1 /* 2 * Copyright (C) 2005 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef ANDROID_HARDWARE_PARCEL_H 18 #define ANDROID_HARDWARE_PARCEL_H 19 20 #include <string> 21 #include <vector> 22 23 #include <cutils/native_handle.h> 24 #include <utils/Errors.h> 25 #include <utils/RefBase.h> 26 #include <utils/String16.h> 27 28 #include <hwbinder/IInterface.h> 29 30 // WARNING: this code is part of libhwbinder, a fork of libbinder. Generally, 31 // this means that it is only relevant to HIDL. Any AIDL- or libbinder-specific 32 // code should not try to use these things. 33 34 struct binder_buffer_object; 35 struct flat_binder_object; 36 37 // --------------------------------------------------------------------------- 38 namespace android { 39 namespace hardware { 40 41 #ifdef BINDER_IPC_32BIT 42 typedef unsigned int binder_size_t; 43 typedef unsigned int binder_uintptr_t; 44 #else 45 typedef unsigned long long binder_size_t; 46 typedef unsigned long long binder_uintptr_t; 47 #endif 48 49 class IBinder; 50 class IPCThreadState; 51 class ProcessState; 52 class TextOutput; 53 54 class Parcel { 55 friend class IPCThreadState; 56 public: 57 58 Parcel(); 59 ~Parcel(); 60 61 const uint8_t* data() const; 62 size_t dataSize() const; 63 size_t dataAvail() const; 64 size_t dataPosition() const; 65 size_t dataCapacity() const; 66 67 status_t setDataSize(size_t size); 68 void setDataPosition(size_t pos) const; 69 status_t setDataCapacity(size_t size); 70 71 // Zeros data when reallocating. Other mitigations may be added 72 // in the future. 73 // 74 // WARNING: some read methods may make additional copies of data. 75 // In order to verify this, heap dumps should be used. 76 void markSensitive() const; 77 78 // Writes the RPC header. 79 status_t writeInterfaceToken(const char* interface); 80 81 // Parses the RPC header, returning true if the interface name 82 // in the header matches the expected interface from the caller. 83 bool enforceInterface(const char* interface) const; 84 85 void freeData(); 86 87 private: 88 const binder_size_t* objects() const; 89 90 public: 91 size_t objectsCount() const; 92 93 status_t errorCheck() const; 94 void setError(status_t err); 95 96 status_t write(const void* data, size_t len); 97 void* writeInplace(size_t len); 98 status_t writeUnpadded(const void* data, size_t len); 99 status_t writeInt8(int8_t val); 100 status_t writeUint8(uint8_t val); 101 status_t writeInt16(int16_t val); 102 status_t writeUint16(uint16_t val); 103 status_t writeInt32(int32_t val); 104 status_t writeUint32(uint32_t val); 105 status_t writeInt64(int64_t val); 106 status_t writeUint64(uint64_t val); 107 status_t writeFloat(float val); 108 status_t writeDouble(double val); 109 status_t writeCString(const char* str); 110 status_t writeString16(const String16& str); 111 status_t writeString16(const std::unique_ptr<String16>& str); 112 status_t writeString16(const char16_t* str, size_t len); 113 status_t writeStrongBinder(const sp<IBinder>& val); 114 status_t writeBool(bool val); 115 116 template<typename T> 117 status_t writeObject(const T& val); 118 119 status_t writeBuffer(const void *buffer, size_t length, size_t *handle); 120 status_t writeEmbeddedBuffer(const void *buffer, size_t length, size_t *handle, 121 size_t parent_buffer_handle, size_t parent_offset); 122 public: 123 status_t writeEmbeddedNativeHandle(const native_handle_t *handle, 124 size_t parent_buffer_handle, size_t parent_offset); 125 status_t writeNativeHandleNoDup(const native_handle* handle, bool embedded, 126 size_t parent_buffer_handle = 0, 127 size_t parent_offset = 0); 128 status_t writeNativeHandleNoDup(const native_handle* handle); 129 130 status_t read(void* outData, size_t len) const; 131 const void* readInplace(size_t len) const; 132 status_t