Snap for 13256841 from 62e70ca21604563c734963806000c1442111e1a5 to 25Q2-release
Change-Id: Ifd919e0bafa56b1bf197653019044152c1c8b41c
diff --git a/android/TerminalApp/AndroidManifest.xml b/android/TerminalApp/AndroidManifest.xml
index aa702a3..48b53dd 100644
--- a/android/TerminalApp/AndroidManifest.xml
+++ b/android/TerminalApp/AndroidManifest.xml
@@ -65,6 +65,8 @@
<activity android:name=".ErrorActivity"
android:label="@string/error_title"
android:process=":error" />
+ <activity android:name=".UpgradeActivity"
+ android:label="@string/upgrade_title" />
<property
android:name="android.window.PROPERTY_ACTIVITY_EMBEDDING_SPLITS_ENABLED"
android:value="true" />
diff --git a/android/TerminalApp/assets/js/terminal_disconnect.js b/android/TerminalApp/assets/js/terminal_disconnect.js
new file mode 100644
index 0000000..1c89a13
--- /dev/null
+++ b/android/TerminalApp/assets/js/terminal_disconnect.js
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+(function() {
+ var originalLog = console.log;
+ console.log = function() {
+ console.log.history = console.log.history || [];
+ console.log.history.push(arguments);
+ originalLog.apply(console, arguments);
+ if (typeof arguments[0] === 'string' && arguments[0].startsWith("[ttyd] websocket connection closed with code: ")) {
+ TerminalApp.closeTab()
+ }
+ };
+})();
\ No newline at end of file
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/InstalledImage.kt b/android/TerminalApp/java/com/android/virtualization/terminal/InstalledImage.kt
index 50aaa33..04d6813 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/InstalledImage.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/InstalledImage.kt
@@ -67,6 +67,16 @@
}
}
+ fun isOlderThanCurrentVersion(): Boolean {
+ val year =
+ try {
+ buildId.split(" ").last().toInt()
+ } catch (_: Exception) {
+ 0
+ }
+ return year < RELEASE_YEAR
+ }
+
@Throws(IOException::class)
fun uninstallAndBackup(): Path {
Files.delete(marker)
@@ -191,6 +201,7 @@
const val MARKER_FILENAME: String = "completed"
const val RESIZE_STEP_BYTES: Long = 4 shl 20 // 4 MiB
+ const val RELEASE_YEAR: Int = 2025
/** Returns InstalledImage for a given app context */
fun getDefault(context: Context): InstalledImage {
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/Logger.kt b/android/TerminalApp/java/com/android/virtualization/terminal/Logger.kt
index ba03716..088744e 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/Logger.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/Logger.kt
@@ -17,9 +17,7 @@
import android.system.virtualmachine.VirtualMachine
import android.system.virtualmachine.VirtualMachineConfig
-import android.system.virtualmachine.VirtualMachineException
import android.util.Log
-import com.android.virtualization.terminal.Logger.LineBufferedOutputStream
import java.io.BufferedOutputStream
import java.io.BufferedReader
import java.io.IOException
@@ -56,19 +54,29 @@
val logPath = dir.resolve(LocalDateTime.now().toString() + ".txt")
val console = vm.getConsoleOutput()
val file = Files.newOutputStream(logPath, StandardOpenOption.CREATE)
- executor.submit<Int?> {
- console.use { console ->
- LineBufferedOutputStream(file).use { fileOutput ->
- Streams.copy(console, fileOutput)
+ executor.execute({
+ try {
+ console.use { console ->
+ LineBufferedOutputStream(file).use { fileOutput ->
+ Streams.copy(console, fileOutput)
+ }
}
+ } catch (e: Exception) {
+ Log.w(tag, "Failed to log console output. VM may be shutting down", e)
}
- }
+ })
val log = vm.getLogOutput()
- executor.submit<Unit> { log.use { writeToLogd(it, tag) } }
- } catch (e: VirtualMachineException) {
- throw RuntimeException(e)
- } catch (e: IOException) {
+ executor.execute({
+ log.use {
+ try {
+ writeToLogd(it, tag)
+ } catch (e: Exception) {
+ Log.w(tag, "Failed to log VM log output. VM may be shutting down", e)
+ }
+ }
+ })
+ } catch (e: Exception) {
throw RuntimeException(e)
}
}
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/MainActivity.kt b/android/TerminalApp/java/com/android/virtualization/terminal/MainActivity.kt
index 52afef4..37147eb 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/MainActivity.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/MainActivity.kt
@@ -24,6 +24,7 @@
import android.content.res.Configuration
import android.graphics.drawable.Icon
import android.graphics.fonts.FontStyle
+import android.media.MediaScannerConnection
import android.net.Uri
import android.os.Build
import android.os.Bundle
@@ -103,7 +104,13 @@
// if installer is launched, it will be handled in onActivityResult
if (!launchInstaller) {
- if (!Environment.isExternalStorageManager()) {
+ if (image.isOlderThanCurrentVersion()) {
+ val intent = Intent(this, UpgradeActivity::class.java)
+ intent.setFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK or Intent.FLAG_ACTIVITY_NEW_TASK)
+ startActivity(intent)
+ // Explicitly finish to make sure that user can't go back from ErrorActivity.
+ finish()
+ } else if (!Environment.isExternalStorageManager()) {
requestStoragePermissions(this, manageExternalStorageActivityResultLauncher)
} else {
startVm()
@@ -179,20 +186,20 @@
terminalViewModel.terminalTabs[tabId] = tab
tab.customView!!
.findViewById<Button>(R.id.tab_close_button)
- .setOnClickListener(
- View.OnClickListener { _: View? ->
- if (terminalTabAdapter.tabs.size == 1) {
- finishAndRemoveTask()
- }
- viewPager.offscreenPageLimit -= 1
- terminalTabAdapter.deleteTab(tab.position)
- tabLayout.removeTab(tab)
- }
- )
+ .setOnClickListener(View.OnClickListener { _: View? -> closeTab(tab) })
// Add and select the tab
tabLayout.addTab(tab, true)
}
+ fun closeTab(tab: TabLayout.Tab) {
+ if (terminalTabAdapter.tabs.size == 1) {
+ finishAndRemoveTask()
+ }
+ viewPager.offscreenPageLimit -= 1
+ terminalTabAdapter.deleteTab(tab.position)
+ tabLayout.removeTab(tab)
+ }
+
private fun lockOrientationIfNecessary() {
val hasHwQwertyKeyboard = resources.configuration.keyboard == Configuration.KEYBOARD_QWERTY
if (hasHwQwertyKeyboard) {
@@ -228,6 +235,16 @@
activityResultLauncher.launch(intent)
}
+ override fun onPause() {
+ super.onPause()
+ MediaScannerConnection.scanFile(
+ this,
+ arrayOf("/storage/emulated/${userId}/Download"),
+ null /* mimeTypes */,
+ null, /* callback */
+ )
+ }
+
private fun getTerminalServiceUrl(ipAddress: String?, port: Int): URL? {
val config = resources.configuration
// TODO: Always enable screenReaderMode (b/395845063)
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/MemBalloonController.kt b/android/TerminalApp/java/com/android/virtualization/terminal/MemBalloonController.kt
index 7647d9b..2ed7217 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/MemBalloonController.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/MemBalloonController.kt
@@ -58,7 +58,7 @@
// available memory to the virtual machine
override fun onResume(owner: LifecycleOwner) {
ongoingInflation?.cancel(false)
- executor.submit({
+ executor.execute({
Log.v(TAG, "app resumed. deflating mem balloon to the minimum")
vm.setMemoryBalloonByPercent(0)
})
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/SettingsDiskResizeActivity.kt b/android/TerminalApp/java/com/android/virtualization/terminal/SettingsDiskResizeActivity.kt
index da07b19..00baeef 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/SettingsDiskResizeActivity.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/SettingsDiskResizeActivity.kt
@@ -15,13 +15,15 @@
*/
package com.android.virtualization.terminal
+import android.content.Context
import android.content.Intent
import android.icu.text.MeasureFormat
import android.icu.text.NumberFormat
import android.icu.util.Measure
import android.icu.util.MeasureUnit
import android.os.Bundle
-import android.os.Environment
+import android.os.storage.StorageManager
+import android.os.storage.StorageManager.UUID_DEFAULT
import android.text.SpannableString
import android.text.Spanned
import android.text.TextUtils
@@ -39,7 +41,7 @@
class SettingsDiskResizeActivity : AppCompatActivity() {
private val numberPattern: Pattern = Pattern.compile("[\\d]*[\\٫.,]?[\\d]+")
- private val defaultMaxDiskSizeMb: Long = 16 shl 10
+ private val defaultHostReserveSizeMb: Long = 5 shl 10
private var diskSizeStepMb: Long = 0
private var diskSizeMb: Long = 0
@@ -59,10 +61,10 @@
}
private fun getAvailableSizeMb(): Long {
- val usableSpaceMb =
- bytesToMb(Environment.getDataDirectory().getUsableSpace()) and
- (diskSizeStepMb - 1).inv()
- return diskSizeMb + usableSpaceMb
+ var storageManager =
+ applicationContext.getSystemService(Context.STORAGE_SERVICE) as StorageManager
+ val hostAllocatableMb = bytesToMb(storageManager.getAllocatableBytes(UUID_DEFAULT))
+ return diskSizeMb + hostAllocatableMb
}
private fun mbToProgress(bytes: Long): Int {
@@ -82,7 +84,10 @@
val image = InstalledImage.getDefault(this)
diskSizeMb = bytesToMb(image.getApparentSize())
val minDiskSizeMb = bytesToMb(image.getSmallestSizePossible()).coerceAtMost(diskSizeMb)
- val maxDiskSizeMb = defaultMaxDiskSizeMb.coerceAtMost(getAvailableSizeMb())
+ var maxDiskSizeMb = getAvailableSizeMb()
+ if (maxDiskSizeMb > defaultHostReserveSizeMb) {
+ maxDiskSizeMb -= defaultHostReserveSizeMb
+ }
diskSizeText = findViewById<TextView>(R.id.settings_disk_resize_resize_gb_assigned)!!
