最近项目中有一个需求，在Framework层新添加一个sensor类型，所以在需求的驱使下研究了一下SensorManger在Framework层的流程。
首先从APP端入手，我们注册一个Sensor的流程如下

if(mSensorManager == null){
            mSensorManager = (SensorManager) getSystemService(SENSOR_SERVICE);
}
mAccSensor = mSensorManager.getDefaultSensor(Sensor.TYPE_ACCELEROMETER);
Log.d("vivian","mAccSensor "+mAccSensor);
mSensorManager.registerListener(new MyPSensorListener(), mAccSensor, SensorManager.SENSOR_DELAY_NORMAL);

首先追一下getDefaultSensor这个方法的流程
/frameworks/base/core/java/android/hardware/SensorManager.java

    public Sensor getDefaultSensor(int type) {
    Log.d("vivian","getDefaultSensor type "+type);
        // TODO: need to be smarter, for now, just return the 1st sensor
        List<Sensor> l = getSensorList(type);

        boolean wakeUpSensor = false;
        // For the following sensor types, return a wake-up sensor. These types are by default
        // defined as wake-up sensors. For the rest of the SDK defined sensor types return a
        // non_wake-up version.
        if (type == Sensor.TYPE_PROXIMITY || type == Sensor.TYPE_SIGNIFICANT_MOTION
                || type == Sensor.TYPE_TILT_DETECTOR || type == Sensor.TYPE_WAKE_GESTURE
                || type == Sensor.TYPE_GLANCE_GESTURE || type == Sensor.TYPE_PICK_UP_GESTURE
                || type == Sensor.TYPE_WRIST_TILT_GESTURE
                || type == Sensor.TYPE_DYNAMIC_SENSOR_META
        || type == Sensor.TYPE_EKG) {
            wakeUpSensor = true;
        }

        for (Sensor sensor : l) {
        Log.d("vivian", "sensor.isWakeUpSensor() "+sensor.isWakeUpSensor());
            if (sensor.isWakeUpSensor() == wakeUpSensor) return sensor;
        }
        return null;
    }

接下来追List<Sensor> l = getSensorList(type)这个方法，同样也在当前文件

public List<Sensor> getSensorList(int type) {
        Log.d("vivian","getSensorList "+type);
        // cache the returned lists the first time
        List<Sensor> list;
        final List<Sensor> fullList = getFullSensorList();
    Log.d("vivian","getSensorList fullList size "+fullList.size());
        synchronized (mSensorListByType) {
            list = mSensorListByType.get(type);
            if (list == null) {
                if (type == Sensor.TYPE_ALL) {
                    list = fullList;
                } else {
                    list = new ArrayList<Sensor>();
                    for (Sensor i : fullList) {
            Log.d("vivian","getSensorList i.getType() "+i.getType());
                        if (i.getType() == type) {
                            list.add(i);
                        }
                    }
                }
                list = Collections.unmodifiableList(list);
                mSensorListByType.append(type, list);
            }else{
        Log.d("vivian","getSensorList list size "+list.size());
        }
        }
        Log.d("vivian","getSensorList list size "+list.size());
        return list;
    }

看代码可以清晰看出，下一步需要追getFullSensorList()这个方法，这个方法在SystemSensorManager.java中
/frameworks/base/core/java/android/hardware/SystemSensorManager.java

/** @hide */
    @Override
    protected List<Sensor> getFullSensorList() {
        return mFullSensorsList;
    }

mFullSensorsList这个变量值怎么来的，我们继续追到该类的构造函数里

/** {@hide} */
    public SystemSensorManager(Context context, Looper mainLooper) {
        synchronized (sLock) {
            if (!sNativeClassInited) {
                sNativeClassInited = true;
                nativeClassInit();
            }
        }

        mMainLooper = mainLooper;
        mTargetSdkLevel = context.getApplicationInfo().targetSdkVersion;
        mContext = context;
        mNativeInstance = nativeCreate(context.getOpPackageName());

        Log.d("vivian", "SystemSensorManager initialize the sensor list");
        // initialize the sensor list
        for (int index = 0;; ++index) {
            Sensor sensor = new Sensor();
            if (!nativeGetSensorAtIndex(mNativeInstance, sensor, index)) break;
            mFullSensorsList.add(sensor);
            mHandleToSensor.put(sensor.getHandle(), sensor);
        }
    }

从上面代码可以看出，所有Sensor是通过nativeGetSensorAtIndex这个方法获取的，继续追这个方法我们追到了jni层
/frameworks/base/core/jni/android_hardware_SensorManager.cpp

static jboolean
nativeGetSensorAtIndex(JNIEnv *env, jclass clazz, jlong sensorManager, jobject sensor, jint index)
{
    ALOGE("vivian nativeGetSensorAtIndex");
    SensorManager* mgr = reinterpret_cast<SensorManager*>(sensorManager);

