1 /*
2 * Copyright (C) 2018 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define TRACE_TAG USB
18
19 #include "sysdeps.h"
20
21 #include "daemon/usb_ffs.h"
22
23 #include <linux/usb/ch9.h>
24 #include <linux/usb/functionfs.h>
25
26 #include <android-base/logging.h>
27 #include <android-base/properties.h>
28 #include <android-base/unique_fd.h>
29
30 #include "adb.h"
31
32 #define MAX_PACKET_SIZE_FS 64
33 #define MAX_PACKET_SIZE_HS 512
34 #define MAX_PACKET_SIZE_SS 1024
35
36 #define USB_FFS_BULK_SIZE 16384
37
38 // Number of buffers needed to fit MAX_PAYLOAD, with an extra for ZLPs.
39 #define USB_FFS_NUM_BUFS ((4 * MAX_PAYLOAD / USB_FFS_BULK_SIZE) + 1)
40
41 #define USB_EXT_PROP_UNICODE 1
42
43 #define cpu_to_le16(x) htole16(x)
44 #define cpu_to_le32(x) htole32(x)
45
46 // clang-format off
47 struct func_desc {
48 struct usb_interface_descriptor intf;
49 struct usb_endpoint_descriptor_no_audio source;
50 struct usb_endpoint_descriptor_no_audio sink;
51 } __attribute__((packed));
52
53 struct ss_func_desc {
54 struct usb_interface_descriptor intf;
55 struct usb_endpoint_descriptor_no_audio source;
56 struct usb_ss_ep_comp_descriptor source_comp;
57 struct usb_endpoint_descriptor_no_audio sink;
58 struct usb_ss_ep_comp_descriptor sink_comp;
59 } __attribute__((packed));
60
61 struct desc_v1 {
62 struct usb_functionfs_descs_head_v1 {
63 __le32 magic;
64 __le32 length;
65 __le32 fs_count;
66 __le32 hs_count;
67 } __attribute__((packed)) header;
68 struct func_desc fs_descs, hs_descs;
69 } __attribute__((packed));
70
71 template <size_t PropertyNameLength, size_t PropertyDataLength>
72 struct usb_os_desc_ext_prop {
73 uint32_t dwSize = sizeof(*this);
74 uint32_t dwPropertyDataType = cpu_to_le32(USB_EXT_PROP_UNICODE);
75
76 // Property name and value are transmitted as UTF-16, but the kernel only
77 // accepts ASCII values and performs the conversion for us.
78 uint16_t wPropertyNameLength = cpu_to_le16(PropertyNameLength);
79 char bPropertyName[PropertyNameLength];
80
81 uint32_t dwPropertyDataLength = cpu_to_le32(PropertyDataLength);
82 char bProperty[PropertyDataLength];
83 } __attribute__((packed));
84
85 using usb_os_desc_guid_t = usb_os_desc_ext_prop<20, 39>;
86 usb_os_desc_guid_t os_desc_guid = {
87 .bPropertyName = "DeviceInterfaceGUID",
88 .bProperty = "{F72FE0D4-CBCB-407D-8814-9ED673D0DD6B}",
89 };
90
91 struct usb_ext_prop_values {
92 usb_os_desc_guid_t guid;
93 } __attribute__((packed));
94
95 usb_ext_prop_values os_prop_values = {
96 .guid = os_desc_guid,
97 };
98
99 struct desc_v2 {
100 struct usb_functionfs_descs_head_v2 header;
101 // The rest of the structure depends on the flags in the header.
