本文基于Android 12源码整理，包含如下内容：

通信架构

应用层实现

涉及代码：

framework/base/core/java/android/hardware/SensorManager.java
framework/base/core/java/android/hardware/SystemSensorManager.java
framework/base/core/java/android/hardware/SensorEvent.java

使用方式

应用层主要使用fwk提供的SensorManager 来监听获取指定传感器的数据，主要实现如下，
回调的参数SensorEvent是一个包含传感器参数与当前值的数据结构，不同的传感器数据均从其values的float数组中获取值，如光感传感器的值只有一个就是values[0], 陀螺仪有三个值就是values[0],values[1],values[2]等。

import android.hardware.Sensor
import android.hardware.SensorEvent
import android.hardware.SensorEventListener
import android.hardware.SensorManagerval sm = getSystemService(Context.SENSOR_SERVICE) as SensorManager
sm.registerListener(object : SensorEventListener{override fun onSensorChanged(event: SensorEvent?) {val x = event?.values?.get(0)val y = event?.values?.get(1)val z = event?.values?.get(2)}override fun onAccuracyChanged(sensor: Sensor?, accuracy: Int) {//传感器精度回调}
}, sm.getDefaultSensor(Sensor.TYPE_ACCELEROMETER), SensorManager.SENSOR_DELAY_NORMAL)

SensorManager抽象接口具体实现

SensorManager是一个抽象函数，部分抽象函数的具体的功能实现是在SystemSensorManager类中， 其构造函数主要做的工作依次如下：

- 初始化jni接口 
- 创建一个SensorManager的native层实例
- 检查当前进程是否具备高速传输传感器数据的权限  
- 初始化本机的sensor设备列表

 public SystemSensorManager(Context context, Looper mainLooper) {synchronized (sLock) {if (!sNativeClassInited) {sNativeClassInited = true;//初始化jni接口 nativeClassInit();}}mMainLooper = mainLooper;ApplicationInfo appInfo = context.getApplicationInfo();mTargetSdkLevel = appInfo.targetSdkVersion;mContext = context;//创建一个SensorManager的native层实例mNativeInstance = nativeCreate(context.getOpPackageName());mIsPackageDebuggable = (0 != (appInfo.flags & ApplicationInfo.FLAG_DEBUGGABLE));PackageManager packageManager = context.getPackageManager();//检查当前进程是否具备高速传输传感器数据的权限 mHasHighSamplingRateSensorsPermission =(PERMISSION_GRANTED == packageManager.checkPermission(HIGH_SAMPLING_RATE_SENSORS_PERMISSION,appInfo.packageName));// initialize the sensor listfor (int index = 0;; ++index) {Sensor sensor = new Sensor();//初始化本机的sensor设备列表if (!nativeGetSensorAtIndex(mNativeInstance, sensor, index)) break;mFullSensorsList.add(sensor);mHandleToSensor.put(sensor.getHandle(), sensor);}}

每个app在通过getSystemService获取class类型为SensorManager的对象时，获取的都是SystemSensorManager对象，实例的初始化在SystemServiceRegistry的静态域中初始化，代码如下：

registerService(Context.SENSOR_SERVICE, SensorManager.class,new CachedServiceFetcher<SensorManager>() {@Overridepublic SensorManager createService(ContextImpl ctx) {Return new SystemSensorManager(ctx.getOuterContext(),ctx.mMainThread.getHandler().getLooper());
}});

再跟一下监听函数registerListener，最终会走到SystemSensorManager的registerListenerImpl函数中，实现功能如下：

- 检查注册参数是否符合要求
- 获取监听器实例的所有事件队列-> 如果队列为空   1.创建新的队列实例2.队列实例中加入当前监听的Sensor对象3.将事件队列加入到监听器的HashMap中对应保存-> 如果队列不为空1.队列实例中加入当前监听的Sensor对象

