blob: 4518a557de5d2f5c647dcde315b6ce48c6f87088 [file] [log] [blame]
David Brazdilafc9a9e2023-01-12 16:08:10 +00001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Implementation of the AIDL interface of the VirtualizationService.
16
David Brazdil33a31022023-01-12 16:55:16 +000017use crate::atom::{forward_vm_booted_atom, forward_vm_creation_atom, forward_vm_exited_atom};
David Drysdale79af2662024-02-19 14:50:31 +000018use crate::maintenance;
Alice Wange64dd182024-01-17 15:57:55 +000019use crate::remote_provisioning;
Alan Stokesac667072024-02-19 16:26:00 +000020use crate::rkpvm::{generate_ecdsa_p256_key_pair, request_attestation};
21use crate::{get_calling_pid, get_calling_uid, REMOTELY_PROVISIONED_COMPONENT_SERVICE_NAME};
David Brazdilafc9a9e2023-01-12 16:08:10 +000022use android_os_permissions_aidl::aidl::android::os::IPermissionController;
Alan Stokesac667072024-02-19 16:26:00 +000023use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon;
David Drysdale79af2662024-02-19 14:50:31 +000024use android_system_virtualizationmaintenance::aidl::android::system::virtualizationmaintenance;
Alan Stokesac667072024-02-19 16:26:00 +000025use android_system_virtualizationservice::aidl::android::system::virtualizationservice;
26use android_system_virtualizationservice_internal as android_vs_internal;
27use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice;
28use android_vs_internal::aidl::android::system::virtualizationservice_internal;
Alice Wangd1b11a02023-04-18 12:30:20 +000029use anyhow::{anyhow, ensure, Context, Result};
Jiyong Parkd7bd2f22023-08-10 20:41:19 +090030use avflog::LogResult;
Alan Stokesac667072024-02-19 16:26:00 +000031use binder::{
32 self, wait_for_interface, BinderFeatures, ExceptionCode, Interface, IntoBinderResult,
33 LazyServiceGuard, ParcelFileDescriptor, Status, Strong,
34};
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +000035use lazy_static::lazy_static;
David Brazdilafc9a9e2023-01-12 16:08:10 +000036use libc::VMADDR_CID_HOST;
37use log::{error, info, warn};
Alan Stokesac667072024-02-19 16:26:00 +000038use nix::unistd::{chown, Uid};
39use openssl::x509::X509;
Shikha Panwar61a74b52024-02-16 13:17:01 +000040use rand::Fill;
Alice Wangbff017f2023-11-09 14:43:28 +000041use rkpd_client::get_rkpd_attestation_key;
David Drysdalee64de8e2024-02-29 11:54:29 +000042use rustutils::{
43 system_properties,
44 users::{multiuser_get_app_id, multiuser_get_user_id},
45};
Inseob Kimc4a774d2023-08-30 12:48:43 +090046use serde::Deserialize;
Alan Stokesac667072024-02-19 16:26:00 +000047use service_vm_comm::Response;
Inseob Kimc4a774d2023-08-30 12:48:43 +090048use std::collections::{HashMap, HashSet};
David Brazdil2dfefd12023-11-17 14:07:36 +000049use std::fs::{self, create_dir, remove_dir_all, remove_file, set_permissions, File, Permissions};
David Brazdilafc9a9e2023-01-12 16:08:10 +000050use std::io::{Read, Write};
51use std::os::unix::fs::PermissionsExt;
52use std::os::unix::raw::{pid_t, uid_t};
Inseob Kim55438b22023-08-09 20:16:01 +090053use std::path::{Path, PathBuf};
David Brazdilafc9a9e2023-01-12 16:08:10 +000054use std::sync::{Arc, Mutex, Weak};
55use tombstoned_client::{DebuggerdDumpType, TombstonedConnection};
Alan Stokesac667072024-02-19 16:26:00 +000056use virtualizationcommon::Certificate::Certificate;
Alan Stokes30ccacb2024-02-20 14:59:02 +000057use virtualizationmaintenance::{
58 IVirtualizationMaintenance::IVirtualizationMaintenance,
59 IVirtualizationReconciliationCallback::IVirtualizationReconciliationCallback,
60};
Alan Stokesac667072024-02-19 16:26:00 +000061use virtualizationservice::{
62 AssignableDevice::AssignableDevice, VirtualMachineDebugInfo::VirtualMachineDebugInfo,
63};
64use virtualizationservice_internal::{
65 AtomVmBooted::AtomVmBooted,
66 AtomVmCreationRequested::AtomVmCreationRequested,
67 AtomVmExited::AtomVmExited,
68 IBoundDevice::IBoundDevice,
69 IGlobalVmContext::{BnGlobalVmContext, IGlobalVmContext},
70 IVfioHandler::VfioDev::VfioDev,
71 IVfioHandler::{BpVfioHandler, IVfioHandler},
David Drysdale79af2662024-02-19 14:50:31 +000072 IVirtualizationServiceInternal::IVirtualizationServiceInternal,
Alan Stokesac667072024-02-19 16:26:00 +000073};
74use virtualmachineservice::IVirtualMachineService::VM_TOMBSTONES_SERVICE_PORT;
David Brazdilafc9a9e2023-01-12 16:08:10 +000075use vsock::{VsockListener, VsockStream};
David Brazdilafc9a9e2023-01-12 16:08:10 +000076
77/// The unique ID of a VM used (together with a port number) for vsock communication.
78pub type Cid = u32;
79
David Brazdilafc9a9e2023-01-12 16:08:10 +000080/// Directory in which to write disk image files used while running VMs.
