Skip to content

Commit adbb1c6

Browse files
author
CKI KWF Bot
committed
Merge: Enable kdump LUKS support for x86_64
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7393 JIRA: https://issues.redhat.com/browse/RHEL-104939 Support dumping vmcore to LUKS-encrypted volume. Tested: Successful tested on x86_64 KVM guest with LUKS-encrypted dump target. Omitted-fix: 95c54cd ("riscv: kexec: Initialize kexec_buf struct") Signed-off-by: Coiby Xu <coxu@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Baoquan He <5820488-baoquan_he@users.noreply.gitlab.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2 parents a4b688b + 0849170 commit adbb1c6

File tree

19 files changed

+636
-11
lines changed

19 files changed

+636
-11
lines changed

‎Documentation/admin-guide/kdump/kdump.rst‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -582,6 +582,38 @@ from within add_taint() whenever the value set in this bitmask matches with the
582582
bit flag being set by add_taint().
583583
This will cause a kdump to occur at the add_taint()->panic() call.
584584

585+
Write the dump file to encrypted disk volume
586+
============================================
587+
588+
CONFIG_CRASH_DM_CRYPT can be enabled to support saving the dump file to an
589+
encrypted disk volume (only x86_64 supported for now). User space can interact
590+
with /sys/kernel/config/crash_dm_crypt_keys for setup,
591+
592+
1. Tell the first kernel what logon keys are needed to unlock the disk volumes,
593+
# Add key #1
594+
mkdir /sys/kernel/config/crash_dm_crypt_keys/7d26b7b4-e342-4d2d-b660-7426b0996720
595+
# Add key #1's description
596+
echo cryptsetup:7d26b7b4-e342-4d2d-b660-7426b0996720 > /sys/kernel/config/crash_dm_crypt_keys/description
597+
598+
# how many keys do we have now?
599+
cat /sys/kernel/config/crash_dm_crypt_keys/count
600+
1
601+
602+
# Add key #2 in the same way
603+
604+
# how many keys do we have now?
605+
cat /sys/kernel/config/crash_dm_crypt_keys/count
606+
2
607+
608+
# To support CPU/memory hot-plugging, re-use keys already saved to reserved
609+
# memory
610+
echo true > /sys/kernel/config/crash_dm_crypt_key/reuse
611+
612+
2. Load the dump-capture kernel
613+
614+
3. After the dump-capture kerne get booted, restore the keys to user keyring
615+
echo yes > /sys/kernel/crash_dm_crypt_keys/restore
616+
585617
Contact
586618
=======
587619

‎arch/arm64/kernel/machine_kexec_file.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ int load_other_segments(struct kimage *image,
9494
char *initrd, unsigned long initrd_len,
9595
char *cmdline)
9696
{
97-
struct kexec_buf kbuf;
97+
struct kexec_buf kbuf = {};
9898
void *dtb = NULL;
9999
unsigned long initrd_load_addr = 0, dtb_len,
100100
orig_segments = image->nr_segments;

‎arch/s390/kernel/kexec_elf.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
static int kexec_file_add_kernel_elf(struct kimage *image,
1717
struct s390_load_data *data)
1818
{
19-
struct kexec_buf buf;
19+
struct kexec_buf buf = {};
2020
const Elf_Ehdr *ehdr;
2121
const Elf_Phdr *phdr;
2222
Elf_Addr entry;

‎arch/s390/kernel/kexec_image.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
static int kexec_file_add_kernel_image(struct kimage *image,
1717
struct s390_load_data *data)
1818
{
19-
struct kexec_buf buf;
19+
struct kexec_buf buf = {};
2020

2121
buf.image = image;
2222

‎arch/s390/kernel/machine_kexec_file.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ static int kexec_file_update_purgatory(struct kimage *image,
129129
static int kexec_file_add_purgatory(struct kimage *image,
130130
struct s390_load_data *data)
131131
{
132-
struct kexec_buf buf;
132+
struct kexec_buf buf = {};
133133
int ret;
134134

