Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 1 | // Copyright 2021, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Microdroid Manager |
| 16 | |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 17 | mod dice; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 18 | mod dice_driver; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 19 | mod instance; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 20 | mod ioutil; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 21 | mod payload; |
Keir Fraser | 933f0ac | 2022-10-12 08:23:28 +0000 | [diff] [blame] | 22 | mod swap; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 23 | mod verify; |
Alice Wang | 59a9e56 | 2022-10-04 15:24:10 +0000 | [diff] [blame] | 24 | mod vm_payload_service; |
Shikha Panwar | 95084df | 2023-07-22 11:47:45 +0000 | [diff] [blame] | 25 | mod vm_secret; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 26 | |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 27 | use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::ErrorCode::ErrorCode; |
David Brazdil | 73988ea | 2022-11-11 15:10:32 +0000 | [diff] [blame] | 28 | use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::IVirtualMachineService; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 29 | use android_system_virtualization_payload::aidl::android::system::virtualization::payload::IVmPayloadService::{ |
| 30 | VM_APK_CONTENTS_PATH, |
| 31 | VM_PAYLOAD_SERVICE_SOCKET_NAME, |
Shikha Panwar | ddc124b | 2022-11-28 19:17:54 +0000 | [diff] [blame] | 32 | ENCRYPTEDSTORE_MOUNTPOINT, |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 33 | }; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 34 | |
| 35 | use crate::dice::dice_derivation; |
| 36 | use crate::dice_driver::DiceDriver; |
Alan Stokes | 0375496 | 2023-11-06 15:36:09 +0000 | [diff] [blame] | 37 | use crate::instance::{InstanceDisk, MicrodroidData}; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 38 | use crate::verify::verify_payload; |
| 39 | use crate::vm_payload_service::register_vm_payload_service; |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 40 | use anyhow::{anyhow, bail, ensure, Context, Error, Result}; |
Alice Wang | 43c884b | 2022-10-24 09:42:40 +0000 | [diff] [blame] | 41 | use binder::Strong; |
Alice Wang | 7e6c935 | 2023-02-15 15:44:13 +0000 | [diff] [blame] | 42 | use keystore2_crypto::ZVec; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 43 | use libc::VMADDR_CID_HOST; |
| 44 | use log::{error, info}; |
Alan Stokes | 0375496 | 2023-11-06 15:36:09 +0000 | [diff] [blame] | 45 | use microdroid_metadata::PayloadMetadata; |
Seungjae Yoo | fd9a062 | 2022-10-14 10:01:29 +0900 | [diff] [blame] | 46 | use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig}; |
Frederick Mayle | b5f7b6b | 2022-11-11 15:24:03 -0800 | [diff] [blame] | 47 | use nix::sys::signal::Signal; |
Alan Stokes | 0375496 | 2023-11-06 15:36:09 +0000 | [diff] [blame] | 48 | use payload::load_metadata; |
David Brazdil | a2125dd | 2022-12-14 16:37:44 +0000 | [diff] [blame] | 49 | use rpcbinder::RpcSession; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 50 | use rustutils::sockets::android_get_control_socket; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 51 | use rustutils::system_properties; |
Joel Galenson | 482704c | 2021-07-29 15:53:53 -0700 | [diff] [blame] | 52 | use rustutils::system_properties::PropertyWatcher; |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 53 | use std::borrow::Cow::{Borrowed, Owned}; |
Inseob Kim | 7ff121c | 2022-11-14 18:13:23 +0900 | [diff] [blame] | 54 | use std::env; |
Shikha Panwar | def7ef9 | 2023-01-06 08:35:48 +0000 | [diff] [blame] | 55 | use std::ffi::CString; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 56 | use std::fs::{self, create_dir, File, OpenOptions}; |
Jaewan Kim | 3124ef0 | 2023-03-23 19:25:20 +0900 | [diff] [blame] | 57 | use std::io::{Read, Write}; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 58 | use std::os::unix::io::{FromRawFd, OwnedFd}; |
Nikita Ioffe | 3452ee2 | 2022-12-15 00:31:56 +0000 | [diff] [blame] | 59 | use std::os::unix::process::CommandExt; |
Frederick Mayle | b5f7b6b | 2022-11-11 15:24:03 -0800 | [diff] [blame] | 60 | use std::os::unix::process::ExitStatusExt; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 61 | use std::path::Path; |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 62 | use std::process::{Child, Command, Stdio}; |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 63 | use std::str; |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 64 | use std::time::Duration; |
Shikha Panwar | 95084df | 2023-07-22 11:47:45 +0000 | [diff] [blame] | 65 | use vm_secret::VmSecret; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 66 | |
| 67 | const WAIT_TIMEOUT: Duration = Duration::from_secs(10); |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 68 | const AVF_STRICT_BOOT: &str = "/sys/firmware/devicetree/base/chosen/avf,strict-boot"; |
| 69 | const AVF_NEW_INSTANCE: &str = "/sys/firmware/devicetree/base/chosen/avf,new-instance"; |
Jaewan Kim | 3124ef0 | 2023-03-23 19:25:20 +0900 | [diff] [blame] | 70 | const AVF_DEBUG_POLICY_RAMDUMP: &str = "/sys/firmware/devicetree/base/avf/guest/common/ramdump"; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 71 | const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str = |
