Merge "pvmfw: Clean pre-populated pvIOMMUs when unused" into main
diff --git a/avf_flags.aconfig b/avf_flags.aconfig
index 8abb9ee..589d227 100644
--- a/avf_flags.aconfig
+++ b/avf_flags.aconfig
@@ -2,6 +2,7 @@
flag {
name: "avf_v_test_apis"
+ is_exported: true
namespace: "virtualization"
description: "Only purpose of this flag is to be used in @FlaggedApi in our V test apis"
bug: "325441024"
diff --git a/service_vm/requests/src/rkp.rs b/service_vm/requests/src/rkp.rs
index 569ab01..08ee08e 100644
--- a/service_vm/requests/src/rkp.rs
+++ b/service_vm/requests/src/rkp.rs
@@ -21,7 +21,10 @@
use alloc::vec;
use alloc::vec::Vec;
use bssl_avf::EcKey;
-use ciborium::{cbor, value::Value};
+use ciborium::{
+ cbor,
+ value::{CanonicalValue, Value},
+};
use core::result;
use coset::{iana, AsCborValue, CoseSign1, CoseSign1Builder, HeaderBuilder};
use diced_open_dice::{derive_cdi_leaf_priv, kdf, sign, DiceArtifacts, PrivateKey};
@@ -106,18 +109,24 @@
/// Generates the device info required by the RKP server as a temporary placeholder.
/// More details in b/301592917.
-fn device_info() -> Value {
- cbor!({"brand" => "aosp-avf",
- "manufacturer" => "aosp-avf",
- "product" => "avf",
- "model" => "avf",
- "device" => "avf",
- "vbmeta_digest" => Value::Bytes(vec![0u8; 0]),
- "system_patch_level" => 202402,
- "boot_patch_level" => 20240202,
- "vendor_patch_level" => 20240202,
- "fused" => 1})
+///
+/// The keys of the map should be in the length-first core deterministic encoding order
+/// as per RFC8949.
+fn device_info() -> CanonicalValue {
+ cbor!({
+ "brand" => "aosp-avf",
+ "fused" => 1,
+ "model" => "avf",
+ "device" => "avf",
+ "product" => "avf",
+ "manufacturer" => "aosp-avf",
+ "vbmeta_digest" => Value::Bytes(vec![0u8; 0]),
+ "boot_patch_level" => 20240202,
+ "system_patch_level" => 202402,
+ "vendor_patch_level" => 20240202,
+ })
.unwrap()
+ .into()
}
fn derive_hmac_key(dice_artifacts: &dyn DiceArtifacts) -> Result<Zeroizing<[u8; HMAC_KEY_LENGTH]>> {
@@ -153,3 +162,25 @@
})?
.to_vec())
}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ /// The keys of device info map should be in the length-first core deterministic encoding
+ /// order as per RFC8949.
+ /// The CBOR ordering rules are:
+ /// 1. If two keys have different lengths, the shorter one sorts earlier;
+ /// 2. If two keys have the same length, the one with the lower value in
+ /// (bytewise) lexical order sorts earlier.
+ #[test]
+ fn device_info_is_in_length_first_deterministic_order() {
+ let device_info = cbor!(device_info()).unwrap();
+ let device_info_map = device_info.as_map().unwrap();
+ let device_info_keys: Vec<&str> =
+ device_info_map.iter().map(|k| k.0.as_text().unwrap()).collect();
+ let mut sorted_keys = device_info_keys.clone();
+ sorted_keys.sort_by(|a, b| a.len().cmp(&b.len()).then(a.cmp(b)));
+ assert_eq!(device_info_keys, sorted_keys);
+ }
+}
diff --git a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
index 4f502ab..6dd3afe 100644
--- a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
+++ b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
@@ -793,12 +793,11 @@
assertWithMessage("Incorrect ABI list").that(abis).hasLength(1);
// Check that no denials have happened so far
+ String logText =
+ getDevice().pullFileContents(CONSOLE_PATH) + getDevice().pullFileContents(LOG_PATH);
assertWithMessage("Unexpected denials during VM boot")
- .that(android.tryRun("egrep", "'avc:[[:space:]]{1,2}denied'", LOG_PATH))
- .isNull();
- assertWithMessage("Unexpected denials during VM boot")
- .that(android.tryRun("egrep", "'avc:[[:space:]]{1,2}denied'", CONSOLE_PATH))
- .isNull();
+ .that(logText)
+ .doesNotContainMatch("avc:\s+denied");
assertThat(getDeviceNumCpus(microdroid)).isEqualTo(getDeviceNumCpus(android));
diff --git a/virtualizationmanager/src/aidl.rs b/virtualizationmanager/src/aidl.rs
index ea3a481..278365c 100644
--- a/virtualizationmanager/src/aidl.rs
+++ b/virtualizationmanager/src/aidl.rs
@@ -49,7 +49,7 @@
use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{
BnVirtualMachineService, IVirtualMachineService,
};
-use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::ISecretkeeper::{BnSecretkeeper, ISecretkeeper};
+use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::ISecretkeeper::ISecretkeeper;
use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::SecretId::SecretId;
use android_hardware_security_authgraph::aidl::android::hardware::security::authgraph::{
Arc::Arc as AuthgraphArc, IAuthGraphKeyExchange::IAuthGraphKeyExchange,
@@ -1506,12 +1506,10 @@
}
fn getSecretkeeper(&self) -> binder::Result<Option<Strong<dyn ISecretkeeper>>> {
- let sk = if is_secretkeeper_supported() {
- Some(binder::wait_for_interface(SECRETKEEPER_IDENTIFIER)?)
- } else {
- None
- };
- Ok(sk.map(|s| BnSecretkeeper::new_binder(SecretkeeperProxy(s), BinderFeatures::default())))
+ // TODO(b/327526008): Session establishment wth secretkeeper is failing.
+ // Re-enable this when fixed.
+ let _sk_supported = is_secretkeeper_supported();
+ Ok(None)
}
fn requestAttestation(&self, csr: &[u8], test_mode: bool) -> binder::Result<Vec<Certificate>> {