blob: 7b30f48305c64a2589c1c3af393dc7f3750022d4 [file] [log] [blame]
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
Andrew Walbranf6bf6862021-05-21 12:41:13 +000015//! Implementation of the AIDL interface of the VirtualizationService.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +000016
David Brazdil1f530702022-10-03 12:18:10 +010017use crate::{get_calling_pid, get_calling_uid};
David Brazdil49f96f52022-12-16 21:29:13 +000018use crate::atom::{
David Brazdil49f96f52022-12-16 21:29:13 +000019 write_vm_booted_stats, write_vm_creation_stats};
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +000020use crate::composite::make_composite_image;
Inseob Kim7307a892023-09-14 13:37:58 +090021use crate::crosvm::{CrosvmConfig, DiskFile, PayloadState, VfioDevice, VmContext, VmInstance, VmState};
Jaewan Kim61f86142023-03-28 15:12:52 +090022use crate::debug_config::DebugConfig;
Nikita Ioffe5dfddf22023-06-29 16:11:26 +010023use crate::payload::{add_microdroid_payload_images, add_microdroid_system_images, add_microdroid_vendor_image};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090024use crate::selinux::{getfilecon, SeContext};
Jiyong Park753553b2021-07-12 21:21:09 +090025use android_os_permissions_aidl::aidl::android::os::IPermissionController;
David Brazdil49f96f52022-12-16 21:29:13 +000026use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::{
Alice Wang4e3015d2023-10-10 09:35:37 +000027 Certificate::Certificate,
Andrew Walbranc92d35f2022-01-12 12:45:19 +000028 DeathReason::DeathReason,
David Brazdil49f96f52022-12-16 21:29:13 +000029 ErrorCode::ErrorCode,
30};
31use android_system_virtualizationservice::aidl::android::system::virtualizationservice::{
Inseob Kim53d0b212023-07-20 16:58:37 +090032 AssignableDevice::AssignableDevice,
David Brazdil7d1e5ec2023-02-06 17:56:29 +000033 CpuTopology::CpuTopology,
Andrew Walbran6b650662021-09-07 13:13:23 +000034 DiskImage::DiskImage,
Alan Stokes0cc59ee2021-09-24 11:20:34 +010035 IVirtualMachine::{BnVirtualMachine, IVirtualMachine},
Andrew Walbran6b650662021-09-07 13:13:23 +000036 IVirtualMachineCallback::IVirtualMachineCallback,
37 IVirtualizationService::IVirtualizationService,
Alan Stokes27f3ef02023-09-29 15:09:35 +010038 IVirtualizationService::FEATURE_MULTI_TENANT,
Nikita Ioffe631717e2023-09-05 13:38:07 +010039 IVirtualizationService::FEATURE_VENDOR_MODULES,
Alan Stokes7f27c0d2023-09-07 16:22:58 +010040 IVirtualizationService::FEATURE_DICE_CHANGES,
Keir Frasercdd4b112022-11-24 14:02:25 +000041 MemoryTrimLevel::MemoryTrimLevel,
Jiyong Park029977d2021-11-24 21:56:49 +090042 Partition::Partition,
Andrew Walbran6b650662021-09-07 13:13:23 +000043 PartitionType::PartitionType,
Inseob Kim0168b462022-12-27 14:54:35 +090044 VirtualMachineAppConfig::{DebugLevel::DebugLevel, Payload::Payload, VirtualMachineAppConfig},
Jooyung Han21e9b922021-06-26 04:14:16 +090045 VirtualMachineConfig::VirtualMachineConfig,
Andrew Walbran6b650662021-09-07 13:13:23 +000046 VirtualMachineDebugInfo::VirtualMachineDebugInfo,
Alan Stokes0d1ef782022-09-27 13:46:35 +010047 VirtualMachinePayloadConfig::VirtualMachinePayloadConfig,
Jooyung Han21e9b922021-06-26 04:14:16 +090048 VirtualMachineRawConfig::VirtualMachineRawConfig,
Andrew Walbran6b650662021-09-07 13:13:23 +000049 VirtualMachineState::VirtualMachineState,
Jooyung Han21e9b922021-06-26 04:14:16 +090050};
David Brazdilafc9a9e2023-01-12 16:08:10 +000051use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::IVirtualizationServiceInternal::IVirtualizationServiceInternal;
Seungjae Yoodd91f0f2022-11-09 15:25:21 +090052use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{
David Brazdilafc9a9e2023-01-12 16:08:10 +000053 BnVirtualMachineService, IVirtualMachineService,
Seungjae Yoofd9a0622022-10-14 10:01:29 +090054};
Shikha Panwar5d6a6752023-12-14 22:08:26 +000055use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::ISecretkeeper::{BnSecretkeeper, ISecretkeeper};
56use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::SecretId::SecretId;
57use android_hardware_security_authgraph::aidl::android::hardware::security::authgraph::{
58 Arc::Arc as AuthgraphArc, IAuthGraphKeyExchange::IAuthGraphKeyExchange,
59 IAuthGraphKeyExchange::BnAuthGraphKeyExchange, Identity::Identity, KeInitResult::KeInitResult,
60 Key::Key, PubKey::PubKey, SessionIdSignature::SessionIdSignature, SessionInfo::SessionInfo,
61 SessionInitiationInfo::SessionInitiationInfo,
62};
Alan Stokes25f69362023-03-06 16:51:54 +000063use anyhow::{anyhow, bail, Context, Result};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090064use apkverify::{HashAlgorithm, V4Signature};
Jiyong Parkd7bd2f22023-08-10 20:41:19 +090065use avflog::LogResult;
Alan Stokes0e82b502022-08-08 14:44:48 +010066use binder::{
David Brazdilafc9a9e2023-01-12 16:08:10 +000067 self, wait_for_interface, BinderFeatures, ExceptionCode, Interface, ParcelFileDescriptor,
68 Status, StatusCode, Strong,
Jiyong Park2227eaa2023-08-04 11:59:18 +090069 IntoBinderResult,
Andrew Walbrana89fc132021-03-17 17:08:36 +000070};
David Brazdilf50c7a62023-04-19 14:22:42 +000071use disk::QcowFile;
David Brazdil49f96f52022-12-16 21:29:13 +000072use lazy_static::lazy_static;
Seungjae Yooec3bc522023-11-09 10:14:30 +090073use libfdt::Fdt;
Seungjae Yoo0a8c84c2022-07-11 08:19:15 +000074use log::{debug, error, info, warn};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090075use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
Inseob Kim0168b462022-12-27 14:54:35 +090076use nix::unistd::pipe;
Inseob Kim7a1fc8f2023-11-22 18:45:28 +090077use regex::Regex;
David Brazdil73988ea2022-11-11 15:10:32 +000078use rpcbinder::RpcServer;
Alan Stokes25f69362023-03-06 16:51:54 +000079use rustutils::system_properties;
Jiyong Parkdcf17412022-02-08 15:07:23 +090080use semver::VersionReq;
Inseob Kim6ef80972023-07-20 17:23:36 +090081use std::collections::HashSet;
Andrew Walbrandff3b942021-06-09 15:20:36 +000082use std::convert::TryInto;
Seungjae Yooec3bc522023-11-09 10:14:30 +090083use std::ffi::{CStr, CString};
Inseob Kim6ef80972023-07-20 17:23:36 +090084use std::fs::{canonicalize, read_dir, remove_file, File, OpenOptions};
David Brazdilf50c7a62023-04-19 14:22:42 +000085use std::io::{BufRead, BufReader, Error, ErrorKind, Write};
Nikita Ioffe5776f082023-02-10 21:38:26 +000086use std::num::{NonZeroU16, NonZeroU32};
Andrew Walbrand3a84182021-09-07 14:48:52 +000087use std::os::unix::io::{FromRawFd, IntoRawFd};
David Brazdilafc9a9e2023-01-12 16:08:10 +000088use std::os::unix::raw::pid_t;
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +000089use std::path::{Path, PathBuf};
Andrew Walbran320b5602021-03-04 16:11:12 +000090use std::sync::{Arc, Mutex, Weak};
Seungjae Yooec3bc522023-11-09 10:14:30 +090091use vbmeta::VbMetaImage;
Andrew Walbrancc0db522021-07-12 17:03:42 +000092use vmconfig::VmConfig;
David Brazdilafc9a9e2023-01-12 16:08:10 +000093use vsock::VsockStream;
Jooyung Han35edb8f2021-07-01 16:17:16 +090094use zip::ZipArchive;
Andrew Walbrand6dce6f2021-03-05 16:39:08 +000095
David Brazdil41d1a872022-10-05 14:44:19 +010096/// The unique ID of a VM used (together with a port number) for vsock communication.
97pub type Cid = u32;
98
David Brazdil4b4c5102022-12-19 22:56:20 +000099pub const BINDER_SERVICE_IDENTIFIER: &str = "android.system.virtualizationservice";
100
Jooyung Han95884632021-07-06 22:27:54 +0900101/// The size of zero.img.
102/// Gaps in composite disk images are filled with a shared zero.img.
103const ZERO_FILLER_SIZE: u64 = 4096;
104
David Brazdilf50c7a62023-04-19 14:22:42 +0000105/// Magic string for the instance image
106const ANDROID_VM_INSTANCE_MAGIC: &str = "Android-VM-instance";
107
108/// Version of the instance image format
109const ANDROID_VM_INSTANCE_VERSION: u16 = 1;
110
Alan Stokes0d1ef782022-09-27 13:46:35 +0100111const MICRODROID_OS_NAME: &str = "microdroid";
112
Shikha Panwar5d6a6752023-12-14 22:08:26 +0000113// TODO(b/291213394): Use 'default' instance for secretkeeper instead of 'nonsecure'
114const SECRETKEEPER_IDENTIFIER: &str =
115 "android.hardware.security.secretkeeper.ISecretkeeper/nonsecure";
116
David Brazdilf50c7a62023-04-19 14:22:42 +0000117const UNFORMATTED_STORAGE_MAGIC: &str = "UNFORMATTED-STORAGE";
118
Seungjae Yooec3bc522023-11-09 10:14:30 +0900119/// Roughly estimated sufficient size for storing vendor public key into DTBO.
120const EMPTY_VENDOR_DT_OVERLAY_BUF_SIZE: usize = 10000;
121
David Brazdilf50c7a62023-04-19 14:22:42 +0000122/// crosvm requires all partitions to be a multiple of 4KiB.
123const PARTITION_GRANULARITY_BYTES: u64 = 4096;
124
David Brazdil49f96f52022-12-16 21:29:13 +0000125lazy_static! {
David Brazdil4b4c5102022-12-19 22:56:20 +0000126 pub static ref GLOBAL_SERVICE: Strong<dyn IVirtualizationServiceInternal> =
127 wait_for_interface(BINDER_SERVICE_IDENTIFIER)
128 .expect("Could not connect to VirtualizationServiceInternal");
Inseob Kim7a1fc8f2023-11-22 18:45:28 +0900129 static ref MICRODROID_GKI_OS_NAME_PATTERN: Regex =
Inseob Kim0276f612023-12-07 17:25:18 +0900130 Regex::new(r"^microdroid_gki-android\d+-\d+\.\d+$").expect("Failed to construct Regex");
David Brazdil49f96f52022-12-16 21:29:13 +0000131}
132
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000133fn create_or_update_idsig_file(
134 input_fd: &ParcelFileDescriptor,
135 idsig_fd: &ParcelFileDescriptor,
136) -> Result<()> {
137 let mut input = clone_file(input_fd)?;
138 let metadata = input.metadata().context("failed to get input metadata")?;
139 if !metadata.is_file() {
140 bail!("input is not a regular file");
141 }
Alan Stokes25f69362023-03-06 16:51:54 +0000142 let mut sig =
143 V4Signature::create(&mut input, get_current_sdk()?, 4096, &[], HashAlgorithm::SHA256)
144 .context("failed to create idsig")?;
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000145
146 let mut output = clone_file(idsig_fd)?;
Jiyong Park8d192952023-06-26 14:29:51 +0900147
148 // Optimization. We don't have to update idsig file whenever a VM is started. Don't update it,
149 // if the idsig file already has the same APK digest.
