Home | History | Annotate | Download | only in binder
      1 /*
      2  * Copyright (C) 2005 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #define LOG_TAG "Parcel"
     18 //#define LOG_NDEBUG 0
     19 
     20 #include <binder/Parcel.h>
     21 
     22 #include <binder/IPCThreadState.h>
     23 #include <binder/Binder.h>
     24 #include <binder/BpBinder.h>
     25 #include <utils/Debug.h>
     26 #include <binder/ProcessState.h>
     27 #include <utils/Log.h>
     28 #include <utils/String8.h>
     29 #include <utils/String16.h>
     30 #include <utils/TextOutput.h>
     31 #include <utils/misc.h>
     32 #include <utils/Flattenable.h>
     33 #include <cutils/ashmem.h>
     34 
     35 #include <private/binder/binder_module.h>
     36 
     37 #include <stdio.h>
     38 #include <stdlib.h>
     39 #include <stdint.h>
     40 #include <sys/mman.h>
     41 
     42 #ifndef INT32_MAX
     43 #define INT32_MAX ((int32_t)(2147483647))
     44 #endif
     45 
     46 #define LOG_REFS(...)
     47 //#define LOG_REFS(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
     48 
     49 // ---------------------------------------------------------------------------
     50 
     51 #define PAD_SIZE(s) (((s)+3)&~3)
     52 
     53 // Note: must be kept in sync with android/os/StrictMode.java's PENALTY_GATHER
     54 #define STRICT_MODE_PENALTY_GATHER 0x100
     55 
     56 // Note: must be kept in sync with android/os/Parcel.java's EX_HAS_REPLY_HEADER
     57 #define EX_HAS_REPLY_HEADER -128
     58 
     59 // Maximum size of a blob to transfer in-place.
     60 static const size_t IN_PLACE_BLOB_LIMIT = 40 * 1024;
     61 
     62 // XXX This can be made public if we want to provide
     63 // support for typed data.
     64 struct small_flat_data
     65 {
     66     uint32_t type;
     67     uint32_t data;
     68 };
     69 
     70 namespace android {
     71 
     72 void acquire_object(const sp<ProcessState>& proc,
     73     const flat_binder_object& obj, const void* who)
     74 {
     75     switch (obj.type) {
     76         case BINDER_TYPE_BINDER:
     77             if (obj.binder) {
     78                 LOG_REFS("Parcel %p acquiring reference on local %p", who, obj.cookie);
     79                 static_cast<IBinder*>(obj.cookie)->incStrong(who);
     80             }
     81             return;
     82         case BINDER_TYPE_WEAK_BINDER:
     83             if (obj.binder)
     84                 static_cast<RefBase::weakref_type*>(obj.binder)->incWeak(who);
     85             return;
     86         case BINDER_TYPE_HANDLE: {
     87             const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
     88             if (b != NULL) {
     89                 LOG_REFS("Parcel %p acquiring reference on remote %p", who, b.get());
     90                 b->incStrong(who);
     91             }
     92             return;
     93         }
     94         case BINDER_TYPE_WEAK_HANDLE: {
     95             const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
     96             if (b != NULL) b.get_refs()->incWeak(who);
     97             return;
     98         }
     99         case BINDER_TYPE_FD: {
    100             // intentionally blank -- nothing to do to acquire this, but we do
    101             // recognize it as a legitimate object type.
    102             return;
    103         }
    104     }
    105 
    106     ALOGD("Invalid object type 0x%08lx", obj.type);
    107 }
    108 
    109 void release_object(const sp<ProcessState>& proc,
    110     const flat_binder_object& obj, const void* who)
    111 {
    112     switch (obj.type) {
    113         case BINDER_TYPE_BINDER:
    114             if (obj.binder) {
    115                 LOG_REFS("Parcel %p releasing reference on local %p", who, obj.cookie);
    116                 static_cast<IBinder*>(obj.cookie)->decStrong(who);
    117             }
    118             return;
    119         case BINDER_TYPE_WEAK_BINDER:
    120             if (obj.binder)
    121                 static_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who);
    122             return;
    123         case BINDER_TYPE_HANDLE: {
    124             const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
    125             if (b != NULL) {
    126                 LOG_REFS("Parcel %p releasing reference on remote %p", who, b.get());
    127                 b->decStrong(who);
    128             }
    129             return;
    130         }
    131         case BINDER_TYPE_WEAK_HANDLE: {
    132             const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
    133             if (b != NULL) b.get_refs()->decWeak(who);
    134             return;
    135         }
    136         case BINDER_TYPE_FD: {
    137             if (obj.cookie != (void*)0) close(obj.handle);
    138             return;
    139         }
    140     }
    141 
    142     ALOGE("Invalid object type 0x%08lx", obj.type);
    143 }
    144 
    145 inline static status_t finish_flatten_binder(
    146     const sp<IBinder>& binder, const flat_binder_object& flat, Parcel* out)
    147 {
    148     return out->writeObject(flat, false);
    149 }
    150 
    151 status_t flatten_binder(const sp<ProcessState>& proc,
    152     const sp<IBinder>& binder, Parcel* out)
    153 {
    154     flat_binder_object obj;
    155 
    156     obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
    157     if (binder != NULL) {
    158         IBinder *local = binder->localBinder();
    159         if (!local) {
    160             BpBinder *proxy = binder->remoteBinder();
    161             if (proxy == NULL) {
    162                 ALOGE("null proxy");
    163             }
    164             const int32_t handle = proxy ? proxy->handle() : 0;
    165             obj.type = BINDER_TYPE_HANDLE;
    166             obj.handle = handle;
    167             obj.cookie = NULL;
    168         } else {
    169             obj.type = BINDER_TYPE_BINDER;
    170             obj.binder = local->getWeakRefs();
    171             obj.cookie = local;
    172         }
    173     } else {
    174         obj.type = BINDER_TYPE_BINDER;
    175         obj.binder = NULL;
    176         obj.cookie = NULL;
    177     }
    178 
    179     return finish_flatten_binder(binder, obj, out);
    180 }
    181 
    182 status_t flatten_binder(const sp<ProcessState>& proc,
    183     const wp<IBinder>& binder, Parcel* out)
    184 {
    185     flat_binder_object obj;
    186 
    187     obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
    188     if (binder != NULL) {
    189         sp<IBinder> real = binder.promote();
    190         if (real != NULL) {
    191             IBinder *local = real->localBinder();
    192             if (!local) {
    193                 BpBinder *proxy = real->remoteBinder();
    194                 if (proxy == NULL) {
    195                     ALOGE("null proxy");
    196                 }
    197                 const int32_t handle = proxy ? proxy->handle() : 0;
    198                 obj.type = BINDER_TYPE_WEAK_HANDLE;
    199                 obj.handle = handle;
    200                 obj.cookie = NULL;
    201             } else {
    202                 obj.type = BINDER_TYPE_WEAK_BINDER;
    203                 obj.binder = binder.get_refs();
    204                 obj.cookie = binder.unsafe_get();
    205             }
    206             return finish_flatten_binder(real, obj, out);
    207         }
    208 
    209         // XXX How to deal?  In order to flatten the given binder,
    210         // we need to probe it for information, which requires a primary
    211         // reference...  but we don't have one.
