Android Sensor HAL层分析

   SensorService在SystemServer进程中启动。

/frameworks/base/ervices/java/com/android/server/SystemServer.java

private void startBootstrapServices() {     ...     startSensorService();  }  

  startSensorService是一个native函数，其具体实现在com_android_server_SystemServer.cpp的android_server_SystemServer_startSensorService函数中。

/frameworks/base/services/core/jni/com_android_server_SystemServer.cpp

static void android_server_SystemServer_startSensorService(JNIEnv* /* env */, jobject /* clazz */) {      char propBuf[PROPERTY_VALUE_MAX];      property_get("system_init.startsensorservice", propBuf, "1");      if (strcmp(propBuf, "1") == 0) {          // Start the sensor service          SensorService::instantiate();      }  }  

  SensorService::instantiate()的instantiate函数定义在BinderService.h中，目的在于向ServiceManager注册SensorService组件。new SERVICE()参数的传入最终结果是创建SensorService的一个强引用。

/frameworks/native/include/binder/BinderService.h

static void instantiate() { publish(); } 

/frameworks/native/include/binder/BinderService.h

static status_t publish(bool allowIsolated = false) {          sp<IServiceManager> sm(defaultServiceManager());          return sm->addService(                  String16(SERVICE::getServiceName()),                  new SERVICE(), allowIsolated);  }  

  onFirstRef函数是RefBase的一个空实现,SensorService继承自RefBase,onFirstRef在第一次被强指针引用时调用,首先是获得一个SensorDevice单例对象。

/frameworks/native/services/sensorservice/SensorService.cpp

void SensorService::onFirstRef()  {      ALOGD("nuSensorService starting...");      SensorDevice& dev(SensorDevice::getInstance());     ...}

  看看SensorDevice的默认构造函数：

/frameworks/native/services/sensorservice/SensorDevice.cpp

SensorDevice::SensorDevice()      :  mSensorDevice(0),         mSensorModule(0)  {      status_t err = hw_get_module(SENSORS_HARDWARE_MODULE_ID,              (hw_module_t const**)&mSensorModule);      ALOGE_IF(err, "couldn't load %s module (%s)",              SENSORS_HARDWARE_MODULE_ID, strerror(-err));      if (mSensorModule) {          err = sensors_open_1(&mSensorModule->common, &mSensorDevice);          ALOGE_IF(err, "couldn't open device for module %s (%s)",                  SENSORS_HARDWARE_MODULE_ID, strerror(-err));          if (mSensorDevice) {              if (mSensorDevice->common.version == SENSORS_DEVICE_API_VERSION_1_1 ||                  mSensorDevice->common.version == SENSORS_DEVICE_API_VERSION_1_2) {                  ALOGE(">>>> WARNING <<< Upgrade sensor HAL to version 1_3");              }              sensor_t const* list;              ssize_t count = mSensorModule->get_sensors_list(mSensorModule, &list);              mActivationCount.setCapacity(count);              Info model;              for (size_t i=0 ; i<size_t(count) ; i++) {                  mActivationCount.add(list[i].handle, model);                  mSensorDevice->activate(                          reinterpret_cast<struct sensors_poll_device_t *>(mSensorDevice),                          list[i].handle, 0);              }          }      }  }  

  hw_get_module是jni层获取HAL层module的接口函数，原型为hareware.c中的:int hw_get_module(const char *id, const struct hw_module_t **module)，第一个参数为硬件模块的id,第二个参数指向硬件模块对应的hw_module_t结构体地址。

/hardware/libhardware/hardware.c

int hw_get_module(const char *id, const struct hw_module_t **module){    return hw_get_module_by_class(id, NULL, module);}