150 if output.metadata()?.len() > 0 {
151 if let Ok(out_sig) = V4Signature::from_idsig(&mut output) {
152 if out_sig.signing_info.apk_digest == sig.signing_info.apk_digest {
153 debug!("idsig {:?} is up-to-date with apk {:?}.", output, input);
154 return Ok(());
155 }
156 }
157 // if we fail to read v4signature from output, that's fine. User can pass a random file.
158 // We will anyway overwrite the file to the v4signature generated from input_fd.
159 }
160
Nikita Ioffec09b0492022-12-14 20:18:33 +0000161 output.set_len(0).context("failed to set_len on the idsig output")?;
162 sig.write_into(&mut output).context("failed to write idsig")?;
Nikita Ioffef1ce9872022-12-09 13:31:59 +0000163 Ok(())
164}
165
Alan Stokes25f69362023-03-06 16:51:54 +0000166fn get_current_sdk() -> Result<u32> {
167 let current_sdk = system_properties::read("ro.build.version.sdk")?;
168 let current_sdk = current_sdk.ok_or_else(|| anyhow!("SDK version missing"))?;
169 current_sdk.parse().context("Malformed SDK version")
170}
171
David Brazdil4b4c5102022-12-19 22:56:20 +0000172pub fn remove_temporary_files(path: &PathBuf) -> Result<()> {
173 for dir_entry in read_dir(path)? {
174 remove_file(dir_entry?.path())?;
175 }
176 Ok(())
David Brazdil528e0472022-10-10 15:06:02 +0100177}
178
David Brazdil528e0472022-10-10 15:06:02 +0100179/// Implementation of `IVirtualizationService`, the entry point of the AIDL service.
David Brazdil49f96f52022-12-16 21:29:13 +0000180#[derive(Debug, Default)]
Andrew Walbranf6bf6862021-05-21 12:41:13 +0000181pub struct VirtualizationService {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900182 state: Arc<Mutex<State>>,
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000183}
184
Shikha Panward8e35422021-10-11 13:51:27 +0000185impl Interface for VirtualizationService {
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000186 fn dump(&self, writer: &mut dyn Write, _args: &[&CStr]) -> Result<(), StatusCode> {
Shikha Panward8e35422021-10-11 13:51:27 +0000187 check_permission("android.permission.DUMP").or(Err(StatusCode::PERMISSION_DENIED))?;
188 let state = &mut *self.state.lock().unwrap();
189 let vms = state.vms();
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000190 writeln!(writer, "Running {0} VMs:", vms.len()).or(Err(StatusCode::UNKNOWN_ERROR))?;
Shikha Panward8e35422021-10-11 13:51:27 +0000191 for vm in vms {
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000192 writeln!(writer, "VM CID: {}", vm.cid).or(Err(StatusCode::UNKNOWN_ERROR))?;
193 writeln!(writer, "\tState: {:?}", vm.vm_state.lock().unwrap())
Shikha Panward8e35422021-10-11 13:51:27 +0000194 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000195 writeln!(writer, "\tPayload state {:?}", vm.payload_state())
Shikha Panward8e35422021-10-11 13:51:27 +0000196 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000197 writeln!(writer, "\tProtected: {}", vm.protected).or(Err(StatusCode::UNKNOWN_ERROR))?;
198 writeln!(writer, "\ttemporary_directory: {}", vm.temporary_directory.to_string_lossy())
Shikha Panward8e35422021-10-11 13:51:27 +0000199 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000200 writeln!(writer, "\trequester_uid: {}", vm.requester_uid)
Shikha Panward8e35422021-10-11 13:51:27 +0000201 .or(Err(StatusCode::UNKNOWN_ERROR))?;
Andrei Homescu0cf8e222023-11-09 04:27:55 +0000202 writeln!(writer, "\trequester_debug_pid: {}", vm.requester_debug_pid)
Shikha Panward8e35422021-10-11 13:51:27 +0000203 .or(Err(StatusCode::UNKNOWN_ERROR))?;
204 }
205 Ok(())
206 }
207}
Andrew Walbranf6bf6862021-05-21 12:41:13 +0000208impl IVirtualizationService for VirtualizationService {
Andrew Walbranf8d94112021-09-07 11:45:36 +0000209 /// Creates (but does not start) a new VM with the given configuration, assigning it the next
210 /// available CID.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000211 ///
212 /// Returns a binder `IVirtualMachine` object referring to it, as a handle for the client.
Andrew Walbranf8d94112021-09-07 11:45:36 +0000213 fn createVm(
Andrew Walbrana89fc132021-03-17 17:08:36 +0000214 &self,
Andrew Walbran3a5a9212021-05-04 17:09:08 +0000215 config: &VirtualMachineConfig,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900216 console_out_fd: Option<&ParcelFileDescriptor>,
217 console_in_fd: Option<&ParcelFileDescriptor>,
Andrew Walbrana89fc132021-03-17 17:08:36 +0000218 log_fd: Option<&ParcelFileDescriptor>,
219 ) -> binder::Result<Strong<dyn IVirtualMachine>> {
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000220 let mut is_protected = false;
Jiyong Parke6fb1672023-06-26 16:45:55 +0900221 let ret = self.create_vm_internal(
222 config,
223 console_out_fd,
224 console_in_fd,
225 log_fd,
226 &mut is_protected,
227 );
Seungjae Yoo0a8c84c2022-07-11 08:19:15 +0000228 write_vm_creation_stats(config, is_protected, &ret);
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000229 ret
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000230 }
Andrew Walbran320b5602021-03-04 16:11:12 +0000231
Andrew Walbrandff3b942021-06-09 15:20:36 +0000232 /// Initialise an empty partition image of the given size to be used as a writable partition.
233 fn initializeWritablePartition(
234 &self,
235 image_fd: &ParcelFileDescriptor,
Alan Stokesff0005f2023-01-30 09:53:00 +0000236 size_bytes: i64,
Jiyong Park9dd389e2021-08-23 20:42:59 +0900237 partition_type: PartitionType,
Andrew Walbrandff3b942021-06-09 15:20:36 +0000238 ) -> binder::Result<()> {
Jiyong Park753553b2021-07-12 21:21:09 +0900239 check_manage_access()?;
Jiyong Park2227eaa2023-08-04 11:59:18 +0900240 let size_bytes = size_bytes
241 .try_into()
242 .with_context(|| format!("Invalid size: {}", size_bytes))
243 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000244 let size_bytes = round_up(size_bytes, PARTITION_GRANULARITY_BYTES);
245 let image = clone_file(image_fd)?;
246 // initialize the file. Any data in the file will be erased.
Jiyong Park2227eaa2023-08-04 11:59:18 +0900247 image.set_len(0).context("Failed to reset a file").or_service_specific_exception(-1)?;
248 let mut part = QcowFile::new(image, size_bytes)
249 .context("Failed to create QCOW2 image")
250 .or_service_specific_exception(-1)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000251
252 match partition_type {
253 PartitionType::RAW => Ok(()),
254 PartitionType::ANDROID_VM_INSTANCE => format_as_android_vm_instance(&mut part),
255 PartitionType::ENCRYPTEDSTORE => format_as_encryptedstore(&mut part),
256 _ => Err(Error::new(
257 ErrorKind::Unsupported,
258 format!("Unsupported partition type {:?}", partition_type),
259 )),
260 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900261 .with_context(|| format!("Failed to initialize partition as {:?}", partition_type))
262 .or_service_specific_exception(-1)?;
David Brazdilf50c7a62023-04-19 14:22:42 +0000263
264 Ok(())
Andrew Walbrandff3b942021-06-09 15:20:36 +0000265 }
266
Jiyong Park0a248432021-08-20 23:32:39 +0900267 /// Creates or update the idsig file by digesting the input APK file.
268 fn createOrUpdateIdsigFile(
269 &self,
270 input_fd: &ParcelFileDescriptor,
271 idsig_fd: &ParcelFileDescriptor,
272 ) -> binder::Result<()> {
Jiyong Parkc3ca24f2022-06-28 10:45:15 +0900273 check_manage_access()?;
274
Jiyong Park2227eaa2023-08-04 11:59:18 +0900275 create_or_update_idsig_file(input_fd, idsig_fd).or_service_specific_exception(-1)?;
Jiyong Park0a248432021-08-20 23:32:39 +0900276 Ok(())
277 }
278
Andrew Walbran320b5602021-03-04 16:11:12 +0000279 /// Get a list of all currently running VMs. This method is only intended for debug purposes,
280 /// and as such is only permitted from the shell user.
281 fn debugListVms(&self) -> binder::Result<Vec<VirtualMachineDebugInfo>> {
David Brazdil209074a2023-01-12 16:44:51 +0000282 // Delegate to the global service, including checking the debug permission.
David Brazdild4f51a52023-01-11 14:09:27 +0000283 GLOBAL_SERVICE.debugListVms()
Andrew Walbran320b5602021-03-04 16:11:12 +0000284 }
Inseob Kim53d0b212023-07-20 16:58:37 +0900285
286 /// Get a list of assignable device types.
287 fn getAssignableDevices(&self) -> binder::Result<Vec<AssignableDevice>> {
288 // Delegate to the global service, including checking the permission.
289 GLOBAL_SERVICE.getAssignableDevices()
290 }
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100291
292 /// Returns whether given feature is enabled
293 fn isFeatureEnabled(&self, feature: &str) -> binder::Result<bool> {
294 check_manage_access()?;
295
296 // This approach is quite cumbersome, but will do the work for the short term.
297 // TODO(b/298012279): make this scalable.
298 match feature {
Alan Stokes7f27c0d2023-09-07 16:22:58 +0100299 FEATURE_DICE_CHANGES => Ok(cfg!(dice_changes)),
Alan Stokes27f3ef02023-09-29 15:09:35 +0100300 FEATURE_MULTI_TENANT => Ok(cfg!(multi_tenant)),
Nikita Ioffe631717e2023-09-05 13:38:07 +0100301 FEATURE_VENDOR_MODULES => Ok(cfg!(vendor_modules)),
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100302 _ => {
Alan Stokes7f27c0d2023-09-07 16:22:58 +0100303 warn!("unknown feature {feature}");
Nikita Ioffef7c742a2023-09-04 16:57:59 +0100304 Ok(false)
305 }
306 }
307 }
Andrew Walbran320b5602021-03-04 16:11:12 +0000308}
309
Jiyong Park8611a6c2021-07-09 18:17:44 +0900310impl VirtualizationService {
311 pub fn init() -> VirtualizationService {
David Brazdil49f96f52022-12-16 21:29:13 +0000312 VirtualizationService::default()
Jiyong Park8611a6c2021-07-09 18:17:44 +0900313 }
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000314
David Brazdil209074a2023-01-12 16:44:51 +0000315 fn create_vm_context(
316 &self,
317 requester_debug_pid: pid_t,
318 ) -> binder::Result<(VmContext, Cid, PathBuf)> {
David Brazdil8cf8f482022-11-23 14:21:26 +0000319 const NUM_ATTEMPTS: usize = 5;
320
321 for _ in 0..NUM_ATTEMPTS {
Charisee96113f32023-01-26 09:00:42 +0000322 let vm_context = GLOBAL_SERVICE.allocateGlobalVmContext(requester_debug_pid)?;
David Brazdild4f51a52023-01-11 14:09:27 +0000323 let cid = vm_context.getCid()? as Cid;
324 let temp_dir: PathBuf = vm_context.getTemporaryDirectory()?.into();
David Brazdil8cf8f482022-11-23 14:21:26 +0000325 let service = VirtualMachineService::new_binder(self.state.clone(), cid).as_binder();
326
327 // Start VM service listening for connections from the new CID on port=CID.
