blob: 762a1494626f14d3803c0fd74a6916e49bbb6b5d [file] [log] [blame]
Jooyung Han347d9f22021-05-28 00:05:14 +09001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Microdroid Manager
16
Andrew Sculld64ae7d2022-10-05 17:41:43 +000017mod dice;
Jiyong Park21ce2c52021-08-28 02:32:17 +090018mod instance;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090019mod ioutil;
Jooyung Han7a343f92021-09-08 22:53:11 +090020mod payload;
Keir Fraser933f0ac2022-10-12 08:23:28 +000021mod swap;
Alice Wang59a9e562022-10-04 15:24:10 +000022mod vm_payload_service;
Jooyung Han347d9f22021-05-28 00:05:14 +090023
Andrew Sculld64ae7d2022-10-05 17:41:43 +000024use crate::dice::{DiceContext, DiceDriver};
Inseob Kime379e7d2022-07-22 18:55:18 +090025use crate::instance::{ApexData, ApkData, InstanceDisk, MicrodroidData, RootHash};
Alice Wang59a9e562022-10-04 15:24:10 +000026use crate::vm_payload_service::register_vm_payload_service;
Alan Stokes2bead0d2022-09-05 16:58:34 +010027use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::ErrorCode::ErrorCode;
Seungjae Yoodd91f0f2022-11-09 15:25:21 +090028use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{
David Brazdil451cc962022-10-14 14:08:12 +010029 IVirtualMachineService, VM_BINDER_SERVICE_PORT,
Alan Stokes2bead0d2022-09-05 16:58:34 +010030};
Alice Wang6bbb6da2022-10-26 12:44:06 +000031use android_system_virtualization_payload::aidl::android::system::virtualization::payload::IVmPayloadService::VM_APK_CONTENTS_PATH;
Jooyung Handd0a1732021-11-23 15:26:20 +090032use anyhow::{anyhow, bail, ensure, Context, Error, Result};
Alice Wang1bf3d782022-09-28 07:56:36 +000033use apkverify::{get_public_key_der, verify, V4Signature};
Alice Wang43c884b2022-10-24 09:42:40 +000034use binder::Strong;
Alan Stokes1f417c92022-09-29 15:13:28 +010035use diced_utils::cbor::{encode_header, encode_number};
Inseob Kim197748b2021-12-01 19:49:00 +090036use glob::glob;
Inseob Kim197748b2021-12-01 19:49:00 +090037use itertools::sorted;
David Brazdila07a1792022-10-25 13:37:57 +010038use libc::VMADDR_CID_HOST;
Andrew Scull684590f2022-01-27 16:14:26 +000039use log::{error, info};
Alan Stokes0d1ef782022-09-27 13:46:35 +010040use microdroid_metadata::{write_metadata, Metadata, PayloadMetadata};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090041use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080042use nix::sys::signal::Signal;
Andrew Sculla0d1b1a2022-05-24 19:32:47 +000043use openssl::sha::Sha512;
Jooyung Han4a9b3bf2021-09-10 17:19:00 +090044use payload::{get_apex_data_from_payload, load_metadata, to_metadata};
Andrew Scull34916a72022-01-30 21:34:24 +000045use rand::Fill;
Andrew Walbran7eb5ca42022-08-08 15:33:34 +000046use rpcbinder::get_vsock_rpc_interface;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090047use rustutils::system_properties;
Joel Galenson482704c2021-07-29 15:53:53 -070048use rustutils::system_properties::PropertyWatcher;
Alan Stokes3ba10fd2022-10-06 15:46:51 +010049use std::borrow::Cow::{Borrowed, Owned};
Andrew Scullb2f44472022-01-21 14:41:34 +000050use std::convert::TryInto;
Inseob Kim7ff121c2022-11-14 18:13:23 +090051use std::env;
David Brazdil451cc962022-10-14 14:08:12 +010052use std::fs::{self, create_dir, OpenOptions};
Inseob Kim11f40d02022-06-13 17:16:00 +090053use std::io::Write;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080054use std::os::unix::process::ExitStatusExt;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090055use std::path::Path;
Inseob Kim217038e2021-11-25 11:15:06 +090056use std::process::{Child, Command, Stdio};
Jiyong Park8611a6c2021-07-09 18:17:44 +090057use std::str;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090058use std::time::{Duration, SystemTime};
Jooyung Han634e2d72021-06-10 16:27:38 +090059
60const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
Inseob Kim197748b2021-12-01 19:49:00 +090061const MAIN_APK_PATH: &str = "/dev/block/by-name/microdroid-apk";
62const MAIN_APK_IDSIG_PATH: &str = "/dev/block/by-name/microdroid-apk-idsig";
63const MAIN_APK_DEVICE_NAME: &str = "microdroid-apk";
64const EXTRA_APK_PATH_PATTERN: &str = "/dev/block/by-name/extra-apk-*";
65const EXTRA_IDSIG_PATH_PATTERN: &str = "/dev/block/by-name/extra-idsig-*";
Jooyung Han19c1d6c2021-08-06 14:08:16 +090066const DM_MOUNTED_APK_PATH: &str = "/dev/block/mapper/microdroid-apk";
Inseob Kim217038e2021-11-25 11:15:06 +090067const APKDMVERITY_BIN: &str = "/system/bin/apkdmverity";
68const ZIPFUSE_BIN: &str = "/system/bin/zipfuse";