diskMaxSizeText = findViewById<TextView>(R.id.settings_disk_resize_resize_gb_max)
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/SettingsRecoveryActivity.kt b/android/TerminalApp/java/com/android/virtualization/terminal/SettingsRecoveryActivity.kt
index 319a53b..654cb57 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/SettingsRecoveryActivity.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/SettingsRecoveryActivity.kt
@@ -21,19 +21,23 @@
import android.view.View
import androidx.appcompat.app.AppCompatActivity
import androidx.core.view.isVisible
-import androidx.lifecycle.lifecycleScope
import com.android.virtualization.terminal.MainActivity.Companion.TAG
import com.google.android.material.card.MaterialCardView
import com.google.android.material.dialog.MaterialAlertDialogBuilder
import com.google.android.material.snackbar.Snackbar
import java.io.IOException
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
+import java.util.concurrent.ExecutorService
+import java.util.concurrent.Executors
class SettingsRecoveryActivity : AppCompatActivity() {
+ private lateinit var executorService: ExecutorService
+
override fun onCreate(savedInstanceState: Bundle?) {
super.onCreate(savedInstanceState)
+
+ executorService =
+ Executors.newSingleThreadExecutor(TerminalThreadFactory(applicationContext))
+
setContentView(R.layout.settings_recovery)
val resetCard = findViewById<MaterialCardView>(R.id.settings_recovery_reset_card)
@@ -81,6 +85,12 @@
}
}
+ override fun onDestroy() {
+ super.onDestroy()
+
+ executorService.shutdown()
+ }
+
private fun removeBackup(): Unit {
try {
InstalledImage.getDefault(this).deleteBackup()
@@ -116,27 +126,22 @@
}
}
- private fun runInBackgroundAndRestartApp(
- backgroundWork: suspend CoroutineScope.() -> Unit
- ): Unit {
+ private fun runInBackgroundAndRestartApp(backgroundWork: Runnable) {
findViewById<View>(R.id.setting_recovery_card_container).visibility = View.INVISIBLE
findViewById<View>(R.id.recovery_boot_progress).visibility = View.VISIBLE
- lifecycleScope
- .launch(Dispatchers.IO) { backgroundWork() }
- .invokeOnCompletion {
- runOnUiThread {
- findViewById<View>(R.id.setting_recovery_card_container).visibility =
- View.VISIBLE
- findViewById<View>(R.id.recovery_boot_progress).visibility = View.INVISIBLE
- // Restart terminal
- val intent =
- baseContext.packageManager.getLaunchIntentForPackage(
- baseContext.packageName
- )
- intent?.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK)
- finish()
- startActivity(intent)
- }
+ executorService.execute({
+ backgroundWork.run()
+
+ runOnUiThread {
+ findViewById<View>(R.id.setting_recovery_card_container).visibility = View.VISIBLE
+ findViewById<View>(R.id.recovery_boot_progress).visibility = View.INVISIBLE
+ // Restart terminal
+ val intent =
+ baseContext.packageManager.getLaunchIntentForPackage(baseContext.packageName)
+ intent?.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK)
+ finish()
+ startActivity(intent)
}
+ })
}
}
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/TerminalTabFragment.kt b/android/TerminalApp/java/com/android/virtualization/terminal/TerminalTabFragment.kt
index a0c6e4e..8106f6e 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/TerminalTabFragment.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/TerminalTabFragment.kt
@@ -24,6 +24,7 @@
import android.view.View
import android.view.ViewGroup
import android.webkit.ClientCertRequest
+import android.webkit.JavascriptInterface
import android.webkit.SslErrorHandler
import android.webkit.WebChromeClient
import android.webkit.WebResourceError
@@ -92,6 +93,7 @@
terminalView.webChromeClient = TerminalWebChromeClient()
terminalView.webViewClient = TerminalWebViewClient()
+ terminalView.addJavascriptInterface(TerminalViewInterface(context!!), "TerminalApp")
(activity as MainActivity).modifierKeysController.addTerminalView(terminalView)
terminalViewModel.terminalViews.add(terminalView)
@@ -119,6 +121,18 @@
}
}
+ inner class TerminalViewInterface(private val mContext: android.content.Context) {
+ @JavascriptInterface
+ fun closeTab() {
+ if (activity != null) {
+ activity?.runOnUiThread {
+ val mainActivity = (activity as MainActivity)
+ mainActivity.closeTab(terminalViewModel.terminalTabs[id]!!)
+ }
+ }
+ }
+ }
+
private inner class TerminalWebViewClient : WebViewClient() {
private var loadFailed = false
private var requestId: Long = 0
@@ -174,6 +188,7 @@
bootProgressView.visibility = View.GONE
terminalView.visibility = View.VISIBLE
terminalView.mapTouchToMouseEvent()
+ terminalView.applyTerminalDisconnectCallback()
updateMainActivity()
updateFocus()
}
@@ -201,7 +216,7 @@
}
private fun updateMainActivity() {
- val mainActivity = (activity as MainActivity)
+ val mainActivity = activity as MainActivity ?: return
if (terminalGuiSupport()) {
mainActivity.displayMenu!!.visibility = View.VISIBLE
mainActivity.displayMenu!!.isEnabled = true
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/TerminalView.kt b/android/TerminalApp/java/com/android/virtualization/terminal/TerminalView.kt
index 4b11c1d..9c83d8b 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/TerminalView.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/TerminalView.kt
@@ -41,6 +41,8 @@
private val ctrlKeyHandler: String = readAssetAsString(context, "js/ctrl_key_handler.js")
private val enableCtrlKey: String = readAssetAsString(context, "js/enable_ctrl_key.js")
private val disableCtrlKey: String = readAssetAsString(context, "js/disable_ctrl_key.js")
+ private val terminalDisconnectCallback: String =
+ readAssetAsString(context, "js/terminal_disconnect.js")
private val touchToMouseHandler: String =
readAssetAsString(context, "js/touch_to_mouse_handler.js")
private val a11yManager =
@@ -70,6 +72,10 @@
this.evaluateJavascript(disableCtrlKey, null)
}
+ fun applyTerminalDisconnectCallback() {
+ this.evaluateJavascript(terminalDisconnectCallback, null)
+ }
+
override fun onAccessibilityStateChanged(enabled: Boolean) {
Log.d(TAG, "accessibility $enabled")
adjustToA11yStateChange()
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/UpgradeActivity.kt b/android/TerminalApp/java/com/android/virtualization/terminal/UpgradeActivity.kt
new file mode 100644
index 0000000..357de94
--- /dev/null
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/UpgradeActivity.kt
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.virtualization.terminal
+
+import android.annotation.MainThread
+import android.content.Intent
+import android.os.Bundle
+import android.util.Log
+import android.view.View
+import com.google.android.material.snackbar.Snackbar
+import java.io.IOException
+import java.util.concurrent.ExecutorService
+import java.util.concurrent.Executors
+
+class UpgradeActivity : BaseActivity() {
+ private lateinit var executorService: ExecutorService
+
+ override fun onCreate(savedInstanceState: Bundle?) {
+ super.onCreate(savedInstanceState)
+
+ executorService =
+ Executors.newSingleThreadExecutor(TerminalThreadFactory(applicationContext))
+
+ setContentView(R.layout.activity_upgrade)
+
+ val button = findViewById<View>(R.id.upgrade)
+ button.setOnClickListener { _ -> upgrade() }
+ }
+
+ override fun onDestroy() {
+ super.onDestroy()
+
+ executorService.shutdown()
+ }
+
+ private fun upgrade() {
+ findViewById<View>(R.id.progress).visibility = View.VISIBLE
+
+ executorService.execute {
+ val image = InstalledImage.getDefault(this)
+ try {
+ image.uninstallAndBackup()
+ } catch (e: IOException) {
+ Snackbar.make(
+ findViewById<View>(android.R.id.content),
+ R.string.upgrade_error,
+ Snackbar.LENGTH_SHORT,
+ )
+ .show()
+ Log.e(MainActivity.Companion.TAG, "Failed to upgrade ", e)
+ return@execute
+ }
+
+ runOnUiThread {
+ findViewById<View>(R.id.progress).visibility = View.INVISIBLE
+ restartTerminal()
+ }
+ }
+ }
+
+ @MainThread
+ private fun restartTerminal() {
+ val intent = baseContext.packageManager.getLaunchIntentForPackage(baseContext.packageName)
+ intent?.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK)
+ finish()
+ startActivity(intent)
+ }
+}
diff --git a/android/TerminalApp/java/com/android/virtualization/terminal/VmLauncherService.kt b/android/TerminalApp/java/com/android/virtualization/terminal/VmLauncherService.kt
index 84168e5..0b34a8d 100644
--- a/android/TerminalApp/java/com/android/virtualization/terminal/VmLauncherService.kt
+++ b/android/TerminalApp/java/com/android/virtualization/terminal/VmLauncherService.kt
@@ -94,7 +94,7 @@
override fun onCreate() {
super.onCreate()
- val threadFactory = TerminalThreadFactory(getApplicationContext())
+ val threadFactory = TerminalThreadFactory(applicationContext)
bgThreads = Executors.newCachedThreadPool(threadFactory)
mainWorkerThread = Executors.newSingleThreadExecutor(threadFactory)
image = InstalledImage.getDefault(this)
@@ -123,7 +123,7 @@
// done.
val diskSize = intent.getLongExtra(EXTRA_DISK_SIZE, image.getApparentSize())
- mainWorkerThread.submit({
+ mainWorkerThread.execute({
doStart(notification, displayInfo, diskSize, resultReceiver)
})
@@ -131,7 +131,7 @@
// ForegroundServiceDidNotStartInTimeException
startForeground(this.hashCode(), notification)
}
- ACTION_SHUTDOWN_VM -> mainWorkerThread.submit({ doShutdown(resultReceiver) })
+ ACTION_SHUTDOWN_VM -> mainWorkerThread.execute({ doShutdown(resultReceiver) })
else -> {
Log.e(TAG, "Unknown command " + intent.action)
stopSelf()
@@ -505,7 +505,7 @@
}
override fun onDestroy() {
- mainWorkerThread.submit({
+ mainWorkerThread.execute({
if (runner?.vm?.getStatus() == VirtualMachine.STATUS_RUNNING) {
doShutdown(null)
}
diff --git a/android/TerminalApp/res/layout/activity_upgrade.xml b/android/TerminalApp/res/layout/activity_upgrade.xml
new file mode 100644
index 0000000..13e8404
--- /dev/null
+++ b/android/TerminalApp/res/layout/activity_upgrade.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2025 The Android Open Source Project
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ -->
+
+<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
+ xmlns:tools="http://schemas.android.com/tools"
+ android:layout_width="match_parent"
+ android:layout_height="match_parent"
+ android:fitsSystemWindows="true"
+ tools:context=".UpgradeActivity">
+
+ <TextView
+ android:id="@+id/title"
+ android:layout_width="match_parent"
+ android:layout_height="wrap_content"
+ android:text="@string/upgrade_title"
+ android:layout_marginVertical="24dp"
+ android:layout_marginHorizontal="24dp"
+ android:layout_alignParentTop="true"
+ android:hyphenationFrequency="full"
