Parcel.cpp revision 4ed5d8c98ea74c953b767a84ebfedf9d038dba3b 
1/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "Parcel"
18//#define LOG_NDEBUG 0
19
20#include <binder/Parcel.h>
21
22#include <binder/IPCThreadState.h>
23#include <binder/Binder.h>
24#include <binder/BpBinder.h>
25#include <binder/ProcessState.h>
26#include <binder/TextOutput.h>
27
28#include <errno.h>
29#include <utils/Debug.h>
30#include <utils/Log.h>
31#include <utils/String8.h>
32#include <utils/String16.h>
33#include <utils/misc.h>
34#include <utils/Flattenable.h>
35#include <cutils/ashmem.h>
36
37#include <private/binder/binder_module.h>
38#include <private/binder/Static.h>
39
40#include <inttypes.h>
41#include <stdio.h>
42#include <stdlib.h>
43#include <stdint.h>
44#include <sys/mman.h>
45
46#ifndef INT32_MAX
47#define INT32_MAX ((int32_t)(2147483647))
48#endif
49
50#define LOG_REFS(...)
51//#define LOG_REFS(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
52#define LOG_ALLOC(...)
53//#define LOG_ALLOC(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
54
55// ---------------------------------------------------------------------------
56
57// This macro should never be used at runtime, as a too large value
58// of s could cause an integer overflow. Instead, you should always
59// use the wrapper function pad_size()
60#define PAD_SIZE_UNSAFE(s) (((s)+3)&~3)
61
62static size_t pad_size(size_t s) {
63    if (s > (SIZE_T_MAX - 3)) {
64        abort();
65    }
66    return PAD_SIZE_UNSAFE(s);
67}
68
69// Note: must be kept in sync with android/os/StrictMode.java's PENALTY_GATHER
70#define STRICT_MODE_PENALTY_GATHER (0x40 << 16)
71
72// Note: must be kept in sync with android/os/Parcel.java's EX_HAS_REPLY_HEADER
73#define EX_HAS_REPLY_HEADER -128
74
75// XXX This can be made public if we want to provide
76// support for typed data.
77struct small_flat_data
78{
79    uint32_t type;
80    uint32_t data;
81};
82
83namespace android {
84
85static pthread_mutex_t gParcelGlobalAllocSizeLock = PTHREAD_MUTEX_INITIALIZER;
86static size_t gParcelGlobalAllocSize = 0;
87static size_t gParcelGlobalAllocCount = 0;
88
89// Maximum size of a blob to transfer in-place.
90static const size_t BLOB_INPLACE_LIMIT = 16 * 1024;
91
92enum {
93    BLOB_INPLACE = 0,
94    BLOB_ASHMEM_IMMUTABLE = 1,
95    BLOB_ASHMEM_MUTABLE = 2,
96};
97
98void acquire_object(const sp<ProcessState>& proc,
99    const flat_binder_object& obj, const void* who, size_t* outAshmemSize)
100{
101    switch (obj.type) {
102        case BINDER_TYPE_BINDER:
103            if (obj.binder) {
104                LOG_REFS("Parcel %p acquiring reference on local %p", who, obj.cookie);
105                reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who);
106            }
107            return;
108        case BINDER_TYPE_WEAK_BINDER:
109            if (obj.binder)
110                reinterpret_cast<RefBase::weakref_type*>(obj.binder)->incWeak(who);
111            return;
112        case BINDER_TYPE_HANDLE: {
113            const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
114            if (b != NULL) {
115                LOG_REFS("Parcel %p acquiring reference on remote %p", who, b.get());
116                b->incStrong(who);
117            }
118            return;
119        }
120        case BINDER_TYPE_WEAK_HANDLE: {
121            const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
122            if (b != NULL) b.get_refs()->incWeak(who);
123            return;
124        }
125        case BINDER_TYPE_FD: {
126            if (obj.cookie != 0) {
127                if (outAshmemSize != NULL) {
128                    // If we own an ashmem fd, keep track of how much memory it refers to.
129                    int size = ashmem_get_size_region(obj.handle);
130                    if (size > 0) {
131                        *outAshmemSize += size;
132                    }
133                }
134            }
135            return;
136        }
137    }
138
139    ALOGD("Invalid object type 0x%08x", obj.type);
140}
141
142void acquire_object(const sp<ProcessState>& proc,
143    const flat_binder_object& obj, const void* who)
144{
145    acquire_object(proc, obj, who, NULL);
146}
147
148static void release_object(const sp<ProcessState>& proc,
149    const flat_binder_object& obj, const void* who, size_t* outAshmemSize)
150{
151    switch (obj.type) {
152        case BINDER_TYPE_BINDER:
153            if (obj.binder) {
154                LOG_REFS("Parcel %p releasing reference on local %p", who, obj.cookie);
155                reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who);
156            }
157            return;
158        case BINDER_TYPE_WEAK_BINDER:
159            if (obj.binder)
160                reinterpret_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who);
161            return;
162        case BINDER_TYPE_HANDLE: {
163            const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
164            if (b != NULL) {
165                LOG_REFS("Parcel %p releasing reference on remote %p", who, b.get());
166                b->decStrong(who);
167            }
168            return;
169        }
170        case BINDER_TYPE_WEAK_HANDLE: {
171            const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
172            if (b != NULL) b.get_refs()->decWeak(who);
173            return;
174        }
175        case BINDER_TYPE_FD: {
176            if (outAshmemSize != NULL) {
177                if (obj.cookie != 0) {
178                    int size = ashmem_get_size_region(obj.handle);
179                    if (size > 0) {
180                        *outAshmemSize -= size;
181                    }
182
183                    close(obj.handle);
184                }
185            }
186            return;
187        }
188    }
189
190    ALOGE("Invalid object type 0x%08x", obj.type);
191}
192
193void release_object(const sp<ProcessState>& proc,
194    const flat_binder_object& obj, const void* who)
195{
196    release_object(proc, obj, who, NULL);
197}
198
199inline static status_t finish_flatten_binder(
200    const sp<IBinder>& /*binder*/, const flat_binder_object& flat, Parcel* out)
201{
202    return out->writeObject(flat, false);
203}
204
205status_t flatten_binder(const sp<ProcessState>& /*proc*/,
206    const sp<IBinder>& binder, Parcel* out)
207{
208    flat_binder_object obj;
209
210    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
211    if (binder != NULL) {
212        IBinder *local = binder->localBinder();
213        if (!local) {
214            BpBinder *proxy = binder->remoteBinder();
215            if (proxy == NULL) {
216                ALOGE("null proxy");
217            }
218            const int32_t handle = proxy ? proxy->handle() : 0;
219            obj.type = BINDER_TYPE_HANDLE;
220            obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
221            obj.handle = handle;
222            obj.cookie = 0;
223        } else {
224            obj.type = BINDER_TYPE_BINDER;
225            obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
226            obj.cookie = reinterpret_cast<uintptr_t>(local);
227        }
228    } else {
229        obj.type = BINDER_TYPE_BINDER;
230        obj.binder = 0;
231        obj.cookie = 0;
232    }
233
234    return finish_flatten_binder(binder, obj, out);
235}
236
237status_t flatten_binder(const sp<ProcessState>& /*proc*/,
238    const wp<IBinder>& binder, Parcel* out)
239{
240    flat_binder_object obj;
241
242    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
243    if (binder != NULL) {
244        sp<IBinder> real = binder.promote();
245        if (real != NULL) {
246            IBinder *local = real->localBinder();
247            if (!local) {
248                BpBinder *proxy = real->remoteBinder();
249                if (proxy == NULL) {
250                    ALOGE("null proxy");
251                }
252                const int32_t handle = proxy ? proxy->handle() : 0;
253                obj.type = BINDER_TYPE_WEAK_HANDLE;
254                obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
255                obj.handle = handle;
256                obj.cookie = 0;
257            } else {
258                obj.type = BINDER_TYPE_WEAK_BINDER;
259                obj.binder = reinterpret_cast<uintptr_t>(binder.get_refs());
260                obj.cookie = reinterpret_cast<uintptr_t>(binder.unsafe_get());
261            }
262            return finish_flatten_binder(real, obj, out);
263        }
264
265        // XXX How to deal?  In order to flatten the given binder,
266        // we need to probe it for information, which requires a primary
267        // reference...  but we don't have one.
268        //
269        // The OpenBinder implementation uses a dynamic_cast<> here,
270        // but we can't do that with the different reference counting
271        // implementation we are using.
