blob: 5dac07ff0e64ca2b0b78930dba4d061ff81a7ef3 [file] [log] [blame]
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
Andrew Walbranf6bf6862021-05-21 12:41:13 +000015//! Implementation of the AIDL interface of the VirtualizationService.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +000016
Seungjae Yoo13af0b62024-05-20 14:15:13 +090017use crate::{get_calling_pid, get_calling_uid, get_this_pid};
Alan Stokesfda70842023-12-20 17:50:14 +000018use crate::atom::{write_vm_booted_stats, write_vm_creation_stats};
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +000019use crate::composite::make_composite_image;
Akilesh Kailash05515dc2024-10-22 21:42:52 -070020use crate::crosvm::{AudioConfig, CrosvmConfig, DiskFile, SharedPathConfig, DisplayConfig, GpuConfig, InputDeviceOption, PayloadState, UsbConfig, VmContext, VmInstance, VmState};
Jaewan Kim61f86142023-03-28 15:12:52 +090021use crate::debug_config::DebugConfig;
Shikha Panwar55e10ec2024-02-13 12:53:49 +000022use crate::dt_overlay::{create_device_tree_overlay, VM_DT_OVERLAY_MAX_SIZE, VM_DT_OVERLAY_PATH};
Nikita Ioffe5dfddf22023-06-29 16:11:26 +010023use crate::payload::{add_microdroid_payload_images, add_microdroid_system_images, add_microdroid_vendor_image};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090024use crate::selinux::{getfilecon, SeContext};
Jiyong Park753553b2021-07-12 21:21:09 +090025use android_os_permissions_aidl::aidl::android::os::IPermissionController;
David Brazdil49f96f52022-12-16 21:29:13 +000026use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::{
Alice Wang4e3015d2023-10-10 09:35:37 +000027 Certificate::Certificate,
Andrew Walbranc92d35f2022-01-12 12:45:19 +000028 DeathReason::DeathReason,
David Brazdil49f96f52022-12-16 21:29:13 +000029 ErrorCode::ErrorCode,
30};
31use android_system_virtualizationservice::aidl::android::system::virtualizationservice::{
Inseob Kim53d0b212023-07-20 16:58:37 +090032 AssignableDevice::AssignableDevice,
David Brazdil7d1e5ec2023-02-06 17:56:29 +000033 CpuTopology::CpuTopology,
Andrew Walbran6b650662021-09-07 13:13:23 +000034 DiskImage::DiskImage,
Akilesh Kailash05515dc2024-10-22 21:42:52 -070035 SharedPath::SharedPath,
Jeongik Chac181be72024-03-27 00:18:30 +090036 InputDevice::InputDevice,
Devin Moore407df8f2024-08-27 19:39:16 +000037 IVirtualMachine::{self, BnVirtualMachine},
Andrew Walbran6b650662021-09-07 13:13:23 +000038 IVirtualMachineCallback::IVirtualMachineCallback,
39 IVirtualizationService::IVirtualizationService,
Jiyong Park029977d2021-11-24 21:56:49 +090040 Partition::Partition,
Andrew Walbran6b650662021-09-07 13:13:23 +000041 PartitionType::PartitionType,
Inseob Kim0168b462022-12-27 14:54:35 +090042 VirtualMachineAppConfig::{DebugLevel::DebugLevel, Payload::Payload, VirtualMachineAppConfig},
Jooyung Han21e9b922021-06-26 04:14:16 +090043 VirtualMachineConfig::VirtualMachineConfig,
Andrew Walbran6b650662021-09-07 13:13:23 +000044 VirtualMachineDebugInfo::VirtualMachineDebugInfo,
Alan Stokes0d1ef782022-09-27 13:46:35 +010045 VirtualMachinePayloadConfig::VirtualMachinePayloadConfig,
Jooyung Han21e9b922021-06-26 04:14:16 +090046 VirtualMachineRawConfig::VirtualMachineRawConfig,
Andrew Walbran6b650662021-09-07 13:13:23 +000047 VirtualMachineState::VirtualMachineState,
Jooyung Han21e9b922021-06-26 04:14:16 +090048};
Inseob Kimecde8c02024-09-03 13:11:08 +090049use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::IGlobalVmContext::IGlobalVmContext;
David Brazdilafc9a9e2023-01-12 16:08:10 +000050use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::IVirtualizationServiceInternal::IVirtualizationServiceInternal;
Seungjae Yoodd91f0f2022-11-09 15:25:21 +090051use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{
David Brazdilafc9a9e2023-01-12 16:08:10 +000052 BnVirtualMachineService, IVirtualMachineService,
Seungjae Yoofd9a0622022-10-14 10:01:29 +090053};
Shikha Panware45e9422024-02-28 21:18:10 +000054use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::ISecretkeeper::{BnSecretkeeper, ISecretkeeper};
Shikha Panwar5d6a6752023-12-14 22:08:26 +000055use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::SecretId::SecretId;
56use android_hardware_security_authgraph::aidl::android::hardware::security::authgraph::{
57 Arc::Arc as AuthgraphArc, IAuthGraphKeyExchange::IAuthGraphKeyExchange,
58 IAuthGraphKeyExchange::BnAuthGraphKeyExchange, Identity::Identity, KeInitResult::KeInitResult,
59 Key::Key, PubKey::PubKey, SessionIdSignature::SessionIdSignature, SessionInfo::SessionInfo,
60 SessionInitiationInfo::SessionInitiationInfo,
61};
Alan Stokes25f69362023-03-06 16:51:54 +000062use anyhow::{anyhow, bail, Context, Result};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090063use apkverify::{HashAlgorithm, V4Signature};
Jiyong Parkd7bd2f22023-08-10 20:41:19 +090064use avflog::LogResult;
Alan Stokes0e82b502022-08-08 14:44:48 +010065use binder::{
Devin Moore407df8f2024-08-27 19:39:16 +000066 self, wait_for_interface, Accessor, BinderFeatures, ConnectionInfo, ExceptionCode, Interface, ParcelFileDescriptor,
67 SpIBinder, Status, StatusCode, Strong, IntoBinderResult,
Andrew Walbrana89fc132021-03-17 17:08:36 +000068};
Shikha Panwar55e10ec2024-02-13 12:53:49 +000069use cstr::cstr;
Inseob Kim46257382024-01-03 15:41:22 +090070use glob::glob;
Devin Moorec8800a12024-10-17 17:56:18 +000071use libc::{AF_VSOCK, sa_family_t, sockaddr_vm};
Seungjae Yoo0a8c84c2022-07-11 08:19:15 +000072use log::{debug, error, info, warn};
Inseob Kim89b24592024-02-23 18:59:43 +090073use microdroid_payload_config::{ApkConfig, Task, TaskType, VmPayloadConfig};
Inseob Kim0168b462022-12-27 14:54:35 +090074use nix::unistd::pipe;
David Brazdil73988ea2022-11-11 15:10:32 +000075use rpcbinder::RpcServer;
Alan Stokes25f69362023-03-06 16:51:54 +000076use rustutils::system_properties;
Jiyong Parkdcf17412022-02-08 15:07:23 +090077use semver::VersionReq;
Inseob Kimecde8c02024-09-03 13:11:08 +090078use serde::Deserialize;
Inseob Kim6ef80972023-07-20 17:23:36 +090079use std::collections::HashSet;
Andrew Walbrandff3b942021-06-09 15:20:36 +000080use std::convert::TryInto;
Shikha Panwar55e10ec2024-02-13 12:53:49 +000081use std::fs;
Jaewan Kim39952072024-01-19 17:04:53 +090082use std::ffi::CStr;
Inseob Kimecde8c02024-09-03 13:11:08 +090083use std::fs::{canonicalize, create_dir_all, read_dir, remove_dir_all, remove_file, File, OpenOptions};
Shikha Panwar9ae2e622024-01-30 12:22:30 +000084use std::io::{BufRead, BufReader, Error, ErrorKind, Seek, SeekFrom, Write};
Inseob Kim46257382024-01-03 15:41:22 +090085use std::iter;
Nikita Ioffe5776f082023-02-10 21:38:26 +000086use std::num::{NonZeroU16, NonZeroU32};
Inseob Kimecde8c02024-09-03 13:11:08 +090087use std::ops::Range;
Jiyong Parkaf63d1c2024-09-04 16:15:42 +090088use std::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd};
David Brazdilafc9a9e2023-01-12 16:08:10 +000089use std::os::unix::raw::pid_t;
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +000090use std::path::{Path, PathBuf};
Andrew Walbran9c03a3a2024-09-03 12:12:59 +010091use std::sync::{Arc, Mutex, Weak, LazyLock};
Seungjae Yoo14e60182024-02-21 13:28:31 +090092use vbmeta::VbMetaImage;
Pierre-Clément Tosid3bbe1d2024-04-15 18:03:51 +010093use vmconfig::{VmConfig, get_debug_level};
Devin Moorec8800a12024-10-17 17:56:18 +000094use vsock::VsockStream;
Jooyung Han35edb8f2021-07-01 16:17:16 +090095use zip::ZipArchive;
Andrew Walbrand6dce6f2021-03-05 16:39:08 +000096
David Brazdil41d1a872022-10-05 14:44:19 +010097/// The unique ID of a VM used (together with a port number) for vsock communication.
98pub type Cid = u32;
99
David Brazdil4b4c5102022-12-19 22:56:20 +0000100pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice";
101
Devin Moore407df8f2024-08-27 19:39:16 +0000102/// Vsock privileged ports are below this number.
103const VSOCK_PRIV_PORT_MAX: u32 = 1024;
104
Jooyung Han95884632021-07-06 22:27:54 +0900105/// The size of zero.img.
106/// Gaps in composite disk images are filled with a shared zero.img.
107const ZERO_FILLER_SIZE: u64 = 4096;
108
David Brazdilf50c7a62023-04-19 14:22:42 +0000109/// Magic string for the instance image
110const ANDROID_VM_INSTANCE_MAGIC: &str = "Android-VM-instance";
111
112/// Version of the instance image format
113const ANDROID_VM_INSTANCE_VERSION: u16 = 1;
114
Alan Stokes0d1ef782022-09-27 13:46:35 +0100115const MICRODROID_OS_NAME: &str = "microdroid";
116
Shikha Panwar5d6a6752023-12-14 22:08:26 +0000117const SECRETKEEPER_IDENTIFIER: &str =
Shikha Panwarbe5dee72024-02-21 19:06:20 +0000118 "android.hardware.security.secretkeeper.ISecretkeeper/default";
Shikha Panwar5d6a6752023-12-14 22:08:26 +0000119
David Brazdilf50c7a62023-04-19 14:22:42 +0000120const UNFORMATTED_STORAGE_MAGIC: &str = "UNFORMATTED-STORAGE";
121
122/// crosvm requires all partitions to be a multiple of 4KiB.
123const PARTITION_GRANULARITY_BYTES: u64 = 4096;
124
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000125const VM_REFERENCE_DT_ON_HOST_PATH: &str = "/proc/device-tree/avf/reference";
126
Andrew Walbran9c03a3a2024-09-03 12:12:59 +0100127pub static GLOBAL_SERVICE: LazyLock<Strong<dyn IVirtualizationServiceInternal>> =
128 LazyLock::new(|| {
Inseob Kimecde8c02024-09-03 13:11:08 +0900129 if cfg!(early) {
130 panic!("Early virtmgr must not connect to VirtualizatinoServiceInternal")
131 } else {
132 wait_for_interface(BINDER_SERVICE_IDENTIFIER)
133 .expect("Could not connect to VirtualizationServiceInternal")
134 }
Andrew Walbran9c03a3a2024-09-03 12:12:59 +0100135 });
136static SUPPORTED_OS_NAMES: LazyLock<HashSet<String>> =
137 LazyLock::new(|| get_supported_os_names().expect("Failed to get list of supported os names"));
David Brazdil49f96f52022-12-16 21:29:13 +0000138
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000139fn create_or_update_idsig_file(
140 input_fd: &ParcelFileDescriptor,
141 idsig_fd: &ParcelFileDescriptor,
142) -> Result<()> {
143 let mut input = clone_file(input_fd)?;
144 let metadata = input.metadata().context("failed to get input metadata")?;
145 if !metadata.is_file() {
146 bail!("input is not a regular file");
147 }
Alan Stokes25f69362023-03-06 16:51:54 +0000148 let mut sig =
149 V4Signature::create(&mut input, get_current_sdk()?, 4096, &[], HashAlgorithm::SHA256)
150 .context("failed to create idsig")?;
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000151
152 let mut output = clone_file(idsig_fd)?;
Jiyong Park8d192952023-06-26 14:29:51 +0900153
154 // Optimization. We don't have to update idsig file whenever a VM is started. Don't update it,
155 // if the idsig file already has the same APK digest.
156 if output.metadata()?.len() > 0 {
157 if let Ok(out_sig) = V4Signature::from_idsig(&mut output) {
158 if out_sig.signing_info.apk_digest == sig.signing_info.apk_digest {
159 debug!("idsig {:?} is up-to-date with apk {:?}.", output, input);
160 return Ok(());
161 }
162 }
163 // if we fail to read v4signature from output, that's fine. User can pass a random file.
164 // We will anyway overwrite the file to the v4signature generated from input_fd.
165 }
166
Shikha Panwar9ae2e622024-01-30 12:22:30 +0000167 output
168 .seek(SeekFrom::Start(0))
169 .context("failed to move cursor to start on the idsig output")?;
Nikita Ioffec09b0492022-12-14 20:18:33 +0000170 output.set_len(0).context("failed to set_len on the idsig output")?;
171 sig.write_into(&mut output).context("failed to write idsig")?;
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000172 Ok(())
173}
174
Alan Stokes25f69362023-03-06 16:51:54 +0000175fn get_current_sdk() -> Result<u32> {
176 let current_sdk = system_properties::read("ro.build.version.sdk")?;
177 let current_sdk = current_sdk.ok_or_else(|| anyhow!("SDK version missing"))?;
178 current_sdk.parse().context("Malformed SDK version")
179}
180
David Brazdil4b4c5102022-12-19 22:56:20 +0000181pub fn remove_temporary_files(path: &PathBuf) -> Result<()> {
182 for dir_entry in read_dir(path)? {
183 remove_file(dir_entry?.path())?;
184 }
185 Ok(())
David Brazdil528e0472022-10-10 15:06:02 +0100186}
187
David Brazdil528e0472022-10-10 15:06:02 +0100188/// Implementation of `IVirtualizationService`, the entry point of the AIDL service.
David Brazdil49f96f52022-12-16 21:29:13 +0000189#[derive(Debug, Default)]
Andrew Walbranf6bf6862021-05-21 12:41:13 +0000190pub struct VirtualizationService {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900191 state: Arc<Mutex<State>>,
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000192}
193
Shikha Panward8e35422021-10-11 13:51:27 +0000194impl Interface for VirtualizationService {
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000195 fn dump(&self, writer: &mut dyn Write, _args: &[&CStr]) -> Result<(), StatusCode> {
Shikha Panward8e35422021-10-11 13:51:27 +0000196 check_permission("android.permission.DUMP").or(Err(StatusCode::PERMISSION_DENIED))?;
197 let state = &mut *self.state.lock().unwrap();
198 let vms = state.vms();
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000199 writeln!(writer, "Running {0} VMs:", vms.len()).or(Err(StatusCode::UNKNOWN_ERROR))?;
Shikha Panward8e35422021-10-11 13:51:27 +0000200 for vm in vms {
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000201 writeln!(writer, "VM CID: {}", vm.cid).or(Err(StatusCode::UNKNOWN_ERROR))?;
202 writeln!(writer, "\tState: {:?}", vm.vm_state.lock().unwrap())
Shikha Panward8e35422021-10-11 13:51:27 +0000203 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000204 writeln!(writer, "\tPayload state {:?}", vm.payload_state())
Shikha Panward8e35422021-10-11 13:51:27 +0000205 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000206 writeln!(writer, "\tProtected: {}", vm.protected).or(Err(StatusCode::UNKNOWN_ERROR))?;
207 writeln!(writer, "\ttemporary_directory: {}", vm.temporary_directory.to_string_lossy())
Shikha Panward8e35422021-10-11 13:51:27 +0000208 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000209 writeln!(writer, "\trequester_uid: {}", vm.requester_uid)
Shikha Panward8e35422021-10-11 13:51:27 +0000210 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000211 writeln!(writer, "\trequester_debug_pid: {}", vm.requester_debug_pid)
Shikha Panward8e35422021-10-11 13:51:27 +0000212 .or(Err(StatusCode::UNKNOWN_ERROR))?;
213 }
214 Ok(())
215 }
216}
Andrew Walbranf6bf6862021-05-21 12:41:13 +0000217impl IVirtualizationService for VirtualizationService {
Andrew Walbranf8d94112021-09-07 11:45:36 +0000218 /// Creates (but does not start) a new VM with the given configuration, assigning it the next
219 /// available CID.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000220 ///
221 /// Returns a binder `IVirtualMachine` object referring to it, as a handle for the client.
