pa-fazil
/
android_packages_modules_Virtualization
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
android_packages_modules_Vi.../microdroid_manager/Android.bp

76 lines
1.7 KiB
Plaintext
Raw Normal View History

microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
package {
default_applicable_licenses: ["Android-Apache-2.0"],
}
microdroid_manager: waits for a config file Ideally, microdroid_manager should start zipfuse only if necessary and access the VM config file from the APK via fusefs when it's ready. But for now zipfuse doesn't report when it's ready to access files in a zip file. So, microdroid_manager should wait a while to access the config file when it is from the APK. Bug: 189301496 Test: MicrodroidHostTestCases Test: microdroid_manager_test Change-Id: I0dc304a8f135f52a846fc1bb6f4e476f6162697a
2021-06-01 09:00:04 +00:00
rust_defaults {
name: "microdroid_manager_defaults",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
crate_name: "microdroid_manager",
srcs: ["src/main.rs"],
Migrate to Rust 2021 edition I only wanted this in one place, but thought we might as well do it all in one go. In a couple of places I added an explicit edition instead of using the default (whatever that is). See https://doc.rust-lang.org/edition-guide/rust-2021/index.html. Test: find . -name "Android.bp" -type f|xargs grep edition | grep -v 2021 Test: atest ComposHostTestCases MicrodroidHostTestCases Change-Id: I4de050078b303cc5614d230e0d36d5454d60a807
2022-08-31 12:41:28 +00:00
edition: "2021",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
prefer_rlib: true,
rustlibs: [
Do a DICE derivation for the payload Send measurements of the payload to diced so that it can derive CDIs for the payload to use. Bug: 214231981 Test: run microdroid Change-Id: I931b0835128cb0ab5ce537ec388b0d03c5ca201a
2022-01-21 14:41:34 +00:00
"android.hardware.security.dice-V1-rust",
Encrypt instance.img data with key from sealing CDI Microdroid connects to diced to retreive the sealing CDI from which it derives the key used to encrypt the instance.img data. Bug: 214231981 Test: run microdroid Change-Id: Ifee99e3c55b649d236fefcbbc9132613fd35660e
2022-01-21 14:36:55 +00:00
"android.security.dice-rust",
Add VirtualMachineService skeleton code VirtualMachineService (the name isn't yet fixed) is a binder service between virt service and guest VMs. Guest VMs can notify that it's ready over VirtualMachineService. Bug: 191845268 Test: atest MicrodroidHostTestCases Change-Id: I80c529f104fe184a1bdbee25805c7871392336d5
2021-08-19 04:17:40 +00:00
"android.system.virtualizationservice-rust",
"android.system.virtualmachineservice-rust",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
"libanyhow",
Move APEX handling to a library Make a library for APEX handling using the microdroid_manager logic as the basis. Other components are going to need to be able to extract the keys from APEXs so make the logic reusable and available to host tools. Test: atest microdroid_manager_test Test: atest libapexutil_rust.test Change-Id: I36abf21b59b67046b1464bf47f7be40186926410
2022-04-25 18:13:21 +00:00
"libapexutil_rust",
microdroid_manager: verify APK/APEXes Even though libapkverify doesn't do much verification for now, having it in use would make CI detect errors in the future. TODO: - zipfuse should wait until APK is verified. - boot should abort when verification fails. Bug: 190343842 Test: MicrodroidHostTestCases Change-Id: I221be1c7d9a0bfcd312593d3958f950311b67af5
2021-08-06 05:08:16 +00:00
"libapkverify",
Add VirtualMachineService skeleton code VirtualMachineService (the name isn't yet fixed) is a binder service between virt service and guest VMs. Guest VMs can notify that it's ready over VirtualMachineService. Bug: 191845268 Test: atest MicrodroidHostTestCases Change-Id: I80c529f104fe184a1bdbee25805c7871392336d5
2021-08-19 04:17:40 +00:00
"libbinder_rs",
