blob: 8175753964024756ed7754ebee6064d5f6f2c4e0 [file] [log] [blame]
Jooyung Han347d9f22021-05-28 00:05:14 +09001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Microdroid Manager
16
Andrew Sculld64ae7d2022-10-05 17:41:43 +000017mod dice;
Alan Stokes1125e012023-10-13 12:31:10 +010018mod dice_driver;
Jiyong Park21ce2c52021-08-28 02:32:17 +090019mod instance;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090020mod ioutil;
Jooyung Han7a343f92021-09-08 22:53:11 +090021mod payload;
Keir Fraser933f0ac2022-10-12 08:23:28 +000022mod swap;
Alan Stokes1125e012023-10-13 12:31:10 +010023mod verify;
Alice Wang59a9e562022-10-04 15:24:10 +000024mod vm_payload_service;
Shikha Panwar95084df2023-07-22 11:47:45 +000025mod vm_secret;
Jooyung Han347d9f22021-05-28 00:05:14 +090026
Alan Stokes2bead0d2022-09-05 16:58:34 +010027use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::ErrorCode::ErrorCode;
David Brazdil73988ea2022-11-11 15:10:32 +000028use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::IVirtualMachineService;
Inseob Kim090b70b2022-11-16 20:01:14 +090029use android_system_virtualization_payload::aidl::android::system::virtualization::payload::IVmPayloadService::{
30 VM_APK_CONTENTS_PATH,
31 VM_PAYLOAD_SERVICE_SOCKET_NAME,
Shikha Panwarddc124b2022-11-28 19:17:54 +000032 ENCRYPTEDSTORE_MOUNTPOINT,
Inseob Kim090b70b2022-11-16 20:01:14 +090033};
Alan Stokes1125e012023-10-13 12:31:10 +010034
35use crate::dice::dice_derivation;
36use crate::dice_driver::DiceDriver;
37use crate::instance::{ApexData, InstanceDisk, MicrodroidData};
38use crate::verify::verify_payload;
39use crate::vm_payload_service::register_vm_payload_service;
Jooyung Handd0a1732021-11-23 15:26:20 +090040use anyhow::{anyhow, bail, ensure, Context, Error, Result};
Alice Wang43c884b2022-10-24 09:42:40 +000041use binder::Strong;
Alice Wang7e6c9352023-02-15 15:44:13 +000042use keystore2_crypto::ZVec;
Alan Stokes1125e012023-10-13 12:31:10 +010043use libc::VMADDR_CID_HOST;
44use log::{error, info};
45use microdroid_metadata::{write_metadata, PayloadMetadata};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090046use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080047use nix::sys::signal::Signal;
Alan Stokes1125e012023-10-13 12:31:10 +010048use payload::{load_metadata, to_metadata};
David Brazdila2125dd2022-12-14 16:37:44 +000049use rpcbinder::RpcSession;
Inseob Kim090b70b2022-11-16 20:01:14 +090050use rustutils::sockets::android_get_control_socket;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090051use rustutils::system_properties;
Joel Galenson482704c2021-07-29 15:53:53 -070052use rustutils::system_properties::PropertyWatcher;
Alan Stokes3ba10fd2022-10-06 15:46:51 +010053use std::borrow::Cow::{Borrowed, Owned};
Inseob Kim7ff121c2022-11-14 18:13:23 +090054use std::env;
Shikha Panwardef7ef92023-01-06 08:35:48 +000055use std::ffi::CString;
Alan Stokes1125e012023-10-13 12:31:10 +010056use std::fs::{self, create_dir, File, OpenOptions};
Jaewan Kim3124ef02023-03-23 19:25:20 +090057use std::io::{Read, Write};
Alan Stokes1125e012023-10-13 12:31:10 +010058use std::os::unix::io::{FromRawFd, OwnedFd};
Nikita Ioffe3452ee22022-12-15 00:31:56 +000059use std::os::unix::process::CommandExt;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080060use std::os::unix::process::ExitStatusExt;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090061use std::path::Path;
Inseob Kim217038e2021-11-25 11:15:06 +090062use std::process::{Child, Command, Stdio};
Jiyong Park8611a6c2021-07-09 18:17:44 +090063use std::str;
Alan Stokes1125e012023-10-13 12:31:10 +010064use std::time::Duration;
Shikha Panwar95084df2023-07-22 11:47:45 +000065use vm_secret::VmSecret;
Jooyung Han634e2d72021-06-10 16:27:38 +090066
67const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
Andrew Scullab72ec52022-03-14 09:10:52 +000068const AVF_STRICT_BOOT: &str = "/sys/firmware/devicetree/base/chosen/avf,strict-boot";
69const AVF_NEW_INSTANCE: &str = "/sys/firmware/devicetree/base/chosen/avf,new-instance";
Jaewan Kim3124ef02023-03-23 19:25:20 +090070const AVF_DEBUG_POLICY_RAMDUMP: &str = "/sys/firmware/devicetree/base/avf/guest/common/ramdump";
Inseob Kime379e7d2022-07-22 18:55:18 +090071const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str =
72 "/sys/firmware/devicetree/base/virtualization/guest/debug-microdroid,no-verified-boot";
Jooyung Han347d9f22021-05-28 00:05:14 +090073
Alan Stokes4fb201c2023-02-08 17:39:05 +000074const ENCRYPTEDSTORE_BIN: &str = "/system/bin/encryptedstore";