Andrew Walbranf8d94112021-09-07 11:45:36 +0000222 fn createVm(
Andrew Walbrana89fc132021-03-17 17:08:36 +0000223 &self,
Andrew Walbran3a5a9212021-05-04 17:09:08 +0000224 config: &VirtualMachineConfig,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900225 console_out_fd: Option<&ParcelFileDescriptor>,
226 console_in_fd: Option<&ParcelFileDescriptor>,
Andrew Walbrana89fc132021-03-17 17:08:36 +0000227 log_fd: Option<&ParcelFileDescriptor>,
Elie Kheirallah5c807a22024-09-23 20:40:42 +0000228 dump_dt_fd: Option<&ParcelFileDescriptor>,
Devin Moore407df8f2024-08-27 19:39:16 +0000229 ) -> binder::Result<Strong<dyn IVirtualMachine::IVirtualMachine>> {
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000230 let mut is_protected = false;
Jiyong Parke6fb1672023-06-26 16:45:55 +0900231 let ret = self.create_vm_internal(
232 config,
233 console_out_fd,
234 console_in_fd,
235 log_fd,
236 &mut is_protected,
Elie Kheirallah5c807a22024-09-23 20:40:42 +0000237 dump_dt_fd,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900238 );
Seungjae Yoo0a8c84c2022-07-11 08:19:15 +0000239 write_vm_creation_stats(config, is_protected, &ret);
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000240 ret
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000241 }
Andrew Walbran320b5602021-03-04 16:11:12 +0000242
Shikha Panwar61a74b52024-02-16 13:17:01 +0000243 /// Allocate a new instance_id to the VM
244 fn allocateInstanceId(&self) -> binder::Result<[u8; 64]> {
Shikha Panwarbd5eba92024-03-27 20:23:31 +0000245 check_manage_access()?;
Shikha Panwar61a74b52024-02-16 13:17:01 +0000246 GLOBAL_SERVICE.allocateInstanceId()
247 }
248
Andrew Walbrandff3b942021-06-09 15:20:36 +0000249 /// Initialise an empty partition image of the given size to be used as a writable partition.
250 fn initializeWritablePartition(
251 &self,
252 image_fd: &ParcelFileDescriptor,
Alan Stokesff0005f2023-01-30 09:53:00 +0000253 size_bytes: i64,
Jiyong Park9dd389e2021-08-23 20:42:59 +0900254 partition_type: PartitionType,
Andrew Walbrandff3b942021-06-09 15:20:36 +0000255 ) -> binder::Result<()> {
Jiyong Park753553b2021-07-12 21:21:09 +0900256 check_manage_access()?;
Jiyong Park2227eaa2023-08-04 11:59:18 +0900257 let size_bytes = size_bytes
258 .try_into()
259 .with_context(|| format!("Invalid size: {}", size_bytes))
260 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000261 let size_bytes = round_up(size_bytes, PARTITION_GRANULARITY_BYTES);
Shikha Panwar9ae2e622024-01-30 12:22:30 +0000262 let mut image = clone_file(image_fd)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000263 // initialize the file. Any data in the file will be erased.
Shikha Panwar9ae2e622024-01-30 12:22:30 +0000264 image
265 .seek(SeekFrom::Start(0))
266 .context("failed to move cursor to start")
267 .or_service_specific_exception(-1)?;
Jiyong Park2227eaa2023-08-04 11:59:18 +0900268 image.set_len(0).context("Failed to reset a file").or_service_specific_exception(-1)?;
Frederick Mayle0d310572024-05-02 12:34:58 -0700269 // Set the file length. In most filesystems, this will not allocate any physical disk
270 // space, it will only change the logical size.
271 image
272 .set_len(size_bytes)
273 .context("Failed to extend file")
Jiyong Park2227eaa2023-08-04 11:59:18 +0900274 .or_service_specific_exception(-1)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000275
276 match partition_type {
277 PartitionType::RAW => Ok(()),
Frederick Mayle0d310572024-05-02 12:34:58 -0700278 PartitionType::ANDROID_VM_INSTANCE => format_as_android_vm_instance(&mut image),
279 PartitionType::ENCRYPTEDSTORE => format_as_encryptedstore(&mut image),
David Brazdilf50c7a62023-04-19 14:22:42 +0000280 _ => Err(Error::new(
281 ErrorKind::Unsupported,
282 format!("Unsupported partition type {:?}", partition_type),
283 )),
284 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900285 .with_context(|| format!("Failed to initialize partition as {:?}", partition_type))
286 .or_service_specific_exception(-1)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000287
288 Ok(())
Andrew Walbrandff3b942021-06-09 15:20:36 +0000289 }
290
Jiyong Park0a248432021-08-20 23:32:39 +0900291 /// Creates or update the idsig file by digesting the input APK file.
292 fn createOrUpdateIdsigFile(
293 &self,
294 input_fd: &ParcelFileDescriptor,
295 idsig_fd: &ParcelFileDescriptor,
296 ) -> binder::Result<()> {
Jiyong Parkc3ca24f2022-06-28 10:45:15 +0900297 check_manage_access()?;
298
Jiyong Park2227eaa2023-08-04 11:59:18 +0900299 create_or_update_idsig_file(input_fd, idsig_fd).or_service_specific_exception(-1)?;
Jiyong Park0a248432021-08-20 23:32:39 +0900300 Ok(())
301 }
302
Andrew Walbran320b5602021-03-04 16:11:12 +0000303 /// Get a list of all currently running VMs. This method is only intended for debug purposes,
304 /// and as such is only permitted from the shell user.
305 fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> {
David Brazdil209074a2023-01-12 16:44:51 +0000306 // Delegate to the global service, including checking the debug permission.
David Brazdild4f51a52023-01-11 14:09:27 +0000307 GLOBAL_SERVICE.debugListVms()
Andrew Walbran320b5602021-03-04 16:11:12 +0000308 }
Inseob Kim53d0b212023-07-20 16:58:37 +0900309
310 /// Get a list of assignable device types.
311 fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> {
312 // Delegate to the global service, including checking the permission.
313 GLOBAL_SERVICE.getAssignableDevices()
314 }
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100315
Inseob Kim46257382024-01-03 15:41:22 +0900316 /// Get a list of supported OSes.
317 fn getSupportedOSList(&self) -> binder::Result<Vec<String>> {
318 Ok(Vec::from_iter(SUPPORTED_OS_NAMES.iter().cloned()))
319 }
320
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100321 /// Returns whether given feature is enabled
322 fn isFeatureEnabled(&self, feature: &str) -> binder::Result<bool> {
323 check_manage_access()?;
Shikha Panwar6d306412024-02-17 21:37:49 +0000324 Ok(avf_features::is_feature_enabled(feature))
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100325 }
Alice Wange64dd182024-01-17 15:57:55 +0000326
327 fn enableTestAttestation(&self) -> binder::Result<()> {
328 GLOBAL_SERVICE.enableTestAttestation()
329 }
Alice Wang0362f7f2024-03-21 08:16:26 +0000330
331 fn isRemoteAttestationSupported(&self) -> binder::Result<bool> {
332 check_manage_access()?;
333 GLOBAL_SERVICE.isRemoteAttestationSupported()
334 }
Shikha Panwar7aef66d2024-03-13 00:28:41 +0000335
336 fn isUpdatableVmSupported(&self) -> binder::Result<bool> {
337 // The response is specific to Microdroid. Updatable VMs are only possible if device
338 // supports Secretkeeper. Guest OS needs to use Secretkeeper based secrets. Microdroid does
339 // this, however other guest OSes may do things differently.
340 check_manage_access()?;
341 Ok(is_secretkeeper_supported())
342 }
Shikha Panwarbd5eba92024-03-27 20:23:31 +0000343
Shikha Panwar07d701c2024-03-28 14:43:52 +0000344 fn removeVmInstance(&self, instance_id: &[u8; 64]) -> binder::Result<()> {
345 check_manage_access()?;
346 GLOBAL_SERVICE.removeVmInstance(instance_id)
347 }
348
Shikha Panwarbd5eba92024-03-27 20:23:31 +0000349 fn claimVmInstance(&self, instance_id: &[u8; 64]) -> binder::Result<()> {
350 check_manage_access()?;
351 GLOBAL_SERVICE.claimVmInstance(instance_id)
352 }
Andrew Walbran320b5602021-03-04 16:11:12 +0000353}
354
Inseob Kimecde8c02024-09-03 13:11:08 +0900355/// Implementation of the AIDL `IGlobalVmContext` interface for early VMs.
356#[derive(Debug, Default)]
357struct EarlyVmContext {
358 /// The unique CID assigned to the VM for vsock communication.
359 cid: Cid,
360 /// Temporary directory for this VM instance.
361 temp_dir: PathBuf,
362}
363
364impl EarlyVmContext {
365 fn new(cid: Cid, temp_dir: PathBuf) -> Result<Self> {
366 // Remove the entire directory before creating a VM. Early VMs use predefined CIDs and AVF
367 // should trust clients, e.g. they won't run two VMs at the same time
368 let _ = remove_dir_all(&temp_dir);
369 create_dir_all(&temp_dir).context(format!("can't create '{}'", temp_dir.display()))?;
370
371 Ok(Self { cid, temp_dir })
372 }
373}
374
375impl Interface for EarlyVmContext {}
376
377impl Drop for EarlyVmContext {
378 fn drop(&mut self) {
379 if let Err(e) = remove_dir_all(&self.temp_dir) {
380 error!("Cannot remove {} upon dropping: {e}", self.temp_dir.display());
381 }
382 }
383}
384
385impl IGlobalVmContext for EarlyVmContext {
386 fn getCid(&self) -> binder::Result<i32> {
387 Ok(self.cid as i32)
388 }
389
390 fn getTemporaryDirectory(&self) -> binder::Result<String> {
391 Ok(self.temp_dir.to_string_lossy().to_string())
392 }
393
394 fn setHostConsoleName(&self, _pathname: &str) -> binder::Result<()> {
395 Err(Status::new_exception_str(
396 ExceptionCode::UNSUPPORTED_OPERATION,
397 Some("Early VM doesn't support setting host console name"),
398 ))
399 }
400}
401
402fn find_partition(path: &Path) -> binder::Result<String> {
403 match path.components().nth(1) {
404 Some(std::path::Component::Normal(partition)) => {
405 Ok(partition.to_string_lossy().into_owned())
406 }
407 _ => Err(anyhow!("Can't find partition in '{}'", path.display()))
408 .or_service_specific_exception(-1),
409 }
410}
411
Jiyong Park8611a6c2021-07-09 18:17:44 +0900412impl VirtualizationService {
413 pub fn init() -> VirtualizationService {
David Brazdil49f96f52022-12-16 21:29:13 +0000414 VirtualizationService::default()
Jiyong Park8611a6c2021-07-09 18:17:44 +0900415 }
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000416
Inseob Kimecde8c02024-09-03 13:11:08 +0900417 fn create_early_vm_context(
418 &self,
419 config: &VirtualMachineConfig,
420 ) -> binder::Result<(VmContext, Cid, PathBuf)> {
421 let calling_exe_path = format!("/proc/{}/exe", get_calling_pid());
422 let link = fs::read_link(&calling_exe_path)
423 .context(format!("can't read_link '{calling_exe_path}'"))
424 .or_service_specific_exception(-1)?;
425 let partition = find_partition(&link)?;
426
427 let name = match config {
428 VirtualMachineConfig::RawConfig(config) => &config.name,
429 VirtualMachineConfig::AppConfig(config) => &config.name,
430 };
431 let early_vm =
432 find_early_vm_for_partition(&partition, name).or_service_specific_exception(-1)?;
433 if Path::new(&early_vm.path) != link {
434 return Err(anyhow!(
435 "VM '{name}' in partition '{partition}' must be created with '{}', not '{}'",
436 &early_vm.path,
437 link.display()
438 ))
439 .or_service_specific_exception(-1);
440 }
441
442 let cid = early_vm.cid as Cid;
443 let temp_dir = PathBuf::from(format!("/mnt/vm/early/{cid}"));
444
445 let context = EarlyVmContext::new(cid, temp_dir.clone())
446 .context(format!("Can't create early vm contexts for {cid}"))
447 .or_service_specific_exception(-1)?;
448 let service = VirtualMachineService::new_binder(self.state.clone(), cid).as_binder();
449
450 // Start VM service listening for connections from the new CID on port=CID.
451 let port = cid;
452 let vm_server = RpcServer::new_vsock(service, cid, port)
453 .context(format!("Could not start RpcServer on port {port}"))
454 .or_service_specific_exception(-1)?;
455 vm_server.start();
456 Ok((VmContext::new(Strong::new(Box::new(context)), vm_server), cid, temp_dir))
457 }
458
David Brazdil209074a2023-01-12 16:44:51 +0000459 fn create_vm_context(
460 &self,
461 requester_debug_pid: pid_t,
462 ) -> binder::Result<(VmContext, Cid, PathBuf)> {
David Brazdil8cf8f482022-11-23 14:21:26 +0000463 const NUM_ATTEMPTS: usize = 5;
464
465 for _ in 0..NUM_ATTEMPTS {
Charisee96113f32023-01-26 09:00:42 +0000466 let vm_context = GLOBAL_SERVICE.allocateGlobalVmContext(requester_debug_pid)?;
David Brazdild4f51a52023-01-11 14:09:27 +0000467 let cid = vm_context.getCid()? as Cid;
468 let temp_dir: PathBuf = vm_context.getTemporaryDirectory()?.into();
David Brazdil8cf8f482022-11-23 14:21:26 +0000469 let service = VirtualMachineService::new_binder(self.state.clone(), cid).as_binder();
470
471 // Start VM service listening for connections from the new CID on port=CID.
David Brazdil8cf8f482022-11-23 14:21:26 +0000472 let port = cid;
David Brazdil3238da42022-11-18 10:04:51 +0000473 match RpcServer::new_vsock(service, cid, port) {
David Brazdil8cf8f482022-11-23 14:21:26 +0000474 Ok(vm_server) => {
475 vm_server.start();
David Brazdild4f51a52023-01-11 14:09:27 +0000476 return Ok((VmContext::new(vm_context, vm_server), cid, temp_dir));
David Brazdil8cf8f482022-11-23 14:21:26 +0000477 }
478 Err(err) => {
479 warn!("Could not start RpcServer on port {}: {}", port, err);
480 }
481 }
482 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900483 Err(anyhow!("Too many attempts to create VM context failed"))
484 .or_service_specific_exception(-1)
David Brazdil8cf8f482022-11-23 14:21:26 +0000485 }
486
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000487 fn create_vm_internal(
488 &self,
489 config: &VirtualMachineConfig,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900490 console_out_fd: Option<&ParcelFileDescriptor>,
491 console_in_fd: Option<&ParcelFileDescriptor>,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000492 log_fd: Option<&ParcelFileDescriptor>,
493 is_protected: &mut bool,
Elie Kheirallah5c807a22024-09-23 20:40:42 +0000494 dump_dt_fd: Option<&ParcelFileDescriptor>,
Devin Moore407df8f2024-08-27 19:39:16 +0000495 ) -> binder::Result<Strong<dyn IVirtualMachine::IVirtualMachine>> {
David Brazdil209074a2023-01-12 16:44:51 +0000496 let requester_uid = get_calling_uid();
497 let requester_debug_pid = get_calling_pid();
498
Nikita Ioffe631717e2023-09-05 13:38:07 +0100499 check_config_features(config)?;
500
Inseob Kimecde8c02024-09-03 13:11:08 +0900501 if cfg!(early) {
502 check_config_allowed_for_early_vms(config)?;
503 }
504
David Brazdil209074a2023-01-12 16:44:51 +0000505 // Allocating VM context checks the MANAGE_VIRTUAL_MACHINE permission.
