src/chrome/browser/devtools/adb/android_usb_device.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/devtools/adb/android_usb_device.h"
   6
   7 #include <set>
   8
   9 #include "base/barrier_closure.h"
  10 #include "base/base64.h"
  11 #include "base/lazy_instance.h"
  12 #include "base/message_loop/message_loop.h"
  13 #include "base/stl_util.h"
  14 #include "base/strings/string_util.h"
  15 #include "base/strings/stringprintf.h"
  16 #include "chrome/browser/devtools/adb/android_rsa.h"
  17 #include "chrome/browser/devtools/adb/android_usb_socket.h"
  18 #include "chrome/browser/usb/usb_device.h"
  19 #include "chrome/browser/usb/usb_interface.h"
  20 #include "chrome/browser/usb/usb_service.h"
  21 #include "content/public/browser/browser_thread.h"
  22 #include "crypto/rsa_private_key.h"
  23 #include "net/base/ip_endpoint.h"
  24 #include "net/base/net_errors.h"
  25 #include "net/socket/stream_socket.h"
  26
  27 namespace {
  28
  29 const size_t kHeaderSize = 24;
  30
  31 const int kAdbClass = 0xff;
  32 const int kAdbSubclass = 0x42;
  33 const int kAdbProtocol = 0x1;
  34
  35 const int kUsbTimeout = 0;
  36
  37 const uint32 kMaxPayload = 4096;
  38 const uint32 kVersion = 0x01000000;
  39
  40 static const char kHostConnectMessage[] = "host::";
  41
  42 using content::BrowserThread;
  43
  44 typedef std::vector<scoped_refptr<UsbDevice> > UsbDevices;
  45 typedef std::set<scoped_refptr<UsbDevice> > UsbDeviceSet;
  46
  47 base::LazyInstance<AndroidUsbDevices>::Leaky g_devices =
  48     LAZY_INSTANCE_INITIALIZER;
  49
  50 bool IsAndroidInterface(
  51     scoped_refptr<const UsbInterfaceDescriptor> interface) {
  52   if (interface->GetNumAltSettings() == 0)
  53     return false;
  54
  55   scoped_refptr<const UsbInterfaceAltSettingDescriptor> idesc =
  56       interface->GetAltSetting(0);
  57
  58   if (idesc->GetInterfaceClass() != kAdbClass ||
  59       idesc->GetInterfaceSubclass() != kAdbSubclass ||
  60       idesc->GetInterfaceProtocol() != kAdbProtocol ||
  61       idesc->GetNumEndpoints() != 2) {
  62     return false;
  63   }
  64   return true;
  65 }
  66
  67 scoped_refptr<AndroidUsbDevice> ClaimInterface(
  68     crypto::RSAPrivateKey* rsa_key,
  69     scoped_refptr<UsbDeviceHandle> usb_handle,
  70     scoped_refptr<const UsbInterfaceDescriptor> interface,
  71     int interface_id) {
  72   scoped_refptr<const UsbInterfaceAltSettingDescriptor> idesc =
  73       interface->GetAltSetting(0);
  74
  75   int inbound_address = 0;
  76   int outbound_address = 0;
  77   int zero_mask = 0;
  78
  79   for (size_t i = 0; i < idesc->GetNumEndpoints(); ++i) {
  80     scoped_refptr<const UsbEndpointDescriptor> edesc =
  81         idesc->GetEndpoint(i);
  82     if (edesc->GetTransferType() != USB_TRANSFER_BULK)
  83       continue;
  84     if (edesc->GetDirection() == USB_DIRECTION_INBOUND)
  85       inbound_address = edesc->GetAddress();
