1 /*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "hw-Parcel"
18 //#define LOG_NDEBUG 0
19
20 #include <errno.h>
21 #include <fcntl.h>
22 #include <inttypes.h>
23 #include <pthread.h>
24 #include <stdint.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <sys/mman.h>
28 #include <sys/stat.h>
29 #include <sys/types.h>
30 #include <sys/resource.h>
31 #include <unistd.h>
32
33 #include <hwbinder/Binder.h>
34 #include <hwbinder/BpHwBinder.h>
35 #include <hwbinder/IPCThreadState.h>
36 #include <hwbinder/Parcel.h>
37 #include <hwbinder/ProcessState.h>
38 #include <hwbinder/TextOutput.h>
39 #include <hwbinder/binder_kernel.h>
40
41 #include <cutils/ashmem.h>
42 #include <utils/Debug.h>
43 #include <utils/Log.h>
44 #include <utils/misc.h>
45 #include <utils/String8.h>
46 #include <utils/String16.h>
47
48 #include <private/binder/binder_module.h>
49 #include <hwbinder/Static.h>
50
51 #ifndef INT32_MAX
52 #define INT32_MAX ((int32_t)(2147483647))
53 #endif
54
55 #define LOG_REFS(...)
56 //#define LOG_REFS(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
57 #define LOG_ALLOC(...)
58 //#define LOG_ALLOC(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
59 #define LOG_BUFFER(...)
60 // #define LOG_BUFFER(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
61
62 // ---------------------------------------------------------------------------
63
64 // This macro should never be used at runtime, as a too large value
65 // of s could cause an integer overflow. Instead, you should always
66 // use the wrapper function pad_size()
67 #define PAD_SIZE_UNSAFE(s) (((s)+3)&~3)
68
pad_size(size_t s)69 static size_t pad_size(size_t s) {
70 if (s > (SIZE_T_MAX - 3)) {
71 abort();
72 }
73 return PAD_SIZE_UNSAFE(s);
74 }
75
76 // Note: must be kept in sync with android/os/StrictMode.java's PENALTY_GATHER
77 #define STRICT_MODE_PENALTY_GATHER (0x40 << 16)
78
79 // XXX This can be made public if we want to provide
80 // support for typed data.
81 struct small_flat_data
82 {
83 uint32_t type;
84 uint32_t data;
85 };
86
87 namespace android {
88 namespace hardware {
89
90 static pthread_mutex_t gParcelGlobalAllocSizeLock = PTHREAD_MUTEX_INITIALIZER;
91 static size_t gParcelGlobalAllocSize = 0;
92 static size_t gParcelGlobalAllocCount = 0;
93
94 static size_t gMaxFds = 0;
95
96 static const size_t PARCEL_REF_CAP = 1024;
97
acquire_binder_object(const sp<ProcessState> & proc,const flat_binder_object & obj,const void * who)98 void acquire_binder_object(const sp<ProcessState>& proc,
99 const flat_binder_object& obj, const void* who)
100 {
101 switch (obj.hdr.type) {
102 case BINDER_TYPE_BINDER:
103 if (obj.binder) {
104 LOG_REFS("Parcel %p acquiring reference on local %p", who, obj.cookie);
105 reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who);
106 }
107 return;
108 case BINDER_TYPE_WEAK_BINDER:
109 if (obj.binder)
110 reinterpret_cast<RefBase::weakref_type*>(obj.binder)->incWeak(who);
111 return;
112 case BINDER_TYPE_HANDLE: {
113 const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
114 if (b != NULL) {
115 LOG_REFS("Parcel %p acquiring reference on remote %p", who, b.get());
116 b->incStrong(who);
117 }
118 return;
119 }
120 case BINDER_TYPE_WEAK_HANDLE: {
121 const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
122 if (b != NULL) b.get_refs()->incWeak(who);
123 return;
124 }
125 }
126
127 ALOGD("Invalid object type 0x%08x", obj.hdr.type);
128 }
129
acquire_object(const sp<ProcessState> & proc,const binder_object_header & obj,const void * who)130 void acquire_object(const sp<ProcessState>& proc, const binder_object_header& obj,
131 const void *who) {
132 switch (obj.type) {
133 case BINDER_TYPE_BINDER:
134 case BINDER_TYPE_WEAK_BINDER:
135 case BINDER_TYPE_HANDLE:
136 case BINDER_TYPE_WEAK_HANDLE: {
137 const flat_binder_object& fbo = reinterpret_cast<const flat_binder_object&>(obj);
138 acquire_binder_object(proc, fbo, who);
139 break;
140 }
141 }
142 }
143
release_object(const sp<ProcessState> & proc,const flat_binder_object & obj,const void * who)144 void release_object(const sp<ProcessState>& proc,
145 const flat_binder_object& obj, const void* who)
146 {
147 switch (obj.hdr.type) {
148 case BINDER_TYPE_BINDER:
149 if (obj.binder) {
150 LOG_REFS("Parcel %p releasing reference on local %p", who, obj.cookie);
151 reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who);
152 }
153 return;
154 case BINDER_TYPE_WEAK_BINDER:
155 if (obj.binder)
156 reinterpret_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who);
157 return;
158 case BINDER_TYPE_HANDLE: {
159 const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
160 if (b != NULL) {
161 LOG_REFS("Parcel %p releasing reference on remote %p", who, b.get());
162 b->decStrong(who);
163 }
164 return;
165 }
166 case BINDER_TYPE_WEAK_HANDLE: {
167 const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
168 if (b != NULL) b.get_refs()->decWeak(who);
169 return;
170 }
171 case BINDER_TYPE_FD: {
172 if (obj.cookie != 0) { // owned
173 close(obj.handle);
174 }
175 return;
176 }
177 case BINDER_TYPE_PTR: {
178 // The relevant buffer is part of the transaction buffer and will be freed that way
179 return;
180 }
181 case BINDER_TYPE_FDA: {
182 // The enclosed file descriptors are closed in the kernel
183 return;
184 }
185 }
186
187 ALOGE("Invalid object type 0x%08x", obj.hdr.type);
188 }
189
finish_flatten_binder(const sp<IBinder> &,const flat_binder_object & flat,Parcel * out)190 inline static status_t finish_flatten_binder(
191 const sp<IBinder>& /*binder*/, const flat_binder_object& flat, Parcel* out)
192 {
193 return out->writeObject(flat);
194 }
195
flatten_binder(const sp<ProcessState> &,const sp<IBinder> & binder,Parcel * out)196 status_t flatten_binder(const sp<ProcessState>& /*proc*/,
197 const sp<IBinder>& binder, Parcel* out)
198 {
199 flat_binder_object obj;
200
201 if (binder != NULL) {
202 BHwBinder *local = binder->localBinder();
203 if (!local) {
204 BpHwBinder *proxy = binder->remoteBinder();
205 if (proxy == NULL) {
206 ALOGE("null proxy");
207 }
208 const int32_t handle = proxy ? proxy->handle() : 0;
209 obj.hdr.type = BINDER_TYPE_HANDLE;
210 obj.flags = FLAT_BINDER_FLAG_ACCEPTS_FDS;
211 obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
212 obj.handle = handle;
213 obj.cookie = 0;
214 } else {
215 // Get policy and convert it
216 int policy = local->getMinSchedulingPolicy();
217 int priority = local->getMinSchedulingPriority();
218
219 obj.flags = priority & FLAT_BINDER_FLAG_PRIORITY_MASK;
220 obj.flags |= FLAT_BINDER_FLAG_ACCEPTS_FDS | FLAT_BINDER_FLAG_INHERIT_RT;
221 obj.flags |= (policy & 3) << FLAT_BINDER_FLAG_SCHEDPOLICY_SHIFT;
222 obj.hdr.type = BINDER_TYPE_BINDER;
223 obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
224 obj.cookie = reinterpret_cast<uintptr_t>(local);
225 }
226 } else {
227 obj.hdr.type = BINDER_TYPE_BINDER;
228 obj.binder = 0;
229 obj.cookie = 0;
230 }
231
232 return finish_flatten_binder(binder, obj, out);
233 }
234
flatten_binder(const sp<ProcessState> &,const wp<IBinder> & binder,Parcel * out)235 status_t flatten_binder(const sp<ProcessState>& /*proc*/,
236 const wp<IBinder>& binder, Parcel* out)
237 {
238 flat_binder_object obj;
239
240 obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
241 if (binder != NULL) {
242 sp<IBinder> real = binder.promote();
243 if (real != NULL) {
244 IBinder *local = real->localBinder();
245 if (!local) {
246 BpHwBinder *proxy = real->remoteBinder();
247 if (proxy == NULL) {
248 ALOGE("null proxy");
249 }
250 const int32_t handle = proxy ? proxy->handle() : 0;
251 obj.hdr.type = BINDER_TYPE_WEAK_HANDLE;
252 obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
253 obj.handle = handle;
254 obj.cookie = 0;
255 } else {
256 obj.hdr.type = BINDER_TYPE_WEAK_BINDER;
257 obj.binder = reinterpret_cast<uintptr_t>(binder.get_refs());
258 obj.cookie = reinterpret_cast<uintptr_t>(binder.unsafe_get());
259 }
260 return finish_flatten_binder(real, obj, out);
261 }
262
263 // XXX How to deal? In order to flatten the given binder,
264 // we need to probe it for information, which requires a primary
265 // reference... but we don't have one.
266 //
267 // The OpenBinder implementation uses a dynamic_cast<> here,
268 // but we can't do that with the different reference counting
269 // implementation we are using.