Inseob Kimecde8c02024-09-03 13:11:08 +0900506 let (vm_context, cid, temporary_directory) = if cfg!(early) {
507 self.create_early_vm_context(config)?
508 } else {
509 self.create_vm_context(requester_debug_pid)?
510 };
Inseob Kim1119d702022-05-02 18:01:58 +0900511
Alan Stokesfda70842023-12-20 17:50:14 +0000512 if is_custom_config(config) {
Alan Stokes7bc146c2022-10-20 17:10:32 +0100513 check_use_custom_virtual_machine()?;
Inseob Kim1119d702022-05-02 18:01:58 +0900514 }
515
Nikita Ioffe5776f082023-02-10 21:38:26 +0000516 let gdb_port = extract_gdb_port(config);
517
518 // Additional permission checks if caller request gdb.
519 if gdb_port.is_some() {
520 check_gdb_allowed(config)?;
521 }
522
Nikita Ioffeb2c6f3a2024-06-06 12:51:53 +0000523 let device_tree_overlay = maybe_create_device_tree_overlay(config, &temporary_directory)?;
Seungjae Yooec3bc522023-11-09 10:14:30 +0900524
Jaewan Kimf3143242024-03-15 06:56:31 +0000525 let debug_config = DebugConfig::new(config);
Nikita Ioffe2cb75cf2024-06-04 16:43:56 +0000526 let ramdump = if !uses_gki_kernel(config) && debug_config.is_ramdump_needed() {
Jiyong Parked180932023-02-24 19:55:41 +0900527 Some(prepare_ramdump_file(&temporary_directory)?)
528 } else {
529 None
530 };
531
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000532 let state = &mut *self.state.lock().unwrap();
Jiyong Parke6fb1672023-06-26 16:45:55 +0900533 let console_out_fd =
Pierre-Clément Tosifc523c52024-08-20 10:34:06 +0100534 clone_or_prepare_logger_fd(console_out_fd, format!("Console({})", cid))?;
Jiyong Parke6fb1672023-06-26 16:45:55 +0900535 let console_in_fd = console_in_fd.map(clone_file).transpose()?;
Pierre-Clément Tosifc523c52024-08-20 10:34:06 +0100536 let log_fd = clone_or_prepare_logger_fd(log_fd, format!("Log({})", cid))?;
Elie Kheirallah5c807a22024-09-23 20:40:42 +0000537 let dump_dt_fd = dump_dt_fd.map(clone_file).transpose()?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000538
539 // Counter to generate unique IDs for temporary image files.
540 let mut next_temporary_image_id = 0;
541 // Files which are referred to from composite images. These must be mapped to the crosvm
542 // child process, and not closed before it is started.
543 let mut indirect_files = vec![];
544
Alan Stokes7bc146c2022-10-20 17:10:32 +0100545 let (is_app_config, config) = match config {
546 VirtualMachineConfig::RawConfig(config) => (false, BorrowedOrOwned::Borrowed(config)),
547 VirtualMachineConfig::AppConfig(config) => {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900548 let config = load_app_config(config, &debug_config, &temporary_directory)
549 .or_service_specific_exception_with(-1, |e| {
Jaewan Kim61f86142023-03-28 15:12:52 +0900550 *is_protected = config.protectedVm;
551 let message = format!("Failed to load app config: {:?}", e);
552 error!("{}", message);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900553 message
Jaewan Kim61f86142023-03-28 15:12:52 +0900554 })?;
Alan Stokes7bc146c2022-10-20 17:10:32 +0100555 (true, BorrowedOrOwned::Owned(config))
556 }
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000557 };
558 let config = config.as_ref();
559 *is_protected = config.protectedVm;
560
561 // Check if partition images are labeled incorrectly. This is to prevent random images
562 // which are not protected by the Android Verified Boot (e.g. bits downloaded by apps) from
Alan Stokes3e5eec12023-09-07 12:10:00 +0100563 // being loaded in a pVM. This applies to everything but the instance image in the raw
564 // config, and everything but the non-executable, generated partitions in the app
565 // config.
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000566 config
567 .disks
568 .iter()
569 .flat_map(|disk| disk.partitions.iter())
570 .filter(|partition| {
571 if is_app_config {
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100572 !is_safe_app_partition(&partition.label)
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000573 } else {
Alice Wangc206b9b2023-08-28 14:13:51 +0000574 !is_safe_raw_partition(&partition.label)
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000575 }
576 })
577 .try_for_each(check_label_for_partition)
Jiyong Park2227eaa2023-08-04 11:59:18 +0900578 .or_service_specific_exception(-1)?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000579
Inseob Kimff48a7c2024-02-26 22:07:21 +0900580 // Check if files for payloads and bases are NOT coming from /vendor and /odm, as they may
581 // have unstable interfaces.
582 // TODO(b/316431494): remove once Treble interfaces are stabilized.
583 check_partitions_for_files(config).or_service_specific_exception(-1)?;
584
Alan Stokes185fe112023-01-10 16:20:55 +0000585 let kernel = maybe_clone_file(&config.kernel)?;
586 let initrd = maybe_clone_file(&config.initrd)?;
587
Alan Stokes185fe112023-01-10 16:20:55 +0000588 if config.protectedVm {
Nikita Ioffef934e812024-07-05 15:44:41 +0000589 // In a protected VM, we require custom kernels to come from a trusted source
590 // (b/237054515).
Jiyong Park2227eaa2023-08-04 11:59:18 +0900591 check_label_for_kernel_files(&kernel, &initrd).or_service_specific_exception(-1)?;
Nikita Ioffef934e812024-07-05 15:44:41 +0000592 // Fail fast with a meaningful error message in case device doesn't support pVMs.
593 check_protected_vm_is_supported()?;
Alan Stokes185fe112023-01-10 16:20:55 +0000594 }
595
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000596 let zero_filler_path = temporary_directory.join("zero.img");
Jiyong Park2227eaa2023-08-04 11:59:18 +0900597 write_zero_filler(&zero_filler_path)
598 .context("Failed to make composite image")
599 .with_log()
600 .or_service_specific_exception(-1)?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000601
602 // Assemble disk images if needed.
603 let disks = config
604 .disks
605 .iter()
606 .map(|disk| {
607 assemble_disk_image(
608 disk,
609 &zero_filler_path,
610 &temporary_directory,
611 &mut next_temporary_image_id,
612 &mut indirect_files,
613 )
614 })
615 .collect::<Result<Vec<DiskFile>, _>>()?;
616
Akilesh Kailash05515dc2024-10-22 21:42:52 -0700617 let shared_paths = assemble_shared_paths(&config.sharedPaths, &temporary_directory)?;
618
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000619 let (cpus, host_cpu_topology) = match config.cpuTopology {
620 CpuTopology::MATCH_HOST => (None, true),
621 CpuTopology::ONE_CPU => (NonZeroU32::new(1), false),
622 val => {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900623 return Err(anyhow!("Failed to parse CPU topology value {:?}", val))
624 .with_log()
625 .or_service_specific_exception(-1);
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000626 }
627 };
628
David Brazdil2dfefd12023-11-17 14:07:36 +0000629 let (vfio_devices, dtbo) = if !config.devices.is_empty() {
Inseob Kim6ef80972023-07-20 17:23:36 +0900630 let mut set = HashSet::new();
631 for device in config.devices.iter() {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900632 let path = canonicalize(device)
633 .with_context(|| format!("can't canonicalize {device}"))
634 .or_service_specific_exception(-1)?;
Inseob Kim6ef80972023-07-20 17:23:36 +0900635 if !set.insert(path) {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900636 return Err(anyhow!("duplicated device {device}"))
637 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Inseob Kim6ef80972023-07-20 17:23:36 +0900638 }
639 }
Jakob Vukalovicd42aa2c2023-11-09 16:04:00 +0000640 let devices = GLOBAL_SERVICE.bindDevicesToVfioDriver(&config.devices)?;
David Brazdil2dfefd12023-11-17 14:07:36 +0000641 let dtbo_file = File::from(
642 GLOBAL_SERVICE
643 .getDtboFile()?
644 .as_ref()
645 .try_clone()
Jaewan Kim39952072024-01-19 17:04:53 +0900646 .context("Failed to create VM DTBO from ParcelFileDescriptor")
David Brazdil2dfefd12023-11-17 14:07:36 +0000647 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?,
648 );
649 (devices, Some(dtbo_file))
Inseob Kim7307a892023-09-14 13:37:58 +0900650 } else {
David Brazdil2dfefd12023-11-17 14:07:36 +0000651 (vec![], None)
Inseob Kim7307a892023-09-14 13:37:58 +0900652 };
Jeongik Cha798401c2024-04-11 21:54:49 +0900653 let display_config = if cfg!(paravirtualized_devices) {
654 config
655 .displayConfig
656 .as_ref()
657 .map(DisplayConfig::new)
658 .transpose()
659 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?
660 } else {
661 None
662 };
Jason Macnakea7b0fa2024-05-08 17:02:44 -0700663 let gpu_config = if cfg!(paravirtualized_devices) {
664 config
665 .gpuConfig
666 .as_ref()
667 .map(GpuConfig::new)
668 .transpose()
669 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?
670 } else {
671 None
672 };
Jeongik Cha1df1c032024-04-03 16:03:12 +0900673
Jeongik Chac181be72024-03-27 00:18:30 +0900674 let input_device_options = if cfg!(paravirtualized_devices) {
675 config
676 .inputDevices
677 .iter()
678 .map(to_input_device_option_from)
679 .collect::<Result<Vec<InputDeviceOption>, _>>()
680 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?
681 } else {
682 vec![]
683 };
684
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900685 // Create TAP network interface if the VM supports network.
Seungjae Yoo986d7a42024-05-28 14:06:58 +0900686 let tap = if cfg!(network) && config.networkSupported {
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900687 if *is_protected {
688 return Err(anyhow!("Network feature is not supported for pVM yet"))
689 .with_log()
690 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION)?;
691 }
Seungjae Yoo986d7a42024-05-28 14:06:58 +0900692 Some(File::from(
693 GLOBAL_SERVICE
694 .createTapInterface(&get_this_pid().to_string())?
695 .as_ref()
696 .try_clone()
697 .context("Failed to get TAP interface from ParcelFileDescriptor")
698 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?,
699 ))
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900700 } else {
701 None
702 };
Mu-Le Leeb2d5a312024-06-05 10:52:47 +0800703
704 let audio_config = if cfg!(paravirtualized_devices) {
705 config.audioConfig.as_ref().map(AudioConfig::new)
706 } else {
707 None
708 };
Seungjae Yoo13af0b62024-05-20 14:15:13 +0900709
Elie Kheirallah29d72912024-08-07 20:17:26 +0000710 let usb_config = config
711 .usbConfig
712 .as_ref()
713 .map(UsbConfig::new)
714 .unwrap_or(Ok(UsbConfig { controller: false }))
715 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?;
716
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000717 // Actually start the VM.
718 let crosvm_config = CrosvmConfig {
719 cid,
Seungjae Yoo62085c02022-08-12 04:44:52 +0000720 name: config.name.clone(),
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000721 bootloader: maybe_clone_file(&config.bootloader)?,
Alan Stokes185fe112023-01-10 16:20:55 +0000722 kernel,
723 initrd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000724 disks,
Akilesh Kailash05515dc2024-10-22 21:42:52 -0700725 shared_paths,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000726 params: config.params.to_owned(),
727 protected: *is_protected,
Jaewan Kim61f86142023-03-28 15:12:52 +0900728 debug_config,
Frederick Mayle68d06e72024-07-12 17:18:11 -0700729 memory_mib: config
730 .memoryMib
731 .try_into()
732 .ok()
733 .and_then(NonZeroU32::new)
734 .unwrap_or(NonZeroU32::new(256).unwrap()),
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000735 cpus,
736 host_cpu_topology,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900737 console_out_fd,
738 console_in_fd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000739 log_fd,
Jiyong Parked180932023-02-24 19:55:41 +0900740 ramdump,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000741 indirect_files,
742 platform_version: parse_platform_version_req(&config.platformVersion)?,
Jiyong Parke6ed0f92022-06-22 00:13:00 +0900743 detect_hangup: is_app_config,
Nikita Ioffe5776f082023-02-10 21:38:26 +0000744 gdb_port,
Inseob Kim7307a892023-09-14 13:37:58 +0900745 vfio_devices,
David Brazdil2dfefd12023-11-17 14:07:36 +0000746 dtbo,
Shikha Panwar55e10ec2024-02-13 12:53:49 +0000747 device_tree_overlay,
Jeongik Cha1df1c032024-04-03 16:03:12 +0900748 display_config,
Jeongik Chac181be72024-03-27 00:18:30 +0900749 input_device_options,
Vincent Donnefort538a2c62024-03-20 16:01:10 +0000750 hugepages: config.hugePages,
Seungjae Yoo986d7a42024-05-28 14:06:58 +0900751 tap,
Yi-Yo Chiang8dd32552024-05-22 19:38:16 +0800752 console_input_device: config.consoleInputDevice.clone(),
David Dai23cff712024-06-13 19:23:45 +0000753 boost_uclamp: config.boostUclamp,
Jason Macnakea7b0fa2024-05-08 17:02:44 -0700754 gpu_config,
Mu-Le Leeb2d5a312024-06-05 10:52:47 +0800755 audio_config,
Jeongik Cha75057452024-09-03 11:26:04 +0900756 no_balloon: config.noBalloon,
Elie Kheirallah29d72912024-08-07 20:17:26 +0000757 usb_config,
Elie Kheirallah5c807a22024-09-23 20:40:42 +0000758 dump_dt_fd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000759 };
760 let instance = Arc::new(
David Brazdil528e0472022-10-10 15:06:02 +0100761 VmInstance::new(
762 crosvm_config,
763 temporary_directory,
764 requester_uid,
765 requester_debug_pid,
766 vm_context,
767 )
Jiyong Park2227eaa2023-08-04 11:59:18 +0900768 .with_context(|| format!("Failed to create VM with config {:?}", config))
769 .with_log()
770 .or_service_specific_exception(-1)?,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000771 );
772 state.add_vm(Arc::downgrade(&instance));
773 Ok(VirtualMachine::create(instance))
774 }
Jiyong Park8611a6c2021-07-09 18:17:44 +0900775}
776
Alan Stokesfda70842023-12-20 17:50:14 +0000777/// Returns whether a VM config represents a "custom" virtual machine, which requires the
778/// USE_CUSTOM_VIRTUAL_MACHINE.
779fn is_custom_config(config: &VirtualMachineConfig) -> bool {
780 match config {
781 // Any raw (non-Microdroid) VM is considered custom.
782 VirtualMachineConfig::RawConfig(_) => true,
783 VirtualMachineConfig::AppConfig(config) => {
784 // Some features are reserved for platform apps only, even when using
785 // VirtualMachineAppConfig. Almost all of these features are grouped in the
786 // CustomConfig struct:
787 // - controlling CPUs;
788 // - gdbPort is set, meaning that crosvm will start a gdb server;
789 // - using anything other than the default kernel;
790 // - specifying devices to be assigned.
791 if config.customConfig.is_some() {
792 true
793 } else {
794 // Additional custom features not included in CustomConfig:
795 // - specifying a config file;
Alan Stokes736f6822024-02-16 16:08:00 +0000796 // - specifying extra APKs;
797 // - specifying an OS other than Microdroid.