/hardware/libhardware/hardware.c

int hw_get_module_by_class(const char *class_id, const char *inst,                           const struct hw_module_t **module){    int i = 0;    char prop[PATH_MAX] = {0};    char path[PATH_MAX] = {0};    char name[PATH_MAX] = {0};    char prop_name[PATH_MAX] = {0};    if (inst)        snprintf(name, PATH_MAX, "%s.%s", class_id, inst);    else        strlcpy(name, class_id, PATH_MAX);//class_id拷贝到name    /*     * Here we rely on the fact that calling dlopen multiple times on     * the same .so will simply increment a refcount (and not load     * a new copy of the library).     * We also assume that dlopen() is thread-safe.     */    /* First try a property specific to the class and possibly instance */    //prop_name为ro.hardware.(name),SensorService传下来的class_id为sensors,则prop_name为ro.hardware.sensors    snprintf(prop_name, sizeof(prop_name), "ro.hardware.%s", name);    //获取prop_name的属性值，保存在prop中    if (property_get(prop_name, prop, NULL) > 0) {    //输出固定的文件名格式到path中        if (hw_module_exists(path, sizeof(path), name, prop) == 0) {//            goto found;        }    }    /* Loop through the configuration variants looking for a module */    for (i=0 ; i<HAL_VARIANT_KEYS_COUNT; i++) {        if (property_get(variant_keys[i], prop, NULL) == 0) {            continue;        }        if (hw_module_exists(path, sizeof(path), name, prop) == 0) {            goto found;        }    }    /* Nothing found, try the default */    if (hw_module_exists(path, sizeof(path), name, "default") == 0) {        goto found;    }    return -ENOENT;found:    /* load the module, if this fails, we're doomed, and we should not try     * to load a different variant. */    return load(class_id, path, module);}

/hardware/libhardware/hardware.c

//紧接上面，32位下生成/vendor/lib/hw.sensors.属性值.so或/system/lib/hw.sensors.属性值.so,64位下生成/vendor/lib64/hw.sensors.属性值.so或/system/lib64/hw.sensors.属性值.sostatic int hw_module_exists(char *path, size_t path_len, const char *name,                            const char *subname){    snprintf(path, path_len, "%s/%s.%s.so",             HAL_LIBRARY_PATH2, name, subname);    if (access(path, R_OK) == 0)        return 0;    snprintf(path, path_len, "%s/%s.%s.so",             HAL_LIBRARY_PATH1, name, subname);    if (access(path, R_OK) == 0)        return 0;    return -ENOENT;}

/hardware/libhardware/hardware.c

//尝试去加载上面路径的so文件static int load(const char *id,        const char *path,        const struct hw_module_t **pHmi){    int status = -EINVAL;    void *handle = NULL;    struct hw_module_t *hmi = NULL;    /*     * load the symbols resolving undefined symbols before     * dlopen returns. Since RTLD_GLOBAL is not or'd in with     * RTLD_NOW the external symbols will not be global     */    //dlopen以暂缓决定模式打开指定的动态连接库文件，并返回一个句柄给调用进程    handle = dlopen(path, RTLD_NOW);    if (handle == NULL) {        char const *err_str = dlerror();        ALOGE("load: module=%s\n%s", path, err_str?err_str:"unknown");        status = -EINVAL;        goto done;    }    /* Get the address of the struct hal_module_info. */    //dlsym通过句柄和连接符名称获取函数名或者变量名，返回符号的地址    const char *sym = HAL_MODULE_INFO_SYM_AS_STR;    hmi = (struct hw_module_t *)dlsym(handle, sym);    if (hmi == NULL) {        ALOGE("load: couldn't find symbol %s", sym);        status = -EINVAL;        goto done;    }    /* Check that the id matches */    if (strcmp(id, hmi->id) != 0) {        ALOGE("load: id=%s != hmi->id=%s", id, hmi->id);        status = -EINVAL;        goto done;    }    hmi->dso = handle;    /* success */    status = 0;    done:    if (status != 0) {        hmi = NULL;        if (handle != NULL) {            dlclose(handle);            handle = NULL;        }    } else {        ALOGV("loaded HAL id=%s path=%s hmi=%p handle=%p",                id, path, *pHmi, handle);    }    *pHmi = hmi;    return status;}

  硬件抽象层模块中总会定义一个HAL_MODULE_INFO_SYM_AS_STR的符号，HAL_MODULE_INFO_SYM_AS_STR在宏定义中被定义为“HMI”,在这里HAL_MODULE_INFO_SYM_AS_STR是struct sensors_module_t的变量，struct sensors_module_t第一个成员common为struct hw_module_t类型。因为common成员和HAL_MODULE_INFO_SYM_AS_STR首地址相同，所以load函数末尾可以安全地将第二个参数的地址指向这个符号的地址。所以SensorDevice中类型为struct sensors_module_t*的mSensorModule成员指向了HAL_MODULE_INFO_SYM_AS_STR符号的地址。

/hardware/libhardware/include/hardware/sensors.h

struct sensors_module_t {    struct hw_module_t common;    /**     * Enumerate all available sensors. The list is returned in "list".     * @return number of sensors in the list     */    int (*get_sensors_list)(struct sensors_module_t* module,            struct sensor_t const** list);    /**     *  Place the module in a specific mode. The following modes are defined     *     *  0 - Normal operation. Default state of the module.     *  1 - Loopback mode. Data is injected for the the supported     *      sensors by the sensor service in this mode.     * @return 0 on success     *         -EINVAL if requested mode is not supported     *         -EPERM if operation is not allowed     */    int (*set_operation_mode)(unsigned int mode);};

  此时，sensor模块的so已加载完成。回到SensorDevice的构造函数中，接着调用sensors_open_1函数打开sensor设备。sensors_open_1没有在SensorDevice.cpp中实现，而是在HAL层实现。

/frameworks/native/services/sensorservice/SensorDevice.cpp

...if (mSensorModule) {        err = sensors_open_1(&mSensorModule->common, &mSensorDevice);        ...

