Merge "Prevent removing instance when changing DebugLevel" into main
diff --git a/docs/vm_remote_attestation.md b/docs/vm_remote_attestation.md
index 093418b..ddb7adf 100644
--- a/docs/vm_remote_attestation.md
+++ b/docs/vm_remote_attestation.md
@@ -1,3 +1,98 @@
# VM Remote Attestation
-(To be filled)
+## Introduction
+
+In today's digital landscape, where security threats are ever-evolving, ensuring
+the authenticity and integrity of VMs is paramount. This is particularly crucial
+for sensitive applications, such as those running machine learning models, where
+guaranteeing a trusted and secure execution environment is essential.
+
+VM remote attestation provides a powerful mechanism for *protected VMs* (pVMs)
+to prove their trustworthiness to a third party. This process allows a pVM to
+demonstrate that:
+
+- All its components, including firmware, operating system, and software, are
+ valid and have not been tampered with.
+- It is running on a valid device trusted by the
+ [Remote Key Provisioning][rkp] (RKP) backend, such as Google.
+
+[rkp]: https://source.android.com/docs/core/ota/modular-system/remote-key-provisioning
+
+## Design
+
+The process of pVM remote attestation involves the use of a lightweight
+intermediate VM known as the [RKP VM][rkpvm]. It allows us to divide the
+attestation process into two parts:
+
+1. Attesting the RKP VM against the RKP server.
+2. Attesting the pVM against the RKP VM.
+
+[rkpvm]: https://android.googlesource.com/platform/packages/modules/Virtualization/+/main/service_vm/README.md
+
+### RKP VM attestation
+
+The RKP VM is recognized and attested by the RKP server, which acts as a trusted
+entity responsible for verifying the [DICE chain][open-dice] of the RKP VM. This
+verification ensures that the RKP VM is operating on a genuine device.
+Additionally, the RKP VM is validated by the pVM Firmware, as part of the
+verified boot process.
+
+[open-dice]: https://android.googlesource.com/platform/external/open-dice/+/main/docs/android.md
+
+### pVM attestation
+
+Once the RKP VM is successfully attested, it acts as a trusted platform to
+attest pVMs. Leveraging its trusted status, the RKP VM validates the integrity
+of each pVM's DICE chain by comparing it against its own DICE chain. This
+validation process ensures that the pVMs are running in the expected VM
+environment and certifies the payload executed within each pVM. Currently, only
+Microdroid VMs are supported.
+
+## API
+
+To request remote attestation of a pVM, the [VM Payload API][api]
+`AVmPayload_requestAttestation(challenge)` can be invoked within the pVM
+payload.
+
+For detailed information and usage examples, please refer to the
+[demo app][demo].
+
+[api]: https://android.googlesource.com/platform/packages/modules/Virtualization/+/main/vm_payload/README.md
+[demo]: https://android.googlesource.com/platform/packages/modules/Virtualization/+/main/service_vm/demo_apk
+
+## Output
+
+Upon successful completion of the attestation process, a pVM receives an
+RKP-backed certificate chain and an attested private key that is exclusively
+known to the pVM. This certificate chain includes a leaf certificate covering
+the attested public key. Notably, the leaf certificate features a new extension
+with the OID `1.3.6.1.4.1.11129.2.1.29.1`, specifically designed to describe the
+pVM payload for third-party verification.
+
+The extension format is as follows:
+
+```
+AttestationExtension ::= SEQUENCE {
+ attestationChallenge OCTET_STRING,
+ isVmSecure BOOLEAN,
+ vmComponents SEQUENCE OF VmComponent,
+}
+
+VmComponent ::= SEQUENCE {
+ name UTF8String,
+ securityVersion INTEGER,
+ codeHash OCTET STRING,
+ authorityHash OCTET STRING,
+}
+```
+
+In `AttestationExtension`:
+
+- The `attestationChallenge` field represents a challenge provided by the
+ third party. It is passed to `AVmPayload_requestAttestation()` to ensure
+ the freshness of the certificate.
+- The `isVmSecure` field indicates whether the attested pVM is secure. It is
+ set to true only when all the DICE certificates in the pVM DICE chain are in
+ normal mode.
+- The `vmComponents` field contains a list of all the APKs and apexes loaded
+ by the pVM.
diff --git a/java/framework/README.md b/java/framework/README.md
index bbcd0ef..61ba096 100644
--- a/java/framework/README.md
+++ b/java/framework/README.md
@@ -11,13 +11,17 @@
The API classes are all in the
[`android.system.virtualmachine`](src/android/system/virtualmachine) package.
-Note that these APIs are all `@SystemApi` and require the restricted
-`android.permission.MANAGE_VIRTUAL_MACHINE` permission, so they are not
-available to third party apps.
-
All of these APIs were introduced in API level 34 (Android 14). The classes may
not exist in devices running an earlier version.
+Note that they are all `@SystemApi` and require the restricted
+`android.permission.MANAGE_VIRTUAL_MACHINE` permission, so they are not
+available to third party apps. In Android 14 the permission was available only to
+privileged apps; in Android 15 it is available to all preinstalled apps. On both
+versions it can also be granted to other apps via `adb shell pm grant` for
+development purposes.
