blob: d12bfd3417515ce30809db604f35dfdc06a76c69 [file] [log] [blame]
Jooyung Han347d9f22021-05-28 00:05:14 +09001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Microdroid Manager
16
Andrew Sculld64ae7d2022-10-05 17:41:43 +000017mod dice;
Jiyong Park21ce2c52021-08-28 02:32:17 +090018mod instance;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090019mod ioutil;
Jooyung Han7a343f92021-09-08 22:53:11 +090020mod payload;
Keir Fraser933f0ac2022-10-12 08:23:28 +000021mod swap;
Alan Stokes1125e012023-10-13 12:31:10 +010022mod verify;
Alice Wang59a9e562022-10-04 15:24:10 +000023mod vm_payload_service;
Shikha Panwar95084df2023-07-22 11:47:45 +000024mod vm_secret;
Jooyung Han347d9f22021-05-28 00:05:14 +090025
Alan Stokes2bead0d2022-09-05 16:58:34 +010026use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::ErrorCode::ErrorCode;
David Brazdil73988ea2022-11-11 15:10:32 +000027use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::IVirtualMachineService;
Inseob Kim090b70b2022-11-16 20:01:14 +090028use android_system_virtualization_payload::aidl::android::system::virtualization::payload::IVmPayloadService::{
29 VM_APK_CONTENTS_PATH,
30 VM_PAYLOAD_SERVICE_SOCKET_NAME,
Shikha Panwarddc124b2022-11-28 19:17:54 +000031 ENCRYPTEDSTORE_MOUNTPOINT,
Inseob Kim090b70b2022-11-16 20:01:14 +090032};
Alan Stokes1125e012023-10-13 12:31:10 +010033
34use crate::dice::dice_derivation;
Alan Stokes03754962023-11-06 15:36:09 +000035use crate::instance::{InstanceDisk, MicrodroidData};
Alan Stokes1125e012023-10-13 12:31:10 +010036use crate::verify::verify_payload;
37use crate::vm_payload_service::register_vm_payload_service;
Jooyung Handd0a1732021-11-23 15:26:20 +090038use anyhow::{anyhow, bail, ensure, Context, Error, Result};
Alice Wang43c884b2022-10-24 09:42:40 +000039use binder::Strong;
Nikita Ioffee18cc132024-02-28 16:13:36 +000040use dice_driver::DiceDriver;
Alice Wang7e6c9352023-02-15 15:44:13 +000041use keystore2_crypto::ZVec;
Alan Stokes1125e012023-10-13 12:31:10 +010042use libc::VMADDR_CID_HOST;
43use log::{error, info};
Shikha Panwar185ba932024-03-12 22:35:09 +000044use microdroid_metadata::{Metadata, PayloadMetadata};
Alan Stokesfda70842023-12-20 17:50:14 +000045use microdroid_payload_config::{ApkConfig, OsConfig, Task, TaskType, VmPayloadConfig};
Nikita Ioffeabb6d8a2024-03-12 23:01:47 +000046use nix::mount::{umount2, MntFlags};
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080047use nix::sys::signal::Signal;
Alan Stokes03754962023-11-06 15:36:09 +000048use payload::load_metadata;
David Brazdila2125dd2022-12-14 16:37:44 +000049use rpcbinder::RpcSession;
Inseob Kim090b70b2022-11-16 20:01:14 +090050use rustutils::sockets::android_get_control_socket;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090051use rustutils::system_properties;
Joel Galenson482704c2021-07-29 15:53:53 -070052use rustutils::system_properties::PropertyWatcher;
Jiyong Park9ef27322024-08-27 15:29:31 +090053use safe_ownedfd::take_fd_ownership;
Shikha Panwar0503cb02024-01-05 10:11:28 +000054use secretkeeper_comm::data_types::ID_SIZE;
Alan Stokes3ba10fd2022-10-06 15:46:51 +010055use std::borrow::Cow::{Borrowed, Owned};
Inseob Kim7ff121c2022-11-14 18:13:23 +090056use std::env;
Shikha Panwardef7ef92023-01-06 08:35:48 +000057use std::ffi::CString;
Alan Stokes1125e012023-10-13 12:31:10 +010058use std::fs::{self, create_dir, File, OpenOptions};
Jaewan Kim3124ef02023-03-23 19:25:20 +090059use std::io::{Read, Write};
Jiyong Park9ef27322024-08-27 15:29:31 +090060use std::os::unix::io::OwnedFd;
Nikita Ioffe3452ee22022-12-15 00:31:56 +000061use std::os::unix::process::CommandExt;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080062use std::os::unix::process::ExitStatusExt;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090063use std::path::Path;
Inseob Kim217038e2021-11-25 11:15:06 +090064use std::process::{Child, Command, Stdio};
Jiyong Park8611a6c2021-07-09 18:17:44 +090065use std::str;
Alan Stokes1125e012023-10-13 12:31:10 +010066use std::time::Duration;
Shikha Panwar95084df2023-07-22 11:47:45 +000067use vm_secret::VmSecret;
Jooyung Han634e2d72021-06-10 16:27:38 +090068
69const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
Jaewan Kim1f0135b2024-01-31 14:59:47 +090070const AVF_STRICT_BOOT: &str = "/proc/device-tree/chosen/avf,strict-boot";
71const AVF_NEW_INSTANCE: &str = "/proc/device-tree/chosen/avf,new-instance";
72const AVF_DEBUG_POLICY_RAMDUMP: &str = "/proc/device-tree/avf/guest/common/ramdump";
Inseob Kime379e7d2022-07-22 18:55:18 +090073const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str =
