SensorService在SystemServer进程中启动。

/frameworks/base/ervices/java/com/android/server/SystemServer.java

private void startBootstrapServices() {  
   ...  
   startSensorService();  
}  

  startSensorService是一个native函数，其具体实现在com_android_server_SystemServer.cpp的android_server_SystemServer_startSensorService函数中。

/frameworks/base/services/core/jni/com_android_server_SystemServer.cpp

static void android_server_SystemServer_startSensorService(JNIEnv* /* env */, jobject /* clazz */) {  
    char propBuf[PROPERTY_VALUE_MAX];  
    property_get("system_init.startsensorservice", propBuf, "1");  
    if (strcmp(propBuf, "1") == 0) {  
        // Start the sensor service  
        SensorService::instantiate();  
    }  
}  

  SensorService::instantiate()的instantiate函数定义在BinderService.h中，目的在于向ServiceManager注册SensorService组件。new SERVICE()参数的传入最终结果是创建SensorService的一个强引用。

/frameworks/native/include/binder/BinderService.h

static void instantiate() { publish(); } 

/frameworks/native/include/binder/BinderService.h

static status_t publish(bool allowIsolated = false) {  
        sp<IServiceManager> sm(defaultServiceManager());  
        return sm->addService(  
                String16(SERVICE::getServiceName()),  
                new SERVICE(), allowIsolated);  
}  

  onFirstRef函数是RefBase的一个空实现,SensorService继承自RefBase,onFirstRef在第一次被强指针引用时调用,首先是获得一个SensorDevice单例对象。

/frameworks/native/services/sensorservice/SensorService.cpp

void SensorService::onFirstRef()  
{  
    ALOGD("nuSensorService starting...");  
    SensorDevice& dev(SensorDevice::getInstance()); 
    ...
}

  看看SensorDevice的默认构造函数：

/frameworks/native/services/sensorservice/SensorDevice.cpp

SensorDevice::SensorDevice()  
    :  mSensorDevice(0),  
       mSensorModule(0)  
{  
    status_t err = hw_get_module(SENSORS_HARDWARE_MODULE_ID,  
            (hw_module_t const**)&mSensorModule);  

    ALOGE_IF(err, "couldn't load %s module (%s)",  
            SENSORS_HARDWARE_MODULE_ID, strerror(-err));  

    if (mSensorModule) {  
        err = sensors_open_1(&mSensorModule->common, &mSensorDevice);  

        ALOGE_IF(err, "couldn't open device for module %s (%s)",  
                SENSORS_HARDWARE_MODULE_ID, strerror(-err));  

        if (mSensorDevice) {  
            if (mSensorDevice->common.version == SENSORS_DEVICE_API_VERSION_1_1 ||  
                mSensorDevice->common.version == SENSORS_DEVICE_API_VERSION_1_2) {  
                ALOGE(">>>> WARNING <<< Upgrade sensor HAL to version 1_3");  
            }  

            sensor_t const* list;  
            ssize_t count = mSensorModule->get_sensors_list(mSensorModule, &list);  
            mActivationCount.setCapacity(count);  
            Info model;  
            for (size_t i=0 ; i<size_t(count) ; i++) {  
                mActivationCount.add(list[i].handle, model);  
                mSensorDevice->activate(  
                        reinterpret_cast<struct sensors_poll_device_t *>(mSensorDevice),  
                        list[i].handle, 0);  
            }  
        }  
    }  
}  

  hw_get_module是jni层获取HAL层module的接口函数，原型为hareware.c中的:int hw_get_module(const char *id, const struct hw_module_t **module)，第一个参数为硬件模块的id,第二个参数指向硬件模块对应的hw_module_t结构体地址。

/hardware/libhardware/hardware.c

int hw_get_module(const char *id, const struct hw_module_t **module)
{
    return hw_get_module_by_class(id, NULL, module);
}

/hardware/libhardware/hardware.c

int hw_get_module_by_class(const char *class_id, const char *inst,
                           const struct hw_module_t **module)
{
    int i = 0;
    char prop[PATH_MAX] = {
   0};
    char path[PATH_MAX] = {
   0};
    char name[PATH_MAX] = {
   0};
    char prop_name[PATH_MAX] = {
   0};


    if (inst)
        snprintf(name, PATH_MAX, "%s.%s", class_id, inst);
    else
        strlcpy(name, class_id, PATH_MAX);//class_id拷贝到name

    /*
     * Here we rely on the fact that calling dlopen multiple times on
     * the same .so will simply increment a refcount (and not load
     * a new copy of the library).
     * We also assume that dlopen() is thread-safe.
     */

