Parcel.cpp revision 0d2a22ece851b5ee358ac18214ccbfa28c3eb121 
1/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "Parcel"
18//#define LOG_NDEBUG 0
19
20#include <binder/Parcel.h>
21
22#include <binder/IPCThreadState.h>
23#include <binder/Binder.h>
24#include <binder/BpBinder.h>
25#include <binder/ProcessState.h>
26#include <binder/TextOutput.h>
27
28#include <errno.h>
29#include <utils/Debug.h>
30#include <utils/Log.h>
31#include <utils/String8.h>
32#include <utils/String16.h>
33#include <utils/misc.h>
34#include <utils/Flattenable.h>
35#include <cutils/ashmem.h>
36
37#include <private/binder/binder_module.h>
38#include <private/binder/Static.h>
39
40#include <inttypes.h>
41#include <stdio.h>
42#include <stdlib.h>
43#include <stdint.h>
44#include <sys/mman.h>
45
46#ifndef INT32_MAX
47#define INT32_MAX ((int32_t)(2147483647))
48#endif
49
50#define LOG_REFS(...)
51//#define LOG_REFS(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
52#define LOG_ALLOC(...)
53//#define LOG_ALLOC(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
54
55// ---------------------------------------------------------------------------
56
57// This macro should never be used at runtime, as a too large value
58// of s could cause an integer overflow. Instead, you should always
59// use the wrapper function pad_size()
60#define PAD_SIZE_UNSAFE(s) (((s)+3)&~3)
61
62static size_t pad_size(size_t s) {
63    if (s > (SIZE_T_MAX - 3)) {
64        abort();
65    }
66    return PAD_SIZE_UNSAFE(s);
67}
68
69// Note: must be kept in sync with android/os/StrictMode.java's PENALTY_GATHER
70#define STRICT_MODE_PENALTY_GATHER (0x40 << 16)
71
72// Note: must be kept in sync with android/os/Parcel.java's EX_HAS_REPLY_HEADER
73#define EX_HAS_REPLY_HEADER -128
74
75// XXX This can be made public if we want to provide
76// support for typed data.
77struct small_flat_data
78{
79    uint32_t type;
80    uint32_t data;
81};
82
83namespace android {
84
85static pthread_mutex_t gParcelGlobalAllocSizeLock = PTHREAD_MUTEX_INITIALIZER;
86static size_t gParcelGlobalAllocSize = 0;
87static size_t gParcelGlobalAllocCount = 0;
88
89// Maximum size of a blob to transfer in-place.
90static const size_t BLOB_INPLACE_LIMIT = 16 * 1024;
91
92enum {
93    BLOB_INPLACE = 0,
94    BLOB_ASHMEM_IMMUTABLE = 1,
95    BLOB_ASHMEM_MUTABLE = 2,
96};
97
98void acquire_object(const sp<ProcessState>& proc,
99    const flat_binder_object& obj, const void* who, size_t* outAshmemSize)
100{
101    switch (obj.type) {
102        case BINDER_TYPE_BINDER:
103            if (obj.binder) {
104                LOG_REFS("Parcel %p acquiring reference on local %p", who, obj.cookie);
105                reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who);
106            }
107            return;
108        case BINDER_TYPE_WEAK_BINDER:
109            if (obj.binder)
110                reinterpret_cast<RefBase::weakref_type*>(obj.binder)->incWeak(who);
111            return;
112        case BINDER_TYPE_HANDLE: {
113            const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
114            if (b != NULL) {
115                LOG_REFS("Parcel %p acquiring reference on remote %p", who, b.get());
116                b->incStrong(who);
117            }
118            return;
119        }
120        case BINDER_TYPE_WEAK_HANDLE: {
121            const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
122            if (b != NULL) b.get_refs()->incWeak(who);
123            return;
124        }
125        case BINDER_TYPE_FD: {
126            if (obj.cookie != 0) {
127                if (outAshmemSize != NULL) {
128                    // If we own an ashmem fd, keep track of how much memory it refers to.
129                    int size = ashmem_get_size_region(obj.handle);
130                    if (size > 0) {
131                        *outAshmemSize += size;
132                    }
133                }
134            }
135            return;
136        }
137    }
138
139    ALOGD("Invalid object type 0x%08x", obj.type);
140}
141
142void acquire_object(const sp<ProcessState>& proc,
143    const flat_binder_object& obj, const void* who)
144{
145    acquire_object(proc, obj, who, NULL);
146}
147
148static void release_object(const sp<ProcessState>& proc,
149    const flat_binder_object& obj, const void* who, size_t* outAshmemSize)
150{
151    switch (obj.type) {
152        case BINDER_TYPE_BINDER:
153            if (obj.binder) {
154                LOG_REFS("Parcel %p releasing reference on local %p", who, obj.cookie);
155                reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who);
156            }
157            return;
158        case BINDER_TYPE_WEAK_BINDER:
159            if (obj.binder)
160                reinterpret_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who);
161            return;
162        case BINDER_TYPE_HANDLE: {
163            const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
164            if (b != NULL) {
165                LOG_REFS("Parcel %p releasing reference on remote %p", who, b.get());
166                b->decStrong(who);
167            }
168            return;
169        }
170        case BINDER_TYPE_WEAK_HANDLE: {
171            const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
172            if (b != NULL) b.get_refs()->decWeak(who);
173            return;
174        }
175        case BINDER_TYPE_FD: {
176            if (outAshmemSize != NULL) {
177                if (obj.cookie != 0) {
178                    int size = ashmem_get_size_region(obj.handle);
179                    if (size > 0) {
180                        *outAshmemSize -= size;
181                    }
182
183                    close(obj.handle);
184                }
185            }
186            return;
187        }
188    }
189
190    ALOGE("Invalid object type 0x%08x", obj.type);
191}
192
193void release_object(const sp<ProcessState>& proc,
194    const flat_binder_object& obj, const void* who)
195{
196    release_object(proc, obj, who, NULL);
197}
198
199inline static status_t finish_flatten_binder(
200    const sp<IBinder>& /*binder*/, const flat_binder_object& flat, Parcel* out)
201{
202    return out->writeObject(flat, false);
203}
204
205status_t flatten_binder(const sp<ProcessState>& /*proc*/,
206    const sp<IBinder>& binder, Parcel* out)
207{
208    flat_binder_object obj;
209
210    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
211    if (binder != NULL) {
212        IBinder *local = binder->localBinder();
213        if (!local) {
214            BpBinder *proxy = binder->remoteBinder();
215            if (proxy == NULL) {
216                ALOGE("null proxy");
217            }
218            const int32_t handle = proxy ? proxy->handle() : 0;
219            obj.type = BINDER_TYPE_HANDLE;
220            obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
221            obj.handle = handle;
222            obj.cookie = 0;
223        } else {
224            obj.type = BINDER_TYPE_BINDER;
225            obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
226            obj.cookie = reinterpret_cast<uintptr_t>(local);
227        }
228    } else {
229        obj.type = BINDER_TYPE_BINDER;
230        obj.binder = 0;
231        obj.cookie = 0;
232    }
233
234    return finish_flatten_binder(binder, obj, out);
235}
236
237status_t flatten_binder(const sp<ProcessState>& /*proc*/,
238    const wp<IBinder>& binder, Parcel* out)
239{
240    flat_binder_object obj;
241
242    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
243    if (binder != NULL) {
244        sp<IBinder> real = binder.promote();
245        if (real != NULL) {
246            IBinder *local = real->localBinder();
247            if (!local) {
248                BpBinder *proxy = real->remoteBinder();
249                if (proxy == NULL) {
250                    ALOGE("null proxy");
251                }
252                const int32_t handle = proxy ? proxy->handle() : 0;
253                obj.type = BINDER_TYPE_WEAK_HANDLE;
254                obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
255                obj.handle = handle;
256                obj.cookie = 0;
257            } else {
258                obj.type = BINDER_TYPE_WEAK_BINDER;
259                obj.binder = reinterpret_cast<uintptr_t>(binder.get_refs());
260                obj.cookie = reinterpret_cast<uintptr_t>(binder.unsafe_get());
261            }
262            return finish_flatten_binder(real, obj, out);
263        }
264
265        // XXX How to deal?  In order to flatten the given binder,
266        // we need to probe it for information, which requires a primary
267        // reference...  but we don't have one.
268        //
269        // The OpenBinder implementation uses a dynamic_cast<> here,
270        // but we can't do that with the different reference counting
271        // implementation we are using.
