David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 1 | // Copyright 2021, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Implementation of the AIDL interface of the VirtualizationService. |
| 16 | |
Alice Wang | bff017f | 2023-11-09 14:43:28 +0000 | [diff] [blame] | 17 | use crate::{get_calling_pid, get_calling_uid, REMOTELY_PROVISIONED_COMPONENT_SERVICE_NAME}; |
David Brazdil | 33a3102 | 2023-01-12 16:55:16 +0000 | [diff] [blame] | 18 | use crate::atom::{forward_vm_booted_atom, forward_vm_creation_atom, forward_vm_exited_atom}; |
Alice Wang | a410b64 | 2023-10-18 09:05:15 +0000 | [diff] [blame] | 19 | use crate::rkpvm::request_attestation; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 20 | use android_os_permissions_aidl::aidl::android::os::IPermissionController; |
Alice Wang | 4e3015d | 2023-10-10 09:35:37 +0000 | [diff] [blame] | 21 | use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::Certificate::Certificate; |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 22 | use android_system_virtualizationservice::{ |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 23 | aidl::android::system::virtualizationservice::AssignableDevice::AssignableDevice, |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 24 | aidl::android::system::virtualizationservice::VirtualMachineDebugInfo::VirtualMachineDebugInfo, |
| 25 | binder::ParcelFileDescriptor, |
| 26 | }; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 27 | use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::{ |
| 28 | AtomVmBooted::AtomVmBooted, |
| 29 | AtomVmCreationRequested::AtomVmCreationRequested, |
| 30 | AtomVmExited::AtomVmExited, |
| 31 | IGlobalVmContext::{BnGlobalVmContext, IGlobalVmContext}, |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 32 | IVirtualizationServiceInternal::BoundDevice::BoundDevice, |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 33 | IVirtualizationServiceInternal::IVirtualizationServiceInternal, |
Inseob Kim | bdca047 | 2023-07-28 19:20:56 +0900 | [diff] [blame] | 34 | IVfioHandler::{BpVfioHandler, IVfioHandler}, |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 35 | }; |
| 36 | use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::VM_TOMBSTONES_SERVICE_PORT; |
Alice Wang | d1b11a0 | 2023-04-18 12:30:20 +0000 | [diff] [blame] | 37 | use anyhow::{anyhow, ensure, Context, Result}; |
Jiyong Park | d7bd2f2 | 2023-08-10 20:41:19 +0900 | [diff] [blame] | 38 | use avflog::LogResult; |
Jiyong Park | 2227eaa | 2023-08-04 11:59:18 +0900 | [diff] [blame] | 39 | use binder::{self, wait_for_interface, BinderFeatures, ExceptionCode, Interface, LazyServiceGuard, Status, Strong, IntoBinderResult}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 40 | use libc::VMADDR_CID_HOST; |
| 41 | use log::{error, info, warn}; |
Alice Wang | bff017f | 2023-11-09 14:43:28 +0000 | [diff] [blame] | 42 | use rkpd_client::get_rkpd_attestation_key; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 43 | use rustutils::system_properties; |
Inseob Kim | c4a774d | 2023-08-30 12:48:43 +0900 | [diff] [blame] | 44 | use serde::Deserialize; |
| 45 | use std::collections::{HashMap, HashSet}; |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 46 | use std::fs::{self, create_dir, remove_dir_all, remove_file, set_permissions, File, Permissions}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 47 | use std::io::{Read, Write}; |
| 48 | use std::os::unix::fs::PermissionsExt; |
| 49 | use std::os::unix::raw::{pid_t, uid_t}; |
Inseob Kim | 55438b2 | 2023-08-09 20:16:01 +0900 | [diff] [blame] | 50 | use std::path::{Path, PathBuf}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 51 | use std::sync::{Arc, Mutex, Weak}; |