    212         //
    213         // The OpenBinder implementation uses a dynamic_cast<> here,
    214         // but we can't do that with the different reference counting
    215         // implementation we are using.
    216         ALOGE("Unable to unflatten Binder weak reference!");
    217         obj.type = BINDER_TYPE_BINDER;
    218         obj.binder = NULL;
    219         obj.cookie = NULL;
    220         return finish_flatten_binder(NULL, obj, out);
    221 
    222     } else {
    223         obj.type = BINDER_TYPE_BINDER;
    224         obj.binder = NULL;
    225         obj.cookie = NULL;
    226         return finish_flatten_binder(NULL, obj, out);
    227     }
    228 }
    229 
    230 inline static status_t finish_unflatten_binder(
    231     BpBinder* proxy, const flat_binder_object& flat, const Parcel& in)
    232 {
    233     return NO_ERROR;
    234 }
    235 
    236 status_t unflatten_binder(const sp<ProcessState>& proc,
    237     const Parcel& in, sp<IBinder>* out)
    238 {
    239     const flat_binder_object* flat = in.readObject(false);
    240 
    241     if (flat) {
    242         switch (flat->type) {
    243             case BINDER_TYPE_BINDER:
    244                 *out = static_cast<IBinder*>(flat->cookie);
    245                 return finish_unflatten_binder(NULL, *flat, in);
    246             case BINDER_TYPE_HANDLE:
    247                 *out = proc->getStrongProxyForHandle(flat->handle);
    248                 return finish_unflatten_binder(
    249                     static_cast<BpBinder*>(out->get()), *flat, in);
    250         }
    251     }
    252     return BAD_TYPE;
    253 }
    254 
    255 status_t unflatten_binder(const sp<ProcessState>& proc,
    256     const Parcel& in, wp<IBinder>* out)
    257 {
    258     const flat_binder_object* flat = in.readObject(false);
    259 
    260     if (flat) {
    261         switch (flat->type) {
    262             case BINDER_TYPE_BINDER:
    263                 *out = static_cast<IBinder*>(flat->cookie);
    264                 return finish_unflatten_binder(NULL, *flat, in);
    265             case BINDER_TYPE_WEAK_BINDER:
    266                 if (flat->binder != NULL) {
    267                     out->set_object_and_refs(
    268                         static_cast<IBinder*>(flat->cookie),
    269                         static_cast<RefBase::weakref_type*>(flat->binder));
    270                 } else {
    271                     *out = NULL;
    272                 }
    273                 return finish_unflatten_binder(NULL, *flat, in);
    274             case BINDER_TYPE_HANDLE:
    275             case BINDER_TYPE_WEAK_HANDLE:
    276                 *out = proc->getWeakProxyForHandle(flat->handle);
    277                 return finish_unflatten_binder(
    278                     static_cast<BpBinder*>(out->unsafe_get()), *flat, in);
    279         }
    280     }
    281     return BAD_TYPE;
    282 }
    283 
    284 // ---------------------------------------------------------------------------
    285 
    286 Parcel::Parcel()
    287 {
    288     initState();
    289 }
    290 
    291 Parcel::~Parcel()
    292 {
    293     freeDataNoInit();
    294 }
    295 
    296 const uint8_t* Parcel::data() const
    297 {
    298     return mData;
    299 }
    300 
    301 size_t Parcel::dataSize() const
    302 {
    303     return (mDataSize > mDataPos ? mDataSize : mDataPos);
    304 }
    305 
    306 size_t Parcel::dataAvail() const
    307 {
    308     // TODO: decide what to do about the possibility that this can
    309     // report an available-data size that exceeds a Java int's max
    310     // positive value, causing havoc.  Fortunately this will only
    311     // happen if someone constructs a Parcel containing more than two
    312     // gigabytes of data, which on typical phone hardware is simply
    313     // not possible.
    314     return dataSize() - dataPosition();
    315 }
    316 
    317 size_t Parcel::dataPosition() const
    318 {
    319     return mDataPos;
    320 }
    321 
    322 size_t Parcel::dataCapacity() const
    323 {
    324     return mDataCapacity;
    325 }
    326 
    327 status_t Parcel::setDataSize(size_t size)
    328 {
    329     status_t err;
    330     err = continueWrite(size);
    331     if (err == NO_ERROR) {
    332         mDataSize = size;
    333         ALOGV("setDataSize Setting data size of %p to %d\n", this, mDataSize);
    334     }
    335     return err;
    336 }
    337 
    338 void Parcel::setDataPosition(size_t pos) const
    339 {
    340     mDataPos = pos;
    341     mNextObjectHint = 0;
    342 }
    343 
    344 status_t Parcel::setDataCapacity(size_t size)
    345 {
    346     if (size > mDataCapacity) return continueWrite(size);
    347     return NO_ERROR;
    348 }
    349 
    350 status_t Parcel::setData(const uint8_t* buffer, size_t len)
    351 {
    352     status_t err = restartWrite(len);
    353     if (err == NO_ERROR) {
    354         memcpy(const_cast<uint8_t*>(data()), buffer, len);
    355         mDataSize = len;
    356         mFdsKnown = false;
    357     }
    358     return err;
    359 }
    360 
    361 status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
    362 {
    363     const sp<ProcessState> proc(ProcessState::self());
    364     status_t err;
    365     const uint8_t *data = parcel->mData;
    366     const size_t *objects = parcel->mObjects;
    367     size_t size = parcel->mObjectsSize;
    368     int startPos = mDataPos;
    369     int firstIndex = -1, lastIndex = -2;
    370 
    371     if (len == 0) {
    372         return NO_ERROR;
    373     }
    374 
    375     // range checks against the source parcel size
    376     if ((offset > parcel->mDataSize)
    377             || (len > parcel->mDataSize)
    378             || (offset + len > parcel->mDataSize)) {
    379         return BAD_VALUE;
    380     }
    381 
    382     // Count objects in range
    383     for (int i = 0; i < (int) size; i++) {
    384         size_t off = objects[i];
    385         if ((off >= offset) && (off < offset + len)) {
    386             if (firstIndex == -1) {
    387                 firstIndex = i;
    388             }
    389             lastIndex = i;
    390         }
    391     }
    392     int numObjects = lastIndex - firstIndex + 1;
    393 
    394     if ((mDataSize+len) > mDataCapacity) {
    395         // grow data
    396         err = growData(len);
    397         if (err != NO_ERROR) {
    398             return err;
    399         }
    400     }
    401 
    402     // append data
    403     memcpy(mData + mDataPos, data + offset, len);
    404     mDataPos += len;
    405     mDataSize += len;
    406 
    407     err = NO_ERROR;
    408 
    409     if (numObjects > 0) {
    410         // grow objects
    411         if (mObjectsCapacity < mObjectsSize + numObjects) {
    412             int newSize = ((mObjectsSize + numObjects)*3)/2;
    413             size_t *objects =
    414                 (size_t*)realloc(mObjects, newSize*sizeof(size_t));
    415             if (objects == (size_t*)0) {
    416                 return NO_MEMORY;
    417             }
    418             mObjects = objects;
    419             mObjectsCapacity = newSize;
    420         }
    421 
    422         // append and acquire objects
    423         int idx = mObjectsSize;
    424         for (int i = firstIndex; i <= lastIndex; i++) {
    425             size_t off = objects[i] - offset + startPos;
    426             mObjects[idx++] = off;
    427             mObjectsSize++;
    428 
    429             flat_binder_object* flat
    430                 = reinterpret_cast<flat_binder_object*>(mData + off);
    431             acquire_object(proc, *flat, this);
    432 
    433             if (flat->type == BINDER_TYPE_FD) {
    434                 // If this is a file descriptor, we need to dup it so the
    435                 // new Parcel now owns its own fd, and can declare that we
    436                 // officially know we have fds.