270 ALOGE("Unable to unflatten Binder weak reference!");
271 obj.hdr.type = BINDER_TYPE_BINDER;
272 obj.binder = 0;
273 obj.cookie = 0;
274 return finish_flatten_binder(NULL, obj, out);
275
276 } else {
277 obj.hdr.type = BINDER_TYPE_BINDER;
278 obj.binder = 0;
279 obj.cookie = 0;
280 return finish_flatten_binder(NULL, obj, out);
281 }
282 }
283
finish_unflatten_binder(BpHwBinder *,const flat_binder_object &,const Parcel &)284 inline static status_t finish_unflatten_binder(
285 BpHwBinder* /*proxy*/, const flat_binder_object& /*flat*/,
286 const Parcel& /*in*/)
287 {
288 return NO_ERROR;
289 }
290
unflatten_binder(const sp<ProcessState> & proc,const Parcel & in,sp<IBinder> * out)291 status_t unflatten_binder(const sp<ProcessState>& proc,
292 const Parcel& in, sp<IBinder>* out)
293 {
294 const flat_binder_object* flat = in.readObject<flat_binder_object>();
295
296 if (flat) {
297 switch (flat->hdr.type) {
298 case BINDER_TYPE_BINDER:
299 *out = reinterpret_cast<IBinder*>(flat->cookie);
300 return finish_unflatten_binder(NULL, *flat, in);
301 case BINDER_TYPE_HANDLE:
302 *out = proc->getStrongProxyForHandle(flat->handle);
303 return finish_unflatten_binder(
304 static_cast<BpHwBinder*>(out->get()), *flat, in);
305 }
306 }
307 return BAD_TYPE;
308 }
309
unflatten_binder(const sp<ProcessState> & proc,const Parcel & in,wp<IBinder> * out)310 status_t unflatten_binder(const sp<ProcessState>& proc,
311 const Parcel& in, wp<IBinder>* out)
312 {
313 const flat_binder_object* flat = in.readObject<flat_binder_object>();
314
315 if (flat) {
316 switch (flat->hdr.type) {
317 case BINDER_TYPE_BINDER:
318 *out = reinterpret_cast<IBinder*>(flat->cookie);
319 return finish_unflatten_binder(NULL, *flat, in);
320 case BINDER_TYPE_WEAK_BINDER:
321 if (flat->binder != 0) {
322 out->set_object_and_refs(
323 reinterpret_cast<IBinder*>(flat->cookie),
324 reinterpret_cast<RefBase::weakref_type*>(flat->binder));
325 } else {
326 *out = NULL;
327 }
328 return finish_unflatten_binder(NULL, *flat, in);
329 case BINDER_TYPE_HANDLE:
330 case BINDER_TYPE_WEAK_HANDLE:
331 *out = proc->getWeakProxyForHandle(flat->handle);
332 return finish_unflatten_binder(
333 static_cast<BpHwBinder*>(out->unsafe_get()), *flat, in);
334 }
335 }
336 return BAD_TYPE;
337 }
338
339 /*
340 * Return true iff:
341 * 1. obj is indeed a binder_buffer_object (type is BINDER_TYPE_PTR), and
342 * 2. obj does NOT have the flag BINDER_BUFFER_FLAG_REF (it is not a reference, but
343 * an actual buffer.)
344 */
isBuffer(const binder_buffer_object & obj)345 static inline bool isBuffer(const binder_buffer_object& obj) {
346 return obj.hdr.type == BINDER_TYPE_PTR
347 && (obj.flags & BINDER_BUFFER_FLAG_REF) == 0;
348 }
349
350 // ---------------------------------------------------------------------------
351
Parcel()352 Parcel::Parcel()
353 {
354 LOG_ALLOC("Parcel %p: constructing", this);
355 initState();
356 }
357
~Parcel()358 Parcel::~Parcel()
359 {
360 freeDataNoInit();
361 LOG_ALLOC("Parcel %p: destroyed", this);
362 }
363
getGlobalAllocSize()364 size_t Parcel::getGlobalAllocSize() {
365 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
366 size_t size = gParcelGlobalAllocSize;
367 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
368 return size;
369 }
370
getGlobalAllocCount()371 size_t Parcel::getGlobalAllocCount() {
372 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
373 size_t count = gParcelGlobalAllocCount;
374 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
375 return count;
376 }
377
data() const378 const uint8_t* Parcel::data() const
379 {
380 return mData;
381 }
382
dataSize() const383 size_t Parcel::dataSize() const
384 {
385 return (mDataSize > mDataPos ? mDataSize : mDataPos);
386 }
387
dataAvail() const388 size_t Parcel::dataAvail() const
389 {
390 size_t result = dataSize() - dataPosition();
391 if (result > INT32_MAX) {
392 abort();
393 }
394 return result;
395 }
396
dataPosition() const397 size_t Parcel::dataPosition() const
398 {
399 return mDataPos;
400 }
401
dataCapacity() const402 size_t Parcel::dataCapacity() const
403 {
404 return mDataCapacity;
405 }
406
setDataSize(size_t size)407 status_t Parcel::setDataSize(size_t size)
408 {
409 if (size > INT32_MAX) {
410 // don't accept size_t values which may have come from an
411 // inadvertent conversion from a negative int.
412 return BAD_VALUE;
413 }
414
415 status_t err;
416 err = continueWrite(size);
417 if (err == NO_ERROR) {
418 mDataSize = size;
419 ALOGV("setDataSize Setting data size of %p to %zu", this, mDataSize);
420 }
421 return err;
422 }
423
setDataPosition(size_t pos) const424 void Parcel::setDataPosition(size_t pos) const
425 {
426 if (pos > INT32_MAX) {
427 // don't accept size_t values which may have come from an
428 // inadvertent conversion from a negative int.
429 abort();
430 }
431
432 mDataPos = pos;
433 mNextObjectHint = 0;
434 }
435
setDataCapacity(size_t size)436 status_t Parcel::setDataCapacity(size_t size)
437 {
438 if (size > INT32_MAX) {
439 // don't accept size_t values which may have come from an
440 // inadvertent conversion from a negative int.
441 return BAD_VALUE;
442 }
443
444 if (size > mDataCapacity) return continueWrite(size);
445 return NO_ERROR;
446 }
447
setData(const uint8_t * buffer,size_t len)448 status_t Parcel::setData(const uint8_t* buffer, size_t len)
449 {
450 if (len > INT32_MAX) {
451 // don't accept size_t values which may have come from an
452 // inadvertent conversion from a negative int.
453 return BAD_VALUE;
454 }
455
456 status_t err = restartWrite(len);
457 if (err == NO_ERROR) {
458 memcpy(const_cast<uint8_t*>(data()), buffer, len);
459 mDataSize = len;
460 mFdsKnown = false;
461 }
462 return err;
463 }
464
465 // Write RPC headers. (previously just the interface token)
writeInterfaceToken(const char * interface)466 status_t Parcel::writeInterfaceToken(const char* interface)
467 {
468 // currently the interface identification token is just its name as a string
469 return writeCString(interface);
470 }
471
enforceInterface(const char * interface) const472 bool Parcel::enforceInterface(const char* interface) const
473 {
474 const char* str = readCString();
475 if (strcmp(str, interface) == 0) {
476 return true;
477 } else {
478 ALOGW("**** enforceInterface() expected '%s' but read '%s'",
479 String8(interface).string(), String8(str).string());
480 return false;
481 }
482 }
483
objects() const484 const binder_size_t* Parcel::objects() const
485 {
486 return mObjects;
487 }
488
objectsCount() const489 size_t Parcel::objectsCount() const
490 {
491 return mObjectsSize;
492 }
493
errorCheck() const494 status_t Parcel::errorCheck() const
495 {
496 return mError;
497 }
498
setError(status_t err)499 void Parcel::setError(status_t err)
500 {
501 mError = err;
502 }
503
finishWrite(size_t len)504 status_t Parcel::finishWrite(size_t len)
505 {
506 if (len > INT32_MAX) {
507 // don't accept size_t values which may have come from an
508 // inadvertent conversion from a negative int.
509 return BAD_VALUE;
510 }
511
512 //printf("Finish write of %d\n", len);
513 mDataPos += len;
514 ALOGV("finishWrite Setting data pos of %p to %zu", this, mDataPos);
515 if (mDataPos > mDataSize) {
516 mDataSize = mDataPos;
517 ALOGV("finishWrite Setting data size of %p to %zu", this, mDataSize);
518 }
519 //printf("New pos=%d, size=%d\n", mDataPos, mDataSize);
520 return NO_ERROR;
521 }
522
writeUnpadded(const void * data,size_t len)523 status_t Parcel::writeUnpadded(const void* data, size_t len)
524 {
525 if (len > INT32_MAX) {
526 // don't accept size_t values which may have come from an
527 // inadvertent conversion from a negative int.
528 return BAD_VALUE;
529 }
530
531 size_t end = mDataPos + len;
532 if (end < mDataPos) {
533 // integer overflow
534 return BAD_VALUE;
535 }
536
537 if (end <= mDataCapacity) {
538 restart_write:
539 memcpy(mData+mDataPos, data, len);
540 return finishWrite(len);
541 }
542
543 status_t err = growData(len);
544 if (err == NO_ERROR) goto restart_write;
545 return err;
546 }
547
write(const void * data,size_t len)548 status_t Parcel::write(const void* data, size_t len)
549 {
550 if (len > INT32_MAX) {
551 // don't accept size_t values which may have come from an
552 // inadvertent conversion from a negative int.
553 return BAD_VALUE;
554 }
555
556 void* const d = writeInplace(len);
557 if (d) {
558 memcpy(d, data, len);
559 return NO_ERROR;
560 }
561 return mError;
562 }
563
writeInplace(size_t len)564 void* Parcel::writeInplace(size_t len)
565 {
566 if (len > INT32_MAX) {
567 // don't accept size_t values which may have come from an
568 // inadvertent conversion from a negative int.
569 return NULL;
570 }
571
572 const size_t padded = pad_size(len);
573
574 // sanity check for integer overflow
575 if (mDataPos+padded < mDataPos) {
576 return NULL;
577 }
578
579 if ((mDataPos+padded) <= mDataCapacity) {
580 restart_write:
581 //printf("Writing %ld bytes, padded to %ld\n", len, padded);
582 uint8_t* const data = mData+mDataPos;
583
584 // Need to pad at end?
