Skip to content

Commit 119c9d4

Browse files
author
CKI KWF Bot
committed
Merge: Enable kdump LUKS support for x86_64
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1427 JIRA: https://issues.redhat.com/browse/RHEL-29040 Support dumping vmcore to LUKS-encrypted volume. Tested: Successful tested on x86_64 KVM guest with LUKS-encrypted root. Omitted-fix: 95c54cd ("riscv: kexec: Initialize kexec_buf struct") Signed-off-by: Coiby Xu <coxu@redhat.com> Approved-by: Mark Langsdorf <mlangsdo@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Baoquan He <5820488-baoquan_he@users.noreply.gitlab.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2 parents 3fddb92 + dbc6479 commit 119c9d4

File tree

19 files changed

+636
-11
lines changed

19 files changed

+636
-11
lines changed

‎Documentation/admin-guide/kdump/kdump.rst‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -551,6 +551,38 @@ from within add_taint() whenever the value set in this bitmask matches with the
551551
bit flag being set by add_taint().
552552
This will cause a kdump to occur at the add_taint()->panic() call.
553553

554+
Write the dump file to encrypted disk volume
555+
============================================
556+
557+
CONFIG_CRASH_DM_CRYPT can be enabled to support saving the dump file to an
558+
encrypted disk volume (only x86_64 supported for now). User space can interact
559+
with /sys/kernel/config/crash_dm_crypt_keys for setup,
560+
561+
1. Tell the first kernel what logon keys are needed to unlock the disk volumes,
562+
# Add key #1
563+
mkdir /sys/kernel/config/crash_dm_crypt_keys/7d26b7b4-e342-4d2d-b660-7426b0996720
564+
# Add key #1's description
565+
echo cryptsetup:7d26b7b4-e342-4d2d-b660-7426b0996720 > /sys/kernel/config/crash_dm_crypt_keys/description
566+
567+
# how many keys do we have now?
568+
cat /sys/kernel/config/crash_dm_crypt_keys/count
569+
1
570+
571+
# Add key #2 in the same way
572+
573+
# how many keys do we have now?
574+
cat /sys/kernel/config/crash_dm_crypt_keys/count
575+
2
576+
577+
# To support CPU/memory hot-plugging, re-use keys already saved to reserved
578+
# memory
579+
echo true > /sys/kernel/config/crash_dm_crypt_key/reuse
580+
581+
2. Load the dump-capture kernel
582+
583+
3. After the dump-capture kerne get booted, restore the keys to user keyring
584+
echo yes > /sys/kernel/crash_dm_crypt_keys/restore
585+
554586
Contact
555587
=======
556588

‎arch/arm64/kernel/machine_kexec_file.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ int load_other_segments(struct kimage *image,
9494
char *initrd, unsigned long initrd_len,
9595
char *cmdline)
9696
{
97-
struct kexec_buf kbuf;
97+
struct kexec_buf kbuf = {};
9898
void *dtb = NULL;
9999
unsigned long initrd_load_addr = 0, dtb_len,
100100
orig_segments = image->nr_segments;

‎arch/s390/kernel/kexec_elf.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
static int kexec_file_add_kernel_elf(struct kimage *image,
1717
struct s390_load_data *data)
1818
{
19-
struct kexec_buf buf;
19+
struct kexec_buf buf = {};
2020
const Elf_Ehdr *ehdr;
2121
const Elf_Phdr *phdr;
2222
Elf_Addr entry;

‎arch/s390/kernel/kexec_image.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
static int kexec_file_add_kernel_image(struct kimage *image,
1717
struct s390_load_data *data)
1818
{
19-
struct kexec_buf buf;
19+
struct kexec_buf buf = {};
2020

2121
buf.image = image;
2222

‎arch/s390/kernel/machine_kexec_file.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ static int kexec_file_update_purgatory(struct kimage *image,
129129
static int kexec_file_add_purgatory(struct kimage *image,
130130
struct s390_load_data *data)
131131
{
132-
struct kexec_buf buf;
132+
struct kexec_buf buf = {};
133133
int ret;
134134

135135
buf.image = image;
@@ -152,7 +152,7 @@ static int kexec_file_add_purgatory(struct kimage *image,
152152
static int kexec_file_add_initrd(struct kimage *image,
153153
struct s390_load_data *data)
154154
{
155-
struct kexec_buf buf;
155+
struct kexec_buf buf = {};
156156
int ret;
157157

158158
buf.image = image;
@@ -184,7 +184,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
184184
{
185185
__u32 *lc_ipl_parmblock_ptr;
186186
unsigned int len, ncerts;
187-
struct kexec_buf buf;
187+
struct kexec_buf buf = {};
188188
unsigned long addr;
189189
void *ptr, *end;
190190
int ret;

‎arch/x86/kernel/crash.c‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,7 @@ static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem,
278278
unsigned long long mend)
279279
{
280280
unsigned long start, end;
281+
int ret;
281282

282283
cmem->ranges[0].start = mstart;
283284
cmem->ranges[0].end = mend;
@@ -286,22 +287,43 @@ static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem,
286287
/* Exclude elf header region */
287288
start = image->elf_load_addr;
288289
end = start + image->elf_headers_sz - 1;
289-
return crash_exclude_mem_range(cmem, start, end);
290+
ret = crash_exclude_mem_range(cmem, start, end);
291+
292+
if (ret)
293+
return ret;
294+
295+
/* Exclude dm crypt keys region */
296+
if (image->dm_crypt_keys_addr) {
297+
start = image->dm_crypt_keys_addr;
298+
end = start + image->dm_crypt_keys_sz - 1;
299+
return crash_exclude_mem_range(cmem, start, end);
300+
}
301+
302+
return ret;
290303
}
291304