Store apk root hash to the instance disk The instance disk has been created, but hasn't actually been used. This CL is the first step towards actually using it. Specifically, this CL * provides routines for navigating the instance disk. The disk consists of a disk header, followed by partitions each of which consists of a header and payload. Each partition is dedicated to a program loader like pVM firmware, Android Boot Loader, and microdroid_manager. A partition is identified by UUID and this CL provides a routine to locate the partition for a given UUID. * provides routines for reading and writing on payload in a partition. The data is stored encrypted when it is written and is decrypted when read. The key is currently hard-coded but, it will eventually be derived from the sealing CDI from the previous stage. * Root hash of an apk extracted from the idsig file is stored to the disk. Note that the stored root hash is not yet used by apkdmverity. It shall be done in a follow-up change. Bug: 193504400 Test: boot microdroid twice. check that the root hash is written to the disk during the first boot, and then read during the second boot. Also check that the two root hashes are the same. Change-Id: Ia1afcda4d8444ad52a47ebcc659b2698159da816
2021-08-27 17:32:17 +00:00
"libbyteorder",
Do a DICE derivation for the payload Send measurements of the payload to diced so that it can derive CDIs for the payload to use. Bug: 214231981 Test: run microdroid Change-Id: I931b0835128cb0ab5ce537ec388b0d03c5ca201a
2022-01-21 14:41:34 +00:00
"libdiced_utils",
Verify and mount extra apks virtualizationservice currently passes extra apks and corresponding idsigs as block devices. microdroid_manager will read the payload config and mount the apks to /mnt/extra-apk/{index} after verifying them. Bug: 205224817 Test: atest ComposHostTestCases MicrodroidHostTestCases Test: manually edit vm config and see apks mounted Change-Id: I9afa03cb7fabe0ca16b7926c4480d0b32c8bcd04
2021-12-01 10:49:00 +00:00
"libglob",
Store apk root hash to the instance disk The instance disk has been created, but hasn't actually been used. This CL is the first step towards actually using it. Specifically, this CL * provides routines for navigating the instance disk. The disk consists of a disk header, followed by partitions each of which consists of a header and payload. Each partition is dedicated to a program loader like pVM firmware, Android Boot Loader, and microdroid_manager. A partition is identified by UUID and this CL provides a routine to locate the partition for a given UUID. * provides routines for reading and writing on payload in a partition. The data is stored encrypted when it is written and is decrypted when read. The key is currently hard-coded but, it will eventually be derived from the sealing CDI from the previous stage. * Root hash of an apk extracted from the idsig file is stored to the disk. Note that the stored root hash is not yet used by apkdmverity. It shall be done in a follow-up change. Bug: 193504400 Test: boot microdroid twice. check that the root hash is written to the disk during the first boot, and then read during the second boot. Also check that the two root hashes are the same. Change-Id: Ia1afcda4d8444ad52a47ebcc659b2698159da816
2021-08-27 17:32:17 +00:00
"libidsig",
Verify and mount extra apks virtualizationservice currently passes extra apks and corresponding idsigs as block devices. microdroid_manager will read the payload config and mount the apks to /mnt/extra-apk/{index} after verifying them. Bug: 205224817 Test: atest ComposHostTestCases MicrodroidHostTestCases Test: manually edit vm config and see apks mounted Change-Id: I9afa03cb7fabe0ca16b7926c4480d0b32c8bcd04
2021-12-01 10:49:00 +00:00
"libitertools",
microdroid_manager uses kernlog Bug: 189805435 Test: atest MicrodroidTestHostCases adb shell into the VM and execute logcat Change-Id: I2724773c237c4ae208671ee206896679488ba7da
2021-06-25 04:06:25 +00:00
"libkernlog",
microdroid_manager: Migate from ring to the openssl crate Bug: 232676161 Test: atest MicrodroidTests Change-Id: I3a1d5eb2529c397ae253b4bdab396db31db6b56b
2022-05-24 19:32:47 +00:00