272        ALOGE("Unable to unflatten Binder weak reference!");
273        obj.type = BINDER_TYPE_BINDER;
274        obj.binder = 0;
275        obj.cookie = 0;
276        return finish_flatten_binder(NULL, obj, out);
277
278    } else {
279        obj.type = BINDER_TYPE_BINDER;
280        obj.binder = 0;
281        obj.cookie = 0;
282        return finish_flatten_binder(NULL, obj, out);
283    }
284}
285
286inline static status_t finish_unflatten_binder(
287    BpBinder* /*proxy*/, const flat_binder_object& /*flat*/,
288    const Parcel& /*in*/)
289{
290    return NO_ERROR;
291}
292
293status_t unflatten_binder(const sp<ProcessState>& proc,
294    const Parcel& in, sp<IBinder>* out)
295{
296    const flat_binder_object* flat = in.readObject(false);
297
298    if (flat) {
299        switch (flat->type) {
300            case BINDER_TYPE_BINDER:
301                *out = reinterpret_cast<IBinder*>(flat->cookie);
302                return finish_unflatten_binder(NULL, *flat, in);
303            case BINDER_TYPE_HANDLE:
304                *out = proc->getStrongProxyForHandle(flat->handle);
305                return finish_unflatten_binder(
306                    static_cast<BpBinder*>(out->get()), *flat, in);
307        }
308    }
309    return BAD_TYPE;
310}
311
312status_t unflatten_binder(const sp<ProcessState>& proc,
313    const Parcel& in, wp<IBinder>* out)
314{
315    const flat_binder_object* flat = in.readObject(false);
316
317    if (flat) {
318        switch (flat->type) {
319            case BINDER_TYPE_BINDER:
320                *out = reinterpret_cast<IBinder*>(flat->cookie);
321                return finish_unflatten_binder(NULL, *flat, in);
322            case BINDER_TYPE_WEAK_BINDER:
323                if (flat->binder != 0) {
324                    out->set_object_and_refs(
325                        reinterpret_cast<IBinder*>(flat->cookie),
326                        reinterpret_cast<RefBase::weakref_type*>(flat->binder));
327                } else {
328                    *out = NULL;
329                }
330                return finish_unflatten_binder(NULL, *flat, in);
331            case BINDER_TYPE_HANDLE:
332            case BINDER_TYPE_WEAK_HANDLE:
333                *out = proc->getWeakProxyForHandle(flat->handle);
334                return finish_unflatten_binder(
335                    static_cast<BpBinder*>(out->unsafe_get()), *flat, in);
336        }
337    }
338    return BAD_TYPE;
339}
340
341// ---------------------------------------------------------------------------
342
343Parcel::Parcel()
344{
345    LOG_ALLOC("Parcel %p: constructing", this);
346    initState();
347}
348
349Parcel::~Parcel()
350{
351    freeDataNoInit();
352    LOG_ALLOC("Parcel %p: destroyed", this);
353}
354
355size_t Parcel::getGlobalAllocSize() {
356    pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
357    size_t size = gParcelGlobalAllocSize;
358    pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
359    return size;
360}
361
362size_t Parcel::getGlobalAllocCount() {
363    pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
364    size_t count = gParcelGlobalAllocCount;
365    pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
366    return count;
367}
368
369const uint8_t* Parcel::data() const
370{
371    return mData;
372}
373
374size_t Parcel::dataSize() const
375{
376    return (mDataSize > mDataPos ? mDataSize : mDataPos);
377}
378
379size_t Parcel::dataAvail() const
380{
381    // TODO: decide what to do about the possibility that this can
382    // report an available-data size that exceeds a Java int's max
383    // positive value, causing havoc.  Fortunately this will only
384    // happen if someone constructs a Parcel containing more than two
385    // gigabytes of data, which on typical phone hardware is simply
386    // not possible.
387    return dataSize() - dataPosition();
388}
389
390size_t Parcel::dataPosition() const
391{
392    return mDataPos;
393}
394
395size_t Parcel::dataCapacity() const
396{
397    return mDataCapacity;
398}
399
400status_t Parcel::setDataSize(size_t size)
401{
402    if (size > INT32_MAX) {
403        // don't accept size_t values which may have come from an
404        // inadvertent conversion from a negative int.
405        return BAD_VALUE;
406    }
407
408    status_t err;
409    err = continueWrite(size);
410    if (err == NO_ERROR) {
411        mDataSize = size;
412        ALOGV("setDataSize Setting data size of %p to %zu", this, mDataSize);
413    }
414    return err;
415}
416
417void Parcel::setDataPosition(size_t pos) const
418{
419    if (pos > INT32_MAX) {
420        // don't accept size_t values which may have come from an
421        // inadvertent conversion from a negative int.
422        abort();
423    }
424
425    mDataPos = pos;
426    mNextObjectHint = 0;
427}
428
429status_t Parcel::setDataCapacity(size_t size)
430{
431    if (size > INT32_MAX) {
432        // don't accept size_t values which may have come from an
433        // inadvertent conversion from a negative int.
434        return BAD_VALUE;
435    }
436
437    if (size > mDataCapacity) return continueWrite(size);
438    return NO_ERROR;
439}
440
441status_t Parcel::setData(const uint8_t* buffer, size_t len)
442{
443    if (len > INT32_MAX) {
444        // don't accept size_t values which may have come from an
445        // inadvertent conversion from a negative int.
446        return BAD_VALUE;
447    }
448
449    status_t err = restartWrite(len);
450    if (err == NO_ERROR) {
451        memcpy(const_cast<uint8_t*>(data()), buffer, len);
452        mDataSize = len;
453        mFdsKnown = false;
454    }
455    return err;
456}
457
458status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
459{
460    const sp<ProcessState> proc(ProcessState::self());
461    status_t err;
462    const uint8_t *data = parcel->mData;
463    const binder_size_t *objects = parcel->mObjects;
464    size_t size = parcel->mObjectsSize;
465    int startPos = mDataPos;
466    int firstIndex = -1, lastIndex = -2;
467
468    if (len == 0) {
469        return NO_ERROR;
470    }
471
472    if (len > INT32_MAX) {
473        // don't accept size_t values which may have come from an
474        // inadvertent conversion from a negative int.
475        return BAD_VALUE;
476    }
477
478    // range checks against the source parcel size
479    if ((offset > parcel->mDataSize)
480            || (len > parcel->mDataSize)
481            || (offset + len > parcel->mDataSize)) {
482        return BAD_VALUE;
483    }
484
485    // Count objects in range
486    for (int i = 0; i < (int) size; i++) {
487        size_t off = objects[i];
488        if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
489            if (firstIndex == -1) {
490                firstIndex = i;
491            }
492            lastIndex = i;
493        }
494    }
495    int numObjects = lastIndex - firstIndex + 1;
496
497    if ((mDataSize+len) > mDataCapacity) {
498        // grow data
499        err = growData(len);
500        if (err != NO_ERROR) {
501            return err;
502        }
503    }
504
505    // append data
506    memcpy(mData + mDataPos, data + offset, len);
507    mDataPos += len;
508    mDataSize += len;
509
510    err = NO_ERROR;
511
512    if (numObjects > 0) {
513        // grow objects
514        if (mObjectsCapacity < mObjectsSize + numObjects) {
515            size_t newSize = ((mObjectsSize + numObjects)*3)/2;
516            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
517            binder_size_t *objects =
518                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
519            if (objects == (binder_size_t*)0) {
520                return NO_MEMORY;
521            }
522            mObjects = objects;
523            mObjectsCapacity = newSize;
524        }
525
526        // append and acquire objects
527        int idx = mObjectsSize;
528        for (int i = firstIndex; i <= lastIndex; i++) {
529            size_t off = objects[i] - offset + startPos;
530            mObjects[idx++] = off;
531            mObjectsSize++;
532
533            flat_binder_object* flat
534                = reinterpret_cast<flat_binder_object*>(mData + off);
535            acquire_object(proc, *flat, this, &mOpenAshmemSize);
536
537            if (flat->type == BINDER_TYPE_FD) {
538                // If this is a file descriptor, we need to dup it so the
539                // new Parcel now owns its own fd, and can declare that we
540                // officially know we have fds.
541                flat->handle = dup(flat->handle);
542                flat->cookie = 1;
543                mHasFds = mFdsKnown = true;
544                if (!mAllowFds) {
545                    err = FDS_NOT_ALLOWED;
546                }
547            }
548        }
549    }
550
551    return err;
552}
553
554bool Parcel::allowFds() const
555{
556    return mAllowFds;
557}
558
559bool Parcel::pushAllowFds(bool allowFds)
560{
561    const bool origValue = mAllowFds;
562    if (!allowFds) {
563        mAllowFds = false;
564    }
565    return origValue;
566}
567
568void Parcel::restoreAllowFds(bool lastValue)
569{
570    mAllowFds = lastValue;
571}
572
573bool Parcel::hasFileDescriptors() const
574{
575    if (!mFdsKnown) {
576        scanForFds();
577    }
578    return mHasFds;
579}
580
581// Write RPC headers.  (previously just the interface token)
582status_t Parcel::writeInterfaceToken(const String16& interface)
583{
584    writeInt32(IPCThreadState::self()->getStrictModePolicy() |
585               STRICT_MODE_PENALTY_GATHER);
586    // currently the interface identification token is just its name as a string
587    return writeString16(interface);
588}
589
590bool Parcel::checkInterface(IBinder* binder) const
591{
592    return enforceInterface(binder->getInterfaceDescriptor());
593}
594
595bool Parcel::enforceInterface(const String16& interface,
596                              IPCThreadState* threadState) const
597{
598    int32_t strictPolicy = readInt32();
599    if (threadState == NULL) {
600        threadState = IPCThreadState::self();
601    }
602    if ((threadState->getLastTransactionBinderFlags() &
603         IBinder::FLAG_ONEWAY) != 0) {
604      // For one-way calls, the callee is running entirely
605      // disconnected from the caller, so disable StrictMode entirely.
