blob: 8aea5566f1c7c947515d736d501b1ec3ba1cee61 [file] [log] [blame]
David Brazdilafc9a9e2023-01-12 16:08:10 +00001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Implementation of the AIDL interface of the VirtualizationService.
16
17use crate::{get_calling_pid, get_calling_uid};
David Brazdil33a31022023-01-12 16:55:16 +000018use crate::atom::{forward_vm_booted_atom, forward_vm_creation_atom, forward_vm_exited_atom};
Alice Wangc2fec932023-02-23 16:24:02 +000019use crate::rkpvm::request_certificate;
David Brazdilafc9a9e2023-01-12 16:08:10 +000020use android_os_permissions_aidl::aidl::android::os::IPermissionController;
Alice Wangc2fec932023-02-23 16:24:02 +000021use android_system_virtualizationservice::{
Inseob Kim53d0b212023-07-20 16:58:37 +090022 aidl::android::system::virtualizationservice::AssignableDevice::AssignableDevice,
Alice Wangc2fec932023-02-23 16:24:02 +000023 aidl::android::system::virtualizationservice::VirtualMachineDebugInfo::VirtualMachineDebugInfo,
24 binder::ParcelFileDescriptor,
25};
David Brazdilafc9a9e2023-01-12 16:08:10 +000026use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::{
27 AtomVmBooted::AtomVmBooted,
28 AtomVmCreationRequested::AtomVmCreationRequested,
29 AtomVmExited::AtomVmExited,
30 IGlobalVmContext::{BnGlobalVmContext, IGlobalVmContext},
31 IVirtualizationServiceInternal::IVirtualizationServiceInternal,
32};
33use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::VM_TOMBSTONES_SERVICE_PORT;
Alice Wangd1b11a02023-04-18 12:30:20 +000034use anyhow::{anyhow, ensure, Context, Result};
David Brazdilafc9a9e2023-01-12 16:08:10 +000035use binder::{self, BinderFeatures, ExceptionCode, Interface, LazyServiceGuard, Status, Strong};
Inseob Kim1ca0f652023-07-20 17:18:12 +090036use lazy_static::lazy_static;
David Brazdilafc9a9e2023-01-12 16:08:10 +000037use libc::VMADDR_CID_HOST;
38use log::{error, info, warn};
39use rustutils::system_properties;
Inseob Kim6ef80972023-07-20 17:23:36 +090040use std::collections::HashMap;
Inseob Kim1ca0f652023-07-20 17:18:12 +090041use std::fs::{canonicalize, create_dir, remove_dir_all, set_permissions, File, Permissions};
David Brazdilafc9a9e2023-01-12 16:08:10 +000042use std::io::{Read, Write};
Inseob Kim1ca0f652023-07-20 17:18:12 +090043use std::os::fd::FromRawFd;
David Brazdilafc9a9e2023-01-12 16:08:10 +000044use std::os::unix::fs::PermissionsExt;
45use std::os::unix::raw::{pid_t, uid_t};
Inseob Kim1ca0f652023-07-20 17:18:12 +090046use std::path::{Path, PathBuf};
David Brazdilafc9a9e2023-01-12 16:08:10 +000047use std::sync::{Arc, Mutex, Weak};
48use tombstoned_client::{DebuggerdDumpType, TombstonedConnection};
49use vsock::{VsockListener, VsockStream};
Inseob Kim1ca0f652023-07-20 17:18:12 +090050use nix::fcntl::OFlag;
51use nix::unistd::{chown, pipe2, Uid};
David Brazdilafc9a9e2023-01-12 16:08:10 +000052
53/// The unique ID of a VM used (together with a port number) for vsock communication.
54pub type Cid = u32;
55
56pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice";
57
58/// Directory in which to write disk image files used while running VMs.
59pub const TEMPORARY_DIRECTORY: &str = "/data/misc/virtualizationservice";
60
61/// The first CID to assign to a guest VM managed by the VirtualizationService. CIDs lower than this
62/// are reserved for the host or other usage.
63const GUEST_CID_MIN: Cid = 2048;
64const GUEST_CID_MAX: Cid = 65535;
65
66const SYSPROP_LAST_CID: &str = "virtualizationservice.state.last_cid";
67
68const CHUNK_RECV_MAX_LEN: usize = 1024;
69
70fn is_valid_guest_cid(cid: Cid) -> bool {
71 (GUEST_CID_MIN..=GUEST_CID_MAX).contains(&cid)
72}
73
74/// Singleton service for allocating globally-unique VM resources, such as the CID, and running
75/// singleton servers, like tombstone receiver.
