blob: 384915ceacf7d14ce3fa758a39dcbbb080945f8c [file] [log] [blame]
David Brazdilafc9a9e2023-01-12 16:08:10 +00001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Implementation of the AIDL interface of the VirtualizationService.
16
17use crate::{get_calling_pid, get_calling_uid};
David Brazdil33a31022023-01-12 16:55:16 +000018use crate::atom::{forward_vm_booted_atom, forward_vm_creation_atom, forward_vm_exited_atom};
Alice Wangc2fec932023-02-23 16:24:02 +000019use crate::rkpvm::request_certificate;
David Brazdilafc9a9e2023-01-12 16:08:10 +000020use android_os_permissions_aidl::aidl::android::os::IPermissionController;
Alice Wangc2fec932023-02-23 16:24:02 +000021use android_system_virtualizationservice::{
Inseob Kim53d0b212023-07-20 16:58:37 +090022 aidl::android::system::virtualizationservice::AssignableDevice::AssignableDevice,
Alice Wangc2fec932023-02-23 16:24:02 +000023 aidl::android::system::virtualizationservice::VirtualMachineDebugInfo::VirtualMachineDebugInfo,
24 binder::ParcelFileDescriptor,
25};
David Brazdilafc9a9e2023-01-12 16:08:10 +000026use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::{
27 AtomVmBooted::AtomVmBooted,
28 AtomVmCreationRequested::AtomVmCreationRequested,
29 AtomVmExited::AtomVmExited,
30 IGlobalVmContext::{BnGlobalVmContext, IGlobalVmContext},
31 IVirtualizationServiceInternal::IVirtualizationServiceInternal,
Inseob Kimbdca0472023-07-28 19:20:56 +090032 IVfioHandler::{BpVfioHandler, IVfioHandler},
David Brazdilafc9a9e2023-01-12 16:08:10 +000033};
34use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::VM_TOMBSTONES_SERVICE_PORT;
Alice Wangd1b11a02023-04-18 12:30:20 +000035use anyhow::{anyhow, ensure, Context, Result};
Inseob Kimbdca0472023-07-28 19:20:56 +090036use binder::{self, wait_for_interface, BinderFeatures, ExceptionCode, Interface, LazyServiceGuard, Status, Strong};
David Brazdilafc9a9e2023-01-12 16:08:10 +000037use libc::VMADDR_CID_HOST;
38use log::{error, info, warn};
39use rustutils::system_properties;
Inseob Kim6ef80972023-07-20 17:23:36 +090040use std::collections::HashMap;
Inseob Kimbdca0472023-07-28 19:20:56 +090041use std::fs::{create_dir, remove_dir_all, set_permissions, Permissions};
David Brazdilafc9a9e2023-01-12 16:08:10 +000042use std::io::{Read, Write};
43use std::os::unix::fs::PermissionsExt;
44use std::os::unix::raw::{pid_t, uid_t};
Inseob Kimbdca0472023-07-28 19:20:56 +090045use std::path::PathBuf;
David Brazdilafc9a9e2023-01-12 16:08:10 +000046use std::sync::{Arc, Mutex, Weak};
47use tombstoned_client::{DebuggerdDumpType, TombstonedConnection};
48use vsock::{VsockListener, VsockStream};
Inseob Kimbdca0472023-07-28 19:20:56 +090049use nix::unistd::{chown, Uid};
David Brazdilafc9a9e2023-01-12 16:08:10 +000050
51/// The unique ID of a VM used (together with a port number) for vsock communication.
52pub type Cid = u32;
53
54pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice";
55
56/// Directory in which to write disk image files used while running VMs.
57pub const TEMPORARY_DIRECTORY: &str = "/data/misc/virtualizationservice";
58
59/// The first CID to assign to a guest VM managed by the VirtualizationService. CIDs lower than this
60/// are reserved for the host or other usage.