81pub const TEMPORARY_DIRECTORY: &str = "/data/misc/virtualizationservice";
82
83/// The first CID to assign to a guest VM managed by the VirtualizationService. CIDs lower than this
84/// are reserved for the host or other usage.
85const GUEST_CID_MIN: Cid = 2048;
86const GUEST_CID_MAX: Cid = 65535;
87
88const SYSPROP_LAST_CID: &str = "virtualizationservice.state.last_cid";
89
90const CHUNK_RECV_MAX_LEN: usize = 1024;
91
Alice Wange64dd182024-01-17 15:57:55 +000092/// The fake certificate is used for testing only when a client VM requests attestation in test
93/// mode, it is a single certificate extracted on an unregistered device for testing.
94/// Here is the snapshot of the certificate:
95///
96/// ```
97/// Certificate:
98/// Data:
99/// Version: 3 (0x2)
100/// Serial Number:
101/// 59:ae:50:98:95:e1:34:25:f1:21:93:c0:4c:e5:24:66
102/// Signature Algorithm: ecdsa-with-SHA256
103/// Issuer: CN = Droid Unregistered Device CA, O = Google Test LLC
104/// Validity
105/// Not Before: Feb 5 14:39:39 2024 GMT
106/// Not After : Feb 14 14:39:39 2024 GMT
107/// Subject: CN = 59ae509895e13425f12193c04ce52466, O = TEE
108/// Subject Public Key Info:
109/// Public Key Algorithm: id-ecPublicKey
110/// Public-Key: (256 bit)
111/// pub:
112/// 04:30:32:cd:95:12:b0:71:8b:b7:14:44:26:58:d5:
113/// 82:8c:25:55:2c:6d:ef:98:e3:4f:88:d0:74:82:09:
114/// 3e:8d:6c:f0:f2:18:d5:83:0e:0d:f2:ce:c5:15:38:
115/// e5:6a:e6:4d:4d:95:15:b7:24:e7:cb:4b:63:42:21:
116/// bc:36:c6:0a:d8
117/// ASN1 OID: prime256v1
118/// NIST CURVE: P-256
119/// X509v3 extensions:
120/// ...
121/// ```
122const FAKE_CERTIFICATE_FOR_TESTING: &[u8] = &[
123 0x30, 0x82, 0x01, 0xee, 0x30, 0x82, 0x01, 0x94, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x59,
124 0xae, 0x50, 0x98, 0x95, 0xe1, 0x34, 0x25, 0xf1, 0x21, 0x93, 0xc0, 0x4c, 0xe5, 0x24, 0x66, 0x30,
125 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x41, 0x31, 0x25, 0x30,
126 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1c, 0x44, 0x72, 0x6f, 0x69, 0x64, 0x20, 0x55, 0x6e,
127 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x20, 0x44, 0x65, 0x76, 0x69, 0x63,
128 0x65, 0x20, 0x43, 0x41, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0f, 0x47,
129 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x54, 0x65, 0x73, 0x74, 0x20, 0x4c, 0x4c, 0x43, 0x30, 0x1e,
130 0x17, 0x0d, 0x32, 0x34, 0x30, 0x32, 0x30, 0x35, 0x31, 0x34, 0x33, 0x39, 0x33, 0x39, 0x5a, 0x17,
131 0x0d, 0x32, 0x34, 0x30, 0x32, 0x31, 0x34, 0x31, 0x34, 0x33, 0x39, 0x33, 0x39, 0x5a, 0x30, 0x39,
132 0x31, 0x29, 0x30, 0x27, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x20, 0x35, 0x39, 0x61, 0x65, 0x35,
133 0x30, 0x39, 0x38, 0x39, 0x35, 0x65, 0x31, 0x33, 0x34, 0x32, 0x35, 0x66, 0x31, 0x32, 0x31, 0x39,
134 0x33, 0x63, 0x30, 0x34, 0x63, 0x65, 0x35, 0x32, 0x34, 0x36, 0x36, 0x31, 0x0c, 0x30, 0x0a, 0x06,
135 0x03, 0x55, 0x04, 0x0a, 0x13, 0x03, 0x54, 0x45, 0x45, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a,
136 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07,
137 0x03, 0x42, 0x00, 0x04, 0x30, 0x32, 0xcd, 0x95, 0x12, 0xb0, 0x71, 0x8b, 0xb7, 0x14, 0x44, 0x26,
138 0x58, 0xd5, 0x82, 0x8c, 0x25, 0x55, 0x2c, 0x6d, 0xef, 0x98, 0xe3, 0x4f, 0x88, 0xd0, 0x74, 0x82,
139 0x09, 0x3e, 0x8d, 0x6c, 0xf0, 0xf2, 0x18, 0xd5, 0x83, 0x0e, 0x0d, 0xf2, 0xce, 0xc5, 0x15, 0x38,
140 0xe5, 0x6a, 0xe6, 0x4d, 0x4d, 0x95, 0x15, 0xb7, 0x24, 0xe7, 0xcb, 0x4b, 0x63, 0x42, 0x21, 0xbc,
141 0x36, 0xc6, 0x0a, 0xd8, 0xa3, 0x76, 0x30, 0x74, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04,
142 0x16, 0x04, 0x14, 0x39, 0x81, 0x41, 0x0a, 0xb9, 0xf3, 0xf4, 0x5b, 0x75, 0x97, 0x4a, 0x46, 0xd6,
143 0x30, 0x9e, 0x1d, 0x7a, 0x3b, 0xec, 0xa8, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18,
144 0x30, 0x16, 0x80, 0x14, 0x82, 0xbd, 0x00, 0xde, 0xcb, 0xc5, 0xe7, 0x72, 0x87, 0x3d, 0x1c, 0x0a,
145 0x1e, 0x78, 0x4f, 0xf5, 0xd3, 0xc1, 0x3e, 0xb8, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
146 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f,
147 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x02, 0x04, 0x30, 0x11, 0x06, 0x0a, 0x2b, 0x06, 0x01,
148 0x04, 0x01, 0xd6, 0x79, 0x02, 0x01, 0x1e, 0x04, 0x03, 0xa1, 0x01, 0x08, 0x30, 0x0a, 0x06, 0x08,
149 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x21, 0x00,
