blob: 9cbcaf131b00ed6bf47b98c81048c60a58d3aff5 [file] [log] [blame]
Jooyung Han347d9f22021-05-28 00:05:14 +09001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Microdroid Manager
16
Jiyong Park21ce2c52021-08-28 02:32:17 +090017mod instance;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090018mod ioutil;
Jooyung Han74573482021-06-08 17:10:21 +090019mod metadata;
Jooyung Han347d9f22021-05-28 00:05:14 +090020
Jiyong Park21ce2c52021-08-28 02:32:17 +090021use crate::instance::InstanceDisk;
Jooyung Han19c1d6c2021-08-06 14:08:16 +090022use anyhow::{anyhow, bail, Context, Result};
23use apkverify::verify;
Inseob Kim1b95f2e2021-08-19 13:17:40 +090024use binder::unstable_api::{new_spibinder, AIBinder};
25use binder::{FromIBinder, Strong};
Jiyong Park21ce2c52021-08-28 02:32:17 +090026use idsig::V4Signature;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090027use log::{error, info, warn};
Jooyung Han634e2d72021-06-10 16:27:38 +090028use microdroid_payload_config::{Task, TaskType, VmPayloadConfig};
Inseob Kim7f61fe72021-08-20 20:50:47 +090029use nix::ioctl_read_bad;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090030use rustutils::system_properties;
Joel Galenson482704c2021-07-29 15:53:53 -070031use rustutils::system_properties::PropertyWatcher;
Inseob Kim7f61fe72021-08-20 20:50:47 +090032use std::fs::{self, File, OpenOptions};
33use std::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd};
Jooyung Hanf48ceb42021-06-01 18:00:04 +090034use std::path::Path;
Jiyong Park8611a6c2021-07-09 18:17:44 +090035use std::process::{Command, Stdio};
36use std::str;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090037use std::time::{Duration, SystemTime};
Jiyong Park8611a6c2021-07-09 18:17:44 +090038use vsock::VsockStream;
Jooyung Han634e2d72021-06-10 16:27:38 +090039
Inseob Kimd0587562021-09-01 21:27:32 +090040use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{
41 VM_BINDER_SERVICE_PORT, VM_STREAM_SERVICE_PORT, IVirtualMachineService,
42};
Inseob Kim1b95f2e2021-08-19 13:17:40 +090043
Jooyung Han634e2d72021-06-10 16:27:38 +090044const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
Jooyung Han19c1d6c2021-08-06 14:08:16 +090045const DM_MOUNTED_APK_PATH: &str = "/dev/block/mapper/microdroid-apk";
Jooyung Han347d9f22021-05-28 00:05:14 +090046
Inseob Kim1b95f2e2021-08-19 13:17:40 +090047/// The CID representing the host VM
48const VMADDR_CID_HOST: u32 = 2;
49
Jiyong Parkbb4a9872021-09-06 15:59:21 +090050const APEX_CONFIG_DONE_PROP: &str = "apex_config.done";
51
Inseob Kim1b95f2e2021-08-19 13:17:40 +090052fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> {
53 // SAFETY: AIBinder returned by RpcClient has correct reference count, and the ownership can be
54 // safely taken by new_spibinder.
55 let ibinder = unsafe {
56 new_spibinder(binder_rpc_unstable_bindgen::RpcClient(
57 VMADDR_CID_HOST,
Inseob Kimd0587562021-09-01 21:27:32 +090058 VM_BINDER_SERVICE_PORT as u32,
Inseob Kim1b95f2e2021-08-19 13:17:40 +090059 ) as *mut AIBinder)
60 };
61 if let Some(ibinder) = ibinder {
62 <dyn IVirtualMachineService>::try_from(ibinder).context("Cannot connect to RPC service")
63 } else {
64 bail!("Invalid raw AIBinder")
65 }
66}
67
Inseob Kim7f61fe72021-08-20 20:50:47 +090068const IOCTL_VM_SOCKETS_GET_LOCAL_CID: usize = 0x7b9;
69ioctl_read_bad!(
70 /// Gets local cid from /dev/vsock
71 vm_sockets_get_local_cid,
72 IOCTL_VM_SOCKETS_GET_LOCAL_CID,
73 u32
74);
75
76// TODO: remove this after VS can check the peer addresses of binder clients
77fn get_local_cid() -> Result<u32> {
78 let f = OpenOptions::new()
79 .read(true)
80 .write(false)
81 .open("/dev/vsock")
82 .context("failed to open /dev/vsock")?;
83 let mut ret = 0;
84 // SAFETY: the kernel only modifies the given u32 integer.
85 unsafe { vm_sockets_get_local_cid(f.as_raw_fd(), &mut ret) }?;
86 Ok(ret)
87}
88
Jooyung Han634e2d72021-06-10 16:27:38 +090089fn main() -> Result<()> {
Jiyong Park79b88012021-06-25 13:06:25 +090090 kernlog::init()?;
Jooyung Han347d9f22021-05-28 00:05:14 +090091 info!("started.");
92
Jooyung Han74573482021-06-08 17:10:21 +090093 let metadata = metadata::load()?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +090094
Jiyong Parkbb4a9872021-09-06 15:59:21 +090095 // Try to read roothash from the instance disk.