272        ALOGE("Unable to unflatten Binder weak reference!");
273        obj.type = BINDER_TYPE_BINDER;
274        obj.binder = 0;
275        obj.cookie = 0;
276        return finish_flatten_binder(NULL, obj, out);
277
278    } else {
279        obj.type = BINDER_TYPE_BINDER;
280        obj.binder = 0;
281        obj.cookie = 0;
282        return finish_flatten_binder(NULL, obj, out);
283    }
284}
285
286inline static status_t finish_unflatten_binder(
287    BpBinder* /*proxy*/, const flat_binder_object& /*flat*/,
288    const Parcel& /*in*/)
289{
290    return NO_ERROR;
291}
292
293status_t unflatten_binder(const sp<ProcessState>& proc,
294    const Parcel& in, sp<IBinder>* out)
295{
296    const flat_binder_object* flat = in.readObject(false);
297
298    if (flat) {
299        switch (flat->type) {
300            case BINDER_TYPE_BINDER:
301                *out = reinterpret_cast<IBinder*>(flat->cookie);
302                return finish_unflatten_binder(NULL, *flat, in);
303            case BINDER_TYPE_HANDLE:
304                *out = proc->getStrongProxyForHandle(flat->handle);
305                return finish_unflatten_binder(
306                    static_cast<BpBinder*>(out->get()), *flat, in);
307        }
308    }
309    return BAD_TYPE;
310}
311
312status_t unflatten_binder(const sp<ProcessState>& proc,
313    const Parcel& in, wp<IBinder>* out)
314{
315    const flat_binder_object* flat = in.readObject(false);
316
317    if (flat) {
318        switch (flat->type) {
319            case BINDER_TYPE_BINDER:
320                *out = reinterpret_cast<IBinder*>(flat->cookie);
321                return finish_unflatten_binder(NULL, *flat, in);
322            case BINDER_TYPE_WEAK_BINDER:
323                if (flat->binder != 0) {
324                    out->set_object_and_refs(
325                        reinterpret_cast<IBinder*>(flat->cookie),
326                        reinterpret_cast<RefBase::weakref_type*>(flat->binder));
327                } else {
328                    *out = NULL;
329                }
330                return finish_unflatten_binder(NULL, *flat, in);
331            case BINDER_TYPE_HANDLE:
332            case BINDER_TYPE_WEAK_HANDLE:
333                *out = proc->getWeakProxyForHandle(flat->handle);
334                return finish_unflatten_binder(
335                    static_cast<BpBinder*>(out->unsafe_get()), *flat, in);
336        }
337    }
338    return BAD_TYPE;
339}
340
341// ---------------------------------------------------------------------------
342
343Parcel::Parcel()
344{
345    LOG_ALLOC("Parcel %p: constructing", this);
346    initState();
347}
348
349Parcel::~Parcel()
350{
351    freeDataNoInit();
352    LOG_ALLOC("Parcel %p: destroyed", this);
353}
354
355size_t Parcel::getGlobalAllocSize() {
356    pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
357    size_t size = gParcelGlobalAllocSize;
358    pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
359    return size;
360}
361
362size_t Parcel::getGlobalAllocCount() {
363    pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
364    size_t count = gParcelGlobalAllocCount;
365    pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
366    return count;
367}
368
369const uint8_t* Parcel::data() const
370{
371    return mData;
372}
373
374size_t Parcel::dataSize() const
375{
376    return (mDataSize > mDataPos ? mDataSize : mDataPos);
377}
378
379size_t Parcel::dataAvail() const
380{
381    // TODO: decide what to do about the possibility that this can
382    // report an available-data size that exceeds a Java int's max
383    // positive value, causing havoc.  Fortunately this will only
384    // happen if someone constructs a Parcel containing more than two
385    // gigabytes of data, which on typical phone hardware is simply
386    // not possible.
387    return dataSize() - dataPosition();
388}
389
390size_t Parcel::dataPosition() const
391{
392    return mDataPos;
393}
394
395size_t Parcel::dataCapacity() const
396{
397    return mDataCapacity;
398}
399
400status_t Parcel::setDataSize(size_t size)
401{
402    if (size > INT32_MAX) {
403        // don't accept size_t values which may have come from an
404        // inadvertent conversion from a negative int.
405        return BAD_VALUE;
406    }
407
408    status_t err;
409    err = continueWrite(size);
410    if (err == NO_ERROR) {
411        mDataSize = size;
412        ALOGV("setDataSize Setting data size of %p to %zu", this, mDataSize);
413    }
414    return err;
415}
416
417void Parcel::setDataPosition(size_t pos) const
418{
419    if (pos > INT32_MAX) {
420        // don't accept size_t values which may have come from an
421        // inadvertent conversion from a negative int.
422        abort();
423    }
424
425    mDataPos = pos;
426    mNextObjectHint = 0;
427}
428
429status_t Parcel::setDataCapacity(size_t size)
430{
431    if (size > INT32_MAX) {
432        // don't accept size_t values which may have come from an
433        // inadvertent conversion from a negative int.
434        return BAD_VALUE;
435    }
436
437    if (size > mDataCapacity) return continueWrite(size);
438    return NO_ERROR;
439}
440
441status_t Parcel::setData(const uint8_t* buffer, size_t len)
442{
443    if (len > INT32_MAX) {
444        // don't accept size_t values which may have come from an
445        // inadvertent conversion from a negative int.
446        return BAD_VALUE;
447    }
448
449    status_t err = restartWrite(len);
450    if (err == NO_ERROR) {
451        memcpy(const_cast<uint8_t*>(data()), buffer, len);
452        mDataSize = len;
453        mFdsKnown = false;
454    }
455    return err;
456}
457
458status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
459{
460    const sp<ProcessState> proc(ProcessState::self());
461    status_t err;
462    const uint8_t *data = parcel->mData;
463    const binder_size_t *objects = parcel->mObjects;
464    size_t size = parcel->mObjectsSize;
465    int startPos = mDataPos;
466    int firstIndex = -1, lastIndex = -2;
467
468    if (len == 0) {
469        return NO_ERROR;
470    }
471
472    if (len > INT32_MAX) {
473        // don't accept size_t values which may have come from an
474        // inadvertent conversion from a negative int.
475        return BAD_VALUE;
476    }
477
478    // range checks against the source parcel size
479    if ((offset > parcel->mDataSize)
480            || (len > parcel->mDataSize)
481            || (offset + len > parcel->mDataSize)) {
482        return BAD_VALUE;
483    }
484
485    // Count objects in range
486    for (int i = 0; i < (int) size; i++) {
487        size_t off = objects[i];
488        if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
489            if (firstIndex == -1) {
490                firstIndex = i;
491            }
492            lastIndex = i;
493        }
494    }
495    int numObjects = lastIndex - firstIndex + 1;
496
497    if ((mDataSize+len) > mDataCapacity) {
498        // grow data
499        err = growData(len);
500        if (err != NO_ERROR) {
501            return err;
502        }
503    }
504
505    // append data
506    memcpy(mData + mDataPos, data + offset, len);
507    mDataPos += len;
508    mDataSize += len;
509
510    err = NO_ERROR;
511
512    if (numObjects > 0) {
513        // grow objects
514        if (mObjectsCapacity < mObjectsSize + numObjects) {
515            size_t newSize = ((mObjectsSize + numObjects)*3)/2;
516            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
517            binder_size_t *objects =
518                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
519            if (objects == (binder_size_t*)0) {
520                return NO_MEMORY;
521            }
522            mObjects = objects;
523            mObjectsCapacity = newSize;
524        }
525
526        // append and acquire objects
527        int idx = mObjectsSize;
528        for (int i = firstIndex; i <= lastIndex; i++) {
529            size_t off = objects[i] - offset + startPos;
530            mObjects[idx++] = off;
531            mObjectsSize++;
532
533            flat_binder_object* flat
534                = reinterpret_cast<flat_binder_object*>(mData + off);
535            acquire_object(proc, *flat, this, &mOpenAshmemSize);
536
537            if (flat->type == BINDER_TYPE_FD) {
538                // If this is a file descriptor, we need to dup it so the
539                // new Parcel now owns its own fd, and can declare that we
540                // officially know we have fds.
541                flat->handle = dup(flat->handle);
542                flat->cookie = 1;
543                mHasFds = mFdsKnown = true;
544                if (!mAllowFds) {
545                    err = FDS_NOT_ALLOWED;
546                }
547            }
548        }
549    }
550
551    return err;
552}
553
554bool Parcel::allowFds() const
555{
556    return mAllowFds;
557}
558
559bool Parcel::pushAllowFds(bool allowFds)
560{
561    const bool origValue = mAllowFds;
562    if (!allowFds) {
563        mAllowFds = false;
564    }
565    return origValue;
566}
567
568void Parcel::restoreAllowFds(bool lastValue)
569{
570    mAllowFds = lastValue;
571}
572
573bool Parcel::hasFileDescriptors() const
574{
575    if (!mFdsKnown) {
576        scanForFds();
577    }
578    return mHasFds;
579}
580
581// Write RPC headers.  (previously just the interface token)
582status_t Parcel::writeInterfaceToken(const String16& interface)
583{
584    writeInt32(IPCThreadState::self()->getStrictModePolicy() |
585               STRICT_MODE_PENALTY_GATHER);
586    // currently the interface identification token is just its name as a string
587    return writeString16(interface);
588}
589
590bool Parcel::checkInterface(IBinder* binder) const
591{
592    return enforceInterface(binder->getInterfaceDescriptor());
593}
594
595bool Parcel::enforceInterface(const String16& interface,
596                              IPCThreadState* threadState) const
597{
598    int32_t strictPolicy = readInt32();
599    if (threadState == NULL) {
600        threadState = IPCThreadState::self();
601    }
602    if ((threadState->getLastTransactionBinderFlags() &
603         IBinder::FLAG_ONEWAY) != 0) {
604      // For one-way calls, the callee is running entirely
605      // disconnected from the caller, so disable StrictMode entirely.
