blob: 0055b3bbdf374f56e998c84ea08286efcea14f2d [file] [log] [blame]
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
Andrew Walbranf6bf6862021-05-21 12:41:13 +000015//! Implementation of the AIDL interface of the VirtualizationService.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +000016
Seungjae Yoo13af0b62024-05-20 14:15:13 +090017use crate::{get_calling_pid, get_calling_uid, get_this_pid};
Alan Stokesfda70842023-12-20 17:50:14 +000018use crate::atom::{write_vm_booted_stats, write_vm_creation_stats};
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +000019use crate::composite::make_composite_image;
Jeongik Chac181be72024-03-27 00:18:30 +090020use crate::crosvm::{CrosvmConfig, DiskFile, DisplayConfig, InputDeviceOption, PayloadState, VmContext, VmInstance, VmState};
Jaewan Kim61f86142023-03-28 15:12:52 +090021use crate::debug_config::DebugConfig;
Shikha Panwar55e10ec2024-02-13 12:53:49 +000022use crate::dt_overlay::{create_device_tree_overlay, VM_DT_OVERLAY_MAX_SIZE, VM_DT_OVERLAY_PATH};
Nikita Ioffe5dfddf22023-06-29 16:11:26 +010023use crate::payload::{add_microdroid_payload_images, add_microdroid_system_images, add_microdroid_vendor_image};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090024use crate::selinux::{getfilecon, SeContext};
Jiyong Park753553b2021-07-12 21:21:09 +090025use android_os_permissions_aidl::aidl::android::os::IPermissionController;
David Brazdil49f96f52022-12-16 21:29:13 +000026use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::{
Alice Wang4e3015d2023-10-10 09:35:37 +000027 Certificate::Certificate,
Andrew Walbranc92d35f2022-01-12 12:45:19 +000028 DeathReason::DeathReason,
David Brazdil49f96f52022-12-16 21:29:13 +000029 ErrorCode::ErrorCode,
30};
31use android_system_virtualizationservice::aidl::android::system::virtualizationservice::{
Inseob Kim53d0b212023-07-20 16:58:37 +090032 AssignableDevice::AssignableDevice,
David Brazdil7d1e5ec2023-02-06 17:56:29 +000033 CpuTopology::CpuTopology,
Andrew Walbran6b650662021-09-07 13:13:23 +000034 DiskImage::DiskImage,
Jeongik Chac181be72024-03-27 00:18:30 +090035 InputDevice::InputDevice,
Alan Stokes0cc59ee2021-09-24 11:20:34 +010036 IVirtualMachine::{BnVirtualMachine, IVirtualMachine},
Andrew Walbran6b650662021-09-07 13:13:23 +000037 IVirtualMachineCallback::IVirtualMachineCallback,
38 IVirtualizationService::IVirtualizationService,
Keir Frasercdd4b112022-11-24 14:02:25 +000039 MemoryTrimLevel::MemoryTrimLevel,
Jiyong Park029977d2021-11-24 21:56:49 +090040 Partition::Partition,
Andrew Walbran6b650662021-09-07 13:13:23 +000041 PartitionType::PartitionType,
Inseob Kim0168b462022-12-27 14:54:35 +090042 VirtualMachineAppConfig::{DebugLevel::DebugLevel, Payload::Payload, VirtualMachineAppConfig},
Jooyung Han21e9b922021-06-26 04:14:16 +090043 VirtualMachineConfig::VirtualMachineConfig,
Andrew Walbran6b650662021-09-07 13:13:23 +000044 VirtualMachineDebugInfo::VirtualMachineDebugInfo,
Alan Stokes0d1ef782022-09-27 13:46:35 +010045 VirtualMachinePayloadConfig::VirtualMachinePayloadConfig,
Jooyung Han21e9b922021-06-26 04:14:16 +090046 VirtualMachineRawConfig::VirtualMachineRawConfig,
Andrew Walbran6b650662021-09-07 13:13:23 +000047 VirtualMachineState::VirtualMachineState,
Jooyung Han21e9b922021-06-26 04:14:16 +090048};
David Brazdilafc9a9e2023-01-12 16:08:10 +000049use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::IVirtualizationServiceInternal::IVirtualizationServiceInternal;
Seungjae Yoodd91f0f2022-11-09 15:25:21 +090050use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{
David Brazdilafc9a9e2023-01-12 16:08:10 +000051 BnVirtualMachineService, IVirtualMachineService,
Seungjae Yoofd9a0622022-10-14 10:01:29 +090052};
Shikha Panware45e9422024-02-28 21:18:10 +000053use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::ISecretkeeper::{BnSecretkeeper, ISecretkeeper};
Shikha Panwar5d6a6752023-12-14 22:08:26 +000054use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::SecretId::SecretId;
55use android_hardware_security_authgraph::aidl::android::hardware::security::authgraph::{
56 Arc::Arc as AuthgraphArc, IAuthGraphKeyExchange::IAuthGraphKeyExchange,
57 IAuthGraphKeyExchange::BnAuthGraphKeyExchange, Identity::Identity, KeInitResult::KeInitResult,
58 Key::Key, PubKey::PubKey, SessionIdSignature::SessionIdSignature, SessionInfo::SessionInfo,
59 SessionInitiationInfo::SessionInitiationInfo,
60};
Alan Stokes25f69362023-03-06 16:51:54 +000061use anyhow::{anyhow, bail, Context, Result};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090062use apkverify::{HashAlgorithm, V4Signature};
Jiyong Parkd7bd2f22023-08-10 20:41:19 +090063use avflog::LogResult;
Alan Stokes0e82b502022-08-08 14:44:48 +010064use binder::{
David Brazdilafc9a9e2023-01-12 16:08:10 +000065 self, wait_for_interface, BinderFeatures, ExceptionCode, Interface, ParcelFileDescriptor,
66 Status, StatusCode, Strong,
Jiyong Park2227eaa2023-08-04 11:59:18 +090067 IntoBinderResult,
Andrew Walbrana89fc132021-03-17 17:08:36 +000068};
Shikha Panwar55e10ec2024-02-13 12:53:49 +000069use cstr::cstr;
Inseob Kim46257382024-01-03 15:41:22 +090070use glob::glob;
David Brazdil49f96f52022-12-16 21:29:13 +000071use lazy_static::lazy_static;
Seungjae Yoo0a8c84c2022-07-11 08:19:15 +000072use log::{debug, error, info, warn};
Inseob Kim89b24592024-02-23 18:59:43 +090073use microdroid_payload_config::{ApkConfig, Task, TaskType, VmPayloadConfig};
Inseob Kim0168b462022-12-27 14:54:35 +090074use nix::unistd::pipe;
David Brazdil73988ea2022-11-11 15:10:32 +000075use rpcbinder::RpcServer;
Alan Stokes25f69362023-03-06 16:51:54 +000076use rustutils::system_properties;
Jiyong Parkdcf17412022-02-08 15:07:23 +090077use semver::VersionReq;
Inseob Kim6ef80972023-07-20 17:23:36 +090078use std::collections::HashSet;
Andrew Walbrandff3b942021-06-09 15:20:36 +000079use std::convert::TryInto;
Shikha Panwar55e10ec2024-02-13 12:53:49 +000080use std::fs;
Jaewan Kim39952072024-01-19 17:04:53 +090081use std::ffi::CStr;
Inseob Kim6ef80972023-07-20 17:23:36 +090082use std::fs::{canonicalize, read_dir, remove_file, File, OpenOptions};
Shikha Panwar9ae2e622024-01-30 12:22:30 +000083use std::io::{BufRead, BufReader, Error, ErrorKind, Seek, SeekFrom, Write};
Inseob Kim46257382024-01-03 15:41:22 +090084use std::iter;
Nikita Ioffe5776f082023-02-10 21:38:26 +000085use std::num::{NonZeroU16, NonZeroU32};
Inseob Kimff48a7c2024-02-26 22:07:21 +090086use std::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd};
David Brazdilafc9a9e2023-01-12 16:08:10 +000087use std::os::unix::raw::pid_t;
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +000088use std::path::{Path, PathBuf};
Andrew Walbran320b5602021-03-04 16:11:12 +000089use std::sync::{Arc, Mutex, Weak};
Seungjae Yoo14e60182024-02-21 13:28:31 +090090use vbmeta::VbMetaImage;
Pierre-Clément Tosid3bbe1d2024-04-15 18:03:51 +010091use vmconfig::{VmConfig, get_debug_level};
David Brazdilafc9a9e2023-01-12 16:08:10 +000092use vsock::VsockStream;
Jooyung Han35edb8f2021-07-01 16:17:16 +090093use zip::ZipArchive;
Andrew Walbrand6dce6f2021-03-05 16:39:08 +000094
David Brazdil41d1a872022-10-05 14:44:19 +010095/// The unique ID of a VM used (together with a port number) for vsock communication.
96pub type Cid = u32;
97
David Brazdil4b4c5102022-12-19 22:56:20 +000098pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice";
99
Jooyung Han95884632021-07-06 22:27:54 +0900100/// The size of zero.img.
101/// Gaps in composite disk images are filled with a shared zero.img.
102const ZERO_FILLER_SIZE: u64 = 4096;
103
David Brazdilf50c7a62023-04-19 14:22:42 +0000104/// Magic string for the instance image
105const ANDROID_VM_INSTANCE_MAGIC: &str = "Android-VM-instance";
106
107/// Version of the instance image format
108const ANDROID_VM_INSTANCE_VERSION: u16 = 1;
109
Alan Stokes0d1ef782022-09-27 13:46:35 +0100110const MICRODROID_OS_NAME: &str = "microdroid";
111
Shikha Panwar5d6a6752023-12-14 22:08:26 +0000112const SECRETKEEPER_IDENTIFIER: &str =
Shikha Panwarbe5dee72024-02-21 19:06:20 +0000113 "android.hardware.security.secretkeeper.ISecretkeeper/default";
Shikha Panwar5d6a6752023-12-14 22:08:26 +0000114
David Brazdilf50c7a62023-04-19 14:22:42 +0000115const UNFORMATTED_STORAGE_MAGIC: &str = "UNFORMATTED-STORAGE";
116
117/// crosvm requires all partitions to be a multiple of 4KiB.
118const PARTITION_GRANULARITY_BYTES: u64 = 4096;
119
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000120const VM_REFERENCE_DT_ON_HOST_PATH: &str = "/proc/device-tree/avf/reference";
121
David Brazdil49f96f52022-12-16 21:29:13 +0000122lazy_static! {
David Brazdil4b4c5102022-12-19 22:56:20 +0000123 pub static ref GLOBAL_SERVICE: Strong<dyn IVirtualizationServiceInternal> =
124 wait_for_interface(BINDER_SERVICE_IDENTIFIER)
125 .expect("Could not connect to VirtualizationServiceInternal");
Inseob Kim46257382024-01-03 15:41:22 +0900126 static ref SUPPORTED_OS_NAMES: HashSet<String> =
127 get_supported_os_names().expect("Failed to get list of supported os names");
David Brazdil49f96f52022-12-16 21:29:13 +0000128}
129
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000130fn create_or_update_idsig_file(
131 input_fd: &ParcelFileDescriptor,
132 idsig_fd: &ParcelFileDescriptor,
133) -> Result<()> {
134 let mut input = clone_file(input_fd)?;
135 let metadata = input.metadata().context("failed to get input metadata")?;
136 if !metadata.is_file() {
137 bail!("input is not a regular file");
138 }
Alan Stokes25f69362023-03-06 16:51:54 +0000139 let mut sig =
140 V4Signature::create(&mut input, get_current_sdk()?, 4096, &[], HashAlgorithm::SHA256)
141 .context("failed to create idsig")?;
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000142
143 let mut output = clone_file(idsig_fd)?;
Jiyong Park8d192952023-06-26 14:29:51 +0900144
145 // Optimization. We don't have to update idsig file whenever a VM is started. Don't update it,
146 // if the idsig file already has the same APK digest.
147 if output.metadata()?.len() > 0 {
148 if let Ok(out_sig) = V4Signature::from_idsig(&mut output) {
149 if out_sig.signing_info.apk_digest == sig.signing_info.apk_digest {
150 debug!("idsig {:?} is up-to-date with apk {:?}.", output, input);
151 return Ok(());
152 }
153 }
154 // if we fail to read v4signature from output, that's fine. User can pass a random file.
155 // We will anyway overwrite the file to the v4signature generated from input_fd.
156 }
157
Shikha Panwar9ae2e622024-01-30 12:22:30 +0000158 output
159 .seek(SeekFrom::Start(0))
160 .context("failed to move cursor to start on the idsig output")?;
Nikita Ioffec09b0492022-12-14 20:18:33 +0000161 output.set_len(0).context("failed to set_len on the idsig output")?;
162 sig.write_into(&mut output).context("failed to write idsig")?;
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000163 Ok(())
164}
165
Alan Stokes25f69362023-03-06 16:51:54 +0000166fn get_current_sdk() -> Result<u32> {
167 let current_sdk = system_properties::read("ro.build.version.sdk")?;
168 let current_sdk = current_sdk.ok_or_else(|| anyhow!("SDK version missing"))?;
169 current_sdk.parse().context("Malformed SDK version")
170}
171
David Brazdil4b4c5102022-12-19 22:56:20 +0000172pub fn remove_temporary_files(path: &PathBuf) -> Result<()> {
173 for dir_entry in read_dir(path)? {
174 remove_file(dir_entry?.path())?;
175 }
176 Ok(())
David Brazdil528e0472022-10-10 15:06:02 +0100177}
178
David Brazdil528e0472022-10-10 15:06:02 +0100179/// Implementation of `IVirtualizationService`, the entry point of the AIDL service.
