1 /* 2 * Copyright (C) 2018 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #define TRACE_TAG USB 18 19 #include "sysdeps.h" 20 21 #include "daemon/usb_ffs.h" 22 23 #include <linux/usb/ch9.h> 24 #include <linux/usb/functionfs.h> 25 26 #include <android-base/logging.h> 27 #include <android-base/properties.h> 28 #include <android-base/unique_fd.h> 29 30 #include "adb.h" 31 32 #define MAX_PACKET_SIZE_FS 64 33 #define MAX_PACKET_SIZE_HS 512 34 #define MAX_PACKET_SIZE_SS 1024 35 36 #define USB_FFS_BULK_SIZE 16384 37 38 // Number of buffers needed to fit MAX_PAYLOAD, with an extra for ZLPs. 39 #define USB_FFS_NUM_BUFS ((4 * MAX_PAYLOAD / USB_FFS_BULK_SIZE) + 1) 40 41 #define USB_EXT_PROP_UNICODE 1 42 43 #define cpu_to_le16(x) htole16(x) 44 #define cpu_to_le32(x) htole32(x) 45 46 // clang-format off 47 struct func_desc { 48 struct usb_interface_descriptor intf; 49 struct usb_endpoint_descriptor_no_audio source; 50 struct usb_endpoint_descriptor_no_audio sink; 51 } __attribute__((packed)); 52 53 struct ss_func_desc { 54 struct usb_interface_descriptor intf; 55 struct usb_endpoint_descriptor_no_audio source; 56 struct usb_ss_ep_comp_descriptor source_comp; 57 struct usb_endpoint_descriptor_no_audio sink; 58 struct usb_ss_ep_comp_descriptor sink_comp; 59 } __attribute__((packed)); 60 61 struct desc_v1 { 62 struct usb_functionfs_descs_head_v1 { 63 __le32 magic; 64 __le32 length; 65 __le32 fs_count; 66 __le32 hs_count; 67 } __attribute__((packed)) header; 68 struct func_desc fs_descs, hs_descs; 69 } __attribute__((packed)); 70 71 template <size_t PropertyNameLength, size_t PropertyDataLength> 72 struct usb_os_desc_ext_prop { 73 uint32_t dwSize = sizeof(*this); 74 uint32_t dwPropertyDataType = cpu_to_le32(USB_EXT_PROP_UNICODE); 75 76 // Property name and value are transmitted as UTF-16, but the kernel only 77 // accepts ASCII values and performs the conversion for us. 78 uint16_t wPropertyNameLength = cpu_to_le16(PropertyNameLength); 79 char bPropertyName[PropertyNameLength]; 80 81 uint32_t dwPropertyDataLength = cpu_to_le32(PropertyDataLength); 82 char bProperty[PropertyDataLength]; 83 } __attribute__((packed)); 84 85 using usb_os_desc_guid_t = usb_os_desc_ext_prop<20, 39>; 86 usb_os_desc_guid_t os_desc_guid = { 87 .bPropertyName = "DeviceInterfaceGUID", 88 .bProperty = "{F72FE0D4-CBCB-407D-8814-9ED673D0DD6B}", 89 }; 90 91 struct usb_ext_prop_values { 92 usb_os_desc_guid_t guid; 93 } __attribute__((packed)); 94 95 usb_ext_prop_values os_prop_values = { 96 .guid = os_desc_guid, 97 }; 98 99 struct desc_v2 { 100 struct usb_functionfs_descs_head_v2 header; 101 // The rest of the structure depends on the flags in the header. 102 __le32 fs_count; 103 __le32 hs_count; 104 __le32 ss_count; 105 __le32 os_count; 106 struct func_desc fs_descs, hs_descs; 107 struct ss_func_desc ss_descs; 108 struct usb_os_desc_header os_header; 109 struct usb_ext_compat_desc os_desc; 110 struct usb_os_desc_header os_prop_header; 111 struct usb_ext_prop_values os_prop_values; 112 } __attribute__((packed)); 113 114 static struct func_desc fs_descriptors = { 115 .intf = { 116 .bLength = sizeof(fs_descriptors.intf), 117 .bDescriptorType = USB_DT_INTERFACE, 118 .bInterfaceNumber = 0, 119 .bNumEndpoints = 2, 120 .bInterfaceClass = ADB_CLASS, 121 .bInterfaceSubClass = ADB_SUBCLASS, 122 .bInterfaceProtocol = ADB_PROTOCOL, 123 .iInterface = 