本文主要分析android 在應用層register一個sensor後從應用層調用到framework SensorService的過程。
版本：android 8.0.0,abdroid 8.1.0
大致調用順序爲：appliction ===>SensorManager===>SystemSeneorManager===>Sensorservice
1，對於應用層，舉個使用的小例子：
private SensorManager mSensorManager;
private Sensor mSensor;
mSensorManager = (SensorManager) getSystemService(Context.SENSOR_SERVICE);
mSensor = mSensorManager.getDefaultSensor(Sensor.TYPE_ACCELEROMETER);
mSensorManager.registerListener(mSensorEventListener,mSensor,SensorManager.SENSOR_DELAY_NORMAL);
final SensorEventListener mSensorEventListener = new SensorEventListener() {
@Override
public void onSensorChanged(SensorEvent sensorEvent) {
Log.i(TAG,"sensorEvent.sensor.getType():" + sensorEvent.sensor.getType());
if(sensorEvent.sensor.getType() == Sensor.TYPE_ACCELEROMETER){
//add you code
}
}
@Override
public void onAccuracyChanged(Sensor sensor, int i) {
//add your code
}
};2，SensorManager
源碼位置:android/frameworks/base/core/java/android/hardware/SensorManager.java
先看registerListener函數：
1. public boolean registerListener(SensorEventListener listener, Sensor sensor,
2. int samplingPeriodUs) {
3. return registerListener(listener, sensor, samplingPeriodUs, null);
對於其參數說明:
SensorEventListener:前面應用層需實現其onSensorChanged（）接口，數據傳上來時該接口被調用（callback）；
Sensor:sensor對象，需說明其類型；
samplingPeriodUs：period，顧名思義爲週期，接收數據的週期，
可以取以下幾個值：
SENSOR_DELAY_NORMAL: rate (default)suitable for screen orientation changes//延遲200000ms
SENSOR_DELAY_UI: rate suitable for the userinterface（適合用戶界面的速率）//延遲66667ms
SENSOR_DELAY_GAME: rate suitable for games（不知道是啥意思）//延遲20000ms
SENSOR_DELAY_FASTEST: get sensor data asfast as possible//沒有延遲，
或自己期望的值，不過也得不高於採樣率喔。
接着看，，，，，
1. public boolean registerListener(SensorEventListener listener, Sensor sensor,
2. int samplingPeriodUs, int maxReportLatencyUs) {
3. int delay = getDelay(samplingPeriodUs);
4. return registerListenerImpl(listener, sensor, delay, null, maxReportLatencyUs, 0);
5. } 打個小插曲，先看一下getDelay()接口：
1. private static int getDelay(int rate) {
2. int delay = -1;
3. switch (rate) {
4. case SENSOR_DELAY_FASTEST:
5. delay = 0;
6. break;
7. case SENSOR_DELAY_GAME:
8. delay = 20000;
9. break;
10. case SENSOR_DELAY_UI:
11. delay = 66667;
12. break;
13. case SENSOR_DELAY_NORMAL:
14. delay = 200000;
15. break;
16. default:
17. delay = rate;
18. break;
19. }
20. return delay;
21. } 就是對參數做了個轉換，好了回到主分支繼續，，，
1. /** @hide */
2. protected abstract boolean registerListenerImpl(SensorEventListener listener, Sensor sensor,
3. int delayUs, Handler handler, int maxReportLatencyUs, int reservedFlags);
SystemSensorManager繼承了SensorManager，
registerListenerImpl()在SystemSensorManager類裏邊實現，這樣就到了SystemSensorManager
3，SystemSensorManager
其registerListenerImpl()方法實現如下：
1. /** @hide */
2. @Override
3. protected boolean registerListenerImpl(SensorEventListener listener, Sensor sensor,
4. int delayUs, Handler handler, int maxBatchReportLatencyUs, int reservedFlags) {
5. // Invariants to preserve:
6. // - one Looper per SensorEventListener
7. // - one Looper per SensorEventQueue
8. // We map SensorEventListener to a SensorEventQueue, which holds the looper
9. synchronized (mSensorListeners) {
10. SensorEventQueue queue = mSensorListeners.get(listener);
11. //由於mySensorListener首次註冊，所以queue==null
12. //因此需要new一個SensorEventQueue
13.
