1 /*
2  * Copyright (C) 2008 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <errno.h>
18 #include <stdio.h>
19 #include <sys/socket.h>
20 #include <sys/un.h>
21 #include <unistd.h>
22 
23 #include "base/logging.h"
24 #include "base/stringprintf.h"
25 #include "jdwp/jdwp_priv.h"
26 
27 #ifdef HAVE_ANDROID_OS
28 #include "cutils/sockets.h"
29 #endif
30 
31 /*
32  * The JDWP <-> ADB transport protocol is explained in detail
33  * in system/core/adb/jdwp_service.c. Here's a summary.
34  *
35  * 1/ when the JDWP thread starts, it tries to connect to a Unix
36  *    domain stream socket (@jdwp-control) that is opened by the
37  *    ADB daemon.
38  *
39  * 2/ it then sends the current process PID as a string of 4 hexadecimal
40  *    chars (no terminating zero)
41  *
42  * 3/ then, it uses recvmsg to receive file descriptors from the
43  *    daemon. each incoming file descriptor is a pass-through to
44  *    a given JDWP debugger, that can be used to read the usual
45  *    JDWP-handshake, etc...
46  */
47 
48 #define kJdwpControlName    "\0jdwp-control"
49 #define kJdwpControlNameLen (sizeof(kJdwpControlName)-1)
50 
51 namespace art {
52 
53 namespace JDWP {
54 
55 struct JdwpAdbState : public JdwpNetStateBase {
56  public:
JdwpAdbStateart::JDWP::JdwpAdbState57   explicit JdwpAdbState(JdwpState* state) : JdwpNetStateBase(state) {
58     control_sock_ = -1;
59     shutting_down_ = false;
60 
61     control_addr_.controlAddrUn.sun_family = AF_UNIX;
62     control_addr_len_ = sizeof(control_addr_.controlAddrUn.sun_family) + kJdwpControlNameLen;
63     memcpy(control_addr_.controlAddrUn.sun_path, kJdwpControlName, kJdwpControlNameLen);
64   }
65 
~JdwpAdbStateart::JDWP::JdwpAdbState66   ~JdwpAdbState() {
67     if (clientSock != -1) {
68       shutdown(clientSock, SHUT_RDWR);
69       close(clientSock);
70     }
71     if (control_sock_ != -1) {
72       shutdown(control_sock_, SHUT_RDWR);
73       close(control_sock_);
74     }
75   }
76 
77   virtual bool Accept();
78 
Establishart::JDWP::JdwpAdbState79   virtual bool Establish(const JdwpOptions*) {
80     return false;
81   }
82 
Shutdownart::JDWP::JdwpAdbState83   virtual void Shutdown() {
84     shutting_down_ = true;
85 
86     int control_sock = this->control_sock_;
87     int clientSock = this->clientSock;
88 
89     /* clear these out so it doesn't wake up and try to reuse them */
90     this->control_sock_ = this->clientSock = -1;
91 
92     if (clientSock != -1) {
93       shutdown(clientSock, SHUT_RDWR);
94     }
95 
96     if (control_sock != -1) {
97       shutdown(control_sock, SHUT_RDWR);
98     }
99 
100     WakePipe();
101   }
102 
103   virtual bool ProcessIncoming();
104 
105  private:
106   int ReceiveClientFd();
107 
108   int control_sock_;
109   bool shutting_down_;
110 
111   socklen_t control_addr_len_;
112   union {
113     sockaddr_un controlAddrUn;
114     sockaddr controlAddrPlain;
115   } control_addr_;
116 };
117 
118 /*
119  * Do initial prep work, e.g. binding to ports and opening files.  This
120  * runs in the main thread, before the JDWP thread starts, so it shouldn't
121  * do anything that might block forever.
122  */
InitAdbTransport(JdwpState * state,const JdwpOptions *)123 bool InitAdbTransport(JdwpState* state, const JdwpOptions*) {
124   VLOG(jdwp) << "ADB transport startup";
125   state->netState = new JdwpAdbState(state);
126   return (state->netState != NULL);
127 }
128 
129 /*
130  * Receive a file descriptor from ADB.  The fd can be used to communicate
131  * directly with a debugger or DDMS.
132  *
133  * Returns the file descriptor on success.  On failure, returns -1 and
134  * closes netState->control_sock_.