| 72 | "/sys/firmware/devicetree/base/virtualization/guest/debug-microdroid,no-verified-boot"; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 73 | |
Alan Stokes | 4fb201c | 2023-02-08 17:39:05 +0000 | [diff] [blame] | 74 | const ENCRYPTEDSTORE_BIN: &str = "/system/bin/encryptedstore"; |
| 75 | const ZIPFUSE_BIN: &str = "/system/bin/zipfuse"; |
| 76 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 77 | const APEX_CONFIG_DONE_PROP: &str = "apex_config.done"; |
Seungjae Yoo | fa22bb0 | 2022-12-08 16:38:42 +0900 | [diff] [blame] | 78 | const DEBUGGABLE_PROP: &str = "ro.boot.microdroid.debuggable"; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 79 | |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 80 | // SYNC WITH virtualizationservice/src/crosvm.rs |
| 81 | const FAILURE_SERIAL_DEVICE: &str = "/dev/ttyS1"; |
| 82 | |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 83 | const ENCRYPTEDSTORE_BACKING_DEVICE: &str = "/dev/block/by-name/encryptedstore"; |
Alice Wang | 62f7e64 | 2023-02-10 09:55:13 +0000 | [diff] [blame] | 84 | const ENCRYPTEDSTORE_KEYSIZE: usize = 32; |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 85 | |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 86 | #[derive(thiserror::Error, Debug)] |
| 87 | enum MicrodroidError { |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 88 | #[error("Cannot connect to virtualization service: {0}")] |
| 89 | FailedToConnectToVirtualizationService(String), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 90 | #[error("Payload has changed: {0}")] |
| 91 | PayloadChanged(String), |
| 92 | #[error("Payload verification has failed: {0}")] |
| 93 | PayloadVerificationFailed(String), |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 94 | #[error("Payload config is invalid: {0}")] |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 95 | PayloadInvalidConfig(String), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 96 | } |
| 97 | |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 98 | fn translate_error(err: &Error) -> (ErrorCode, String) { |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 99 | if let Some(e) = err.downcast_ref::<MicrodroidError>() { |
| 100 | match e { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 101 | MicrodroidError::PayloadChanged(msg) => (ErrorCode::PAYLOAD_CHANGED, msg.to_string()), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 102 | MicrodroidError::PayloadVerificationFailed(msg) => { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 103 | (ErrorCode::PAYLOAD_VERIFICATION_FAILED, msg.to_string()) |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 104 | } |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 105 | MicrodroidError::PayloadInvalidConfig(msg) => { |
| 106 | (ErrorCode::PAYLOAD_INVALID_CONFIG, msg.to_string()) |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 107 | } |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 108 | |
| 109 | // Connection failure won't be reported to VS; return the default value |
| 110 | MicrodroidError::FailedToConnectToVirtualizationService(msg) => { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 111 | (ErrorCode::UNKNOWN, msg.to_string()) |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 112 | } |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 113 | } |
| 114 | } else { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 115 | (ErrorCode::UNKNOWN, err.to_string()) |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 116 | } |
| 117 | } |
| 118 | |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 119 | fn write_death_reason_to_serial(err: &Error) -> Result<()> { |
| 120 | let death_reason = if let Some(e) = err.downcast_ref::<MicrodroidError>() { |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 121 | Borrowed(match e { |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 122 | MicrodroidError::FailedToConnectToVirtualizationService(_) => { |
| 123 | "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE" |
| 124 | } |
| 125 | MicrodroidError::PayloadChanged(_) => "MICRODROID_PAYLOAD_HAS_CHANGED", |
| 126 | MicrodroidError::PayloadVerificationFailed(_) => { |
| 127 | "MICRODROID_PAYLOAD_VERIFICATION_FAILED" |
| 128 | } |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 129 | MicrodroidError::PayloadInvalidConfig(_) => "MICRODROID_INVALID_PAYLOAD_CONFIG", |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 130 | }) |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 131 | } else { |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 132 | // Send context information back after a separator, to ease diagnosis. |
| 133 | // These errors occur before the payload runs, so this should not leak sensitive |
| 134 | // information. |
| 135 | Owned(format!("MICRODROID_UNKNOWN_RUNTIME_ERROR|{:?}", err)) |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 136 | }; |
| 137 | |
Pierre-Clément Tosi | d225af5 | 2023-09-15 15:59:20 +0100 | [diff] [blame] | 138 | for chunk in death_reason.as_bytes().chunks(16) { |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 139 | // TODO(b/220071963): Sometimes, sending more than 16 bytes at once makes MM hang. |
Pierre-Clément Tosi | d225af5 | 2023-09-15 15:59:20 +0100 | [diff] [blame] | 140 | OpenOptions::new().read(false).write(true).open(FAILURE_SERIAL_DEVICE)?.write_all(chunk)?; |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 141 | } |
| 142 | |
| 143 | Ok(()) |
| 144 | } |
| 145 | |