+
+
## Detecting AVF Support
The simplest way to detect whether a device has support for AVF is to retrieve
diff --git a/java/framework/src/android/system/virtualmachine/VirtualMachine.java b/java/framework/src/android/system/virtualmachine/VirtualMachine.java
index d746c7c..cc126eb 100644
--- a/java/framework/src/android/system/virtualmachine/VirtualMachine.java
+++ b/java/framework/src/android/system/virtualmachine/VirtualMachine.java
@@ -431,11 +431,6 @@
VirtualMachineConfig config = VirtualMachineConfig.from(vmDescriptor.getConfigFd());
vm = new VirtualMachine(context, name, config, VirtualizationService.getInstance());
config.serialize(vm.mConfigFilePath);
- if (vm.mInstanceIdPath != null) {
- vm.importInstanceIdFrom(vmDescriptor.getInstanceIdFd());
- vm.claimInstance();
- }
-
try {
vm.mInstanceFilePath.createNewFile();
} catch (IOException e) {
@@ -452,12 +447,16 @@
}
vm.importEncryptedStoreFrom(vmDescriptor.getEncryptedStoreFd());
}
+ if (vm.mInstanceIdPath != null) {
+ vm.importInstanceIdFrom(vmDescriptor.getInstanceIdFd());
+ vm.claimInstance();
+ }
}
return vm;
} catch (VirtualMachineException | RuntimeException e) {
// If anything goes wrong, delete any files created so far and the VM's directory
try {
- vmInstanceCleanup(context, name);
+ deleteRecursively(vmDir);
} catch (Exception innerException) {
e.addSuppressed(innerException);
}
diff --git a/java/framework/src/android/system/virtualmachine/VirtualMachineConfig.java b/java/framework/src/android/system/virtualmachine/VirtualMachineConfig.java
index be80db8..a8f318c 100644
--- a/java/framework/src/android/system/virtualmachine/VirtualMachineConfig.java
+++ b/java/framework/src/android/system/virtualmachine/VirtualMachineConfig.java
@@ -641,6 +641,10 @@
config.disks[i].partitions = new Partition[0];
}
+ config.displayConfig =
+ Optional.ofNullable(customImageConfig.getDisplayConfig())
+ .map(dc -> dc.toParcelable())
+ .orElse(null);
config.protectedVm = this.mProtectedVm;
config.memoryMib = bytesToMebiBytes(mMemoryBytes);
config.cpuTopology = (byte) this.mCpuTopology;
diff --git a/java/framework/src/android/system/virtualmachine/VirtualMachineCustomImageConfig.java b/java/framework/src/android/system/virtualmachine/VirtualMachineCustomImageConfig.java
index 7a4f564..89df1f2 100644
--- a/java/framework/src/android/system/virtualmachine/VirtualMachineCustomImageConfig.java
+++ b/java/framework/src/android/system/virtualmachine/VirtualMachineCustomImageConfig.java
@@ -22,6 +22,7 @@
import java.util.ArrayList;
import java.util.List;
+import java.util.Optional;
/** @hide */
public class VirtualMachineCustomImageConfig {
@@ -32,12 +33,15 @@
private static final String KEY_PARAMS = "params";
private static final String KEY_DISK_WRITABLES = "disk_writables";
private static final String KEY_DISK_IMAGES = "disk_images";
+ private static final String KEY_DISPLAY_CONFIG = "display_config";
+
@Nullable private final String name;
@NonNull private final String kernelPath;
@Nullable private final String initrdPath;
@Nullable private final String bootloaderPath;
@Nullable private final String[] params;
@Nullable private final Disk[] disks;
+ @Nullable private final DisplayConfig displayConfig;
@Nullable
public Disk[] getDisks() {
@@ -76,13 +80,15 @@
String initrdPath,
String bootloaderPath,
String[] params,
- Disk[] disks) {
+ Disk[] disks,
+ DisplayConfig displayConfig) {
this.name = name;
this.kernelPath = kernelPath;
this.initrdPath = initrdPath;
this.bootloaderPath = bootloaderPath;
this.params = params;
this.disks = disks;
+ this.displayConfig = displayConfig;
}
static VirtualMachineCustomImageConfig from(PersistableBundle customImageConfigBundle) {
@@ -107,9 +113,15 @@
}
}
}
+ PersistableBundle displayConfigPb =
+ customImageConfigBundle.getPersistableBundle(KEY_DISPLAY_CONFIG);
+ builder.setDisplayConfig(DisplayConfig.from(displayConfigPb));
+
return builder.build();
}
+
+
PersistableBundle toPersistableBundle() {
PersistableBundle pb = new PersistableBundle();
pb.putString(KEY_NAME, this.name);
@@ -128,9 +140,19 @@
pb.putBooleanArray(KEY_DISK_WRITABLES, writables);
pb.putStringArray(KEY_DISK_IMAGES, images);
}
+ pb.putPersistableBundle(
+ KEY_DISPLAY_CONFIG,
+ Optional.ofNullable(displayConfig)
+ .map(dc -> dc.toPersistableBundle())
+ .orElse(null));
return pb;
}
+ @Nullable
+ public DisplayConfig getDisplayConfig() {
+ return displayConfig;
+ }
+
/** @hide */
public static final class Disk {
private final boolean writable;
@@ -170,6 +192,7 @@
private String bootloaderPath;
private List<String> params = new ArrayList<>();
private List<Disk> disks = new ArrayList<>();
+ private DisplayConfig displayConfig;
/** @hide */
public Builder() {}
@@ -211,6 +234,12 @@
}
/** @hide */
+ public Builder setDisplayConfig(DisplayConfig displayConfig) {
+ this.displayConfig = displayConfig;
+ return this;
+ }
+
+ /** @hide */
public VirtualMachineCustomImageConfig build() {
return new VirtualMachineCustomImageConfig(
this.name,
@@ -218,7 +247,142 @@
this.initrdPath,
this.bootloaderPath,
this.params.toArray(new String[0]),
- this.disks.toArray(new Disk[0]));
+ this.disks.toArray(new Disk[0]),
+ displayConfig);
+ }
+ }
+
+ /** @hide */
+ public static final class DisplayConfig {
+ private static final String KEY_WIDTH = "width";
+ private static final String KEY_HEIGHT = "height";
+ private static final String KEY_HORIZONTAL_DPI = "horizontal_dpi";
+ private static final String KEY_VERTICAL_DPI = "vertical_dpi";
+ private static final String KEY_REFRESH_RATE = "refresh_rate";
+ private final int width;
+ private final int height;
+ private final int horizontalDpi;
+ private final int verticalDpi;
+ private final int refreshRate;
+
+ private DisplayConfig(
+ int width, int height, int horizontalDpi, int verticalDpi, int refreshRate) {
+ this.width = width;
+ this.height = height;
+ this.horizontalDpi = horizontalDpi;
+ this.verticalDpi = verticalDpi;
+ this.refreshRate = refreshRate;
+ }
+
+ /** @hide */
+ public int getWidth() {
+ return width;
+ }
+
+ /** @hide */
+ public int getHeight() {
+ return height;
+ }
+
+ /** @hide */
+ public int getHorizontalDpi() {
+ return horizontalDpi;
+ }
+
+ /** @hide */
+ public int getVerticalDpi() {
+ return verticalDpi;
+ }
+
+ /** @hide */
+ public int getRefreshRate() {
+ return refreshRate;
+ }
+
+ android.system.virtualizationservice.DisplayConfig toParcelable() {
+ android.system.virtualizationservice.DisplayConfig parcelable =
+ new android.system.virtualizationservice.DisplayConfig();
+ parcelable.width = this.width;
+ parcelable.height = this.height;
+ parcelable.horizontalDpi = this.horizontalDpi;
+ parcelable.verticalDpi = this.verticalDpi;
+ parcelable.refreshRate = this.refreshRate;
+
+ return parcelable;
+ }
+
+ private static DisplayConfig from(PersistableBundle pb) {
+ if (pb == null) {
+ return null;
+ }
+ Builder builder = new Builder();
+ builder.setWidth(pb.getInt(KEY_WIDTH));
+ builder.setHeight(pb.getInt(KEY_HEIGHT));
+ builder.setHorizontalDpi(pb.getInt(KEY_HORIZONTAL_DPI));
+ builder.setVerticalDpi(pb.getInt(KEY_VERTICAL_DPI));
+ builder.setRefreshRate(pb.getInt(KEY_REFRESH_RATE));
+ return builder.build();
+ }
+
+ private PersistableBundle toPersistableBundle() {
+ PersistableBundle pb = new PersistableBundle();
+ pb.putInt(KEY_WIDTH, this.width);
+ pb.putInt(KEY_HEIGHT, this.height);
+ pb.putInt(KEY_HORIZONTAL_DPI, this.horizontalDpi);
+ pb.putInt(KEY_VERTICAL_DPI, this.verticalDpi);
+ pb.putInt(KEY_REFRESH_RATE, this.refreshRate);
+ return pb;
+ }
+
+ /** @hide */
+ public static class Builder {
+ // Default values come from external/crosvm/vm_control/src/gpu.rs
+ private int width;
+ private int height;
+ private int horizontalDpi = 320;
+ private int verticalDpi = 320;
+ private int refreshRate = 60;
+
+ /** @hide */
+ public Builder() {}
+
+ /** @hide */
+ public Builder setWidth(int width) {
+ this.width = width;
+ return this;
+ }
+
+ /** @hide */
+ public Builder setHeight(int height) {
+ this.height = height;
+ return this;
+ }
+
+ /** @hide */
+ public Builder setHorizontalDpi(int horizontalDpi) {
+ this.horizontalDpi = horizontalDpi;
+ return this;
+ }
+
+ /** @hide */
+ public Builder setVerticalDpi(int verticalDpi) {
+ this.verticalDpi = verticalDpi;
+ return this;
+ }
+
+ /** @hide */
+ public Builder setRefreshRate(int refreshRate) {
+ this.refreshRate = refreshRate;
+ return this;
+ }
+
+ /** @hide */
+ public DisplayConfig build() {
+ if (this.width == 0 || this.height == 0) {
+ throw new IllegalStateException("width and height must be specified");
+ }
+ return new DisplayConfig(width, height, horizontalDpi, verticalDpi, refreshRate);
+ }
}
}
}
diff --git a/libs/dice/driver/src/lib.rs b/libs/dice/driver/src/lib.rs
index 79edb51..b5c1f12 100644
--- a/libs/dice/driver/src/lib.rs
+++ b/libs/dice/driver/src/lib.rs
@@ -65,6 +65,7 @@
/// Creates a new dice driver from the given driver_path.