75const ZIPFUSE_BIN: &str = "/system/bin/zipfuse";
76
Jiyong Parkbb4a9872021-09-06 15:59:21 +090077const APEX_CONFIG_DONE_PROP: &str = "apex_config.done";
Seungjae Yoofa22bb02022-12-08 16:38:42 +090078const DEBUGGABLE_PROP: &str = "ro.boot.microdroid.debuggable";
Jiyong Parkbb4a9872021-09-06 15:59:21 +090079
Inseob Kim11f40d02022-06-13 17:16:00 +090080// SYNC WITH virtualizationservice/src/crosvm.rs
81const FAILURE_SERIAL_DEVICE: &str = "/dev/ttyS1";
82
Shikha Panwar566c9672022-11-15 14:39:58 +000083const ENCRYPTEDSTORE_BACKING_DEVICE: &str = "/dev/block/by-name/encryptedstore";
Alice Wang62f7e642023-02-10 09:55:13 +000084const ENCRYPTEDSTORE_KEYSIZE: usize = 32;
Shikha Panwar566c9672022-11-15 14:39:58 +000085
Jooyung Handd0a1732021-11-23 15:26:20 +090086#[derive(thiserror::Error, Debug)]
87enum MicrodroidError {
Inseob Kim11f40d02022-06-13 17:16:00 +090088 #[error("Cannot connect to virtualization service: {0}")]
89 FailedToConnectToVirtualizationService(String),
Jooyung Handd0a1732021-11-23 15:26:20 +090090 #[error("Payload has changed: {0}")]
91 PayloadChanged(String),
92 #[error("Payload verification has failed: {0}")]
93 PayloadVerificationFailed(String),
Jooyung Han5c6d4172021-12-06 14:17:52 +090094 #[error("Payload config is invalid: {0}")]
95 InvalidConfig(String),
Jooyung Handd0a1732021-11-23 15:26:20 +090096}
97
Alan Stokes2bead0d2022-09-05 16:58:34 +010098fn translate_error(err: &Error) -> (ErrorCode, String) {
Jooyung Handd0a1732021-11-23 15:26:20 +090099 if let Some(e) = err.downcast_ref::<MicrodroidError>() {
100 match e {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100101 MicrodroidError::PayloadChanged(msg) => (ErrorCode::PAYLOAD_CHANGED, msg.to_string()),
Jooyung Handd0a1732021-11-23 15:26:20 +0900102 MicrodroidError::PayloadVerificationFailed(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100103 (ErrorCode::PAYLOAD_VERIFICATION_FAILED, msg.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900104 }
Alan Stokes2bead0d2022-09-05 16:58:34 +0100105 MicrodroidError::InvalidConfig(msg) => {
106 (ErrorCode::PAYLOAD_CONFIG_INVALID, msg.to_string())
107 }
Inseob Kim11f40d02022-06-13 17:16:00 +0900108
109 // Connection failure won't be reported to VS; return the default value
110 MicrodroidError::FailedToConnectToVirtualizationService(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100111 (ErrorCode::UNKNOWN, msg.to_string())
Inseob Kim11f40d02022-06-13 17:16:00 +0900112 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900113 }
114 } else {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100115 (ErrorCode::UNKNOWN, err.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900116 }
117}
118
Inseob Kim11f40d02022-06-13 17:16:00 +0900119fn write_death_reason_to_serial(err: &Error) -> Result<()> {
120 let death_reason = if let Some(e) = err.downcast_ref::<MicrodroidError>() {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100121 Borrowed(match e {
Inseob Kim11f40d02022-06-13 17:16:00 +0900122 MicrodroidError::FailedToConnectToVirtualizationService(_) => {
123 "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE"
124 }
125 MicrodroidError::PayloadChanged(_) => "MICRODROID_PAYLOAD_HAS_CHANGED",
126 MicrodroidError::PayloadVerificationFailed(_) => {
127 "MICRODROID_PAYLOAD_VERIFICATION_FAILED"
128 }
129 MicrodroidError::InvalidConfig(_) => "MICRODROID_INVALID_PAYLOAD_CONFIG",
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100130 })
Inseob Kim11f40d02022-06-13 17:16:00 +0900131 } else {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100132 // Send context information back after a separator, to ease diagnosis.
133 // These errors occur before the payload runs, so this should not leak sensitive
134 // information.
135 Owned(format!("MICRODROID_UNKNOWN_RUNTIME_ERROR|{:?}", err))
Inseob Kim11f40d02022-06-13 17:16:00 +0900136 };
137
Pierre-Clément Tosid225af52023-09-15 15:59:20 +0100138 for chunk in death_reason.as_bytes().chunks(16) {
Inseob Kim11f40d02022-06-13 17:16:00 +0900139 // TODO(b/220071963): Sometimes, sending more than 16 bytes at once makes MM hang.
Pierre-Clément Tosid225af52023-09-15 15:59:20 +0100140 OpenOptions::new().read(false).write(true).open(FAILURE_SERIAL_DEVICE)?.write_all(chunk)?;
Inseob Kim11f40d02022-06-13 17:16:00 +0900141 }
142
143 Ok(())
144}
145
Inseob Kim1b95f2e2021-08-19 13:17:40 +0900146fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> {
David Brazdil73988ea2022-11-11 15:10:32 +0000147 // The host is running a VirtualMachineService for this VM on a port equal
148 // to the CID of this VM.