Inseob Kim | 437f105 | 2022-06-21 11:30:22 +0900 | [diff] [blame] | 146 | fn main() -> Result<()> { |
Inseob Kim | 7ff121c | 2022-11-14 18:13:23 +0900 | [diff] [blame] | 147 | // If debuggable, print full backtrace to console log with stdio_to_kmsg |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 148 | if is_debuggable()? { |
Inseob Kim | 7ff121c | 2022-11-14 18:13:23 +0900 | [diff] [blame] | 149 | env::set_var("RUST_BACKTRACE", "full"); |
| 150 | } |
| 151 | |
Inseob Kim | 437f105 | 2022-06-21 11:30:22 +0900 | [diff] [blame] | 152 | scopeguard::defer! { |
| 153 | info!("Shutting down..."); |
Jooyung Han | bfe086f | 2021-10-28 10:15:45 +0900 | [diff] [blame] | 154 | if let Err(e) = system_properties::write("sys.powerctl", "shutdown") { |
| 155 | error!("failed to shutdown {:?}", e); |
| 156 | } |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 157 | } |
Inseob Kim | 437f105 | 2022-06-21 11:30:22 +0900 | [diff] [blame] | 158 | |
| 159 | try_main().map_err(|e| { |
| 160 | error!("Failed with {:?}.", e); |
| 161 | if let Err(e) = write_death_reason_to_serial(&e) { |
| 162 | error!("Failed to write death reason {:?}", e); |
| 163 | } |
| 164 | e |
| 165 | }) |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 166 | } |
| 167 | |
| 168 | fn try_main() -> Result<()> { |
Jiyong Park | 2b6346d | 2023-06-19 13:37:42 +0900 | [diff] [blame] | 169 | android_logger::init_once( |
| 170 | android_logger::Config::default() |
| 171 | .with_tag("microdroid_manager") |
| 172 | .with_min_level(log::Level::Info), |
| 173 | ); |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 174 | info!("started."); |
| 175 | |
Alice Wang | fd222fd | 2023-05-25 09:37:38 +0000 | [diff] [blame] | 176 | // SAFETY: This is the only place we take the ownership of the fd of the vm payload service. |
| 177 | // |
Alice Wang | 2a5306e | 2023-06-05 09:18:32 +0000 | [diff] [blame] | 178 | // To ensure that the CLOEXEC flag is set on the file descriptor as early as possible, |
| 179 | // it is necessary to fetch the socket corresponding to vm_payload_service at the |
| 180 | // very beginning, as android_get_control_socket() sets the CLOEXEC flag on the file |
| 181 | // descriptor. |
Alice Wang | fd222fd | 2023-05-25 09:37:38 +0000 | [diff] [blame] | 182 | let vm_payload_service_fd = unsafe { prepare_vm_payload_service_socket()? }; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 183 | |
Jiyong Park | 202856e | 2022-08-22 16:04:26 +0900 | [diff] [blame] | 184 | load_crashkernel_if_supported().context("Failed to load crashkernel")?; |
| 185 | |
Alice Wang | eff5839 | 2023-07-04 13:32:09 +0000 | [diff] [blame] | 186 | swap::init_swap().context("Failed to initialize swap")?; |
Keir Fraser | 933f0ac | 2022-10-12 08:23:28 +0000 | [diff] [blame] | 187 | info!("swap enabled."); |
| 188 | |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 189 | let service = get_vms_rpc_binder() |
| 190 | .context("cannot connect to VirtualMachineService") |
| 191 | .map_err(|e| MicrodroidError::FailedToConnectToVirtualizationService(e.to_string()))?; |
Seungjae Yoo | fd9a062 | 2022-10-14 10:01:29 +0900 | [diff] [blame] | 192 | |
Alice Wang | fd222fd | 2023-05-25 09:37:38 +0000 | [diff] [blame] | 193 | match try_run_payload(&service, vm_payload_service_fd) { |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 194 | Ok(code) => { |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 195 | if code == 0 { |
| 196 | info!("task successfully finished"); |
| 197 | } else { |
| 198 | error!("task exited with exit code: {}", code); |
| 199 | } |
Shikha Panwar | def7ef9 | 2023-01-06 08:35:48 +0000 | [diff] [blame] | 200 | if let Err(e) = post_payload_work() { |
| 201 | error!( |
| 202 | "Failed to run post payload work. It is possible that certain tasks |
| 203 | like syncing encrypted store might be incomplete. Error: {:?}", |
| 204 | e |
| 205 | ); |
| 206 | }; |
| 207 | |
| 208 | info!("notifying payload finished"); |
| 209 | service.notifyPayloadFinished(code)?; |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 210 | Ok(()) |
| 211 | } |
| 212 | Err(err) => { |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 213 | let (error_code, message) = translate_error(&err); |
| 214 | service.notifyError(error_code, &message)?; |
| 215 | Err(err) |
| 216 | } |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 217 | } |
| 218 | } |
| 219 | |
Alice Wang | fd222fd | 2023-05-25 09:37:38 +0000 | [diff] [blame] | 220 | fn try_run_payload( |
| 221 | service: &Strong<dyn IVirtualMachineService>, |
| 222 | vm_payload_service_fd: OwnedFd, |
| 223 | ) -> Result<i32> { |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 224 | let metadata = load_metadata().context("Failed to load payload metadata")?; |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 225 | let dice = DiceDriver::new(Path::new("/dev/open-dice0")).context("Failed to load DICE")?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 226 | |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 227 | let mut instance = InstanceDisk::new().context("Failed to load instance.img")?; |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 228 | let saved_data = |
| 229 | instance.read_microdroid_data(&dice).context("Failed to read identity data")?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 230 | |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 231 | if is_strict_boot() { |
| 232 | // Provisioning must happen on the first boot and never again. |