pub fn new(driver_path: &Path, is_strict_boot: bool) -> Result<Self> {
+ log::info!("Creating DiceDriver backed by {driver_path:?} driver");
if driver_path.exists() {
log::info!("Using DICE values from driver");
} else if is_strict_boot {
@@ -107,6 +108,7 @@
/// Create a new dice driver that reads dice_artifacts from the given file.
pub fn from_file(file_path: &Path) -> Result<Self> {
+ log::info!("Creating DiceDriver backed by {file_path:?} file");
let file =
fs::File::open(file_path).map_err(|error| Error::new(error).context("open file"))?;
let dice_artifacts = serde_cbor::from_reader(file)
@@ -149,11 +151,18 @@
&input_values,
)
.context("DICE derive from driver")?;
- if let Self::Real { driver_path, .. } = &self {
- // Writing to the device wipes the artifacts. The string is ignored by the driver but
- // included for documentation.
- fs::write(driver_path, "wipe")
- .map_err(|err| Error::new(err).context("Wiping driver"))?;
+ match &self {
+ Self::Real { driver_path, .. } => {
+ // Writing to the device wipes the artifacts. The string is ignored by the driver
+ // but included for documentation.
+ fs::write(driver_path, "wipe")
+ .map_err(|err| Error::new(err).context("Wiping driver"))?;
+ }
+ Self::FromFile { file_path, .. } => {
+ fs::remove_file(file_path)
+ .map_err(|err| Error::new(err).context("Deleting file"))?;
+ }
+ Self::Fake { .. } => (),
}
Ok(next_dice_artifacts)
}
@@ -176,6 +185,11 @@
#[cfg(test)]
mod tests {
use super::*;
+ use core::ffi::CStr;
+ use diced_open_dice::{
+ hash, retry_bcc_format_config_descriptor, DiceConfigValues, HIDDEN_SIZE,
+ };
+ use std::fs::File;
fn assert_eq_bytes(expected: &[u8], actual: &[u8]) {
assert_eq!(
@@ -204,4 +218,34 @@
Ok(())
}
+
+ #[test]
+ fn test_dice_driver_from_file_deletes_file_after_derive() -> Result<()> {
+ let tmp_dir = tempfile::tempdir()?;
+
+ let file_path = tmp_dir.path().join("test-dice-chain.raw");
+
+ {
+ let dice_artifacts = diced_sample_inputs::make_sample_bcc_and_cdis()?;
+ let file = File::create(&file_path)?;
+ serde_cbor::to_writer(file, &dice_artifacts)?;
+ }
+
+ let dice = DiceDriver::from_file(&file_path)?;
+
+ let values = DiceConfigValues {
+ component_name: Some(CStr::from_bytes_with_nul(b"test\0")?),
+ ..Default::default()
+ };
+ let desc = retry_bcc_format_config_descriptor(&values)?;
+ let code_hash = hash(&String::from("test code hash").into_bytes())?;
+ let authority_hash = hash(&String::from("test authority hash").into_bytes())?;
+ let hidden = [0; HIDDEN_SIZE];
+
+ let _ = dice.derive(code_hash, &desc, authority_hash, false, hidden)?;
+
+ assert!(!file_path.exists());
+
+ Ok(())
+ }
}
diff --git a/libs/vbmeta/Android.bp b/libs/vbmeta/Android.bp
index 4fb6ae4..9a7375d 100644
--- a/libs/vbmeta/Android.bp
+++ b/libs/vbmeta/Android.bp
@@ -35,6 +35,8 @@
":avb_testkey_rsa2048",
":avb_testkey_rsa4096",
":avb_testkey_rsa8192",
+ ":test_microdroid_vendor_image",
+ ":test_microdroid_vendor_image_no_rollback_index",
],
required: ["avbtool"],
test_suites: ["general-tests"],
diff --git a/libs/vbmeta/src/lib.rs b/libs/vbmeta/src/lib.rs
index 1a40e45..a15f699 100644
--- a/libs/vbmeta/src/lib.rs
+++ b/libs/vbmeta/src/lib.rs
@@ -148,6 +148,11 @@
Descriptors::from_image(&self.data)
}
+ /// Returns the rollback_index of the VBMeta image.
+ pub fn rollback_index(&self) -> u64 {
+ self.header.rollback_index
+ }
+
/// Get the raw VBMeta image.
pub fn data(&self) -> &[u8] {
&self.data
@@ -283,4 +288,19 @@
fn test_rsa8192_signed_image() -> Result<()> {
signed_image_has_valid_vbmeta("SHA256_RSA8192", "data/testkey_rsa8192.pem")
}
+
+ #[test]
+ fn test_rollback_index() -> Result<()> {
+ let vbmeta = VbMetaImage::verify_path("test_microdroid_vendor_image.img")?;
+ assert_eq!(5, vbmeta.rollback_index());
+ Ok(())
+ }
+
+ #[test]
+ fn test_rollback_index_default_zero() -> Result<()> {
+ let vbmeta =
+ VbMetaImage::verify_path("test_microdroid_vendor_image_no_rollback_index.img")?;
+ assert_eq!(0, vbmeta.rollback_index());
+ Ok(())
+ }
}
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 169ecae..33d98dc 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -55,6 +55,7 @@
properties: [
"deps",
"dirs",
+ "multilib",
],
}
@@ -157,9 +158,11 @@
// Below are dependencies that are conditionally enabled depending on value of build flags.
soong_config_variables: {
release_avf_enable_dice_changes: {
- deps: [
- "derive_microdroid_vendor_dice_node",
- ],
+ multilib: {
+ lib64: {
+ deps: ["derive_microdroid_vendor_dice_node"],
+ },
+ },
dirs: [
"microdroid_resources",
],
diff --git a/microdroid/README.md b/microdroid/README.md
index 6e7b20c..c0cba97 100644
--- a/microdroid/README.md
+++ b/microdroid/README.md
@@ -41,7 +41,7 @@
## Building an app
A [vm
-payload](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/master/vm_payload/)
+payload](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/main/vm_payload/)
is a shared library file that gets executed in microdroid. It is packaged as
part of an Android application. The library should have an entry point
`AVmPayload_main` as shown below:
@@ -132,12 +132,12 @@
### Using the APIs
Use the [Android Virtualization Framework Java
-APIs](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/master/javalib/api/system-current.txt)
-in your app to create a microdroid VM and run payload in it. The APIs currently
-are @SystemApi, thus available only to privileged apps.