606      // Not only does disk/network usage not impact the caller, but
607      // there's no way to commuicate back any violations anyway.
608      threadState->setStrictModePolicy(0);
609    } else {
610      threadState->setStrictModePolicy(strictPolicy);
611    }
612    const String16 str(readString16());
613    if (str == interface) {
614        return true;
615    } else {
616        ALOGW("**** enforceInterface() expected '%s' but read '%s'",
617                String8(interface).string(), String8(str).string());
618        return false;
619    }
620}
621
622const binder_size_t* Parcel::objects() const
623{
624    return mObjects;
625}
626
627size_t Parcel::objectsCount() const
628{
629    return mObjectsSize;
630}
631
632status_t Parcel::errorCheck() const
633{
634    return mError;
635}
636
637void Parcel::setError(status_t err)
638{
639    mError = err;
640}
641
642status_t Parcel::finishWrite(size_t len)
643{
644    if (len > INT32_MAX) {
645        // don't accept size_t values which may have come from an
646        // inadvertent conversion from a negative int.
647        return BAD_VALUE;
648    }
649
650    //printf("Finish write of %d\n", len);
651    mDataPos += len;
652    ALOGV("finishWrite Setting data pos of %p to %zu", this, mDataPos);
653    if (mDataPos > mDataSize) {
654        mDataSize = mDataPos;
655        ALOGV("finishWrite Setting data size of %p to %zu", this, mDataSize);
656    }
657    //printf("New pos=%d, size=%d\n", mDataPos, mDataSize);
658    return NO_ERROR;
659}
660
661status_t Parcel::writeUnpadded(const void* data, size_t len)
662{
663    if (len > INT32_MAX) {
664        // don't accept size_t values which may have come from an
665        // inadvertent conversion from a negative int.
666        return BAD_VALUE;
667    }
668
669    size_t end = mDataPos + len;
670    if (end < mDataPos) {
671        // integer overflow
672        return BAD_VALUE;
673    }
674
675    if (end <= mDataCapacity) {
676restart_write:
677        memcpy(mData+mDataPos, data, len);
678        return finishWrite(len);
679    }
680
681    status_t err = growData(len);
682    if (err == NO_ERROR) goto restart_write;
683    return err;
684}
685
686status_t Parcel::write(const void* data, size_t len)
687{
688    if (len > INT32_MAX) {
689        // don't accept size_t values which may have come from an
690        // inadvertent conversion from a negative int.
691        return BAD_VALUE;
692    }
693
694    void* const d = writeInplace(len);
695    if (d) {
696        memcpy(d, data, len);
697        return NO_ERROR;
698    }
699    return mError;
700}
701
702void* Parcel::writeInplace(size_t len)
703{
704    if (len > INT32_MAX) {
705        // don't accept size_t values which may have come from an
706        // inadvertent conversion from a negative int.
707        return NULL;
708    }
709
710    const size_t padded = pad_size(len);
711
712    // sanity check for integer overflow
713    if (mDataPos+padded < mDataPos) {
714        return NULL;
715    }
716
717    if ((mDataPos+padded) <= mDataCapacity) {
718restart_write:
719        //printf("Writing %ld bytes, padded to %ld\n", len, padded);
720        uint8_t* const data = mData+mDataPos;
721
722        // Need to pad at end?
723        if (padded != len) {
724#if BYTE_ORDER == BIG_ENDIAN
725            static const uint32_t mask[4] = {
726                0x00000000, 0xffffff00, 0xffff0000, 0xff000000
727            };
728#endif
729#if BYTE_ORDER == LITTLE_ENDIAN
730            static const uint32_t mask[4] = {
731                0x00000000, 0x00ffffff, 0x0000ffff, 0x000000ff
732            };
733#endif
734            //printf("Applying pad mask: %p to %p\n", (void*)mask[padded-len],
735            //    *reinterpret_cast<void**>(data+padded-4));
736            *reinterpret_cast<uint32_t*>(data+padded-4) &= mask[padded-len];
737        }
738
739        finishWrite(padded);
740        return data;
741    }
742
743    status_t err = growData(padded);
744    if (err == NO_ERROR) goto restart_write;
745    return NULL;
746}
747
748status_t Parcel::writeByteVector(const std::vector<int8_t>& val)
749{
750    status_t status;
751    if (val.size() > std::numeric_limits<int32_t>::max()) {
752        status = BAD_VALUE;
753        return status;
754    }
755
756    status = writeInt32(val.size());
757    if (status != OK) {
758        return status;
759    }
760
761    void* data = writeInplace(val.size());
762    if (!data) {
763        status = BAD_VALUE;
764        return status;
765    }
766
767    memcpy(data, val.data(), val.size());
768    return status;
769}
770
771status_t Parcel::writeInt32Vector(const std::vector<int32_t>& val)
772{
773    if (val.size() > std::numeric_limits<int32_t>::max()) {
774        return BAD_VALUE;
775    }
776
777    status_t status = writeInt32(val.size());
778
779    if (status != OK) {
780        return status;
781    }
782
783    for (const auto& item : val) {
784        status = writeInt32(item);
785
786        if (status != OK) {
787            return status;
788        }
789    }
790
791    return OK;
792}
793
794status_t Parcel::writeInt64Vector(const std::vector<int64_t>& val)
795{
796    if (val.size() > std::numeric_limits<int32_t>::max()) {
797        return BAD_VALUE;
798    }
799
800    status_t status = writeInt32(val.size());
801
802    if (status != OK) {
803        return status;
804    }
805
806    for (const auto& item : val) {
807        status = writeInt64(item);
808
809        if (status != OK) {
810            return status;
811        }
812    }
813
814    return OK;
815}
816
817status_t Parcel::writeFloatVector(const std::vector<float>& val)
818{
819    if (val.size() > std::numeric_limits<int32_t>::max()) {
820        return BAD_VALUE;
821    }
822
823    status_t status = writeInt32(val.size());
824
825    if (status != OK) {
826        return status;
827    }
828
829    for (const auto& item : val) {
830        status = writeFloat(item);
831
832        if (status != OK) {
833            return status;
834        }
835    }
836
837    return OK;
838}
839
840status_t Parcel::writeDoubleVector(const std::vector<double>& val)
841{
842    if (val.size() > std::numeric_limits<int32_t>::max()) {
843        return BAD_VALUE;
844    }
845
846    status_t status = writeInt32(val.size());
847
848    if (status != OK) {
849        return status;
850    }
851
852    for (const auto& item : val) {
853        status = writeDouble(item);
854
855        if (status != OK) {
856            return status;
857        }
858    }
859
860    return OK;
861}
862
863status_t Parcel::writeBoolVector(const std::vector<bool>& val)
864{
865    if (val.size() > std::numeric_limits<int32_t>::max()) {
866        return BAD_VALUE;
867    }
868
869    status_t status = writeInt32(val.size());
870
871    if (status != OK) {
872        return status;
873    }
874
875    for (const auto& item : val) {
876        status = writeBool(item);
877
878        if (status != OK) {
879            return status;
880        }
881    }
882
883    return OK;
884}
885
886status_t Parcel::writeCharVector(const std::vector<char16_t>& val)
887{
888    if (val.size() > std::numeric_limits<int32_t>::max()) {
889        return BAD_VALUE;
890    }
891
892    status_t status = writeInt32(val.size());
893
894    if (status != OK) {
895        return status;
896    }
897
898    for (const auto& item : val) {
899        status = writeChar(item);
900
901        if (status != OK) {
902            return status;
903        }
904    }
905
906    return OK;
907}
908
909status_t Parcel::writeString16Vector(const std::vector<String16>& val)
910{
911    if (val.size() > std::numeric_limits<int32_t>::max()) {
912        return BAD_VALUE;
913    }
914
915    status_t status = writeInt32(val.size());
916
917    if (status != OK) {
918        return status;
919    }
920
921    for (const auto& item : val) {
922        status = writeString16(item);
923
924        if (status != OK) {
925            return status;
926        }
927    }
928
929    return OK;
930}
931
932status_t Parcel::writeInt32(int32_t val)
933{
934    return writeAligned(val);
935}
936
937status_t Parcel::writeUint32(uint32_t val)
938{
939    return writeAligned(val);
940}
941
942status_t Parcel::writeInt32Array(size_t len, const int32_t *val) {
943    if (len > INT32_MAX) {
944        // don't accept size_t values which may have come from an
945        // inadvertent conversion from a negative int.
946        return BAD_VALUE;
947    }
948
949    if (!val) {
950        return writeInt32(-1);
951    }
952    status_t ret = writeInt32(static_cast<uint32_t>(len));
953    if (ret == NO_ERROR) {
954        ret = write(val, len * sizeof(*val));
955    }
956    return ret;
957}
958status_t Parcel::writeByteArray(size_t len, const uint8_t *val) {
959    if (len > INT32_MAX) {
960        // don't accept size_t values which may have come from an
961        // inadvertent conversion from a negative int.