    /* First try a property specific to the class and possibly instance */
    //prop_name为ro.hardware.(name),SensorService传下来的class_id为sensors,则prop_name为ro.hardware.sensors
    snprintf(prop_name, sizeof(prop_name), "ro.hardware.%s", name);
    //获取prop_name的属性值，保存在prop中
    if (property_get(prop_name, prop, NULL) > 0) {
    //输出固定的文件名格式到path中
        if (hw_module_exists(path, sizeof(path), name, prop) == 0) {
   //
            goto found;
        }
    }

    /* Loop through the configuration variants looking for a module */
    for (i=0 ; i<HAL_VARIANT_KEYS_COUNT; i++) {
        if (property_get(variant_keys[i], prop, NULL) == 0) {
            continue;
        }
        if (hw_module_exists(path, sizeof(path), name, prop) == 0) {
            goto found;
        }
    }

    /* Nothing found, try the default */
    if (hw_module_exists(path, sizeof(path), name, "default") == 0) {
        goto found;
    }

    return -ENOENT;

found:
    /* load the module, if this fails, we're doomed, and we should not try
     * to load a different variant. */
    return load(class_id, path, module);
}

/hardware/libhardware/hardware.c

//紧接上面，32位下生成/vendor/lib/hw.sensors.属性值.so或/system/lib/hw.sensors.属性值.so,64位下生成/vendor/lib64/hw.sensors.属性值.so或/system/lib64/hw.sensors.属性值.so
static int hw_module_exists(char *path, size_t path_len, const char *name,
                            const char *subname)
{
    snprintf(path, path_len, "%s/%s.%s.so",
             HAL_LIBRARY_PATH2, name, subname);
    if (access(path, R_OK) == 0)
        return 0;

    snprintf(path, path_len, "%s/%s.%s.so",
             HAL_LIBRARY_PATH1, name, subname);
    if (access(path, R_OK) == 0)
        return 0;

    return -ENOENT;
}

/hardware/libhardware/hardware.c

//尝试去加载上面路径的so文件
static int load(const char *id,
        const char *path,
        const struct hw_module_t **pHmi)
{
    int status = -EINVAL;
    void *handle = NULL;
    struct hw_module_t *hmi = NULL;

    /*
     * load the symbols resolving undefined symbols before
     * dlopen returns. Since RTLD_GLOBAL is not or'd in with
     * RTLD_NOW the external symbols will not be global
     */
    //dlopen以暂缓决定模式打开指定的动态连接库文件，并返回一个句柄给调用进程
    handle = dlopen(path, RTLD_NOW);
    if (handle == NULL) {
        char const *err_str = dlerror();
        ALOGE("load: module=%s\n%s", path, err_str?err_str:"unknown");
        status = -EINVAL;
        goto done;
    }

    /* Get the address of the struct hal_module_info. */
    //dlsym通过句柄和连接符名称获取函数名或者变量名，返回符号的地址
    const char *sym = HAL_MODULE_INFO_SYM_AS_STR;
    hmi = (struct hw_module_t *)dlsym(handle, sym);
    if (hmi == NULL) {
        ALOGE("load: couldn't find symbol %s", sym);
        status = -EINVAL;
        goto done;
    }

    /* Check that the id matches */
    if (strcmp(id, hmi->id) != 0) {
        ALOGE("load: id=%s != hmi->id=%s", id, hmi->id);
        status = -EINVAL;
        goto done;
    }

    hmi->dso = handle;

    /* success */
    status = 0;

    done:
    if (status != 0) {
        hmi = NULL;
        if (handle != NULL) {
            dlclose(handle);
            handle = NULL;
        }
    } else {
        ALOGV("loaded HAL id=%s path=%s hmi=%p handle=%p",
                id, path, *pHmi, handle);
    }

    *pHmi = hmi;

    return status;
}

  硬件抽象层模块中总会定义一个HAL_MODULE_INFO_SYM_AS_STR的符号，HAL_MODULE_INFO_SYM_AS_STR在宏定义中被定义为“HMI”,在这里HAL_MODULE_INFO_SYM_AS_STR是struct sensors_module_t的变量，struct sensors_module_t第一个成员common为struct hw_module_t类型。因为common成员和HAL_MODULE_INFO_SYM_AS_STR首地址相同，所以load函数末尾可以安全地将第二个参数的地址指向这个符号的地址。所以SensorDevice中类型为struct sensors_module_t*的mSensorModule成员指向了HAL_MODULE_INFO_SYM_AS_STR符号的地址。

/hardware/libhardware/include/hardware/sensors.h

struct sensors_module_t {
    struct hw_module_t common;

    /**
     * Enumerate all available sensors. The list is returned in "list".
     * @return number of sensors in the list
     */
    int (*get_sensors_list)(struct sensors_module_t* module,
            struct sensor_t const** list);