14. if (queue == null) {
15. //前面SensorManager裏邊handler == null
16. //所以looper = mMainLooper
17. Looper looper = (handler != null) ? handler.getLooper() : mMainLooper;
18. final String fullClassName = listener.getClass().getEnclosingClass() != null ?
19. listener.getClass().getEnclosingClass().getName() :
20. listener.getClass().getName();
21. queue = new SensorEventQueue(listener, looper, this, fullClassName);
22. if (!queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs)) {
23. queue.dispose();
24. return false;
25. }
26. //將2者加入hashMap
27. mSensorListeners.put(listener, queue);
28. return true;
29. } else {
30. return queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs);
31. }
32. }
33. }
對於mSensorListeners.put(listener, queue);mSensorListeners類型爲
1. private final HashMap<SensorEventListener, SensorEventQueue> mSensorListeners = new HashMap<SensorEventListener, SensorEventQueue>();
主要爲創建一個SensorEventQueue後將sensor添加進去，
該變量sensor爲前面應用層註冊的時候傳進來的通過mSensorManager.getDefaultSensor(Sensor.TYPE_...)獲取到的。
看看SensorEventQueue是個什麼東西，主要看構造方法和addSensor方法，
static final classSensorEventQueue extends BaseEventQueue，
看BaseEventQueue的構造函數
1. BaseEventQueue(Looper looper, SystemSensorManager manager, int mode, String packageName) {
2. if (packageName == null) packageName = "";
3. //通過jni調用c++
4. nSensorEventQueue = nativeInitBaseEventQueue(manager.mNativeInstance,
5. new WeakReference<>(this), looper.getQueue(),
6. packageName, mode, manager.mContext.getOpPackageName());
7. mCloseGuard.open("dispose");
8. mManager = manager;
9. } nativeInitBaseEventQueue（）函數在
android/frameworks/base/core/jni/android_hardware_SensorManager.cpp裏邊，
1. static jlong nativeInitSensorEventQueue(JNIEnv *env, jclass clazz, jlong sensorManager,
2. jobject eventQWeak, jobject msgQ, jstring packageName, jint mode) {
3. SensorManager* mgr = reinterpret_cast<SensorManager*>(sensorManager);
4. ScopedUtfChars packageUtf(env, packageName);
5. String8 clientName(packageUtf.c_str());
6. sp<SensorEventQueue> queue(mgr->createEventQueue(clientName, mode));
7.
8. if (queue == NULL) {
9. jniThrowRuntimeException(env, "Cannot construct native SensorEventQueue.");
10. return 0;
11. }
12.
13. sp<MessageQueue> messageQueue = android_os_MessageQueue_getMessageQueue(env, msgQ);
14. if (messageQueue == NULL) {
15. jniThrowRuntimeException(env, "MessageQueue is not initialized.");
16. return 0;
17. }
18.
19. sp<Receiver> receiver = new Receiver(queue, messageQueue, eventQWeak);
20. receiver->incStrong((void*)nativeInitSensorEventQueue);
21. return jlong(receiver.get());
22. } 在這裏邊new 了一個receiver對象，
返回該receiver對象，保存在類BaseEventQueue裏邊的nSensorEventQueue 屬性裏邊，
這邊的addSensor()還是調用父類BaseEventQuene的方法：
1. public boolean addSensor(
2. Sensor sensor, int delayUs, int maxBatchReportLatencyUs) {
3. // Check if already present.
4. int handle = sensor.getHandle();
5. if (mActiveSensors.get(handle)) return false;
6.
7. // Get ready to receive events before calling enable.