150 0xae, 0xd8, 0x40, 0x9e, 0x37, 0x3e, 0x5c, 0x9c, 0xe2, 0x93, 0x3d, 0x8c, 0xf7, 0x05, 0x10, 0xe7,
151 0xd1, 0x2b, 0x87, 0x8a, 0xee, 0xd6, 0x1e, 0x6c, 0x3b, 0xd2, 0x91, 0x3e, 0xa5, 0xdf, 0x91, 0x20,
152 0x02, 0x20, 0x7f, 0x0f, 0x29, 0x54, 0x60, 0x80, 0x07, 0x50, 0x5f, 0x56, 0x6b, 0x9f, 0xe0, 0x94,
153 0xb4, 0x3f, 0x3b, 0x0f, 0x61, 0xa0, 0x33, 0x40, 0xe6, 0x1a, 0x42, 0xda, 0x4b, 0xa4, 0xfd, 0x92,
154 0xb9, 0x0f,
155];
156
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000157lazy_static! {
Alice Wange64dd182024-01-17 15:57:55 +0000158 static ref FAKE_PROVISIONED_KEY_BLOB_FOR_TESTING: Mutex<Option<Vec<u8>>> = Mutex::new(None);
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000159 static ref VFIO_SERVICE: Strong<dyn IVfioHandler> =
160 wait_for_interface(<BpVfioHandler as IVfioHandler>::get_descriptor())
161 .expect("Could not connect to VfioHandler");
162}
163
David Brazdilafc9a9e2023-01-12 16:08:10 +0000164fn is_valid_guest_cid(cid: Cid) -> bool {
165 (GUEST_CID_MIN..=GUEST_CID_MAX).contains(&cid)
166}
167
168/// Singleton service for allocating globally-unique VM resources, such as the CID, and running
169/// singleton servers, like tombstone receiver.
David Drysdale79af2662024-02-19 14:50:31 +0000170#[derive(Clone)]
David Brazdilafc9a9e2023-01-12 16:08:10 +0000171pub struct VirtualizationServiceInternal {
172 state: Arc<Mutex<GlobalState>>,
173}
174
175impl VirtualizationServiceInternal {
David Drysdale79af2662024-02-19 14:50:31 +0000176 pub fn init() -> VirtualizationServiceInternal {
177 let service =
178 VirtualizationServiceInternal { state: Arc::new(Mutex::new(GlobalState::new())) };
David Brazdilafc9a9e2023-01-12 16:08:10 +0000179
180 std::thread::spawn(|| {
181 if let Err(e) = handle_stream_connection_tombstoned() {
182 warn!("Error receiving tombstone from guest or writing them. Error: {:?}", e);
183 }
184 });
185
David Drysdale79af2662024-02-19 14:50:31 +0000186 service
David Brazdilafc9a9e2023-01-12 16:08:10 +0000187 }
188}
189
190impl Interface for VirtualizationServiceInternal {}
191
192impl IVirtualizationServiceInternal for VirtualizationServiceInternal {
193 fn removeMemlockRlimit(&self) -> binder::Result<()> {
194 let pid = get_calling_pid();
195 let lim = libc::rlimit { rlim_cur: libc::RLIM_INFINITY, rlim_max: libc::RLIM_INFINITY };
196
Andrew Walbranb58d1b42023-07-07 13:54:49 +0100197 // SAFETY: borrowing the new limit struct only
David Brazdilafc9a9e2023-01-12 16:08:10 +0000198 let ret = unsafe { libc::prlimit(pid, libc::RLIMIT_MEMLOCK, &lim, std::ptr::null_mut()) };
199
200 match ret {
201 0 => Ok(()),
Jiyong Park2227eaa2023-08-04 11:59:18 +0900202 -1 => Err(std::io::Error::last_os_error().into()),
203 n => Err(anyhow!("Unexpected return value from prlimit(): {n}")),
David Brazdilafc9a9e2023-01-12 16:08:10 +0000204 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900205 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)
David Brazdilafc9a9e2023-01-12 16:08:10 +0000206 }
207
208 fn allocateGlobalVmContext(
209 &self,
210 requester_debug_pid: i32,
211 ) -> binder::Result<Strong<dyn IGlobalVmContext>> {
212 check_manage_access()?;
213
214 let requester_uid = get_calling_uid();
215 let requester_debug_pid = requester_debug_pid as pid_t;
216 let state = &mut *self.state.lock().unwrap();
Jiyong Park2227eaa2023-08-04 11:59:18 +0900217 state
218 .allocate_vm_context(requester_uid, requester_debug_pid)
219 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)
David Brazdilafc9a9e2023-01-12 16:08:10 +0000220 }
221
222 fn atomVmBooted(&self, atom: &AtomVmBooted) -> Result<(), Status> {
223 forward_vm_booted_atom(atom);
224 Ok(())
225 }
226
227 fn atomVmCreationRequested(&self, atom: &AtomVmCreationRequested) -> Result<(), Status> {
228 forward_vm_creation_atom(atom);
229 Ok(())
230 }
231
232 fn atomVmExited(&self, atom: &AtomVmExited) -> Result<(), Status> {
233 forward_vm_exited_atom(atom);
234 Ok(())
235 }
236
237 fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> {
238 check_debug_access()?;
239
240 let state = &mut *self.state.lock().unwrap();
241 let cids = state
242 .held_contexts
243 .iter()
244 .filter_map(|(_, inst)| Weak::upgrade(inst))
245 .map(|vm| VirtualMachineDebugInfo {
246 cid: vm.cid as i32,
