From e932ec3fd345b4bbf7cb0596e1765647cb3ff6ff Mon Sep 17 00:00:00 2001 From: "A. Cody Schuffelen" Date: Wed, 12 Aug 2026 11:38:20 -0700 Subject: [PATCH] Include crosvm and secure_env in the debian package crosvm is always built in `opt` to disable debug assertions, which crash over an IO safety issue in sandbox mode. As a side effect, this noticeably improves VM runtime performance. This additionally introduces secure_env into the debian package, which makes the debian package built from the git repository complete enough to launch a device without downloading `cvd-host_package.tar.gz`, with some caveats. To reproduce: ``` $ bazel run //cuttlefish/package:cvd -- fetch \ --default_build=git_main/aosp_cf_x86_64_only_phone-trunk_staging-userdebug \ --target_directory=$HOME/dl \ --host_substitutions=only \ --bootloader_build=aosp_u-boot-mainline/u-boot_crosvm_x86_64 $ bazel run //cuttlefish/package:cvd -- create \ --product_path=$HOME/dl \ --host_path=$HOME/dl \ --reuse \ --enable_wifi=false \ --gpu_mode=guest_swiftshader \ --enable_sandbox=true $ bazel run //cuttlefish/package:cvd -- clear $ bazel run //cuttlefish/package:cvd -- create \ --product_path=$HOME/dl \ --host_path=$HOME/dl \ --reuse \ --enable_wifi=false \ ``` Caveats: - There are no wifi images downloaded, so wifi is disabled. - There is no bootloader prebuilt, so that is added to the fetch command. Bug: b/402274999 --- base/cvd/build_external/crosvm/BUILD.bazel | 15 +++++++ .../build_external/crosvm/transition_opt.bzl | 41 +++++++++++++++++++ .../host/libs/vm_manager/crosvm_manager.cpp | 14 +++---- base/cvd/cuttlefish/package/BUILD.bazel | 8 ++-- 4 files changed, 67 insertions(+), 11 deletions(-) create mode 100644 base/cvd/build_external/crosvm/transition_opt.bzl diff --git a/base/cvd/build_external/crosvm/BUILD.bazel b/base/cvd/build_external/crosvm/BUILD.bazel index b348ef79b89..b9b600ac2ae 100644 --- a/base/cvd/build_external/crosvm/BUILD.bazel +++ b/base/cvd/build_external/crosvm/BUILD.bazel @@ -1,3 +1,18 @@ +load("//build_external/crosvm:transition_opt.bzl", "build_in_opt") + exports_files([ "crosvm.config.toml", ]) + +# Build crosvm as if bazel was invoked with `-c opt`. Without this, observed +# some errors that looked like +# ``` +# fatal runtime error: IO Safety violation: owned file descriptor already closed +# ``` +# Additionally, crosvm optimization affects VM performance more noticeably +# than other executables involved in running Cuttlefish devices. +build_in_opt( + name = "crosvm_bin_opt", + actual = "@crosvm_bin//:crosvm__crosvm", + visibility = ["//visibility:public"], +) diff --git a/base/cvd/build_external/crosvm/transition_opt.bzl b/base/cvd/build_external/crosvm/transition_opt.bzl new file mode 100644 index 00000000000..0701a178ba3 --- /dev/null +++ b/base/cvd/build_external/crosvm/transition_opt.bzl @@ -0,0 +1,41 @@ +def _file_from_label(l): + files = l.files.to_list() + if len(files) != 1: + fail(msg = "Unexpected number of files in target {}: {}".format(l, len(files))) + return files[0] + +def _build_in_opt_transition_impl(settings, attr): + return {"//command_line_option:compilation_mode": "opt"} + +# https://bazel.build/rules/lib/builtins/transition#transition +build_in_opt_transition = transition( + implementation = _build_in_opt_transition_impl, + inputs = [], + outputs = ["//command_line_option:compilation_mode"], +) + +def _build_in_opt_rule_impl(ctx): + input_file = _file_from_label(ctx.attr.actual) + output = ctx.actions.declare_file(ctx.attr.name) + ctx.actions.run_shell( + mnemonic = "CopyOutput", + inputs = [input_file], + outputs = [output], + command = " ".join(["cp", input_file.path, output.path]) + ) + return [ + DefaultInfo( + executable = output, + files = depset([output]) + ), + ] + +# https://bazel.build/extending/config#attaching-transitions +build_in_opt = rule( + attrs = { + "actual": attr.label(), + }, + implementation = _build_in_opt_rule_impl, + cfg = build_in_opt_transition, + executable = True, +) diff --git a/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp b/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp index 7dfbdca4e17..79f69d41a11 100644 --- a/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp +++ b/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp @@ -28,6 +28,7 @@ #include #include +#include "absl/log/log.h" #include "absl/strings/str_join.h" #include "android-base/file.h" #include "json/json.h" @@ -751,13 +752,12 @@ Result> CrosvmManager::StartCommands( const bool seccomp_exists = DirectoryExists(instance.seccomp_policy_dir()); const std::string& var_empty_dir = kCrosvmVarEmptyDir; const bool var_empty_available = DirectoryExists(var_empty_dir); - CF_EXPECT(var_empty_available && seccomp_exists, - var_empty_dir << " is not an existing, empty directory." - << "seccomp-policy-dir, " - << instance.seccomp_policy_dir() - << " does not exist"); - crosvm_cmd.Cmd().AddParameter("--seccomp-policy-dir=", - instance.seccomp_policy_dir()); + if (seccomp_exists && var_empty_available) { + crosvm_cmd.Cmd().AddParameter("--seccomp-policy-dir=", + instance.seccomp_policy_dir()); + } else { + VLOG(0) << "Relying on crosvm built-in sandboxing"; + } } else { crosvm_cmd.Cmd().AddParameter("--disable-sandbox"); } diff --git a/base/cvd/cuttlefish/package/BUILD.bazel b/base/cvd/cuttlefish/package/BUILD.bazel index 4e435a981a6..656f6ce1466 100644 --- a/base/cvd/cuttlefish/package/BUILD.bazel +++ b/base/cvd/cuttlefish/package/BUILD.bazel @@ -39,6 +39,7 @@ package_files( "lib64/vulkan.lvp.so": "bin/libvk_lavapipe.so", "lib64/vulkan.pastel.so": "bin/libvk_swiftshader.so", "bin/prebuilts/libgfxstream_backend.so": "bin/libgfxstream_backend.so", + "bin/prebuilts/crosvm": "bin/crosvm", }, package_file_to_src = { "bin/adb": "//adb:adb", @@ -51,7 +52,9 @@ package_files( "bin/console_forwarder": "//cuttlefish/host/commands/console_forwarder", "bin/control_env_proxy_server": "//cuttlefish/host/commands/control_env_proxy_server", "bin/cpio": "@libarchive//cpio:cpio", + "bin/crosvm": "//build_external/crosvm:crosvm_bin_opt", "bin/cuttlefish_example_action_server": "//cuttlefish/host/example_custom_actions:cuttlefish_example_action_server", + "bin/cvd": "//cuttlefish/host/commands/cvd", "bin/cvd_import_locations": "//cuttlefish/host/commands/cvd_import_locations", "bin/cvd_internal_display": "//cuttlefish/host/commands/display:cvd_internal_display", "bin/cvd_internal_env": "//cuttlefish/host/commands/cvd_env:cvd_internal_env", @@ -64,7 +67,6 @@ package_files( "bin/cvd_send_sms": "//cuttlefish/host/commands/cvd_send_sms", "bin/cvd_update_location": "//cuttlefish/host/commands/cvd_update_location", "bin/cvd_update_security_algorithm": "//cuttlefish/host/commands/cvd_update_security_algorithm", - "bin/cvd": "//cuttlefish/host/commands/cvd", "bin/cvdalloc": "//cuttlefish/host/commands/cvdalloc", "bin/e2fsck": "@e2fsprogs//:e2fsck", "bin/e2fsdroid": "@e2fsprogs//:e2fsdroid", @@ -113,7 +115,7 @@ package_files( "bin/rootcanal": "@rootcanal", "bin/run_cvd": "//cuttlefish/host/commands/run_cvd", "bin/screen_recording_server": "//cuttlefish/host/commands/screen_recording_server", - # "bin/secure_env": "//cuttlefish/host/commands/secure_env", # TODO: schuffelen - make this more complete + "bin/secure_env": "//cuttlefish/host/commands/secure_env", # TODO: schuffelen - make this more complete "bin/sefcontext_compile": "@selinux//:sefcontext_compile", "bin/sensors_simulator": "//cuttlefish/host/commands/sensors_simulator", "bin/simg2img": "@android_system_core//:simg2img", @@ -158,8 +160,6 @@ package_files( "etc/modem_simulator/files/iccprofile_for_sim1_for_CtsCarrierApiTestCases.xml": "//cuttlefish/host/commands/modem_simulator:etc/files/iccprofile_for_sim1_for_CtsCarrierApiTestCases.xml", "etc/modem_simulator/files/iccprofile_for_sim1.xml": "//cuttlefish/host/commands/modem_simulator:etc/files/iccprofile_for_sim1.xml", "etc/modem_simulator/files/numeric_operator.xml": "//cuttlefish/host/commands/modem_simulator:etc/files/numeric_operator.xml", - # "bin/crosvm": "@crosvm_bin//:crosvm__crosvm", # TODO: b/402274999 - currently requires --enable_sandbox=false - "bin/prebuilts/crosvm": "@crosvm_bin//:crosvm__crosvm", # TODO: b/402274999 - keep in bin and symlink to prebuilts "usr/share/webrtc/assets/client.html": "//cuttlefish/host/frontend/webrtc/html_client:client.html", "usr/share/webrtc/assets/controls.css": "//cuttlefish/host/frontend/webrtc/html_client:controls.css", "usr/share/webrtc/assets/custom.css": "//cuttlefish/host/frontend/webrtc/html_client:custom.css",