    /**
     *  Place the module in a specific mode. The following modes are defined
     *
     *  0 - Normal operation. Default state of the module.
     *  1 - Loopback mode. Data is injected for the the supported
     *      sensors by the sensor service in this mode.
     * @return 0 on success
     *         -EINVAL if requested mode is not supported
     *         -EPERM if operation is not allowed
     */
    int (*set_operation_mode)(unsigned int mode);
};

  此时，sensor模块的so已加载完成。回到SensorDevice的构造函数中，接着调用sensors_open_1函数打开sensor设备。sensors_open_1没有在SensorDevice.cpp中实现，而是在HAL层实现。

/frameworks/native/services/sensorservice/SensorDevice.cpp

...
if (mSensorModule) {
        err = sensors_open_1(&mSensorModule->common, &mSensorDevice);
        ...

/hardware/libhardware/include/hardware/sensors.h

static inline int sensors_open_1(const struct hw_module_t* module,
        sensors_poll_device_1_t** device) {
    return module->methods->open(module,
            SENSORS_HARDWARE_POLL, (struct hw_device_t**)device);
}

  该函数接收sensors_module_t的common成员的指针(struct hw_module_t*类型）作为第一个参数，调用参数的struct hw_module_methods_t*类型的methods成员的唯一函数指针成员，即open函数。其中，SENSORS_HARDWARE_POLL在宏定义被定义为“poll”。

/hardware/libhardware/include/hardware/hardware.h

typedef struct hw_module_t {
    /** tag must be initialized to HARDWARE_MODULE_TAG */
    uint32_t tag;

    /**
     * The API version of the implemented module. The module owner is
     * responsible for updating the version when a module interface has
     * changed.
     *
     * The derived modules such as gralloc and audio own and manage this field.
     * The module user must interpret the version field to decide whether or
     * not to inter-operate with the supplied module implementation.
     * For example, SurfaceFlinger is responsible for making sure that
     * it knows how to manage different versions of the gralloc-module API,
     * and AudioFlinger must know how to do the same for audio-module API.
     *
     * The module API version should include a major and a minor component.
     * For example, version 1.0 could be represented as 0x0100. This format
     * implies that versions 0x0100-0x01ff are all API-compatible.
     *
     * In the future, libhardware will expose a hw_get_module_version()
     * (or equivalent) function that will take minimum/maximum supported
     * versions as arguments and would be able to reject modules with
     * versions outside of the supplied range.
     */
    uint16_t module_api_version;
#define version_major module_api_version
    /**
     * version_major/version_minor defines are supplied here for temporary
     * source code compatibility. They will be removed in the next version.
     * ALL clients must convert to the new version format.
     */

    /**
     * The API version of the HAL module interface. This is meant to
     * version the hw_module_t, hw_module_methods_t, and hw_device_t
     * structures and definitions.
     *
     * The HAL interface owns this field. Module users/implementations
     * must NOT rely on this value for version information.
     *
     * Presently, 0 is the only valid value.
     */
    uint16_t hal_api_version;
#define version_minor hal_api_version

    /** Identifier of module */
    const char *id;

    /** Name of this module */
    const char *name;

    /** Author/owner/implementor of the module */
    const char *author;

    /** Modules methods */
    struct hw_module_methods_t* methods;

    /** module's dso */
    void* dso;

#ifdef __LP64__
    uint64_t reserved[32-7];
#else
    /** padding to 128 bytes, reserved for future use */
    uint32_t reserved[32-7];
#endif

} hw_module_t;

/hardware/libhardware/include/hardware/hardware.h

typedef struct hw_module_methods_t {
    /** Open a specific device */
    int (*open)(const struct hw_module_t* module, const char* id,
            struct hw_device_t** device);

} hw_module_methods_t;

  sensors.h为我们提供了HAL层的接口，实现部分则在sensors.c或sensors.cpp完成。sensors.cpp定义了一个hw_module_methods_t类型的变量sensors_module_methods，并且指定open函数的实现为open_sensors函数。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static struct hw_module_methods_t sensors_module_methods = {
        .open = open_sensors
};

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static int open_sensors(const struct hw_module_t* module, const char* id,
                        struct hw_device_t** device)
{
    UNUSE(id);

    LOGD("open_sensors()");
    int status = -EINVAL;
    sensors_poll_context_t *dev = new sensors_poll_context_t();

    if (!dev->isValid()) {
        ALOGE("Failed to open the sensors");
        return status;
    }

    memset(&dev->device, 0, sizeof(sensors_poll_device_t));

    dev->device.common.tag = HARDWARE_DEVICE_TAG;
    dev->device.common.version  = SENSORS_DEVICE_API_VERSION_1_0;
    dev->device.common.module   = const_cast<hw_module_t*>(module);
    dev->device.common.close    = poll__close;
    dev->device.activate        = poll__activate;
    dev->device.setDelay        = poll__setDelay;
    dev->device.poll            = poll__poll;