    437                 flat->handle = dup(flat->handle);
    438                 flat->cookie = (void*)1;
    439                 mHasFds = mFdsKnown = true;
    440                 if (!mAllowFds) {
    441                     err = FDS_NOT_ALLOWED;
    442                 }
    443             }
    444         }
    445     }
    446 
    447     return err;
    448 }
    449 
    450 bool Parcel::pushAllowFds(bool allowFds)
    451 {
    452     const bool origValue = mAllowFds;
    453     if (!allowFds) {
    454         mAllowFds = false;
    455     }
    456     return origValue;
    457 }
    458 
    459 void Parcel::restoreAllowFds(bool lastValue)
    460 {
    461     mAllowFds = lastValue;
    462 }
    463 
    464 bool Parcel::hasFileDescriptors() const
    465 {
    466     if (!mFdsKnown) {
    467         scanForFds();
    468     }
    469     return mHasFds;
    470 }
    471 
    472 // Write RPC headers.  (previously just the interface token)
    473 status_t Parcel::writeInterfaceToken(const String16& interface)
    474 {
    475     writeInt32(IPCThreadState::self()->getStrictModePolicy() |
    476                STRICT_MODE_PENALTY_GATHER);
    477     // currently the interface identification token is just its name as a string
    478     return writeString16(interface);
    479 }
    480 
    481 bool Parcel::checkInterface(IBinder* binder) const
    482 {
    483     return enforceInterface(binder->getInterfaceDescriptor());
    484 }
    485 
    486 bool Parcel::enforceInterface(const String16& interface,
    487                               IPCThreadState* threadState) const
    488 {
    489     int32_t strictPolicy = readInt32();
    490     if (threadState == NULL) {
    491         threadState = IPCThreadState::self();
    492     }
    493     if ((threadState->getLastTransactionBinderFlags() &
    494          IBinder::FLAG_ONEWAY) != 0) {
    495       // For one-way calls, the callee is running entirely
    496       // disconnected from the caller, so disable StrictMode entirely.
    497       // Not only does disk/network usage not impact the caller, but
    498       // there's no way to commuicate back any violations anyway.
    499       threadState->setStrictModePolicy(0);
    500     } else {
    501       threadState->setStrictModePolicy(strictPolicy);
    502     }
    503     const String16 str(readString16());
    504     if (str == interface) {
    505         return true;
    506     } else {
    507         ALOGW("**** enforceInterface() expected '%s' but read '%s'\n",
    508                 String8(interface).string(), String8(str).string());
    509         return false;
    510     }
    511 }
    512 
    513 const size_t* Parcel::objects() const
    514 {
    515     return mObjects;
    516 }
    517 
    518 size_t Parcel::objectsCount() const
    519 {
    520     return mObjectsSize;
    521 }
    522 
    523 status_t Parcel::errorCheck() const
    524 {
    525     return mError;
    526 }
    527 
    528 void Parcel::setError(status_t err)
    529 {
    530     mError = err;
    531 }
    532 
    533 status_t Parcel::finishWrite(size_t len)
    534 {
    535     //printf("Finish write of %d\n", len);
    536     mDataPos += len;
    537     ALOGV("finishWrite Setting data pos of %p to %d\n", this, mDataPos);
    538     if (mDataPos > mDataSize) {
    539         mDataSize = mDataPos;
    540         ALOGV("finishWrite Setting data size of %p to %d\n", this, mDataSize);
    541     }
    542     //printf("New pos=%d, size=%d\n", mDataPos, mDataSize);
    543     return NO_ERROR;
    544 }
    545 
    546 status_t Parcel::writeUnpadded(const void* data, size_t len)
    547 {
    548     size_t end = mDataPos + len;
    549     if (end < mDataPos) {
    550         // integer overflow
    551         return BAD_VALUE;
    552     }
    553 
    554     if (end <= mDataCapacity) {
    555 restart_write:
    556         memcpy(mData+mDataPos, data, len);
    557         return finishWrite(len);
    558     }
    559 
    560     status_t err = growData(len);
    561     if (err == NO_ERROR) goto restart_write;
    562     return err;
    563 }
    564 
    565 status_t Parcel::write(const void* data, size_t len)
    566 {
    567     void* const d = writeInplace(len);
    568     if (d) {
    569         memcpy(d, data, len);
    570         return NO_ERROR;
    571     }
    572     return mError;
    573 }
    574 
    575 void* Parcel::writeInplace(size_t len)
    576 {
    577     const size_t padded = PAD_SIZE(len);
    578 
    579     // sanity check for integer overflow
    580     if (mDataPos+padded < mDataPos) {
    581         return NULL;
    582     }
    583 
    584     if ((mDataPos+padded) <= mDataCapacity) {
    585 restart_write:
    586         //printf("Writing %ld bytes, padded to %ld\n", len, padded);
    587         uint8_t* const data = mData+mDataPos;
    588 
    589         // Need to pad at end?