606      // Not only does disk/network usage not impact the caller, but
607      // there's no way to commuicate back any violations anyway.
608      threadState->setStrictModePolicy(0);
609    } else {
610      threadState->setStrictModePolicy(strictPolicy);
611    }
612    const String16 str(readString16());
613    if (str == interface) {
614        return true;
615    } else {
616        ALOGW("**** enforceInterface() expected '%s' but read '%s'",
617                String8(interface).string(), String8(str).string());
618        return false;
619    }
620}
621
622const binder_size_t* Parcel::objects() const
623{
624    return mObjects;
625}
626
627size_t Parcel::objectsCount() const
628{
629    return mObjectsSize;
630}
631
632status_t Parcel::errorCheck() const
633{
634    return mError;
635}
636
637void Parcel::setError(status_t err)
638{
639    mError = err;
640}
641
642status_t Parcel::finishWrite(size_t len)
643{
644    if (len > INT32_MAX) {
645        // don't accept size_t values which may have come from an
646        // inadvertent conversion from a negative int.
647        return BAD_VALUE;
648    }
649
650    //printf("Finish write of %d\n", len);
651    mDataPos += len;
652    ALOGV("finishWrite Setting data pos of %p to %zu", this, mDataPos);
653    if (mDataPos > mDataSize) {
654        mDataSize = mDataPos;
655        ALOGV("finishWrite Setting data size of %p to %zu", this, mDataSize);
656    }
657    //printf("New pos=%d, size=%d\n", mDataPos, mDataSize);
658    return NO_ERROR;
659}
660
661status_t Parcel::writeUnpadded(const void* data, size_t len)
662{
663    if (len > INT32_MAX) {
664        // don't accept size_t values which may have come from an
665        // inadvertent conversion from a negative int.
666        return BAD_VALUE;
667    }
668
669    size_t end = mDataPos + len;
670    if (end < mDataPos) {
671        // integer overflow
672        return BAD_VALUE;
673    }
674
675    if (end <= mDataCapacity) {
676restart_write:
677        memcpy(mData+mDataPos, data, len);
678        return finishWrite(len);
679    }
680
681    status_t err = growData(len);
682    if (err == NO_ERROR) goto restart_write;
683    return err;
684}
685
686status_t Parcel::write(const void* data, size_t len)
687{
688    if (len > INT32_MAX) {
689        // don't accept size_t values which may have come from an
690        // inadvertent conversion from a negative int.
691        return BAD_VALUE;
692    }
693
694    void* const d = writeInplace(len);
695    if (d) {
696        memcpy(d, data, len);
697        return NO_ERROR;
698    }
699    return mError;
700}
701
702void* Parcel::writeInplace(size_t len)
703{
704    if (len > INT32_MAX) {
705        // don't accept size_t values which may have come from an
706        // inadvertent conversion from a negative int.
707        return NULL;
708    }
709
710    const size_t padded = pad_size(len);
711
712    // sanity check for integer overflow
713    if (mDataPos+padded < mDataPos) {
714        return NULL;
715    }
716
717    if ((mDataPos+padded) <= mDataCapacity) {
718restart_write:
719        //printf("Writing %ld bytes, padded to %ld\n", len, padded);
720        uint8_t* const data = mData+mDataPos;
721
722        // Need to pad at end?
723        if (padded != len) {
724#if BYTE_ORDER == BIG_ENDIAN
725            static const uint32_t mask[4] = {
726                0x00000000, 0xffffff00, 0xffff0000, 0xff000000
727            };
728#endif
729#if BYTE_ORDER == LITTLE_ENDIAN
730            static const uint32_t mask[4] = {
731                0x00000000, 0x00ffffff, 0x0000ffff, 0x000000ff
732            };
733#endif
734            //printf("Applying pad mask: %p to %p\n", (void*)mask[padded-len],
735            //    *reinterpret_cast<void**>(data+padded-4));
736            *reinterpret_cast<uint32_t*>(data+padded-4) &= mask[padded-len];
737        }
738
739        finishWrite(padded);
740        return data;
741    }
742
743    status_t err = growData(padded);
744    if (err == NO_ERROR) goto restart_write;
745    return NULL;
746}
747
748status_t Parcel::writeByteVector(const std::vector<int8_t>& val)
749{
750    if (val.size() > std::numeric_limits<int32_t>::max()) {
751        return BAD_VALUE;
752    }
753
754    status_t status = writeInt32(val.size());
755
756    if (status != OK) {
757        return status;
758    }
759
760    for (const auto& item : val) {
761        status = writeByte(item);
762
763        if (status != OK) {
764            return status;
765        }
766    }
767
768    return OK;
769}
770
771status_t Parcel::writeInt32Vector(const std::vector<int32_t>& val)
772{
773    if (val.size() > std::numeric_limits<int32_t>::max()) {
774        return BAD_VALUE;
775    }
776
777    status_t status = writeInt32(val.size());
778
779    if (status != OK) {
780        return status;
781    }
782
783    for (const auto& item : val) {
784        status = writeInt32(item);
785
786        if (status != OK) {
787            return status;
788        }
789    }
790
791    return OK;
792}
793
794status_t Parcel::writeInt64Vector(const std::vector<int64_t>& val)
795{
796    if (val.size() > std::numeric_limits<int32_t>::max()) {
797        return BAD_VALUE;
798    }
799
800    status_t status = writeInt32(val.size());
801
802    if (status != OK) {
803        return status;
804    }
805
806    for (const auto& item : val) {
807        status = writeInt64(item);
808
809        if (status != OK) {
810            return status;
811        }
812    }
813
814    return OK;
815}
816
817status_t Parcel::writeFloatVector(const std::vector<float>& val)
818{
819    if (val.size() > std::numeric_limits<int32_t>::max()) {
820        return BAD_VALUE;
821    }
822
823    status_t status = writeInt32(val.size());
824
825    if (status != OK) {
826        return status;
827    }
828
829    for (const auto& item : val) {
830        status = writeFloat(item);
831
832        if (status != OK) {
833            return status;
834        }
835    }
836
837    return OK;
838}
839
840status_t Parcel::writeDoubleVector(const std::vector<double>& val)
841{
842    if (val.size() > std::numeric_limits<int32_t>::max()) {
843        return BAD_VALUE;
844    }
845
846    status_t status = writeInt32(val.size());
847
848    if (status != OK) {
849        return status;
850    }
851
852    for (const auto& item : val) {
853        status = writeDouble(item);
854
855        if (status != OK) {
856            return status;
857        }
858    }
859
860    return OK;
861}
862
863status_t Parcel::writeBoolVector(const std::vector<bool>& val)
864{
865    if (val.size() > std::numeric_limits<int32_t>::max()) {
866        return BAD_VALUE;
867    }
868
869    status_t status = writeInt32(val.size());
870
871    if (status != OK) {
872        return status;
873    }
874
875    for (const auto& item : val) {
876        status = writeBool(item);
877
878        if (status != OK) {
879            return status;
880        }
881    }
882
883    return OK;
884}
885
886status_t Parcel::writeCharVector(const std::vector<char16_t>& val)
887{
888    if (val.size() > std::numeric_limits<int32_t>::max()) {
889        return BAD_VALUE;
890    }
891
892    status_t status = writeInt32(val.size());
893
894    if (status != OK) {
895        return status;
896    }
897
898    for (const auto& item : val) {
899        status = writeChar(item);
900
901        if (status != OK) {
902            return status;
903        }
904    }
905
906    return OK;
907}
908
909status_t Parcel::writeString16Vector(const std::vector<String16>& val)
910{
911    if (val.size() > std::numeric_limits<int32_t>::max()) {
912        return BAD_VALUE;
913    }
914
915    status_t status = writeInt32(val.size());
916
917    if (status != OK) {
918        return status;
919    }
920
921    for (const auto& item : val) {
922        status = writeString16(item);
923
924        if (status != OK) {
925            return status;
926        }
927    }
928
929    return OK;
930}
931
932status_t Parcel::writeInt32(int32_t val)
933{
934    return writeAligned(val);
935}
936
937status_t Parcel::writeUint32(uint32_t val)
938{
939    return writeAligned(val);
940}
941
942status_t Parcel::writeInt32Array(size_t len, const int32_t *val) {
943    if (len > INT32_MAX) {
944        // don't accept size_t values which may have come from an
945        // inadvertent conversion from a negative int.