585 if (padded != len) {
586 #if BYTE_ORDER == BIG_ENDIAN
587 static const uint32_t mask[4] = {
588 0x00000000, 0xffffff00, 0xffff0000, 0xff000000
589 };
590 #endif
591 #if BYTE_ORDER == LITTLE_ENDIAN
592 static const uint32_t mask[4] = {
593 0x00000000, 0x00ffffff, 0x0000ffff, 0x000000ff
594 };
595 #endif
596 //printf("Applying pad mask: %p to %p\n", (void*)mask[padded-len],
597 // *reinterpret_cast<void**>(data+padded-4));
598 *reinterpret_cast<uint32_t*>(data+padded-4) &= mask[padded-len];
599 }
600
601 finishWrite(padded);
602 return data;
603 }
604
605 status_t err = growData(padded);
606 if (err == NO_ERROR) goto restart_write;
607 return NULL;
608 }
609
writeInt8(int8_t val)610 status_t Parcel::writeInt8(int8_t val)
611 {
612 return write(&val, sizeof(val));
613 }
614
writeUint8(uint8_t val)615 status_t Parcel::writeUint8(uint8_t val)
616 {
617 return write(&val, sizeof(val));
618 }
619
writeInt16(int16_t val)620 status_t Parcel::writeInt16(int16_t val)
621 {
622 return write(&val, sizeof(val));
623 }
624
writeUint16(uint16_t val)625 status_t Parcel::writeUint16(uint16_t val)
626 {
627 return write(&val, sizeof(val));
628 }
629
writeInt32(int32_t val)630 status_t Parcel::writeInt32(int32_t val)
631 {
632 return writeAligned(val);
633 }
634
writeUint32(uint32_t val)635 status_t Parcel::writeUint32(uint32_t val)
636 {
637 return writeAligned(val);
638 }
639
writeBool(bool val)640 status_t Parcel::writeBool(bool val)
641 {
642 return writeInt8(int8_t(val));
643 }
writeInt64(int64_t val)644 status_t Parcel::writeInt64(int64_t val)
645 {
646 return writeAligned(val);
647 }
648
writeUint64(uint64_t val)649 status_t Parcel::writeUint64(uint64_t val)
650 {
651 return writeAligned(val);
652 }
653
writePointer(uintptr_t val)654 status_t Parcel::writePointer(uintptr_t val)
655 {
656 return writeAligned<binder_uintptr_t>(val);
657 }
658
writeFloat(float val)659 status_t Parcel::writeFloat(float val)
660 {
661 return writeAligned(val);
662 }
663
664 #if defined(__mips__) && defined(__mips_hard_float)
665
writeDouble(double val)666 status_t Parcel::writeDouble(double val)
667 {
668 union {
669 double d;
670 unsigned long long ll;
671 } u;
672 u.d = val;
673 return writeAligned(u.ll);
674 }
675
676 #else
677
writeDouble(double val)678 status_t Parcel::writeDouble(double val)
679 {
680 return writeAligned(val);
681 }
682
683 #endif
684
writeCString(const char * str)685 status_t Parcel::writeCString(const char* str)
686 {
687 return write(str, strlen(str)+1);
688 }
writeString16(const std::unique_ptr<String16> & str)689 status_t Parcel::writeString16(const std::unique_ptr<String16>& str)
690 {
691 if (!str) {
692 return writeInt32(-1);
693 }
694
695 return writeString16(*str);
696 }
697
writeString16(const String16 & str)698 status_t Parcel::writeString16(const String16& str)
699 {
700 return writeString16(str.string(), str.size());
701 }
702
writeString16(const char16_t * str,size_t len)703 status_t Parcel::writeString16(const char16_t* str, size_t len)
704 {
705 if (str == NULL) return writeInt32(-1);
706
707 status_t err = writeInt32(len);
708 if (err == NO_ERROR) {
709 len *= sizeof(char16_t);
710 uint8_t* data = (uint8_t*)writeInplace(len+sizeof(char16_t));
711 if (data) {
712 memcpy(data, str, len);
713 *reinterpret_cast<char16_t*>(data+len) = 0;
714 return NO_ERROR;
715 }
716 err = mError;
717 }
718 return err;
719 }
writeStrongBinder(const sp<IBinder> & val)720 status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
721 {
722 return flatten_binder(ProcessState::self(), val, this);
723 }
724
writeWeakBinder(const wp<IBinder> & val)725 status_t Parcel::writeWeakBinder(const wp<IBinder>& val)
726 {
727 return flatten_binder(ProcessState::self(), val, this);
728 }
729
730 template <typename T>
writeObject(const T & val)731 status_t Parcel::writeObject(const T& val)
732 {
733 const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;
734 const bool enoughObjects = mObjectsSize < mObjectsCapacity;
735 if (enoughData && enoughObjects) {
736 restart_write:
737 *reinterpret_cast<T*>(mData+mDataPos) = val;
738
739 const binder_object_header* hdr = reinterpret_cast<binder_object_header*>(mData+mDataPos);
740 switch (hdr->type) {
741 case BINDER_TYPE_BINDER:
742 case BINDER_TYPE_WEAK_BINDER:
743 case BINDER_TYPE_HANDLE:
744 case BINDER_TYPE_WEAK_HANDLE: {
745 const flat_binder_object *fbo = reinterpret_cast<const flat_binder_object*>(hdr);
746 if (fbo->binder != 0) {
747 mObjects[mObjectsSize++] = mDataPos;
748 acquire_binder_object(ProcessState::self(), *fbo, this);
749 }
750 break;
751 }
752 case BINDER_TYPE_FD: {
753 // remember if it's a file descriptor
754 if (!mAllowFds) {
755 // fail before modifying our object index
756 return FDS_NOT_ALLOWED;
757 }
758 mHasFds = mFdsKnown = true;
759 mObjects[mObjectsSize++] = mDataPos;
760 break;
761 }
762 case BINDER_TYPE_FDA:
763 mObjects[mObjectsSize++] = mDataPos;
764 break;
765 case BINDER_TYPE_PTR: {
766 const binder_buffer_object *buffer_obj = reinterpret_cast<
767 const binder_buffer_object*>(hdr);
768 if ((void *)buffer_obj->buffer != nullptr) {
769 mObjects[mObjectsSize++] = mDataPos;
770 }
771 break;
772 }
773 default: {
774 ALOGE("writeObject: unknown type %d", hdr->type);
775 break;
776 }
777 }
778 return finishWrite(sizeof(val));
779 }
780
781 if (!enoughData) {
782 const status_t err = growData(sizeof(val));
783 if (err != NO_ERROR) return err;
784 }
785 if (!enoughObjects) {
786 size_t newSize = ((mObjectsSize+2)*3)/2;
787 if (newSize * sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY; // overflow
788 binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
789 if (objects == NULL) return NO_MEMORY;
790 mObjects = objects;
791 mObjectsCapacity = newSize;
792 }
793
794 goto restart_write;
795 }
796
797 template status_t Parcel::writeObject<flat_binder_object>(const flat_binder_object& val);
798 template status_t Parcel::writeObject<binder_fd_object>(const binder_fd_object& val);
799 template status_t Parcel::writeObject<binder_buffer_object>(const binder_buffer_object& val);
800 template status_t Parcel::writeObject<binder_fd_array_object>(const binder_fd_array_object& val);
801
802
803 // TODO merge duplicated code in writeEmbeddedBuffer, writeEmbeddedReference, and writeEmbeddedNullReference
804 // TODO merge duplicated code in writeBuffer, writeReference, and writeNullReference
805
validateBufferChild(size_t child_buffer_handle,size_t child_offset) const806 bool Parcel::validateBufferChild(size_t child_buffer_handle,
807 size_t child_offset) const {
808 if (child_buffer_handle >= mObjectsSize)
809 return false;
810 binder_buffer_object *child = reinterpret_cast<binder_buffer_object*>
811 (mData + mObjects[child_buffer_handle]);
812 if (!isBuffer(*child) || child_offset > child->length) {
813 // Parent object not a buffer, or not large enough
814 LOG_BUFFER("writeEmbeddedReference found wierd child. "
815 "child_offset = %zu, child->length = %zu",
816 child_offset, (size_t)child->length);
817 return false;
818 }
819 return true;
820 }
821
validateBufferParent(size_t parent_buffer_handle,size_t parent_offset) const822 bool Parcel::validateBufferParent(size_t parent_buffer_handle,
823 size_t parent_offset) const {
824 if (parent_buffer_handle >= mObjectsSize)
825 return false;
826 binder_buffer_object *parent = reinterpret_cast<binder_buffer_object*>
827 (mData + mObjects[parent_buffer_handle]);
828 if (!isBuffer(*parent) ||
829 sizeof(binder_uintptr_t) > parent->length ||
830 parent_offset > parent->length - sizeof(binder_uintptr_t)) {
831 // Parent object not a buffer, or not large enough
832 return false;
833 }
834 return true;
835 }
writeEmbeddedBuffer(const void * buffer,size_t length,size_t * handle,size_t parent_buffer_handle,size_t parent_offset)836 status_t Parcel::writeEmbeddedBuffer(
837 const void *buffer, size_t length, size_t *handle,
838 size_t parent_buffer_handle, size_t parent_offset) {
839 LOG_BUFFER("writeEmbeddedBuffer(%p, %zu, parent = (%zu, %zu)) -> %zu",
840 buffer, length, parent_buffer_handle,
841 parent_offset, mObjectsSize);
842 binder_buffer_object obj;
843 obj.hdr.type = BINDER_TYPE_PTR;
844 obj.buffer = reinterpret_cast<binder_uintptr_t>(buffer);
845 obj.length = length;
846 obj.flags = BINDER_BUFFER_FLAG_HAS_PARENT;
847 if(!validateBufferParent(parent_buffer_handle, parent_offset))
848 return BAD_VALUE;
849 obj.parent = parent_buffer_handle;
850 obj.parent_offset = parent_offset;
851 if (handle != nullptr) {
852 // We use an index into mObjects as a handle
853 *handle = mObjectsSize;
854 }
855 return writeObject(obj);
856 }
857
writeBuffer(const void * buffer,size_t length,size_t * handle)858 status_t Parcel::writeBuffer(const void *buffer, size_t length, size_t *handle)
859 {
860 LOG_BUFFER("writeBuffer(%p, %zu) -> %zu",
861 buffer, length, mObjectsSize);
862 binder_buffer_object obj;
863 obj.hdr.type = BINDER_TYPE_PTR;
864 obj.buffer = reinterpret_cast<binder_uintptr_t>(buffer);
865 obj.length = length;
866 obj.flags = 0;
867 if (handle != nullptr) {
868 // We use an index into mObjects as a handle
869 *handle = mObjectsSize;
870 }
871 return writeObject(obj);
872 }
873
incrementNumReferences()874 status_t Parcel::incrementNumReferences() {
875 ++mNumRef;
876 LOG_BUFFER("incrementNumReferences: %zu", mNumRef);
877 return mNumRef <= PARCEL_REF_CAP ? OK : NO_MEMORY;
878 }
879
writeReference(size_t * handle,size_t child_buffer_handle,size_t child_offset)880 status_t Parcel::writeReference(size_t *handle,
881 size_t child_buffer_handle, size_t child_offset) {
882 LOG_BUFFER("writeReference(child = (%zu, %zu)) -> %zu",
883 child_buffer_handle, child_offset,
884 mObjectsSize);
885 status_t status = incrementNumReferences();
886 if (status != OK)
887 return status;
888 binder_buffer_object obj;
889 obj.hdr.type = BINDER_TYPE_PTR;
890 obj.flags = BINDER_BUFFER_FLAG_REF;
891 if (!validateBufferChild(child_buffer_handle, child_offset))
892 return BAD_VALUE;
893 // The current binder.h does not have child and child_offset names yet.
