Flag guard the code related to the vendor modules feature
The feature is guarded by the RELEASE_AVF_ENABLE_VENDOR_MODULES flag. On
the virtmgr side the flag-guard check is done in the create_vm_internal
function. On the vm binary side the related flags (--vendor, --kernel)
are only enabled if the RELEASE_AVF_ENABLE_VENDOR_MODULES flag is
enabled.
Additionally the vendor modules related tests in MicrodroidTests now run
conditionally depending on the result of the
`isFeatureEnabled(FEATURE_VENDOR_MODULES)` call.
Bug: 298007909
Test: atest MicrodroidTests
Change-Id: I1467194c802720601a10d0a760a8f1d7ce134037
diff --git a/virtualizationmanager/src/aidl.rs b/virtualizationmanager/src/aidl.rs
index 1ddf129..62fa09d 100644
--- a/virtualizationmanager/src/aidl.rs
+++ b/virtualizationmanager/src/aidl.rs
@@ -35,6 +35,7 @@
IVirtualMachineCallback::IVirtualMachineCallback,
IVirtualizationService::IVirtualizationService,
IVirtualizationService::FEATURE_PAYLOAD_NON_ROOT,
+ IVirtualizationService::FEATURE_VENDOR_MODULES,
MemoryTrimLevel::MemoryTrimLevel,
Partition::Partition,
PartitionType::PartitionType,
@@ -274,6 +275,7 @@
// TODO(b/298012279): make this scalable.
match feature {
FEATURE_PAYLOAD_NON_ROOT => Ok(cfg!(payload_not_root)),
+ FEATURE_VENDOR_MODULES => Ok(cfg!(vendor_modules)),
_ => {
warn!("unknown feature {}", feature);
Ok(false)
@@ -326,6 +328,8 @@
let requester_uid = get_calling_uid();
let requester_debug_pid = get_calling_pid();
+ check_config_features(config)?;
+
// Allocating VM context checks the MANAGE_VIRTUAL_MACHINE permission.
let (vm_context, cid, temporary_directory) = self.create_vm_context(requester_debug_pid)?;
@@ -1100,6 +1104,24 @@
}
}
+fn check_no_vendor_modules(config: &VirtualMachineConfig) -> binder::Result<()> {
+ let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
+ if let Some(custom_config) = &config.customConfig {
+ if custom_config.vendorImage.is_some() || custom_config.customKernelImage.is_some() {
+ return Err(anyhow!("vendor modules feature is disabled"))
+ .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
+ }
+ }
+ Ok(())
+}
+
+fn check_config_features(config: &VirtualMachineConfig) -> binder::Result<()> {
+ if !cfg!(vendor_modules) {
+ check_no_vendor_modules(config)?;
+ }
+ Ok(())
+}
+
fn clone_or_prepare_logger_fd(
debug_config: &DebugConfig,
fd: Option<&ParcelFileDescriptor>,