通信架构

在这里插入图片描述

应用层实现

涉及代码：

framework/base/core/java/android/hardware/SensorManager.java
framework/base/core/java/android/hardware/SystemSensorManager.java
framework/base/core/java/android/hardware/SensorEvent.java

使用方式

应用层主要使用fwk提供的SensorManager 来监听获取指定传感器的数据，主要实现如下，
回调的参数SensorEvent是一个包含传感器参数与当前值的数据结构，不同的传感器数据均从其values的float数组中获取值，如光感传感器的值只有一个就是values[0], 陀螺仪有三个值就是values[0],values[1],values[2]等。

import android.hardware.Sensor
import android.hardware.SensorEvent
import android.hardware.SensorEventListener
import android.hardware.SensorManager

val sm = getSystemService(Context.SENSOR_SERVICE) as SensorManager
sm.registerListener(object : SensorEventListener{
    override fun onSensorChanged(event: SensorEvent?) {
         val x = event?.values?.get(0)
         val y = event?.values?.get(1)
         val z = event?.values?.get(2)
    }
    override fun onAccuracyChanged(sensor: Sensor?, accuracy: Int) {
         //传感器精度回调
    }
}, sm.getDefaultSensor(Sensor.TYPE_ACCELEROMETER), 
									SensorManager.SENSOR_DELAY_NORMAL)

SensorManager抽象接口具体实现

SensorManager是一个抽象函数，部分抽象函数的具体的功能实现是在SystemSensorManager类中，其构造函数主要做的工作依次如下：

- 初始化jni接口 
- 创建一个SensorManager的native层实例
- 检查当前进程是否具备高速传输传感器数据的权限  
- 初始化本机的sensor设备列表

 public SystemSensorManager(Context context, Looper mainLooper) {
        synchronized (sLock) {
            if (!sNativeClassInited) {
                sNativeClassInited = true;
                //初始化jni接口 
                nativeClassInit();
            }
        }

        mMainLooper = mainLooper;
        ApplicationInfo appInfo = context.getApplicationInfo();
        mTargetSdkLevel = appInfo.targetSdkVersion;
        mContext = context;
        //创建一个SensorManager的native层实例
        mNativeInstance = nativeCreate(context.getOpPackageName());
        mIsPackageDebuggable = (0 != (appInfo.flags & ApplicationInfo.FLAG_DEBUGGABLE));
        PackageManager packageManager = context.getPackageManager();
        //检查当前进程是否具备高速传输传感器数据的权限 
        mHasHighSamplingRateSensorsPermission =
                (PERMISSION_GRANTED == packageManager.checkPermission(
                        HIGH_SAMPLING_RATE_SENSORS_PERMISSION,
                        appInfo.packageName));

        // initialize the sensor list
        for (int index = 0;; ++index) {
            Sensor sensor = new Sensor();
            //初始化本机的sensor设备列表
            if (!nativeGetSensorAtIndex(mNativeInstance, sensor, index)) break;
            mFullSensorsList.add(sensor);
            mHandleToSensor.put(sensor.getHandle(), sensor);
        }
    }

每个app在通过getSystemService获取class类型为SensorManager的对象时，获取的都是SystemSensorManager对象，实例的初始化在SystemServiceRegistry的静态域中初始化，代码如下：

registerService(Context.SENSOR_SERVICE, SensorManager.class,
                new CachedServiceFetcher<SensorManager>() {
     @Override
     public SensorManager createService(ContextImpl ctx) {
         Return new SystemSensorManager(ctx.getOuterContext(),
     ctx.mMainThread.getHandler().getLooper());
}});

再跟一下监听函数registerListener，最终会走到SystemSensorManager的registerListenerImpl函数中，实现功能如下：

- 检查注册参数是否符合要求
- 获取监听器实例的所有事件队列
      -> 如果队列为空   
           1.创建新的队列实例
           2.队列实例中加入当前监听的Sensor对象
           3.将事件队列加入到监听器的HashMap中对应保存
      -> 如果队列不为空
           1.队列实例中加入当前监听的Sensor对象