Andrew Scullab72ec52022-03-14 09:10:52 +000069const AVF_STRICT_BOOT: &str = "/sys/firmware/devicetree/base/chosen/avf,strict-boot";
70const AVF_NEW_INSTANCE: &str = "/sys/firmware/devicetree/base/chosen/avf,new-instance";
Inseob Kime379e7d2022-07-22 18:55:18 +090071const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str =
72 "/sys/firmware/devicetree/base/virtualization/guest/debug-microdroid,no-verified-boot";
Jooyung Han347d9f22021-05-28 00:05:14 +090073
Jiyong Parkbb4a9872021-09-06 15:59:21 +090074const APEX_CONFIG_DONE_PROP: &str = "apex_config.done";
Andrew Scull65ddfc42022-02-14 21:03:58 +000075const APP_DEBUGGABLE_PROP: &str = "ro.boot.microdroid.app_debuggable";
Alan Stokes60f82202022-10-07 16:40:07 +010076const APK_MOUNT_DONE_PROP: &str = "microdroid_manager.apk.mounted";
Jiyong Parkbb4a9872021-09-06 15:59:21 +090077
Inseob Kim11f40d02022-06-13 17:16:00 +090078// SYNC WITH virtualizationservice/src/crosvm.rs
79const FAILURE_SERIAL_DEVICE: &str = "/dev/ttyS1";
80
Jooyung Handd0a1732021-11-23 15:26:20 +090081#[derive(thiserror::Error, Debug)]
82enum MicrodroidError {
Inseob Kim11f40d02022-06-13 17:16:00 +090083 #[error("Cannot connect to virtualization service: {0}")]
84 FailedToConnectToVirtualizationService(String),
Jooyung Handd0a1732021-11-23 15:26:20 +090085 #[error("Payload has changed: {0}")]
86 PayloadChanged(String),
87 #[error("Payload verification has failed: {0}")]
88 PayloadVerificationFailed(String),
Jooyung Han5c6d4172021-12-06 14:17:52 +090089 #[error("Payload config is invalid: {0}")]
90 InvalidConfig(String),
Jooyung Handd0a1732021-11-23 15:26:20 +090091}
92
Alan Stokes2bead0d2022-09-05 16:58:34 +010093fn translate_error(err: &Error) -> (ErrorCode, String) {
Jooyung Handd0a1732021-11-23 15:26:20 +090094 if let Some(e) = err.downcast_ref::<MicrodroidError>() {
95 match e {
Alan Stokes2bead0d2022-09-05 16:58:34 +010096 MicrodroidError::PayloadChanged(msg) => (ErrorCode::PAYLOAD_CHANGED, msg.to_string()),
Jooyung Handd0a1732021-11-23 15:26:20 +090097 MicrodroidError::PayloadVerificationFailed(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +010098 (ErrorCode::PAYLOAD_VERIFICATION_FAILED, msg.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +090099 }
Alan Stokes2bead0d2022-09-05 16:58:34 +0100100 MicrodroidError::InvalidConfig(msg) => {
101 (ErrorCode::PAYLOAD_CONFIG_INVALID, msg.to_string())
102 }
Inseob Kim11f40d02022-06-13 17:16:00 +0900103
104 // Connection failure won't be reported to VS; return the default value
105 MicrodroidError::FailedToConnectToVirtualizationService(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100106 (ErrorCode::UNKNOWN, msg.to_string())
Inseob Kim11f40d02022-06-13 17:16:00 +0900107 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900108 }
109 } else {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100110 (ErrorCode::UNKNOWN, err.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900111 }
112}
113
Inseob Kim11f40d02022-06-13 17:16:00 +0900114fn write_death_reason_to_serial(err: &Error) -> Result<()> {
115 let death_reason = if let Some(e) = err.downcast_ref::<MicrodroidError>() {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100116 Borrowed(match e {
Inseob Kim11f40d02022-06-13 17:16:00 +0900117 MicrodroidError::FailedToConnectToVirtualizationService(_) => {
118 "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE"
119 }
120 MicrodroidError::PayloadChanged(_) => "MICRODROID_PAYLOAD_HAS_CHANGED",
121 MicrodroidError::PayloadVerificationFailed(_) => {
122 "MICRODROID_PAYLOAD_VERIFICATION_FAILED"
123 }
124 MicrodroidError::InvalidConfig(_) => "MICRODROID_INVALID_PAYLOAD_CONFIG",
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100125 })
Inseob Kim11f40d02022-06-13 17:16:00 +0900126 } else {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100127 // Send context information back after a separator, to ease diagnosis.
128 // These errors occur before the payload runs, so this should not leak sensitive
129 // information.
130 Owned(format!("MICRODROID_UNKNOWN_RUNTIME_ERROR|{:?}", err))
Inseob Kim11f40d02022-06-13 17:16:00 +0900131 };
132
133 let death_reason_bytes = death_reason.as_bytes();
134 let mut sent_total = 0;
135 while sent_total < death_reason_bytes.len() {
136 // TODO(b/220071963): Sometimes, sending more than 16 bytes at once makes MM hang.
137 let begin = sent_total;
138 let end = std::cmp::min(begin.saturating_add(16), death_reason_bytes.len());
139 OpenOptions::new()
140 .read(false)
141 .write(true)
142 .open(FAILURE_SERIAL_DEVICE)?
