Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 1 | // Copyright 2021, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Microdroid Manager |
| 16 | |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 17 | mod instance; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 18 | mod ioutil; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 19 | mod payload; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 20 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 21 | use crate::instance::{ApkData, InstanceDisk, MicrodroidData, RootHash}; |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 22 | use anyhow::{anyhow, bail, ensure, Context, Error, Result}; |
Jiyong Park | a41535b | 2021-09-10 19:31:48 +0900 | [diff] [blame] | 23 | use apkverify::{get_public_key_der, verify}; |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 24 | use binder::unstable_api::{new_spibinder, AIBinder}; |
| 25 | use binder::{FromIBinder, Strong}; |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 26 | use glob::glob; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 27 | use idsig::V4Signature; |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 28 | use itertools::sorted; |
Andrew Scull | 684590f | 2022-01-27 16:14:26 +0000 | [diff] [blame^] | 29 | use log::{error, info}; |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 30 | use microdroid_metadata::{write_metadata, Metadata}; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 31 | use microdroid_payload_config::{Task, TaskType, VmPayloadConfig}; |
Jiyong Park | 9f72ea6 | 2021-12-06 21:18:38 +0900 | [diff] [blame] | 32 | use once_cell::sync::OnceCell; |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 33 | use payload::{get_apex_data_from_payload, load_metadata, to_metadata}; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 34 | use rustutils::system_properties; |
Joel Galenson | 482704c | 2021-07-29 15:53:53 -0700 | [diff] [blame] | 35 | use rustutils::system_properties::PropertyWatcher; |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 36 | use std::fs::{self, create_dir, File, OpenOptions}; |
Jiyong Park | 44e967d | 2021-12-21 13:53:42 +0900 | [diff] [blame] | 37 | use std::io::BufRead; |
Inseob Kim | c7d28c7 | 2021-10-25 14:28:10 +0000 | [diff] [blame] | 38 | use std::os::unix::io::{FromRawFd, IntoRawFd}; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 39 | use std::path::Path; |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 40 | use std::process::{Child, Command, Stdio}; |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 41 | use std::str; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 42 | use std::time::{Duration, SystemTime}; |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 43 | use vsock::VsockStream; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 44 | |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 45 | use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{ |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 46 | ERROR_PAYLOAD_CHANGED, ERROR_PAYLOAD_VERIFICATION_FAILED, ERROR_PAYLOAD_INVALID_CONFIG, ERROR_UNKNOWN, VM_BINDER_SERVICE_PORT, VM_STREAM_SERVICE_PORT, IVirtualMachineService, |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 47 | }; |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 48 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 49 | const WAIT_TIMEOUT: Duration = Duration::from_secs(10); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 50 | const MAIN_APK_PATH: &str = "/dev/block/by-name/microdroid-apk"; |
| 51 | const MAIN_APK_IDSIG_PATH: &str = "/dev/block/by-name/microdroid-apk-idsig"; |
| 52 | const MAIN_APK_DEVICE_NAME: &str = "microdroid-apk"; |
| 53 | const EXTRA_APK_PATH_PATTERN: &str = "/dev/block/by-name/extra-apk-*"; |
| 54 | const EXTRA_IDSIG_PATH_PATTERN: &str = "/dev/block/by-name/extra-idsig-*"; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 55 | const DM_MOUNTED_APK_PATH: &str = "/dev/block/mapper/microdroid-apk"; |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 56 | const APKDMVERITY_BIN: &str = "/system/bin/apkdmverity"; |
| 57 | const ZIPFUSE_BIN: &str = "/system/bin/zipfuse"; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 58 | |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 59 | /// The CID representing the host VM |
