Merge changes from topic "prepare-for-system-tee-services" into main
* changes:
Only allow pVMs to request access to tee services
virtmgr: also support non-vendor tee services
diff --git a/android/virtmgr/src/aidl.rs b/android/virtmgr/src/aidl.rs
index 28f36fd..3c5408c 100644
--- a/android/virtmgr/src/aidl.rs
+++ b/android/virtmgr/src/aidl.rs
@@ -151,6 +151,17 @@
}
});
+// TODO(ioffe): add service for guest-ffa.
+const KNOWN_TEE_SERVICES: [&str; 0] = [];
+
+fn check_known_tee_service(tee_service: &str) -> binder::Result<()> {
+ if !KNOWN_TEE_SERVICES.contains(&tee_service) {
+ return Err(anyhow!("unknown tee_service {tee_service}"))
+ .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
+ }
+ Ok(())
+}
+
fn create_or_update_idsig_file(
input_fd: &ParcelFileDescriptor,
idsig_fd: &ParcelFileDescriptor,
@@ -716,11 +727,38 @@
*is_protected = config.protectedVm;
if !config.teeServices.is_empty() {
+ if !config.protectedVm {
+ return Err(anyhow!("only protected VMs can request tee services"))
+ .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
+ }
check_tee_service_permission(&caller_secontext, &config.teeServices)
.with_log()
.or_binder_exception(ExceptionCode::SECURITY)?;
}
+ let mut system_tee_services = Vec::new();
+ let mut vendor_tee_services = Vec::new();
+ for tee_service in config.teeServices.clone() {
+ if !tee_service.starts_with("vendor.") {
+ check_known_tee_service(&tee_service)?;
+ system_tee_services.push(tee_service);
+ } else {
+ vendor_tee_services.push(tee_service);
+ }
+ }
+
+ // TODO(b/391774181): handle vendor tee services (which require talking to HAL) as well.
+ if !vendor_tee_services.is_empty() {
+ return Err(anyhow!("support for vendor tee services is coming soon!"))
+ .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
+ }
+
+ // TODO(b/391774181): remove this check in a follow-up patch.
+ if !system_tee_services.is_empty() {
+ return Err(anyhow!("support for system tee services is coming soon!"))
+ .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
+ }
+
let kernel = maybe_clone_file(&config.kernel)?;
let initrd = maybe_clone_file(&config.initrd)?;