    *device = &dev->device.common;
    status = 0;

    return status;
}

  open_sensors函数首先new了一个sensors_poll_context_t对象。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

struct sensors_poll_context_t {
    struct sensors_poll_device_t device; // must be first

    sensors_poll_context_t();
    ~sensors_poll_context_t();
    int activate(int handle, int enabled);
    int setDelay(int handle, int64_t ns);
    int setDelay_sub(int handle, int64_t ns);
    int pollEvents(sensors_event_t* data, int count);

private:
    enum {
        acc          = 0,
        akm          = 1,
        numSensorDrivers,
        numFds,
    };

    static const size_t wake = numFds - 1;
    static const char WAKE_MESSAGE = 'W';
    struct pollfd mPollFds[numFds];
    int mWritePipeFd;
    SensorBase* mSensors[numSensorDrivers];

    /* These function will be different depends on
     * which sensor is implemented in AKMD program.
     */
    int handleToDriver(int handle);
    int proxy_enable(int handle, int enabled);
    int proxy_setDelay(int handle, int64_t ns);
};

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

sensors_poll_context_t::sensors_poll_context_t()
{
#ifdef SENSORHAL_ACC_ADXL346
    mSensors[acc] = new AdxlSensor();
#endif
#ifdef SENSORHAL_ACC_KXTF9
    mSensors[acc] = new KionixSensor();
#endif
    mPollFds[acc].fd = mSensors[acc]->getFd();
    mPollFds[acc].events = POLLIN;
    mPollFds[acc].revents = 0;

    mSensors[akm] = new AkmSensor();
    mPollFds[akm].fd = mSensors[akm]->getFd();
    mPollFds[akm].events = POLLIN;
    mPollFds[akm].revents = 0;

    int wakeFds[2];
    int result = pipe(wakeFds);
    ALOGE_IF(result<0, "error creating wake pipe (%s)", strerror(errno));
    fcntl(wakeFds[0], F_SETFL, O_NONBLOCK);
    fcntl(wakeFds[1], F_SETFL, O_NONBLOCK);
    mWritePipeFd = wakeFds[1];

    mPollFds[wake].fd = wakeFds[0];
    mPollFds[wake].events = POLLIN;
    mPollFds[wake].revents = 0;
}

  sensors_poll_context_t的构造函数主要工作是使用poll监听AdxlSensor，KionixSensor和创建的管道读端的POLLIN事件。
  回到open_sensors函数，接着对sensors_poll_context_t的成员作初始化。sensors_poll_context_t的首个成员为sensors_poll_device_t，而sensors_poll_device_t的首个成员是hw_device_t，这三个类型的变量首地址是相同的，所以它们的指针可以相互安全地进行转换。最后把传下来的第二个指针参数指向已被初始化的hw_device_t成员地址。
  hw_get_module和sensors_open_1这两个函数保存了HAL层对应的hw_module_t类型和hw_device_t类型的指针。再次返回SenosrDevice的构造函数，接下来用get_sensors_list去获取sensor的列表。

/frameworks/native/services/sensorservice/SensorDevice.cpp

...
sensor_t const* list;
ssize_t count = mSensorModule->get_sensors_list(mSensorModule, &list);
mActivationCount.setCapacity(count);
...

  同样地，get_sensors_list方法的设置出现在HMI符号中，然后调到sensors__get_sensors_list方法，最后获取到struct sensor_t数组，并使传下来的第二个参数指向该数组的地址，其中sensor_t的作用是记录sensor的信息参数，一个sensor设备对应一个sensor_t结构体。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

struct sensors_module_t HAL_MODULE_INFO_SYM = {
        .common = {
                .tag = HARDWARE_MODULE_TAG,
                .version_major = 1,
                .version_minor = 0,
                .id = SENSORS_HARDWARE_MODULE_ID,
                .name = "AKM Sensor module",
                .author = "Asahi Kasei Microdevices",
                .methods = &sensors_module_methods,
                .dso  = NULL,
                .reserved = {
   0},
        },
        .get_sensors_list = sensors__get_sensors_list,
};

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static int sensors__get_sensors_list(struct sensors_module_t* module,
                                     struct sensor_t const** list)
{
        *list = sSensorList;
        return ARRAY_SIZE(sSensorList);
}

