JAVA层HIDL服务的注册原理-Android10.0 HwBinder通信原理(八)

摘要：本节主要来讲解Android10.0 JAVA层HIDL服务的注册原理

阅读本文大约需要花费22分钟。

文章首发微信公众号：IngresGe

专注于Android系统级源码分析，Android的平台设计，欢迎关注我，谢谢！

欢迎关注我的公众号！

[Android取经之路] 的源码都基于Android-Q（10.0）进行分析

[Android取经之路] 系列文章：

《系统启动篇》

Android系统架构
Android是怎么启动的
Android 10.0系统启动之init进程
Android10.0系统启动之Zygote进程
Android 10.0 系统启动之SystemServer进程
Android 10.0 系统服务之ActivityMnagerService
Android10.0系统启动之Launcher(桌面)启动流程
Android10.0应用进程创建过程以及Zygote的fork流程
Android 10.0 PackageManagerService（一）工作原理及启动流程
Android 10.0 PackageManagerService（二）权限扫描
Android 10.0 PackageManagerService（三）APK扫描
Android 10.0 PackageManagerService（四）APK安装流程

《日志系统篇》

Android10.0 日志系统分析(一)-logd、logcat 指令说明、分类和属性
Android10.0 日志系统分析(二)-logd、logcat架构分析及日志系统初始化
Android10.0 日志系统分析(三)-logd、logcat读写日志源码分析
Android10.0 日志系统分析(四)-selinux、kernel日志在logd中的实现

《Binder通信原理》：

Android10.0 Binder通信原理(一)Binder、HwBinder、VndBinder概要
Android10.0 Binder通信原理(二)-Binder入门篇
Android10.0 Binder通信原理(三)-ServiceManager篇
Android10.0 Binder通信原理(四)-Native-C\C++实例分析
Android10.0 Binder通信原理(五)-Binder驱动分析
Android10.0 Binder通信原理(六)-Binder数据如何完成定向打击
Android10.0 Binder通信原理(七)-Framework binder示例
Android10.0 Binder通信原理(八)-Framework层分析
Android10.0 Binder通信原理(九)-AIDL Binder示例
Android10.0 Binder通信原理(十)-AIDL原理分析-Proxy-Stub设计模式
Android10.0 Binder通信原理(十一)-Binder总结

《HwBinder通信原理》

HwBinder入门篇-Android10.0 HwBinder通信原理(一)
HIDL详解-Android10.0 HwBinder通信原理(二)
HIDL示例-C++服务创建Client验证-Android10.0 HwBinder通信原理(三)
HIDL示例-JAVA服务创建-Client验证-Android10.0 HwBinder通信原理(四)
HwServiceManager篇-Android10.0 HwBinder通信原理(五)
Native层HIDL服务的注册原理-Android10.0 HwBinder通信原理(六)
Native层HIDL服务的获取原理-Android10.0 HwBinder通信原理(七)
JAVA层HIDL服务的注册原理-Android10.0 HwBinder通信原理(八)
JAVA层HIDL服务的获取原理-Android10.0 HwBinder通信原理（九）
HwBinder驱动篇-Android10.0 HwBinder通信原理(十)
HwBinder原理总结-Android10.0 HwBinder通信原理(十一)

《编译原理》

编译系统入门篇-Android10.0编译系统（一）
编译环境初始化-Android10.0编译系统（二）
make编译过程-Android10.0编译系统（三）
Image打包流程-Android10.0编译系统（四）
Kati详解-Android10.0编译系统（五）

前面我们学习了Native层 HIDL服务的注册获取原理，这一节我们来看看JAVA层HIDL服务的注册原理。

1.概述

上一节中，我们了解了Native层的HIDL服务注册和获取流程，HAL服务的注册和获取，其实就是从HwServiceManager的mServiceMap中，插入和获取对应的hidl服务。通常情况下，HAL的服务都是在Native层，Client可以在Native也可以在framework、应用层。但是Android新引入的HIDL是支持JAVA侧的服务创建和Client验证的，这一节，我们深度分析JAVA层的HAL服务的注册和获取。

JAVA层的HIDL服务注册和获取流程和Native层类似，只是在JAVA到Native层的过渡中，采用了JNI的机制来进行Native层的相关接口转换。

2.JAVA层的HwBinder架构

HwBinder通信原理：

3.HwBinder-JNI

当Init进程启动后，孵化Zygote进程时，会有一个虚拟机注册过程，在这个过程中完成了JNI的注册，我们现在不需要深入去理解JNI的原理，现在我们只要知道 JAVA和Native侧的函数对应关系在哪里即可。