962        return BAD_VALUE;
963    }
964
965    if (!val) {
966        return writeInt32(-1);
967    }
968    status_t ret = writeInt32(static_cast<uint32_t>(len));
969    if (ret == NO_ERROR) {
970        ret = write(val, len * sizeof(*val));
971    }
972    return ret;
973}
974
975status_t Parcel::writeBool(bool val)
976{
977    return writeInt32(int32_t(val));
978}
979
980status_t Parcel::writeChar(char16_t val)
981{
982    return writeInt32(int32_t(val));
983}
984
985status_t Parcel::writeByte(int8_t val)
986{
987    return writeInt32(int32_t(val));
988}
989
990status_t Parcel::writeInt64(int64_t val)
991{
992    return writeAligned(val);
993}
994
995status_t Parcel::writeUint64(uint64_t val)
996{
997    return writeAligned(val);
998}
999
1000status_t Parcel::writePointer(uintptr_t val)
1001{
1002    return writeAligned<binder_uintptr_t>(val);
1003}
1004
1005status_t Parcel::writeFloat(float val)
1006{
1007    return writeAligned(val);
1008}
1009
1010#if defined(__mips__) && defined(__mips_hard_float)
1011
1012status_t Parcel::writeDouble(double val)
1013{
1014    union {
1015        double d;
1016        unsigned long long ll;
1017    } u;
1018    u.d = val;
1019    return writeAligned(u.ll);
1020}
1021
1022#else
1023
1024status_t Parcel::writeDouble(double val)
1025{
1026    return writeAligned(val);
1027}
1028
1029#endif
1030
1031status_t Parcel::writeCString(const char* str)
1032{
1033    return write(str, strlen(str)+1);
1034}
1035
1036status_t Parcel::writeString8(const String8& str)
1037{
1038    status_t err = writeInt32(str.bytes());
1039    // only write string if its length is more than zero characters,
1040    // as readString8 will only read if the length field is non-zero.
1041    // this is slightly different from how writeString16 works.
1042    if (str.bytes() > 0 && err == NO_ERROR) {
1043        err = write(str.string(), str.bytes()+1);
1044    }
1045    return err;
1046}
1047
1048status_t Parcel::writeString16(const String16& str)
1049{
1050    return writeString16(str.string(), str.size());
1051}
1052
1053status_t Parcel::writeString16(const char16_t* str, size_t len)
1054{
1055    if (str == NULL) return writeInt32(-1);
1056
1057    status_t err = writeInt32(len);
1058    if (err == NO_ERROR) {
1059        len *= sizeof(char16_t);
1060        uint8_t* data = (uint8_t*)writeInplace(len+sizeof(char16_t));
1061        if (data) {
1062            memcpy(data, str, len);
1063            *reinterpret_cast<char16_t*>(data+len) = 0;
1064            return NO_ERROR;
1065        }
1066        err = mError;
1067    }
1068    return err;
1069}
1070
1071status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
1072{
1073    return flatten_binder(ProcessState::self(), val, this);
1074}
1075
1076status_t Parcel::writeStrongBinderVector(const std::vector<sp<IBinder>>& val)
1077{
1078    if (val.size() > std::numeric_limits<int32_t>::max()) {
1079        return BAD_VALUE;
1080    }
1081
1082    status_t status = writeInt32(val.size());
1083
1084    if (status != OK) {
1085        return status;
1086    }
1087
1088    for (const auto& item : val) {
1089        status = writeStrongBinder(item);
1090
1091        if (status != OK) {
1092            return status;
1093        }
1094    }
1095
1096    return OK;
1097}
1098
1099status_t Parcel::readStrongBinderVector(std::vector<sp<IBinder>>* val) const {
1100    val->clear();
1101
1102    int32_t size;
1103    status_t status = readInt32(&size);
1104
1105    if (status != OK) {
1106        return status;
1107    }
1108
1109    if (size < 0) {
1110        return BAD_VALUE;
1111    }
1112
1113    val->resize(size);
1114
1115    for (auto& v : *val) {
1116        status = readStrongBinder(&v);
1117
1118        if (status != OK) {
1119            return status;
1120        }
1121    }
1122
1123    return OK;
1124}
1125
1126status_t Parcel::writeWeakBinder(const wp<IBinder>& val)
1127{
1128    return flatten_binder(ProcessState::self(), val, this);
1129}
1130
1131status_t Parcel::writeNativeHandle(const native_handle* handle)
1132{
1133    if (!handle || handle->version != sizeof(native_handle))
1134        return BAD_TYPE;
1135
1136    status_t err;
1137    err = writeInt32(handle->numFds);
1138    if (err != NO_ERROR) return err;
1139
1140    err = writeInt32(handle->numInts);
1141    if (err != NO_ERROR) return err;
1142
1143    for (int i=0 ; err==NO_ERROR && i<handle->numFds ; i++)
1144        err = writeDupFileDescriptor(handle->data[i]);
1145
1146    if (err != NO_ERROR) {
1147        ALOGD("write native handle, write dup fd failed");
1148        return err;
1149    }
1150    err = write(handle->data + handle->numFds, sizeof(int)*handle->numInts);
1151    return err;
1152}
1153
1154status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership)
1155{
1156    flat_binder_object obj;
1157    obj.type = BINDER_TYPE_FD;
1158    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
1159    obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
1160    obj.handle = fd;
1161    obj.cookie = takeOwnership ? 1 : 0;
1162    return writeObject(obj, true);
1163}
1164
1165status_t Parcel::writeDupFileDescriptor(int fd)
1166{
1167    int dupFd = dup(fd);
1168    if (dupFd < 0) {
1169        return -errno;
1170    }
1171    status_t err = writeFileDescriptor(dupFd, true /*takeOwnership*/);
1172    if (err) {
1173        close(dupFd);
1174    }
1175    return err;
1176}
1177
1178status_t Parcel::writeBlob(size_t len, bool mutableCopy, WritableBlob* outBlob)
1179{
1180    if (len > INT32_MAX) {
1181        // don't accept size_t values which may have come from an
1182        // inadvertent conversion from a negative int.
1183        return BAD_VALUE;
1184    }
1185
1186    status_t status;
1187    if (!mAllowFds || len <= BLOB_INPLACE_LIMIT) {
1188        ALOGV("writeBlob: write in place");
1189        status = writeInt32(BLOB_INPLACE);
1190        if (status) return status;
1191
1192        void* ptr = writeInplace(len);
1193        if (!ptr) return NO_MEMORY;
1194
1195        outBlob->init(-1, ptr, len, false);
1196        return NO_ERROR;
1197    }
1198
1199    ALOGV("writeBlob: write to ashmem");
1200    int fd = ashmem_create_region("Parcel Blob", len);
1201    if (fd < 0) return NO_MEMORY;
1202
1203    int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);
1204    if (result < 0) {
1205        status = result;
1206    } else {
1207        void* ptr = ::mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
1208        if (ptr == MAP_FAILED) {
1209            status = -errno;
1210        } else {
1211            if (!mutableCopy) {
1212                result = ashmem_set_prot_region(fd, PROT_READ);
1213            }
1214            if (result < 0) {
1215                status = result;
1216            } else {
1217                status = writeInt32(mutableCopy ? BLOB_ASHMEM_MUTABLE : BLOB_ASHMEM_IMMUTABLE);
1218                if (!status) {
1219                    status = writeFileDescriptor(fd, true /*takeOwnership*/);
1220                    if (!status) {
1221                        outBlob->init(fd, ptr, len, mutableCopy);
1222                        return NO_ERROR;
1223                    }
1224                }
1225            }
1226        }
1227        ::munmap(ptr, len);
1228    }
1229    ::close(fd);
1230    return status;
1231}
1232
1233status_t Parcel::writeDupImmutableBlobFileDescriptor(int fd)
1234{
1235    // Must match up with what's done in writeBlob.
1236    if (!mAllowFds) return FDS_NOT_ALLOWED;
1237    status_t status = writeInt32(BLOB_ASHMEM_IMMUTABLE);
1238    if (status) return status;
1239    return writeDupFileDescriptor(fd);
1240}
1241
1242status_t Parcel::write(const FlattenableHelperInterface& val)
1243{
1244    status_t err;
1245
1246    // size if needed
1247    const size_t len = val.getFlattenedSize();
1248    const size_t fd_count = val.getFdCount();
1249
1250    if ((len > INT32_MAX) || (fd_count > INT32_MAX)) {
1251        // don't accept size_t values which may have come from an
1252        // inadvertent conversion from a negative int.