247 temporaryDirectory: vm.get_temp_dir().to_string_lossy().to_string(),
248 requesterUid: vm.requester_uid as i32,
Charisee96113f32023-01-26 09:00:42 +0000249 requesterPid: vm.requester_debug_pid,
David Brazdilafc9a9e2023-01-12 16:08:10 +0000250 })
251 .collect();
252 Ok(cids)
253 }
Alice Wangc2fec932023-02-23 16:24:02 +0000254
Alice Wange64dd182024-01-17 15:57:55 +0000255 fn enableTestAttestation(&self) -> binder::Result<()> {
256 check_manage_access()?;
257 check_use_custom_virtual_machine()?;
258 if !cfg!(remote_attestation) {
259 return Err(Status::new_exception_str(
260 ExceptionCode::UNSUPPORTED_OPERATION,
261 Some(
262 "enableTestAttestation is not supported with the remote_attestation \
263 feature disabled",
264 ),
265 ))
266 .with_log();
267 }
268 let res = generate_ecdsa_p256_key_pair()
269 .context("Failed to generate ECDSA P-256 key pair for testing")
270 .with_log()
271 .or_service_specific_exception(-1)?;
272 match res {
273 Response::GenerateEcdsaP256KeyPair(key_pair) => {
274 FAKE_PROVISIONED_KEY_BLOB_FOR_TESTING
275 .lock()
276 .unwrap()
277 .replace(key_pair.key_blob.to_vec());
278 Ok(())
279 }
280 _ => Err(remote_provisioning::to_service_specific_error(res)),
281 }
282 .with_log()
283 }
284
Alice Wangbff017f2023-11-09 14:43:28 +0000285 fn requestAttestation(
286 &self,
287 csr: &[u8],
288 requester_uid: i32,
Alice Wange64dd182024-01-17 15:57:55 +0000289 test_mode: bool,
Alice Wangbff017f2023-11-09 14:43:28 +0000290 ) -> binder::Result<Vec<Certificate>> {
Alice Wangc2fec932023-02-23 16:24:02 +0000291 check_manage_access()?;
Alice Wang4c6c5582023-11-23 15:07:18 +0000292 if !cfg!(remote_attestation) {
293 return Err(Status::new_exception_str(
Alice Wange9ac2db2023-09-08 15:13:13 +0000294 ExceptionCode::UNSUPPORTED_OPERATION,
295 Some(
Alice Wanga410b642023-10-18 09:05:15 +0000296 "requestAttestation is not supported with the remote_attestation feature \
297 disabled",
Alice Wange9ac2db2023-09-08 15:13:13 +0000298 ),
299 ))
Alice Wang4c6c5582023-11-23 15:07:18 +0000300 .with_log();
Alice Wange9ac2db2023-09-08 15:13:13 +0000301 }
Alice Wang4c6c5582023-11-23 15:07:18 +0000302 info!("Received csr. Requestting attestation...");
Alice Wange64dd182024-01-17 15:57:55 +0000303 let (key_blob, certificate_chain) = if test_mode {
304 check_use_custom_virtual_machine()?;
305 info!("Using the fake key blob for testing...");
306 (
307 FAKE_PROVISIONED_KEY_BLOB_FOR_TESTING
308 .lock()
309 .unwrap()
310 .clone()
311 .ok_or_else(|| anyhow!("No key blob for testing"))
312 .with_log()
313 .or_service_specific_exception(-1)?,
314 FAKE_CERTIFICATE_FOR_TESTING.to_vec(),
315 )
316 } else {
317 info!("Retrieving the remotely provisioned keys from RKPD...");
318 let attestation_key = get_rkpd_attestation_key(
319 REMOTELY_PROVISIONED_COMPONENT_SERVICE_NAME,
320 requester_uid as u32,
321 )
322 .context("Failed to retrieve the remotely provisioned keys")
323 .with_log()
324 .or_service_specific_exception(-1)?;
325 (attestation_key.keyBlob, attestation_key.encodedCertChain)
326 };
327 let mut certificate_chain = split_x509_certificate_chain(&certificate_chain)
Alice Wang4c6c5582023-11-23 15:07:18 +0000328 .context("Failed to split the remotely provisioned certificate chain")
329 .with_log()
330 .or_service_specific_exception(-1)?;
331 if certificate_chain.is_empty() {
332 return Err(Status::new_service_specific_error_str(
333 -1,
334 Some("The certificate chain should contain at least 1 certificate"),
335 ))
336 .with_log();
337 }
Alice Wang20b8ebc2023-11-17 09:54:47 +0000338 let certificate = request_attestation(
339 csr.to_vec(),
Alice Wange64dd182024-01-17 15:57:55 +0000340 key_blob,
Alice Wang20b8ebc2023-11-17 09:54:47 +0000341 certificate_chain[0].encodedCertificate.clone(),
342 )
343 .context("Failed to request attestation")
344 .with_log()
345 .or_service_specific_exception(-1)?;
Alice Wang4c6c5582023-11-23 15:07:18 +0000346 certificate_chain.insert(0, Certificate { encodedCertificate: certificate });
347
348 Ok(certificate_chain)
Alice Wangc2fec932023-02-23 16:24:02 +0000349 }
Inseob Kim53d0b212023-07-20 16:58:37 +0900350
351 fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> {
352 check_use_custom_virtual_machine()?;
353
Inseob Kim7307a892023-09-14 13:37:58 +0900354 Ok(get_assignable_devices()?