135135
buf.image = image;
@@ -152,7 +152,7 @@ static int kexec_file_add_purgatory(struct kimage *image,
152152
static int kexec_file_add_initrd(struct kimage *image,
153153
struct s390_load_data *data)
154154
{
155-
struct kexec_buf buf;
155+
struct kexec_buf buf = {};
156156
int ret;
157157

158158
buf.image = image;
@@ -184,7 +184,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
184184
{
185185
__u32 *lc_ipl_parmblock_ptr;
186186
unsigned int len, ncerts;
187-
struct kexec_buf buf;
187+
struct kexec_buf buf = {};
188188
unsigned long addr;
189189
void *ptr, *end;
190190
int ret;

‎arch/x86/kernel/crash.c‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,7 @@ static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem,
277277
unsigned long long mend)
278278
{
279279
unsigned long start, end;
280+
int ret;
280281

281282
cmem->ranges[0].start = mstart;
282283
cmem->ranges[0].end = mend;
@@ -285,22 +286,43 @@ static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem,
285286
/* Exclude elf header region */
286287
start = image->elf_load_addr;
287288
end = start + image->elf_headers_sz - 1;
288-
return crash_exclude_mem_range(cmem, start, end);
289+
ret = crash_exclude_mem_range(cmem, start, end);
290+
291+
if (ret)
292+
return ret;
293+
294+
/* Exclude dm crypt keys region */
295+
if (image->dm_crypt_keys_addr) {
296+
start = image->dm_crypt_keys_addr;
297+
end = start + image->dm_crypt_keys_sz - 1;
298+
return crash_exclude_mem_range(cmem, start, end);
299+
}
300+
301+
return ret;
289302
}
290303

291304
/* Prepare memory map for crash dump kernel */
292305
int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params)
293306
{
307+
unsigned int nr_ranges = 0;
294308
int i, ret = 0;
295309
unsigned long flags;
296310
struct e820_entry ei;
297311
struct crash_memmap_data cmd;
298312
struct crash_mem *cmem;
299313

300-
cmem = vzalloc(struct_size(cmem, ranges, 1));
314+
/*
315+
* Using random kexec_buf for passing dm crypt keys may cause a range
316+
* split. So use two slots here.
317+
*/
318+
nr_ranges = 2;
319+
cmem = vzalloc(struct_size(cmem, ranges, nr_ranges));
301320
if (!cmem)
302321
return -ENOMEM;
303322

323+
cmem->max_nr_ranges = nr_ranges;
324+
cmem->nr_ranges = 0;
325+
304326
memset(&cmd, 0, sizeof(struct crash_memmap_data));
305327
cmd.params = params;
306328

‎arch/x86/kernel/kexec-bzimage64.c‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
#include <asm/kexec-bzimage64.h>
2828

2929
#define MAX_ELFCOREHDR_STR_LEN 30 /* elfcorehdr=0x<64bit-value> */
30+
#define MAX_DMCRYPTKEYS_STR_LEN 31 /* dmcryptkeys=0x<64bit-value> */
31+
3032