+APIs](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/main/java/framework/README.md)
+in your app to create a microdroid VM and run payload in it. The APIs are currently
+@SystemApi, and only available to preinstalled apps.
If you are looking for an example usage of the APIs, you may refer to the [demo
-app](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/master/demo/).
+app](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/main/demo/).
## Running Microdroid with vendor image
diff --git a/microdroid/derive_microdroid_vendor_dice_node/Android.bp b/microdroid/derive_microdroid_vendor_dice_node/Android.bp
index de1bef7..8b79aad 100644
--- a/microdroid/derive_microdroid_vendor_dice_node/Android.bp
+++ b/microdroid/derive_microdroid_vendor_dice_node/Android.bp
@@ -10,9 +10,20 @@
rustlibs: [
"libanyhow",
"libclap",
+ "libcstr",
+ "libdice_driver",
+ "libdiced_open_dice",
+ "libdm_rust",
+ "libserde_cbor",
+ "libvbmeta_rust",
],
bootstrap: true,
prefer_rlib: true,
+ multilib: {
+ lib32: {
+ enabled: false,
+ },
+ },
}
rust_binary {
diff --git a/microdroid/derive_microdroid_vendor_dice_node/src/main.rs b/microdroid/derive_microdroid_vendor_dice_node/src/main.rs
index 1d5db0d..c7bc3f5 100644
--- a/microdroid/derive_microdroid_vendor_dice_node/src/main.rs
+++ b/microdroid/derive_microdroid_vendor_dice_node/src/main.rs
@@ -14,9 +14,19 @@
//! Derives microdroid vendor dice node.
-use anyhow::Error;
+use anyhow::{bail, Context, Result};
use clap::Parser;
-use std::path::PathBuf;
+use cstr::cstr;
+use dice_driver::DiceDriver;
+use diced_open_dice::{
+ hash, retry_bcc_format_config_descriptor, DiceConfigValues, OwnedDiceArtifacts, HIDDEN_SIZE,
+};
+use dm::util::blkgetsize64;
+use std::fs::{read_link, File};
+use std::path::{Path, PathBuf};
+use vbmeta::VbMetaImage;
+
+const AVF_STRICT_BOOT: &str = "/proc/device-tree/chosen/avf,strict-boot";
#[derive(Parser)]
struct Args {
@@ -31,8 +41,74 @@
output: PathBuf,
}
-fn main() -> Result<(), Error> {
+// TODO(ioffe): move to a library to reuse same code here, in microdroid_manager and in
+// first_stage_init.
+fn is_strict_boot() -> bool {
+ Path::new(AVF_STRICT_BOOT).exists()
+}
+
+fn build_descriptor(vbmeta: &VbMetaImage) -> Result<Vec<u8>> {
+ let values = DiceConfigValues {
+ component_name: Some(cstr!("Microdroid vendor")),
+ security_version: Some(vbmeta.rollback_index()),
+ ..Default::default()
+ };
+ Ok(retry_bcc_format_config_descriptor(&values)?)
+}
+
+// TODO(ioffe): move to libvbmeta.
+fn find_root_digest(vbmeta: &VbMetaImage) -> Result<Option<Vec<u8>>> {
+ for descriptor in vbmeta.descriptors()?.iter() {
+ if let vbmeta::Descriptor::Hashtree(_) = descriptor {
+ return Ok(Some(descriptor.to_hashtree()?.root_digest().to_vec()));
+ }
+ }
+ Ok(None)
+}
+
+fn dice_derivation(dice: DiceDriver, vbmeta: &VbMetaImage) -> Result<OwnedDiceArtifacts> {
+ let authority_hash = if let Some(pubkey) = vbmeta.public_key() {
+ hash(pubkey).context("hash pubkey")?
+ } else {
+ bail!("no public key")
+ };
+ let code_hash = if let Some(root_digest) = find_root_digest(vbmeta)? {
+ hash(root_digest.as_ref()).context("hash root_digest")?
+ } else {
+ bail!("no hashtree")
+ };
+ let desc = build_descriptor(vbmeta).context("build descriptor")?;
+ let hidden = [0; HIDDEN_SIZE];
+ // The microdroid vendor partition doesn't contribute to the debuggability of the VM, and it is
+ // a bit tricky to propagate the info on whether the VM is debuggable to
+ // derive_microdroid_dice_node binary. Given these, we just always set `is_debuggable: false`
+ // for the "Microdroid vendor" dice node. The adjacent dice nodes (pvmfw & payload) provide the
+ // accurate information on whether VM is debuggable.
+ dice.derive(code_hash, &desc, authority_hash, /* debug= */ false, hidden)
+}
+
+fn extract_vbmeta(block_dev: &Path) -> Result<VbMetaImage> {
+ let size = blkgetsize64(block_dev).context("blkgetsize64 failed")?;
+ let file = File::open(block_dev).context("open failed")?;
+ let vbmeta = VbMetaImage::verify_reader_region(file, 0, size)?;
+ Ok(vbmeta)
+}
+
+fn try_main() -> Result<()> {
let args = Args::parse();
- eprintln!("{:?} {:?} {:?}", args.dice_driver, args.microdroid_vendor_disk_image, args.output);
+ let dice =
+ DiceDriver::new(&args.dice_driver, is_strict_boot()).context("Failed to load DICE")?;
+ let path = read_link(args.microdroid_vendor_disk_image).context("failed to read symlink")?;
+ let vbmeta = extract_vbmeta(&path).context("failed to extract vbmeta")?;
+ let dice_artifacts = dice_derivation(dice, &vbmeta).context("failed to derive dice chain")?;
+ let file = File::create(&args.output).context("failed to create output")?;
+ serde_cbor::to_writer(file, &dice_artifacts).context("failed to write dice artifacts")?;
Ok(())
}
+
+fn main() {
+ if let Err(e) = try_main() {
+ eprintln!("failed with {:?}", e);
+ std::process::exit(1);
+ }
+}
diff --git a/microdroid/kernel/README.md b/microdroid/kernel/README.md
index 92b7cfe..52df333 100644
--- a/microdroid/kernel/README.md
+++ b/microdroid/kernel/README.md
@@ -29,7 +29,7 @@
```
Note that
-[`--config=fast`](https://android.googlesource.com/kernel/build/+/refs/heads/master/kleaf/docs/fast.md)
+[`--config=fast`](https://android.googlesource.com/kernel/build/+/refs/heads/main/kleaf/docs/fast.md)
is not mandatory, but will make your build much faster.