"libkeystore2_crypto_rust",
Pass a VM secret to KeyMint from microdroid_manager This secret will be used to protect the keyblobs so that only a VM that gets the same secret will be able to use those blobs. It is held in a system property so that it won't be lost should KeyMint happen to restart and has SELinux rules to ensure only microdroid_manager can set the value and only KeyMint can read the value. Bug: 190578423 Test: atest MicrodroidHostTestCases Change-Id: I675cc9d6e9942090a761b83a6b9456b5c9909747
2021-07-02 12:38:21 +00:00
"liblibc",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
"liblog_rust",
Extract libmicrodroid_metadata (rust_library) from microdroid_manager. Virtualizationservice will use it to make a payload disk image. Bug: 190503456 Test: m Change-Id: Ifd7d2ef60b7a63dcc373a78dbcbe26f472dc1bc7
2021-06-25 03:02:33 +00:00
"libmicrodroid_metadata",
microdroid_manager executes a task via microdroid_launcher Task can be one of "executable" or "microdroid_launcher". When it is a microdroid_launcher task, microdroid_manager find the target library in /mnt/apk/lib/{abi}/, and then executes it via microdroid_launcher. Bug: 186396080 Test: MicrodroidHostTestCases Test: /system/bin/microdroid_manager in microdroid launched with default configuration. it should run testapk's MicrodroidTestNativeLib.so Change-Id: I065f5c5d789e6a96fd658a52ed8533f42b1cbc42
2021-06-10 07:27:38 +00:00
"libmicrodroid_payload_config",
Refactor callback and make payload stream duplex Guest VMs now directly call onPayloadStarted to tell the host that their payload started. And the stream passed by onPayloadStarted is now duplex so it can also be used as an input stream, which will be fed to the payload's stdin. Bug: 191845268 Bug: 195381416 Test: run MicrodroidDemoApp and see output Test: atest MicrodroidHostTestCases ComposHostTestCases AuthFsHostTest Change-Id: Ic72045b4e4d11ab1efb14cb2e95de319ca8f9f97
2021-08-20 11:50:47 +00:00
"libnix",
bootconfig is part of VM identity VM's identity should be changed if debug level is changed. Debug level is implemented using bootconfig. So changing the bootconfig should invalidate the previous identity. This change implements the policy by adding the bootconfig to MicrodroidData and refuses to boot if the saved bootconfig is not the same as the current bootconfig. Bug: 208639280 Test: atest MicrodroidTestApp on oriole_pkvm Change-Id: I63ac0c2ecd7514d9193e655c9258c305c87e2a08
2021-12-06 12:18:38 +00:00
"libonce_cell",
microdroid_manager: Migate from ring to the openssl crate Bug: 232676161 Test: atest MicrodroidTests Change-Id: I3a1d5eb2529c397ae253b4bdab396db31db6b56b
2022-05-24 19:32:47 +00:00
"libopenssl",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
"libprotobuf",
Moved binder_common to rpcbinder package under binder directory. Bug: 234019127 Bug: 184872979 Test: atest compos_key_tests MicrodroidHostTestCases MicrodroidTestApp libbinder_rs-internal_test Change-Id: Iceac394d2341f463362e9bbe8908e5d8a1b3f34f
2022-08-08 15:33:34 +00:00
"librpcbinder_rs",
Migrate to the librustutils system property bindings. Bug: 182498247 Test: Build Change-Id: Ibd1937d9b44ed114dff0dacaabd6f20b81988b0a
2021-07-29 22:53:53 +00:00
"librustutils",
Shutdown VM once payload finishes Bug: 236588647 Test: atest MicrodroidTests MicrodroidHostTestCases Change-Id: I1d9b7bd1fd23048c28f1fb554e5ded1771f666d5
2022-06-21 02:30:22 +00:00
"libscopeguard",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
"libserde",
Data written to instance.img has schema ... so that we can store structured data. Currently the data is encoded in CBOR. Bug: 193504400 Test: atest MicrodroidHostTestCases Change-Id: I271b40f7d2c42fc42d793c36e27ca65cfaa9ba25
2021-09-07 16:42:54 +00:00
"libserde_cbor",
microdroid_manager uses kernlog Bug: 189805435 Test: atest MicrodroidTestHostCases adb shell into the VM and execute logcat Change-Id: I2724773c237c4ae208671ee206896679488ba7da
2021-06-25 04:06:25 +00:00
"libserde_json",