135  */
ReceiveClientFd()136 int JdwpAdbState::ReceiveClientFd() {
137   char dummy = '!';
138   union {
139     cmsghdr cm;
140     char buffer[CMSG_SPACE(sizeof(int))];
141   } cm_un;
142 
143   iovec iov;
144   iov.iov_base       = &dummy;
145   iov.iov_len        = 1;
146 
147   msghdr msg;
148   msg.msg_name       = NULL;
149   msg.msg_namelen    = 0;
150   msg.msg_iov        = &iov;
151   msg.msg_iovlen     = 1;
152   msg.msg_flags      = 0;
153   msg.msg_control    = cm_un.buffer;
154   msg.msg_controllen = sizeof(cm_un.buffer);
155 
156   cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
157   cmsg->cmsg_len   = msg.msg_controllen;
158   cmsg->cmsg_level = SOL_SOCKET;
159   cmsg->cmsg_type  = SCM_RIGHTS;
160   (reinterpret_cast<int*>(CMSG_DATA(cmsg)))[0] = -1;
161 
162   int rc = TEMP_FAILURE_RETRY(recvmsg(control_sock_, &msg, 0));
163 
164   if (rc <= 0) {
165     if (rc == -1) {
166       PLOG(WARNING) << "Receiving file descriptor from ADB failed (socket " << control_sock_ << ")";
167     }
168     close(control_sock_);
169     control_sock_ = -1;
170     return -1;
171   }
172 
173   return (reinterpret_cast<int*>(CMSG_DATA(cmsg)))[0];
174 }
175 
176 /*
177  * Block forever, waiting for a debugger to connect to us.  Called from the
178  * JDWP thread.
179  *
180  * This needs to un-block and return "false" if the VM is shutting down.  It
181  * should return "true" when it successfully accepts a connection.
182  */
Accept()183 bool JdwpAdbState::Accept() {
184   int retryCount = 0;
185 
186   /* first, ensure that we get a connection to the ADB daemon */
187 
188  retry:
189   if (shutting_down_) {
190     return false;
191   }
192 
193   if (control_sock_ == -1) {
194     int        sleep_ms     = 500;
195     const int  sleep_max_ms = 2*1000;
196     char       buff[5];
197 
198     control_sock_ = socket(PF_UNIX, SOCK_STREAM, 0);
199     if (control_sock_ < 0) {
200       PLOG(ERROR) << "Could not create ADB control socket";
201       return false;
202     }
203 
204     if (!MakePipe()) {
205       return false;
206     }
207 
208     snprintf(buff, sizeof(buff), "%04x", getpid());
209     buff[4] = 0;
210 
211     for (;;) {
212       /*
213        * If adbd isn't running, because USB debugging was disabled or
214        * perhaps the system is restarting it for "adb root", the
215        * connect() will fail.  We loop here forever waiting for it
216        * to come back.
217        *
218        * Waking up and polling every couple of seconds is generally a
219        * bad thing to do, but we only do this if the application is
220        * debuggable *and* adbd isn't running.  Still, for the sake
221        * of battery life, we should consider timing out and giving
222        * up after a few minutes in case somebody ships an app with
223        * the debuggable flag set.
224        */
225       int  ret = connect(control_sock_, &control_addr_.controlAddrPlain, control_addr_len_);
226       if (!ret) {
227 #ifdef HAVE_ANDROID_OS
228         if (!socket_peer_is_trusted(control_sock_)) {
229           if (shutdown(control_sock_, SHUT_RDWR)) {
230             PLOG(ERROR) << "trouble shutting down socket";
231           }
232           return false;
233         }
234 #endif
235 
236         /* now try to send our pid to the ADB daemon */
237         ret = TEMP_FAILURE_RETRY(send(control_sock_, buff, 4, 0));
238         if (ret >= 0) {
239           VLOG(jdwp) << StringPrintf("PID sent as '%.*s' to ADB", 4, buff);
240           break;
241         }
242 
243         PLOG(ERROR) << "Weird, can't send JDWP process pid to ADB";
244         return false;
245       }
246       if (VLOG_IS_ON(jdwp)) {
247         PLOG(ERROR) << "Can't connect to ADB control socket";
248       }
249 
250       usleep(sleep_ms * 1000);
251 
252       sleep_ms += (sleep_ms >> 1);
253       if (sleep_ms > sleep_max_ms) {
254         sleep_ms = sleep_max_ms;
255       }
256       if (shutting_down_) {
257         return false;
258       }
259     }
260   }
261 
262   VLOG(jdwp) << "trying to receive file descriptor from ADB";
263   /* now we can receive a client file descriptor */
264   clientSock = ReceiveClientFd();
265   if (shutting_down_) {
266     return false;       // suppress logs and additional activity
267   }
268   if (clientSock == -1) {
269     if (++retryCount > 5) {
270       LOG(ERROR) << "adb connection max retries exceeded";
271       return false;
272     }
273     goto retry;
274   } else {
275     VLOG(jdwp) << "received file descriptor " << clientSock << " from ADB";
276     SetAwaitingHandshake(true);
277     input_count_ = 0;
278     return true;
279   }
280 }
281 
282 /*
283  * Process incoming data.  If no data is available, this will block until
284  * some arrives.
285  *
286  * If we get a full packet, handle it.
287  *
288  * To take some of the mystery out of life, we want to reject incoming
289  * connections if we already have a debugger attached.  If we don't, the
290  * debugger will just mysteriously hang until it times out.  We could just
291  * close the listen socket, but there's a good chance we won't be able to
292  * bind to the same port again, which would confuse utilities.
293  *
294  * Returns "false" on error (indicating that the connection has been severed),
295  * "true" if things are still okay.