355 .device
356 .into_iter()
357 .map(|x| AssignableDevice { node: x.sysfs_path, kind: x.kind })
358 .collect::<Vec<_>>())
Inseob Kim53d0b212023-07-20 16:58:37 +0900359 }
Inseob Kim1ca0f652023-07-20 17:18:12 +0900360
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000361 fn bindDevicesToVfioDriver(
362 &self,
363 devices: &[String],
364 ) -> binder::Result<Vec<Strong<dyn IBoundDevice>>> {
Inseob Kim1ca0f652023-07-20 17:18:12 +0900365 check_use_custom_virtual_machine()?;
366
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000367 let devices = get_assignable_devices()?
Inseob Kim7307a892023-09-14 13:37:58 +0900368 .device
369 .into_iter()
370 .filter_map(|x| {
371 if devices.contains(&x.sysfs_path) {
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000372 Some(VfioDev { sysfsPath: x.sysfs_path, dtboLabel: x.dtbo_label })
Inseob Kim7307a892023-09-14 13:37:58 +0900373 } else {
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000374 warn!("device {} is not assignable", x.sysfs_path);
Inseob Kim7307a892023-09-14 13:37:58 +0900375 None
376 }
377 })
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000378 .collect::<Vec<VfioDev>>();
379
380 VFIO_SERVICE.bindDevicesToVfioDriver(devices.as_slice())
Inseob Kim1ca0f652023-07-20 17:18:12 +0900381 }
David Brazdil2dfefd12023-11-17 14:07:36 +0000382
383 fn getDtboFile(&self) -> binder::Result<ParcelFileDescriptor> {
384 check_use_custom_virtual_machine()?;
385
386 let state = &mut *self.state.lock().unwrap();
387 let file = state.get_dtbo_file().or_service_specific_exception(-1)?;
388 Ok(ParcelFileDescriptor::new(file))
389 }
Shikha Panwar61a74b52024-02-16 13:17:01 +0000390
Shikha Panwar61a74b52024-02-16 13:17:01 +0000391 fn allocateInstanceId(&self) -> binder::Result<[u8; 64]> {
392 let mut id = [0u8; 64];
393 id.try_fill(&mut rand::thread_rng())
394 .context("Failed to allocate instance_id")
395 .or_service_specific_exception(-1)?;
396 let uid = get_calling_uid();
397 info!("Allocated a VM's instance_id: {:?}, for uid: {:?}", hex::encode(id), uid);
David Drysdalee64de8e2024-02-29 11:54:29 +0000398 let state = &mut *self.state.lock().unwrap();
399 if let Some(sk_state) = &mut state.sk_state {
400 let user_id = multiuser_get_user_id(uid);
401 let app_id = multiuser_get_app_id(uid);
David Drysdale1138fa02024-03-19 13:06:23 +0000402 info!("Recording possible existence of state for (user_id={user_id}, app_id={app_id})");
David Drysdalee64de8e2024-02-29 11:54:29 +0000403 if let Err(e) = sk_state.add_id(&id, user_id, app_id) {
404 error!("Failed to record the instance_id: {e:?}");
405 }
406 }
407
Shikha Panwar61a74b52024-02-16 13:17:01 +0000408 Ok(id)
409 }
David Drysdale79af2662024-02-19 14:50:31 +0000410
411 fn removeVmInstance(&self, instance_id: &[u8; 64]) -> binder::Result<()> {
412 let state = &mut *self.state.lock().unwrap();
413 if let Some(sk_state) = &mut state.sk_state {
414 info!("removeVmInstance(): delete secret");
415 sk_state.delete_ids(&[*instance_id]);
416 } else {
417 info!("ignoring removeVmInstance() as no ISecretkeeper");
418 }
419 Ok(())
420 }
421}
422
423impl IVirtualizationMaintenance for VirtualizationServiceInternal {
424 fn appRemoved(&self, user_id: i32, app_id: i32) -> binder::Result<()> {
425 let state = &mut *self.state.lock().unwrap();
426 if let Some(sk_state) = &mut state.sk_state {
427 info!("packageRemoved(user_id={user_id}, app_id={app_id})");
428 sk_state.delete_ids_for_app(user_id, app_id).or_service_specific_exception(-1)?;
429 } else {
430 info!("ignoring packageRemoved(user_id={user_id}, app_id={app_id})");
431 }
432 Ok(())
433 }
434
435 fn userRemoved(&self, user_id: i32) -> binder::Result<()> {
436 let state = &mut *self.state.lock().unwrap();
437 if let Some(sk_state) = &mut state.sk_state {
438 info!("userRemoved({user_id})");
439 sk_state.delete_ids_for_user(user_id).or_service_specific_exception(-1)?;
440 } else {
441 info!("ignoring userRemoved(user_id={user_id})");
442 }
443 Ok(())
444 }
Alan Stokes30ccacb2024-02-20 14:59:02 +0000445
446 fn performReconciliation(
447 &self,
David Drysdale1138fa02024-03-19 13:06:23 +0000448 callback: &Strong<dyn IVirtualizationReconciliationCallback>,
Alan Stokes30ccacb2024-02-20 14:59:02 +0000449 ) -> binder::Result<()> {
David Drysdale1138fa02024-03-19 13:06:23 +0000450 let state = &mut *self.state.lock().unwrap();
451 if let Some(sk_state) = &mut state.sk_state {
452 info!("performReconciliation()");
453 sk_state.reconcile(callback).or_service_specific_exception(-1)?;
454 } else {
455 info!("ignoring performReconciliation()");
456 }
457 Ok(())
