SensorService的启动是放在SystemServer的startBootstrapServices方法中，代码如下：

frameworks/base/services/java/com/android/server/SystemServer.java  
/**
     * Start the sensor service. This is a blocking call and can take time.
*/
private static native void startSensorService();
    
private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
        ...
        mSensorServiceStart = SystemServerInitThreadPool.submit(() -> {
            TimingsTraceAndSlog traceLog = TimingsTraceAndSlog.newAsyncLog();
            traceLog.traceBegin(START_SENSOR_SERVICE);
            startSensorService();
            traceLog.traceEnd();
        }, START_SENSOR_SERVICE);
}

在SystemServer的startBootstrapServices方法中调用startSensorService方法，而这个方法是JNI的native方法。那该方法是如何被添加到虚拟机的呢？

frameworks/base/services/java/com/android/server/SystemServer.java  
public static void main(String[] args) {
        new SystemServer().run();//SystemServer的入口函数，调用了run方法
 }
private void run() {
        ...
            // Initialize native services.
            System.loadLibrary("android_servers");//加载libandroid_servers.so文件
        ...
}

那这个so对应的代码是放在/frameworks/base/services/core/jni目录下，打开onload.cpp的JNI_OnLoad方法：

frameworks/base/services/core/jni/onload.cpp
extern "C" jint JNI_OnLoad(JavaVM* vm, void* /* reserved */)
{
    JNIEnv* env = NULL;
    jint result = -1;

    if (vm->GetEnv((void**) &env, JNI_VERSION_1_4) != JNI_OK) {
        ALOGE("GetEnv failed!");
        return result;
    }
    ALOG_ASSERT(env, "Could not retrieve the env!");
    ...
    register_android_server_PowerManagerService(env);
    register_android_server_InputManager(env);
    register_android_server_AlarmManagerService(env);
    ...
    register_android_server_SystemServer(env);//SensorService是放在SystemServer
   ...
}

在JNI_OnLoad方法中注册了系统服务的JNI方法，如PowerManagerService、InputManager等等，我们的SensorService是放在SystemServer中的，打开com_android_server_SystemServer.cpp。

frameworks/base/services/core/jni/com_android_server_SystemServer.cpp
static void android_server_SystemServer_startSensorService(JNIEnv* /* env */, jobject /* clazz */) {
    char propBuf[PROPERTY_VALUE_MAX];
    property_get("system_init.startsensorservice", propBuf, "1");
    if (strcmp(propBuf, "1") == 0) {
        SensorService::publish(false /* allowIsolated */,
                               IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL);//调用SersorService的publish方法
    }
}

static const JNINativeMethod gMethods[] = {
        /* name, signature, funcPtr */
        {"startSensorService", "()V", (void*)android_server_SystemServer_startSensorService},
        {"startHidlServices", "()V", (void*)android_server_SystemServer_startHidlServices},
        {"initZygoteChildHeapProfiling", "()V",
         (void*)android_server_SystemServer_initZygoteChildHeapProfiling},
        {"spawnFdLeakCheckThread", "()V",
         (void*)android_server_SystemServer_spawnFdLeakCheckThread},
        {"startIncrementalService", "()J",
         (void*)android_server_SystemServer_startIncrementalService},
        {"setIncrementalServiceSystemReady", "(J)V",
         (void*)android_server_SystemServer_setIncrementalServiceSystemReady},
};

int register_android_server_SystemServer(JNIEnv* env)
{
    return jniRegisterNativeMethods(env, "com/android/server/SystemServer",
            gMethods, NELEM(gMethods));
}

从startSensorService->android_server_SystemServer_startSensorService->SensorService::publish，发现startSensorService调用的是SensorService的publish方法。我们来看下SensorService的定义：

frameworks/native/services/sensorservice/SensorService.h
class SensorService :
        public BinderService<SensorService>,
        public BnSensorServer,
        protected Thread

SensorService是继承BinderService的，其中publish方法就是在BinderService中实现的。

template<typename SERVICE>
class BinderService
{
public:
    static status_t publish(bool allowIsolated = false,
                            int dumpFlags = IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT) {
        sp<IServiceManager> sm(defaultServiceManager());//获取ServiceManager对象
        return sm->addService(String16(SERVICE::getServiceName()), new SERVICE(), allowIsolated,
                              dumpFlags);//调用addService添加服务
    }
    ...
    static void instantiate() { publish(); }
    ...
};

我们可以把SERVICE理解成JAVA中的泛型，SensorService继承BinderService<SensorService>，所以addService中的new SERVICE()就是调用SensorService的构造方法得到实例化对象。

到此，我们的 SensorService就被启动啦！！