8. mActiveSensors.put(handle, true);
9. addSensorEvent(sensor);
10.
11. if (enableSensor(sensor, delayUs, maxBatchReportLatencyUs) != 0) {
12. // Try continuous mode if batching fails.
13. if (maxBatchReportLatencyUs == 0 ||
14. maxBatchReportLatencyUs > 0 && enableSensor(sensor, delayUs, 0) != 0) {
15. removeSensor(sensor, false);
16. return false;
17. }
18. }
19. return true;
20. }
看addSensorEvent()方法，調用的爲類SensorEventQueue自己的addSensorEvent()方法，
1. public void addSensorEvent(Sensor sensor) {
2. SensorEvent t = new SensorEvent(Sensor.getMaxLengthValuesArray(sensor,
3. mManager.mTargetSdkLevel));
4. synchronized (mSensorsEvents) {
5. mSensorsEvents.put(sensor.getHandle(), t);
6. }
7. }
即new了一個SensorEvent對象後，將其與sensor裏邊的handle一起添加進mSensorsEvents，
mSensorsEvents爲
1. private final SparseArray<SensorEvent> mSensorsEvents = new SparseArray<SensorEvent>(); 再看enableSensor()方法，
1. private int enableSensor(
2. Sensor sensor, int rateUs, int maxBatchReportLatencyUs) {
3. if (nSensorEventQueue == 0) throw new NullPointerException();
4. if (sensor == null) throw new NullPointerException();
5. //通過jni調用c++
6. return nativeEnableSensor(nSensorEventQueue, sensor.getHandle(), rateUs,
7. maxBatchReportLatencyUs);
8. }
接着看nativeEnableSensor（）方法，同樣在
android/frameworks/base/core/jni/android_hardware_SensorManager.cpp裏邊
1. static jint nativeEnableSensor(JNIEnv *env, jclass clazz, jlong eventQ, jint handle, jint rate_us,
2. jint maxBatchReportLatency) {
3. sp<Receiver> receiver(reinterpret_cast<Receiver *>(eventQ));
4. return receiver->getSensorEventQueue()->enableSensor(handle, rate_us, maxBatchReportLatency,
5. 0);
6. }
這邊有一個回調，即
nSensorEventQueue->getSensorEventQueue()->enableSensor，回過頭去看nSensorEventQueue，
在類BaseEventQueue構造函數裏邊被初始化，nSensorEventQueue 保存了一個在jni裏邊
New 的receiver對象。所以，
receiver->getSensorEventQueue()->enableSensor()
<==>
nSensorEventQueue->getSensorEventQueue()->enableSensor(),
而nSensorEventQueue保存的又是一個在jni裏邊New 的receiver對象，
所以確實是receiver->getSensorEventQueue()->enableSensor()，
其實就是一個指針類型強制轉過來又轉回去。
看看jni函數nativeInitSensorEventQueue()是如何搞的，
1. static jlong nativeInitSensorEventQueue(JNIEnv *env, jclass clazz, jlong sensorManager,
2. jobject eventQWeak, jobject msgQ, jstring packageName, jint mode) {
3. SensorManager* mgr = reinterpret_cast<SensorManager*>(sensorManager);
4. ScopedUtfChars packageUtf(env, packageName);
5. String8 clientName(packageUtf.c_str());
6. sp<SensorEventQueue> queue(mgr->createEventQueue(clientName, mode));
7.
8. if (queue == NULL) {
9. jniThrowRuntimeException(env, "Cannot construct native SensorEventQueue.");
10. return 0;
11. }
12.