946        return BAD_VALUE;
947    }
948
949    if (!val) {
950        return writeInt32(-1);
951    }
952    status_t ret = writeInt32(static_cast<uint32_t>(len));
953    if (ret == NO_ERROR) {
954        ret = write(val, len * sizeof(*val));
955    }
956    return ret;
957}
958status_t Parcel::writeByteArray(size_t len, const uint8_t *val) {
959    if (len > INT32_MAX) {
960        // don't accept size_t values which may have come from an
961        // inadvertent conversion from a negative int.
962        return BAD_VALUE;
963    }
964
965    if (!val) {
966        return writeInt32(-1);
967    }
968    status_t ret = writeInt32(static_cast<uint32_t>(len));
969    if (ret == NO_ERROR) {
970        ret = write(val, len * sizeof(*val));
971    }
972    return ret;
973}
974
975status_t Parcel::writeBool(bool val)
976{
977    return writeInt32(int32_t(val));
978}
979
980status_t Parcel::writeChar(char16_t val)
981{
982    return writeInt32(int32_t(val));
983}
984
985status_t Parcel::writeByte(int8_t val)
986{
987    return writeInt32(int32_t(val));
988}
989
990status_t Parcel::writeInt64(int64_t val)
991{
992    return writeAligned(val);
993}
994
995status_t Parcel::writeUint64(uint64_t val)
996{
997    return writeAligned(val);
998}
999
1000status_t Parcel::writePointer(uintptr_t val)
1001{
1002    return writeAligned<binder_uintptr_t>(val);
1003}
1004
1005status_t Parcel::writeFloat(float val)
1006{
1007    return writeAligned(val);
1008}
1009
1010#if defined(__mips__) && defined(__mips_hard_float)
1011
1012status_t Parcel::writeDouble(double val)
1013{
1014    union {
1015        double d;
1016        unsigned long long ll;
1017    } u;
1018    u.d = val;
1019    return writeAligned(u.ll);
1020}
1021
1022#else
1023
1024status_t Parcel::writeDouble(double val)
1025{
1026    return writeAligned(val);
1027}
1028
1029#endif
1030
1031status_t Parcel::writeCString(const char* str)
1032{
1033    return write(str, strlen(str)+1);
1034}
1035
1036status_t Parcel::writeString8(const String8& str)
1037{
1038    status_t err = writeInt32(str.bytes());
1039    // only write string if its length is more than zero characters,
1040    // as readString8 will only read if the length field is non-zero.
1041    // this is slightly different from how writeString16 works.
1042    if (str.bytes() > 0 && err == NO_ERROR) {
1043        err = write(str.string(), str.bytes()+1);
1044    }
1045    return err;
1046}
1047
1048status_t Parcel::writeString16(const String16& str)
1049{
1050    return writeString16(str.string(), str.size());
1051}
1052
1053status_t Parcel::writeString16(const char16_t* str, size_t len)
1054{
1055    if (str == NULL) return writeInt32(-1);
1056
1057    status_t err = writeInt32(len);
1058    if (err == NO_ERROR) {
1059        len *= sizeof(char16_t);
1060        uint8_t* data = (uint8_t*)writeInplace(len+sizeof(char16_t));
1061        if (data) {
1062            memcpy(data, str, len);
1063            *reinterpret_cast<char16_t*>(data+len) = 0;
1064            return NO_ERROR;
1065        }
1066        err = mError;
1067    }
1068    return err;
1069}
1070
1071status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
1072{
1073    return flatten_binder(ProcessState::self(), val, this);
1074}
1075
1076status_t Parcel::writeWeakBinder(const wp<IBinder>& val)
1077{
1078    return flatten_binder(ProcessState::self(), val, this);
1079}
1080
1081status_t Parcel::writeNativeHandle(const native_handle* handle)
1082{
1083    if (!handle || handle->version != sizeof(native_handle))
1084        return BAD_TYPE;
1085
1086    status_t err;
1087    err = writeInt32(handle->numFds);
1088    if (err != NO_ERROR) return err;
1089
1090    err = writeInt32(handle->numInts);
1091    if (err != NO_ERROR) return err;
1092
1093    for (int i=0 ; err==NO_ERROR && i<handle->numFds ; i++)
1094        err = writeDupFileDescriptor(handle->data[i]);
1095
1096    if (err != NO_ERROR) {
1097        ALOGD("write native handle, write dup fd failed");
1098        return err;
1099    }
1100    err = write(handle->data + handle->numFds, sizeof(int)*handle->numInts);
1101    return err;
1102}
1103
1104status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership)
1105{
1106    flat_binder_object obj;
1107    obj.type = BINDER_TYPE_FD;
1108    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
1109    obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
1110    obj.handle = fd;
1111    obj.cookie = takeOwnership ? 1 : 0;
1112    return writeObject(obj, true);
1113}
1114
1115status_t Parcel::writeDupFileDescriptor(int fd)
1116{
1117    int dupFd = dup(fd);
1118    if (dupFd < 0) {
1119        return -errno;
1120    }
1121    status_t err = writeFileDescriptor(dupFd, true /*takeOwnership*/);
1122    if (err) {
1123        close(dupFd);
1124    }
1125    return err;
1126}
1127
1128status_t Parcel::writeBlob(size_t len, bool mutableCopy, WritableBlob* outBlob)
1129{
1130    if (len > INT32_MAX) {
1131        // don't accept size_t values which may have come from an
1132        // inadvertent conversion from a negative int.
1133        return BAD_VALUE;
1134    }
1135
1136    status_t status;
1137    if (!mAllowFds || len <= BLOB_INPLACE_LIMIT) {
1138        ALOGV("writeBlob: write in place");
1139        status = writeInt32(BLOB_INPLACE);
1140        if (status) return status;
1141
1142        void* ptr = writeInplace(len);
1143        if (!ptr) return NO_MEMORY;
1144
1145        outBlob->init(-1, ptr, len, false);
1146        return NO_ERROR;
1147    }
1148
1149    ALOGV("writeBlob: write to ashmem");
1150    int fd = ashmem_create_region("Parcel Blob", len);
1151    if (fd < 0) return NO_MEMORY;
1152
1153    int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);
1154    if (result < 0) {
1155        status = result;
1156    } else {
1157        void* ptr = ::mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
1158        if (ptr == MAP_FAILED) {
1159            status = -errno;
1160        } else {
1161            if (!mutableCopy) {
1162                result = ashmem_set_prot_region(fd, PROT_READ);
1163            }
1164            if (result < 0) {
1165                status = result;
1166            } else {
1167                status = writeInt32(mutableCopy ? BLOB_ASHMEM_MUTABLE : BLOB_ASHMEM_IMMUTABLE);
1168                if (!status) {
1169                    status = writeFileDescriptor(fd, true /*takeOwnership*/);
1170                    if (!status) {
1171                        outBlob->init(fd, ptr, len, mutableCopy);
1172                        return NO_ERROR;
1173                    }
1174                }
1175            }
1176        }
1177        ::munmap(ptr, len);
1178    }
1179    ::close(fd);
1180    return status;
1181}
1182
1183status_t Parcel::writeDupImmutableBlobFileDescriptor(int fd)
1184{
1185    // Must match up with what's done in writeBlob.
1186    if (!mAllowFds) return FDS_NOT_ALLOWED;
1187    status_t status = writeInt32(BLOB_ASHMEM_IMMUTABLE);
1188    if (status) return status;
1189    return writeDupFileDescriptor(fd);
1190}
1191
1192status_t Parcel::write(const FlattenableHelperInterface& val)
1193{
1194    status_t err;
1195
1196    // size if needed
1197    const size_t len = val.getFlattenedSize();
1198    const size_t fd_count = val.getFdCount();
1199
1200    if ((len > INT32_MAX) || (fd_count > INT32_MAX)) {
1201        // don't accept size_t values which may have come from an
1202        // inadvertent conversion from a negative int.
1203        return BAD_VALUE;
1204    }
1205
1206    err = this->writeInt32(len);
1207    if (err) return err;
1208
1209    err = this->writeInt32(fd_count);
1210    if (err) return err;
1211
1212    // payload
1213    void* const buf = this->writeInplace(pad_size(len));
1214    if (buf == NULL)
1215        return BAD_VALUE;
1216
1217    int* fds = NULL;
1218    if (fd_count) {
1219        fds = new int[fd_count];
1220    }
1221
1222    err = val.flatten(buf, len, fds, fd_count);
1223    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
1224        err = this->writeDupFileDescriptor( fds[i] );
1225    }
1226
1227    if (fd_count) {
1228        delete [] fds;
1229    }
1230
1231    return err;
1232}
1233
1234status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData)
1235{
1236    const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;
1237    const bool enoughObjects = mObjectsSize < mObjectsCapacity;
1238    if (enoughData && enoughObjects) {
1239restart_write:
1240        *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
1241
1242        // remember if it's a file descriptor
1243        if (val.type == BINDER_TYPE_FD) {
1244            if (!mAllowFds) {
1245                // fail before modifying our object index
1246                return FDS_NOT_ALLOWED;
1247            }
1248            mHasFds = mFdsKnown = true;
1249        }
1250
1251        // Need to write meta-data?