143 .write_all(&death_reason_bytes[begin..end])?;
144 sent_total = end;
145 }
146
147 Ok(())
148}
149
Inseob Kim1b95f2e2021-08-19 13:17:40 +0900150fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> {
Andrew Walbran7eb5ca42022-08-08 15:33:34 +0000151 get_vsock_rpc_interface(VMADDR_CID_HOST, VM_BINDER_SERVICE_PORT as u32)
Andrew Walbranc4ce7872022-07-29 11:26:41 +0000152 .context("Cannot connect to RPC service")
Inseob Kim1b95f2e2021-08-19 13:17:40 +0900153}
154
Inseob Kim437f1052022-06-21 11:30:22 +0900155fn main() -> Result<()> {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900156 // If debuggable, print full backtrace to console log with stdio_to_kmsg
157 if system_properties::read_bool(APP_DEBUGGABLE_PROP, true)? {
158 env::set_var("RUST_BACKTRACE", "full");
159 }
160
Inseob Kim437f1052022-06-21 11:30:22 +0900161 scopeguard::defer! {
162 info!("Shutting down...");
Jooyung Hanbfe086f2021-10-28 10:15:45 +0900163 if let Err(e) = system_properties::write("sys.powerctl", "shutdown") {
164 error!("failed to shutdown {:?}", e);
165 }
Jooyung Han311b1202021-09-14 22:00:16 +0900166 }
Inseob Kim437f1052022-06-21 11:30:22 +0900167
168 try_main().map_err(|e| {
169 error!("Failed with {:?}.", e);
170 if let Err(e) = write_death_reason_to_serial(&e) {
171 error!("Failed to write death reason {:?}", e);
172 }
173 e
174 })
Jooyung Han311b1202021-09-14 22:00:16 +0900175}
176
177fn try_main() -> Result<()> {
Andrew Sculle127cff2022-02-15 15:34:04 +0000178 let _ = kernlog::init();
Jooyung Han347d9f22021-05-28 00:05:14 +0900179 info!("started.");
180
Jiyong Park202856e2022-08-22 16:04:26 +0900181 load_crashkernel_if_supported().context("Failed to load crashkernel")?;
182
Keir Fraser933f0ac2022-10-12 08:23:28 +0000183 swap::init_swap().context("Failed to initialise swap")?;
184 info!("swap enabled.");
185
Inseob Kim11f40d02022-06-13 17:16:00 +0900186 let service = get_vms_rpc_binder()
187 .context("cannot connect to VirtualMachineService")
188 .map_err(|e| MicrodroidError::FailedToConnectToVirtualizationService(e.to_string()))?;
Seungjae Yoofd9a0622022-10-14 10:01:29 +0900189
Jooyung Han5c6d4172021-12-06 14:17:52 +0900190 match try_run_payload(&service) {
191 Ok(code) => {
192 info!("notifying payload finished");
193 service.notifyPayloadFinished(code)?;
194 if code == 0 {
195 info!("task successfully finished");
196 } else {
197 error!("task exited with exit code: {}", code);
198 }
199 Ok(())
200 }
201 Err(err) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900202 let (error_code, message) = translate_error(&err);
203 service.notifyError(error_code, &message)?;
204 Err(err)
205 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900206 }
207}
208
Alan Stokes1f417c92022-09-29 15:13:28 +0100209fn dice_derivation(
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000210 dice: DiceDriver,
Alan Stokes1f417c92022-09-29 15:13:28 +0100211 verified_data: &MicrodroidData,
212 payload_metadata: &PayloadMetadata,
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000213) -> Result<DiceContext> {
Andrew Scullb2f44472022-01-21 14:41:34 +0000214 // Calculate compound digests of code and authorities
Andrew Sculla0d1b1a2022-05-24 19:32:47 +0000215 let mut code_hash_ctx = Sha512::new();
216 let mut authority_hash_ctx = Sha512::new();
Andrew Scullb2f44472022-01-21 14:41:34 +0000217 code_hash_ctx.update(verified_data.apk_data.root_hash.as_ref());
218 authority_hash_ctx.update(verified_data.apk_data.pubkey.as_ref());
Inseob Kimb2519c52022-04-14 02:10:09 +0900219 for extra_apk in &verified_data.extra_apks_data {
Andrew Scullb2f44472022-01-21 14:41:34 +0000220 code_hash_ctx.update(extra_apk.root_hash.as_ref());
221 authority_hash_ctx.update(extra_apk.pubkey.as_ref());
222 }
Inseob Kimb2519c52022-04-14 02:10:09 +0900223 for apex in &verified_data.apex_data {
Andrew Scullb2f44472022-01-21 14:41:34 +0000224 code_hash_ctx.update(apex.root_digest.as_ref());
225 authority_hash_ctx.update(apex.public_key.as_ref());
226 }
Andrew Sculla0d1b1a2022-05-24 19:32:47 +0000227 let code_hash = code_hash_ctx.finish();
228 let authority_hash = authority_hash_ctx.finish();
Andrew Scullb2f44472022-01-21 14:41:34 +0000229
230 // {
231 // -70002: "Microdroid payload",
Alan Stokes1f417c92022-09-29 15:13:28 +0100232 // ? -71000: tstr // payload_config_path
233 // ? -71001: PayloadConfig
Andrew Scullb2f44472022-01-21 14:41:34 +0000234 // }
Alan Stokes1f417c92022-09-29 15:13:28 +0100235 // PayloadConfig = {
236 // 1: tstr // payload_binary_path
Alan Stokes1f417c92022-09-29 15:13:28 +0100237 // }
238
Andrew Scullb2f44472022-01-21 14:41:34 +0000239 let mut config_desc = vec![
Alan Stokes1f417c92022-09-29 15:13:28 +0100240 0xa2, // map(2)
241 0x3a, 0x00, 0x01, 0x11, 0x71, // -70002
242 0x72, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x64, 0x72, 0x6f, 0x69, 0x64, 0x20, 0x70, 0x61, 0x79,
243 0x6c, 0x6f, 0x61, 0x64, // "Microdroid payload"
Andrew Scullb2f44472022-01-21 14:41:34 +0000244 ];
Alan Stokes1f417c92022-09-29 15:13:28 +0100245