    Sensor const* const* sensorList;
    ssize_t count = mgr->getSensorList(&sensorList);
    if (ssize_t(index) >= count) {
        return false;
    }

    return translateNativeSensorToJavaSensor(env, sensor, *sensorList[index]) != NULL;
}

ssize_t count = mgr->getSensorList(&sensorList);这里开始就调到了native层的SensorManager
/frameworks/native/services/sensorservice/hidl/SensorManager.cpp

// Methods from ::android::frameworks::sensorservice::V1_0::ISensorManager follow.
Return<void> SensorManager::getSensorList(getSensorList_cb _hidl_cb) {
    LOG(ERROR) << "vivian native SensorManager getSensorList";
    ::android::Sensor const* const* list;
    ssize_t count = getInternalManager().getSensorList(&list);
    LOG(ERROR) << "vivian native SensorManager getSensorList count " << count;
    if (count < 0 || !list) {
        LOG(ERROR) << "::android::SensorManager::getSensorList encounters " << count;
        _hidl_cb({}, Result::UNKNOWN_ERROR);
        return Void();
    }
    hidl_vec<SensorInfo> ret;
    ret.resize(static_cast<size_t>(count));
    for (ssize_t i = 0; i < count; ++i) {
        ret[i] = convertSensor(*list[i]);
    }
    _hidl_cb(ret, Result::OK);
    return Void();
}

接下来就是通过SensorService的getSensorList拿数据
/frameworks/native/services/sensorservice/SensorService.java

Vector<Sensor> SensorService::getSensorList(const String16& /* opPackageName */) {
    ALOGE("vivian native SensorService::getSensorList");
    char value[PROPERTY_VALUE_MAX];
    property_get("debug.sensors", value, "0");
    const Vector<Sensor>& initialSensorList = (atoi(value)) ?
            mSensors.getUserDebugSensors() : mSensors.getUserSensors();
    Vector<Sensor> accessibleSensorList;
    for (size_t i = 0; i < initialSensorList.size(); i++) {
        Sensor sensor = initialSensorList[i];
        accessibleSensorList.add(sensor);
    }
    makeUuidsIntoIdsForSensorList(accessibleSensorList);
    return accessibleSensorList;
}

而SensorService的数据是在初始化的时候拿到的

// 这部分只截取一部分代码
void SensorService::onFirstRef() {
    ALOGE("vivian native SensorService::onFirstRef()");
    ALOGD("nuSensorService starting...");
    SensorDevice& dev(SensorDevice::getInstance());

    sHmacGlobalKeyIsValid = initializeHmacKey();

    if (dev.initCheck() == NO_ERROR) {

在SensorService初始化的时候初始化了Sensordevice，我们来看一下SensorDevice的构造函数
/frameworks/native/services/sensorservice/SensorDevice.cpp

SensorDevice::SensorDevice()
        : mHidlTransportErrors(20), mRestartWaiter(new HidlServiceRegistrationWaiter()) {
    ALOGE("vivian SensorDevice::SensorDevice()");
    if (!connectHidlService()) {
        return;
    }

    float minPowerMa = 0.001; // 1 microAmp

    checkReturn(mSensors->getSensorsList(
            [&](const auto &list) {
                const size_t count = list.size();

                mActivationCount.setCapacity(count);
                Info model;
                for (size_t i=0 ; i < count; i++) {
                    sensor_t sensor;
                    convertToSensor(list[i], &sensor);
            ALOGE("vivian SensorDevice::SensorDevice() type %d", sensor.type);
                    // Sanity check and clamp power if it is 0 (or close)
                    if (sensor.power < minPowerMa) {
                        ALOGE("Reported power %f not deemed sane, clamping to %f",
                              sensor.power, minPowerMa);
                        sensor.power = minPowerMa;
                    }
                    mSensorList.push_back(sensor);

                    mActivationCount.add(list[i].sensorHandle, model);

                    checkReturn(mSensors->activate(list[i].sensorHandle, 0 /* enabled */));
                }
            }));

    mIsDirectReportSupported =
           (checkReturn(mSensors->unregisterDirectChannel(-1)) != Result::INVALID_OPERATION);
}

在这个位置会调用connectHidlService()（该方法的代码就不贴了，可以自行到源码里查看），应该是connect了hal层的Sensor Service，连接成功后会初始化mSensors这个变量，这个变量不为空后，就可以通过mSensors->getSensorsList获取到sensor的列表，这样整个的获取sensor列表的流程就结束了，其他方法基本上都是走这几层，可以自行查看。