    590         if (padded != len) {
    591 #if BYTE_ORDER == BIG_ENDIAN
    592             static const uint32_t mask[4] = {
    593                 0x00000000, 0xffffff00, 0xffff0000, 0xff000000
    594             };
    595 #endif
    596 #if BYTE_ORDER == LITTLE_ENDIAN
    597             static const uint32_t mask[4] = {
    598                 0x00000000, 0x00ffffff, 0x0000ffff, 0x000000ff
    599             };
    600 #endif
    601             //printf("Applying pad mask: %p to %p\n", (void*)mask[padded-len],
    602             //    *reinterpret_cast<void**>(data+padded-4));
    603             *reinterpret_cast<uint32_t*>(data+padded-4) &= mask[padded-len];
    604         }
    605 
    606         finishWrite(padded);
    607         return data;
    608     }
    609 
    610     status_t err = growData(padded);
    611     if (err == NO_ERROR) goto restart_write;
    612     return NULL;
    613 }
    614 
    615 status_t Parcel::writeInt32(int32_t val)
    616 {
    617     return writeAligned(val);
    618 }
    619 
    620 status_t Parcel::writeInt64(int64_t val)
    621 {
    622     return writeAligned(val);
    623 }
    624 
    625 status_t Parcel::writeFloat(float val)
    626 {
    627     return writeAligned(val);
    628 }
    629 
    630 status_t Parcel::writeDouble(double val)
    631 {
    632     return writeAligned(val);
    633 }
    634 
    635 status_t Parcel::writeIntPtr(intptr_t val)
    636 {
    637     return writeAligned(val);
    638 }
    639 
    640 status_t Parcel::writeCString(const char* str)
    641 {
    642     return write(str, strlen(str)+1);
    643 }
    644 
    645 status_t Parcel::writeString8(const String8& str)
    646 {
    647     status_t err = writeInt32(str.bytes());
    648     // only write string if its length is more than zero characters,
    649     // as readString8 will only read if the length field is non-zero.
    650     // this is slightly different from how writeString16 works.
    651     if (str.bytes() > 0 && err == NO_ERROR) {
    652         err = write(str.string(), str.bytes()+1);
    653     }
    654     return err;
    655 }
    656 
    657 status_t Parcel::writeString16(const String16& str)
    658 {
    659     return writeString16(str.string(), str.size());
    660 }
    661 
    662 status_t Parcel::writeString16(const char16_t* str, size_t len)
    663 {
    664     if (str == NULL) return writeInt32(-1);
    665 
    666     status_t err = writeInt32(len);
    667     if (err == NO_ERROR) {
    668         len *= sizeof(char16_t);
    669         uint8_t* data = (uint8_t*)writeInplace(len+sizeof(char16_t));
    670         if (data) {
    671             memcpy(data, str, len);
    672             *reinterpret_cast<char16_t*>(data+len) = 0;
    673             return NO_ERROR;
    674         }
    675         err = mError;
    676     }
    677     return err;
    678 }
    679 
    680 status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
    681 {
    682     return flatten_binder(ProcessState::self(), val, this);
    683 }
    684 
    685 status_t Parcel::writeWeakBinder(const wp<IBinder>& val)
    686 {
    687     return flatten_binder(ProcessState::self(), val, this);
    688 }
    689 
    690 status_t Parcel::writeNativeHandle(const native_handle* handle)
    691 {
    692     if (!handle || handle->version != sizeof(native_handle))
    693         return BAD_TYPE;
    694 
    695     status_t err;
    696     err = writeInt32(handle->numFds);
    697     if (err != NO_ERROR) return err;
    698 
    699     err = writeInt32(handle->numInts);
    700     if (err != NO_ERROR) return err;
    701 
    702     for (int i=0 ; err==NO_ERROR && i<handle->numFds ; i++)
    703         err = writeDupFileDescriptor(handle->data[i]);
    704 
    705     if (err != NO_ERROR) {
    706         ALOGD("write native handle, write dup fd failed");
    707         return err;
    708     }
    709     err = write(handle->data + handle->numFds, sizeof(int)*handle->numInts);
    710     return err;
    711 }
    712 
    713 status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership)
    714 {
    715     flat_binder_object obj;
    716     obj.type = BINDER_TYPE_FD;
    717     obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
    718     obj.handle = fd;
    719     obj.cookie = (void*) (takeOwnership ? 1 : 0);
    720     return writeObject(obj, true);
    721 }
    722 
    723 status_t Parcel::writeDupFileDescriptor(int fd)
    724 {
    725     int dupFd = dup(fd);
    726     if (dupFd < 0) {
    727         return -errno;
    728     }
    729     status_t err = writeFileDescriptor(dupFd, true /*takeOwnership*/);
    730     if (err) {
    731         close(dupFd);
    732     }
    733     return err;
    734 }
    735 
    736 status_t Parcel::writeBlob(size_t len, WritableBlob* outBlob)
    737 {
    738     status_t status;
    739 
    740     if (!mAllowFds || len <= IN_PLACE_BLOB_LIMIT) {
    741         ALOGV("writeBlob: write in place");
    742         status = writeInt32(0);
    743         if (status) return status;
    744 
    745         void* ptr = writeInplace(len);
    746         if (!ptr) return NO_MEMORY;
    747 
    748         outBlob->init(false /*mapped*/, ptr, len);
    749         return NO_ERROR;
    750     }
    751 
    752     ALOGV("writeBlob: write to ashmem");
    753     int fd = ashmem_create_region("Parcel Blob", len);
    754     if (fd < 0) return NO_MEMORY;
    755 
    756     int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);
    757     if (result < 0) {
    758         status = result;
    759     } else {
    760         void* ptr = ::mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
    761         if (ptr == MAP_FAILED) {
    762             status = -errno;
    763         } else {
    764             result = ashmem_set_prot_region(fd, PROT_READ);
    765             if (result < 0) {
    766                 status = result;
    767             } else {
    768                 status = writeInt32(1);
    769                 if (!status) {
    770                     status = writeFileDescriptor(fd, true /*takeOwnership*/);
    771                     if (!status) {
    772                         outBlob->init(true /*mapped*/, ptr, len);
    773                         return NO_ERROR;
    774                     }
    775                 }
    776             }
    777         }
    778         ::munmap(ptr, len);
    779     }
    780     ::close(fd);
    781     return status;
    782 }
    783 
    784 status_t Parcel::write(const Flattenable& val)
    785 {
    786     status_t err;
    787 
    788     // size if needed
    789     size_t len = val.getFlattenedSize();
    790     size_t fd_count = val.getFdCount();
    791 
    792     err = this->writeInt32(len);
    793     if (err) return err;
    794 
    795     err = this->writeInt32(fd_count);
    796     if (err) return err;
    797 
    798     // payload
    799     void* buf = this->writeInplace(PAD_SIZE(len));
    800     if (buf == NULL)
    801         return BAD_VALUE;
    802 
    803     int* fds = NULL;
    804     if (fd_count) {
    805         fds = new int[fd_count];
    806     }
    807 
    808     err = val.flatten(buf, len, fds, fd_count);
    809     for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
    810         err = this->writeDupFileDescriptor( fds[i] );
    811     }
    812 
    813     if (fd_count) {
    814         delete [] fds;
    815     }
    816 
    817     return err;
    818 }
    819 
    820 status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData)
    821 {
    822     const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;
    823     const bool enoughObjects = mObjectsSize < mObjectsCapacity;
    824     if (enoughData && enoughObjects) {
    825 restart_write:
    826         *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
    827 
    828         // Need to write meta-data?