Jaewan Kim1f0135b2024-01-31 14:59:47 +090074 "/proc/device-tree/virtualization/guest/debug-microdroid,no-verified-boot";
Shikha Panwar14abe442024-02-23 15:04:27 +000075const SECRETKEEPER_KEY: &str = "/proc/device-tree/avf/secretkeeper_public_key";
76const INSTANCE_ID_PATH: &str = "/proc/device-tree/avf/untrusted/instance-id";
Shikha Panware45e9422024-02-28 21:18:10 +000077const DEFER_ROLLBACK_PROTECTION: &str = "/proc/device-tree/avf/untrusted/defer-rollback-protection";
Jooyung Han347d9f22021-05-28 00:05:14 +090078
Alan Stokes4fb201c2023-02-08 17:39:05 +000079const ENCRYPTEDSTORE_BIN: &str = "/system/bin/encryptedstore";
80const ZIPFUSE_BIN: &str = "/system/bin/zipfuse";
81
Jiyong Parkbb4a9872021-09-06 15:59:21 +090082const APEX_CONFIG_DONE_PROP: &str = "apex_config.done";
Seungjae Yoofa22bb02022-12-08 16:38:42 +090083const DEBUGGABLE_PROP: &str = "ro.boot.microdroid.debuggable";
Jiyong Parkbb4a9872021-09-06 15:59:21 +090084
Inseob Kim11f40d02022-06-13 17:16:00 +090085// SYNC WITH virtualizationservice/src/crosvm.rs
86const FAILURE_SERIAL_DEVICE: &str = "/dev/ttyS1";
87
Shikha Panwar566c9672022-11-15 14:39:58 +000088const ENCRYPTEDSTORE_BACKING_DEVICE: &str = "/dev/block/by-name/encryptedstore";
Alice Wang62f7e642023-02-10 09:55:13 +000089const ENCRYPTEDSTORE_KEYSIZE: usize = 32;
Shikha Panwar566c9672022-11-15 14:39:58 +000090
Nikita Ioffeabb6d8a2024-03-12 23:01:47 +000091const DICE_CHAIN_FILE: &str = "/microdroid_resources/dice_chain.raw";
92
Jooyung Handd0a1732021-11-23 15:26:20 +090093#[derive(thiserror::Error, Debug)]
94enum MicrodroidError {
Inseob Kim11f40d02022-06-13 17:16:00 +090095 #[error("Cannot connect to virtualization service: {0}")]
96 FailedToConnectToVirtualizationService(String),
Jooyung Handd0a1732021-11-23 15:26:20 +090097 #[error("Payload has changed: {0}")]
98 PayloadChanged(String),
99 #[error("Payload verification has failed: {0}")]
100 PayloadVerificationFailed(String),
Jooyung Han5c6d4172021-12-06 14:17:52 +0900101 #[error("Payload config is invalid: {0}")]
Alan Stokesbbed8872023-10-19 13:17:12 +0100102 PayloadInvalidConfig(String),
Jooyung Handd0a1732021-11-23 15:26:20 +0900103}
104
Alan Stokes2bead0d2022-09-05 16:58:34 +0100105fn translate_error(err: &Error) -> (ErrorCode, String) {
Jooyung Handd0a1732021-11-23 15:26:20 +0900106 if let Some(e) = err.downcast_ref::<MicrodroidError>() {
107 match e {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100108 MicrodroidError::PayloadChanged(msg) => (ErrorCode::PAYLOAD_CHANGED, msg.to_string()),
Jooyung Handd0a1732021-11-23 15:26:20 +0900109 MicrodroidError::PayloadVerificationFailed(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100110 (ErrorCode::PAYLOAD_VERIFICATION_FAILED, msg.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900111 }
Alan Stokesbbed8872023-10-19 13:17:12 +0100112 MicrodroidError::PayloadInvalidConfig(msg) => {
113 (ErrorCode::PAYLOAD_INVALID_CONFIG, msg.to_string())
Alan Stokes2bead0d2022-09-05 16:58:34 +0100114 }
Inseob Kim11f40d02022-06-13 17:16:00 +0900115 // Connection failure won't be reported to VS; return the default value
116 MicrodroidError::FailedToConnectToVirtualizationService(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100117 (ErrorCode::UNKNOWN, msg.to_string())
Inseob Kim11f40d02022-06-13 17:16:00 +0900118 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900119 }
120 } else {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100121 (ErrorCode::UNKNOWN, err.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900122 }
123}
124
Inseob Kim11f40d02022-06-13 17:16:00 +0900125fn write_death_reason_to_serial(err: &Error) -> Result<()> {
126 let death_reason = if let Some(e) = err.downcast_ref::<MicrodroidError>() {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100127 Borrowed(match e {
Inseob Kim11f40d02022-06-13 17:16:00 +0900128 MicrodroidError::FailedToConnectToVirtualizationService(_) => {
129 "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE"
130 }
131 MicrodroidError::PayloadChanged(_) => "MICRODROID_PAYLOAD_HAS_CHANGED",
132 MicrodroidError::PayloadVerificationFailed(_) => {
133 "MICRODROID_PAYLOAD_VERIFICATION_FAILED"
134 }
Alan Stokesbbed8872023-10-19 13:17:12 +0100135 MicrodroidError::PayloadInvalidConfig(_) => "MICRODROID_INVALID_PAYLOAD_CONFIG",
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100136 })
Inseob Kim11f40d02022-06-13 17:16:00 +0900137 } else {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100138 // Send context information back after a separator, to ease diagnosis.
139 // These errors occur before the payload runs, so this should not leak sensitive
140 // information.