| 52 | use tombstoned_client::{DebuggerdDumpType, TombstonedConnection}; |
| 53 | use vsock::{VsockListener, VsockStream}; |
Inseob Kim | bdca047 | 2023-07-28 19:20:56 +0900 | [diff] [blame] | 54 | use nix::unistd::{chown, Uid}; |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 55 | use x509_parser::{traits::FromDer, certificate::X509Certificate}; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 56 | |
| 57 | /// The unique ID of a VM used (together with a port number) for vsock communication. |
| 58 | pub type Cid = u32; |
| 59 | |
| 60 | pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice"; |
| 61 | |
| 62 | /// Directory in which to write disk image files used while running VMs. |
| 63 | pub const TEMPORARY_DIRECTORY: &str = "/data/misc/virtualizationservice"; |
| 64 | |
| 65 | /// The first CID to assign to a guest VM managed by the VirtualizationService. CIDs lower than this |
| 66 | /// are reserved for the host or other usage. |
| 67 | const GUEST_CID_MIN: Cid = 2048; |
| 68 | const GUEST_CID_MAX: Cid = 65535; |
| 69 | |
| 70 | const SYSPROP_LAST_CID: &str = "virtualizationservice.state.last_cid"; |
| 71 | |
| 72 | const CHUNK_RECV_MAX_LEN: usize = 1024; |
| 73 | |
| 74 | fn is_valid_guest_cid(cid: Cid) -> bool { |
| 75 | (GUEST_CID_MIN..=GUEST_CID_MAX).contains(&cid) |
| 76 | } |
| 77 | |
| 78 | /// Singleton service for allocating globally-unique VM resources, such as the CID, and running |
| 79 | /// singleton servers, like tombstone receiver. |
| 80 | #[derive(Debug, Default)] |
| 81 | pub struct VirtualizationServiceInternal { |
| 82 | state: Arc<Mutex<GlobalState>>, |
| 83 | } |
| 84 | |
| 85 | impl VirtualizationServiceInternal { |
| 86 | pub fn init() -> VirtualizationServiceInternal { |
| 87 | let service = VirtualizationServiceInternal::default(); |
| 88 | |
| 89 | std::thread::spawn(|| { |
| 90 | if let Err(e) = handle_stream_connection_tombstoned() { |
| 91 | warn!("Error receiving tombstone from guest or writing them. Error: {:?}", e); |
| 92 | } |
| 93 | }); |
| 94 | |
| 95 | service |
| 96 | } |
| 97 | } |
| 98 | |
| 99 | impl Interface for VirtualizationServiceInternal {} |
| 100 | |
| 101 | impl IVirtualizationServiceInternal for VirtualizationServiceInternal { |
| 102 | fn removeMemlockRlimit(&self) -> binder::Result<()> { |
| 103 | let pid = get_calling_pid(); |
| 104 | let lim = libc::rlimit { rlim_cur: libc::RLIM_INFINITY, rlim_max: libc::RLIM_INFINITY }; |
| 105 | |
Andrew Walbran | b58d1b4 | 2023-07-07 13:54:49 +0100 | [diff] [blame] | 106 | // SAFETY: borrowing the new limit struct only |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 107 | let ret = unsafe { libc::prlimit(pid, libc::RLIMIT_MEMLOCK, &lim, std::ptr::null_mut()) }; |
| 108 | |
| 109 | match ret { |
| 110 | 0 => Ok(()), |
Jiyong Park | 2227eaa | 2023-08-04 11:59:18 +0900 | [diff] [blame] | 111 | -1 => Err(std::io::Error::last_os_error().into()), |
| 112 | n => Err(anyhow!("Unexpected return value from prlimit(): {n}")), |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 113 | } |
Jiyong Park | 2227eaa | 2023-08-04 11:59:18 +0900 | [diff] [blame] | 114 | .or_binder_exception(ExceptionCode::ILLEGAL_STATE) |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 115 | } |
| 116 | |
| 117 | fn allocateGlobalVmContext( |
| 118 | &self, |
| 119 | requester_debug_pid: i32, |
| 120 | ) -> binder::Result<Strong<dyn IGlobalVmContext>> { |
| 121 | check_manage_access()?; |
| 122 | |
| 123 | let requester_uid = get_calling_uid(); |
| 124 | let requester_debug_pid = requester_debug_pid as pid_t; |
| 125 | let state = &mut *self.state.lock().unwrap(); |
Jiyong Park | 2227eaa | 2023-08-04 11:59:18 +0900 | [diff] [blame] | 126 | state |