David Brazdil8cf8f482022-11-23 14:21:26 +0000328 let port = cid;
David Brazdil3238da42022-11-18 10:04:51 +0000329 match RpcServer::new_vsock(service, cid, port) {
David Brazdil8cf8f482022-11-23 14:21:26 +0000330 Ok(vm_server) => {
331 vm_server.start();
David Brazdild4f51a52023-01-11 14:09:27 +0000332 return Ok((VmContext::new(vm_context, vm_server), cid, temp_dir));
David Brazdil8cf8f482022-11-23 14:21:26 +0000333 }
334 Err(err) => {
335 warn!("Could not start RpcServer on port {}: {}", port, err);
336 }
337 }
338 }
Jiyong Park2227eaa2023-08-04 11:59:18 +0900339 Err(anyhow!("Too many attempts to create VM context failed"))
340 .or_service_specific_exception(-1)
David Brazdil8cf8f482022-11-23 14:21:26 +0000341 }
342
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000343 fn create_vm_internal(
344 &self,
345 config: &VirtualMachineConfig,
Jiyong Parke6fb1672023-06-26 16:45:55 +0900346 console_out_fd: Option<&ParcelFileDescriptor>,
347 console_in_fd: Option<&ParcelFileDescriptor>,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000348 log_fd: Option<&ParcelFileDescriptor>,
349 is_protected: &mut bool,
350 ) -> binder::Result<Strong<dyn IVirtualMachine>> {
David Brazdil209074a2023-01-12 16:44:51 +0000351 let requester_uid = get_calling_uid();
352 let requester_debug_pid = get_calling_pid();
353
Nikita Ioffe631717e2023-09-05 13:38:07 +0100354 check_config_features(config)?;
355
David Brazdil209074a2023-01-12 16:44:51 +0000356 // Allocating VM context checks the MANAGE_VIRTUAL_MACHINE permission.
357 let (vm_context, cid, temporary_directory) = self.create_vm_context(requester_debug_pid)?;
Inseob Kim1119d702022-05-02 18:01:58 +0900358
Alan Stokes7bc146c2022-10-20 17:10:32 +0100359 let is_custom = match config {
360 VirtualMachineConfig::RawConfig(_) => true,
361 VirtualMachineConfig::AppConfig(config) => {
362 // Some features are reserved for platform apps only, even when using
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +0100363 // VirtualMachineAppConfig. Almost all of these features are grouped in the
364 // CustomConfig struct:
Alan Stokes7bc146c2022-10-20 17:10:32 +0100365 // - controlling CPUs;
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +0100366 // - specifying a config file in the APK; (this one is not part of CustomConfig)
Nikita Ioffe26c35ed2023-06-05 17:49:08 +0100367 // - gdbPort is set, meaning that crosvm will start a gdb server;
Inseob Kim6ef80972023-07-20 17:23:36 +0900368 // - using anything other than the default kernel;
369 // - specifying devices to be assigned.
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +0100370 config.customConfig.is_some() || matches!(config.payload, Payload::ConfigPath(_))
Inseob Kim1119d702022-05-02 18:01:58 +0900371 }
Alan Stokes7bc146c2022-10-20 17:10:32 +0100372 };
373 if is_custom {
374 check_use_custom_virtual_machine()?;
Inseob Kim1119d702022-05-02 18:01:58 +0900375 }
376
Nikita Ioffe5776f082023-02-10 21:38:26 +0000377 let gdb_port = extract_gdb_port(config);
378
379 // Additional permission checks if caller request gdb.
380 if gdb_port.is_some() {
381 check_gdb_allowed(config)?;
382 }
383
Seungjae Yooec3bc522023-11-09 10:14:30 +0900384 let vendor_public_key = extract_vendor_public_key(config)
385 .context("Failed to extract vendor public key")
386 .or_service_specific_exception(-1)?;
387 let dtbo_vendor = if let Some(vendor_public_key) = vendor_public_key {
388 let dtbo_for_vendor_image = temporary_directory.join("dtbo_vendor");
389 create_dtbo_for_vendor_image(&vendor_public_key, &dtbo_for_vendor_image)
390 .context("Failed to write vendor_public_key")
391 .or_service_specific_exception(-1)?;
392 let file = File::open(dtbo_for_vendor_image)
393 .context("Failed to open dtbo_vendor")
394 .or_service_specific_exception(-1)?;
395 Some(file)
396 } else {
397 None
398 };
399
Jaewan Kim61f86142023-03-28 15:12:52 +0900400 let debug_level = match config {
401 VirtualMachineConfig::AppConfig(config) => config.debugLevel,
402 _ => DebugLevel::NONE,
403 };
404 let debug_config = DebugConfig::new(debug_level);
405
406 let ramdump = if debug_config.is_ramdump_needed() {
Jiyong Parked180932023-02-24 19:55:41 +0900407 Some(prepare_ramdump_file(&temporary_directory)?)
408 } else {
409 None
410 };
411
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000412 let state = &mut *self.state.lock().unwrap();
Jiyong Parke6fb1672023-06-26 16:45:55 +0900413 let console_out_fd =
414 clone_or_prepare_logger_fd(&debug_config, console_out_fd, format!("Console({})", cid))?;
415 let console_in_fd = console_in_fd.map(clone_file).transpose()?;
Jaewan Kim61f86142023-03-28 15:12:52 +0900416 let log_fd = clone_or_prepare_logger_fd(&debug_config, log_fd, format!("Log({})", cid))?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000417
418 // Counter to generate unique IDs for temporary image files.
419 let mut next_temporary_image_id = 0;
420 // Files which are referred to from composite images. These must be mapped to the crosvm
421 // child process, and not closed before it is started.
422 let mut indirect_files = vec![];
423
Alan Stokes7bc146c2022-10-20 17:10:32 +0100424 let (is_app_config, config) = match config {
425 VirtualMachineConfig::RawConfig(config) => (false, BorrowedOrOwned::Borrowed(config)),
426 VirtualMachineConfig::AppConfig(config) => {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900427 let config = load_app_config(config, &debug_config, &temporary_directory)
428 .or_service_specific_exception_with(-1, |e| {
Jaewan Kim61f86142023-03-28 15:12:52 +0900429 *is_protected = config.protectedVm;
430 let message = format!("Failed to load app config: {:?}", e);
431 error!("{}", message);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900432 message
Jaewan Kim61f86142023-03-28 15:12:52 +0900433 })?;
Alan Stokes7bc146c2022-10-20 17:10:32 +0100434 (true, BorrowedOrOwned::Owned(config))
435 }
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000436 };
437 let config = config.as_ref();
438 *is_protected = config.protectedVm;
439
440 // Check if partition images are labeled incorrectly. This is to prevent random images
441 // which are not protected by the Android Verified Boot (e.g. bits downloaded by apps) from
Alan Stokes3e5eec12023-09-07 12:10:00 +0100442 // being loaded in a pVM. This applies to everything but the instance image in the raw
443 // config, and everything but the non-executable, generated partitions in the app
444 // config.
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000445 config
446 .disks
447 .iter()
448 .flat_map(|disk| disk.partitions.iter())
449 .filter(|partition| {
450 if is_app_config {
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100451 !is_safe_app_partition(&partition.label)
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000452 } else {
Alice Wangc206b9b2023-08-28 14:13:51 +0000453 !is_safe_raw_partition(&partition.label)
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000454 }
455 })
456 .try_for_each(check_label_for_partition)
Jiyong Park2227eaa2023-08-04 11:59:18 +0900457 .or_service_specific_exception(-1)?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000458
Alan Stokes185fe112023-01-10 16:20:55 +0000459 let kernel = maybe_clone_file(&config.kernel)?;
460 let initrd = maybe_clone_file(&config.initrd)?;
461
462 // In a protected VM, we require custom kernels to come from a trusted source (b/237054515).
463 if config.protectedVm {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900464 check_label_for_kernel_files(&kernel, &initrd).or_service_specific_exception(-1)?;
Alan Stokes185fe112023-01-10 16:20:55 +0000465 }
466
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000467 let zero_filler_path = temporary_directory.join("zero.img");
Jiyong Park2227eaa2023-08-04 11:59:18 +0900468 write_zero_filler(&zero_filler_path)
469 .context("Failed to make composite image")
470 .with_log()
471 .or_service_specific_exception(-1)?;
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000472
473 // Assemble disk images if needed.
474 let disks = config
475 .disks
476 .iter()
477 .map(|disk| {
478 assemble_disk_image(
479 disk,
480 &zero_filler_path,
481 &temporary_directory,
482 &mut next_temporary_image_id,
483 &mut indirect_files,
484 )
485 })
486 .collect::<Result<Vec<DiskFile>, _>>()?;
487
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000488 let (cpus, host_cpu_topology) = match config.cpuTopology {
489 CpuTopology::MATCH_HOST => (None, true),
490 CpuTopology::ONE_CPU => (NonZeroU32::new(1), false),
491 val => {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900492 return Err(anyhow!("Failed to parse CPU topology value {:?}", val))
493 .with_log()
494 .or_service_specific_exception(-1);
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000495 }
496 };
497
David Brazdil2dfefd12023-11-17 14:07:36 +0000498 let (vfio_devices, dtbo) = if !config.devices.is_empty() {
Inseob Kim6ef80972023-07-20 17:23:36 +0900499 let mut set = HashSet::new();
500 for device in config.devices.iter() {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900501 let path = canonicalize(device)
502 .with_context(|| format!("can't canonicalize {device}"))
503 .or_service_specific_exception(-1)?;
Inseob Kim6ef80972023-07-20 17:23:36 +0900504 if !set.insert(path) {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900505 return Err(anyhow!("duplicated device {device}"))
506 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Inseob Kim6ef80972023-07-20 17:23:36 +0900507 }
508 }
David Brazdil2dfefd12023-11-17 14:07:36 +0000509 let devices = GLOBAL_SERVICE
Inseob Kim7307a892023-09-14 13:37:58 +0900510 .bindDevicesToVfioDriver(&config.devices)?
511 .into_iter()
512 .map(|x| VfioDevice {
513 sysfs_path: PathBuf::from(&x.sysfsPath),
Jaewan Kim35e818d2023-10-18 05:36:38 +0000514 dtbo_label: x.dtboLabel,
Inseob Kim7307a892023-09-14 13:37:58 +0900515 })
David Brazdil2dfefd12023-11-17 14:07:36 +0000516 .collect::<Vec<_>>();
517 let dtbo_file = File::from(
518 GLOBAL_SERVICE
519 .getDtboFile()?
520 .as_ref()
521 .try_clone()
522 .context("Failed to create File from ParcelFileDescriptor")
523 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)?,
524 );
525 (devices, Some(dtbo_file))
Inseob Kim7307a892023-09-14 13:37:58 +0900526 } else {
David Brazdil2dfefd12023-11-17 14:07:36 +0000527 (vec![], None)
Inseob Kim7307a892023-09-14 13:37:58 +0900528 };
Inseob Kim6ef80972023-07-20 17:23:36 +0900529
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000530 // Actually start the VM.