61const GUEST_CID_MIN: Cid = 2048;
62const GUEST_CID_MAX: Cid = 65535;
63
64const SYSPROP_LAST_CID: &str = "virtualizationservice.state.last_cid";
65
66const CHUNK_RECV_MAX_LEN: usize = 1024;
67
68fn is_valid_guest_cid(cid: Cid) -> bool {
69 (GUEST_CID_MIN..=GUEST_CID_MAX).contains(&cid)
70}
71
72/// Singleton service for allocating globally-unique VM resources, such as the CID, and running
73/// singleton servers, like tombstone receiver.
74#[derive(Debug, Default)]
75pub struct VirtualizationServiceInternal {
76 state: Arc<Mutex<GlobalState>>,
77}
78
79impl VirtualizationServiceInternal {
80 pub fn init() -> VirtualizationServiceInternal {
81 let service = VirtualizationServiceInternal::default();
82
83 std::thread::spawn(|| {
84 if let Err(e) = handle_stream_connection_tombstoned() {
85 warn!("Error receiving tombstone from guest or writing them. Error: {:?}", e);
86 }
87 });
88
89 service
90 }
91}
92
93impl Interface for VirtualizationServiceInternal {}
94
95impl IVirtualizationServiceInternal for VirtualizationServiceInternal {
96 fn removeMemlockRlimit(&self) -> binder::Result<()> {
97 let pid = get_calling_pid();
98 let lim = libc::rlimit { rlim_cur: libc::RLIM_INFINITY, rlim_max: libc::RLIM_INFINITY };
99
Andrew Walbranb58d1b42023-07-07 13:54:49 +0100100 // SAFETY: borrowing the new limit struct only
David Brazdilafc9a9e2023-01-12 16:08:10 +0000101 let ret = unsafe { libc::prlimit(pid, libc::RLIMIT_MEMLOCK, &lim, std::ptr::null_mut()) };
102
103 match ret {
104 0 => Ok(()),
105 -1 => Err(Status::new_exception_str(
106 ExceptionCode::ILLEGAL_STATE,
107 Some(std::io::Error::last_os_error().to_string()),
108 )),
109 n => Err(Status::new_exception_str(
110 ExceptionCode::ILLEGAL_STATE,
111 Some(format!("Unexpected return value from prlimit(): {n}")),
112 )),
113 }
114 }
115
116 fn allocateGlobalVmContext(
117 &self,
118 requester_debug_pid: i32,
119 ) -> binder::Result<Strong<dyn IGlobalVmContext>> {
120 check_manage_access()?;
121
122 let requester_uid = get_calling_uid();
123 let requester_debug_pid = requester_debug_pid as pid_t;
124 let state = &mut *self.state.lock().unwrap();
125 state.allocate_vm_context(requester_uid, requester_debug_pid).map_err(|e| {
126 Status::new_exception_str(ExceptionCode::ILLEGAL_STATE, Some(e.to_string()))
127 })
128 }
129
130 fn atomVmBooted(&self, atom: &AtomVmBooted) -> Result<(), Status> {
131 forward_vm_booted_atom(atom);
132 Ok(())
133 }
134
135 fn atomVmCreationRequested(&self, atom: &AtomVmCreationRequested) -> Result<(), Status> {
136 forward_vm_creation_atom(atom);
137 Ok(())
138 }
139
140 fn atomVmExited(&self, atom: &AtomVmExited) -> Result<(), Status> {
141 forward_vm_exited_atom(atom);
142 Ok(())
143 }
144
145 fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> {
146 check_debug_access()?;
147
148 let state = &mut *self.state.lock().unwrap();
149 let cids = state
150 .held_contexts
151 .iter()
152 .filter_map(|(_, inst)| Weak::upgrade(inst))
153 .map(|vm| VirtualMachineDebugInfo {
154 cid: vm.cid as i32,
155 temporaryDirectory: vm.get_temp_dir().to_string_lossy().to_string(),
156 requesterUid: vm.requester_uid as i32,
Charisee96113f32023-01-26 09:00:42 +0000157 requesterPid: vm.requester_debug_pid,
David Brazdilafc9a9e2023-01-12 16:08:10 +0000158 })
159 .collect();
160 Ok(cids)
161 }
Alice Wangc2fec932023-02-23 16:24:02 +0000162
163 fn requestCertificate(
164 &self,
165 csr: &[u8],
166 instance_img_fd: &ParcelFileDescriptor,
167 ) -> binder::Result<Vec<u8>> {
168 check_manage_access()?;
169 info!("Received csr. Getting certificate...");
170 request_certificate(csr, instance_img_fd).map_err(|e| {
171 error!("Failed to get certificate. Error: {e:?}");
172 Status::new_exception_str(ExceptionCode::SERVICE_SPECIFIC, Some(e.to_string()))
173 })
174 }
Inseob Kim53d0b212023-07-20 16:58:37 +0900175
176 fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> {
177 check_use_custom_virtual_machine()?;
178
179 // TODO(b/291191362): read VM DTBO to find assignable devices.