    829         if (nullMetaData || val.binder != NULL) {
    830             mObjects[mObjectsSize] = mDataPos;
    831             acquire_object(ProcessState::self(), val, this);
    832             mObjectsSize++;
    833         }
    834 
    835         // remember if it's a file descriptor
    836         if (val.type == BINDER_TYPE_FD) {
    837             if (!mAllowFds) {
    838                 return FDS_NOT_ALLOWED;
    839             }
    840             mHasFds = mFdsKnown = true;
    841         }
    842 
    843         return finishWrite(sizeof(flat_binder_object));
    844     }
    845 
    846     if (!enoughData) {
    847         const status_t err = growData(sizeof(val));
    848         if (err != NO_ERROR) return err;
    849     }
    850     if (!enoughObjects) {
    851         size_t newSize = ((mObjectsSize+2)*3)/2;
    852         size_t* objects = (size_t*)realloc(mObjects, newSize*sizeof(size_t));
    853         if (objects == NULL) return NO_MEMORY;
    854         mObjects = objects;
    855         mObjectsCapacity = newSize;
    856     }
    857 
    858     goto restart_write;
    859 }
    860 
    861 status_t Parcel::writeNoException()
    862 {
    863     return writeInt32(0);
    864 }
    865 
    866 void Parcel::remove(size_t start, size_t amt)
    867 {
    868     LOG_ALWAYS_FATAL("Parcel::remove() not yet implemented!");
    869 }
    870 
    871 status_t Parcel::read(void* outData, size_t len) const
    872 {
    873     if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {
    874         memcpy(outData, mData+mDataPos, len);
    875         mDataPos += PAD_SIZE(len);
    876         ALOGV("read Setting data pos of %p to %d\n", this, mDataPos);
    877         return NO_ERROR;
    878     }
    879     return NOT_ENOUGH_DATA;
    880 }
    881 
    882 const void* Parcel::readInplace(size_t len) const
    883 {
    884     if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {
    885         const void* data = mData+mDataPos;
    886         mDataPos += PAD_SIZE(len);
    887         ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos);
    888         return data;
    889     }
    890     return NULL;
    891 }
    892 
    893 template<class T>
    894 status_t Parcel::readAligned(T *pArg) const {
    895     COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE(sizeof(T)) == sizeof(T));
    896 
    897     if ((mDataPos+sizeof(T)) <= mDataSize) {
    898         const void* data = mData+mDataPos;
    899         mDataPos += sizeof(T);
    900         *pArg =  *reinterpret_cast<const T*>(data);
    901         return NO_ERROR;
    902     } else {
    903         return NOT_ENOUGH_DATA;
    904     }
    905 }
    906 
    907 template<class T>
    908 T Parcel::readAligned() const {
    909     T result;
    910     if (readAligned(&result) != NO_ERROR) {
    911         result = 0;
    912     }
    913 
    914     return result;
    915 }
    916 
    917 template<class T>
    918 status_t Parcel::writeAligned(T val) {
    919     COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE(sizeof(T)) == sizeof(T));
    920 
    921     if ((mDataPos+sizeof(val)) <= mDataCapacity) {
    922 restart_write:
    923         *reinterpret_cast<T*>(mData+mDataPos) = val;
    924         return finishWrite(sizeof(val));
    925     }
    926 
    927     status_t err = growData(sizeof(val));
    928     if (err == NO_ERROR) goto restart_write;
    929     return err;
    930 }
    931 
    932 status_t Parcel::readInt32(int32_t *pArg) const
    933 {
    934     return readAligned(pArg);
    935 }
    936 
    937 int32_t Parcel::readInt32() const
    938 {
    939     return readAligned<int32_t>();
    940 }
    941 
    942 
    943 status_t Parcel::readInt64(int64_t *pArg) const
    944 {
    945     return readAligned(pArg);
    946 }
    947 
    948 
    949 int64_t Parcel::readInt64() const
    950 {
    951     return readAligned<int64_t>();
    952 }
    953 
    954 status_t Parcel::readFloat(float *pArg) const
    955 {
    956     return readAligned(pArg);
    957 }
    958 
    959 
    960 float Parcel::readFloat() const
    961 {
    962     return readAligned<float>();
    963 }
    964 
    965 status_t Parcel::readDouble(double *pArg) const
    966 {
    967     return readAligned(pArg);
    968 }
    969 
    970 
    971 double Parcel::readDouble() const
    972 {
    973     return readAligned<double>();
    974 }
    975 
    976 status_t Parcel::readIntPtr(intptr_t *pArg) const
    977 {
    978     return readAligned(pArg);
    979 }
    980 
    981 
    982 intptr_t Parcel::readIntPtr() const
    983 {
    984     return readAligned<intptr_t>();
    985 }
    986 
    987 
    988 const char* Parcel::readCString() const
    989 {
    990     const size_t avail = mDataSize-mDataPos;
    991     if (avail > 0) {
    992         const char* str = reinterpret_cast<const char*>(mData+mDataPos);
    993         // is the string's trailing NUL within the parcel's valid bounds?