141 Owned(format!("MICRODROID_UNKNOWN_RUNTIME_ERROR|{:?}", err))
Inseob Kim11f40d02022-06-13 17:16:00 +0900142 };
143
Pierre-Clément Tosid225af52023-09-15 15:59:20 +0100144 for chunk in death_reason.as_bytes().chunks(16) {
Inseob Kim11f40d02022-06-13 17:16:00 +0900145 // TODO(b/220071963): Sometimes, sending more than 16 bytes at once makes MM hang.
Pierre-Clément Tosid225af52023-09-15 15:59:20 +0100146 OpenOptions::new().read(false).write(true).open(FAILURE_SERIAL_DEVICE)?.write_all(chunk)?;
Inseob Kim11f40d02022-06-13 17:16:00 +0900147 }
148
149 Ok(())
150}
151
Shikha Panwar14abe442024-02-23 15:04:27 +0000152/// The (host allocated) instance_id can be found at node /avf/untrusted/ in the device tree.
153fn get_instance_id() -> Result<Option<[u8; ID_SIZE]>> {
154 let path = Path::new(INSTANCE_ID_PATH);
155 let instance_id = if path.exists() {
156 Some(
157 fs::read(path)?
158 .try_into()
159 .map_err(|x: Vec<_>| anyhow!("Expected {ID_SIZE} bytes, found {:?}", x.len()))?,
160 )
161 } else {
162 // TODO(b/325094712): x86 support for Device tree in nested guest is limited/broken/
163 // untested. So instance_id will not be present in cuttlefish.
164 None
165 };
166 Ok(instance_id)
167}
168
Shikha Panware45e9422024-02-28 21:18:10 +0000169fn should_defer_rollback_protection() -> bool {
170 Path::new(DEFER_ROLLBACK_PROTECTION).exists()
171}
172
Inseob Kim437f1052022-06-21 11:30:22 +0900173fn main() -> Result<()> {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900174 // If debuggable, print full backtrace to console log with stdio_to_kmsg
Alan Stokes1125e012023-10-13 12:31:10 +0100175 if is_debuggable()? {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900176 env::set_var("RUST_BACKTRACE", "full");
177 }
178
Inseob Kim437f1052022-06-21 11:30:22 +0900179 scopeguard::defer! {
180 info!("Shutting down...");
Jooyung Hanbfe086f2021-10-28 10:15:45 +0900181 if let Err(e) = system_properties::write("sys.powerctl", "shutdown") {
182 error!("failed to shutdown {:?}", e);
183 }
Jooyung Han311b1202021-09-14 22:00:16 +0900184 }
Inseob Kim437f1052022-06-21 11:30:22 +0900185
186 try_main().map_err(|e| {
187 error!("Failed with {:?}.", e);
188 if let Err(e) = write_death_reason_to_serial(&e) {
189 error!("Failed to write death reason {:?}", e);
190 }
191 e
192 })
Jooyung Han311b1202021-09-14 22:00:16 +0900193}
194
195fn try_main() -> Result<()> {
Jiyong Park2b6346d2023-06-19 13:37:42 +0900196 android_logger::init_once(
197 android_logger::Config::default()
198 .with_tag("microdroid_manager")
Jeff Vander Stoep57da1572024-01-31 10:52:16 +0100199 .with_max_level(log::LevelFilter::Info),
Jiyong Park2b6346d2023-06-19 13:37:42 +0900200 );
Jooyung Han347d9f22021-05-28 00:05:14 +0900201 info!("started.");
202
Jiyong Park9ef27322024-08-27 15:29:31 +0900203 let vm_payload_service_fd = prepare_vm_payload_service_socket()?;
Inseob Kim090b70b2022-11-16 20:01:14 +0900204
Jiyong Park202856e2022-08-22 16:04:26 +0900205 load_crashkernel_if_supported().context("Failed to load crashkernel")?;
206
Alice Wangeff58392023-07-04 13:32:09 +0000207 swap::init_swap().context("Failed to initialize swap")?;
Keir Fraser933f0ac2022-10-12 08:23:28 +0000208 info!("swap enabled.");
209
Inseob Kim11f40d02022-06-13 17:16:00 +0900210 let service = get_vms_rpc_binder()
211 .context("cannot connect to VirtualMachineService")
212 .map_err(|e| MicrodroidError::FailedToConnectToVirtualizationService(e.to_string()))?;
Seungjae Yoofd9a0622022-10-14 10:01:29 +0900213
Alice Wangfd222fd2023-05-25 09:37:38 +0000214 match try_run_payload(&service, vm_payload_service_fd) {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900215 Ok(code) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900216 if code == 0 {
217 info!("task successfully finished");
218 } else {
219 error!("task exited with exit code: {}", code);
220 }
Shikha Panwardef7ef92023-01-06 08:35:48 +0000221 if let Err(e) = post_payload_work() {
222 error!(
223 "Failed to run post payload work. It is possible that certain tasks
224 like syncing encrypted store might be incomplete. Error: {:?}",
225 e
226 );
227 };
228
229 info!("notifying payload finished");
230 service.notifyPayloadFinished(code)?;
Jooyung Han5c6d4172021-12-06 14:17:52 +0900231 Ok(())
232 }
233 Err(err) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900234 let (error_code, message) = translate_error(&err);
235 service.notifyError(error_code, &message)?;
236 Err(err)
237 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900238 }
239}
240
Shikha Panwar185ba932024-03-12 22:35:09 +0000241fn verify_payload_with_instance_img(
242 metadata: &Metadata,
243 dice: &DiceDriver,
244) -> Result<MicrodroidData> {
Jooyung Han311b1202021-09-14 22:00:16 +0900245 let mut instance = InstanceDisk::new().context("Failed to load instance.img")?;
Shikha Panwar185ba932024-03-12 22:35:09 +0000246 let saved_data = instance.read_microdroid_data(dice).context("Failed to read identity data")?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900247
Andrew Scullab72ec52022-03-14 09:10:52 +0000248 if is_strict_boot() {
249 // Provisioning must happen on the first boot and never again.