HwBinder的JNI中有个一个HwBinder的映射数组：gMethods。

我们在撸代码时，是要根据JAVA的函数入口找到JNI的函数调用即可，暂时不要太追求细枝末节，等流程理顺后，再专攻细节分析。

Zygote进程启动时，JNI的注册调用栈如下所示：

其中gRegJNI保存了我们不同JNI的入口，里面就包含我们HwBinder的JNI入口

static const RegJNIRec gRegJNI[] = {...REG_JNI(register_android_os_HwBinder),...
};

3.1 register_android_os_HwBinder()

[/frameworks/base/core/jni/android_os_HwBinder.cpp]
int register_android_os_HwBinder(JNIEnv *env) {jclass errorClass = FindClassOrDie(env, "java/lang/Error");gErrorClass = MakeGlobalRefOrDie(env, errorClass);//注册JNI对应的接口return RegisterMethodsOrDie(env, CLASS_PATH, gMethods, NELEM(gMethods));
}

HwBinder JAVA层和Native层的JNI接口对应关系

static JNINativeMethod gMethods[] = {{ "native_init", "()J", (void *)JHwBinder_native_init },{ "native_setup", "()V", (void *)JHwBinder_native_setup },{ "transact","(IL" PACKAGE_PATH "/HwParcel;L" PACKAGE_PATH "/HwParcel;I)V",(void *)JHwBinder_native_transact },{ "registerService", "(Ljava/lang/String;)V",(void *)JHwBinder_native_registerService },{ "getService", "(Ljava/lang/String;Ljava/lang/String;Z)L" PACKAGE_PATH "/IHwBinder;",(void *)JHwBinder_native_getService },{ "configureRpcThreadpool", "(JZ)V",(void *)JHwBinder_native_configureRpcThreadpool },{ "joinRpcThreadpool", "()V",(void *)JHwBinder_native_joinRpcThreadpool },{ "native_report_sysprop_change", "()V",(void *)JHwBinder_report_sysprop_change },
};

我们本节主要分析的就是注册服务：registerService 和获取服务getService

4.IDemo服务注册

JAVA层的HIDL服务注册流程如下图所示：

4.1 服务注册调用栈

4.2 main()

[vendor/ingres/hal_demo/java/src/com/android/demo/Server.java]
public static void main(String args[]){Log.d(TAG, "start");//1.启动HwBinder线程池HwBinder.configureRpcThreadpool(1, true);Demo demo = new Demo();try {//2.注册HIDL服务demo.registerAsService("default");Log.d(TAG, "success to register demo service");} catch (RemoteException ex) {Log.e(TAG, "exception, fail to register demo service");}//3.把当前的进程加入HwBinder的线程池进行循环HwBinder.joinRpcThreadpool();
}

步骤如下：

1.启动HwBinder线程池

2.注册HIDL服务

3.把当前的进程加入HwBinder的线程池进行循环

4.3 registerAsService()

IDemo服务中注册最终调用的是HwBinder的registerService，接着通过JNI，走到了Native层进行服务注册

[out/soong/.intermediates/vendor/ingres/interfaces/demo/1.0/vendor.ingres.demo-V1.0-java_gen_java/gen/srcs/vendor/ingres/demo/V1_0/IDemo.java]
public void registerAsService(String serviceName) throws android.os.RemoteException {registerService(serviceName);
}[/frameworks/base/core/java/android/os/HwBinder.java]
public native final void registerService(String serviceName)throws RemoteException;

4.4 JHwBinder_native_registerService()

[/frameworks/base/core/jni/android_os_HwBinder.cpp]
static void JHwBinder_native_registerService(JNIEnv *env,jobject thiz,jstring serviceNameObj) {ScopedUtfChars str(env, serviceNameObj);if (str.c_str() == nullptr) {return;  // NPE will be pending.}//1.获取一个JHwBinder对象，父类为HwBindersp<hardware::IBinder> binder = JHwBinder::GetNativeBinder(env, thiz);/* TODO(b/33440494) this is not right *///2.创建一个BpHwBase来包装JHwBindersp<hidl::base::V1_0::IBase> base = new hidl::base::V1_0::BpHwBase(binder);//3.拿到HwServiceManager对象auto manager = hardware::defaultServiceManager();if (manager == nullptr) {LOG(ERROR) << "Could not get hwservicemanager.";signalExceptionForError(env, UNKNOWN_ERROR, true /* canThrowRemoteException */);return;}//4.进行服务注册，参数为：服务名称和对象Return<bool> ret = manager->add(str.c_str(), base);bool ok = ret.isOk() && ret;if (ok) {LOG(INFO) << "HwBinder: Starting thread pool for " << str.c_str();::android::hardware::ProcessState::self()->startThreadPool();}signalExceptionForError(env, (ok ? OK : UNKNOWN_ERROR), true /* canThrowRemoteException */);
}