96 // TODO(jiyong): the data should have an internal structure.
97 let mut instance = InstanceDisk::new()?;
98 let saved_roothash = instance.read_microdroid_data().context("Failed to read identity data")?;
99 let saved_roothash = saved_roothash.as_deref();
100
101 // Verify the payload before using it.
102 let verified_roothash =
103 verify_payload(saved_roothash).context("Payload verification failed")?;
104 if let Some(saved_roothash) = saved_roothash {
105 if saved_roothash == verified_roothash.as_ref() {
106 info!("Saved roothash is verified.");
107 } else {
108 bail!("Detected an update of the APK which isn't supported yet.");
109 }
110 } else {
111 info!("Saving APK roothash: {}", to_hex_string(verified_roothash.as_ref()));
112 // TODO(jiyong): the data should have an internal structure.
113 instance
114 .write_microdroid_data(verified_roothash.as_ref())
115 .context("Failed to write identity data")?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900116 }
117
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900118 wait_for_apex_config_done()?;
Jiyong Park21ce2c52021-08-28 02:32:17 +0900119
Inseob Kim7f61fe72021-08-20 20:50:47 +0900120 let service = get_vms_rpc_binder().expect("cannot connect to VirtualMachineService");
Jooyung Han74573482021-06-08 17:10:21 +0900121 if !metadata.payload_config_path.is_empty() {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900122 // Before reading a file from the APK, start zipfuse
123 system_properties::write("ctl.start", "zipfuse")?;
124
Jooyung Han634e2d72021-06-10 16:27:38 +0900125 let config = load_config(Path::new(&metadata.payload_config_path))?;
126
Andrew Scull6f3e5fe2021-07-02 12:38:21 +0000127 let fake_secret = "This is a placeholder for a value that is derived from the images that are loaded in the VM.";
Joel Galenson482704c2021-07-29 15:53:53 -0700128 if let Err(err) = rustutils::system_properties::write("ro.vmsecret.keymint", fake_secret) {
Andrew Scull6f3e5fe2021-07-02 12:38:21 +0000129 warn!("failed to set ro.vmsecret.keymint: {}", err);
130 }
131
Jooyung Han634e2d72021-06-10 16:27:38 +0900132 // TODO(jooyung): wait until sys.boot_completed?
Jooyung Han347d9f22021-05-28 00:05:14 +0900133 if let Some(main_task) = &config.task {
Inseob Kim7f61fe72021-08-20 20:50:47 +0900134 exec_task(main_task, &service).map_err(|e| {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900135 error!("failed to execute task: {}", e);
136 e
137 })?;
Jooyung Han347d9f22021-05-28 00:05:14 +0900138 }
139 }
140
141 Ok(())
142}
143
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900144type Roothash = [u8];
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900145
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900146// Verify payload before executing it. Full verification (which is slow) is done when the roothash
147// values from the idsig file and the instance disk are different. This function returns the
148// verified roothash that can be saved to the instance disk.
149fn verify_payload(roothash: Option<&Roothash>) -> Result<Box<Roothash>> {
150 let start_time = SystemTime::now();
151
152 let roothash_from_idsig = get_apk_roothash_from_idsig()?;
153 let roothash_trustful = roothash == Some(&roothash_from_idsig);
154
155 // If roothash can be trusted, pass it to apkdmverity so that it uses the passed roothash
156 // instead of the value read from the idsig file.
157 if roothash_trustful {
158 let roothash = to_hex_string(roothash.unwrap());
159 system_properties::write("microdroid_manager.apk_roothash", &roothash)?;
160 }
161
162 // Start apkdmverity and wait for the dm-verify block
163 system_properties::write("ctl.start", "apkdmverity")?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900164 ioutil::wait_for_file(DM_MOUNTED_APK_PATH, WAIT_TIMEOUT)?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900165
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900166 // Do the full verification if the roothash is un-trustful. This requires the full scanning of
167 // the APK file and therefore can be very slow if the APK is large. Note that this step is
168 // taken only when the roothash is un-trustful which can be either when this is the first boot
169 // of the VM or APK was updated in the host.
170 // TODO(jooyung): consider multithreading to make this faster
171 if !roothash_trustful {
172 verify(DM_MOUNTED_APK_PATH).context(format!("failed to verify {}", DM_MOUNTED_APK_PATH))?;
173 }
174
175 info!("payload verification successful. took {:#?}", start_time.elapsed().unwrap());
176
177 // At this point, we can ensure that the roothash from the idsig file is trusted, either by
178 // fully verifying the APK or by comparing it with the saved roothash.