13. sp<MessageQueue> messageQueue = android_os_MessageQueue_getMessageQueue(env, msgQ);
14. if (messageQueue == NULL) {
15. jniThrowRuntimeException(env, "MessageQueue is not initialized.");
16. return 0;
17. }
18. // eventQWeak爲其調用對象BaseEventQueue的this指針
19. sp<Receiver> receiver = new Receiver(queue, messageQueue, eventQWeak);
20. receiver->incStrong((void*)nativeInitSensorEventQueue);
21. return jlong(receiver.get());
22. }
將類BaseEventQueue構造函數傳進來的。。。這邊還通過回調createEventQueue（）
，android_os_MessageQueue_getMessageQueue（）初始化了2個指針queue，messageQueue ，
先看看到底receiver->getSensorEventQueue()->enableSensor()
的getSensorEventQueue()到底返回的是個什麼東西，再去看那個東西的enableSensor()方法，
看名字估計是返回個SensorEventQueue類型的指針吧，也就是上面初始化
sp<SensorEventQueue> queue(mgr->createEventQueue(clientName, mode))的queue指針，並且後來不是傳進去給Receiver的構造函數了嘛。
接下來驗證一下，看Revceiver類：
1. sp<SensorEventQueue> getSensorEventQueue() const {
2. return mSensorQueue;
3. }
而mSensorQueue在構造函數裏邊初始化爲：
1. Receiver(const sp<SensorEventQueue>& sensorQueue,
2. const sp<MessageQueue>& messageQueue,
3. jobject receiverWeak) {
4. JNIEnv* env = AndroidRuntime::getJNIEnv();
5. mSensorQueue = sensorQueue;
6. mMessageQueue = messageQueue;
7. mReceiverWeakGlobal = env->NewGlobalRef(receiverWeak);
8.
9. mIntScratch = (jintArray) env->NewGlobalRef(env->NewIntArray(16));
10. mFloatScratch = (jfloatArray) env->NewGlobalRef(env->NewFloatArray(16));
11. }
也確實就是前邊傳進來的queue沒錯，
接下來就去搞懂queue->enableSensor()到底怎麼搞的，
在類SensorEventQueue中，看其enableSensor（）方法，
1. status_t SensorEventQueue::enableSensor(int32_t handle, int32_t samplingPeriodUs,
2. int64_t maxBatchReportLatencyUs, int reservedFlags) const {
3. return mSensorEventConnection->enableDisable(handle, true, us2ns(samplingPeriodUs),
4. us2ns(maxBatchReportLatencyUs), reservedFlags);
5. }
即調用了mSensorEventConnection的enableDisable()方法，去看看mSensorEventConnection是個什麼東西，定義爲，
1. sp<ISensorEventConnection> mSensorEventConnection; 使用，看看在哪兒被初始化的，在構造函數裏邊被初始化，
1. SensorEventQueue::SensorEventQueue(const sp<ISensorEventConnection>& connection)
2. : mSensorEventConnection(connection), mRecBuffer(NULL), mAvailable(0), mConsumed(0),
3. mNumAcksToSend(0) {
4. mRecBuffer = new ASensorEvent[MAX_RECEIVE_BUFFER_EVENT_COUNT];
5. }
那麼connection就是在前面nativeInitSensorEventQueue（）函數裏邊初始化queue傳進去的mgr->createEventQueue(clientName, mode)了，
也就是說，mgr->createEventQueue(clientName, mode)返回一個ISensorEventConnection類型指針，然後在nativeEnableSensor（）函數裏邊會通過
receiver->getSensorEventQueue()->enableSensor()最終去調用它的enableDisable()方法，
接下來需要看2個東西，一個是mgr爲java裏邊的SensorManager.Instance,
該Instance其實是通過jni調用c++裏邊的SensorManager創建一個SensorManager對象後返回，如下，
1. static jlong
2. nativeCreate
3. (JNIEnv *env, jclass clazz, jstring opPackageName)
4. {
5. ScopedUtfChars opPackageNameUtf(env, opPackageName);
6. return (jlong) &SensorManager::getInstanceForPackage(String16(opPackageNameUtf.c_str()));
7. }
在/android/frameworks/native/libs/sensor/SensorManager.cpp裏邊，如下，截取部分代碼，
1. SensorManager& SensorManager::getInstanceForPackage(const String16& packageName) {
2.