Alan Stokes30ccacb2024-02-20 14:59:02 +0000458 }
Inseob Kim1ca0f652023-07-20 17:18:12 +0900459}
460
Inseob Kimc4a774d2023-08-30 12:48:43 +0900461// KEEP IN SYNC WITH assignable_devices.xsd
462#[derive(Debug, Deserialize)]
463struct Device {
464 kind: String,
Jaewan Kim35e818d2023-10-18 05:36:38 +0000465 dtbo_label: String,
Inseob Kimc4a774d2023-08-30 12:48:43 +0900466 sysfs_path: String,
467}
468
Inseob Kim7307a892023-09-14 13:37:58 +0900469#[derive(Debug, Default, Deserialize)]
Inseob Kimc4a774d2023-08-30 12:48:43 +0900470struct Devices {
471 device: Vec<Device>,
472}
473
Inseob Kim7307a892023-09-14 13:37:58 +0900474fn get_assignable_devices() -> binder::Result<Devices> {
475 let xml_path = Path::new("/vendor/etc/avf/assignable_devices.xml");
476 if !xml_path.exists() {
477 return Ok(Devices { ..Default::default() });
478 }
479
480 let xml = fs::read(xml_path)
481 .context("Failed to read assignable_devices.xml")
482 .with_log()
483 .or_service_specific_exception(-1)?;
484
485 let xml = String::from_utf8(xml)
486 .context("assignable_devices.xml is not a valid UTF-8 file")
487 .with_log()
488 .or_service_specific_exception(-1)?;
489
490 let mut devices: Devices = serde_xml_rs::from_str(&xml)
491 .context("can't parse assignable_devices.xml")
492 .with_log()
493 .or_service_specific_exception(-1)?;
494
495 let mut device_set = HashSet::new();
496 devices.device.retain(move |device| {
497 if device_set.contains(&device.sysfs_path) {
498 warn!("duplicated assignable device {device:?}; ignoring...");
499 return false;
500 }
501
502 if !Path::new(&device.sysfs_path).exists() {
503 warn!("assignable device {device:?} doesn't exist; ignoring...");
504 return false;
505 }
506
507 device_set.insert(device.sysfs_path.clone());
508 true
509 });
510 Ok(devices)
511}
512
Alice Wang4c6c5582023-11-23 15:07:18 +0000513fn split_x509_certificate_chain(mut cert_chain: &[u8]) -> Result<Vec<Certificate>> {
514 let mut out = Vec::new();
515 while !cert_chain.is_empty() {
Alice Wangfc5a44a2023-12-21 12:22:40 +0000516 let cert = X509::from_der(cert_chain)?;
517 let end = cert.to_der()?.len();
Alice Wang4c6c5582023-11-23 15:07:18 +0000518 out.push(Certificate { encodedCertificate: cert_chain[..end].to_vec() });
Alice Wangfc5a44a2023-12-21 12:22:40 +0000519 cert_chain = &cert_chain[end..];
Alice Wang4c6c5582023-11-23 15:07:18 +0000520 }
521 Ok(out)
522}
523
David Brazdilafc9a9e2023-01-12 16:08:10 +0000524#[derive(Debug, Default)]
525struct GlobalVmInstance {
526 /// The unique CID assigned to the VM for vsock communication.
527 cid: Cid,
528 /// UID of the client who requested this VM instance.
529 requester_uid: uid_t,
530 /// PID of the client who requested this VM instance.
531 requester_debug_pid: pid_t,
532}
533
534impl GlobalVmInstance {
535 fn get_temp_dir(&self) -> PathBuf {
536 let cid = self.cid;
537 format!("{TEMPORARY_DIRECTORY}/{cid}").into()
538 }
539}
540
541/// The mutable state of the VirtualizationServiceInternal. There should only be one instance
542/// of this struct.
David Brazdilafc9a9e2023-01-12 16:08:10 +0000543struct GlobalState {
544 /// VM contexts currently allocated to running VMs. A CID is never recycled as long
545 /// as there is a strong reference held by a GlobalVmContext.
546 held_contexts: HashMap<Cid, Weak<GlobalVmInstance>>,
David Brazdil2dfefd12023-11-17 14:07:36 +0000547
548 /// Cached read-only FD of VM DTBO file. Also serves as a lock for creating the file.
549 dtbo_file: Mutex<Option<File>>,
David Drysdale79af2662024-02-19 14:50:31 +0000550
551 /// State relating to secrets held by (optional) Secretkeeper instance on behalf of VMs.
552 sk_state: Option<maintenance::State>,
David Brazdilafc9a9e2023-01-12 16:08:10 +0000553}
554
555impl GlobalState {
David Drysdale79af2662024-02-19 14:50:31 +0000556 fn new() -> Self {
557 Self {
558 held_contexts: HashMap::new(),
559 dtbo_file: Mutex::new(None),
560 sk_state: maintenance::State::new(),
561 }
562 }
563
David Brazdilafc9a9e2023-01-12 16:08:10 +0000564 /// Get the next available CID, or an error if we have run out. The last CID used is stored in
565 /// a system property so that restart of virtualizationservice doesn't reuse CID while the host
566 /// Android is up.
567 fn get_next_available_cid(&mut self) -> Result<Cid> {
568 // Start trying to find a CID from the last used CID + 1. This ensures
569 // that we do not eagerly recycle CIDs. It makes debugging easier but
570 // also means that retrying to allocate a CID, eg. because it is
571 // erroneously occupied by a process, will not recycle the same CID.