149 let port = vsock::get_local_cid().context("Could not determine local CID")?;
David Brazdila2125dd2022-12-14 16:37:44 +0000150 RpcSession::new()
151 .setup_vsock_client(VMADDR_CID_HOST, port)
David Brazdil73988ea2022-11-11 15:10:32 +0000152 .context("Could not connect to IVirtualMachineService")
Inseob Kim1b95f2e2021-08-19 13:17:40 +0900153}
154
Inseob Kim437f1052022-06-21 11:30:22 +0900155fn main() -> Result<()> {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900156 // If debuggable, print full backtrace to console log with stdio_to_kmsg
Alan Stokes1125e012023-10-13 12:31:10 +0100157 if is_debuggable()? {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900158 env::set_var("RUST_BACKTRACE", "full");
159 }
160
Inseob Kim437f1052022-06-21 11:30:22 +0900161 scopeguard::defer! {
162 info!("Shutting down...");
Jooyung Hanbfe086f2021-10-28 10:15:45 +0900163 if let Err(e) = system_properties::write("sys.powerctl", "shutdown") {
164 error!("failed to shutdown {:?}", e);
165 }
Jooyung Han311b1202021-09-14 22:00:16 +0900166 }
Inseob Kim437f1052022-06-21 11:30:22 +0900167
168 try_main().map_err(|e| {
169 error!("Failed with {:?}.", e);
170 if let Err(e) = write_death_reason_to_serial(&e) {
171 error!("Failed to write death reason {:?}", e);
172 }
173 e
174 })
Jooyung Han311b1202021-09-14 22:00:16 +0900175}
176
Alice Wangfd222fd2023-05-25 09:37:38 +0000177/// Prepares a socket file descriptor for the vm payload service.
178///
Andrew Walbranae3350d2023-07-21 19:01:18 +0100179/// # Safety
Alice Wangfd222fd2023-05-25 09:37:38 +0000180///
181/// The caller must ensure that this function is the only place that claims ownership
182/// of the file descriptor and it is called only once.
183unsafe fn prepare_vm_payload_service_socket() -> Result<OwnedFd> {
184 let raw_fd = android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?;
Inseob Kim090b70b2022-11-16 20:01:14 +0900185
Alice Wangfd222fd2023-05-25 09:37:38 +0000186 // Creating OwnedFd for stdio FDs is not safe.
187 if [libc::STDIN_FILENO, libc::STDOUT_FILENO, libc::STDERR_FILENO].contains(&raw_fd) {
188 bail!("File descriptor {raw_fd} is standard I/O descriptor");
189 }
190 // SAFETY: Initializing OwnedFd for a RawFd created by the init.
191 // We checked that the integer value corresponds to a valid FD and that the caller
192 // ensures that this is the only place to claim its ownership.
193 Ok(unsafe { OwnedFd::from_raw_fd(raw_fd) })
Inseob Kim090b70b2022-11-16 20:01:14 +0900194}
195
Jooyung Han311b1202021-09-14 22:00:16 +0900196fn try_main() -> Result<()> {
Jiyong Park2b6346d2023-06-19 13:37:42 +0900197 android_logger::init_once(
198 android_logger::Config::default()
199 .with_tag("microdroid_manager")
200 .with_min_level(log::Level::Info),
201 );
Jooyung Han347d9f22021-05-28 00:05:14 +0900202 info!("started.");
203
Alice Wangfd222fd2023-05-25 09:37:38 +0000204 // SAFETY: This is the only place we take the ownership of the fd of the vm payload service.
205 //
Alice Wang2a5306e2023-06-05 09:18:32 +0000206 // To ensure that the CLOEXEC flag is set on the file descriptor as early as possible,
207 // it is necessary to fetch the socket corresponding to vm_payload_service at the
208 // very beginning, as android_get_control_socket() sets the CLOEXEC flag on the file
209 // descriptor.
Alice Wangfd222fd2023-05-25 09:37:38 +0000210 let vm_payload_service_fd = unsafe { prepare_vm_payload_service_socket()? };
Inseob Kim090b70b2022-11-16 20:01:14 +0900211
Jiyong Park202856e2022-08-22 16:04:26 +0900212 load_crashkernel_if_supported().context("Failed to load crashkernel")?;
213
Alice Wangeff58392023-07-04 13:32:09 +0000214 swap::init_swap().context("Failed to initialize swap")?;
Keir Fraser933f0ac2022-10-12 08:23:28 +0000215 info!("swap enabled.");
216
Inseob Kim11f40d02022-06-13 17:16:00 +0900217 let service = get_vms_rpc_binder()
218 .context("cannot connect to VirtualMachineService")
219 .map_err(|e| MicrodroidError::FailedToConnectToVirtualizationService(e.to_string()))?;
Seungjae Yoofd9a0622022-10-14 10:01:29 +0900220
Alice Wangfd222fd2023-05-25 09:37:38 +0000221 match try_run_payload(&service, vm_payload_service_fd) {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900222 Ok(code) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900223 if code == 0 {
224 info!("task successfully finished");
225 } else {
226 error!("task exited with exit code: {}", code);
227 }
Shikha Panwardef7ef92023-01-06 08:35:48 +0000228 if let Err(e) = post_payload_work() {
229 error!(
230 "Failed to run post payload work. It is possible that certain tasks
231 like syncing encrypted store might be incomplete. Error: {:?}",
232 e
233 );
234 };
235
236 info!("notifying payload finished");
237 service.notifyPayloadFinished(code)?;
Jooyung Han5c6d4172021-12-06 14:17:52 +0900238 Ok(())
239 }
240 Err(err) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900241 let (error_code, message) = translate_error(&err);
242 service.notifyError(error_code, &message)?;
243 Err(err)
244 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900245 }
246}
247
Shikha Panwardef7ef92023-01-06 08:35:48 +0000248fn post_payload_work() -> Result<()> {
249 // Sync the encrypted storage filesystem (flushes the filesystem caches).