531 let crosvm_config = CrosvmConfig {
532 cid,
Seungjae Yoo62085c02022-08-12 04:44:52 +0000533 name: config.name.clone(),
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000534 bootloader: maybe_clone_file(&config.bootloader)?,
Alan Stokes185fe112023-01-10 16:20:55 +0000535 kernel,
536 initrd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000537 disks,
538 params: config.params.to_owned(),
539 protected: *is_protected,
Jaewan Kim61f86142023-03-28 15:12:52 +0900540 debug_config,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000541 memory_mib: config.memoryMib.try_into().ok().and_then(NonZeroU32::new),
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000542 cpus,
543 host_cpu_topology,
Jiyong Parkdfe16d62022-04-20 17:32:12 +0900544 task_profiles: config.taskProfiles.clone(),
Jiyong Parke6fb1672023-06-26 16:45:55 +0900545 console_out_fd,
546 console_in_fd,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000547 log_fd,
Jiyong Parked180932023-02-24 19:55:41 +0900548 ramdump,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000549 indirect_files,
550 platform_version: parse_platform_version_req(&config.platformVersion)?,
Jiyong Parke6ed0f92022-06-22 00:13:00 +0900551 detect_hangup: is_app_config,
Nikita Ioffe5776f082023-02-10 21:38:26 +0000552 gdb_port,
Inseob Kim7307a892023-09-14 13:37:58 +0900553 vfio_devices,
David Brazdil2dfefd12023-11-17 14:07:36 +0000554 dtbo,
Seungjae Yooec3bc522023-11-09 10:14:30 +0900555 dtbo_vendor,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000556 };
557 let instance = Arc::new(
David Brazdil528e0472022-10-10 15:06:02 +0100558 VmInstance::new(
559 crosvm_config,
560 temporary_directory,
561 requester_uid,
562 requester_debug_pid,
563 vm_context,
564 )
Jiyong Park2227eaa2023-08-04 11:59:18 +0900565 .with_context(|| format!("Failed to create VM with config {:?}", config))
566 .with_log()
567 .or_service_specific_exception(-1)?,
Shikha Panwar061aa2c2022-04-05 12:52:56 +0000568 );
569 state.add_vm(Arc::downgrade(&instance));
570 Ok(VirtualMachine::create(instance))
571 }
Jiyong Park8611a6c2021-07-09 18:17:44 +0900572}
573
Seungjae Yooec3bc522023-11-09 10:14:30 +0900574fn extract_vendor_public_key(config: &VirtualMachineConfig) -> Result<Option<Vec<u8>>> {
575 let VirtualMachineConfig::AppConfig(config) = config else {
576 return Ok(None);
577 };
578 let Some(custom_config) = &config.customConfig else {
579 return Ok(None);
580 };
581 let Some(file) = custom_config.vendorImage.as_ref() else {
582 return Ok(None);
583 };
584
585 let file = clone_file(file)?;
586 let size = file.metadata().context("Failed to get metadata from microdroid-vendor.img")?.len();
587 let vbmeta = VbMetaImage::verify_reader_region(&file, 0, size)
588 .context("Failed to get vbmeta from microdroid-vendor.img")?;
589 let vendor_public_key = vbmeta
590 .public_key()
591 .ok_or(anyhow!("No public key is extracted from microdroid-vendor.img"))?
592 .to_vec();
593
594 Ok(Some(vendor_public_key))
595}
596
597fn create_dtbo_for_vendor_image(vendor_public_key: &[u8], dtbo: &PathBuf) -> Result<()> {
598 if dtbo.exists() {
599 return Err(anyhow!("DTBO file already exists"));
600 }
601
602 let mut buf = vec![0; EMPTY_VENDOR_DT_OVERLAY_BUF_SIZE];
603 let fdt = Fdt::create_empty_tree(buf.as_mut_slice())
604 .map_err(|e| anyhow!("Failed to create FDT: {:?}", e))?;
605 let mut root = fdt.root_mut().map_err(|e| anyhow!("Failed to get root node: {:?}", e))?;
606
607 let fragment_node_name = CString::new("fragment@0")?;
608 let mut fragment_node = root
609 .add_subnode(fragment_node_name.as_c_str())
610 .map_err(|e| anyhow!("Failed to create fragment node: {:?}", e))?;
611 let target_path_prop_name = CString::new("target-path")?;
612 let target_path = CString::new("/")?;
613 fragment_node
614 .setprop(target_path_prop_name.as_c_str(), target_path.to_bytes_with_nul())
615 .map_err(|e| anyhow!("Failed to set target-path: {:?}", e))?;
616 let overlay_node_name = CString::new("__overlay__")?;
617 let mut overlay_node = fragment_node
618 .add_subnode(overlay_node_name.as_c_str())
619 .map_err(|e| anyhow!("Failed to create overlay node: {:?}", e))?;
620
621 let avf_node_name = CString::new("avf")?;
622 let mut avf_node = overlay_node
623 .add_subnode(avf_node_name.as_c_str())
624 .map_err(|e| anyhow!("Failed to create avf node: {:?}", e))?;
625 let vendor_public_key_name = CString::new("vendor_public_key")?;
626 avf_node
627 .setprop(vendor_public_key_name.as_c_str(), vendor_public_key)
628 .map_err(|e| anyhow!("Failed to set avf/vendor_public_key: {:?}", e))?;
629
630 fdt.pack().map_err(|e| anyhow!("Failed to pack fdt: {:?}", e))?;
631 let mut file = File::create(dtbo)?;
632 file.write_all(fdt.as_slice())?;
633 Ok(file.flush()?)
634}
635
Andrew Walbranfbb39d22021-07-28 17:01:25 +0000636fn write_zero_filler(zero_filler_path: &Path) -> Result<()> {
Jooyung Han95884632021-07-06 22:27:54 +0900637 let file = OpenOptions::new()
638 .create_new(true)
639 .read(true)
640 .write(true)
641 .open(zero_filler_path)
642 .with_context(|| "Failed to create zero.img")?;
643 file.set_len(ZERO_FILLER_SIZE)?;
Andrew Walbranfbb39d22021-07-28 17:01:25 +0000644 Ok(())
Jooyung Han95884632021-07-06 22:27:54 +0900645}
646
David Brazdilf50c7a62023-04-19 14:22:42 +0000647fn format_as_android_vm_instance(part: &mut dyn Write) -> std::io::Result<()> {
648 part.write_all(ANDROID_VM_INSTANCE_MAGIC.as_bytes())?;
649 part.write_all(&ANDROID_VM_INSTANCE_VERSION.to_le_bytes())?;
650 part.flush()
651}
652
653fn format_as_encryptedstore(part: &mut dyn Write) -> std::io::Result<()> {
654 part.write_all(UNFORMATTED_STORAGE_MAGIC.as_bytes())?;
655 part.flush()
656}
657
658fn round_up(input: u64, granularity: u64) -> u64 {
659 if granularity == 0 {
660 return input;
661 }
662 // If the input is absurdly large we round down instead of up; it's going to fail anyway.
663 let result = input.checked_add(granularity - 1).unwrap_or(input);
664 (result / granularity) * granularity
665}
666
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000667/// Given the configuration for a disk image, assembles the `DiskFile` to pass to crosvm.
668///
669/// This may involve assembling a composite disk from a set of partition images.
670fn assemble_disk_image(
671 disk: &DiskImage,
Jooyung Han95884632021-07-06 22:27:54 +0900672 zero_filler_path: &Path,
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000673 temporary_directory: &Path,
674 next_temporary_image_id: &mut u64,
675 indirect_files: &mut Vec<File>,
Andrew Walbran806f1542021-06-10 14:07:12 +0000676) -> Result<DiskFile, Status> {
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000677 let image = if !disk.partitions.is_empty() {
678 if disk.image.is_some() {
679 warn!("DiskImage {:?} contains both image and partitions.", disk);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900680 return Err(anyhow!("DiskImage contains both image and partitions"))
681 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000682 }
683
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000684 let composite_image_filenames =
685 make_composite_image_filenames(temporary_directory, next_temporary_image_id);
686 let (image, partition_files) = make_composite_image(
687 &disk.partitions,
Jooyung Han95884632021-07-06 22:27:54 +0900688 zero_filler_path,
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000689 &composite_image_filenames.composite,
690 &composite_image_filenames.header,
691 &composite_image_filenames.footer,
692 )
Jiyong Park2227eaa2023-08-04 11:59:18 +0900693 .with_context(|| format!("Failed to make composite disk image with config {:?}", disk))
694 .with_log()
695 .or_service_specific_exception(-1)?;
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000696
697 // Pass the file descriptors for the various partition files to crosvm when it
698 // is run.
699 indirect_files.extend(partition_files);
700
701 image
702 } else if let Some(image) = &disk.image {
703 clone_file(image)?
704 } else {
705 warn!("DiskImage {:?} didn't contain image or partitions.", disk);
Jiyong Park2227eaa2023-08-04 11:59:18 +0900706 return Err(anyhow!("DiskImage didn't contain image or partitions."))
707 .or_binder_exception(ExceptionCode::ILLEGAL_ARGUMENT);
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000708 };
709
710 Ok(DiskFile { image, writable: disk.writable })
711}
712
Nikita Ioffeaa6858c2023-07-04 01:37:41 +0100713fn append_kernel_param(param: &str, vm_config: &mut VirtualMachineRawConfig) {
714 if let Some(ref mut params) = vm_config.params {
715 params.push(' ');
716 params.push_str(param)
717 } else {
718 vm_config.params = Some(param.to_owned())
719 }
720}
721
Inseob Kim172f9eb2023-11-06 17:02:08 +0900722fn is_valid_os(os_name: &str) -> bool {
723 if os_name == MICRODROID_OS_NAME {
Inseob Kim7a1fc8f2023-11-22 18:45:28 +0900724 true
725 } else if cfg!(vendor_modules) && MICRODROID_GKI_OS_NAME_PATTERN.is_match(os_name) {
726 PathBuf::from(format!("/apex/com.android.virt/etc/{}.json", os_name)).exists()
727 } else {
728 false
Inseob Kim172f9eb2023-11-06 17:02:08 +0900729 }
Inseob Kim172f9eb2023-11-06 17:02:08 +0900730}
731
Jooyung Han21e9b922021-06-26 04:14:16 +0900732fn load_app_config(
733 config: &VirtualMachineAppConfig,
Jaewan Kim61f86142023-03-28 15:12:52 +0900734 debug_config: &DebugConfig,
Jooyung Han21e9b922021-06-26 04:14:16 +0900735 temporary_directory: &Path,
Jooyung Hanadfb76c2021-06-28 17:29:30 +0900736) -> Result<VirtualMachineRawConfig> {
Andrew Walbrancc0db522021-07-12 17:03:42 +0000737 let apk_file = clone_file(config.apk.as_ref().unwrap())?;
738 let idsig_file = clone_file(config.idsig.as_ref().unwrap())?;
Jiyong Park8d081812021-07-23 17:45:04 +0900739 let instance_file = clone_file(config.instanceImage.as_ref().unwrap())?;
Jooyung Han21e9b922021-06-26 04:14:16 +0900740
Shikha Panwar22e70452022-10-10 18:32:55 +0000741 let storage_image = if let Some(file) = config.encryptedStorageImage.as_ref() {
742 Some(clone_file(file)?)
743 } else {
744 None
745 };
746
Alan Stokes0d1ef782022-09-27 13:46:35 +0100747 let vm_payload_config = match &config.payload {
748 Payload::ConfigPath(config_path) => {
749 load_vm_payload_config_from_file(&apk_file, config_path.as_str())
750 .with_context(|| format!("Couldn't read config from {}", config_path))?
751 }
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000752 Payload::PayloadConfig(payload_config) => create_vm_payload_config(payload_config)?,
Alan Stokes0d1ef782022-09-27 13:46:35 +0100753 };
Jooyung Han21e9b922021-06-26 04:14:16 +0900754
Inseob Kim172f9eb2023-11-06 17:02:08 +0900755 // For now, the only supported OS is Microdroid and Microdroid GKI
Alan Stokes0d1ef782022-09-27 13:46:35 +0100756 let os_name = vm_payload_config.os.name.as_str();
Inseob Kim172f9eb2023-11-06 17:02:08 +0900757 if !is_valid_os(os_name) {
Andrew Walbrancc0db522021-07-12 17:03:42 +0000758 bail!("Unknown OS \"{}\"", os_name);
Jooyung Han35edb8f2021-07-01 16:17:16 +0900759 }
Andrew Walbrancc0db522021-07-12 17:03:42 +0000760
761 // It is safe to construct a filename based on the os_name because we've already checked that it
762 // is one of the allowed values.
Jooyung Han21e9b922021-06-26 04:14:16 +0900763 let vm_config_path = PathBuf::from(format!("/apex/com.android.virt/etc/{}.json", os_name));
764 let vm_config_file = File::open(vm_config_path)?;
Andrew Walbrancc0db522021-07-12 17:03:42 +0000765 let mut vm_config = VmConfig::load(&vm_config_file)?.to_parcelable()?;
Jooyung Han21e9b922021-06-26 04:14:16 +0900766
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +0100767 if let Some(custom_config) = &config.customConfig {
768 if let Some(file) = custom_config.customKernelImage.as_ref() {
769 vm_config.kernel = Some(ParcelFileDescriptor::new(clone_file(file)?))