| 127 | .allocate_vm_context(requester_uid, requester_debug_pid) |
| 128 | .or_binder_exception(ExceptionCode::ILLEGAL_STATE) |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 129 | } |
| 130 | |
| 131 | fn atomVmBooted(&self, atom: &AtomVmBooted) -> Result<(), Status> { |
| 132 | forward_vm_booted_atom(atom); |
| 133 | Ok(()) |
| 134 | } |
| 135 | |
| 136 | fn atomVmCreationRequested(&self, atom: &AtomVmCreationRequested) -> Result<(), Status> { |
| 137 | forward_vm_creation_atom(atom); |
| 138 | Ok(()) |
| 139 | } |
| 140 | |
| 141 | fn atomVmExited(&self, atom: &AtomVmExited) -> Result<(), Status> { |
| 142 | forward_vm_exited_atom(atom); |
| 143 | Ok(()) |
| 144 | } |
| 145 | |
| 146 | fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> { |
| 147 | check_debug_access()?; |
| 148 | |
| 149 | let state = &mut *self.state.lock().unwrap(); |
| 150 | let cids = state |
| 151 | .held_contexts |
| 152 | .iter() |
| 153 | .filter_map(|(_, inst)| Weak::upgrade(inst)) |
| 154 | .map(|vm| VirtualMachineDebugInfo { |
| 155 | cid: vm.cid as i32, |
| 156 | temporaryDirectory: vm.get_temp_dir().to_string_lossy().to_string(), |
| 157 | requesterUid: vm.requester_uid as i32, |
Charisee | 96113f3 | 2023-01-26 09:00:42 +0000 | [diff] [blame] | 158 | requesterPid: vm.requester_debug_pid, |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 159 | }) |
| 160 | .collect(); |
| 161 | Ok(cids) |
| 162 | } |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 163 | |
Alice Wang | bff017f | 2023-11-09 14:43:28 +0000 | [diff] [blame] | 164 | fn requestAttestation( |
| 165 | &self, |
| 166 | csr: &[u8], |
| 167 | requester_uid: i32, |
| 168 | ) -> binder::Result<Vec<Certificate>> { |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 169 | check_manage_access()?; |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 170 | if !cfg!(remote_attestation) { |
| 171 | return Err(Status::new_exception_str( |
Alice Wang | e9ac2db | 2023-09-08 15:13:13 +0000 | [diff] [blame] | 172 | ExceptionCode::UNSUPPORTED_OPERATION, |
| 173 | Some( |
Alice Wang | a410b64 | 2023-10-18 09:05:15 +0000 | [diff] [blame] | 174 | "requestAttestation is not supported with the remote_attestation feature \ |
| 175 | disabled", |
Alice Wang | e9ac2db | 2023-09-08 15:13:13 +0000 | [diff] [blame] | 176 | ), |
| 177 | )) |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 178 | .with_log(); |
Alice Wang | e9ac2db | 2023-09-08 15:13:13 +0000 | [diff] [blame] | 179 | } |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 180 | info!("Received csr. Requestting attestation..."); |
| 181 | let attestation_key = get_rkpd_attestation_key( |
| 182 | REMOTELY_PROVISIONED_COMPONENT_SERVICE_NAME, |
| 183 | requester_uid as u32, |
| 184 | ) |
| 185 | .context("Failed to retrieve the remotely provisioned keys") |
| 186 | .with_log() |
| 187 | .or_service_specific_exception(-1)?; |
| 188 | let mut certificate_chain = split_x509_certificate_chain(&attestation_key.encodedCertChain) |
| 189 | .context("Failed to split the remotely provisioned certificate chain") |
| 190 | .with_log() |
| 191 | .or_service_specific_exception(-1)?; |
| 192 | if certificate_chain.is_empty() { |
| 193 | return Err(Status::new_service_specific_error_str( |
| 194 | -1, |
| 195 | Some("The certificate chain should contain at least 1 certificate"), |
| 196 | )) |
| 197 | .with_log(); |
| 198 | } |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 199 | let certificate = request_attestation( |
| 200 | csr.to_vec(), |
| 201 | attestation_key.keyBlob, |
| 202 | certificate_chain[0].encodedCertificate.clone(), |
| 203 | ) |
| 204 | .context("Failed to request attestation") |
| 205 | .with_log() |