The build may fail in case you are doing an incremental build and the config has changed (b/257288175). Until that issue
diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index 2386bd4..7da9ea4 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -43,6 +43,7 @@
use log::{error, info};
use microdroid_metadata::{Metadata, PayloadMetadata};
use microdroid_payload_config::{ApkConfig, OsConfig, Task, TaskType, VmPayloadConfig};
+use nix::mount::{umount2, MntFlags};
use nix::sys::signal::Signal;
use payload::load_metadata;
use rpcbinder::RpcSession;
@@ -86,6 +87,8 @@
const ENCRYPTEDSTORE_BACKING_DEVICE: &str = "/dev/block/by-name/encryptedstore";
const ENCRYPTEDSTORE_KEYSIZE: usize = 32;
+const DICE_CHAIN_FILE: &str = "/microdroid_resources/dice_chain.raw";
+
#[derive(thiserror::Error, Debug)]
enum MicrodroidError {
#[error("Cannot connect to virtualization service: {0}")]
@@ -301,8 +304,13 @@
vm_payload_service_fd: OwnedFd,
) -> Result<i32> {
let metadata = load_metadata().context("Failed to load payload metadata")?;
- let dice = DiceDriver::new(Path::new("/dev/open-dice0"), is_strict_boot())
- .context("Failed to load DICE")?;
+ let dice = if Path::new(DICE_CHAIN_FILE).exists() {
+ DiceDriver::from_file(Path::new(DICE_CHAIN_FILE))
+ .context("Failed to load DICE from file")?
+ } else {
+ DiceDriver::new(Path::new("/dev/open-dice0"), is_strict_boot())
+ .context("Failed to load DICE from driver")?
+ };
// Microdroid skips checking payload against instance image iff the device supports
// secretkeeper. In that case Microdroid use VmSecret::V2, which provide protection against
@@ -328,6 +336,10 @@
// Start apexd to activate APEXes. This may allow code within them to run.
system_properties::write("ctl.start", "apexd-vm")?;
+
+ // Unmounting /microdroid_resources is a defence-in-depth effort to ensure that payload
+ // can't get hold of dice chain stored there.
+ umount2("/microdroid_resources", MntFlags::MNT_DETACH)?;
}
// Run encryptedstore binary to prepare the storage
diff --git a/service_vm/README.md b/service_vm/README.md
index 3d94f78..ca03c1d 100644
--- a/service_vm/README.md
+++ b/service_vm/README.md
@@ -18,28 +18,12 @@
## RKP VM (Remote Key Provisioning Virtual Machine)
-The RKP VM is a key dependency of the Service VM. It is a virtual machine that
-undergoes validation by the [RKP][rkp] Server and acts as a remotely provisioned
-component for verifying the integrity of other virtual machines.
+Currently, the Service VM only supports VM remote attestation, and in that
+context we refer to it as the RKP VM. The RKP VM undergoes validation by the
+[RKP][rkp] Server and functions as a remotely provisioned component responsible
+for verifying the integrity of other virtual machines. See
+[VM remote attestation][vm-attestation] for more details about the role of RKP
+VM in remote attestation.
[rkp]: https://source.android.com/docs/core/ota/modular-system/remote-key-provisioning
-
-### RKP VM attestation
-
-The RKP VM is recognized and attested by the RKP server, which acts as a trusted
-entity responsible for verifying the DICE chain of the RKP VM. This verification
-ensures that the RKP VM is operating on a genuine device.
-Additionally, the RKP VM is validated by the pVM Firmware, as part of the
-verified boot process.
-
-### Client VM attestation
-
-Once the RKP VM is successfully attested, it assumes the role of a trusted
-platform to attest client VMs. It leverages its trusted status to validate the
-integrity of the [DICE chain][open-dice] associated with each client VM. This
-validation process verifies that the client VMs are running in the expected
-[Microdroid][microdroid] VM environment, and certifies the payload executed
-within the VM. Currently, only Microdroid VMs are supported.
-
-[open-dice]: https://android.googlesource.com/platform/external/open-dice/+/main/docs/android.md
-[microdroid]: https://android.googlesource.com/platform/packages/modules/Virtualization/+/main/microdroid/README.md
+[vm-attestation]: https://android.googlesource.com/platform/packages/modules/Virtualization/+/main/docs/vm_remote_attestation.md
diff --git a/service_vm/requests/src/cert.rs b/service_vm/requests/src/cert.rs
index 91281e7..e31d870 100644
--- a/service_vm/requests/src/cert.rs
+++ b/service_vm/requests/src/cert.rs
@@ -43,7 +43,7 @@
/// Attestation extension contents
///
/// ```asn1
-/// AttestationDescription ::= SEQUENCE {
+/// AttestationExtension ::= SEQUENCE {
/// attestationChallenge OCTET_STRING,
/// isVmSecure BOOLEAN,
/// vmComponents SEQUENCE OF VmComponent,
diff --git a/tests/vendor_images/Android.bp b/tests/vendor_images/Android.bp
index 26dbc01..66f0219 100644
--- a/tests/vendor_images/Android.bp
+++ b/tests/vendor_images/Android.bp
@@ -15,6 +15,16 @@
file_contexts: ":microdroid_vendor_file_contexts.gen",
use_avb: true,
avb_private_key: ":vendor_sign_key",
+ rollback_index: 5,
+}
+
+android_filesystem {
+ name: "test_microdroid_vendor_image_no_rollback_index",
+ partition_name: "microdroid-vendor",
+ type: "ext4",
+ file_contexts: ":microdroid_vendor_file_contexts.gen",
+ use_avb: true,
+ avb_private_key: ":vendor_sign_key",
}
android_filesystem {
diff --git a/virtualizationmanager/src/aidl.rs b/virtualizationmanager/src/aidl.rs
index b712ed6..279b4ec 100644
--- a/virtualizationmanager/src/aidl.rs
+++ b/virtualizationmanager/src/aidl.rs
@@ -17,7 +17,7 @@
use crate::{get_calling_pid, get_calling_uid};
use crate::atom::{write_vm_booted_stats, write_vm_creation_stats};
use crate::composite::make_composite_image;
-use crate::crosvm::{CrosvmConfig, DiskFile, PayloadState, VmContext, VmInstance, VmState};
+use crate::crosvm::{CrosvmConfig, DiskFile, DisplayConfig, PayloadState, VmContext, VmInstance, VmState};
use crate::debug_config::DebugConfig;
use crate::dt_overlay::{create_device_tree_overlay, VM_DT_OVERLAY_MAX_SIZE, VM_DT_OVERLAY_PATH};
use crate::payload::{add_microdroid_payload_images, add_microdroid_system_images, add_microdroid_vendor_image};
@@ -582,6 +582,13 @@
(vec![], None)
};
+ let display_config = config
+ .displayConfig
+ .as_ref()
+ .map(DisplayConfig::new)
+ .transpose()
+ .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?;
+
// Actually start the VM.