David Brazdil49f96f52022-12-16 21:29:13 +0000180#[derive(Debug, Default)]
Andrew Walbranf6bf6862021-05-21 12:41:13 +0000181pub struct VirtualizationService {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900182 state: Arc<Mutex<State>>,
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000183}
184
Shikha Panward8e35422021-10-11 13:51:27 +0000185impl Interface for VirtualizationService {
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000186 fn dump(&self, writer: &mut dyn Write, _args: &[&CStr]) -> Result<(), StatusCode> {
Shikha Panward8e35422021-10-11 13:51:27 +0000187 check_permission("android.permission.DUMP").or(Err(StatusCode::PERMISSION_DENIED))?;
188 let state = &mut *self.state.lock().unwrap();
189 let vms = state.vms();
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000190 writeln!(writer, "Running {0} VMs:", vms.len()).or(Err(StatusCode::UNKNOWN_ERROR))?;
Shikha Panward8e35422021-10-11 13:51:27 +0000191 for vm in vms {
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000192 writeln!(writer, "VM CID: {}", vm.cid).or(Err(StatusCode::UNKNOWN_ERROR))?;
193 writeln!(writer, "\tState: {:?}", vm.vm_state.lock().unwrap())
Shikha Panward8e35422021-10-11 13:51:27 +0000194 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000195 writeln!(writer, "\tPayload state {:?}", vm.payload_state())
Shikha Panward8e35422021-10-11 13:51:27 +0000196 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000197 writeln!(writer, "\tProtected: {}", vm.protected).or(Err(StatusCode::UNKNOWN_ERROR))?;
198 writeln!(writer, "\ttemporary_directory: {}", vm.temporary_directory.to_string_lossy())
Shikha Panward8e35422021-10-11 13:51:27 +0000199 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000200 writeln!(writer, "\trequester_uid: {}", vm.requester_uid)
Shikha Panward8e35422021-10-11 13:51:27 +0000201 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000202 writeln!(writer, "\trequester_debug_pid: {}", vm.requester_debug_pid)
Shikha Panward8e35422021-10-11 13:51:27 +0000203 .or(Err(StatusCode::UNKNOWN_ERROR))?;
204 }
205 Ok(())
206 }
207}
Andrew Walbranf6bf6862021-05-21 12:41:13 +0000208impl IVirtualizationService for VirtualizationService {
Andrew Walbranf8d94112021-09-07 11:45:36 +0000209 /// Creates (but does not start) a new VM with the given configuration, assigning it the next
210 /// available CID.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000211 ///
212 /// Returns a binder `IVirtualMachine` object referring to it, as a handle for the client.
Andrew Walbranf8d94112021-09-07 11:45:36 +0000213 fn createVm(
Andrew Walbrana89fc132021-03-17 17:08:36 +0000214 &self,
Andrew Walbran3a5a9212021-05-04 17:09:08 +0000215 config: &VirtualMachineConfig,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900216 console_out_fd: Option<&ParcelFileDescriptor>,
217 console_in_fd: Option<&ParcelFileDescriptor>,
Andrew Walbrana89fc132021-03-17 17:08:36 +0000218 log_fd: Option<&ParcelFileDescriptor>,
219 ) -> binder::Result<Strong<dyn IVirtualMachine>> {
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000220 let mut is_protected = false;
Jiyong Parke6fb1672023-06-26 16:45:55 +0900221 let ret = self.create_vm_internal(
222 config,
223 console_out_fd,
224 console_in_fd,
225 log_fd,
226 &mut is_protected,
227 );
Seungjae Yoo0a8c84c2022-07-11 08:19:15 +0000228 write_vm_creation_stats(config, is_protected, &ret);
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000229 ret
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000230 }
Andrew Walbran320b5602021-03-04 16:11:12 +0000231
Shikha Panwar61a74b52024-02-16 13:17:01 +0000232 /// Allocate a new instance_id to the VM
233 fn allocateInstanceId(&self) -> binder::Result<[u8; 64]> {
Shikha Panwarbd5eba92024-03-27 20:23:31 +0000234 check_manage_access()?;
Shikha Panwar61a74b52024-02-16 13:17:01 +0000235 GLOBAL_SERVICE.allocateInstanceId()
236 }
237
Andrew Walbrandff3b942021-06-09 15:20:36 +0000238 /// Initialise an empty partition image of the given size to be used as a writable partition.
239 fn initializeWritablePartition(
240 &self,
241 image_fd: &ParcelFileDescriptor,
Alan Stokesff0005f2023-01-30 09:53:00 +0000242 size_bytes: i64,
Jiyong Park9dd389e2021-08-23 20:42:59 +0900243 partition_type: PartitionType,
Andrew Walbrandff3b942021-06-09 15:20:36 +0000244 ) -> binder::Result<()> {
Jiyong Park753553b2021-07-12 21:21:09 +0900245 check_manage_access()?;
Jiyong Park2227eaa2023-08-04 11:59:18 +0900246 let size_bytes = size_bytes
247 .try_into()
248 .with_context(|| format!("Invalid size: {}", size_bytes))
249 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000250 let size_bytes = round_up(size_bytes, PARTITION_GRANULARITY_BYTES);
Shikha Panwar9ae2e622024-01-30 12:22:30 +0000251 let mut image = clone_file(image_fd)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000252 // initialize the file. Any data in the file will be erased.
Shikha Panwar9ae2e622024-01-30 12:22:30 +0000253 image
254 .seek(SeekFrom::Start(0))
255 .context("failed to move cursor to start")
256 .or_service_specific_exception(-1)?;
Jiyong Park2227eaa2023-08-04 11:59:18 +0900257 image.set_len(0).context("Failed to reset a file").or_service_specific_exception(-1)?;
Frederick Mayle0d310572024-05-02 12:34:58 -0700258 // Set the file length. In most filesystems, this will not allocate any physical disk
259 // space, it will only change the logical size.
260 image
261 .set_len(size_bytes)
262 .context("Failed to extend file")
Jiyong Park2227eaa2023-08-04 11:59:18 +0900263 .or_service_specific_exception(-1)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000264
265 match partition_type {
266 PartitionType::RAW => Ok(()),
Frederick Mayle0d310572024-05-02 12:34:58 -0700267 PartitionType::ANDROID_VM_INSTANCE => format_as_android_vm_instance(&mut image),
268 PartitionType::ENCRYPTEDSTORE => format_as_encryptedstore(&mut image),
David Brazdilf50c7a62023-04-19 14:22:42 +0000269 _ => Err(Error::new(
270 ErrorKind::Unsupported,
271 format!("Unsupported partition type {:?}", partition_type),
272 )),
273 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900274 .with_context(|| format!("Failed to initialize partition as {:?}", partition_type))
275 .or_service_specific_exception(-1)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000276
277 Ok(())
Andrew Walbrandff3b942021-06-09 15:20:36 +0000278 }
279
Jiyong Park0a248432021-08-20 23:32:39 +0900280 /// Creates or update the idsig file by digesting the input APK file.
281 fn createOrUpdateIdsigFile(
282 &self,
283 input_fd: &ParcelFileDescriptor,
284 idsig_fd: &ParcelFileDescriptor,
285 ) -> binder::Result<()> {
Jiyong Parkc3ca24f2022-06-28 10:45:15 +0900286 check_manage_access()?;
287
Jiyong Park2227eaa2023-08-04 11:59:18 +0900288 create_or_update_idsig_file(input_fd, idsig_fd).or_service_specific_exception(-1)?;
Jiyong Park0a248432021-08-20 23:32:39 +0900289 Ok(())
290 }
291
Andrew Walbran320b5602021-03-04 16:11:12 +0000292 /// Get a list of all currently running VMs. This method is only intended for debug purposes,
293 /// and as such is only permitted from the shell user.
294 fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> {
David Brazdil209074a2023-01-12 16:44:51 +0000295 // Delegate to the global service, including checking the debug permission.
David Brazdild4f51a52023-01-11 14:09:27 +0000296 GLOBAL_SERVICE.debugListVms()
Andrew Walbran320b5602021-03-04 16:11:12 +0000297 }
Inseob Kim53d0b212023-07-20 16:58:37 +0900298
299 /// Get a list of assignable device types.
300 fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> {
301 // Delegate to the global service, including checking the permission.
302 GLOBAL_SERVICE.getAssignableDevices()
303 }
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100304
Inseob Kim46257382024-01-03 15:41:22 +0900305 /// Get a list of supported OSes.
306 fn getSupportedOSList(&self) -> binder::Result<Vec<String>> {
307 Ok(Vec::from_iter(SUPPORTED_OS_NAMES.iter().cloned()))
308 }
309
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100310 /// Returns whether given feature is enabled
311 fn isFeatureEnabled(&self, feature: &str) -> binder::Result<bool> {
312 check_manage_access()?;
Shikha Panwar6d306412024-02-17 21:37:49 +0000313 Ok(avf_features::is_feature_enabled(feature))
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100314 }
Alice Wange64dd182024-01-17 15:57:55 +0000315
316 fn enableTestAttestation(&self) -> binder::Result<()> {
317 GLOBAL_SERVICE.enableTestAttestation()
318 }
Alice Wang0362f7f2024-03-21 08:16:26 +0000319
320 fn isRemoteAttestationSupported(&self) -> binder::Result<bool> {
321 check_manage_access()?;
322 GLOBAL_SERVICE.isRemoteAttestationSupported()
323 }
Shikha Panwar7aef66d2024-03-13 00:28:41 +0000324
325 fn isUpdatableVmSupported(&self) -> binder::Result<bool> {
326 // The response is specific to Microdroid. Updatable VMs are only possible if device
327 // supports Secretkeeper. Guest OS needs to use Secretkeeper based secrets. Microdroid does
328 // this, however other guest OSes may do things differently.
329 check_manage_access()?;
330 Ok(is_secretkeeper_supported())
331 }
Shikha Panwarbd5eba92024-03-27 20:23:31 +0000332
Shikha Panwar07d701c2024-03-28 14:43:52 +0000333 fn removeVmInstance(&self, instance_id: &[u8; 64]) -> binder::Result<()> {
334 check_manage_access()?;
335 GLOBAL_SERVICE.removeVmInstance(instance_id)
336 }
337
Shikha Panwarbd5eba92024-03-27 20:23:31 +0000338 fn claimVmInstance(&self, instance_id: &[u8; 64]) -> binder::Result<()> {
339 check_manage_access()?;
340 GLOBAL_SERVICE.claimVmInstance(instance_id)
341 }
Andrew Walbran320b5602021-03-04 16:11:12 +0000342}
343
Jiyong Park8611a6c2021-07-09 18:17:44 +0900344impl VirtualizationService {
345 pub fn init() -> VirtualizationService {
David Brazdil49f96f52022-12-16 21:29:13 +0000346 VirtualizationService::default()
Jiyong Park8611a6c2021-07-09 18:17:44 +0900347 }
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000348
David Brazdil209074a2023-01-12 16:44:51 +0000349 fn create_vm_context(
350 &self,
351 requester_debug_pid: pid_t,
352 ) -> binder::Result<(VmContext, Cid, PathBuf)> {
David Brazdil8cf8f482022-11-23 14:21:26 +0000353 const NUM_ATTEMPTS: usize = 5;
354
355 for _ in 0..NUM_ATTEMPTS {
Charisee96113f32023-01-26 09:00:42 +0000356 let vm_context = GLOBAL_SERVICE.allocateGlobalVmContext(requester_debug_pid)?;
David Brazdild4f51a52023-01-11 14:09:27 +0000357 let cid = vm_context.getCid()? as Cid;
358 let temp_dir: PathBuf = vm_context.getTemporaryDirectory()?.into();
David Brazdil8cf8f482022-11-23 14:21:26 +0000359 let service = VirtualMachineService::new_binder(self.state.clone(), cid).as_binder();
360
361 // Start VM service listening for connections from the new CID on port=CID.
David Brazdil8cf8f482022-11-23 14:21:26 +0000362 let port = cid;
David Brazdil3238da42022-11-18 10:04:51 +0000363 match RpcServer::new_vsock(service, cid, port) {
David Brazdil8cf8f482022-11-23 14:21:26 +0000364 Ok(vm_server) => {
365 vm_server.start();
David Brazdild4f51a52023-01-11 14:09:27 +0000366 return Ok((VmContext::new(vm_context, vm_server), cid, temp_dir));
David Brazdil8cf8f482022-11-23 14:21:26 +0000367 }
368 Err(err) => {
369 warn!("Could not start RpcServer on port {}: {}", port, err);
370 }
371 }
372 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900373 Err(anyhow!("Too many attempts to create VM context failed"))
374 .or_service_specific_exception(-1)
David Brazdil8cf8f482022-11-23 14:21:26 +0000375 }
376
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000377 fn create_vm_internal(
378 &self,
379 config: &VirtualMachineConfig,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900380 console_out_fd: Option<&ParcelFileDescriptor>,
381 console_in_fd: Option<&ParcelFileDescriptor>,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000382 log_fd: Option<&ParcelFileDescriptor>,
383 is_protected: &mut bool,
384 ) -> binder::Result<Strong<dyn IVirtualMachine>> {
David Brazdil209074a2023-01-12 16:44:51 +0000385 let requester_uid = get_calling_uid();
386 let requester_debug_pid = get_calling_pid();
387
Nikita Ioffe631717e2023-09-05 13:38:07 +0100388 check_config_features(config)?;
389
David Brazdil209074a2023-01-12 16:44:51 +0000390 // Allocating VM context checks the MANAGE_VIRTUAL_MACHINE permission.