250 if is_new_instance() {
251 ensure!(
252 saved_data.is_none(),
Alan Stokesbbed8872023-10-19 13:17:12 +0100253 MicrodroidError::PayloadInvalidConfig(
254 "Found instance data on first boot.".to_string()
255 )
Andrew Scullab72ec52022-03-14 09:10:52 +0000256 );
257 } else {
258 ensure!(
259 saved_data.is_some(),
Alan Stokesbbed8872023-10-19 13:17:12 +0100260 MicrodroidError::PayloadInvalidConfig("Instance data not found.".to_string())
Andrew Scullab72ec52022-03-14 09:10:52 +0000261 );
262 };
263 }
264
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900265 // Verify the payload before using it.
Shikha Panwar185ba932024-03-12 22:35:09 +0000266 let extracted_data = verify_payload(metadata, saved_data.as_ref())
Inseob Kim11f40d02022-06-13 17:16:00 +0900267 .context("Payload verification failed")
Inseob Kimbe8afd62024-09-03 11:12:10 +0900268 .map_err(|e| MicrodroidError::PayloadVerificationFailed(format!("{:?}", e)))?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900269
270 // In case identity is ignored (by debug policy), we should reuse existing payload data, even
271 // when the payload is changed. This is to keep the derived secret same as before.
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000272 let instance_data = if let Some(saved_data) = saved_data {
Inseob Kime379e7d2022-07-22 18:55:18 +0900273 if !is_verified_boot() {
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000274 if saved_data != extracted_data {
Inseob Kime379e7d2022-07-22 18:55:18 +0900275 info!("Detected an update of the payload, but continue (regarding debug policy)")
276 }
277 } else {
278 ensure!(
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000279 saved_data == extracted_data,
Inseob Kime379e7d2022-07-22 18:55:18 +0900280 MicrodroidError::PayloadChanged(String::from(
281 "Detected an update of the payload which isn't supported yet."
282 ))
283 );
284 info!("Saved data is verified.");
285 }
286 saved_data
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900287 } else {
Jooyung Han7a343f92021-09-08 22:53:11 +0900288 info!("Saving verified data.");
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000289 instance
Shikha Panwar185ba932024-03-12 22:35:09 +0000290 .write_microdroid_data(&extracted_data, dice)
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000291 .context("Failed to write identity data")?;
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000292 extracted_data
Inseob Kime379e7d2022-07-22 18:55:18 +0900293 };
Shikha Panwar185ba932024-03-12 22:35:09 +0000294 Ok(instance_data)
295}
296
297fn try_run_payload(
298 service: &Strong<dyn IVirtualMachineService>,
299 vm_payload_service_fd: OwnedFd,
300) -> Result<i32> {
301 let metadata = load_metadata().context("Failed to load payload metadata")?;
Nikita Ioffeabb6d8a2024-03-12 23:01:47 +0000302 let dice = if Path::new(DICE_CHAIN_FILE).exists() {
303 DiceDriver::from_file(Path::new(DICE_CHAIN_FILE))
304 .context("Failed to load DICE from file")?
305 } else {
306 DiceDriver::new(Path::new("/dev/open-dice0"), is_strict_boot())
307 .context("Failed to load DICE from driver")?
308 };
Shikha Panwar185ba932024-03-12 22:35:09 +0000309
Shikha Panware45e9422024-02-28 21:18:10 +0000310 // Microdroid skips checking payload against instance image iff the device supports
311 // secretkeeper. In that case Microdroid use VmSecret::V2, which provide protection against
312 // rollback of boot images and packages.
313 let instance_data = if should_defer_rollback_protection() {
Shikha Panwar185ba932024-03-12 22:35:09 +0000314 verify_payload(&metadata, None)?
315 } else {
316 verify_payload_with_instance_img(&metadata, &dice)?
317 };
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900318
Alan Stokes1f417c92022-09-29 15:13:28 +0100319 let payload_metadata = metadata.payload.ok_or_else(|| {
Alan Stokesbbed8872023-10-19 13:17:12 +0100320 MicrodroidError::PayloadInvalidConfig("No payload config in metadata".to_string())
Alan Stokes1f417c92022-09-29 15:13:28 +0100321 })?;
Alan Stokes0d1ef782022-09-27 13:46:35 +0100322
Inseob Kimb2519c52022-04-14 02:10:09 +0900323 // To minimize the exposure to untrusted data, derive dice profile as soon as possible.
324 info!("DICE derivation for payload");
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000325 let dice_artifacts = dice_derivation(dice, &instance_data, &payload_metadata)?;
Shikha Panwar5d6a6752023-12-14 22:08:26 +0000326 let vm_secret =
Shikha Panwar14abe442024-02-23 15:04:27 +0000327 VmSecret::new(dice_artifacts, service).context("Failed to create VM secrets")?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000328
Alan Stokes9a7f67e2023-11-07 09:37:40 +0000329 if cfg!(dice_changes) {
330 // Now that the DICE derivation is done, it's ok to allow payload code to run.
331
332 // Start apexd to activate APEXes. This may allow code within them to run.
333 system_properties::write("ctl.start", "apexd-vm")?;
Nikita Ioffeabb6d8a2024-03-12 23:01:47 +0000334
335 // Unmounting /microdroid_resources is a defence-in-depth effort to ensure that payload
336 // can't get hold of dice chain stored there.