1252        if (nullMetaData || val.binder != 0) {
1253            mObjects[mObjectsSize] = mDataPos;
1254            acquire_object(ProcessState::self(), val, this, &mOpenAshmemSize);
1255            mObjectsSize++;
1256        }
1257
1258        return finishWrite(sizeof(flat_binder_object));
1259    }
1260
1261    if (!enoughData) {
1262        const status_t err = growData(sizeof(val));
1263        if (err != NO_ERROR) return err;
1264    }
1265    if (!enoughObjects) {
1266        size_t newSize = ((mObjectsSize+2)*3)/2;
1267        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
1268        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
1269        if (objects == NULL) return NO_MEMORY;
1270        mObjects = objects;
1271        mObjectsCapacity = newSize;
1272    }
1273
1274    goto restart_write;
1275}
1276
1277status_t Parcel::writeNoException()
1278{
1279    return writeInt32(0);
1280}
1281
1282void Parcel::remove(size_t /*start*/, size_t /*amt*/)
1283{
1284    LOG_ALWAYS_FATAL("Parcel::remove() not yet implemented!");
1285}
1286
1287status_t Parcel::read(void* outData, size_t len) const
1288{
1289    if (len > INT32_MAX) {
1290        // don't accept size_t values which may have come from an
1291        // inadvertent conversion from a negative int.
1292        return BAD_VALUE;
1293    }
1294
1295    if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1296            && len <= pad_size(len)) {
1297        memcpy(outData, mData+mDataPos, len);
1298        mDataPos += pad_size(len);
1299        ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
1300        return NO_ERROR;
1301    }
1302    return NOT_ENOUGH_DATA;
1303}
1304
1305const void* Parcel::readInplace(size_t len) const
1306{
1307    if (len > INT32_MAX) {
1308        // don't accept size_t values which may have come from an
1309        // inadvertent conversion from a negative int.
1310        return NULL;
1311    }
1312
1313    if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1314            && len <= pad_size(len)) {
1315        const void* data = mData+mDataPos;
1316        mDataPos += pad_size(len);
1317        ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
1318        return data;
1319    }
1320    return NULL;
1321}
1322
1323template<class T>
1324status_t Parcel::readAligned(T *pArg) const {
1325    COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
1326
1327    if ((mDataPos+sizeof(T)) <= mDataSize) {
1328        const void* data = mData+mDataPos;
1329        mDataPos += sizeof(T);
1330        *pArg =  *reinterpret_cast<const T*>(data);
1331        return NO_ERROR;
1332    } else {
1333        return NOT_ENOUGH_DATA;
1334    }
1335}
1336
1337template<class T>
1338T Parcel::readAligned() const {
1339    T result;
1340    if (readAligned(&result) != NO_ERROR) {
1341        result = 0;
1342    }
1343
1344    return result;
1345}
1346
1347template<class T>
1348status_t Parcel::writeAligned(T val) {
1349    COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
1350
1351    if ((mDataPos+sizeof(val)) <= mDataCapacity) {
1352restart_write:
1353        *reinterpret_cast<T*>(mData+mDataPos) = val;
1354        return finishWrite(sizeof(val));
1355    }
1356
1357    status_t err = growData(sizeof(val));
1358    if (err == NO_ERROR) goto restart_write;
1359    return err;
1360}
1361
1362status_t Parcel::readByteVector(std::vector<int8_t>* val) const {
1363    val->clear();
1364
1365    int32_t size;
1366    status_t status = readInt32(&size);
1367
1368    if (status != OK) {
1369        return status;
1370    }
1371
1372    if (size < 0) {
1373        return BAD_VALUE;
1374    }
1375
1376    val->resize(size);
1377
1378    for (auto& v : *val) {
1379        status = readByte(&v);
1380
1381        if (status != OK) {
1382            return status;
1383        }
1384    }
1385
1386    return OK;
1387}
1388
1389status_t Parcel::readInt32Vector(std::vector<int32_t>* val) const {
1390    val->clear();
1391
1392    int32_t size;
1393    status_t status = readInt32(&size);
1394
1395    if (status != OK) {
1396        return status;
1397    }
1398
1399    if (size < 0) {
1400        return BAD_VALUE;
1401    }
1402
1403    val->resize(size);
1404
1405    for (auto& v: *val) {
1406        status = readInt32(&v);
1407
1408        if (status != OK) {
1409            return status;
1410        }
1411    }
1412
1413    return OK;
1414}
1415
1416status_t Parcel::readInt64Vector(std::vector<int64_t>* val) const {
1417    val->clear();
1418
1419    int32_t size;
1420    status_t status = readInt32(&size);
1421
1422    if (status != OK) {
1423        return status;
1424    }
1425
1426    if (size < 0) {
1427        return BAD_VALUE;
1428    }
1429
1430    val->resize(size);
1431
1432    for (auto& v : *val) {
1433        status = readInt64(&v);
1434
1435        if (status != OK) {
1436            return status;
1437        }
1438    }
1439
1440    return OK;
1441}
1442
1443status_t Parcel::readFloatVector(std::vector<float>* val) const {
1444    val->clear();
1445
1446    int32_t size;
1447    status_t status = readInt32(&size);
1448
1449    if (status != OK) {
1450        return status;
1451    }
1452
1453    if (size < 0) {
1454        return BAD_VALUE;
1455    }
1456
1457    val->resize(size);
1458
1459    for (auto& v : *val) {
1460        status = readFloat(&v);
1461
1462        if (status != OK) {
1463            return status;
1464        }
1465    }
1466
1467    return OK;
1468}
1469
1470status_t Parcel::readDoubleVector(std::vector<double>* val) const {
1471    val->clear();
1472
1473    int32_t size;
1474    status_t status = readInt32(&size);
1475
1476    if (status != OK) {
1477        return status;
1478    }
1479
1480    if (size < 0) {
1481        return BAD_VALUE;
1482    }
1483
1484    val->resize(size);
1485
1486    for (auto& v : *val) {
1487        status = readDouble(&v);
1488
1489        if (status != OK) {
1490            return status;
1491        }
1492    }
1493
1494    return OK;
1495}
1496
1497status_t Parcel::readBoolVector(std::vector<bool>* val) const {
1498    val->clear();
1499
1500    int32_t size;
1501    status_t status = readInt32(&size);
1502
1503    if (status != OK) {
1504        return status;
1505    }
1506
1507    if (size < 0) {
1508        return BAD_VALUE;
1509    }
1510
1511    val->resize(size);
1512
1513    /* C++ bool handling means a vector of bools isn't necessarily addressable
1514     * (we might use individual bits)
1515     */
1516    for (int32_t i = 0; i < size; size++) {
1517        bool data;
1518        status = readBool(&data);
1519        (*val)[i] = data;
1520
1521        if (status != OK) {
1522            return status;
1523        }
1524    }
1525
1526    return OK;
1527}
1528
1529status_t Parcel::readCharVector(std::vector<char16_t>* val) const {
1530    val->clear();
1531
1532    int32_t size;
1533    status_t status = readInt32(&size);
1534
1535    if (status != OK) {
1536        return status;
1537    }
1538
1539    if (size < 0) {
1540        return BAD_VALUE;
1541    }
1542
1543    val->resize(size);
1544
1545    for (auto& v : *val) {
1546        status = readChar(&v);
1547
1548        if (status != OK) {
1549            return status;
1550        }
1551    }
1552
1553    return OK;
1554}
1555
1556status_t Parcel::readString16Vector(std::vector<String16>* val) const {
1557    val->clear();
1558
1559    int32_t size;
1560    status_t status = readInt32(&size);
1561
1562    if (status != OK) {
1563        return status;
1564    }
1565
1566    if (size < 0) {
1567        return BAD_VALUE;
1568    }
1569
1570    val->reserve(size);
1571
1572    while (size-- > 0) {
1573        const char16_t *data;
1574        size_t size;
1575        data = readString16Inplace(&size);
1576
1577        if (data == nullptr) {
1578            return UNKNOWN_ERROR;
1579        }
1580
1581        val->emplace_back(data, size);
1582    }
1583
1584    return OK;
1585}
1586
1587
1588status_t Parcel::readInt32(int32_t *pArg) const
1589{
1590    return readAligned(pArg);
1591}
1592
1593int32_t Parcel::readInt32() const
1594{
1595    return readAligned<int32_t>();
1596}
1597
1598status_t Parcel::readUint32(uint32_t *pArg) const
1599{
1600    return readAligned(pArg);