391 let (vm_context, cid, temporary_directory) = self.create_vm_context(requester_debug_pid)?;
Inseob Kim1119d702022-05-02 18:01:58 +0900392
Alan Stokesfda70842023-12-20 17:50:14 +0000393 if is_custom_config(config) {
Alan Stokes7bc146c2022-10-20 17:10:32 +0100394 check_use_custom_virtual_machine()?;
Inseob Kim1119d702022-05-02 18:01:58 +0900395 }
396
Nikita Ioffe5776f082023-02-10 21:38:26 +0000397 let gdb_port = extract_gdb_port(config);
398
399 // Additional permission checks if caller request gdb.
400 if gdb_port.is_some() {
401 check_gdb_allowed(config)?;
402 }
403
Shikha Panwar8707f0f2024-02-28 20:40:42 +0000404 // Currently, VirtMgr adds the host copy of reference DT & untrusted properties
405 // (e.g. instance-id)
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000406 let host_ref_dt = Path::new(VM_REFERENCE_DT_ON_HOST_PATH);
407 let host_ref_dt = if host_ref_dt.exists()
408 && read_dir(host_ref_dt).or_service_specific_exception(-1)?.next().is_some()
409 {
410 Some(host_ref_dt)
411 } else {
412 warn!("VM reference DT doesn't exist in host DT");
413 None
414 };
415
Seungjae Yoo14e60182024-02-21 13:28:31 +0900416 let vendor_hashtree_digest = extract_vendor_hashtree_digest(config)
417 .context("Failed to extract vendor hashtree digest")
418 .or_service_specific_exception(-1)?;
419
420 let trusted_props = if let Some(ref vendor_hashtree_digest) = vendor_hashtree_digest {
421 info!(
422 "Passing vendor hashtree digest to pvmfw. This will be rejected if it doesn't \
423 match the trusted digest in the pvmfw config, causing the VM to fail to start."
424 );
425 vec![(
426 cstr!("vendor_hashtree_descriptor_root_digest"),
427 vendor_hashtree_digest.as_slice(),
428 )]
429 } else {
430 vec![]
431 };
432
Shikha Panwar61a74b52024-02-16 13:17:01 +0000433 let instance_id;
Shikha Panwar8707f0f2024-02-28 20:40:42 +0000434 let mut untrusted_props = Vec::with_capacity(2);
435 if cfg!(llpvm_changes) {
Shikha Panwar61a74b52024-02-16 13:17:01 +0000436 instance_id = extract_instance_id(config);
Shikha Panwar8707f0f2024-02-28 20:40:42 +0000437 untrusted_props.push((cstr!("instance-id"), &instance_id[..]));
Alan Stokesc96b35e2024-05-03 13:21:20 +0100438 let want_updatable = extract_want_updatable(config);
439 if want_updatable && is_secretkeeper_supported() {
Shikha Panwar8707f0f2024-02-28 20:40:42 +0000440 // Let guest know that it can defer rollback protection to Secretkeeper by setting
441 // an empty property in untrusted node in DT. This enables Updatable VMs.
442 untrusted_props.push((cstr!("defer-rollback-protection"), &[]))
443 }
444 }
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000445
Seungjae Yoo14e60182024-02-21 13:28:31 +0900446 let device_tree_overlay =
447 if host_ref_dt.is_some() || !untrusted_props.is_empty() || !trusted_props.is_empty() {
448 let dt_output = temporary_directory.join(VM_DT_OVERLAY_PATH);
449 let mut data = [0_u8; VM_DT_OVERLAY_MAX_SIZE];
450 let fdt = create_device_tree_overlay(
451 &mut data,
452 host_ref_dt,
453 &untrusted_props,
454 &trusted_props,
455 )
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000456 .map_err(|e| anyhow!("Failed to create DT overlay, {e:?}"))
457 .or_service_specific_exception(-1)?;
Seungjae Yoo14e60182024-02-21 13:28:31 +0900458 fs::write(&dt_output, fdt.as_slice()).or_service_specific_exception(-1)?;
459 Some(File::open(dt_output).or_service_specific_exception(-1)?)
460 } else {
461 None
462 };
Seungjae Yooec3bc522023-11-09 10:14:30 +0900463
Jaewan Kimf3143242024-03-15 06:56:31 +0000464 let debug_config = DebugConfig::new(config);
Jaewan Kim61f86142023-03-28 15:12:52 +0900465
Nikita Ioffe2cb75cf2024-06-04 16:43:56 +0000466 let ramdump = if !uses_gki_kernel(config) && debug_config.is_ramdump_needed() {
Jiyong Parked180932023-02-24 19:55:41 +0900467 Some(prepare_ramdump_file(&temporary_directory)?)
468 } else {
469 None
470 };
471
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000472 let state = &mut *self.state.lock().unwrap();
Jiyong Parke6fb1672023-06-26 16:45:55 +0900473 let console_out_fd =
474 clone_or_prepare_logger_fd(&debug_config, console_out_fd, format!("Console({})", cid))?;
475 let console_in_fd = console_in_fd.map(clone_file).transpose()?;
Jaewan Kim61f86142023-03-28 15:12:52 +0900476 let log_fd = clone_or_prepare_logger_fd(&debug_config, log_fd, format!("Log({})", cid))?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000477
478 // Counter to generate unique IDs for temporary image files.
479 let mut next_temporary_image_id = 0;
480 // Files which are referred to from composite images. These must be mapped to the crosvm
481 // child process, and not closed before it is started.
482 let mut indirect_files = vec![];
483
Alan Stokes7bc146c2022-10-20 17:10:32 +0100484 let (is_app_config, config) = match config {
485 VirtualMachineConfig::RawConfig(config) => (false, BorrowedOrOwned::Borrowed(config)),
486 VirtualMachineConfig::AppConfig(config) => {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900487 let config = load_app_config(config, &debug_config, &temporary_directory)
488 .or_service_specific_exception_with(-1, |e| {
Jaewan Kim61f86142023-03-28 15:12:52 +0900489 *is_protected = config.protectedVm;
490 let message = format!("Failed to load app config: {:?}", e);
491 error!("{}", message);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900492 message
Jaewan Kim61f86142023-03-28 15:12:52 +0900493 })?;
Alan Stokes7bc146c2022-10-20 17:10:32 +0100494 (true, BorrowedOrOwned::Owned(config))
495 }
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000496 };
497 let config = config.as_ref();
498 *is_protected = config.protectedVm;
499
500 // Check if partition images are labeled incorrectly. This is to prevent random images
501 // which are not protected by the Android Verified Boot (e.g. bits downloaded by apps) from
Alan Stokes3e5eec12023-09-07 12:10:00 +0100502 // being loaded in a pVM. This applies to everything but the instance image in the raw
503 // config, and everything but the non-executable, generated partitions in the app
504 // config.
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000505 config
506 .disks
507 .iter()
508 .flat_map(|disk| disk.partitions.iter())
509 .filter(|partition| {
510 if is_app_config {
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100511 !is_safe_app_partition(&partition.label)
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000512 } else {
Alice Wangc206b9b2023-08-28 14:13:51 +0000513 !is_safe_raw_partition(&partition.label)
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000514 }
515 })
516 .try_for_each(check_label_for_partition)
Jiyong Park2227eaa2023-08-04 11:59:18 +0900517 .or_service_specific_exception(-1)?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000518
Inseob Kimff48a7c2024-02-26 22:07:21 +0900519 // Check if files for payloads and bases are NOT coming from /vendor and /odm, as they may
520 // have unstable interfaces.
521 // TODO(b/316431494): remove once Treble interfaces are stabilized.
522 check_partitions_for_files(config).or_service_specific_exception(-1)?;
523
Alan Stokes185fe112023-01-10 16:20:55 +0000524 let kernel = maybe_clone_file(&config.kernel)?;
525 let initrd = maybe_clone_file(&config.initrd)?;
526
527 // In a protected VM, we require custom kernels to come from a trusted source (b/237054515).
528 if config.protectedVm {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900529 check_label_for_kernel_files(&kernel, &initrd).or_service_specific_exception(-1)?;
Alan Stokes185fe112023-01-10 16:20:55 +0000530 }
531
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000532 let zero_filler_path = temporary_directory.join("zero.img");
Jiyong Park2227eaa2023-08-04 11:59:18 +0900533 write_zero_filler(&zero_filler_path)
534 .context("Failed to make composite image")
535 .with_log()
536 .or_service_specific_exception(-1)?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000537
538 // Assemble disk images if needed.
539 let disks = config
540 .disks
541 .iter()
542 .map(|disk| {
543 assemble_disk_image(
544 disk,
545 &zero_filler_path,
546 &temporary_directory,
547 &mut next_temporary_image_id,
548 &mut indirect_files,
549 )
550 })
551 .collect::<Result<Vec<DiskFile>, _>>()?;
552
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000553 let (cpus, host_cpu_topology) = match config.cpuTopology {
554 CpuTopology::MATCH_HOST => (None, true),
555 CpuTopology::ONE_CPU => (NonZeroU32::new(1), false),
556 val => {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900557 return Err(anyhow!("Failed to parse CPU topology value {:?}", val))
558 .with_log()
559 .or_service_specific_exception(-1);
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000560 }
561 };
562
David Brazdil2dfefd12023-11-17 14:07:36 +0000563 let (vfio_devices, dtbo) = if !config.devices.is_empty() {
Inseob Kim6ef80972023-07-20 17:23:36 +0900564 let mut set = HashSet::new();
565 for device in config.devices.iter() {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900566 let path = canonicalize(device)
567 .with_context(|| format!("can't canonicalize {device}"))
568 .or_service_specific_exception(-1)?;
Inseob Kim6ef80972023-07-20 17:23:36 +0900569 if !set.insert(path) {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900570 return Err(anyhow!("duplicated device {device}"))
571 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Inseob Kim6ef80972023-07-20 17:23:36 +0900572 }
573 }
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000574 let devices = GLOBAL_SERVICE.bindDevicesToVfioDriver(&config.devices)?;
David Brazdil2dfefd12023-11-17 14:07:36 +0000575 let dtbo_file = File::from(
576 GLOBAL_SERVICE
577 .getDtboFile()?
578 .as_ref()
579 .try_clone()
Jaewan Kim39952072024-01-19 17:04:53 +0900580 .context("Failed to create VM DTBO from ParcelFileDescriptor")
David Brazdil2dfefd12023-11-17 14:07:36 +0000581 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?,
582 );
583 (devices, Some(dtbo_file))
Inseob Kim7307a892023-09-14 13:37:58 +0900584 } else {
David Brazdil2dfefd12023-11-17 14:07:36 +0000585 (vec![], None)
Inseob Kim7307a892023-09-14 13:37:58 +0900586 };
Jeongik Cha798401c2024-04-11 21:54:49 +0900587 let display_config = if cfg!(paravirtualized_devices) {
588 config
589 .displayConfig
590 .as_ref()
591 .map(DisplayConfig::new)
592 .transpose()
593 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?
594 } else {
595 None
596 };
Jeongik Cha1df1c032024-04-03 16:03:12 +0900597
Jeongik Chac181be72024-03-27 00:18:30 +0900598 let input_device_options = if cfg!(paravirtualized_devices) {
599 config
600 .inputDevices
601 .iter()
602 .map(to_input_device_option_from)
603 .collect::<Result<Vec<InputDeviceOption>, _>>()
604 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?
605 } else {
606 vec![]
607 };
608
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900609 // Create TAP network interface if the VM supports network.
Seungjae Yoo986d7a42024-05-28 14:06:58 +0900610 let tap = if cfg!(network) && config.networkSupported {
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900611 if *is_protected {
612 return Err(anyhow!("Network feature is not supported for pVM yet"))
613 .with_log()
614 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION)?;
615 }
Seungjae Yoo986d7a42024-05-28 14:06:58 +0900616 Some(File::from(
617 GLOBAL_SERVICE
618 .createTapInterface(&get_this_pid().to_string())?
619 .as_ref()
620 .try_clone()
621 .context("Failed to get TAP interface from ParcelFileDescriptor")
622 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?,
623 ))
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900624 } else {
625 None
626 };
Mu-Le Lee134180a2024-04-16 15:13:07 +0800627 let virtio_snd_backend =
628 if cfg!(paravirtualized_devices) { Some(String::from("aaudio")) } else { None };
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900629
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000630 // Actually start the VM.
