Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 1 | // Copyright 2021, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Microdroid Manager |
| 16 | |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 17 | mod instance; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 18 | mod ioutil; |
Jooyung Han | 7457348 | 2021-06-08 17:10:21 +0900 | [diff] [blame] | 19 | mod metadata; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 20 | |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 21 | use crate::instance::InstanceDisk; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 22 | use anyhow::{anyhow, bail, Context, Result}; |
| 23 | use apkverify::verify; |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 24 | use binder::unstable_api::{new_spibinder, AIBinder}; |
| 25 | use binder::{FromIBinder, Strong}; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 26 | use idsig::V4Signature; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 27 | use log::{error, info, warn}; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 28 | use microdroid_payload_config::{Task, TaskType, VmPayloadConfig}; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 29 | use nix::ioctl_read_bad; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 30 | use rustutils::system_properties; |
Joel Galenson | 482704c | 2021-07-29 15:53:53 -0700 | [diff] [blame] | 31 | use rustutils::system_properties::PropertyWatcher; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 32 | use std::fs::{self, File, OpenOptions}; |
| 33 | use std::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd}; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 34 | use std::path::Path; |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 35 | use std::process::{Command, Stdio}; |
| 36 | use std::str; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 37 | use std::time::{Duration, SystemTime}; |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 38 | use vsock::VsockStream; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 39 | |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 40 | use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::{ |
| 41 | VM_BINDER_SERVICE_PORT, VM_STREAM_SERVICE_PORT, IVirtualMachineService, |
| 42 | }; |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 43 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 44 | const WAIT_TIMEOUT: Duration = Duration::from_secs(10); |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 45 | const DM_MOUNTED_APK_PATH: &str = "/dev/block/mapper/microdroid-apk"; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 46 | |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 47 | /// The CID representing the host VM |
| 48 | const VMADDR_CID_HOST: u32 = 2; |
| 49 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 50 | const APEX_CONFIG_DONE_PROP: &str = "apex_config.done"; |
| 51 | |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 52 | fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> { |
| 53 | // SAFETY: AIBinder returned by RpcClient has correct reference count, and the ownership can be |
| 54 | // safely taken by new_spibinder. |
| 55 | let ibinder = unsafe { |
| 56 | new_spibinder(binder_rpc_unstable_bindgen::RpcClient( |
| 57 | VMADDR_CID_HOST, |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 58 | VM_BINDER_SERVICE_PORT as u32, |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 59 | ) as *mut AIBinder) |
| 60 | }; |
| 61 | if let Some(ibinder) = ibinder { |
| 62 | <dyn IVirtualMachineService>::try_from(ibinder).context("Cannot connect to RPC service") |
| 63 | } else { |
| 64 | bail!("Invalid raw AIBinder") |
| 65 | } |
| 66 | } |
| 67 | |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 68 | const IOCTL_VM_SOCKETS_GET_LOCAL_CID: usize = 0x7b9; |
| 69 | ioctl_read_bad!( |
| 70 | /// Gets local cid from /dev/vsock |
| 71 | vm_sockets_get_local_cid, |
| 72 | IOCTL_VM_SOCKETS_GET_LOCAL_CID, |
| 73 | u32 |
| 74 | ); |
| 75 | |
| 76 | // TODO: remove this after VS can check the peer addresses of binder clients |
| 77 | fn get_local_cid() -> Result<u32> { |
| 78 | let f = OpenOptions::new() |
| 79 | .read(true) |
| 80 | .write(false) |
| 81 | .open("/dev/vsock") |
| 82 | .context("failed to open /dev/vsock")?; |
| 83 | let mut ret = 0; |
| 84 | // SAFETY: the kernel only modifies the given u32 integer. |
| 85 | unsafe { vm_sockets_get_local_cid(f.as_raw_fd(), &mut ret) }?; |
| 86 | Ok(ret) |
| 87 | } |
| 88 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 89 | fn main() -> Result<()> { |
Jiyong Park | 79b8801 | 2021-06-25 13:06:25 +0900 | [diff] [blame] | 90 | kernlog::init()?; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 91 | info!("started."); |
| 92 | |
Jooyung Han | 7457348 | 2021-06-08 17:10:21 +0900 | [diff] [blame] | 93 | let metadata = metadata::load()?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 94 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 95 | // Try to read roothash from the instance disk. |
| 96 | // TODO(jiyong): the data should have an internal structure. |
| 97 | let mut instance = InstanceDisk::new()?; |
| 98 | let saved_roothash = instance.read_microdroid_data().context("Failed to read identity data")?; |
| 99 | let saved_roothash = saved_roothash.as_deref(); |
| 100 | |
| 101 | // Verify the payload before using it. |
| 102 | let verified_roothash = |