250 if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() {
251 let mountpoint = CString::new(ENCRYPTEDSTORE_MOUNTPOINT).unwrap();
252
Andrew Walbranae3350d2023-07-21 19:01:18 +0100253 // SAFETY: `mountpoint` is a valid C string. `syncfs` and `close` are safe for any parameter
254 // values.
Shikha Panwardef7ef92023-01-06 08:35:48 +0000255 let ret = unsafe {
256 let dirfd = libc::open(
257 mountpoint.as_ptr(),
258 libc::O_DIRECTORY | libc::O_RDONLY | libc::O_CLOEXEC,
259 );
260 ensure!(dirfd >= 0, "Unable to open {:?}", mountpoint);
261 let ret = libc::syncfs(dirfd);
262 libc::close(dirfd);
263 ret
264 };
265 if ret != 0 {
266 error!("failed to sync encrypted storage.");
267 return Err(anyhow!(std::io::Error::last_os_error()));
268 }
269 }
270 Ok(())
271}
Alan Stokes1f417c92022-09-29 15:13:28 +0100272
Andrew Scullab72ec52022-03-14 09:10:52 +0000273fn is_strict_boot() -> bool {
274 Path::new(AVF_STRICT_BOOT).exists()
275}
276
277fn is_new_instance() -> bool {
278 Path::new(AVF_NEW_INSTANCE).exists()
279}
280
Inseob Kime379e7d2022-07-22 18:55:18 +0900281fn is_verified_boot() -> bool {
282 !Path::new(DEBUG_MICRODROID_NO_VERIFIED_BOOT).exists()
283}
284
Alan Stokes1125e012023-10-13 12:31:10 +0100285fn is_debuggable() -> Result<bool> {
286 Ok(system_properties::read_bool(DEBUGGABLE_PROP, true)?)
287}
288
Inseob Kimab1037d2023-02-08 17:03:31 +0900289fn should_export_tombstones(config: &VmPayloadConfig) -> bool {
290 match config.export_tombstones {
291 Some(b) => b,
Alan Stokes1125e012023-10-13 12:31:10 +0100292 None => is_debuggable().unwrap_or(false),
Inseob Kimab1037d2023-02-08 17:03:31 +0900293 }
294}
295
Jaewan Kim3124ef02023-03-23 19:25:20 +0900296/// Get debug policy value in bool. It's true iff the value is explicitly set to <1>.
297fn get_debug_policy_bool(path: &'static str) -> Result<Option<bool>> {
298 let mut file = match File::open(path) {
299 Ok(dp) => dp,
300 Err(e) => {
Jaewan Kim476ecd42023-08-28 05:57:00 +0000301 info!(
302 "Assumes that debug policy is disabled because failed to read debug policy ({e:?})"
303 );
Jaewan Kim3124ef02023-03-23 19:25:20 +0900304 return Ok(Some(false));
305 }
306 };
307 let mut log: [u8; 4] = Default::default();
308 file.read_exact(&mut log).context("Malformed data in {path}")?;
309 // DT spec uses big endian although Android is always little endian.
310 Ok(Some(u32::from_be_bytes(log) == 1))
311}
312
Alice Wangfd222fd2023-05-25 09:37:38 +0000313fn try_run_payload(
314 service: &Strong<dyn IVirtualMachineService>,
315 vm_payload_service_fd: OwnedFd,
316) -> Result<i32> {
Jooyung Han311b1202021-09-14 22:00:16 +0900317 let metadata = load_metadata().context("Failed to load payload metadata")?;
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000318 let dice = DiceDriver::new(Path::new("/dev/open-dice0")).context("Failed to load DICE")?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900319
Jooyung Han311b1202021-09-14 22:00:16 +0900320 let mut instance = InstanceDisk::new().context("Failed to load instance.img")?;
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000321 let saved_data =
322 instance.read_microdroid_data(&dice).context("Failed to read identity data")?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900323
Andrew Scullab72ec52022-03-14 09:10:52 +0000324 if is_strict_boot() {
325 // Provisioning must happen on the first boot and never again.
326 if is_new_instance() {
327 ensure!(
328 saved_data.is_none(),
329 MicrodroidError::InvalidConfig("Found instance data on first boot.".to_string())
330 );
331 } else {
332 ensure!(
333 saved_data.is_some(),
334 MicrodroidError::InvalidConfig("Instance data not found.".to_string())
335 );
336 };
337 }
338
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900339 // Verify the payload before using it.
Inseob Kim11f40d02022-06-13 17:16:00 +0900340 let verified_data = verify_payload(&metadata, saved_data.as_ref())
341 .context("Payload verification failed")
342 .map_err(|e| MicrodroidError::PayloadVerificationFailed(e.to_string()))?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900343
344 // In case identity is ignored (by debug policy), we should reuse existing payload data, even
345 // when the payload is changed. This is to keep the derived secret same as before.