894 // Use the buffer and length parameters.
895 obj.buffer = child_buffer_handle;
896 obj.length = child_offset;
897 if (handle != nullptr)
898 // We use an index into mObjects as a handle
899 *handle = mObjectsSize;
900 return writeObject(obj);
901 }
902
903 /* Write an object that describes a pointer from parent to child.
904 * Output the handle of that object in the size_t *handle variable. */
writeEmbeddedReference(size_t * handle,size_t child_buffer_handle,size_t child_offset,size_t parent_buffer_handle,size_t parent_offset)905 status_t Parcel::writeEmbeddedReference(size_t *handle,
906 size_t child_buffer_handle, size_t child_offset,
907 size_t parent_buffer_handle, size_t parent_offset) {
908 LOG_BUFFER("writeEmbeddedReference(child = (%zu, %zu), parent = (%zu, %zu)) -> %zu",
909 child_buffer_handle, child_offset,
910 parent_buffer_handle, parent_offset,
911 mObjectsSize);
912 status_t status = incrementNumReferences();
913 if (status != OK)
914 return status;
915 binder_buffer_object obj;
916 obj.hdr.type = BINDER_TYPE_PTR;
917 obj.flags = BINDER_BUFFER_FLAG_REF | BINDER_BUFFER_FLAG_HAS_PARENT;
918 if (!validateBufferChild(child_buffer_handle, child_offset))
919 return BAD_VALUE;
920 // The current binder.h does not have child and child_offset names yet.
921 // Use the buffer and length parameters.
922 obj.buffer = child_buffer_handle;
923 obj.length = child_offset;
924 if(!validateBufferParent(parent_buffer_handle, parent_offset))
925 return BAD_VALUE;
926 obj.parent = parent_buffer_handle;
927 obj.parent_offset = parent_offset;
928 if (handle != nullptr) {
929 // We use an index into mObjects as a handle
930 *handle = mObjectsSize;
931 }
932 return writeObject(obj);
933 }
934
writeNullReference(size_t * handle)935 status_t Parcel::writeNullReference(size_t * handle) {
936 LOG_BUFFER("writeNullReference -> %zu", mObjectsSize);
937 status_t status = incrementNumReferences();
938 if (status != OK)
939 return status;
940 binder_buffer_object obj;
941 obj.hdr.type = BINDER_TYPE_PTR;
942 obj.flags = BINDER_BUFFER_FLAG_REF;
943 if (handle != nullptr)
944 // We use an index into mObjects as a handle
945 *handle = mObjectsSize;
946 return writeObject(obj);
947 }
948
writeEmbeddedNullReference(size_t * handle,size_t parent_buffer_handle,size_t parent_offset)949 status_t Parcel::writeEmbeddedNullReference(size_t * handle,
950 size_t parent_buffer_handle, size_t parent_offset) {
951 LOG_BUFFER("writeEmbeddedNullReference(parent = (%zu, %zu)) -> %zu",
952 parent_buffer_handle,
953 parent_offset,
954 mObjectsSize);
955 status_t status = incrementNumReferences();
956 if (status != OK)
957 return status;
958 binder_buffer_object obj;
959 obj.hdr.type = BINDER_TYPE_PTR;
960 obj.flags = BINDER_BUFFER_FLAG_REF | BINDER_BUFFER_FLAG_HAS_PARENT;
961 // parent_buffer_handle and parent_offset needs to be checked.
962 if(!validateBufferParent(parent_buffer_handle, parent_offset))
963 return BAD_VALUE;
964 obj.parent = parent_buffer_handle;
965 obj.parent_offset = parent_offset;
966 if (handle != nullptr) {
967 // We use an index into mObjects as a handle
968 *handle = mObjectsSize;
969 }
970 return writeObject(obj);
971 }
972
clearCache() const973 void Parcel::clearCache() const {
974 LOG_BUFFER("clearing cache.");
975 mBufCachePos = 0;
976 mBufCache.clear();
977 }
978
updateCache() const979 void Parcel::updateCache() const {
980 if(mBufCachePos == mObjectsSize)
981 return;
982 LOG_BUFFER("updating cache from %zu to %zu", mBufCachePos, mObjectsSize);
983 for(size_t i = mBufCachePos; i < mObjectsSize; i++) {
984 binder_size_t dataPos = mObjects[i];
985 binder_buffer_object *obj =
986 reinterpret_cast<binder_buffer_object*>(mData+dataPos);
987 if(!isBuffer(*obj))
988 continue;
989 BufferInfo ifo;
990 ifo.index = i;
991 ifo.buffer = obj->buffer;
992 ifo.bufend = obj->buffer + obj->length;
993 mBufCache.push_back(ifo);
994 }
995 mBufCachePos = mObjectsSize;
996 }
997
998 /* O(n) (n=#buffers) to find a buffer that contains the given addr */
findBuffer(const void * ptr,size_t length,bool * found,size_t * handle,size_t * offset) const999 status_t Parcel::findBuffer(const void *ptr, size_t length, bool *found,
1000 size_t *handle, size_t *offset) const {
1001 if(found == nullptr)
1002 return UNKNOWN_ERROR;
1003 updateCache();
1004 binder_uintptr_t ptrVal = reinterpret_cast<binder_uintptr_t>(ptr);
1005 // true if the pointer is in some buffer, but the length is too big
1006 // so that ptr + length doesn't fit into the buffer.
1007 bool suspectRejectBadPointer = false;
1008 LOG_BUFFER("findBuffer examining %zu objects.", mObjectsSize);
1009 for(auto entry = mBufCache.rbegin(); entry != mBufCache.rend(); ++entry ) {
1010 if(entry->buffer <= ptrVal && ptrVal < entry->bufend) {
1011 // might have found it.
1012 if(ptrVal + length <= entry->bufend) {
1013 *found = true;
1014 if(handle != nullptr) *handle = entry->index;
1015 if(offset != nullptr) *offset = ptrVal - entry->buffer;
1016 LOG_BUFFER(" findBuffer has a match at %zu!", entry->index);
1017 return OK;
1018 } else {
1019 suspectRejectBadPointer = true;
1020 }
1021 }
1022 }
1023 LOG_BUFFER("findBuffer did not find for ptr = %p.", ptr);
1024 *found = false;
1025 return suspectRejectBadPointer ? BAD_VALUE : OK;
1026 }
1027
1028 /* findBuffer with the assumption that ptr = .buffer (so it points to top
1029 * of the buffer, aka offset 0).
1030 * */
quickFindBuffer(const void * ptr,size_t * handle) const1031 status_t Parcel::quickFindBuffer(const void *ptr, size_t *handle) const {
1032 updateCache();
1033 binder_uintptr_t ptrVal = reinterpret_cast<binder_uintptr_t>(ptr);
1034 LOG_BUFFER("quickFindBuffer examining %zu objects.", mObjectsSize);
1035 for(auto entry = mBufCache.rbegin(); entry != mBufCache.rend(); ++entry ) {
1036 if(entry->buffer == ptrVal) {
1037 if(handle != nullptr) *handle = entry->index;
1038 return OK;
1039 }
1040 }
1041 LOG_BUFFER("quickFindBuffer did not find for ptr = %p.", ptr);
1042 return NO_INIT;
1043 }
1044
writeNativeHandleNoDup(const native_handle_t * handle,bool embedded,size_t parent_buffer_handle,size_t parent_offset)1045 status_t Parcel::writeNativeHandleNoDup(const native_handle_t *handle,
1046 bool embedded,
1047 size_t parent_buffer_handle,
1048 size_t parent_offset)
1049 {
1050 struct binder_fd_array_object fd_array;
1051 size_t buffer_handle;
1052 status_t status = OK;
1053
1054 if (handle == nullptr) {
1055 status = writeUint64(0);
1056 return status;
1057 }
1058
1059 size_t native_handle_size = sizeof(native_handle_t)
1060 + handle->numFds * sizeof(int) + handle->numInts * sizeof(int);
1061 writeUint64(native_handle_size);
1062
1063 if (embedded) {
1064 status = writeEmbeddedBuffer((void*) handle,
1065 native_handle_size, &buffer_handle,
1066 parent_buffer_handle, parent_offset);
1067 } else {
1068 status = writeBuffer((void*) handle, native_handle_size, &buffer_handle);
1069 }
1070
1071 if (status != OK) {
1072 return status;
1073 }
1074
1075 fd_array.hdr.type = BINDER_TYPE_FDA;
1076 fd_array.num_fds = handle->numFds;
1077 fd_array.parent = buffer_handle;
1078 fd_array.parent_offset = offsetof(native_handle_t, data);
1079
1080 return writeObject(fd_array);
1081 }
1082
writeNativeHandleNoDup(const native_handle_t * handle)1083 status_t Parcel::writeNativeHandleNoDup(const native_handle_t *handle)
1084 {
1085 return writeNativeHandleNoDup(handle, false /* embedded */);
1086 }
1087
writeEmbeddedNativeHandle(const native_handle_t * handle,size_t parent_buffer_handle,size_t parent_offset)1088 status_t Parcel::writeEmbeddedNativeHandle(const native_handle_t *handle,
1089 size_t parent_buffer_handle,
1090 size_t parent_offset)
1091 {
1092 return writeNativeHandleNoDup(handle, true /* embedded */,
1093 parent_buffer_handle, parent_offset);
1094 }
1095
remove(size_t,size_t)1096 void Parcel::remove(size_t /*start*/, size_t /*amt*/)
1097 {
1098 LOG_ALWAYS_FATAL("Parcel::remove() not yet implemented!");
1099 }
1100
read(void * outData,size_t len) const1101 status_t Parcel::read(void* outData, size_t len) const
1102 {
1103 if (len > INT32_MAX) {
1104 // don't accept size_t values which may have come from an
1105 // inadvertent conversion from a negative int.