Inseob Kim89b24592024-02-23 18:59:43 +0900798 (match &config.payload {
Alan Stokesfda70842023-12-20 17:50:14 +0000799 Payload::ConfigPath(_) => true,
Inseob Kim89b24592024-02-23 18:59:43 +0900800 Payload::PayloadConfig(payload_config) => !payload_config.extraApks.is_empty(),
801 }) || config.osName != MICRODROID_OS_NAME
Alan Stokesfda70842023-12-20 17:50:14 +0000802 }
803 }
804 }
805}
806
Seungjae Yoo14e60182024-02-21 13:28:31 +0900807fn extract_vendor_hashtree_digest(config: &VirtualMachineConfig) -> Result<Option<Vec<u8>>> {
808 let VirtualMachineConfig::AppConfig(config) = config else {
809 return Ok(None);
810 };
811 let Some(custom_config) = &config.customConfig else {
812 return Ok(None);
813 };
814 let Some(file) = custom_config.vendorImage.as_ref() else {
815 return Ok(None);
816 };
817
818 let file = clone_file(file)?;
819 let size =
820 file.metadata().context("Failed to get metadata from microdroid vendor image")?.len();
821 let vbmeta = VbMetaImage::verify_reader_region(&file, 0, size)
822 .context("Failed to get vbmeta from microdroid-vendor.img")?;
823
824 for descriptor in vbmeta.descriptors()?.iter() {
825 if let vbmeta::Descriptor::Hashtree(_) = descriptor {
826 let root_digest = hex::encode(descriptor.to_hashtree()?.root_digest());
827 return Ok(Some(root_digest.as_bytes().to_vec()));
828 }
829 }
830 Err(anyhow!("No hashtree digest is extracted from microdroid vendor image"))
831}
832
Nikita Ioffeb2c6f3a2024-06-06 12:51:53 +0000833fn maybe_create_device_tree_overlay(
834 config: &VirtualMachineConfig,
835 temporary_directory: &Path,
836) -> binder::Result<Option<File>> {
837 // Currently, VirtMgr adds the host copy of reference DT & untrusted properties
838 // (e.g. instance-id)
839 let host_ref_dt = Path::new(VM_REFERENCE_DT_ON_HOST_PATH);
840 let host_ref_dt = if host_ref_dt.exists()
841 && read_dir(host_ref_dt).or_service_specific_exception(-1)?.next().is_some()
842 {
843 Some(host_ref_dt)
844 } else {
845 warn!("VM reference DT doesn't exist in host DT");
846 None
847 };
848
849 let vendor_hashtree_digest = extract_vendor_hashtree_digest(config)
850 .context("Failed to extract vendor hashtree digest")
851 .or_service_specific_exception(-1)?;
852
853 let trusted_props = if let Some(ref vendor_hashtree_digest) = vendor_hashtree_digest {
854 info!(
855 "Passing vendor hashtree digest to pvmfw. This will be rejected if it doesn't \
856 match the trusted digest in the pvmfw config, causing the VM to fail to start."
857 );
858 vec![(cstr!("vendor_hashtree_descriptor_root_digest"), vendor_hashtree_digest.as_slice())]
859 } else {
860 vec![]
861 };
862
863 let instance_id;
864 let mut untrusted_props = Vec::with_capacity(2);
865 if cfg!(llpvm_changes) {
866 instance_id = extract_instance_id(config);
867 untrusted_props.push((cstr!("instance-id"), &instance_id[..]));
868 let want_updatable = extract_want_updatable(config);
869 if want_updatable && is_secretkeeper_supported() {
870 // Let guest know that it can defer rollback protection to Secretkeeper by setting
871 // an empty property in untrusted node in DT. This enables Updatable VMs.
872 untrusted_props.push((cstr!("defer-rollback-protection"), &[]))
873 }
874 }
875
876 let device_tree_overlay = if host_ref_dt.is_some()
877 || !untrusted_props.is_empty()
878 || !trusted_props.is_empty()
879 {
880 let dt_output = temporary_directory.join(VM_DT_OVERLAY_PATH);
881 let mut data = [0_u8; VM_DT_OVERLAY_MAX_SIZE];
882 let fdt =
883 create_device_tree_overlay(&mut data, host_ref_dt, &untrusted_props, &trusted_props)
884 .map_err(|e| anyhow!("Failed to create DT overlay, {e:?}"))
885 .or_service_specific_exception(-1)?;
886 fs::write(&dt_output, fdt.as_slice()).or_service_specific_exception(-1)?;
887 Some(File::open(dt_output).or_service_specific_exception(-1)?)
888 } else {
889 None
890 };
891 Ok(device_tree_overlay)
892}
893
Andrew Walbranfbb39d22021-07-28 17:01:25 +0000894fn write_zero_filler(zero_filler_path: &Path) -> Result<()> {
Jooyung Han95884632021-07-06 22:27:54 +0900895 let file = OpenOptions::new()
896 .create_new(true)
897 .read(true)
898 .write(true)
899 .open(zero_filler_path)
900 .with_context(|| "Failed to create zero.img")?;
901 file.set_len(ZERO_FILLER_SIZE)?;
Andrew Walbranfbb39d22021-07-28 17:01:25 +0000902 Ok(())
Jooyung Han95884632021-07-06 22:27:54 +0900903}
904
David Brazdilf50c7a62023-04-19 14:22:42 +0000905fn format_as_android_vm_instance(part: &mut dyn Write) -> std::io::Result<()> {
906 part.write_all(ANDROID_VM_INSTANCE_MAGIC.as_bytes())?;
907 part.write_all(&ANDROID_VM_INSTANCE_VERSION.to_le_bytes())?;
908 part.flush()
909}
910
911fn format_as_encryptedstore(part: &mut dyn Write) -> std::io::Result<()> {
912 part.write_all(UNFORMATTED_STORAGE_MAGIC.as_bytes())?;
913 part.flush()
914}
915
916fn round_up(input: u64, granularity: u64) -> u64 {
917 if granularity == 0 {
918 return input;
919 }
920 // If the input is absurdly large we round down instead of up; it's going to fail anyway.
921 let result = input.checked_add(granularity - 1).unwrap_or(input);
922 (result / granularity) * granularity
923}
924
Jeongik Chac181be72024-03-27 00:18:30 +0900925fn to_input_device_option_from(input_device: &InputDevice) -> Result<InputDeviceOption> {
926 Ok(match input_device {
927 InputDevice::SingleTouch(single_touch) => InputDeviceOption::SingleTouch {
928 file: clone_file(single_touch.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?)?,
929 height: u32::try_from(single_touch.height)?,
930 width: u32::try_from(single_touch.width)?,
931 name: if !single_touch.name.is_empty() {
932 Some(single_touch.name.clone())
933 } else {
934 None
935 },
936 },
937 InputDevice::EvDev(evdev) => InputDeviceOption::EvDev(clone_file(
938 evdev.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
939 )?),
Jeongik Cha985b6402024-04-15 18:13:00 +0900940 InputDevice::Keyboard(keyboard) => InputDeviceOption::Keyboard(clone_file(
941 keyboard.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
942 )?),
Jeongik Cha343894e2024-05-17 20:39:31 +0900943 InputDevice::Mouse(mouse) => InputDeviceOption::Mouse(clone_file(
944 mouse.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
945 )?),
Jiyong Park6c1b9f02024-07-05 16:21:10 +0900946 InputDevice::Switches(switches) => InputDeviceOption::Switches(clone_file(
947 switches.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?,
948 )?),
Jeongik Cha112a2682024-07-09 12:28:45 +0900949 InputDevice::Trackpad(trackpad) => InputDeviceOption::MultiTouchTrackpad {
950 file: clone_file(trackpad.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?)?,
951 height: u32::try_from(trackpad.height)?,
952 width: u32::try_from(trackpad.width)?,
953 name: if !trackpad.name.is_empty() { Some(trackpad.name.clone()) } else { None },
954 },
Jeongik Cha10494912024-07-16 11:19:50 +0900955 InputDevice::MultiTouch(multi_touch) => InputDeviceOption::MultiTouch {
956 file: clone_file(multi_touch.pfd.as_ref().ok_or(anyhow!("pfd should have value"))?)?,
957 height: u32::try_from(multi_touch.height)?,
958 width: u32::try_from(multi_touch.width)?,
959 name: if !multi_touch.name.is_empty() { Some(multi_touch.name.clone()) } else { None },
960 },
Jeongik Chac181be72024-03-27 00:18:30 +0900961 })
962}
Akilesh Kailash05515dc2024-10-22 21:42:52 -0700963
964fn assemble_shared_paths(
965 shared_paths: &[SharedPath],
966 temporary_directory: &Path,
967) -> Result<Vec<SharedPathConfig>, Status> {
968 if shared_paths.is_empty() {
969 return Ok(Vec::new()); // Return an empty vector if shared_paths is empty
970 }
971
972 shared_paths
973 .iter()
974 .map(|path| {
975 Ok(SharedPathConfig {
976 path: path.sharedPath.clone(),
977 host_uid: path.hostUid,
978 host_gid: path.hostGid,
979 guest_uid: path.guestUid,
980 guest_gid: path.guestGid,
981 mask: path.mask,
982 tag: path.tag.clone(),
983 socket_path: temporary_directory.join(&path.socket).to_string_lossy().to_string(),
984 })
985 })
986 .collect()
987}
988
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000989/// Given the configuration for a disk image, assembles the `DiskFile` to pass to crosvm.
990///
991/// This may involve assembling a composite disk from a set of partition images.
992fn assemble_disk_image(
993 disk: &DiskImage,
Jooyung Han95884632021-07-06 22:27:54 +0900994 zero_filler_path: &Path,
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000995 temporary_directory: &Path,
996 next_temporary_image_id: &mut u64,
997 indirect_files: &mut Vec<File>,
Andrew Walbran806f1542021-06-10 14:07:12 +0000998) -> Result<DiskFile, Status> {
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000999 let image = if !disk.partitions.is_empty() {
1000 if disk.image.is_some() {
1001 warn!("DiskImage {:?} contains both image and partitions.", disk);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001002 return Err(anyhow!("DiskImage contains both image and partitions"))
1003 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001004 }
1005
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001006 let composite_image_filenames =
1007 make_composite_image_filenames(temporary_directory, next_temporary_image_id);
1008 let (image, partition_files) = make_composite_image(
1009 &disk.partitions,
Jooyung Han95884632021-07-06 22:27:54 +09001010 zero_filler_path,
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001011 &composite_image_filenames.composite,
1012 &composite_image_filenames.header,
1013 &composite_image_filenames.footer,
1014 )
Jiyong Park2227eaa2023-08-04 11:59:18 +09001015 .with_context(|| format!("Failed to make composite disk image with config {:?}", disk))
1016 .with_log()
1017 .or_service_specific_exception(-1)?;
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001018
1019 // Pass the file descriptors for the various partition files to crosvm when it
1020 // is run.
1021 indirect_files.extend(partition_files);
1022
1023 image
1024 } else if let Some(image) = &disk.image {
1025 clone_file(image)?
1026 } else {
1027 warn!("DiskImage {:?} didn't contain image or partitions.", disk);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001028 return Err(anyhow!("DiskImage didn't contain image or partitions."))
1029 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001030 };
1031
1032 Ok(DiskFile { image, writable: disk.writable })
1033}
1034
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01001035fn append_kernel_param(param: &str, vm_config: &mut VirtualMachineRawConfig) {
1036 if let Some(ref mut params) = vm_config.params {
1037 params.push(' ');
1038 params.push_str(param)
1039 } else {
1040 vm_config.params = Some(param.to_owned())
1041 }
1042}
1043
Inseob Kim46257382024-01-03 15:41:22 +09001044fn extract_os_name_from_config_path(config: &Path) -> Option<String> {
1045 if config.extension()?.to_str()? != "json" {
1046 return None;
Inseob Kim172f9eb2023-11-06 17:02:08 +09001047 }
Inseob Kim46257382024-01-03 15:41:22 +09001048
1049 Some(config.with_extension("").file_name()?.to_str()?.to_owned())
1050}
1051
1052fn extract_os_names_from_configs(config_glob_pattern: &str) -> Result<HashSet<String>> {
1053 let configs = glob(config_glob_pattern)?.collect::<Result<Vec<_>, _>>()?;
1054 let os_names =
1055 configs.iter().filter_map(|x| extract_os_name_from_config_path(x)).collect::<HashSet<_>>();
1056
1057 Ok(os_names)
1058}
1059
1060fn get_supported_os_names() -> Result<HashSet<String>> {
1061 if !cfg!(vendor_modules) {
1062 return Ok(iter::once(MICRODROID_OS_NAME.to_owned()).collect());
1063 }
1064
1065 extract_os_names_from_configs("/apex/com.android.virt/etc/microdroid*.json")
1066}
1067
1068fn is_valid_os(os_name: &str) -> bool {
1069 SUPPORTED_OS_NAMES.contains(os_name)
Inseob Kim172f9eb2023-11-06 17:02:08 +09001070}
1071
Nikita Ioffe2cb75cf2024-06-04 16:43:56 +00001072fn uses_gki_kernel(config: &VirtualMachineConfig) -> bool {
1073 if !cfg!(vendor_modules) {
1074 return false;
1075 }
1076 match config {
1077 VirtualMachineConfig::RawConfig(_) => false,
1078 VirtualMachineConfig::AppConfig(config) => config.osName.starts_with("microdroid_gki-"),
1079 }
1080}
1081
Jooyung Han21e9b922021-06-26 04:14:16 +09001082fn load_app_config(
1083 config: &VirtualMachineAppConfig,
Jaewan Kim61f86142023-03-28 15:12:52 +09001084 debug_config: &DebugConfig,
Jooyung Han21e9b922021-06-26 04:14:16 +09001085 temporary_directory: &Path,
Jooyung Hanadfb76c2021-06-28 17:29:30 +09001086) -> Result<VirtualMachineRawConfig> {
Andrew Walbrancc0db522021-07-12 17:03:42 +00001087 let apk_file = clone_file(config.apk.as_ref().unwrap())?;
1088 let idsig_file = clone_file(config.idsig.as_ref().unwrap())?;
Jiyong Park8d081812021-07-23 17:45:04 +09001089 let instance_file = clone_file(config.instanceImage.as_ref().unwrap())?;
Jooyung Han21e9b922021-06-26 04:14:16 +09001090
Shikha Panwar22e70452022-10-10 18:32:55 +00001091 let storage_image = if let Some(file) = config.encryptedStorageImage.as_ref() {
1092 Some(clone_file(file)?)
1093 } else {
1094 None
1095 };
1096
Alan Stokesfda70842023-12-20 17:50:14 +00001097 let vm_payload_config;
1098 let extra_apk_files: Vec<_>;
1099 match &config.payload {
Alan Stokes0d1ef782022-09-27 13:46:35 +01001100 Payload::ConfigPath(config_path) => {
Alan Stokesfda70842023-12-20 17:50:14 +00001101 vm_payload_config =
1102 load_vm_payload_config_from_file(&apk_file, config_path.as_str())
1103 .with_context(|| format!("Couldn't read config from {}", config_path))?;
1104 extra_apk_files = vm_payload_config
1105 .extra_apks
1106 .iter()
1107 .enumerate()
1108 .map(|(i, apk)| {
1109 File::open(PathBuf::from(&apk.path))
1110 .with_context(|| format!("Failed to open extra apk #{i} {}", apk.path))
1111 })
1112 .collect::<Result<_>>()?;
Alan Stokes0d1ef782022-09-27 13:46:35 +01001113 }
Alan Stokesfda70842023-12-20 17:50:14 +00001114 Payload::PayloadConfig(payload_config) => {
1115 vm_payload_config = create_vm_payload_config(payload_config)?;
1116 extra_apk_files =
1117 payload_config.extraApks.iter().map(clone_file).collect::<binder::Result<_>>()?;
1118 }
Alan Stokes0d1ef782022-09-27 13:46:35 +01001119 };
Jooyung Han21e9b922021-06-26 04:14:16 +09001120
Inseob Kim89b24592024-02-23 18:59:43 +09001121 let payload_config_os = vm_payload_config.os.name.as_str();
1122 if !payload_config_os.is_empty() && payload_config_os != "microdroid" {
1123 bail!("'os' in payload config is deprecated");
1124 }
1125
Inseob Kim172f9eb2023-11-06 17:02:08 +09001126 // For now, the only supported OS is Microdroid and Microdroid GKI
Inseob Kim89b24592024-02-23 18:59:43 +09001127 let os_name = config.osName.as_str();
Inseob Kim172f9eb2023-11-06 17:02:08 +09001128 if !is_valid_os(os_name) {
Andrew Walbrancc0db522021-07-12 17:03:42 +00001129 bail!("Unknown OS \"{}\"", os_name);
Jooyung Han35edb8f2021-07-01 16:17:16 +09001130 }
Andrew Walbrancc0db522021-07-12 17:03:42 +00001131
1132 // It is safe to construct a filename based on the os_name because we've already checked that it
1133 // is one of the allowed values.