  86     else
  87       outbound_address = edesc->GetAddress();
  88     zero_mask = edesc->GetMaximumPacketSize() - 1;
  89   }
  90
  91   if (inbound_address == 0 || outbound_address == 0)
  92     return NULL;
  93
  94   if (!usb_handle->ClaimInterface(interface_id))
  95     return NULL;
  96
  97   base::string16 serial;
  98   if (!usb_handle->GetSerial(&serial) || serial.empty())
  99     return NULL;
 100
 101   return new AndroidUsbDevice(rsa_key, usb_handle, UTF16ToASCII(serial),
 102                               inbound_address, outbound_address, zero_mask);
 103 }
 104
 105 uint32 Checksum(const std::string& data) {
 106   unsigned char* x = (unsigned char*)data.data();
 107   int count = data.length();
 108   uint32 sum = 0;
 109   while (count-- > 0)
 110     sum += *x++;
 111   return sum;
 112 }
 113
 114 void DumpMessage(bool outgoing, const char* data, size_t length) {
 115 #if 0
 116   std::string result = "";
 117   if (length == kHeaderSize) {
 118     for (size_t i = 0; i < 24; ++i) {
 119       result += base::StringPrintf("%02x",
 120           data[i] > 0 ? data[i] : (data[i] + 0x100) & 0xFF);
 121       if ((i + 1) % 4 == 0)
 122         result += " ";
 123     }
 124     for (size_t i = 0; i < 24; ++i) {
 125       if (data[i] >= 0x20 && data[i] <= 0x7E)
 126         result += data[i];
 127       else
 128         result += ".";
 129     }
 130   } else {
 131     result = base::StringPrintf("%d: ", (int)length);
 132     for (size_t i = 0; i < length; ++i) {
 133       if (data[i] >= 0x20 && data[i] <= 0x7E)
 134         result += data[i];
 135       else
 136         result += ".";
 137     }
 138   }
 139   LOG(ERROR) << (outgoing ? "[out] " : "[ in] ") << result;
 140 #endif  // 0
 141 }
 142
 143 void ReleaseInterface(scoped_refptr<UsbDeviceHandle> usb_device) {
 144   usb_device->ReleaseInterface(1);
 145   usb_device->Close();
 146 }
 147
 148 }  // namespace
 149
 150 AdbMessage::AdbMessage(uint32 command,
 151                        uint32 arg0,
 152                        uint32 arg1,
 153                        const std::string& body)
 154     : command(command),
 155       arg0(arg0),
 156       arg1(arg1),
 157       body(body) {
 158 }
 159
 160 AdbMessage::~AdbMessage() {
 161 }
 162
 163 static void RespondWithCountOnUIThread(base::Callback<void(int)> callback,
 164                                        int count) {
 165   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 166   callback.Run(count);
 167 }
 168
 169 static void RespondOnUIThread(const AndroidUsbDevicesCallback& callback,
 170                               const AndroidUsbDevices& devices) {
 171   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 172   callback.Run(devices);
 173 }
 174
 175 static void RespondOnFileThread(const AndroidUsbDevicesCallback& callback) {
 176   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
 177   // Copy g_devices.Get() on file thread.