Add notifyError/onError notification for VM errors For now, microdroid_manager shuts down a VM instance when it fails to verify the VM payload. This change adds a new "error" notification to deliver the error to the VM app. Fow now this doesn't change the workflow. In a follow-up change this will be changed so that VM app can decide to shutdown or not "onError". Bug: 205778374 Test: MicrodroidHostTestCases Change-Id: If7fdac3996b69601be0eda17da3e4cf218b4d1d8
2021-11-23 06:26:20 +00:00
"libthiserror",
Store apk root hash to the instance disk The instance disk has been created, but hasn't actually been used. This CL is the first step towards actually using it. Specifically, this CL * provides routines for navigating the instance disk. The disk consists of a disk header, followed by partitions each of which consists of a header and payload. Each partition is dedicated to a program loader like pVM firmware, Android Boot Loader, and microdroid_manager. A partition is identified by UUID and this CL provides a routine to locate the partition for a given UUID. * provides routines for reading and writing on payload in a partition. The data is stored encrypted when it is written and is decrypted when read. The key is currently hard-coded but, it will eventually be derived from the sealing CDI from the previous stage. * Root hash of an apk extracted from the idsig file is stored to the disk. Note that the stored root hash is not yet used by apkdmverity. It shall be done in a follow-up change. Bug: 193504400 Test: boot microdroid twice. check that the root hash is written to the disk during the first boot, and then read during the second boot. Also check that the two root hashes are the same. Change-Id: Ia1afcda4d8444ad52a47ebcc659b2698159da816
2021-08-27 17:32:17 +00:00
"libuuid",
Add the onPayloadStarted callback API The API is called back to the client when the payload starts in the VM. The standard output from the payload is accessible via the ParcelFileDescriptor argument as well. Bug: 192904048 Test: run MicrodroidDemoApp and check that the payload output is shown. Change-Id: Ie2afbb455496eec21617b94940ed4386a4865876
2021-07-09 09:17:44 +00:00
"libvsock",
Store apk root hash to the instance disk The instance disk has been created, but hasn't actually been used. This CL is the first step towards actually using it. Specifically, this CL * provides routines for navigating the instance disk. The disk consists of a disk header, followed by partitions each of which consists of a header and payload. Each partition is dedicated to a program loader like pVM firmware, Android Boot Loader, and microdroid_manager. A partition is identified by UUID and this CL provides a routine to locate the partition for a given UUID. * provides routines for reading and writing on payload in a partition. The data is stored encrypted when it is written and is decrypted when read. The key is currently hard-coded but, it will eventually be derived from the sealing CDI from the previous stage. * Root hash of an apk extracted from the idsig file is stored to the disk. Note that the stored root hash is not yet used by apkdmverity. It shall be done in a follow-up change. Bug: 193504400 Test: boot microdroid twice. check that the root hash is written to the disk during the first boot, and then read during the second boot. Also check that the two root hashes are the same. Change-Id: Ia1afcda4d8444ad52a47ebcc659b2698159da816
2021-08-27 17:32:17 +00:00
"librand",
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
],
Add VirtualMachineService skeleton code VirtualMachineService (the name isn't yet fixed) is a binder service between virt service and guest VMs. Guest VMs can notify that it's ready over VirtualMachineService. Bug: 191845268 Test: atest MicrodroidHostTestCases Change-Id: I80c529f104fe184a1bdbee25805c7871392336d5
2021-08-19 04:17:40 +00:00
shared_libs: [
"libbinder_rpc_unstable",
],
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
init_rc: ["microdroid_manager.rc"],