实现代码如下：

// Invariants to preserve:
// - one Looper per SensorEventListener
// - one Looper per SensorEventQueue
// We map SensorEventListener to a SensorEventQueue, which holds the looper
synchronized (mSensorListeners) {
    SensorEventQueue queue = mSensorListeners.get(listener);
    if (queue == null) {
        Looper looper = (handler != null) ? handler.getLooper() : mMainLooper;
        final String fullClassName =listener.getClass().getEnclosingClass() != null
                            ? listener.getClass().getEnclosingClass().getName()
                            : listener.getClass().getName();
        queue = new SensorEventQueue(listener, looper, this, fullClassName);
        if (!queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs)) {
              queue.dispose();
              return false;
        }
        mSensorListeners.put(listener, queue);
        return true;
    } else {
        return queue.addSensor(sensor, delayUs, maxBatchReportLatencyUs);
    }
}

SensorEventQueue 是定义在SystemSensorManager.java文件中的一个静态内部类，其父类类型为BaseEventQueue，BaseEventQueue中定义了enableSensor, 在app注册了监听器后，BaseEventQueue会调用nativeEnableSensor去激活该Sensor. SensorEventQueue中还实现了dispatchSensorEvent函数，当底层上报数据的时候，JNI层会回调该函数，将数据传给listener实例。

 protected void dispatchSensorEvent(int handle, float[] values, int inAccuracy,
                long timestamp) {
            final Sensor sensor = mManager.mHandleToSensor.get(handle);
            if (sensor == null) {
                // sensor disconnected
                return;
            }

            SensorEvent t = null;
            synchronized (mSensorsEvents) {
                t = mSensorsEvents.get(handle);
            }

            if (t == null) {
                // This may happen if the client has unregistered and there are pending events in
                // the queue waiting to be delivered. Ignore.
                return;
            }
            // Copy from the values array.
            System.arraycopy(values, 0, t.values, 0, t.values.length);
            t.timestamp = timestamp;
            t.accuracy = inAccuracy;
            t.sensor = sensor;

            // call onAccuracyChanged() only if the value changes
            final int accuracy = mSensorAccuracies.get(handle);
            if ((t.accuracy >= 0) && (accuracy != t.accuracy)) {
                mSensorAccuracies.put(handle, t.accuracy);
                mListener.onAccuracyChanged(t.sensor, t.accuracy);
            }
            mListener.onSensorChanged(t);
        }

fwk层的实现

涉及代码如下：

frameworks/base/core/jni/android_hardware_SensorManager.cpp
frameworks/native/libs/sensor/*
frameworks/native/services/sensorservice/*

SensorManager的jni实现，定义在android_hardware_SensorManager.cpp这个文件中，这里不全部介绍每个本地函数的功能，只挑几个重要的

native中的SensorManager的初始化流程

android_hardware_SensorManager.cpp

//初始化native层SensorManager
static jlong
nativeCreate(JNIEnv *env, jclass clazz, jstring opPackageName)
{
    ScopedUtfChars opPackageNameUtf(env, opPackageName);
    return (jlong) &SensorManager::getInstanceForPackage(String16(opPackageNameUtf.c_str()));
}

SensorManager.cpp文件路径在frameworks/native/libs/sensor文件夹下，该库编译后生成libsensor.so给到libandroid_server.so依赖，该库是一个通信中间件，实现了Sensor数据的同一进程内unix域通信，以及通过binder通信来实现部分Sensor的设置项实现。Sensor的jni类就是靠引入该库的头文件来实现与Sensor Service通信的。

获取SensorManager实例

frameworks/native/libs/sensor/SensorManager.cpp

SensorManager& SensorManager::getInstanceForPackage(const String16& packageName) {
    waitForSensorService(nullptr);

    Mutex::Autolock _l(sLock);
    SensorManager* sensorManager;
    //sPackageInstances是一个map数据结构，key是const String16，value是SensorManager指针
    auto iterator = sPackageInstances.find(packageName);
    //如果这个包已经获取过SensorManager，直接把返回该实例的指针
    if (iterator != sPackageInstances.end()) {
        sensorManager = iterator->second;
    } else {
        String16 opPackageName = packageName;
         //权限检测，判断当前调用的包名是不是有权限访问sensor
        if (opPackageName.size() <= 0) {
            sp<IBinder> binder = defaultServiceManager()->getService(String16("permission"));
            if (binder != nullptr) {
                const uid_t uid = IPCThreadState::self()->getCallingUid();
                Vector<String16> packages;
                interface_cast<IPermissionController>(binder)->getPackagesForUid(uid, packages);
                if (!packages.isEmpty()) {
                    opPackageName = packages[0];
                } else {
                    ALOGE("No packages for calling UID");
                }
            } else {
                ALOGE("Cannot get permission service");
            }
        }
        //创建一个新的SensorManager对象
        sensorManager = new SensorManager(opPackageName);

