Rework wakeup SELinux policy for ACPI and block virtio PCI nodes Currently genfscon is used to set sysfs_wakeup context for sysfs files of ACPI and block devices associated with virtio PCI devices. Since genfscon only supports path prefixes it requires adding entries for each device. This means that we need to update the SELinux policy everytime a new virtio device is added which is easily missed and is hard to maintain. This patch rework the SELinux policy to use file_contexts which supports full regular expressions. This simplifies the policy as there are now only two rules for ACPI devices (one for crosvm and one for qemu) instead of the few tens before. It also simplifies the process of adding new virtio devices as now the SELinux policy does not need to be updated with each new virtio device. Bug: 307608726 Test: check no avc denial regressions at boot for both qemu (x86, arm64, riscv64) and crosvm (x86) Change-Id: Iec1492420aae55ed3abfd4315d55f7a70191c135
Make sure virtualization with KVM is available.
grep -c -w "vmx\|svm" /proc/cpuinfo
This should return a non-zero value. If running on a cloud machine, this may take cloud-vendor-specific steps to enable. For Google Compute Engine specifically, see the GCE guide.
ARM specific steps:
/dev/kvm. Note that this method can also be used to confirm support of KVM on any environment.Download, build, and install the host debian packages:
sudo apt install -y git devscripts config-package-dev debhelper-compat golang curl git clone https://github.com/google/android-cuttlefish cd android-cuttlefish for dir in base frontend; do cd $dir debuild -i -us -uc -b -d cd .. done sudo dpkg -i ./cuttlefish-base_*_*64.deb || sudo apt-get install -f sudo dpkg -i ./cuttlefish-user_*_*64.deb || sudo apt-get install -f sudo usermod -aG kvm,cvdnetwork,render $USER sudo reboot
The reboot will trigger installing additional kernel modules and applying udev rules.
Go to http://ci.android.com/
Enter a branch name. Start with aosp-master if you don‘t know what you’re looking for
Navigate to aosp_cf_x86_64_phone and click on userdebug for the latest build
aosp-master-throttled-copped and device target aosp_cf_arm64_only_phone-userdebugClick on Artifacts
Scroll down to the OTA images. These packages look like aosp_cf_x86_64_phone-img-xxxxxx.zip -- it will always have img in the name. Download this file
Scroll down to cvd-host_package.tar.gz. You should always download a host package from the same build as your images.
On your local system, combine the packages:
mkdir cf cd cf tar xvf /path/to/cvd-host_package.tar.gz unzip /path/to/aosp_cf_x86_64_phone-img-xxxxxx.zip
Launch cuttlefish with:
$ HOME=$PWD ./bin/launch_cvd
You can use adb to debug it, just like a physical device:
$ ./bin/adb -e shell
When launching with ---start_webrtc (the default), you can see a list of all available devices at https://localhost:8443 . For more information, see the WebRTC on Cuttlefish documentation.
You will need to stop the virtual device within the same directory as you used to launch the device.
$ HOME=$PWD ./bin/stop_cvd