631 let crosvm_config = CrosvmConfig {
632 cid,
Seungjae Yoo62085c02022-08-12 04:44:52 +0000633 name: config.name.clone(),
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000634 bootloader: maybe_clone_file(&config.bootloader)?,
Alan Stokes185fe112023-01-10 16:20:55 +0000635 kernel,
636 initrd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000637 disks,
638 params: config.params.to_owned(),
639 protected: *is_protected,
Jaewan Kim61f86142023-03-28 15:12:52 +0900640 debug_config,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000641 memory_mib: config.memoryMib.try_into().ok().and_then(NonZeroU32::new),
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000642 cpus,
643 host_cpu_topology,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900644 console_out_fd,
645 console_in_fd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000646 log_fd,
Jiyong Parked180932023-02-24 19:55:41 +0900647 ramdump,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000648 indirect_files,
649 platform_version: parse_platform_version_req(&config.platformVersion)?,
Jiyong Parke6ed0f92022-06-22 00:13:00 +0900650 detect_hangup: is_app_config,
Nikita Ioffe5776f082023-02-10 21:38:26 +0000651 gdb_port,
Inseob Kim7307a892023-09-14 13:37:58 +0900652 vfio_devices,
David Brazdil2dfefd12023-11-17 14:07:36 +0000653 dtbo,
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000654 device_tree_overlay,
Jeongik Cha1df1c032024-04-03 16:03:12 +0900655 display_config,
Jeongik Chac181be72024-03-27 00:18:30 +0900656 input_device_options,
Vincent Donnefort538a2c62024-03-20 16:01:10 +0000657 hugepages: config.hugePages,
Seungjae Yoo986d7a42024-05-28 14:06:58 +0900658 tap,
Mu-Le Lee134180a2024-04-16 15:13:07 +0800659 virtio_snd_backend,
Yi-Yo Chiang8dd32552024-05-22 19:38:16 +0800660 console_input_device: config.consoleInputDevice.clone(),
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000661 };
662 let instance = Arc::new(
David Brazdil528e0472022-10-10 15:06:02 +0100663 VmInstance::new(
664 crosvm_config,
665 temporary_directory,
666 requester_uid,
667 requester_debug_pid,
668 vm_context,
669 )
Jiyong Park2227eaa2023-08-04 11:59:18 +0900670 .with_context(|| format!("Failed to create VM with config {:?}", config))
671 .with_log()
672 .or_service_specific_exception(-1)?,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000673 );
674 state.add_vm(Arc::downgrade(&instance));
675 Ok(VirtualMachine::create(instance))
676 }
Jiyong Park8611a6c2021-07-09 18:17:44 +0900677}
678
Alan Stokesfda70842023-12-20 17:50:14 +0000679/// Returns whether a VM config represents a "custom" virtual machine, which requires the
680/// USE_CUSTOM_VIRTUAL_MACHINE.
681fn is_custom_config(config: &VirtualMachineConfig) -> bool {
682 match config {
683 // Any raw (non-Microdroid) VM is considered custom.
684 VirtualMachineConfig::RawConfig(_) => true,
685 VirtualMachineConfig::AppConfig(config) => {
686 // Some features are reserved for platform apps only, even when using
687 // VirtualMachineAppConfig. Almost all of these features are grouped in the
688 // CustomConfig struct:
689 // - controlling CPUs;
690 // - gdbPort is set, meaning that crosvm will start a gdb server;
691 // - using anything other than the default kernel;
692 // - specifying devices to be assigned.
693 if config.customConfig.is_some() {
694 true
695 } else {
696 // Additional custom features not included in CustomConfig:
697 // - specifying a config file;
Alan Stokes736f6822024-02-16 16:08:00 +0000698 // - specifying extra APKs;
699 // - specifying an OS other than Microdroid.
Inseob Kim89b24592024-02-23 18:59:43 +0900700 (match &config.payload {
Alan Stokesfda70842023-12-20 17:50:14 +0000701 Payload::ConfigPath(_) => true,
Inseob Kim89b24592024-02-23 18:59:43 +0900702 Payload::PayloadConfig(payload_config) => !payload_config.extraApks.is_empty(),
703 }) || config.osName != MICRODROID_OS_NAME
Alan Stokesfda70842023-12-20 17:50:14 +0000704 }
705 }
706 }
707}
708
Seungjae Yoo14e60182024-02-21 13:28:31 +0900709fn extract_vendor_hashtree_digest(config: &VirtualMachineConfig) -> Result<Option<Vec<u8>>> {
710 let VirtualMachineConfig::AppConfig(config) = config else {
711 return Ok(None);
712 };
713 let Some(custom_config) = &config.customConfig else {
714 return Ok(None);
715 };
716 let Some(file) = custom_config.vendorImage.as_ref() else {
717 return Ok(None);
718 };
719
720 let file = clone_file(file)?;
721 let size =
722 file.metadata().context("Failed to get metadata from microdroid vendor image")?.len();
723 let vbmeta = VbMetaImage::verify_reader_region(&file, 0, size)
724 .context("Failed to get vbmeta from microdroid-vendor.img")?;
725
726 for descriptor in vbmeta.descriptors()?.iter() {
727 if let vbmeta::Descriptor::Hashtree(_) = descriptor {
728 let root_digest = hex::encode(descriptor.to_hashtree()?.root_digest());
729 return Ok(Some(root_digest.as_bytes().to_vec()));
730 }
731 }
732 Err(anyhow!("No hashtree digest is extracted from microdroid vendor image"))
733}
734
Andrew Walbranfbb39d22021-07-28 17:01:25 +0000735fn write_zero_filler(zero_filler_path: &Path) -> Result<()> {
Jooyung Han95884632021-07-06 22:27:54 +0900736 let file = OpenOptions::new()
737 .create_new(true)
738 .read(true)
739 .write(true)
740 .open(zero_filler_path)
741 .with_context(|| "Failed to create zero.img")?;
742 file.set_len(ZERO_FILLER_SIZE)?;
Andrew Walbranfbb39d22021-07-28 17:01:25 +0000743 Ok(())
Jooyung Han95884632021-07-06 22:27:54 +0900744}
745
David Brazdilf50c7a62023-04-19 14:22:42 +0000746fn format_as_android_vm_instance(part: &mut dyn Write) -> std::io::Result<()> {
747 part.write_all(ANDROID_VM_INSTANCE_MAGIC.as_bytes())?;
748 part.write_all(&ANDROID_VM_INSTANCE_VERSION.to_le_bytes())?;
749 part.flush()
750}
751
752fn format_as_encryptedstore(part: &mut dyn Write) -> std::io::Result<()> {
753 part.write_all(UNFORMATTED_STORAGE_MAGIC.as_bytes())?;
754 part.flush()
755}
756
757fn round_up(input: u64, granularity: u64) -> u64 {
758 if granularity == 0 {
759 return input;
760 }
761 // If the input is absurdly large we round down instead of up; it's going to fail anyway.
762 let result = input.checked_add(granularity - 1).unwrap_or(input);
763 (result / granularity) * granularity
764}
765
Jeongik Chac181be72024-03-27 00:18:30 +0900766fn to_input_device_option_from(input_device: &InputDevice) -> Result<InputDeviceOption> {
767 Ok(match input_device {
768 InputDevice::SingleTouch(single_touch) => InputDeviceOption::SingleTouch {
769 file: clone_file(single_touch.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?)?,
770 height: u32::try_from(single_touch.height)?,
771 width: u32::try_from(single_touch.width)?,
772 name: if !single_touch.name.is_empty() {
773 Some(single_touch.name.clone())
774 } else {
775 None
776 },
777 },
778 InputDevice::EvDev(evdev) => InputDeviceOption::EvDev(clone_file(
779 evdev.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
780 )?),
Jeongik Cha985b6402024-04-15 18:13:00 +0900781 InputDevice::Keyboard(keyboard) => InputDeviceOption::Keyboard(clone_file(
782 keyboard.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
783 )?),
Jeongik Cha343894e2024-05-17 20:39:31 +0900784 InputDevice::Mouse(mouse) => InputDeviceOption::Mouse(clone_file(
785 mouse.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
786 )?),
Jeongik Chac181be72024-03-27 00:18:30 +0900787 })
788}
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000789/// Given the configuration for a disk image, assembles the `DiskFile` to pass to crosvm.
790///
791/// This may involve assembling a composite disk from a set of partition images.
792fn assemble_disk_image(
793 disk: &DiskImage,
Jooyung Han95884632021-07-06 22:27:54 +0900794 zero_filler_path: &Path,
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000795 temporary_directory: &Path,
796 next_temporary_image_id: &mut u64,
797 indirect_files: &mut Vec<File>,
Andrew Walbran806f1542021-06-10 14:07:12 +0000798) -> Result<DiskFile, Status> {
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000799 let image = if !disk.partitions.is_empty() {
800 if disk.image.is_some() {
801 warn!("DiskImage {:?} contains both image and partitions.", disk);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900802 return Err(anyhow!("DiskImage contains both image and partitions"))
803 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000804 }
805
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000806 let composite_image_filenames =
807 make_composite_image_filenames(temporary_directory, next_temporary_image_id);
808 let (image, partition_files) = make_composite_image(
809 &disk.partitions,
Jooyung Han95884632021-07-06 22:27:54 +0900810 zero_filler_path,
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000811 &composite_image_filenames.composite,
812 &composite_image_filenames.header,
813 &composite_image_filenames.footer,
814 )
Jiyong Park2227eaa2023-08-04 11:59:18 +0900815 .with_context(|| format!("Failed to make composite disk image with config {:?}", disk))
816 .with_log()
817 .or_service_specific_exception(-1)?;
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000818
819 // Pass the file descriptors for the various partition files to crosvm when it
820 // is run.
821 indirect_files.extend(partition_files);
822
823 image
824 } else if let Some(image) = &disk.image {
825 clone_file(image)?
826 } else {
827 warn!("DiskImage {:?} didn't contain image or partitions.", disk);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900828 return Err(anyhow!("DiskImage didn't contain image or partitions."))
829 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000830 };
831
832 Ok(DiskFile { image, writable: disk.writable })
833}
834
Nikita Ioffeaa6858c2023-07-04 01:37:41 +0100835fn append_kernel_param(param: &str, vm_config: &mut VirtualMachineRawConfig) {
836 if let Some(ref mut params) = vm_config.params {
837 params.push(' ');
838 params.push_str(param)
839 } else {
840 vm_config.params = Some(param.to_owned())
841 }
842}
843
Inseob Kim46257382024-01-03 15:41:22 +0900844fn extract_os_name_from_config_path(config: &Path) -> Option<String> {
845 if config.extension()?.to_str()? != "json" {
846 return None;
Inseob Kim172f9eb2023-11-06 17:02:08 +0900847 }
Inseob Kim46257382024-01-03 15:41:22 +0900848
849 Some(config.with_extension("").file_name()?.to_str()?.to_owned())
850}
851
852fn extract_os_names_from_configs(config_glob_pattern: &str) -> Result<HashSet<String>> {
853 let configs = glob(config_glob_pattern)?.collect::<Result<Vec<_>, _>>()?;
854 let os_names =
855 configs.iter().filter_map(|x| extract_os_name_from_config_path(x)).collect::<HashSet<_>>();
856
857 Ok(os_names)
858}
859
860fn get_supported_os_names() -> Result<HashSet<String>> {
861 if !cfg!(vendor_modules) {
862 return Ok(iter::once(MICRODROID_OS_NAME.to_owned()).collect());
863 }
864
865 extract_os_names_from_configs("/apex/com.android.virt/etc/microdroid*.json")
866}
867
868fn is_valid_os(os_name: &str) -> bool {
869 SUPPORTED_OS_NAMES.contains(os_name)
Inseob Kim172f9eb2023-11-06 17:02:08 +0900870}
871
Nikita Ioffe2cb75cf2024-06-04 16:43:56 +0000872fn uses_gki_kernel(config: &VirtualMachineConfig) -> bool {
873 if !cfg!(vendor_modules) {
874 return false;
875 }
876 match config {
877 VirtualMachineConfig::RawConfig(_) => false,
878 VirtualMachineConfig::AppConfig(config) => config.osName.starts_with("microdroid_gki-"),
879 }
880}
881
Jooyung Han21e9b922021-06-26 04:14:16 +0900882fn load_app_config(
883 config: &VirtualMachineAppConfig,
Jaewan Kim61f86142023-03-28 15:12:52 +0900884 debug_config: &DebugConfig,
Jooyung Han21e9b922021-06-26 04:14:16 +0900885 temporary_directory: &Path,
Jooyung Hanadfb76c2021-06-28 17:29:30 +0900886) -> Result<VirtualMachineRawConfig> {
Andrew Walbrancc0db522021-07-12 17:03:42 +0000887 let apk_file = clone_file(config.apk.as_ref().unwrap())?;
888 let idsig_file = clone_file(config.idsig.as_ref().unwrap())?;
Jiyong Park8d081812021-07-23 17:45:04 +0900889 let instance_file = clone_file(config.instanceImage.as_ref().unwrap())?;
Jooyung Han21e9b922021-06-26 04:14:16 +0900890
Shikha Panwar22e70452022-10-10 18:32:55 +0000891 let storage_image = if let Some(file) = config.encryptedStorageImage.as_ref() {
892 Some(clone_file(file)?)
893 } else {
894 None
895 };
896
Alan Stokesfda70842023-12-20 17:50:14 +0000897 let vm_payload_config;
898 let extra_apk_files: Vec<_>;
899 match &config.payload {
Alan Stokes0d1ef782022-09-27 13:46:35 +0100900 Payload::ConfigPath(config_path) => {
Alan Stokesfda70842023-12-20 17:50:14 +0000901 vm_payload_config =
902 load_vm_payload_config_from_file(&apk_file, config_path.as_str())
903 .with_context(|| format!("Couldn't read config from {}", config_path))?;
904 extra_apk_files = vm_payload_config
905 .extra_apks
906 .iter()
907 .enumerate()
908 .map(|(i, apk)| {
909 File::open(PathBuf::from(&apk.path))
910 .with_context(|| format!("Failed to open extra apk #{i} {}", apk.path))
911 })
912 .collect::<Result<_>>()?;
Alan Stokes0d1ef782022-09-27 13:46:35 +0100913 }
Alan Stokesfda70842023-12-20 17:50:14 +0000914 Payload::PayloadConfig(payload_config) => {
915 vm_payload_config = create_vm_payload_config(payload_config)?;
916 extra_apk_files =
917 payload_config.extraApks.iter().map(clone_file).collect::<binder::Result<_>>()?;
918 }
Alan Stokes0d1ef782022-09-27 13:46:35 +0100919 };
Jooyung Han21e9b922021-06-26 04:14:16 +0900920
Inseob Kim89b24592024-02-23 18:59:43 +0900921 let payload_config_os = vm_payload_config.os.name.as_str();
922 if !payload_config_os.is_empty() && payload_config_os != "microdroid" {
923 bail!("'os' in payload config is deprecated");
924 }
925
Inseob Kim172f9eb2023-11-06 17:02:08 +0900926 // For now, the only supported OS is Microdroid and Microdroid GKI
Inseob Kim89b24592024-02-23 18:59:43 +0900927 let os_name = config.osName.as_str();
Inseob Kim172f9eb2023-11-06 17:02:08 +0900928 if !is_valid_os(os_name) {
Andrew Walbrancc0db522021-07-12 17:03:42 +0000929 bail!("Unknown OS \"{}\"", os_name);
Jooyung Han35edb8f2021-07-01 16:17:16 +0900930 }
Andrew Walbrancc0db522021-07-12 17:03:42 +0000931
932 // It is safe to construct a filename based on the os_name because we've already checked that it
933 // is one of the allowed values.