572 let last_cid_prop =
573 system_properties::read(SYSPROP_LAST_CID)?.and_then(|val| match val.parse::<Cid>() {
574 Ok(num) => {
575 if is_valid_guest_cid(num) {
576 Some(num)
577 } else {
578 error!("Invalid value '{}' of property '{}'", num, SYSPROP_LAST_CID);
579 None
580 }
581 }
582 Err(_) => {
583 error!("Invalid value '{}' of property '{}'", val, SYSPROP_LAST_CID);
584 None
585 }
586 });
587
588 let first_cid = if let Some(last_cid) = last_cid_prop {
589 if last_cid == GUEST_CID_MAX {
590 GUEST_CID_MIN
591 } else {
592 last_cid + 1
593 }
594 } else {
595 GUEST_CID_MIN
596 };
597
598 let cid = self
599 .find_available_cid(first_cid..=GUEST_CID_MAX)
600 .or_else(|| self.find_available_cid(GUEST_CID_MIN..first_cid))
601 .ok_or_else(|| anyhow!("Could not find an available CID."))?;
602
603 system_properties::write(SYSPROP_LAST_CID, &format!("{}", cid))?;
604 Ok(cid)
605 }
606
607 fn find_available_cid<I>(&self, mut range: I) -> Option<Cid>
608 where
609 I: Iterator<Item = Cid>,
610 {
611 range.find(|cid| !self.held_contexts.contains_key(cid))
612 }
613
614 fn allocate_vm_context(
615 &mut self,
616 requester_uid: uid_t,
617 requester_debug_pid: pid_t,
618 ) -> Result<Strong<dyn IGlobalVmContext>> {
619 // Garbage collect unused VM contexts.
620 self.held_contexts.retain(|_, instance| instance.strong_count() > 0);
621
622 let cid = self.get_next_available_cid()?;
623 let instance = Arc::new(GlobalVmInstance { cid, requester_uid, requester_debug_pid });
David Brazdil2dfefd12023-11-17 14:07:36 +0000624 create_temporary_directory(&instance.get_temp_dir(), Some(requester_uid))?;
David Brazdilafc9a9e2023-01-12 16:08:10 +0000625
626 self.held_contexts.insert(cid, Arc::downgrade(&instance));
627 let binder = GlobalVmContext { instance, ..Default::default() };
628 Ok(BnGlobalVmContext::new_binder(binder, BinderFeatures::default()))
629 }
David Brazdil2dfefd12023-11-17 14:07:36 +0000630
631 fn get_dtbo_file(&mut self) -> Result<File> {
632 let mut file = self.dtbo_file.lock().unwrap();
633
634 let fd = if let Some(ref_fd) = &*file {
635 ref_fd.try_clone()?
636 } else {
637 let path = get_or_create_common_dir()?.join("vm.dtbo");
638 if path.exists() {
639 // All temporary files are deleted when the service is started.
640 // If the file exists but the FD is not cached, the file is
641 // likely corrupted.
642 remove_file(&path).context("Failed to clone cached VM DTBO file descriptor")?;
643 }
644
645 // Open a write-only file descriptor for vfio_handler.
646 let write_fd = File::create(&path).context("Failed to create VM DTBO file")?;
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000647 VFIO_SERVICE.writeVmDtbo(&ParcelFileDescriptor::new(write_fd))?;
David Brazdil2dfefd12023-11-17 14:07:36 +0000648
649 // Open read-only. This FD will be cached and returned to clients.
650 let read_fd = File::open(&path).context("Failed to open VM DTBO file")?;
651 let read_fd_clone =
652 read_fd.try_clone().context("Failed to clone VM DTBO file descriptor")?;
653 *file = Some(read_fd);
654 read_fd_clone
655 };
656
657 Ok(fd)
658 }
David Brazdilafc9a9e2023-01-12 16:08:10 +0000659}
660
David Brazdil2dfefd12023-11-17 14:07:36 +0000661fn create_temporary_directory(path: &PathBuf, requester_uid: Option<uid_t>) -> Result<()> {
662 // Directory may exist if previous attempt to create it had failed.
663 // Delete it before trying again.
David Brazdilafc9a9e2023-01-12 16:08:10 +0000664 if path.as_path().exists() {
665 remove_temporary_dir(path).unwrap_or_else(|e| {
666 warn!("Could not delete temporary directory {:?}: {}", path, e);
667 });
668 }
David Brazdil2dfefd12023-11-17 14:07:36 +0000669 // Create directory.
670 create_dir(path).with_context(|| format!("Could not create temporary directory {:?}", path))?;
671 // If provided, change ownership to client's UID but system's GID, and permissions 0700.
David Brazdilafc9a9e2023-01-12 16:08:10 +0000672 // If the chown() fails, this will leave behind an empty directory that will get removed
673 // at the next attempt, or if virtualizationservice is restarted.
David Brazdil2dfefd12023-11-17 14:07:36 +0000674 if let Some(uid) = requester_uid {
675 chown(path, Some(Uid::from_raw(uid)), None).with_context(|| {
676 format!("Could not set ownership of temporary directory {:?}", path)
677 })?;
678 }
David Brazdilafc9a9e2023-01-12 16:08:10 +0000679 Ok(())
680}
681
682/// Removes a directory owned by a different user by first changing its owner back
683/// to VirtualizationService.
684pub fn remove_temporary_dir(path: &PathBuf) -> Result<()> {
Alice Wangd1b11a02023-04-18 12:30:20 +0000685 ensure!(path.as_path().is_dir(), "Path {:?} is not a directory", path);
David Brazdilafc9a9e2023-01-12 16:08:10 +0000686 chown(path, Some(Uid::current()), None)?;
687 set_permissions(path, Permissions::from_mode(0o700))?;
Alice Wangd1b11a02023-04-18 12:30:20 +0000688 remove_dir_all(path)?;
David Brazdilafc9a9e2023-01-12 16:08:10 +0000689 Ok(())
690}
691
David Brazdil2dfefd12023-11-17 14:07:36 +0000692fn get_or_create_common_dir() -> Result<PathBuf> {
693 let path = Path::new(TEMPORARY_DIRECTORY).join("common");
694 if !path.exists() {
695 create_temporary_directory(&path, None)?;
696 }
697 Ok(path)
698}
699
David Brazdilafc9a9e2023-01-12 16:08:10 +0000700/// Implementation of the AIDL `IGlobalVmContext` interface.
