Skip to content

WIP: crash_log: Dump encrypted log on panic #1711

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Femi Adeyemi (femiatl) wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

WIP: crash_log: Dump encrypted log on panic #1711

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
176 changes: 165 additions & 11 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions dev_tests/src/ratchet.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,9 @@ fn ratchet_globals() -> Result<()> {
("litebox/", 10),
("litebox_platform_linux_kernel/", 5),
("litebox_platform_linux_userland/", 6),
("litebox_platform_lvbs/", 25),
("litebox_platform_lvbs/", 26),
("litebox_platform_windows_userland/", 10),
("litebox_runner_lvbs/", 8),
("litebox_runner_lvbs/", 7),
("litebox_runner_snp/", 2),
("litebox_shim_linux/", 1),
("litebox_shim_optee/", 7),
Expand Down
10 changes: 10 additions & 0 deletions litebox_common_lvbs/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ pub const VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY: u32 = 0x1_ffed;

// This VSM function ID for generating the identity signing key is subject to change
pub const VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY: u32 = 0x1_ffee;
pub const VSM_VTL_CALL_FUNC_ID_SET_CRASH_DUMP_KEY: u32 = 0x1_ffef;

// This VSM function ID for OP-TEE messages is subject to change
pub const VSM_VTL_CALL_FUNC_ID_OPTEE_MESSAGE: u32 = 0x1_fff0;
Expand All @@ -77,6 +78,7 @@ pub enum VsmFunction {
AllocateRingbufferMemory = VSM_VTL_CALL_FUNC_ID_ALLOCATE_RINGBUFFER_MEMORY,
SetPlatformRootKey = VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY,
GenerateIdentitySigningKey = VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY,
SetCrashDumpKey = VSM_VTL_CALL_FUNC_ID_SET_CRASH_DUMP_KEY,
}

// `HV_STATUS_*` constants used as discriminants for `HypervCallError`.
Expand Down Expand Up @@ -289,6 +291,9 @@ pub enum VsmError {

#[error("symbol name contains invalid UTF-8")]
SymbolNameInvalidUtf8,

#[error("invalid key")]
InvalidKey,
}

impl From<VerificationError> for VsmError {
Expand Down Expand Up @@ -898,6 +903,11 @@ pub trait Vtl1Gate {
/// Read the platform root key from VTL0 `key_pa` and store it in VTL1 state.
fn set_platform_root_key(&self, key_pa: u64) -> Result<(), VsmError>;

/// Read the crash dump public key from VTL0 'key_pa'.
/// TODO: The key may be provisioned by a VTL0 agent eg. Azure Watson
/// after end-of boot, so certificate chain will need verifying
fn set_crash_dump_key(&self, key_pa: u64, key_len: u64) -> Result<(), VsmError>;

/// Close VTL1's window of trusting VTL0, making
/// [`Vtl0Gate::end_of_boot_reached`] report `true` from here on. One-way:
/// the window never reopens.
Expand Down
3 changes: 3 additions & 0 deletions litebox_platform_lvbs/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ rand_chacha = { version = "0.3.1", default-features = false }
rand_core = { version = "0.6.4", default-features = false }
zerocopy = { version = "0.8", default-features = false, features = ["derive"] }
zeroize = { version = "1.8", default-features = false, features = ["alloc"] }
log = { version = "0.4.28", default-features = false }
rsa = { version = "0.9.10", default-features = false }
aes-gcm = { version = "0.11.1", default-features = false, features = ["aes", "alloc"] }

[target.'cfg(target_arch = "x86_64")'.dependencies]
x86_64 = { version = "0.15.2", default-features = false, features = ["instructions"] }
Expand Down
Loading
Loading