Jooyung Han21e9b922021-06-26 04:14:16 +0900934 let vm_config_path = PathBuf::from(format!("/apex/com.android.virt/etc/{}.json", os_name));
935 let vm_config_file = File::open(vm_config_path)?;
Andrew Walbrancc0db522021-07-12 17:03:42 +0000936 let mut vm_config = VmConfig::load(&vm_config_file)?.to_parcelable()?;
Jooyung Han21e9b922021-06-26 04:14:16 +0900937
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +0100938 if let Some(custom_config) = &config.customConfig {
939 if let Some(file) = custom_config.customKernelImage.as_ref() {
940 vm_config.kernel = Some(ParcelFileDescriptor::new(clone_file(file)?))
941 }
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +0100942 vm_config.gdbPort = custom_config.gdbPort;
Nikita Ioffe5dfddf22023-06-29 16:11:26 +0100943
944 if let Some(file) = custom_config.vendorImage.as_ref() {
Nikita Ioffeaa6858c2023-07-04 01:37:41 +0100945 add_microdroid_vendor_image(clone_file(file)?, &mut vm_config);
946 append_kernel_param("androidboot.microdroid.mount_vendor=1", &mut vm_config)
Nikita Ioffe5dfddf22023-06-29 16:11:26 +0100947 }
Inseob Kim6ef80972023-07-20 17:23:36 +0900948
Chris Wailes6177c662024-05-09 14:37:44 -0700949 vm_config.devices.clone_from(&custom_config.devices);
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900950 vm_config.networkSupported = custom_config.networkSupported;
Nikita Ioffe26c35ed2023-06-05 17:49:08 +0100951 }
952
Andrew Walbrancc045902021-07-27 16:06:17 +0000953 if config.memoryMib > 0 {
954 vm_config.memoryMib = config.memoryMib;
Andrew Walbran45bcb0c2021-07-14 15:02:06 +0000955 }
956
Chris Wailes6177c662024-05-09 14:37:44 -0700957 vm_config.name.clone_from(&config.name);
Andrew Walbran3994f002022-01-27 17:33:45 +0000958 vm_config.protectedVm = config.protectedVm;
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000959 vm_config.cpuTopology = config.cpuTopology;
Vincent Donnefort538a2c62024-03-20 16:01:10 +0000960 vm_config.hugePages = config.hugePages || vm_payload_config.hugepages;
Jiyong Park032615f2022-01-10 13:55:34 +0900961
Shikha Panwar22e70452022-10-10 18:32:55 +0000962 // Microdroid takes additional init ramdisk & (optionally) storage image
Inseob Kim172f9eb2023-11-06 17:02:08 +0900963 add_microdroid_system_images(config, instance_file, storage_image, os_name, &mut vm_config)?;
Shikha Panwar22e70452022-10-10 18:32:55 +0000964
965 // Include Microdroid payload disk (contains apks, idsigs) in vm config
966 add_microdroid_payload_images(
Alan Stokes0d1ef782022-09-27 13:46:35 +0100967 config,
Jaewan Kim61f86142023-03-28 15:12:52 +0900968 debug_config,
Alan Stokes0d1ef782022-09-27 13:46:35 +0100969 temporary_directory,
970 apk_file,
971 idsig_file,
Alan Stokesfda70842023-12-20 17:50:14 +0000972 extra_apk_files,
Alan Stokes0d1ef782022-09-27 13:46:35 +0100973 &vm_payload_config,
974 &mut vm_config,
975 )?;
Jooyung Han21e9b922021-06-26 04:14:16 +0900976
Andrew Walbrancc0db522021-07-12 17:03:42 +0000977 Ok(vm_config)
Jooyung Han21e9b922021-06-26 04:14:16 +0900978}
979
Inseob Kimff48a7c2024-02-26 22:07:21 +0900980fn check_partition_for_file(fd: &ParcelFileDescriptor) -> Result<()> {
981 let path = format!("/proc/self/fd/{}", fd.as_raw_fd());
982 let link = fs::read_link(&path).context(format!("can't read_link {path}"))?;
983
984 // microdroid vendor image is OK
985 if cfg!(vendor_modules) && link == Path::new("/vendor/etc/avf/microdroid/microdroid_vendor.img")
986 {
987 return Ok(());
988 }
989
990 if link.starts_with("/vendor") || link.starts_with("/odm") {
991 bail!("vendor or odm file {} can't be used for VM", link.display());
992 }
993
994 Ok(())
995}
996
997fn check_partitions_for_files(config: &VirtualMachineRawConfig) -> Result<()> {
998 config
999 .disks
1000 .iter()
1001 .flat_map(|disk| disk.partitions.iter())
1002 .filter_map(|partition| partition.image.as_ref())
1003 .try_for_each(check_partition_for_file)?;
1004
1005 config.kernel.as_ref().map_or(Ok(()), check_partition_for_file)?;
1006 config.initrd.as_ref().map_or(Ok(()), check_partition_for_file)?;
1007 config.bootloader.as_ref().map_or(Ok(()), check_partition_for_file)?;
1008
1009 Ok(())
1010}
1011
Alan Stokes0d1ef782022-09-27 13:46:35 +01001012fn load_vm_payload_config_from_file(apk_file: &File, config_path: &str) -> Result<VmPayloadConfig> {
1013 let mut apk_zip = ZipArchive::new(apk_file)?;
1014 let config_file = apk_zip.by_name(config_path)?;
1015 Ok(serde_json::from_reader(config_file)?)
1016}
1017
Alan Stokes8f12f2b2023-01-09 09:19:20 +00001018fn create_vm_payload_config(
1019 payload_config: &VirtualMachinePayloadConfig,
1020) -> Result<VmPayloadConfig> {
Alan Stokes0d1ef782022-09-27 13:46:35 +01001021 // There isn't an actual config file. Construct a synthetic VmPayloadConfig from the explicit
1022 // parameters we've been given. Microdroid will do something equivalent inside the VM using the
1023 // payload config that we send it via the metadata file.
Alan Stokes8f12f2b2023-01-09 09:19:20 +00001024
1025 let payload_binary_name = &payload_config.payloadBinaryName;
1026 if payload_binary_name.contains('/') {
1027 bail!("Payload binary name must not specify a path: {payload_binary_name}");
1028 }
1029
1030 let task = Task { type_: TaskType::MicrodroidLauncher, command: payload_binary_name.clone() };
Alan Stokesfda70842023-12-20 17:50:14 +00001031
1032 // The VM only cares about how many there are, these names are actually ignored.
1033 let extra_apk_count = payload_config.extraApks.len();
1034 let extra_apks =
1035 (0..extra_apk_count).map(|i| ApkConfig { path: format!("extra-apk-{i}") }).collect();
1036
Inseob Kim89b24592024-02-23 18:59:43 +09001037 Ok(VmPayloadConfig { task: Some(task), extra_apks, ..Default::default() })
Alan Stokes0d1ef782022-09-27 13:46:35 +01001038}
1039
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001040/// Generates a unique filename to use for a composite disk image.
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001041fn make_composite_image_filenames(
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001042 temporary_directory: &Path,
1043 next_temporary_image_id: &mut u64,
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001044) -> CompositeImageFilenames {
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001045 let id = *next_temporary_image_id;
1046 *next_temporary_image_id += 1;
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001047 CompositeImageFilenames {
1048 composite: temporary_directory.join(format!("composite-{}.img", id)),
1049 header: temporary_directory.join(format!("composite-{}-header.img", id)),
1050 footer: temporary_directory.join(format!("composite-{}-footer.img", id)),
1051 }
1052}
1053
1054/// Filenames for a composite disk image, including header and footer partitions.
1055#[derive(Clone, Debug, Eq, PartialEq)]
1056struct CompositeImageFilenames {
1057 /// The composite disk image itself.
1058 composite: PathBuf,
1059 /// The header partition image.
1060 header: PathBuf,
1061 /// The footer partition image.
1062 footer: PathBuf,
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001063}
1064
Jiyong Park753553b2021-07-12 21:21:09 +09001065/// Checks whether the caller has a specific permission
1066fn check_permission(perm: &str) -> binder::Result<()> {
David Brazdil1f530702022-10-03 12:18:10 +01001067 let calling_pid = get_calling_pid();
1068 let calling_uid = get_calling_uid();
Jiyong Park753553b2021-07-12 21:21:09 +09001069 // Root can do anything
1070 if calling_uid == 0 {
1071 return Ok(());
1072 }
1073 let perm_svc: Strong<dyn IPermissionController::IPermissionController> =
Frederick Mayleb2a02872024-05-08 13:35:12 -07001074 binder::wait_for_interface("permission")?;
Jiyong Park753553b2021-07-12 21:21:09 +09001075 if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? {
Andrew Walbran806f1542021-06-10 14:07:12 +00001076 Ok(())
1077 } else {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001078 Err(anyhow!("does not have the {} permission", perm))
1079 .or_binder_exception(ExceptionCode::SECURITY)
Andrew Walbran806f1542021-06-10 14:07:12 +00001080 }
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001081}
1082
Jiyong Park753553b2021-07-12 21:21:09 +09001083/// Check whether the caller of the current Binder method is allowed to manage VMs
1084fn check_manage_access() -> binder::Result<()> {
1085 check_permission("android.permission.MANAGE_VIRTUAL_MACHINE")
1086}
1087
Inseob Kim1119d702022-05-02 18:01:58 +09001088/// Check whether the caller of the current Binder method is allowed to create custom VMs
1089fn check_use_custom_virtual_machine() -> binder::Result<()> {
1090 check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE")
1091}
1092
Alan Stokes185fe112023-01-10 16:20:55 +00001093/// Return whether a partition is exempt from selinux label checks, because we know that it does
1094/// not contain code and is likely to be generated in an app-writable directory.
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001095fn is_safe_app_partition(label: &str) -> bool {
Shikha Panwara2ff8c52022-11-30 19:25:46 +00001096 // See add_microdroid_system_images & add_microdroid_payload_images in payload.rs.
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001097 label == "vm-instance"
Shikha Panwara2ff8c52022-11-30 19:25:46 +00001098 || label == "encryptedstore"
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001099 || label == "microdroid-apk-idsig"
1100 || label == "payload-metadata"
1101 || label.starts_with("extra-idsig-")
1102}
1103
Alice Wangc206b9b2023-08-28 14:13:51 +00001104/// Returns whether a partition with the given label is safe for a raw config VM.
1105fn is_safe_raw_partition(label: &str) -> bool {
1106 label == "vm-instance"
1107}
1108
Alan Stokes185fe112023-01-10 16:20:55 +00001109/// Check that a file SELinux label is acceptable.
1110///
1111/// We only want to allow code in a VM to be sourced from places that apps, and the
Seungjae Yoo2b74c442023-11-15 18:05:07 +09001112/// system or vendor, do not have write access to.
Alan Stokes185fe112023-01-10 16:20:55 +00001113///
1114/// Note that sepolicy must also grant read access for these types to both virtualization
1115/// service and crosvm.
1116///
1117/// App private data files are deliberately excluded, to avoid arbitrary payloads being run on
1118/// user devices (W^X).
1119fn check_label_is_allowed(context: &SeContext) -> Result<()> {
1120 match context.selinux_type()? {
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001121 | "apk_data_file" // APKs of an installed app
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001122 | "shell_data_file" // test files created via adb shell
Alan Stokesfe4bb0c2023-03-20 14:15:36 +00001123 | "staging_data_file" // updated/staged APEX images
1124 | "system_file" // immutable dm-verity protected partition
1125 | "virtualizationservice_data_file" // files created by VS / VirtMgr
Seungjae Yoo2b74c442023-11-15 18:05:07 +09001126 | "vendor_microdroid_file" // immutable dm-verity protected partition (/vendor/etc/avf/microdroid/.*)
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001127 => Ok(()),
Alan Stokes185fe112023-01-10 16:20:55 +00001128 _ => bail!("Label {} is not allowed", context),
Jiyong Park029977d2021-11-24 21:56:49 +09001129 }
1130}
1131
Alan Stokes185fe112023-01-10 16:20:55 +00001132fn check_label_for_partition(partition: &Partition) -> Result<()> {
1133 let file = partition.image.as_ref().unwrap().as_ref();
1134 check_label_is_allowed(&getfilecon(file)?)