102 __le32 fs_count;
103 __le32 hs_count;
104 __le32 ss_count;
105 __le32 os_count;
106 struct func_desc fs_descs, hs_descs;
107 struct ss_func_desc ss_descs;
108 struct usb_os_desc_header os_header;
109 struct usb_ext_compat_desc os_desc;
110 struct usb_os_desc_header os_prop_header;
111 struct usb_ext_prop_values os_prop_values;
112 } __attribute__((packed));
113
114 static struct func_desc fs_descriptors = {
115 .intf = {
116 .bLength = sizeof(fs_descriptors.intf),
117 .bDescriptorType = USB_DT_INTERFACE,
118 .bInterfaceNumber = 0,
119 .bNumEndpoints = 2,
120 .bInterfaceClass = ADB_CLASS,
121 .bInterfaceSubClass = ADB_SUBCLASS,
122 .bInterfaceProtocol = ADB_PROTOCOL,
123 .iInterface = 1, /* first string from the provided table */
124 },
125 .source = {
126 .bLength = sizeof(fs_descriptors.source),
127 .bDescriptorType = USB_DT_ENDPOINT,
128 .bEndpointAddress = 1 | USB_DIR_OUT,
129 .bmAttributes = USB_ENDPOINT_XFER_BULK,
130 .wMaxPacketSize = MAX_PACKET_SIZE_FS,
131 },
132 .sink = {
133 .bLength = sizeof(fs_descriptors.sink),
134 .bDescriptorType = USB_DT_ENDPOINT,
135 .bEndpointAddress = 2 | USB_DIR_IN,
136 .bmAttributes = USB_ENDPOINT_XFER_BULK,
137 .wMaxPacketSize = MAX_PACKET_SIZE_FS,
138 },
139 };
140
141 static struct func_desc hs_descriptors = {
142 .intf = {
143 .bLength = sizeof(hs_descriptors.intf),
144 .bDescriptorType = USB_DT_INTERFACE,
145 .bInterfaceNumber = 0,
146 .bNumEndpoints = 2,
147 .bInterfaceClass = ADB_CLASS,
148 .bInterfaceSubClass = ADB_SUBCLASS,
149 .bInterfaceProtocol = ADB_PROTOCOL,
150 .iInterface = 1, /* first string from the provided table */
151 },
152 .source = {
153 .bLength = sizeof(hs_descriptors.source),
154 .bDescriptorType = USB_DT_ENDPOINT,
155 .bEndpointAddress = 1 | USB_DIR_OUT,
156 .bmAttributes = USB_ENDPOINT_XFER_BULK,
157 .wMaxPacketSize = MAX_PACKET_SIZE_HS,
158 },
159 .sink = {
160 .bLength = sizeof(hs_descriptors.sink),
161 .bDescriptorType = USB_DT_ENDPOINT,
162 .bEndpointAddress = 2 | USB_DIR_IN,
163 .bmAttributes = USB_ENDPOINT_XFER_BULK,
164 .wMaxPacketSize = MAX_PACKET_SIZE_HS,
165 },
166 };
167
168 static struct ss_func_desc ss_descriptors = {
169 .intf = {
170 .bLength = sizeof(ss_descriptors.intf),
171 .bDescriptorType = USB_DT_INTERFACE,
172 .bInterfaceNumber = 0,
173 .bNumEndpoints = 2,
174 .bInterfaceClass = ADB_CLASS,
175 .bInterfaceSubClass = ADB_SUBCLASS,
176 .bInterfaceProtocol = ADB_PROTOCOL,
177 .iInterface = 1, /* first string from the provided table */
178 },
179 .source = {
180 .bLength = sizeof(ss_descriptors.source),
181 .bDescriptorType = USB_DT_ENDPOINT,
182 .bEndpointAddress = 1 | USB_DIR_OUT,
183 .bmAttributes = USB_ENDPOINT_XFER_BULK,
184 .wMaxPacketSize = MAX_PACKET_SIZE_SS,
185 },
186 .source_comp = {
187 .bLength = sizeof(ss_descriptors.source_comp),
188 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
189 .bMaxBurst = 4,
190 },
191 .sink = {
192 .bLength = sizeof(ss_descriptors.sink),
193 .bDescriptorType = USB_DT_ENDPOINT,
194 .bEndpointAddress = 2 | USB_DIR_IN,
195 .bmAttributes = USB_ENDPOINT_XFER_BULK,
196 .wMaxPacketSize = MAX_PACKET_SIZE_SS,
197 },
198 .sink_comp = {
199 .bLength = sizeof(ss_descriptors.sink_comp),
200 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
201 .bMaxBurst = 4,
202 },
203 };
204
205 struct usb_ext_compat_desc os_desc_compat = {
206 .bFirstInterfaceNumber = 0,
207 .Reserved1 = cpu_to_le32(1),
208 .CompatibleID = { 'W', 'I', 'N', 'U', 'S', 'B', '\0', '\0'},
209 .SubCompatibleID = {0},
210 .Reserved2 = {0},
211 };
212
213 static struct usb_os_desc_header os_desc_header = {
214 .interface = cpu_to_le32(0),
215 .dwLength = cpu_to_le32(sizeof(os_desc_header) + sizeof(os_desc_compat)),
216 .bcdVersion = cpu_to_le32(1),
217 .wIndex = cpu_to_le32(4),
218 .bCount = cpu_to_le32(1),
219 .Reserved = cpu_to_le32(0),