1, /* first string from the provided table */ 124 }, 125 .source = { 126 .bLength = sizeof(fs_descriptors.source), 127 .bDescriptorType = USB_DT_ENDPOINT, 128 .bEndpointAddress = 1 | USB_DIR_OUT, 129 .bmAttributes = USB_ENDPOINT_XFER_BULK, 130 .wMaxPacketSize = MAX_PACKET_SIZE_FS, 131 }, 132 .sink = { 133 .bLength = sizeof(fs_descriptors.sink), 134 .bDescriptorType = USB_DT_ENDPOINT, 135 .bEndpointAddress = 2 | USB_DIR_IN, 136 .bmAttributes = USB_ENDPOINT_XFER_BULK, 137 .wMaxPacketSize = MAX_PACKET_SIZE_FS, 138 }, 139 }; 140 141 static struct func_desc hs_descriptors = { 142 .intf = { 143 .bLength = sizeof(hs_descriptors.intf), 144 .bDescriptorType = USB_DT_INTERFACE, 145 .bInterfaceNumber = 0, 146 .bNumEndpoints = 2, 147 .bInterfaceClass = ADB_CLASS, 148 .bInterfaceSubClass = ADB_SUBCLASS, 149 .bInterfaceProtocol = ADB_PROTOCOL, 150 .iInterface = 1, /* first string from the provided table */ 151 }, 152 .source = { 153 .bLength = sizeof(hs_descriptors.source), 154 .bDescriptorType = USB_DT_ENDPOINT, 155 .bEndpointAddress = 1 | USB_DIR_OUT, 156 .bmAttributes = USB_ENDPOINT_XFER_BULK, 157 .wMaxPacketSize = MAX_PACKET_SIZE_HS, 158 }, 159 .sink = { 160 .bLength = sizeof(hs_descriptors.sink), 161 .bDescriptorType = USB_DT_ENDPOINT, 162 .bEndpointAddress = 2 | USB_DIR_IN, 163 .bmAttributes = USB_ENDPOINT_XFER_BULK, 164 .wMaxPacketSize = MAX_PACKET_SIZE_HS, 165 }, 166 }; 167 168 static struct ss_func_desc ss_descriptors = { 169 .intf = { 170 .bLength = sizeof(ss_descriptors.intf), 171 .bDescriptorType = USB_DT_INTERFACE, 172 .bInterfaceNumber = 0, 173 .bNumEndpoints = 2, 174 .bInterfaceClass = ADB_CLASS, 175 .bInterfaceSubClass = ADB_SUBCLASS, 176 .bInterfaceProtocol = ADB_PROTOCOL, 177 .iInterface = 1, /* first string from the provided table */ 178 }, 179 .source = { 180 .bLength = sizeof(ss_descriptors.source), 181 .bDescriptorType = USB_DT_ENDPOINT, 182 .bEndpointAddress = 1 | USB_DIR_OUT, 183 .bmAttributes = USB_ENDPOINT_XFER_BULK, 184 .wMaxPacketSize = MAX_PACKET_SIZE_SS, 185 }, 186 .source_comp = { 187 .bLength = sizeof(ss_descriptors.source_comp), 188 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, 189 .bMaxBurst = 4, 190 }, 191 .sink = { 192 .bLength = sizeof(ss_descriptors.sink), 193 .bDescriptorType = USB_DT_ENDPOINT, 194 .bEndpointAddress = 2 | USB_DIR_IN, 195 .bmAttributes = USB_ENDPOINT_XFER_BULK, 196 .wMaxPacketSize = MAX_PACKET_SIZE_SS, 197 }, 198 .sink_comp = { 199 .bLength = sizeof(ss_descriptors.sink_comp), 200 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, 201 .bMaxBurst = 4, 202 }, 203 }; 204 205 struct usb_ext_compat_desc os_desc_compat = { 206 .bFirstInterfaceNumber = 0, 207 .Reserved1 = cpu_to_le32(1), 208 .CompatibleID = { 'W', 'I', 'N', 'U', 'S', 'B', '\0', '\0'}, 209 .SubCompatibleID = {0}, 210 .Reserved2 = {0}, 211 }; 212 213 static struct usb_os_desc_header os_desc_header = { 214 .interface = cpu_to_le32(0), 215 .dwLength = cpu_to_le32(sizeof(os_desc_header) + sizeof(os_desc_compat)), 216 .bcdVersion = cpu_to_le32(1), 217 .wIndex = cpu_to_le32(4), 218 .bCount = cpu_to_le32(1), 219 .Reserved = cpu_to_le32(0), 220 }; 221 222 static struct usb_os_desc_header os_prop_header = { 223 .interface = cpu_to_le32(0), 224 .dwLength = cpu_to_le32(sizeof(os_desc_header) + sizeof(os_prop_values)), 225 .bcdVersion = cpu_to_le32(1), 226 .wIndex = cpu_to_le32(5), 227 .wCount = cpu_to_le16(1), 