Jooyung Han21e9b922021-06-26 04:14:16 +09001134 let vm_config_path = PathBuf::from(format!("/apex/com.android.virt/etc/{}.json", os_name));
1135 let vm_config_file = File::open(vm_config_path)?;
Andrew Walbrancc0db522021-07-12 17:03:42 +00001136 let mut vm_config = VmConfig::load(&vm_config_file)?.to_parcelable()?;
Jooyung Han21e9b922021-06-26 04:14:16 +09001137
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +01001138 if let Some(custom_config) = &config.customConfig {
1139 if let Some(file) = custom_config.customKernelImage.as_ref() {
1140 vm_config.kernel = Some(ParcelFileDescriptor::new(clone_file(file)?))
1141 }
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +01001142 vm_config.gdbPort = custom_config.gdbPort;
Nikita Ioffe5dfddf22023-06-29 16:11:26 +01001143
1144 if let Some(file) = custom_config.vendorImage.as_ref() {
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01001145 add_microdroid_vendor_image(clone_file(file)?, &mut vm_config);
Pechetty Sravani (xWF)faabfbd2024-09-24 15:27:48 +00001146 append_kernel_param("androidboot.microdroid.mount_vendor=1", &mut vm_config)
Nikita Ioffe5dfddf22023-06-29 16:11:26 +01001147 }
Inseob Kim6ef80972023-07-20 17:23:36 +09001148
Chris Wailes6177c662024-05-09 14:37:44 -07001149 vm_config.devices.clone_from(&custom_config.devices);
Seungjae Yoo13af0b62024-05-20 14:15:13 +09001150 vm_config.networkSupported = custom_config.networkSupported;
Nikita Ioffeb4268b32024-09-03 10:23:14 +00001151
1152 for param in custom_config.extraKernelCmdlineParams.iter() {
1153 append_kernel_param(param, &mut vm_config);
1154 }
Nikita Ioffe26c35ed2023-06-05 17:49:08 +01001155 }
1156
Andrew Walbrancc045902021-07-27 16:06:17 +00001157 if config.memoryMib > 0 {
1158 vm_config.memoryMib = config.memoryMib;
Andrew Walbran45bcb0c2021-07-14 15:02:06 +00001159 }
1160
Chris Wailes6177c662024-05-09 14:37:44 -07001161 vm_config.name.clone_from(&config.name);
Andrew Walbran3994f002022-01-27 17:33:45 +00001162 vm_config.protectedVm = config.protectedVm;
David Brazdil7d1e5ec2023-02-06 17:56:29 +00001163 vm_config.cpuTopology = config.cpuTopology;
Vincent Donnefort538a2c62024-03-20 16:01:10 +00001164 vm_config.hugePages = config.hugePages || vm_payload_config.hugepages;
David Dai23cff712024-06-13 19:23:45 +00001165 vm_config.boostUclamp = config.boostUclamp;
Jiyong Park032615f2022-01-10 13:55:34 +09001166
Shikha Panwar22e70452022-10-10 18:32:55 +00001167 // Microdroid takes additional init ramdisk & (optionally) storage image
Inseob Kim172f9eb2023-11-06 17:02:08 +09001168 add_microdroid_system_images(config, instance_file, storage_image, os_name, &mut vm_config)?;
Shikha Panwar22e70452022-10-10 18:32:55 +00001169
1170 // Include Microdroid payload disk (contains apks, idsigs) in vm config
1171 add_microdroid_payload_images(
Alan Stokes0d1ef782022-09-27 13:46:35 +01001172 config,
Jaewan Kim61f86142023-03-28 15:12:52 +09001173 debug_config,
Alan Stokes0d1ef782022-09-27 13:46:35 +01001174 temporary_directory,
1175 apk_file,
1176 idsig_file,
Alan Stokesfda70842023-12-20 17:50:14 +00001177 extra_apk_files,
Alan Stokes0d1ef782022-09-27 13:46:35 +01001178 &vm_payload_config,
1179 &mut vm_config,
1180 )?;
Jooyung Han21e9b922021-06-26 04:14:16 +09001181
Andrew Walbrancc0db522021-07-12 17:03:42 +00001182 Ok(vm_config)
Jooyung Han21e9b922021-06-26 04:14:16 +09001183}
1184
Inseob Kimff48a7c2024-02-26 22:07:21 +09001185fn check_partition_for_file(fd: &ParcelFileDescriptor) -> Result<()> {
1186 let path = format!("/proc/self/fd/{}", fd.as_raw_fd());
1187 let link = fs::read_link(&path).context(format!("can't read_link {path}"))?;
1188
1189 // microdroid vendor image is OK
1190 if cfg!(vendor_modules) && link == Path::new("/vendor/etc/avf/microdroid/microdroid_vendor.img")
1191 {
1192 return Ok(());
1193 }
1194
1195 if link.starts_with("/vendor") || link.starts_with("/odm") {
1196 bail!("vendor or odm file {} can't be used for VM", link.display());
1197 }
1198
1199 Ok(())
1200}
1201
1202fn check_partitions_for_files(config: &VirtualMachineRawConfig) -> Result<()> {
1203 config
1204 .disks
1205 .iter()
1206 .flat_map(|disk| disk.partitions.iter())
1207 .filter_map(|partition| partition.image.as_ref())
1208 .try_for_each(check_partition_for_file)?;
1209
1210 config.kernel.as_ref().map_or(Ok(()), check_partition_for_file)?;
1211 config.initrd.as_ref().map_or(Ok(()), check_partition_for_file)?;
1212 config.bootloader.as_ref().map_or(Ok(()), check_partition_for_file)?;
1213
1214 Ok(())
1215}
1216
Alan Stokes0d1ef782022-09-27 13:46:35 +01001217fn load_vm_payload_config_from_file(apk_file: &File, config_path: &str) -> Result<VmPayloadConfig> {
1218 let mut apk_zip = ZipArchive::new(apk_file)?;
1219 let config_file = apk_zip.by_name(config_path)?;
1220 Ok(serde_json::from_reader(config_file)?)
1221}
1222
Alan Stokes8f12f2b2023-01-09 09:19:20 +00001223fn create_vm_payload_config(
1224 payload_config: &VirtualMachinePayloadConfig,
1225) -> Result<VmPayloadConfig> {
Alan Stokes0d1ef782022-09-27 13:46:35 +01001226 // There isn't an actual config file. Construct a synthetic VmPayloadConfig from the explicit
1227 // parameters we've been given. Microdroid will do something equivalent inside the VM using the
1228 // payload config that we send it via the metadata file.
Alan Stokes8f12f2b2023-01-09 09:19:20 +00001229
1230 let payload_binary_name = &payload_config.payloadBinaryName;
1231 if payload_binary_name.contains('/') {
1232 bail!("Payload binary name must not specify a path: {payload_binary_name}");
1233 }
1234
1235 let task = Task { type_: TaskType::MicrodroidLauncher, command: payload_binary_name.clone() };
Alan Stokesfda70842023-12-20 17:50:14 +00001236
1237 // The VM only cares about how many there are, these names are actually ignored.
1238 let extra_apk_count = payload_config.extraApks.len();
1239 let extra_apks =
1240 (0..extra_apk_count).map(|i| ApkConfig { path: format!("extra-apk-{i}") }).collect();
1241
Inseob Kim89b24592024-02-23 18:59:43 +09001242 Ok(VmPayloadConfig { task: Some(task), extra_apks, ..Default::default() })
Alan Stokes0d1ef782022-09-27 13:46:35 +01001243}
1244
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001245/// Generates a unique filename to use for a composite disk image.
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001246fn make_composite_image_filenames(
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001247 temporary_directory: &Path,
1248 next_temporary_image_id: &mut u64,
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001249) -> CompositeImageFilenames {
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001250 let id = *next_temporary_image_id;
1251 *next_temporary_image_id += 1;
Andrew Walbran3eca16c2021-06-14 11:15:14 +00001252 CompositeImageFilenames {
1253 composite: temporary_directory.join(format!("composite-{}.img", id)),
1254 header: temporary_directory.join(format!("composite-{}-header.img", id)),
1255 footer: temporary_directory.join(format!("composite-{}-footer.img", id)),
1256 }
1257}
1258
1259/// Filenames for a composite disk image, including header and footer partitions.
1260#[derive(Clone, Debug, Eq, PartialEq)]
1261struct CompositeImageFilenames {
1262 /// The composite disk image itself.
1263 composite: PathBuf,
1264 /// The header partition image.
1265 header: PathBuf,
1266 /// The footer partition image.
1267 footer: PathBuf,
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +00001268}
1269
Jiyong Park753553b2021-07-12 21:21:09 +09001270/// Checks whether the caller has a specific permission
1271fn check_permission(perm: &str) -> binder::Result<()> {
Inseob Kimecde8c02024-09-03 13:11:08 +09001272 if cfg!(early) {
1273 // Skip permission check for early VMs, in favor of SELinux
1274 return Ok(());
1275 }
David Brazdil1f530702022-10-03 12:18:10 +01001276 let calling_pid = get_calling_pid();
1277 let calling_uid = get_calling_uid();
Jiyong Park753553b2021-07-12 21:21:09 +09001278 // Root can do anything
1279 if calling_uid == 0 {
1280 return Ok(());
1281 }
1282 let perm_svc: Strong<dyn IPermissionController::IPermissionController> =
Frederick Mayleb2a02872024-05-08 13:35:12 -07001283 binder::wait_for_interface("permission")?;
Jiyong Park753553b2021-07-12 21:21:09 +09001284 if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? {
Andrew Walbran806f1542021-06-10 14:07:12 +00001285 Ok(())
1286 } else {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001287 Err(anyhow!("does not have the {} permission", perm))
1288 .or_binder_exception(ExceptionCode::SECURITY)
Andrew Walbran806f1542021-06-10 14:07:12 +00001289 }
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001290}
1291
Jiyong Park753553b2021-07-12 21:21:09 +09001292/// Check whether the caller of the current Binder method is allowed to manage VMs
1293fn check_manage_access() -> binder::Result<()> {
1294 check_permission("android.permission.MANAGE_VIRTUAL_MACHINE")
1295}
1296
Inseob Kim1119d702022-05-02 18:01:58 +09001297/// Check whether the caller of the current Binder method is allowed to create custom VMs
1298fn check_use_custom_virtual_machine() -> binder::Result<()> {
1299 check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE")
1300}
1301
Alan Stokes185fe112023-01-10 16:20:55 +00001302/// Return whether a partition is exempt from selinux label checks, because we know that it does
1303/// not contain code and is likely to be generated in an app-writable directory.
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001304fn is_safe_app_partition(label: &str) -> bool {
Shikha Panwara2ff8c52022-11-30 19:25:46 +00001305 // See add_microdroid_system_images & add_microdroid_payload_images in payload.rs.
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001306 label == "vm-instance"
Shikha Panwara2ff8c52022-11-30 19:25:46 +00001307 || label == "encryptedstore"
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001308 || label == "microdroid-apk-idsig"
1309 || label == "payload-metadata"
1310 || label.starts_with("extra-idsig-")
1311}
1312
Alice Wangc206b9b2023-08-28 14:13:51 +00001313/// Returns whether a partition with the given label is safe for a raw config VM.
1314fn is_safe_raw_partition(label: &str) -> bool {
1315 label == "vm-instance"
1316}
1317
Alan Stokes185fe112023-01-10 16:20:55 +00001318/// Check that a file SELinux label is acceptable.
1319///
1320/// We only want to allow code in a VM to be sourced from places that apps, and the
Seungjae Yoo2b74c442023-11-15 18:05:07 +09001321/// system or vendor, do not have write access to.
Alan Stokes185fe112023-01-10 16:20:55 +00001322///
1323/// Note that sepolicy must also grant read access for these types to both virtualization
1324/// service and crosvm.
1325///
1326/// App private data files are deliberately excluded, to avoid arbitrary payloads being run on
1327/// user devices (W^X).
1328fn check_label_is_allowed(context: &SeContext) -> Result<()> {
1329 match context.selinux_type()? {
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001330 | "apk_data_file" // APKs of an installed app
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001331 | "shell_data_file" // test files created via adb shell
Alan Stokesfe4bb0c2023-03-20 14:15:36 +00001332 | "staging_data_file" // updated/staged APEX images
1333 | "system_file" // immutable dm-verity protected partition
1334 | "virtualizationservice_data_file" // files created by VS / VirtMgr
Seungjae Yoo2b74c442023-11-15 18:05:07 +09001335 | "vendor_microdroid_file" // immutable dm-verity protected partition (/vendor/etc/avf/microdroid/.*)
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001336 => Ok(()),
Alan Stokes185fe112023-01-10 16:20:55 +00001337 _ => bail!("Label {} is not allowed", context),
Jiyong Park029977d2021-11-24 21:56:49 +09001338 }
1339}
1340
Alan Stokes185fe112023-01-10 16:20:55 +00001341fn check_label_for_partition(partition: &Partition) -> Result<()> {
1342 let file = partition.image.as_ref().unwrap().as_ref();
1343 check_label_is_allowed(&getfilecon(file)?)
1344 .with_context(|| format!("Partition {} invalid", &partition.label))
1345}
1346
1347fn check_label_for_kernel_files(kernel: &Option<File>, initrd: &Option<File>) -> Result<()> {
1348 if let Some(f) = kernel {
1349 check_label_for_file(f, "kernel")?;
1350 }
1351 if let Some(f) = initrd {
1352 check_label_for_file(f, "initrd")?;
1353 }
1354 Ok(())
1355}
1356fn check_label_for_file(file: &File, name: &str) -> Result<()> {
1357 check_label_is_allowed(&getfilecon(file)?).with_context(|| format!("{} file invalid", name))
1358}
1359
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001360/// Implementation of the AIDL `IVirtualMachine` interface. Used as a handle to a VM.
1361#[derive(Debug)]
1362struct VirtualMachine {
1363 instance: Arc<VmInstance>,
1364}
1365
1366impl VirtualMachine {
Devin Moore407df8f2024-08-27 19:39:16 +00001367 fn create(instance: Arc<VmInstance>) -> Strong<dyn IVirtualMachine::IVirtualMachine> {
David Brazdil4b4c5102022-12-19 22:56:20 +00001368 BnVirtualMachine::new_binder(VirtualMachine { instance }, BinderFeatures::default())
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001369 }
1370}
1371
1372impl Interface for VirtualMachine {}
1373
Devin Moore407df8f2024-08-27 19:39:16 +00001374impl IVirtualMachine::IVirtualMachine for VirtualMachine {
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001375 fn getCid(&self) -> binder::Result<i32> {
Jiyong Park753553b2021-07-12 21:21:09 +09001376 // Don't check permission. The owner of the VM might have passed this binder object to
1377 // others.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001378 Ok(self.instance.cid as i32)
1379 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001380
Andrew Walbran6b650662021-09-07 13:13:23 +00001381 fn getState(&self) -> binder::Result<VirtualMachineState> {
Jiyong Park753553b2021-07-12 21:21:09 +09001382 // Don't check permission. The owner of the VM might have passed this binder object to
1383 // others.