    994         const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));
    995         if (eos) {
    996             const size_t len = eos - str;
    997             mDataPos += PAD_SIZE(len+1);
    998             ALOGV("readCString Setting data pos of %p to %d\n", this, mDataPos);
    999             return str;
   1000         }
   1001     }
   1002     return NULL;
   1003 }
   1004 
   1005 String8 Parcel::readString8() const
   1006 {
   1007     int32_t size = readInt32();
   1008     // watch for potential int overflow adding 1 for trailing NUL
   1009     if (size > 0 && size < INT32_MAX) {
   1010         const char* str = (const char*)readInplace(size+1);
   1011         if (str) return String8(str, size);
   1012     }
   1013     return String8();
   1014 }
   1015 
   1016 String16 Parcel::readString16() const
   1017 {
   1018     size_t len;
   1019     const char16_t* str = readString16Inplace(&len);
   1020     if (str) return String16(str, len);
   1021     ALOGE("Reading a NULL string not supported here.");
   1022     return String16();
   1023 }
   1024 
   1025 const char16_t* Parcel::readString16Inplace(size_t* outLen) const
   1026 {
   1027     int32_t size = readInt32();
   1028     // watch for potential int overflow from size+1
   1029     if (size >= 0 && size < INT32_MAX) {
   1030         *outLen = size;
   1031         const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t));
   1032         if (str != NULL) {
   1033             return str;
   1034         }
   1035     }
   1036     *outLen = 0;
   1037     return NULL;
   1038 }
   1039 
   1040 sp<IBinder> Parcel::readStrongBinder() const
   1041 {
   1042     sp<IBinder> val;
   1043     unflatten_binder(ProcessState::self(), *this, &val);
   1044     return val;
   1045 }
   1046 
   1047 wp<IBinder> Parcel::readWeakBinder() const
   1048 {
   1049     wp<IBinder> val;
   1050     unflatten_binder(ProcessState::self(), *this, &val);
   1051     return val;
   1052 }
   1053 
   1054 int32_t Parcel::readExceptionCode() const
   1055 {
   1056   int32_t exception_code = readAligned<int32_t>();
   1057   if (exception_code == EX_HAS_REPLY_HEADER) {
   1058     int32_t header_size = readAligned<int32_t>();
   1059     // Skip over fat responses headers.  Not used (or propagated) in
   1060     // native code
   1061     setDataPosition(dataPosition() + header_size);
   1062     // And fat response headers are currently only used when there are no
   1063     // exceptions, so return no error:
   1064     return 0;
   1065   }
   1066   return exception_code;
   1067 }
   1068 
   1069 native_handle* Parcel::readNativeHandle() const
   1070 {
   1071     int numFds, numInts;
   1072     status_t err;
   1073     err = readInt32(&numFds);
   1074     if (err != NO_ERROR) return 0;
   1075     err = readInt32(&numInts);
   1076     if (err != NO_ERROR) return 0;
   1077 
   1078     native_handle* h = native_handle_create(numFds, numInts);
   1079     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
   1080         h->data[i] = dup(readFileDescriptor());
   1081         if (h->data[i] < 0) err = BAD_VALUE;
   1082     }
   1083     err = read(h->data + numFds, sizeof(int)*numInts);
   1084     if (err != NO_ERROR) {
   1085         native_handle_close(h);
   1086         native_handle_delete(h);
   1087         h = 0;
   1088     }
   1089     return h;
   1090 }
   1091 
   1092 
   1093 int Parcel::readFileDescriptor() const
   1094 {
   1095     const flat_binder_object* flat = readObject(true);
   1096     if (flat) {
   1097         switch (flat->type) {
   1098             case BINDER_TYPE_FD:
   1099                 //ALOGI("Returning file descriptor %ld from parcel %p\n", flat->handle, this);
   1100                 return flat->handle;
   1101         }
   1102     }
   1103     return BAD_TYPE;
   1104 }
   1105 
   1106 status_t Parcel::readBlob(size_t len, ReadableBlob* outBlob) const
   1107 {
   1108     int32_t useAshmem;
   1109     status_t status = readInt32(&useAshmem);
   1110     if (status) return status;
   1111 
   1112     if (!useAshmem) {
   1113         ALOGV("readBlob: read in place");
   1114         const void* ptr = readInplace(len);
   1115         if (!ptr) return BAD_VALUE;
   1116 
   1117         outBlob->init(false /*mapped*/, const_cast<void*>(ptr), len);
   1118         return NO_ERROR;
   1119     }
   1120 
   1121     ALOGV("readBlob: read from ashmem");
   1122     int fd = readFileDescriptor();
   1123     if (fd == int(BAD_TYPE)) return BAD_VALUE;
   1124 
   1125     void* ptr = ::mmap(NULL, len, PROT_READ, MAP_SHARED, fd, 0);
   1126     if (!ptr) return NO_MEMORY;
   1127 
   1128     outBlob->init(true /*mapped*/, ptr, len);
   1129     return NO_ERROR;
   1130 }
   1131 
   1132 status_t Parcel::read(Flattenable& val) const
   1133 {
   1134     // size
   1135     const size_t len = this->readInt32();
   1136     const size_t fd_count = this->readInt32();
   1137 
   1138     // payload
   1139     void const* buf = this->readInplace(PAD_SIZE(len));
   1140     if (buf == NULL)
   1141         return BAD_VALUE;
   1142 
   1143     int* fds = NULL;
   1144     if (fd_count) {
   1145         fds = new int[fd_count];
   1146     }
   1147 
   1148     status_t err = NO_ERROR;
   1149     for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
   1150         fds[i] = dup(this->readFileDescriptor());
   1151         if (fds[i] < 0) err = BAD_VALUE;
   1152     }
   1153 
   1154     if (err == NO_ERROR) {
   1155         err = val.unflatten(buf, len, fds, fd_count);
   1156     }
   1157 
   1158     if (fd_count) {
   1159         delete [] fds;
   1160     }
   1161 
   1162     return err;
   1163 }
   1164 const flat_binder_object* Parcel::readObject(bool nullMetaData) const
   1165 {
   1166     const size_t DPOS = mDataPos;
   1167     if ((DPOS+sizeof(flat_binder_object)) <= mDataSize) {
   1168         const flat_binder_object* obj
   1169                 = reinterpret_cast<const flat_binder_object*>(mData+DPOS);
   1170         mDataPos = DPOS + sizeof(flat_binder_object);
   1171         if (!nullMetaData && (obj->cookie == NULL && obj->binder == NULL)) {
   1172             // When transferring a NULL object, we don't write it into
   1173             // the object list, so we don't want to check for it when
   1174             // reading.
   1175             ALOGV("readObject Setting data pos of %p to %d\n", this, mDataPos);
   1176             return obj;
   1177         }
   1178 
   1179         // Ensure that this object is valid...
   1180         size_t* const OBJS = mObjects;
   1181         const size_t N = mObjectsSize;
   1182         size_t opos = mNextObjectHint;
   1183 
   1184         if (N > 0) {
   1185             ALOGV("Parcel %p looking for obj at %d, hint=%d\n",
   1186                  this, DPOS, opos);
   1187 
   1188             // Start at the current hint position, looking for an object at
   1189             // the current data position.
   1190             if (opos < N) {
   1191                 while (opos < (N-1) && OBJS[opos] < DPOS) {
   1192                     opos++;
   1193                 }
   1194             } else {
   1195                 opos = N-1;
   1196             }
   1197             if (OBJS[opos] == DPOS) {
   1198                 // Found it!
   1199                 ALOGV("Parcel found obj %d at index %d with forward search",
   1200                      this, DPOS, opos);
   1201                 mNextObjectHint = opos+1;
   1202                 ALOGV("readObject Setting data pos of %p to %d\n", this, mDataPos);
   1203                 return obj;
   1204             }
   1205 
   1206             // Look backwards for it...
   1207             while (opos > 0 && OBJS[opos] > DPOS) {
   1208                 opos--;
   1209             }
   1210             if (OBJS[opos] == DPOS) {
   1211                 // Found it!