76#[derive(Debug, Default)]
77pub struct VirtualizationServiceInternal {
78 state: Arc<Mutex<GlobalState>>,
79}
80
81impl VirtualizationServiceInternal {
82 pub fn init() -> VirtualizationServiceInternal {
83 let service = VirtualizationServiceInternal::default();
84
85 std::thread::spawn(|| {
86 if let Err(e) = handle_stream_connection_tombstoned() {
87 warn!("Error receiving tombstone from guest or writing them. Error: {:?}", e);
88 }
89 });
90
91 service
92 }
93}
94
95impl Interface for VirtualizationServiceInternal {}
96
97impl IVirtualizationServiceInternal for VirtualizationServiceInternal {
98 fn removeMemlockRlimit(&self) -> binder::Result<()> {
99 let pid = get_calling_pid();
100 let lim = libc::rlimit { rlim_cur: libc::RLIM_INFINITY, rlim_max: libc::RLIM_INFINITY };
101
Andrew Walbranb58d1b42023-07-07 13:54:49 +0100102 // SAFETY: borrowing the new limit struct only
David Brazdilafc9a9e2023-01-12 16:08:10 +0000103 let ret = unsafe { libc::prlimit(pid, libc::RLIMIT_MEMLOCK, &lim, std::ptr::null_mut()) };
104
105 match ret {
106 0 => Ok(()),
107 -1 => Err(Status::new_exception_str(
108 ExceptionCode::ILLEGAL_STATE,
109 Some(std::io::Error::last_os_error().to_string()),
110 )),
111 n => Err(Status::new_exception_str(
112 ExceptionCode::ILLEGAL_STATE,
113 Some(format!("Unexpected return value from prlimit(): {n}")),
114 )),
115 }
116 }
117
118 fn allocateGlobalVmContext(
119 &self,
120 requester_debug_pid: i32,
121 ) -> binder::Result<Strong<dyn IGlobalVmContext>> {
122 check_manage_access()?;
123
124 let requester_uid = get_calling_uid();
125 let requester_debug_pid = requester_debug_pid as pid_t;
126 let state = &mut *self.state.lock().unwrap();
127 state.allocate_vm_context(requester_uid, requester_debug_pid).map_err(|e| {
128 Status::new_exception_str(ExceptionCode::ILLEGAL_STATE, Some(e.to_string()))
129 })
130 }
131
132 fn atomVmBooted(&self, atom: &AtomVmBooted) -> Result<(), Status> {
133 forward_vm_booted_atom(atom);
134 Ok(())
135 }
136
137 fn atomVmCreationRequested(&self, atom: &AtomVmCreationRequested) -> Result<(), Status> {
138 forward_vm_creation_atom(atom);
139 Ok(())
140 }
141
142 fn atomVmExited(&self, atom: &AtomVmExited) -> Result<(), Status> {
143 forward_vm_exited_atom(atom);
144 Ok(())
145 }
146
147 fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> {
148 check_debug_access()?;
149
150 let state = &mut *self.state.lock().unwrap();
151 let cids = state
152 .held_contexts
153 .iter()
154 .filter_map(|(_, inst)| Weak::upgrade(inst))
155 .map(|vm| VirtualMachineDebugInfo {
156 cid: vm.cid as i32,
157 temporaryDirectory: vm.get_temp_dir().to_string_lossy().to_string(),
158 requesterUid: vm.requester_uid as i32,
Charisee96113f32023-01-26 09:00:42 +0000159 requesterPid: vm.requester_debug_pid,
David Brazdilafc9a9e2023-01-12 16:08:10 +0000160 })
161 .collect();
162 Ok(cids)
163 }
Alice Wangc2fec932023-02-23 16:24:02 +0000164
165 fn requestCertificate(
166 &self,
167 csr: &[u8],
168 instance_img_fd: &ParcelFileDescriptor,
169 ) -> binder::Result<Vec<u8>> {
170 check_manage_access()?;
171 info!("Received csr. Getting certificate...");
172 request_certificate(csr, instance_img_fd).map_err(|e| {
173 error!("Failed to get certificate. Error: {e:?}");
174 Status::new_exception_str(ExceptionCode::SERVICE_SPECIFIC, Some(e.to_string()))
175 })
176 }
Inseob Kim53d0b212023-07-20 16:58:37 +0900177
178 fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> {
179 check_use_custom_virtual_machine()?;
180
181 // TODO(b/291191362): read VM DTBO to find assignable devices.