Andrew Walbran6b650662021-09-07 13:13:23 +00001384 Ok(get_state(&self.instance))
Andrew Walbrandae07162021-03-12 17:05:20 +00001385 }
1386
1387 fn registerCallback(
1388 &self,
1389 callback: &Strong<dyn IVirtualMachineCallback>,
1390 ) -> binder::Result<()> {
Jiyong Park753553b2021-07-12 21:21:09 +09001391 // Don't check permission. The owner of the VM might have passed this binder object to
1392 // others.
1393 //
Andrew Walbrandae07162021-03-12 17:05:20 +00001394 // TODO: Should this give an error if the VM is already dead?
1395 self.instance.callbacks.add(callback.clone());
1396 Ok(())
1397 }
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001398
Andrew Walbranf8d94112021-09-07 11:45:36 +00001399 fn start(&self) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001400 self.instance
1401 .start()
1402 .with_context(|| format!("Error starting VM with CID {}", self.instance.cid))
1403 .with_log()
1404 .or_service_specific_exception(-1)
Andrew Walbranf8d94112021-09-07 11:45:36 +00001405 }
1406
Inseob Kima446f802022-07-11 19:46:37 +09001407 fn stop(&self) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001408 self.instance
1409 .kill()
1410 .with_context(|| format!("Error stopping VM with CID {}", self.instance.cid))
1411 .with_log()
1412 .or_service_specific_exception(-1)
Inseob Kima446f802022-07-11 19:46:37 +09001413 }
1414
Keir Fraser48221ba2024-07-12 14:05:02 +00001415 fn getMemoryBalloon(&self) -> binder::Result<i64> {
1416 let balloon = self
1417 .instance
1418 .get_memory_balloon()
1419 .with_context(|| format!("Error getting balloon for VM with CID {}", self.instance.cid))
1420 .with_log()
1421 .or_service_specific_exception(-1)?;
1422 Ok(balloon.try_into().unwrap())
1423 }
1424
1425 fn setMemoryBalloon(&self, num_bytes: i64) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001426 self.instance
Keir Fraser48221ba2024-07-12 14:05:02 +00001427 .set_memory_balloon(num_bytes.try_into().unwrap())
1428 .with_context(|| format!("Error setting balloon for VM with CID {}", self.instance.cid))
Jiyong Park2227eaa2023-08-04 11:59:18 +09001429 .with_log()
1430 .or_service_specific_exception(-1)
Keir Frasercdd4b112022-11-24 14:02:25 +00001431 }
1432
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001433 fn connectVsock(&self, port: i32) -> binder::Result<ParcelFileDescriptor> {
Andrew Walbranf8d94112021-09-07 11:45:36 +00001434 if !matches!(&*self.instance.vm_state.lock().unwrap(), VmState::Running { .. }) {
Devin Moore407df8f2024-08-27 19:39:16 +00001435 return Err(Status::new_service_specific_error_str(
1436 IVirtualMachine::ERROR_UNEXPECTED,
1437 Some("Virtual Machine is not running"),
1438 ));
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001439 }
Alan Stokes10c47672022-12-13 17:17:08 +00001440 let port = port as u32;
Devin Moore407df8f2024-08-27 19:39:16 +00001441 if port < VSOCK_PRIV_PORT_MAX {
1442 return Err(Status::new_service_specific_error_str(
1443 IVirtualMachine::ERROR_UNEXPECTED,
1444 Some("Can't connect to privileged port {port}"),
1445 ));
Alan Stokes10c47672022-12-13 17:17:08 +00001446 }
Jiyong Park2227eaa2023-08-04 11:59:18 +09001447 let stream = VsockStream::connect_with_cid_port(self.instance.cid, port)
1448 .context("Failed to connect")
Devin Moore407df8f2024-08-27 19:39:16 +00001449 .or_service_specific_exception(IVirtualMachine::ERROR_UNEXPECTED)?;
Jiyong Parkaf63d1c2024-09-04 16:15:42 +09001450 Ok(vsock_stream_to_pfd(stream))
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001451 }
Yi-Yo Chiang2fbf0da2024-06-14 22:56:56 +08001452
Devin Moore407df8f2024-08-27 19:39:16 +00001453 fn createAccessorBinder(&self, name: &str, port: i32) -> binder::Result<SpIBinder> {
1454 if !matches!(&*self.instance.vm_state.lock().unwrap(), VmState::Running { .. }) {
1455 return Err(Status::new_service_specific_error_str(
1456 IVirtualMachine::ERROR_UNEXPECTED,
1457 Some("Virtual Machine is not running"),
1458 ));
1459 }
1460 let port = port as u32;
1461 if port < VSOCK_PRIV_PORT_MAX {
1462 return Err(Status::new_service_specific_error_str(
1463 IVirtualMachine::ERROR_UNEXPECTED,
1464 Some("Can't connect to privileged port {port}"),
1465 ));
1466 }
1467 let cid = self.instance.cid;
Devin Moorec8800a12024-10-17 17:56:18 +00001468 let addr = sockaddr_vm {
1469 svm_family: AF_VSOCK as sa_family_t,
1470 svm_reserved1: 0,
1471 svm_port: port,
1472 svm_cid: cid,
1473 svm_zero: [0u8; 4],
1474 };
1475 let get_connection_info = move |_instance: &str| Some(ConnectionInfo::Vsock(addr));
Devin Moore407df8f2024-08-27 19:39:16 +00001476 let accessor = Accessor::new(name, get_connection_info);
1477 accessor
1478 .as_binder()
1479 .context("The newly created Accessor should always have a binder")
1480 .or_service_specific_exception(IVirtualMachine::ERROR_UNEXPECTED)
1481 }
1482
Yi-Yo Chiang2fbf0da2024-06-14 22:56:56 +08001483 fn setHostConsoleName(&self, ptsname: &str) -> binder::Result<()> {
1484 self.instance.vm_context.global_context.setHostConsoleName(ptsname)
1485 }
Jiyong Park23b67392024-07-04 13:51:42 +09001486
1487 fn suspend(&self) -> binder::Result<()> {
1488 self.instance
1489 .suspend()
1490 .with_context(|| format!("Error suspending VM with CID {}", self.instance.cid))
1491 .with_log()
1492 .or_service_specific_exception(-1)
1493 }
1494
1495 fn resume(&self) -> binder::Result<()> {
1496 self.instance
1497 .resume()
1498 .with_context(|| format!("Error resuming VM with CID {}", self.instance.cid))
1499 .with_log()
1500 .or_service_specific_exception(-1)
1501 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001502}
1503
1504impl Drop for VirtualMachine {
1505 fn drop(&mut self) {
1506 debug!("Dropping {:?}", self);
Inseob Kima446f802022-07-11 19:46:37 +09001507 if let Err(e) = self.instance.kill() {
1508 debug!("Error stopping dropped VM with CID {}: {:?}", self.instance.cid, e);
1509 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001510 }
1511}
1512
1513/// A set of Binders to be called back in response to various events on the VM, such as when it
1514/// dies.
1515#[derive(Debug, Default)]
1516pub struct VirtualMachineCallbacks(Mutex<Vec<Strong<dyn IVirtualMachineCallback>>>);
1517
1518impl VirtualMachineCallbacks {
Jiyong Park8611a6c2021-07-09 18:17:44 +09001519 /// Call all registered callbacks to notify that the payload has started.
David Brazdil451cc962022-10-14 14:08:12 +01001520 pub fn notify_payload_started(&self, cid: Cid) {
Jiyong Park8611a6c2021-07-09 18:17:44 +09001521 let callbacks = &*self.0.lock().unwrap();
Jiyong Park8611a6c2021-07-09 18:17:44 +09001522 for callback in callbacks {
David Brazdil451cc962022-10-14 14:08:12 +01001523 if let Err(e) = callback.onPayloadStarted(cid as i32) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001524 error!("Error notifying payload start event from VM CID {}: {:?}", cid, e);
Jiyong Park8611a6c2021-07-09 18:17:44 +09001525 }
1526 }
1527 }
1528
Inseob Kim14cb8692021-08-31 21:50:39 +09001529 /// Call all registered callbacks to notify that the payload is ready to serve.
1530 pub fn notify_payload_ready(&self, cid: Cid) {
1531 let callbacks = &*self.0.lock().unwrap();
1532 for callback in callbacks {
1533 if let Err(e) = callback.onPayloadReady(cid as i32) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001534 error!("Error notifying payload ready event from VM CID {}: {:?}", cid, e);
Inseob Kim14cb8692021-08-31 21:50:39 +09001535 }
1536 }
1537 }
1538
Inseob Kim2444af92021-08-31 01:22:50 +09001539 /// Call all registered callbacks to notify that the payload has finished.
1540 pub fn notify_payload_finished(&self, cid: Cid, exit_code: i32) {
1541 let callbacks = &*self.0.lock().unwrap();
1542 for callback in callbacks {
1543 if let Err(e) = callback.onPayloadFinished(cid as i32, exit_code) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001544 error!("Error notifying payload finish event from VM CID {}: {:?}", cid, e);
Inseob Kim2444af92021-08-31 01:22:50 +09001545 }
1546 }
1547 }
1548
Jooyung Handd0a1732021-11-23 15:26:20 +09001549 /// Call all registered callbacks to say that the VM encountered an error.
Alan Stokes2bead0d2022-09-05 16:58:34 +01001550 pub fn notify_error(&self, cid: Cid, error_code: ErrorCode, message: &str) {
Jooyung Handd0a1732021-11-23 15:26:20 +09001551 let callbacks = &*self.0.lock().unwrap();
1552 for callback in callbacks {
1553 if let Err(e) = callback.onError(cid as i32, error_code, message) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001554 error!("Error notifying error event from VM CID {}: {:?}", cid, e);
Jooyung Handd0a1732021-11-23 15:26:20 +09001555 }
1556 }
1557 }
1558
Andrew Walbrandae07162021-03-12 17:05:20 +00001559 /// Call all registered callbacks to say that the VM has died.
Andrew Walbranc92d35f2022-01-12 12:45:19 +00001560 pub fn callback_on_died(&self, cid: Cid, reason: DeathReason) {
Andrew Walbrandae07162021-03-12 17:05:20 +00001561 let callbacks = &*self.0.lock().unwrap();
1562 for callback in callbacks {
Andrew Walbranc92d35f2022-01-12 12:45:19 +00001563 if let Err(e) = callback.onDied(cid as i32, reason) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001564 error!("Error notifying exit of VM CID {}: {:?}", cid, e);
Andrew Walbrandae07162021-03-12 17:05:20 +00001565 }
1566 }
1567 }
1568
1569 /// Add a new callback to the set.
1570 fn add(&self, callback: Strong<dyn IVirtualMachineCallback>) {
1571 self.0.lock().unwrap().push(callback);
1572 }
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001573}
1574
Andrew Walbranf6bf6862021-05-21 12:41:13 +00001575/// The mutable state of the VirtualizationService. There should only be one instance of this
1576/// struct.
Chris Wailes641fc4a2021-12-01 15:03:21 -08001577#[derive(Debug, Default)]
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001578struct State {
Alan Stokes3e5eec12023-09-07 12:10:00 +01001579 /// The VMs which have been started. When VMs are started a weak reference is added to this
1580 /// list while a strong reference is returned to the caller over Binder. Once all copies of
1581 /// the Binder client are dropped the weak reference here will become invalid, and will be
1582 /// removed from the list opportunistically the next time `add_vm` is called.
Andrew Walbran320b5602021-03-04 16:11:12 +00001583 vms: Vec<Weak<VmInstance>>,
1584}
1585
1586impl State {
Andrew Walbrandae07162021-03-12 17:05:20 +00001587 /// Get a list of VMs which still have Binder references to them.
Andrew Walbran320b5602021-03-04 16:11:12 +00001588 fn vms(&self) -> Vec<Arc<VmInstance>> {
1589 // Attempt to upgrade the weak pointers to strong pointers.
1590 self.vms.iter().filter_map(Weak::upgrade).collect()
1591 }
1592
1593 /// Add a new VM to the list.
1594 fn add_vm(&mut self, vm: Weak<VmInstance>) {
1595 // Garbage collect any entries from the stored list which no longer exist.
1596 self.vms.retain(|vm| vm.strong_count() > 0);
1597
1598 // Actually add the new VM.
1599 self.vms.push(vm);
1600 }
David Brazdil3c2ddef2021-03-18 13:09:57 +00001601
Jiyong Park8611a6c2021-07-09 18:17:44 +09001602 /// Get a VM that corresponds to the given cid
1603 fn get_vm(&self, cid: Cid) -> Option<Arc<VmInstance>> {
1604 self.vms().into_iter().find(|vm| vm.cid == cid)
1605 }
Jiyong Parkd50a0242021-09-16 21:00:14 +09001606}
1607
Andrew Walbran6b650662021-09-07 13:13:23 +00001608/// Gets the `VirtualMachineState` of the given `VmInstance`.
1609fn get_state(instance: &VmInstance) -> VirtualMachineState {
Andrew Walbranf8d94112021-09-07 11:45:36 +00001610 match &*instance.vm_state.lock().unwrap() {
1611 VmState::NotStarted { .. } => VirtualMachineState::NOT_STARTED,
1612 VmState::Running { .. } => match instance.payload_state() {
Andrew Walbran6b650662021-09-07 13:13:23 +00001613 PayloadState::Starting => VirtualMachineState::STARTING,
1614 PayloadState::Started => VirtualMachineState::STARTED,
1615 PayloadState::Ready => VirtualMachineState::READY,
1616 PayloadState::Finished => VirtualMachineState::FINISHED,
Jiyong Parka4eebde2022-07-12 18:01:12 +09001617 PayloadState::Hangup => VirtualMachineState::DEAD,
Andrew Walbranf8d94112021-09-07 11:45:36 +00001618 },
1619 VmState::Dead => VirtualMachineState::DEAD,
1620 VmState::Failed => VirtualMachineState::DEAD,
Andrew Walbran6b650662021-09-07 13:13:23 +00001621 }
1622}
1623
David Brazdilf50c7a62023-04-19 14:22:42 +00001624/// Converts a `&ParcelFileDescriptor` to a `File` by cloning the file.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001625pub fn clone_file(file: &ParcelFileDescriptor) -> binder::Result<File> {
1626 file.as_ref()
1627 .try_clone()
1628 .context("Failed to clone File from ParcelFileDescriptor")
1629 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)
Andrei Homescu11333c62023-11-09 04:26:39 +00001630 .map(File::from)
David Brazdilf50c7a62023-04-19 14:22:42 +00001631}
1632
Andrew Walbrand3a84182021-09-07 14:48:52 +00001633/// Converts an `&Option<ParcelFileDescriptor>` to an `Option<File>` by cloning the file.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001634fn maybe_clone_file(file: &Option<ParcelFileDescriptor>) -> binder::Result<Option<File>> {
Andrew Walbrand3a84182021-09-07 14:48:52 +00001635 file.as_ref().map(clone_file).transpose()
1636}
1637
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001638/// Converts a `VsockStream` to a `ParcelFileDescriptor`.
Jiyong Parkaf63d1c2024-09-04 16:15:42 +09001639fn vsock_stream_to_pfd(stream: VsockStream) -> ParcelFileDescriptor {
1640 // SAFETY: ownership is transferred from stream to f
1641 let f = unsafe { File::from_raw_fd(stream.into_raw_fd()) };
1642 ParcelFileDescriptor::new(f)
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001643}
1644
Jiyong Parkdcf17412022-02-08 15:07:23 +09001645/// Parses the platform version requirement string.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001646fn parse_platform_version_req(s: &str) -> binder::Result<VersionReq> {
1647 VersionReq::parse(s)
1648 .with_context(|| format!("Invalid platform version requirement {}", s))
1649 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)
Jiyong Parkdcf17412022-02-08 15:07:23 +09001650}
1651
Jiyong Parked180932023-02-24 19:55:41 +09001652/// Create the empty ramdump file
1653fn prepare_ramdump_file(temporary_directory: &Path) -> binder::Result<File> {
1654 // `ramdump_write` is sent to crosvm and will be the backing store for the /dev/hvc1 where
1655 // VM will emit ramdump to. `ramdump_read` will be sent back to the client (i.e. the VM
1656 // owner) for readout.