770 }
771 vm_config.taskProfiles = custom_config.taskProfiles.clone();
772 vm_config.gdbPort = custom_config.gdbPort;
Nikita Ioffe5dfddf22023-06-29 16:11:26 +0100773
774 if let Some(file) = custom_config.vendorImage.as_ref() {
Nikita Ioffeaa6858c2023-07-04 01:37:41 +0100775 add_microdroid_vendor_image(clone_file(file)?, &mut vm_config);
776 append_kernel_param("androidboot.microdroid.mount_vendor=1", &mut vm_config)
Nikita Ioffe5dfddf22023-06-29 16:11:26 +0100777 }
Inseob Kim6ef80972023-07-20 17:23:36 +0900778
779 vm_config.devices = custom_config.devices.clone();
Nikita Ioffe26c35ed2023-06-05 17:49:08 +0100780 }
781
Andrew Walbrancc045902021-07-27 16:06:17 +0000782 if config.memoryMib > 0 {
783 vm_config.memoryMib = config.memoryMib;
Andrew Walbran45bcb0c2021-07-14 15:02:06 +0000784 }
785
Seungjae Yoo62085c02022-08-12 04:44:52 +0000786 vm_config.name = config.name.clone();
Andrew Walbran3994f002022-01-27 17:33:45 +0000787 vm_config.protectedVm = config.protectedVm;
David Brazdil7d1e5ec2023-02-06 17:56:29 +0000788 vm_config.cpuTopology = config.cpuTopology;
Jiyong Park032615f2022-01-10 13:55:34 +0900789
Shikha Panwar22e70452022-10-10 18:32:55 +0000790 // Microdroid takes additional init ramdisk & (optionally) storage image
Inseob Kim172f9eb2023-11-06 17:02:08 +0900791 add_microdroid_system_images(config, instance_file, storage_image, os_name, &mut vm_config)?;
Shikha Panwar22e70452022-10-10 18:32:55 +0000792
793 // Include Microdroid payload disk (contains apks, idsigs) in vm config
794 add_microdroid_payload_images(
Alan Stokes0d1ef782022-09-27 13:46:35 +0100795 config,
Jaewan Kim61f86142023-03-28 15:12:52 +0900796 debug_config,
Alan Stokes0d1ef782022-09-27 13:46:35 +0100797 temporary_directory,
798 apk_file,
799 idsig_file,
Alan Stokes0d1ef782022-09-27 13:46:35 +0100800 &vm_payload_config,
801 &mut vm_config,
802 )?;
Jooyung Han21e9b922021-06-26 04:14:16 +0900803
Andrew Walbrancc0db522021-07-12 17:03:42 +0000804 Ok(vm_config)
Jooyung Han21e9b922021-06-26 04:14:16 +0900805}
806
Alan Stokes0d1ef782022-09-27 13:46:35 +0100807fn load_vm_payload_config_from_file(apk_file: &File, config_path: &str) -> Result<VmPayloadConfig> {
808 let mut apk_zip = ZipArchive::new(apk_file)?;
809 let config_file = apk_zip.by_name(config_path)?;
810 Ok(serde_json::from_reader(config_file)?)
811}
812
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000813fn create_vm_payload_config(
814 payload_config: &VirtualMachinePayloadConfig,
815) -> Result<VmPayloadConfig> {
Alan Stokes0d1ef782022-09-27 13:46:35 +0100816 // There isn't an actual config file. Construct a synthetic VmPayloadConfig from the explicit
817 // parameters we've been given. Microdroid will do something equivalent inside the VM using the
818 // payload config that we send it via the metadata file.
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000819
820 let payload_binary_name = &payload_config.payloadBinaryName;
821 if payload_binary_name.contains('/') {
822 bail!("Payload binary name must not specify a path: {payload_binary_name}");
823 }
824
825 let task = Task { type_: TaskType::MicrodroidLauncher, command: payload_binary_name.clone() };
Inseob Kim172f9eb2023-11-06 17:02:08 +0900826 let name = payload_config.osName.clone();
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000827 Ok(VmPayloadConfig {
Inseob Kim172f9eb2023-11-06 17:02:08 +0900828 os: OsConfig { name },
Alan Stokes0d1ef782022-09-27 13:46:35 +0100829 task: Some(task),
830 apexes: vec![],
831 extra_apks: vec![],
832 prefer_staged: false,
Inseob Kimab1037d2023-02-08 17:03:31 +0900833 export_tombstones: None,
Alan Stokes0d1ef782022-09-27 13:46:35 +0100834 enable_authfs: false,
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000835 })
Alan Stokes0d1ef782022-09-27 13:46:35 +0100836}
837
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000838/// Generates a unique filename to use for a composite disk image.
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000839fn make_composite_image_filenames(
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000840 temporary_directory: &Path,
841 next_temporary_image_id: &mut u64,
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000842) -> CompositeImageFilenames {
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000843 let id = *next_temporary_image_id;
844 *next_temporary_image_id += 1;
Andrew Walbran3eca16c2021-06-14 11:15:14 +0000845 CompositeImageFilenames {
846 composite: temporary_directory.join(format!("composite-{}.img", id)),
847 header: temporary_directory.join(format!("composite-{}-header.img", id)),
848 footer: temporary_directory.join(format!("composite-{}-footer.img", id)),
849 }
850}
851
852/// Filenames for a composite disk image, including header and footer partitions.
853#[derive(Clone, Debug, Eq, PartialEq)]
854struct CompositeImageFilenames {
855 /// The composite disk image itself.
856 composite: PathBuf,
857 /// The header partition image.
858 header: PathBuf,
859 /// The footer partition image.
860 footer: PathBuf,
Andrew Walbranf5fbb7d2021-05-12 17:15:48 +0000861}
862
Jiyong Park753553b2021-07-12 21:21:09 +0900863/// Checks whether the caller has a specific permission
864fn check_permission(perm: &str) -> binder::Result<()> {
David Brazdil1f530702022-10-03 12:18:10 +0100865 let calling_pid = get_calling_pid();
866 let calling_uid = get_calling_uid();
Jiyong Park753553b2021-07-12 21:21:09 +0900867 // Root can do anything
868 if calling_uid == 0 {
869 return Ok(());
870 }
871 let perm_svc: Strong<dyn IPermissionController::IPermissionController> =
872 binder::get_interface("permission")?;
873 if perm_svc.checkPermission(perm, calling_pid, calling_uid as i32)? {
Andrew Walbran806f1542021-06-10 14:07:12 +0000874 Ok(())
875 } else {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900876 Err(anyhow!("does not have the {} permission", perm))
877 .or_binder_exception(ExceptionCode::SECURITY)
Andrew Walbran806f1542021-06-10 14:07:12 +0000878 }
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000879}
880
Jiyong Park753553b2021-07-12 21:21:09 +0900881/// Check whether the caller of the current Binder method is allowed to manage VMs
882fn check_manage_access() -> binder::Result<()> {
883 check_permission("android.permission.MANAGE_VIRTUAL_MACHINE")
884}
885
Inseob Kim1119d702022-05-02 18:01:58 +0900886/// Check whether the caller of the current Binder method is allowed to create custom VMs
887fn check_use_custom_virtual_machine() -> binder::Result<()> {
888 check_permission("android.permission.USE_CUSTOM_VIRTUAL_MACHINE")
889}
890
Alan Stokes185fe112023-01-10 16:20:55 +0000891/// Return whether a partition is exempt from selinux label checks, because we know that it does
892/// not contain code and is likely to be generated in an app-writable directory.
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100893fn is_safe_app_partition(label: &str) -> bool {
Shikha Panwara2ff8c52022-11-30 19:25:46 +0000894 // See add_microdroid_system_images & add_microdroid_payload_images in payload.rs.
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100895 label == "vm-instance"
Shikha Panwara2ff8c52022-11-30 19:25:46 +0000896 || label == "encryptedstore"
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100897 || label == "microdroid-apk-idsig"
898 || label == "payload-metadata"
899 || label.starts_with("extra-idsig-")
900}
901
Alice Wangc206b9b2023-08-28 14:13:51 +0000902/// Returns whether a partition with the given label is safe for a raw config VM.
903fn is_safe_raw_partition(label: &str) -> bool {
904 label == "vm-instance"
905}
906
Alan Stokes185fe112023-01-10 16:20:55 +0000907/// Check that a file SELinux label is acceptable.
908///
909/// We only want to allow code in a VM to be sourced from places that apps, and the
Seungjae Yoo2b74c442023-11-15 18:05:07 +0900910/// system or vendor, do not have write access to.
Alan Stokes185fe112023-01-10 16:20:55 +0000911///
912/// Note that sepolicy must also grant read access for these types to both virtualization
913/// service and crosvm.
914///
915/// App private data files are deliberately excluded, to avoid arbitrary payloads being run on
916/// user devices (W^X).
917fn check_label_is_allowed(context: &SeContext) -> Result<()> {
918 match context.selinux_type()? {
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100919 | "apk_data_file" // APKs of an installed app
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100920 | "shell_data_file" // test files created via adb shell
Alan Stokesfe4bb0c2023-03-20 14:15:36 +0000921 | "staging_data_file" // updated/staged APEX images
922 | "system_file" // immutable dm-verity protected partition
923 | "virtualizationservice_data_file" // files created by VS / VirtMgr
Seungjae Yoo2b74c442023-11-15 18:05:07 +0900924 | "vendor_microdroid_file" // immutable dm-verity protected partition (/vendor/etc/avf/microdroid/.*)
Alan Stokes53cc5ca2022-08-30 14:28:19 +0100925 => Ok(()),
Alan Stokes185fe112023-01-10 16:20:55 +0000926 _ => bail!("Label {} is not allowed", context),
Jiyong Park029977d2021-11-24 21:56:49 +0900927 }
928}
929
Alan Stokes185fe112023-01-10 16:20:55 +0000930fn check_label_for_partition(partition: &Partition) -> Result<()> {
931 let file = partition.image.as_ref().unwrap().as_ref();
932 check_label_is_allowed(&getfilecon(file)?)
933 .with_context(|| format!("Partition {} invalid", &partition.label))
934}
935
936fn check_label_for_kernel_files(kernel: &Option<File>, initrd: &Option<File>) -> Result<()> {
937 if let Some(f) = kernel {
938 check_label_for_file(f, "kernel")?;
939 }
940 if let Some(f) = initrd {
941 check_label_for_file(f, "initrd")?;
942 }
943 Ok(())
944}
945fn check_label_for_file(file: &File, name: &str) -> Result<()> {
946 check_label_is_allowed(&getfilecon(file)?).with_context(|| format!("{} file invalid", name))
947}
948
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000949/// Implementation of the AIDL `IVirtualMachine` interface. Used as a handle to a VM.
950#[derive(Debug)]
951struct VirtualMachine {
952 instance: Arc<VmInstance>,
953}
954
955impl VirtualMachine {
956 fn create(instance: Arc<VmInstance>) -> Strong<dyn IVirtualMachine> {
David Brazdil4b4c5102022-12-19 22:56:20 +0000957 BnVirtualMachine::new_binder(VirtualMachine { instance }, BinderFeatures::default())
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000958 }
959}
960
961impl Interface for VirtualMachine {}
962
963impl IVirtualMachine for VirtualMachine {
964 fn getCid(&self) -> binder::Result<i32> {
Jiyong Park753553b2021-07-12 21:21:09 +0900965 // Don't check permission. The owner of the VM might have passed this binder object to
966 // others.
Andrew Walbrand6dce6f2021-03-05 16:39:08 +0000967 Ok(self.instance.cid as i32)
968 }
Andrew Walbrandae07162021-03-12 17:05:20 +0000969
Andrew Walbran6b650662021-09-07 13:13:23 +0000970 fn getState(&self) -> binder::Result<VirtualMachineState> {
Jiyong Park753553b2021-07-12 21:21:09 +0900971 // Don't check permission. The owner of the VM might have passed this binder object to
972 // others.