346 let verified_data = if let Some(saved_data) = saved_data {
347 if !is_verified_boot() {
348 if saved_data != verified_data {
349 info!("Detected an update of the payload, but continue (regarding debug policy)")
350 }
351 } else {
352 ensure!(
353 saved_data == verified_data,
354 MicrodroidError::PayloadChanged(String::from(
355 "Detected an update of the payload which isn't supported yet."
356 ))
357 );
358 info!("Saved data is verified.");
359 }
360 saved_data
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900361 } else {
Jooyung Han7a343f92021-09-08 22:53:11 +0900362 info!("Saving verified data.");
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000363 instance
364 .write_microdroid_data(&verified_data, &dice)
365 .context("Failed to write identity data")?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900366 verified_data
367 };
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900368
Alan Stokes1f417c92022-09-29 15:13:28 +0100369 let payload_metadata = metadata.payload.ok_or_else(|| {
370 MicrodroidError::InvalidConfig("No payload config in metadata".to_string())
371 })?;
Alan Stokes0d1ef782022-09-27 13:46:35 +0100372
Inseob Kimb2519c52022-04-14 02:10:09 +0900373 // To minimize the exposure to untrusted data, derive dice profile as soon as possible.
374 info!("DICE derivation for payload");
Alice Wang62f7e642023-02-10 09:55:13 +0000375 let dice_artifacts = dice_derivation(dice, &verified_data, &payload_metadata)?;
Shikha Panwar95084df2023-07-22 11:47:45 +0000376 let vm_secret = VmSecret::new(dice_artifacts).context("Failed to create VM secrets")?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000377
378 // Run encryptedstore binary to prepare the storage
379 let encryptedstore_child = if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() {
380 info!("Preparing encryptedstore ...");
Shikha Panwar95084df2023-07-22 11:47:45 +0000381 Some(prepare_encryptedstore(&vm_secret).context("encryptedstore run")?)
Shikha Panwar566c9672022-11-15 14:39:58 +0000382 } else {
383 None
384 };
Inseob Kimb2519c52022-04-14 02:10:09 +0900385
Alan Stokes960c9032022-12-07 16:53:45 +0000386 let mut zipfuse = Zipfuse::default();
387
Jooyung Hana6d11eb2021-09-10 11:48:05 +0900388 // Before reading a file from the APK, start zipfuse
Alan Stokes960c9032022-12-07 16:53:45 +0000389 zipfuse.mount(
Alan Stokes60f82202022-10-07 16:40:07 +0100390 MountForExec::Allowed,
Inseob Kim217038e2021-11-25 11:15:06 +0900391 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0",
Alan Stokes1125e012023-10-13 12:31:10 +0100392 Path::new(verify::DM_MOUNTED_APK_PATH),
Alice Wang6bbb6da2022-10-26 12:44:06 +0000393 Path::new(VM_APK_CONTENTS_PATH),
Alan Stokes960c9032022-12-07 16:53:45 +0000394 "microdroid_manager.apk.mounted".to_owned(),
395 )?;
Jiyong Park21ce2c52021-08-28 02:32:17 +0900396
Andrew Scull4d262dc2022-10-21 13:14:33 +0000397 // Restricted APIs are only allowed to be used by platform or test components. Infer this from
398 // the use of a VM config file since those can only be used by platform and test components.
399 let allow_restricted_apis = match payload_metadata {
Ludovic Barman93ee3082023-06-20 12:18:43 +0000400 PayloadMetadata::ConfigPath(_) => true,
401 PayloadMetadata::Config(_) => false,
402 _ => false, // default is false for safety
Andrew Scull4d262dc2022-10-21 13:14:33 +0000403 };
404
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100405 let config = load_config(payload_metadata).context("Failed to load payload metadata")?;
Shikha Panwar6f03c942022-04-13 20:26:50 +0000406
Alan Stokes01b3ef02022-09-22 17:43:24 +0100407 let task = config
408 .task
409 .as_ref()
410 .ok_or_else(|| MicrodroidError::InvalidConfig("No task in VM config".to_string()))?;
411
Alice Wang061478b2023-04-11 13:26:17 +0000412 ensure!(
413 config.extra_apks.len() == verified_data.extra_apks_data.len(),
414 "config expects {} extra apks, but found {}",
415 config.extra_apks.len(),
416 verified_data.extra_apks_data.len()
417 );
Alan Stokes960c9032022-12-07 16:53:45 +0000418 mount_extra_apks(&config, &mut zipfuse)?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900419
Jooyung Han5c6d4172021-12-06 14:17:52 +0900420 // Wait until apex config is done. (e.g. linker configuration for apexes)
Jooyung Han5c6d4172021-12-06 14:17:52 +0900421 wait_for_apex_config_done()?;
422
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000423 setup_config_sysprops(&config)?;
424
Shikha Panwar1a6efcd2023-02-03 19:23:43 +0000425 // Set export_tombstones if enabled
Inseob Kimab1037d2023-02-08 17:03:31 +0900426 if should_export_tombstones(&config) {
Shikha Panwar1a6efcd2023-02-03 19:23:43 +0000427 // This property is read by tombstone_handler.