337 umount2("/microdroid_resources", MntFlags::MNT_DETACH)?;
Alan Stokes9a7f67e2023-11-07 09:37:40 +0000338 }
339
Shikha Panwar566c9672022-11-15 14:39:58 +0000340 // Run encryptedstore binary to prepare the storage
341 let encryptedstore_child = if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() {
342 info!("Preparing encryptedstore ...");
Shikha Panwar95084df2023-07-22 11:47:45 +0000343 Some(prepare_encryptedstore(&vm_secret).context("encryptedstore run")?)
Shikha Panwar566c9672022-11-15 14:39:58 +0000344 } else {
345 None
346 };
Inseob Kimb2519c52022-04-14 02:10:09 +0900347
Alan Stokes960c9032022-12-07 16:53:45 +0000348 let mut zipfuse = Zipfuse::default();
349
Jooyung Hana6d11eb2021-09-10 11:48:05 +0900350 // Before reading a file from the APK, start zipfuse
Alan Stokes960c9032022-12-07 16:53:45 +0000351 zipfuse.mount(
Alan Stokes60f82202022-10-07 16:40:07 +0100352 MountForExec::Allowed,
Inseob Kim217038e2021-11-25 11:15:06 +0900353 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0",
Alan Stokes1125e012023-10-13 12:31:10 +0100354 Path::new(verify::DM_MOUNTED_APK_PATH),
Alice Wang6bbb6da2022-10-26 12:44:06 +0000355 Path::new(VM_APK_CONTENTS_PATH),
Alan Stokes960c9032022-12-07 16:53:45 +0000356 "microdroid_manager.apk.mounted".to_owned(),
357 )?;
Jiyong Park21ce2c52021-08-28 02:32:17 +0900358
Andrew Scull4d262dc2022-10-21 13:14:33 +0000359 // Restricted APIs are only allowed to be used by platform or test components. Infer this from
360 // the use of a VM config file since those can only be used by platform and test components.
361 let allow_restricted_apis = match payload_metadata {
Ludovic Barman93ee3082023-06-20 12:18:43 +0000362 PayloadMetadata::ConfigPath(_) => true,
363 PayloadMetadata::Config(_) => false,
364 _ => false, // default is false for safety
Andrew Scull4d262dc2022-10-21 13:14:33 +0000365 };
366
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100367 let config = load_config(payload_metadata).context("Failed to load payload metadata")?;
Shikha Panwar6f03c942022-04-13 20:26:50 +0000368
Alan Stokes01b3ef02022-09-22 17:43:24 +0100369 let task = config
370 .task
371 .as_ref()
Alan Stokesbbed8872023-10-19 13:17:12 +0100372 .ok_or_else(|| MicrodroidError::PayloadInvalidConfig("No task in VM config".to_string()))?;
Alan Stokes01b3ef02022-09-22 17:43:24 +0100373
Alice Wang061478b2023-04-11 13:26:17 +0000374 ensure!(
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000375 config.extra_apks.len() == instance_data.extra_apks_data.len(),
Alice Wang061478b2023-04-11 13:26:17 +0000376 "config expects {} extra apks, but found {}",
377 config.extra_apks.len(),
Alan Stokes26a6a5c2023-11-10 16:18:43 +0000378 instance_data.extra_apks_data.len()
Alice Wang061478b2023-04-11 13:26:17 +0000379 );
Alan Stokes960c9032022-12-07 16:53:45 +0000380 mount_extra_apks(&config, &mut zipfuse)?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900381
Alan Stokes26efd192023-11-06 16:30:15 +0000382 register_vm_payload_service(
383 allow_restricted_apis,
384 service.clone(),
385 vm_secret,
386 vm_payload_service_fd,
387 )?;
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000388
Shikha Panwar1a6efcd2023-02-03 19:23:43 +0000389 // Set export_tombstones if enabled
Inseob Kimab1037d2023-02-08 17:03:31 +0900390 if should_export_tombstones(&config) {
Shikha Panwar1a6efcd2023-02-03 19:23:43 +0000391 // This property is read by tombstone_handler.
392 system_properties::write("microdroid_manager.export_tombstones.enabled", "1")
393 .context("set microdroid_manager.export_tombstones.enabled")?;
Inseob Kimcd9c1dd2022-07-13 17:13:45 +0900394 }
395
Alan Stokes26efd192023-11-06 16:30:15 +0000396 // Wait until apex config is done. (e.g. linker configuration for apexes)
397 wait_for_property_true(APEX_CONFIG_DONE_PROP).context("Failed waiting for apex config done")?;
398
399 // Trigger init post-fs-data. This will start authfs if we wask it to.
400 if config.enable_authfs {
401 system_properties::write("microdroid_manager.authfs.enabled", "1")
402 .context("failed to write microdroid_manager.authfs.enabled")?;
403 }
404 system_properties::write("microdroid_manager.config_done", "1")
405 .context("failed to write microdroid_manager.config_done")?;
406
Alan Stokes960c9032022-12-07 16:53:45 +0000407 // Wait until zipfuse has mounted the APKs so we can access the payload
408 zipfuse.wait_until_done()?;
Alan Stokes60f82202022-10-07 16:40:07 +0100409
Shikha Panwarddc124b2022-11-28 19:17:54 +0000410 // Wait for encryptedstore to finish mounting the storage (if enabled) before setting
411 // microdroid_manager.init_done. Reason is init stops uneventd after that.