let crosvm_config = CrosvmConfig {
cid,
@@ -607,6 +614,7 @@
vfio_devices,
dtbo,
device_tree_overlay,
+ display_config,
};
let instance = Arc::new(
VmInstance::new(
diff --git a/virtualizationmanager/src/crosvm.rs b/virtualizationmanager/src/crosvm.rs
index 97a27e0..86c9af3 100644
--- a/virtualizationmanager/src/crosvm.rs
+++ b/virtualizationmanager/src/crosvm.rs
@@ -44,7 +44,8 @@
use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::DeathReason::DeathReason;
use android_system_virtualizationservice::aidl::android::system::virtualizationservice::{
MemoryTrimLevel::MemoryTrimLevel,
- VirtualMachineAppConfig::DebugLevel::DebugLevel
+ VirtualMachineAppConfig::DebugLevel::DebugLevel,
+ DisplayConfig::DisplayConfig as DisplayConfigParcelable,
};
use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::IGlobalVmContext::IGlobalVmContext;
use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::IBoundDevice::IBoundDevice;
@@ -118,6 +119,32 @@
pub vfio_devices: Vec<VfioDevice>,
pub dtbo: Option<File>,
pub device_tree_overlay: Option<File>,
+ pub display_config: Option<DisplayConfig>,
+}
+
+#[derive(Debug)]
+pub struct DisplayConfig {
+ pub width: NonZeroU32,
+ pub height: NonZeroU32,
+ pub horizontal_dpi: NonZeroU32,
+ pub vertical_dpi: NonZeroU32,
+ pub refresh_rate: NonZeroU32,
+}
+
+impl DisplayConfig {
+ pub fn new(raw_config: &DisplayConfigParcelable) -> Result<DisplayConfig> {
+ let width = try_into_non_zero_u32(raw_config.width)?;
+ let height = try_into_non_zero_u32(raw_config.height)?;
+ let horizontal_dpi = try_into_non_zero_u32(raw_config.horizontalDpi)?;
+ let vertical_dpi = try_into_non_zero_u32(raw_config.verticalDpi)?;
+ let refresh_rate = try_into_non_zero_u32(raw_config.refreshRate)?;
+ Ok(DisplayConfig { width, height, horizontal_dpi, vertical_dpi, refresh_rate })
+ }
+}
+
+fn try_into_non_zero_u32(value: i32) -> Result<NonZeroU32> {
+ let u32_value = value.try_into()?;
+ NonZeroU32::new(u32_value).ok_or(anyhow!("value should be greater than 0"))
}
/// A disk image to pass to crosvm for a VM.
@@ -415,12 +442,13 @@
/// the VM to prevent indefinite hangup and update the payload_state accordingly.
fn monitor_payload_hangup(&self, child: Arc<SharedChild>) {
debug!("Starting to monitor hangup for Microdroid({})", child.id());
- let (_, result) = self
+ let (state, result) = self
.payload_state_updated
.wait_timeout_while(self.payload_state.lock().unwrap(), *BOOT_HANGUP_TIMEOUT, |s| {
*s < PayloadState::Started
})
.unwrap();
+ drop(state); // we are not interested in state
let child_still_running = child.try_wait().ok() == Some(None);
if result.timed_out() && child_still_running {
error!(
@@ -927,6 +955,13 @@
if let Some(dt_overlay) = &config.device_tree_overlay {
command.arg("--device-tree-overlay").arg(add_preserved_fd(&mut preserved_fds, dt_overlay));
}
+ if let Some(display_config) = &config.display_config {
+ command.arg("--gpu")
+ // TODO(b/331708504): support backend config as well
+ .arg("backend=virglrenderer,context-types=virgl2,egl=true,surfaceless=true,glx=false,gles=true")
+ .arg(format!("--gpu-display=mode=windowed[{},{}],dpi=[{},{}],refresh-rate={}", display_config.width, display_config.height, display_config.horizontal_dpi, display_config.vertical_dpi, display_config.refresh_rate))
+ .arg(format!("--android-display-service={}", config.name));
+ }
append_platform_devices(&mut command, &mut preserved_fds, &config)?;
diff --git a/virtualizationservice/aidl/android/system/virtualizationservice/DisplayConfig.aidl b/virtualizationservice/aidl/android/system/virtualizationservice/DisplayConfig.aidl
new file mode 100644
index 0000000..1fd392b
--- /dev/null
+++ b/virtualizationservice/aidl/android/system/virtualizationservice/DisplayConfig.aidl
@@ -0,0 +1,24 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.system.virtualizationservice;
+
+parcelable DisplayConfig {
+ int width;
+ int height;
+ int horizontalDpi;
+ int verticalDpi;
+ int refreshRate;
+}
diff --git a/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachineRawConfig.aidl b/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachineRawConfig.aidl
index b2116c4..1a18bf8 100644
--- a/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachineRawConfig.aidl
+++ b/virtualizationservice/aidl/android/system/virtualizationservice/VirtualMachineRawConfig.aidl
@@ -17,6 +17,7 @@
import android.system.virtualizationservice.CpuTopology;
import android.system.virtualizationservice.DiskImage;
+import android.system.virtualizationservice.DisplayConfig;
/** Raw configuration for running a VM. */
parcelable VirtualMachineRawConfig {
@@ -70,4 +71,6 @@
/** List of SysFS nodes of devices to be assigned */
String[] devices;
+
+ @nullable DisplayConfig displayConfig;
}
diff --git a/virtualizationservice/src/maintenance.rs b/virtualizationservice/src/maintenance.rs
index f950db9..8efc58d 100644
--- a/virtualizationservice/src/maintenance.rs
+++ b/virtualizationservice/src/maintenance.rs
@@ -40,6 +40,9 @@
/// parcel fits within max AIDL message size.
const DELETE_MAX_BATCH_SIZE: usize = 100;
+/// Maximum number of VM IDs that a single app can have.
+const MAX_VM_IDS_PER_APP: usize = 400;
+
/// State related to VM secrets.
pub struct State {
sk: binder::Strong<dyn ISecretkeeper>,
@@ -101,6 +104,24 @@
pub fn add_id(&mut self, vm_id: &VmId, user_id: u32, app_id: u32) -> Result<()> {
let user_id: i32 = user_id.try_into().context(format!("user_id {user_id} out of range"))?;
let app_id: i32 = app_id.try_into().context(format!("app_id {app_id} out of range"))?;
+
+ // To prevent unbounded growth of VM IDs (and the associated state) for an app, limit the
+ // number of VM IDs per app.
+ let count = self
+ .vm_id_db
+ .count_vm_ids_for_app(user_id, app_id)
+ .context("failed to determine VM count")?;
+ if count >= MAX_VM_IDS_PER_APP {
+ // The owner has too many VM IDs, so delete the oldest IDs so that the new VM ID
+ // creation can progress/succeed.
+ let purge = 1 + count - MAX_VM_IDS_PER_APP;
+ let old_vm_ids = self
+ .vm_id_db
+ .oldest_vm_ids_for_app(user_id, app_id, purge)
+ .context("failed to find oldest VM IDs")?;
+ error!("Deleting {purge} of {count} VM IDs for user_id={user_id}, app_id={app_id}");
+ self.delete_ids(&old_vm_ids);
+ }
self.vm_id_db.add_vm_id(vm_id, user_id, app_id)
}
@@ -396,6 +417,39 @@
assert_eq!(vec![VM_ID5], sk_state.vm_id_db.vm_ids_for_user(USER3).unwrap());
}
+ #[test]
+ fn test_sk_state_too_many_vms() {
+ let history = Arc::new(Mutex::new(Vec::new()));
+ let mut sk_state = new_test_state(history.clone(), 20);
+
+ // Every VM ID added up to the limit is kept.