428 system_properties::write("microdroid_manager.export_tombstones.enabled", "1")
429 .context("set microdroid_manager.export_tombstones.enabled")?;
Inseob Kimcd9c1dd2022-07-13 17:13:45 +0900430 }
431
Alan Stokes960c9032022-12-07 16:53:45 +0000432 // Wait until zipfuse has mounted the APKs so we can access the payload
433 zipfuse.wait_until_done()?;
Alan Stokes60f82202022-10-07 16:40:07 +0100434
Alice Wangfd222fd2023-05-25 09:37:38 +0000435 register_vm_payload_service(
436 allow_restricted_apis,
437 service.clone(),
Shikha Panwar95084df2023-07-22 11:47:45 +0000438 vm_secret,
Alice Wangfd222fd2023-05-25 09:37:38 +0000439 vm_payload_service_fd,
440 )?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000441
Shikha Panwarddc124b2022-11-28 19:17:54 +0000442 // Wait for encryptedstore to finish mounting the storage (if enabled) before setting
443 // microdroid_manager.init_done. Reason is init stops uneventd after that.
444 // Encryptedstore, however requires ueventd
Shikha Panwar566c9672022-11-15 14:39:58 +0000445 if let Some(mut child) = encryptedstore_child {
446 let exitcode = child.wait().context("Wait for encryptedstore child")?;
447 ensure!(exitcode.success(), "Unable to prepare encrypted storage. Exitcode={}", exitcode);
448 }
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100449
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000450 wait_for_property_true("dev.bootcomplete").context("failed waiting for dev.bootcomplete")?;
Shikha Panwar3f6f6a52022-11-29 17:28:36 +0000451 system_properties::write("microdroid_manager.init_done", "1")
452 .context("set microdroid_manager.init_done")?;
Inseob Kimc16b0cc2023-01-26 14:57:24 +0900453
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000454 info!("boot completed, time to run payload");
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100455 exec_task(task, service).context("Failed to run payload")
Alan Stokes01b3ef02022-09-22 17:43:24 +0100456}
457
Alan Stokes60f82202022-10-07 16:40:07 +0100458enum MountForExec {
459 Allowed,
460 Disallowed,
461}
462
Alan Stokes960c9032022-12-07 16:53:45 +0000463#[derive(Default)]
464struct Zipfuse {
465 ready_properties: Vec<String>,
466}
467
468impl Zipfuse {
469 fn mount(
470 &mut self,
471 noexec: MountForExec,
472 option: &str,
473 zip_path: &Path,
474 mount_dir: &Path,
475 ready_prop: String,
476 ) -> Result<Child> {
477 let mut cmd = Command::new(ZIPFUSE_BIN);
478 if let MountForExec::Disallowed = noexec {
479 cmd.arg("--noexec");
480 }
Alan Stokes1294f942023-08-21 14:34:12 +0100481 // Let root own the files in APK, so we can access them, but set the group to
482 // allow all payloads to have access too.
483 let (uid, gid) = (microdroid_uids::ROOT_UID, microdroid_uids::MICRODROID_PAYLOAD_GID);
484
Alan Stokes960c9032022-12-07 16:53:45 +0000485 cmd.args(["-p", &ready_prop, "-o", option]);
Alan Stokes1294f942023-08-21 14:34:12 +0100486 cmd.args(["-u", &uid.to_string()]);
487 cmd.args(["-g", &gid.to_string()]);
Alan Stokes960c9032022-12-07 16:53:45 +0000488 cmd.arg(zip_path).arg(mount_dir);
489 self.ready_properties.push(ready_prop);
490 cmd.spawn().with_context(|| format!("Failed to run zipfuse for {mount_dir:?}"))
Andrew Scullcc339a12022-07-04 12:44:19 +0000491 }
Alan Stokes960c9032022-12-07 16:53:45 +0000492
493 fn wait_until_done(self) -> Result<()> {
494 // We check the last-started check first in the hope that by the time it is done
495 // all or most of the others will also be done, minimising the number of times we
496 // block on a property.
497 for property in self.ready_properties.into_iter().rev() {
498 wait_for_property_true(&property)
499 .with_context(|| format!("Failed waiting for {property}"))?;
500 }
501 Ok(())
Alan Stokes60f82202022-10-07 16:40:07 +0100502 }
Inseob Kim217038e2021-11-25 11:15:06 +0900503}
504
Inseob Kime379e7d2022-07-22 18:55:18 +0900505fn write_apex_payload_data(
506 saved_data: Option<&MicrodroidData>,
507 apex_data_from_payload: &[ApexData],
508) -> Result<()> {
509 if let Some(saved_apex_data) = saved_data.map(|d| &d.apex_data) {
510 // We don't support APEX updates. (assuming that update will change root digest)
511 ensure!(
512 saved_apex_data == apex_data_from_payload,
513 MicrodroidError::PayloadChanged(String::from("APEXes have changed."))
514 );
515 let apex_metadata = to_metadata(apex_data_from_payload);
516 // Pass metadata(with public keys and root digests) to apexd so that it uses the passed
517 // metadata instead of the default one (/dev/block/by-name/payload-metadata)
518 OpenOptions::new()
519 .create_new(true)
520 .write(true)
521 .open("/apex/vm-payload-metadata")
522 .context("Failed to open /apex/vm-payload-metadata")
523 .and_then(|f| write_metadata(&apex_metadata, f))?;
524 }
525 Ok(())
526}
527
Alan Stokes960c9032022-12-07 16:53:45 +0000528fn mount_extra_apks(config: &VmPayloadConfig, zipfuse: &mut Zipfuse) -> Result<()> {
Inseob Kim197748b2021-12-01 19:49:00 +0900529 // For now, only the number of apks is important, as the mount point and dm-verity name is fixed
530 for i in 0..config.extra_apks.len() {
Alan Stokes960c9032022-12-07 16:53:45 +0000531 let mount_dir = format!("/mnt/extra-apk/{i}");
Inseob Kim197748b2021-12-01 19:49:00 +0900532 create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?;
533
Alan Stokes92789f12023-09-29 14:55:42 +0100534 let mount_for_exec =
535 if cfg!(multi_tenant) { MountForExec::Allowed } else { MountForExec::Disallowed };
536 // These run asynchronously in parallel - we wait later for them to complete.