1253        return BAD_VALUE;
1254    }
1255
1256    err = this->writeInt32(len);
1257    if (err) return err;
1258
1259    err = this->writeInt32(fd_count);
1260    if (err) return err;
1261
1262    // payload
1263    void* const buf = this->writeInplace(pad_size(len));
1264    if (buf == NULL)
1265        return BAD_VALUE;
1266
1267    int* fds = NULL;
1268    if (fd_count) {
1269        fds = new int[fd_count];
1270    }
1271
1272    err = val.flatten(buf, len, fds, fd_count);
1273    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
1274        err = this->writeDupFileDescriptor( fds[i] );
1275    }
1276
1277    if (fd_count) {
1278        delete [] fds;
1279    }
1280
1281    return err;
1282}
1283
1284status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData)
1285{
1286    const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;
1287    const bool enoughObjects = mObjectsSize < mObjectsCapacity;
1288    if (enoughData && enoughObjects) {
1289restart_write:
1290        *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
1291
1292        // remember if it's a file descriptor
1293        if (val.type == BINDER_TYPE_FD) {
1294            if (!mAllowFds) {
1295                // fail before modifying our object index
1296                return FDS_NOT_ALLOWED;
1297            }
1298            mHasFds = mFdsKnown = true;
1299        }
1300
1301        // Need to write meta-data?
1302        if (nullMetaData || val.binder != 0) {
1303            mObjects[mObjectsSize] = mDataPos;
1304            acquire_object(ProcessState::self(), val, this, &mOpenAshmemSize);
1305            mObjectsSize++;
1306        }
1307
1308        return finishWrite(sizeof(flat_binder_object));
1309    }
1310
1311    if (!enoughData) {
1312        const status_t err = growData(sizeof(val));
1313        if (err != NO_ERROR) return err;
1314    }
1315    if (!enoughObjects) {
1316        size_t newSize = ((mObjectsSize+2)*3)/2;
1317        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
1318        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
1319        if (objects == NULL) return NO_MEMORY;
1320        mObjects = objects;
1321        mObjectsCapacity = newSize;
1322    }
1323
1324    goto restart_write;
1325}
1326
1327status_t Parcel::writeNoException()
1328{
1329    return writeInt32(0);
1330}
1331
1332void Parcel::remove(size_t /*start*/, size_t /*amt*/)
1333{
1334    LOG_ALWAYS_FATAL("Parcel::remove() not yet implemented!");
1335}
1336
1337status_t Parcel::read(void* outData, size_t len) const
1338{
1339    if (len > INT32_MAX) {
1340        // don't accept size_t values which may have come from an
1341        // inadvertent conversion from a negative int.
1342        return BAD_VALUE;
1343    }
1344
1345    if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1346            && len <= pad_size(len)) {
1347        memcpy(outData, mData+mDataPos, len);
1348        mDataPos += pad_size(len);
1349        ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
1350        return NO_ERROR;
1351    }
1352    return NOT_ENOUGH_DATA;
1353}
1354
1355const void* Parcel::readInplace(size_t len) const
1356{
1357    if (len > INT32_MAX) {
1358        // don't accept size_t values which may have come from an
1359        // inadvertent conversion from a negative int.
1360        return NULL;
1361    }
1362
1363    if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1364            && len <= pad_size(len)) {
1365        const void* data = mData+mDataPos;
1366        mDataPos += pad_size(len);
1367        ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
1368        return data;
1369    }
1370    return NULL;
1371}
1372
1373template<class T>
1374status_t Parcel::readAligned(T *pArg) const {
1375    COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
1376
1377    if ((mDataPos+sizeof(T)) <= mDataSize) {
1378        const void* data = mData+mDataPos;
1379        mDataPos += sizeof(T);
1380        *pArg =  *reinterpret_cast<const T*>(data);
1381        return NO_ERROR;
1382    } else {
1383        return NOT_ENOUGH_DATA;
1384    }
1385}
1386
1387template<class T>
1388T Parcel::readAligned() const {
1389    T result;
1390    if (readAligned(&result) != NO_ERROR) {
1391        result = 0;
1392    }
1393
1394    return result;
1395}
1396
1397template<class T>
1398status_t Parcel::writeAligned(T val) {
1399    COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
1400
1401    if ((mDataPos+sizeof(val)) <= mDataCapacity) {
1402restart_write:
1403        *reinterpret_cast<T*>(mData+mDataPos) = val;
1404        return finishWrite(sizeof(val));
1405    }
1406
1407    status_t err = growData(sizeof(val));
1408    if (err == NO_ERROR) goto restart_write;
1409    return err;
1410}
1411
1412status_t Parcel::readByteVector(std::vector<int8_t>* val) const {
1413    val->clear();
1414
1415    int32_t size;
1416    status_t status = readInt32(&size);
1417
1418    if (status != OK) {
1419        return status;
1420    }
1421
1422    if (size < 0 || size_t(size) > dataAvail()) {
1423        status = BAD_VALUE;
1424        return status;
1425    }
1426    const void* data = readInplace(size);
1427    if (!data) {
1428        status = BAD_VALUE;
1429        return status;
1430    }
1431    val->resize(size);
1432    memcpy(val->data(), data, size);
1433
1434    return status;
1435}
1436
1437status_t Parcel::readInt32Vector(std::vector<int32_t>* val) const {
1438    val->clear();
1439
1440    int32_t size;
1441    status_t status = readInt32(&size);
1442
1443    if (status != OK) {
1444        return status;
1445    }
1446
1447    if (size < 0) {
1448        return BAD_VALUE;
1449    }
1450
1451    val->resize(size);
1452
1453    for (auto& v: *val) {
1454        status = readInt32(&v);
1455
1456        if (status != OK) {
1457            return status;
1458        }
1459    }
1460
1461    return OK;
1462}
1463
1464status_t Parcel::readInt64Vector(std::vector<int64_t>* val) const {
1465    val->clear();
1466
1467    int32_t size;
1468    status_t status = readInt32(&size);
1469
1470    if (status != OK) {
1471        return status;
1472    }
1473
1474    if (size < 0) {
1475        return BAD_VALUE;
1476    }
1477
1478    val->resize(size);
1479
1480    for (auto& v : *val) {
1481        status = readInt64(&v);
1482
1483        if (status != OK) {
1484            return status;
1485        }
1486    }
1487
1488    return OK;
1489}
1490
1491status_t Parcel::readFloatVector(std::vector<float>* val) const {
1492    val->clear();
1493
1494    int32_t size;
1495    status_t status = readInt32(&size);
1496
1497    if (status != OK) {
1498        return status;
1499    }
1500
1501    if (size < 0) {
1502        return BAD_VALUE;
1503    }
1504
1505    val->resize(size);
1506
1507    for (auto& v : *val) {
1508        status = readFloat(&v);
1509
1510        if (status != OK) {
1511            return status;
1512        }
1513    }
1514
1515    return OK;
1516}
1517
1518status_t Parcel::readDoubleVector(std::vector<double>* val) const {
1519    val->clear();
1520
1521    int32_t size;
1522    status_t status = readInt32(&size);
1523
1524    if (status != OK) {
1525        return status;
1526    }
1527
1528    if (size < 0) {
1529        return BAD_VALUE;
1530    }
1531
1532    val->resize(size);
1533
1534    for (auto& v : *val) {
1535        status = readDouble(&v);
1536
1537        if (status != OK) {
1538            return status;
1539        }
1540    }
1541
1542    return OK;
1543}
1544
1545status_t Parcel::readBoolVector(std::vector<bool>* val) const {
1546    val->clear();
1547
1548    int32_t size;
1549    status_t status = readInt32(&size);
1550
1551    if (status != OK) {
1552        return status;
1553    }
1554
1555    if (size < 0) {
1556        return BAD_VALUE;
1557    }
1558
1559    val->resize(size);
1560
1561    /* C++ bool handling means a vector of bools isn't necessarily addressable
1562     * (we might use individual bits)
1563     */
1564    bool data;
1565    for (int32_t i = 0; i < size; ++i) {
1566        status = readBool(&data);
1567        (*val)[i] = data;
1568
1569        if (status != OK) {
1570            return status;
1571        }
1572    }
1573
1574    return OK;
1575}
1576
1577status_t Parcel::readCharVector(std::vector<char16_t>* val) const {
1578    val->clear();
1579
1580    int32_t size;
1581    status_t status = readInt32(&size);
1582
1583    if (status != OK) {
1584        return status;
1585    }
1586
1587    if (size < 0) {
1588        return BAD_VALUE;
1589    }
1590
1591    val->resize(size);
1592
1593    for (auto& v : *val) {
1594        status = readChar(&v);
1595
1596        if (status != OK) {
1597            return status;
1598        }
1599    }
1600
1601    return OK;
1602}
1603
1604status_t Parcel::readString16Vector(std::vector<String16>* val) const {
1605    val->clear();
1606
1607    int32_t size;
1608    status_t status = readInt32(&size);
1609
1610    if (status != OK) {
1611        return status;
1612    }
1613
1614    if (size < 0) {