1601}
1602
1603uint32_t Parcel::readUint32() const
1604{
1605    return readAligned<uint32_t>();
1606}
1607
1608status_t Parcel::readInt64(int64_t *pArg) const
1609{
1610    return readAligned(pArg);
1611}
1612
1613
1614int64_t Parcel::readInt64() const
1615{
1616    return readAligned<int64_t>();
1617}
1618
1619status_t Parcel::readUint64(uint64_t *pArg) const
1620{
1621    return readAligned(pArg);
1622}
1623
1624uint64_t Parcel::readUint64() const
1625{
1626    return readAligned<uint64_t>();
1627}
1628
1629status_t Parcel::readPointer(uintptr_t *pArg) const
1630{
1631    status_t ret;
1632    binder_uintptr_t ptr;
1633    ret = readAligned(&ptr);
1634    if (!ret)
1635        *pArg = ptr;
1636    return ret;
1637}
1638
1639uintptr_t Parcel::readPointer() const
1640{
1641    return readAligned<binder_uintptr_t>();
1642}
1643
1644
1645status_t Parcel::readFloat(float *pArg) const
1646{
1647    return readAligned(pArg);
1648}
1649
1650
1651float Parcel::readFloat() const
1652{
1653    return readAligned<float>();
1654}
1655
1656#if defined(__mips__) && defined(__mips_hard_float)
1657
1658status_t Parcel::readDouble(double *pArg) const
1659{
1660    union {
1661      double d;
1662      unsigned long long ll;
1663    } u;
1664    u.d = 0;
1665    status_t status;
1666    status = readAligned(&u.ll);
1667    *pArg = u.d;
1668    return status;
1669}
1670
1671double Parcel::readDouble() const
1672{
1673    union {
1674      double d;
1675      unsigned long long ll;
1676    } u;
1677    u.ll = readAligned<unsigned long long>();
1678    return u.d;
1679}
1680
1681#else
1682
1683status_t Parcel::readDouble(double *pArg) const
1684{
1685    return readAligned(pArg);
1686}
1687
1688double Parcel::readDouble() const
1689{
1690    return readAligned<double>();
1691}
1692
1693#endif
1694
1695status_t Parcel::readIntPtr(intptr_t *pArg) const
1696{
1697    return readAligned(pArg);
1698}
1699
1700
1701intptr_t Parcel::readIntPtr() const
1702{
1703    return readAligned<intptr_t>();
1704}
1705
1706status_t Parcel::readBool(bool *pArg) const
1707{
1708    int32_t tmp;
1709    status_t ret = readInt32(&tmp);
1710    *pArg = (tmp != 0);
1711    return ret;
1712}
1713
1714bool Parcel::readBool() const
1715{
1716    return readInt32() != 0;
1717}
1718
1719status_t Parcel::readChar(char16_t *pArg) const
1720{
1721    int32_t tmp;
1722    status_t ret = readInt32(&tmp);
1723    *pArg = char16_t(tmp);
1724    return ret;
1725}
1726
1727char16_t Parcel::readChar() const
1728{
1729    return char16_t(readInt32());
1730}
1731
1732status_t Parcel::readByte(int8_t *pArg) const
1733{
1734    int32_t tmp;
1735    status_t ret = readInt32(&tmp);
1736    *pArg = int8_t(tmp);
1737    return ret;
1738}
1739
1740int8_t Parcel::readByte() const
1741{
1742    return int8_t(readInt32());
1743}
1744
1745const char* Parcel::readCString() const
1746{
1747    const size_t avail = mDataSize-mDataPos;
1748    if (avail > 0) {
1749        const char* str = reinterpret_cast<const char*>(mData+mDataPos);
1750        // is the string's trailing NUL within the parcel's valid bounds?
1751        const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));
1752        if (eos) {
1753            const size_t len = eos - str;
1754            mDataPos += pad_size(len+1);
1755            ALOGV("readCString Setting data pos of %p to %zu", this, mDataPos);
1756            return str;
1757        }
1758    }
1759    return NULL;
1760}
1761
1762String8 Parcel::readString8() const
1763{
1764    int32_t size = readInt32();
1765    // watch for potential int overflow adding 1 for trailing NUL
1766    if (size > 0 && size < INT32_MAX) {
1767        const char* str = (const char*)readInplace(size+1);
1768        if (str) return String8(str, size);
1769    }
1770    return String8();
1771}
1772
1773String16 Parcel::readString16() const
1774{
1775    size_t len;
1776    const char16_t* str = readString16Inplace(&len);
1777    if (str) return String16(str, len);
1778    ALOGE("Reading a NULL string not supported here.");
1779    return String16();
1780}
1781
1782status_t Parcel::readString16(String16* pArg) const
1783{
1784    size_t len;
1785    const char16_t* str = readString16Inplace(&len);
1786    if (str) {
1787        pArg->setTo(str, len);
1788        return 0;
1789    } else {
1790        *pArg = String16();
1791        return UNKNOWN_ERROR;
1792    }
1793}
1794
1795const char16_t* Parcel::readString16Inplace(size_t* outLen) const
1796{
1797    int32_t size = readInt32();
1798    // watch for potential int overflow from size+1
1799    if (size >= 0 && size < INT32_MAX) {
1800        *outLen = size;
1801        const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t));
1802        if (str != NULL) {
1803            return str;
1804        }
1805    }
1806    *outLen = 0;
1807    return NULL;
1808}
1809
1810sp<IBinder> Parcel::readStrongBinder() const
1811{
1812    sp<IBinder> val;
1813    unflatten_binder(ProcessState::self(), *this, &val);
1814    return val;
1815}
1816
1817wp<IBinder> Parcel::readWeakBinder() const
1818{
1819    wp<IBinder> val;
1820    unflatten_binder(ProcessState::self(), *this, &val);
1821    return val;
1822}
1823
1824int32_t Parcel::readExceptionCode() const
1825{
1826  int32_t exception_code = readAligned<int32_t>();
1827  if (exception_code == EX_HAS_REPLY_HEADER) {
1828    int32_t header_start = dataPosition();
1829    int32_t header_size = readAligned<int32_t>();
1830    // Skip over fat responses headers.  Not used (or propagated) in
1831    // native code
1832    setDataPosition(header_start + header_size);
1833    // And fat response headers are currently only used when there are no
1834    // exceptions, so return no error:
1835    return 0;
1836  }
1837  return exception_code;
1838}
1839
1840native_handle* Parcel::readNativeHandle() const
1841{
1842    int numFds, numInts;
1843    status_t err;
1844    err = readInt32(&numFds);
1845    if (err != NO_ERROR) return 0;
1846    err = readInt32(&numInts);
1847    if (err != NO_ERROR) return 0;
1848
1849    native_handle* h = native_handle_create(numFds, numInts);
1850    if (!h) {
1851        return 0;
1852    }
1853
1854    for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
1855        h->data[i] = dup(readFileDescriptor());
1856        if (h->data[i] < 0) err = BAD_VALUE;
1857    }
1858    err = read(h->data + numFds, sizeof(int)*numInts);
1859    if (err != NO_ERROR) {
1860        native_handle_close(h);
1861        native_handle_delete(h);
1862        h = 0;
1863    }
1864    return h;
1865}
1866
1867
1868int Parcel::readFileDescriptor() const
1869{
1870    const flat_binder_object* flat = readObject(true);
1871    if (flat) {
1872        switch (flat->type) {
1873            case BINDER_TYPE_FD:
1874                //ALOGI("Returning file descriptor %ld from parcel %p", flat->handle, this);
1875                return flat->handle;
1876        }
1877    }
1878    return BAD_TYPE;
1879}
1880
1881status_t Parcel::readBlob(size_t len, ReadableBlob* outBlob) const
1882{
1883    int32_t blobType;
1884    status_t status = readInt32(&blobType);
1885    if (status) return status;
1886
1887    if (blobType == BLOB_INPLACE) {
1888        ALOGV("readBlob: read in place");
1889        const void* ptr = readInplace(len);
1890        if (!ptr) return BAD_VALUE;
1891
1892        outBlob->init(-1, const_cast<void*>(ptr), len, false);
1893        return NO_ERROR;
1894    }
1895
1896    ALOGV("readBlob: read from ashmem");
1897    bool isMutable = (blobType == BLOB_ASHMEM_MUTABLE);
1898    int fd = readFileDescriptor();
1899    if (fd == int(BAD_TYPE)) return BAD_VALUE;
1900
1901    void* ptr = ::mmap(NULL, len, isMutable ? PROT_READ | PROT_WRITE : PROT_READ,
1902            MAP_SHARED, fd, 0);
1903    if (ptr == MAP_FAILED) return NO_MEMORY;
1904
1905    outBlob->init(fd, ptr, len, isMutable);
1906    return NO_ERROR;
1907}
1908
1909status_t Parcel::read(FlattenableHelperInterface& val) const
1910{
1911    // size
1912    const size_t len = this->readInt32();
1913    const size_t fd_count = this->readInt32();
1914
1915    if (len > INT32_MAX) {
1916        // don't accept size_t values which may have come from an
1917        // inadvertent conversion from a negative int.