 178   BrowserThread::PostTask(
 179       BrowserThread::UI, FROM_HERE,
 180       base::Bind(&RespondOnUIThread, callback, g_devices.Get()));
 181 }
 182
 183 static void OpenAndroidDevicesOnFileThread(
 184     crypto::RSAPrivateKey* rsa_key,
 185     const base::Closure& barrier,
 186     scoped_refptr<UsbDevice> device,
 187     int interface_id,
 188     bool success) {
 189   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
 190   if (success) {
 191     scoped_refptr<UsbConfigDescriptor> config = device->ListInterfaces();
 192     scoped_refptr<UsbDeviceHandle> usb_handle = device->Open();
 193     if (usb_handle) {
 194       scoped_refptr<AndroidUsbDevice> device =
 195         ClaimInterface(rsa_key, usb_handle, config->GetInterface(interface_id),
 196                        interface_id);
 197       if (device.get())
 198         g_devices.Get().push_back(device);
 199       else
 200         usb_handle->Close();
 201     }
 202   }
 203   barrier.Run();
 204 }
 205
 206 static void CountOnFileThread(
 207     const base::Callback<void(int)>& callback) {
 208   UsbService* service = UsbService::GetInstance();
 209   UsbDevices usb_devices;
 210   service->GetDevices(&usb_devices);
 211   int device_count = 0;
 212   for (UsbDevices::iterator it = usb_devices.begin(); it != usb_devices.end();
 213        ++it) {
 214     scoped_refptr<UsbConfigDescriptor> config = (*it)->ListInterfaces();
 215     if (!config)
 216       continue;
 217
 218     for (size_t j = 0; j < config->GetNumInterfaces(); ++j) {
 219       if (IsAndroidInterface(config->GetInterface(j)))
 220         ++device_count;
 221     }
 222   }
 223   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 224                           base::Bind(&RespondWithCountOnUIThread, callback,
 225                                      device_count));
 226 }
 227
 228 static void EnumerateOnFileThread(crypto::RSAPrivateKey* rsa_key,
 229                                   const AndroidUsbDevicesCallback& callback) {
 230   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
 231
 232   UsbService* service = UsbService::GetInstance();
 233   UsbDevices usb_devices;
 234   service->GetDevices(&usb_devices);
 235
 236   AndroidUsbDevices& devices = g_devices.Get();
 237
 238   // GC Android devices with no actual usb device.
 239   AndroidUsbDevices::iterator it = devices.begin();
 240   UsbDeviceSet claimed_devices;
 241   while (it != devices.end()) {
 242     bool found_device = false;
 243     for (UsbDevices::iterator it2 = usb_devices.begin();
 244          it2 != usb_devices.end() && !found_device; ++it2) {
 245       UsbDevice* usb_device = it2->get();
 246       AndroidUsbDevice* device = it->get();
 247       if (usb_device == device->usb_device()->device()) {
 248         found_device = true;
 249         claimed_devices.insert(usb_device);
 250       }
 251     }
 252
 253     if (!found_device)
 254       it = devices.erase(it);
 255     else
 256       ++it;
 257   }
 258
 259   // Add new devices.
 260   base::Closure barrier = base::BarrierClosure(
 261       usb_devices.size(), base::Bind(&RespondOnFileThread, callback));
 262
 263   for (UsbDevices::iterator it = usb_devices.begin(); it != usb_devices.end();
 264        ++it) {
 265     if (ContainsKey(claimed_devices, it->get())) {
 266       barrier.Run();
 267       continue;
 268     }
 269
 270     scoped_refptr<UsbConfigDescriptor> config = (*it)->ListInterfaces();
 271     if (!config) {
 272       barrier.Run();
 273       continue;
 274     }
 275
 276     bool has_android_interface = false;
 277     for (size_t j = 0; j < config->GetNumInterfaces(); ++j) {
 278       if (!IsAndroidInterface(config->GetInterface(j)))
 279         continue;
 280
 281       // Request permission on Chrome OS.
 282 #if defined(OS_CHROMEOS)
 283       (*it)->RequestUsbAcess(j, base::Bind(&OpenAndroidDevicesOnFileThread,
 284                                            rsa_key, barrier, *it, j));
 285 #else
 286       OpenAndroidDevicesOnFileThread(rsa_key, barrier, *it, j, true);
 287 #endif  // defined(OS_CHROMEOS)
 288
 289       has_android_interface = true;
 290       break;
 291     }
 292     if (!has_android_interface)
 293       barrier.Run();
 294   }
 295 }
 296
 297 // static
 298 void AndroidUsbDevice::CountDevices(