1106 return BAD_VALUE;
1107 }
1108
1109 if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1110 && len <= pad_size(len)) {
1111 memcpy(outData, mData+mDataPos, len);
1112 mDataPos += pad_size(len);
1113 ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
1114 return NO_ERROR;
1115 }
1116 return NOT_ENOUGH_DATA;
1117 }
1118
readInplace(size_t len) const1119 const void* Parcel::readInplace(size_t len) const
1120 {
1121 if (len > INT32_MAX) {
1122 // don't accept size_t values which may have come from an
1123 // inadvertent conversion from a negative int.
1124 return NULL;
1125 }
1126
1127 if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1128 && len <= pad_size(len)) {
1129 const void* data = mData+mDataPos;
1130 mDataPos += pad_size(len);
1131 ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
1132 return data;
1133 }
1134 return NULL;
1135 }
1136
1137 template<class T>
readAligned(T * pArg) const1138 status_t Parcel::readAligned(T *pArg) const {
1139 COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
1140
1141 if ((mDataPos+sizeof(T)) <= mDataSize) {
1142 const void* data = mData+mDataPos;
1143 mDataPos += sizeof(T);
1144 *pArg = *reinterpret_cast<const T*>(data);
1145 return NO_ERROR;
1146 } else {
1147 return NOT_ENOUGH_DATA;
1148 }
1149 }
1150
1151 template<class T>
readAligned() const1152 T Parcel::readAligned() const {
1153 T result;
1154 if (readAligned(&result) != NO_ERROR) {
1155 result = 0;
1156 }
1157
1158 return result;
1159 }
1160
1161 template<class T>
writeAligned(T val)1162 status_t Parcel::writeAligned(T val) {
1163 COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
1164
1165 if ((mDataPos+sizeof(val)) <= mDataCapacity) {
1166 restart_write:
1167 *reinterpret_cast<T*>(mData+mDataPos) = val;
1168 return finishWrite(sizeof(val));
1169 }
1170
1171 status_t err = growData(sizeof(val));
1172 if (err == NO_ERROR) goto restart_write;
1173 return err;
1174 }
1175
readInt8(int8_t * pArg) const1176 status_t Parcel::readInt8(int8_t *pArg) const
1177 {
1178 return read(pArg, sizeof(*pArg));
1179 }
1180
readUint8(uint8_t * pArg) const1181 status_t Parcel::readUint8(uint8_t *pArg) const
1182 {
1183 return read(pArg, sizeof(*pArg));
1184 }
1185
readInt16(int16_t * pArg) const1186 status_t Parcel::readInt16(int16_t *pArg) const
1187 {
1188 return read(pArg, sizeof(*pArg));
1189 }
1190
readUint16(uint16_t * pArg) const1191 status_t Parcel::readUint16(uint16_t *pArg) const
1192 {
1193 return read(pArg, sizeof(*pArg));
1194 }
1195
readInt32(int32_t * pArg) const1196 status_t Parcel::readInt32(int32_t *pArg) const
1197 {
1198 return readAligned(pArg);
1199 }
1200
readInt32() const1201 int32_t Parcel::readInt32() const
1202 {
1203 return readAligned<int32_t>();
1204 }
1205
readUint32(uint32_t * pArg) const1206 status_t Parcel::readUint32(uint32_t *pArg) const
1207 {
1208 return readAligned(pArg);
1209 }
1210
readUint32() const1211 uint32_t Parcel::readUint32() const
1212 {
1213 return readAligned<uint32_t>();
1214 }
1215
readInt64(int64_t * pArg) const1216 status_t Parcel::readInt64(int64_t *pArg) const
1217 {
1218 return readAligned(pArg);
1219 }
1220
readInt64() const1221 int64_t Parcel::readInt64() const
1222 {
1223 return readAligned<int64_t>();
1224 }
1225
readUint64(uint64_t * pArg) const1226 status_t Parcel::readUint64(uint64_t *pArg) const
1227 {
1228 return readAligned(pArg);
1229 }
1230
readUint64() const1231 uint64_t Parcel::readUint64() const
1232 {
1233 return readAligned<uint64_t>();
1234 }
1235
readPointer(uintptr_t * pArg) const1236 status_t Parcel::readPointer(uintptr_t *pArg) const
1237 {
1238 status_t ret;
1239 binder_uintptr_t ptr;
1240 ret = readAligned(&ptr);
1241 if (!ret)
1242 *pArg = ptr;
1243 return ret;
1244 }
1245
readPointer() const1246 uintptr_t Parcel::readPointer() const
1247 {
1248 return readAligned<binder_uintptr_t>();
1249 }
1250
1251
readFloat(float * pArg) const1252 status_t Parcel::readFloat(float *pArg) const
1253 {
1254 return readAligned(pArg);
1255 }
1256
1257
readFloat() const1258 float Parcel::readFloat() const
1259 {
1260 return readAligned<float>();
1261 }
1262
1263 #if defined(__mips__) && defined(__mips_hard_float)
1264
readDouble(double * pArg) const1265 status_t Parcel::readDouble(double *pArg) const
1266 {
1267 union {
1268 double d;
1269 unsigned long long ll;
1270 } u;
1271 u.d = 0;
1272 status_t status;
1273 status = readAligned(&u.ll);
1274 *pArg = u.d;
1275 return status;
1276 }
1277
readDouble() const1278 double Parcel::readDouble() const
1279 {
1280 union {
1281 double d;
1282 unsigned long long ll;
1283 } u;
1284 u.ll = readAligned<unsigned long long>();
1285 return u.d;
1286 }
1287
1288 #else
1289
readDouble(double * pArg) const1290 status_t Parcel::readDouble(double *pArg) const
1291 {
1292 return readAligned(pArg);
1293 }
1294
readDouble() const1295 double Parcel::readDouble() const
1296 {
1297 return readAligned<double>();
1298 }
1299
1300 #endif
1301
readBool(bool * pArg) const1302 status_t Parcel::readBool(bool *pArg) const
1303 {
1304 int8_t tmp;
1305 status_t ret = readInt8(&tmp);
1306 *pArg = (tmp != 0);
1307 return ret;
1308 }
1309
readBool() const1310 bool Parcel::readBool() const
1311 {
1312 int8_t tmp;
1313 status_t err = readInt8(&tmp);
1314
1315 if (err != OK) {
1316 return 0;
1317 }
1318
1319 return tmp != 0;
1320 }
1321
readCString() const1322 const char* Parcel::readCString() const
1323 {
1324 const size_t avail = mDataSize-mDataPos;
1325 if (avail > 0) {
1326 const char* str = reinterpret_cast<const char*>(mData+mDataPos);
1327 // is the string's trailing NUL within the parcel's valid bounds?
1328 const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));
1329 if (eos) {
1330 const size_t len = eos - str;
1331 mDataPos += pad_size(len+1);
1332 ALOGV("readCString Setting data pos of %p to %zu", this, mDataPos);
1333 return str;
1334 }
1335 }
1336 return NULL;
1337 }
readString16() const1338 String16 Parcel::readString16() const
1339 {
1340 size_t len;
1341 const char16_t* str = readString16Inplace(&len);
1342 if (str) return String16(str, len);
1343 ALOGE("Reading a NULL string not supported here.");
1344 return String16();
1345 }
1346
readString16(std::unique_ptr<String16> * pArg) const1347 status_t Parcel::readString16(std::unique_ptr<String16>* pArg) const
1348 {
1349 const int32_t start = dataPosition();
1350 int32_t size;
1351 status_t status = readInt32(&size);
1352 pArg->reset();
1353
1354 if (status != OK || size < 0) {
1355 return status;
1356 }
1357
1358 setDataPosition(start);
1359 pArg->reset(new (std::nothrow) String16());
1360
1361 status = readString16(pArg->get());
1362
1363 if (status != OK) {
1364 pArg->reset();
1365 }
1366
1367 return status;
1368 }
1369
readString16(String16 * pArg) const1370 status_t Parcel::readString16(String16* pArg) const
1371 {
1372 size_t len;
1373 const char16_t* str = readString16Inplace(&len);
1374 if (str) {
1375 pArg->setTo(str, len);
1376 return 0;
1377 } else {
1378 *pArg = String16();
1379 return UNEXPECTED_NULL;
1380 }
1381 }
1382
readString16Inplace(size_t * outLen) const1383 const char16_t* Parcel::readString16Inplace(size_t* outLen) const
1384 {
1385 int32_t size = readInt32();
1386 // watch for potential int overflow from size+1
1387 if (size >= 0 && size < INT32_MAX) {
1388 *outLen = size;
1389 const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t));
1390 if (str != NULL) {
1391 return str;
1392 }
1393 }
1394 *outLen = 0;
1395 return NULL;
1396 }
readStrongBinder(sp<IBinder> * val) const1397 status_t Parcel::readStrongBinder(sp<IBinder>* val) const
1398 {
1399 status_t status = readNullableStrongBinder(val);
1400 if (status == OK && !val->get()) {
1401 status = UNEXPECTED_NULL;
1402 }
1403 return status;
1404 }
1405
readNullableStrongBinder(sp<IBinder> * val) const1406 status_t Parcel::readNullableStrongBinder(sp<IBinder>* val) const
1407 {
1408 return unflatten_binder(ProcessState::self(), *this, val);
1409 }
1410
readStrongBinder() const1411 sp<IBinder> Parcel::readStrongBinder() const
1412 {
1413 sp<IBinder> val;
1414 // Note that a lot of code in Android reads binders by hand with this
1415 // method, and that code has historically been ok with getting nullptr
1416 // back (while ignoring error codes).
1417 readNullableStrongBinder(&val);
1418 return val;
1419 }
1420
readWeakBinder() const1421 wp<IBinder> Parcel::readWeakBinder() const
1422 {
1423 wp<IBinder> val;
1424 unflatten_binder(ProcessState::self(), *this, &val);
1425 return val;
1426 }
1427
1428 template<typename T>
readObject(size_t * objects_offset) const1429 const T* Parcel::readObject(size_t *objects_offset) const
1430 {
1431 const size_t DPOS = mDataPos;
1432 if (objects_offset != nullptr) {
1433 *objects_offset = 0;
1434 }
1435
1436 if ((DPOS+sizeof(T)) <= mDataSize) {
1437 const T* obj = reinterpret_cast<const T*>(mData+DPOS);
1438 mDataPos = DPOS + sizeof(T);
1439 const binder_object_header *hdr = reinterpret_cast<const binder_object_header*>(obj);
1440 switch (hdr->type) {
1441 case BINDER_TYPE_BINDER:
1442 case BINDER_TYPE_WEAK_BINDER:
1443 case BINDER_TYPE_HANDLE:
1444 case BINDER_TYPE_WEAK_HANDLE: {
1445 const flat_binder_object *flat_obj =
1446 reinterpret_cast<const flat_binder_object*>(hdr);
1447 if (flat_obj->cookie == 0 && flat_obj->binder == 0) {
1448 // When transferring a NULL binder object, we don't write it into
1449 // the object list, so we don't want to check for it when
1450 // reading.