        // If we had no package name, we looked it up from the UID and the sensor
        // manager instance we created should also be mapped to the empty package
        // name, to avoid looking up the packages for a UID and get the same result.
        if (packageName.size() <= 0) {
            sPackageInstances.insert(std::make_pair(String16(), sensorManager));
        }

        // Stash the per package sensor manager.
        sPackageInstances.insert(std::make_pair(opPackageName, sensorManager));
    }

    return *sensorManager;
}

native中的消息队列初始化与数据读取

在这里插入图片描述
上图包括了一个native中消息队列创建的完整流程，在之前讲过registerListener的数据主要来自SensorEventQueue的dispatchSensorEvent, 这个java层的方法回调是由JNI实现中的Receiver函数来触发的，Receiver是LooperCallback的子类，实际可以看成Handler的Native样式，这个函数的dispatchEvent中会一直循环从native层的SensorEventQueue中去read数据，read函数的实现在libsensor.so库中的BitTube.cpp实现，因为sensorservice与sensor jni均运行在system_server进程内，故这里数据的读写使用unix同进程内的域通信来实现的。具体的通信实现可以看BitTube.cpp这个文件。

sensorservice实现

上面一节分析完了，Sensor数据是在jni中的Receiver中通过JNI反射java层函数，调用Java层的SensorEventQueue中的dispatchSensorEvent函数发给各个app的， Receiver通过libsensor.so不断从server端去read数据，这里Receiver可以看作是一个客户端，那么服务端的实现就是sensorservice, 其实现在frameworks/native/services/sensorservice下，这个服务的作用就是起到承上启下的作用，对上作为aidl的BnBinder端供BpBinder调用，作为Socket的Server端，往Client端写数据；对下，则是作为一个hidl的client端，通过调用hal层的sensor服务接口，来联通上下层。其主要流程如下：


 - threadLoop函数中循环通过SensorDevice去poll数据，并通过SensorEventConnect的sendEvents发送到jni函数的Receiver中
 - SensorDevice.cpp 顾名思义就是传感器设备，该类实现了HIDL的接口，并通过hidl与hal层实现数据的poll以及设置的接口调用，列表的初始化等。
 - SensorEventConnection.cpp是一个事件处理通道，保持了与client进行unix域通信的双句柄，通过调用SensorEventQueue的write函数实现将sensor数据发送到client端（JNI中的Receiver类）。

threadLoop函数poll数据的实现：

SensorService.cpp

bool SensorService::threadLoop() {
    ALOGD("nuSensorService thread starting...");
    ...
    ...
    //SensorDevice是单例模式的
    SensorDevice& device(SensorDevice::getInstance());
    //获取hal层版本
    const int halVersion = device.getHalDeviceVersion();
    do {
        //poll数据
        ssize_t count = device.poll(mSensorEventBuffer, numEventMax);
        if (count < 0) {
            if(count == DEAD_OBJECT && device.isReconnecting()) {
                device.reconnect();
                continue;
            } else {
                ALOGE("sensor poll failed (%s)", strerror(-count));
                break;
            }
        }

        // Reset sensors_event_t.flags to zero for all events in the buffer.
        for (int i = 0; i < count; i++) {
             mSensorEventBuffer[i].flags = 0;
        }
        
        //省略了很多代码

	    //将数据发送到所有通道
        for (const sp<SensorEventConnection>& connection : activeConnections) {
            //发送数据
            connection->sendEvents(mSensorEventBuffer, count, mSensorEventScratch,
                    mMapFlushEventsToConnections);
            needsWakeLock |= connection->needsWakeLock();
            // If the connection has one-shot sensors, it may be cleaned up after first trigger.
            // Early check for one-shot sensors.
            if (connection->hasOneShotSensors()) {
                cleanupAutoDisabledSensorLocked(connection, mSensorEventBuffer, count);
            }
        }
    }while (!Thread::exitPending());
}