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static const struct sensor_t sSensorList[] = {
        { "AK8975 3-axis Magnetic field sensor",
          "Asahi Kasei Microdevices",
          1,
          SENSORS_MAGNETIC_FIELD_HANDLE,
          SENSOR_TYPE_MAGNETIC_FIELD, 1228.8f,
          CONVERT_M, 0.35f, 10000, 0, 0, 0, 0, 0, 0, { } },
#ifdef SENSORHAL_ACC_ADXL346
        { "Analog Devices ADXL345/6 3-axis Accelerometer",
          "ADI",
          1, SENSORS_ACCELERATION_HANDLE,
          SENSOR_TYPE_ACCELEROMETER, (GRAVITY_EARTH * 16.0f),
          (GRAVITY_EARTH * 16.0f) / 4096.0f, 0.145f, 10000, 0, 0, 0, 0, 0, 0, { } },
        { "AK8975 Orientation sensor",
          "Asahi Kasei Microdevices",
          1, SENSORS_ORIENTATION_HANDLE,
          SENSOR_TYPE_ORIENTATION, 360.0f,
          CONVERT_O, 0.495f, 10000, 0, 0, 0, 0, 0, 0, { } }
#endif
#ifdef SENSORHAL_ACC_KXTF9
        { "Kionix KXTF9 3-axis Accelerometer",
          "Kionix",
          1, SENSORS_ACCELERATION_HANDLE,
          SENSOR_TYPE_ACCELEROMETER, (GRAVITY_EARTH * 2.0f),
          (GRAVITY_EARTH) / 1024.0f, 0.7f, 10000, 0, 0, 0, 0, 0, 0, { } },
        { "AK8975 Orientation sensor",
          "Asahi Kasei Microdevices",
          1, SENSORS_ORIENTATION_HANDLE,
          SENSOR_TYPE_ORIENTATION, 360.0f,
          CONVERT_O, 1.05f, 10000, 0, 0, 0, 0, 0, 0, { } }
#endif
};

  回到SensorDevice的构造函数中，最后一步是使用activate方法对上面sensor列表的sensor进行激活。同理，activate方法最终会调到sensors_poll_context_t::activate方法。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static int poll__activate(struct sensors_poll_device_t *dev,
        int handle, int enabled) {
    sensors_poll_context_t *ctx = (sensors_poll_context_t *)dev;
    return ctx->activate(handle, enabled);
}

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

int sensors_poll_context_t::activate(int handle, int enabled) {
    int drv = handleToDriver(handle);
    int err;

    switch (handle) {
        case ID_A:
        case ID_M:
            /* No dependencies */
            break;

        case ID_O:
            /* These sensors depend on ID_A and ID_M */
            mSensors[handleToDriver(ID_A)]->setEnable(ID_A, enabled);
            mSensors[handleToDriver(ID_M)]->setEnable(ID_M, enabled);
            break;

        default:
            return -EINVAL;
    }
    err = mSensors[drv]->setEnable(handle, enabled);

    if (enabled && !err) {
        const char wakeMessage(WAKE_MESSAGE);
        int result = write(mWritePipeFd, &wakeMessage, 1);
        ALOGE_IF(result<0, "error sending wake message (%s)", strerror(errno));
    }
    return err;
}

  下面以AdxlSensor为例进行说明：
  如果AdxlSensor没有被激活且enabled参数为1，只将mEnables加1。
  如果AdxlSensor已经被首次激活了，则往/sys/class/input/(input_name)/device/device/disable中写入“1”，将mEnable减1。注意到这里传下来的enabled参数为0，AdxlSensor构造函数中把mEnabled初始化为0，也就是说SensorDevice初始化时不会将相关Sensor使能，要使Sensor使能，需要应用层调到native层使能。

/hardware/akm/AK8975_FS/libsensors/AdxlSensor.cpp

int AdxlSensor::setEnable(int32_t handle, int enabled) {
    int err = 0;
    char buffer[2];

    /* handle check */
    if (handle != ID_A) {
        ALOGE("AdxlSensor: Invalid handle (%d)", handle);
        return -EINVAL;
    }

    buffer[0] = '\0';
    buffer[1] = '\0';

    if (mEnabled <= 0) {
        if(enabled) buffer[0] = '0';
    } else if (mEnabled == 1) {
        if(!enabled) buffer[0] = '1';
    }
    if (buffer[0] != '\0') {
        strcpy(&input_sysfs_path[input_sysfs_path_len], "disable");
        err = write_sys_attribute(input_sysfs_path, buffer, 1);
        if (err != 0) {
            return err;
        }
        ALOGD("AdxlSensor: Control set %s", buffer);
        setInitialState();
    }

    if (enabled) {
        mEnabled++;
        if (mEnabled > 32767) mEnabled = 32767;
    } else {
        mEnabled--;
        if (mEnabled < 0) mEnabled = 0;
    }
    ALOGD("AdxlSensor: mEnabled = %d", mEnabled);

    return err;
}

  AdxlSensor传给SensorBase构造函数的两个参数分别是NULL, ADXL_DATA_NAME，在宏定义被定义为”ADXL34x accelerometer”。之后调用openInput(ADXL_DATA_NAME)打开输入设备。