1451 ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
1452 return obj;
1453 }
1454 break;
1455 }
1456 case BINDER_TYPE_FD:
1457 case BINDER_TYPE_FDA:
1458 // fd (-arrays) must always appear in the meta-data list (eg touched by the kernel)
1459 break;
1460 case BINDER_TYPE_PTR: {
1461 const binder_buffer_object *buffer_obj =
1462 reinterpret_cast<const binder_buffer_object*>(hdr);
1463 if ((void *)buffer_obj->buffer == nullptr) {
1464 // null pointers can be returned directly - they're not written in the
1465 // object list. All non-null buffers must appear in the objects list.
1466 return obj;
1467 }
1468 break;
1469 }
1470 }
1471 // Ensure that this object is valid...
1472 binder_size_t* const OBJS = mObjects;
1473 const size_t N = mObjectsSize;
1474 size_t opos = mNextObjectHint;
1475
1476 if (N > 0) {
1477 ALOGV("Parcel %p looking for obj at %zu, hint=%zu",
1478 this, DPOS, opos);
1479
1480 // Start at the current hint position, looking for an object at
1481 // the current data position.
1482 if (opos < N) {
1483 while (opos < (N-1) && OBJS[opos] < DPOS) {
1484 opos++;
1485 }
1486 } else {
1487 opos = N-1;
1488 }
1489 if (OBJS[opos] == DPOS) {
1490 // Found it!
1491 ALOGV("Parcel %p found obj %zu at index %zu with forward search",
1492 this, DPOS, opos);
1493 mNextObjectHint = opos+1;
1494 ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
1495 if (objects_offset != nullptr) {
1496 *objects_offset = opos;
1497 }
1498 return obj;
1499 }
1500
1501 // Look backwards for it...
1502 while (opos > 0 && OBJS[opos] > DPOS) {
1503 opos--;
1504 }
1505 if (OBJS[opos] == DPOS) {
1506 // Found it!
1507 ALOGV("Parcel %p found obj %zu at index %zu with backward search",
1508 this, DPOS, opos);
1509 mNextObjectHint = opos+1;
1510 ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
1511 if (objects_offset != nullptr) {
1512 *objects_offset = opos;
1513 }
1514 return obj;
1515 }
1516 }
1517 ALOGW("Attempt to read object from Parcel %p at offset %zu that is not in the object list",
1518 this, DPOS);
1519 }
1520 return NULL;
1521 }
1522
1523 template const flat_binder_object* Parcel::readObject<flat_binder_object>(size_t *objects_offset) const;
1524
1525 template const binder_fd_object* Parcel::readObject<binder_fd_object>(size_t *objects_offset) const;
1526
1527 template const binder_buffer_object* Parcel::readObject<binder_buffer_object>(size_t *objects_offset) const;
1528
1529 template const binder_fd_array_object* Parcel::readObject<binder_fd_array_object>(size_t *objects_offset) const;
1530
verifyBufferObject(const binder_buffer_object * buffer_obj,size_t size,uint32_t flags,size_t parent,size_t parentOffset) const1531 bool Parcel::verifyBufferObject(const binder_buffer_object *buffer_obj,
1532 size_t size, uint32_t flags, size_t parent,
1533 size_t parentOffset) const {
1534 if (buffer_obj->length != size) {
1535 ALOGE("Buffer length %" PRIu64 " does not match expected size %zu.",
1536 static_cast<uint64_t>(buffer_obj->length), size);
1537 return false;
1538 }
1539
1540 if (buffer_obj->flags != flags) {
1541 ALOGE("Buffer flags 0x%02X do not match expected flags 0x%02X.", buffer_obj->flags, flags);
1542 return false;
1543 }
1544
1545 if (flags & BINDER_BUFFER_FLAG_HAS_PARENT) {
1546 if (buffer_obj->parent != parent) {
1547 ALOGE("Buffer parent %" PRIu64 " does not match expected parent %zu.",
1548 static_cast<uint64_t>(buffer_obj->parent), parent);
1549 return false;
1550 }
1551 if (buffer_obj->parent_offset != parentOffset) {
1552 ALOGE("Buffer parent offset %" PRIu64 " does not match expected offset %zu.",
1553 static_cast<uint64_t>(buffer_obj->parent_offset), parentOffset);
1554 return false;
1555 }
1556 }
1557
1558 return true;
1559 }
1560
readBuffer(size_t buffer_size,size_t * buffer_handle,uint32_t flags,size_t parent,size_t parentOffset,const void ** buffer_out) const1561 status_t Parcel::readBuffer(size_t buffer_size, size_t *buffer_handle,
1562 uint32_t flags, size_t parent, size_t parentOffset,
1563 const void **buffer_out) const {
1564
1565 const binder_buffer_object* buffer_obj = readObject<binder_buffer_object>(buffer_handle);
1566
1567 if (buffer_obj == nullptr || !isBuffer(*buffer_obj)) {
1568 return BAD_VALUE;
1569 }
1570
1571 if (!verifyBufferObject(buffer_obj, buffer_size, flags, parent, parentOffset)) {
1572 return BAD_VALUE;
1573 }
1574
1575 // in read side, always use .buffer and .length.
1576 *buffer_out = reinterpret_cast<void*>(buffer_obj->buffer);
1577
1578 return OK;
1579 }
1580
readNullableBuffer(size_t buffer_size,size_t * buffer_handle,const void ** buffer_out) const1581 status_t Parcel::readNullableBuffer(size_t buffer_size, size_t *buffer_handle,
1582 const void **buffer_out) const
1583 {
1584 return readBuffer(buffer_size, buffer_handle,
1585 0 /* flags */, 0 /* parent */, 0 /* parentOffset */,
1586 buffer_out);
1587 }
1588
readBuffer(size_t buffer_size,size_t * buffer_handle,const void ** buffer_out) const1589 status_t Parcel::readBuffer(size_t buffer_size, size_t *buffer_handle,
1590 const void **buffer_out) const
1591 {
1592 status_t status = readNullableBuffer(buffer_size, buffer_handle, buffer_out);
1593 if (status == OK && *buffer_out == nullptr) {
1594 return UNEXPECTED_NULL;
1595 }
1596 return status;
1597 }
1598
1599
readEmbeddedBuffer(size_t buffer_size,size_t * buffer_handle,size_t parent_buffer_handle,size_t parent_offset,const void ** buffer_out) const1600 status_t Parcel::readEmbeddedBuffer(size_t buffer_size,
1601 size_t *buffer_handle,
1602 size_t parent_buffer_handle,
1603 size_t parent_offset,
1604 const void **buffer_out) const
1605 {
1606 status_t status = readNullableEmbeddedBuffer(buffer_size, buffer_handle,
1607 parent_buffer_handle,
1608 parent_offset, buffer_out);
1609 if (status == OK && *buffer_out == nullptr) {
1610 return UNEXPECTED_NULL;
1611 }
1612 return status;
1613 }
1614
readNullableEmbeddedBuffer(size_t buffer_size,size_t * buffer_handle,size_t parent_buffer_handle,size_t parent_offset,const void ** buffer_out) const1615 status_t Parcel::readNullableEmbeddedBuffer(size_t buffer_size,
1616 size_t *buffer_handle,
1617 size_t parent_buffer_handle,
1618 size_t parent_offset,
1619 const void **buffer_out) const
1620 {
1621 return readBuffer(buffer_size, buffer_handle, BINDER_BUFFER_FLAG_HAS_PARENT,
1622 parent_buffer_handle, parent_offset, buffer_out);
1623 }
1624
1625 // isRef if corresponds to a writeReference call, else corresponds to a writeBuffer call.
1626 // see ::android::hardware::writeReferenceToParcel for details.
readReference(void const ** bufptr,size_t * buffer_handle,bool * isRef) const1627 status_t Parcel::readReference(void const* *bufptr,
1628 size_t *buffer_handle, bool *isRef) const
1629 {
1630 LOG_BUFFER("readReference");
1631 const binder_buffer_object* buffer_obj = readObject<binder_buffer_object>();
1632 LOG_BUFFER(" readReference: buf = %p, len = %zu, flags = %x",
1633 (void*)buffer_obj->buffer, (size_t)buffer_obj->length,
1634 (int)buffer_obj->flags);
1635 // TODO need verification here
1636 if (buffer_obj && buffer_obj->hdr.type == BINDER_TYPE_PTR) {
1637 if (buffer_handle != nullptr) {
1638 *buffer_handle = 0; // TODO fix this, as readBuffer would do
1639 }
1640 if(isRef != nullptr) {
1641 *isRef = (buffer_obj->flags & BINDER_BUFFER_FLAG_REF) != 0;
1642 LOG_BUFFER(" readReference: isRef = %d", *isRef);
1643 }
1644 // in read side, always use .buffer and .length.
1645 if(bufptr != nullptr) {
1646 *bufptr = (void*)buffer_obj->buffer;
1647 }
1648 return OK;
1649 }
1650
1651 return BAD_VALUE;
1652 }
1653
1654 // isRef if corresponds to a writeEmbeddedReference call, else corresponds to a writeEmbeddedBuffer call.