/hardware/libhardware/include/hardware/sensors.h

static inline int sensors_open_1(const struct hw_module_t* module,        sensors_poll_device_1_t** device) {    return module->methods->open(module,            SENSORS_HARDWARE_POLL, (struct hw_device_t**)device);}

  该函数接收sensors_module_t的common成员的指针(struct hw_module_t*类型）作为第一个参数，调用参数的struct hw_module_methods_t*类型的methods成员的唯一函数指针成员，即open函数。其中，SENSORS_HARDWARE_POLL在宏定义被定义为“poll”。

/hardware/libhardware/include/hardware/hardware.h

typedef struct hw_module_t {    /** tag must be initialized to HARDWARE_MODULE_TAG */    uint32_t tag;    /**     * The API version of the implemented module. The module owner is     * responsible for updating the version when a module interface has     * changed.     *     * The derived modules such as gralloc and audio own and manage this field.     * The module user must interpret the version field to decide whether or     * not to inter-operate with the supplied module implementation.     * For example, SurfaceFlinger is responsible for making sure that     * it knows how to manage different versions of the gralloc-module API,     * and AudioFlinger must know how to do the same for audio-module API.     *     * The module API version should include a major and a minor component.     * For example, version 1.0 could be represented as 0x0100. This format     * implies that versions 0x0100-0x01ff are all API-compatible.     *     * In the future, libhardware will expose a hw_get_module_version()     * (or equivalent) function that will take minimum/maximum supported     * versions as arguments and would be able to reject modules with     * versions outside of the supplied range.     */    uint16_t module_api_version;#define version_major module_api_version    /**     * version_major/version_minor defines are supplied here for temporary     * source code compatibility. They will be removed in the next version.     * ALL clients must convert to the new version format.     */    /**     * The API version of the HAL module interface. This is meant to     * version the hw_module_t, hw_module_methods_t, and hw_device_t     * structures and definitions.     *     * The HAL interface owns this field. Module users/implementations     * must NOT rely on this value for version information.     *     * Presently, 0 is the only valid value.     */    uint16_t hal_api_version;#define version_minor hal_api_version    /** Identifier of module */    const char *id;    /** Name of this module */    const char *name;    /** Author/owner/implementor of the module */    const char *author;    /** Modules methods */    struct hw_module_methods_t* methods;    /** module's dso */    void* dso;#ifdef __LP64__    uint64_t reserved[32-7];#else    /** padding to 128 bytes, reserved for future use */    uint32_t reserved[32-7];#endif} hw_module_t;

/hardware/libhardware/include/hardware/hardware.h

typedef struct hw_module_methods_t {    /** Open a specific device */    int (*open)(const struct hw_module_t* module, const char* id,            struct hw_device_t** device);} hw_module_methods_t;

  sensors.h为我们提供了HAL层的接口，实现部分则在sensors.c或sensors.cpp完成。sensors.cpp定义了一个hw_module_methods_t类型的变量sensors_module_methods，并且指定open函数的实现为open_sensors函数。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static struct hw_module_methods_t sensors_module_methods = {        .open = open_sensors};

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static int open_sensors(const struct hw_module_t* module, const char* id,                        struct hw_device_t** device){    UNUSE(id);    LOGD("open_sensors()");    int status = -EINVAL;    sensors_poll_context_t *dev = new sensors_poll_context_t();    if (!dev->isValid()) {        ALOGE("Failed to open the sensors");        return status;    }    memset(&dev->device, 0, sizeof(sensors_poll_device_t));    dev->device.common.tag = HARDWARE_DEVICE_TAG;    dev->device.common.version  = SENSORS_DEVICE_API_VERSION_1_0;    dev->device.common.module   = const_cast<hw_module_t*>(module);    dev->device.common.close    = poll__close;    dev->device.activate        = poll__activate;    dev->device.setDelay        = poll__setDelay;    dev->device.poll            = poll__poll;    *device = &dev->device.common;    status = 0;    return status;}