实现代码如下：

// Invariants to preserve:
// - one Looper per SensorEventListener
// - one Looper per SensorEventQueue
// We map SensorEventListener to a SensorEventQueue, which holds the looper
synchronized (mSensorListeners) {SensorEventQueue queue = mSensorListeners.get(listener);if (queue == null) {Looper looper = (handler != null) ? handler.getLooper() : mMainLooper;final String fullClassName =listener.getClass().getEnclosingClass() != null? listener.getClass().getEnclosingClass().getName(): listener.getClass().getName();queue = new SensorEventQueue(listener, looper, this, fullClassName);if (!queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs)) {queue.dispose();return false;}mSensorListeners.put(listener, queue);return true;} else {return queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs);}
}

SensorEventQueue 是定义在SystemSensorManager.java文件中的一个静态内部类，其父类类型为BaseEventQueue，BaseEventQueue中定义了enableSensor, 在app注册了监听器后，BaseEventQueue会调用nativeEnableSensor去激活该Sensor. SensorEventQueue中还实现了dispatchSensorEvent函数，当底层上报数据的时候，JNI层会回调该函数，将数据传给listener实例。

 protected void dispatchSensorEvent(int handle, float[] values, int inAccuracy,long timestamp) {final Sensor sensor = mManager.mHandleToSensor.get(handle);if (sensor == null) {// sensor disconnectedreturn;}SensorEvent t = null;synchronized (mSensorsEvents) {t = mSensorsEvents.get(handle);}if (t == null) {// This may happen if the client has unregistered and there are pending events in// the queue waiting to be delivered. Ignore.return;}// Copy from the values array.System.arraycopy(values, 0, t.values, 0, t.values.length);t.timestamp = timestamp;t.accuracy = inAccuracy;t.sensor = sensor;// call onAccuracyChanged() only if the value changesfinal int accuracy = mSensorAccuracies.get(handle);if ((t.accuracy >= 0) && (accuracy != t.accuracy)) {mSensorAccuracies.put(handle, t.accuracy);mListener.onAccuracyChanged(t.sensor, t.accuracy);}mListener.onSensorChanged(t);}

fwk层的实现

涉及代码如下：

frameworks/base/core/jni/android_hardware_SensorManager.cpp
frameworks/native/libs/sensor/*
frameworks/native/services/sensorservice/*

SensorManager的jni实现，定义在android_hardware_SensorManager.cpp这个文件中，这里不全部介绍每个本地函数的功能，只挑几个重要的

native中的SensorManager的初始化流程

android_hardware_SensorManager.cpp//初始化native层SensorManager
static jlong
nativeCreate(JNIEnv *env, jclass clazz, jstring opPackageName)
{ScopedUtfChars opPackageNameUtf(env, opPackageName);return (jlong) &SensorManager::getInstanceForPackage(String16(opPackageNameUtf.c_str()));
}

SensorManager.cpp文件路径在frameworks/native/libs/sensor文件夹下，该库编译后生成libsensor.so给到libandroid_server.so依赖，该库是一个通信中间件，实现了Sensor数据的同一进程内unix域通信，以及通过binder通信来实现部分Sensor的设置项实现。Sensor的jni类就是靠引入该库的头文件来实现与Sensor Service通信的。