| 233 | if is_new_instance() { |
| 234 | ensure!( |
| 235 | saved_data.is_none(), |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 236 | MicrodroidError::PayloadInvalidConfig( |
| 237 | "Found instance data on first boot.".to_string() |
| 238 | ) |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 239 | ); |
| 240 | } else { |
| 241 | ensure!( |
| 242 | saved_data.is_some(), |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 243 | MicrodroidError::PayloadInvalidConfig("Instance data not found.".to_string()) |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 244 | ); |
| 245 | }; |
| 246 | } |
| 247 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 248 | // Verify the payload before using it. |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 249 | let verified_data = verify_payload(&metadata, saved_data.as_ref()) |
| 250 | .context("Payload verification failed") |
| 251 | .map_err(|e| MicrodroidError::PayloadVerificationFailed(e.to_string()))?; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 252 | |
| 253 | // In case identity is ignored (by debug policy), we should reuse existing payload data, even |
| 254 | // when the payload is changed. This is to keep the derived secret same as before. |
| 255 | let verified_data = if let Some(saved_data) = saved_data { |
| 256 | if !is_verified_boot() { |
| 257 | if saved_data != verified_data { |
| 258 | info!("Detected an update of the payload, but continue (regarding debug policy)") |
| 259 | } |
| 260 | } else { |
| 261 | ensure!( |
| 262 | saved_data == verified_data, |
| 263 | MicrodroidError::PayloadChanged(String::from( |
| 264 | "Detected an update of the payload which isn't supported yet." |
| 265 | )) |
| 266 | ); |
| 267 | info!("Saved data is verified."); |
| 268 | } |
| 269 | saved_data |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 270 | } else { |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 271 | info!("Saving verified data."); |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 272 | instance |
| 273 | .write_microdroid_data(&verified_data, &dice) |
| 274 | .context("Failed to write identity data")?; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 275 | verified_data |
| 276 | }; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 277 | |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 278 | let payload_metadata = metadata.payload.ok_or_else(|| { |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 279 | MicrodroidError::PayloadInvalidConfig("No payload config in metadata".to_string()) |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 280 | })?; |
Alan Stokes | 0d1ef78 | 2022-09-27 13:46:35 +0100 | [diff] [blame] | 281 | |
Inseob Kim | b2519c5 | 2022-04-14 02:10:09 +0900 | [diff] [blame] | 282 | // To minimize the exposure to untrusted data, derive dice profile as soon as possible. |
| 283 | info!("DICE derivation for payload"); |
Alice Wang | 62f7e64 | 2023-02-10 09:55:13 +0000 | [diff] [blame] | 284 | let dice_artifacts = dice_derivation(dice, &verified_data, &payload_metadata)?; |
Shikha Panwar | 95084df | 2023-07-22 11:47:45 +0000 | [diff] [blame] | 285 | let vm_secret = VmSecret::new(dice_artifacts).context("Failed to create VM secrets")?; |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 286 | |
Alan Stokes | 9a7f67e | 2023-11-07 09:37:40 +0000 | [diff] [blame^] | 287 | if cfg!(dice_changes) { |
| 288 | // Now that the DICE derivation is done, it's ok to allow payload code to run. |
| 289 | |
| 290 | // Start apexd to activate APEXes. This may allow code within them to run. |
| 291 | system_properties::write("ctl.start", "apexd-vm")?; |
| 292 | } |
| 293 | |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 294 | // Run encryptedstore binary to prepare the storage |
| 295 | let encryptedstore_child = if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() { |
| 296 | info!("Preparing encryptedstore ..."); |
Shikha Panwar | 95084df | 2023-07-22 11:47:45 +0000 | [diff] [blame] | 297 | Some(prepare_encryptedstore(&vm_secret).context("encryptedstore run")?) |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 298 | } else { |
| 299 | None |
| 300 | }; |
Inseob Kim | b2519c5 | 2022-04-14 02:10:09 +0900 | [diff] [blame] | 301 | |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 302 | let mut zipfuse = Zipfuse::default(); |
| 303 | |
Jooyung Han | a6d11eb | 2021-09-10 11:48:05 +0900 | [diff] [blame] | 304 | // Before reading a file from the APK, start zipfuse |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 305 | zipfuse.mount( |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 306 | MountForExec::Allowed, |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 307 | "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0", |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 308 | Path::new(verify::DM_MOUNTED_APK_PATH), |
Alice Wang | 6bbb6da | 2022-10-26 12:44:06 +0000 | [diff] [blame] | 309 | Path::new(VM_APK_CONTENTS_PATH), |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 310 | "microdroid_manager.apk.mounted".to_owned(), |
| 311 | )?; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 312 | |
Andrew Scull | 4d262dc | 2022-10-21 13:14:33 +0000 | [diff] [blame] | 313 | // Restricted APIs are only allowed to be used by platform or test components. Infer this from |
| 314 | // the use of a VM config file since those can only be used by platform and test components. |