  open_sensors函数首先new了一个sensors_poll_context_t对象。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

struct sensors_poll_context_t {    struct sensors_poll_device_t device; // must be first    sensors_poll_context_t();    ~sensors_poll_context_t();    int activate(int handle, int enabled);    int setDelay(int handle, int64_t ns);    int setDelay_sub(int handle, int64_t ns);    int pollEvents(sensors_event_t* data, int count);private:    enum {        acc          = 0,        akm          = 1,        numSensorDrivers,        numFds,    };    static const size_t wake = numFds - 1;    static const char WAKE_MESSAGE = 'W';    struct pollfd mPollFds[numFds];    int mWritePipeFd;    SensorBase* mSensors[numSensorDrivers];    /* These function will be different depends on     * which sensor is implemented in AKMD program.     */    int handleToDriver(int handle);    int proxy_enable(int handle, int enabled);    int proxy_setDelay(int handle, int64_t ns);};

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

sensors_poll_context_t::sensors_poll_context_t(){#ifdef SENSORHAL_ACC_ADXL346    mSensors[acc] = new AdxlSensor();#endif#ifdef SENSORHAL_ACC_KXTF9    mSensors[acc] = new KionixSensor();#endif    mPollFds[acc].fd = mSensors[acc]->getFd();    mPollFds[acc].events = POLLIN;    mPollFds[acc].revents = 0;    mSensors[akm] = new AkmSensor();    mPollFds[akm].fd = mSensors[akm]->getFd();    mPollFds[akm].events = POLLIN;    mPollFds[akm].revents = 0;    int wakeFds[2];    int result = pipe(wakeFds);    ALOGE_IF(result<0, "error creating wake pipe (%s)", strerror(errno));    fcntl(wakeFds[0], F_SETFL, O_NONBLOCK);    fcntl(wakeFds[1], F_SETFL, O_NONBLOCK);    mWritePipeFd = wakeFds[1];    mPollFds[wake].fd = wakeFds[0];    mPollFds[wake].events = POLLIN;    mPollFds[wake].revents = 0;}

  sensors_poll_context_t的构造函数主要工作是使用poll监听AdxlSensor，KionixSensor和创建的管道读端的POLLIN事件。
  回到open_sensors函数，接着对sensors_poll_context_t的成员作初始化。sensors_poll_context_t的首个成员为sensors_poll_device_t，而sensors_poll_device_t的首个成员是hw_device_t，这三个类型的变量首地址是相同的，所以它们的指针可以相互安全地进行转换。最后把传下来的第二个指针参数指向已被初始化的hw_device_t成员地址。
  hw_get_module和sensors_open_1这两个函数保存了HAL层对应的hw_module_t类型和hw_device_t类型的指针。再次返回SenosrDevice的构造函数，接下来用get_sensors_list去获取sensor的列表。

/frameworks/native/services/sensorservice/SensorDevice.cpp

...sensor_t const* list;ssize_t count = mSensorModule->get_sensors_list(mSensorModule, &list);mActivationCount.setCapacity(count);...

  同样地，get_sensors_list方法的设置出现在HMI符号中，然后调到sensors__get_sensors_list方法，最后获取到struct sensor_t数组，并使传下来的第二个参数指向该数组的地址，其中sensor_t的作用是记录sensor的信息参数，一个sensor设备对应一个sensor_t结构体。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

struct sensors_module_t HAL_MODULE_INFO_SYM = {        .common = {                .tag = HARDWARE_MODULE_TAG,                .version_major = 1,                .version_minor = 0,                .id = SENSORS_HARDWARE_MODULE_ID,                .name = "AKM Sensor module",                .author = "Asahi Kasei Microdevices",                .methods = &sensors_module_methods,                .dso  = NULL,                .reserved = {0},        },        .get_sensors_list = sensors__get_sensors_list,};

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static int sensors__get_sensors_list(struct sensors_module_t* module,                                     struct sensor_t const** list){        *list = sSensorList;        return ARRAY_SIZE(sSensorList);}