Andrew Walbran6b650662021-09-07 13:13:23 +0000973 Ok(get_state(&self.instance))
Andrew Walbrandae07162021-03-12 17:05:20 +0000974 }
975
976 fn registerCallback(
977 &self,
978 callback: &Strong<dyn IVirtualMachineCallback>,
979 ) -> binder::Result<()> {
Jiyong Park753553b2021-07-12 21:21:09 +0900980 // Don't check permission. The owner of the VM might have passed this binder object to
981 // others.
982 //
Andrew Walbrandae07162021-03-12 17:05:20 +0000983 // TODO: Should this give an error if the VM is already dead?
984 self.instance.callbacks.add(callback.clone());
985 Ok(())
986 }
Andrew Walbrancbe8b082021-08-06 15:42:11 +0000987
Andrew Walbranf8d94112021-09-07 11:45:36 +0000988 fn start(&self) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900989 self.instance
990 .start()
991 .with_context(|| format!("Error starting VM with CID {}", self.instance.cid))
992 .with_log()
993 .or_service_specific_exception(-1)
Andrew Walbranf8d94112021-09-07 11:45:36 +0000994 }
995
Inseob Kima446f802022-07-11 19:46:37 +0900996 fn stop(&self) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +0900997 self.instance
998 .kill()
999 .with_context(|| format!("Error stopping VM with CID {}", self.instance.cid))
1000 .with_log()
1001 .or_service_specific_exception(-1)
Inseob Kima446f802022-07-11 19:46:37 +09001002 }
1003
Keir Frasercdd4b112022-11-24 14:02:25 +00001004 fn onTrimMemory(&self, level: MemoryTrimLevel) -> binder::Result<()> {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001005 self.instance
1006 .trim_memory(level)
1007 .with_context(|| format!("Error trimming VM with CID {}", self.instance.cid))
1008 .with_log()
1009 .or_service_specific_exception(-1)
Keir Frasercdd4b112022-11-24 14:02:25 +00001010 }
1011
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001012 fn connectVsock(&self, port: i32) -> binder::Result<ParcelFileDescriptor> {
Andrew Walbranf8d94112021-09-07 11:45:36 +00001013 if !matches!(&*self.instance.vm_state.lock().unwrap(), VmState::Running { .. }) {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001014 return Err(anyhow!("VM is not running")).or_service_specific_exception(-1);
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001015 }
Alan Stokes10c47672022-12-13 17:17:08 +00001016 let port = port as u32;
1017 if port < 1024 {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001018 return Err(anyhow!("Can't connect to privileged port {port}"))
1019 .or_service_specific_exception(-1);
Alan Stokes10c47672022-12-13 17:17:08 +00001020 }
Jiyong Park2227eaa2023-08-04 11:59:18 +09001021 let stream = VsockStream::connect_with_cid_port(self.instance.cid, port)
1022 .context("Failed to connect")
1023 .or_service_specific_exception(-1)?;
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001024 Ok(vsock_stream_to_pfd(stream))
1025 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001026}
1027
1028impl Drop for VirtualMachine {
1029 fn drop(&mut self) {
1030 debug!("Dropping {:?}", self);
Inseob Kima446f802022-07-11 19:46:37 +09001031 if let Err(e) = self.instance.kill() {
1032 debug!("Error stopping dropped VM with CID {}: {:?}", self.instance.cid, e);
1033 }
Andrew Walbrandae07162021-03-12 17:05:20 +00001034 }
1035}
1036
1037/// A set of Binders to be called back in response to various events on the VM, such as when it
1038/// dies.
1039#[derive(Debug, Default)]
1040pub struct VirtualMachineCallbacks(Mutex<Vec<Strong<dyn IVirtualMachineCallback>>>);
1041
1042impl VirtualMachineCallbacks {
Jiyong Park8611a6c2021-07-09 18:17:44 +09001043 /// Call all registered callbacks to notify that the payload has started.
David Brazdil451cc962022-10-14 14:08:12 +01001044 pub fn notify_payload_started(&self, cid: Cid) {
Jiyong Park8611a6c2021-07-09 18:17:44 +09001045 let callbacks = &*self.0.lock().unwrap();
Jiyong Park8611a6c2021-07-09 18:17:44 +09001046 for callback in callbacks {
David Brazdil451cc962022-10-14 14:08:12 +01001047 if let Err(e) = callback.onPayloadStarted(cid as i32) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001048 error!("Error notifying payload start event from VM CID {}: {:?}", cid, e);
Jiyong Park8611a6c2021-07-09 18:17:44 +09001049 }
1050 }
1051 }
1052
Inseob Kim14cb8692021-08-31 21:50:39 +09001053 /// Call all registered callbacks to notify that the payload is ready to serve.
1054 pub fn notify_payload_ready(&self, cid: Cid) {
1055 let callbacks = &*self.0.lock().unwrap();
1056 for callback in callbacks {
1057 if let Err(e) = callback.onPayloadReady(cid as i32) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001058 error!("Error notifying payload ready event from VM CID {}: {:?}", cid, e);
Inseob Kim14cb8692021-08-31 21:50:39 +09001059 }
1060 }
1061 }
1062
Inseob Kim2444af92021-08-31 01:22:50 +09001063 /// Call all registered callbacks to notify that the payload has finished.
1064 pub fn notify_payload_finished(&self, cid: Cid, exit_code: i32) {
1065 let callbacks = &*self.0.lock().unwrap();
1066 for callback in callbacks {
1067 if let Err(e) = callback.onPayloadFinished(cid as i32, exit_code) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001068 error!("Error notifying payload finish event from VM CID {}: {:?}", cid, e);
Inseob Kim2444af92021-08-31 01:22:50 +09001069 }
1070 }
1071 }
1072
Jooyung Handd0a1732021-11-23 15:26:20 +09001073 /// Call all registered callbacks to say that the VM encountered an error.
Alan Stokes2bead0d2022-09-05 16:58:34 +01001074 pub fn notify_error(&self, cid: Cid, error_code: ErrorCode, message: &str) {
Jooyung Handd0a1732021-11-23 15:26:20 +09001075 let callbacks = &*self.0.lock().unwrap();
1076 for callback in callbacks {
1077 if let Err(e) = callback.onError(cid as i32, error_code, message) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001078 error!("Error notifying error event from VM CID {}: {:?}", cid, e);
Jooyung Handd0a1732021-11-23 15:26:20 +09001079 }
1080 }
1081 }
1082
Andrew Walbrandae07162021-03-12 17:05:20 +00001083 /// Call all registered callbacks to say that the VM has died.
Andrew Walbranc92d35f2022-01-12 12:45:19 +00001084 pub fn callback_on_died(&self, cid: Cid, reason: DeathReason) {
Andrew Walbrandae07162021-03-12 17:05:20 +00001085 let callbacks = &*self.0.lock().unwrap();
1086 for callback in callbacks {
Andrew Walbranc92d35f2022-01-12 12:45:19 +00001087 if let Err(e) = callback.onDied(cid as i32, reason) {
Alan Stokes70ccf162022-07-08 11:05:03 +01001088 error!("Error notifying exit of VM CID {}: {:?}", cid, e);
Andrew Walbrandae07162021-03-12 17:05:20 +00001089 }
1090 }
1091 }
1092
1093 /// Add a new callback to the set.
1094 fn add(&self, callback: Strong<dyn IVirtualMachineCallback>) {
1095 self.0.lock().unwrap().push(callback);
1096 }
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001097}
1098
Andrew Walbranf6bf6862021-05-21 12:41:13 +00001099/// The mutable state of the VirtualizationService. There should only be one instance of this
1100/// struct.
Chris Wailes641fc4a2021-12-01 15:03:21 -08001101#[derive(Debug, Default)]
Andrew Walbrand6dce6f2021-03-05 16:39:08 +00001102struct State {
Alan Stokes3e5eec12023-09-07 12:10:00 +01001103 /// The VMs which have been started. When VMs are started a weak reference is added to this
1104 /// list while a strong reference is returned to the caller over Binder. Once all copies of
1105 /// the Binder client are dropped the weak reference here will become invalid, and will be
1106 /// removed from the list opportunistically the next time `add_vm` is called.
Andrew Walbran320b5602021-03-04 16:11:12 +00001107 vms: Vec<Weak<VmInstance>>,
1108}
1109
1110impl State {
Andrew Walbrandae07162021-03-12 17:05:20 +00001111 /// Get a list of VMs which still have Binder references to them.
Andrew Walbran320b5602021-03-04 16:11:12 +00001112 fn vms(&self) -> Vec<Arc<VmInstance>> {
1113 // Attempt to upgrade the weak pointers to strong pointers.
1114 self.vms.iter().filter_map(Weak::upgrade).collect()
1115 }
1116
1117 /// Add a new VM to the list.
1118 fn add_vm(&mut self, vm: Weak<VmInstance>) {
1119 // Garbage collect any entries from the stored list which no longer exist.
1120 self.vms.retain(|vm| vm.strong_count() > 0);
1121
1122 // Actually add the new VM.
1123 self.vms.push(vm);
1124 }
David Brazdil3c2ddef2021-03-18 13:09:57 +00001125
Jiyong Park8611a6c2021-07-09 18:17:44 +09001126 /// Get a VM that corresponds to the given cid
1127 fn get_vm(&self, cid: Cid) -> Option<Arc<VmInstance>> {
1128 self.vms().into_iter().find(|vm| vm.cid == cid)
1129 }
Jiyong Parkd50a0242021-09-16 21:00:14 +09001130}
1131
Andrew Walbran6b650662021-09-07 13:13:23 +00001132/// Gets the `VirtualMachineState` of the given `VmInstance`.
1133fn get_state(instance: &VmInstance) -> VirtualMachineState {
Andrew Walbranf8d94112021-09-07 11:45:36 +00001134 match &*instance.vm_state.lock().unwrap() {
1135 VmState::NotStarted { .. } => VirtualMachineState::NOT_STARTED,
1136 VmState::Running { .. } => match instance.payload_state() {
Andrew Walbran6b650662021-09-07 13:13:23 +00001137 PayloadState::Starting => VirtualMachineState::STARTING,
1138 PayloadState::Started => VirtualMachineState::STARTED,
1139 PayloadState::Ready => VirtualMachineState::READY,
1140 PayloadState::Finished => VirtualMachineState::FINISHED,
Jiyong Parka4eebde2022-07-12 18:01:12 +09001141 PayloadState::Hangup => VirtualMachineState::DEAD,
Andrew Walbranf8d94112021-09-07 11:45:36 +00001142 },
1143 VmState::Dead => VirtualMachineState::DEAD,
1144 VmState::Failed => VirtualMachineState::DEAD,
Andrew Walbran6b650662021-09-07 13:13:23 +00001145 }
1146}
1147
David Brazdilf50c7a62023-04-19 14:22:42 +00001148/// Converts a `&ParcelFileDescriptor` to a `File` by cloning the file.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001149pub fn clone_file(file: &ParcelFileDescriptor) -> binder::Result<File> {
1150 file.as_ref()
1151 .try_clone()
1152 .context("Failed to clone File from ParcelFileDescriptor")
1153 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)
Andrei Homescu11333c62023-11-09 04:26:39 +00001154 .map(File::from)
David Brazdilf50c7a62023-04-19 14:22:42 +00001155}
1156
Andrew Walbrand3a84182021-09-07 14:48:52 +00001157/// Converts an `&Option<ParcelFileDescriptor>` to an `Option<File>` by cloning the file.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001158fn maybe_clone_file(file: &Option<ParcelFileDescriptor>) -> binder::Result<Option<File>> {
Andrew Walbrand3a84182021-09-07 14:48:52 +00001159 file.as_ref().map(clone_file).transpose()
1160}
1161
Andrew Walbrancbe8b082021-08-06 15:42:11 +00001162/// Converts a `VsockStream` to a `ParcelFileDescriptor`.
1163fn vsock_stream_to_pfd(stream: VsockStream) -> ParcelFileDescriptor {
1164 // SAFETY: ownership is transferred from stream to f
1165 let f = unsafe { File::from_raw_fd(stream.into_raw_fd()) };
1166 ParcelFileDescriptor::new(f)
1167}
1168
Jiyong Parkdcf17412022-02-08 15:07:23 +09001169/// Parses the platform version requirement string.