| 315 | let allow_restricted_apis = match payload_metadata { |
Ludovic Barman | 93ee308 | 2023-06-20 12:18:43 +0000 | [diff] [blame] | 316 | PayloadMetadata::ConfigPath(_) => true, |
| 317 | PayloadMetadata::Config(_) => false, |
| 318 | _ => false, // default is false for safety |
Andrew Scull | 4d262dc | 2022-10-21 13:14:33 +0000 | [diff] [blame] | 319 | }; |
| 320 | |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 321 | let config = load_config(payload_metadata).context("Failed to load payload metadata")?; |
Shikha Panwar | 6f03c94 | 2022-04-13 20:26:50 +0000 | [diff] [blame] | 322 | |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 323 | let task = config |
| 324 | .task |
| 325 | .as_ref() |
Alan Stokes | bbed887 | 2023-10-19 13:17:12 +0100 | [diff] [blame] | 326 | .ok_or_else(|| MicrodroidError::PayloadInvalidConfig("No task in VM config".to_string()))?; |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 327 | |
Alice Wang | 061478b | 2023-04-11 13:26:17 +0000 | [diff] [blame] | 328 | ensure!( |
| 329 | config.extra_apks.len() == verified_data.extra_apks_data.len(), |
| 330 | "config expects {} extra apks, but found {}", |
| 331 | config.extra_apks.len(), |
| 332 | verified_data.extra_apks_data.len() |
| 333 | ); |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 334 | mount_extra_apks(&config, &mut zipfuse)?; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 335 | |
Alan Stokes | 26efd19 | 2023-11-06 16:30:15 +0000 | [diff] [blame] | 336 | register_vm_payload_service( |
| 337 | allow_restricted_apis, |
| 338 | service.clone(), |
| 339 | vm_secret, |
| 340 | vm_payload_service_fd, |
| 341 | )?; |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 342 | |
Shikha Panwar | 1a6efcd | 2023-02-03 19:23:43 +0000 | [diff] [blame] | 343 | // Set export_tombstones if enabled |
Inseob Kim | ab1037d | 2023-02-08 17:03:31 +0900 | [diff] [blame] | 344 | if should_export_tombstones(&config) { |
Shikha Panwar | 1a6efcd | 2023-02-03 19:23:43 +0000 | [diff] [blame] | 345 | // This property is read by tombstone_handler. |
| 346 | system_properties::write("microdroid_manager.export_tombstones.enabled", "1") |
| 347 | .context("set microdroid_manager.export_tombstones.enabled")?; |
Inseob Kim | cd9c1dd | 2022-07-13 17:13:45 +0900 | [diff] [blame] | 348 | } |
| 349 | |
Alan Stokes | 26efd19 | 2023-11-06 16:30:15 +0000 | [diff] [blame] | 350 | // Wait until apex config is done. (e.g. linker configuration for apexes) |
| 351 | wait_for_property_true(APEX_CONFIG_DONE_PROP).context("Failed waiting for apex config done")?; |
| 352 | |
| 353 | // Trigger init post-fs-data. This will start authfs if we wask it to. |
| 354 | if config.enable_authfs { |
| 355 | system_properties::write("microdroid_manager.authfs.enabled", "1") |
| 356 | .context("failed to write microdroid_manager.authfs.enabled")?; |
| 357 | } |
| 358 | system_properties::write("microdroid_manager.config_done", "1") |
| 359 | .context("failed to write microdroid_manager.config_done")?; |
| 360 | |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 361 | // Wait until zipfuse has mounted the APKs so we can access the payload |
| 362 | zipfuse.wait_until_done()?; |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 363 | |
Shikha Panwar | ddc124b | 2022-11-28 19:17:54 +0000 | [diff] [blame] | 364 | // Wait for encryptedstore to finish mounting the storage (if enabled) before setting |
| 365 | // microdroid_manager.init_done. Reason is init stops uneventd after that. |
| 366 | // Encryptedstore, however requires ueventd |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 367 | if let Some(mut child) = encryptedstore_child { |
| 368 | let exitcode = child.wait().context("Wait for encryptedstore child")?; |
| 369 | ensure!(exitcode.success(), "Unable to prepare encrypted storage. Exitcode={}", exitcode); |
| 370 | } |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 371 | |
Alan Stokes | 26efd19 | 2023-11-06 16:30:15 +0000 | [diff] [blame] | 372 | // Wait for init to have finished booting. |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 373 | wait_for_property_true("dev.bootcomplete").context("failed waiting for dev.bootcomplete")?; |
Alan Stokes | 26efd19 | 2023-11-06 16:30:15 +0000 | [diff] [blame] | 374 | |
| 375 | // And then tell it we're done so unnecessary services can be shut down. |
Shikha Panwar | 3f6f6a5 | 2022-11-29 17:28:36 +0000 | [diff] [blame] | 376 | system_properties::write("microdroid_manager.init_done", "1") |
| 377 | .context("set microdroid_manager.init_done")?; |
Inseob Kim | c16b0cc | 2023-01-26 14:57:24 +0900 | [diff] [blame] | 378 | |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 379 | info!("boot completed, time to run payload"); |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 380 | exec_task(task, service).context("Failed to run payload") |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 381 | } |
| 382 | |
Alan Stokes | 0375496 | 2023-11-06 15:36:09 +0000 | [diff] [blame] | 383 | fn post_payload_work() -> Result<()> { |
| 384 | // Sync the encrypted storage filesystem (flushes the filesystem caches). |
| 385 | if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() { |
| 386 | let mountpoint = CString::new(ENCRYPTEDSTORE_MOUNTPOINT).unwrap(); |
| 387 | |
| 388 | // SAFETY: `mountpoint` is a valid C string. `syncfs` and `close` are safe for any parameter |
| 389 | // values. |