步骤：

1.通过GetNativeBinder获取一个JHwBinder对象，父类为HwBinder

2.创建一个BpHwBase来包装JHwBinder

3.拿到HwServiceManager对象

4.将BpHwBase注册到hwservicemanager中，参数为：服务名称和对象

4.4.1 JHwBinder::GetNativeBinder()

获取一个JHwBinder 对象

[/frameworks/base/core/jni/android_os_HwBinder.cpp]
sp<JHwBinder> JHwBinder::GetNativeBinder(JNIEnv *env, jobject thiz) {//从env中获取之前保存的JHwBinderHolder对象，native_setup时，会创建这个对象，并保存到env中JHwBinderHolder *holder =reinterpret_cast<JHwBinderHolder *>(env->GetLongField(thiz, gFields.contextID));//从JHwBinderHolder对象中取出 JHwBinder对象return holder->get(env, thiz);
}
sp<JHwBinder> get(JNIEnv *env, jobject obj) {Mutex::Autolock autoLock(mLock);sp<JHwBinder> binder = mBinder.promote();if (binder == NULL) {//创建一个JHwBinder对象binder = new JHwBinder(env, obj);mBinder = binder;}return binder;
}

4.4.2 hidl::base::V1_0::BpHwBase(binder)

从HwBinder的成员变量mNativeContext中得到JHwBinderHolder的对象指针，然后调用其get函数得到JHwBinder对象。然后将JHwBinder封装为BpHwBase对象

[/out/soong/.intermediates/system/libhidl/transport/base/1.0/android.hidl.base@1.0_genc++/gen/android/hidl/base/1.0/BaseAll.cpp]
BpHwBase::BpHwBase(const ::android::sp<::android::hardware::IBinder> &_hidl_impl): BpInterface<IBase>(_hidl_impl),::android::hardware::details::HidlInstrumentor("android.hidl.base@1.0", "IBase") {
}

4.4.3 defaultServiceManager

[/system/libhidl/transport/ServiceManagement.cpp]
sp<IServiceManager1_0> defaultServiceManager() {return defaultServiceManager1_2();
}

defaultServiceManager1_2()是用来拿到HwServiceManager的代理对象--BpHwServiceManager


sp<IServiceManager1_2> defaultServiceManager1_2() {using android::hidl::manager::V1_2::BnHwServiceManager;using android::hidl::manager::V1_2::BpHwServiceManager;static std::mutex gDefaultServiceManagerLock;static sp<IServiceManager1_2> gDefaultServiceManager;{std::lock_guard<std::mutex> _l(gDefaultServiceManagerLock);if (gDefaultServiceManager != nullptr) {return gDefaultServiceManager;}//1.检查hwbinder的节点是否存在，如果不存在说明不支持hwbinderif (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {// HwBinder not available on this device or not accessible to// this process.return nullptr;}//2.等待属性"hwservicemanager.ready" 变为true，表明hwservicemanager已经启动好waitForHwServiceManager();while (gDefaultServiceManager == nullptr) {//3.拿到HwServiceManager的代理对象,参考Native层[4.5.1]gDefaultServiceManager =fromBinder<IServiceManager1_2, BpHwServiceManager, BnHwServiceManager>(ProcessState::self()->getContextObject(nullptr));if (gDefaultServiceManager == nullptr) {LOG(ERROR) << "Waited for hwservicemanager, but got nullptr.";sleep(1);}}}return gDefaultServiceManager;
}