   1212                 ALOGV("Parcel found obj %d at index %d with backward search",
   1213                      this, DPOS, opos);
   1214                 mNextObjectHint = opos+1;
   1215                 ALOGV("readObject Setting data pos of %p to %d\n", this, mDataPos);
   1216                 return obj;
   1217             }
   1218         }
   1219         ALOGW("Attempt to read object from Parcel %p at offset %d that is not in the object list",
   1220              this, DPOS);
   1221     }
   1222     return NULL;
   1223 }
   1224 
   1225 void Parcel::closeFileDescriptors()
   1226 {
   1227     size_t i = mObjectsSize;
   1228     if (i > 0) {
   1229         //ALOGI("Closing file descriptors for %d objects...", mObjectsSize);
   1230     }
   1231     while (i > 0) {
   1232         i--;
   1233         const flat_binder_object* flat
   1234             = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
   1235         if (flat->type == BINDER_TYPE_FD) {
   1236             //ALOGI("Closing fd: %ld\n", flat->handle);
   1237             close(flat->handle);
   1238         }
   1239     }
   1240 }
   1241 
   1242 const uint8_t* Parcel::ipcData() const
   1243 {
   1244     return mData;
   1245 }
   1246 
   1247 size_t Parcel::ipcDataSize() const
   1248 {
   1249     return (mDataSize > mDataPos ? mDataSize : mDataPos);
   1250 }
   1251 
   1252 const size_t* Parcel::ipcObjects() const
   1253 {
   1254     return mObjects;
   1255 }
   1256 
   1257 size_t Parcel::ipcObjectsCount() const
   1258 {
   1259     return mObjectsSize;
   1260 }
   1261 
   1262 void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,
   1263     const size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)
   1264 {
   1265     freeDataNoInit();
   1266     mError = NO_ERROR;
   1267     mData = const_cast<uint8_t*>(data);
   1268     mDataSize = mDataCapacity = dataSize;
   1269     //ALOGI("setDataReference Setting data size of %p to %lu (pid=%d)\n", this, mDataSize, getpid());
   1270     mDataPos = 0;
   1271     ALOGV("setDataReference Setting data pos of %p to %d\n", this, mDataPos);
   1272     mObjects = const_cast<size_t*>(objects);
   1273     mObjectsSize = mObjectsCapacity = objectsCount;
   1274     mNextObjectHint = 0;
   1275     mOwner = relFunc;
   1276     mOwnerCookie = relCookie;
   1277     scanForFds();
   1278 }
   1279 
   1280 void Parcel::print(TextOutput& to, uint32_t flags) const
   1281 {
   1282     to << "Parcel(";
   1283 
   1284     if (errorCheck() != NO_ERROR) {
   1285         const status_t err = errorCheck();
   1286         to << "Error: " << (void*)err << " \"" << strerror(-err) << "\"";
   1287     } else if (dataSize() > 0) {
   1288         const uint8_t* DATA = data();
   1289         to << indent << HexDump(DATA, dataSize()) << dedent;
   1290         const size_t* OBJS = objects();
   1291         const size_t N = objectsCount();
   1292         for (size_t i=0; i<N; i++) {
   1293             const flat_binder_object* flat
   1294                 = reinterpret_cast<const flat_binder_object*>(DATA+OBJS[i]);
   1295             to << endl << "Object #" << i << " @ " << (void*)OBJS[i] << ": "
   1296                 << TypeCode(flat->type & 0x7f7f7f00)
   1297                 << " = " << flat->binder;
   1298         }
   1299     } else {
   1300         to << "NULL";
   1301     }
   1302 
   1303     to << ")";
   1304 }
   1305 
   1306 void Parcel::releaseObjects()
   1307 {
   1308     const sp<ProcessState> proc(ProcessState::self());
   1309     size_t i = mObjectsSize;
   1310     uint8_t* const data = mData;
   1311     size_t* const objects = mObjects;
   1312     while (i > 0) {
   1313         i--;
   1314         const flat_binder_object* flat
   1315             = reinterpret_cast<flat_binder_object*>(data+objects[i]);
   1316         release_object(proc, *flat, this);
   1317     }
   1318 }
   1319 
   1320 void Parcel::acquireObjects()
   1321 {
   1322     const sp<ProcessState> proc(ProcessState::self());
   1323     size_t i = mObjectsSize;
   1324     uint8_t* const data = mData;
   1325     size_t* const objects = mObjects;
   1326     while (i > 0) {
   1327         i--;
   1328         const flat_binder_object* flat
   1329             = reinterpret_cast<flat_binder_object*>(data+objects[i]);
   1330         acquire_object(proc, *flat, this);
   1331     }
   1332 }
   1333 
   1334 void Parcel::freeData()
   1335 {
   1336     freeDataNoInit();
   1337     initState();
   1338 }
   1339 
   1340 void Parcel::freeDataNoInit()
   1341 {
   1342     if (mOwner) {
   1343         //ALOGI("Freeing data ref of %p (pid=%d)\n", this, getpid());
   1344         mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
   1345     } else {
   1346         releaseObjects();
   1347         if (mData) free(mData);
   1348         if (mObjects) free(mObjects);
   1349     }
   1350 }
   1351 
   1352 status_t Parcel::growData(size_t len)
   1353 {
   1354     size_t newSize = ((mDataSize+len)*3)/2;
   1355     return (newSize <= mDataSize)
   1356             ? (status_t) NO_MEMORY
   1357             : continueWrite(newSize);
   1358 }
   1359 
   1360 status_t Parcel::restartWrite(size_t desired)
   1361 {
   1362     if (mOwner) {
   1363         freeData();
   1364         return continueWrite(desired);
   1365     }
   1366 
   1367     uint8_t* data = (uint8_t*)realloc(mData, desired);
   1368     if (!data && desired > mDataCapacity) {
   1369         mError = NO_MEMORY;
   1370         return NO_MEMORY;
   1371     }
   1372 
   1373     releaseObjects();
   1374 
   1375     if (data) {
   1376         mData = data;
   1377         mDataCapacity = desired;
   1378     }
   1379 
   1380     mDataSize = mDataPos = 0;
   1381     ALOGV("restartWrite Setting data size of %p to %d\n", this, mDataSize);
   1382     ALOGV("restartWrite Setting data pos of %p to %d\n", this, mDataPos);
   1383 
   1384     free(mObjects);
   1385     mObjects = NULL;
   1386     mObjectsSize = mObjectsCapacity = 0;
   1387     mNextObjectHint = 0;
   1388     mHasFds = false;
   1389     mFdsKnown = true;
   1390     mAllowFds = true;
   1391 
   1392     return NO_ERROR;
   1393 }
   1394 
   1395 status_t Parcel::continueWrite(size_t desired)
   1396 {
   1397     // If shrinking, first adjust for any objects that appear
   1398     // after the new data size.
   1399     size_t objectsSize = mObjectsSize;
   1400     if (desired < mDataSize) {
   1401         if (desired == 0) {
   1402             objectsSize = 0;
   1403         } else {
   1404             while (objectsSize > 0) {
   1405                 if (mObjects[objectsSize-1] < desired)
   1406                     break;
   1407                 objectsSize--;
   1408             }
   1409         }
   1410     }
   1411 
   1412     if (mOwner) {
   1413         // If the size is going to zero, just release the owner's data.