| 206 | .or_service_specific_exception(-1)?; |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 207 | certificate_chain.insert(0, Certificate { encodedCertificate: certificate }); |
| 208 | |
| 209 | Ok(certificate_chain) |
Alice Wang | c2fec93 | 2023-02-23 16:24:02 +0000 | [diff] [blame] | 210 | } |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 211 | |
| 212 | fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> { |
| 213 | check_use_custom_virtual_machine()?; |
| 214 | |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 215 | Ok(get_assignable_devices()? |
| 216 | .device |
| 217 | .into_iter() |
| 218 | .map(|x| AssignableDevice { node: x.sysfs_path, kind: x.kind }) |
| 219 | .collect::<Vec<_>>()) |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 220 | } |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 221 | |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 222 | fn bindDevicesToVfioDriver(&self, devices: &[String]) -> binder::Result<Vec<BoundDevice>> { |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 223 | check_use_custom_virtual_machine()?; |
| 224 | |
Inseob Kim | bdca047 | 2023-07-28 19:20:56 +0900 | [diff] [blame] | 225 | let vfio_service: Strong<dyn IVfioHandler> = |
| 226 | wait_for_interface(<BpVfioHandler as IVfioHandler>::get_descriptor())?; |
Seungjae Yoo | 9d3c20a | 2023-09-07 15:36:44 +0900 | [diff] [blame] | 227 | vfio_service.bindDevicesToVfioDriver(devices)?; |
| 228 | |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 229 | Ok(get_assignable_devices()? |
| 230 | .device |
| 231 | .into_iter() |
| 232 | .filter_map(|x| { |
| 233 | if devices.contains(&x.sysfs_path) { |
Jaewan Kim | 35e818d | 2023-10-18 05:36:38 +0000 | [diff] [blame] | 234 | Some(BoundDevice { sysfsPath: x.sysfs_path, dtboLabel: x.dtbo_label }) |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 235 | } else { |
| 236 | None |
| 237 | } |
| 238 | }) |
| 239 | .collect::<Vec<_>>()) |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 240 | } |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 241 | |
| 242 | fn getDtboFile(&self) -> binder::Result<ParcelFileDescriptor> { |
| 243 | check_use_custom_virtual_machine()?; |
| 244 | |
| 245 | let state = &mut *self.state.lock().unwrap(); |
| 246 | let file = state.get_dtbo_file().or_service_specific_exception(-1)?; |
| 247 | Ok(ParcelFileDescriptor::new(file)) |
| 248 | } |
Inseob Kim | 1ca0f65 | 2023-07-20 17:18:12 +0900 | [diff] [blame] | 249 | } |
| 250 | |
Inseob Kim | c4a774d | 2023-08-30 12:48:43 +0900 | [diff] [blame] | 251 | // KEEP IN SYNC WITH assignable_devices.xsd |
| 252 | #[derive(Debug, Deserialize)] |
| 253 | struct Device { |
| 254 | kind: String, |
Jaewan Kim | 35e818d | 2023-10-18 05:36:38 +0000 | [diff] [blame] | 255 | dtbo_label: String, |
Inseob Kim | c4a774d | 2023-08-30 12:48:43 +0900 | [diff] [blame] | 256 | sysfs_path: String, |
| 257 | } |
| 258 | |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 259 | #[derive(Debug, Default, Deserialize)] |
Inseob Kim | c4a774d | 2023-08-30 12:48:43 +0900 | [diff] [blame] | 260 | struct Devices { |
| 261 | device: Vec<Device>, |
| 262 | } |
| 263 | |
Inseob Kim | 7307a89 | 2023-09-14 13:37:58 +0900 | [diff] [blame] | 264 | fn get_assignable_devices() -> binder::Result<Devices> { |
| 265 | let xml_path = Path::new("/vendor/etc/avf/assignable_devices.xml"); |
| 266 | if !xml_path.exists() { |
| 267 | return Ok(Devices { ..Default::default() }); |
| 268 | } |
| 269 | |
| 270 | let xml = fs::read(xml_path) |
| 271 | .context("Failed to read assignable_devices.xml") |
| 272 | .with_log() |
| 273 | .or_service_specific_exception(-1)?; |
| 274 | |
| 275 | let xml = String::from_utf8(xml) |
| 276 | .context("assignable_devices.xml is not a valid UTF-8 file") |