246 match payload_metadata {
247 PayloadMetadata::config_path(payload_config_path) => {
248 encode_negative_number(-71000, &mut config_desc)?;
249 encode_tstr(payload_config_path, &mut config_desc)?;
250 }
251 PayloadMetadata::config(payload_config) => {
252 encode_negative_number(-71001, &mut config_desc)?;
253 encode_header(5, 1, &mut config_desc)?; // map(1)
254 encode_number(1, &mut config_desc)?;
255 encode_tstr(&payload_config.payload_binary_path, &mut config_desc)?;
256 }
257 }
Andrew Scullb2f44472022-01-21 14:41:34 +0000258
Andrew Scull65ddfc42022-02-14 21:03:58 +0000259 // Check app debuggability, conervatively assuming it is debuggable
260 let app_debuggable = system_properties::read_bool(APP_DEBUGGABLE_PROP, true)?;
261
Andrew Scullb2f44472022-01-21 14:41:34 +0000262 // Send the details to diced
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000263 let hidden = verified_data.salt.clone().try_into().unwrap();
264 dice.derive(code_hash, &config_desc, authority_hash, app_debuggable, hidden)
Andrew Scullb2f44472022-01-21 14:41:34 +0000265}
266
Alan Stokes1f417c92022-09-29 15:13:28 +0100267fn encode_tstr(tstr: &str, buffer: &mut Vec<u8>) -> Result<()> {
268 let bytes = tstr.as_bytes();
269 encode_header(3, bytes.len().try_into().unwrap(), buffer)?;
270 buffer.extend_from_slice(bytes);
271 Ok(())
272}
273
274fn encode_negative_number(n: i64, buffer: &mut dyn Write) -> Result<()> {
275 ensure!(n < 0);
276 let n = -1 - n;
277 encode_header(1, n.try_into().unwrap(), buffer)
278}
279
Andrew Scullab72ec52022-03-14 09:10:52 +0000280fn is_strict_boot() -> bool {
281 Path::new(AVF_STRICT_BOOT).exists()
282}
283
284fn is_new_instance() -> bool {
285 Path::new(AVF_NEW_INSTANCE).exists()
286}
287
Inseob Kime379e7d2022-07-22 18:55:18 +0900288fn is_verified_boot() -> bool {
289 !Path::new(DEBUG_MICRODROID_NO_VERIFIED_BOOT).exists()
290}
291
Jooyung Han5c6d4172021-12-06 14:17:52 +0900292fn try_run_payload(service: &Strong<dyn IVirtualMachineService>) -> Result<i32> {
Jooyung Han311b1202021-09-14 22:00:16 +0900293 let metadata = load_metadata().context("Failed to load payload metadata")?;
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000294 let dice = DiceDriver::new(Path::new("/dev/open-dice0")).context("Failed to load DICE")?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900295
Jooyung Han311b1202021-09-14 22:00:16 +0900296 let mut instance = InstanceDisk::new().context("Failed to load instance.img")?;
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000297 let saved_data =
298 instance.read_microdroid_data(&dice).context("Failed to read identity data")?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900299
Andrew Scullab72ec52022-03-14 09:10:52 +0000300 if is_strict_boot() {
301 // Provisioning must happen on the first boot and never again.
302 if is_new_instance() {
303 ensure!(
304 saved_data.is_none(),
305 MicrodroidError::InvalidConfig("Found instance data on first boot.".to_string())
306 );
307 } else {
308 ensure!(
309 saved_data.is_some(),
310 MicrodroidError::InvalidConfig("Instance data not found.".to_string())
311 );
312 };
313 }
314
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900315 // Verify the payload before using it.
Inseob Kim11f40d02022-06-13 17:16:00 +0900316 let verified_data = verify_payload(&metadata, saved_data.as_ref())
317 .context("Payload verification failed")
318 .map_err(|e| MicrodroidError::PayloadVerificationFailed(e.to_string()))?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900319
320 // In case identity is ignored (by debug policy), we should reuse existing payload data, even
321 // when the payload is changed. This is to keep the derived secret same as before.
322 let verified_data = if let Some(saved_data) = saved_data {
323 if !is_verified_boot() {
324 if saved_data != verified_data {
325 info!("Detected an update of the payload, but continue (regarding debug policy)")
326 }
327 } else {
328 ensure!(
329 saved_data == verified_data,
330 MicrodroidError::PayloadChanged(String::from(
331 "Detected an update of the payload which isn't supported yet."
332 ))
333 );
334 info!("Saved data is verified.");
335 }
336 saved_data
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900337 } else {
Jooyung Han7a343f92021-09-08 22:53:11 +0900338 info!("Saving verified data.");
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000339 instance
340 .write_microdroid_data(&verified_data, &dice)
341 .context("Failed to write identity data")?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900342 verified_data
343 };
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900344
Alan Stokes1f417c92022-09-29 15:13:28 +0100345 let payload_metadata = metadata.payload.ok_or_else(|| {
346 MicrodroidError::InvalidConfig("No payload config in metadata".to_string())
347 })?;
Alan Stokes0d1ef782022-09-27 13:46:35 +0100348
Inseob Kimb2519c52022-04-14 02:10:09 +0900349 // To minimize the exposure to untrusted data, derive dice profile as soon as possible.