readInt8(int8_t *pArg) const; 133 status_t readUint8(uint8_t *pArg) const; 134 status_t readInt16(int16_t *pArg) const; 135 status_t readUint16(uint16_t *pArg) const; 136 int32_t readInt32() const; 137 status_t readInt32(int32_t *pArg) const; 138 uint32_t readUint32() const; 139 status_t readUint32(uint32_t *pArg) const; 140 int64_t readInt64() const; 141 status_t readInt64(int64_t *pArg) const; 142 uint64_t readUint64() const; 143 status_t readUint64(uint64_t *pArg) const; 144 float readFloat() const; 145 status_t readFloat(float *pArg) const; 146 double readDouble() const; 147 status_t readDouble(double *pArg) const; 148 149 bool readBool() const; 150 status_t readBool(bool *pArg) const; 151 const char* readCString() const; 152 String16 readString16() const; 153 status_t readString16(String16* pArg) const; 154 status_t readString16(std::unique_ptr<String16>* pArg) const; 155 const char16_t* readString16Inplace(size_t* outLen) const; 156 sp<IBinder> readStrongBinder() const; 157 status_t readStrongBinder(sp<IBinder>* val) const; 158 status_t readNullableStrongBinder(sp<IBinder>* val) const; 159 160 template<typename T> 161 const T* readObject(size_t *objects_offset = nullptr) const; 162 163 status_t readBuffer(size_t buffer_size, size_t *buffer_handle, 164 const void **buffer_out) const; 165 status_t readNullableBuffer(size_t buffer_size, size_t *buffer_handle, 166 const void **buffer_out) const; 167 status_t readEmbeddedBuffer(size_t buffer_size, size_t *buffer_handle, 168 size_t parent_buffer_handle, size_t parent_offset, 169 const void **buffer_out) const; 170 status_t readNullableEmbeddedBuffer(size_t buffer_size, 171 size_t *buffer_handle, 172 size_t parent_buffer_handle, 173 size_t parent_offset, 174 const void **buffer_out) const; 175 176 status_t readEmbeddedNativeHandle(size_t parent_buffer_handle, 177 size_t parent_offset, const native_handle_t **handle) const; 178 status_t readNullableEmbeddedNativeHandle(size_t parent_buffer_handle, 179 size_t parent_offset, const native_handle_t **handle) const; 180 status_t readNativeHandleNoDup(const native_handle_t **handle) const; 181 status_t readNullableNativeHandleNoDup(const native_handle_t **handle) const; 182 183 // Explicitly close all file descriptors in the parcel. 184 void closeFileDescriptors(); 185 186 // Debugging: get metrics on current allocations. 187 static size_t getGlobalAllocSize(); 188 static size_t getGlobalAllocCount(); 189 190 private: 191 // Below is a cache that records some information about all actual buffers 192 // in this parcel. 193 struct BufferInfo { 194 size_t index; 195 binder_uintptr_t buffer; 196 binder_uintptr_t bufend; // buffer + length 197 }; 198 // value of mObjectSize when mBufCache is last updated. 199 mutable size_t mBufCachePos; 200 mutable std::vector<BufferInfo> mBufCache; 201 // clear mBufCachePos and mBufCache. 202 void clearCache() const; 203 // update mBufCache for all objects between mBufCachePos and mObjectsSize 204 void updateCache() const; 205 206 bool verifyBufferObject(const binder_buffer_object *buffer_obj, 207 size_t size, uint32_t flags, size_t parent, 208 size_t parentOffset) const; 209 210 status_t readBuffer(size_t buffer_size, size_t *buffer_handle, 211 uint32_t flags, size_t parent, size_t parentOffset, 212 const void **buffer_out) const; 213 214 status_t readNullableNativeHandleNoDup(const native_handle_t **handle, 215 bool embedded, 216 size_t parent_buffer_handle = 0, 217 size_t parent_offset = 0) const; 218 public: 219 220 // The following two methods attempt to find if a chunk of memory ("buffer") 221 // is written / read before (by (read|write)(Embedded)?Buffer methods. ) 222 // 1. Call findBuffer if the chunk of memory could be a small part of a larger 223 // buffer written before (for example, an element of a hidl_vec). The 224 // method will also ensure that the end address (ptr + length) is also 225 // within the buffer. 