Store apk root hash to the instance disk The instance disk has been created, but hasn't actually been used. This CL is the first step towards actually using it. Specifically, this CL * provides routines for navigating the instance disk. The disk consists of a disk header, followed by partitions each of which consists of a header and payload. Each partition is dedicated to a program loader like pVM firmware, Android Boot Loader, and microdroid_manager. A partition is identified by UUID and this CL provides a routine to locate the partition for a given UUID. * provides routines for reading and writing on payload in a partition. The data is stored encrypted when it is written and is decrypted when read. The key is currently hard-coded but, it will eventually be derived from the sealing CDI from the previous stage. * Root hash of an apk extracted from the idsig file is stored to the disk. Note that the stored root hash is not yet used by apkdmverity. It shall be done in a follow-up change. Bug: 193504400 Test: boot microdroid twice. check that the root hash is written to the disk during the first boot, and then read during the second boot. Also check that the two root hashes are the same. Change-Id: Ia1afcda4d8444ad52a47ebcc659b2698159da816
2021-08-27 17:32:17 +00:00
multilib: {
lib32: {
enabled: false,
},
},
microdroid_manager: initial impl It is started by init in microdroid and executes a command specified in a VM payload config. Bug: 189301496 Test: MicrodroidHostTestCases (in a microdroid, run /system/bin/microdroid_manager manulally) Change-Id: I85c7e370d4a0dcf58b4aafbe6e9fba73e69c2a44
2021-05-27 15:05:14 +00:00
}
microdroid_manager: waits for a config file Ideally, microdroid_manager should start zipfuse only if necessary and access the VM config file from the APK via fusefs when it's ready. But for now zipfuse doesn't report when it's ready to access files in a zip file. So, microdroid_manager should wait a while to access the config file when it is from the APK. Bug: 189301496 Test: MicrodroidHostTestCases Test: microdroid_manager_test Change-Id: I0dc304a8f135f52a846fc1bb6f4e476f6162697a
2021-06-01 09:00:04 +00:00
rust_binary {
name: "microdroid_manager",
defaults: ["microdroid_manager_defaults"],
Microdroid_manager starts before apexd Microdroid_manager should verify payloads (APEXes, APK) before anything else (including apexd reading APEXes, apkdmverity/zipfuse reading APK). In order to start before apexd, it should be "bootstrap" process (since it can't rely on any apexes including bionic). Bug: 190343842 Test: MicrodroidHostTestCases Change-Id: I682555822fb8f73ea160c4a2ac379549dde35329
2021-07-29 08:21:20 +00:00
bootstrap: true,
microdroid_manager: waits for a config file Ideally, microdroid_manager should start zipfuse only if necessary and access the VM config file from the APK via fusefs when it's ready. But for now zipfuse doesn't report when it's ready to access files in a zip file. So, microdroid_manager should wait a while to access the config file when it is from the APK. Bug: 189301496 Test: MicrodroidHostTestCases Test: microdroid_manager_test Change-Id: I0dc304a8f135f52a846fc1bb6f4e476f6162697a
2021-06-01 09:00:04 +00:00
}
rust_test {
name: "microdroid_manager_test",
defaults: ["microdroid_manager_defaults"],
Put all our tests to general-tests ... because the tests can be built for the generic test_suites target. Bug: N/A Test: watch TH Change-Id: I5a60723a964ac3b8fb92b395f544a9b84f49e9e7
2022-02-04 02:49:31 +00:00
test_suites: ["general-tests"],
microdroid_manager: waits for a config file Ideally, microdroid_manager should start zipfuse only if necessary and access the VM config file from the APK via fusefs when it's ready. But for now zipfuse doesn't report when it's ready to access files in a zip file. So, microdroid_manager should wait a while to access the config file when it is from the APK. Bug: 189301496 Test: MicrodroidHostTestCases Test: microdroid_manager_test Change-Id: I0dc304a8f135f52a846fc1bb6f4e476f6162697a
2021-06-01 09:00:04 +00:00
rustlibs: [
"libtempfile",
],
multilib: {
lib32: {
enabled: false,
},
},
}