412 // Encryptedstore, however requires ueventd
Shikha Panwar566c9672022-11-15 14:39:58 +0000413 if let Some(mut child) = encryptedstore_child {
414 let exitcode = child.wait().context("Wait for encryptedstore child")?;
415 ensure!(exitcode.success(), "Unable to prepare encrypted storage. Exitcode={}", exitcode);
416 }
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100417
Alan Stokes26efd192023-11-06 16:30:15 +0000418 // Wait for init to have finished booting.
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000419 wait_for_property_true("dev.bootcomplete").context("failed waiting for dev.bootcomplete")?;
Alan Stokes26efd192023-11-06 16:30:15 +0000420
421 // And then tell it we're done so unnecessary services can be shut down.
Shikha Panwar3f6f6a52022-11-29 17:28:36 +0000422 system_properties::write("microdroid_manager.init_done", "1")
423 .context("set microdroid_manager.init_done")?;
Inseob Kimc16b0cc2023-01-26 14:57:24 +0900424
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000425 info!("boot completed, time to run payload");
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100426 exec_task(task, service).context("Failed to run payload")
Alan Stokes01b3ef02022-09-22 17:43:24 +0100427}
428
Alan Stokes03754962023-11-06 15:36:09 +0000429fn post_payload_work() -> Result<()> {
430 // Sync the encrypted storage filesystem (flushes the filesystem caches).
431 if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() {
432 let mountpoint = CString::new(ENCRYPTEDSTORE_MOUNTPOINT).unwrap();
433
434 // SAFETY: `mountpoint` is a valid C string. `syncfs` and `close` are safe for any parameter
435 // values.
436 let ret = unsafe {
437 let dirfd = libc::open(
438 mountpoint.as_ptr(),
439 libc::O_DIRECTORY | libc::O_RDONLY | libc::O_CLOEXEC,
440 );
441 ensure!(dirfd >= 0, "Unable to open {:?}", mountpoint);
442 let ret = libc::syncfs(dirfd);
443 libc::close(dirfd);
444 ret
445 };
446 if ret != 0 {
447 error!("failed to sync encrypted storage.");
448 return Err(anyhow!(std::io::Error::last_os_error()));
449 }
450 }
451 Ok(())
452}
453
Alan Stokes03754962023-11-06 15:36:09 +0000454fn mount_extra_apks(config: &VmPayloadConfig, zipfuse: &mut Zipfuse) -> Result<()> {
455 // For now, only the number of apks is important, as the mount point and dm-verity name is fixed
456 for i in 0..config.extra_apks.len() {
457 let mount_dir = format!("/mnt/extra-apk/{i}");
458 create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?;
459
460 let mount_for_exec =
461 if cfg!(multi_tenant) { MountForExec::Allowed } else { MountForExec::Disallowed };
462 // These run asynchronously in parallel - we wait later for them to complete.
463 zipfuse.mount(
464 mount_for_exec,
465 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0",
466 Path::new(&format!("/dev/block/mapper/extra-apk-{i}")),
467 Path::new(&mount_dir),
468 format!("microdroid_manager.extra_apk.mounted.{i}"),
469 )?;
470 }
471
472 Ok(())
473}
474
475fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> {
476 // The host is running a VirtualMachineService for this VM on a port equal
477 // to the CID of this VM.
478 let port = vsock::get_local_cid().context("Could not determine local CID")?;
479 RpcSession::new()
480 .setup_vsock_client(VMADDR_CID_HOST, port)
481 .context("Could not connect to IVirtualMachineService")
482}
483
484/// Prepares a socket file descriptor for the vm payload service.
Jiyong Park9ef27322024-08-27 15:29:31 +0900485fn prepare_vm_payload_service_socket() -> Result<OwnedFd> {
Alan Stokes03754962023-11-06 15:36:09 +0000486 let raw_fd = android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?;
Jiyong Park9ef27322024-08-27 15:29:31 +0900487 Ok(take_fd_ownership(raw_fd)?)
Alan Stokes03754962023-11-06 15:36:09 +0000488}
489
490fn is_strict_boot() -> bool {
491 Path::new(AVF_STRICT_BOOT).exists()
492}
493
494fn is_new_instance() -> bool {
495 Path::new(AVF_NEW_INSTANCE).exists()
496}
497
498fn is_verified_boot() -> bool {
499 !Path::new(DEBUG_MICRODROID_NO_VERIFIED_BOOT).exists()
500}
501
502fn is_debuggable() -> Result<bool> {
503 Ok(system_properties::read_bool(DEBUGGABLE_PROP, true)?)
504}
505
506fn should_export_tombstones(config: &VmPayloadConfig) -> bool {
507 match config.export_tombstones {
508 Some(b) => b,
509 None => is_debuggable().unwrap_or(false),
510 }
511}
512
513/// Get debug policy value in bool. It's true iff the value is explicitly set to <1>.
514fn get_debug_policy_bool(path: &'static str) -> Result<Option<bool>> {
515 let mut file = match File::open(path) {
516 Ok(dp) => dp,
517 Err(e) => {
518 info!(
519 "Assumes that debug policy is disabled because failed to read debug policy ({e:?})"
520 );
521 return Ok(Some(false));
522 }
523 };
524 let mut log: [u8; 4] = Default::default();
525 file.read_exact(&mut log).context("Malformed data in {path}")?;
526 // DT spec uses big endian although Android is always little endian.