SensorDevice的poll功能实现

ssize_t SensorDevice::poll(sensors_event_t* buffer, size_t count) {
    if (mSensors == nullptr) return NO_INIT;

    ssize_t eventsRead = 0;
    if (mSensors->supportsMessageQueues()) {
        eventsRead = pollFmq(buffer, count);//从mSensors的消息队列读值
    } else if (mSensors->supportsPolling()) {
        eventsRead = pollHal(buffer, count); //调用mSensors的poll函数取值
    } else {
        ALOGE("Must support polling or FMQ");
        eventsRead = -1;
    }
    return eventsRead;
}

mSensors变量类型定义如下：

sp<::android::hardware::sensors::V2_1::implementation::ISensorsWrapperBase> mSensors;

这个类型是由hidl生成的，定义在hardware/interfaces/sensors/2.1/default下，厂商自定义实现该功能。

SensorEventConnection sendEvents的实现

SensorEventConnection.cpp

status_t SensorService::SensorEventConnection::sendEvents(
        sensors_event_t const* buffer, size_t numEvents,
        sensors_event_t* scratch,
        wp<const SensorEventConnection> const * mapFlushEventsToConnections) 
        //... 省略很多代码
       ssize_t size = SensorEventQueue::write(mChannel,
                                    reinterpret_cast<ASensorEvent const*>(scratch), count);
	 //... 省略很多代码
}

SensorEventQueue实现在libsensor.so里面，write函数就是调用了内部的网络通信封装的类BitTube.cpp来实现写入。

HAL层的实现

hal层的实现基本上每个厂商的实现都不一样，这里只跟了一下原生的，涉及到的源码如下：

hardware/libhardware/include/hardware/sensors.h
hardware/libhardware/include/hardware/sensors-base.h
hardware/interfaces/sensors/*

sensors.h定义了sensor的各类数据结构，如sensor的数据格式，sensor对应hal层的module，sensor device格式，以及实现了动态管理客制化的sensor hal实现的库或者驱动的接口。

/** convenience API for opening and closing a device */
static inline int sensors_open(const struct hw_module_t* module,
        struct sensors_poll_device_t** device) {
    return module->methods->open(module,
            SENSORS_HARDWARE_POLL, TO_HW_DEVICE_T_OPEN(device));
}

static inline int sensors_close(struct sensors_poll_device_t* device) {
    return device->common.close(&device->common);
}

static inline int sensors_open_1(const struct hw_module_t* module,
        sensors_poll_device_1_t** device) {
    return module->methods->open(module,
            SENSORS_HARDWARE_POLL, TO_HW_DEVICE_T_OPEN(device));
}

static inline int sensors_close_1(sensors_poll_device_1_t* device) {
    return device->common.close(&device->common);
}

sensors-base.h则定义了SENSOR设备类型的值。

hardware/interfaces/sensors/1.0/default/Sensors.cpp中实现了对sensor module的load,以及设备的加载。

Sensors::Sensors()
    : mInitCheck(NO_INIT),
      mSensorModule(nullptr),
      mSensorDevice(nullptr) {
    status_t err = OK;
    if (UseMultiHal()) {
        mSensorModule = ::get_multi_hal_module_info();
    } else {
        //hal层动态加载module的so库， hw_get_module的实现在hardware/libhardware/hardware.c中，是要是动过dlopen动态加载so库。
        err = hw_get_module(
            SENSORS_HARDWARE_MODULE_ID,
            (hw_module_t const **)&mSensorModule);
    }
    if (mSensorModule == NULL) {
        err = UNKNOWN_ERROR;
    }

    if (err != OK) {
        LOG(ERROR) << "Couldn't load "
                   << SENSORS_HARDWARE_MODULE_ID
                   << " module ("
                   << strerror(-err)
                   << ")";

        mInitCheck = err;
        return;
    }
    //从module涨获取到sensor设备，后续的操作都需要mSensorDevice才能与真实的硬件设备通讯
    err = sensors_open_1(&mSensorModule->common, &mSensorDevice);