1918        return BAD_VALUE;
1919    }
1920
1921    // payload
1922    void const* const buf = this->readInplace(pad_size(len));
1923    if (buf == NULL)
1924        return BAD_VALUE;
1925
1926    int* fds = NULL;
1927    if (fd_count) {
1928        fds = new int[fd_count];
1929    }
1930
1931    status_t err = NO_ERROR;
1932    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
1933        fds[i] = dup(this->readFileDescriptor());
1934        if (fds[i] < 0) {
1935            err = BAD_VALUE;
1936            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
1937                i, fds[i], fd_count, strerror(errno));
1938        }
1939    }
1940
1941    if (err == NO_ERROR) {
1942        err = val.unflatten(buf, len, fds, fd_count);
1943    }
1944
1945    if (fd_count) {
1946        delete [] fds;
1947    }
1948
1949    return err;
1950}
1951const flat_binder_object* Parcel::readObject(bool nullMetaData) const
1952{
1953    const size_t DPOS = mDataPos;
1954    if ((DPOS+sizeof(flat_binder_object)) <= mDataSize) {
1955        const flat_binder_object* obj
1956                = reinterpret_cast<const flat_binder_object*>(mData+DPOS);
1957        mDataPos = DPOS + sizeof(flat_binder_object);
1958        if (!nullMetaData && (obj->cookie == 0 && obj->binder == 0)) {
1959            // When transferring a NULL object, we don't write it into
1960            // the object list, so we don't want to check for it when
1961            // reading.
1962            ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
1963            return obj;
1964        }
1965
1966        // Ensure that this object is valid...
1967        binder_size_t* const OBJS = mObjects;
1968        const size_t N = mObjectsSize;
1969        size_t opos = mNextObjectHint;
1970
1971        if (N > 0) {
1972            ALOGV("Parcel %p looking for obj at %zu, hint=%zu",
1973                 this, DPOS, opos);
1974
1975            // Start at the current hint position, looking for an object at
1976            // the current data position.
1977            if (opos < N) {
1978                while (opos < (N-1) && OBJS[opos] < DPOS) {
1979                    opos++;
1980                }
1981            } else {
1982                opos = N-1;
1983            }
1984            if (OBJS[opos] == DPOS) {
1985                // Found it!
1986                ALOGV("Parcel %p found obj %zu at index %zu with forward search",
1987                     this, DPOS, opos);
1988                mNextObjectHint = opos+1;
1989                ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
1990                return obj;
1991            }
1992
1993            // Look backwards for it...
1994            while (opos > 0 && OBJS[opos] > DPOS) {
1995                opos--;
1996            }
1997            if (OBJS[opos] == DPOS) {
1998                // Found it!
1999                ALOGV("Parcel %p found obj %zu at index %zu with backward search",
2000                     this, DPOS, opos);
2001                mNextObjectHint = opos+1;
2002                ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
2003                return obj;
2004            }
2005        }
2006        ALOGW("Attempt to read object from Parcel %p at offset %zu that is not in the object list",
2007             this, DPOS);
2008    }
2009    return NULL;
2010}
2011
2012void Parcel::closeFileDescriptors()
2013{
2014    size_t i = mObjectsSize;
2015    if (i > 0) {
2016        //ALOGI("Closing file descriptors for %zu objects...", i);
2017    }
2018    while (i > 0) {
2019        i--;
2020        const flat_binder_object* flat
2021            = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
2022        if (flat->type == BINDER_TYPE_FD) {
2023            //ALOGI("Closing fd: %ld", flat->handle);
2024            close(flat->handle);
2025        }
2026    }
2027}
2028
2029uintptr_t Parcel::ipcData() const
2030{
2031    return reinterpret_cast<uintptr_t>(mData);
2032}
2033
2034size_t Parcel::ipcDataSize() const
2035{
2036    return (mDataSize > mDataPos ? mDataSize : mDataPos);
2037}
2038
2039uintptr_t Parcel::ipcObjects() const
2040{
2041    return reinterpret_cast<uintptr_t>(mObjects);
2042}
2043
2044size_t Parcel::ipcObjectsCount() const
2045{
2046    return mObjectsSize;
2047}
2048
2049void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,
2050    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)
2051{
2052    binder_size_t minOffset = 0;
2053    freeDataNoInit();
2054    mError = NO_ERROR;
2055    mData = const_cast<uint8_t*>(data);
2056    mDataSize = mDataCapacity = dataSize;
2057    //ALOGI("setDataReference Setting data size of %p to %lu (pid=%d)", this, mDataSize, getpid());
2058    mDataPos = 0;
2059    ALOGV("setDataReference Setting data pos of %p to %zu", this, mDataPos);
2060    mObjects = const_cast<binder_size_t*>(objects);
2061    mObjectsSize = mObjectsCapacity = objectsCount;
2062    mNextObjectHint = 0;
2063    mOwner = relFunc;
2064    mOwnerCookie = relCookie;
2065    for (size_t i = 0; i < mObjectsSize; i++) {
2066        binder_size_t offset = mObjects[i];
2067        if (offset < minOffset) {
2068            ALOGE("%s: bad object offset %" PRIu64 " < %" PRIu64 "\n",
2069                  __func__, (uint64_t)offset, (uint64_t)minOffset);
2070            mObjectsSize = 0;
2071            break;
2072        }
2073        minOffset = offset + sizeof(flat_binder_object);
2074    }
2075    scanForFds();
2076}
2077
2078void Parcel::print(TextOutput& to, uint32_t /*flags*/) const
2079{
2080    to << "Parcel(";
2081
2082    if (errorCheck() != NO_ERROR) {
2083        const status_t err = errorCheck();
2084        to << "Error: " << (void*)(intptr_t)err << " \"" << strerror(-err) << "\"";
2085    } else if (dataSize() > 0) {
2086        const uint8_t* DATA = data();
2087        to << indent << HexDump(DATA, dataSize()) << dedent;
2088        const binder_size_t* OBJS = objects();
2089        const size_t N = objectsCount();
2090        for (size_t i=0; i<N; i++) {
2091            const flat_binder_object* flat
2092                = reinterpret_cast<const flat_binder_object*>(DATA+OBJS[i]);
2093            to << endl << "Object #" << i << " @ " << (void*)OBJS[i] << ": "
2094                << TypeCode(flat->type & 0x7f7f7f00)
2095                << " = " << flat->binder;
2096        }
2097    } else {
2098        to << "NULL";
2099    }
2100
2101    to << ")";
2102}
2103
2104void Parcel::releaseObjects()
2105{
2106    const sp<ProcessState> proc(ProcessState::self());
2107    size_t i = mObjectsSize;
2108    uint8_t* const data = mData;
2109    binder_size_t* const objects = mObjects;
2110    while (i > 0) {
2111        i--;
2112        const flat_binder_object* flat
2113            = reinterpret_cast<flat_binder_object*>(data+objects[i]);
2114        release_object(proc, *flat, this, &mOpenAshmemSize);
2115    }
2116}
2117
2118void Parcel::acquireObjects()
2119{
2120    const sp<ProcessState> proc(ProcessState::self());
2121    size_t i = mObjectsSize;
2122    uint8_t* const data = mData;
2123    binder_size_t* const objects = mObjects;
2124    while (i > 0) {
2125        i--;
2126        const flat_binder_object* flat
2127            = reinterpret_cast<flat_binder_object*>(data+objects[i]);
2128        acquire_object(proc, *flat, this, &mOpenAshmemSize);
2129    }
2130}
2131
2132void Parcel::freeData()
2133{
2134    freeDataNoInit();
2135    initState();
2136}
2137
2138void Parcel::freeDataNoInit()
2139{
2140    if (mOwner) {
2141        LOG_ALLOC("Parcel %p: freeing other owner data", this);
2142        //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
2143        mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
2144    } else {
2145        LOG_ALLOC("Parcel %p: freeing allocated data", this);
2146        releaseObjects();
2147        if (mData) {
2148            LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);
2149            pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2150            if (mDataCapacity <= gParcelGlobalAllocSize) {
2151              gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;
2152            } else {
2153              gParcelGlobalAllocSize = 0;
2154            }
2155            if (gParcelGlobalAllocCount > 0) {
2156              gParcelGlobalAllocCount--;
2157            }
2158            pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2159            free(mData);
2160        }
2161        if (mObjects) free(mObjects);
2162    }
2163}
2164
2165status_t Parcel::growData(size_t len)
2166{
2167    if (len > INT32_MAX) {
2168        // don't accept size_t values which may have come from an
2169        // inadvertent conversion from a negative int.
2170        return BAD_VALUE;
2171    }
2172
2173    size_t newSize = ((mDataSize+len)*3)/2;
2174    return (newSize <= mDataSize)
2175            ? (status_t) NO_MEMORY
2176            : continueWrite(newSize);
2177}
2178
2179status_t Parcel::restartWrite(size_t desired)
2180{
2181    if (desired > INT32_MAX) {
2182        // don't accept size_t values which may have come from an
2183        // inadvertent conversion from a negative int.