获取SensorManager实例

frameworks/native/libs/sensor/SensorManager.cppSensorManager& SensorManager::getInstanceForPackage(const String16& packageName) {waitForSensorService(nullptr);Mutex::Autolock _l(sLock);SensorManager* sensorManager;//sPackageInstances是一个map数据结构，key是const String16，value是SensorManager指针auto iterator = sPackageInstances.find(packageName);//如果这个包已经获取过SensorManager，直接把返回该实例的指针if (iterator != sPackageInstances.end()) {sensorManager = iterator->second;} else {String16 opPackageName = packageName;//权限检测，判断当前调用的包名是不是有权限访问sensorif (opPackageName.size() <= 0) {sp<IBinder> binder = defaultServiceManager()->getService(String16("permission"));if (binder != nullptr) {const uid_t uid = IPCThreadState::self()->getCallingUid();Vector<String16> packages;interface_cast<IPermissionController>(binder)->getPackagesForUid(uid, packages);if (!packages.isEmpty()) {opPackageName = packages[0];} else {ALOGE("No packages for calling UID");}} else {ALOGE("Cannot get permission service");}}//创建一个新的SensorManager对象sensorManager = new SensorManager(opPackageName);// If we had no package name, we looked it up from the UID and the sensor// manager instance we created should also be mapped to the empty package// name, to avoid looking up the packages for a UID and get the same result.if (packageName.size() <= 0) {sPackageInstances.insert(std::make_pair(String16(), sensorManager));}// Stash the per package sensor manager.sPackageInstances.insert(std::make_pair(opPackageName, sensorManager));}return *sensorManager;
}

native中的消息队列初始化与数据读取

上图包括了一个native中消息队列创建的完整流程，在之前讲过registerListener的数据主要来自SensorEventQueue的dispatchSensorEvent, 这个java层的方法回调是由JNI实现中的Receiver函数来触发的，Receiver是LooperCallback的子类，实际可以看成Handler的Native样式，这个函数的dispatchEvent中会一直循环从native层的SensorEventQueue中去read数据，read函数的实现在libsensor.so库中的BitTube.cpp实现，因为sensorservice与sensor jni均运行在system_server进程内，故这里数据的读写使用unix同进程内的域通信来实现的。具体的通信实现可以看BitTube.cpp这个文件。

sensorservice实现

上面一节分析完了，Sensor数据是在jni中的Receiver中通过JNI反射java层函数，调用Java层的SensorEventQueue中的dispatchSensorEvent函数发给各个app的， Receiver通过libsensor.so不断从server端去read数据，这里Receiver可以看作是一个客户端，那么服务端的实现就是sensorservice, 其实现在frameworks/native/services/sensorservice下，这个服务的作用就是起到承上启下的作用，对上作为aidl的BnBinder端供BpBinder调用，作为Socket的Server端，往Client端写数据；对下，则是作为一个hidl的client端，通过调用hal层的sensor服务接口，来联通上下层。其主要流程如下：

- threadLoop函数中循环通过SensorDevice去poll数据，并通过SensorEventConnect的sendEvents发送到jni函数的Receiver中- SensorDevice.cpp 顾名思义就是传感器设备，该类实现了HIDL的接口，并通过hidl与hal层实现数据的poll以及设置的接口调用，列表的初始化等。- SensorEventConnection.cpp是一个事件处理通道，保持了与client进行unix域通信的双句柄，通过调用SensorEventQueue的write函数实现将sensor数据发送到client端（JNI中的Receiver类）。

threadLoop函数poll数据的实现：

SensorService.cppbool SensorService::threadLoop() {ALOGD("nuSensorService thread starting...");......//SensorDevice是单例模式的SensorDevice& device(SensorDevice::getInstance());//获取hal层版本const int halVersion = device.getHalDeviceVersion();do {//poll数据ssize_t count = device.poll(mSensorEventBuffer, numEventMax);if (count < 0) {if(count == DEAD_OBJECT && device.isReconnecting()) {device.reconnect();continue;} else {ALOGE("sensor poll failed (%s)", strerror(-count));break;}}// Reset sensors_event_t.flags to zero for all events in the buffer.for (int i = 0; i < count; i++) {mSensorEventBuffer[i].flags = 0;}//省略了很多代码//将数据发送到所有通道for (const sp<SensorEventConnection>& connection : activeConnections) {//发送数据connection->sendEvents(mSensorEventBuffer, count, mSensorEventScratch,mMapFlushEventsToConnections);needsWakeLock |= connection->needsWakeLock();// If the connection has one-shot sensors, it may be cleaned up after first trigger.// Early check for one-shot sensors.if (connection->hasOneShotSensors()) {cleanupAutoDisabledSensorLocked(connection, mSensorEventBuffer, count);}}}while (!Thread::exitPending());
}