1657 let ramdump_path = temporary_directory.join("ramdump");
Jiyong Park2227eaa2023-08-04 11:59:18 +09001658 let ramdump = File::create(ramdump_path)
1659 .context("Failed to prepare ramdump file")
1660 .with_log()
1661 .or_service_specific_exception(-1)?;
Jiyong Parked180932023-02-24 19:55:41 +09001662 Ok(ramdump)
1663}
1664
Nikita Ioffe5776f082023-02-10 21:38:26 +00001665fn is_protected(config: &VirtualMachineConfig) -> bool {
1666 match config {
1667 VirtualMachineConfig::RawConfig(config) => config.protectedVm,
1668 VirtualMachineConfig::AppConfig(config) => config.protectedVm,
1669 }
1670}
1671
1672fn check_gdb_allowed(config: &VirtualMachineConfig) -> binder::Result<()> {
1673 if is_protected(config) {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001674 return Err(anyhow!("Can't use gdb with protected VMs"))
1675 .or_binder_exception(ExceptionCode::SECURITY);
Nikita Ioffe5776f082023-02-10 21:38:26 +00001676 }
1677
Pierre-Clément Tosid3bbe1d2024-04-15 18:03:51 +01001678 if get_debug_level(config) == Some(DebugLevel::NONE) {
1679 return Err(anyhow!("Can't use gdb with non-debuggable VMs"))
1680 .or_binder_exception(ExceptionCode::SECURITY);
Nikita Ioffe5776f082023-02-10 21:38:26 +00001681 }
Pierre-Clément Tosid3bbe1d2024-04-15 18:03:51 +01001682
1683 Ok(())
Nikita Ioffe5776f082023-02-10 21:38:26 +00001684}
1685
Shikha Panwar61a74b52024-02-16 13:17:01 +00001686fn extract_instance_id(config: &VirtualMachineConfig) -> [u8; 64] {
1687 match config {
1688 VirtualMachineConfig::RawConfig(config) => config.instanceId,
1689 VirtualMachineConfig::AppConfig(config) => config.instanceId,
1690 }
1691}
1692
Alan Stokesc96b35e2024-05-03 13:21:20 +01001693fn extract_want_updatable(config: &VirtualMachineConfig) -> bool {
1694 match config {
1695 VirtualMachineConfig::RawConfig(_) => true,
1696 VirtualMachineConfig::AppConfig(config) => {
1697 let Some(custom) = &config.customConfig else { return true };
1698 custom.wantUpdatable
1699 }
1700 }
1701}
1702
Nikita Ioffe5776f082023-02-10 21:38:26 +00001703fn extract_gdb_port(config: &VirtualMachineConfig) -> Option<NonZeroU16> {
1704 match config {
1705 VirtualMachineConfig::RawConfig(config) => NonZeroU16::new(config.gdbPort as u16),
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +01001706 VirtualMachineConfig::AppConfig(config) => {
1707 NonZeroU16::new(config.customConfig.as_ref().map(|c| c.gdbPort).unwrap_or(0) as u16)
1708 }
Nikita Ioffe5776f082023-02-10 21:38:26 +00001709 }
1710}
1711
Nikita Ioffe631717e2023-09-05 13:38:07 +01001712fn check_no_vendor_modules(config: &VirtualMachineConfig) -> binder::Result<()> {
1713 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1714 if let Some(custom_config) = &config.customConfig {
1715 if custom_config.vendorImage.is_some() || custom_config.customKernelImage.is_some() {
1716 return Err(anyhow!("vendor modules feature is disabled"))
1717 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1718 }
1719 }
1720 Ok(())
1721}
1722
Nikita Ioffe94a8a182023-11-16 16:37:48 +00001723fn check_no_devices(config: &VirtualMachineConfig) -> binder::Result<()> {
1724 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1725 if let Some(custom_config) = &config.customConfig {
1726 if !custom_config.devices.is_empty() {
1727 return Err(anyhow!("device assignment feature is disabled"))
1728 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1729 }
1730 }
1731 Ok(())
1732}
1733
Alan Stokesfda70842023-12-20 17:50:14 +00001734fn check_no_extra_apks(config: &VirtualMachineConfig) -> binder::Result<()> {
1735 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1736 let Payload::PayloadConfig(payload_config) = &config.payload else { return Ok(()) };
1737 if !payload_config.extraApks.is_empty() {
1738 return Err(anyhow!("multi-tenant feature is disabled"))
1739 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1740 }
1741 Ok(())
1742}
1743
Nikita Ioffeb4268b32024-09-03 10:23:14 +00001744fn check_no_extra_kernel_cmdline_params(config: &VirtualMachineConfig) -> binder::Result<()> {
1745 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1746 if let Some(custom_config) = &config.customConfig {
1747 if !custom_config.extraKernelCmdlineParams.is_empty() {
1748 return Err(anyhow!("debuggable_vms_improvements feature is disabled"))
1749 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1750 }
1751 }
1752 Ok(())
1753}
1754
Nikita Ioffef934e812024-07-05 15:44:41 +00001755fn check_protected_vm_is_supported() -> binder::Result<()> {
1756 let is_pvm_supported =
1757 hypervisor_props::is_protected_vm_supported().or_service_specific_exception(-1)?;
1758 if is_pvm_supported {
1759 Ok(())
1760 } else {
1761 Err(anyhow!("pVM is not supported"))
1762 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION)
1763 }
1764}
1765
Nikita Ioffe631717e2023-09-05 13:38:07 +01001766fn check_config_features(config: &VirtualMachineConfig) -> binder::Result<()> {
1767 if !cfg!(vendor_modules) {
1768 check_no_vendor_modules(config)?;
1769 }
Nikita Ioffe94a8a182023-11-16 16:37:48 +00001770 if !cfg!(device_assignment) {
1771 check_no_devices(config)?;
1772 }
Alan Stokesfda70842023-12-20 17:50:14 +00001773 if !cfg!(multi_tenant) {
1774 check_no_extra_apks(config)?;
1775 }
Nikita Ioffeb4268b32024-09-03 10:23:14 +00001776 if !cfg!(debuggable_vms_improvements) {
1777 check_no_extra_kernel_cmdline_params(config)?;
1778 }
Nikita Ioffe631717e2023-09-05 13:38:07 +01001779 Ok(())
1780}
1781
Inseob Kimecde8c02024-09-03 13:11:08 +09001782fn check_config_allowed_for_early_vms(config: &VirtualMachineConfig) -> binder::Result<()> {
1783 check_no_vendor_modules(config)?;
1784 check_no_devices(config)?;
1785
1786 Ok(())
1787}
1788
Inseob Kim0168b462022-12-27 14:54:35 +09001789fn clone_or_prepare_logger_fd(
Inseob Kim0168b462022-12-27 14:54:35 +09001790 fd: Option<&ParcelFileDescriptor>,
1791 tag: String,
1792) -> Result<Option<File>, Status> {
1793 if let Some(fd) = fd {
1794 return Ok(Some(clone_file(fd)?));
1795 }
1796
Frederick Maylefbbcfcd2024-04-08 16:31:54 -07001797 let (read_fd, write_fd) =
Jiyong Park2227eaa2023-08-04 11:59:18 +09001798 pipe().context("Failed to create pipe").or_service_specific_exception(-1)?;
Inseob Kim0168b462022-12-27 14:54:35 +09001799
Frederick Maylefbbcfcd2024-04-08 16:31:54 -07001800 let mut reader = BufReader::new(File::from(read_fd));
1801 let write_fd = File::from(write_fd);
Inseob Kim0168b462022-12-27 14:54:35 +09001802
1803 std::thread::spawn(move || loop {
1804 let mut buf = vec![];
1805 match reader.read_until(b'\n', &mut buf) {
1806 Ok(0) => {
1807 // EOF
1808 return;
1809 }
1810 Ok(size) => {
1811 if buf[size - 1] == b'\n' {
1812 buf.pop();
1813 }
1814 info!("{}: {}", &tag, &String::from_utf8_lossy(&buf));
1815 }
1816 Err(e) => {
1817 error!("Could not read console pipe: {:?}", e);
1818 return;
1819 }
1820 };
1821 });
1822
1823 Ok(Some(write_fd))
1824}
1825
Jooyung Han35edb8f2021-07-01 16:17:16 +09001826/// Simple utility for referencing Borrowed or Owned. Similar to std::borrow::Cow, but
1827/// it doesn't require that T implements Clone.
1828enum BorrowedOrOwned<'a, T> {
1829 Borrowed(&'a T),
1830 Owned(T),
1831}
1832
1833impl<'a, T> AsRef<T> for BorrowedOrOwned<'a, T> {
1834 fn as_ref(&self) -> &T {
1835 match self {
1836 Self::Borrowed(b) => b,
Chris Wailes68c39f82021-07-27 16:03:44 -07001837 Self::Owned(o) => o,
Jooyung Han35edb8f2021-07-01 16:17:16 +09001838 }
1839 }
1840}
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001841
1842/// Implementation of `IVirtualMachineService`, the entry point of the AIDL service.
1843#[derive(Debug, Default)]
1844struct VirtualMachineService {
1845 state: Arc<Mutex<State>>,
Inseob Kimc7d28c72021-10-25 14:28:10 +00001846 cid: Cid,
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001847}
1848
1849impl Interface for VirtualMachineService {}
1850
1851impl IVirtualMachineService for VirtualMachineService {
Inseob Kimc7d28c72021-10-25 14:28:10 +00001852 fn notifyPayloadStarted(&self) -> binder::Result<()> {
1853 let cid = self.cid;
Inseob Kim7f61fe72021-08-20 20:50:47 +09001854 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001855 info!("VM with CID {} started payload", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001856 vm.update_payload_state(PayloadState::Started)
1857 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
David Brazdil451cc962022-10-14 14:08:12 +01001858 vm.callbacks.notify_payload_started(cid);
Seungjae Yoo62085c02022-08-12 04:44:52 +00001859
Seungjae Yoo6d265d92022-11-15 10:51:33 +09001860 let vm_start_timestamp = vm.vm_metric.lock().unwrap().start_timestamp;
1861 write_vm_booted_stats(vm.requester_uid as i32, &vm.name, vm_start_timestamp);
Inseob Kim7f61fe72021-08-20 20:50:47 +09001862 Ok(())
1863 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001864 error!("notifyPayloadStarted is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001865 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001866 }
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001867 }
Inseob Kim2444af92021-08-31 01:22:50 +09001868
Inseob Kimc7d28c72021-10-25 14:28:10 +00001869 fn notifyPayloadReady(&self) -> binder::Result<()> {
1870 let cid = self.cid;
Inseob Kim14cb8692021-08-31 21:50:39 +09001871 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001872 info!("VM with CID {} reported payload is ready", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001873 vm.update_payload_state(PayloadState::Ready)
1874 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Inseob Kim14cb8692021-08-31 21:50:39 +09001875 vm.callbacks.notify_payload_ready(cid);
1876 Ok(())
1877 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001878 error!("notifyPayloadReady is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001879 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim14cb8692021-08-31 21:50:39 +09001880 }
1881 }
1882
Inseob Kimc7d28c72021-10-25 14:28:10 +00001883 fn notifyPayloadFinished(&self, exit_code: i32) -> binder::Result<()> {
1884 let cid = self.cid;
Inseob Kim2444af92021-08-31 01:22:50 +09001885 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001886 info!("VM with CID {} finished payload", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001887 vm.update_payload_state(PayloadState::Finished)
1888 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Inseob Kim2444af92021-08-31 01:22:50 +09001889 vm.callbacks.notify_payload_finished(cid, exit_code);
1890 Ok(())
1891 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001892 error!("notifyPayloadFinished is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001893 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Jooyung Handd0a1732021-11-23 15:26:20 +09001894 }
1895 }
1896
Alan Stokes2bead0d2022-09-05 16:58:34 +01001897 fn notifyError(&self, error_code: ErrorCode, message: &str) -> binder::Result<()> {
Jooyung Handd0a1732021-11-23 15:26:20 +09001898 let cid = self.cid;
1899 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001900 info!("VM with CID {} encountered an error", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001901 vm.update_payload_state(PayloadState::Finished)
1902 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Jooyung Handd0a1732021-11-23 15:26:20 +09001903 vm.callbacks.notify_error(cid, error_code, message);
1904 Ok(())
1905 } else {
Seungjae Yooec8c1602022-06-20 05:28:00 +00001906 error!("notifyError is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001907 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim2444af92021-08-31 01:22:50 +09001908 }
1909 }
Alice Wangc2fec932023-02-23 16:24:02 +00001910
Shikha Panware45e9422024-02-28 21:18:10 +00001911 fn getSecretkeeper(&self) -> binder::Result<Strong<dyn ISecretkeeper>> {
1912 if !is_secretkeeper_supported() {
1913 return Err(StatusCode::NAME_NOT_FOUND)?;
1914 }
1915 let sk = binder::wait_for_interface(SECRETKEEPER_IDENTIFIER)?;
1916 Ok(BnSecretkeeper::new_binder(SecretkeeperProxy(sk), BinderFeatures::default()))
Shikha Panwar5d6a6752023-12-14 22:08:26 +00001917 }
1918
Alice Wange64dd182024-01-17 15:57:55 +00001919 fn requestAttestation(&self, csr: &[u8], test_mode: bool) -> binder::Result<Vec<Certificate>> {
1920 GLOBAL_SERVICE.requestAttestation(csr, get_calling_uid() as i32, test_mode)
Alice Wangc2fec932023-02-23 16:24:02 +00001921 }
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001922}
1923
Shikha Panwar8707f0f2024-02-28 20:40:42 +00001924fn is_secretkeeper_supported() -> bool {
Shikha Panwar81d13d32024-03-10 19:39:23 +00001925 binder::is_declared(SECRETKEEPER_IDENTIFIER)
1926 .expect("Could not check for declared Secretkeeper interface")
Shikha Panwar8187ca22024-01-04 08:33:08 +00001927}
1928
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001929impl VirtualMachineService {
Inseob Kimc7d28c72021-10-25 14:28:10 +00001930 fn new_binder(state: Arc<Mutex<State>>, cid: Cid) -> Strong<dyn IVirtualMachineService> {
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001931 BnVirtualMachineService::new_binder(
Inseob Kimc7d28c72021-10-25 14:28:10 +00001932 VirtualMachineService { state, cid },
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001933 BinderFeatures::default(),
1934 )
1935 }
1936}
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001937
Stephen Hines4c1e2fc2024-02-09 16:34:47 -08001938struct SecretkeeperProxy(Strong<dyn ISecretkeeper>);
1939
1940impl Interface for SecretkeeperProxy {}
1941
1942impl ISecretkeeper for SecretkeeperProxy {
1943 fn processSecretManagementRequest(&self, req: &[u8]) -> binder::Result<Vec<u8>> {
1944 // Pass the request to the channel, and read the response.