527 Ok(Some(u32::from_be_bytes(log) == 1))
528}
529
Alan Stokes60f82202022-10-07 16:40:07 +0100530enum MountForExec {
531 Allowed,
532 Disallowed,
533}
534
Alan Stokes960c9032022-12-07 16:53:45 +0000535#[derive(Default)]
536struct Zipfuse {
537 ready_properties: Vec<String>,
538}
539
540impl Zipfuse {
541 fn mount(
542 &mut self,
543 noexec: MountForExec,
544 option: &str,
545 zip_path: &Path,
546 mount_dir: &Path,
547 ready_prop: String,
548 ) -> Result<Child> {
549 let mut cmd = Command::new(ZIPFUSE_BIN);
550 if let MountForExec::Disallowed = noexec {
551 cmd.arg("--noexec");
552 }
Alan Stokes1294f942023-08-21 14:34:12 +0100553 // Let root own the files in APK, so we can access them, but set the group to
554 // allow all payloads to have access too.
555 let (uid, gid) = (microdroid_uids::ROOT_UID, microdroid_uids::MICRODROID_PAYLOAD_GID);
556
Alan Stokes960c9032022-12-07 16:53:45 +0000557 cmd.args(["-p", &ready_prop, "-o", option]);
Alan Stokes1294f942023-08-21 14:34:12 +0100558 cmd.args(["-u", &uid.to_string()]);
559 cmd.args(["-g", &gid.to_string()]);
Alan Stokes960c9032022-12-07 16:53:45 +0000560 cmd.arg(zip_path).arg(mount_dir);
561 self.ready_properties.push(ready_prop);
562 cmd.spawn().with_context(|| format!("Failed to run zipfuse for {mount_dir:?}"))
Andrew Scullcc339a12022-07-04 12:44:19 +0000563 }
Alan Stokes960c9032022-12-07 16:53:45 +0000564
565 fn wait_until_done(self) -> Result<()> {
566 // We check the last-started check first in the hope that by the time it is done
567 // all or most of the others will also be done, minimising the number of times we
568 // block on a property.
569 for property in self.ready_properties.into_iter().rev() {
570 wait_for_property_true(&property)
571 .with_context(|| format!("Failed waiting for {property}"))?;
572 }
573 Ok(())
Alan Stokes60f82202022-10-07 16:40:07 +0100574 }
Inseob Kim217038e2021-11-25 11:15:06 +0900575}
576
Alan Stokes60f82202022-10-07 16:40:07 +0100577fn wait_for_property_true(property_name: &str) -> Result<()> {
578 let mut prop = PropertyWatcher::new(property_name)?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900579 loop {
Andrew Walbrand9c766e2023-05-10 15:15:39 +0000580 prop.wait(None)?;
Alan Stokes60f82202022-10-07 16:40:07 +0100581 if system_properties::read_bool(property_name, false)? {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900582 break;
583 }
584 }
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900585 Ok(())
586}
587
Alan Stokes1f417c92022-09-29 15:13:28 +0100588fn load_config(payload_metadata: PayloadMetadata) -> Result<VmPayloadConfig> {
589 match payload_metadata {
Ludovic Barman93ee3082023-06-20 12:18:43 +0000590 PayloadMetadata::ConfigPath(path) => {
Alan Stokes1f417c92022-09-29 15:13:28 +0100591 let path = Path::new(&path);
592 info!("loading config from {:?}...", path);
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100593 let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)
594 .with_context(|| format!("Failed to read {:?}", path))?;
Alan Stokes1f417c92022-09-29 15:13:28 +0100595 Ok(serde_json::from_reader(file)?)
596 }
Ludovic Barman93ee3082023-06-20 12:18:43 +0000597 PayloadMetadata::Config(payload_config) => {
Alan Stokes1f417c92022-09-29 15:13:28 +0100598 let task = Task {
599 type_: TaskType::MicrodroidLauncher,
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000600 command: payload_config.payload_binary_name,
Alan Stokes1f417c92022-09-29 15:13:28 +0100601 };
Alan Stokesfda70842023-12-20 17:50:14 +0000602 // We don't care about the paths, only the number of extra APKs really matters.
603 let extra_apks = (0..payload_config.extra_apk_count)
604 .map(|i| ApkConfig { path: format!("extra-apk-{i}") })
605 .collect();
Alan Stokes1f417c92022-09-29 15:13:28 +0100606 Ok(VmPayloadConfig {
607 os: OsConfig { name: "microdroid".to_owned() },
608 task: Some(task),
609 apexes: vec![],
Alan Stokesfda70842023-12-20 17:50:14 +0000610 extra_apks,
Alan Stokes1f417c92022-09-29 15:13:28 +0100611 prefer_staged: false,
Inseob Kimab1037d2023-02-08 17:03:31 +0900612 export_tombstones: None,
Alan Stokes1f417c92022-09-29 15:13:28 +0100613 enable_authfs: false,
Vincent Donnefort538a2c62024-03-20 16:01:10 +0000614 hugepages: false,
Alan Stokes1f417c92022-09-29 15:13:28 +0100615 })
616 }
Ludovic Barman93ee3082023-06-20 12:18:43 +0000617 _ => bail!("Failed to match config against a config type."),
Alan Stokes1f417c92022-09-29 15:13:28 +0100618 }
Jooyung Han634e2d72021-06-10 16:27:38 +0900619}
620
Jaewan Kim3124ef02023-03-23 19:25:20 +0900621/// Loads the crashkernel into memory using kexec if debuggable or debug policy says so.
622/// The VM should be loaded with `crashkernel=' parameter in the cmdline to allocate memory
623/// for crashkernel.