SensorDevice的poll功能实现

ssize_t SensorDevice::poll(sensors_event_t* buffer, size_t count) {if (mSensors == nullptr) return NO_INIT;ssize_t eventsRead = 0;if (mSensors->supportsMessageQueues()) {eventsRead = pollFmq(buffer, count);//从mSensors的消息队列读值} else if (mSensors->supportsPolling()) {eventsRead = pollHal(buffer, count); //调用mSensors的poll函数取值} else {ALOGE("Must support polling or FMQ");eventsRead = -1;}return eventsRead;
}

mSensors变量类型定义如下：

sp<::android::hardware::sensors::V2_1::implementation::ISensorsWrapperBase> mSensors;

这个类型是由hidl生成的，定义在hardware/interfaces/sensors/2.1/default下，厂商自定义实现该功能。

SensorEventConnection sendEvents的实现

SensorEventConnection.cppstatus_t SensorService::SensorEventConnection::sendEvents(sensors_event_t const* buffer, size_t numEvents,sensors_event_t* scratch,wp<const SensorEventConnection> const * mapFlushEventsToConnections) //... 省略很多代码ssize_t size = SensorEventQueue::write(mChannel,reinterpret_cast<ASensorEvent const*>(scratch), count);//... 省略很多代码
}SensorEventQueue实现在libsensor.so里面，write函数就是调用了内部的网络通信封装的类BitTube.cpp来实现写入。

HAL层的实现

hal层的实现基本上每个厂商的实现都不一样，这里只跟了一下原生的，涉及到的源码如下：

hardware/libhardware/include/hardware/sensors.h
hardware/libhardware/include/hardware/sensors-base.h
hardware/interfaces/sensors/*

sensors.h定义了sensor的各类数据结构，如sensor的数据格式，sensor对应hal层的module，sensor device格式，以及实现了动态管理客制化的sensor hal实现的库或者驱动的接口。

/** convenience API for opening and closing a device */
static inline int sensors_open(const struct hw_module_t* module,struct sensors_poll_device_t** device) {return module->methods->open(module,SENSORS_HARDWARE_POLL, TO_HW_DEVICE_T_OPEN(device));
}static inline int sensors_close(struct sensors_poll_device_t* device) {return device->common.close(&device->common);
}static inline int sensors_open_1(const struct hw_module_t* module,sensors_poll_device_1_t** device) {return module->methods->open(module,SENSORS_HARDWARE_POLL, TO_HW_DEVICE_T_OPEN(device));
}static inline int sensors_close_1(sensors_poll_device_1_t* device) {return device->common.close(&device->common);
}

sensors-base.h则定义了SENSOR设备类型的值。

hardware/interfaces/sensors/1.0/default/Sensors.cpp中实现了对sensor module的load,以及设备的加载。

Sensors::Sensors(): mInitCheck(NO_INIT),mSensorModule(nullptr),mSensorDevice(nullptr) {status_t err = OK;if (UseMultiHal()) {mSensorModule = ::get_multi_hal_module_info();} else {//hal层动态加载module的so库， hw_get_module的实现在hardware/libhardware/hardware.c中，是要是动过dlopen动态加载so库。err = hw_get_module(SENSORS_HARDWARE_MODULE_ID,(hw_module_t const **)&mSensorModule);}if (mSensorModule == NULL) {err = UNKNOWN_ERROR;}if (err != OK) {LOG(ERROR) << "Couldn't load "<< SENSORS_HARDWARE_MODULE_ID<< " module ("<< strerror(-err)<< ")";mInitCheck = err;return;}//从module涨获取到sensor设备，后续的操作都需要mSensorDevice才能与真实的硬件设备通讯err = sensors_open_1(&mSensorModule->common, &mSensorDevice);