182 Ok(vec![AssignableDevice {
183 kind: "eh".to_owned(),
184 node: "/sys/bus/platform/devices/16d00000.eh".to_owned(),
185 }])
186 }
Inseob Kim1ca0f652023-07-20 17:18:12 +0900187
188 fn bindDevicesToVfioDriver(&self, devices: &[String]) -> binder::Result<ParcelFileDescriptor> {
189 check_use_custom_virtual_machine()?;
190
Inseob Kim6ef80972023-07-20 17:23:36 +0900191 devices.iter().try_for_each(|x| bind_device(x))?;
Inseob Kim1ca0f652023-07-20 17:18:12 +0900192
193 // TODO(b/278008182): create a file descriptor containing DTBO for devices.
194 let (raw_read, raw_write) = pipe2(OFlag::O_CLOEXEC).map_err(|e| {
195 Status::new_exception_str(
196 ExceptionCode::SERVICE_SPECIFIC,
197 Some(format!("can't create fd for DTBO: {e:?}")),
198 )
199 })?;
200 // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
201 let read_fd = unsafe { File::from_raw_fd(raw_read) };
202 // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
203 let _write_fd = unsafe { File::from_raw_fd(raw_write) };
204
205 Ok(ParcelFileDescriptor::new(read_fd))
206 }
207}
208
209lazy_static! {
210 static ref SYSFS_PLATFORM_DEVICES: &'static Path = Path::new("/sys/devices/platform/");
211 static ref VFIO_PLATFORM_DRIVER: &'static Path =
212 Path::new("/sys/bus/platform/drivers/vfio-platform");
213}
214
215fn bind_device(device: &str) -> binder::Result<()> {
216 // Check platform device exists
217 let dev_sysfs_path = canonicalize(device).map_err(|e| {
218 Status::new_exception_str(
219 ExceptionCode::SERVICE_SPECIFIC,
220 Some(format!("can't canonicalize: {e:?}")),
221 )
222 })?;
223 if !dev_sysfs_path.starts_with(*SYSFS_PLATFORM_DEVICES) {
224 return Err(Status::new_exception_str(
225 ExceptionCode::ILLEGAL_ARGUMENT,
226 Some(format!("{device} is not a platform device")),
227 ));
228 }
229
230 // Check platform device is bound to VFIO driver
231 let dev_driver_path = canonicalize(dev_sysfs_path.join("driver")).map_err(|e| {
232 Status::new_exception_str(
233 ExceptionCode::SERVICE_SPECIFIC,
234 Some(format!("can't canonicalize: {e:?}")),
235 )
236 })?;
237 if dev_driver_path != *VFIO_PLATFORM_DRIVER {
238 // TODO(b/278008182): unbind driver and bind to VFIO
239 return Err(Status::new_exception_str(
240 ExceptionCode::UNSUPPORTED_OPERATION,
241 Some("not implemented".to_owned()),
242 ));
243 }
244
245 // already bound to VFIO driver
246 Ok(())
David Brazdilafc9a9e2023-01-12 16:08:10 +0000247}
248
249#[derive(Debug, Default)]
250struct GlobalVmInstance {
251 /// The unique CID assigned to the VM for vsock communication.
252 cid: Cid,
253 /// UID of the client who requested this VM instance.
254 requester_uid: uid_t,
255 /// PID of the client who requested this VM instance.
256 requester_debug_pid: pid_t,
257}
258
259impl GlobalVmInstance {
260 fn get_temp_dir(&self) -> PathBuf {
261 let cid = self.cid;
262 format!("{TEMPORARY_DIRECTORY}/{cid}").into()
263 }
264}
265
266/// The mutable state of the VirtualizationServiceInternal. There should only be one instance
267/// of this struct.
268#[derive(Debug, Default)]
269struct GlobalState {
270 /// VM contexts currently allocated to running VMs. A CID is never recycled as long
271 /// as there is a strong reference held by a GlobalVmContext.