228 }; 229 230 #define STR_INTERFACE_ "ADB Interface" 231 232 static const struct { 233 struct usb_functionfs_strings_head header; 234 struct { 235 __le16 code; 236 const char str1[sizeof(STR_INTERFACE_)]; 237 } __attribute__((packed)) lang0; 238 } __attribute__((packed)) strings = { 239 .header = { 240 .magic = cpu_to_le32(FUNCTIONFS_STRINGS_MAGIC), 241 .length = cpu_to_le32(sizeof(strings)), 242 .str_count = cpu_to_le32(1), 243 .lang_count = cpu_to_le32(1), 244 }, 245 .lang0 = { 246 cpu_to_le16(0x0409), /* en-us */ 247 STR_INTERFACE_, 248 }, 249 }; 250 // clang-format on 251 252 bool open_functionfs(android::base::unique_fd* out_control, android::base::unique_fd* out_bulk_out, 253 android::base::unique_fd* out_bulk_in) { 254 unique_fd control, bulk_out, bulk_in; 255 struct desc_v1 v1_descriptor = {}; 256 struct desc_v2 v2_descriptor = {}; 257 258 v2_descriptor.header.magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC_V2); 259 v2_descriptor.header.length = cpu_to_le32(sizeof(v2_descriptor)); 260 v2_descriptor.header.flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC | 261 FUNCTIONFS_HAS_SS_DESC | FUNCTIONFS_HAS_MS_OS_DESC; 262 v2_descriptor.fs_count = 3; 263 v2_descriptor.hs_count = 3; 264 v2_descriptor.ss_count = 5; 265 v2_descriptor.os_count = 2; 266 v2_descriptor.fs_descs = fs_descriptors; 267 v2_descriptor.hs_descs = hs_descriptors; 268 v2_descriptor.ss_descs = ss_descriptors; 269 v2_descriptor.os_header = os_desc_header; 270 v2_descriptor.os_desc = os_desc_compat; 271 v2_descriptor.os_prop_header = os_prop_header; 272 v2_descriptor.os_prop_values = os_prop_values; 273 274 if (out_control->get() < 0) { // might have already done this before 275 LOG(INFO) << "opening control endpoint " << USB_FFS_ADB_EP0; 276 control.reset(adb_open(USB_FFS_ADB_EP0, O_RDWR)); 277 if (control < 0) { 278 PLOG(ERROR) << "cannot open control endpoint " << USB_FFS_ADB_EP0; 279 return false; 280 } 281 282 if (adb_write(control.get(), &v2_descriptor, sizeof(v2_descriptor)) < 0) { 283 D("[ %s: Switching to V1_descriptor format errno=%s ]", USB_FFS_ADB_EP0, 284 strerror(errno)); 285 v1_descriptor.header.magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC); 286 v1_descriptor.header.length = cpu_to_le32(sizeof(v1_descriptor)); 287 v1_descriptor.header.fs_count = 3; 288 v1_descriptor.header.hs_count = 3; 289 v1_descriptor.fs_descs = fs_descriptors; 290 v1_descriptor.hs_descs = hs_descriptors; 291 if (adb_write(control.get(), &v1_descriptor, sizeof(v1_descriptor)) < 0) { 292 PLOG(ERROR) << "failed to write USB descriptors"; 293 return false; 294 } 295 } 296 297 if (adb_write(control.get(), &strings, sizeof(strings)) < 0) { 298 PLOG(ERROR) << "failed to write USB strings"; 299 return false; 300 } 301 // Signal only when writing the descriptors to ffs 302 android::base::SetProperty("sys.usb.ffs.ready", "1"); 303 } 304 305 bulk_out.reset(adb_open(USB_FFS_ADB_OUT, O_RDONLY)); 306 if (bulk_out < 0) { 307 PLOG(ERROR) << "cannot open bulk-out endpoint " << USB_FFS_ADB_OUT; 308 return false; 309 } 310 311 bulk_in.reset(adb_open(USB_FFS_ADB_IN, O_WRONLY)); 312 if (bulk_in < 0) { 313 PLOG(ERROR) << "cannot open bulk-in endpoint " << USB_FFS_ADB_IN; 314 return false; 315 } 316 317 *out_control = std::move(control); 318 *out_bulk_in = std::move(bulk_in); 319 *out_bulk_out = std::move(bulk_out); 320 return true; 321 } 322