Alan Stokes960c9032022-12-07 16:53:45 +0000537 zipfuse.mount(
Alan Stokes92789f12023-09-29 14:55:42 +0100538 mount_for_exec,
Inseob Kim197748b2021-12-01 19:49:00 +0900539 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0",
Alan Stokes960c9032022-12-07 16:53:45 +0000540 Path::new(&format!("/dev/block/mapper/extra-apk-{i}")),
Inseob Kim197748b2021-12-01 19:49:00 +0900541 Path::new(&mount_dir),
Alan Stokes960c9032022-12-07 16:53:45 +0000542 format!("microdroid_manager.extra_apk.mounted.{i}"),
543 )?;
Inseob Kim197748b2021-12-01 19:49:00 +0900544 }
545
546 Ok(())
547}
548
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000549fn setup_config_sysprops(config: &VmPayloadConfig) -> Result<()> {
550 if config.enable_authfs {
551 system_properties::write("microdroid_manager.authfs.enabled", "1")
552 .context("failed to write microdroid_manager.authfs.enabled")?;
553 }
554 system_properties::write("microdroid_manager.config_done", "1")
555 .context("failed to write microdroid_manager.config_done")?;
556 Ok(())
557}
558
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900559// Waits until linker config is generated
560fn wait_for_apex_config_done() -> Result<()> {
Alan Stokes60f82202022-10-07 16:40:07 +0100561 wait_for_property_true(APEX_CONFIG_DONE_PROP).context("Failed waiting for apex config done")
562}
563
564fn wait_for_property_true(property_name: &str) -> Result<()> {
565 let mut prop = PropertyWatcher::new(property_name)?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900566 loop {
Andrew Walbrand9c766e2023-05-10 15:15:39 +0000567 prop.wait(None)?;
Alan Stokes60f82202022-10-07 16:40:07 +0100568 if system_properties::read_bool(property_name, false)? {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900569 break;
570 }
571 }
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900572 Ok(())
573}
574
Alan Stokes1f417c92022-09-29 15:13:28 +0100575fn load_config(payload_metadata: PayloadMetadata) -> Result<VmPayloadConfig> {
576 match payload_metadata {
Ludovic Barman93ee3082023-06-20 12:18:43 +0000577 PayloadMetadata::ConfigPath(path) => {
Alan Stokes1f417c92022-09-29 15:13:28 +0100578 let path = Path::new(&path);
579 info!("loading config from {:?}...", path);
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100580 let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)
581 .with_context(|| format!("Failed to read {:?}", path))?;
Alan Stokes1f417c92022-09-29 15:13:28 +0100582 Ok(serde_json::from_reader(file)?)
583 }
Ludovic Barman93ee3082023-06-20 12:18:43 +0000584 PayloadMetadata::Config(payload_config) => {
Alan Stokes1f417c92022-09-29 15:13:28 +0100585 let task = Task {
586 type_: TaskType::MicrodroidLauncher,
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000587 command: payload_config.payload_binary_name,
Alan Stokes1f417c92022-09-29 15:13:28 +0100588 };
589 Ok(VmPayloadConfig {
590 os: OsConfig { name: "microdroid".to_owned() },
591 task: Some(task),
592 apexes: vec![],
593 extra_apks: vec![],
594 prefer_staged: false,
Inseob Kimab1037d2023-02-08 17:03:31 +0900595 export_tombstones: None,
Alan Stokes1f417c92022-09-29 15:13:28 +0100596 enable_authfs: false,
597 })
598 }
Ludovic Barman93ee3082023-06-20 12:18:43 +0000599 _ => bail!("Failed to match config against a config type."),
Alan Stokes1f417c92022-09-29 15:13:28 +0100600 }
Jooyung Han634e2d72021-06-10 16:27:38 +0900601}
602
Jaewan Kim3124ef02023-03-23 19:25:20 +0900603/// Loads the crashkernel into memory using kexec if debuggable or debug policy says so.
604/// The VM should be loaded with `crashkernel=' parameter in the cmdline to allocate memory
605/// for crashkernel.
