1 /*
2  * Copyright (C) 2007 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define TRACE_TAG TRACE_TRANSPORT
18 
19 #include "sysdeps.h"
20 #include "transport.h"
21 
22 #include <errno.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <sys/types.h>
27 
28 #include <base/stringprintf.h>
29 
30 #if !ADB_HOST
31 #include "cutils/properties.h"
32 #endif
33 
34 #include "adb.h"
35 #include "adb_io.h"
36 
37 #if ADB_HOST
38 /* we keep a list of opened transports. The atransport struct knows to which
39  * local transport it is connected. The list is used to detect when we're
40  * trying to connect twice to a given local transport.
41  */
42 #define  ADB_LOCAL_TRANSPORT_MAX  64
43 
44 ADB_MUTEX_DEFINE( local_transports_lock );
45 
46 static atransport*  local_transports[ ADB_LOCAL_TRANSPORT_MAX ];
47 #endif /* ADB_HOST */
48 
remote_read(apacket * p,atransport * t)49 static int remote_read(apacket *p, atransport *t)
50 {
51     if(!ReadFdExactly(t->sfd, &p->msg, sizeof(amessage))){
52         D("remote local: read terminated (message)\n");
53         return -1;
54     }
55 
56     if(check_header(p)) {
57         D("bad header: terminated (data)\n");
58         return -1;
59     }
60 
61     if(!ReadFdExactly(t->sfd, p->data, p->msg.data_length)){
62         D("remote local: terminated (data)\n");
63         return -1;
64     }
65 
66     if(check_data(p)) {
67         D("bad data: terminated (data)\n");
68         return -1;
69     }
70 
71     return 0;
72 }
73 
remote_write(apacket * p,atransport * t)74 static int remote_write(apacket *p, atransport *t)
75 {
76     int   length = p->msg.data_length;
77 
78     if(!WriteFdExactly(t->sfd, &p->msg, sizeof(amessage) + length)) {
79         D("remote local: write terminated\n");
80         return -1;
81     }
82 
83     return 0;
84 }
85 
86 
local_connect(int port)87 int local_connect(int port) {
88     return local_connect_arbitrary_ports(port-1, port);
89 }
90 
local_connect_arbitrary_ports(int console_port,int adb_port)91 int local_connect_arbitrary_ports(int console_port, int adb_port)
92 {
93     int  fd = -1;
94 
95 #if ADB_HOST
96     const char *host = getenv("ADBHOST");
97     if (host) {
98         fd = socket_network_client(host, adb_port, SOCK_STREAM);
99     }
100 #endif
101     if (fd < 0) {
102         fd = socket_loopback_client(adb_port, SOCK_STREAM);
103     }
104 
105     if (fd >= 0) {
106         D("client: connected on remote on fd %d\n", fd);
107         close_on_exec(fd);
108         disable_tcp_nagle(fd);
109         std::string serial = android::base::StringPrintf("emulator-%d", console_port);
110         register_socket_transport(fd, serial.c_str(), adb_port, 1);
111         return 0;
112     }
113     return -1;
114 }
115 
116 
client_socket_thread(void * x)117 static void *client_socket_thread(void *x)
118 {
119 #if ADB_HOST
120     int  port  = DEFAULT_ADB_LOCAL_TRANSPORT_PORT;
121     int  count = ADB_LOCAL_TRANSPORT_MAX;
122 
123     D("transport: client_socket_thread() starting\n");
124 
125     /* try to connect to any number of running emulator instances     */
126     /* this is only done when ADB starts up. later, each new emulator */
127     /* will send a message to ADB to indicate that is is starting up  */
128     for ( ; count > 0; count--, port += 2 ) {
129         (void) local_connect(port);
130     }
131 #endif
132     return 0;
133 }
134 
server_socket_thread(void * arg)135 static void *server_socket_thread(void * arg)
136 {
137     int serverfd, fd;
138     struct sockaddr addr;
139     socklen_t alen;
140     int port = (int) (uintptr_t) arg;
141 
142     D("transport: server_socket_thread() starting\n");
143     serverfd = -1;
144     for(;;) {
145         if(serverfd == -1) {
146             serverfd = socket_inaddr_any_server(port, SOCK_STREAM);
147             if(serverfd < 0) {
148                 D("server: cannot bind socket yet: %s\n", strerror(errno));
149                 adb_sleep_ms(1000);
150                 continue;
151             }
152             close_on_exec(serverfd);
153         }
154 
155         alen = sizeof(addr);
156         D("server: trying to get new connection from %d\n", port);
157         fd = adb_socket_accept(serverfd, &addr, &alen);
158         if(fd >= 0) {
159             D("server: new connection on fd %d\n", fd);
160             close_on_exec(fd);
161             disable_tcp_nagle(fd);
162             register_socket_transport(fd, "host", port, 1);
163         }
164     }
165     D("transport: server_socket_thread() exiting\n");
166     return 0;
167 }
168 
169 /* This is relevant only for ADB daemon running inside the emulator. */
170 #if !ADB_HOST
171 /*
172  * Redefine open and write for qemu_pipe.h that contains inlined references
173  * to those routines. We will redifine them back after qemu_pipe.h inclusion.