Jiyong Park2227eaa2023-08-04 11:59:18 +09001170fn parse_platform_version_req(s: &str) -> binder::Result<VersionReq> {
1171 VersionReq::parse(s)
1172 .with_context(|| format!("Invalid platform version requirement {}", s))
1173 .or_binder_exception(ExceptionCode::BAD_PARCELABLE)
Jiyong Parkdcf17412022-02-08 15:07:23 +09001174}
1175
Jiyong Parked180932023-02-24 19:55:41 +09001176/// Create the empty ramdump file
1177fn prepare_ramdump_file(temporary_directory: &Path) -> binder::Result<File> {
1178 // `ramdump_write` is sent to crosvm and will be the backing store for the /dev/hvc1 where
1179 // VM will emit ramdump to. `ramdump_read` will be sent back to the client (i.e. the VM
1180 // owner) for readout.
1181 let ramdump_path = temporary_directory.join("ramdump");
Jiyong Park2227eaa2023-08-04 11:59:18 +09001182 let ramdump = File::create(ramdump_path)
1183 .context("Failed to prepare ramdump file")
1184 .with_log()
1185 .or_service_specific_exception(-1)?;
Jiyong Parked180932023-02-24 19:55:41 +09001186 Ok(ramdump)
1187}
1188
Nikita Ioffe5776f082023-02-10 21:38:26 +00001189fn is_protected(config: &VirtualMachineConfig) -> bool {
1190 match config {
1191 VirtualMachineConfig::RawConfig(config) => config.protectedVm,
1192 VirtualMachineConfig::AppConfig(config) => config.protectedVm,
1193 }
1194}
1195
1196fn check_gdb_allowed(config: &VirtualMachineConfig) -> binder::Result<()> {
1197 if is_protected(config) {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001198 return Err(anyhow!("Can't use gdb with protected VMs"))
1199 .or_binder_exception(ExceptionCode::SECURITY);
Nikita Ioffe5776f082023-02-10 21:38:26 +00001200 }
1201
1202 match config {
1203 VirtualMachineConfig::RawConfig(_) => Ok(()),
1204 VirtualMachineConfig::AppConfig(config) => {
1205 if config.debugLevel != DebugLevel::FULL {
Jiyong Park2227eaa2023-08-04 11:59:18 +09001206 Err(anyhow!("Can't use gdb with non-debuggable VMs"))
1207 .or_binder_exception(ExceptionCode::SECURITY)
Nikita Ioffe5776f082023-02-10 21:38:26 +00001208 } else {
1209 Ok(())
1210 }
1211 }
1212 }
1213}
1214
1215fn extract_gdb_port(config: &VirtualMachineConfig) -> Option<NonZeroU16> {
1216 match config {
1217 VirtualMachineConfig::RawConfig(config) => NonZeroU16::new(config.gdbPort as u16),
Nikita Ioffea0eb5ee2023-06-26 18:18:21 +01001218 VirtualMachineConfig::AppConfig(config) => {
1219 NonZeroU16::new(config.customConfig.as_ref().map(|c| c.gdbPort).unwrap_or(0) as u16)
1220 }
Nikita Ioffe5776f082023-02-10 21:38:26 +00001221 }
1222}
1223
Nikita Ioffe631717e2023-09-05 13:38:07 +01001224fn check_no_vendor_modules(config: &VirtualMachineConfig) -> binder::Result<()> {
1225 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1226 if let Some(custom_config) = &config.customConfig {
1227 if custom_config.vendorImage.is_some() || custom_config.customKernelImage.is_some() {
1228 return Err(anyhow!("vendor modules feature is disabled"))
1229 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1230 }
1231 }
1232 Ok(())
1233}
1234
Nikita Ioffe94a8a182023-11-16 16:37:48 +00001235fn check_no_devices(config: &VirtualMachineConfig) -> binder::Result<()> {
1236 let VirtualMachineConfig::AppConfig(config) = config else { return Ok(()) };
1237 if let Some(custom_config) = &config.customConfig {
1238 if !custom_config.devices.is_empty() {
1239 return Err(anyhow!("device assignment feature is disabled"))
1240 .or_binder_exception(ExceptionCode::UNSUPPORTED_OPERATION);
1241 }
1242 }
1243 Ok(())
1244}
1245
Nikita Ioffe631717e2023-09-05 13:38:07 +01001246fn check_config_features(config: &VirtualMachineConfig) -> binder::Result<()> {
1247 if !cfg!(vendor_modules) {
1248 check_no_vendor_modules(config)?;
1249 }
Nikita Ioffe94a8a182023-11-16 16:37:48 +00001250 if !cfg!(device_assignment) {
1251 check_no_devices(config)?;
1252 }
Nikita Ioffe631717e2023-09-05 13:38:07 +01001253 Ok(())
1254}
1255
Inseob Kim0168b462022-12-27 14:54:35 +09001256fn clone_or_prepare_logger_fd(
Jaewan Kim61f86142023-03-28 15:12:52 +09001257 debug_config: &DebugConfig,
Inseob Kim0168b462022-12-27 14:54:35 +09001258 fd: Option<&ParcelFileDescriptor>,
1259 tag: String,
1260) -> Result<Option<File>, Status> {
1261 if let Some(fd) = fd {
1262 return Ok(Some(clone_file(fd)?));
1263 }
1264
Jaewan Kim61f86142023-03-28 15:12:52 +09001265 if !debug_config.should_prepare_console_output() {
Jaewan Kim66f062e2023-02-25 01:07:43 +09001266 return Ok(None);
1267 };
Inseob Kim0168b462022-12-27 14:54:35 +09001268
Jiyong Park2227eaa2023-08-04 11:59:18 +09001269 let (raw_read_fd, raw_write_fd) =
1270 pipe().context("Failed to create pipe").or_service_specific_exception(-1)?;
Inseob Kim0168b462022-12-27 14:54:35 +09001271
Andrew Walbranb58d1b42023-07-07 13:54:49 +01001272 // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
Inseob Kim0168b462022-12-27 14:54:35 +09001273 let mut reader = BufReader::new(unsafe { File::from_raw_fd(raw_read_fd) });
Andrew Walbranb58d1b42023-07-07 13:54:49 +01001274 // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
Inseob Kim0168b462022-12-27 14:54:35 +09001275 let write_fd = unsafe { File::from_raw_fd(raw_write_fd) };
1276
1277 std::thread::spawn(move || loop {
1278 let mut buf = vec![];
1279 match reader.read_until(b'\n', &mut buf) {
1280 Ok(0) => {
1281 // EOF
1282 return;
1283 }
1284 Ok(size) => {
1285 if buf[size - 1] == b'\n' {
1286 buf.pop();
1287 }
1288 info!("{}: {}", &tag, &String::from_utf8_lossy(&buf));
1289 }
1290 Err(e) => {
1291 error!("Could not read console pipe: {:?}", e);
1292 return;
1293 }
1294 };
1295 });
1296
1297 Ok(Some(write_fd))
1298}
1299
Jooyung Han35edb8f2021-07-01 16:17:16 +09001300/// Simple utility for referencing Borrowed or Owned. Similar to std::borrow::Cow, but
1301/// it doesn't require that T implements Clone.
1302enum BorrowedOrOwned<'a, T> {
1303 Borrowed(&'a T),
1304 Owned(T),
1305}
1306
1307impl<'a, T> AsRef<T> for BorrowedOrOwned<'a, T> {
1308 fn as_ref(&self) -> &T {
1309 match self {
1310 Self::Borrowed(b) => b,
Chris Wailes68c39f82021-07-27 16:03:44 -07001311 Self::Owned(o) => o,
Jooyung Han35edb8f2021-07-01 16:17:16 +09001312 }
1313 }
1314}
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001315
1316/// Implementation of `IVirtualMachineService`, the entry point of the AIDL service.
1317#[derive(Debug, Default)]
1318struct VirtualMachineService {
1319 state: Arc<Mutex<State>>,
Inseob Kimc7d28c72021-10-25 14:28:10 +00001320 cid: Cid,
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001321}
1322
1323impl Interface for VirtualMachineService {}
1324
1325impl IVirtualMachineService for VirtualMachineService {
Inseob Kimc7d28c72021-10-25 14:28:10 +00001326 fn notifyPayloadStarted(&self) -> binder::Result<()> {
1327 let cid = self.cid;
Inseob Kim7f61fe72021-08-20 20:50:47 +09001328 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001329 info!("VM with CID {} started payload", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001330 vm.update_payload_state(PayloadState::Started)
1331 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
David Brazdil451cc962022-10-14 14:08:12 +01001332 vm.callbacks.notify_payload_started(cid);
Seungjae Yoo62085c02022-08-12 04:44:52 +00001333
Seungjae Yoo6d265d92022-11-15 10:51:33 +09001334 let vm_start_timestamp = vm.vm_metric.lock().unwrap().start_timestamp;
1335 write_vm_booted_stats(vm.requester_uid as i32, &vm.name, vm_start_timestamp);
Inseob Kim7f61fe72021-08-20 20:50:47 +09001336 Ok(())
1337 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001338 error!("notifyPayloadStarted is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001339 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001340 }
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001341 }
Inseob Kim2444af92021-08-31 01:22:50 +09001342
Inseob Kimc7d28c72021-10-25 14:28:10 +00001343 fn notifyPayloadReady(&self) -> binder::Result<()> {
1344 let cid = self.cid;
Inseob Kim14cb8692021-08-31 21:50:39 +09001345 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001346 info!("VM with CID {} reported payload is ready", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001347 vm.update_payload_state(PayloadState::Ready)
1348 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Inseob Kim14cb8692021-08-31 21:50:39 +09001349 vm.callbacks.notify_payload_ready(cid);
1350 Ok(())
1351 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001352 error!("notifyPayloadReady is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001353 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim14cb8692021-08-31 21:50:39 +09001354 }
1355 }
1356
Inseob Kimc7d28c72021-10-25 14:28:10 +00001357 fn notifyPayloadFinished(&self, exit_code: i32) -> binder::Result<()> {
1358 let cid = self.cid;
Inseob Kim2444af92021-08-31 01:22:50 +09001359 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001360 info!("VM with CID {} finished payload", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001361 vm.update_payload_state(PayloadState::Finished)
1362 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Inseob Kim2444af92021-08-31 01:22:50 +09001363 vm.callbacks.notify_payload_finished(cid, exit_code);
1364 Ok(())
1365 } else {
Jooyung Handd0a1732021-11-23 15:26:20 +09001366 error!("notifyPayloadFinished is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001367 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Jooyung Handd0a1732021-11-23 15:26:20 +09001368 }
1369 }
1370
Alan Stokes2bead0d2022-09-05 16:58:34 +01001371 fn notifyError(&self, error_code: ErrorCode, message: &str) -> binder::Result<()> {
Jooyung Handd0a1732021-11-23 15:26:20 +09001372 let cid = self.cid;
1373 if let Some(vm) = self.state.lock().unwrap().get_vm(cid) {
David Brazdil415097c2022-10-21 14:17:05 +01001374 info!("VM with CID {} encountered an error", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001375 vm.update_payload_state(PayloadState::Finished)
1376 .or_binder_exception(ExceptionCode::ILLEGAL_STATE)?;
Jooyung Handd0a1732021-11-23 15:26:20 +09001377 vm.callbacks.notify_error(cid, error_code, message);
1378 Ok(())
1379 } else {