1655 // see ::android::hardware::writeEmbeddedReferenceToParcel for details.
readEmbeddedReference(void const ** bufptr,size_t * buffer_handle,size_t,size_t,bool * isRef) const1656 status_t Parcel::readEmbeddedReference(void const* *bufptr,
1657 size_t *buffer_handle,
1658 size_t /* parent_buffer_handle */,
1659 size_t /* parent_offset */,
1660 bool *isRef) const
1661 {
1662 // TODO verify parent and offset
1663 LOG_BUFFER("readEmbeddedReference");
1664 return (readReference(bufptr, buffer_handle, isRef));
1665 }
1666
readEmbeddedNativeHandle(size_t parent_buffer_handle,size_t parent_offset,const native_handle_t ** handle) const1667 status_t Parcel::readEmbeddedNativeHandle(size_t parent_buffer_handle,
1668 size_t parent_offset,
1669 const native_handle_t **handle) const
1670 {
1671 status_t status = readNullableEmbeddedNativeHandle(parent_buffer_handle, parent_offset, handle);
1672 if (status == OK && *handle == nullptr) {
1673 return UNEXPECTED_NULL;
1674 }
1675 return status;
1676 }
1677
readNullableNativeHandleNoDup(const native_handle_t ** handle,bool embedded,size_t parent_buffer_handle,size_t parent_offset) const1678 status_t Parcel::readNullableNativeHandleNoDup(const native_handle_t **handle,
1679 bool embedded,
1680 size_t parent_buffer_handle,
1681 size_t parent_offset) const
1682 {
1683 status_t status;
1684 uint64_t nativeHandleSize;
1685 size_t fdaParent;
1686
1687 status = readUint64(&nativeHandleSize);
1688 if (status != OK || nativeHandleSize == 0) {
1689 *handle = nullptr;
1690 return status;
1691 }
1692
1693 if (nativeHandleSize < sizeof(native_handle_t)) {
1694 ALOGE("Received a native_handle_t size that was too small.");
1695 return BAD_VALUE;
1696 }
1697
1698 if (embedded) {
1699 status = readNullableEmbeddedBuffer(nativeHandleSize, &fdaParent,
1700 parent_buffer_handle, parent_offset,
1701 reinterpret_cast<const void**>(handle));
1702 } else {
1703 status = readNullableBuffer(nativeHandleSize, &fdaParent,
1704 reinterpret_cast<const void**>(handle));
1705 }
1706
1707 if (status != OK) {
1708 return status;
1709 }
1710
1711 const binder_fd_array_object* fd_array_obj = readObject<binder_fd_array_object>();
1712
1713 if (fd_array_obj == nullptr || fd_array_obj->hdr.type != BINDER_TYPE_FDA) {
1714 ALOGE("Can't find file-descriptor array object.");
1715 return BAD_VALUE;
1716 }
1717
1718 if (static_cast<int>(fd_array_obj->num_fds) != (*handle)->numFds) {
1719 ALOGE("Number of native handles does not match.");
1720 return BAD_VALUE;
1721 }
1722
1723 if (fd_array_obj->parent != fdaParent) {
1724 ALOGE("Parent handle of file-descriptor array not correct.");
1725 return BAD_VALUE;
1726 }
1727
1728 if (fd_array_obj->parent_offset != offsetof(native_handle_t, data)) {
1729 ALOGE("FD array object not properly offset in parent.");
1730 return BAD_VALUE;
1731 }
1732
1733 return OK;
1734 }
1735
readNullableEmbeddedNativeHandle(size_t parent_buffer_handle,size_t parent_offset,const native_handle_t ** handle) const1736 status_t Parcel::readNullableEmbeddedNativeHandle(size_t parent_buffer_handle,
1737 size_t parent_offset,
1738 const native_handle_t **handle) const
1739 {
1740 return readNullableNativeHandleNoDup(handle, true /* embedded */, parent_buffer_handle,
1741 parent_offset);
1742 }
1743
readNativeHandleNoDup(const native_handle_t ** handle) const1744 status_t Parcel::readNativeHandleNoDup(const native_handle_t **handle) const
1745 {
1746 status_t status = readNullableNativeHandleNoDup(handle);
1747 if (status == OK && *handle == nullptr) {
1748 return UNEXPECTED_NULL;
1749 }
1750 return status;
1751 }
1752
readNullableNativeHandleNoDup(const native_handle_t ** handle) const1753 status_t Parcel::readNullableNativeHandleNoDup(const native_handle_t **handle) const
1754 {
1755 return readNullableNativeHandleNoDup(handle, false /* embedded */);
1756 }
1757
closeFileDescriptors()1758 void Parcel::closeFileDescriptors()
1759 {
1760 size_t i = mObjectsSize;
1761 if (i > 0) {
1762 //ALOGI("Closing file descriptors for %zu objects...", i);
1763 }
1764 while (i > 0) {
1765 i--;
1766 const flat_binder_object* flat
1767 = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
1768 if (flat->hdr.type == BINDER_TYPE_FD) {
1769 //ALOGI("Closing fd: %ld", flat->handle);
1770 close(flat->handle);
1771 }
1772 }
1773 }
1774
ipcData() const1775 uintptr_t Parcel::ipcData() const
1776 {
1777 return reinterpret_cast<uintptr_t>(mData);
1778 }
1779
ipcDataSize() const1780 size_t Parcel::ipcDataSize() const
1781 {
1782 return mDataSize > mDataPos ? mDataSize : mDataPos;
1783 }
1784
ipcObjects() const1785 uintptr_t Parcel::ipcObjects() const
1786 {
1787 return reinterpret_cast<uintptr_t>(mObjects);
1788 }
1789
ipcObjectsCount() const1790 size_t Parcel::ipcObjectsCount() const
1791 {
1792 return mObjectsSize;
1793 }
1794
1795 #define BUFFER_ALIGNMENT_BYTES 8
ipcBufferSize() const1796 size_t Parcel::ipcBufferSize() const
1797 {
1798 size_t totalBuffersSize = 0;
1799 // Add size for BINDER_TYPE_PTR
1800 size_t i = mObjectsSize;
1801 while (i > 0) {
1802 i--;
1803 const binder_buffer_object* buffer
1804 = reinterpret_cast<binder_buffer_object*>(mData+mObjects[i]);
1805 if (isBuffer(*buffer)) {
1806 /* The binder kernel driver requires each buffer to be 8-byte
1807 * aligned */
1808 size_t alignedSize = (buffer->length + (BUFFER_ALIGNMENT_BYTES - 1))
1809 & ~(BUFFER_ALIGNMENT_BYTES - 1);
1810 if (alignedSize > SIZE_MAX - totalBuffersSize) {
1811 ALOGE("ipcBuffersSize(): invalid buffer sizes.");
1812 return 0;
1813 }
1814 totalBuffersSize += alignedSize;
1815 }
1816 }
1817 return totalBuffersSize;
1818 }
1819
ipcSetDataReference(const uint8_t * data,size_t dataSize,const binder_size_t * objects,size_t objectsCount,release_func relFunc,void * relCookie)1820 void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,
1821 const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)
1822 {
1823 binder_size_t minOffset = 0;
1824 freeDataNoInit();
1825 mError = NO_ERROR;
1826 mData = const_cast<uint8_t*>(data);
1827 mDataSize = mDataCapacity = dataSize;
1828 //ALOGI("setDataReference Setting data size of %p to %lu (pid=%d)", this, mDataSize, getpid());
1829 mDataPos = 0;
1830 ALOGV("setDataReference Setting data pos of %p to %zu", this, mDataPos);
1831 mObjects = const_cast<binder_size_t*>(objects);
1832 mObjectsSize = mObjectsCapacity = objectsCount;
1833 mNextObjectHint = 0;
1834 clearCache();
1835 mNumRef = 0;
1836 mOwner = relFunc;
1837 mOwnerCookie = relCookie;
1838 for (size_t i = 0; i < mObjectsSize; i++) {
1839 binder_size_t offset = mObjects[i];
1840 if (offset < minOffset) {
1841 ALOGE("%s: bad object offset %" PRIu64 " < %" PRIu64 "\n",
1842 __func__, (uint64_t)offset, (uint64_t)minOffset);
1843 mObjectsSize = 0;
1844 break;
1845 }
1846 minOffset = offset + sizeof(flat_binder_object);
1847 }
1848 scanForFds();
1849 }
1850
print(TextOutput & to,uint32_t) const1851 void Parcel::print(TextOutput& to, uint32_t /*flags*/) const
1852 {
1853 to << "Parcel(";
1854
1855 if (errorCheck() != NO_ERROR) {
1856 const status_t err = errorCheck();
1857 to << "Error: " << (void*)(intptr_t)err << " \"" << strerror(-err) << "\"";
1858 } else if (dataSize() > 0) {
1859 const uint8_t* DATA = data();
1860 to << indent << HexDump(DATA, dataSize()) << dedent;
1861 const binder_size_t* OBJS = objects();
1862 const size_t N = objectsCount();
1863 for (size_t i=0; i<N; i++) {
1864 const flat_binder_object* flat
1865 = reinterpret_cast<const flat_binder_object*>(DATA+OBJS[i]);
1866 if (flat->hdr.type == BINDER_TYPE_PTR) {
1867 const binder_buffer_object* buffer
1868 = reinterpret_cast<const binder_buffer_object*>(DATA+OBJS[i]);
1869 if(isBuffer(*buffer)) {
1870 HexDump bufferDump((const uint8_t*)buffer->buffer, (size_t)buffer->length);
1871 bufferDump.setSingleLineCutoff(0);
1872 to << endl << "Object #" << i << " @ " << (void*)OBJS[i] << " (buffer size " << buffer->length << "):";
1873 to << indent << bufferDump << dedent;
1874 } else {
1875 to << endl << "Object #" << i << " @ " << (void*)OBJS[i];
1876 }
1877 } else {
1878 to << endl << "Object #" << i << " @ " << (void*)OBJS[i] << ": "
1879 << TypeCode(flat->hdr.type & 0x7f7f7f00)
1880 << " = " << flat->binder;
1881 }
1882 }
1883 } else {
1884 to << "NULL";
1885 }
1886
1887 to << ")";
1888 }
1889
releaseObjects()1890 void Parcel::releaseObjects()
1891 {
1892 const sp<ProcessState> proc(ProcessState::self());
1893 size_t i = mObjectsSize;
1894 uint8_t* const data = mData;
1895 binder_size_t* const objects = mObjects;
1896 while (i > 0) {
1897 i--;
1898 const flat_binder_object* flat
1899 = reinterpret_cast<flat_binder_object*>(data+objects[i]);
1900 release_object(proc, *flat, this);
1901 }
1902 }
1903
acquireObjects()1904 void Parcel::acquireObjects()
1905 {
1906 const sp<ProcessState> proc(ProcessState::self());
1907 size_t i = mObjectsSize;
1908 uint8_t* const data = mData;
1909 binder_size_t* const objects = mObjects;
1910 while (i > 0) {
1911 i--;
1912 const binder_object_header* flat
1913 = reinterpret_cast<binder_object_header*>(data+objects[i]);
1914 acquire_object(proc, *flat, this);
1915 }
1916 }
1917
freeData()1918 void Parcel::freeData()
1919 {
1920 freeDataNoInit();
1921 initState();
1922 }
1923
freeDataNoInit()1924 void Parcel::freeDataNoInit()
1925 {
1926 if (mOwner) {
1927 LOG_ALLOC("Parcel %p: freeing other owner data", this);
1928 //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
1929 mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
1930 } else {
1931 LOG_ALLOC("Parcel %p: freeing allocated data", this);
1932 releaseObjects();
1933 if (mData) {
1934 LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);
1935 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
1936 if (mDataCapacity <= gParcelGlobalAllocSize) {
1937 gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;
1938 } else {
1939 gParcelGlobalAllocSize = 0;
1940 }
1941 if (gParcelGlobalAllocCount > 0) {
1942 gParcelGlobalAllocCount--;
1943 }
1944 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
1945 free(mData);
1946 }
1947 if (mObjects) free(mObjects);
1948 }
1949 }
1950
growData(size_t len)1951 status_t Parcel::growData(size_t len)
1952 {
1953 if (len > INT32_MAX) {
1954 // don't accept size_t values which may have come from an
1955 // inadvertent conversion from a negative int.