| 60 | const VMADDR_CID_HOST: u32 = 2; |
| 61 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 62 | const APEX_CONFIG_DONE_PROP: &str = "apex_config.done"; |
Jiyong Park | fa91d70 | 2021-10-18 23:51:39 +0900 | [diff] [blame] | 63 | const LOGD_ENABLED_PROP: &str = "ro.boot.logd.enabled"; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 64 | |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 65 | #[derive(thiserror::Error, Debug)] |
| 66 | enum MicrodroidError { |
| 67 | #[error("Payload has changed: {0}")] |
| 68 | PayloadChanged(String), |
| 69 | #[error("Payload verification has failed: {0}")] |
| 70 | PayloadVerificationFailed(String), |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 71 | #[error("Payload config is invalid: {0}")] |
| 72 | InvalidConfig(String), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 73 | } |
| 74 | |
| 75 | fn translate_error(err: &Error) -> (i32, String) { |
| 76 | if let Some(e) = err.downcast_ref::<MicrodroidError>() { |
| 77 | match e { |
| 78 | MicrodroidError::PayloadChanged(msg) => (ERROR_PAYLOAD_CHANGED, msg.to_string()), |
| 79 | MicrodroidError::PayloadVerificationFailed(msg) => { |
| 80 | (ERROR_PAYLOAD_VERIFICATION_FAILED, msg.to_string()) |
| 81 | } |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 82 | MicrodroidError::InvalidConfig(msg) => (ERROR_PAYLOAD_INVALID_CONFIG, msg.to_string()), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 83 | } |
| 84 | } else { |
| 85 | (ERROR_UNKNOWN, err.to_string()) |
| 86 | } |
| 87 | } |
| 88 | |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 89 | fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> { |
| 90 | // SAFETY: AIBinder returned by RpcClient has correct reference count, and the ownership can be |
| 91 | // safely taken by new_spibinder. |
| 92 | let ibinder = unsafe { |
| 93 | new_spibinder(binder_rpc_unstable_bindgen::RpcClient( |
| 94 | VMADDR_CID_HOST, |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 95 | VM_BINDER_SERVICE_PORT as u32, |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 96 | ) as *mut AIBinder) |
| 97 | }; |
| 98 | if let Some(ibinder) = ibinder { |
| 99 | <dyn IVirtualMachineService>::try_from(ibinder).context("Cannot connect to RPC service") |
| 100 | } else { |
| 101 | bail!("Invalid raw AIBinder") |
| 102 | } |
| 103 | } |
| 104 | |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 105 | fn main() { |
| 106 | if let Err(e) = try_main() { |
Jooyung Han | bfe086f | 2021-10-28 10:15:45 +0900 | [diff] [blame] | 107 | error!("Failed with {:?}. Shutting down...", e); |
| 108 | if let Err(e) = system_properties::write("sys.powerctl", "shutdown") { |
| 109 | error!("failed to shutdown {:?}", e); |
| 110 | } |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 111 | std::process::exit(1); |
| 112 | } |
| 113 | } |
| 114 | |
| 115 | fn try_main() -> Result<()> { |
Jiyong Park | 79b8801 | 2021-06-25 13:06:25 +0900 | [diff] [blame] | 116 | kernlog::init()?; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 117 | info!("started."); |
| 118 | |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 119 | let service = get_vms_rpc_binder().context("cannot connect to VirtualMachineService")?; |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 120 | match try_run_payload(&service) { |
| 121 | Ok(code) => { |
| 122 | info!("notifying payload finished"); |
| 123 | service.notifyPayloadFinished(code)?; |
| 124 | if code == 0 { |
| 125 | info!("task successfully finished"); |
| 126 | } else { |
| 127 | error!("task exited with exit code: {}", code); |
| 128 | } |
| 129 | Ok(()) |
| 130 | } |
| 131 | Err(err) => { |
| 132 | error!("task terminated: {:?}", err); |
| 133 | let (error_code, message) = translate_error(&err); |
| 134 | service.notifyError(error_code, &message)?; |
| 135 | Err(err) |
| 136 | } |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 137 | } |
| 138 | } |
| 139 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 140 | fn try_run_payload(service: &Strong<dyn IVirtualMachineService>) -> Result<i32> { |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 141 | let metadata = load_metadata().context("Failed to load payload metadata")?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 142 | |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 143 | let mut instance = InstanceDisk::new().context("Failed to load instance.img")?; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 144 | let saved_data = instance.read_microdroid_data().context("Failed to read identity data")?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 145 | |