220 };
221
222 static struct usb_os_desc_header os_prop_header = {
223 .interface = cpu_to_le32(0),
224 .dwLength = cpu_to_le32(sizeof(os_desc_header) + sizeof(os_prop_values)),
225 .bcdVersion = cpu_to_le32(1),
226 .wIndex = cpu_to_le32(5),
227 .wCount = cpu_to_le16(1),
228 };
229
230 #define STR_INTERFACE_ "ADB Interface"
231
232 static const struct {
233 struct usb_functionfs_strings_head header;
234 struct {
235 __le16 code;
236 const char str1[sizeof(STR_INTERFACE_)];
237 } __attribute__((packed)) lang0;
238 } __attribute__((packed)) strings = {
239 .header = {
240 .magic = cpu_to_le32(FUNCTIONFS_STRINGS_MAGIC),
241 .length = cpu_to_le32(sizeof(strings)),
242 .str_count = cpu_to_le32(1),
243 .lang_count = cpu_to_le32(1),
244 },
245 .lang0 = {
246 cpu_to_le16(0x0409), /* en-us */
247 STR_INTERFACE_,
248 },
249 };
250 // clang-format on
251
open_functionfs(android::base::unique_fd * out_control,android::base::unique_fd * out_bulk_out,android::base::unique_fd * out_bulk_in)252 bool open_functionfs(android::base::unique_fd* out_control, android::base::unique_fd* out_bulk_out,
253 android::base::unique_fd* out_bulk_in) {
254 unique_fd control, bulk_out, bulk_in;
255 struct desc_v1 v1_descriptor = {};
256 struct desc_v2 v2_descriptor = {};
257
258 v2_descriptor.header.magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC_V2);
259 v2_descriptor.header.length = cpu_to_le32(sizeof(v2_descriptor));
260 v2_descriptor.header.flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC |
261 FUNCTIONFS_HAS_SS_DESC | FUNCTIONFS_HAS_MS_OS_DESC;
262 v2_descriptor.fs_count = 3;
263 v2_descriptor.hs_count = 3;
264 v2_descriptor.ss_count = 5;
265 v2_descriptor.os_count = 2;
266 v2_descriptor.fs_descs = fs_descriptors;
267 v2_descriptor.hs_descs = hs_descriptors;
268 v2_descriptor.ss_descs = ss_descriptors;
269 v2_descriptor.os_header = os_desc_header;
270 v2_descriptor.os_desc = os_desc_compat;
271 v2_descriptor.os_prop_header = os_prop_header;
272 v2_descriptor.os_prop_values = os_prop_values;
273
274 if (out_control->get() < 0) { // might have already done this before
275 LOG(INFO) << "opening control endpoint " << USB_FFS_ADB_EP0;
276 control.reset(adb_open(USB_FFS_ADB_EP0, O_RDWR));
277 if (control < 0) {
278 PLOG(ERROR) << "cannot open control endpoint " << USB_FFS_ADB_EP0;
279 return false;
280 }
281
282 if (adb_write(control.get(), &v2_descriptor, sizeof(v2_descriptor)) < 0) {
283 D("[ %s: Switching to V1_descriptor format errno=%s ]", USB_FFS_ADB_EP0,
284 strerror(errno));
285 v1_descriptor.header.magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC);
286 v1_descriptor.header.length = cpu_to_le32(sizeof(v1_descriptor));
287 v1_descriptor.header.fs_count = 3;
288 v1_descriptor.header.hs_count = 3;
289 v1_descriptor.fs_descs = fs_descriptors;
290 v1_descriptor.hs_descs = hs_descriptors;
291 if (adb_write(control.get(), &v1_descriptor, sizeof(v1_descriptor)) < 0) {
292 PLOG(ERROR) << "failed to write USB descriptors";
293 return false;
294 }
295 }
296
297 if (adb_write(control.get(), &strings, sizeof(strings)) < 0) {
298 PLOG(ERROR) << "failed to write USB strings";
299 return false;
300 }
301 // Signal only when writing the descriptors to ffs
302 android::base::SetProperty("sys.usb.ffs.ready", "1");
303 }
304
305 bulk_out.reset(adb_open(USB_FFS_ADB_OUT, O_RDONLY));
306 if (bulk_out < 0) {
307 PLOG(ERROR) << "cannot open bulk-out endpoint " << USB_FFS_ADB_OUT;
308 return false;
309 }
310
311 bulk_in.reset(adb_open(USB_FFS_ADB_IN, O_WRONLY));
312 if (bulk_in < 0) {
313 PLOG(ERROR) << "cannot open bulk-in endpoint " << USB_FFS_ADB_IN;
314 return false;
315 }
316
317 *out_control = std::move(control);
318 *out_bulk_in = std::move(bulk_in);
319 *out_bulk_out = std::move(bulk_out);
320 return true;
321 }
322