+ android:textSize="48sp" />
+
+ <com.google.android.material.progressindicator.LinearProgressIndicator
+ android:id="@+id/progress"
+ android:indeterminate="true"
+ android:layout_width="match_parent"
+ android:layout_height="wrap_content"
+ android:layout_alignParentStart="true"
+ android:layout_below="@id/title"
+ android:visibility="invisible" />
+
+ <TextView
+ android:id="@+id/desc"
+ android:layout_width="match_parent"
+ android:layout_height="wrap_content"
+ android:text="@string/upgrade_desc"
+ android:lineSpacingExtra="5sp"
+ android:layout_marginTop="20dp"
+ android:layout_marginHorizontal="48dp"
+ android:layout_below="@id/progress"
+ android:textSize="20sp" />
+
+ <Button
+ android:id="@+id/upgrade"
+ android:layout_width="wrap_content"
+ android:layout_height="wrap_content"
+ android:layout_alignParentBottom="true"
+ android:layout_alignParentEnd="true"
+ android:layout_marginBottom="32dp"
+ android:layout_marginHorizontal="40dp"
+ android:backgroundTint="?attr/colorPrimaryDark"
+ android:text="@string/upgrade_button" />
+
+</RelativeLayout>
diff --git a/android/TerminalApp/res/values/strings.xml b/android/TerminalApp/res/values/strings.xml
index 273032e..a0e33e5 100644
--- a/android/TerminalApp/res/values/strings.xml
+++ b/android/TerminalApp/res/values/strings.xml
@@ -161,6 +161,15 @@
<!-- Error page that shows detailed error code (error reason) for bugreport. [CHAR LIMIT=none] -->
<string name="error_code">Error code: <xliff:g id="error_code" example="ACCESS_DENIED">%s</xliff:g></string>
+ <!-- Upgrade page's title. Tells users that you'll need to upgrade [CHAR LIMIT=none] -->
+ <string name="upgrade_title">Upgrade to newer terminal</string>
+ <!-- Upgrade page's description. Tell users that can't use as-is, and also explains next step. (/mnt/backup is the path which is supposed not to be translated) [CHAR LIMIT=none] -->
+ <string name="upgrade_desc">Linux terminal you were using is out of date. Please upgrade to proceed.\nData will be backed at <xliff:g id="path" example="/mnt/backup">/mnt/backup</xliff:g></string>
+ <!-- Upgrade page's button to start upgrade. [CHAR LIMIT=16] -->
+ <string name="upgrade_button">Upgrade</string>
+ <!-- Upgrade page's error toast message when upgrade failed. [CHAR LIMIT=none] -->
+ <string name="upgrade_error">Upgrade failed</string>
+
<!-- Notification action button for settings [CHAR LIMIT=20] -->
<string name="service_notification_settings">Settings</string>
<!-- Notification title for foreground service notification [CHAR LIMIT=none] -->
diff --git a/build/apex/Android.bp b/build/apex/Android.bp
index f0eba7f..7496f4d 100644
--- a/build/apex/Android.bp
+++ b/build/apex/Android.bp
@@ -69,10 +69,7 @@
default: [],
}),
- canned_fs_config: select(release_flag("RELEASE_AVF_ENABLE_VIRT_CPUFREQ"), {
- true: "canned_fs_config_sys_nice",
- default: "canned_fs_config",
- }),
+ canned_fs_config: "canned_fs_config",
}
vintf_fragment {
diff --git a/build/apex/canned_fs_config b/build/apex/canned_fs_config
index 5afd9d6..90c9747 100644
--- a/build/apex/canned_fs_config
+++ b/build/apex/canned_fs_config
@@ -1 +1,3 @@
/bin/virtualizationservice 0 2000 0755 capabilities=0x1000001 # CAP_CHOWN, CAP_SYS_RESOURCE
+/bin/crosvm 0 3013 0755 capabilities=0x800000 # CAP_SYS_NICE
+/bin/virtmgr 0 3013 0755 capabilities=0x800000 # CAP_SYS_NICE
diff --git a/build/apex/canned_fs_config_sys_nice b/build/apex/canned_fs_config_sys_nice
deleted file mode 100644
index 90c9747..0000000
--- a/build/apex/canned_fs_config_sys_nice
+++ /dev/null
@@ -1,3 +0,0 @@
-/bin/virtualizationservice 0 2000 0755 capabilities=0x1000001 # CAP_CHOWN, CAP_SYS_RESOURCE
-/bin/crosvm 0 3013 0755 capabilities=0x800000 # CAP_SYS_NICE
-/bin/virtmgr 0 3013 0755 capabilities=0x800000 # CAP_SYS_NICE
diff --git a/build/apex/manifest.json b/build/apex/manifest.json
index e596ce1..9be2aa6 100644
--- a/build/apex/manifest.json
+++ b/build/apex/manifest.json
@@ -1,6 +1,6 @@
{
"name": "com.android.virt",
- "version": 2,
+ "version": 3,
"requireNativeLibs": [
"libEGL.so",
"libGLESv2.so",
diff --git a/build/compos/manifest.json b/build/compos/manifest.json
index 7a07b1b..6d1f816 100644
--- a/build/compos/manifest.json
+++ b/build/compos/manifest.json
@@ -1,4 +1,4 @@
{
"name": "com.android.compos",
- "version": 2
+ "version": 3
}
diff --git a/build/debian/build.sh b/build/debian/build.sh
index 8c1345c..f751b30 100755
--- a/build/debian/build.sh
+++ b/build/debian/build.sh
@@ -15,6 +15,7 @@
echo "-a ARCH Architecture of the image [default is host arch: $(uname -m)]"
echo "-g Use Debian generic kernel [default is our custom kernel]"
echo "-r Release mode build"
+ echo "-u Set VM boot mode to u-boot [default is to load kernel directly]"
echo "-w Save temp work directory [for debugging]"
}
@@ -25,7 +26,7 @@
}
parse_options() {
- while getopts "a:ghrw" option; do
+ while getopts "a:ghruw" option; do
case ${option} in
h)
show_help ; exit
@@ -39,6 +40,9 @@
r)
mode=release
;;
+ u)
+ uboot=1
+ ;;
w)
save_workdir=1
;;
@@ -114,6 +118,13 @@
)
fi
+ if [[ "$uboot" != 1 ]]; then
+ packages+=(
+ libguestfs-tools
+ linux-image-generic
+ )
+ fi
+
if [[ "$use_generic_kernel" != 1 ]]; then
packages+=(
bc
@@ -312,6 +323,14 @@
}
run_fai() {
+ # NOTE: Prevent FAI from installing grub packages and running related scripts,
+ # if we are loading the kernel directly.
+ if [[ "$uboot" != 1 ]]; then
+ sed -i "/shim-signed/d ; /grub.*${debian_arch}.*/d" \
+ "${config_space}/package_config/${debian_arch^^}"
+ rm "${config_space}/scripts/SYSTEM_BOOT/20-grub"
+ fi
+
local out="${raw_disk_image}"
make -C "${debian_cloud_image}" "image_bookworm_nocloud_${debian_arch}"
mv "${debian_cloud_image}/image_bookworm_nocloud_${debian_arch}.raw" "${out}"
@@ -319,10 +338,14 @@
generate_output_package() {
fdisk -l "${raw_disk_image}"
- local vm_config="$SCRIPT_DIR/vm_config.json"
local root_partition_num=1
local efi_partition_num=15
+ local vm_config="$SCRIPT_DIR/vm_config.json"
+ if [[ "$uboot" == 1 ]]; then
+ vm_config="$SCRIPT_DIR/vm_config.u-boot.json"
+ fi
+
pushd ${workdir} > /dev/null
echo ${build_id} > build_id
@@ -341,8 +364,6 @@
sed -i "s/{root_part_guid}/$(sfdisk --part-uuid $raw_disk_image $root_partition_num)/g" vm_config.json
sed -i "s/{efi_part_guid}/$(sfdisk --part-uuid $raw_disk_image $efi_partition_num)/g" vm_config.json
- popd > /dev/null
-
contents=(
build_id
root_part
@@ -350,6 +371,19 @@
vm_config.json
)
+ if [[ "$uboot" != 1 ]]; then
+ rm -f vmlinuz* initrd.img*
+ virt-get-kernel -a "${raw_disk_image}"
+ mv vmlinuz* vmlinuz
+ mv initrd.img* initrd.img
+ contents+=(
+ vmlinuz
+ initrd.img
+ )
+ fi
+
+ popd > /dev/null
+
# --sparse option isn't supported in apache-commons-compress
tar czv -f ${output} -C ${workdir} "${contents[@]}"
}
@@ -373,6 +407,7 @@
mode=debug
save_workdir=0
use_generic_kernel=0
+uboot=0
parse_options "$@"
check_sudo
diff --git a/build/debian/build_in_container.sh b/build/debian/build_in_container.sh
index 739d2dd..82098ed 100755
--- a/build/debian/build_in_container.sh
+++ b/build/debian/build_in_container.sh
@@ -9,6 +9,7 @@
echo "-g Use Debian generic kernel [default is our custom kernel]"
echo "-r Release mode build"
echo "-s Leave a shell open [default: only if the build fails]"
+ echo "-u Set VM boot mode to u-boot [default is to load kernel directly]"
echo "-w Save temp work directory in the container [for debugging]"
}
@@ -17,8 +18,9 @@
release_flag=
save_workdir_flag=
shell_condition="||"
+uboot_flag=
-while getopts "a:ghrsw" option; do
+while getopts "a:ghrsuw" option; do
case ${option} in
a)
arch="$OPTARG"
@@ -35,6 +37,9 @@
s)
shell_condition=";"
;;
+ u)
+ uboot_flag="-u"
+ ;;
w)
save_workdir_flag="-w"
;;
@@ -58,4 +63,4 @@
-v "$ANDROID_BUILD_TOP/packages/modules/Virtualization:/root/Virtualization" \
--workdir /root/Virtualization/build/debian \
ubuntu:22.04 \
- bash -c "./build.sh -a $arch $release_flag $kernel_flag $save_workdir_flag $shell_condition bash"
+ bash -c "./build.sh -a $arch $release_flag $kernel_flag $uboot_flag $save_workdir_flag $shell_condition bash"
diff --git a/build/debian/vm_config.json b/build/debian/vm_config.json
index 463583f..e9b3763 100644
--- a/build/debian/vm_config.json
+++ b/build/debian/vm_config.json
@@ -27,6 +27,9 @@
"sharedPath": "$APP_DATA_DIR/files"
}
],
+ "kernel": "$PAYLOAD_DIR/vmlinuz",
+ "initrd": "$PAYLOAD_DIR/initrd.img",
+ "params": "root=/dev/vda1",
"protected": false,
"cpu_topology": "match_host",
"platform_version": "~1.0",
diff --git a/build/debian/vm_config.u-boot.json b/build/debian/vm_config.u-boot.json
new file mode 100644
index 0000000..463583f
--- /dev/null
+++ b/build/debian/vm_config.u-boot.json
@@ -0,0 +1,42 @@
+{
+ "name": "debian",
+ "disks": [
+ {
+ "partitions": [
+ {
+ "label": "ROOT",
+ "path": "$PAYLOAD_DIR/root_part",
+ "writable": true,
+ "guid": "{root_part_guid}"
+ },
+ {
+ "label": "EFI",
+ "path": "$PAYLOAD_DIR/efi_part",
+ "writable": false,
+ "guid": "{efi_part_guid}"
+ }
+ ],
+ "writable": true
+ }
+ ],
+ "sharedPath": [
+ {
+ "sharedPath": "/storage/emulated"
+ },
+ {
+ "sharedPath": "$APP_DATA_DIR/files"
+ }
+ ],
+ "protected": false,
+ "cpu_topology": "match_host",
+ "platform_version": "~1.0",
+ "memory_mib": 4096,
+ "debuggable": true,
+ "console_out": true,
+ "console_input_device": "ttyS0",
+ "network": true,
+ "auto_memory_balloon": true,
+ "gpu": {
+ "backend": "2d"
+ }
+}
diff --git a/build/microdroid/Android.bp b/build/microdroid/Android.bp
index 10b492b..9152091 100644
--- a/build/microdroid/Android.bp
+++ b/build/microdroid/Android.bp
@@ -506,7 +506,7 @@
},
}
-MICRODROID_GKI_ROLLBACK_INDEX = 1
+MICRODROID_GKI_ROLLBACK_INDEX = 2
flag_aware_avb_add_hash_footer_defaults {
name: "microdroid_kernel_cap_defaults",
diff --git a/guest/pvmfw/README.md b/guest/pvmfw/README.md
index 08b0d5c..0288741 100644
--- a/guest/pvmfw/README.md
+++ b/guest/pvmfw/README.md
@@ -521,12 +521,12 @@
and its configuration data.
As a quick prototyping solution, a valid DICE chain (such as this [test
-file][bcc.dat]) can be appended to the `pvmfw.bin` image with `pvmfw-tool`.
+file][dice.dat]) can be appended to the `pvmfw.bin` image with `pvmfw-tool`.
```shell
m pvmfw-tool pvmfw_bin
PVMFW_BIN=${ANDROID_PRODUCT_OUT}/system/etc/pvmfw.bin
-DICE=${ANDROID_BUILD_TOP}/packages/modules/Virtualization/tests/pvmfw/assets/bcc.dat
+DICE=${ANDROID_BUILD_TOP}/packages/modules/Virtualization/tests/pvmfw/assets/dice.dat
pvmfw-tool custom_pvmfw ${PVMFW_BIN} ${DICE}
```
@@ -548,7 +548,7 @@
Note: `adb root` is required to set the system property.