/hardware/akm/AK8975_FS/libsensors/SensorBase.cpp

SensorBase::SensorBase(
        const char* dev_name,
        const char* data_name)
    : dev_name(dev_name), data_name(data_name),
      dev_fd(-1), data_fd(-1)
{
    if (data_name) {
        data_fd = openInput(data_name);
    }
}

  openInput函数在/dev/input目录下查找设备名称。Linux内核提供了一个Input子系统，Input子系统会在/dev/input/路径下创建我们硬件输入设备的节点，一般情况下在我们的手机中这些节点是以eventXX来命名的，如event0，event1等等，可以利用EVIOCGNAME获取此事件结点名称。open(devname, O_RDONLY)打开了设备节点，strcpy(input_name, filename)将设备名拷贝到input_name中。
/hardware/akm/AK8975_FS/libsensors/SensorBase.cpp

int SensorBase::openInput(const char* inputName) {
    int fd = -1;
    const char *dirname = "/dev/input";
    char devname[PATH_MAX];
    char *filename;
    DIR *dir;
    struct dirent *de;
    dir = opendir(dirname);
    if(dir == NULL)
        return -1;
    strcpy(devname, dirname);
    filename = devname + strlen(devname);
    *filename++ = '/';
    while((de = readdir(dir))) {
        if(de->d_name[0] == '.' &&
                (de->d_name[1] == '\0' ||
                        (de->d_name[1] == '.' && de->d_name[2] == '\0')))
            continue;
        strcpy(filename, de->d_name);
        fd = open(devname, O_RDONLY);
        if (fd>=0) {
            char name[80];
            if (ioctl(fd, EVIOCGNAME(sizeof(name) - 1), &name) < 1) {
                name[0] = '\0';
            }
            if (!strcmp(name, inputName)) {
                strcpy(input_name, filename);
                break;
            } else {
                close(fd);
                fd = -1;
            }
        }
    }
    closedir(dir);
    ALOGE_IF(fd<0, "couldn't find '%s' input device", inputName);
    return fd;
}

  这样，SensorDevice的构造函数便介绍完毕。
  回到SensorService的onFirstRef函数，SensorService继承自Thread,函数末尾调用run进入threadLoop方法。

/frameworks/native/services/sensorservice/SensorService.cpp

...
run("SensorService", PRIORITY_URGENT_DISPLAY);
...

  threadLoop方法中调用了SensorDevice::poll方法，mSensorEventBuffer是一个struct sensors_event_t数组。每个传感器的数据都由struct sensors_event_t表示。

/frameworks/native/services/sensorservice/SensorService.cpp

...
do {
        ssize_t count = device.poll(mSensorEventBuffer, numEventMax);
        if (count < 0) {
            ALOGE("sensor poll failed (%s)", strerror(-count));
            break;
        }
...

/hardware/libhardware/include/hardware/sensors.h

typedef struct sensors_event_t {
    /* must be sizeof(struct sensors_event_t) */
    int32_t version;

    /* sensor identifier */
    int32_t sensor;

    /* sensor type */
    int32_t type;

    /* reserved */
    int32_t reserved0;

    /* time is in nanosecond */
    int64_t timestamp;

    union {
        union {
            float           data[16];

            /* acceleration values are in meter per second per second (m/s^2) */
            sensors_vec_t   acceleration;

            /* magnetic vector values are in micro-Tesla (uT) */
            sensors_vec_t   magnetic;

            /* orientation values are in degrees */
            sensors_vec_t   orientation;

            /* gyroscope values are in rad/s */
            sensors_vec_t   gyro;

            /* temperature is in degrees centigrade (Celsius) */
            float           temperature;

            /* distance in centimeters */
            float           distance;

            /* light in SI lux units */
            float           light;

            /* pressure in hectopascal (hPa) */
            float           pressure;

            /* relative humidity in percent */
            float           relative_humidity;

            /* uncalibrated gyroscope values are in rad/s */
            uncalibrated_event_t uncalibrated_gyro;

            /* uncalibrated magnetometer values are in micro-Teslas */
            uncalibrated_event_t uncalibrated_magnetic;

            /* heart rate data containing value in bpm and status */
            heart_rate_event_t heart_rate;

            /* this is a special event. see SENSOR_TYPE_META_DATA above.
             * sensors_meta_data_event_t events are all reported with a type of
             * SENSOR_TYPE_META_DATA. The handle is ignored and must be zero.
             */
            meta_data_event_t meta_data;
        };

        union {
            uint64_t        data[8];

            /* step-counter */
            uint64_t        step_counter;
        } u64;
    };

    /* Reserved flags for internal use. Set to zero. */
    uint32_t flags;

    uint32_t reserved1[3];
} sensors_event_t;