| 146 | // Verify the payload before using it. |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 147 | let verified_data = |
| 148 | verify_payload(&metadata, saved_data.as_ref()).context("Payload verification failed")?; |
| 149 | if let Some(saved_data) = saved_data { |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 150 | ensure!( |
| 151 | saved_data == verified_data, |
| 152 | MicrodroidError::PayloadChanged(String::from( |
| 153 | "Detected an update of the payload which isn't supported yet." |
| 154 | )) |
| 155 | ); |
| 156 | info!("Saved data is verified."); |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 157 | } else { |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 158 | info!("Saving verified data."); |
| 159 | instance.write_microdroid_data(&verified_data).context("Failed to write identity data")?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 160 | } |
| 161 | |
Jooyung Han | a6d11eb | 2021-09-10 11:48:05 +0900 | [diff] [blame] | 162 | // Before reading a file from the APK, start zipfuse |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 163 | run_zipfuse( |
| 164 | "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0", |
| 165 | Path::new("/dev/block/mapper/microdroid-apk"), |
| 166 | Path::new("/mnt/apk"), |
| 167 | ) |
| 168 | .context("Failed to run zipfuse")?; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 169 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 170 | ensure!( |
| 171 | !metadata.payload_config_path.is_empty(), |
| 172 | MicrodroidError::InvalidConfig("No payload_config_path in metadata".to_string()) |
| 173 | ); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 174 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 175 | let config = load_config(Path::new(&metadata.payload_config_path))?; |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 176 | if config.extra_apks.len() != verified_data.extra_apks_data.len() { |
| 177 | return Err(anyhow!( |
| 178 | "config expects {} extra apks, but found only {}", |
| 179 | config.extra_apks.len(), |
| 180 | verified_data.extra_apks_data.len() |
| 181 | )); |
| 182 | } |
| 183 | mount_extra_apks(&config)?; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 184 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 185 | // Wait until apex config is done. (e.g. linker configuration for apexes) |
| 186 | // TODO(jooyung): wait until sys.boot_completed? |
| 187 | wait_for_apex_config_done()?; |
| 188 | |
| 189 | ensure!( |
| 190 | config.task.is_some(), |
| 191 | MicrodroidError::InvalidConfig("No task in VM config".to_string()) |
| 192 | ); |
| 193 | exec_task(&config.task.unwrap(), service) |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 194 | } |
| 195 | |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 196 | struct ApkDmverityArgument<'a> { |
| 197 | apk: &'a str, |
| 198 | idsig: &'a str, |
| 199 | name: &'a str, |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 200 | saved_root_hash: Option<&'a RootHash>, |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 201 | } |
| 202 | |
| 203 | fn run_apkdmverity(args: &[ApkDmverityArgument]) -> Result<Child> { |
| 204 | let mut cmd = Command::new(APKDMVERITY_BIN); |
| 205 | |
| 206 | cmd.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()); |
| 207 | |
| 208 | for argument in args { |
| 209 | cmd.arg("--apk").arg(argument.apk).arg(argument.idsig).arg(argument.name); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 210 | if let Some(root_hash) = argument.saved_root_hash { |
| 211 | cmd.arg(&to_hex_string(root_hash)); |
| 212 | } else { |
| 213 | cmd.arg("none"); |
| 214 | } |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 215 | } |
| 216 | |
| 217 | cmd.spawn().context("Spawn apkdmverity") |
| 218 | } |
| 219 | |
| 220 | fn run_zipfuse(option: &str, zip_path: &Path, mount_dir: &Path) -> Result<Child> { |
| 221 | Command::new(ZIPFUSE_BIN) |
| 222 | .arg("-o") |
| 223 | .arg(option) |
| 224 | .arg(zip_path) |
| 225 | .arg(mount_dir) |