1956 return BAD_VALUE;
1957 }
1958
1959 size_t newSize = ((mDataSize+len)*3)/2;
1960 return (newSize <= mDataSize)
1961 ? (status_t) NO_MEMORY
1962 : continueWrite(newSize);
1963 }
1964
restartWrite(size_t desired)1965 status_t Parcel::restartWrite(size_t desired)
1966 {
1967 if (desired > INT32_MAX) {
1968 // don't accept size_t values which may have come from an
1969 // inadvertent conversion from a negative int.
1970 return BAD_VALUE;
1971 }
1972
1973 if (mOwner) {
1974 freeData();
1975 return continueWrite(desired);
1976 }
1977
1978 uint8_t* data = (uint8_t*)realloc(mData, desired);
1979 if (!data && desired > mDataCapacity) {
1980 mError = NO_MEMORY;
1981 return NO_MEMORY;
1982 }
1983
1984 releaseObjects();
1985
1986 if (data) {
1987 LOG_ALLOC("Parcel %p: restart from %zu to %zu capacity", this, mDataCapacity, desired);
1988 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
1989 gParcelGlobalAllocSize += desired;
1990 gParcelGlobalAllocSize -= mDataCapacity;
1991 if (!mData) {
1992 gParcelGlobalAllocCount++;
1993 }
1994 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
1995 mData = data;
1996 mDataCapacity = desired;
1997 }
1998
1999 mDataSize = mDataPos = 0;
2000 ALOGV("restartWrite Setting data size of %p to %zu", this, mDataSize);
2001 ALOGV("restartWrite Setting data pos of %p to %zu", this, mDataPos);
2002
2003 free(mObjects);
2004 mObjects = NULL;
2005 mObjectsSize = mObjectsCapacity = 0;
2006 mNextObjectHint = 0;
2007 mHasFds = false;
2008 clearCache();
2009 mNumRef = 0;
2010 mFdsKnown = true;
2011 mAllowFds = true;
2012
2013 return NO_ERROR;
2014 }
2015
continueWrite(size_t desired)2016 status_t Parcel::continueWrite(size_t desired)
2017 {
2018 if (desired > INT32_MAX) {
2019 // don't accept size_t values which may have come from an
2020 // inadvertent conversion from a negative int.
2021 return BAD_VALUE;
2022 }
2023
2024 // If shrinking, first adjust for any objects that appear
2025 // after the new data size.
2026 size_t objectsSize = mObjectsSize;
2027 if (desired < mDataSize) {
2028 if (desired == 0) {
2029 objectsSize = 0;
2030 } else {
2031 while (objectsSize > 0) {
2032 if (mObjects[objectsSize-1] < desired)
2033 break;
2034 objectsSize--;
2035 }
2036 }
2037 }
2038
2039 if (mOwner) {
2040 // If the size is going to zero, just release the owner's data.
2041 if (desired == 0) {
2042 freeData();
2043 return NO_ERROR;
2044 }
2045
2046 // If there is a different owner, we need to take
2047 // posession.
2048 uint8_t* data = (uint8_t*)malloc(desired);
2049 if (!data) {
2050 mError = NO_MEMORY;
2051 return NO_MEMORY;
2052 }
2053 binder_size_t* objects = NULL;
2054
2055 if (objectsSize) {
2056 objects = (binder_size_t*)calloc(objectsSize, sizeof(binder_size_t));
2057 if (!objects) {
2058 free(data);
2059
2060 mError = NO_MEMORY;
2061 return NO_MEMORY;
2062 }
2063
2064 // Little hack to only acquire references on objects
2065 // we will be keeping.
2066 size_t oldObjectsSize = mObjectsSize;
2067 mObjectsSize = objectsSize;
2068 acquireObjects();
2069 mObjectsSize = oldObjectsSize;
2070 }
2071
2072 if (mData) {
2073 memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
2074 }
2075 if (objects && mObjects) {
2076 memcpy(objects, mObjects, objectsSize*sizeof(binder_size_t));
2077 }
2078 //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
2079 mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
2080 mOwner = NULL;
2081
2082 LOG_ALLOC("Parcel %p: taking ownership of %zu capacity", this, desired);
2083 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2084 gParcelGlobalAllocSize += desired;
2085 gParcelGlobalAllocCount++;
2086 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2087
2088 mData = data;
2089 mObjects = objects;
2090 mDataSize = (mDataSize < desired) ? mDataSize : desired;
2091 ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2092 mDataCapacity = desired;
2093 mObjectsSize = mObjectsCapacity = objectsSize;
2094 mNextObjectHint = 0;
2095
2096 clearCache();
2097 } else if (mData) {
2098 if (objectsSize < mObjectsSize) {
2099 // Need to release refs on any objects we are dropping.
2100 const sp<ProcessState> proc(ProcessState::self());
2101 for (size_t i=objectsSize; i<mObjectsSize; i++) {
2102 const flat_binder_object* flat
2103 = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
2104 if (flat->hdr.type == BINDER_TYPE_FD) {
2105 // will need to rescan because we may have lopped off the only FDs
2106 mFdsKnown = false;
2107 }
2108 release_object(proc, *flat, this);
2109 }
2110 binder_size_t* objects =
2111 (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));
2112 if (objects) {
2113 mObjects = objects;
2114 }
2115 mObjectsSize = objectsSize;
2116 mNextObjectHint = 0;
2117
2118 clearCache();
2119 }
2120
2121 // We own the data, so we can just do a realloc().
2122 if (desired > mDataCapacity) {
2123 uint8_t* data = (uint8_t*)realloc(mData, desired);
2124 if (data) {
2125 LOG_ALLOC("Parcel %p: continue from %zu to %zu capacity", this, mDataCapacity,
2126 desired);
2127 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2128 gParcelGlobalAllocSize += desired;
2129 gParcelGlobalAllocSize -= mDataCapacity;
2130 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2131 mData = data;
2132 mDataCapacity = desired;
2133 } else {
2134 mError = NO_MEMORY;
2135 return NO_MEMORY;
2136 }
2137 } else {
2138 if (mDataSize > desired) {
2139 mDataSize = desired;
2140 ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2141 }
2142 if (mDataPos > desired) {
2143 mDataPos = desired;
2144 ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
2145 }
2146 }
2147
2148 } else {
2149 // This is the first data. Easy!
2150 uint8_t* data = (uint8_t*)malloc(desired);
2151 if (!data) {
2152 mError = NO_MEMORY;
2153 return NO_MEMORY;
2154 }
2155
2156 if(!(mDataCapacity == 0 && mObjects == NULL
2157 && mObjectsCapacity == 0)) {
2158 ALOGE("continueWrite: %zu/%p/%zu/%zu", mDataCapacity, mObjects, mObjectsCapacity, desired);
2159 }
2160
2161 LOG_ALLOC("Parcel %p: allocating with %zu capacity", this, desired);
2162 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
2163 gParcelGlobalAllocSize += desired;
2164 gParcelGlobalAllocCount++;
2165 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
2166
2167 mData = data;
2168 mDataSize = mDataPos = 0;
2169 ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
2170 ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
2171 mDataCapacity = desired;
2172 }
2173
2174 return NO_ERROR;
2175 }
2176
initState()2177 void Parcel::initState()
2178 {
2179 LOG_ALLOC("Parcel %p: initState", this);
2180 mError = NO_ERROR;
2181 mData = 0;
2182 mDataSize = 0;
2183 mDataCapacity = 0;
2184 mDataPos = 0;
2185 ALOGV("initState Setting data size of %p to %zu", this, mDataSize);
2186 ALOGV("initState Setting data pos of %p to %zu", this, mDataPos);
2187 mObjects = NULL;
2188 mObjectsSize = 0;
2189 mObjectsCapacity = 0;
2190 mNextObjectHint = 0;
2191 mHasFds = false;
2192 mFdsKnown = true;
2193 mAllowFds = true;
2194 mOwner = NULL;
2195 clearCache();
2196 mNumRef = 0;
2197
2198 // racing multiple init leads only to multiple identical write
2199 if (gMaxFds == 0) {
2200 struct rlimit result;
2201 if (!getrlimit(RLIMIT_NOFILE, &result)) {
2202 gMaxFds = (size_t)result.rlim_cur;
2203 //ALOGI("parcel fd limit set to %zu", gMaxFds);
2204 } else {
2205 ALOGW("Unable to getrlimit: %s", strerror(errno));
2206 gMaxFds = 1024;
2207 }
2208 }
2209 }
2210
scanForFds() const2211 void Parcel::scanForFds() const
2212 {
2213 bool hasFds = false;
2214 for (size_t i=0; i<mObjectsSize; i++) {
2215 const flat_binder_object* flat
2216 = reinterpret_cast<const flat_binder_object*>(mData + mObjects[i]);
2217 if (flat->hdr.type == BINDER_TYPE_FD) {
2218 hasFds = true;
2219 break;
2220 }
2221 }
2222 mHasFds = hasFds;
2223 mFdsKnown = true;
2224 }
2225
2226 }; // namespace hardware
2227 }; // namespace android
2228