3. SensorManager* sensorManager;
4. a
5. sensorManager = new SensorManager(opPackageName);
6.
7.
8. return *sensorManager;
9. }
所以mgr->createEventQueue(clientName, mode)就是調用c++裏邊的SensorManager裏邊的createEventQueue（）方法，看看該方法做了什麼，其實顧名思義就是創建了一個EventQueue對象並返回嘛，代碼如下：
位置爲：android/frameworks/native/libs/sensor/SensorManager.cpp
1. sp<SensorEventQueue> SensorManager::createEventQueue(String8 packageName, int mode) {
2. sp<SensorEventQueue> queue;
3.
4. Mutex::Autolock _l(mLock);
5. while (assertStateLocked() == NO_ERROR) {
6. sp<ISensorEventConnection> connection =
7. mSensorServer->createSensorEventConnection(packageName, mode, mOpPackageName);
8. if (connection == NULL) {
9. // SensorService just died or the app doesn't have required permissions.
10. ALOGE("createEventQueue: connection is NULL.");
11. return NULL;
12. }
13. queue = new SensorEventQueue(connection);
14. break;
15. }
16. return queue;
17. }
到了這邊就有點清楚了，
一個·SensorEventQueue對象（queue），通過一個ISensorEventConnection對其進行初始化，然後將其（queue）返回給調用者，所以前邊queue->enableSensor()：
tatus_t SensorEventQueue::enableSensor(int32_t handle, int32_t samplingPeriodUs,
2. int64_t maxBatchReportLatencyUs, int reservedFlags) const {
3. return mSensorEventConnection->enableDisable(handle, true, us2ns(samplingPeriodUs),
4. us2ns(maxBatchReportLatencyUs), reservedFlags);
5. }
裏邊的
mSensorEventConnection->enableDisable()即爲在
sp<SensorEventQueue> SensorManager::createEventQueue(String8 packageName, int mode)
裏邊創建的一個ISensorEventConnection 指針指向的ISensorEventConnection子類對象的enableDisable（）方法。
接下來先看該ISensorEventConnection的enableDisable方法，
1. virtual status_t enableDisable(int handle, bool enabled, nsecs_t samplingPeriodNs,
2. nsecs_t maxBatchReportLatencyNs, int reservedFlags) = 0;
爲純虛函數，所以實現在其子類，所以需要搞清楚
1， 還有mSensorServer是個什麼東西，
Ans：SensorService
2， mSensorServer->createSensorEventConnection（）返回的是個什麼對象，
Ans:返回一個SensorEventConnection的對象
mSensorServer爲
sp<ISensorServer> mSensorServer;
所以看類ISensorServer的createSensorEventConnection（）方法，
在android/ frameworks\native\libs\sensor/ ISensorServer.cpp裏邊
1. virtual sp<ISensorEventConnection> createSensorEventConnection(const String8& packageName,
2. int mode, const String16& opPackageName)
3. {
4. Parcel data, reply;
5. data.writeInterfaceToken(ISensorServer::getInterfaceDescriptor());
6. data.writeString8(packageName);
7. data.writeInt32(mode);
8. data.writeString16(opPackageName);
9. remote()->transact(CREATE_SENSOR_EVENT_CONNECTION, data, &reply);
10. return interface_cast<ISensorEventConnection>(reply.readStrongBinder());
11. }
繼續看：
1. tatus_t BnSensorServer::onTransact(
2. uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
3. {
4. switch(code) {
5. //省略其他無關代碼
6. case CREATE_SENSOR_EVENT_CONNECTION: {
7. CHECK_INTERFACE(ISensorServer, data, reply);
8. String8 packageName = data.readString8();
9. int32_t mode = data.readInt32();
10. const String16& opPackageName = data.readString16();
11. sp<ISensorEventConnection> connection(createSensorEventConnection(packageName, mode,
12. opPackageName));
13. reply->writeStrongBinder(IInterface::asBinder(connection));
14. return NO_ERROR;
15. }
16. //省略其他無關代碼
17. }
18. return BBinder::onTransact(code, data, reply, flags);
19. }
此時就調用到SensorService裏邊了，
4，SensorService
1. p<ISensorEventConnection> SensorService::createSensorEventConnection(const String8& packageName,
2. int requestedMode, const String16& opPackageName) {
3.