272 held_contexts: HashMap<Cid, Weak<GlobalVmInstance>>,
273}
274
275impl GlobalState {
276 /// Get the next available CID, or an error if we have run out. The last CID used is stored in
277 /// a system property so that restart of virtualizationservice doesn't reuse CID while the host
278 /// Android is up.
279 fn get_next_available_cid(&mut self) -> Result<Cid> {
280 // Start trying to find a CID from the last used CID + 1. This ensures
281 // that we do not eagerly recycle CIDs. It makes debugging easier but
282 // also means that retrying to allocate a CID, eg. because it is
283 // erroneously occupied by a process, will not recycle the same CID.
284 let last_cid_prop =
285 system_properties::read(SYSPROP_LAST_CID)?.and_then(|val| match val.parse::<Cid>() {
286 Ok(num) => {
287 if is_valid_guest_cid(num) {
288 Some(num)
289 } else {
290 error!("Invalid value '{}' of property '{}'", num, SYSPROP_LAST_CID);
291 None
292 }
293 }
294 Err(_) => {
295 error!("Invalid value '{}' of property '{}'", val, SYSPROP_LAST_CID);
296 None
297 }
298 });
299
300 let first_cid = if let Some(last_cid) = last_cid_prop {
301 if last_cid == GUEST_CID_MAX {
302 GUEST_CID_MIN
303 } else {
304 last_cid + 1
305 }
306 } else {
307 GUEST_CID_MIN
308 };
309
310 let cid = self
311 .find_available_cid(first_cid..=GUEST_CID_MAX)
312 .or_else(|| self.find_available_cid(GUEST_CID_MIN..first_cid))
313 .ok_or_else(|| anyhow!("Could not find an available CID."))?;
314
315 system_properties::write(SYSPROP_LAST_CID, &format!("{}", cid))?;
316 Ok(cid)
317 }
318
319 fn find_available_cid<I>(&self, mut range: I) -> Option<Cid>
320 where
321 I: Iterator<Item = Cid>,
322 {
323 range.find(|cid| !self.held_contexts.contains_key(cid))
324 }
325
326 fn allocate_vm_context(
327 &mut self,
328 requester_uid: uid_t,
329 requester_debug_pid: pid_t,
330 ) -> Result<Strong<dyn IGlobalVmContext>> {
331 // Garbage collect unused VM contexts.
332 self.held_contexts.retain(|_, instance| instance.strong_count() > 0);
333
334 let cid = self.get_next_available_cid()?;
335 let instance = Arc::new(GlobalVmInstance { cid, requester_uid, requester_debug_pid });
336 create_temporary_directory(&instance.get_temp_dir(), requester_uid)?;
337
338 self.held_contexts.insert(cid, Arc::downgrade(&instance));
339 let binder = GlobalVmContext { instance, ..Default::default() };
340 Ok(BnGlobalVmContext::new_binder(binder, BinderFeatures::default()))
341 }
342}
343
344fn create_temporary_directory(path: &PathBuf, requester_uid: uid_t) -> Result<()> {
345 if path.as_path().exists() {
346 remove_temporary_dir(path).unwrap_or_else(|e| {
347 warn!("Could not delete temporary directory {:?}: {}", path, e);
348 });
349 }
350 // Create a directory that is owned by client's UID but system's GID, and permissions 0700.
351 // If the chown() fails, this will leave behind an empty directory that will get removed
352 // at the next attempt, or if virtualizationservice is restarted.
353 create_dir(path).with_context(|| format!("Could not create temporary directory {:?}", path))?;
354 chown(path, Some(Uid::from_raw(requester_uid)), None)
355 .with_context(|| format!("Could not set ownership of temporary directory {:?}", path))?;
356 Ok(())
357}
358
359/// Removes a directory owned by a different user by first changing its owner back
360/// to VirtualizationService.
361pub fn remove_temporary_dir(path: &PathBuf) -> Result<()> {
Alice Wangd1b11a02023-04-18 12:30:20 +0000362 ensure!(path.as_path().is_dir(), "Path {:?} is not a directory", path);
David Brazdilafc9a9e2023-01-12 16:08:10 +0000363 chown(path, Some(Uid::current()), None)?;
364 set_permissions(path, Permissions::from_mode(0o700))?;
Alice Wangd1b11a02023-04-18 12:30:20 +0000365 remove_dir_all(path)?;
David Brazdilafc9a9e2023-01-12 16:08:10 +0000366 Ok(())
367}
368
369/// Implementation of the AIDL `IGlobalVmContext` interface.