| 390 | let ret = unsafe { |
| 391 | let dirfd = libc::open( |
| 392 | mountpoint.as_ptr(), |
| 393 | libc::O_DIRECTORY | libc::O_RDONLY | libc::O_CLOEXEC, |
| 394 | ); |
| 395 | ensure!(dirfd >= 0, "Unable to open {:?}", mountpoint); |
| 396 | let ret = libc::syncfs(dirfd); |
| 397 | libc::close(dirfd); |
| 398 | ret |
| 399 | }; |
| 400 | if ret != 0 { |
| 401 | error!("failed to sync encrypted storage."); |
| 402 | return Err(anyhow!(std::io::Error::last_os_error())); |
| 403 | } |
| 404 | } |
| 405 | Ok(()) |
| 406 | } |
| 407 | |
Alan Stokes | 0375496 | 2023-11-06 15:36:09 +0000 | [diff] [blame] | 408 | fn mount_extra_apks(config: &VmPayloadConfig, zipfuse: &mut Zipfuse) -> Result<()> { |
| 409 | // For now, only the number of apks is important, as the mount point and dm-verity name is fixed |
| 410 | for i in 0..config.extra_apks.len() { |
| 411 | let mount_dir = format!("/mnt/extra-apk/{i}"); |
| 412 | create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?; |
| 413 | |
| 414 | let mount_for_exec = |
| 415 | if cfg!(multi_tenant) { MountForExec::Allowed } else { MountForExec::Disallowed }; |
| 416 | // These run asynchronously in parallel - we wait later for them to complete. |
| 417 | zipfuse.mount( |
| 418 | mount_for_exec, |
| 419 | "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0", |
| 420 | Path::new(&format!("/dev/block/mapper/extra-apk-{i}")), |
| 421 | Path::new(&mount_dir), |
| 422 | format!("microdroid_manager.extra_apk.mounted.{i}"), |
| 423 | )?; |
| 424 | } |
| 425 | |
| 426 | Ok(()) |
| 427 | } |
| 428 | |
| 429 | fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> { |
| 430 | // The host is running a VirtualMachineService for this VM on a port equal |
| 431 | // to the CID of this VM. |
| 432 | let port = vsock::get_local_cid().context("Could not determine local CID")?; |
| 433 | RpcSession::new() |
| 434 | .setup_vsock_client(VMADDR_CID_HOST, port) |
| 435 | .context("Could not connect to IVirtualMachineService") |
| 436 | } |
| 437 | |
| 438 | /// Prepares a socket file descriptor for the vm payload service. |
| 439 | /// |
| 440 | /// # Safety |
| 441 | /// |
| 442 | /// The caller must ensure that this function is the only place that claims ownership |
| 443 | /// of the file descriptor and it is called only once. |
| 444 | unsafe fn prepare_vm_payload_service_socket() -> Result<OwnedFd> { |
| 445 | let raw_fd = android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?; |
| 446 | |
| 447 | // Creating OwnedFd for stdio FDs is not safe. |
| 448 | if [libc::STDIN_FILENO, libc::STDOUT_FILENO, libc::STDERR_FILENO].contains(&raw_fd) { |
| 449 | bail!("File descriptor {raw_fd} is standard I/O descriptor"); |
| 450 | } |
| 451 | // SAFETY: Initializing OwnedFd for a RawFd created by the init. |
| 452 | // We checked that the integer value corresponds to a valid FD and that the caller |
| 453 | // ensures that this is the only place to claim its ownership. |
| 454 | Ok(unsafe { OwnedFd::from_raw_fd(raw_fd) }) |
| 455 | } |
| 456 | |
| 457 | fn is_strict_boot() -> bool { |
| 458 | Path::new(AVF_STRICT_BOOT).exists() |
| 459 | } |
| 460 | |
| 461 | fn is_new_instance() -> bool { |
| 462 | Path::new(AVF_NEW_INSTANCE).exists() |
| 463 | } |
| 464 | |
| 465 | fn is_verified_boot() -> bool { |
| 466 | !Path::new(DEBUG_MICRODROID_NO_VERIFIED_BOOT).exists() |
| 467 | } |
| 468 | |
| 469 | fn is_debuggable() -> Result<bool> { |
| 470 | Ok(system_properties::read_bool(DEBUGGABLE_PROP, true)?) |
| 471 | } |
| 472 | |
| 473 | fn should_export_tombstones(config: &VmPayloadConfig) -> bool { |
| 474 | match config.export_tombstones { |
| 475 | Some(b) => b, |
| 476 | None => is_debuggable().unwrap_or(false), |
| 477 | } |
| 478 | } |
| 479 | |
| 480 | /// Get debug policy value in bool. It's true iff the value is explicitly set to <1>. |
| 481 | fn get_debug_policy_bool(path: &'static str) -> Result<Option<bool>> { |
| 482 | let mut file = match File::open(path) { |
| 483 | Ok(dp) => dp, |
| 484 | Err(e) => { |
| 485 | info!( |
| 486 | "Assumes that debug policy is disabled because failed to read debug policy ({e:?})" |
| 487 | ); |
| 488 | return Ok(Some(false)); |
| 489 | } |
| 490 | }; |
| 491 | let mut log: [u8; 4] = Default::default(); |
| 492 | file.read_exact(&mut log).context("Malformed data in {path}")?; |
| 493 | // DT spec uses big endian although Android is always little endian. |
| 494 | Ok(Some(u32::from_be_bytes(log) == 1)) |
| 495 | } |
| 496 | |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 497 | enum MountForExec { |
| 498 | Allowed, |
| 499 | Disallowed, |
| 500 | } |
| 501 | |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 502 | #[derive(Default)] |
| 503 | struct Zipfuse { |
| 504 | ready_properties: Vec<String>, |
| 505 | } |
| 506 | |
| 507 | impl Zipfuse { |
| 508 | fn mount( |
| 509 | &mut self, |
| 510 | noexec: MountForExec, |
| 511 | option: &str, |
| 512 | zip_path: &Path, |
| 513 | mount_dir: &Path, |
| 514 | ready_prop: String, |
| 515 | ) -> Result<Child> { |
| 516 | let mut cmd = Command::new(ZIPFUSE_BIN); |
| 517 | if let MountForExec::Disallowed = noexec { |
| 518 | cmd.arg("--noexec"); |
| 519 | } |
Alan Stokes | 1294f94 | 2023-08-21 14:34:12 +0100 | [diff] [blame] | 520 | // Let root own the files in APK, so we can access them, but set the group to |
| 521 | // allow all payloads to have access too. |