   1414         if (desired == 0) {
   1415             freeData();
   1416             return NO_ERROR;
   1417         }
   1418 
   1419         // If there is a different owner, we need to take
   1420         // posession.
   1421         uint8_t* data = (uint8_t*)malloc(desired);
   1422         if (!data) {
   1423             mError = NO_MEMORY;
   1424             return NO_MEMORY;
   1425         }
   1426         size_t* objects = NULL;
   1427 
   1428         if (objectsSize) {
   1429             objects = (size_t*)malloc(objectsSize*sizeof(size_t));
   1430             if (!objects) {
   1431                 mError = NO_MEMORY;
   1432                 return NO_MEMORY;
   1433             }
   1434 
   1435             // Little hack to only acquire references on objects
   1436             // we will be keeping.
   1437             size_t oldObjectsSize = mObjectsSize;
   1438             mObjectsSize = objectsSize;
   1439             acquireObjects();
   1440             mObjectsSize = oldObjectsSize;
   1441         }
   1442 
   1443         if (mData) {
   1444             memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
   1445         }
   1446         if (objects && mObjects) {
   1447             memcpy(objects, mObjects, objectsSize*sizeof(size_t));
   1448         }
   1449         //ALOGI("Freeing data ref of %p (pid=%d)\n", this, getpid());
   1450         mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
   1451         mOwner = NULL;
   1452 
   1453         mData = data;
   1454         mObjects = objects;
   1455         mDataSize = (mDataSize < desired) ? mDataSize : desired;
   1456         ALOGV("continueWrite Setting data size of %p to %d\n", this, mDataSize);
   1457         mDataCapacity = desired;
   1458         mObjectsSize = mObjectsCapacity = objectsSize;
   1459         mNextObjectHint = 0;
   1460 
   1461     } else if (mData) {
   1462         if (objectsSize < mObjectsSize) {
   1463             // Need to release refs on any objects we are dropping.
   1464             const sp<ProcessState> proc(ProcessState::self());
   1465             for (size_t i=objectsSize; i<mObjectsSize; i++) {
   1466                 const flat_binder_object* flat
   1467                     = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
   1468                 if (flat->type == BINDER_TYPE_FD) {
   1469                     // will need to rescan because we may have lopped off the only FDs
   1470                     mFdsKnown = false;
   1471                 }
   1472                 release_object(proc, *flat, this);
   1473             }
   1474             size_t* objects =
   1475                 (size_t*)realloc(mObjects, objectsSize*sizeof(size_t));
   1476             if (objects) {
   1477                 mObjects = objects;
   1478             }
   1479             mObjectsSize = objectsSize;
   1480             mNextObjectHint = 0;
   1481         }
   1482 
   1483         // We own the data, so we can just do a realloc().
   1484         if (desired > mDataCapacity) {
   1485             uint8_t* data = (uint8_t*)realloc(mData, desired);
   1486             if (data) {
   1487                 mData = data;
   1488                 mDataCapacity = desired;
   1489             } else if (desired > mDataCapacity) {
   1490                 mError = NO_MEMORY;
   1491                 return NO_MEMORY;
   1492             }
   1493         } else {
   1494             if (mDataSize > desired) {
   1495                 mDataSize = desired;
   1496                 ALOGV("continueWrite Setting data size of %p to %d\n", this, mDataSize);
   1497             }
   1498             if (mDataPos > desired) {
   1499                 mDataPos = desired;
   1500                 ALOGV("continueWrite Setting data pos of %p to %d\n", this, mDataPos);
   1501             }
   1502         }
   1503 
   1504     } else {
   1505         // This is the first data.  Easy!
   1506         uint8_t* data = (uint8_t*)malloc(desired);
   1507         if (!data) {
   1508             mError = NO_MEMORY;
   1509             return NO_MEMORY;
   1510         }
   1511 
   1512         if(!(mDataCapacity == 0 && mObjects == NULL
   1513              && mObjectsCapacity == 0)) {
   1514             ALOGE("continueWrite: %d/%p/%d/%d", mDataCapacity, mObjects, mObjectsCapacity, desired);
   1515         }
   1516 
   1517         mData = data;
   1518         mDataSize = mDataPos = 0;
   1519         ALOGV("continueWrite Setting data size of %p to %d\n", this, mDataSize);
   1520         ALOGV("continueWrite Setting data pos of %p to %d\n", this, mDataPos);
   1521         mDataCapacity = desired;
   1522     }
   1523 
   1524     return NO_ERROR;
   1525 }
   1526 
   1527 void Parcel::initState()
   1528 {
   1529     mError = NO_ERROR;
   1530     mData = 0;
   1531     mDataSize = 0;
   1532     mDataCapacity = 0;
   1533     mDataPos = 0;
   1534     ALOGV("initState Setting data size of %p to %d\n", this, mDataSize);
   1535     ALOGV("initState Setting data pos of %p to %d\n", this, mDataPos);
   1536     mObjects = NULL;
   1537     mObjectsSize = 0;
   1538     mObjectsCapacity = 0;
   1539     mNextObjectHint = 0;
   1540     mHasFds = false;
   1541     mFdsKnown = true;
   1542     mAllowFds = true;
   1543     mOwner = NULL;
   1544 }
   1545 
   1546 void Parcel::scanForFds() const
   1547 {
   1548     bool hasFds = false;
   1549     for (size_t i=0; i<mObjectsSize; i++) {
   1550         const flat_binder_object* flat
   1551             = reinterpret_cast<const flat_binder_object*>(mData + mObjects[i]);
   1552         if (flat->type == BINDER_TYPE_FD) {
   1553             hasFds = true;
   1554             break;
   1555         }
   1556     }
   1557     mHasFds = hasFds;
   1558     mFdsKnown = true;
   1559 }
   1560 
   1561 // --- Parcel::Blob ---
   1562 
   1563 Parcel::Blob::Blob() :
   1564         mMapped(false), mData(NULL), mSize(0) {
   1565 }
   1566 
   1567 Parcel::Blob::~Blob() {
   1568     release();
   1569 }
   1570 
   1571 void Parcel::Blob::release() {
   1572     if (mMapped && mData) {
   1573         ::munmap(mData, mSize);
   1574     }
   1575     clear();
   1576 }
   1577 
   1578 void Parcel::Blob::init(bool mapped, void* data, size_t size) {
   1579     mMapped = mapped;
   1580     mData = data;
   1581     mSize = size;
   1582 }
   1583 
   1584 void Parcel::Blob::clear() {
   1585     mMapped = false;
   1586     mData = NULL;
   1587     mSize = 0;
   1588 }
   1589 
   1590 }; // namespace android
   1591