226 // 2. Call quickFindBuffer if the buffer could only be written previously 227 // by itself (for example, the mBuffer field of a hidl_vec). No lengths 228 // are checked. 229 status_t findBuffer(const void *ptr, 230 size_t length, 231 bool *found, 232 size_t *handle, 233 size_t *offset // valid if found 234 ) const; 235 status_t quickFindBuffer(const void *ptr, 236 size_t *handle // valid if found 237 ) const; 238 239 private: 240 bool validateBufferChild(size_t child_buffer_handle, 241 size_t child_offset) const; 242 bool validateBufferParent(size_t parent_buffer_handle, 243 size_t parent_offset) const; 244 245 private: 246 typedef void (*release_func)(Parcel* parcel, 247 const uint8_t* data, size_t dataSize, 248 const binder_size_t* objects, size_t objectsSize, 249 void* cookie); 250 251 uintptr_t ipcData() const; 252 size_t ipcDataSize() const; 253 uintptr_t ipcObjects() const; 254 size_t ipcObjectsCount() const; 255 size_t ipcBufferSize() const; 256 void ipcSetDataReference(const uint8_t* data, size_t dataSize, 257 const binder_size_t* objects, size_t objectsCount, 258 release_func relFunc, void* relCookie); 259 260 public: 261 void print(TextOutput& to, uint32_t flags = 0) const; 262 263 private: 264 Parcel(const Parcel& o); 265 Parcel& operator=(const Parcel& o); 266 267 status_t finishWrite(size_t len); 268 void releaseObjects(); 269 void acquireObjects(); 270 status_t growData(size_t len); 271 status_t continueWrite(size_t desired); 272 status_t writePointer(uintptr_t val); 273 status_t readPointer(uintptr_t *pArg) const; 274 uintptr_t readPointer() const; 275 void freeDataNoInit(); 276 void initState(); 277 void scanForFds() const; 278 279 template<class T> 280 status_t readAligned(T *pArg) const; 281 282 template<class T> T readAligned() const; 283 284 template<class T> 285 status_t writeAligned(T val); 286 287 status_t mError; 288 uint8_t* mData; 289 size_t mDataSize; 290 size_t mDataCapacity; 291 mutable size_t mDataPos; 292 binder_size_t* mObjects; 293 size_t mObjectsSize; 294 size_t mObjectsCapacity; 295 mutable size_t mNextObjectHint; 296 297 [[deprecated]] size_t mNumRef; 298 299 mutable bool mFdsKnown; 300 mutable bool mHasFds; 301 bool mAllowFds; 302 303 // if this parcelable is involved in a secure transaction, force the 304 // data to be overridden with zero when deallocated 305 mutable bool mDeallocZero; 306 307 release_func mOwner; 308 void* mOwnerCookie; 309 }; 310 // --------------------------------------------------------------------------- 311 312 inline TextOutput& operator<<(TextOutput& to, const Parcel& parcel) 313 { 314 parcel.print(to); 315 return to; 316 } 317 318 // --------------------------------------------------------------------------- 319 320 // Generic acquire and release of objects. 321 void acquire_object(const sp<ProcessState>& proc, 322 const flat_binder_object& obj, const void* who); 323 void release_object(const sp<ProcessState>& proc, 324 const flat_binder_object& obj, const void* who); 325 326 void flatten_binder(const sp<ProcessState>& proc, 327 const sp<IBinder>& binder, flat_binder_object* out); 328 void flatten_binder(const sp<ProcessState>& proc, 329 const wp<IBinder>& binder, flat_binder_object* out); 330 status_t unflatten_binder(const sp<ProcessState>& proc, 331 const flat_binder_object& flat, sp<IBinder>* out); 332 status_t unflatten_binder(const sp<ProcessState>& proc, 333 const flat_binder_object& flat, wp<IBinder>* out); 334 335 } // namespace hardware 336 } // namespace android 337 338 // --------------------------------------------------------------------------- 339 340 #endif // ANDROID_HARDWARE_PARCEL_H 341