     }
  33.  
  34. 	//当这个函数返回时，mSensorDevice里边装的是
  35. 	//multihal.cpp  open_sensors()里边的 dev->proxy_device 
  36. 	//所以之后 mSensorDevice->activate(),mSensorDevice->poll(),mSensorDevice->batch()等接口调用，
  37. 	//其实现都是调用了multihal.cpp 的device__activate(),device__poll(),device__batch()
  38.     err = sensors_open_1(&mSensorModule->common, &mSensorDevice);
  39.  
  40.     if (err != OK) {
  41.         LOG(ERROR) << "Couldn't open device for module "
  42.                    << SENSORS_HARDWARE_MODULE_ID
  43.                    << " ("
  44.                    << strerror(-err)
  45.                    << ")";
  46.  
  47.         mInitCheck = err;
  48.         return;
  49.     }
  50.  
  51.     // Require all the old HAL APIs to be present except for injection, which
  52.     // is considered optional.
  53.     CHECK_GE(getHalDeviceVersion(), SENSORS_DEVICE_API_VERSION_1_3);
  54.  
  55.     if (getHalDeviceVersion() == SENSORS_DEVICE_API_VERSION_1_4) {
  56.         if (mSensorDevice->inject_sensor_data == nullptr) {
  57.             LOG(ERROR) << "HAL specifies version 1.4, but does not implement inject_sensor_data()";
  58.         }
  59.         if (mSensorModule->set_operation_mode == nullptr) {
  60.             LOG(ERROR) << "HAL specifies version 1.4, but does not implement set_operation_mode()";
  61.         }
  62.     }
  63.  
  64.     mInitCheck = OK;
  65. }

接着看 sensors_open_1()
android/hardware/libhardware/include/hardware/sensors.h

  1. static inline int sensors_open_1(const struct hw_module_t* module,
  2.         sensors_poll_device_1_t** device) {
  3.     return module->methods->open(module,
  4.             SENSORS_HARDWARE_POLL, TO_HW_DEVICE_T_OPEN(device));
  5. }

其中 
#define TO_HW_DEVICE_T_OPEN(x) reinterpret_cast<struct hw_device_t**>(x)
将sensors_poll_device_1_t** 类型强转成hw_device_t，
作为参数给到函数open_sensors(),

接着到了android/hardware/libhardware/modules/sensors/multihal.cpp

  1. static int open_sensors(const struct hw_module_t* hw_module, const char* name,
  2.         struct hw_device_t** hw_device_out) {
  3.     ALOGV("open_sensors begin...");
  4.  
  5.     lazy_init_modules();//这边dlopen手机厂商或第三方供应商实现的那个sensor库
  6.     //将获取到的hw_module_t保存起来
  7.     // Create proxy device, to return later.
  8.     sensors_poll_context_t *dev = new sensors_poll_context_t();
  9.     memset(dev, 0, sizeof(sensors_poll_device_1_t));
  10.     dev->proxy_device.common.tag = HARDWARE_DEVICE_TAG;
  11.     dev->proxy_device.common.version = SENSORS_DEVICE_API_VERSION_1_4;
  12.     dev->proxy_device.common.module = const_cast<hw_module_t*>(hw_module);
  13.     dev->proxy_device.common.close = device__close;
  14.     dev->proxy_device.activate = device__activate;
  15.     dev->proxy_device.setDelay = device__setDelay;
  16.     dev->proxy_device.poll = device__poll;
  17.     dev->proxy_device.batch = device__batch;
  18.     dev->proxy_device.flush = device__flush;
  19.     dev->proxy_device.inject_sensor_data = device__inject_sensor_data;
  20.     dev->proxy_device.register_direct_channel = device__register_direct_channel;
  21.     dev->proxy_device.config_direct_report = device__config_direct_report;
  22.  
  23.     dev->nextReadIndex = 0;
  24.  
  25.     // Open() the subhal modules. Remember their devices in a vector parallel to sub_hw_modules.
  26.     for (std::vector<hw_module_t*>::iterator it = sub_hw_modules->begin();
  27.             it != sub_hw_modules->end(); it++) {
  28.         sensors_module_t *sensors_module = (sensors_module_t*) *it;
  29.         struct hw_device_t* sub_hw_device;
  30.         //这边,就会去调用手机厂商或第三方供应商实现的那个sensor库里边实现的open函数,
  31.         //进而将其对hw_device_t的实现装到sub_hw_device里边,存储在 sensors_poll_context_t::sub_hw_devices里边
  32.         //之后, 所有对下hal层的调用，都通过该函数传出去的*hw_device_out(即proxy_device)，
  33. 		//类型强转获取到这边创建的dev（首地址相同），然后调用sensors_poll_context_t实现的接口，
  34. 		//进而在这里边调用sub_hw_devices里边存储的从OEM HAL层获取的对应接口的实现（装在hw_device_t里边）。
  35.         int sub_open_result = sensors_module->common.methods->open(*it, name, &sub_hw_device);
  36.  
  37.         if (!sub_open_result) {
  38.             if (!HAL_VERSION_IS_COMPLIANT(sub_hw_device->version)) {
  39.                 ALOGE("SENSORS_DEVICE_API_VERSION_1_3 or newer is required for all sensor HALs");
  40.                 ALOGE("This HAL reports non-compliant API level : %s",
  41.                         apiNumToStr(sub_hw_device->version));
  42.                 ALOGE("Sensors belonging to this HAL will get ignored !");
  43.             }
  44.             dev->addSubHwDevice(sub_hw_device);//用vector保存起来，后面调用OEM HAL层接口实现时重新取出来
  45.         }
  46.     }
  47.  
  48.     // Prepare the output param and return
  49.     *hw_device_out = &dev->proxy_device.common;
  50. 	//这里边将proxy_device.common的地址装进去，实际上也是proxy_device的地址(common为其第一个成员，因此地址相同)，
  51.     ALOGV("...open_sensors end");
  52.     return 0;
  53. }