 299     const base::Callback<void(int)>& callback) {
 300   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 301   BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
 302                           base::Bind(&CountOnFileThread, callback));
 303 }
 304
 305 // static
 306 void AndroidUsbDevice::Enumerate(crypto::RSAPrivateKey* rsa_key,
 307                                  const AndroidUsbDevicesCallback& callback) {
 308   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 309   BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
 310                           base::Bind(&EnumerateOnFileThread, rsa_key,
 311                                      callback));
 312 }
 313
 314 AndroidUsbDevice::AndroidUsbDevice(crypto::RSAPrivateKey* rsa_key,
 315                                    scoped_refptr<UsbDeviceHandle> usb_device,
 316                                    const std::string& serial,
 317                                    int inbound_address,
 318                                    int outbound_address,
 319                                    int zero_mask)
 320     : message_loop_(NULL),
 321       rsa_key_(rsa_key->Copy()),
 322       usb_device_(usb_device),
 323       serial_(serial),
 324       inbound_address_(inbound_address),
 325       outbound_address_(outbound_address),
 326       zero_mask_(zero_mask),
 327       is_connected_(false),
 328       signature_sent_(false),
 329       last_socket_id_(256),
 330       terminated_(false) {
 331 }
 332
 333 void AndroidUsbDevice::InitOnCallerThread() {
 334   if (message_loop_)
 335     return;
 336   message_loop_ = base::MessageLoop::current();
 337   Queue(new AdbMessage(AdbMessage::kCommandCNXN, kVersion, kMaxPayload,
 338                        kHostConnectMessage));
 339   ReadHeader(true);
 340 }
 341
 342 net::StreamSocket* AndroidUsbDevice::CreateSocket(const std::string& command) {
 343   uint32 socket_id = ++last_socket_id_;
 344   sockets_[socket_id] = new AndroidUsbSocket(this, socket_id, command,
 345       base::Bind(&AndroidUsbDevice::SocketDeleted, this));
 346   return sockets_[socket_id];
 347 }
 348
 349 void AndroidUsbDevice::Send(uint32 command,
 350                             uint32 arg0,
 351                             uint32 arg1,
 352                             const std::string& body) {
 353   scoped_refptr<AdbMessage> m = new AdbMessage(command, arg0, arg1, body);
 354   // Delay open request if not yet connected.
 355   if (!is_connected_) {
 356     pending_messages_.push_back(m);
 357     return;
 358   }
 359   Queue(m);
 360 }
 361
 362 AndroidUsbDevice::~AndroidUsbDevice() {
 363   Terminate();
 364   usb_device_->AddRef();
 365   BrowserThread::ReleaseSoon(BrowserThread::FILE, FROM_HERE,
 366                              usb_device_.get());
 367 }
 368
 369 void AndroidUsbDevice::Queue(scoped_refptr<AdbMessage> message) {
 370   // Queue header.
 371   std::vector<uint32> header;
 372   header.push_back(message->command);
 373   header.push_back(message->arg0);
 374   header.push_back(message->arg1);
 375   bool append_zero = true;
 376   if (message->body.empty())
 377     append_zero = false;
 378   if (message->command == AdbMessage::kCommandAUTH &&
 379       message->arg0 == AdbMessage::kAuthSignature)
 380     append_zero = false;
 381   if (message->command == AdbMessage::kCommandWRTE)
 382     append_zero = false;
 383
 384   size_t body_length = message->body.length() + (append_zero ? 1 : 0);
 385   header.push_back(body_length);
 386   header.push_back(Checksum(message->body));
 387   header.push_back(message->command ^ 0xffffffff);
 388   scoped_refptr<net::IOBuffer> header_buffer = new net::IOBuffer(kHeaderSize);
 389   memcpy(header_buffer.get()->data(), &header[0], kHeaderSize);
 390   outgoing_queue_.push(std::make_pair(header_buffer, kHeaderSize));
 391
 392   // Queue body.
 393   if (!message->body.empty()) {
 394     scoped_refptr<net::IOBuffer> body_buffer = new net::IOBuffer(body_length);
 395     memcpy(body_buffer->data(), message->body.data(), message->body.length());
 396     if (append_zero)
 397       body_buffer->data()[body_length - 1] = 0;
 398     outgoing_queue_.push(std::make_pair(body_buffer, body_length));
 399     if (zero_mask_ && (body_length & zero_mask_) == 0) {
 400       // Send a zero length packet.
