kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdump: dfi: add support to read Protected Virtualization dumps

Browse Source 
Sometimes dumping a virtual machine from the outside is the only way to
get the data that is needed. This can be the case if a dumping mechanism
like kdump hasn't been configured or data needs to be fetched at a
specific point. Dumping a protected guest from the outside without help
from FW/HW doesn't yield sufficient data to be useful. Hence we have
introduced Protected Virtualization (PV) dump support - also named
confidential dump support.

The confidential dump support works by integrating the firmware into the
dump process. New Ultravisor calls (UVC) are used to initiate the dump
process, dump CPU data, dump memory state and lastly complete the dump
process. The guest's data is fully encrypted and can only be decrypted
by the entity that owns the customer communication key (CCK) for the
dumped guest. The output format is very similar the normal s390 vmcore
ELF format, it's only enriched by new sections where the returned data
from the UVC "Complete Configuration Dump" and the UVC "Dump
Configuration Storage State" is stored. The encrypted CPU data is stored
in a new note type `NT_S390_PV_CPU_DATA`. The old note types do still
exists but without any confidential data stored. The memory data is
stored in the LOAD segment as usual but for PV dumps it's fully AES-XTS
encrypted.

This commit adds support for reading/decrypting PV guest dumps to
zgetdump by introducing a new DFI input module (`dfi_pv_elf.c`). For
specifying the customer communication key a new command line option
`--key` is added.

Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2022-10-12 09:25:02 +00:00
committed by Jan Höppner
parent e537ab902e
commit 8fa1b5a00b
14 changed files with 1959 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zdump/opts.c
+25 -7
View File
@@ -20,9 +20,11 @@
#include "opts.h"
static struct option long_opts[] = {
/* clang-format off */
{"help", no_argument, NULL, 'h'},
{"version", no_argument, NULL, 'v'},
{"info", no_argument, NULL, 'i'},
{"key", required_argument, NULL, 'k'},
{"device", no_argument, NULL, 'd'},
{"mount", no_argument, NULL, 'm'},
{"umount", no_argument, NULL, 'u'},
@@ -30,19 +32,20 @@ static struct option long_opts[] = {
{"select", required_argument, NULL, 's'},
{"debug", no_argument, NULL, 'X'},
{"verbose", no_argument, NULL, 'V'},
{NULL, 0, NULL, 0 }
{NULL, 0, NULL, 0 },
/* clang-format on */
};
static const char optstr[] = "hvVidmus:f:X";
static const char optstr[] = "hvVidmuk:s:f:X";
/*
* Text for --help option
*/
static const char help_text[] =
"Usage: zgetdump DUMP [-s SYS] [-f FMT] > DUMP_FILE\n"
" DUMP [-s SYS] [-f FMT] DUMP_FILE\n"
" -m DUMP [-s SYS] [-f FMT] DIR\n"
" -i DUMP [-s SYS]\n"
"Usage: zgetdump DUMP [-s SYS] [-f FMT] [-k KEY] > DUMP_FILE\n"
" DUMP [-s SYS] [-f FMT] [-k KEY] DUMP_FILE\n"
" -m DUMP [-s SYS] [-f FMT] [-k KEY] DIR\n"
" -i DUMP [-s SYS] [-k KEY]\n"
" -d DUMPDEV\n"
" -u DIR\n"
"\n"
@@ -58,6 +61,7 @@ static const char help_text[] =
"In the syntax description, DUMP specifies a dump device or dump file to be\n"
"read. The following options are available:\n"
"\n"
"-k, --key Specify the key KEY to decrypt the protected virtualization dump\n"
"-m, --mount Mount DUMP to mount point DIR\n"
"-u, --umount Unmount dump from mount point DIR\n"
"-i, --info Print DUMP information\n"
@@ -71,7 +75,7 @@ static const char help_text[] =
" messages. This option is intended for debugging\n"
"-h, --help Print this help, then exit\n";
static const char copyright_str[] = "Copyright IBM Corp. 2001, 2018";
static const char copyright_str[] = "Copyright IBM Corp. 2001, 2022";
/*
* Select option strings
@@ -88,6 +92,7 @@ static void init_defaults(struct options *opts)
opts->prog_name = "zgetdump";
opts->action = ZG_ACTION_COPY;
opts->output_path = NULL;
opts->key_path = NULL;
#ifdef __s390x__
opts->fmt = "elf";
#else
@@ -181,6 +186,16 @@ static void output_set(struct options *opts, const char *path)
opts->output_path = zg_strdup(path);
}
/*
* Set customer communication key (CCK)
*/
static void key_set(struct options *opts, const char *key)
{
assert(!opts->key_path);
opts->key_path = zg_strdup(key);
}
/*
* Set FUSE debug options
*/
@@ -318,6 +333,9 @@ void opts_parse(int argc, char *argv[], struct options *opts)
case 's':
select_set(opts, optarg);
break;
case 'k':
key_set(opts, optarg);
break;
case 'X':
opts->debug_specified = 1;
break;