| 226 | .stdin(Stdio::null()) |
| 227 | .stdout(Stdio::null()) |
| 228 | .stderr(Stdio::null()) |
| 229 | .spawn() |
| 230 | .context("Spawn zipfuse") |
| 231 | } |
| 232 | |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 233 | // Verify payload before executing it. For APK payload, Full verification (which is slow) is done |
| 234 | // when the root_hash values from the idsig file and the instance disk are different. This function |
| 235 | // returns the verified root hash (for APK payload) and pubkeys (for APEX payloads) that can be |
| 236 | // saved to the instance disk. |
| 237 | fn verify_payload( |
| 238 | metadata: &Metadata, |
| 239 | saved_data: Option<&MicrodroidData>, |
| 240 | ) -> Result<MicrodroidData> { |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 241 | let start_time = SystemTime::now(); |
| 242 | |
Jiyong Park | 9f72ea6 | 2021-12-06 21:18:38 +0900 | [diff] [blame] | 243 | if let Some(saved_bootconfig) = saved_data.map(|d| &d.bootconfig) { |
| 244 | ensure!( |
| 245 | saved_bootconfig.as_ref() == get_bootconfig()?.as_slice(), |
| 246 | MicrodroidError::PayloadChanged(String::from("Bootconfig has changed.")) |
| 247 | ); |
| 248 | } |
| 249 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 250 | // Verify main APK |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 251 | let root_hash = saved_data.map(|d| &d.apk_data.root_hash); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 252 | let root_hash_from_idsig = get_apk_root_hash_from_idsig(MAIN_APK_IDSIG_PATH)?; |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 253 | let root_hash_trustful = root_hash == Some(&root_hash_from_idsig); |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 254 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 255 | // If root_hash can be trusted, pass it to apkdmverity so that it uses the passed root_hash |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 256 | // instead of the value read from the idsig file. |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 257 | let main_apk_argument = { |
| 258 | ApkDmverityArgument { |
| 259 | apk: MAIN_APK_PATH, |
| 260 | idsig: MAIN_APK_IDSIG_PATH, |
| 261 | name: MAIN_APK_DEVICE_NAME, |
| 262 | saved_root_hash: if root_hash_trustful { |
| 263 | Some(root_hash_from_idsig.as_ref()) |
| 264 | } else { |
| 265 | None |
| 266 | }, |
| 267 | } |
| 268 | }; |
| 269 | let mut apkdmverity_arguments = vec![main_apk_argument]; |
| 270 | |
| 271 | // Verify extra APKs |
| 272 | // For now, we can't read the payload config, so glob APKs and idsigs. |
| 273 | // Later, we'll see if it matches with the payload config. |
| 274 | |
| 275 | // sort globbed paths to match apks (extra-apk-{idx}) and idsigs (extra-idsig-{idx}) |
| 276 | // e.g. "extra-apk-0" corresponds to "extra-idsig-0" |
| 277 | let extra_apks = |
| 278 | sorted(glob(EXTRA_APK_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>(); |
| 279 | let extra_idsigs = |
| 280 | sorted(glob(EXTRA_IDSIG_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>(); |
| 281 | if extra_apks.len() != extra_idsigs.len() { |
| 282 | return Err(anyhow!( |
| 283 | "Extra apks/idsigs mismatch: {} apks but {} idsigs", |
| 284 | extra_apks.len(), |
| 285 | extra_idsigs.len() |
| 286 | )); |
| 287 | } |
| 288 | let extra_apks_count = extra_apks.len(); |
| 289 | |
| 290 | let (extra_apk_names, extra_root_hashes_from_idsig): (Vec<_>, Vec<_>) = extra_idsigs |
| 291 | .iter() |
| 292 | .enumerate() |
| 293 | .map(|(i, extra_idsig)| { |
| 294 | ( |
| 295 | format!("extra-apk-{}", i), |
| 296 | get_apk_root_hash_from_idsig(extra_idsig.to_str().unwrap()) |
| 297 | .expect("Can't find root hash from extra idsig"), |
| 298 | ) |
| 299 | }) |
| 300 | .unzip(); |
| 301 | |
| 302 | let saved_extra_root_hashes: Vec<_> = saved_data |
| 303 | .map(|d| d.extra_apks_data.iter().map(|apk_data| &apk_data.root_hash).collect()) |
| 304 | .unwrap_or_else(Vec::new); |
| 305 | let extra_root_hashes_trustful: Vec<_> = extra_root_hashes_from_idsig |
| 306 | .iter() |
| 307 | .enumerate() |
| 308 | .map(|(i, root_hash_from_idsig)| { |
| 309 | saved_extra_root_hashes.get(i).copied() == Some(root_hash_from_idsig) |
| 310 | }) |
| 311 | .collect(); |
| 312 | |
| 313 | for i in 0..extra_apks_count { |
| 314 | apkdmverity_arguments.push({ |
| 315 | ApkDmverityArgument { |