350 info!("DICE derivation for payload");
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000351 let dice = dice_derivation(dice, &verified_data, &payload_metadata)?;
Inseob Kimb2519c52022-04-14 02:10:09 +0900352
Jooyung Hana6d11eb2021-09-10 11:48:05 +0900353 // Before reading a file from the APK, start zipfuse
Inseob Kim217038e2021-11-25 11:15:06 +0900354 run_zipfuse(
Alan Stokes60f82202022-10-07 16:40:07 +0100355 MountForExec::Allowed,
Inseob Kim217038e2021-11-25 11:15:06 +0900356 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0",
357 Path::new("/dev/block/mapper/microdroid-apk"),
Alice Wang6bbb6da2022-10-26 12:44:06 +0000358 Path::new(VM_APK_CONTENTS_PATH),
Alan Stokes60f82202022-10-07 16:40:07 +0100359 Some(APK_MOUNT_DONE_PROP),
Inseob Kim217038e2021-11-25 11:15:06 +0900360 )
361 .context("Failed to run zipfuse")?;
Jiyong Park21ce2c52021-08-28 02:32:17 +0900362
Andrew Scull4d262dc2022-10-21 13:14:33 +0000363 // Restricted APIs are only allowed to be used by platform or test components. Infer this from
364 // the use of a VM config file since those can only be used by platform and test components.
365 let allow_restricted_apis = match payload_metadata {
366 PayloadMetadata::config_path(_) => true,
367 PayloadMetadata::config(_) => false,
368 };
369
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100370 let config = load_config(payload_metadata).context("Failed to load payload metadata")?;
Shikha Panwar6f03c942022-04-13 20:26:50 +0000371
Alan Stokes01b3ef02022-09-22 17:43:24 +0100372 let task = config
373 .task
374 .as_ref()
375 .ok_or_else(|| MicrodroidError::InvalidConfig("No task in VM config".to_string()))?;
376
Inseob Kim197748b2021-12-01 19:49:00 +0900377 if config.extra_apks.len() != verified_data.extra_apks_data.len() {
378 return Err(anyhow!(
Alan Stokes1f417c92022-09-29 15:13:28 +0100379 "config expects {} extra apks, but found {}",
Inseob Kim197748b2021-12-01 19:49:00 +0900380 config.extra_apks.len(),
381 verified_data.extra_apks_data.len()
382 ));
383 }
384 mount_extra_apks(&config)?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900385
Jooyung Han5c6d4172021-12-06 14:17:52 +0900386 // Wait until apex config is done. (e.g. linker configuration for apexes)
387 // TODO(jooyung): wait until sys.boot_completed?
388 wait_for_apex_config_done()?;
389
Inseob Kimcd9c1dd2022-07-13 17:13:45 +0900390 // Start tombstone_transmit if enabled
391 if config.export_tombstones {
Alan Stokes01b3ef02022-09-22 17:43:24 +0100392 control_service("start", "tombstone_transmit")?;
Inseob Kimcd9c1dd2022-07-13 17:13:45 +0900393 } else {
Alan Stokes01b3ef02022-09-22 17:43:24 +0100394 control_service("stop", "tombstoned")?;
Inseob Kimcd9c1dd2022-07-13 17:13:45 +0900395 }
396
Alan Stokes01b3ef02022-09-22 17:43:24 +0100397 // Start authfs if enabled
398 if config.enable_authfs {
399 control_service("start", "authfs_service")?;
400 }
401
Alan Stokes60f82202022-10-07 16:40:07 +0100402 // Wait until zipfuse has mounted the APK so we can access the payload
403 wait_for_property_true(APK_MOUNT_DONE_PROP).context("Failed waiting for APK mount done")?;
404
Andrew Scull4d262dc2022-10-21 13:14:33 +0000405 register_vm_payload_service(allow_restricted_apis, service.clone(), dice)?;
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100406
407 system_properties::write("dev.bootcomplete", "1").context("set dev.bootcomplete")?;
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100408 exec_task(task, service).context("Failed to run payload")
Alan Stokes01b3ef02022-09-22 17:43:24 +0100409}
410
411fn control_service(action: &str, service: &str) -> Result<()> {
412 system_properties::write(&format!("ctl.{}", action), service)
413 .with_context(|| format!("Failed to {} {}", action, service))
Jooyung Han347d9f22021-05-28 00:05:14 +0900414}
415
Inseob Kim217038e2021-11-25 11:15:06 +0900416struct ApkDmverityArgument<'a> {
417 apk: &'a str,
418 idsig: &'a str,
419 name: &'a str,
Inseob Kim197748b2021-12-01 19:49:00 +0900420 saved_root_hash: Option<&'a RootHash>,
Inseob Kim217038e2021-11-25 11:15:06 +0900421}
422
423fn run_apkdmverity(args: &[ApkDmverityArgument]) -> Result<Child> {
424 let mut cmd = Command::new(APKDMVERITY_BIN);
425
426 cmd.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
427
428 for argument in args {
429 cmd.arg("--apk").arg(argument.apk).arg(argument.idsig).arg(argument.name);
Inseob Kim197748b2021-12-01 19:49:00 +0900430 if let Some(root_hash) = argument.saved_root_hash {
431 cmd.arg(&to_hex_string(root_hash));
432 } else {
433 cmd.arg("none");
434 }
Inseob Kim217038e2021-11-25 11:15:06 +0900435 }
436
437 cmd.spawn().context("Spawn apkdmverity")
438}
439
Alan Stokes60f82202022-10-07 16:40:07 +0100440enum MountForExec {
441 Allowed,
442 Disallowed,
443}
444
445fn run_zipfuse(
446 noexec: MountForExec,
447 option: &str,
448 zip_path: &Path,
449 mount_dir: &Path,
450 ready_prop: Option<&str>,
451) -> Result<Child> {
Andrew Scullcc339a12022-07-04 12:44:19 +0000452 let mut cmd = Command::new(ZIPFUSE_BIN);
Alan Stokes60f82202022-10-07 16:40:07 +0100453 if let MountForExec::Disallowed = noexec {
Andrew Scullcc339a12022-07-04 12:44:19 +0000454 cmd.arg("--noexec");
455 }
Alan Stokes60f82202022-10-07 16:40:07 +0100456 if let Some(property_name) = ready_prop {
457 cmd.args(["-p", property_name]);
458 }
Andrew Scullcc339a12022-07-04 12:44:19 +0000459 cmd.arg("-o")
Inseob Kim217038e2021-11-25 11:15:06 +0900460 .arg(option)
461 .arg(zip_path)
462 .arg(mount_dir)
463 .stdin(Stdio::null())
464 .stdout(Stdio::null())
465 .stderr(Stdio::null())
466 .spawn()
467 .context("Spawn zipfuse")
468}
469
Inseob Kime379e7d2022-07-22 18:55:18 +0900470fn write_apex_payload_data(
471 saved_data: Option<&MicrodroidData>,
472 apex_data_from_payload: &[ApexData],
473) -> Result<()> {
474 if let Some(saved_apex_data) = saved_data.map(|d| &d.apex_data) {
475 // We don't support APEX updates. (assuming that update will change root digest)