Jiyong Park202856e2022-08-22 16:04:26 +0900606fn load_crashkernel_if_supported() -> Result<()> {
607 let supported = std::fs::read_to_string("/proc/cmdline")?.contains(" crashkernel=");
608 info!("ramdump supported: {}", supported);
Jaewan Kim3124ef02023-03-23 19:25:20 +0900609
610 if !supported {
611 return Ok(());
612 }
613
Alan Stokes1125e012023-10-13 12:31:10 +0100614 let debuggable = is_debuggable()?;
Jaewan Kim3124ef02023-03-23 19:25:20 +0900615 let ramdump = get_debug_policy_bool(AVF_DEBUG_POLICY_RAMDUMP)?.unwrap_or_default();
616 let requested = debuggable | ramdump;
617
618 if requested {
Jiyong Park202856e2022-08-22 16:04:26 +0900619 let status = Command::new("/system/bin/kexec_load").status()?;
620 if !status.success() {
621 return Err(anyhow!("Failed to load crashkernel: {:?}", status));
622 }
Jaewan Kim3124ef02023-03-23 19:25:20 +0900623 info!("ramdump is loaded: debuggable={debuggable}, ramdump={ramdump}");
Jiyong Park202856e2022-08-22 16:04:26 +0900624 }
625 Ok(())
626}
627
Inseob Kim090b70b2022-11-16 20:01:14 +0900628/// Executes the given task.
Jooyung Han5c6d4172021-12-06 14:17:52 +0900629fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900630 info!("executing main task {:?}...", task);
David Brazdil451cc962022-10-14 14:08:12 +0100631 let mut command = match task.type_ {
Alan Stokes1294f942023-08-21 14:34:12 +0100632 TaskType::Executable => {
Alan Stokes679ddf32023-09-01 11:14:48 +0100633 // TODO(b/297501338): Figure out how to handle non-root for system payloads.
Alan Stokes1294f942023-08-21 14:34:12 +0100634 Command::new(&task.command)
635 }
David Brazdil451cc962022-10-14 14:08:12 +0100636 TaskType::MicrodroidLauncher => {
637 let mut command = Command::new("/system/bin/microdroid_launcher");
638 command.arg(find_library_path(&task.command)?);
Alan Stokes1294f942023-08-21 14:34:12 +0100639 command.uid(microdroid_uids::MICRODROID_PAYLOAD_UID);
640 command.gid(microdroid_uids::MICRODROID_PAYLOAD_GID);
David Brazdil451cc962022-10-14 14:08:12 +0100641 command
642 }
643 };
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000644
Andrew Walbranaac68302023-07-21 19:05:34 +0100645 // SAFETY: We are not accessing any resource of the parent process. This means we can't make any
646 // log calls inside the closure.
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000647 unsafe {
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000648 command.pre_exec(|| {
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000649 // It is OK to continue with payload execution even if the calls below fail, since
650 // whether process can use a capability is controlled by the SELinux. Dropping the
651 // capabilities here is just another defense-in-depth layer.
Andrew Walbranaac68302023-07-21 19:05:34 +0100652 let _ = cap::drop_inheritable_caps();
653 let _ = cap::drop_bounding_set();
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000654 Ok(())
655 });
656 }
657
Inseob Kim090b70b2022-11-16 20:01:14 +0900658 command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
Inseob Kim7f61fe72021-08-20 20:50:47 +0900659
660 info!("notifying payload started");
Inseob Kimc7d28c72021-10-25 14:28:10 +0000661 service.notifyPayloadStarted()?;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900662
Inseob Kim86ca0162021-10-20 02:21:02 +0000663 let exit_status = command.spawn()?.wait()?;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -0800664 match exit_status.code() {
665 Some(exit_code) => Ok(exit_code),
666 None => Err(match exit_status.signal() {
667 Some(signal) => anyhow!(
668 "Payload exited due to signal: {} ({})",
669 signal,
670 Signal::try_from(signal).map_or("unknown", |s| s.as_str())
671 ),
672 None => anyhow!("Payload has neither exit code nor signal"),
673 }),
674 }
Jooyung Han347d9f22021-05-28 00:05:14 +0900675}
Jooyung Han634e2d72021-06-10 16:27:38 +0900676
Jooyung Han634e2d72021-06-10 16:27:38 +0900677fn find_library_path(name: &str) -> Result<String> {
678 let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?;
679 let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?;
680 let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?;
Alice Wang6bbb6da2022-10-26 12:44:06 +0000681 let path = format!("{}/lib/{}/{}", VM_APK_CONTENTS_PATH, abi, name);
Jooyung Han634e2d72021-06-10 16:27:38 +0900682
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100683 let metadata = fs::metadata(&path).with_context(|| format!("Unable to access {}", path))?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900684 if !metadata.is_file() {
685 bail!("{} is not a file", &path);
686 }
687
688 Ok(path)
689}
Jiyong Park21ce2c52021-08-28 02:32:17 +0900690
Shikha Panwar95084df2023-07-22 11:47:45 +0000691fn prepare_encryptedstore(vm_secret: &VmSecret) -> Result<Child> {
Alice Wang7e6c9352023-02-15 15:44:13 +0000692 let mut key = ZVec::new(ENCRYPTEDSTORE_KEYSIZE)?;
Shikha Panwar3d3a70a2023-08-21 20:02:08 +0000693 vm_secret.derive_encryptedstore_key(&mut key)?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000694 let mut cmd = Command::new(ENCRYPTEDSTORE_BIN);
695 cmd.arg("--blkdevice")
696 .arg(ENCRYPTEDSTORE_BACKING_DEVICE)
697 .arg("--key")
698 .arg(hex::encode(&*key))
Shikha Panwar9fd198f2022-11-18 17:43:43 +0000699 .args(["--mountpoint", ENCRYPTEDSTORE_MOUNTPOINT])
Shikha Panwar566c9672022-11-15 14:39:58 +0000700 .spawn()
701 .context("encryptedstore failed")
702}