1615        return BAD_VALUE;
1616    }
1617
1618    val->reserve(size);
1619
1620    while (size-- > 0) {
1621        const char16_t *data;
1622        size_t size;
1623        data = readString16Inplace(&size);
1624
1625        if (data == nullptr) {
1626            return UNKNOWN_ERROR;
1627        }
1628
1629        val->emplace_back(data, size);
1630    }
1631
1632    return OK;
1633}
1634
1635
1636status_t Parcel::readInt32(int32_t *pArg) const
1637{
1638    return readAligned(pArg);
1639}
1640
1641int32_t Parcel::readInt32() const
1642{
1643    return readAligned<int32_t>();
1644}
1645
1646status_t Parcel::readUint32(uint32_t *pArg) const
1647{
1648    return readAligned(pArg);
1649}
1650
1651uint32_t Parcel::readUint32() const
1652{
1653    return readAligned<uint32_t>();
1654}
1655
1656status_t Parcel::readInt64(int64_t *pArg) const
1657{
1658    return readAligned(pArg);
1659}
1660
1661
1662int64_t Parcel::readInt64() const
1663{
1664    return readAligned<int64_t>();
1665}
1666
1667status_t Parcel::readUint64(uint64_t *pArg) const
1668{
1669    return readAligned(pArg);
1670}
1671
1672uint64_t Parcel::readUint64() const
1673{
1674    return readAligned<uint64_t>();
1675}
1676
1677status_t Parcel::readPointer(uintptr_t *pArg) const
1678{
1679    status_t ret;
1680    binder_uintptr_t ptr;
1681    ret = readAligned(&ptr);
1682    if (!ret)
1683        *pArg = ptr;
1684    return ret;
1685}
1686
1687uintptr_t Parcel::readPointer() const
1688{
1689    return readAligned<binder_uintptr_t>();
1690}
1691
1692
1693status_t Parcel::readFloat(float *pArg) const
1694{
1695    return readAligned(pArg);
1696}
1697
1698
1699float Parcel::readFloat() const
1700{
1701    return readAligned<float>();
1702}
1703
1704#if defined(__mips__) && defined(__mips_hard_float)
1705
1706status_t Parcel::readDouble(double *pArg) const
1707{
1708    union {
1709      double d;
1710      unsigned long long ll;
1711    } u;
1712    u.d = 0;
1713    status_t status;
1714    status = readAligned(&u.ll);
1715    *pArg = u.d;
1716    return status;
1717}
1718
1719double Parcel::readDouble() const
1720{
1721    union {
1722      double d;
1723      unsigned long long ll;
1724    } u;
1725    u.ll = readAligned<unsigned long long>();
1726    return u.d;
1727}
1728
1729#else
1730
1731status_t Parcel::readDouble(double *pArg) const
1732{
1733    return readAligned(pArg);
1734}
1735
1736double Parcel::readDouble() const
1737{
1738    return readAligned<double>();
1739}
1740
1741#endif
1742
1743status_t Parcel::readIntPtr(intptr_t *pArg) const
1744{
1745    return readAligned(pArg);
1746}
1747
1748
1749intptr_t Parcel::readIntPtr() const
1750{
1751    return readAligned<intptr_t>();
1752}
1753
1754status_t Parcel::readBool(bool *pArg) const
1755{
1756    int32_t tmp;
1757    status_t ret = readInt32(&tmp);
1758    *pArg = (tmp != 0);
1759    return ret;
1760}
1761
1762bool Parcel::readBool() const
1763{
1764    return readInt32() != 0;
1765}
1766
1767status_t Parcel::readChar(char16_t *pArg) const
1768{
1769    int32_t tmp;
1770    status_t ret = readInt32(&tmp);
1771    *pArg = char16_t(tmp);
1772    return ret;
1773}
1774
1775char16_t Parcel::readChar() const
1776{
1777    return char16_t(readInt32());
1778}
1779
1780status_t Parcel::readByte(int8_t *pArg) const
1781{
1782    int32_t tmp;
1783    status_t ret = readInt32(&tmp);
1784    *pArg = int8_t(tmp);
1785    return ret;
1786}
1787
1788int8_t Parcel::readByte() const
1789{
1790    return int8_t(readInt32());
1791}
1792
1793const char* Parcel::readCString() const
1794{
1795    const size_t avail = mDataSize-mDataPos;
1796    if (avail > 0) {
1797        const char* str = reinterpret_cast<const char*>(mData+mDataPos);
1798        // is the string's trailing NUL within the parcel's valid bounds?
1799        const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));
1800        if (eos) {
1801            const size_t len = eos - str;
1802            mDataPos += pad_size(len+1);
1803            ALOGV("readCString Setting data pos of %p to %zu", this, mDataPos);
1804            return str;
1805        }
1806    }
1807    return NULL;
1808}
1809
1810String8 Parcel::readString8() const
1811{
1812    int32_t size = readInt32();
1813    // watch for potential int overflow adding 1 for trailing NUL
1814    if (size > 0 && size < INT32_MAX) {
1815        const char* str = (const char*)readInplace(size+1);
1816        if (str) return String8(str, size);
1817    }
1818    return String8();
1819}
1820
1821String16 Parcel::readString16() const
1822{
1823    size_t len;
1824    const char16_t* str = readString16Inplace(&len);
1825    if (str) return String16(str, len);
1826    ALOGE("Reading a NULL string not supported here.");
1827    return String16();
1828}
1829
1830status_t Parcel::readString16(String16* pArg) const
1831{
1832    size_t len;
1833    const char16_t* str = readString16Inplace(&len);
1834    if (str) {
1835        pArg->setTo(str, len);
1836        return 0;
1837    } else {
1838        *pArg = String16();
1839        return UNKNOWN_ERROR;
1840    }
1841}
1842
1843const char16_t* Parcel::readString16Inplace(size_t* outLen) const
1844{
1845    int32_t size = readInt32();
1846    // watch for potential int overflow from size+1
1847    if (size >= 0 && size < INT32_MAX) {
1848        *outLen = size;
1849        const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t));
1850        if (str != NULL) {
1851            return str;
1852        }
1853    }
1854    *outLen = 0;
1855    return NULL;
1856}
1857
1858status_t Parcel::readStrongBinder(sp<IBinder>* val) const
1859{
1860    return unflatten_binder(ProcessState::self(), *this, val);
1861}
1862
1863sp<IBinder> Parcel::readStrongBinder() const
1864{
1865    sp<IBinder> val;
1866    readStrongBinder(&val);
1867    return val;
1868}
1869
1870wp<IBinder> Parcel::readWeakBinder() const
1871{
1872    wp<IBinder> val;
1873    unflatten_binder(ProcessState::self(), *this, &val);
1874    return val;
1875}
1876
1877int32_t Parcel::readExceptionCode() const
1878{
1879  int32_t exception_code = readAligned<int32_t>();
1880  if (exception_code == EX_HAS_REPLY_HEADER) {
1881    int32_t header_start = dataPosition();
1882    int32_t header_size = readAligned<int32_t>();
1883    // Skip over fat responses headers.  Not used (or propagated) in
1884    // native code
1885    setDataPosition(header_start + header_size);
1886    // And fat response headers are currently only used when there are no
1887    // exceptions, so return no error:
1888    return 0;
1889  }
1890  return exception_code;
1891}
1892
1893native_handle* Parcel::readNativeHandle() const
1894{
1895    int numFds, numInts;
1896    status_t err;
1897    err = readInt32(&numFds);
1898    if (err != NO_ERROR) return 0;
1899    err = readInt32(&numInts);
1900    if (err != NO_ERROR) return 0;
1901
1902    native_handle* h = native_handle_create(numFds, numInts);
1903    if (!h) {
1904        return 0;
1905    }
1906
1907    for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
1908        h->data[i] = dup(readFileDescriptor());
1909        if (h->data[i] < 0) err = BAD_VALUE;
1910    }
1911    err = read(h->data + numFds, sizeof(int)*numInts);
1912    if (err != NO_ERROR) {
1913        native_handle_close(h);
1914        native_handle_delete(h);
1915        h = 0;
1916    }
1917    return h;
1918}
1919
1920
1921int Parcel::readFileDescriptor() const
1922{
1923    const flat_binder_object* flat = readObject(true);
1924    if (flat) {
1925        switch (flat->type) {
1926            case BINDER_TYPE_FD:
1927                //ALOGI("Returning file descriptor %ld from parcel %p", flat->handle, this);
1928                return flat->handle;
1929        }
1930    }
1931    return BAD_TYPE;
1932}
1933
1934status_t Parcel::readBlob(size_t len, ReadableBlob* outBlob) const
1935{
1936    int32_t blobType;
1937    status_t status = readInt32(&blobType);
1938    if (status) return status;
1939
1940    if (blobType == BLOB_INPLACE) {
1941        ALOGV("readBlob: read in place");
1942        const void* ptr = readInplace(len);
1943        if (!ptr) return BAD_VALUE;
1944
1945        outBlob->init(-1, const_cast<void*>(ptr), len, false);
1946        return NO_ERROR;
1947    }
1948
1949    ALOGV("readBlob: read from ashmem");
1950    bool isMutable = (blobType == BLOB_ASHMEM_MUTABLE);
1951    int fd = readFileDescriptor();
1952    if (fd == int(BAD_TYPE)) return BAD_VALUE;
1953
1954    void* ptr = ::mmap(NULL, len, isMutable ? PROT_READ | PROT_WRITE : PROT_READ,
1955            MAP_SHARED, fd, 0);
1956    if (ptr == MAP_FAILED) return NO_MEMORY;
1957
1958    outBlob->init(fd, ptr, len, isMutable);
1959    return NO_ERROR;
1960}
1961
1962status_t Parcel::read(FlattenableHelperInterface& val) const
1963{
1964    // size
1965    const size_t len = this->readInt32();
1966    const size_t fd_count = this->readInt32();
1967
1968    if (len > INT32_MAX) {
1969        // don't accept size_t values which may have come from an
1970        // inadvertent conversion from a negative int.