 401       outgoing_queue_.push(std::make_pair(body_buffer, 0));
 402     }
 403   }
 404   ProcessOutgoing();
 405 }
 406
 407 void AndroidUsbDevice::ProcessOutgoing() {
 408   if (outgoing_queue_.empty() || terminated_)
 409     return;
 410
 411   BulkMessage message = outgoing_queue_.front();
 412   outgoing_queue_.pop();
 413   DumpMessage(true, message.first->data(), message.second);
 414   usb_device_->BulkTransfer(USB_DIRECTION_OUTBOUND, outbound_address_,
 415       message.first, message.second, kUsbTimeout,
 416       base::Bind(&AndroidUsbDevice::OutgoingMessageSent, this));
 417 }
 418
 419 void AndroidUsbDevice::OutgoingMessageSent(UsbTransferStatus status,
 420                                            scoped_refptr<net::IOBuffer> buffer,
 421                                            size_t result) {
 422   if (status != USB_TRANSFER_COMPLETED)
 423     return;
 424   message_loop_->PostTask(FROM_HERE,
 425                           base::Bind(&AndroidUsbDevice::ProcessOutgoing,
 426                                      this));
 427 }
 428
 429 void AndroidUsbDevice::ReadHeader(bool initial) {
 430   if (terminated_)
 431     return;
 432   if (!initial && HasOneRef())
 433     return;  // Stop polling.
 434   scoped_refptr<net::IOBuffer> buffer = new net::IOBuffer(kHeaderSize);
 435   usb_device_->BulkTransfer(USB_DIRECTION_INBOUND, inbound_address_,
 436       buffer, kHeaderSize, kUsbTimeout,
 437       base::Bind(&AndroidUsbDevice::ParseHeader, this));
 438 }
 439
 440 void AndroidUsbDevice::ParseHeader(UsbTransferStatus status,
 441                                    scoped_refptr<net::IOBuffer> buffer,
 442                                    size_t result) {
 443   if (status == USB_TRANSFER_TIMEOUT) {
 444     message_loop_->PostTask(FROM_HERE,
 445                             base::Bind(&AndroidUsbDevice::ReadHeader, this,
 446                                        false));
 447     return;
 448   }
 449
 450   if (status != USB_TRANSFER_COMPLETED || result != kHeaderSize) {
 451     TransferError(status);
 452     return;
 453   }
 454
 455   DumpMessage(false, buffer->data(), result);
 456   std::vector<uint32> header(6);
 457   memcpy(&header[0], buffer->data(), result);
 458   scoped_refptr<AdbMessage> message =
 459       new AdbMessage(header[0], header[1], header[2], "");
 460   uint32 data_length = header[3];
 461   uint32 data_check = header[4];
 462   uint32 magic = header[5];
 463   if ((message->command ^ 0xffffffff) != magic) {
 464     TransferError(USB_TRANSFER_ERROR);
 465     return;
 466   }
 467
 468   if (data_length == 0) {
 469     message_loop_->PostTask(FROM_HERE,
 470                             base::Bind(&AndroidUsbDevice::HandleIncoming, this,
 471                                        message));
 472     return;
 473   }
 474
 475   message_loop_->PostTask(FROM_HERE,
 476                           base::Bind(&AndroidUsbDevice::ReadBody, this,
 477                                      message, data_length, data_check));
 478 }
 479
 480 void AndroidUsbDevice::ReadBody(scoped_refptr<AdbMessage> message,
 481                                 uint32 data_length,
 482                                 uint32 data_check) {
 483   scoped_refptr<net::IOBuffer> buffer = new net::IOBuffer(data_length);
 484   usb_device_->BulkTransfer(USB_DIRECTION_INBOUND, inbound_address_,
 485       buffer, data_length, kUsbTimeout,
 486       base::Bind(&AndroidUsbDevice::ParseBody, this, message, data_length,
 487                  data_check));
 488 }
 489
 490 void AndroidUsbDevice::ParseBody(scoped_refptr<AdbMessage> message,
 491                                  uint32 data_length,
 492                                  uint32 data_check,
 493                                  UsbTransferStatus status,