370#[derive(Debug, Default)]
371struct GlobalVmContext {
372 /// Strong reference to the context's instance data structure.
373 instance: Arc<GlobalVmInstance>,
374 /// Keeps our service process running as long as this VM context exists.
375 #[allow(dead_code)]
376 lazy_service_guard: LazyServiceGuard,
377}
378
379impl Interface for GlobalVmContext {}
380
381impl IGlobalVmContext for GlobalVmContext {
382 fn getCid(&self) -> binder::Result<i32> {
383 Ok(self.instance.cid as i32)
384 }
385
386 fn getTemporaryDirectory(&self) -> binder::Result<String> {
387 Ok(self.instance.get_temp_dir().to_string_lossy().to_string())
388 }
389}
390
391fn handle_stream_connection_tombstoned() -> Result<()> {
392 // Should not listen for tombstones on a guest VM's port.
393 assert!(!is_valid_guest_cid(VM_TOMBSTONES_SERVICE_PORT as Cid));
394 let listener =
395 VsockListener::bind_with_cid_port(VMADDR_CID_HOST, VM_TOMBSTONES_SERVICE_PORT as Cid)?;
396 for incoming_stream in listener.incoming() {
397 let mut incoming_stream = match incoming_stream {
398 Err(e) => {
399 warn!("invalid incoming connection: {:?}", e);
400 continue;
401 }
402 Ok(s) => s,
403 };
404 std::thread::spawn(move || {
405 if let Err(e) = handle_tombstone(&mut incoming_stream) {
406 error!("Failed to write tombstone- {:?}", e);
407 }
408 });
409 }
410 Ok(())
411}
412
413fn handle_tombstone(stream: &mut VsockStream) -> Result<()> {
414 if let Ok(addr) = stream.peer_addr() {
415 info!("Vsock Stream connected to cid={} for tombstones", addr.cid());
416 }
417 let tb_connection =
418 TombstonedConnection::connect(std::process::id() as i32, DebuggerdDumpType::Tombstone)
419 .context("Failed to connect to tombstoned")?;
420 let mut text_output = tb_connection
421 .text_output
422 .as_ref()
423 .ok_or_else(|| anyhow!("Could not get file to write the tombstones on"))?;
424 let mut num_bytes_read = 0;
425 loop {
426 let mut chunk_recv = [0; CHUNK_RECV_MAX_LEN];
427 let n = stream
428 .read(&mut chunk_recv)
429 .context("Failed to read tombstone data from Vsock stream")?;
430 if n == 0 {
431 break;
432 }
433 num_bytes_read += n;
434 text_output.write_all(&chunk_recv[0..n]).context("Failed to write guests tombstones")?;
435 }
436 info!("Received {} bytes from guest & wrote to tombstone file", num_bytes_read);
437 tb_connection.notify_completion()?;
438 Ok(())
439}
440
441/// Checks whether the caller has a specific permission
442fn check_permission(perm: &str) -> binder::Result<()> {
443 let calling_pid = get_calling_pid();
444 let calling_uid = get_calling_uid();
445 // Root can do anything
446 if calling_uid == 0 {
447 return Ok(());
448 }
449 let perm_svc: Strong<dyn IPermissionController::IPermissionController> =
450 binder::get_interface("permission")?;
451 if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? {
452 Ok(())
453 } else {
454 Err(Status::new_exception_str(
455 ExceptionCode::SECURITY,
456 Some(format!("does not have the {} permission", perm)),
457 ))
458 }
459}
460
461/// Check whether the caller of the current Binder method is allowed to call debug methods.
462fn check_debug_access() -> binder::Result<()> {
463 check_permission("android.permission.DEBUG_VIRTUAL_MACHINE")
464}
465
466/// Check whether the caller of the current Binder method is allowed to manage VMs
467fn check_manage_access() -> binder::Result<()> {
468 check_permission("android.permission.MANAGE_VIRTUAL_MACHINE")
469}
Inseob Kim53d0b212023-07-20 16:58:37 +0900470
471/// Check whether the caller of the current Binder method is allowed to use custom VMs
472fn check_use_custom_virtual_machine() -> binder::Result<()> {
473 check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE")
474}