Android 7系统无障碍服务（六）输入事件拦截与 TouchExplorer

系列目录 ：第一篇：全景图与架构概览 | [第二篇：AccessibilityManagerService 启动与初始化](#第二篇：AccessibilityManagerService 启动与初始化) | 第三篇：无障碍服务的注册与绑定 | [第四篇：AccessibilityEvent 的产生与投递](#第四篇：AccessibilityEvent 的产生与投递) | [第五篇：AccessibilityNodeInfo 的构建与查询](#第五篇：AccessibilityNodeInfo 的构建与查询) | [第六篇：输入事件拦截与 TouchExplorer](#第六篇：输入事件拦截与 TouchExplorer) | [第七篇：手势分发与 KeyEvent 处理](#第七篇：手势分发与 KeyEvent 处理) | 第八篇：放大镜与辅助功能特性

一、为什么输入事件拦截是 Touch Exploration 的地基

前面几篇分别梳理了无障碍服务的启动、注册绑定、事件投递与节点树查询。这一篇回答一个更底层的问题：

当用户用手指在屏幕上慢慢滑动时，系统如何判断这是「探索界面」而不是「划动列表」？

这个问题看似是产品逻辑，实际上是工程问题。Android 7 的屏幕阅读器（TalkBack 等）之所以能用「单指滑动探索、双击确认、双指拖拽滚动」三套手势共存，靠的是系统在主线程上插入了一个 InputFilter，在事件进入窗口分发之前，先把它交给一个状态机去解读。

这个状态机就是 TouchExplorer，而承载它的链路叫 EventStreamTransformation。本篇按这条链路展开：

AMS 在什么时机创建并安装 AccessibilityInputFilter
AccessibilityInputFilter 如何按输入源分发、按帧批处理事件
EventStreamTransformation 责任链的组成与顺序
TouchExplorer 的四个状态及其转换
AccessibilityGestureDetector 如何把慢速滑动与快速手势区分开

二、InputFilter 的安装 ------ AMS 的 updateInputFilter

2.1 触发条件

AccessibilityInputFilter 不是一直存在的。只有当当前用户启用了至少一项需要拦截输入的功能时（触摸探索、屏幕放大镜、按键过滤、鼠标自动点击、注入 MotionEvent），AMS 才会把它注册到 WindowManagerService 的输入过滤器链。

2.2 AMS 的 updateInputFilter

源码路径 ：frameworks/base/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

java 复制代码

public class AccessibilityManagerService extends IAccessibilityManager.Stub {
    // ...
    private AccessibilityInputFilter mInputFilter;
    private boolean mHasInputFilter;
    private final WindowManagerInternal mWindowManagerService;

    private void updateInputFilter(UserState userState) {
        boolean setInputFilter = false;
        AccessibilityInputFilter inputFilter = null;
        synchronized (mLock) {
            int flags = 0;
            if (userState.mIsDisplayMagnificationEnabled) {
                flags |= AccessibilityInputFilter.FLAG_FEATURE_SCREEN_MAGNIFIER;
            }
            // ... 其余 FLAG 计算省略 ...
            if (userState.mIsPerformGesturesEnabled) {
                flags |= AccessibilityInputFilter.FLAG_FEATURE_INJECT_MOTION_EVENTS;
            }
            if (flags != 0) {
                if (!mHasInputFilter) {
                    mHasInputFilter = true;
                    if (mInputFilter == null) {
                        mInputFilter = new AccessibilityInputFilter(mContext,
                                AccessibilityManagerService.this);
                    }
                    inputFilter = mInputFilter;
                    setInputFilter = true;
                }
                mInputFilter.setUserAndEnabledFeatures(userState.mUserId, flags);
            } else {
                if (mHasInputFilter) {
                    mHasInputFilter = false;
                    mInputFilter.setUserAndEnabledFeatures(userState.mUserId, 0);
                    inputFilter = null;
                    setInputFilter = true;
                }
            }
        }
        if (setInputFilter) {
            mWindowManagerService.setInputFilter(inputFilter);
        }
    }
}

关键设计 ：updateInputFilter 先在 mLock 内决定「是否注册」以及「打开哪些 feature flag」，但把 setInputFilter() 调用放到锁外------因为该方法内部会走 WindowManagerService，再回头可能回调到 AMS，持锁调用会造成死锁。

2.3 何时被调用

updateInputFilter 不是同步调用，而是被 scheduleUpdateInputFilter 投递到 MainHandler 的 MSG_UPDATE_INPUT_FILTER 异步执行。触发点主要有两类：

用户在设置中启用了带 flagRequestTouchExplorationMode 等标志的服务
UserState 中相关布尔量（如 mIsDisplayMagnificationEnabled）发生变化

关键：InputFilter 的生命周期由 feature flag 集合驱动，而不是由单个服务的启用/禁用驱动。这是后文 enableFeatures 能按位组合的根本原因。