476 ensure!(
477 saved_apex_data == apex_data_from_payload,
478 MicrodroidError::PayloadChanged(String::from("APEXes have changed."))
479 );
480 let apex_metadata = to_metadata(apex_data_from_payload);
481 // Pass metadata(with public keys and root digests) to apexd so that it uses the passed
482 // metadata instead of the default one (/dev/block/by-name/payload-metadata)
483 OpenOptions::new()
484 .create_new(true)
485 .write(true)
486 .open("/apex/vm-payload-metadata")
487 .context("Failed to open /apex/vm-payload-metadata")
488 .and_then(|f| write_metadata(&apex_metadata, f))?;
489 }
490 Ok(())
491}
492
Jooyung Han7a343f92021-09-08 22:53:11 +0900493// Verify payload before executing it. For APK payload, Full verification (which is slow) is done
494// when the root_hash values from the idsig file and the instance disk are different. This function
495// returns the verified root hash (for APK payload) and pubkeys (for APEX payloads) that can be
496// saved to the instance disk.
497fn verify_payload(
498 metadata: &Metadata,
499 saved_data: Option<&MicrodroidData>,
500) -> Result<MicrodroidData> {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900501 let start_time = SystemTime::now();
502
Inseob Kim197748b2021-12-01 19:49:00 +0900503 // Verify main APK
Jooyung Han7a343f92021-09-08 22:53:11 +0900504 let root_hash = saved_data.map(|d| &d.apk_data.root_hash);
Inseob Kim197748b2021-12-01 19:49:00 +0900505 let root_hash_from_idsig = get_apk_root_hash_from_idsig(MAIN_APK_IDSIG_PATH)?;
Jiyong Parkf7dea252021-09-08 01:42:54 +0900506 let root_hash_trustful = root_hash == Some(&root_hash_from_idsig);
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900507
Jiyong Parkf7dea252021-09-08 01:42:54 +0900508 // If root_hash can be trusted, pass it to apkdmverity so that it uses the passed root_hash
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900509 // instead of the value read from the idsig file.
Inseob Kim197748b2021-12-01 19:49:00 +0900510 let main_apk_argument = {
511 ApkDmverityArgument {
512 apk: MAIN_APK_PATH,
513 idsig: MAIN_APK_IDSIG_PATH,
514 name: MAIN_APK_DEVICE_NAME,
515 saved_root_hash: if root_hash_trustful {
516 Some(root_hash_from_idsig.as_ref())
517 } else {
518 None
519 },
520 }
521 };
522 let mut apkdmverity_arguments = vec![main_apk_argument];
523
524 // Verify extra APKs
525 // For now, we can't read the payload config, so glob APKs and idsigs.
526 // Later, we'll see if it matches with the payload config.
527
528 // sort globbed paths to match apks (extra-apk-{idx}) and idsigs (extra-idsig-{idx})
529 // e.g. "extra-apk-0" corresponds to "extra-idsig-0"
530 let extra_apks =
531 sorted(glob(EXTRA_APK_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>();
532 let extra_idsigs =
533 sorted(glob(EXTRA_IDSIG_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>();
534 if extra_apks.len() != extra_idsigs.len() {
535 return Err(anyhow!(
536 "Extra apks/idsigs mismatch: {} apks but {} idsigs",
537 extra_apks.len(),
538 extra_idsigs.len()
539 ));
540 }
541 let extra_apks_count = extra_apks.len();
542
543 let (extra_apk_names, extra_root_hashes_from_idsig): (Vec<_>, Vec<_>) = extra_idsigs
544 .iter()
545 .enumerate()
546 .map(|(i, extra_idsig)| {
547 (
548 format!("extra-apk-{}", i),
Alice Wang89cff012022-09-26 10:05:16 +0000549 get_apk_root_hash_from_idsig(extra_idsig)
Inseob Kim197748b2021-12-01 19:49:00 +0900550 .expect("Can't find root hash from extra idsig"),
551 )
552 })
553 .unzip();
554
555 let saved_extra_root_hashes: Vec<_> = saved_data
556 .map(|d| d.extra_apks_data.iter().map(|apk_data| &apk_data.root_hash).collect())
557 .unwrap_or_else(Vec::new);
558 let extra_root_hashes_trustful: Vec<_> = extra_root_hashes_from_idsig
559 .iter()
560 .enumerate()
561 .map(|(i, root_hash_from_idsig)| {
562 saved_extra_root_hashes.get(i).copied() == Some(root_hash_from_idsig)
563 })
564 .collect();
565
566 for i in 0..extra_apks_count {
567 apkdmverity_arguments.push({
568 ApkDmverityArgument {
569 apk: extra_apks[i].to_str().unwrap(),
570 idsig: extra_idsigs[i].to_str().unwrap(),
571 name: &extra_apk_names[i],
572 saved_root_hash: if extra_root_hashes_trustful[i] {
573 Some(&extra_root_hashes_from_idsig[i])
574 } else {
575 None
576 },
577 }
578 });
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900579 }
580
581 // Start apkdmverity and wait for the dm-verify block
Inseob Kim197748b2021-12-01 19:49:00 +0900582 let mut apkdmverity_child = run_apkdmverity(&apkdmverity_arguments)?;
Jooyung Han7a343f92021-09-08 22:53:11 +0900583
Jooyung Hanc8deb472021-09-13 13:48:25 +0900584 // While waiting for apkdmverity to mount APK, gathers public keys and root digests from
585 // APEX payload.