| 316 | apk: extra_apks[i].to_str().unwrap(), |
| 317 | idsig: extra_idsigs[i].to_str().unwrap(), |
| 318 | name: &extra_apk_names[i], |
| 319 | saved_root_hash: if extra_root_hashes_trustful[i] { |
| 320 | Some(&extra_root_hashes_from_idsig[i]) |
| 321 | } else { |
| 322 | None |
| 323 | }, |
| 324 | } |
| 325 | }); |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 326 | } |
| 327 | |
| 328 | // Start apkdmverity and wait for the dm-verify block |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 329 | let mut apkdmverity_child = run_apkdmverity(&apkdmverity_arguments)?; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 330 | |
Jooyung Han | c8deb47 | 2021-09-13 13:48:25 +0900 | [diff] [blame] | 331 | // While waiting for apkdmverity to mount APK, gathers public keys and root digests from |
| 332 | // APEX payload. |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 333 | let apex_data_from_payload = get_apex_data_from_payload(metadata)?; |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 334 | if let Some(saved_data) = saved_data.map(|d| &d.apex_data) { |
Jooyung Han | c8deb47 | 2021-09-13 13:48:25 +0900 | [diff] [blame] | 335 | // We don't support APEX updates. (assuming that update will change root digest) |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 336 | ensure!( |
| 337 | saved_data == &apex_data_from_payload, |
| 338 | MicrodroidError::PayloadChanged(String::from("APEXes have changed.")) |
| 339 | ); |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 340 | let apex_metadata = to_metadata(&apex_data_from_payload); |
Jooyung Han | c8deb47 | 2021-09-13 13:48:25 +0900 | [diff] [blame] | 341 | // Pass metadata(with public keys and root digests) to apexd so that it uses the passed |
| 342 | // metadata instead of the default one (/dev/block/by-name/payload-metadata) |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 343 | OpenOptions::new() |
| 344 | .create_new(true) |
| 345 | .write(true) |
| 346 | .open("/apex/vm-payload-metadata") |
| 347 | .context("Failed to open /apex/vm-payload-metadata") |
| 348 | .and_then(|f| write_metadata(&apex_metadata, f))?; |
| 349 | } |
| 350 | // Start apexd to activate APEXes |
| 351 | system_properties::write("ctl.start", "apexd-vm")?; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 352 | |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 353 | // TODO(inseob): add timeout |
| 354 | apkdmverity_child.wait()?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 355 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 356 | // Do the full verification if the root_hash is un-trustful. This requires the full scanning of |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 357 | // the APK file and therefore can be very slow if the APK is large. Note that this step is |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 358 | // taken only when the root_hash is un-trustful which can be either when this is the first boot |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 359 | // of the VM or APK was updated in the host. |
| 360 | // TODO(jooyung): consider multithreading to make this faster |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 361 | let main_apk_pubkey = get_public_key_from_apk(DM_MOUNTED_APK_PATH, root_hash_trustful)?; |
| 362 | let extra_apks_data = extra_root_hashes_from_idsig |
| 363 | .into_iter() |
| 364 | .enumerate() |
| 365 | .map(|(i, extra_root_hash)| { |
| 366 | let mount_path = format!("/dev/block/mapper/{}", &extra_apk_names[i]); |
| 367 | let apk_pubkey = get_public_key_from_apk(&mount_path, extra_root_hashes_trustful[i])?; |
| 368 | Ok(ApkData { root_hash: extra_root_hash, pubkey: apk_pubkey }) |
| 369 | }) |
| 370 | .collect::<Result<Vec<_>>>()?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 371 | |
| 372 | info!("payload verification successful. took {:#?}", start_time.elapsed().unwrap()); |
| 373 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 374 | // At this point, we can ensure that the root_hash from the idsig file is trusted, either by |
| 375 | // fully verifying the APK or by comparing it with the saved root_hash. |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 376 | Ok(MicrodroidData { |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 377 | apk_data: ApkData { root_hash: root_hash_from_idsig, pubkey: main_apk_pubkey }, |