| 103 | verify_payload(saved_roothash).context("Payload verification failed")?; |
| 104 | if let Some(saved_roothash) = saved_roothash { |
| 105 | if saved_roothash == verified_roothash.as_ref() { |
| 106 | info!("Saved roothash is verified."); |
| 107 | } else { |
| 108 | bail!("Detected an update of the APK which isn't supported yet."); |
| 109 | } |
| 110 | } else { |
| 111 | info!("Saving APK roothash: {}", to_hex_string(verified_roothash.as_ref())); |
| 112 | // TODO(jiyong): the data should have an internal structure. |
| 113 | instance |
| 114 | .write_microdroid_data(verified_roothash.as_ref()) |
| 115 | .context("Failed to write identity data")?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 116 | } |
| 117 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 118 | wait_for_apex_config_done()?; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 119 | |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 120 | let service = get_vms_rpc_binder().expect("cannot connect to VirtualMachineService"); |
Jooyung Han | 7457348 | 2021-06-08 17:10:21 +0900 | [diff] [blame] | 121 | if !metadata.payload_config_path.is_empty() { |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 122 | // Before reading a file from the APK, start zipfuse |
| 123 | system_properties::write("ctl.start", "zipfuse")?; |
| 124 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 125 | let config = load_config(Path::new(&metadata.payload_config_path))?; |
| 126 | |
Andrew Scull | 6f3e5fe | 2021-07-02 12:38:21 +0000 | [diff] [blame] | 127 | let fake_secret = "This is a placeholder for a value that is derived from the images that are loaded in the VM."; |
Joel Galenson | 482704c | 2021-07-29 15:53:53 -0700 | [diff] [blame] | 128 | if let Err(err) = rustutils::system_properties::write("ro.vmsecret.keymint", fake_secret) { |
Andrew Scull | 6f3e5fe | 2021-07-02 12:38:21 +0000 | [diff] [blame] | 129 | warn!("failed to set ro.vmsecret.keymint: {}", err); |
| 130 | } |
| 131 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 132 | // TODO(jooyung): wait until sys.boot_completed? |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 133 | if let Some(main_task) = &config.task { |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 134 | exec_task(main_task, &service).map_err(|e| { |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 135 | error!("failed to execute task: {}", e); |
| 136 | e |
| 137 | })?; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 138 | } |
| 139 | } |
| 140 | |
| 141 | Ok(()) |
| 142 | } |
| 143 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 144 | type Roothash = [u8]; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 145 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 146 | // Verify payload before executing it. Full verification (which is slow) is done when the roothash |
| 147 | // values from the idsig file and the instance disk are different. This function returns the |
| 148 | // verified roothash that can be saved to the instance disk. |
| 149 | fn verify_payload(roothash: Option<&Roothash>) -> Result<Box<Roothash>> { |
| 150 | let start_time = SystemTime::now(); |
| 151 | |
| 152 | let roothash_from_idsig = get_apk_roothash_from_idsig()?; |
| 153 | let roothash_trustful = roothash == Some(&roothash_from_idsig); |
| 154 | |
| 155 | // If roothash can be trusted, pass it to apkdmverity so that it uses the passed roothash |
| 156 | // instead of the value read from the idsig file. |
| 157 | if roothash_trustful { |
| 158 | let roothash = to_hex_string(roothash.unwrap()); |
| 159 | system_properties::write("microdroid_manager.apk_roothash", &roothash)?; |
| 160 | } |
| 161 | |
| 162 | // Start apkdmverity and wait for the dm-verify block |
| 163 | system_properties::write("ctl.start", "apkdmverity")?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 164 | ioutil::wait_for_file(DM_MOUNTED_APK_PATH, WAIT_TIMEOUT)?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 165 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 166 | // Do the full verification if the roothash is un-trustful. This requires the full scanning of |
| 167 | // the APK file and therefore can be very slow if the APK is large. Note that this step is |
| 168 | // taken only when the roothash is un-trustful which can be either when this is the first boot |
| 169 | // of the VM or APK was updated in the host. |
| 170 | // TODO(jooyung): consider multithreading to make this faster |
| 171 | if !roothash_trustful { |
| 172 | verify(DM_MOUNTED_APK_PATH).context(format!("failed to verify {}", DM_MOUNTED_APK_PATH))?; |
| 173 | } |
| 174 | |
| 175 | info!("payload verification successful. took {:#?}", start_time.elapsed().unwrap()); |
| 176 | |
| 177 | // At this point, we can ensure that the roothash from the idsig file is trusted, either by |
| 178 | // fully verifying the APK or by comparing it with the saved roothash. |
| 179 | Ok(roothash_from_idsig) |
| 180 | } |
| 181 | |
| 182 | // Waits until linker config is generated |
| 183 | fn wait_for_apex_config_done() -> Result<()> { |
| 184 | let mut prop = PropertyWatcher::new(APEX_CONFIG_DONE_PROP)?; |
| 185 | loop { |
| 186 | prop.wait()?; |
| 187 | let val = system_properties::read(APEX_CONFIG_DONE_PROP)?; |
| 188 | if val == "true" { |
| 189 | break; |
| 190 | } |
| 191 | } |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 192 | Ok(()) |
| 193 | } |
