WIP: crash_log: Dump encrypted log on panic by femiatl · Pull Request #1711 · microsoft/litebox

Femi Adeyemi (femiatl) · 2026-10-23T19:10:23Z

Replace HOST_LOGGER with CRASH_LOGGER. It logs to VTL1 allocated memory instead of serial port and VTL0 ringbuffer. On debug builds, it optionally mirrors to the serial port.
VTL0 will a use a new SetCrashDumpKey API to send LiteBox a public key that will be used for crash dump envelope encryption.
On panic, the VTL1 logs are encrypted with a symmetric AES-256-GCM key, and that key itself is encrypted by the public key sent by VTL0. The crash dump envelope is then written to VTL0 ringbuffer in the following format (see CrashDumpHeader for details): CrashDumpHeader(AEAD) | Encrypted Key | Log Ciphertext | Tag
Design Choices:
- VTL1 logs are stored in a const-size ringbuffer available at boot. This implies some space in .bss/.data section.
- Envelope cipher is prepared on public key provision to avoid RNG availability in panic path.
TODOS:

On vault panic, what can be dumped, if any.
Test exceptions (div/0,... ), VTL0 panic paths.
Add certificate validation for VTL0 public key
VTL0 ringbuffer writes can be simplified if we insist on a page aligned buffer.

1. Replace HOST_LOGGER with CRASH_LOGGER. It logs to VTL1 allocated memory instead of serial port and VTL0 ringbuffer. On debug builds, it optionally mirrors to the serial port. 2. VTL0 will a use a new SetCrashDumpKey API to send LiteBox a public key that will be used for crash dump envelope encryption. 3. On panic, the VTL1 logs are encrypted with a symmetric AES-256-GCM key, and that key itself is encrypted by the public key sent by VTL0. The crash dump envelope is then written to VTL0 ringbuffer in the following format (see CrashDumpHeader for details): CrashDumpHeader(AEAD) | Encrypted Key | Log Ciphertext | Tag 4. Design Choices: - VTL1 logs are stored in a const-size ringbuffer available at boot. This implies some space in .bss/.data section. - Envelope cipher is prepared on public key provision to avoid RNG availability in panic path. 5. TODOS: - On vault panic, what can be dumped, if any. - Test exceptions (div/0,... ), VTL0 panic paths. - VTL0 ringbuffer writes can be simplified if we insist on a page aligned buffer.

github-actions · 2026-10-23T23:46:18Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---

Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_variant_added.ron

Failed in:
  variant VsmFunction:SetCrashDumpKey in /home/runner/work/litebox/litebox/litebox_common_lvbs/src/lib.rs:81

--- failure trait_method_added: pub trait method added ---

Description:
A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_method_added.ron

Failed in:
  trait method litebox_common_lvbs::Vtl1Gate::set_crash_dump_key in file /home/runner/work/litebox/litebox/litebox_common_lvbs/src/lib.rs:909

Copilot

🟡 Changes recommended

Unresolved provisioning, log retention, serialization, key-trust, and panic-coordination issues prevent reliable and secure crash dumping.

8 open issues

Advance ring buffer head only for overwritten bytes · New
Park concurrent panics during crash dump collection · New
Remove duplicate crash dump key ID · New
Reject dump key provisioning after boot trust window · New
Route SetCrashDumpKey dispatch to the gate method · New
Include panic information in encrypted crash artifact · New
Preserve formatted prefix for oversized records · New
Use the CRNG-produced seed for dump key generation · New

What changed in this PR

This PR introduces encrypted crash logging for LVBS, keeping logs in VTL1 memory and preparing an encrypted envelope for export to VTL0 on panic.

Changes:

Replaces the host logger with a fixed-size crash logger and optional debug serial mirroring.
Adds crash-dump key provisioning interfaces and RSA-wrapped AES-256-GCM encryption.
Connects panic handling to dump generation and updates dependencies and global-count limits.