至此，我们可以看到JAVA-JNI-Native，三层共有三个对象的转换：HwBinder、JHwBinderHolder、JHwBinder。

它们的类继承如下图所示：

它们的对象关系如下图所示：

4.5 BpHwServiceManager::add()

调用BpHwServiceManager::_hidl_add的方法进行服务注册

[/out/soong/.intermediates/system/libhidl/transport/manager/1.2/android.hidl.manager@1.2_genc++/gen/android/hidl/manager/1.2/ServiceManagerAll.cpp]
::android::hardware::Return<bool> BpHwServiceManager::add(const ::android::hardware::hidl_string& name, const ::android::sp<::android::hidl::base::V1_0::IBase>& service){::android::hardware::Return<bool>  _hidl_out = ::android::hidl::manager::V1_0::BpHwServiceManager::_hidl_add(this, this, name, service);return _hidl_out;
}

4.6 BpHwServiceManager::_hidl_add()

_hidl_add的主要步骤如下：

1.准备两个Parcel结构-- _hidl_data，_hidl_reply

2.组装Parcel数据

3.写入RPC头信息"android.hidl.manager@1.2::IServiceManager"

4.写入服务名称，如果没有配置的话，name为"default"

5.写入服务的实体对象--new Demo()

6.调用remote的transact，发送 12 /* addWithChain */ 的命令进行服务的注册

7.得到返回的reply数据

[/out/soong/.intermediates/system/libhidl/transport/manager/1.2/android.hidl.manager@1.2_genc++/gen/android/hidl/manager/1.2/ServiceManagerAll.cpp]
::android::hardware::Return<bool> BpHwServiceManager::_hidl_add(::android::hardware::IInterface *_hidl_this, ::android::hardware::details::HidlInstrumentor *_hidl_this_instrumentor, const ::android::hardware::hidl_string& name, const ::android::sp<::android::hidl::base::V1_0::IBase>& service) {...::android::hardware::Parcel _hidl_data; //定义一个Parcel的data数据包::android::hardware::Parcel _hidl_reply;//定义一个Parcel的reply数据包::android::status_t _hidl_err;::android::hardware::Status _hidl_status;bool _hidl_out_success;//1.写入RPC头信息"android.hidl.manager@1.2::IServiceManager"_hidl_err = _hidl_data.writeInterfaceToken(BpHwServiceManager::descriptor);if (_hidl_err != ::android::OK) { goto _hidl_error; }size_t _hidl_name_parent;//2.写入服务名称，如果没有配置的话，name为"default"_hidl_err = _hidl_data.writeBuffer(&name, sizeof(name), &_hidl_name_parent);if (_hidl_err != ::android::OK) { goto _hidl_error; }_hidl_err = ::android::hardware::writeEmbeddedToParcel(name,&_hidl_data,_hidl_name_parent,0 /* parentOffset */);if (_hidl_err != ::android::OK) { goto _hidl_error; }if (service == nullptr) {_hidl_err = _hidl_data.writeStrongBinder(nullptr);} else {//3.根据传入的service，获取对应的hidl binder实体，把一个binder实体“打扁”并写入parcel，实体为 new Demo()::android::sp<::android::hardware::IBinder> _hidl_binder = ::android::hardware::getOrCreateCachedBinder(service.get());if (_hidl_binder.get() != nullptr) {_hidl_err = _hidl_data.writeStrongBinder(_hidl_binder);} else {_hidl_err = ::android::UNKNOWN_ERROR;}}if (_hidl_err != ::android::OK) { goto _hidl_error; }//4.启动一个线程池::android::hardware::ProcessState::self()->startThreadPool();//5.调用BpHwBinder::transact()，asBinder转换过程，参考下图//_hidl_this 指的是 BpHwServiceManager，通过asBinder转换为传输层面的BpHwBinder对象，其实就是取出BpHwServiceManager的成员变量mRemote的值_hidl_err = ::android::hardware::IInterface::asBinder(_hidl_this)->transact(2 /* add */, _hidl_data, &_hidl_reply);if (_hidl_err != ::android::OK) { goto _hidl_error; }//6.从_hidl_reply读取返回结果_hidl_err = ::android::hardware::readFromParcel(&_hidl_status, _hidl_reply);if (_hidl_err != ::android::OK) { goto _hidl_error; }if (!_hidl_status.isOk()) { return _hidl_status; }_hidl_err = _hidl_reply.readBool(&_hidl_out_success);if (_hidl_err != ::android::OK) { goto _hidl_error; }#ifdef __ANDROID_DEBUGGABLE__if (UNLIKELY(mEnableInstrumentation)) {std::vector<void *> _hidl_args;_hidl_args.push_back((void *)&_hidl_out_success);for (const auto &callback: mInstrumentationCallbacks) {callback(InstrumentationEvent::CLIENT_API_EXIT, "android.hidl.manager", "1.0", "IServiceManager", "add", &_hidl_args);}}#endif // __ANDROID_DEBUGGABLE___hidl_status.setFromStatusT(_hidl_err);return ::android::hardware::Return<bool>(_hidl_out_success);_hidl_error:_hidl_status.setFromStatusT(_hidl_err);return ::android::hardware::Return<bool>(_hidl_status);
}