2184        return BAD_VALUE;
2185    }
2186
2187    if (mOwner) {
2188        freeData();
2189        return continueWrite(desired);
2190    }
2191
2192    uint8_t* data = (uint8_t*)realloc(mData, desired);
2193    if (!data && desired > mDataCapacity) {
2194        mError = NO_MEMORY;
2195        return NO_MEMORY;
2196    }
2197
2198    releaseObjects();
2199
2200    if (data) {
2201        LOG_ALLOC("Parcel %p: restart from %zu to %zu capacity", this, mDataCapacity, desired);
2202        pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2203        gParcelGlobalAllocSize += desired;
2204        gParcelGlobalAllocSize -= mDataCapacity;
2205        pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2206        mData = data;
2207        mDataCapacity = desired;
2208    }
2209
2210    mDataSize = mDataPos = 0;
2211    ALOGV("restartWrite Setting data size of %p to %zu", this, mDataSize);
2212    ALOGV("restartWrite Setting data pos of %p to %zu", this, mDataPos);
2213
2214    free(mObjects);
2215    mObjects = NULL;
2216    mObjectsSize = mObjectsCapacity = 0;
2217    mNextObjectHint = 0;
2218    mHasFds = false;
2219    mFdsKnown = true;
2220    mAllowFds = true;
2221
2222    return NO_ERROR;
2223}
2224
2225status_t Parcel::continueWrite(size_t desired)
2226{
2227    if (desired > INT32_MAX) {
2228        // don't accept size_t values which may have come from an
2229        // inadvertent conversion from a negative int.
2230        return BAD_VALUE;
2231    }
2232
2233    // If shrinking, first adjust for any objects that appear
2234    // after the new data size.
2235    size_t objectsSize = mObjectsSize;
2236    if (desired < mDataSize) {
2237        if (desired == 0) {
2238            objectsSize = 0;
2239        } else {
2240            while (objectsSize > 0) {
2241                if (mObjects[objectsSize-1] < desired)
2242                    break;
2243                objectsSize--;
2244            }
2245        }
2246    }
2247
2248    if (mOwner) {
2249        // If the size is going to zero, just release the owner's data.
2250        if (desired == 0) {
2251            freeData();
2252            return NO_ERROR;
2253        }
2254
2255        // If there is a different owner, we need to take
2256        // posession.
2257        uint8_t* data = (uint8_t*)malloc(desired);
2258        if (!data) {
2259            mError = NO_MEMORY;
2260            return NO_MEMORY;
2261        }
2262        binder_size_t* objects = NULL;
2263
2264        if (objectsSize) {
2265            objects = (binder_size_t*)calloc(objectsSize, sizeof(binder_size_t));
2266            if (!objects) {
2267                free(data);
2268
2269                mError = NO_MEMORY;
2270                return NO_MEMORY;
2271            }
2272
2273            // Little hack to only acquire references on objects
2274            // we will be keeping.
2275            size_t oldObjectsSize = mObjectsSize;
2276            mObjectsSize = objectsSize;
2277            acquireObjects();
2278            mObjectsSize = oldObjectsSize;
2279        }
2280
2281        if (mData) {
2282            memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
2283        }
2284        if (objects && mObjects) {
2285            memcpy(objects, mObjects, objectsSize*sizeof(binder_size_t));
2286        }
2287        //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
2288        mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
2289        mOwner = NULL;
2290
2291        LOG_ALLOC("Parcel %p: taking ownership of %zu capacity", this, desired);
2292        pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2293        gParcelGlobalAllocSize += desired;
2294        gParcelGlobalAllocCount++;
2295        pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2296
2297        mData = data;
2298        mObjects = objects;
2299        mDataSize = (mDataSize < desired) ? mDataSize : desired;
2300        ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2301        mDataCapacity = desired;
2302        mObjectsSize = mObjectsCapacity = objectsSize;
2303        mNextObjectHint = 0;
2304
2305    } else if (mData) {
2306        if (objectsSize < mObjectsSize) {
2307            // Need to release refs on any objects we are dropping.
2308            const sp<ProcessState> proc(ProcessState::self());
2309            for (size_t i=objectsSize; i<mObjectsSize; i++) {
2310                const flat_binder_object* flat
2311                    = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
2312                if (flat->type == BINDER_TYPE_FD) {
2313                    // will need to rescan because we may have lopped off the only FDs
2314                    mFdsKnown = false;
2315                }
2316                release_object(proc, *flat, this, &mOpenAshmemSize);
2317            }
2318            binder_size_t* objects =
2319                (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));
2320            if (objects) {
2321                mObjects = objects;
2322            }
2323            mObjectsSize = objectsSize;
2324            mNextObjectHint = 0;
2325        }
2326
2327        // We own the data, so we can just do a realloc().
2328        if (desired > mDataCapacity) {
2329            uint8_t* data = (uint8_t*)realloc(mData, desired);
2330            if (data) {
2331                LOG_ALLOC("Parcel %p: continue from %zu to %zu capacity", this, mDataCapacity,
2332                        desired);
2333                pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2334                gParcelGlobalAllocSize += desired;
2335                gParcelGlobalAllocSize -= mDataCapacity;
2336                gParcelGlobalAllocCount++;
2337                pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2338                mData = data;
2339                mDataCapacity = desired;
2340            } else if (desired > mDataCapacity) {
2341                mError = NO_MEMORY;
2342                return NO_MEMORY;
2343            }
2344        } else {
2345            if (mDataSize > desired) {
2346                mDataSize = desired;
2347                ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2348            }
2349            if (mDataPos > desired) {
2350                mDataPos = desired;
2351                ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
2352            }
2353        }
2354
2355    } else {
2356        // This is the first data.  Easy!
2357        uint8_t* data = (uint8_t*)malloc(desired);
2358        if (!data) {
2359            mError = NO_MEMORY;
2360            return NO_MEMORY;
2361        }
2362
2363        if(!(mDataCapacity == 0 && mObjects == NULL
2364             && mObjectsCapacity == 0)) {
2365            ALOGE("continueWrite: %zu/%p/%zu/%zu", mDataCapacity, mObjects, mObjectsCapacity, desired);
2366        }
2367
2368        LOG_ALLOC("Parcel %p: allocating with %zu capacity", this, desired);
2369        pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2370        gParcelGlobalAllocSize += desired;
2371        gParcelGlobalAllocCount++;
2372        pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2373
2374        mData = data;
2375        mDataSize = mDataPos = 0;
2376        ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2377        ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
2378        mDataCapacity = desired;
2379    }
2380
2381    return NO_ERROR;
2382}
2383
2384void Parcel::initState()
2385{
2386    LOG_ALLOC("Parcel %p: initState", this);
2387    mError = NO_ERROR;
2388    mData = 0;
2389    mDataSize = 0;
2390    mDataCapacity = 0;
2391    mDataPos = 0;
2392    ALOGV("initState Setting data size of %p to %zu", this, mDataSize);
2393    ALOGV("initState Setting data pos of %p to %zu", this, mDataPos);
2394    mObjects = NULL;
2395    mObjectsSize = 0;
2396    mObjectsCapacity = 0;
2397    mNextObjectHint = 0;
2398    mHasFds = false;
2399    mFdsKnown = true;
2400    mAllowFds = true;
2401    mOwner = NULL;
2402    mOpenAshmemSize = 0;
2403}
2404
2405void Parcel::scanForFds() const
2406{
2407    bool hasFds = false;
2408    for (size_t i=0; i<mObjectsSize; i++) {
2409        const flat_binder_object* flat
2410            = reinterpret_cast<const flat_binder_object*>(mData + mObjects[i]);
2411        if (flat->type == BINDER_TYPE_FD) {
2412            hasFds = true;
2413            break;
2414        }
2415    }
2416    mHasFds = hasFds;
2417    mFdsKnown = true;
2418}
2419
2420size_t Parcel::getBlobAshmemSize() const
2421{
2422    // This used to return the size of all blobs that were written to ashmem, now we're returning
2423    // the ashmem currently referenced by this Parcel, which should be equivalent.
2424    // TODO: Remove method once ABI can be changed.
2425    return mOpenAshmemSize;
2426}
2427
2428size_t Parcel::getOpenAshmemSize() const
2429{
2430    return mOpenAshmemSize;
2431}
2432
2433// --- Parcel::Blob ---
2434
2435Parcel::Blob::Blob() :
2436        mFd(-1), mData(NULL), mSize(0), mMutable(false) {
2437}
2438
2439Parcel::Blob::~Blob() {
2440    release();
2441}
2442
2443void Parcel::Blob::release() {
2444    if (mFd != -1 && mData) {
2445        ::munmap(mData, mSize);
2446    }
2447    clear();
2448}
2449
2450void Parcel::Blob::init(int fd, void* data, size_t size, bool isMutable) {
2451    mFd = fd;
2452    mData = data;
2453    mSize = size;
2454    mMutable = isMutable;
2455}
2456
2457void Parcel::Blob::clear() {
2458    mFd = -1;
2459    mData = NULL;
2460    mSize = 0;
2461    mMutable = false;
2462}
2463
2464}; // namespace android
2465