| 378 | extra_apks_data, |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 379 | apex_data: apex_data_from_payload, |
Jiyong Park | 9f72ea6 | 2021-12-06 21:18:38 +0900 | [diff] [blame] | 380 | bootconfig: get_bootconfig()?.clone().into_boxed_slice(), |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 381 | }) |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 382 | } |
| 383 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 384 | fn mount_extra_apks(config: &VmPayloadConfig) -> Result<()> { |
| 385 | // For now, only the number of apks is important, as the mount point and dm-verity name is fixed |
| 386 | for i in 0..config.extra_apks.len() { |
| 387 | let mount_dir = format!("/mnt/extra-apk/{}", i); |
| 388 | create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?; |
| 389 | |
| 390 | // don't wait, just detach |
| 391 | run_zipfuse( |
| 392 | "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0", |
| 393 | Path::new(&format!("/dev/block/mapper/extra-apk-{}", i)), |
| 394 | Path::new(&mount_dir), |
| 395 | ) |
| 396 | .context("Failed to zipfuse extra apks")?; |
| 397 | } |
| 398 | |
| 399 | Ok(()) |
| 400 | } |
| 401 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 402 | // Waits until linker config is generated |
| 403 | fn wait_for_apex_config_done() -> Result<()> { |
| 404 | let mut prop = PropertyWatcher::new(APEX_CONFIG_DONE_PROP)?; |
| 405 | loop { |
| 406 | prop.wait()?; |
| 407 | let val = system_properties::read(APEX_CONFIG_DONE_PROP)?; |
| 408 | if val == "true" { |
| 409 | break; |
| 410 | } |
| 411 | } |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 412 | Ok(()) |
| 413 | } |
| 414 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 415 | fn get_apk_root_hash_from_idsig(path: &str) -> Result<Box<RootHash>> { |
| 416 | let mut idsig = File::open(path)?; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 417 | let idsig = V4Signature::from(&mut idsig)?; |
| 418 | Ok(idsig.hashing_info.raw_root_hash) |
| 419 | } |
| 420 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 421 | fn get_public_key_from_apk(apk: &str, root_hash_trustful: bool) -> Result<Box<[u8]>> { |
| 422 | if !root_hash_trustful { |
| 423 | verify(apk).context(MicrodroidError::PayloadVerificationFailed(format!( |
| 424 | "failed to verify {}", |
| 425 | apk |
| 426 | ))) |
| 427 | } else { |
| 428 | get_public_key_der(apk) |
| 429 | } |
| 430 | } |
| 431 | |
Jiyong Park | 9f72ea6 | 2021-12-06 21:18:38 +0900 | [diff] [blame] | 432 | fn get_bootconfig() -> Result<&'static Vec<u8>> { |
| 433 | static VAL: OnceCell<Vec<u8>> = OnceCell::new(); |
Jiyong Park | 44e967d | 2021-12-21 13:53:42 +0900 | [diff] [blame] | 434 | VAL.get_or_try_init(|| -> Result<Vec<u8>> { |
| 435 | let f = File::open("/proc/bootconfig")?; |
| 436 | |
| 437 | // Filter-out androidboot.vbmeta.device which contains UUID of the vbmeta partition. That |
| 438 | // UUID could change everytime when the same VM is started because the composite disk image |
| 439 | // is ephemeral. A change in UUID is okay as long as other configs (e.g. |
| 440 | // androidboot.vbmeta.digest) remain same. |
| 441 | Ok(std::io::BufReader::new(f) |
| 442 | .lines() |
| 443 | // note: this try_fold is to early return when we fail to read a line from the file |
| 444 | .try_fold(Vec::new(), |mut lines, line| { |
| 445 | line.map(|s| { |
| 446 | lines.push(s); |
| 447 | lines |
| 448 | }) |
| 449 | })? |
| 450 | .into_iter() |
| 451 | .filter(|line| { |
| 452 | let tokens: Vec<&str> = line.splitn(2, '=').collect(); |
| 453 | // note: if `line` doesn't have =, tokens[0] is the entire line. |
| 454 | tokens[0].trim() != "androidboot.vbmeta.device" |
| 455 | }) |
| 456 | .flat_map(|line| (line + "\n").into_bytes()) |
| 457 | .collect()) |
| 458 | }) |
Jiyong Park | 9f72ea6 | 2021-12-06 21:18:38 +0900 | [diff] [blame] | 459 | } |
| 460 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 461 | fn load_config(path: &Path) -> Result<VmPayloadConfig> { |
| 462 | info!("loading config from {:?}...", path); |
| 463 | let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)?; |
| 464 | Ok(serde_json::from_reader(file)?) |
| 465 | } |
| 466 | |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 467 | /// Executes the given task. Stdout of the task is piped into the vsock stream to the |