701#[derive(Debug, Default)]
702struct GlobalVmContext {
703 /// Strong reference to the context's instance data structure.
704 instance: Arc<GlobalVmInstance>,
705 /// Keeps our service process running as long as this VM context exists.
706 #[allow(dead_code)]
707 lazy_service_guard: LazyServiceGuard,
708}
709
710impl Interface for GlobalVmContext {}
711
712impl IGlobalVmContext for GlobalVmContext {
713 fn getCid(&self) -> binder::Result<i32> {
714 Ok(self.instance.cid as i32)
715 }
716
717 fn getTemporaryDirectory(&self) -> binder::Result<String> {
718 Ok(self.instance.get_temp_dir().to_string_lossy().to_string())
719 }
720}
721
722fn handle_stream_connection_tombstoned() -> Result<()> {
723 // Should not listen for tombstones on a guest VM's port.
724 assert!(!is_valid_guest_cid(VM_TOMBSTONES_SERVICE_PORT as Cid));
725 let listener =
726 VsockListener::bind_with_cid_port(VMADDR_CID_HOST, VM_TOMBSTONES_SERVICE_PORT as Cid)?;
727 for incoming_stream in listener.incoming() {
728 let mut incoming_stream = match incoming_stream {
729 Err(e) => {
730 warn!("invalid incoming connection: {:?}", e);
731 continue;
732 }
733 Ok(s) => s,
734 };
735 std::thread::spawn(move || {
736 if let Err(e) = handle_tombstone(&mut incoming_stream) {
737 error!("Failed to write tombstone- {:?}", e);
738 }
739 });
740 }
741 Ok(())
742}
743
744fn handle_tombstone(stream: &mut VsockStream) -> Result<()> {
745 if let Ok(addr) = stream.peer_addr() {
746 info!("Vsock Stream connected to cid={} for tombstones", addr.cid());
747 }
748 let tb_connection =
749 TombstonedConnection::connect(std::process::id() as i32, DebuggerdDumpType::Tombstone)
750 .context("Failed to connect to tombstoned")?;
751 let mut text_output = tb_connection
752 .text_output
753 .as_ref()
754 .ok_or_else(|| anyhow!("Could not get file to write the tombstones on"))?;
755 let mut num_bytes_read = 0;
756 loop {
757 let mut chunk_recv = [0; CHUNK_RECV_MAX_LEN];
758 let n = stream
759 .read(&mut chunk_recv)
760 .context("Failed to read tombstone data from Vsock stream")?;
761 if n == 0 {
762 break;
763 }
764 num_bytes_read += n;
765 text_output.write_all(&chunk_recv[0..n]).context("Failed to write guests tombstones")?;
766 }
767 info!("Received {} bytes from guest & wrote to tombstone file", num_bytes_read);
768 tb_connection.notify_completion()?;
769 Ok(())
770}
771
772/// Checks whether the caller has a specific permission
773fn check_permission(perm: &str) -> binder::Result<()> {
774 let calling_pid = get_calling_pid();
775 let calling_uid = get_calling_uid();
776 // Root can do anything
777 if calling_uid == 0 {
778 return Ok(());
779 }
780 let perm_svc: Strong<dyn IPermissionController::IPermissionController> =
781 binder::get_interface("permission")?;
782 if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? {
783 Ok(())
784 } else {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900785 Err(anyhow!("does not have the {} permission", perm))
786 .or_binder_exception(ExceptionCode::SECURITY)
David Brazdilafc9a9e2023-01-12 16:08:10 +0000787 }
788}
789
790/// Check whether the caller of the current Binder method is allowed to call debug methods.
791fn check_debug_access() -> binder::Result<()> {
792 check_permission("android.permission.DEBUG_VIRTUAL_MACHINE")
793}
794
795/// Check whether the caller of the current Binder method is allowed to manage VMs
796fn check_manage_access() -> binder::Result<()> {
797 check_permission("android.permission.MANAGE_VIRTUAL_MACHINE")
798}
Inseob Kim53d0b212023-07-20 16:58:37 +0900799
800/// Check whether the caller of the current Binder method is allowed to use custom VMs
801fn check_use_custom_virtual_machine() -> binder::Result<()> {
802 check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE")
803}
Alice Wang4c6c5582023-11-23 15:07:18 +0000804
805#[cfg(test)]
806mod tests {
807 use super::*;
Alice Wang4c6c5582023-11-23 15:07:18 +0000808
809 const TEST_RKP_CERT_CHAIN_PATH: &str = "testdata/rkp_cert_chain.der";
810
811 #[test]
812 fn splitting_x509_certificate_chain_succeeds() -> Result<()> {
813 let bytes = fs::read(TEST_RKP_CERT_CHAIN_PATH)?;
814 let cert_chain = split_x509_certificate_chain(&bytes)?;
815
816 assert_eq!(4, cert_chain.len());
817 for cert in cert_chain {
Alice Wangfc5a44a2023-12-21 12:22:40 +0000818 let x509_cert = X509::from_der(&cert.encodedCertificate)?;
819 assert_eq!(x509_cert.to_der()?.len(), cert.encodedCertificate.len());
Alice Wang4c6c5582023-11-23 15:07:18 +0000820 }
821 Ok(())
822 }
823}