三、AccessibilityInputFilter ------ 链的入口与批处理器

3.1 类结构

AccessibilityInputFilter 继承自 android.view.InputFilter（主线程的 Looper 构造），自身同时实现 EventStreamTransformation。它既是链的「起点」，也是链的「终点 sink」------当某个 handler 决定把事件继续往下传时，最终会调回 AccessibilityInputFilter.onMotionEvent()，由它调用 sendInputEvent() 把事件送进 WindowManagerService。

源码路径 ：frameworks/base/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java

java 复制代码

class AccessibilityInputFilter extends InputFilter implements EventStreamTransformation {

    static final int FLAG_FEATURE_SCREEN_MAGNIFIER      = 0x00000001;
    static final int FLAG_FEATURE_TOUCH_EXPLORATION     = 0x00000002;
    static final int FLAG_FEATURE_FILTER_KEY_EVENTS     = 0x00000004;
    static final int FLAG_FEATURE_AUTOCLICK             = 0x00000008;
    static final int FLAG_FEATURE_INJECT_MOTION_EVENTS  = 0x00000010;
    static final int FLAG_FEATURE_CONTROL_SCREEN_MAGNIFIER = 0x00000020;

    private TouchExplorer mTouchExplorer;
    private MagnificationGestureHandler mMagnificationGestureHandler;
    private MotionEventInjector mMotionEventInjector;
    private AutoclickController mAutoclickController;
    private KeyboardInterceptor mKeyboardInterceptor;
    private EventStreamTransformation mEventHandler;   // 链头
    private MotionEventHolder mEventQueue;             // 待批处理队列
    private Choreographer mChoreographer;

    AccessibilityInputFilter(Context context, AccessibilityManagerService service) {
        super(context.getMainLooper());   // ← 绑定主线程 Looper
        // ...
    }

    void setUserAndEnabledFeatures(int userId, int enabledFeatures) {
        if (mEnabledFeatures == enabledFeatures && mUserId == userId) {
            return;
        }
        if (mInstalled) {
            disableFeatures();
        }
        mUserId = userId;
        mEnabledFeatures = enabledFeatures;
        if (mInstalled) {
            enableFeatures();
        }
    }

    private void enableFeatures() {
        resetStreamState();

        if ((mEnabledFeatures & FLAG_FEATURE_AUTOCLICK) != 0) {
            mAutoclickController = new AutoclickController(mContext, mUserId);
            addFirstEventHandler(mAutoclickController);
        }

        if ((mEnabledFeatures & FLAG_FEATURE_TOUCH_EXPLORATION) != 0) {
            mTouchExplorer = new TouchExplorer(mContext, mAms);
            addFirstEventHandler(mTouchExplorer);
        }

        if ((mEnabledFeatures & FLAG_FEATURE_CONTROL_SCREEN_MAGNIFIER) != 0
                || (mEnabledFeatures  & FLAG_FEATURE_SCREEN_MAGNIFIER) != 0) {
            final boolean detectControlGestures = (mEnabledFeatures
                    & FLAG_FEATURE_SCREEN_MAGNIFIER) != 0;
            mMagnificationGestureHandler = new MagnificationGestureHandler(
                    mContext, mAms, detectControlGestures);
            addFirstEventHandler(mMagnificationGestureHandler);
        }

        if ((mEnabledFeatures & FLAG_FEATURE_INJECT_MOTION_EVENTS) != 0) {
            mMotionEventInjector = new MotionEventInjector(mContext.getMainLooper());
            addFirstEventHandler(mMotionEventInjector);
            mAms.setMotionEventInjector(mMotionEventInjector);
        }

        if ((mEnabledFeatures & FLAG_FEATURE_FILTER_KEY_EVENTS) != 0) {
            mKeyboardInterceptor = new KeyboardInterceptor(mAms);
            addFirstEventHandler(mKeyboardInterceptor);
        }
    }

    private void addFirstEventHandler(EventStreamTransformation handler) {
        if (mEventHandler != null) {
           handler.setNext(mEventHandler);
        } else {
            handler.setNext(this);    // ← 链尾回指 InputFilter 自身
        }
        mEventHandler = handler;
    }
}

关键设计 ：每个 feature 通过 addFirstEventHandler() 加入链头，因此「后添加的 feature」先看到事件。源码中 mAutoclickController 先加、mTouchExplorer 后加，意味着鼠标自动点击的转换会先于触摸探索生效。链尾始终指回 AccessibilityInputFilter 自身，最终由 onMotionEvent() 调 sendInputEvent() 把事件交还给 WindowManagerService。