Jooyung Han7a343f92021-09-08 22:53:11 +0900586 let apex_data_from_payload = get_apex_data_from_payload(metadata)?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900587
588 // Writing /apex/vm-payload-metadata is to verify that the payload isn't changed.
589 // Skip writing it if the debug policy ignoring identity is on
590 if is_verified_boot() {
591 write_apex_payload_data(saved_data, &apex_data_from_payload)?;
Jooyung Han4a9b3bf2021-09-10 17:19:00 +0900592 }
Inseob Kime379e7d2022-07-22 18:55:18 +0900593
Jooyung Han4a9b3bf2021-09-10 17:19:00 +0900594 // Start apexd to activate APEXes
595 system_properties::write("ctl.start", "apexd-vm")?;
Jooyung Han7a343f92021-09-08 22:53:11 +0900596
Inseob Kim217038e2021-11-25 11:15:06 +0900597 // TODO(inseob): add timeout
598 apkdmverity_child.wait()?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900599
Jiyong Parkf7dea252021-09-08 01:42:54 +0900600 // Do the full verification if the root_hash is un-trustful. This requires the full scanning of
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900601 // the APK file and therefore can be very slow if the APK is large. Note that this step is
Jiyong Parkf7dea252021-09-08 01:42:54 +0900602 // taken only when the root_hash is un-trustful which can be either when this is the first boot
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900603 // of the VM or APK was updated in the host.
604 // TODO(jooyung): consider multithreading to make this faster
Inseob Kim197748b2021-12-01 19:49:00 +0900605 let main_apk_pubkey = get_public_key_from_apk(DM_MOUNTED_APK_PATH, root_hash_trustful)?;
606 let extra_apks_data = extra_root_hashes_from_idsig
607 .into_iter()
608 .enumerate()
609 .map(|(i, extra_root_hash)| {
610 let mount_path = format!("/dev/block/mapper/{}", &extra_apk_names[i]);
611 let apk_pubkey = get_public_key_from_apk(&mount_path, extra_root_hashes_trustful[i])?;
612 Ok(ApkData { root_hash: extra_root_hash, pubkey: apk_pubkey })
613 })
614 .collect::<Result<Vec<_>>>()?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900615
616 info!("payload verification successful. took {:#?}", start_time.elapsed().unwrap());
617
Andrew Scull34916a72022-01-30 21:34:24 +0000618 // Use the salt from a verified instance, or generate a salt for a new instance.
619 let salt = if let Some(saved_data) = saved_data {
620 saved_data.salt.clone()
621 } else {
622 let mut salt = vec![0u8; 64];
623 salt.as_mut_slice().try_fill(&mut rand::thread_rng())?;
624 salt
625 };
626
Jiyong Parkf7dea252021-09-08 01:42:54 +0900627 // At this point, we can ensure that the root_hash from the idsig file is trusted, either by
628 // fully verifying the APK or by comparing it with the saved root_hash.