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static const struct sensor_t sSensorList[] = {        { "AK8975 3-axis Magnetic field sensor",          "Asahi Kasei Microdevices",          1,          SENSORS_MAGNETIC_FIELD_HANDLE,          SENSOR_TYPE_MAGNETIC_FIELD, 1228.8f,          CONVERT_M, 0.35f, 10000, 0, 0, 0, 0, 0, 0, { } },#ifdef SENSORHAL_ACC_ADXL346        { "Analog Devices ADXL345/6 3-axis Accelerometer",          "ADI",          1, SENSORS_ACCELERATION_HANDLE,          SENSOR_TYPE_ACCELEROMETER, (GRAVITY_EARTH * 16.0f),          (GRAVITY_EARTH * 16.0f) / 4096.0f, 0.145f, 10000, 0, 0, 0, 0, 0, 0, { } },        { "AK8975 Orientation sensor",          "Asahi Kasei Microdevices",          1, SENSORS_ORIENTATION_HANDLE,          SENSOR_TYPE_ORIENTATION, 360.0f,          CONVERT_O, 0.495f, 10000, 0, 0, 0, 0, 0, 0, { } }#endif#ifdef SENSORHAL_ACC_KXTF9        { "Kionix KXTF9 3-axis Accelerometer",          "Kionix",          1, SENSORS_ACCELERATION_HANDLE,          SENSOR_TYPE_ACCELEROMETER, (GRAVITY_EARTH * 2.0f),          (GRAVITY_EARTH) / 1024.0f, 0.7f, 10000, 0, 0, 0, 0, 0, 0, { } },        { "AK8975 Orientation sensor",          "Asahi Kasei Microdevices",          1, SENSORS_ORIENTATION_HANDLE,          SENSOR_TYPE_ORIENTATION, 360.0f,          CONVERT_O, 1.05f, 10000, 0, 0, 0, 0, 0, 0, { } }#endif};

  回到SensorDevice的构造函数中，最后一步是使用activate方法对上面sensor列表的sensor进行激活。同理，activate方法最终会调到sensors_poll_context_t::activate方法。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

static int poll__activate(struct sensors_poll_device_t *dev,        int handle, int enabled) {    sensors_poll_context_t *ctx = (sensors_poll_context_t *)dev;    return ctx->activate(handle, enabled);}

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

int sensors_poll_context_t::activate(int handle, int enabled) {    int drv = handleToDriver(handle);    int err;    switch (handle) {        case ID_A:        case ID_M:            /* No dependencies */            break;        case ID_O:            /* These sensors depend on ID_A and ID_M */            mSensors[handleToDriver(ID_A)]->setEnable(ID_A, enabled);            mSensors[handleToDriver(ID_M)]->setEnable(ID_M, enabled);            break;        default:            return -EINVAL;    }    err = mSensors[drv]->setEnable(handle, enabled);    if (enabled && !err) {        const char wakeMessage(WAKE_MESSAGE);        int result = write(mWritePipeFd, &wakeMessage, 1);        ALOGE_IF(result<0, "error sending wake message (%s)", strerror(errno));    }    return err;}

  下面以AdxlSensor为例进行说明：
  如果AdxlSensor没有被激活且enabled参数为1，只将mEnables加1。
  如果AdxlSensor已经被首次激活了，则往/sys/class/input/(input_name)/device/device/disable中写入“1”，将mEnable减1。注意到这里传下来的enabled参数为0，AdxlSensor构造函数中把mEnabled初始化为0，也就是说SensorDevice初始化时不会将相关Sensor使能，要使Sensor使能，需要应用层调到native层使能。

/hardware/akm/AK8975_FS/libsensors/AdxlSensor.cpp

int AdxlSensor::setEnable(int32_t handle, int enabled) {    int err = 0;    char buffer[2];    /* handle check */    if (handle != ID_A) {        ALOGE("AdxlSensor: Invalid handle (%d)", handle);        return -EINVAL;    }    buffer[0] = '\0';    buffer[1] = '\0';    if (mEnabled <= 0) {        if(enabled) buffer[0] = '0';    } else if (mEnabled == 1) {        if(!enabled) buffer[0] = '1';    }    if (buffer[0] != '\0') {        strcpy(&input_sysfs_path[input_sysfs_path_len], "disable");        err = write_sys_attribute(input_sysfs_path, buffer, 1);        if (err != 0) {            return err;        }        ALOGD("AdxlSensor: Control set %s", buffer);        setInitialState();    }    if (enabled) {        mEnabled++;        if (mEnabled > 32767) mEnabled = 32767;    } else {        mEnabled--;        if (mEnabled < 0) mEnabled = 0;    }    ALOGD("AdxlSensor: mEnabled = %d", mEnabled);    return err;}

  AdxlSensor传给SensorBase构造函数的两个参数分别是NULL, ADXL_DATA_NAME，在宏定义被定义为”ADXL34x accelerometer”。之后调用openInput(ADXL_DATA_NAME)打开输入设备。