| 277 | .with_log() |
| 278 | .or_service_specific_exception(-1)?; |
| 279 | |
| 280 | let mut devices: Devices = serde_xml_rs::from_str(&xml) |
| 281 | .context("can't parse assignable_devices.xml") |
| 282 | .with_log() |
| 283 | .or_service_specific_exception(-1)?; |
| 284 | |
| 285 | let mut device_set = HashSet::new(); |
| 286 | devices.device.retain(move |device| { |
| 287 | if device_set.contains(&device.sysfs_path) { |
| 288 | warn!("duplicated assignable device {device:?}; ignoring..."); |
| 289 | return false; |
| 290 | } |
| 291 | |
| 292 | if !Path::new(&device.sysfs_path).exists() { |
| 293 | warn!("assignable device {device:?} doesn't exist; ignoring..."); |
| 294 | return false; |
| 295 | } |
| 296 | |
| 297 | device_set.insert(device.sysfs_path.clone()); |
| 298 | true |
| 299 | }); |
| 300 | Ok(devices) |
| 301 | } |
| 302 | |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 303 | fn split_x509_certificate_chain(mut cert_chain: &[u8]) -> Result<Vec<Certificate>> { |
| 304 | let mut out = Vec::new(); |
| 305 | while !cert_chain.is_empty() { |
| 306 | let (remaining, _) = X509Certificate::from_der(cert_chain)?; |
| 307 | let end = cert_chain.len() - remaining.len(); |
| 308 | out.push(Certificate { encodedCertificate: cert_chain[..end].to_vec() }); |
| 309 | cert_chain = remaining; |
| 310 | } |
| 311 | Ok(out) |
| 312 | } |
| 313 | |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 314 | #[derive(Debug, Default)] |
| 315 | struct GlobalVmInstance { |
| 316 | /// The unique CID assigned to the VM for vsock communication. |
| 317 | cid: Cid, |
| 318 | /// UID of the client who requested this VM instance. |
| 319 | requester_uid: uid_t, |
| 320 | /// PID of the client who requested this VM instance. |
| 321 | requester_debug_pid: pid_t, |
| 322 | } |
| 323 | |
| 324 | impl GlobalVmInstance { |
| 325 | fn get_temp_dir(&self) -> PathBuf { |
| 326 | let cid = self.cid; |
| 327 | format!("{TEMPORARY_DIRECTORY}/{cid}").into() |
| 328 | } |
| 329 | } |
| 330 | |
| 331 | /// The mutable state of the VirtualizationServiceInternal. There should only be one instance |
| 332 | /// of this struct. |
| 333 | #[derive(Debug, Default)] |
| 334 | struct GlobalState { |
| 335 | /// VM contexts currently allocated to running VMs. A CID is never recycled as long |
| 336 | /// as there is a strong reference held by a GlobalVmContext. |
| 337 | held_contexts: HashMap<Cid, Weak<GlobalVmInstance>>, |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 338 | |
| 339 | /// Cached read-only FD of VM DTBO file. Also serves as a lock for creating the file. |
| 340 | dtbo_file: Mutex<Option<File>>, |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 341 | } |
| 342 | |
| 343 | impl GlobalState { |
| 344 | /// Get the next available CID, or an error if we have run out. The last CID used is stored in |
| 345 | /// a system property so that restart of virtualizationservice doesn't reuse CID while the host |
| 346 | /// Android is up. |
| 347 | fn get_next_available_cid(&mut self) -> Result<Cid> { |
| 348 | // Start trying to find a CID from the last used CID + 1. This ensures |
| 349 | // that we do not eagerly recycle CIDs. It makes debugging easier but |
| 350 | // also means that retrying to allocate a CID, eg. because it is |
| 351 | // erroneously occupied by a process, will not recycle the same CID. |
| 352 | let last_cid_prop = |
| 353 | system_properties::read(SYSPROP_LAST_CID)?.and_then(|val| match val.parse::<Cid>() { |
| 354 | Ok(num) => { |
| 355 | if is_valid_guest_cid(num) { |
| 356 | Some(num) |
| 357 | } else { |
| 358 | error!("Invalid value '{}' of property '{}'", num, SYSPROP_LAST_CID); |
| 359 | None |
| 360 | } |
| 361 | } |