3.2 入口分发：onInputEvent

InputFilter 框架会按事件类型回调 onInputEvent。AccessibilityInputFilter 在这一步做了三件事：按 InputEvent 来源分桶（触摸 / 鼠标 / 键盘）、校验 policyFlags 的 FLAG_PASS_TO_USER、把 MotionEvent 入队批处理、把 KeyEvent 直接转发给链头。

源码路径 ：frameworks/base/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java

java 复制代码

class AccessibilityInputFilter extends InputFilter implements EventStreamTransformation {
    // ...
    private EventStreamState mMouseStreamState;
    private EventStreamState mTouchScreenStreamState;
    private EventStreamState mKeyboardStreamState;

    @Override
    public void onInputEvent(InputEvent event, int policyFlags) {
        if (mEventHandler == null) {
            super.onInputEvent(event, policyFlags);   // 未启用任何 feature → 直接透传
            return;
        }

        EventStreamState state = getEventStreamState(event);
        if (state == null) {
            super.onInputEvent(event, policyFlags);   // 非键盘/触摸/鼠标 → 透传
            return;
        }

        int eventSource = event.getSource();
        if ((policyFlags & WindowManagerPolicy.FLAG_PASS_TO_USER) == 0) {
            state.reset();
            mEventHandler.clearEvents(eventSource);
            super.onInputEvent(event, policyFlags);
            return;
        }

        if (state.updateDeviceId(event.getDeviceId())) {
            mEventHandler.clearEvents(eventSource);   // 输入设备切换 → 清空状态机
        }

        if (!state.deviceIdValid()) {
            super.onInputEvent(event, policyFlags);
            return;
        }

        if (event instanceof MotionEvent) {
            if ((mEnabledFeatures & FEATURES_AFFECTING_MOTION_EVENTS) != 0) {
                MotionEvent motionEvent = (MotionEvent) event;
                processMotionEvent(state, motionEvent, policyFlags);
                return;
            } else {
                super.onInputEvent(event, policyFlags);
            }
        } else if (event instanceof KeyEvent) {
            KeyEvent keyEvent = (KeyEvent) event;
            processKeyEvent(state, keyEvent, policyFlags);
        }
    }

    private void processKeyEvent(EventStreamState state, KeyEvent event, int policyFlags) {
        if (!state.shouldProcessKeyEvent(event)) {
            return;
        }
        mEventHandler.onKeyEvent(event, policyFlags);
    }
}

关键：FLAG_PASS_TO_USER == 0 表示事件被系统 policy 层吞掉（例如电源键），此时必须 state.reset() 并把 clearEvents 广播给整条链，让每个 handler 都退出自己可能残留的状态。这是责任链设计里最容易被忽略的「一致性协议」。

3.3 按帧批处理 MotionEvent

触摸事件频率远高于帧率。如果每个 MotionEvent 都触发一次状态机迁移，会出现大量中间态。AccessibilityInputFilter 因此把触摸事件暂存到 MotionEventHolder 链表，再借助 Choreographer.CALLBACK_INPUT 在帧回调里按「属于当前帧」为界批量消费：

源码路径 ：frameworks/base/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java

java 复制代码

class AccessibilityInputFilter extends InputFilter implements EventStreamTransformation {
    // ...
    private final Runnable mProcessBatchedEventsRunnable = new Runnable() {
        @Override
        public void run() {
            final long frameTimeNanos = mChoreographer.getFrameTimeNanos();
            processBatchedEvents(frameTimeNanos);
            if (mEventQueue != null) {
                scheduleProcessBatchedEvents();
            }
        }
    };

    private void scheduleProcessBatchedEvents() {
        mChoreographer.postCallback(Choreographer.CALLBACK_INPUT,
                mProcessBatchedEventsRunnable, null);
    }

    private void batchMotionEvent(MotionEvent event, int policyFlags) {
        if (mEventQueue == null) {
            mEventQueue = MotionEventHolder.obtain(event, policyFlags);
            scheduleProcessBatchedEvents();
            return;
        }
        if (mEventQueue.event.addBatch(event)) {
            return;
        }
        MotionEventHolder holder = MotionEventHolder.obtain(event, policyFlags);
        holder.next = mEventQueue;
        mEventQueue.previous = holder;
        mEventQueue = holder;
    }

    private void processBatchedEvents(long frameNanos) {
        MotionEventHolder current = mEventQueue;
        if (current == null) {
            return;
        }
        while (current.next != null) {
            current = current.next;
        }
        while (true) {
            if (current == null) {
                mEventQueue = null;
                break;
            }
            if (current.event.getEventTimeNano() >= frameNanos) {
                // 本帧已处理完，剩下的留给下一帧
                current.next = null;
                break;
            }
            handleMotionEvent(current.event, current.policyFlags);
            MotionEventHolder prior = current;
            current = current.previous;
            prior.recycle();
        }
    }

    private void handleMotionEvent(MotionEvent event, int policyFlags) {
        if (mEventHandler != null) {
            mPm.userActivity(event.getEventTime(), false);
            MotionEvent transformedEvent = MotionEvent.obtain(event);
            mEventHandler.onMotionEvent(transformedEvent, event, policyFlags);
            transformedEvent.recycle();
        }
    }
}