1971        return BAD_VALUE;
1972    }
1973
1974    // payload
1975    void const* const buf = this->readInplace(pad_size(len));
1976    if (buf == NULL)
1977        return BAD_VALUE;
1978
1979    int* fds = NULL;
1980    if (fd_count) {
1981        fds = new int[fd_count];
1982    }
1983
1984    status_t err = NO_ERROR;
1985    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
1986        fds[i] = dup(this->readFileDescriptor());
1987        if (fds[i] < 0) {
1988            err = BAD_VALUE;
1989            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
1990                i, fds[i], fd_count, strerror(errno));
1991        }
1992    }
1993
1994    if (err == NO_ERROR) {
1995        err = val.unflatten(buf, len, fds, fd_count);
1996    }
1997
1998    if (fd_count) {
1999        delete [] fds;
2000    }
2001
2002    return err;
2003}
2004const flat_binder_object* Parcel::readObject(bool nullMetaData) const
2005{
2006    const size_t DPOS = mDataPos;
2007    if ((DPOS+sizeof(flat_binder_object)) <= mDataSize) {
2008        const flat_binder_object* obj
2009                = reinterpret_cast<const flat_binder_object*>(mData+DPOS);
2010        mDataPos = DPOS + sizeof(flat_binder_object);
2011        if (!nullMetaData && (obj->cookie == 0 && obj->binder == 0)) {
2012            // When transferring a NULL object, we don't write it into
2013            // the object list, so we don't want to check for it when
2014            // reading.
2015            ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
2016            return obj;
2017        }
2018
2019        // Ensure that this object is valid...
2020        binder_size_t* const OBJS = mObjects;
2021        const size_t N = mObjectsSize;
2022        size_t opos = mNextObjectHint;
2023
2024        if (N > 0) {
2025            ALOGV("Parcel %p looking for obj at %zu, hint=%zu",
2026                 this, DPOS, opos);
2027
2028            // Start at the current hint position, looking for an object at
2029            // the current data position.
2030            if (opos < N) {
2031                while (opos < (N-1) && OBJS[opos] < DPOS) {
2032                    opos++;
2033                }
2034            } else {
2035                opos = N-1;
2036            }
2037            if (OBJS[opos] == DPOS) {
2038                // Found it!
2039                ALOGV("Parcel %p found obj %zu at index %zu with forward search",
2040                     this, DPOS, opos);
2041                mNextObjectHint = opos+1;
2042                ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
2043                return obj;
2044            }
2045
2046            // Look backwards for it...
2047            while (opos > 0 && OBJS[opos] > DPOS) {
2048                opos--;
2049            }
2050            if (OBJS[opos] == DPOS) {
2051                // Found it!
2052                ALOGV("Parcel %p found obj %zu at index %zu with backward search",
2053                     this, DPOS, opos);
2054                mNextObjectHint = opos+1;
2055                ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
2056                return obj;
2057            }
2058        }
2059        ALOGW("Attempt to read object from Parcel %p at offset %zu that is not in the object list",
2060             this, DPOS);
2061    }
2062    return NULL;
2063}
2064
2065void Parcel::closeFileDescriptors()
2066{
2067    size_t i = mObjectsSize;
2068    if (i > 0) {
2069        //ALOGI("Closing file descriptors for %zu objects...", i);
2070    }
2071    while (i > 0) {
2072        i--;
2073        const flat_binder_object* flat
2074            = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
2075        if (flat->type == BINDER_TYPE_FD) {
2076            //ALOGI("Closing fd: %ld", flat->handle);
2077            close(flat->handle);
2078        }
2079    }
2080}
2081
2082uintptr_t Parcel::ipcData() const
2083{
2084    return reinterpret_cast<uintptr_t>(mData);
2085}
2086
2087size_t Parcel::ipcDataSize() const
2088{
2089    return (mDataSize > mDataPos ? mDataSize : mDataPos);
2090}
2091
2092uintptr_t Parcel::ipcObjects() const
2093{
2094    return reinterpret_cast<uintptr_t>(mObjects);
2095}
2096
2097size_t Parcel::ipcObjectsCount() const
2098{
2099    return mObjectsSize;
2100}
2101
2102void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,
2103    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)
2104{
2105    binder_size_t minOffset = 0;
2106    freeDataNoInit();
2107    mError = NO_ERROR;
2108    mData = const_cast<uint8_t*>(data);
2109    mDataSize = mDataCapacity = dataSize;
2110    //ALOGI("setDataReference Setting data size of %p to %lu (pid=%d)", this, mDataSize, getpid());
2111    mDataPos = 0;
2112    ALOGV("setDataReference Setting data pos of %p to %zu", this, mDataPos);
2113    mObjects = const_cast<binder_size_t*>(objects);
2114    mObjectsSize = mObjectsCapacity = objectsCount;
2115    mNextObjectHint = 0;
2116    mOwner = relFunc;
2117    mOwnerCookie = relCookie;
2118    for (size_t i = 0; i < mObjectsSize; i++) {
2119        binder_size_t offset = mObjects[i];
2120        if (offset < minOffset) {
2121            ALOGE("%s: bad object offset %" PRIu64 " < %" PRIu64 "\n",
2122                  __func__, (uint64_t)offset, (uint64_t)minOffset);
2123            mObjectsSize = 0;
2124            break;
2125        }
2126        minOffset = offset + sizeof(flat_binder_object);
2127    }
2128    scanForFds();
2129}
2130
2131void Parcel::print(TextOutput& to, uint32_t /*flags*/) const
2132{
2133    to << "Parcel(";
2134
2135    if (errorCheck() != NO_ERROR) {
2136        const status_t err = errorCheck();
2137        to << "Error: " << (void*)(intptr_t)err << " \"" << strerror(-err) << "\"";
2138    } else if (dataSize() > 0) {
2139        const uint8_t* DATA = data();
2140        to << indent << HexDump(DATA, dataSize()) << dedent;
2141        const binder_size_t* OBJS = objects();
2142        const size_t N = objectsCount();
2143        for (size_t i=0; i<N; i++) {
2144            const flat_binder_object* flat
2145                = reinterpret_cast<const flat_binder_object*>(DATA+OBJS[i]);
2146            to << endl << "Object #" << i << " @ " << (void*)OBJS[i] << ": "
2147                << TypeCode(flat->type & 0x7f7f7f00)
2148                << " = " << flat->binder;
2149        }
2150    } else {
2151        to << "NULL";
2152    }
2153
2154    to << ")";
2155}
2156
2157void Parcel::releaseObjects()
2158{
2159    const sp<ProcessState> proc(ProcessState::self());
2160    size_t i = mObjectsSize;
2161    uint8_t* const data = mData;
2162    binder_size_t* const objects = mObjects;
2163    while (i > 0) {
2164        i--;
2165        const flat_binder_object* flat
2166            = reinterpret_cast<flat_binder_object*>(data+objects[i]);
2167        release_object(proc, *flat, this, &mOpenAshmemSize);
2168    }
2169}
2170
2171void Parcel::acquireObjects()
2172{
2173    const sp<ProcessState> proc(ProcessState::self());
2174    size_t i = mObjectsSize;
2175    uint8_t* const data = mData;
2176    binder_size_t* const objects = mObjects;
2177    while (i > 0) {
2178        i--;
2179        const flat_binder_object* flat
2180            = reinterpret_cast<flat_binder_object*>(data+objects[i]);
2181        acquire_object(proc, *flat, this, &mOpenAshmemSize);
2182    }
2183}
2184
2185void Parcel::freeData()
2186{
2187    freeDataNoInit();
2188    initState();
2189}
2190
2191void Parcel::freeDataNoInit()
2192{
2193    if (mOwner) {
2194        LOG_ALLOC("Parcel %p: freeing other owner data", this);
2195        //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
2196        mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
2197    } else {
2198        LOG_ALLOC("Parcel %p: freeing allocated data", this);
2199        releaseObjects();
2200        if (mData) {
2201            LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);
2202            pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2203            if (mDataCapacity <= gParcelGlobalAllocSize) {
2204              gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;
2205            } else {
2206              gParcelGlobalAllocSize = 0;
2207            }
2208            if (gParcelGlobalAllocCount > 0) {
2209              gParcelGlobalAllocCount--;
2210            }
2211            pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2212            free(mData);
2213        }
2214        if (mObjects) free(mObjects);
2215    }
2216}
2217
2218status_t Parcel::growData(size_t len)
2219{
2220    if (len > INT32_MAX) {
2221        // don't accept size_t values which may have come from an
2222        // inadvertent conversion from a negative int.
2223        return BAD_VALUE;
2224    }
2225
2226    size_t newSize = ((mDataSize+len)*3)/2;
2227    return (newSize <= mDataSize)
2228            ? (status_t) NO_MEMORY
2229            : continueWrite(newSize);
2230}
2231
2232status_t Parcel::restartWrite(size_t desired)
2233{
2234    if (desired > INT32_MAX) {
2235        // don't accept size_t values which may have come from an
2236        // inadvertent conversion from a negative int.