1945 self.0.processSecretManagementRequest(req)
1946 }
1947
1948 fn getAuthGraphKe(&self) -> binder::Result<Strong<dyn IAuthGraphKeyExchange>> {
1949 let ag = AuthGraphKeyExchangeProxy(self.0.getAuthGraphKe()?);
1950 Ok(BnAuthGraphKeyExchange::new_binder(ag, BinderFeatures::default()))
1951 }
1952
1953 fn deleteIds(&self, ids: &[SecretId]) -> binder::Result<()> {
1954 self.0.deleteIds(ids)
1955 }
1956
1957 fn deleteAll(&self) -> binder::Result<()> {
1958 self.0.deleteAll()
1959 }
1960}
1961
1962struct AuthGraphKeyExchangeProxy(Strong<dyn IAuthGraphKeyExchange>);
1963
1964impl Interface for AuthGraphKeyExchangeProxy {}
1965
1966impl IAuthGraphKeyExchange for AuthGraphKeyExchangeProxy {
1967 fn create(&self) -> binder::Result<SessionInitiationInfo> {
1968 self.0.create()
1969 }
1970
1971 fn init(
1972 &self,
1973 peer_pub_key: &PubKey,
1974 peer_id: &Identity,
1975 peer_nonce: &[u8],
1976 peer_version: i32,
1977 ) -> binder::Result<KeInitResult> {
1978 self.0.init(peer_pub_key, peer_id, peer_nonce, peer_version)
1979 }
1980
1981 fn finish(
1982 &self,
1983 peer_pub_key: &PubKey,
1984 peer_id: &Identity,
1985 peer_signature: &SessionIdSignature,
1986 peer_nonce: &[u8],
1987 peer_version: i32,
1988 own_key: &Key,
1989 ) -> binder::Result<SessionInfo> {
1990 self.0.finish(peer_pub_key, peer_id, peer_signature, peer_nonce, peer_version, own_key)
1991 }
1992
1993 fn authenticationComplete(
1994 &self,
1995 peer_signature: &SessionIdSignature,
1996 shared_keys: &[AuthgraphArc; 2],
1997 ) -> binder::Result<[AuthgraphArc; 2]> {
1998 self.0.authenticationComplete(peer_signature, shared_keys)
1999 }
2000}
2001
Inseob Kimecde8c02024-09-03 13:11:08 +09002002// KEEP IN SYNC WITH early_vms.xsd
2003#[derive(Debug, Deserialize, PartialEq)]
2004struct EarlyVm {
2005 #[allow(dead_code)]
2006 name: String,
2007 #[allow(dead_code)]
2008 cid: i32,
2009 #[allow(dead_code)]
2010 path: String,
2011}
2012
2013#[derive(Debug, Default, Deserialize)]
2014struct EarlyVms {
2015 #[allow(dead_code)]
2016 early_vm: Vec<EarlyVm>,
2017}
2018
2019fn range_for_partition(partition: &str) -> Result<Range<Cid>> {
2020 match partition {
2021 "system" => Ok(100..200),
2022 "system_ext" | "product" => Ok(200..300),
2023 _ => Err(anyhow!("Early VMs are not supported for {partition}")),
2024 }
2025}
2026
2027fn find_early_vm(xml_path: &Path, cid_range: &Range<Cid>, name: &str) -> Result<EarlyVm> {
2028 if !xml_path.exists() {
2029 bail!("{} doesn't exist", xml_path.display());
2030 }
2031
2032 let xml =
2033 fs::read(xml_path).with_context(|| format!("Failed to read {}", xml_path.display()))?;
2034 let xml = String::from_utf8(xml)
2035 .with_context(|| format!("{} is not a valid UTF-8 file", xml_path.display()))?;
2036 let early_vms: EarlyVms = serde_xml_rs::from_str(&xml)
2037 .with_context(|| format!("Can't parse {}", xml_path.display()))?;
2038
2039 let mut found_vm: Option<EarlyVm> = None;
2040
2041 for early_vm in early_vms.early_vm {
2042 if early_vm.name != name {
2043 continue;
2044 }
2045
2046 let cid = early_vm
2047 .cid
2048 .try_into()
2049 .with_context(|| format!("Invalid CID value {}", early_vm.cid))?;
2050
2051 if !cid_range.contains(&cid) {
2052 bail!("VM '{}' uses CID {cid} which is out of range. Available CIDs for '{}': {cid_range:?}", xml_path.display(), early_vm.name);
2053 }
2054
2055 if found_vm.is_some() {
2056 bail!("Multiple VMs named {name} are found in {}", xml_path.display());
2057 }
2058
2059 found_vm = Some(early_vm);
2060 }
2061
2062 found_vm.ok_or_else(|| anyhow!("Can't find {name} in {}", xml_path.display()))
2063}
2064
2065fn find_early_vm_for_partition(partition: &str, name: &str) -> Result<EarlyVm> {
2066 let cid_range = range_for_partition(partition)?;
2067 find_early_vm(Path::new(&format!("/{partition}/etc/avf/early_vms.xml")), &cid_range, name)
2068}
2069
Alan Stokes53cc5ca2022-08-30 14:28:19 +01002070#[cfg(test)]
2071mod tests {
2072 use super::*;
2073
2074 #[test]
2075 fn test_is_allowed_label_for_partition() -> Result<()> {
2076 let expected_results = vec![
2077 ("u:object_r:system_file:s0", true),
2078 ("u:object_r:apk_data_file:s0", true),
2079 ("u:object_r:app_data_file:s0", false),
2080 ("u:object_r:app_data_file:s0:c512,c768", false),
2081 ("u:object_r:privapp_data_file:s0:c512,c768", false),
2082 ("invalid", false),
2083 ("user:role:apk_data_file:severity:categories", true),
2084 ("user:role:apk_data_file:severity:categories:extraneous", false),
2085 ];
2086
2087 for (label, expected_valid) in expected_results {
2088 let context = SeContext::new(label)?;
2089 let result = check_label_is_allowed(&context);
2090 if expected_valid {
2091 assert!(result.is_ok(), "Expected label {} to be allowed, got {:?}", label, result);
2092 } else if result.is_ok() {
2093 bail!("Expected label {} to be disallowed", label);
2094 }
2095 }
2096 Ok(())
2097 }
Nikita Ioffef1ce9872022-12-09 13:31:59 +00002098
2099 #[test]
2100 fn test_create_or_update_idsig_file_empty_apk() -> Result<()> {
2101 let apk = tempfile::tempfile().unwrap();
2102 let idsig = tempfile::tempfile().unwrap();
2103
2104 let ret = create_or_update_idsig_file(
2105 &ParcelFileDescriptor::new(apk),
2106 &ParcelFileDescriptor::new(idsig),
2107 );
2108 assert!(ret.is_err(), "should fail");
2109 Ok(())
2110 }
2111
2112 #[test]
2113 fn test_create_or_update_idsig_dir_instead_of_file_for_apk() -> Result<()> {
2114 let tmp_dir = tempfile::TempDir::new().unwrap();
2115 let apk = File::open(tmp_dir.path()).unwrap();
2116 let idsig = tempfile::tempfile().unwrap();
2117
2118 let ret = create_or_update_idsig_file(
2119 &ParcelFileDescriptor::new(apk),
2120 &ParcelFileDescriptor::new(idsig),
2121 );
2122 assert!(ret.is_err(), "should fail");
2123 Ok(())
2124 }
2125
2126 /// Verifies that create_or_update_idsig_file won't oom if a fd that corresponds to a directory
2127 /// on ext4 filesystem is passed.
2128 /// On ext4 lseek on a directory fd will return (off_t)-1 (see:
2129 /// https://bugzilla.kernel.org/show_bug.cgi?id=200043), which will result in
2130 /// create_or_update_idsig_file ooming while attempting to allocate petabytes of memory.
2131 #[test]
2132 fn test_create_or_update_idsig_does_not_crash_dir_on_ext4() -> Result<()> {
2133 // APEXes are backed by the ext4.
2134 let apk = File::open("/apex/com.android.virt/").unwrap();
2135 let idsig = tempfile::tempfile().unwrap();
2136
2137 let ret = create_or_update_idsig_file(
2138 &ParcelFileDescriptor::new(apk),
2139 &ParcelFileDescriptor::new(idsig),
2140 );
2141 assert!(ret.is_err(), "should fail");
2142 Ok(())
2143 }
Jiyong Park8d192952023-06-26 14:29:51 +09002144
2145 #[test]
2146 fn test_create_or_update_idsig_does_not_update_if_already_valid() -> Result<()> {
2147 use std::io::Seek;
2148
2149 // Pick any APK
2150 let mut apk = File::open("/system/priv-app/Shell/Shell.apk").unwrap();
2151 let mut idsig = tempfile::tempfile().unwrap();
2152
2153 create_or_update_idsig_file(
2154 &ParcelFileDescriptor::new(apk.try_clone()?),
2155 &ParcelFileDescriptor::new(idsig.try_clone()?),
2156 )?;
2157 let modified_orig = idsig.metadata()?.modified()?;
2158 apk.rewind()?;
2159 idsig.rewind()?;
2160
2161 // Call the function again
2162 create_or_update_idsig_file(
2163 &ParcelFileDescriptor::new(apk.try_clone()?),
2164 &ParcelFileDescriptor::new(idsig.try_clone()?),
2165 )?;
2166 let modified_new = idsig.metadata()?.modified()?;
2167 assert!(modified_orig == modified_new, "idsig file was updated unnecessarily");
2168 Ok(())
2169 }
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01002170
2171 #[test]
Shikha Panwar9ae2e622024-01-30 12:22:30 +00002172 fn test_create_or_update_idsig_on_non_empty_file() -> Result<()> {
2173 use std::io::Read;
2174
2175 // Pick any APK
2176 let mut apk = File::open("/system/priv-app/Shell/Shell.apk").unwrap();
2177 let idsig_empty = tempfile::tempfile().unwrap();
2178 let mut idsig_invalid = tempfile::tempfile().unwrap();
2179 idsig_invalid.write_all(b"Oops")?;
2180
2181 // Create new idsig
2182 create_or_update_idsig_file(
2183 &ParcelFileDescriptor::new(apk.try_clone()?),
2184 &ParcelFileDescriptor::new(idsig_empty.try_clone()?),
2185 )?;
2186 apk.rewind()?;
2187
2188 // Update idsig_invalid
2189 create_or_update_idsig_file(
2190 &ParcelFileDescriptor::new(apk.try_clone()?),
2191 &ParcelFileDescriptor::new(idsig_invalid.try_clone()?),
2192 )?;
2193
2194 // Ensure the 2 idsig files have same size!
2195 assert!(
2196 idsig_empty.metadata()?.len() == idsig_invalid.metadata()?.len(),
2197 "idsig files differ in size"
2198 );
2199 // Ensure the 2 idsig files have same content!
2200 for (b1, b2) in idsig_empty.bytes().zip(idsig_invalid.bytes()) {
2201 assert!(b1.unwrap() == b2.unwrap(), "idsig files differ")
2202 }
2203 Ok(())
2204 }
2205 #[test]
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01002206 fn test_append_kernel_param_first_param() {
2207 let mut vm_config = VirtualMachineRawConfig { ..Default::default() };
2208 append_kernel_param("foo=1", &mut vm_config);
2209 assert_eq!(vm_config.params, Some("foo=1".to_owned()))
2210 }
2211
2212 #[test]
2213 fn test_append_kernel_param() {
2214 let mut vm_config =
2215 VirtualMachineRawConfig { params: Some("foo=5".to_owned()), ..Default::default() };
2216 append_kernel_param("bar=42", &mut vm_config);
2217 assert_eq!(vm_config.params, Some("foo=5 bar=42".to_owned()))
2218 }
Seungjae Yooec3bc522023-11-09 10:14:30 +09002219
Inseob Kim46257382024-01-03 15:41:22 +09002220 fn test_extract_os_name_from_config_path(
2221 path: &Path,
2222 expected_result: Option<&str>,
2223 ) -> Result<()> {
2224 let result = extract_os_name_from_config_path(path);
2225 if result.as_deref() != expected_result {
2226 bail!("Expected {:?} but was {:?}", expected_result, &result)
2227 }
2228 Ok(())
2229 }
2230
2231 #[test]
2232 fn test_extract_os_name_from_microdroid_config() -> Result<()> {
2233 test_extract_os_name_from_config_path(
2234 Path::new("/apex/com.android.virt/etc/microdroid.json"),
2235 Some("microdroid"),
2236 )
2237 }
2238
2239 #[test]
2240 fn test_extract_os_name_from_microdroid_gki_config() -> Result<()> {
2241 test_extract_os_name_from_config_path(
2242 Path::new("/apex/com.android.virt/etc/microdroid_gki-android14-6.1.json"),
2243 Some("microdroid_gki-android14-6.1"),
2244 )
2245 }
2246
2247 #[test]
2248 fn test_extract_os_name_from_invalid_path() -> Result<()> {
2249 test_extract_os_name_from_config_path(
2250 Path::new("/apex/com.android.virt/etc/microdroid.img"),
2251 None,
2252 )
2253 }
2254
2255 #[test]
2256 fn test_extract_os_name_from_configs() -> Result<()> {
2257 let tmp_dir = tempfile::TempDir::new()?;
2258 let tmp_dir_path = tmp_dir.path().to_owned();
2259
2260 let mut os_names: HashSet<String> = HashSet::new();
2261 os_names.insert("microdroid".to_owned());
2262 os_names.insert("microdroid_gki-android14-6.1".to_owned());
2263 os_names.insert("microdroid_gki-android15-6.1".to_owned());
2264
2265 // config files
2266 for os_name in &os_names {
2267 std::fs::write(tmp_dir_path.join(os_name.to_owned() + ".json"), b"")?;
2268 }
2269
2270 // fake files not related to configs
2271 std::fs::write(tmp_dir_path.join("microdroid_super.img"), b"")?;
2272 std::fs::write(tmp_dir_path.join("microdroid_foobar.apk"), b"")?;
2273
2274 let glob_pattern = match tmp_dir_path.join("microdroid*.json").to_str() {
2275 Some(s) => s.to_owned(),
2276 None => bail!("tmp_dir_path {:?} is not UTF-8", tmp_dir_path),
2277 };
2278
2279 let result = extract_os_names_from_configs(&glob_pattern)?;
2280 if result != os_names {
2281 bail!("Expected {:?} but was {:?}", os_names, result);
2282 }
2283 Ok(())
2284 }
Inseob Kimecde8c02024-09-03 13:11:08 +09002285
2286 #[test]
2287 fn test_find_early_vms_from_xml() -> Result<()> {
2288 let tmp_dir = tempfile::TempDir::new()?;
2289 let tmp_dir_path = tmp_dir.path().to_owned();
2290 let xml_path = tmp_dir_path.join("early_vms.xml");
2291
2292 std::fs::write(
2293 &xml_path,
2294 br#"<?xml version="1.0" encoding="utf-8"?>
2295 <early_vms>
2296 <early_vm>
2297 <name>vm_demo_native_early</name>
2298 <cid>123</cid>
2299 <path>/system/bin/vm_demo_native_early</path>
2300 </early_vm>
2301 <early_vm>
2302 <name>vm_demo_duplicated_name</name>
2303 <cid>456</cid>
2304 <path>/system/bin/vm_demo_duplicated_name_1</path>
2305 </early_vm>
2306 <early_vm>
2307 <name>vm_demo_duplicated_name</name>
2308 <cid>789</cid>
2309 <path>/system/bin/vm_demo_duplicated_name_2</path>
2310 </early_vm>
2311 <early_vm>
2312 <name>vm_demo_invalid_cid_1</name>
2313 <cid>-1</cid>
2314 <path>/system/bin/vm_demo_invalid_cid_1</path>
2315 </early_vm>
2316 <early_vm>
2317 <name>vm_demo_invalid_cid_2</name>
2318 <cid>999999</cid>
2319 <path>/system/bin/vm_demo_invalid_cid_2</path>
2320 </early_vm>
2321 </early_vms>
2322 "#,
2323 )?;
2324
2325 let cid_range = 100..1000;
2326
2327 let result = find_early_vm(&xml_path, &cid_range, "vm_demo_native_early")?;
2328 let expected = EarlyVm {
2329 name: "vm_demo_native_early".to_owned(),
2330 cid: 123,
2331 path: "/system/bin/vm_demo_native_early".to_owned(),
2332 };
2333 assert_eq!(result, expected);
2334
2335 assert!(
2336 find_early_vm(&xml_path, &cid_range, "vm_demo_duplicated_name").is_err(),
2337 "should fail"
2338 );
2339 assert!(
2340 find_early_vm(&xml_path, &cid_range, "vm_demo_invalid_cid_1").is_err(),
2341 "should fail"
2342 );
2343 assert!(
2344 find_early_vm(&xml_path, &cid_range, "vm_demo_invalid_cid_2").is_err(),
2345 "should fail"
2346 );
2347
2348 Ok(())
2349 }
Alan Stokes53cc5ca2022-08-30 14:28:19 +01002350}