| 522 | let (uid, gid) = (microdroid_uids::ROOT_UID, microdroid_uids::MICRODROID_PAYLOAD_GID); |
| 523 | |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 524 | cmd.args(["-p", &ready_prop, "-o", option]); |
Alan Stokes | 1294f94 | 2023-08-21 14:34:12 +0100 | [diff] [blame] | 525 | cmd.args(["-u", &uid.to_string()]); |
| 526 | cmd.args(["-g", &gid.to_string()]); |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 527 | cmd.arg(zip_path).arg(mount_dir); |
| 528 | self.ready_properties.push(ready_prop); |
| 529 | cmd.spawn().with_context(|| format!("Failed to run zipfuse for {mount_dir:?}")) |
Andrew Scull | cc339a1 | 2022-07-04 12:44:19 +0000 | [diff] [blame] | 530 | } |
Alan Stokes | 960c903 | 2022-12-07 16:53:45 +0000 | [diff] [blame] | 531 | |
| 532 | fn wait_until_done(self) -> Result<()> { |
| 533 | // We check the last-started check first in the hope that by the time it is done |
| 534 | // all or most of the others will also be done, minimising the number of times we |
| 535 | // block on a property. |
| 536 | for property in self.ready_properties.into_iter().rev() { |
| 537 | wait_for_property_true(&property) |
| 538 | .with_context(|| format!("Failed waiting for {property}"))?; |
| 539 | } |
| 540 | Ok(()) |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 541 | } |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 542 | } |
| 543 | |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 544 | fn wait_for_property_true(property_name: &str) -> Result<()> { |
| 545 | let mut prop = PropertyWatcher::new(property_name)?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 546 | loop { |
Andrew Walbran | d9c766e | 2023-05-10 15:15:39 +0000 | [diff] [blame] | 547 | prop.wait(None)?; |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 548 | if system_properties::read_bool(property_name, false)? { |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 549 | break; |
| 550 | } |
| 551 | } |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 552 | Ok(()) |
| 553 | } |
| 554 | |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 555 | fn load_config(payload_metadata: PayloadMetadata) -> Result<VmPayloadConfig> { |
| 556 | match payload_metadata { |
Ludovic Barman | 93ee308 | 2023-06-20 12:18:43 +0000 | [diff] [blame] | 557 | PayloadMetadata::ConfigPath(path) => { |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 558 | let path = Path::new(&path); |
| 559 | info!("loading config from {:?}...", path); |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 560 | let file = ioutil::wait_for_file(path, WAIT_TIMEOUT) |
| 561 | .with_context(|| format!("Failed to read {:?}", path))?; |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 562 | Ok(serde_json::from_reader(file)?) |
| 563 | } |
Ludovic Barman | 93ee308 | 2023-06-20 12:18:43 +0000 | [diff] [blame] | 564 | PayloadMetadata::Config(payload_config) => { |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 565 | let task = Task { |
| 566 | type_: TaskType::MicrodroidLauncher, |
Alan Stokes | 8f12f2b | 2023-01-09 09:19:20 +0000 | [diff] [blame] | 567 | command: payload_config.payload_binary_name, |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 568 | }; |
| 569 | Ok(VmPayloadConfig { |
| 570 | os: OsConfig { name: "microdroid".to_owned() }, |
| 571 | task: Some(task), |
| 572 | apexes: vec![], |
| 573 | extra_apks: vec![], |
| 574 | prefer_staged: false, |
Inseob Kim | ab1037d | 2023-02-08 17:03:31 +0900 | [diff] [blame] | 575 | export_tombstones: None, |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 576 | enable_authfs: false, |
| 577 | }) |
| 578 | } |
Ludovic Barman | 93ee308 | 2023-06-20 12:18:43 +0000 | [diff] [blame] | 579 | _ => bail!("Failed to match config against a config type."), |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 580 | } |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 581 | } |
| 582 | |
Jaewan Kim | 3124ef0 | 2023-03-23 19:25:20 +0900 | [diff] [blame] | 583 | /// Loads the crashkernel into memory using kexec if debuggable or debug policy says so. |
| 584 | /// The VM should be loaded with `crashkernel=' parameter in the cmdline to allocate memory |
| 585 | /// for crashkernel. |
Jiyong Park | 202856e | 2022-08-22 16:04:26 +0900 | [diff] [blame] | 586 | fn load_crashkernel_if_supported() -> Result<()> { |
| 587 | let supported = std::fs::read_to_string("/proc/cmdline")?.contains(" crashkernel="); |
| 588 | info!("ramdump supported: {}", supported); |
Jaewan Kim | 3124ef0 | 2023-03-23 19:25:20 +0900 | [diff] [blame] | 589 | |
| 590 | if !supported { |
| 591 | return Ok(()); |
| 592 | } |
| 593 | |
Alan Stokes | 1125e01 | 2023-10-13 12:31:10 +0100 | [diff] [blame] | 594 | let debuggable = is_debuggable()?; |
Jaewan Kim | 3124ef0 | 2023-03-23 19:25:20 +0900 | [diff] [blame] | 595 | let ramdump = get_debug_policy_bool(AVF_DEBUG_POLICY_RAMDUMP)?.unwrap_or_default(); |
| 596 | let requested = debuggable | ramdump; |
| 597 | |
| 598 | if requested { |
Jiyong Park | 202856e | 2022-08-22 16:04:26 +0900 | [diff] [blame] | 599 | let status = Command::new("/system/bin/kexec_load").status()?; |
| 600 | if !status.success() { |
| 601 | return Err(anyhow!("Failed to load crashkernel: {:?}", status)); |
| 602 | } |
Jaewan Kim | 3124ef0 | 2023-03-23 19:25:20 +0900 | [diff] [blame] | 603 | info!("ramdump is loaded: debuggable={debuggable}, ramdump={ramdump}"); |
Jiyong Park | 202856e | 2022-08-22 16:04:26 +0900 | [diff] [blame] | 604 | } |
| 605 | Ok(()) |