  SensorDevice::poll函数最终会调到sensors_poll_context_t::pollEvents函数。

/frameworks/native/services/sensorservice/SensorDevice.cpp

ssize_t SensorDevice::poll(sensors_event_t* buffer, size_t count) {
    if (!mSensorDevice) return NO_INIT;
    ssize_t c;
    do {
        c = mSensorDevice->poll(reinterpret_cast<struct sensors_poll_device_t *> (mSensorDevice),
                                buffer, count);
    } while (c == -EINTR);
    return c;
}

  如果前面监听的Sensor描述符（AdxlSensor和KionixSensor）发生了POLLIN事件或者有未处理的事件，则调用readEvents去处理这些事件。readEvents返回值nb为读得的事件数量，count为传回上层的事件容量，data记录了sensors_event_t结构体数组的当前保存位置。每次读出事件后，都会对这三个变量作处理。
  如果还有剩余容量（count>0),则会抓住最后机会使用poll争取获得事件，nbEvents记录了每次进入pollEvents读到的事件总数量。若nbEvents大于0，poll的时间参数为0，表示立即返回；若nbEvents等于0，poll的时间参数为-1，表示一直阻塞到读取到事件。若此时有线程从管道唤醒poll,则会对唤醒事件作处理（实质就是使 mPollFds[wake]的revents恢复默认值）。若poll成功读取到事件且还有剩余容量，则再次进入pollEvents的主循环。
  第一次进入pollEvents函数时，由于还没有poll，mPollFds中的所有Sensor的fd都不会有变化，所以会阻塞在poll调用中，直到Sensor发生了事件或者有线程从管道将其唤醒。之后再次进入主循环调用readEvents读取Sensor事件（如果Sensor发生POLLIN事件的话），count没有满的情况下，然后再次进入poll函数，这样一直循环下去，直到poll没有事件返回且没有事件容量才会退出循环。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

int sensors_poll_context_t::pollEvents(sensors_event_t* data, int count)
{
    int nbEvents = 0;
    int n = 0;

    do {
        // see if we have some leftover from the last poll()
        for (int i=0 ; count && i<numSensorDrivers ; i++) {
            SensorBase* const sensor(mSensors[i]);
            if ((mPollFds[i].revents & POLLIN) || (sensor->hasPendingEvents())) {
                int nb = sensor->readEvents(data, count);
                if (nb < count) {
                    // no more data for this sensor
                    mPollFds[i].revents = 0;
                }
                if ((0 != nb) && (acc == i)) {
                    ((AkmSensor*)(mSensors[akm]))->setAccel(&data[nb-1]);
                }
                count -= nb;
                nbEvents += nb;
                data += nb;
            }
        }

        if (count) {
            // we still have some room, so try to see if we can get
            // some events immediately or just wait if we don't have
            // anything to return
            n = poll(mPollFds, numFds, nbEvents ? 0 : -1);
            if (n<0) {
                ALOGE("poll() failed (%s)", strerror(errno));
                return -errno;
            }
            if (mPollFds[wake].revents & POLLIN) {
                char msg;
                int result = read(mPollFds[wake].fd, &msg, 1);
                ALOGE_IF(result<0, "error reading from wake pipe (%s)", strerror(errno));
                ALOGE_IF(msg != WAKE_MESSAGE, "unknown message on wake queue (0x%02x)", int(msg));
                mPollFds[wake].revents = 0;
            }
        }
        // if we have events and space, go read them
    } while (n && count);

    return nbEvents;
}

  readEvents中如果有未处理事件，则将sensors_event_t类型的未处理事件指针保存在第一个参数中。mInputReader类型为class InputEventCircularReader，是用来填充struct input_event输入事件的环形缓冲区。data_fd为openInput的返回值，即打开的输入设备的fd。AdxlSensor的构造函数将4传给InputEventCircularReader构造函数参数，mBuffer初始化为8个input_event大小的内存，以暂存读取超出环形缓冲区的部分。mBufferEnd指向环形缓冲的末尾，mHead记录了下次填充input_event的位置，mCurr记录了最后一个填充的input_event的位置，mFreeSpace记录了空闲的input_event大小的内存块数量。fill函数从输入设备中读取input_event事件到环形缓冲区中，当读取的大小超过缓冲区大小时，会将超出部分覆盖到缓冲区起始部分。
  while循环里读取mCurr记录的input_event的类型来执行操作，循环的条件是环形缓冲区还有数据可以读且需要读取事件的余量count大于0。AdxlSensor是一个加速度传感器，读取的事件类型为EV_ABS，可以用来判断手机屏幕的方向。x轴，y轴是以屏幕左下角为原点向右和向上的方向，z轴是垂直于屏幕指向屏幕外面的方向。在一个时刻，只有一个轴读取到加速度值。使用ADXL_UNIT_CONVERSION宏将内核层读到的重力加速度值转化为标准单位重力加速度值。在三轴上计算得到的数据用以初始化一个mPendingEvent。读取事件类型为EV_SYN时（EV_SYN是用于事件间的分割标志。事件可能按时间或空间进行分割，就像在多点触摸协议中的例子），设定mPendingEvent的时间戳为输入事件发生的时间，将mPendingEvent指针保存在data参数中。这样，readEvents函数将底层传上来的input_event填充到入参data中。SensorService便保存了来自底层的input_event包装而成的sensors_event_t事件。readEvents的返回值就是保存到data参数中的
input_event数量。
  值得注意的是，readEvents的入参data是对sensors_poll_context_t::pollEvents的入参data指针值的拷贝，readEvents中能改变data指向的数组的内容，但不能改变指针的指向的位置。所以，当readEvents函数返回了读取的事件数时，sensors_poll_context_t::pollEvents的入参data表示的数组内容已经改变，指向的位置和调用readEvents前的位置相同。