180 Ok(vec![AssignableDevice {
181 kind: "eh".to_owned(),
182 node: "/sys/bus/platform/devices/16d00000.eh".to_owned(),
183 }])
184 }
Inseob Kim1ca0f652023-07-20 17:18:12 +0900185
186 fn bindDevicesToVfioDriver(&self, devices: &[String]) -> binder::Result<ParcelFileDescriptor> {
187 check_use_custom_virtual_machine()?;
188
Inseob Kimbdca0472023-07-28 19:20:56 +0900189 let vfio_service: Strong<dyn IVfioHandler> =
190 wait_for_interface(<BpVfioHandler as IVfioHandler>::get_descriptor())?;
191 vfio_service.bindDevicesToVfioDriver(devices)
Inseob Kim1ca0f652023-07-20 17:18:12 +0900192 }
193}
194
David Brazdilafc9a9e2023-01-12 16:08:10 +0000195#[derive(Debug, Default)]
196struct GlobalVmInstance {
197 /// The unique CID assigned to the VM for vsock communication.
198 cid: Cid,
199 /// UID of the client who requested this VM instance.
200 requester_uid: uid_t,
201 /// PID of the client who requested this VM instance.
202 requester_debug_pid: pid_t,
203}
204
205impl GlobalVmInstance {
206 fn get_temp_dir(&self) -> PathBuf {
207 let cid = self.cid;
208 format!("{TEMPORARY_DIRECTORY}/{cid}").into()
209 }
210}
211
212/// The mutable state of the VirtualizationServiceInternal. There should only be one instance
213/// of this struct.
214#[derive(Debug, Default)]
215struct GlobalState {
216 /// VM contexts currently allocated to running VMs. A CID is never recycled as long
217 /// as there is a strong reference held by a GlobalVmContext.
218 held_contexts: HashMap<Cid, Weak<GlobalVmInstance>>,
219}
220
221impl GlobalState {
222 /// Get the next available CID, or an error if we have run out. The last CID used is stored in
223 /// a system property so that restart of virtualizationservice doesn't reuse CID while the host
224 /// Android is up.
225 fn get_next_available_cid(&mut self) -> Result<Cid> {
226 // Start trying to find a CID from the last used CID + 1. This ensures
227 // that we do not eagerly recycle CIDs. It makes debugging easier but
228 // also means that retrying to allocate a CID, eg. because it is
229 // erroneously occupied by a process, will not recycle the same CID.