179 Ok(roothash_from_idsig)
180}
181
182// Waits until linker config is generated
183fn wait_for_apex_config_done() -> Result<()> {
184 let mut prop = PropertyWatcher::new(APEX_CONFIG_DONE_PROP)?;
185 loop {
186 prop.wait()?;
187 let val = system_properties::read(APEX_CONFIG_DONE_PROP)?;
188 if val == "true" {
189 break;
190 }
191 }
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900192 Ok(())
193}
194
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900195fn get_apk_roothash_from_idsig() -> Result<Box<Roothash>> {
Jiyong Park21ce2c52021-08-28 02:32:17 +0900196 let mut idsig = File::open("/dev/block/by-name/microdroid-apk-idsig")?;
197 let idsig = V4Signature::from(&mut idsig)?;
198 Ok(idsig.hashing_info.raw_root_hash)
199}
200
Jooyung Han634e2d72021-06-10 16:27:38 +0900201fn load_config(path: &Path) -> Result<VmPayloadConfig> {
202 info!("loading config from {:?}...", path);
203 let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)?;
204 Ok(serde_json::from_reader(file)?)
205}
206
Jiyong Park8611a6c2021-07-09 18:17:44 +0900207/// Executes the given task. Stdout of the task is piped into the vsock stream to the
208/// virtualizationservice in the host side.
Inseob Kim7f61fe72021-08-20 20:50:47 +0900209fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<()> {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900210 info!("executing main task {:?}...", task);
Inseob Kim7f61fe72021-08-20 20:50:47 +0900211 let mut child = build_command(task)?.spawn()?;
212
Inseob Kim2444af92021-08-31 01:22:50 +0900213 let local_cid = get_local_cid()?;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900214 info!("notifying payload started");
Inseob Kim2444af92021-08-31 01:22:50 +0900215 service.notifyPayloadStarted(local_cid as i32)?;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900216
Inseob Kim2444af92021-08-31 01:22:50 +0900217 if let Some(code) = child.wait()?.code() {
218 info!("notifying payload finished");
219 service.notifyPayloadFinished(local_cid as i32, code)?;
220
221 if code == 0 {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900222 info!("task successfully finished");
Inseob Kim2444af92021-08-31 01:22:50 +0900223 } else {
224 error!("task exited with exit code: {}", code);
Jiyong Park8611a6c2021-07-09 18:17:44 +0900225 }
Inseob Kim2444af92021-08-31 01:22:50 +0900226 } else {
227 error!("task terminated by signal");
Jiyong Park038b73e2021-06-16 01:57:02 +0900228 }
Inseob Kim2444af92021-08-31 01:22:50 +0900229 Ok(())
Jooyung Han347d9f22021-05-28 00:05:14 +0900230}
Jooyung Han634e2d72021-06-10 16:27:38 +0900231
232fn build_command(task: &Task) -> Result<Command> {
Inseob Kim7f61fe72021-08-20 20:50:47 +0900233 const VMADDR_CID_HOST: u32 = 2;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900234
235 let mut command = match task.type_ {
Jooyung Han634e2d72021-06-10 16:27:38 +0900236 TaskType::Executable => {
237 let mut command = Command::new(&task.command);
238 command.args(&task.args);
239 command
240 }
241 TaskType::MicrodroidLauncher => {
242 let mut command = Command::new("/system/bin/microdroid_launcher");
243 command.arg(find_library_path(&task.command)?).args(&task.args);
244 command
245 }
Inseob Kim7f61fe72021-08-20 20:50:47 +0900246 };
247
Inseob Kimd0587562021-09-01 21:27:32 +0900248 match VsockStream::connect_with_cid_port(VMADDR_CID_HOST, VM_STREAM_SERVICE_PORT as u32) {
Inseob Kim7f61fe72021-08-20 20:50:47 +0900249 Ok(stream) => {
250 // SAFETY: the ownership of the underlying file descriptor is transferred from stream
251 // to the file object, and then into the Command object. When the command is finished,
252 // the file descriptor is closed.
253 let file = unsafe { File::from_raw_fd(stream.into_raw_fd()) };
254 command
255 .stdin(Stdio::from(file.try_clone()?))
256 .stdout(Stdio::from(file.try_clone()?))
257 .stderr(Stdio::from(file));
258 }
259 Err(e) => {
260 error!("failed to connect to virtualization service: {}", e);
261 // Don't fail hard here. Even if we failed to connect to the virtualizationservice,
262 // we keep executing the task. This can happen if the owner of the VM doesn't register
263 // callback to accept the stream. Use /dev/null as the stream so that the task can
264 // make progress without waiting for someone to consume the output.
265 command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
266 }
267 }
268
269 Ok(command)
Jooyung Han634e2d72021-06-10 16:27:38 +0900270}
271
272fn find_library_path(name: &str) -> Result<String> {
273 let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?;
274 let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?;
275 let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?;
276 let path = format!("/mnt/apk/lib/{}/{}", abi, name);
277
278 let metadata = fs::metadata(&path)?;
279 if !metadata.is_file() {
280 bail!("{} is not a file", &path);
281 }
282
283 Ok(path)
284}
Jiyong Park21ce2c52021-08-28 02:32:17 +0900285
286fn to_hex_string(buf: &[u8]) -> String {
287 buf.iter().map(|b| format!("{:02X}", b)).collect()
288}