| 362 | Err(_) => { |
| 363 | error!("Invalid value '{}' of property '{}'", val, SYSPROP_LAST_CID); |
| 364 | None |
| 365 | } |
| 366 | }); |
| 367 | |
| 368 | let first_cid = if let Some(last_cid) = last_cid_prop { |
| 369 | if last_cid == GUEST_CID_MAX { |
| 370 | GUEST_CID_MIN |
| 371 | } else { |
| 372 | last_cid + 1 |
| 373 | } |
| 374 | } else { |
| 375 | GUEST_CID_MIN |
| 376 | }; |
| 377 | |
| 378 | let cid = self |
| 379 | .find_available_cid(first_cid..=GUEST_CID_MAX) |
| 380 | .or_else(|| self.find_available_cid(GUEST_CID_MIN..first_cid)) |
| 381 | .ok_or_else(|| anyhow!("Could not find an available CID."))?; |
| 382 | |
| 383 | system_properties::write(SYSPROP_LAST_CID, &format!("{}", cid))?; |
| 384 | Ok(cid) |
| 385 | } |
| 386 | |
| 387 | fn find_available_cid<I>(&self, mut range: I) -> Option<Cid> |
| 388 | where |
| 389 | I: Iterator<Item = Cid>, |
| 390 | { |
| 391 | range.find(|cid| !self.held_contexts.contains_key(cid)) |
| 392 | } |
| 393 | |
| 394 | fn allocate_vm_context( |
| 395 | &mut self, |
| 396 | requester_uid: uid_t, |
| 397 | requester_debug_pid: pid_t, |
| 398 | ) -> Result<Strong<dyn IGlobalVmContext>> { |
| 399 | // Garbage collect unused VM contexts. |
| 400 | self.held_contexts.retain(|_, instance| instance.strong_count() > 0); |
| 401 | |
| 402 | let cid = self.get_next_available_cid()?; |
| 403 | let instance = Arc::new(GlobalVmInstance { cid, requester_uid, requester_debug_pid }); |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 404 | create_temporary_directory(&instance.get_temp_dir(), Some(requester_uid))?; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 405 | |
| 406 | self.held_contexts.insert(cid, Arc::downgrade(&instance)); |
| 407 | let binder = GlobalVmContext { instance, ..Default::default() }; |
| 408 | Ok(BnGlobalVmContext::new_binder(binder, BinderFeatures::default())) |
| 409 | } |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 410 | |
| 411 | fn get_dtbo_file(&mut self) -> Result<File> { |
| 412 | let mut file = self.dtbo_file.lock().unwrap(); |
| 413 | |
| 414 | let fd = if let Some(ref_fd) = &*file { |
| 415 | ref_fd.try_clone()? |
| 416 | } else { |
| 417 | let path = get_or_create_common_dir()?.join("vm.dtbo"); |
| 418 | if path.exists() { |
| 419 | // All temporary files are deleted when the service is started. |
| 420 | // If the file exists but the FD is not cached, the file is |
| 421 | // likely corrupted. |
| 422 | remove_file(&path).context("Failed to clone cached VM DTBO file descriptor")?; |
| 423 | } |
| 424 | |
| 425 | // Open a write-only file descriptor for vfio_handler. |
| 426 | let write_fd = File::create(&path).context("Failed to create VM DTBO file")?; |
| 427 | |
| 428 | let vfio_service: Strong<dyn IVfioHandler> = |
| 429 | wait_for_interface(<BpVfioHandler as IVfioHandler>::get_descriptor())?; |
| 430 | vfio_service.writeVmDtbo(&ParcelFileDescriptor::new(write_fd))?; |
| 431 | |
| 432 | // Open read-only. This FD will be cached and returned to clients. |
| 433 | let read_fd = File::open(&path).context("Failed to open VM DTBO file")?; |
| 434 | let read_fd_clone = |
| 435 | read_fd.try_clone().context("Failed to clone VM DTBO file descriptor")?; |
| 436 | *file = Some(read_fd); |
| 437 | read_fd_clone |
| 438 | }; |
| 439 | |
| 440 | Ok(fd) |
| 441 | } |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 442 | } |
| 443 | |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 444 | fn create_temporary_directory(path: &PathBuf, requester_uid: Option<uid_t>) -> Result<()> { |
| 445 | // Directory may exist if previous attempt to create it had failed. |
| 446 | // Delete it before trying again. |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 447 | if path.as_path().exists() { |