1135 .with_context(|| format!("Partition {} invalid", &partition.label))
1136}
1137
1138fn check_label_for_kernel_files(kernel: &Option<File>, initrd: &Option<File>) -> Result<()> {
1139 if let Some(f) = kernel {
1140 check_label_for_file(f, "kernel")?;
1141 }
1142 if let Some(f) = initrd {
1143 check_label_for_file(f, "initrd")?;
1144 }
1145 Ok(())
1146}
1147fn check_label_for_file(file: &File, name: &str) -> Result<()> {
1148 check_label_is_allowed(&getfilecon(file)?).with_context(|| format!("{} file invalid", name))
1149}
1150
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001151/// Implementation of the AIDL `IVirtualMachine` interface. Used as a handle to a VM.
1152#[derive(Debug)]
1153struct VirtualMachine {
1154 instance: Arc<VmInstance>,
1155}
1156
1157impl VirtualMachine {
1158 fn create(instance: Arc<VmInstance>) -> Strong<dyn IVirtualMachine> {
David Brazdil4b4c5102022-12-19 22:56:20 +00001159 BnVirtualMachine::new_binder(VirtualMachine { instance }, BinderFeatures::default())
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001160 }
1161}
1162
1163impl Interface for VirtualMachine {}
1164
1165impl IVirtualMachine for VirtualMachine {
1166 fn getCid(&self) -> binder::Result<i32> {
Jiyong Park753553b2021-07-12 21:21:09 +09001167 // Don't check permission. The owner of the VM might have passed this binder object to
1168 // others.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001169 Ok(self.instance.cid as i32)
1170 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001171
Andrew Walbran6b650662021-09-07 13:13:23 +00001172 fn getState(&self) -> binder::Result<VirtualMachineState> {
Jiyong Park753553b2021-07-12 21:21:09 +09001173 // Don't check permission. The owner of the VM might have passed this binder object to
1174 // others.
Andrew Walbran6b650662021-09-07 13:13:23 +00001175 Ok(get_state(&self.instance))
Andrew Walbrandae07162021-03-12 17:05:20 +00001176 }
1177
1178 fn registerCallback(
1179 &self,
1180 callback: &Strong<dyn IVirtualMachineCallback>,
1181 ) -> binder::Result<()> {
Jiyong Park753553b2021-07-12 21:21:09 +09001182 // Don't check permission. The owner of the VM might have passed this binder object to
1183 // others.
1184 //
Andrew Walbrandae07162021-03-12 17:05:20 +00001185 // TODO: Should this give an error if the VM is already dead?
1186 self.instance.callbacks.add(callback.clone());
1187 Ok(())
1188 }
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001189
Andrew Walbranf8d94112021-09-07 11:45:36 +00001190 fn start(&self) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001191 self.instance
1192 .start()
1193 .with_context(|| format!("Error starting VM with CID {}", self.instance.cid))
1194 .with_log()
1195 .or_service_specific_exception(-1)
Andrew Walbranf8d94112021-09-07 11:45:36 +00001196 }
1197
Inseob Kima446f802022-07-11 19:46:37 +09001198 fn stop(&self) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001199 self.instance
1200 .kill()
1201 .with_context(|| format!("Error stopping VM with CID {}", self.instance.cid))
1202 .with_log()
1203 .or_service_specific_exception(-1)
Inseob Kima446f802022-07-11 19:46:37 +09001204 }
1205
Keir Frasercdd4b112022-11-24 14:02:25 +00001206 fn onTrimMemory(&self, level: MemoryTrimLevel) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001207 self.instance
1208 .trim_memory(level)
1209 .with_context(|| format!("Error trimming VM with CID {}", self.instance.cid))
1210 .with_log()
1211 .or_service_specific_exception(-1)
Keir Frasercdd4b112022-11-24 14:02:25 +00001212 }
1213
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001214 fn connectVsock(&self, port: i32) -> binder::Result<ParcelFileDescriptor> {
Andrew Walbranf8d94112021-09-07 11:45:36 +00001215 if !matches!(&*self.instance.vm_state.lock().unwrap(), VmState::Running { .. }) {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001216 return Err(anyhow!("VM is not running")).or_service_specific_exception(-1);
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001217 }
Alan Stokes10c47672022-12-13 17:17:08 +00001218 let port = port as u32;
1219 if port < 1024 {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001220 return Err(anyhow!("Can't connect to privileged port {port}"))
1221 .or_service_specific_exception(-1);
Alan Stokes10c47672022-12-13 17:17:08 +00001222 }
Jiyong Park2227eaa2023-08-04 11:59:18 +09001223 let stream = VsockStream::connect_with_cid_port(self.instance.cid, port)
1224 .context("Failed to connect")
1225 .or_service_specific_exception(-1)?;
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001226 Ok(vsock_stream_to_pfd(stream))
1227 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001228}
1229
1230impl Drop for VirtualMachine {
1231 fn drop(&mut self) {
1232 debug!("Dropping {:?}", self);
Inseob Kima446f802022-07-11 19:46:37 +09001233 if let Err(e) = self.instance.kill() {
1234 debug!("Error stopping dropped VM with CID {}: {:?}", self.instance.cid, e);
1235 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001236 }
1237}
1238
1239/// A set of Binders to be called back in response to various events on the VM, such as when it
1240/// dies.
1241#[derive(Debug, Default)]
1242pub struct VirtualMachineCallbacks(Mutex<Vec<Strong<dyn IVirtualMachineCallback>>>);
1243
1244impl VirtualMachineCallbacks {
Jiyong Park8611a6c2021-07-09 18:17:44 +09001245 /// Call all registered callbacks to notify that the payload has started.
David Brazdil451cc962022-10-14 14:08:12 +01001246 pub fn notify_payload_started(&self, cid: Cid) {
Jiyong Park8611a6c2021-07-09 18:17:44 +09001247 let callbacks = &*self.0.lock().unwrap();
Jiyong Park8611a6c2021-07-09 18:17:44 +09001248 for callback in callbacks {
David Brazdil451cc962022-10-14 14:08:12 +01001249 if let Err(e) = callback.onPayloadStarted(cid as i32) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001250 error!("Error notifying payload start event from VM CID {}: {:?}", cid, e);
Jiyong Park8611a6c2021-07-09 18:17:44 +09001251 }
1252 }
1253 }
1254
Inseob Kim14cb8692021-08-31 21:50:39 +09001255 /// Call all registered callbacks to notify that the payload is ready to serve.
1256 pub fn notify_payload_ready(&self, cid: Cid) {
1257 let callbacks = &*self.0.lock().unwrap();
1258 for callback in callbacks {
1259 if let Err(e) = callback.onPayloadReady(cid as i32) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001260 error!("Error notifying payload ready event from VM CID {}: {:?}", cid, e);
Inseob Kim14cb8692021-08-31 21:50:39 +09001261 }
1262 }
1263 }
1264
Inseob Kim2444af92021-08-31 01:22:50 +09001265 /// Call all registered callbacks to notify that the payload has finished.
1266 pub fn notify_payload_finished(&self, cid: Cid, exit_code: i32) {
1267 let callbacks = &*self.0.lock().unwrap();
1268 for callback in callbacks {
1269 if let Err(e) = callback.onPayloadFinished(cid as i32, exit_code) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001270 error!("Error notifying payload finish event from VM CID {}: {:?}", cid, e);
Inseob Kim2444af92021-08-31 01:22:50 +09001271 }
1272 }
1273 }
1274
Jooyung Handd0a1732021-11-23 15:26:20 +09001275 /// Call all registered callbacks to say that the VM encountered an error.
Alan Stokes2bead0d2022-09-05 16:58:34 +01001276 pub fn notify_error(&self, cid: Cid, error_code: ErrorCode, message: &str) {
Jooyung Handd0a1732021-11-23 15:26:20 +09001277 let callbacks = &*self.0.lock().unwrap();
1278 for callback in callbacks {
1279 if let Err(e) = callback.onError(cid as i32, error_code, message) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001280 error!("Error notifying error event from VM CID {}: {:?}", cid, e);
Jooyung Handd0a1732021-11-23 15:26:20 +09001281 }
1282 }
1283 }
1284
Andrew Walbrandae07162021-03-12 17:05:20 +00001285 /// Call all registered callbacks to say that the VM has died.
Andrew Walbranc92d35f2022-01-12 12:45:19 +00001286 pub fn callback_on_died(&self, cid: Cid, reason: DeathReason) {
Andrew Walbrandae07162021-03-12 17:05:20 +00001287 let callbacks = &*self.0.lock().unwrap();
1288 for callback in callbacks {
Andrew Walbranc92d35f2022-01-12 12:45:19 +00001289 if let Err(e) = callback.onDied(cid as i32, reason) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001290 error!("Error notifying exit of VM CID {}: {:?}", cid, e);
Andrew Walbrandae07162021-03-12 17:05:20 +00001291 }
1292 }
1293 }
1294
1295 /// Add a new callback to the set.
1296 fn add(&self, callback: Strong<dyn IVirtualMachineCallback>) {
1297 self.0.lock().unwrap().push(callback);
1298 }
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001299}
1300
Andrew Walbranf6bf6862021-05-21 12:41:13 +00001301/// The mutable state of the VirtualizationService. There should only be one instance of this
1302/// struct.
Chris Wailes641fc4a2021-12-01 15:03:21 -08001303#[derive(Debug, Default)]
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001304struct State {
Alan Stokes3e5eec12023-09-07 12:10:00 +01001305 /// The VMs which have been started. When VMs are started a weak reference is added to this
1306 /// list while a strong reference is returned to the caller over Binder. Once all copies of
1307 /// the Binder client are dropped the weak reference here will become invalid, and will be
1308 /// removed from the list opportunistically the next time `add_vm` is called.
Andrew Walbran320b5602021-03-04 16:11:12 +00001309 vms: Vec<Weak<VmInstance>>,
1310}
1311
1312impl State {
Andrew Walbrandae07162021-03-12 17:05:20 +00001313 /// Get a list of VMs which still have Binder references to them.
Andrew Walbran320b5602021-03-04 16:11:12 +00001314 fn vms(&self) -> Vec<Arc<VmInstance>> {
1315 // Attempt to upgrade the weak pointers to strong pointers.
1316 self.vms.iter().filter_map(Weak::upgrade).collect()
1317 }
1318
1319 /// Add a new VM to the list.
1320 fn add_vm(&mut self, vm: Weak<VmInstance>) {
1321 // Garbage collect any entries from the stored list which no longer exist.
1322 self.vms.retain(|vm| vm.strong_count() > 0);
1323
1324 // Actually add the new VM.
1325 self.vms.push(vm);
1326 }
David Brazdil3c2ddef2021-03-18 13:09:57 +00001327
Jiyong Park8611a6c2021-07-09 18:17:44 +09001328 /// Get a VM that corresponds to the given cid
1329 fn get_vm(&self, cid: Cid) -> Option<Arc<VmInstance>> {
1330 self.vms().into_iter().find(|vm| vm.cid == cid)
1331 }
Jiyong Parkd50a0242021-09-16 21:00:14 +09001332}
1333
Andrew Walbran6b650662021-09-07 13:13:23 +00001334/// Gets the `VirtualMachineState` of the given `VmInstance`.
1335fn get_state(instance: &VmInstance) -> VirtualMachineState {
Andrew Walbranf8d94112021-09-07 11:45:36 +00001336 match &*instance.vm_state.lock().unwrap() {
1337 VmState::NotStarted { .. } => VirtualMachineState::NOT_STARTED,
1338 VmState::Running { .. } => match instance.payload_state() {
Andrew Walbran6b650662021-09-07 13:13:23 +00001339 PayloadState::Starting => VirtualMachineState::STARTING,
1340 PayloadState::Started => VirtualMachineState::STARTED,
1341 PayloadState::Ready => VirtualMachineState::READY,
1342 PayloadState::Finished => VirtualMachineState::FINISHED,
Jiyong Parka4eebde2022-07-12 18:01:12 +09001343 PayloadState::Hangup => VirtualMachineState::DEAD,
Andrew Walbranf8d94112021-09-07 11:45:36 +00001344 },
1345 VmState::Dead => VirtualMachineState::DEAD,
1346 VmState::Failed => VirtualMachineState::DEAD,
Andrew Walbran6b650662021-09-07 13:13:23 +00001347 }
1348}
1349
David Brazdilf50c7a62023-04-19 14:22:42 +00001350/// Converts a `&ParcelFileDescriptor` to a `File` by cloning the file.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001351pub fn clone_file(file: &ParcelFileDescriptor) -> binder::Result<File> {
1352 file.as_ref()
1353 .try_clone()
1354 .context("Failed to clone File from ParcelFileDescriptor")
1355 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)
Andrei Homescu11333c62023-11-09 04:26:39 +00001356 .map(File::from)
David Brazdilf50c7a62023-04-19 14:22:42 +00001357}
1358
Andrew Walbrand3a84182021-09-07 14:48:52 +00001359/// Converts an `&Option<ParcelFileDescriptor>` to an `Option<File>` by cloning the file.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001360fn maybe_clone_file(file: &Option<ParcelFileDescriptor>) -> binder::Result<Option<File>> {
Andrew Walbrand3a84182021-09-07 14:48:52 +00001361 file.as_ref().map(clone_file).transpose()
1362}
1363
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001364/// Converts a `VsockStream` to a `ParcelFileDescriptor`.