-[bcc.dat]: https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Virtualization/tests/pvmfw/assets/bcc.dat
+[dice.dat]: https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Virtualization/tests/pvmfw/assets/dice.dat
### Running pVM without pvmfw
diff --git a/guest/pvmfw/avb/tests/utils.rs b/guest/pvmfw/avb/tests/utils.rs
index 38541c5..843cca9 100644
--- a/guest/pvmfw/avb/tests/utils.rs
+++ b/guest/pvmfw/avb/tests/utils.rs
@@ -133,7 +133,9 @@
initrd_digest,
public_key: &public_key,
capabilities,
- rollback_index: 1,
+ // TODO(b/392081737): Capture expected rollback_index from build variables as we
+ // intend on auto-syncing rollback_index with security patch timestamps
+ rollback_index: 2,
page_size,
name: None,
};
diff --git a/guest/pvmfw/src/arch/aarch64/payload.rs b/guest/pvmfw/src/arch/aarch64/payload.rs
index 0da8297..77e9a31 100644
--- a/guest/pvmfw/src/arch/aarch64/payload.rs
+++ b/guest/pvmfw/src/arch/aarch64/payload.rs
@@ -23,13 +23,10 @@
/// Function boot payload after cleaning all secret from pvmfw memory
pub fn jump_to_payload(entrypoint: usize, slices: &MemorySlices) -> ! {
let fdt_address = slices.fdt.as_ptr() as usize;
- let bcc = slices
- .dice_chain
- .map(|slice| {
- let r = slice.as_ptr_range();
- (r.start as usize)..(r.end as usize)
- })
- .expect("Missing DICE chain");
+ let dice_handover = slices.dice_handover.map(|slice| {
+ let r = slice.as_ptr_range();
+ (r.start as usize)..(r.end as usize)
+ });
deactivate_dynamic_page_tables();
@@ -50,9 +47,14 @@
assert_eq!(scratch.start.0 % ASM_STP_ALIGN, 0, "scratch memory is misaligned.");
assert_eq!(scratch.end.0 % ASM_STP_ALIGN, 0, "scratch memory is misaligned.");
- assert!(bcc.is_within(&(scratch.start.0..scratch.end.0)));
- assert_eq!(bcc.start % ASM_STP_ALIGN, 0, "Misaligned guest BCC.");
- assert_eq!(bcc.end % ASM_STP_ALIGN, 0, "Misaligned guest BCC.");
+ // A sub-region of the scratch memory might contain data for the next stage so skip zeroing it.
+ // Alternatively, an empty region at the start of the scratch region is compatible with the ASM
+ // implementation and results in the whole scratch region being zeroed.
+ let skipped = dice_handover.unwrap_or(scratch.start.0..scratch.start.0);
+
+ assert!(skipped.is_within(&(scratch.start.0..scratch.end.0)));
+ assert_eq!(skipped.start % ASM_STP_ALIGN, 0, "Misaligned skipped region.");
+ assert_eq!(skipped.end % ASM_STP_ALIGN, 0, "Misaligned skipped region.");
let stack = layout::stack_range();
@@ -73,27 +75,22 @@
// SAFETY: We're exiting pvmfw by passing the register values we need to a noreturn asm!().
unsafe {
asm!(
- "cmp {scratch}, {bcc}",
- "b.hs 1f",
-
- // Zero .data & .bss until BCC.
+ // Zero .data & .bss until the start of the skipped region.
+ "b 1f",
"0: stp xzr, xzr, [{scratch}], 16",
- "cmp {scratch}, {bcc}",
+ "1: cmp {scratch}, {skipped}",
"b.lo 0b",
- "1:",
- // Skip BCC.
- "mov {scratch}, {bcc_end}",
- "cmp {scratch}, {scratch_end}",
- "b.hs 1f",
+ // Skip the skipped region.
+ "mov {scratch}, {skipped_end}",
// Keep zeroing .data & .bss.
+ "b 1f",
"0: stp xzr, xzr, [{scratch}], 16",
- "cmp {scratch}, {scratch_end}",
+ "1: cmp {scratch}, {scratch_end}",
"b.lo 0b",
- "1:",
- // Flush d-cache over .data & .bss (including BCC).
+ // Flush d-cache over .data & .bss (including skipped region).
"0: dc cvau, {cache_line}",
"add {cache_line}, {cache_line}, {dcache_line_size}",
"cmp {cache_line}, {scratch_end}",
@@ -159,8 +156,8 @@
"dsb nsh",
"br x30",
sctlr_el1_val = in(reg) SCTLR_EL1_VAL,
- bcc = in(reg) u64::try_from(bcc.start).unwrap(),
- bcc_end = in(reg) u64::try_from(bcc.end).unwrap(),
+ skipped = in(reg) u64::try_from(skipped.start).unwrap(),
+ skipped_end = in(reg) u64::try_from(skipped.end).unwrap(),
cache_line = in(reg) u64::try_from(scratch.start.0).unwrap(),
scratch = in(reg) u64::try_from(scratch.start.0).unwrap(),
scratch_end = in(reg) u64::try_from(scratch.end.0).unwrap(),
diff --git a/guest/pvmfw/src/config.rs b/guest/pvmfw/src/config.rs
index dbfde15..a16da35 100644
--- a/guest/pvmfw/src/config.rs
+++ b/guest/pvmfw/src/config.rs
@@ -124,7 +124,7 @@
#[derive(Clone, Copy, Debug)]
pub enum Entry {
- Bcc,
+ DiceHandover,
DebugPolicy,
VmDtbo,
VmBaseDtbo,
@@ -136,12 +136,12 @@
const COUNT: usize = Self::_VARIANT_COUNT as usize;
const ALL_ENTRIES: [Entry; Self::COUNT] =
- [Self::Bcc, Self::DebugPolicy, Self::VmDtbo, Self::VmBaseDtbo];
+ [Self::DiceHandover, Self::DebugPolicy, Self::VmDtbo, Self::VmBaseDtbo];
}
#[derive(Default)]
pub struct Entries<'a> {
- pub bcc: &'a mut [u8],
+ pub dice_handover: Option<&'a mut [u8]>,
pub debug_policy: Option<&'a [u8]>,
pub vm_dtbo: Option<&'a mut [u8]>,
pub vm_ref_dt: Option<&'a [u8]>,
@@ -269,8 +269,8 @@
entry_size,
);
}
- // Ensures that BCC exists.
- ranges[Entry::Bcc as usize].ok_or(Error::MissingEntry(Entry::Bcc))?;
+ // Ensures that the DICE handover is present.
+ ranges[Entry::DiceHandover as usize].ok_or(Error::MissingEntry(Entry::DiceHandover))?;
Ok(Self { body, ranges })
}
@@ -293,15 +293,12 @@
entries[i] = Some(chunk);
}
}
- let [bcc, debug_policy, vm_dtbo, vm_ref_dt] = entries;
-
- // The platform BCC has always been required.
- let bcc = bcc.unwrap();
+ let [dice_handover, debug_policy, vm_dtbo, vm_ref_dt] = entries;
// We have no reason to mutate so drop the `mut`.
let debug_policy = debug_policy.map(|x| &*x);
let vm_ref_dt = vm_ref_dt.map(|x| &*x);
- Entries { bcc, debug_policy, vm_dtbo, vm_ref_dt }
+ Entries { dice_handover, debug_policy, vm_dtbo, vm_ref_dt }
}
}
diff --git a/guest/pvmfw/src/dice/chain.rs b/guest/pvmfw/src/dice/chain.rs
index 0f5b058..c8353fa 100644
--- a/guest/pvmfw/src/dice/chain.rs
+++ b/guest/pvmfw/src/dice/chain.rs
@@ -12,7 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
-//! Code to inspect/manipulate the BCC (DICE Chain) we receive from our loader (the hypervisor).
+//! Code to inspect/manipulate the DICE Chain we receive from our loader.
// TODO(b/279910232): Unify this, somehow, with the similar but different code in hwtrust.
@@ -25,55 +25,55 @@
use diced_open_dice::{BccHandover, Cdi, DiceArtifacts, DiceMode};
use log::trace;
-type Result<T> = core::result::Result<T, BccError>;
+type Result<T> = core::result::Result<T, DiceChainError>;
-pub enum BccError {
+pub enum DiceChainError {
CborDecodeError,
CborEncodeError,
CosetError(coset::CoseError),
DiceError(diced_open_dice::DiceError),
- MalformedBcc(&'static str),
- MissingBcc,
+ Malformed(&'static str),
+ Missing,
}
-impl From<coset::CoseError> for BccError {
+impl From<coset::CoseError> for DiceChainError {
fn from(e: coset::CoseError) -> Self {
Self::CosetError(e)
}
}
-impl fmt::Display for BccError {
+impl fmt::Display for DiceChainError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
match self {
- Self::CborDecodeError => write!(f, "Error parsing BCC CBOR"),
- Self::CborEncodeError => write!(f, "Error encoding BCC CBOR"),
+ Self::CborDecodeError => write!(f, "Error parsing DICE chain CBOR"),
+ Self::CborEncodeError => write!(f, "Error encoding DICE chain CBOR"),
Self::CosetError(e) => write!(f, "Encountered an error with coset: {e}"),
Self::DiceError(e) => write!(f, "Dice error: {e:?}"),
- Self::MalformedBcc(s) => {
- write!(f, "BCC does not have the expected CBOR structure: {s}")
+ Self::Malformed(s) => {
+ write!(f, "DICE chain does not have the expected CBOR structure: {s}")
}
- Self::MissingBcc => write!(f, "Missing BCC"),
+ Self::Missing => write!(f, "Missing DICE chain"),
}
}
}
/// Return a new CBOR encoded BccHandover that is based on the incoming CDIs but does not chain
-/// from the received BCC.
+/// from the received DICE chain.
#[cfg_attr(test, allow(dead_code))]
-pub fn truncate(bcc_handover: BccHandover) -> Result<Vec<u8>> {
+pub fn truncate(handover: BccHandover) -> Result<Vec<u8>> {
// Note: The strings here are deliberately different from those used in a normal DICE handover
// because we want this to not be equivalent to any valid DICE derivation.
- let cdi_seal = taint_cdi(bcc_handover.cdi_seal(), "TaintCdiSeal")?;
- let cdi_attest = taint_cdi(bcc_handover.cdi_attest(), "TaintCdiAttest")?;
+ let cdi_seal = taint_cdi(handover.cdi_seal(), "TaintCdiSeal")?;
+ let cdi_attest = taint_cdi(handover.cdi_attest(), "TaintCdiAttest")?;
// BccHandover = {
// 1 : bstr .size 32, ; CDI_Attest
// 2 : bstr .size 32, ; CDI_Seal
// ? 3 : Bcc, ; Certificate chain
// }
- let bcc_handover: Vec<(Value, Value)> =
+ let handover: Vec<(Value, Value)> =
vec![(1.into(), cdi_attest.as_slice().into()), (2.into(), cdi_seal.as_slice().into())];
- cbor_util::serialize(&bcc_handover).map_err(|_| BccError::CborEncodeError)
+ cbor_util::serialize(&handover).map_err(|_| DiceChainError::CborEncodeError)
}
#[cfg_attr(test, allow(dead_code))]
@@ -88,42 +88,39 @@
];
let mut result = [0u8; size_of::<Cdi>()];
diced_open_dice::kdf(cdi.as_slice(), &SALT, info.as_bytes(), result.as_mut_slice())
- .map_err(BccError::DiceError)?;
+ .map_err(DiceChainError::DiceError)?;
Ok(result)
}
-/// Represents a (partially) decoded BCC DICE chain.
-pub struct Bcc {
+/// Represents a (partially) decoded DICE chain.
+pub struct DiceChainInfo {
is_debug_mode: bool,
leaf_subject_pubkey: PublicKey,
}
-impl Bcc {
- pub fn new(received_bcc: Option<&[u8]>) -> Result<Bcc> {
- let received_bcc = received_bcc.unwrap_or(&[]);
- if received_bcc.is_empty() {
- return Err(BccError::MissingBcc);
- }
+impl DiceChainInfo {
+ pub fn new(handover: Option<&[u8]>) -> Result<Self> {
+ let handover = handover.filter(|h| !h.is_empty()).ok_or(DiceChainError::Missing)?;
- // We don't attempt to fully validate the BCC (e.g. we don't check the signatures) - we
- // have to trust our loader. But if it's invalid CBOR or otherwise clearly ill-formed,
+ // We don't attempt to fully validate the DICE chain (e.g. we don't check the signatures) -
+ // we have to trust our loader. But if it's invalid CBOR or otherwise clearly ill-formed,
// something is very wrong, so we fail.