174  */
175 #undef open
176 #undef write
177 #define open    adb_open
178 #define write   adb_write
179 #include <hardware/qemu_pipe.h>
180 #undef open
181 #undef write
182 #define open    ___xxx_open
183 #define write   ___xxx_write
184 
185 /* A worker thread that monitors host connections, and registers a transport for
186  * every new host connection. This thread replaces server_socket_thread on
187  * condition that adbd daemon runs inside the emulator, and emulator uses QEMUD
188  * pipe to communicate with adbd daemon inside the guest. This is done in order
189  * to provide more robust communication channel between ADB host and guest. The
190  * main issue with server_socket_thread approach is that it runs on top of TCP,
191  * and thus is sensitive to network disruptions. For instance, the
192  * ConnectionManager may decide to reset all network connections, in which case
193  * the connection between ADB host and guest will be lost. To make ADB traffic
194  * independent from the network, we use here 'adb' QEMUD service to transfer data
195  * between the host, and the guest. See external/qemu/android/adb-*.* that
196  * implements the emulator's side of the protocol. Another advantage of using
197  * QEMUD approach is that ADB will be up much sooner, since it doesn't depend
198  * anymore on network being set up.
199  * The guest side of the protocol contains the following phases:
200  * - Connect with adb QEMUD service. In this phase a handle to 'adb' QEMUD service
201  *   is opened, and it becomes clear whether or not emulator supports that
202  *   protocol.
203  * - Wait for the ADB host to create connection with the guest. This is done by
204  *   sending an 'accept' request to the adb QEMUD service, and waiting on
205  *   response.
206  * - When new ADB host connection is accepted, the connection with adb QEMUD
207  *   service is registered as the transport, and a 'start' request is sent to the
208  *   adb QEMUD service, indicating that the guest is ready to receive messages.
209  *   Note that the guest will ignore messages sent down from the emulator before
210  *   the transport registration is completed. That's why we need to send the
211  *   'start' request after the transport is registered.
212  */
qemu_socket_thread(void * arg)213 static void *qemu_socket_thread(void * arg)
214 {
215 /* 'accept' request to the adb QEMUD service. */
216 static const char _accept_req[] = "accept";
217 /* 'start' request to the adb QEMUD service. */
218 static const char _start_req[]  = "start";
219 /* 'ok' reply from the adb QEMUD service. */
220 static const char _ok_resp[]    = "ok";
221 
222     const int port = (int) (uintptr_t) arg;
223     int res, fd;
224     char tmp[256];
225     char con_name[32];
226 
227     D("transport: qemu_socket_thread() starting\n");
228 
229     /* adb QEMUD service connection request. */
230     snprintf(con_name, sizeof(con_name), "qemud:adb:%d", port);
231 
232     /* Connect to the adb QEMUD service. */
233     fd = qemu_pipe_open(con_name);
234     if (fd < 0) {
235         /* This could be an older version of the emulator, that doesn't
236          * implement adb QEMUD service. Fall back to the old TCP way. */
237         adb_thread_t thr;
238         D("adb service is not available. Falling back to TCP socket.\n");
239         adb_thread_create(&thr, server_socket_thread, arg);
240         return 0;
241     }
242 
243     for(;;) {
244         /*
245          * Wait till the host creates a new connection.