1365fn vsock_stream_to_pfd(stream: VsockStream) -> ParcelFileDescriptor {
1366 // SAFETY: ownership is transferred from stream to f
1367 let f = unsafe { File::from_raw_fd(stream.into_raw_fd()) };
1368 ParcelFileDescriptor::new(f)
1369}
1370
Jiyong Parkdcf17412022-02-08 15:07:23 +09001371/// Parses the platform version requirement string.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001372fn parse_platform_version_req(s: &str) -> binder::Result<VersionReq> {
1373 VersionReq::parse(s)
1374 .with_context(|| format!("Invalid platform version requirement {}", s))
1375 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)
Jiyong Parkdcf17412022-02-08 15:07:23 +09001376}
1377
Jiyong Parked180932023-02-24 19:55:41 +09001378/// Create the empty ramdump file
1379fn prepare_ramdump_file(temporary_directory: &Path) -> binder::Result<File> {
1380 // `ramdump_write` is sent to crosvm and will be the backing store for the /dev/hvc1 where
1381 // VM will emit ramdump to. `ramdump_read` will be sent back to the client (i.e. the VM
1382 // owner) for readout.
1383 let ramdump_path = temporary_directory.join("ramdump");
Jiyong Park2227eaa2023-08-04 11:59:18 +09001384 let ramdump = File::create(ramdump_path)
1385 .context("Failed to prepare ramdump file")
1386 .with_log()
1387 .or_service_specific_exception(-1)?;
Jiyong Parked180932023-02-24 19:55:41 +09001388 Ok(ramdump)
1389}
1390
Nikita Ioffe5776f082023-02-10 21:38:26 +00001391fn is_protected(config: &VirtualMachineConfig) -> bool {
1392 match config {
1393 VirtualMachineConfig::RawConfig(config) => config.protectedVm,
1394 VirtualMachineConfig::AppConfig(config) => config.protectedVm,
1395 }
1396}
1397
1398fn check_gdb_allowed(config: &VirtualMachineConfig) -> binder::Result<()> {
1399 if is_protected(config) {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001400 return Err(anyhow!("Can't use gdb with protected VMs"))
1401 .or_binder_exception(ExceptionCode::SECURITY);
Nikita Ioffe5776f082023-02-10 21:38:26 +00001402 }
1403
Pierre-Clément Tosid3bbe1d2024-04-15 18:03:51 +01001404 if get_debug_level(config) == Some(DebugLevel::NONE) {
1405 return Err(anyhow!("Can't use gdb with non-debuggable VMs"))
1406 .or_binder_exception(ExceptionCode::SECURITY);
Nikita Ioffe5776f082023-02-10 21:38:26 +00001407 }
Pierre-Clément Tosid3bbe1d2024-04-15 18:03:51 +01001408
1409 Ok(())
Nikita Ioffe5776f082023-02-10 21:38:26 +00001410}
1411
Shikha Panwar61a74b52024-02-16 13:17:01 +00001412fn extract_instance_id(config: &VirtualMachineConfig) -> [u8; 64] {
1413 match config {
1414 VirtualMachineConfig::RawConfig(config) => config.instanceId,
1415 VirtualMachineConfig::AppConfig(config) => config.instanceId,
1416 }
1417}
1418
Alan Stokesc96b35e2024-05-03 13:21:20 +01001419fn extract_want_updatable(config: &VirtualMachineConfig) -> bool {
1420 match config {
1421 VirtualMachineConfig::RawConfig(_) => true,
1422 VirtualMachineConfig::AppConfig(config) => {
1423 let Some(custom) = &config.customConfig else { return true };
1424 custom.wantUpdatable
1425 }
1426 }
1427}
1428
Nikita Ioffe5776f082023-02-10 21:38:26 +00001429fn extract_gdb_port(config: &VirtualMachineConfig) -> Option<NonZeroU16> {
1430 match config {
1431 VirtualMachineConfig::RawConfig(config) => NonZeroU16::new(config.gdbPort as u16),
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +01001432 VirtualMachineConfig::AppConfig(config) => {
1433 NonZeroU16::new(config.customConfig.as_ref().map(|c| c.gdbPort).unwrap_or(0) as u16)
1434 }
Nikita Ioffe5776f082023-02-10 21:38:26 +00001435 }
1436}
1437
Nikita Ioffe631717e2023-09-05 13:38:07 +01001438fn check_no_vendor_modules(config: &VirtualMachineConfig) -> binder::Result<()> {
1439 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1440 if let Some(custom_config) = &config.customConfig {
1441 if custom_config.vendorImage.is_some() || custom_config.customKernelImage.is_some() {
1442 return Err(anyhow!("vendor modules feature is disabled"))
1443 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1444 }
1445 }
1446 Ok(())
1447}
1448
Nikita Ioffe94a8a182023-11-16 16:37:48 +00001449fn check_no_devices(config: &VirtualMachineConfig) -> binder::Result<()> {
1450 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1451 if let Some(custom_config) = &config.customConfig {
1452 if !custom_config.devices.is_empty() {
1453 return Err(anyhow!("device assignment feature is disabled"))
1454 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1455 }
1456 }
1457 Ok(())
1458}
1459
Alan Stokesfda70842023-12-20 17:50:14 +00001460fn check_no_extra_apks(config: &VirtualMachineConfig) -> binder::Result<()> {
1461 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1462 let Payload::PayloadConfig(payload_config) = &config.payload else { return Ok(()) };
1463 if !payload_config.extraApks.is_empty() {
1464 return Err(anyhow!("multi-tenant feature is disabled"))
1465 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1466 }
1467 Ok(())
1468}
1469
Nikita Ioffe631717e2023-09-05 13:38:07 +01001470fn check_config_features(config: &VirtualMachineConfig) -> binder::Result<()> {
1471 if !cfg!(vendor_modules) {
1472 check_no_vendor_modules(config)?;
1473 }
Nikita Ioffe94a8a182023-11-16 16:37:48 +00001474 if !cfg!(device_assignment) {
1475 check_no_devices(config)?;
1476 }
Alan Stokesfda70842023-12-20 17:50:14 +00001477 if !cfg!(multi_tenant) {
1478 check_no_extra_apks(config)?;
1479 }
Nikita Ioffe631717e2023-09-05 13:38:07 +01001480 Ok(())
1481}
1482
Inseob Kim0168b462022-12-27 14:54:35 +09001483fn clone_or_prepare_logger_fd(
Jaewan Kim61f86142023-03-28 15:12:52 +09001484 debug_config: &DebugConfig,
Inseob Kim0168b462022-12-27 14:54:35 +09001485 fd: Option<&ParcelFileDescriptor>,
1486 tag: String,
1487) -> Result<Option<File>, Status> {
1488 if let Some(fd) = fd {
1489 return Ok(Some(clone_file(fd)?));
1490 }
1491
Jaewan Kim61f86142023-03-28 15:12:52 +09001492 if !debug_config.should_prepare_console_output() {
Jaewan Kim66f062e2023-02-25 01:07:43 +09001493 return Ok(None);
1494 };
Inseob Kim0168b462022-12-27 14:54:35 +09001495
Frederick Maylefbbcfcd2024-04-08 16:31:54 -07001496 let (read_fd, write_fd) =
Jiyong Park2227eaa2023-08-04 11:59:18 +09001497 pipe().context("Failed to create pipe").or_service_specific_exception(-1)?;
Inseob Kim0168b462022-12-27 14:54:35 +09001498
Frederick Maylefbbcfcd2024-04-08 16:31:54 -07001499 let mut reader = BufReader::new(File::from(read_fd));
1500 let write_fd = File::from(write_fd);
Inseob Kim0168b462022-12-27 14:54:35 +09001501
1502 std::thread::spawn(move || loop {
1503 let mut buf = vec![];
1504 match reader.read_until(b'\n', &mut buf) {
1505 Ok(0) => {
1506 // EOF
1507 return;
1508 }
1509 Ok(size) => {
1510 if buf[size - 1] == b'\n' {
1511 buf.pop();
1512 }
1513 info!("{}: {}", &tag, &String::from_utf8_lossy(&buf));
1514 }
1515 Err(e) => {
1516 error!("Could not read console pipe: {:?}", e);
1517 return;
1518 }
1519 };
1520 });
1521
1522 Ok(Some(write_fd))
1523}
1524
Jooyung Han35edb8f2021-07-01 16:17:16 +09001525/// Simple utility for referencing Borrowed or Owned. Similar to std::borrow::Cow, but
1526/// it doesn't require that T implements Clone.
1527enum BorrowedOrOwned<'a, T> {
1528 Borrowed(&'a T),
1529 Owned(T),
1530}
1531
1532impl<'a, T> AsRef<T> for BorrowedOrOwned<'a, T> {
1533 fn as_ref(&self) -> &T {
1534 match self {
1535 Self::Borrowed(b) => b,
Chris Wailes68c39f82021-07-27 16:03:44 -07001536 Self::Owned(o) => o,
Jooyung Han35edb8f2021-07-01 16:17:16 +09001537 }
1538 }
1539}
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001540
1541/// Implementation of `IVirtualMachineService`, the entry point of the AIDL service.
1542#[derive(Debug, Default)]
1543struct VirtualMachineService {
1544 state: Arc<Mutex<State>>,
Inseob Kimc7d28c72021-10-25 14:28:10 +00001545 cid: Cid,
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001546}
1547
1548impl Interface for VirtualMachineService {}
1549
1550impl IVirtualMachineService for VirtualMachineService {
Inseob Kimc7d28c72021-10-25 14:28:10 +00001551 fn notifyPayloadStarted(&self) -> binder::Result<()> {
1552 let cid = self.cid;
Inseob Kim7f61fe72021-08-20 20:50:47 +09001553 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001554 info!("VM with CID {} started payload", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001555 vm.update_payload_state(PayloadState::Started)
1556 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
David Brazdil451cc962022-10-14 14:08:12 +01001557 vm.callbacks.notify_payload_started(cid);
Seungjae Yoo62085c02022-08-12 04:44:52 +00001558
Seungjae Yoo6d265d92022-11-15 10:51:33 +09001559 let vm_start_timestamp = vm.vm_metric.lock().unwrap().start_timestamp;
1560 write_vm_booted_stats(vm.requester_uid as i32, &vm.name, vm_start_timestamp);
Inseob Kim7f61fe72021-08-20 20:50:47 +09001561 Ok(())
1562 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001563 error!("notifyPayloadStarted is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001564 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001565 }
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001566 }
Inseob Kim2444af92021-08-31 01:22:50 +09001567
Inseob Kimc7d28c72021-10-25 14:28:10 +00001568 fn notifyPayloadReady(&self) -> binder::Result<()> {
1569 let cid = self.cid;
Inseob Kim14cb8692021-08-31 21:50:39 +09001570 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001571 info!("VM with CID {} reported payload is ready", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001572 vm.update_payload_state(PayloadState::Ready)
1573 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Inseob Kim14cb8692021-08-31 21:50:39 +09001574 vm.callbacks.notify_payload_ready(cid);
1575 Ok(())
1576 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001577 error!("notifyPayloadReady is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001578 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim14cb8692021-08-31 21:50:39 +09001579 }
1580 }
1581
Inseob Kimc7d28c72021-10-25 14:28:10 +00001582 fn notifyPayloadFinished(&self, exit_code: i32) -> binder::Result<()> {
1583 let cid = self.cid;
Inseob Kim2444af92021-08-31 01:22:50 +09001584 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001585 info!("VM with CID {} finished payload", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001586 vm.update_payload_state(PayloadState::Finished)
1587 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Inseob Kim2444af92021-08-31 01:22:50 +09001588 vm.callbacks.notify_payload_finished(cid, exit_code);
1589 Ok(())
1590 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001591 error!("notifyPayloadFinished is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001592 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Jooyung Handd0a1732021-11-23 15:26:20 +09001593 }
1594 }
1595
Alan Stokes2bead0d2022-09-05 16:58:34 +01001596 fn notifyError(&self, error_code: ErrorCode, message: &str) -> binder::Result<()> {
Jooyung Handd0a1732021-11-23 15:26:20 +09001597 let cid = self.cid;
1598 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001599 info!("VM with CID {} encountered an error", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001600 vm.update_payload_state(PayloadState::Finished)
1601 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Jooyung Handd0a1732021-11-23 15:26:20 +09001602 vm.callbacks.notify_error(cid, error_code, message);
1603 Ok(())
1604 } else {
Seungjae Yooec8c1602022-06-20 05:28:00 +00001605 error!("notifyError is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001606 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim2444af92021-08-31 01:22:50 +09001607 }
1608 }
Alice Wangc2fec932023-02-23 16:24:02 +00001609
Shikha Panware45e9422024-02-28 21:18:10 +00001610 fn getSecretkeeper(&self) -> binder::Result<Strong<dyn ISecretkeeper>> {
1611 if !is_secretkeeper_supported() {
1612 return Err(StatusCode::NAME_NOT_FOUND)?;
1613 }
1614 let sk = binder::wait_for_interface(SECRETKEEPER_IDENTIFIER)?;
1615 Ok(BnSecretkeeper::new_binder(SecretkeeperProxy(sk), BinderFeatures::default()))
Shikha Panwar5d6a6752023-12-14 22:08:26 +00001616 }
1617
Alice Wange64dd182024-01-17 15:57:55 +00001618 fn requestAttestation(&self, csr: &[u8], test_mode: bool) -> binder::Result<Vec<Certificate>> {
1619 GLOBAL_SERVICE.requestAttestation(csr, get_calling_uid() as i32, test_mode)
Alice Wangc2fec932023-02-23 16:24:02 +00001620 }
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001621}
1622
Shikha Panwar8707f0f2024-02-28 20:40:42 +00001623fn is_secretkeeper_supported() -> bool {
Shikha Panwar81d13d32024-03-10 19:39:23 +00001624 binder::is_declared(SECRETKEEPER_IDENTIFIER)
1625 .expect("Could not check for declared Secretkeeper interface")
Shikha Panwar8187ca22024-01-04 08:33:08 +00001626}
1627
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001628impl VirtualMachineService {
Inseob Kimc7d28c72021-10-25 14:28:10 +00001629 fn new_binder(state: Arc<Mutex<State>>, cid: Cid) -> Strong<dyn IVirtualMachineService> {
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001630 BnVirtualMachineService::new_binder(
Inseob Kimc7d28c72021-10-25 14:28:10 +00001631 VirtualMachineService { state, cid },
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001632 BinderFeatures::default(),
1633 )
1634 }
1635}
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001636
Stephen Hines4c1e2fc2024-02-09 16:34:47 -08001637struct SecretkeeperProxy(Strong<dyn ISecretkeeper>);
1638
1639impl Interface for SecretkeeperProxy {}
1640
1641impl ISecretkeeper for SecretkeeperProxy {
1642 fn processSecretManagementRequest(&self, req: &[u8]) -> binder::Result<Vec<u8>> {
1643 // Pass the request to the channel, and read the response.