/hardware/akm/AK8975_FS/libsensors/SensorBase.cpp

SensorBase::SensorBase(        const char* dev_name,        const char* data_name)    : dev_name(dev_name), data_name(data_name),      dev_fd(-1), data_fd(-1){    if (data_name) {        data_fd = openInput(data_name);    }}

  openInput函数在/dev/input目录下查找设备名称。Linux内核提供了一个Input子系统，Input子系统会在/dev/input/路径下创建我们硬件输入设备的节点，一般情况下在我们的手机中这些节点是以eventXX来命名的，如event0，event1等等，可以利用EVIOCGNAME获取此事件结点名称。open(devname, O_RDONLY)打开了设备节点，strcpy(input_name, filename)将设备名拷贝到input_name中。
/hardware/akm/AK8975_FS/libsensors/SensorBase.cpp

int SensorBase::openInput(const char* inputName) {    int fd = -1;    const char *dirname = "/dev/input";    char devname[PATH_MAX];    char *filename;    DIR *dir;    struct dirent *de;    dir = opendir(dirname);    if(dir == NULL)        return -1;    strcpy(devname, dirname);    filename = devname + strlen(devname);    *filename++ = '/';    while((de = readdir(dir))) {        if(de->d_name[0] == '.' &&                (de->d_name[1] == '\0' ||                        (de->d_name[1] == '.' && de->d_name[2] == '\0')))            continue;        strcpy(filename, de->d_name);        fd = open(devname, O_RDONLY);        if (fd>=0) {            char name[80];            if (ioctl(fd, EVIOCGNAME(sizeof(name) - 1), &name) < 1) {                name[0] = '\0';            }            if (!strcmp(name, inputName)) {                strcpy(input_name, filename);                break;            } else {                close(fd);                fd = -1;            }        }    }    closedir(dir);    ALOGE_IF(fd<0, "couldn't find '%s' input device", inputName);    return fd;}

  这样，SensorDevice的构造函数便介绍完毕。
  回到SensorService的onFirstRef函数，SensorService继承自Thread,函数末尾调用run进入threadLoop方法。

/frameworks/native/services/sensorservice/SensorService.cpp

...run("SensorService", PRIORITY_URGENT_DISPLAY);...

  threadLoop方法中调用了SensorDevice::poll方法，mSensorEventBuffer是一个struct sensors_event_t数组。每个传感器的数据都由struct sensors_event_t表示。

/frameworks/native/services/sensorservice/SensorService.cpp

...do {        ssize_t count = device.poll(mSensorEventBuffer, numEventMax);        if (count < 0) {            ALOGE("sensor poll failed (%s)", strerror(-count));            break;        }...

/hardware/libhardware/include/hardware/sensors.h

typedef struct sensors_event_t {    /* must be sizeof(struct sensors_event_t) */    int32_t version;    /* sensor identifier */    int32_t sensor;    /* sensor type */    int32_t type;    /* reserved */    int32_t reserved0;    /* time is in nanosecond */    int64_t timestamp;    union {        union {            float           data[16];            /* acceleration values are in meter per second per second (m/s^2) */            sensors_vec_t   acceleration;            /* magnetic vector values are in micro-Tesla (uT) */            sensors_vec_t   magnetic;            /* orientation values are in degrees */            sensors_vec_t   orientation;            /* gyroscope values are in rad/s */            sensors_vec_t   gyro;            /* temperature is in degrees centigrade (Celsius) */            float           temperature;            /* distance in centimeters */            float           distance;            /* light in SI lux units */            float           light;            /* pressure in hectopascal (hPa) */            float           pressure;            /* relative humidity in percent */            float           relative_humidity;            /* uncalibrated gyroscope values are in rad/s */            uncalibrated_event_t uncalibrated_gyro;            /* uncalibrated magnetometer values are in micro-Teslas */            uncalibrated_event_t uncalibrated_magnetic;            /* heart rate data containing value in bpm and status */            heart_rate_event_t heart_rate;            /* this is a special event. see SENSOR_TYPE_META_DATA above.             * sensors_meta_data_event_t events are all reported with a type of             * SENSOR_TYPE_META_DATA. The handle is ignored and must be zero.             */            meta_data_event_t meta_data;        };        union {            uint64_t        data[8];            /* step-counter */            uint64_t        step_counter;        } u64;    };    /* Reserved flags for internal use. Set to zero. */    uint32_t flags;    uint32_t reserved1[3];} sensors_event_t;