 494                                  scoped_refptr<net::IOBuffer> buffer,
 495                                  size_t result) {
 496   if (status == USB_TRANSFER_TIMEOUT) {
 497     message_loop_->PostTask(FROM_HERE,
 498                             base::Bind(&AndroidUsbDevice::ReadBody, this,
 499                             message, data_length, data_check));
 500     return;
 501   }
 502
 503   if (status != USB_TRANSFER_COMPLETED ||
 504       static_cast<uint32>(result) != data_length) {
 505     TransferError(status);
 506     return;
 507   }
 508
 509   DumpMessage(false, buffer->data(), data_length);
 510   message->body = std::string(buffer->data(), result);
 511   if (Checksum(message->body) != data_check) {
 512     TransferError(USB_TRANSFER_ERROR);
 513     return;
 514   }
 515
 516   message_loop_->PostTask(FROM_HERE,
 517                           base::Bind(&AndroidUsbDevice::HandleIncoming, this,
 518                                      message));
 519 }
 520
 521 void AndroidUsbDevice::HandleIncoming(scoped_refptr<AdbMessage> message) {
 522   switch (message->command) {
 523     case AdbMessage::kCommandAUTH:
 524       {
 525         DCHECK_EQ(message->arg0, static_cast<uint32>(AdbMessage::kAuthToken));
 526         if (signature_sent_) {
 527           Queue(new AdbMessage(AdbMessage::kCommandAUTH,
 528                                AdbMessage::kAuthRSAPublicKey, 0,
 529                                AndroidRSAPublicKey(rsa_key_.get())));
 530         } else {
 531           signature_sent_ = true;
 532           std::string signature = AndroidRSASign(rsa_key_.get(), message->body);
 533           if (!signature.empty()) {
 534             Queue(new AdbMessage(AdbMessage::kCommandAUTH,
 535                                  AdbMessage::kAuthSignature, 0,
 536                                  signature));
 537           } else {
 538             Queue(new AdbMessage(AdbMessage::kCommandAUTH,
 539                                  AdbMessage::kAuthRSAPublicKey, 0,
 540                                  AndroidRSAPublicKey(rsa_key_.get())));
 541           }
 542         }
 543       }
 544       break;
 545     case AdbMessage::kCommandCNXN:
 546       {
 547         is_connected_ = true;
 548         PendingMessages pending;
 549         pending.swap(pending_messages_);
 550         for (PendingMessages::iterator it = pending.begin();
 551              it != pending.end(); ++it) {
 552           Queue(*it);
 553         }
 554       }
 555       break;
 556     case AdbMessage::kCommandOKAY:
 557     case AdbMessage::kCommandWRTE:
 558     case AdbMessage::kCommandCLSE:
 559       {
 560         AndroidUsbSockets::iterator it = sockets_.find(message->arg1);
 561         if (it != sockets_.end())
 562           it->second->HandleIncoming(message);
 563       }
 564       break;
 565     default:
 566       break;
 567   }
 568   ReadHeader(false);
 569 }
 570
 571 void AndroidUsbDevice::TransferError(UsbTransferStatus status) {
 572   message_loop_->PostTask(FROM_HERE,
 573                           base::Bind(&AndroidUsbDevice::Terminate,
 574                                      this));
 575 }
 576
 577 void AndroidUsbDevice::Terminate() {
 578   if (terminated_)
 579     return;
 580
 581   terminated_ = true;
 582
 583   // Iterate over copy.
 584   AndroidUsbSockets sockets(sockets_);
 585   for (AndroidUsbSockets::iterator it = sockets.begin();
 586        it != sockets.end(); ++it) {
 587     it->second->Terminated();
 588   }
 589
 590   BrowserThread::PostTask(
 591       BrowserThread::FILE, FROM_HERE,
 592       base::Bind(&ReleaseInterface, usb_device_));
 593 }
 594
 595 void AndroidUsbDevice::SocketDeleted(uint32 socket_id) {
 596   sockets_.erase(socket_id);
 597 }