- let bcc_cbor =
- cbor_util::deserialize(received_bcc).map_err(|_| BccError::CborDecodeError)?;
+ let handover_cbor =
+ cbor_util::deserialize(handover).map_err(|_| DiceChainError::CborDecodeError)?;
// Bcc = [
// PubKeyEd25519 / PubKeyECDSA256, // DK_pub
// + BccEntry, // Root -> leaf (KM_pub)
// ]
- let bcc = match bcc_cbor {
+ let dice_chain = match handover_cbor {
Value::Array(v) if v.len() >= 2 => v,
- _ => return Err(BccError::MalformedBcc("Invalid top level value")),
+ _ => return Err(DiceChainError::Malformed("Invalid top level value")),
};
// Decode all the DICE payloads to make sure they are well-formed.
- let payloads = bcc
+ let payloads = dice_chain
.into_iter()
.skip(1)
- .map(|v| BccEntry::new(v).payload())
+ .map(|v| DiceChainEntry::new(v).payload())
.collect::<Result<Vec<_>>>()?;
let is_debug_mode = is_any_payload_debug_mode(&payloads)?;
@@ -143,7 +140,7 @@
}
}
-fn is_any_payload_debug_mode(payloads: &[BccPayload]) -> Result<bool> {
+fn is_any_payload_debug_mode(payloads: &[DiceChainEntryPayload]) -> Result<bool> {
// Check if any payload in the chain is marked as Debug mode, which means the device is not
// secure. (Normal means it is a secure boot, for that stage at least; we ignore recovery
// & not configured /invalid values, since it's not clear what they would mean in this
@@ -157,10 +154,7 @@
}
#[repr(transparent)]
-struct BccEntry(Value);
-
-#[repr(transparent)]
-struct BccPayload(Value);
+struct DiceChainEntry(Value);
#[derive(Debug, Clone)]
pub struct PublicKey {
@@ -169,12 +163,12 @@
pub cose_alg: iana::Algorithm,
}
-impl BccEntry {
+impl DiceChainEntry {
pub fn new(entry: Value) -> Self {
Self(entry)
}
- pub fn payload(&self) -> Result<BccPayload> {
+ pub fn payload(&self) -> Result<DiceChainEntryPayload> {
// BccEntry = [ // COSE_Sign1 (untagged)
// protected : bstr .cbor {
// 1 : AlgorithmEdDSA / AlgorithmES256, // Algorithm
@@ -185,11 +179,13 @@
// // ECDSA(SigningKey, bstr .cbor BccEntryInput)
// // See RFC 8032 for details of how to encode the signature value for Ed25519.
// ]
+ let payload = self
+ .payload_bytes()
+ .ok_or(DiceChainError::Malformed("Invalid DiceChainEntryPayload"))?;
let payload =
- self.payload_bytes().ok_or(BccError::MalformedBcc("Invalid payload in BccEntry"))?;
- let payload = cbor_util::deserialize(payload).map_err(|_| BccError::CborDecodeError)?;
- trace!("Bcc payload: {payload:?}");
- Ok(BccPayload(payload))
+ cbor_util::deserialize(payload).map_err(|_| DiceChainError::CborDecodeError)?;
+ trace!("DiceChainEntryPayload: {payload:?}");
+ Ok(DiceChainEntryPayload(payload))
}
fn payload_bytes(&self) -> Option<&Vec<u8>> {
@@ -205,7 +201,10 @@
const MODE_DEBUG: u8 = DiceMode::kDiceModeDebug as u8;
const SUBJECT_PUBLIC_KEY: i32 = -4670552;
-impl BccPayload {
+#[repr(transparent)]
+struct DiceChainEntryPayload(Value);
+
+impl DiceChainEntryPayload {
pub fn is_debug_mode(&self) -> Result<bool> {
// BccPayload = { // CWT
// ...
@@ -221,11 +220,11 @@
// Profile for DICE spec.
let mode = if let Some(bytes) = value.as_bytes() {
if bytes.len() != 1 {
- return Err(BccError::MalformedBcc("Invalid mode bstr"));
+ return Err(DiceChainError::Malformed("Invalid mode bstr"));
}
bytes[0].into()
} else {
- value.as_integer().ok_or(BccError::MalformedBcc("Invalid type for mode"))?
+ value.as_integer().ok_or(DiceChainError::Malformed("Invalid type for mode"))?
};
Ok(mode == MODE_DEBUG.into())
}
@@ -239,9 +238,9 @@
// ...
// }
self.value_from_key(SUBJECT_PUBLIC_KEY)
- .ok_or(BccError::MalformedBcc("Subject public key missing"))?
+ .ok_or(DiceChainError::Malformed("Subject public key missing"))?
.as_bytes()
- .ok_or(BccError::MalformedBcc("Subject public key is not a byte string"))
+ .ok_or(DiceChainError::Malformed("Subject public key is not a byte string"))
.and_then(|v| PublicKey::from_slice(v))
}
@@ -264,7 +263,7 @@
fn from_slice(slice: &[u8]) -> Result<Self> {
let key = CoseKey::from_slice(slice)?;
let Some(Algorithm::Assigned(cose_alg)) = key.alg else {
- return Err(BccError::MalformedBcc("Invalid algorithm in public key"));
+ return Err(DiceChainError::Malformed("Invalid algorithm in public key"));
};
Ok(Self { cose_alg })
}
diff --git a/guest/pvmfw/src/dice/mod.rs b/guest/pvmfw/src/dice/mod.rs
index 94348a5..dc7b64e 100644
--- a/guest/pvmfw/src/dice/mod.rs
+++ b/guest/pvmfw/src/dice/mod.rs
@@ -12,7 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
-//! Support for DICE derivation and BCC generation.
+//! Support for DICE derivation and DICE chain generation.
extern crate alloc;
pub(crate) mod chain;
@@ -20,7 +20,7 @@
use alloc::format;
use alloc::string::String;
use alloc::vec::Vec;
-pub use chain::Bcc;
+pub use chain::DiceChainInfo;
use ciborium::cbor;
use ciborium::Value;
use core::mem::size_of;
@@ -87,11 +87,12 @@
pub mode: DiceMode,
pub security_version: u64,
pub rkp_vm_marker: bool,
+ pub instance_hash: Option<Hash>,
component_name: String,
}
impl PartialInputs {
- pub fn new(data: &VerifiedBootData) -> Result<Self> {
+ pub fn new(data: &VerifiedBootData, instance_hash: Option<Hash>) -> Result<Self> {
let code_hash = to_dice_hash(data)?;
let auth_hash = hash(data.public_key)?;
let mode = to_dice_mode(data.debug_level);
@@ -101,20 +102,27 @@
let rkp_vm_marker = data.has_capability(Capability::RemoteAttest)
|| data.has_capability(Capability::TrustySecurityVm);
- Ok(Self { code_hash, auth_hash, mode, security_version, rkp_vm_marker, component_name })
+ Ok(Self {
+ code_hash,
+ auth_hash,
+ mode,
+ security_version,
+ rkp_vm_marker,
+ instance_hash,
+ component_name,
+ })
}
- pub fn write_next_bcc(
+ pub fn write_next_handover(
self,
- current_bcc_handover: &[u8],
+ current_handover: &[u8],
salt: &[u8; HIDDEN_SIZE],
- instance_hash: Option<Hash>,
deferred_rollback_protection: bool,
- next_bcc: &mut [u8],
+ next_handover: &mut [u8],
context: DiceContext,
) -> Result<()> {
let config = self
- .generate_config_descriptor(instance_hash)
+ .generate_config_descriptor()
.map_err(|_| diced_open_dice::DiceError::InvalidInput)?;
let dice_inputs = InputValues::new(
@@ -124,7 +132,7 @@
self.mode,
self.make_hidden(salt, deferred_rollback_protection)?,
);
- let _ = bcc_handover_main_flow(current_bcc_handover, &dice_inputs, next_bcc, context)?;
+ let _ = bcc_handover_main_flow(current_handover, &dice_inputs, next_handover, context)?;
Ok(())
}
@@ -160,14 +168,14 @@
)
}
- fn generate_config_descriptor(&self, instance_hash: Option<Hash>) -> Result<Vec<u8>> {
+ fn generate_config_descriptor(&self) -> Result<Vec<u8>> {
let mut config = Vec::with_capacity(4);
config.push((cbor!(COMPONENT_NAME_KEY)?, cbor!(self.component_name.as_str())?));
config.push((cbor!(SECURITY_VERSION_KEY)?, cbor!(self.security_version)?));
if self.rkp_vm_marker {
config.push((cbor!(RKP_VM_MARKER_KEY)?, Value::Null))
}
- if let Some(instance_hash) = instance_hash {
+ if let Some(instance_hash) = self.instance_hash {
config.push((cbor!(INSTANCE_HASH_KEY)?, Value::from(instance_hash.as_slice())));
}
let config = Value::Map(config);
@@ -184,6 +192,7 @@
SECURITY_VERSION_KEY,
};
use ciborium::Value;
+ use diced_open_dice::bcc_handover_parse;
use diced_open_dice::DiceArtifacts;
use diced_open_dice::DiceContext;
use diced_open_dice::DiceMode;
@@ -216,7 +225,7 @@
#[test]
fn base_data_conversion() {
let vb_data = BASE_VB_DATA;
- let inputs = PartialInputs::new(&vb_data).unwrap();
+ let inputs = PartialInputs::new(&vb_data, None).unwrap();
assert_eq!(inputs.mode, DiceMode::kDiceModeNormal);
assert_eq!(inputs.security_version, 42);
@@ -228,7 +237,7 @@
#[test]
fn debuggable_conversion() {
let vb_data = VerifiedBootData { debug_level: DebugLevel::Full, ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
+ let inputs = PartialInputs::new(&vb_data, None).unwrap();
assert_eq!(inputs.mode, DiceMode::kDiceModeDebug);
}
@@ -237,7 +246,7 @@
fn rkp_vm_conversion() {
let vb_data =
VerifiedBootData { capabilities: vec![Capability::RemoteAttest], ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
+ let inputs = PartialInputs::new(&vb_data, None).unwrap();
assert!(inputs.rkp_vm_marker);
}
@@ -245,22 +254,23 @@
#[test]
fn base_config_descriptor() {
let vb_data = BASE_VB_DATA;
- let inputs = PartialInputs::new(&vb_data).unwrap();
- let config_map = decode_config_descriptor(&inputs, None);
+ let inputs = PartialInputs::new(&vb_data, None).unwrap();
+ let config_map = decode_config_descriptor(&inputs);
assert_eq!(config_map.get(&COMPONENT_NAME_KEY).unwrap().as_text().unwrap(), "vm_entry");
assert_eq!(config_map.get(&COMPONENT_VERSION_KEY), None);
assert_eq!(config_map.get(&RESETTABLE_KEY), None);
assert_eq!(config_map.get(&SECURITY_VERSION_KEY).unwrap().as_integer().unwrap(), 42.into());
assert_eq!(config_map.get(&RKP_VM_MARKER_KEY), None);
+ assert_eq!(config_map.get(&INSTANCE_HASH_KEY), None);
}
#[test]
fn rkp_vm_config_descriptor_has_rkp_vm_marker_and_component_name() {
let vb_data =
VerifiedBootData { capabilities: vec![Capability::RemoteAttest], ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
- let config_map = decode_config_descriptor(&inputs, Some(HASH));
+ let inputs = PartialInputs::new(&vb_data, Some(HASH)).unwrap();
+ let config_map = decode_config_descriptor(&inputs);
assert_eq!(config_map.get(&COMPONENT_NAME_KEY).unwrap().as_text().unwrap(), "vm_entry");
assert!(config_map.get(&RKP_VM_MARKER_KEY).unwrap().is_null());
@@ -270,8 +280,8 @@
fn security_vm_config_descriptor_has_rkp_vm_marker() {
let vb_data =
VerifiedBootData { capabilities: vec![Capability::TrustySecurityVm], ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
- let config_map = decode_config_descriptor(&inputs, Some(HASH));
+ let inputs = PartialInputs::new(&vb_data, Some(HASH)).unwrap();
+ let config_map = decode_config_descriptor(&inputs);
assert!(config_map.get(&RKP_VM_MARKER_KEY).unwrap().is_null());
}
@@ -280,8 +290,8 @@
fn config_descriptor_with_instance_hash() {
let vb_data =
VerifiedBootData { capabilities: vec![Capability::RemoteAttest], ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