4.
5.
6. sp<SensorEventConnection> result(new SensorEventConnection(this, uid, packageName,
7. requestedMode == DATA_INJECTION, opPackageName));
8. if (requestedMode == DATA_INJECTION) {
9. if (mActiveConnections.indexOf(result) < 0) {
10. mActiveConnections.add(result);
11. }
12. // Add the associated file descriptor to the Looper for polling whenever there is data to
13. // be injected.
14. result->updateLooperRegistration(mLooper);
15. }
16. return result;
17. }
即new 一個SensorEventConnection對象存放在result指針裏邊並返回。
所以到這兒就有點清楚了，前邊的 mSensorEventConnection->enableDisable（）
其實就是調用類SensorEventConnection的enableDisable（）方法，
位置爲：android/ frameworks\native\services\sensorservice/ SensorEventConnection.cpp
如下：
1. status_t SensorService::SensorEventConnection::enableDisable(
2. int handle, bool enabled, nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs,
3. int reservedFlags)
4. {
5. status_t err;
6. if (enabled) {
7. err = mService->enable(this, handle, samplingPeriodNs, maxBatchReportLatencyNs,
8. reservedFlags, mOpPackageName);
9.
10. } else {
11. err = mService->disable(this, handle);
12. }
13. return err;
14. }
看一下mService是個啥東西，
sp<SensorService> const mService;看SensorEventConnection構造函數：
1. SensorService::SensorEventConnection::SensorEventConnection(
2. const sp<SensorService>& service, uid_t uid, String8 packageName, bool isDataInjectionMode,
3. const String16& opPackageName)
4. : mService(service), mUid(uid), mWakeLockRefCount(0), mHasLooperCallbacks(false),
5. mDead(false), mDataInjectionMode(isDataInjectionMode), mEventCache(NULL),
6. mCacheSize(0), mMaxCacheSize(0), mPackageName(packageName), mOpPackageName(opPackageName) {
7. mChannel = new BitTube(mService->mSocketBufferSize);
8. #if DEBUG_CONNECTIONS
9. mEventsReceived = mEventsSentFromCache = mEventsSent = 0;
10. mTotalAcksNeeded = mTotalAcksReceived = 0;
11. #endif
12. }
即創建SensorEventConnection時傳進來的一個SensorService對象地址，、
所以也就是調用SensorService::enable(),
接下來看SensorService的enable（）方法，如下截取片段：
status_t SensorService::enable(const sp<SensorEventConnection>& connection,
int handle, nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs, int reservedFlags,
const String16& opPackageName) {
/......
//獲取各個類型的hal層的sensor實例，這邊是在SensorService:onFirsRef()註冊的
sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
if (err == NO_ERROR) {
ALOGD_IF(DEBUG_CONNECTIONS, "Calling activate on %d", handle);
//here active這邊是調hal
err = sensor->activate(connection.get(), true);
// 調用SensorDevice::activate
}//......
return err;
}這邊獲取到前面在SensorService::onFirsRef()註冊的實例後，調用SensorDevice::activate(),
在這裏邊就會調用hal層的activate(),
sp<android::hardware::sensors::V1_0::ISensors> mSensors;
mSensors->activate(handle, enabled);
mSensors是在SensorDevice的構造函數裏邊通過hidl獲取到hal層的一個android::hardware::sensors::V1_0::ISensors 類型的對象，該對象定義在hal層裏邊，之後就可以使用該對象通過hidl協議去調用hal層的服務了
接下去hal層怎麼走，日後分析。