+ for idx in 0..MAX_VM_IDS_PER_APP {
+ let mut vm_id = [0u8; 64];
+ vm_id[0..8].copy_from_slice(&(idx as u64).to_be_bytes());
+ sk_state.add_id(&vm_id, USER1 as u32, APP_A as u32).unwrap();
+ assert_eq!(idx + 1, sk_state.vm_id_db.count_vm_ids_for_app(USER1, APP_A).unwrap());
+ }
+ assert_eq!(
+ MAX_VM_IDS_PER_APP,
+ sk_state.vm_id_db.count_vm_ids_for_app(USER1, APP_A).unwrap()
+ );
+
+ // Beyond the limit it's one in, one out.
+ for idx in MAX_VM_IDS_PER_APP..MAX_VM_IDS_PER_APP + 10 {
+ let mut vm_id = [0u8; 64];
+ vm_id[0..8].copy_from_slice(&(idx as u64).to_be_bytes());
+ sk_state.add_id(&vm_id, USER1 as u32, APP_A as u32).unwrap();
+ assert_eq!(
+ MAX_VM_IDS_PER_APP,
+ sk_state.vm_id_db.count_vm_ids_for_app(USER1, APP_A).unwrap()
+ );
+ }
+ assert_eq!(
+ MAX_VM_IDS_PER_APP,
+ sk_state.vm_id_db.count_vm_ids_for_app(USER1, APP_A).unwrap()
+ );
+ }
+
struct Irreconcilable;
impl IVirtualizationReconciliationCallback for Irreconcilable {
diff --git a/virtualizationservice/src/maintenance/vmdb.rs b/virtualizationservice/src/maintenance/vmdb.rs
index 47704bc..273f340 100644
--- a/virtualizationservice/src/maintenance/vmdb.rs
+++ b/virtualizationservice/src/maintenance/vmdb.rs
@@ -272,6 +272,34 @@
Ok(vm_ids)
}
+ /// Determine the number of VM IDs associated with `(user_id, app_id)`.
+ pub fn count_vm_ids_for_app(&mut self, user_id: i32, app_id: i32) -> Result<usize> {
+ let mut stmt = self
+ .conn
+ .prepare("SELECT COUNT(vm_id) FROM main.vmids WHERE user_id = ? AND app_id = ?;")
+ .context("failed to prepare SELECT stmt")?;
+ stmt.query_row(params![user_id, app_id], |row| row.get(0)).context("query failed")
+ }
+
+ /// Return the `count` oldest VM IDs associated with `(user_id, app_id)`.
+ pub fn oldest_vm_ids_for_app(
+ &mut self,
+ user_id: i32,
+ app_id: i32,
+ count: usize,
+ ) -> Result<Vec<VmId>> {
+ // SQLite considers NULL columns to be smaller than values, so rows left over from a v0
+ // database will be listed first.
+ let mut stmt = self
+ .conn
+ .prepare(
+ "SELECT vm_id FROM main.vmids WHERE user_id = ? AND app_id = ? ORDER BY created LIMIT ?;",
+ )
+ .context("failed to prepare SELECT stmt")?;
+ let rows = stmt.query(params![user_id, app_id, count]).context("query failed")?;
+ Self::vm_ids_from_rows(rows)
+ }
+
/// Return all of the `(user_id, app_id)` pairs present in the database.
pub fn get_all_owners(&mut self) -> Result<Vec<(i32, i32)>> {
let mut stmt = self
@@ -344,6 +372,19 @@
fn show_contents(db: &VmIdDb) {
let mut stmt = db.conn.prepare("SELECT * FROM main.vmids;").unwrap();
let mut rows = stmt.query(()).unwrap();
+ println!("DB contents:");
+ while let Some(row) = rows.next().unwrap() {
+ println!(" {row:?}");
+ }
+ }
+
+ fn show_contents_for_app(db: &VmIdDb, user_id: i32, app_id: i32, count: usize) {
+ let mut stmt = db
+ .conn
+ .prepare("SELECT vm_id, created FROM main.vmids WHERE user_id = ? AND app_id = ? ORDER BY created LIMIT ?;")
+ .unwrap();
+ let mut rows = stmt.query(params![user_id, app_id, count]).unwrap();
+ println!("First (by created) {count} rows for app_id={app_id}");
while let Some(row) = rows.next().unwrap() {
println!(" {row:?}");
}
@@ -457,31 +498,39 @@
assert_eq!(vec![VM_ID1, VM_ID2, VM_ID3], db.vm_ids_for_user(USER1).unwrap());
assert_eq!(vec![VM_ID1, VM_ID2, VM_ID3], db.vm_ids_for_app(USER1, APP_A).unwrap());
+ assert_eq!(3, db.count_vm_ids_for_app(USER1, APP_A).unwrap());
assert_eq!(vec![VM_ID4], db.vm_ids_for_app(USER2, APP_B).unwrap());
+ assert_eq!(1, db.count_vm_ids_for_app(USER2, APP_B).unwrap());
assert_eq!(vec![VM_ID5], db.vm_ids_for_user(USER3).unwrap());
assert_eq!(empty, db.vm_ids_for_user(USER_UNKNOWN).unwrap());
assert_eq!(empty, db.vm_ids_for_app(USER1, APP_UNKNOWN).unwrap());
+ assert_eq!(0, db.count_vm_ids_for_app(USER1, APP_UNKNOWN).unwrap());
db.delete_vm_ids(&[VM_ID2, VM_ID3]).unwrap();
assert_eq!(vec![VM_ID1], db.vm_ids_for_user(USER1).unwrap());
assert_eq!(vec![VM_ID1], db.vm_ids_for_app(USER1, APP_A).unwrap());
+ assert_eq!(1, db.count_vm_ids_for_app(USER1, APP_A).unwrap());
// OK to delete things that don't exist.
db.delete_vm_ids(&[VM_ID2, VM_ID3]).unwrap();
assert_eq!(vec![VM_ID1], db.vm_ids_for_user(USER1).unwrap());
assert_eq!(vec![VM_ID1], db.vm_ids_for_app(USER1, APP_A).unwrap());
+ assert_eq!(1, db.count_vm_ids_for_app(USER1, APP_A).unwrap());
db.add_vm_id(&VM_ID2, USER1, APP_A).unwrap();
db.add_vm_id(&VM_ID3, USER1, APP_A).unwrap();
assert_eq!(vec![VM_ID1, VM_ID2, VM_ID3], db.vm_ids_for_user(USER1).unwrap());
assert_eq!(vec![VM_ID1, VM_ID2, VM_ID3], db.vm_ids_for_app(USER1, APP_A).unwrap());
+ assert_eq!(3, db.count_vm_ids_for_app(USER1, APP_A).unwrap());
assert_eq!(vec![VM_ID4], db.vm_ids_for_app(USER2, APP_B).unwrap());
+ assert_eq!(1, db.count_vm_ids_for_app(USER2, APP_B).unwrap());
assert_eq!(vec![VM_ID5], db.vm_ids_for_user(USER3).unwrap());
assert_eq!(empty, db.vm_ids_for_user(USER_UNKNOWN).unwrap());
assert_eq!(empty, db.vm_ids_for_app(USER1, APP_UNKNOWN).unwrap());
+ assert_eq!(0, db.count_vm_ids_for_app(USER1, APP_UNKNOWN).unwrap());
assert_eq!(
vec![(USER1, APP_A), (USER2, APP_B), (USER3, APP_C)],
@@ -513,4 +562,47 @@
assert_eq!(vec![VM_ID1, VM_ID2, VM_ID3], db.vm_ids_for_user(USER1).unwrap());
show_contents(&db);
}
+
+ #[test]
+ fn test_remove_oldest_with_upgrade() {
+ let mut db = new_test_db_version(0);
+ let version = db.schema_version().unwrap();
+ assert_eq!(0, version);
+
+ let remove_count = 10;
+ let mut want = vec![];
+
+ // Manually insert rows before upgrade.