2237        return BAD_VALUE;
2238    }
2239
2240    if (mOwner) {
2241        freeData();
2242        return continueWrite(desired);
2243    }
2244
2245    uint8_t* data = (uint8_t*)realloc(mData, desired);
2246    if (!data && desired > mDataCapacity) {
2247        mError = NO_MEMORY;
2248        return NO_MEMORY;
2249    }
2250
2251    releaseObjects();
2252
2253    if (data) {
2254        LOG_ALLOC("Parcel %p: restart from %zu to %zu capacity", this, mDataCapacity, desired);
2255        pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2256        gParcelGlobalAllocSize += desired;
2257        gParcelGlobalAllocSize -= mDataCapacity;
2258        pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2259        mData = data;
2260        mDataCapacity = desired;
2261    }
2262
2263    mDataSize = mDataPos = 0;
2264    ALOGV("restartWrite Setting data size of %p to %zu", this, mDataSize);
2265    ALOGV("restartWrite Setting data pos of %p to %zu", this, mDataPos);
2266
2267    free(mObjects);
2268    mObjects = NULL;
2269    mObjectsSize = mObjectsCapacity = 0;
2270    mNextObjectHint = 0;
2271    mHasFds = false;
2272    mFdsKnown = true;
2273    mAllowFds = true;
2274
2275    return NO_ERROR;
2276}
2277
2278status_t Parcel::continueWrite(size_t desired)
2279{
2280    if (desired > INT32_MAX) {
2281        // don't accept size_t values which may have come from an
2282        // inadvertent conversion from a negative int.
2283        return BAD_VALUE;
2284    }
2285
2286    // If shrinking, first adjust for any objects that appear
2287    // after the new data size.
2288    size_t objectsSize = mObjectsSize;
2289    if (desired < mDataSize) {
2290        if (desired == 0) {
2291            objectsSize = 0;
2292        } else {
2293            while (objectsSize > 0) {
2294                if (mObjects[objectsSize-1] < desired)
2295                    break;
2296                objectsSize--;
2297            }
2298        }
2299    }
2300
2301    if (mOwner) {
2302        // If the size is going to zero, just release the owner's data.
2303        if (desired == 0) {
2304            freeData();
2305            return NO_ERROR;
2306        }
2307
2308        // If there is a different owner, we need to take
2309        // posession.
2310        uint8_t* data = (uint8_t*)malloc(desired);
2311        if (!data) {
2312            mError = NO_MEMORY;
2313            return NO_MEMORY;
2314        }
2315        binder_size_t* objects = NULL;
2316
2317        if (objectsSize) {
2318            objects = (binder_size_t*)calloc(objectsSize, sizeof(binder_size_t));
2319            if (!objects) {
2320                free(data);
2321
2322                mError = NO_MEMORY;
2323                return NO_MEMORY;
2324            }
2325
2326            // Little hack to only acquire references on objects
2327            // we will be keeping.
2328            size_t oldObjectsSize = mObjectsSize;
2329            mObjectsSize = objectsSize;
2330            acquireObjects();
2331            mObjectsSize = oldObjectsSize;
2332        }
2333
2334        if (mData) {
2335            memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
2336        }
2337        if (objects && mObjects) {
2338            memcpy(objects, mObjects, objectsSize*sizeof(binder_size_t));
2339        }
2340        //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
2341        mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
2342        mOwner = NULL;
2343
2344        LOG_ALLOC("Parcel %p: taking ownership of %zu capacity", this, desired);
2345        pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2346        gParcelGlobalAllocSize += desired;
2347        gParcelGlobalAllocCount++;
2348        pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2349
2350        mData = data;
2351        mObjects = objects;
2352        mDataSize = (mDataSize < desired) ? mDataSize : desired;
2353        ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2354        mDataCapacity = desired;
2355        mObjectsSize = mObjectsCapacity = objectsSize;
2356        mNextObjectHint = 0;
2357
2358    } else if (mData) {
2359        if (objectsSize < mObjectsSize) {
2360            // Need to release refs on any objects we are dropping.
2361            const sp<ProcessState> proc(ProcessState::self());
2362            for (size_t i=objectsSize; i<mObjectsSize; i++) {
2363                const flat_binder_object* flat
2364                    = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
2365                if (flat->type == BINDER_TYPE_FD) {
2366                    // will need to rescan because we may have lopped off the only FDs
2367                    mFdsKnown = false;
2368                }
2369                release_object(proc, *flat, this, &mOpenAshmemSize);
2370            }
2371            binder_size_t* objects =
2372                (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));
2373            if (objects) {
2374                mObjects = objects;
2375            }
2376            mObjectsSize = objectsSize;
2377            mNextObjectHint = 0;
2378        }
2379
2380        // We own the data, so we can just do a realloc().
2381        if (desired > mDataCapacity) {
2382            uint8_t* data = (uint8_t*)realloc(mData, desired);
2383            if (data) {
2384                LOG_ALLOC("Parcel %p: continue from %zu to %zu capacity", this, mDataCapacity,
2385                        desired);
2386                pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2387                gParcelGlobalAllocSize += desired;
2388                gParcelGlobalAllocSize -= mDataCapacity;
2389                gParcelGlobalAllocCount++;
2390                pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2391                mData = data;
2392                mDataCapacity = desired;
2393            } else if (desired > mDataCapacity) {
2394                mError = NO_MEMORY;
2395                return NO_MEMORY;
2396            }
2397        } else {
2398            if (mDataSize > desired) {
2399                mDataSize = desired;
2400                ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2401            }
2402            if (mDataPos > desired) {
2403                mDataPos = desired;
2404                ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
2405            }
2406        }
2407
2408    } else {
2409        // This is the first data.  Easy!
2410        uint8_t* data = (uint8_t*)malloc(desired);
2411        if (!data) {
2412            mError = NO_MEMORY;
2413            return NO_MEMORY;
2414        }
2415
2416        if(!(mDataCapacity == 0 && mObjects == NULL
2417             && mObjectsCapacity == 0)) {
2418            ALOGE("continueWrite: %zu/%p/%zu/%zu", mDataCapacity, mObjects, mObjectsCapacity, desired);
2419        }
2420
2421        LOG_ALLOC("Parcel %p: allocating with %zu capacity", this, desired);
2422        pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2423        gParcelGlobalAllocSize += desired;
2424        gParcelGlobalAllocCount++;
2425        pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2426
2427        mData = data;
2428        mDataSize = mDataPos = 0;
2429        ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2430        ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
2431        mDataCapacity = desired;
2432    }
2433
2434    return NO_ERROR;
2435}
2436
2437void Parcel::initState()
2438{
2439    LOG_ALLOC("Parcel %p: initState", this);
2440    mError = NO_ERROR;
2441    mData = 0;
2442    mDataSize = 0;
2443    mDataCapacity = 0;
2444    mDataPos = 0;
2445    ALOGV("initState Setting data size of %p to %zu", this, mDataSize);
2446    ALOGV("initState Setting data pos of %p to %zu", this, mDataPos);
2447    mObjects = NULL;
2448    mObjectsSize = 0;
2449    mObjectsCapacity = 0;
2450    mNextObjectHint = 0;
2451    mHasFds = false;
2452    mFdsKnown = true;
2453    mAllowFds = true;
2454    mOwner = NULL;
2455    mOpenAshmemSize = 0;
2456}
2457
2458void Parcel::scanForFds() const
2459{
2460    bool hasFds = false;
2461    for (size_t i=0; i<mObjectsSize; i++) {
2462        const flat_binder_object* flat
2463            = reinterpret_cast<const flat_binder_object*>(mData + mObjects[i]);
2464        if (flat->type == BINDER_TYPE_FD) {
2465            hasFds = true;
2466            break;
2467        }
2468    }
2469    mHasFds = hasFds;
2470    mFdsKnown = true;
2471}
2472
2473size_t Parcel::getBlobAshmemSize() const
2474{
2475    // This used to return the size of all blobs that were written to ashmem, now we're returning
2476    // the ashmem currently referenced by this Parcel, which should be equivalent.
2477    // TODO: Remove method once ABI can be changed.
2478    return mOpenAshmemSize;
2479}
2480
2481size_t Parcel::getOpenAshmemSize() const
2482{
2483    return mOpenAshmemSize;
2484}
2485
2486// --- Parcel::Blob ---
2487
2488Parcel::Blob::Blob() :
2489        mFd(-1), mData(NULL), mSize(0), mMutable(false) {
2490}
2491
2492Parcel::Blob::~Blob() {
2493    release();
2494}
2495
2496void Parcel::Blob::release() {
2497    if (mFd != -1 && mData) {
2498        ::munmap(mData, mSize);
2499    }
2500    clear();
2501}
2502
2503void Parcel::Blob::init(int fd, void* data, size_t size, bool isMutable) {
2504    mFd = fd;
2505    mData = data;
2506    mSize = size;
2507    mMutable = isMutable;
2508}
2509
2510void Parcel::Blob::clear() {
2511    mFd = -1;
2512    mData = NULL;
2513    mSize = 0;
2514    mMutable = false;
2515}
2516
2517}; // namespace android
2518