296  */
ProcessIncoming()297 bool JdwpAdbState::ProcessIncoming() {
298   int readCount;
299 
300   CHECK_NE(clientSock, -1);
301 
302   if (!HaveFullPacket()) {
303     /* read some more, looping until we have data */
304     errno = 0;
305     while (1) {
306       int selCount;
307       fd_set readfds;
308       int maxfd = -1;
309       int fd;
310 
311       FD_ZERO(&readfds);
312 
313       /* configure fds; note these may get zapped by another thread */
314       fd = control_sock_;
315       if (fd >= 0) {
316         FD_SET(fd, &readfds);
317         if (maxfd < fd) {
318           maxfd = fd;
319         }
320       }
321       fd = clientSock;
322       if (fd >= 0) {
323         FD_SET(fd, &readfds);
324         if (maxfd < fd) {
325           maxfd = fd;
326         }
327       }
328       fd = wake_pipe_[0];
329       if (fd >= 0) {
330         FD_SET(fd, &readfds);
331         if (maxfd < fd) {
332           maxfd = fd;
333         }
334       } else {
335         LOG(INFO) << "NOTE: entering select w/o wakepipe";
336       }
337 
338       if (maxfd < 0) {
339         VLOG(jdwp) << "+++ all fds are closed";
340         return false;
341       }
342 
343       /*
344        * Select blocks until it sees activity on the file descriptors.
345        * Closing the local file descriptor does not count as activity,
346        * so we can't rely on that to wake us up (it works for read()
347        * and accept(), but not select()).
348        *
349        * We can do one of three things: (1) send a signal and catch
350        * EINTR, (2) open an additional fd ("wake pipe") and write to
351        * it when it's time to exit, or (3) time out periodically and
352        * re-issue the select.  We're currently using #2, as it's more
353        * reliable than #1 and generally better than #3.  Wastes two fds.
354        */
355       selCount = select(maxfd+1, &readfds, NULL, NULL, NULL);
356       if (selCount < 0) {
357         if (errno == EINTR) {
358           continue;
359         }
360         PLOG(ERROR) << "select failed";
361         goto fail;
362       }
363 
364       if (wake_pipe_[0] >= 0 && FD_ISSET(wake_pipe_[0], &readfds)) {
365         VLOG(jdwp) << "Got wake-up signal, bailing out of select";
366         goto fail;
367       }
368       if (control_sock_ >= 0 && FD_ISSET(control_sock_, &readfds)) {
369         int  sock = ReceiveClientFd();
370         if (sock >= 0) {
371           LOG(INFO) << "Ignoring second debugger -- accepting and dropping";
372           close(sock);
373         } else {
374           CHECK_EQ(control_sock_, -1);
375           /*
376            * Remote side most likely went away, so our next read
377            * on clientSock will fail and throw us out of the loop.
378            */
379         }
380       }
381       if (clientSock >= 0 && FD_ISSET(clientSock, &readfds)) {
382         readCount = read(clientSock, input_buffer_ + input_count_, sizeof(input_buffer_) - input_count_);
383         if (readCount < 0) {
384           /* read failed */
385           if (errno != EINTR) {
386             goto fail;
387           }
388           VLOG(jdwp) << "+++ EINTR hit";
389           return true;
390         } else if (readCount == 0) {
391           /* EOF hit -- far end went away */
392           VLOG(jdwp) << "+++ peer disconnected";
393           goto fail;
394         } else {
395           break;
396         }
397       }
398     }
399 
400     input_count_ += readCount;
401     if (!HaveFullPacket()) {
402       return true;        /* still not there yet */
403     }
404   }
405 
406   /*
407    * Special-case the initial handshake.  For some bizarre reason we're
408    * expected to emulate bad tty settings by echoing the request back
409    * exactly as it was sent.  Note the handshake is always initiated by
410    * the debugger, no matter who connects to whom.
411    *
412    * Other than this one case, the protocol [claims to be] stateless.
413    */
414   if (IsAwaitingHandshake()) {
415     if (memcmp(input_buffer_, kMagicHandshake, kMagicHandshakeLen) != 0) {
416       LOG(ERROR) << StringPrintf("ERROR: bad handshake '%.14s'", input_buffer_);
417       goto fail;
418     }
419 
420     errno = 0;
421     int cc = TEMP_FAILURE_RETRY(write(clientSock, input_buffer_, kMagicHandshakeLen));
422     if (cc != kMagicHandshakeLen) {
423       PLOG(ERROR) << "Failed writing handshake bytes (" << cc << " of " << kMagicHandshakeLen << ")";
424       goto fail;
425     }
426 
427     ConsumeBytes(kMagicHandshakeLen);
428     SetAwaitingHandshake(false);
429     VLOG(jdwp) << "+++ handshake complete";
430     return true;
431   }
432 
433   /*
434    * Handle this packet.
435    */
436   return state_->HandlePacket();
437 
438  fail:
439   Close();
440   return false;
441 }
442 
443 }  // namespace JDWP
444 
445 }  // namespace art
446