关键设计 ：批处理以 frameNanos 为界------eventTime < frameNanos 的事件在本帧处理，>= frameNanos 的留给下一帧。addBatch 利用了 MotionEvent 自身对「同类型 move 事件可合并」的能力，能进一步降低 handler 调用次数。

3.4 链尾 sink：onMotionEvent / onKeyEvent

AccessibilityInputFilter 自己实现 EventStreamTransformation 时，onMotionEvent 与 onKeyEvent 的角色不是「处理」而是「出口」：

源码路径 ：frameworks/base/services/accessibility/java/com/android/server/accessibility/AccessibilityInputFilter.java

java 复制代码

class AccessibilityInputFilter extends InputFilter implements EventStreamTransformation {
    // ...
    @Override
    public void onMotionEvent(MotionEvent transformedEvent, MotionEvent rawEvent,
            int policyFlags) {
        sendInputEvent(transformedEvent, policyFlags);
    }

    @Override
    public void onKeyEvent(KeyEvent event, int policyFlags) {
        sendInputEvent(event, policyFlags);
    }

    @Override
    public void onAccessibilityEvent(AccessibilityEvent event) {
        // TODO Implement this to inject the accessibility event
        //      into the accessibility manager service similarly
        //      to how this is done for input events.
    }

    @Override
    public void setNext(EventStreamTransformation sink) {
        /* do nothing */
    }

    @Override
    public void clearEvents(int inputSource) {
        /* do nothing */
    }
}

关键：链上每个 handler 处理完后，要么消费事件（不调 mNext），要么调用 mNext.onMotionEvent(...) 把（可能被修改的）事件往下传。最终到达 AccessibilityInputFilter.onMotionEvent()，由 sendInputEvent() 把事件送进 WindowManagerService。这构成了一个「入口 = 出口」的环形责任链。

四、EventStreamTransformation ------ 责任链的契约

EventStreamTransformation 是这条链的接口定义。它规定了四个能力：处理触摸事件、处理按键事件、监听无障碍事件、清除状态。它还隐含了两条「责任链契约」：

消费即终止 ：handler 处理完事件后若未调用 mNext，事件即被消费。
取消事件必须向下游广播 ：如果 handler 决定取消当前手势，必须自己构造 ACTION_CANCEL 或 FLAG_CANCELED 事件往下发，否则下游状态机将停留在不一致状态。

源码路径 ：frameworks/base/services/accessibility/java/com/android/server/accessibility/EventStreamTransformation.java

java 复制代码

interface EventStreamTransformation {

    public void onMotionEvent(MotionEvent event, MotionEvent rawEvent, int policyFlags);

    public void onKeyEvent(KeyEvent event, int policyFlags);

    public void onAccessibilityEvent(AccessibilityEvent event);

    public void setNext(EventStreamTransformation next);

    public void clearEvents(int inputSource);

    public void onDestroy();
}

关键设计 ：接口同时暴露「事件流（onMotionEvent/onKeyEvent）」与「无障碍流（onAccessibilityEvent）」两条路径，使得 handler 既能改写输入事件，也能根据 AMS 投递的 AccessibilityEvent 同步自己的内部状态（例如 TouchExplorer 会监听 TYPE_VIEW_HOVER_EXIT 来保证「手势结束」事件严格晚于最后一个 hover exit）。

4.1 责任链结构

按 enableFeatures() 的添加顺序（后加者先看到事件），一个典型 TalkBack 场景下的链形如下：

复制代码

WindowManagerService (InputDispatcher)
        │  onInputEvent(event, policyFlags)
        ▼
AccessibilityInputFilter
        │  onMotionEvent / onKeyEvent (sink)
        ▲
        │  setNext 链
        │
        ├── mAutoclickController            (鼠标自动点击)
        │       │
        │       ▼
        ├── mTouchExplorer                  (触摸探索)
        │       │
        │       ▼
        ├── mMagnificationGestureHandler    (放大镜控制手势)
        │       │
        │       ▼
        ├── mMotionEventInjector            (注入 MotionEvent 出口)
        │       │
        │       ▼
        └── mKeyboardInterceptor            (按键过滤)
                │
                ▼
        AccessibilityInputFilter.onMotionEvent()
                └── sendInputEvent() → WindowManagerService

关键：mTouchExplorer 位于放大镜手势之前，因为触摸探索必须先把单指手势识别为「探索 / 拖拽 / 委托」三种意图之一，放大镜控制手势才有机会介入多指场景。顺序错乱会导致两种 feature 互斥冲突。