请注意，这边传出去的虽然是一个hw_device_t类型的地址&dev->proxy_device.common，由于它是sensors_poll_device_1的第一个成员，而sensors_poll_device_1又是sensors_poll_context_t的
第一个成员，并且这边创建的其实是一个sensors_poll_context_t对象，所以之后可以通过&dev->proxy_device.common类型强转获取到 proxy_device和dev的首地址，


对于上面分析，举个例子，对于SensorService通过HIDL调用下来的activate接口，
到了android/hardware/interfaces/sensors/1.0/default/Sensors.cpp

  1. Return<Result> Sensors::activate(
  2.         int32_t sensor_handle, bool enabled) {
  3.     return ResultFromStatus(
  4.             mSensorDevice->activate(
  5.                 reinterpret_cast<sensors_poll_device_t *>(mSensorDevice),
  6.                 sensor_handle,
  7.                 enabled));
  8. }

//接着到了android/hardware/libhardware/modules/sensors/multihal.cpp 

  1. static int device__activate(struct sensors_poll_device_t *dev, int handle,
  2.         int enabled) {
  3.     sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
  4.     return ctx->activate(handle, enabled);
  5. }

接着看

  1. int sensors_poll_context_t::activate(int handle, int enabled) {
  2.     int retval = -EINVAL;
  3.     ALOGV("activate");
  4. 	//这边将前面分析的open_sensors()里边获取到的OEM HAL层实现的hw_device_t取出来，
  5. 	//进而调用OEM HAL层对activate的实现。
  6.     int local_handle = get_local_handle(handle);
  7.     sensors_poll_device_t* v0 = this->get_v0_device_by_handle(handle);
  8.  
  9.     if (halIsCompliant(this, handle) && local_handle >= 0 && v0) {
  10.         retval = v0->activate(v0, local_handle, enabled);
  11.     } else {
  12.         ALOGE("IGNORING activate(enable %d) call to non-API-compliant sensor handle=%d !",
  13.                 enabled, handle);
  14.     }
  15.     ALOGV("retval %d", retval);
  16.     return retval;
  17. }

到了这边，android HAL层已经启动完毕，并能够相应hidl客户端的调用，并进而调用OEM HAL 层的接口了。

10，SensorManager 启动

(1)SystemSensorManager 启动流程

SystemSensorManager 继承并实现SensorManager接口,应用通过调用SensorManager的接口来达到其需求,
而实际的功能实现者是SystemSensorManager(多态技术),
先看下SystemSensorManager的启动流程, 创建实例的调用栈如下,

05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.hardware.SystemSensorManager.<init>(SystemSensorManager.java:147)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.app.SystemServiceRegistry$33.createService(SystemServiceRegistry.java:476)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.app.SystemServiceRegistry$33.createService(SystemServiceRegistry.java:472)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.app.SystemServiceRegistry$CachedServiceFetcher.getService(SystemServiceRegistry.java:1200)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.app.SystemServiceRegistry.getSystemService(SystemServiceRegistry.java:1116)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.app.ContextImpl.getSystemService(ContextImpl.java:1739)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.policy.WakeGestureListener.<init>(WakeGestureListener.java:43)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.policy.PhoneWindowManager$MyWakeGestureListener.<init>(PhoneWindowManager.java:1407)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.policy.PhoneWindowManager.init(PhoneWindowManager.java:2665)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.policy.OemPhoneWindowManager.init(OemPhoneWindowManager.java:410)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.wm.WindowManagerService$4.run(WindowManagerService.java:1236)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.os.Handler$BlockingRunnable.run(Handler.java:893)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.os.Handler.handleCallback(Handler.java:873)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.os.Handler.dispatchMessage(Handler.java:99)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.os.Looper.loop(Looper.java:193)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at android.os.HandlerThread.run(HandlerThread.java:65)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.ServiceThread.run(ServiceThread.java:44)
05-21 16:01:29.257  1813  1885 E ======>lkh:     at com.android.server.UiThread.run(UiThread.java:43)