| 448 | remove_temporary_dir(path).unwrap_or_else(|e| { |
| 449 | warn!("Could not delete temporary directory {:?}: {}", path, e); |
| 450 | }); |
| 451 | } |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 452 | // Create directory. |
| 453 | create_dir(path).with_context(|| format!("Could not create temporary directory {:?}", path))?; |
| 454 | // If provided, change ownership to client's UID but system's GID, and permissions 0700. |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 455 | // If the chown() fails, this will leave behind an empty directory that will get removed |
| 456 | // at the next attempt, or if virtualizationservice is restarted. |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 457 | if let Some(uid) = requester_uid { |
| 458 | chown(path, Some(Uid::from_raw(uid)), None).with_context(|| { |
| 459 | format!("Could not set ownership of temporary directory {:?}", path) |
| 460 | })?; |
| 461 | } |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 462 | Ok(()) |
| 463 | } |
| 464 | |
| 465 | /// Removes a directory owned by a different user by first changing its owner back |
| 466 | /// to VirtualizationService. |
| 467 | pub fn remove_temporary_dir(path: &PathBuf) -> Result<()> { |
Alice Wang | d1b11a0 | 2023-04-18 12:30:20 +0000 | [diff] [blame] | 468 | ensure!(path.as_path().is_dir(), "Path {:?} is not a directory", path); |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 469 | chown(path, Some(Uid::current()), None)?; |
| 470 | set_permissions(path, Permissions::from_mode(0o700))?; |
Alice Wang | d1b11a0 | 2023-04-18 12:30:20 +0000 | [diff] [blame] | 471 | remove_dir_all(path)?; |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 472 | Ok(()) |
| 473 | } |
| 474 | |
David Brazdil | 2dfefd1 | 2023-11-17 14:07:36 +0000 | [diff] [blame] | 475 | fn get_or_create_common_dir() -> Result<PathBuf> { |
| 476 | let path = Path::new(TEMPORARY_DIRECTORY).join("common"); |
| 477 | if !path.exists() { |
| 478 | create_temporary_directory(&path, None)?; |
| 479 | } |
| 480 | Ok(path) |
| 481 | } |
| 482 | |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 483 | /// Implementation of the AIDL `IGlobalVmContext` interface. |
| 484 | #[derive(Debug, Default)] |
| 485 | struct GlobalVmContext { |
| 486 | /// Strong reference to the context's instance data structure. |
| 487 | instance: Arc<GlobalVmInstance>, |
| 488 | /// Keeps our service process running as long as this VM context exists. |
| 489 | #[allow(dead_code)] |
| 490 | lazy_service_guard: LazyServiceGuard, |
| 491 | } |
| 492 | |
| 493 | impl Interface for GlobalVmContext {} |
| 494 | |
| 495 | impl IGlobalVmContext for GlobalVmContext { |
| 496 | fn getCid(&self) -> binder::Result<i32> { |
| 497 | Ok(self.instance.cid as i32) |
| 498 | } |
| 499 | |
| 500 | fn getTemporaryDirectory(&self) -> binder::Result<String> { |
| 501 | Ok(self.instance.get_temp_dir().to_string_lossy().to_string()) |
| 502 | } |
| 503 | } |
| 504 | |
| 505 | fn handle_stream_connection_tombstoned() -> Result<()> { |
| 506 | // Should not listen for tombstones on a guest VM's port. |
| 507 | assert!(!is_valid_guest_cid(VM_TOMBSTONES_SERVICE_PORT as Cid)); |
| 508 | let listener = |
| 509 | VsockListener::bind_with_cid_port(VMADDR_CID_HOST, VM_TOMBSTONES_SERVICE_PORT as Cid)?; |
| 510 | for incoming_stream in listener.incoming() { |
| 511 | let mut incoming_stream = match incoming_stream { |
| 512 | Err(e) => { |
| 513 | warn!("invalid incoming connection: {:?}", e); |
| 514 | continue; |
| 515 | } |
| 516 | Ok(s) => s, |
| 517 | }; |
| 518 | std::thread::spawn(move || { |
| 519 | if let Err(e) = handle_tombstone(&mut incoming_stream) { |