3133
/*
3234
* Defines lowest physical address for various segments. Not sure where
@@ -76,6 +78,10 @@ static int setup_cmdline(struct kimage *image, struct boot_params *params,
7678
if (image->type == KEXEC_TYPE_CRASH) {
7779
len = sprintf(cmdline_ptr,
7880
"elfcorehdr=0x%lx ", image->elf_load_addr);
81+
82+
if (image->dm_crypt_keys_addr != 0)
83+
len += sprintf(cmdline_ptr + len,
84+
"dmcryptkeys=0x%lx ", image->dm_crypt_keys_addr);
7985
}
8086
memcpy(cmdline_ptr + len, cmdline, cmdline_len);
8187
cmdline_len += len;
@@ -441,6 +447,19 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
441447
ret = crash_load_segments(image);
442448
if (ret)
443449
return ERR_PTR(ret);
450+
ret = crash_load_dm_crypt_keys(image);
451+
if (ret == -ENOENT) {
452+
kexec_dprintk("No dm crypt key to load\n");
453+
} else if (ret) {
454+
pr_err("Failed to load dm crypt keys\n");
455+
return ERR_PTR(ret);
456+
}
457+
if (image->dm_crypt_keys_addr &&
458+
cmdline_len + MAX_ELFCOREHDR_STR_LEN + MAX_DMCRYPTKEYS_STR_LEN >
459+
header->cmdline_size) {
460+
pr_err("Appending dmcryptkeys=<addr> to command line exceeds maximum allowed length\n");
461+
return ERR_PTR(-EINVAL);
462+
}
444463
}
445464
#endif
446465

@@ -468,6 +487,8 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
468487
efi_map_sz = efi_get_runtime_map_size();
469488
params_cmdline_sz = sizeof(struct boot_params) + cmdline_len +
470489
MAX_ELFCOREHDR_STR_LEN;
490+
if (image->dm_crypt_keys_addr)
491+
params_cmdline_sz += MAX_DMCRYPTKEYS_STR_LEN;
471492
params_cmdline_sz = ALIGN(params_cmdline_sz, 16);
472493
kbuf.bufsz = params_cmdline_sz + ALIGN(efi_map_sz, 16) +
473494
sizeof(struct setup_data) +

‎arch/x86/kernel/machine_kexec_64.c‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -572,13 +572,35 @@ static void kexec_mark_crashkres(bool protect)
572572
kexec_mark_range(control, crashk_res.end, protect);
573573
}
574574

575+
/* make the memory storing dm crypt keys in/accessible */
576+
static void kexec_mark_dm_crypt_keys(bool protect)
577+
{
578+
unsigned long start_paddr, end_paddr;
579+
unsigned int nr_pages;
580+
581+
if (kexec_crash_image->dm_crypt_keys_addr) {
582+
start_paddr = kexec_crash_image->dm_crypt_keys_addr;
583+
end_paddr = start_paddr + kexec_crash_image->dm_crypt_keys_sz - 1;
584+
nr_pages = (PAGE_ALIGN(end_paddr) - PAGE_ALIGN_DOWN(start_paddr))/PAGE_SIZE;
585+
if (protect)
586+
set_memory_np((unsigned long)phys_to_virt(start_paddr), nr_pages);
587+
else
588+
__set_memory_prot(
589+
(unsigned long)phys_to_virt(start_paddr),
590+
nr_pages,
591+
__pgprot(_PAGE_PRESENT | _PAGE_NX | _PAGE_RW));
592+
}
593+
}
594+
575595
void arch_kexec_protect_crashkres(void)
576596
{
577597
kexec_mark_crashkres(true);
598+
kexec_mark_dm_crypt_keys(true);
578599
}
579600

580601
void arch_kexec_unprotect_crashkres(void)
581602
{
603+
kexec_mark_dm_crypt_keys(false);
582604
kexec_mark_crashkres(false);
583605
}
584606
#endif

‎drivers/nvme/target/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
config NVME_TARGET
44
tristate "NVMe Target support"
55
depends on BLOCK
6-
depends on CONFIGFS_FS
6+
select CONFIGFS_FS
77
select NVME_KEYRING if NVME_TARGET_TCP_TLS
88
select KEYS if NVME_TARGET_TCP_TLS
99
select SGL_ALLOC

‎fs/configfs/Kconfig‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
# SPDX-License-Identifier: GPL-2.0-only
22
config CONFIGFS_FS
33
tristate "Userspace-driven configuration filesystem"
4-
select SYSFS
54
help
65
configfs is a RAM-based filesystem that provides the converse
76
of sysfs's functionality. Where sysfs is a filesystem-based

0 commit comments

Comments
 (0)