Seungjae Yooec8c1602022-06-20 05:28:00 +00001380 error!("notifyError is called from an unknown CID {}", cid);
Jiyong Park2227eaa2023-08-04 11:59:18 +09001381 Err(anyhow!("cannot find a VM with CID {}", cid)).or_service_specific_exception(-1)
Inseob Kim2444af92021-08-31 01:22:50 +09001382 }
1383 }
Alice Wangc2fec932023-02-23 16:24:02 +00001384
Shikha Panwar5d6a6752023-12-14 22:08:26 +00001385 fn getSecretkeeper(&self) -> binder::Result<Option<Strong<dyn ISecretkeeper>>> {
1386 let sk = match binder::get_interface(SECRETKEEPER_IDENTIFIER) {
1387 Ok(sk) => {
1388 Some(BnSecretkeeper::new_binder(SecretkeeperProxy(sk), BinderFeatures::default()))
1389 }
1390 Err(StatusCode::NAME_NOT_FOUND) => None,
1391 Err(e) => {
1392 error!("unexpected error while fetching connection to Secretkeeper {:?}", e);
1393 return Err(e.into());
1394 }
1395 };
1396 Ok(sk)
1397 }
1398
Alice Wang4e3015d2023-10-10 09:35:37 +00001399 fn requestAttestation(&self, csr: &[u8]) -> binder::Result<Vec<Certificate>> {
Alice Wangbff017f2023-11-09 14:43:28 +00001400 GLOBAL_SERVICE.requestAttestation(csr, get_calling_uid() as i32)
Alice Wangc2fec932023-02-23 16:24:02 +00001401 }
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001402}
1403
1404impl VirtualMachineService {
Inseob Kimc7d28c72021-10-25 14:28:10 +00001405 fn new_binder(state: Arc<Mutex<State>>, cid: Cid) -> Strong<dyn IVirtualMachineService> {
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001406 BnVirtualMachineService::new_binder(
Inseob Kimc7d28c72021-10-25 14:28:10 +00001407 VirtualMachineService { state, cid },
Inseob Kim1b95f2e2021-08-19 13:17:40 +09001408 BinderFeatures::default(),
1409 )
1410 }
1411}
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001412
1413#[cfg(test)]
1414mod tests {
1415 use super::*;
1416
1417 #[test]
1418 fn test_is_allowed_label_for_partition() -> Result<()> {
1419 let expected_results = vec![
1420 ("u:object_r:system_file:s0", true),
1421 ("u:object_r:apk_data_file:s0", true),
1422 ("u:object_r:app_data_file:s0", false),
1423 ("u:object_r:app_data_file:s0:c512,c768", false),
1424 ("u:object_r:privapp_data_file:s0:c512,c768", false),
1425 ("invalid", false),
1426 ("user:role:apk_data_file:severity:categories", true),
1427 ("user:role:apk_data_file:severity:categories:extraneous", false),
1428 ];
1429
1430 for (label, expected_valid) in expected_results {
1431 let context = SeContext::new(label)?;
1432 let result = check_label_is_allowed(&context);
1433 if expected_valid {
1434 assert!(result.is_ok(), "Expected label {} to be allowed, got {:?}", label, result);
1435 } else if result.is_ok() {
1436 bail!("Expected label {} to be disallowed", label);
1437 }
1438 }
1439 Ok(())
1440 }
Nikita Ioffef1ce9872022-12-09 13:31:59 +00001441
1442 #[test]
1443 fn test_create_or_update_idsig_file_empty_apk() -> Result<()> {
1444 let apk = tempfile::tempfile().unwrap();
1445 let idsig = tempfile::tempfile().unwrap();
1446
1447 let ret = create_or_update_idsig_file(
1448 &ParcelFileDescriptor::new(apk),
1449 &ParcelFileDescriptor::new(idsig),
1450 );
1451 assert!(ret.is_err(), "should fail");
1452 Ok(())
1453 }
1454
1455 #[test]
1456 fn test_create_or_update_idsig_dir_instead_of_file_for_apk() -> Result<()> {
1457 let tmp_dir = tempfile::TempDir::new().unwrap();
1458 let apk = File::open(tmp_dir.path()).unwrap();
1459 let idsig = tempfile::tempfile().unwrap();
1460
1461 let ret = create_or_update_idsig_file(
1462 &ParcelFileDescriptor::new(apk),
1463 &ParcelFileDescriptor::new(idsig),
1464 );
1465 assert!(ret.is_err(), "should fail");
1466 Ok(())
1467 }
1468
1469 /// Verifies that create_or_update_idsig_file won't oom if a fd that corresponds to a directory
1470 /// on ext4 filesystem is passed.
1471 /// On ext4 lseek on a directory fd will return (off_t)-1 (see:
1472 /// https://bugzilla.kernel.org/show_bug.cgi?id=200043), which will result in
1473 /// create_or_update_idsig_file ooming while attempting to allocate petabytes of memory.
1474 #[test]
1475 fn test_create_or_update_idsig_does_not_crash_dir_on_ext4() -> Result<()> {
1476 // APEXes are backed by the ext4.
1477 let apk = File::open("/apex/com.android.virt/").unwrap();
1478 let idsig = tempfile::tempfile().unwrap();
1479
1480 let ret = create_or_update_idsig_file(
1481 &ParcelFileDescriptor::new(apk),
1482 &ParcelFileDescriptor::new(idsig),
1483 );
1484 assert!(ret.is_err(), "should fail");
1485 Ok(())
1486 }
Jiyong Park8d192952023-06-26 14:29:51 +09001487
1488 #[test]
1489 fn test_create_or_update_idsig_does_not_update_if_already_valid() -> Result<()> {
1490 use std::io::Seek;
1491
1492 // Pick any APK
1493 let mut apk = File::open("/system/priv-app/Shell/Shell.apk").unwrap();
1494 let mut idsig = tempfile::tempfile().unwrap();
1495
1496 create_or_update_idsig_file(
1497 &ParcelFileDescriptor::new(apk.try_clone()?),
1498 &ParcelFileDescriptor::new(idsig.try_clone()?),
1499 )?;
1500 let modified_orig = idsig.metadata()?.modified()?;
1501 apk.rewind()?;
1502 idsig.rewind()?;
1503
1504 // Call the function again
1505 create_or_update_idsig_file(
1506 &ParcelFileDescriptor::new(apk.try_clone()?),
1507 &ParcelFileDescriptor::new(idsig.try_clone()?),
1508 )?;
1509 let modified_new = idsig.metadata()?.modified()?;
1510 assert!(modified_orig == modified_new, "idsig file was updated unnecessarily");
1511 Ok(())
1512 }
Nikita Ioffeaa6858c2023-07-04 01:37:41 +01001513
1514 #[test]
1515 fn test_append_kernel_param_first_param() {
1516 let mut vm_config = VirtualMachineRawConfig { ..Default::default() };
1517 append_kernel_param("foo=1", &mut vm_config);
1518 assert_eq!(vm_config.params, Some("foo=1".to_owned()))
1519 }
1520
1521 #[test]
1522 fn test_append_kernel_param() {
1523 let mut vm_config =
1524 VirtualMachineRawConfig { params: Some("foo=5".to_owned()), ..Default::default() };
1525 append_kernel_param("bar=42", &mut vm_config);
1526 assert_eq!(vm_config.params, Some("foo=5 bar=42".to_owned()))
1527 }
Seungjae Yooec3bc522023-11-09 10:14:30 +09001528
1529 #[test]
1530 fn test_create_dtbo_for_vendor_image() -> Result<()> {
1531 let vendor_public_key = String::from("foo");
1532 let vendor_public_key = vendor_public_key.as_bytes();
1533
1534 let tmp_dir = tempfile::TempDir::new()?;
1535 let dtbo_path = tmp_dir.path().to_path_buf().join("bar");
1536
1537 create_dtbo_for_vendor_image(vendor_public_key, &dtbo_path)?;
1538
1539 let data = std::fs::read(dtbo_path)?;
1540 let fdt = Fdt::from_slice(&data).unwrap();
1541
1542 let fragment_node_path = CString::new("/fragment@0")?;
1543 let fragment_node = fdt.node(fragment_node_path.as_c_str()).unwrap();
1544 let Some(fragment_node) = fragment_node else {
1545 bail!("fragment_node shouldn't be None.");
1546 };
1547 let target_path_prop_name = CString::new("target-path")?;
1548 let target_path_from_dtbo =
1549 fragment_node.getprop(target_path_prop_name.as_c_str()).unwrap();
1550 let target_path_expected = CString::new("/")?;
1551 assert_eq!(target_path_from_dtbo, Some(target_path_expected.to_bytes_with_nul()));
1552
1553 let avf_node_path = CString::new("/fragment@0/__overlay__/avf")?;
1554 let avf_node = fdt.node(avf_node_path.as_c_str()).unwrap();
1555 let Some(avf_node) = avf_node else {
1556 bail!("avf_node shouldn't be None.");
1557 };
1558 let vendor_public_key_name = CString::new("vendor_public_key")?;
1559 let key_from_dtbo = avf_node.getprop(vendor_public_key_name.as_c_str()).unwrap();
1560 assert_eq!(key_from_dtbo, Some(vendor_public_key));
1561
1562 tmp_dir.close()?;
1563 Ok(())
1564 }
1565
1566 #[test]
1567 fn test_create_dtbo_for_vendor_image_throws_error_if_already_exists() -> Result<()> {
1568 let vendor_public_key = String::from("foo");
1569 let vendor_public_key = vendor_public_key.as_bytes();
1570
1571 let tmp_dir = tempfile::TempDir::new()?;
1572 let dtbo_path = tmp_dir.path().to_path_buf().join("bar");
1573
1574 create_dtbo_for_vendor_image(vendor_public_key, &dtbo_path)?;
1575
1576 let ret_second_trial = create_dtbo_for_vendor_image(vendor_public_key, &dtbo_path);
1577 assert!(ret_second_trial.is_err(), "should fail");
1578
1579 tmp_dir.close()?;
1580 Ok(())
1581 }
Alan Stokes53cc5ca2022-08-30 14:28:19 +01001582}
Shikha Panwar5d6a6752023-12-14 22:08:26 +00001583
1584struct SecretkeeperProxy(Strong<dyn ISecretkeeper>);
1585
1586impl Interface for SecretkeeperProxy {}
1587
1588impl ISecretkeeper for SecretkeeperProxy {
1589 fn processSecretManagementRequest(&self, req: &[u8]) -> binder::Result<Vec<u8>> {
1590 // Pass the request to the channel, and read the response.
1591 self.0.processSecretManagementRequest(req)
1592 }
1593
1594 fn getAuthGraphKe(&self) -> binder::Result<Strong<dyn IAuthGraphKeyExchange>> {
1595 let ag = AuthGraphKeyExchangeProxy(self.0.getAuthGraphKe()?);
1596 Ok(BnAuthGraphKeyExchange::new_binder(ag, BinderFeatures::default()))
1597 }
1598
1599 fn deleteIds(&self, ids: &[SecretId]) -> binder::Result<()> {
1600 self.0.deleteIds(ids)
1601 }
1602
1603 fn deleteAll(&self) -> binder::Result<()> {
1604 self.0.deleteAll()
1605 }
1606}
1607
1608struct AuthGraphKeyExchangeProxy(Strong<dyn IAuthGraphKeyExchange>);
1609
1610impl Interface for AuthGraphKeyExchangeProxy {}
1611
1612impl IAuthGraphKeyExchange for AuthGraphKeyExchangeProxy {
1613 fn create(&self) -> binder::Result<SessionInitiationInfo> {
1614 self.0.create()
1615 }
1616
1617 fn init(
1618 &self,
1619 peer_pub_key: &PubKey,
1620 peer_id: &Identity,
1621 peer_nonce: &[u8],
1622 peer_version: i32,
1623 ) -> binder::Result<KeInitResult> {
1624 self.0.init(peer_pub_key, peer_id, peer_nonce, peer_version)
1625 }
1626
1627 fn finish(
1628 &self,
1629 peer_pub_key: &PubKey,
1630 peer_id: &Identity,
1631 peer_signature: &SessionIdSignature,
1632 peer_nonce: &[u8],
1633 peer_version: i32,
1634 own_key: &Key,
1635 ) -> binder::Result<SessionInfo> {
1636 self.0.finish(peer_pub_key, peer_id, peer_signature, peer_nonce, peer_version, own_key)
1637 }
1638
1639 fn authenticationComplete(
1640 &self,
1641 peer_signature: &SessionIdSignature,
1642 shared_keys: &[AuthgraphArc; 2],
1643 ) -> binder::Result<[AuthgraphArc; 2]> {
1644 self.0.authenticationComplete(peer_signature, shared_keys)
1645 }
1646}