+ const V0_COUNT: usize = 5;
+ for idx in 0..V0_COUNT {
+ let mut vm_id = [0u8; 64];
+ vm_id[0..8].copy_from_slice(&(idx as u64).to_be_bytes());
+ if want.len() < remove_count {
+ want.push(vm_id);
+ }
+ db.conn
+ .execute(
+ "REPLACE INTO main.vmids (vm_id, user_id, app_id) VALUES (?1, ?2, ?3);",
+ params![&vm_id, &USER1, APP_A],
+ )
+ .unwrap();
+ }
+
+ // Now move to v1.
+ db.upgrade_tables_v0_v1().unwrap();
+ let version = db.schema_version().unwrap();
+ assert_eq!(1, version);
+
+ for idx in V0_COUNT..40 {
+ let mut vm_id = [0u8; 64];
+ vm_id[0..8].copy_from_slice(&(idx as u64).to_be_bytes());
+ if want.len() < remove_count {
+ want.push(vm_id);
+ }
+ db.add_vm_id(&vm_id, USER1, APP_A).unwrap();
+ }
+ show_contents_for_app(&db, USER1, APP_A, 10);
+ let got = db.oldest_vm_ids_for_app(USER1, APP_A, 10).unwrap();
+ assert_eq!(got, want);
+ }
}
diff --git a/vm_payload/README.md b/vm_payload/README.md
index 419d854..4b1e6f3 100644
--- a/vm_payload/README.md
+++ b/vm_payload/README.md
@@ -2,7 +2,7 @@
This directory contains the definition of the VM Payload API. This is a native
API, exposed as a set of C functions, available to payload code running inside a
-[Microdroid](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/master/microdroid/README.md)
+[Microdroid](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/main/microdroid/README.md)
VM.
Note that only native code is supported in Microdroid, so no Java APIs are
@@ -17,7 +17,7 @@
under the `lib/<ABI>` directory, like other JNI code.
The primary .so, which is specified as part of the VM configuration via
-[VirtualMachineConfig.Builder#setPayloadBinaryPath](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/master/javalib/src/android/system/virtualmachine/VirtualMachineConfig.java),
+[VirtualMachineConfig.Builder#setPayloadBinaryPath](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/main/java/framework/src/android/system/virtualmachine/VirtualMachineConfig.java),
must define the entry point for the payload.
This entry point is a C function called `AVmPayload_main()`, as declared in
@@ -36,7 +36,7 @@
runtime from the real `libvm_payload.so` hosted within the Microdroid VM.
See `MicrodroidTestNativeLib` in the [test
-APK](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/master/tests/testapk/Android.bp)
+APK](https://android.googlesource.com/platform/packages/modules/Virtualization/+/refs/heads/main/tests/testapk/Android.bp)
for an example.
In other build systems a similar stub `libvm_payload.so` can be built using
diff --git a/vmbase/src/bionic.rs b/vmbase/src/bionic.rs
index a049616..63a6894 100644
--- a/vmbase/src/bionic.rs
+++ b/vmbase/src/bionic.rs
@@ -14,17 +14,17 @@
//! Low-level compatibility layer between baremetal Rust and Bionic C functions.
-use core::ffi::c_char;
-use core::ffi::c_int;
-use core::ffi::c_void;
-use core::ffi::CStr;
-use core::slice;
-use core::str;
-
use crate::console;
use crate::eprintln;
use crate::rand::fill_with_entropy;
use crate::read_sysreg;
+use core::ffi::c_char;
+use core::ffi::c_int;
+use core::ffi::c_void;
+use core::ffi::CStr;
+use core::ptr::addr_of_mut;
+use core::slice;
+use core::str;
use cstr::cstr;
@@ -75,7 +75,7 @@
unsafe extern "C" fn __errno() -> *mut c_int {
// SAFETY: C functions which call this are only called from the main thread, not from exception
// handlers.
- unsafe { &mut ERRNO as *mut _ }
+ unsafe { addr_of_mut!(ERRNO) as *mut _ }
}
fn set_errno(value: c_int) {
diff --git a/vmlauncher_app/java/com/android/virtualization/vmlauncher/MainActivity.java b/vmlauncher_app/java/com/android/virtualization/vmlauncher/MainActivity.java
index e365c46..b5995b8 100644
--- a/vmlauncher_app/java/com/android/virtualization/vmlauncher/MainActivity.java
+++ b/vmlauncher_app/java/com/android/virtualization/vmlauncher/MainActivity.java
@@ -19,23 +19,28 @@
import static android.system.virtualmachine.VirtualMachineConfig.CPU_TOPOLOGY_MATCH_HOST;
import android.app.Activity;
+import android.graphics.Rect;
import android.os.Bundle;
import android.os.RemoteException;
import android.os.ServiceManager;
import android.crosvm.ICrosvmAndroidDisplayService;
import android.system.virtualizationservice_internal.IVirtualizationServiceInternal;
import android.system.virtualmachine.VirtualMachineCustomImageConfig;
+import android.system.virtualmachine.VirtualMachineCustomImageConfig.DisplayConfig;
+import android.util.DisplayMetrics;
import android.util.Log;
import android.system.virtualmachine.VirtualMachine;
import android.system.virtualmachine.VirtualMachineCallback;
import android.system.virtualmachine.VirtualMachineConfig;
import android.system.virtualmachine.VirtualMachineException;
import android.system.virtualmachine.VirtualMachineManager;
+import android.view.Display;
import android.view.SurfaceHolder;
import android.view.SurfaceView;
import android.view.WindowManager;
import android.view.WindowInsets;
import android.view.WindowInsetsController;
+import android.view.WindowMetrics;
import org.json.JSONArray;
import org.json.JSONException;
@@ -106,6 +111,21 @@
}
configBuilder.setMemoryBytes(8L * 1024 * 1024 * 1024 /* 8 GB */);
+ WindowMetrics windowMetrics = getWindowManager().getCurrentWindowMetrics();
+ Rect windowSize = windowMetrics.getBounds();
+ int dpi = (int) (DisplayMetrics.DENSITY_DEFAULT * windowMetrics.getDensity());
+ DisplayConfig.Builder displayConfigBuilder = new DisplayConfig.Builder();
+ displayConfigBuilder.setWidth(windowSize.right);
+ displayConfigBuilder.setHeight(windowSize.bottom);
+ displayConfigBuilder.setHorizontalDpi(dpi);
+ displayConfigBuilder.setVerticalDpi(dpi);
+
+ Display display = getDisplay();
+ if (display != null) {
+ displayConfigBuilder.setRefreshRate((int) display.getRefreshRate());
+ }
+
+ customImageConfigBuilder.setDisplayConfig(displayConfigBuilder.build());
configBuilder.setCustomImageConfig(customImageConfigBuilder.build());
} catch (JSONException | IOException e) {