开机的时候在 android/frameworks/base/core/java/android/app/SystemServiceRegistry.java里边创建的实例

  1. registerService(Context.SENSOR_SERVICE, SensorManager.class,
  2.         new CachedServiceFetcher<SensorManager>() {
  3.     @Override
  4.     public SensorManager createService(ContextImpl ctx) {
  5.         return new SystemSensorManager(ctx.getOuterContext(),
  6.           ctx.mMainThread.getHandler().getLooper());
  7.     }});

开始看SystemSensorManager的构造函数

  1. public SystemSensorManager(Context context, Looper mainLooper) {
  2.     synchronized (sLock) {
  3.         if (!sNativeClassInited) {
  4.             sNativeClassInited = true;
  5.             nativeClassInit();//native层offset初始化,没做什么其他事情
  6.         }
  7.     }
  8.     Log.e("======>lkh", Log.getStackTraceString(new Throwable()));
  9.  
  10.  
  11.     mMainLooper = mainLooper;
  12.     mTargetSdkLevel = context.getApplicationInfo().targetSdkVersion;
  13.     mContext = context;
  14.     mNativeInstance = nativeCreate(context.getOpPackageName());
  15.     //mNativeInstance 保存native创建的 c++对象 SensorManager的引用,
  16.     //该对象通过getOpPackageName()返回的结果作为参数创建,并且2者保存在一个map里边,
  17.     //注意,此SensorManager为native层c++实现的,非面向应用用Java实现的SensorManager
  18.  
  19.     // initialize the sensor list
  20.     for (int index = 0;; ++index) {
  21.         Sensor sensor = new Sensor();
  22.         if (!nativeGetSensorAtIndex(mNativeInstance, sensor, index)) break;
  23.         mFullSensorsList.add(sensor);
  24.         mHandleToSensor.put(sensor.getHandle(), sensor);
  25.     }
  26.     //获取SesorService的sensor list里边的所有sensor,每个sensor创建一个对应的java层的Sensor对象,
  27.     //并保存到链表里边,并将sensor handle和sensor一并保存到map里边
  28. }

(2) native层 SensorManager 启动流程

SensorManager的创建如上所看到的,是SystemSensorManager初始化时通过jni调用到android_hardware_SensorManager,
接着调用其static接口getInstanceForPackage()进行初始化的,
可以看下其构造函数

  1. SensorManager::SensorManager(const String16& opPackageName)
  2.     : mSensorList(0), mOpPackageName(opPackageName), mDirectConnectionHandle(1) {
  3.     // okay we're not locked here, but it's not needed during construction
  4.     assertStateLocked();
  5. }

 

//保存SystemSensorManager传过来的 opPackageName

  1. status_t SensorManager::assertStateLocked() {
  2.     bool initSensorManager = false;
  3.     if (mSensorServer == NULL) {
  4.         initSensorManager = true;
  5.     } else {
  6.         // Ping binder to check if sensorservice is alive.
  7.         status_t err = IInterface::asBinder(mSensorServer)->pingBinder();
  8.         if (err != NO_ERROR) {
  9.             initSensorManager = true;
  10.         }
  11.     }
  12.     if (initSensorManager) {
  13.         waitForSensorService(&mSensorServer);
  14.         LOG_ALWAYS_FATAL_IF(mSensorServer == nullptr, "getService(SensorService) NULL");
  15.  
  16.         class DeathObserver : public IBinder::DeathRecipient {
  17.             SensorManager& mSensorManager;
  18.             virtual void binderDied(const wp<IBinder>& who) {
  19.                 ALOGW("sensorservice died [%p]", who.unsafe_get());
  20.                 mSensorManager.sensorManagerDied();
  21.             }
  22.         public:
  23.             explicit DeathObserver(SensorManager& mgr) : mSensorManager(mgr) { }
  24.         };
  25.  
  26.         mDeathObserver = new DeathObserver(*const_cast<SensorManager *>(this));
  27.         IInterface::asBinder(mSensorServer)->linkToDeath(mDeathObserver);
  28.  
  29.         mSensors = mSensorServer->getSensorList(mOpPackageName);
  30.         size_t count = mSensors.size();
  31.         mSensorList =
  32.                 static_cast<Sensor const**>(malloc(count * sizeof(Sensor*)));
  33.         LOG_ALWAYS_FATAL_IF(mSensorList == NULL, "mSensorList NULL");
  34.  
  35.         for (size_t i=0 ; i<count ; i++) {
  36.             mSensorList[i] = mSensors.array() + i;
  37.         }
  38.     }
  39.  
  40.     return NO_ERROR;
  41. }

主要做的事情有3个,
1,开机的时候等SensorService起来,获取到其指针,
2,注册一个DeathObserver(这个具体是个什么机制目前还没去看,应该就是利用观察者模式,SensorService挂了的时候,
  注册的某个接口会被调用进行一些后期清理操作,这边的话就是sensorManagerDied()接口了)
3,获取sensorlist里边的每个sensor对象地址

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/天景科技苑/article/detail/764891
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号