/hardware/akm/AK8975_FS/libsensors/AdxlSensor.cpp

int AdxlSensor::readEvents(sensors_event_t* data, int count)
{
    if (count < 1)
        return -EINVAL;

    if (mHasPendingEvent) {
        mHasPendingEvent = false;
        mPendingEvent.timestamp = getTimestamp();
        *data = mPendingEvent;
        return mEnabled ? 1 : 0;
    }

    ssize_t n = mInputReader.fill(data_fd);
    if (n < 0)
        return n;

    int numEventReceived = 0;
    input_event const* event;

    while (count && mInputReader.readEvent(&event)) {
        int type = event->type;
        if (type == EV_ABS) {
            float value = event->value;
            if (event->code == EVENT_TYPE_ACCEL_X) {
                mPendingEvent.acceleration.x = ADXL_UNIT_CONVERSION(value);
            } else if (event->code == EVENT_TYPE_ACCEL_Y) {
                mPendingEvent.acceleration.y = ADXL_UNIT_CONVERSION(value);
            } else if (event->code == EVENT_TYPE_ACCEL_Z) {
                mPendingEvent.acceleration.z = ADXL_UNIT_CONVERSION(value);
            }
        } else if (type == EV_SYN) {
            mPendingEvent.timestamp = timevalToNano(event->time);
            if (mEnabled) {
                *data++ = mPendingEvent;
                count--;
                numEventReceived++;
            }
        } else {
            ALOGE("AdxlSensor: unknown event (type=%d, code=%d)",
                    type, event->code);
        }
        mInputReader.next();
    }

    return numEventReceived;
}

/hardware/akm/AK8975_FS/libsensors/InputEventReader.h

class InputEventCircularReader
{
    struct input_event* const mBuffer;
    struct input_event* const mBufferEnd;
    struct input_event* mHead;
    struct input_event* mCurr;
    ssize_t mFreeSpace;

public:
    InputEventCircularReader(size_t numEvents);
    ~InputEventCircularReader();
    ssize_t fill(int fd);
    ssize_t readEvent(input_event const** events);
    void next();
};

/hardware/akm/AK8975_FS/libsensors/InputEventReader.h

InputEventCircularReader::InputEventCircularReader(size_t numEvents)
    : mBuffer(new input_event[numEvents * 2]),
      mBufferEnd(mBuffer + numEvents),
      mHead(mBuffer),
      mCurr(mBuffer),
      mFreeSpace(numEvents)
{
}

/hardware/akm/AK8975_FS/libsensors/InputEventReader.cpp

ssize_t InputEventCircularReader::fill(int fd)
{
    size_t numEventsRead = 0;
    if (mFreeSpace) {
        const ssize_t nread = read(fd, mHead, mFreeSpace * sizeof(input_event));
        if (nread<0 || nread % sizeof(input_event)) {
            // we got a partial event!!
            return nread<0 ? -errno : -EINVAL;
        }

        numEventsRead = nread / sizeof(input_event);
        if (numEventsRead) {
            mHead += numEventsRead;
            mFreeSpace -= numEventsRead;
            if (mHead > mBufferEnd) {
                size_t s = mHead - mBufferEnd;
                memcpy(mBuffer, mBufferEnd, s * sizeof(input_event));
                mHead = mBuffer + s;
            }
        }
    }

    return numEventsRead;
}

/bionic/libc/kernel/uapi/linux

struct input_event {
  //按键时间
  struct timeval time;
  //类型
  __u16 type;
  //模拟成的按键
  __u16 code;
  //按下还是释放
  __s32 value;
};

  至此，Android Sensor的HAL层代码大致分析完毕。