| 520 | error!("Failed to write tombstone- {:?}", e); |
| 521 | } |
| 522 | }); |
| 523 | } |
| 524 | Ok(()) |
| 525 | } |
| 526 | |
| 527 | fn handle_tombstone(stream: &mut VsockStream) -> Result<()> { |
| 528 | if let Ok(addr) = stream.peer_addr() { |
| 529 | info!("Vsock Stream connected to cid={} for tombstones", addr.cid()); |
| 530 | } |
| 531 | let tb_connection = |
| 532 | TombstonedConnection::connect(std::process::id() as i32, DebuggerdDumpType::Tombstone) |
| 533 | .context("Failed to connect to tombstoned")?; |
| 534 | let mut text_output = tb_connection |
| 535 | .text_output |
| 536 | .as_ref() |
| 537 | .ok_or_else(|| anyhow!("Could not get file to write the tombstones on"))?; |
| 538 | let mut num_bytes_read = 0; |
| 539 | loop { |
| 540 | let mut chunk_recv = [0; CHUNK_RECV_MAX_LEN]; |
| 541 | let n = stream |
| 542 | .read(&mut chunk_recv) |
| 543 | .context("Failed to read tombstone data from Vsock stream")?; |
| 544 | if n == 0 { |
| 545 | break; |
| 546 | } |
| 547 | num_bytes_read += n; |
| 548 | text_output.write_all(&chunk_recv[0..n]).context("Failed to write guests tombstones")?; |
| 549 | } |
| 550 | info!("Received {} bytes from guest & wrote to tombstone file", num_bytes_read); |
| 551 | tb_connection.notify_completion()?; |
| 552 | Ok(()) |
| 553 | } |
| 554 | |
| 555 | /// Checks whether the caller has a specific permission |
| 556 | fn check_permission(perm: &str) -> binder::Result<()> { |
| 557 | let calling_pid = get_calling_pid(); |
| 558 | let calling_uid = get_calling_uid(); |
| 559 | // Root can do anything |
| 560 | if calling_uid == 0 { |
| 561 | return Ok(()); |
| 562 | } |
| 563 | let perm_svc: Strong<dyn IPermissionController::IPermissionController> = |
| 564 | binder::get_interface("permission")?; |
| 565 | if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? { |
| 566 | Ok(()) |
| 567 | } else { |
Jiyong Park | 2227eaa | 2023-08-04 11:59:18 +0900 | [diff] [blame] | 568 | Err(anyhow!("does not have the {} permission", perm)) |
| 569 | .or_binder_exception(ExceptionCode::SECURITY) |
David Brazdil | afc9a9e | 2023-01-12 16:08:10 +0000 | [diff] [blame] | 570 | } |
| 571 | } |
| 572 | |
| 573 | /// Check whether the caller of the current Binder method is allowed to call debug methods. |
| 574 | fn check_debug_access() -> binder::Result<()> { |
| 575 | check_permission("android.permission.DEBUG_VIRTUAL_MACHINE") |
| 576 | } |
| 577 | |
| 578 | /// Check whether the caller of the current Binder method is allowed to manage VMs |
| 579 | fn check_manage_access() -> binder::Result<()> { |
| 580 | check_permission("android.permission.MANAGE_VIRTUAL_MACHINE") |
| 581 | } |
Inseob Kim | 53d0b21 | 2023-07-20 16:58:37 +0900 | [diff] [blame] | 582 | |
| 583 | /// Check whether the caller of the current Binder method is allowed to use custom VMs |
| 584 | fn check_use_custom_virtual_machine() -> binder::Result<()> { |
| 585 | check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE") |
| 586 | } |
Alice Wang | 4c6c558 | 2023-11-23 15:07:18 +0000 | [diff] [blame] | 587 | |
| 588 | #[cfg(test)] |
| 589 | mod tests { |
| 590 | use super::*; |
| 591 | use std::fs; |
| 592 | |
| 593 | const TEST_RKP_CERT_CHAIN_PATH: &str = "testdata/rkp_cert_chain.der"; |
| 594 | |
| 595 | #[test] |
| 596 | fn splitting_x509_certificate_chain_succeeds() -> Result<()> { |
| 597 | let bytes = fs::read(TEST_RKP_CERT_CHAIN_PATH)?; |
| 598 | let cert_chain = split_x509_certificate_chain(&bytes)?; |
| 599 | |
| 600 | assert_eq!(4, cert_chain.len()); |
| 601 | for cert in cert_chain { |
| 602 | let (remaining, _) = X509Certificate::from_der(&cert.encodedCertificate)?; |
| 603 | assert!(remaining.is_empty()); |
| 604 | } |
| 605 | Ok(()) |
| 606 | } |
| 607 | } |