| 606 | } |
| 607 | |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 608 | /// Executes the given task. |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 609 | fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> { |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 610 | info!("executing main task {:?}...", task); |
David Brazdil | 451cc96 | 2022-10-14 14:08:12 +0100 | [diff] [blame] | 611 | let mut command = match task.type_ { |
Alan Stokes | 1294f94 | 2023-08-21 14:34:12 +0100 | [diff] [blame] | 612 | TaskType::Executable => { |
Alan Stokes | 679ddf3 | 2023-09-01 11:14:48 +0100 | [diff] [blame] | 613 | // TODO(b/297501338): Figure out how to handle non-root for system payloads. |
Alan Stokes | 1294f94 | 2023-08-21 14:34:12 +0100 | [diff] [blame] | 614 | Command::new(&task.command) |
| 615 | } |
David Brazdil | 451cc96 | 2022-10-14 14:08:12 +0100 | [diff] [blame] | 616 | TaskType::MicrodroidLauncher => { |
| 617 | let mut command = Command::new("/system/bin/microdroid_launcher"); |
| 618 | command.arg(find_library_path(&task.command)?); |
Alan Stokes | 1294f94 | 2023-08-21 14:34:12 +0100 | [diff] [blame] | 619 | command.uid(microdroid_uids::MICRODROID_PAYLOAD_UID); |
| 620 | command.gid(microdroid_uids::MICRODROID_PAYLOAD_GID); |
David Brazdil | 451cc96 | 2022-10-14 14:08:12 +0100 | [diff] [blame] | 621 | command |
| 622 | } |
| 623 | }; |
Nikita Ioffe | 3452ee2 | 2022-12-15 00:31:56 +0000 | [diff] [blame] | 624 | |
Andrew Walbran | aac6830 | 2023-07-21 19:05:34 +0100 | [diff] [blame] | 625 | // SAFETY: We are not accessing any resource of the parent process. This means we can't make any |
| 626 | // log calls inside the closure. |
Nikita Ioffe | 3452ee2 | 2022-12-15 00:31:56 +0000 | [diff] [blame] | 627 | unsafe { |
Nikita Ioffe | 3452ee2 | 2022-12-15 00:31:56 +0000 | [diff] [blame] | 628 | command.pre_exec(|| { |
Nikita Ioffe | 3452ee2 | 2022-12-15 00:31:56 +0000 | [diff] [blame] | 629 | // It is OK to continue with payload execution even if the calls below fail, since |
| 630 | // whether process can use a capability is controlled by the SELinux. Dropping the |
| 631 | // capabilities here is just another defense-in-depth layer. |
Andrew Walbran | aac6830 | 2023-07-21 19:05:34 +0100 | [diff] [blame] | 632 | let _ = cap::drop_inheritable_caps(); |
| 633 | let _ = cap::drop_bounding_set(); |
Nikita Ioffe | 3452ee2 | 2022-12-15 00:31:56 +0000 | [diff] [blame] | 634 | Ok(()) |
| 635 | }); |
| 636 | } |
| 637 | |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 638 | command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()); |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 639 | |
| 640 | info!("notifying payload started"); |
Inseob Kim | c7d28c7 | 2021-10-25 14:28:10 +0000 | [diff] [blame] | 641 | service.notifyPayloadStarted()?; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 642 | |
Inseob Kim | 86ca016 | 2021-10-20 02:21:02 +0000 | [diff] [blame] | 643 | let exit_status = command.spawn()?.wait()?; |
Frederick Mayle | b5f7b6b | 2022-11-11 15:24:03 -0800 | [diff] [blame] | 644 | match exit_status.code() { |
| 645 | Some(exit_code) => Ok(exit_code), |
| 646 | None => Err(match exit_status.signal() { |
| 647 | Some(signal) => anyhow!( |
| 648 | "Payload exited due to signal: {} ({})", |
| 649 | signal, |
| 650 | Signal::try_from(signal).map_or("unknown", |s| s.as_str()) |
| 651 | ), |
| 652 | None => anyhow!("Payload has neither exit code nor signal"), |
| 653 | }), |
| 654 | } |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 655 | } |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 656 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 657 | fn find_library_path(name: &str) -> Result<String> { |
| 658 | let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?; |
| 659 | let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?; |
| 660 | let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?; |
Alice Wang | 6bbb6da | 2022-10-26 12:44:06 +0000 | [diff] [blame] | 661 | let path = format!("{}/lib/{}/{}", VM_APK_CONTENTS_PATH, abi, name); |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 662 | |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 663 | let metadata = fs::metadata(&path).with_context(|| format!("Unable to access {}", path))?; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 664 | if !metadata.is_file() { |
| 665 | bail!("{} is not a file", &path); |
| 666 | } |
| 667 | |
| 668 | Ok(path) |
| 669 | } |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 670 | |
Shikha Panwar | 95084df | 2023-07-22 11:47:45 +0000 | [diff] [blame] | 671 | fn prepare_encryptedstore(vm_secret: &VmSecret) -> Result<Child> { |
Alice Wang | 7e6c935 | 2023-02-15 15:44:13 +0000 | [diff] [blame] | 672 | let mut key = ZVec::new(ENCRYPTEDSTORE_KEYSIZE)?; |
Shikha Panwar | 3d3a70a | 2023-08-21 20:02:08 +0000 | [diff] [blame] | 673 | vm_secret.derive_encryptedstore_key(&mut key)?; |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 674 | let mut cmd = Command::new(ENCRYPTEDSTORE_BIN); |
| 675 | cmd.arg("--blkdevice") |
| 676 | .arg(ENCRYPTEDSTORE_BACKING_DEVICE) |
| 677 | .arg("--key") |
| 678 | .arg(hex::encode(&*key)) |
Shikha Panwar | 9fd198f | 2022-11-18 17:43:43 +0000 | [diff] [blame] | 679 | .args(["--mountpoint", ENCRYPTEDSTORE_MOUNTPOINT]) |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 680 | .spawn() |
| 681 | .context("encryptedstore failed") |
| 682 | } |