BpHwBinder::transact调用后，会把组装的Parcel数据传到/dev/hwbinder,HwServiceManager发现hwbinder有数据变化，进行数据读取，最终根据传入的code=2，找到_hidl_add，进行服务注册

调用栈如下：

4.7 BnHwServiceManager::_hidl_add

_hidl_add()主要步骤如下：

1.读取注册的Service Name

2. 读取注册的hidl_binder

3.通过hidl_binder,转换得到，注册时的服务实体

4.调用ServiceManager::add()，进行服务注册

5.向_hidl_reply中写入OK

6.把服务注册的结构，写入_hidl_reply

7.返回replay数据


[/out/soong/.intermediates/system/libhidl/transport/manager/1.2/android.hidl.manager@1.2_genc++/gen/android/hidl/manager/1.2/ServiceManagerAll.cpp]
::android::status_t BnHwServiceManager::_hidl_add(::android::hidl::base::V1_0::BnHwBase* _hidl_this,const ::android::hardware::Parcel &_hidl_data,::android::hardware::Parcel *_hidl_reply,TransactCallback _hidl_cb) {...const ::android::hardware::hidl_string* name;::android::sp<::android::hidl::base::V1_0::IBase> service;size_t _hidl_name_parent;//1.读取注册的Service Name_hidl_err = _hidl_data.readBuffer(sizeof(*name), &_hidl_name_parent,  reinterpret_cast<const void **>(&name));if (_hidl_err != ::android::OK) { return _hidl_err; }_hidl_err = ::android::hardware::readEmbeddedFromParcel(const_cast<::android::hardware::hidl_string &>(*name),_hidl_data,_hidl_name_parent,0 /* parentOffset */);if (_hidl_err != ::android::OK) { return _hidl_err; }{//2. 读取注册的hidl_binder::android::sp<::android::hardware::IBinder> _hidl_binder;_hidl_err = _hidl_data.readNullableStrongBinder(&_hidl_binder);if (_hidl_err != ::android::OK) { return _hidl_err; }//3.通过hidl_binder,转换得到，注册时的服务实体service = ::android::hardware::fromBinder<::android::hidl::base::V1_0::IBase,::android::hidl::base::V1_0::BpHwBase,::android::hidl::base::V1_0::BnHwBase>(_hidl_binder);}atrace_begin(ATRACE_TAG_HAL, "HIDL::IServiceManager::add::server");...//5.调用ServiceManager::add()，进行服务注册，参考[4.7.2]bool _hidl_out_success = static_cast<IServiceManager*>(_hidl_this->getImpl().get())->add(*name, service);//6.向_hidl_reply中写入OK::android::hardware::writeToParcel(::android::hardware::Status::ok(), _hidl_reply);//7.把服务注册的结构，写入_hidl_reply_hidl_err = _hidl_reply->writeBool(_hidl_out_success);/* _hidl_err ignored! */atrace_end(ATRACE_TAG_HAL);...//8.返回replay数据_hidl_cb(*_hidl_reply);return _hidl_err;
}