246          */
247 
248         /* Send the 'accept' request. */
249         res = adb_write(fd, _accept_req, strlen(_accept_req));
250         if ((size_t)res == strlen(_accept_req)) {
251             /* Wait for the response. In the response we expect 'ok' on success,
252              * or 'ko' on failure. */
253             res = adb_read(fd, tmp, sizeof(tmp));
254             if (res != 2 || memcmp(tmp, _ok_resp, 2)) {
255                 D("Accepting ADB host connection has failed.\n");
256                 adb_close(fd);
257             } else {
258                 /* Host is connected. Register the transport, and start the
259                  * exchange. */
260                 register_socket_transport(fd, "host", port, 1);
261                 adb_write(fd, _start_req, strlen(_start_req));
262             }
263 
264             /* Prepare for accepting of the next ADB host connection. */
265             fd = qemu_pipe_open(con_name);
266             if (fd < 0) {
267                 D("adb service become unavailable.\n");
268                 return 0;
269             }
270         } else {
271             D("Unable to send the '%s' request to ADB service.\n", _accept_req);
272             return 0;
273         }
274     }
275     D("transport: qemu_socket_thread() exiting\n");
276     return 0;
277 }
278 #endif  // !ADB_HOST
279 
local_init(int port)280 void local_init(int port)
281 {
282     adb_thread_t thr;
283     void* (*func)(void *);
284 
285     if(HOST) {
286         func = client_socket_thread;
287     } else {
288 #if ADB_HOST
289         func = server_socket_thread;
290 #else
291         /* For the adbd daemon in the system image we need to distinguish
292          * between the device, and the emulator. */
293         char is_qemu[PROPERTY_VALUE_MAX];
294         property_get("ro.kernel.qemu", is_qemu, "");
295         if (!strcmp(is_qemu, "1")) {
296             /* Running inside the emulator: use QEMUD pipe as the transport. */
297             func = qemu_socket_thread;
298         } else {
299             /* Running inside the device: use TCP socket as the transport. */
300             func = server_socket_thread;
301         }
302 #endif // !ADB_HOST
303     }
304 
305     D("transport: local %s init\n", HOST ? "client" : "server");
306 
307     if(adb_thread_create(&thr, func, (void *) (uintptr_t) port)) {
308         fatal_errno("cannot create local socket %s thread",
309                     HOST ? "client" : "server");
310     }
311 }
312 
remote_kick(atransport * t)313 static void remote_kick(atransport *t)
314 {
315     int fd = t->sfd;
316     t->sfd = -1;
317     adb_shutdown(fd);
318     adb_close(fd);
319 
320 #if ADB_HOST
321     if(HOST) {
322         int  nn;
323         adb_mutex_lock( &local_transports_lock );
324         for (nn = 0; nn < ADB_LOCAL_TRANSPORT_MAX; nn++) {
325             if (local_transports[nn] == t) {
326                 local_transports[nn] = NULL;
327                 break;
328             }
329         }
330         adb_mutex_unlock( &local_transports_lock );
331     }
332 #endif
333 }
334 
remote_close(atransport * t)335 static void remote_close(atransport *t)
336 {
337     adb_close(t->fd);
338 }
339 
340 
341 #if ADB_HOST
342 /* Only call this function if you already hold local_transports_lock. */
find_emulator_transport_by_adb_port_locked(int adb_port)343 atransport* find_emulator_transport_by_adb_port_locked(int adb_port)
344 {
345     int i;
346     for (i = 0; i < ADB_LOCAL_TRANSPORT_MAX; i++) {
347         if (local_transports[i] && local_transports[i]->adb_port == adb_port) {
348             return local_transports[i];
349         }
350     }
351     return NULL;
352 }
353 
find_emulator_transport_by_adb_port(int adb_port)354 atransport* find_emulator_transport_by_adb_port(int adb_port)
355 {
356     adb_mutex_lock( &local_transports_lock );
357     atransport* result = find_emulator_transport_by_adb_port_locked(adb_port);
358     adb_mutex_unlock( &local_transports_lock );
359     return result;
360 }
361 
362 /* Only call this function if you already hold local_transports_lock. */
get_available_local_transport_index_locked()363 int get_available_local_transport_index_locked()
364 {
365     int i;
366     for (i = 0; i < ADB_LOCAL_TRANSPORT_MAX; i++) {
367         if (local_transports[i] == NULL) {
368             return i;
369         }
370     }
371     return -1;
372 }
373 
get_available_local_transport_index()374 int get_available_local_transport_index()
375 {
376     adb_mutex_lock( &local_transports_lock );
377     int result = get_available_local_transport_index_locked();
378     adb_mutex_unlock( &local_transports_lock );
379     return result;
380 }
381 #endif
382 
init_socket_transport(atransport * t,int s,int adb_port,int local)383 int init_socket_transport(atransport *t, int s, int adb_port, int local)
384 {
385     int  fail = 0;
386 
387     t->kick = remote_kick;
388     t->close = remote_close;
389     t->read_from_remote = remote_read;
390     t->write_to_remote = remote_write;
391     t->sfd = s;
392     t->sync_token = 1;
393     t->connection_state = CS_OFFLINE;
394     t->type = kTransportLocal;
395     t->adb_port = 0;
396 
397 #if ADB_HOST
398     if (HOST && local) {
399         adb_mutex_lock( &local_transports_lock );
400         {
401             t->adb_port = adb_port;
402             atransport* existing_transport =
403                     find_emulator_transport_by_adb_port_locked(adb_port);
404             int index = get_available_local_transport_index_locked();
405             if (existing_transport != NULL) {
406                 D("local transport for port %d already registered (%p)?\n",
407                 adb_port, existing_transport);
408                 fail = -1;
409             } else if (index < 0) {
410                 // Too many emulators.
411                 D("cannot register more emulators. Maximum is %d\n",
412                         ADB_LOCAL_TRANSPORT_MAX);
413                 fail = -1;
414             } else {
415                 local_transports[index] = t;
416             }
417        }
418        adb_mutex_unlock( &local_transports_lock );
419     }
420 #endif
421     return fail;
422 }
423