  SensorDevice::poll函数最终会调到sensors_poll_context_t::pollEvents函数。

/frameworks/native/services/sensorservice/SensorDevice.cpp

ssize_t SensorDevice::poll(sensors_event_t* buffer, size_t count) {    if (!mSensorDevice) return NO_INIT;    ssize_t c;    do {        c = mSensorDevice->poll(reinterpret_cast<struct sensors_poll_device_t *> (mSensorDevice),                                buffer, count);    } while (c == -EINTR);    return c;}

  如果前面监听的Sensor描述符（AdxlSensor和KionixSensor）发生了POLLIN事件或者有未处理的事件，则调用readEvents去处理这些事件。readEvents返回值nb为读得的事件数量，count为传回上层的事件容量，data记录了sensors_event_t结构体数组的当前保存位置。每次读出事件后，都会对这三个变量作处理。
  如果还有剩余容量（count>0),则会抓住最后机会使用poll争取获得事件，nbEvents记录了每次进入pollEvents读到的事件总数量。若nbEvents大于0，poll的时间参数为0，表示立即返回；若nbEvents等于0，poll的时间参数为-1，表示一直阻塞到读取到事件。若此时有线程从管道唤醒poll,则会对唤醒事件作处理（实质就是使 mPollFds[wake]的revents恢复默认值）。若poll成功读取到事件且还有剩余容量，则再次进入pollEvents的主循环。
  第一次进入pollEvents函数时，由于还没有poll，mPollFds中的所有Sensor的fd都不会有变化，所以会阻塞在poll调用中，直到Sensor发生了事件或者有线程从管道将其唤醒。之后再次进入主循环调用readEvents读取Sensor事件（如果Sensor发生POLLIN事件的话），count没有满的情况下，然后再次进入poll函数，这样一直循环下去，直到poll没有事件返回且没有事件容量才会退出循环。

/hardware/akm/AK8975_FS/libsensors/Sensors.cpp

int sensors_poll_context_t::pollEvents(sensors_event_t* data, int count){    int nbEvents = 0;    int n = 0;    do {        // see if we have some leftover from the last poll()        for (int i=0 ; count && i<numSensorDrivers ; i++) {            SensorBase* const sensor(mSensors[i]);            if ((mPollFds[i].revents & POLLIN) || (sensor->hasPendingEvents())) {                int nb = sensor->readEvents(data, count);                if (nb < count) {                    // no more data for this sensor                    mPollFds[i].revents = 0;                }                if ((0 != nb) && (acc == i)) {                    ((AkmSensor*)(mSensors[akm]))->setAccel(&data[nb-1]);                }                count -= nb;                nbEvents += nb;                data += nb;            }        }        if (count) {            // we still have some room, so try to see if we can get            // some events immediately or just wait if we don't have            // anything to return            n = poll(mPollFds, numFds, nbEvents ? 0 : -1);            if (n<0) {                ALOGE("poll() failed (%s)", strerror(errno));                return -errno;            }            if (mPollFds[wake].revents & POLLIN) {                char msg;                int result = read(mPollFds[wake].fd, &msg, 1);                ALOGE_IF(result<0, "error reading from wake pipe (%s)", strerror(errno));                ALOGE_IF(msg != WAKE_MESSAGE, "unknown message on wake queue (0x%02x)", int(msg));                mPollFds[wake].revents = 0;            }        }        // if we have events and space, go read them    } while (n && count);    return nbEvents;}

  readEvents中如果有未处理事件，则将sensors_event_t类型的未处理事件指针保存在第一个参数中。mInputReader类型为class InputEventCircularReader，是用来填充struct input_event输入事件的环形缓冲区。data_fd为openInput的返回值，即打开的输入设备的fd。AdxlSensor的构造函数将4传给InputEventCircularReader构造函数参数，mBuffer初始化为8个input_event大小的内存，以暂存读取超出环形缓冲区的部分。mBufferEnd指向环形缓冲的末尾，mHead记录了下次填充input_event的位置，mCurr记录了最后一个填充的input_event的位置，mFreeSpace记录了空闲的input_event大小的内存块数量。fill函数从输入设备中读取input_event事件到环形缓冲区中，当读取的大小超过缓冲区大小时，会将超出部分覆盖到缓冲区起始部分。
  while循环里读取mCurr记录的input_event的类型来执行操作，循环的条件是环形缓冲区还有数据可以读且需要读取事件的余量count大于0。AdxlSensor是一个加速度传感器，读取的事件类型为EV_ABS，可以用来判断手机屏幕的方向。x轴，y轴是以屏幕左下角为原点向右和向上的方向，z轴是垂直于屏幕指向屏幕外面的方向。在一个时刻，只有一个轴读取到加速度值。使用ADXL_UNIT_CONVERSION宏将内核层读到的重力加速度值转化为标准单位重力加速度值。在三轴上计算得到的数据用以初始化一个mPendingEvent。读取事件类型为EV_SYN时（EV_SYN是用于事件间的分割标志。事件可能按时间或空间进行分割，就像在多点触摸协议中的例子），设定mPendingEvent的时间戳为输入事件发生的时间，将mPendingEvent指针保存在data参数中。这样，readEvents函数将底层传上来的input_event填充到入参data中。SensorService便保存了来自底层的input_event包装而成的sensors_event_t事件。readEvents的返回值就是保存到data参数中的
input_event数量。
  值得注意的是，readEvents的入参data是对sensors_poll_context_t::pollEvents的入参data指针值的拷贝，readEvents中能改变data指向的数组的内容，但不能改变指针的指向的位置。所以，当readEvents函数返回了读取的事件数时，sensors_poll_context_t::pollEvents的入参data表示的数组内容已经改变，指向的位置和调用readEvents前的位置相同。