File	Description
`litebox_runner_lvbs/src/main.rs`	Installs the crash logger and configures serial mirroring.
`litebox_runner_lvbs/src/lib.rs`	Adds the dispatch arm and invokes dumping on panic.
`litebox_platform_lvbs/src/mshv/vsm.rs`	Implements public-key loading and envelope preparation.
`litebox_platform_lvbs/src/mshv/ringbuffer.rs`	Adds a TODO about buffer alignment requirements.
`litebox_platform_lvbs/src/lib.rs`	Exposes the crash-log module.
`litebox_platform_lvbs/src/host/lvbs_impl.rs`	Makes the hardware seed helper crate-visible.
`litebox_platform_lvbs/src/crash_log.rs`	Implements buffered logging, encryption, and dump serialization.
`litebox_platform_lvbs/src/arch/x86/ioport.rs`	Removes ring-buffer forwarding and adds nonblocking panic serial output.
`litebox_platform_lvbs/Cargo.toml`	Adds logging and encryption dependencies.
`litebox_common_lvbs/src/lib.rs`	Defines the crash-key call, gate method, and error.
`dev_tests/src/ratchet.rs`	Adjusts global-count limits for logger relocation.
`Cargo.lock`	Records the added cryptographic dependency graph.

_{Review effort: Balanced}

+        self.buf[tail..tail + first_len].copy_from_slice(&data[..first_len]);
+        self.buf[..data.len() - first_len].copy_from_slice(&data[first_len..]);
+
+        self.head = (self.head + data.len()) % N;


+        if self.panic_dump_started.swap(true, Ordering::SeqCst) {
+            serial_print_panic_string("Crash dump already progress");
+            return Err(VsmError::OutOfMemory);


+        let mut vtl0_buf = vtl0_buf.lock();
+        vtl0_buf.write(aead.as_bytes());
+        vtl0_buf.write(&envelope.wrapped_data_key);
+        vtl0_buf.write(&envelope.crash_dump_key_id);


+    fn set_crash_dump_key(&self, key_pa: u64, key_len: u64) -> Result<(), VsmError> {
+        let key_pa = PhysAddr::try_new(key_pa).map_err(|_| VsmError::InvalidPhysicalAddress)?;


            Err(VsmError::OperationNotSupported("Identity key generation"))
        }
        VsmFunction::OpteeMessage => Err(VsmError::OperationNotSupported("OP-TEE communication")),
+        VsmFunction::SetCrashDumpKey => Err(VsmError::OperationNotSupported("Set Crash Dump Key")),


+    pub fn dump_on_panic(&self, _info: &PanicInfo) -> Result<(), VsmError> {
+        if self.panic_dump_started.swap(true, Ordering::SeqCst) {
+            serial_print_panic_string("Crash dump already progress");
+            return Err(VsmError::OutOfMemory);
+        }
+
+        let Some(envelope) = &*self.envelope.lock() else {
+            return Err(VsmError::InvalidKey);
+        };
+
+        let ring_buffer = &mut *self.ring_buf.lock();


+        if litebox_util_log::format_record(&mut buf, record).is_ok() {
+            self.ring_buf.lock().write(buf.as_bytes());
+        }


+        let seed = crate::host::lvbs_impl::rdrand_seed().ok_or(VsmError::InvalidKey)?;
+        let mut rng = rand_chacha::ChaCha20Rng::from_seed(seed);


Femi Adeyemi (femiatl) requested a review from Sangho Lee (sangho2) October 23, 2026 19:13

Femi Adeyemi (femiatl) force-pushed the femia/wip/crashlog branch 3 times, most recently from ad38bbc to 578f890 Compare October 23, 2026 23:23

Femi Adeyemi (femiatl) force-pushed the femia/wip/crashlog branch from 578f890 to b8df8aa Compare October 23, 2026 23:37

Femi Adeyemi (femiatl) requested a balanced review from Copilot October 23, 2026 23:47

Copilot started reviewing on behalf of Femi Adeyemi (femiatl) October 23, 2026 23:48

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

Navigation Menu

Repository navigation

WIP: crash_log: Dump encrypted log on panic - #1711

WIP: crash_log: Dump encrypted log on panic#1711
Femi Adeyemi (femiatl) wants to merge 1 commit into
mainfrom
femia/wip/crashlog

Femi Adeyemi (femiatl) commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		fn set_crash_dump_key(&self, key_pa: u64, key_len: u64) -> Result<(), VsmError> {
		let key_pa = PhysAddr::try_new(key_pa).map_err(\|_\| VsmError::InvalidPhysicalAddress)?;

		let seed = crate::host::lvbs_impl::rdrand_seed().ok_or(VsmError::InvalidKey)?;
		let mut rng = rand_chacha::ChaCha20Rng::from_seed(seed);

Conversation

Femi Adeyemi (femiatl) commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Femi Adeyemi (femiatl) commented Oct 23, 2026 •

edited

Loading