230 let last_cid_prop =
231 system_properties::read(SYSPROP_LAST_CID)?.and_then(|val| match val.parse::<Cid>() {
232 Ok(num) => {
233 if is_valid_guest_cid(num) {
234 Some(num)
235 } else {
236 error!("Invalid value '{}' of property '{}'", num, SYSPROP_LAST_CID);
237 None
238 }
239 }
240 Err(_) => {
241 error!("Invalid value '{}' of property '{}'", val, SYSPROP_LAST_CID);
242 None
243 }
244 });
245
246 let first_cid = if let Some(last_cid) = last_cid_prop {
247 if last_cid == GUEST_CID_MAX {
248 GUEST_CID_MIN
249 } else {
250 last_cid + 1
251 }
252 } else {
253 GUEST_CID_MIN
254 };
255
256 let cid = self
257 .find_available_cid(first_cid..=GUEST_CID_MAX)
258 .or_else(|| self.find_available_cid(GUEST_CID_MIN..first_cid))
259 .ok_or_else(|| anyhow!("Could not find an available CID."))?;
260
261 system_properties::write(SYSPROP_LAST_CID, &format!("{}", cid))?;
262 Ok(cid)
263 }
264
265 fn find_available_cid<I>(&self, mut range: I) -> Option<Cid>
266 where
267 I: Iterator<Item = Cid>,
268 {
269 range.find(|cid| !self.held_contexts.contains_key(cid))
270 }
271
272 fn allocate_vm_context(
273 &mut self,
274 requester_uid: uid_t,
275 requester_debug_pid: pid_t,
276 ) -> Result<Strong<dyn IGlobalVmContext>> {
277 // Garbage collect unused VM contexts.
278 self.held_contexts.retain(|_, instance| instance.strong_count() > 0);
279
280 let cid = self.get_next_available_cid()?;
281 let instance = Arc::new(GlobalVmInstance { cid, requester_uid, requester_debug_pid });
282 create_temporary_directory(&instance.get_temp_dir(), requester_uid)?;
283
284 self.held_contexts.insert(cid, Arc::downgrade(&instance));
285 let binder = GlobalVmContext { instance, ..Default::default() };
286 Ok(BnGlobalVmContext::new_binder(binder, BinderFeatures::default()))
287 }
288}
289
290fn create_temporary_directory(path: &PathBuf, requester_uid: uid_t) -> Result<()> {
291 if path.as_path().exists() {
292 remove_temporary_dir(path).unwrap_or_else(|e| {
293 warn!("Could not delete temporary directory {:?}: {}", path, e);
294 });
295 }
296 // Create a directory that is owned by client's UID but system's GID, and permissions 0700.
297 // If the chown() fails, this will leave behind an empty directory that will get removed
298 // at the next attempt, or if virtualizationservice is restarted.
299 create_dir(path).with_context(|| format!("Could not create temporary directory {:?}", path))?;
300 chown(path, Some(Uid::from_raw(requester_uid)), None)
301 .with_context(|| format!("Could not set ownership of temporary directory {:?}", path))?;
302 Ok(())
303}
304
305/// Removes a directory owned by a different user by first changing its owner back
306/// to VirtualizationService.
307pub fn remove_temporary_dir(path: &PathBuf) -> Result<()> {
Alice Wangd1b11a02023-04-18 12:30:20 +0000308 ensure!(path.as_path().is_dir(), "Path {:?} is not a directory", path);
David Brazdilafc9a9e2023-01-12 16:08:10 +0000309 chown(path, Some(Uid::current()), None)?;
310 set_permissions(path, Permissions::from_mode(0o700))?;
Alice Wangd1b11a02023-04-18 12:30:20 +0000311 remove_dir_all(path)?;
David Brazdilafc9a9e2023-01-12 16:08:10 +0000312 Ok(())
313}
314
315/// Implementation of the AIDL `IGlobalVmContext` interface.
316#[derive(Debug, Default)]
317struct GlobalVmContext {
318 /// Strong reference to the context's instance data structure.
319 instance: Arc<GlobalVmInstance>,
320 /// Keeps our service process running as long as this VM context exists.