_hidl_add的调用栈如下：

4.7.2 ServiceManager::addImpl()

获取当前binder调用的pid、sid 上下文信息后，开始注册服务，即把Demo对象注册到mServiceMap中

在过程中，要进行selinux检查，确认该进程有权限添加service后，再检查是否有重复注册，而且如果子类在父类上注册，则注销它，

排除一切问题后，把需要注册的服务，注册到mServiceMap中，最后建立一个死亡连接，当服务挂掉时会接收到通知，做一些清理工作。

[/system/hwservicemanager/ServiceManager.cpp]
bool ServiceManager::addImpl(const std::string& name,const sp<IBase>& service,const hidl_vec<hidl_string>& interfaceChain,const AccessControl::CallingContext& callingContext) {//传入的interfaceChain size大于0if (interfaceChain.size() == 0) {LOG(WARNING) << "Empty interface chain for " << name;return false;}//1.首先，检查是否有权限来否允许add()整个接口层次结构,最终调用的是selinux_check_access来检查，是否有 hwservice_manager的权限for(size_t i = 0; i < interfaceChain.size(); i++) {const std::string fqName = interfaceChain[i];if (!mAcl.canAdd(fqName, callingContext)) {return false;}}// 2.检查是否有重复注册if (interfaceChain.size() > 1) {// 倒数第二的条目应该是除IBase之外的最高基类。const std::string baseFqName = interfaceChain[interfaceChain.size() - 2];const HidlService *hidlService = lookup(baseFqName, name);if (hidlService != nullptr && hidlService->getService() != nullptr) {// This shouldn't occur during normal operation. Here are some cases where// it might get hit:// - bad configuration (service installed on device multiple times)// - race between death notification and a new service being registered//     (previous logs should indicate a separate problem)const std::string childFqName = interfaceChain[0];pid_t newServicePid = IPCThreadState::self()->getCallingPid();pid_t oldServicePid = hidlService->getDebugPid();LOG(WARNING) << "Detected instance of " << childFqName << " (pid: " << newServicePid<< ") registering over instance of or with base of " << baseFqName << " (pid: "<< oldServicePid << ").";}}// 3.如果子类在父类上注册，则注销它{// For IBar extends IFoo if IFoo/default is being registered, remove// IBar/default. This makes sure the following two things are equivalent// 1). IBar::castFrom(IFoo::getService(X))// 2). IBar::getService(X)// assuming that IBar is declared in the device manifest and there// is also not an IBaz extends IFoo and there is no race.const std::string childFqName = interfaceChain[0];const HidlService *hidlService = lookup(childFqName, name);if (hidlService != nullptr) {const sp<IBase> remove = hidlService->getService();if (remove != nullptr) {const std::string instanceName = name;removeService(remove, &instanceName /* restrictToInstanceName */);}}}// 4.排除问题后，把需要注册的服务，注册到mServiceMap中for(size_t i = 0; i < interfaceChain.size(); i++) {const std::string fqName = interfaceChain[i];PackageInterfaceMap &ifaceMap = mServiceMap[fqName];HidlService *hidlService = ifaceMap.lookup(name);if (hidlService == nullptr) {//服务插入 mServiceMap，以后从这取出服务，参考 [4.9.3]ifaceMap.insertService(std::make_unique<HidlService>(fqName, name, service, callingContext.pid));} else {hidlService->setService(service, callingContext.pid);}ifaceMap.sendPackageRegistrationNotification(fqName, name);}//建立一个死亡连接，当服务挂掉时会接收到通知，做一些清理工作bool linkRet = service->linkToDeath(this, kServiceDiedCookie).withDefault(false);if (!linkRet) {LOG(ERROR) << "Could not link to death for " << interfaceChain[0] << "/" << name;}return true;
}

4.8 PackageInterfaceMap::insertService()

把传入的hidlservice插入到mInstanceMap 中，即 mServiceMap的value--PackageInterfaceMap 中

[/system/hwservicemanager/ServiceManager.cpp]
void ServiceManager::PackageInterfaceMap::insertService(std::unique_ptr<HidlService> &&service) {mInstanceMap.insert({service->getInstanceName(), std::move(service)});
}

HwServiceManager中hidl服务的管理map：

至此，我们JAVA层的IDemo服务注册完成，对象转换如下图所示：

注册步骤分为以下几个步骤：

1.服务进程先通过JNI注册得到一个JHwBinder对象

2.获取HwServiceManager的代理对象HwBpServiceManager，主要通过new BpHwBinder(0)得到。

3.调用HwBpServiceManager的_hidl_add，组装一个Parce数据，传入服务名称、服务实体对象--BHwBinder、执行2 /* add */

4.先通过IPCThreadThread的writeTransactionData()把上面的Parcel数据写入mOut，用来进行发送

5.通过IPCThreadThread的talkWithDriver()与HwBinder驱动通信，传递语义BINDER_WRITE_READ

6.HwServiceManager有个for循环，调用epoll_wait()监控hwbinder的变化

7.waitForResponse()收到BR_TRANSACTION响应码后，最终后调用executeCommand()进行命令执行，根据逻辑处理，最终会调用到BnHwServiceManager::onTransact()，根据传入的code=12,调用addWithChain，最终把服务名称和实体对象插入到mServiceMap这个map中

8.注册成功后，把注册结果写入reply，返回reply信息

9.最终完成服务的注册流程

下一节，我们一起来看看《JAVA层HIDL服务的获取原理》

我的微信公众号：IngresGe