- let config_map = decode_config_descriptor(&inputs, Some(HASH));
+ let inputs = PartialInputs::new(&vb_data, Some(HASH)).unwrap();
+ let config_map = decode_config_descriptor(&inputs);
assert_eq!(*config_map.get(&INSTANCE_HASH_KEY).unwrap(), Value::from(HASH.as_slice()));
}
@@ -289,16 +299,13 @@
fn config_descriptor_without_instance_hash() {
let vb_data =
VerifiedBootData { capabilities: vec![Capability::RemoteAttest], ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
- let config_map = decode_config_descriptor(&inputs, None);
+ let inputs = PartialInputs::new(&vb_data, None).unwrap();
+ let config_map = decode_config_descriptor(&inputs);
assert!(!config_map.contains_key(&INSTANCE_HASH_KEY));
}
- fn decode_config_descriptor(
- inputs: &PartialInputs,
- instance_hash: Option<Hash>,
- ) -> HashMap<i64, Value> {
- let config_descriptor = inputs.generate_config_descriptor(instance_hash).unwrap();
+ fn decode_config_descriptor(inputs: &PartialInputs) -> HashMap<i64, Value> {
+ let config_descriptor = inputs.generate_config_descriptor().unwrap();
let cbor_map =
cbor_util::deserialize::<Value>(&config_descriptor).unwrap().into_map().unwrap();
@@ -312,7 +319,7 @@
#[test]
fn changing_deferred_rpb_changes_secrets() {
let vb_data = VerifiedBootData { debug_level: DebugLevel::Full, ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
+ let inputs = PartialInputs::new(&vb_data, Some([0u8; 64])).unwrap();
let mut buffer_without_defer = [0; 4096];
let mut buffer_with_defer = [0; 4096];
let mut buffer_without_defer_retry = [0; 4096];
@@ -337,62 +344,57 @@
inputs
.clone()
- .write_next_bcc(
+ .write_next_handover(
sample_dice_input,
&[0u8; HIDDEN_SIZE],
- Some([0u8; 64]),
false,
&mut buffer_without_defer,
context.clone(),
)
.unwrap();
- let bcc_handover1 = diced_open_dice::bcc_handover_parse(&buffer_without_defer).unwrap();
+ let handover1 = from_serialized_handover(&buffer_without_defer);
inputs
.clone()
- .write_next_bcc(
+ .write_next_handover(
sample_dice_input,
&[0u8; HIDDEN_SIZE],
- Some([0u8; 64]),
true,
&mut buffer_with_defer,
context.clone(),
)
.unwrap();
- let bcc_handover2 = diced_open_dice::bcc_handover_parse(&buffer_with_defer).unwrap();
+ let handover2 = from_serialized_handover(&buffer_with_defer);
inputs
.clone()
- .write_next_bcc(
+ .write_next_handover(
sample_dice_input,
&[0u8; HIDDEN_SIZE],
- Some([0u8; 64]),
false,
&mut buffer_without_defer_retry,
context.clone(),
)
.unwrap();
- let bcc_handover3 =
- diced_open_dice::bcc_handover_parse(&buffer_without_defer_retry).unwrap();
+ let handover3 = from_serialized_handover(&buffer_without_defer_retry);
- assert_ne!(bcc_handover1.cdi_seal(), bcc_handover2.cdi_seal());
- assert_eq!(bcc_handover1.cdi_seal(), bcc_handover3.cdi_seal());
+ assert_ne!(handover1.cdi_seal(), handover2.cdi_seal());
+ assert_eq!(handover1.cdi_seal(), handover3.cdi_seal());
}
#[test]
fn dice_derivation_with_different_algorithms_is_valid() {
let dice_artifacts = make_sample_bcc_and_cdis().unwrap();
- let bcc_handover0_bytes = to_bcc_handover(&dice_artifacts);
+ let handover0_bytes = to_serialized_handover(&dice_artifacts);
let vb_data = VerifiedBootData { debug_level: DebugLevel::Full, ..BASE_VB_DATA };
- let inputs = PartialInputs::new(&vb_data).unwrap();
+ let inputs = PartialInputs::new(&vb_data, Some([0u8; 64])).unwrap();
let mut buffer = [0; 4096];
inputs
.clone()
- .write_next_bcc(
- &bcc_handover0_bytes,
+ .write_next_handover(
+ &handover0_bytes,
&[0u8; HIDDEN_SIZE],
- Some([0u8; 64]),
true,
&mut buffer,
DiceContext {
@@ -400,17 +402,16 @@
subject_algorithm: KeyAlgorithm::EcdsaP256,
},
)
- .expect("Failed to derive Ed25519 -> EcdsaP256 BCC");
- let bcc_handover1 = diced_open_dice::bcc_handover_parse(&buffer).unwrap();
- let bcc_handover1_bytes = to_bcc_handover(&bcc_handover1);
+ .expect("Failed to derive Ed25519 -> EcdsaP256 DICE chain");
+ let handover1 = from_serialized_handover(&buffer);
+ let handover1_bytes = to_serialized_handover(&handover1);
buffer.fill(0);
inputs
.clone()
- .write_next_bcc(
- &bcc_handover1_bytes,
+ .write_next_handover(
+ &handover1_bytes,
&[0u8; HIDDEN_SIZE],
- Some([0u8; 64]),
true,
&mut buffer,
DiceContext {
@@ -418,17 +419,16 @@
subject_algorithm: KeyAlgorithm::EcdsaP384,
},
)
- .expect("Failed to derive EcdsaP256 -> EcdsaP384 BCC");
- let bcc_handover2 = diced_open_dice::bcc_handover_parse(&buffer).unwrap();
- let bcc_handover2_bytes = to_bcc_handover(&bcc_handover2);
+ .expect("Failed to derive EcdsaP256 -> EcdsaP384 DICE chain");
+ let handover2 = from_serialized_handover(&buffer);
+ let handover2_bytes = to_serialized_handover(&handover2);
buffer.fill(0);
inputs
.clone()
- .write_next_bcc(
- &bcc_handover2_bytes,
+ .write_next_handover(
+ &handover2_bytes,
&[0u8; HIDDEN_SIZE],
- Some([0u8; 64]),
true,
&mut buffer,
DiceContext {
@@ -436,21 +436,25 @@
subject_algorithm: KeyAlgorithm::Ed25519,
},
)
- .expect("Failed to derive EcdsaP384 -> Ed25519 BCC");
- let bcc_handover3 = diced_open_dice::bcc_handover_parse(&buffer).unwrap();
+ .expect("Failed to derive EcdsaP384 -> Ed25519 DICE chain");
+ let handover3 = from_serialized_handover(&buffer);
let mut session = Session::default();
session.set_allow_any_mode(true);
- let _chain = dice::Chain::from_cbor(&session, bcc_handover3.bcc().unwrap()).unwrap();
+ let _chain = dice::Chain::from_cbor(&session, handover3.bcc().unwrap()).unwrap();
}
- fn to_bcc_handover(dice_artifacts: &dyn DiceArtifacts) -> Vec<u8> {
+ fn to_serialized_handover(dice_artifacts: &dyn DiceArtifacts) -> Vec<u8> {
let dice_chain = cbor_util::deserialize::<Value>(dice_artifacts.bcc().unwrap()).unwrap();
- let bcc_handover = Value::Map(vec![
+ let handover = Value::Map(vec![
(Value::Integer(1.into()), Value::Bytes(dice_artifacts.cdi_attest().to_vec())),
(Value::Integer(2.into()), Value::Bytes(dice_artifacts.cdi_seal().to_vec())),
(Value::Integer(3.into()), dice_chain),
]);
- cbor_util::serialize(&bcc_handover).unwrap()
+ cbor_util::serialize(&handover).unwrap()
+ }
+
+ fn from_serialized_handover(bytes: &[u8]) -> diced_open_dice::BccHandover {
+ bcc_handover_parse(bytes).unwrap()
}
}
diff --git a/guest/pvmfw/src/entry.rs b/guest/pvmfw/src/entry.rs
index cde4cfe..cb6c64e 100644
--- a/guest/pvmfw/src/entry.rs
+++ b/guest/pvmfw/src/entry.rs
@@ -33,8 +33,8 @@
#[derive(Debug, Clone)]
pub enum RebootReason {
- /// A malformed BCC was received.
- InvalidBcc,
+ /// A malformed DICE handover was received.
+ InvalidDiceHandover,
/// An invalid configuration was appended to pvmfw.
InvalidConfig,
/// An unexpected internal error happened.
@@ -54,7 +54,7 @@
impl RebootReason {
pub fn as_avf_reboot_string(&self) -> &'static str {
match self {
- Self::InvalidBcc => "PVM_FIRMWARE_INVALID_BCC",
+ Self::InvalidDiceHandover => "PVM_FIRMWARE_INVALID_DICE_HANDOVER",
Self::InvalidConfig => "PVM_FIRMWARE_INVALID_CONFIG_DATA",
Self::InternalError => "PVM_FIRMWARE_INTERNAL_ERROR",
Self::InvalidFdt => "PVM_FIRMWARE_INVALID_FDT",
@@ -135,21 +135,26 @@
let mut slices = MemorySlices::new(fdt, payload, payload_size)?;
// This wrapper allows main() to be blissfully ignorant of platform details.
- let (next_bcc, debuggable_payload) = crate::main(
+ let (next_dice_handover, debuggable_payload) = crate::main(
slices.fdt,
slices.kernel,
slices.ramdisk,
- config_entries.bcc,
+ config_entries.dice_handover.as_deref(),
config_entries.debug_policy,
config_entries.vm_dtbo,
config_entries.vm_ref_dt,
)?;
- slices.add_dice_chain(next_bcc);
+ if let Some(r) = next_dice_handover {
+ slices.add_dice_handover(r);
+ }
+
// Keep UART MMIO_GUARD-ed for debuggable payloads, to enable earlycon.
let keep_uart = cfg!(debuggable_vms_improvements) && debuggable_payload;
// Writable-dirty regions will be flushed when MemoryTracker is dropped.
- config_entries.bcc.zeroize();
+ if let Some(r) = config_entries.dice_handover {
+ r.zeroize();
+ }
unshare_all_mmio_except_uart().map_err(|e| {
error!("Failed to unshare MMIO ranges: {e}");
@@ -180,8 +185,8 @@
enum AppendedPayload<'a> {
/// Configuration data.
Config(config::Config<'a>),
- /// Deprecated raw BCC, as used in Android T.
- LegacyBcc(&'a mut [u8]),
+ /// Deprecated raw DICE handover, as used in Android T.
+ LegacyDiceHandover(&'a mut [u8]),
}
impl<'a> AppendedPayload<'a> {
@@ -201,9 +206,12 @@
// SAFETY: Pointer to a valid mut (not accessed elsewhere), 'a lifetime re-used.
let data: &'a mut _ = unsafe { &mut *data_ptr };
- const BCC_SIZE: usize = SIZE_4KB;
- warn!("Assuming the appended data at {:?} to be a raw BCC", data.as_ptr());
- Some(Self::LegacyBcc(&mut data[..BCC_SIZE]))
+ const DICE_CHAIN_SIZE: usize = SIZE_4KB;
+ warn!(
+ "Assuming the appended data at {:?} to be a raw DICE handover",
+ data.as_ptr()
+ );
+ Some(Self::LegacyDiceHandover(&mut data[..DICE_CHAIN_SIZE]))
}
Err(e) => {
error!("Invalid configuration data at {data_ptr:?}: {e}");
@@ -215,7 +223,9 @@
fn get_entries(self) -> config::Entries<'a> {
match self {
Self::Config(cfg) => cfg.get_entries(),
- Self::LegacyBcc(bcc) => config::Entries { bcc, ..Default::default() },
+ Self::LegacyDiceHandover(d) => {
+ config::Entries { dice_handover: Some(d), ..Default::default() }
+ }
}
}
}
diff --git a/guest/pvmfw/src/fdt.rs b/guest/pvmfw/src/fdt.rs
index 6f55c21..2444b00 100644
--- a/guest/pvmfw/src/fdt.rs
+++ b/guest/pvmfw/src/fdt.rs
@@ -1360,7 +1360,7 @@
/// Modifies the input DT according to the fields of the configuration.
pub fn modify_for_next_stage(
fdt: &mut Fdt,
- bcc: &[u8],
+ dice_handover: Option<&[u8]>,
new_instance: bool,
strict_boot: bool,
debug_policy: Option<&[u8]>,
@@ -1382,7 +1382,7 @@
fdt.unpack()?;
}
- patch_dice_node(fdt, bcc)?;
+ patch_dice_node(fdt, dice_handover)?;
if let Some(mut chosen) = fdt.chosen_mut()? {
empty_or_delete_prop(&mut chosen, c"avf,strict-boot", strict_boot)?;
@@ -1400,15 +1400,19 @@
Ok(())
}
-/// Patch the "google,open-dice"-compatible reserved-memory node to point to the bcc range
-fn patch_dice_node(fdt: &mut Fdt, handover: &[u8]) -> libfdt::Result<()> {
+/// Patch the "google,open-dice"-compatible reserved-memory node to point to the DICE handover.