| 194 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame^] | 195 | fn get_apk_roothash_from_idsig() -> Result<Box<Roothash>> { |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 196 | let mut idsig = File::open("/dev/block/by-name/microdroid-apk-idsig")?; |
| 197 | let idsig = V4Signature::from(&mut idsig)?; |
| 198 | Ok(idsig.hashing_info.raw_root_hash) |
| 199 | } |
| 200 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 201 | fn load_config(path: &Path) -> Result<VmPayloadConfig> { |
| 202 | info!("loading config from {:?}...", path); |
| 203 | let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)?; |
| 204 | Ok(serde_json::from_reader(file)?) |
| 205 | } |
| 206 | |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 207 | /// Executes the given task. Stdout of the task is piped into the vsock stream to the |
| 208 | /// virtualizationservice in the host side. |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 209 | fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<()> { |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 210 | info!("executing main task {:?}...", task); |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 211 | let mut child = build_command(task)?.spawn()?; |
| 212 | |
Inseob Kim | 2444af9 | 2021-08-31 01:22:50 +0900 | [diff] [blame] | 213 | let local_cid = get_local_cid()?; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 214 | info!("notifying payload started"); |
Inseob Kim | 2444af9 | 2021-08-31 01:22:50 +0900 | [diff] [blame] | 215 | service.notifyPayloadStarted(local_cid as i32)?; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 216 | |
Inseob Kim | 2444af9 | 2021-08-31 01:22:50 +0900 | [diff] [blame] | 217 | if let Some(code) = child.wait()?.code() { |
| 218 | info!("notifying payload finished"); |
| 219 | service.notifyPayloadFinished(local_cid as i32, code)?; |
| 220 | |
| 221 | if code == 0 { |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 222 | info!("task successfully finished"); |
Inseob Kim | 2444af9 | 2021-08-31 01:22:50 +0900 | [diff] [blame] | 223 | } else { |
| 224 | error!("task exited with exit code: {}", code); |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 225 | } |
Inseob Kim | 2444af9 | 2021-08-31 01:22:50 +0900 | [diff] [blame] | 226 | } else { |
| 227 | error!("task terminated by signal"); |
Jiyong Park | 038b73e | 2021-06-16 01:57:02 +0900 | [diff] [blame] | 228 | } |
Inseob Kim | 2444af9 | 2021-08-31 01:22:50 +0900 | [diff] [blame] | 229 | Ok(()) |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 230 | } |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 231 | |
| 232 | fn build_command(task: &Task) -> Result<Command> { |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 233 | const VMADDR_CID_HOST: u32 = 2; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 234 | |
| 235 | let mut command = match task.type_ { |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 236 | TaskType::Executable => { |
| 237 | let mut command = Command::new(&task.command); |
| 238 | command.args(&task.args); |
| 239 | command |
| 240 | } |
| 241 | TaskType::MicrodroidLauncher => { |
| 242 | let mut command = Command::new("/system/bin/microdroid_launcher"); |
| 243 | command.arg(find_library_path(&task.command)?).args(&task.args); |
| 244 | command |
| 245 | } |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 246 | }; |
| 247 | |
Inseob Kim | d058756 | 2021-09-01 21:27:32 +0900 | [diff] [blame] | 248 | match VsockStream::connect_with_cid_port(VMADDR_CID_HOST, VM_STREAM_SERVICE_PORT as u32) { |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 249 | Ok(stream) => { |
| 250 | // SAFETY: the ownership of the underlying file descriptor is transferred from stream |
| 251 | // to the file object, and then into the Command object. When the command is finished, |
| 252 | // the file descriptor is closed. |
| 253 | let file = unsafe { File::from_raw_fd(stream.into_raw_fd()) }; |
| 254 | command |
| 255 | .stdin(Stdio::from(file.try_clone()?)) |
| 256 | .stdout(Stdio::from(file.try_clone()?)) |
| 257 | .stderr(Stdio::from(file)); |
| 258 | } |
| 259 | Err(e) => { |
| 260 | error!("failed to connect to virtualization service: {}", e); |
| 261 | // Don't fail hard here. Even if we failed to connect to the virtualizationservice, |
| 262 | // we keep executing the task. This can happen if the owner of the VM doesn't register |
| 263 | // callback to accept the stream. Use /dev/null as the stream so that the task can |
| 264 | // make progress without waiting for someone to consume the output. |
| 265 | command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()); |
| 266 | } |
| 267 | } |
| 268 | |
| 269 | Ok(command) |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 270 | } |
| 271 | |
| 272 | fn find_library_path(name: &str) -> Result<String> { |
| 273 | let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?; |
| 274 | let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?; |
| 275 | let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?; |
| 276 | let path = format!("/mnt/apk/lib/{}/{}", abi, name); |
| 277 | |
| 278 | let metadata = fs::metadata(&path)?; |
| 279 | if !metadata.is_file() { |
| 280 | bail!("{} is not a file", &path); |
| 281 | } |
| 282 | |
| 283 | Ok(path) |
| 284 | } |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 285 | |
| 286 | fn to_hex_string(buf: &[u8]) -> String { |
| 287 | buf.iter().map(|b| format!("{:02X}", b)).collect() |
| 288 | } |