Jiyong Park202856e2022-08-22 16:04:26 +0900624fn load_crashkernel_if_supported() -> Result<()> {
625 let supported = std::fs::read_to_string("/proc/cmdline")?.contains(" crashkernel=");
626 info!("ramdump supported: {}", supported);
Jaewan Kim3124ef02023-03-23 19:25:20 +0900627
628 if !supported {
629 return Ok(());
630 }
631
Alan Stokes1125e012023-10-13 12:31:10 +0100632 let debuggable = is_debuggable()?;
Jaewan Kim3124ef02023-03-23 19:25:20 +0900633 let ramdump = get_debug_policy_bool(AVF_DEBUG_POLICY_RAMDUMP)?.unwrap_or_default();
634 let requested = debuggable | ramdump;
635
636 if requested {
Jiyong Park202856e2022-08-22 16:04:26 +0900637 let status = Command::new("/system/bin/kexec_load").status()?;
638 if !status.success() {
639 return Err(anyhow!("Failed to load crashkernel: {:?}", status));
640 }
Jaewan Kim3124ef02023-03-23 19:25:20 +0900641 info!("ramdump is loaded: debuggable={debuggable}, ramdump={ramdump}");
Jiyong Park202856e2022-08-22 16:04:26 +0900642 }
643 Ok(())
644}
645
Inseob Kim090b70b2022-11-16 20:01:14 +0900646/// Executes the given task.
Jooyung Han5c6d4172021-12-06 14:17:52 +0900647fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900648 info!("executing main task {:?}...", task);
David Brazdil451cc962022-10-14 14:08:12 +0100649 let mut command = match task.type_ {
Alan Stokes1294f942023-08-21 14:34:12 +0100650 TaskType::Executable => {
Alan Stokes679ddf32023-09-01 11:14:48 +0100651 // TODO(b/297501338): Figure out how to handle non-root for system payloads.
Alan Stokes1294f942023-08-21 14:34:12 +0100652 Command::new(&task.command)
653 }
David Brazdil451cc962022-10-14 14:08:12 +0100654 TaskType::MicrodroidLauncher => {
655 let mut command = Command::new("/system/bin/microdroid_launcher");
656 command.arg(find_library_path(&task.command)?);
Alan Stokes1294f942023-08-21 14:34:12 +0100657 command.uid(microdroid_uids::MICRODROID_PAYLOAD_UID);
658 command.gid(microdroid_uids::MICRODROID_PAYLOAD_GID);
David Brazdil451cc962022-10-14 14:08:12 +0100659 command
660 }
661 };
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000662
Andrew Walbranaac68302023-07-21 19:05:34 +0100663 // SAFETY: We are not accessing any resource of the parent process. This means we can't make any
664 // log calls inside the closure.
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000665 unsafe {
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000666 command.pre_exec(|| {
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000667 // It is OK to continue with payload execution even if the calls below fail, since
668 // whether process can use a capability is controlled by the SELinux. Dropping the
669 // capabilities here is just another defense-in-depth layer.
Andrew Walbranaac68302023-07-21 19:05:34 +0100670 let _ = cap::drop_inheritable_caps();
671 let _ = cap::drop_bounding_set();
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000672 Ok(())
673 });
674 }
675
Inseob Kim090b70b2022-11-16 20:01:14 +0900676 command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
Inseob Kim7f61fe72021-08-20 20:50:47 +0900677
678 info!("notifying payload started");
Inseob Kimc7d28c72021-10-25 14:28:10 +0000679 service.notifyPayloadStarted()?;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900680
Inseob Kim86ca0162021-10-20 02:21:02 +0000681 let exit_status = command.spawn()?.wait()?;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -0800682 match exit_status.code() {
683 Some(exit_code) => Ok(exit_code),
684 None => Err(match exit_status.signal() {
685 Some(signal) => anyhow!(
686 "Payload exited due to signal: {} ({})",
687 signal,
688 Signal::try_from(signal).map_or("unknown", |s| s.as_str())
689 ),
690 None => anyhow!("Payload has neither exit code nor signal"),
691 }),
692 }
Jooyung Han347d9f22021-05-28 00:05:14 +0900693}
Jooyung Han634e2d72021-06-10 16:27:38 +0900694
Jooyung Han634e2d72021-06-10 16:27:38 +0900695fn find_library_path(name: &str) -> Result<String> {
696 let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?;
697 let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?;
698 let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?;
Alice Wang6bbb6da2022-10-26 12:44:06 +0000699 let path = format!("{}/lib/{}/{}", VM_APK_CONTENTS_PATH, abi, name);
Jooyung Han634e2d72021-06-10 16:27:38 +0900700
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100701 let metadata = fs::metadata(&path).with_context(|| format!("Unable to access {}", path))?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900702 if !metadata.is_file() {
703 bail!("{} is not a file", &path);
704 }
705
706 Ok(path)
707}
Jiyong Park21ce2c52021-08-28 02:32:17 +0900708
Shikha Panwar95084df2023-07-22 11:47:45 +0000709fn prepare_encryptedstore(vm_secret: &VmSecret) -> Result<Child> {
Alice Wang7e6c9352023-02-15 15:44:13 +0000710 let mut key = ZVec::new(ENCRYPTEDSTORE_KEYSIZE)?;
Shikha Panwar3d3a70a2023-08-21 20:02:08 +0000711 vm_secret.derive_encryptedstore_key(&mut key)?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000712 let mut cmd = Command::new(ENCRYPTEDSTORE_BIN);
713 cmd.arg("--blkdevice")
714 .arg(ENCRYPTEDSTORE_BACKING_DEVICE)
715 .arg("--key")
716 .arg(hex::encode(&*key))
Shikha Panwar9fd198f2022-11-18 17:43:43 +0000717 .args(["--mountpoint", ENCRYPTEDSTORE_MOUNTPOINT])
Shikha Panwar566c9672022-11-15 14:39:58 +0000718 .spawn()
719 .context("encryptedstore failed")
720}