| 468 | /// virtualizationservice in the host side. |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 469 | fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> { |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 470 | info!("executing main task {:?}...", task); |
Inseob Kim | 86ca016 | 2021-10-20 02:21:02 +0000 | [diff] [blame] | 471 | let mut command = build_command(task)?; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 472 | |
| 473 | info!("notifying payload started"); |
Inseob Kim | c7d28c7 | 2021-10-25 14:28:10 +0000 | [diff] [blame] | 474 | service.notifyPayloadStarted()?; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 475 | |
Jiyong Park | fa91d70 | 2021-10-18 23:51:39 +0900 | [diff] [blame] | 476 | // Start logging if enabled |
| 477 | // TODO(b/200914564) set filterspec if debug_level is app_only |
| 478 | if system_properties::read(LOGD_ENABLED_PROP)? == "1" { |
| 479 | system_properties::write("ctl.start", "seriallogging")?; |
| 480 | } |
| 481 | |
Inseob Kim | 86ca016 | 2021-10-20 02:21:02 +0000 | [diff] [blame] | 482 | let exit_status = command.spawn()?.wait()?; |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 483 | exit_status.code().ok_or_else(|| anyhow!("Failed to get exit_code from the paylaod.")) |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 484 | } |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 485 | |
| 486 | fn build_command(task: &Task) -> Result<Command> { |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 487 | const VMADDR_CID_HOST: u32 = 2; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 488 | |
| 489 | let mut command = match task.type_ { |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 490 | TaskType::Executable => { |
| 491 | let mut command = Command::new(&task.command); |
| 492 | command.args(&task.args); |
| 493 | command |
| 494 | } |
| 495 | TaskType::MicrodroidLauncher => { |
| 496 | let mut command = Command::new("/system/bin/microdroid_launcher"); |
| 497 | command.arg(find_library_path(&task.command)?).args(&task.args); |
| 498 | command |
| 499 | } |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 500 | }; |
| 501 | |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 502 | match VsockStream::connect_with_cid_port(VMADDR_CID_HOST, VM_STREAM_SERVICE_PORT as u32) { |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 503 | Ok(stream) => { |
| 504 | // SAFETY: the ownership of the underlying file descriptor is transferred from stream |
| 505 | // to the file object, and then into the Command object. When the command is finished, |
| 506 | // the file descriptor is closed. |
| 507 | let file = unsafe { File::from_raw_fd(stream.into_raw_fd()) }; |
| 508 | command |
| 509 | .stdin(Stdio::from(file.try_clone()?)) |
| 510 | .stdout(Stdio::from(file.try_clone()?)) |
| 511 | .stderr(Stdio::from(file)); |
| 512 | } |
| 513 | Err(e) => { |
| 514 | error!("failed to connect to virtualization service: {}", e); |
| 515 | // Don't fail hard here. Even if we failed to connect to the virtualizationservice, |
| 516 | // we keep executing the task. This can happen if the owner of the VM doesn't register |
| 517 | // callback to accept the stream. Use /dev/null as the stream so that the task can |
| 518 | // make progress without waiting for someone to consume the output. |
| 519 | command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()); |
| 520 | } |
| 521 | } |
| 522 | |
| 523 | Ok(command) |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 524 | } |
| 525 | |
| 526 | fn find_library_path(name: &str) -> Result<String> { |
| 527 | let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?; |
| 528 | let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?; |
| 529 | let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?; |
| 530 | let path = format!("/mnt/apk/lib/{}/{}", abi, name); |
| 531 | |
| 532 | let metadata = fs::metadata(&path)?; |
| 533 | if !metadata.is_file() { |
| 534 | bail!("{} is not a file", &path); |
| 535 | } |
| 536 | |
| 537 | Ok(path) |
| 538 | } |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 539 | |
| 540 | fn to_hex_string(buf: &[u8]) -> String { |
| 541 | buf.iter().map(|b| format!("{:02X}", b)).collect() |
| 542 | } |