Jooyung Han7a343f92021-09-08 22:53:11 +0900629 Ok(MicrodroidData {
Andrew Scull34916a72022-01-30 21:34:24 +0000630 salt,
Inseob Kim197748b2021-12-01 19:49:00 +0900631 apk_data: ApkData { root_hash: root_hash_from_idsig, pubkey: main_apk_pubkey },
632 extra_apks_data,
Jooyung Han7a343f92021-09-08 22:53:11 +0900633 apex_data: apex_data_from_payload,
634 })
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900635}
636
Inseob Kim197748b2021-12-01 19:49:00 +0900637fn mount_extra_apks(config: &VmPayloadConfig) -> Result<()> {
638 // For now, only the number of apks is important, as the mount point and dm-verity name is fixed
639 for i in 0..config.extra_apks.len() {
640 let mount_dir = format!("/mnt/extra-apk/{}", i);
641 create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?;
642
643 // don't wait, just detach
644 run_zipfuse(
Alan Stokes60f82202022-10-07 16:40:07 +0100645 MountForExec::Disallowed,
Inseob Kim197748b2021-12-01 19:49:00 +0900646 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0",
647 Path::new(&format!("/dev/block/mapper/extra-apk-{}", i)),
648 Path::new(&mount_dir),
Alan Stokes60f82202022-10-07 16:40:07 +0100649 None,
Inseob Kim197748b2021-12-01 19:49:00 +0900650 )
651 .context("Failed to zipfuse extra apks")?;
652 }
653
654 Ok(())
655}
656
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900657// Waits until linker config is generated
658fn wait_for_apex_config_done() -> Result<()> {
Alan Stokes60f82202022-10-07 16:40:07 +0100659 wait_for_property_true(APEX_CONFIG_DONE_PROP).context("Failed waiting for apex config done")
660}
661
662fn wait_for_property_true(property_name: &str) -> Result<()> {
663 let mut prop = PropertyWatcher::new(property_name)?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900664 loop {
665 prop.wait()?;
Alan Stokes60f82202022-10-07 16:40:07 +0100666 if system_properties::read_bool(property_name, false)? {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900667 break;
668 }
669 }
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900670 Ok(())
671}
672
Alice Wang89cff012022-09-26 10:05:16 +0000673fn get_apk_root_hash_from_idsig<P: AsRef<Path>>(idsig_path: P) -> Result<Box<RootHash>> {
674 Ok(V4Signature::from_idsig_path(idsig_path)?.hashing_info.raw_root_hash)
Jiyong Park21ce2c52021-08-28 02:32:17 +0900675}
676
Inseob Kim197748b2021-12-01 19:49:00 +0900677fn get_public_key_from_apk(apk: &str, root_hash_trustful: bool) -> Result<Box<[u8]>> {
678 if !root_hash_trustful {
679 verify(apk).context(MicrodroidError::PayloadVerificationFailed(format!(
680 "failed to verify {}",
681 apk
682 )))
683 } else {
684 get_public_key_der(apk)
685 }
686}
687
Alan Stokes1f417c92022-09-29 15:13:28 +0100688fn load_config(payload_metadata: PayloadMetadata) -> Result<VmPayloadConfig> {
689 match payload_metadata {
690 PayloadMetadata::config_path(path) => {
691 let path = Path::new(&path);
692 info!("loading config from {:?}...", path);
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100693 let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)
694 .with_context(|| format!("Failed to read {:?}", path))?;
Alan Stokes1f417c92022-09-29 15:13:28 +0100695 Ok(serde_json::from_reader(file)?)
696 }
697 PayloadMetadata::config(payload_config) => {
698 let task = Task {
699 type_: TaskType::MicrodroidLauncher,
700 command: payload_config.payload_binary_path,
Alan Stokes1f417c92022-09-29 15:13:28 +0100701 };
702 Ok(VmPayloadConfig {
703 os: OsConfig { name: "microdroid".to_owned() },
704 task: Some(task),
705 apexes: vec![],
706 extra_apks: vec![],
707 prefer_staged: false,
708 export_tombstones: false,
709 enable_authfs: false,
710 })
711 }
712 }
Jooyung Han634e2d72021-06-10 16:27:38 +0900713}
714
Jiyong Park202856e2022-08-22 16:04:26 +0900715/// Loads the crashkernel into memory using kexec if the VM is loaded with `crashkernel=' parameter
716/// in the cmdline.
717fn load_crashkernel_if_supported() -> Result<()> {
718 let supported = std::fs::read_to_string("/proc/cmdline")?.contains(" crashkernel=");
719 info!("ramdump supported: {}", supported);
720 if supported {
721 let status = Command::new("/system/bin/kexec_load").status()?;
722 if !status.success() {
723 return Err(anyhow!("Failed to load crashkernel: {:?}", status));
724 }
725 }
726 Ok(())
727}
728
Jiyong Park8611a6c2021-07-09 18:17:44 +0900729/// Executes the given task. Stdout of the task is piped into the vsock stream to the
730/// virtualizationservice in the host side.
Jooyung Han5c6d4172021-12-06 14:17:52 +0900731fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900732 info!("executing main task {:?}...", task);
David Brazdil451cc962022-10-14 14:08:12 +0100733 let mut command = match task.type_ {
734 TaskType::Executable => Command::new(&task.command),
735 TaskType::MicrodroidLauncher => {
736 let mut command = Command::new("/system/bin/microdroid_launcher");
737 command.arg(find_library_path(&task.command)?);
738 command
739 }
740 };
Inseob Kim7f61fe72021-08-20 20:50:47 +0900741
742 info!("notifying payload started");
Inseob Kimc7d28c72021-10-25 14:28:10 +0000743 service.notifyPayloadStarted()?;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900744
Inseob Kim86ca0162021-10-20 02:21:02 +0000745 let exit_status = command.spawn()?.wait()?;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -0800746 match exit_status.code() {
747 Some(exit_code) => Ok(exit_code),
748 None => Err(match exit_status.signal() {
749 Some(signal) => anyhow!(
750 "Payload exited due to signal: {} ({})",
751 signal,
752 Signal::try_from(signal).map_or("unknown", |s| s.as_str())
753 ),
754 None => anyhow!("Payload has neither exit code nor signal"),
755 }),
756 }
Jooyung Han347d9f22021-05-28 00:05:14 +0900757}
Jooyung Han634e2d72021-06-10 16:27:38 +0900758
Jooyung Han634e2d72021-06-10 16:27:38 +0900759fn find_library_path(name: &str) -> Result<String> {
760 let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?;
761 let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?;
762 let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?;
Alice Wang6bbb6da2022-10-26 12:44:06 +0000763 let path = format!("{}/lib/{}/{}", VM_APK_CONTENTS_PATH, abi, name);
Jooyung Han634e2d72021-06-10 16:27:38 +0900764
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100765 let metadata = fs::metadata(&path).with_context(|| format!("Unable to access {}", path))?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900766 if !metadata.is_file() {
767 bail!("{} is not a file", &path);
768 }
769
770 Ok(path)
771}
Jiyong Park21ce2c52021-08-28 02:32:17 +0900772
773fn to_hex_string(buf: &[u8]) -> String {
774 buf.iter().map(|b| format!("{:02X}", b)).collect()
775}