1644 self.0.processSecretManagementRequest(req)
1645 }
1646
1647 fn getAuthGraphKe(&self) -> binder::Result<Strong<dyn IAuthGraphKeyExchange>> {
1648 let ag = AuthGraphKeyExchangeProxy(self.0.getAuthGraphKe()?);
1649 Ok(BnAuthGraphKeyExchange::new_binder(ag, BinderFeatures::default()))
1650 }
1651
1652 fn deleteIds(&self, ids: &[SecretId]) -> binder::Result<()> {
1653 self.0.deleteIds(ids)
1654 }
1655
1656 fn deleteAll(&self) -> binder::Result<()> {
1657 self.0.deleteAll()
1658 }
1659}
1660
1661struct AuthGraphKeyExchangeProxy(Strong<dyn IAuthGraphKeyExchange>);
1662
1663impl Interface for AuthGraphKeyExchangeProxy {}
1664
1665impl IAuthGraphKeyExchange for AuthGraphKeyExchangeProxy {
1666 fn create(&self) -> binder::Result<SessionInitiationInfo> {
1667 self.0.create()
1668 }
1669
1670 fn init(
1671 &self,
1672 peer_pub_key: &PubKey,
1673 peer_id: &Identity,
1674 peer_nonce: &[u8],
1675 peer_version: i32,
1676 ) -> binder::Result<KeInitResult> {
1677 self.0.init(peer_pub_key, peer_id, peer_nonce, peer_version)
1678 }
1679
1680 fn finish(
1681 &self,
1682 peer_pub_key: &PubKey,
1683 peer_id: &Identity,
1684 peer_signature: &SessionIdSignature,
1685 peer_nonce: &[u8],
1686 peer_version: i32,
1687 own_key: &Key,
1688 ) -> binder::Result<SessionInfo> {
1689 self.0.finish(peer_pub_key, peer_id, peer_signature, peer_nonce, peer_version, own_key)
1690 }
1691
1692 fn authenticationComplete(
1693 &self,
1694 peer_signature: &SessionIdSignature,
1695 shared_keys: &[AuthgraphArc; 2],
1696 ) -> binder::Result<[AuthgraphArc; 2]> {
1697 self.0.authenticationComplete(peer_signature, shared_keys)
1698 }
1699}
1700
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001701#[cfg(test)]
1702mod tests {
1703 use super::*;
1704
1705 #[test]
1706 fn test_is_allowed_label_for_partition() -> Result<()> {
1707 let expected_results = vec![
1708 ("u:object_r:system_file:s0", true),
1709 ("u:object_r:apk_data_file:s0", true),
1710 ("u:object_r:app_data_file:s0", false),
1711 ("u:object_r:app_data_file:s0:c512,c768", false),
1712 ("u:object_r:privapp_data_file:s0:c512,c768", false),
1713 ("invalid", false),
1714 ("user:role:apk_data_file:severity:categories", true),
1715 ("user:role:apk_data_file:severity:categories:extraneous", false),
1716 ];
1717
1718 for (label, expected_valid) in expected_results {
1719 let context = SeContext::new(label)?;
1720 let result = check_label_is_allowed(&context);
1721 if expected_valid {
1722 assert!(result.is_ok(), "Expected label {} to be allowed, got {:?}", label, result);
1723 } else if result.is_ok() {
1724 bail!("Expected label {} to be disallowed", label);
1725 }
1726 }
1727 Ok(())
1728 }
Nikita Ioffef1ce9872022-12-09 13:31:59 +00001729
1730 #[test]
1731 fn test_create_or_update_idsig_file_empty_apk() -> Result<()> {
1732 let apk = tempfile::tempfile().unwrap();
1733 let idsig = tempfile::tempfile().unwrap();
1734
1735 let ret = create_or_update_idsig_file(
1736 &ParcelFileDescriptor::new(apk),
1737 &ParcelFileDescriptor::new(idsig),
1738 );
1739 assert!(ret.is_err(), "should fail");
1740 Ok(())
1741 }
1742
1743 #[test]
1744 fn test_create_or_update_idsig_dir_instead_of_file_for_apk() -> Result<()> {
1745 let tmp_dir = tempfile::TempDir::new().unwrap();
1746 let apk = File::open(tmp_dir.path()).unwrap();
1747 let idsig = tempfile::tempfile().unwrap();
1748
1749 let ret = create_or_update_idsig_file(
1750 &ParcelFileDescriptor::new(apk),
1751 &ParcelFileDescriptor::new(idsig),
1752 );
1753 assert!(ret.is_err(), "should fail");
1754 Ok(())
1755 }
1756
1757 /// Verifies that create_or_update_idsig_file won't oom if a fd that corresponds to a directory
1758 /// on ext4 filesystem is passed.
1759 /// On ext4 lseek on a directory fd will return (off_t)-1 (see:
1760 /// https://bugzilla.kernel.org/show_bug.cgi?id=200043), which will result in
1761 /// create_or_update_idsig_file ooming while attempting to allocate petabytes of memory.
1762 #[test]
1763 fn test_create_or_update_idsig_does_not_crash_dir_on_ext4() -> Result<()> {
1764 // APEXes are backed by the ext4.
1765 let apk = File::open("/apex/com.android.virt/").unwrap();
1766 let idsig = tempfile::tempfile().unwrap();
1767
1768 let ret = create_or_update_idsig_file(
1769 &ParcelFileDescriptor::new(apk),
1770 &ParcelFileDescriptor::new(idsig),
1771 );
1772 assert!(ret.is_err(), "should fail");
1773 Ok(())
1774 }
Jiyong Park8d192952023-06-26 14:29:51 +09001775
1776 #[test]
1777 fn test_create_or_update_idsig_does_not_update_if_already_valid() -> Result<()> {
1778 use std::io::Seek;
1779
1780 // Pick any APK
1781 let mut apk = File::open("/system/priv-app/Shell/Shell.apk").unwrap();
1782 let mut idsig = tempfile::tempfile().unwrap();
1783
1784 create_or_update_idsig_file(
1785 &ParcelFileDescriptor::new(apk.try_clone()?),
1786 &ParcelFileDescriptor::new(idsig.try_clone()?),
1787 )?;
1788 let modified_orig = idsig.metadata()?.modified()?;
1789 apk.rewind()?;
1790 idsig.rewind()?;
1791
1792 // Call the function again
1793 create_or_update_idsig_file(
1794 &ParcelFileDescriptor::new(apk.try_clone()?),
1795 &ParcelFileDescriptor::new(idsig.try_clone()?),
1796 )?;
1797 let modified_new = idsig.metadata()?.modified()?;
1798 assert!(modified_orig == modified_new, "idsig file was updated unnecessarily");
1799 Ok(())
1800 }
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01001801
1802 #[test]
Shikha Panwar9ae2e622024-01-30 12:22:30 +00001803 fn test_create_or_update_idsig_on_non_empty_file() -> Result<()> {
1804 use std::io::Read;
1805
1806 // Pick any APK
1807 let mut apk = File::open("/system/priv-app/Shell/Shell.apk").unwrap();
1808 let idsig_empty = tempfile::tempfile().unwrap();
1809 let mut idsig_invalid = tempfile::tempfile().unwrap();
1810 idsig_invalid.write_all(b"Oops")?;
1811
1812 // Create new idsig
1813 create_or_update_idsig_file(
1814 &ParcelFileDescriptor::new(apk.try_clone()?),
1815 &ParcelFileDescriptor::new(idsig_empty.try_clone()?),
1816 )?;
1817 apk.rewind()?;
1818
1819 // Update idsig_invalid
1820 create_or_update_idsig_file(
1821 &ParcelFileDescriptor::new(apk.try_clone()?),
1822 &ParcelFileDescriptor::new(idsig_invalid.try_clone()?),
1823 )?;
1824
1825 // Ensure the 2 idsig files have same size!
1826 assert!(
1827 idsig_empty.metadata()?.len() == idsig_invalid.metadata()?.len(),
1828 "idsig files differ in size"
1829 );
1830 // Ensure the 2 idsig files have same content!
1831 for (b1, b2) in idsig_empty.bytes().zip(idsig_invalid.bytes()) {
1832 assert!(b1.unwrap() == b2.unwrap(), "idsig files differ")
1833 }
1834 Ok(())
1835 }
1836 #[test]
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01001837 fn test_append_kernel_param_first_param() {
1838 let mut vm_config = VirtualMachineRawConfig { ..Default::default() };
1839 append_kernel_param("foo=1", &mut vm_config);
1840 assert_eq!(vm_config.params, Some("foo=1".to_owned()))
1841 }
1842
1843 #[test]
1844 fn test_append_kernel_param() {
1845 let mut vm_config =
1846 VirtualMachineRawConfig { params: Some("foo=5".to_owned()), ..Default::default() };
1847 append_kernel_param("bar=42", &mut vm_config);
1848 assert_eq!(vm_config.params, Some("foo=5 bar=42".to_owned()))
1849 }
Seungjae Yooec3bc522023-11-09 10:14:30 +09001850
Inseob Kim46257382024-01-03 15:41:22 +09001851 fn test_extract_os_name_from_config_path(
1852 path: &Path,
1853 expected_result: Option<&str>,
1854 ) -> Result<()> {
1855 let result = extract_os_name_from_config_path(path);
1856 if result.as_deref() != expected_result {
1857 bail!("Expected {:?} but was {:?}", expected_result, &result)
1858 }
1859 Ok(())
1860 }
1861
1862 #[test]
1863 fn test_extract_os_name_from_microdroid_config() -> Result<()> {
1864 test_extract_os_name_from_config_path(
1865 Path::new("/apex/com.android.virt/etc/microdroid.json"),
1866 Some("microdroid"),
1867 )
1868 }
1869
1870 #[test]
1871 fn test_extract_os_name_from_microdroid_gki_config() -> Result<()> {
1872 test_extract_os_name_from_config_path(
1873 Path::new("/apex/com.android.virt/etc/microdroid_gki-android14-6.1.json"),
1874 Some("microdroid_gki-android14-6.1"),
1875 )
1876 }
1877
1878 #[test]
1879 fn test_extract_os_name_from_invalid_path() -> Result<()> {
1880 test_extract_os_name_from_config_path(
1881 Path::new("/apex/com.android.virt/etc/microdroid.img"),
1882 None,
1883 )
1884 }
1885
1886 #[test]
1887 fn test_extract_os_name_from_configs() -> Result<()> {
1888 let tmp_dir = tempfile::TempDir::new()?;
1889 let tmp_dir_path = tmp_dir.path().to_owned();
1890
1891 let mut os_names: HashSet<String> = HashSet::new();
1892 os_names.insert("microdroid".to_owned());
1893 os_names.insert("microdroid_gki-android14-6.1".to_owned());
1894 os_names.insert("microdroid_gki-android15-6.1".to_owned());
1895
1896 // config files
1897 for os_name in &os_names {
1898 std::fs::write(tmp_dir_path.join(os_name.to_owned() + ".json"), b"")?;
1899 }
1900
1901 // fake files not related to configs
1902 std::fs::write(tmp_dir_path.join("microdroid_super.img"), b"")?;
1903 std::fs::write(tmp_dir_path.join("microdroid_foobar.apk"), b"")?;
1904
1905 let glob_pattern = match tmp_dir_path.join("microdroid*.json").to_str() {
1906 Some(s) => s.to_owned(),
1907 None => bail!("tmp_dir_path {:?} is not UTF-8", tmp_dir_path),
1908 };
1909
1910 let result = extract_os_names_from_configs(&glob_pattern)?;
1911 if result != os_names {
1912 bail!("Expected {:?} but was {:?}", os_names, result);
1913 }
1914 Ok(())
1915 }
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001916}