+fn patch_dice_node(fdt: &mut Fdt, handover: Option<&[u8]>) -> libfdt::Result<()> {
// The node is assumed to be present in the template DT.
let node = fdt.node_mut(c"/reserved-memory")?.ok_or(FdtError::NotFound)?;
let mut node = node.next_compatible(c"google,open-dice")?.ok_or(FdtError::NotFound)?;
- let addr = (handover.as_ptr() as usize).try_into().unwrap();
- let size = handover.len().try_into().unwrap();
- node.setprop_addrrange_inplace(c"reg", addr, size)
+ if let Some(r) = handover {
+ let addr = (r.as_ptr() as usize).try_into().unwrap();
+ let size = r.len().try_into().unwrap();
+ node.setprop_addrrange_inplace(c"reg", addr, size)
+ } else {
+ node.nop()
+ }
}
fn empty_or_delete_prop(
diff --git a/guest/pvmfw/src/main.rs b/guest/pvmfw/src/main.rs
index d3d5527..db60849 100644
--- a/guest/pvmfw/src/main.rs
+++ b/guest/pvmfw/src/main.rs
@@ -31,18 +31,22 @@
mod memory;
mod rollback;
-use crate::dice::{Bcc, PartialInputs};
+use crate::dice::{DiceChainInfo, PartialInputs};
use crate::entry::RebootReason;
use crate::fdt::{modify_for_next_stage, read_instance_id, sanitize_device_tree};
use crate::rollback::perform_rollback_protection;
use alloc::borrow::Cow;
use alloc::boxed::Box;
+use alloc::vec::Vec;
use bssl_avf::Digester;
-use diced_open_dice::{bcc_handover_parse, DiceArtifacts, DiceContext, Hidden, VM_KEY_ALGORITHM};
+use diced_open_dice::{
+ bcc_handover_parse, DiceArtifacts, DiceContext, Hidden, HIDDEN_SIZE, VM_KEY_ALGORITHM,
+};
use libfdt::Fdt;
use log::{debug, error, info, trace, warn};
use pvmfw_avb::verify_payload;
use pvmfw_avb::DebugLevel;
+use pvmfw_avb::VerifiedBootData;
use pvmfw_embedded_key::PUBLIC_KEY;
use vmbase::heap;
use vmbase::memory::{flush, SIZE_4KB};
@@ -52,11 +56,11 @@
untrusted_fdt: &mut Fdt,
signed_kernel: &[u8],
ramdisk: Option<&[u8]>,
- current_bcc_handover: &[u8],
+ current_dice_handover: Option<&[u8]>,
mut debug_policy: Option<&[u8]>,
vm_dtbo: Option<&mut [u8]>,
vm_ref_dt: Option<&[u8]>,
-) -> Result<(&'a [u8], bool), RebootReason> {
+) -> Result<(Option<&'a [u8]>, bool), RebootReason> {
info!("pVM firmware");
debug!("FDT: {:?}", untrusted_fdt.as_ptr());
debug!("Signed kernel: {:?} ({:#x} bytes)", signed_kernel.as_ptr(), signed_kernel.len());
@@ -67,101 +71,57 @@
debug!("Ramdisk: None");
}
- let bcc_handover = bcc_handover_parse(current_bcc_handover).map_err(|e| {
- error!("Invalid BCC Handover: {e:?}");
- RebootReason::InvalidBcc
- })?;
- trace!("BCC: {bcc_handover:x?}");
-
- let bcc = Bcc::new(bcc_handover.bcc()).map_err(|e| {
- error!("{e}");
- RebootReason::InvalidBcc
- })?;
+ let (parsed_dice, dice_debug_mode) = parse_dice_handover(current_dice_handover)?;
// The bootloader should never pass us a debug policy when the boot is secure (the bootloader
// is locked). If it gets it wrong, disregard it & log it, to avoid it causing problems.
- if debug_policy.is_some() && !bcc.is_debug_mode() {
- warn!("Ignoring debug policy, BCC does not indicate Debug mode");
+ if debug_policy.is_some() && !dice_debug_mode {
+ warn!("Ignoring debug policy, DICE handover does not indicate Debug mode");
debug_policy = None;
}
- let verified_boot_data = verify_payload(signed_kernel, ramdisk, PUBLIC_KEY).map_err(|e| {
- error!("Failed to verify the payload: {e}");
- RebootReason::PayloadVerificationError
- })?;
- let debuggable = verified_boot_data.debug_level != DebugLevel::None;
- if debuggable {
- info!("Successfully verified a debuggable payload.");
- info!("Please disregard any previous libavb ERROR about initrd_normal.");
- }
+ // Policy/Hidden ABI: If the pvmfw loader (typically ABL) didn't pass a DICE handover (which is
+ // technically still mandatory, as per the config data specification), skip DICE, AVB, and RBP.
+ // This is to support Qualcomm QTVMs, which perform guest image verification in TrustZone.
+ let (verified_boot_data, debuggable, guest_page_size) = if current_dice_handover.is_none() {
+ warn!("Verified boot is disabled!");
+ (None, false, SIZE_4KB)
+ } else {
+ let (dat, debug, sz) = perform_verified_boot(signed_kernel, ramdisk)?;
+ (Some(dat), debug, sz)
+ };
- let guest_page_size = verified_boot_data.page_size.unwrap_or(SIZE_4KB);
let hyp_page_size = hypervisor_backends::get_granule_size();
let _ =
sanitize_device_tree(untrusted_fdt, vm_dtbo, vm_ref_dt, guest_page_size, hyp_page_size)?;
let fdt = untrusted_fdt; // DT has now been sanitized.
- let next_bcc_size = guest_page_size;
- let next_bcc = heap::aligned_boxed_slice(next_bcc_size, guest_page_size).ok_or_else(|| {
- error!("Failed to allocate the next-stage BCC");
- RebootReason::InternalError
- })?;
- // By leaking the slice, its content will be left behind for the next stage.
- let next_bcc = Box::leak(next_bcc);
-
- let dice_inputs = PartialInputs::new(&verified_boot_data).map_err(|e| {
- error!("Failed to compute partial DICE inputs: {e:?}");
- RebootReason::InternalError
- })?;
-
- let instance_hash = salt_from_instance_id(fdt)?;
- let (new_instance, salt, defer_rollback_protection) = perform_rollback_protection(
- fdt,
- &verified_boot_data,
- &dice_inputs,
- bcc_handover.cdi_seal(),
- instance_hash,
- )?;
- trace!("Got salt for instance: {salt:x?}");
-
- let new_bcc_handover = if cfg!(dice_changes) {
- Cow::Borrowed(current_bcc_handover)
- } else {
- // It is possible that the DICE chain we were given is rooted in the UDS. We do not want to
- // give such a chain to the payload, or even the associated CDIs. So remove the
- // entire chain we were given and taint the CDIs. Note that the resulting CDIs are
- // still deterministically derived from those we received, so will vary iff they do.
- // TODO(b/280405545): Remove this post Android 14.
- let truncated_bcc_handover = dice::chain::truncate(bcc_handover).map_err(|e| {
- error!("{e}");
+ let (next_dice_handover, new_instance) = if let Some(ref data) = verified_boot_data {
+ let instance_hash = salt_from_instance_id(fdt)?;
+ let dice_inputs = PartialInputs::new(data, instance_hash).map_err(|e| {
+ error!("Failed to compute partial DICE inputs: {e:?}");
RebootReason::InternalError
})?;
- Cow::Owned(truncated_bcc_handover)
- };
+ let (dice_handover_bytes, dice_cdi_seal, dice_context) =
+ parsed_dice.expect("Missing DICE values with VB data");
+ let (new_instance, salt, defer_rollback_protection) =
+ perform_rollback_protection(fdt, data, &dice_inputs, &dice_cdi_seal)?;
+ trace!("Got salt for instance: {salt:x?}");
- trace!("BCC leaf subject public key algorithm: {:?}", bcc.leaf_subject_pubkey().cose_alg);
-
- let dice_context = DiceContext {
- authority_algorithm: bcc.leaf_subject_pubkey().cose_alg.try_into().map_err(|e| {
- error!("{e}");
- RebootReason::InternalError
- })?,
- subject_algorithm: VM_KEY_ALGORITHM,
- };
- dice_inputs
- .write_next_bcc(
- new_bcc_handover.as_ref(),
- &salt,
- instance_hash,
- defer_rollback_protection,
- next_bcc,
+ let next_dice_handover = perform_dice_derivation(
+ dice_handover_bytes.as_ref(),
dice_context,
- )
- .map_err(|e| {
- error!("Failed to derive next-stage DICE secrets: {e:?}");
- RebootReason::SecretDerivationError
- })?;
- flush(next_bcc);
+ dice_inputs,
+ &salt,
+ defer_rollback_protection,
+ guest_page_size,
+ guest_page_size,
+ )?;
+
+ (Some(next_dice_handover), new_instance)
+ } else {
+ (None, true)
+ };
let kaslr_seed = u64::from_ne_bytes(rand::random_array().map_err(|e| {
error!("Failed to generated guest KASLR seed: {e}");
@@ -170,7 +130,7 @@
let strict_boot = true;
modify_for_next_stage(
fdt,
- next_bcc,
+ next_dice_handover,
new_instance,
strict_boot,
debug_policy,
@@ -183,7 +143,106 @@
})?;
info!("Starting payload...");
- Ok((next_bcc, debuggable))
+ Ok((next_dice_handover, debuggable))
+}
+
+fn parse_dice_handover(
+ bytes: Option<&[u8]>,
+) -> Result<(Option<(Cow<'_, [u8]>, Vec<u8>, DiceContext)>, bool), RebootReason> {
+ let Some(bytes) = bytes else {
+ return Ok((None, false));
+ };
+ let dice_handover = bcc_handover_parse(bytes).map_err(|e| {
+ error!("Invalid DICE Handover: {e:?}");
+ RebootReason::InvalidDiceHandover
+ })?;
+ trace!("DICE handover: {dice_handover:x?}");
+
+ let dice_chain_info = DiceChainInfo::new(dice_handover.bcc()).map_err(|e| {
+ error!("{e}");
+ RebootReason::InvalidDiceHandover
+ })?;
+ let is_debug_mode = dice_chain_info.is_debug_mode();
+ let cose_alg = dice_chain_info.leaf_subject_pubkey().cose_alg;
+ trace!("DICE chain leaf subject public key algorithm: {:?}", cose_alg);
+
+ let dice_context = DiceContext {
+ authority_algorithm: cose_alg.try_into().map_err(|e| {
+ error!("{e}");
+ RebootReason::InternalError
+ })?,
+ subject_algorithm: VM_KEY_ALGORITHM,
+ };
+
+ let cdi_seal = dice_handover.cdi_seal().to_vec();
+
+ let bytes_for_next = if cfg!(dice_changes) {
+ Cow::Borrowed(bytes)
+ } else {
+ // It is possible that the DICE chain we were given is rooted in the UDS. We do not want to
+ // give such a chain to the payload, or even the associated CDIs. So remove the
+ // entire chain we were given and taint the CDIs. Note that the resulting CDIs are
+ // still deterministically derived from those we received, so will vary iff they do.