321 #[allow(dead_code)]
322 lazy_service_guard: LazyServiceGuard,
323}
324
325impl Interface for GlobalVmContext {}
326
327impl IGlobalVmContext for GlobalVmContext {
328 fn getCid(&self) -> binder::Result<i32> {
329 Ok(self.instance.cid as i32)
330 }
331
332 fn getTemporaryDirectory(&self) -> binder::Result<String> {
333 Ok(self.instance.get_temp_dir().to_string_lossy().to_string())
334 }
335}
336
337fn handle_stream_connection_tombstoned() -> Result<()> {
338 // Should not listen for tombstones on a guest VM's port.
339 assert!(!is_valid_guest_cid(VM_TOMBSTONES_SERVICE_PORT as Cid));
340 let listener =
341 VsockListener::bind_with_cid_port(VMADDR_CID_HOST, VM_TOMBSTONES_SERVICE_PORT as Cid)?;
342 for incoming_stream in listener.incoming() {
343 let mut incoming_stream = match incoming_stream {
344 Err(e) => {
345 warn!("invalid incoming connection: {:?}", e);
346 continue;
347 }
348 Ok(s) => s,
349 };
350 std::thread::spawn(move || {
351 if let Err(e) = handle_tombstone(&mut incoming_stream) {
352 error!("Failed to write tombstone- {:?}", e);
353 }
354 });
355 }
356 Ok(())
357}
358
359fn handle_tombstone(stream: &mut VsockStream) -> Result<()> {
360 if let Ok(addr) = stream.peer_addr() {
361 info!("Vsock Stream connected to cid={} for tombstones", addr.cid());
362 }
363 let tb_connection =
364 TombstonedConnection::connect(std::process::id() as i32, DebuggerdDumpType::Tombstone)
365 .context("Failed to connect to tombstoned")?;
366 let mut text_output = tb_connection
367 .text_output
368 .as_ref()
369 .ok_or_else(|| anyhow!("Could not get file to write the tombstones on"))?;
370 let mut num_bytes_read = 0;
371 loop {
372 let mut chunk_recv = [0; CHUNK_RECV_MAX_LEN];
373 let n = stream
374 .read(&mut chunk_recv)
375 .context("Failed to read tombstone data from Vsock stream")?;
376 if n == 0 {
377 break;
378 }
379 num_bytes_read += n;
380 text_output.write_all(&chunk_recv[0..n]).context("Failed to write guests tombstones")?;
381 }
382 info!("Received {} bytes from guest & wrote to tombstone file", num_bytes_read);
383 tb_connection.notify_completion()?;
384 Ok(())
385}
386
387/// Checks whether the caller has a specific permission
388fn check_permission(perm: &str) -> binder::Result<()> {
389 let calling_pid = get_calling_pid();
390 let calling_uid = get_calling_uid();
391 // Root can do anything
392 if calling_uid == 0 {
393 return Ok(());
394 }
395 let perm_svc: Strong<dyn IPermissionController::IPermissionController> =
396 binder::get_interface("permission")?;
397 if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? {
398 Ok(())
399 } else {
400 Err(Status::new_exception_str(
401 ExceptionCode::SECURITY,
402 Some(format!("does not have the {} permission", perm)),
403 ))
404 }
405}
406
407/// Check whether the caller of the current Binder method is allowed to call debug methods.
408fn check_debug_access() -> binder::Result<()> {
409 check_permission("android.permission.DEBUG_VIRTUAL_MACHINE")
410}
411
412/// Check whether the caller of the current Binder method is allowed to manage VMs
413fn check_manage_access() -> binder::Result<()> {
414 check_permission("android.permission.MANAGE_VIRTUAL_MACHINE")
415}
Inseob Kim53d0b212023-07-20 16:58:37 +0900416
417/// Check whether the caller of the current Binder method is allowed to use custom VMs
418fn check_use_custom_virtual_machine() -> binder::Result<()> {
419 check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE")
420}