/hardware/akm/AK8975_FS/libsensors/AdxlSensor.cpp

int AdxlSensor::readEvents(sensors_event_t* data, int count){    if (count < 1)        return -EINVAL;    if (mHasPendingEvent) {        mHasPendingEvent = false;        mPendingEvent.timestamp = getTimestamp();        *data = mPendingEvent;        return mEnabled ? 1 : 0;    }    ssize_t n = mInputReader.fill(data_fd);    if (n < 0)        return n;    int numEventReceived = 0;    input_event const* event;    while (count && mInputReader.readEvent(&event)) {        int type = event->type;        if (type == EV_ABS) {            float value = event->value;            if (event->code == EVENT_TYPE_ACCEL_X) {                mPendingEvent.acceleration.x = ADXL_UNIT_CONVERSION(value);            } else if (event->code == EVENT_TYPE_ACCEL_Y) {                mPendingEvent.acceleration.y = ADXL_UNIT_CONVERSION(value);            } else if (event->code == EVENT_TYPE_ACCEL_Z) {                mPendingEvent.acceleration.z = ADXL_UNIT_CONVERSION(value);            }        } else if (type == EV_SYN) {            mPendingEvent.timestamp = timevalToNano(event->time);            if (mEnabled) {                *data++ = mPendingEvent;                count--;                numEventReceived++;            }        } else {            ALOGE("AdxlSensor: unknown event (type=%d, code=%d)",                    type, event->code);        }        mInputReader.next();    }    return numEventReceived;}

/hardware/akm/AK8975_FS/libsensors/InputEventReader.h

class InputEventCircularReader{    struct input_event* const mBuffer;    struct input_event* const mBufferEnd;    struct input_event* mHead;    struct input_event* mCurr;    ssize_t mFreeSpace;public:    InputEventCircularReader(size_t numEvents);    ~InputEventCircularReader();    ssize_t fill(int fd);    ssize_t readEvent(input_event const** events);    void next();};

/hardware/akm/AK8975_FS/libsensors/InputEventReader.h

InputEventCircularReader::InputEventCircularReader(size_t numEvents)    : mBuffer(new input_event[numEvents * 2]),      mBufferEnd(mBuffer + numEvents),      mHead(mBuffer),      mCurr(mBuffer),      mFreeSpace(numEvents){}

/hardware/akm/AK8975_FS/libsensors/InputEventReader.cpp

ssize_t InputEventCircularReader::fill(int fd){    size_t numEventsRead = 0;    if (mFreeSpace) {        const ssize_t nread = read(fd, mHead, mFreeSpace * sizeof(input_event));        if (nread<0 || nread % sizeof(input_event)) {            // we got a partial event!!            return nread<0 ? -errno : -EINVAL;        }        numEventsRead = nread / sizeof(input_event);        if (numEventsRead) {            mHead += numEventsRead;            mFreeSpace -= numEventsRead;            if (mHead > mBufferEnd) {                size_t s = mHead - mBufferEnd;                memcpy(mBuffer, mBufferEnd, s * sizeof(input_event));                mHead = mBuffer + s;            }        }    }    return numEventsRead;}

/bionic/libc/kernel/uapi/linux

struct input_event {  //按键时间  struct timeval time;  //类型  __u16 type;  //模拟成的按键  __u16 code;  //按下还是释放  __s32 value;};

  至此，Android Sensor的HAL层代码大致分析完毕。