+ // TODO(b/280405545): Remove this post Android 14.
+ let truncated_bytes = dice::chain::truncate(dice_handover).map_err(|e| {
+ error!("{e}");
+ RebootReason::InternalError
+ })?;
+ Cow::Owned(truncated_bytes)
+ };
+
+ Ok((Some((bytes_for_next, cdi_seal, dice_context)), is_debug_mode))
+}
+
+fn perform_dice_derivation<'a>(
+ dice_handover_bytes: &[u8],
+ dice_context: DiceContext,
+ dice_inputs: PartialInputs,
+ salt: &[u8; HIDDEN_SIZE],
+ defer_rollback_protection: bool,
+ next_handover_size: usize,
+ next_handover_align: usize,
+) -> Result<&'a [u8], RebootReason> {
+ let next_dice_handover = heap::aligned_boxed_slice(next_handover_size, next_handover_align)
+ .ok_or_else(|| {
+ error!("Failed to allocate the next-stage DICE handover");
+ RebootReason::InternalError
+ })?;
+ // By leaking the slice, its content will be left behind for the next stage.
+ let next_dice_handover = Box::leak(next_dice_handover);
+
+ dice_inputs
+ .write_next_handover(
+ dice_handover_bytes.as_ref(),
+ salt,
+ defer_rollback_protection,
+ next_dice_handover,
+ dice_context,
+ )
+ .map_err(|e| {
+ error!("Failed to derive next-stage DICE secrets: {e:?}");
+ RebootReason::SecretDerivationError
+ })?;
+ flush(next_dice_handover);
+ Ok(next_dice_handover)
+}
+
+fn perform_verified_boot<'a>(
+ signed_kernel: &[u8],
+ ramdisk: Option<&[u8]>,
+) -> Result<(VerifiedBootData<'a>, bool, usize), RebootReason> {
+ let verified_boot_data = verify_payload(signed_kernel, ramdisk, PUBLIC_KEY).map_err(|e| {
+ error!("Failed to verify the payload: {e}");
+ RebootReason::PayloadVerificationError
+ })?;
+ let debuggable = verified_boot_data.debug_level != DebugLevel::None;
+ if debuggable {
+ info!("Successfully verified a debuggable payload.");
+ info!("Please disregard any previous libavb ERROR about initrd_normal.");
+ }
+ let guest_page_size = verified_boot_data.page_size.unwrap_or(SIZE_4KB);
+
+ Ok((verified_boot_data, debuggable, guest_page_size))
}
// Get the "salt" which is one of the input for DICE derivation.
diff --git a/guest/pvmfw/src/memory.rs b/guest/pvmfw/src/memory.rs
index a663008..8af5aae 100644
--- a/guest/pvmfw/src/memory.rs
+++ b/guest/pvmfw/src/memory.rs
@@ -31,7 +31,7 @@
pub fdt: &'a mut libfdt::Fdt,
pub kernel: &'a [u8],
pub ramdisk: Option<&'a [u8]>,
- pub dice_chain: Option<&'a [u8]>,
+ pub dice_handover: Option<&'a [u8]>,
}
impl<'a> MemorySlices<'a> {
@@ -112,12 +112,12 @@
None
};
- let dice_chain = None;
+ let dice_handover = None;
- Ok(Self { fdt: untrusted_fdt, kernel, ramdisk, dice_chain })
+ Ok(Self { fdt: untrusted_fdt, kernel, ramdisk, dice_handover })
}
- pub fn add_dice_chain(&mut self, dice_chain: &'a [u8]) {
- self.dice_chain = Some(dice_chain)
+ pub fn add_dice_handover(&mut self, slice: &'a [u8]) {
+ self.dice_handover = Some(slice)
}
}
diff --git a/guest/pvmfw/src/rollback.rs b/guest/pvmfw/src/rollback.rs
index e51b6d5..c2848a2 100644
--- a/guest/pvmfw/src/rollback.rs
+++ b/guest/pvmfw/src/rollback.rs
@@ -42,8 +42,8 @@
verified_boot_data: &VerifiedBootData,
dice_inputs: &PartialInputs,
cdi_seal: &[u8],
- instance_hash: Option<Hidden>,
) -> Result<(bool, Hidden, bool), RebootReason> {
+ let instance_hash = dice_inputs.instance_hash;
if let Some(fixed) = get_fixed_rollback_protection(verified_boot_data) {
// Prevent attackers from impersonating well-known images.
perform_fixed_index_rollback_protection(verified_boot_data, fixed)?;
diff --git a/guest/rialto/Android.bp b/guest/rialto/Android.bp
index d76a48a..8da3889 100644
--- a/guest/rialto/Android.bp
+++ b/guest/rialto/Android.bp
@@ -69,8 +69,8 @@
// Both SERVICE_VM_VERSION and SERVICE_VM_VERSION_STRING should represent the
// same version number for the service VM.
-SERVICE_VM_VERSION = 1
-SERVICE_VM_VERSION_STRING = "1"
+SERVICE_VM_VERSION = 2
+SERVICE_VM_VERSION_STRING = "2"
genrule {
name: "service_vm_version_rs",
diff --git a/libs/dice/open_dice/Android.bp b/libs/dice/open_dice/Android.bp
index 739f245..9e4544d 100644
--- a/libs/dice/open_dice/Android.bp
+++ b/libs/dice/open_dice/Android.bp
@@ -61,6 +61,7 @@
"//apex_available:platform",
"com.android.virt",
],
+ min_sdk_version: "35",
}
rust_library {
@@ -88,6 +89,7 @@
"//apex_available:platform",
"com.android.virt",
],
+ min_sdk_version: "35",
}
rust_defaults {
@@ -210,6 +212,7 @@
],
whole_static_libs: ["libopen_dice_cbor"],
shared_libs: ["libcrypto"],
+ min_sdk_version: "35",
}
rust_bindgen {
@@ -224,6 +227,7 @@
],
whole_static_libs: ["libopen_dice_cbor_multialg"],
shared_libs: ["libcrypto"],
+ min_sdk_version: "35",
}
rust_bindgen {
@@ -281,6 +285,7 @@
"libopen_dice_cbor_bindgen",
],
whole_static_libs: ["libopen_dice_android"],
+ min_sdk_version: "35",
}
rust_bindgen {
@@ -293,6 +298,7 @@
"libopen_dice_cbor_bindgen_multialg",
],
whole_static_libs: ["libopen_dice_android_multialg"],
+ min_sdk_version: "35",
}
rust_bindgen {
diff --git a/libs/framework-virtualization/src/android/system/virtualmachine/VirtualMachine.java b/libs/framework-virtualization/src/android/system/virtualmachine/VirtualMachine.java
index 9641882..3a1fc7a 100644
--- a/libs/framework-virtualization/src/android/system/virtualmachine/VirtualMachine.java
+++ b/libs/framework-virtualization/src/android/system/virtualmachine/VirtualMachine.java
@@ -758,7 +758,7 @@
try {
status = stateToStatus(virtualMachine.getState());
} catch (RemoteException e) {
- throw e.rethrowAsRuntimeException();
+ status = STATUS_STOPPED;
}
}
if (status == STATUS_STOPPED && !mVmRootPath.exists()) {
@@ -1890,9 +1890,7 @@
mVirtualMachine.stop();
dropVm();
}
- } catch (RemoteException e) {
- throw e.rethrowAsRuntimeException();
- } catch (ServiceSpecificException e) {
+ } catch (RemoteException | ServiceSpecificException e) {
// Deliberately ignored; this almost certainly means the VM exited just as
// we tried to stop it.
Log.i(TAG, "Ignoring error on close()", e);
diff --git a/tests/old_images_avf_test/src/main.rs b/tests/old_images_avf_test/src/main.rs
index 018a80e..b72c706 100644
--- a/tests/old_images_avf_test/src/main.rs
+++ b/tests/old_images_avf_test/src/main.rs
@@ -173,20 +173,6 @@
}
#[test]
-fn test_run_rialto_protected() -> Result<()> {
- if hypervisor_props::is_protected_vm_supported()? {
- run_vm(
- "/data/local/tmp/rialto.bin", /* image_path */
- c"test_rialto", /* test_name */
- true, /* protected_vm */
- )
- } else {
- info!("pVMs are not supported on device. skipping test");
- Ok(())
- }
-}
-
-#[test]
fn test_run_rialto_non_protected() -> Result<()> {
if hypervisor_props::is_vm_supported()? {
run_vm(
@@ -201,20 +187,6 @@
}
#[test]
-fn test_run_android16_rialto_protected() -> Result<()> {
- if hypervisor_props::is_protected_vm_supported()? {
- run_vm(
- "/data/local/tmp/android16_rialto.bin", /* image_path */
- c"android16_test_rialto", /* test_name */
- true, /* protected_vm */
- )
- } else {
- info!("pVMs are not supported on device. skipping test");
- Ok(())
- }
-}
-
-#[test]
fn test_run_android16_rialto_non_protected() -> Result<()> {
if hypervisor_props::is_vm_supported()? {
run_vm(
diff --git a/tests/pvmfw/Android.bp b/tests/pvmfw/Android.bp
index 7f5f2af..f7a8aed 100644
--- a/tests/pvmfw/Android.bp
+++ b/tests/pvmfw/Android.bp
@@ -63,6 +63,6 @@
filegroup {
name: "test_avf_bcc_dat",
srcs: [
- "assets/bcc.dat",
+ "assets/dice.dat",
],
}
diff --git a/tests/pvmfw/assets/bcc.dat b/tests/pvmfw/assets/bcc.dat
new file mode 120000
index 0000000..0bf1fec
--- /dev/null
+++ b/tests/pvmfw/assets/bcc.dat
@@ -0,0 +1 @@
+dice.dat
\ No newline at end of file
diff --git a/tests/pvmfw/assets/bcc.dat b/tests/pvmfw/assets/dice.dat
similarity index 100%
rename from tests/pvmfw/assets/bcc.dat
rename to tests/pvmfw/assets/dice.dat
Binary files differ
diff --git a/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java b/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java
index 296604b..1e9efae 100644
--- a/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java
+++ b/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java
@@ -40,7 +40,7 @@
/** Base class for testing custom pvmfw */
public class CustomPvmfwHostTestCaseBase extends MicrodroidHostTestCaseBase {
@NonNull public static final String PVMFW_FILE_NAME = "pvmfw_test.bin";
- @NonNull public static final String BCC_FILE_NAME = "bcc.dat";
+ @NonNull public static final String BCC_FILE_NAME = "dice.dat";
@NonNull public static final String PACKAGE_FILE_NAME = "MicrodroidTestApp.apk";
@NonNull public static final String PACKAGE_NAME = "com.android.microdroid.test";
@NonNull public static final String MICRODROID_DEBUG_FULL = "full";
diff --git a/tests/pvmfw/tools/PvmfwTool.java b/tests/pvmfw/tools/PvmfwTool.java
index 9f0cb42..5df0b48 100644
--- a/tests/pvmfw/tools/PvmfwTool.java
+++ b/tests/pvmfw/tools/PvmfwTool.java
@@ -28,7 +28,7 @@
System.out.println(" Requires BCC. VM Reference DT, VM DTBO, and Debug policy");
System.out.println(" can optionally be specified");
System.out.println(
- "Usage: pvmfw-tool <out> <pvmfw.bin> <bcc.dat> [VM reference DT] [VM DTBO] [debug"
+ "Usage: pvmfw-tool <out> <pvmfw.bin> <dice.dat> [VM reference DT] [VM DTBO] [debug"
+ " policy]");
}