292305
/* Prepare memory map for crash dump kernel */
293306
int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params)
294307
{
308+
unsigned int nr_ranges = 0;
295309
int i, ret = 0;
296310
unsigned long flags;
297311
struct e820_entry ei;
298312
struct crash_memmap_data cmd;
299313
struct crash_mem *cmem;
300314

301-
cmem = vzalloc(struct_size(cmem, ranges, 1));
315+
/*
316+
* Using random kexec_buf for passing dm crypt keys may cause a range
317+
* split. So use two slots here.
318+
*/
319+
nr_ranges = 2;
320+
cmem = vzalloc(struct_size(cmem, ranges, nr_ranges));
302321
if (!cmem)
303322
return -ENOMEM;
304323

324+
cmem->max_nr_ranges = nr_ranges;
325+
cmem->nr_ranges = 0;
326+
305327
memset(&cmd, 0, sizeof(struct crash_memmap_data));
306328
cmd.params = params;
307329

‎arch/x86/kernel/kexec-bzimage64.c‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
#include <asm/kexec-bzimage64.h>
2828

2929
#define MAX_ELFCOREHDR_STR_LEN 30 /* elfcorehdr=0x<64bit-value> */
30+
#define MAX_DMCRYPTKEYS_STR_LEN 31 /* dmcryptkeys=0x<64bit-value> */
31+
3032

3133
/*
3234
* Defines lowest physical address for various segments. Not sure where
@@ -76,6 +78,10 @@ static int setup_cmdline(struct kimage *image, struct boot_params *params,
7678
if (image->type == KEXEC_TYPE_CRASH) {
7779
len = sprintf(cmdline_ptr,
7880
"elfcorehdr=0x%lx ", image->elf_load_addr);
81+
82+
if (image->dm_crypt_keys_addr != 0)
83+
len += sprintf(cmdline_ptr + len,
84+
"dmcryptkeys=0x%lx ", image->dm_crypt_keys_addr);
7985
}
8086
memcpy(cmdline_ptr + len, cmdline, cmdline_len);
8187
cmdline_len += len;
@@ -441,6 +447,19 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
441447
ret = crash_load_segments(image);
442448
if (ret)
443449
return ERR_PTR(ret);
450+
ret = crash_load_dm_crypt_keys(image);
451+
if (ret == -ENOENT) {
452+
kexec_dprintk("No dm crypt key to load\n");
453+
} else if (ret) {
454+
pr_err("Failed to load dm crypt keys\n");
455+
return ERR_PTR(ret);
456+
}
457+
if (image->dm_crypt_keys_addr &&
458+
cmdline_len + MAX_ELFCOREHDR_STR_LEN + MAX_DMCRYPTKEYS_STR_LEN >
459+
header->cmdline_size) {
460+
pr_err("Appending dmcryptkeys=<addr> to command line exceeds maximum allowed length\n");
461+
return ERR_PTR(-EINVAL);
462+
}
444463
}
445464
#endif
446465

@@ -468,6 +487,8 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
468487
efi_map_sz = efi_get_runtime_map_size();
469488
params_cmdline_sz = sizeof(struct boot_params) + cmdline_len +
470489
MAX_ELFCOREHDR_STR_LEN;
490+
if (image->dm_crypt_keys_addr)
491+
params_cmdline_sz += MAX_DMCRYPTKEYS_STR_LEN;
471492
params_cmdline_sz = ALIGN(params_cmdline_sz, 16);
472493
kbuf.bufsz = params_cmdline_sz + ALIGN(efi_map_sz, 16) +
473494
sizeof(struct setup_data) +

‎arch/x86/kernel/machine_kexec_64.c‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -579,13 +579,35 @@ static void kexec_mark_crashkres(bool protect)
579579
kexec_mark_range(control, crashk_res.end, protect);
580580
}
581581

582+
/* make the memory storing dm crypt keys in/accessible */
583+
static void kexec_mark_dm_crypt_keys(bool protect)
584+
{
585+
unsigned long start_paddr, end_paddr;
586+
unsigned int nr_pages;
587+
588+
if (kexec_crash_image->dm_crypt_keys_addr) {
589+
start_paddr = kexec_crash_image->dm_crypt_keys_addr;
590+
end_paddr = start_paddr + kexec_crash_image->dm_crypt_keys_sz - 1;
591+
nr_pages = (PAGE_ALIGN(end_paddr) - PAGE_ALIGN_DOWN(start_paddr))/PAGE_SIZE;
592+
if (protect)
593+
set_memory_np((unsigned long)phys_to_virt(start_paddr), nr_pages);
594+
else
595+
__set_memory_prot(
596+
(unsigned long)phys_to_virt(start_paddr),
597+
nr_pages,
598+
__pgprot(_PAGE_PRESENT | _PAGE_NX | _PAGE_RW));
599+
}
600+
}
601+
582602
void arch_kexec_protect_crashkres(void)
583603
{
584604
kexec_mark_crashkres(true);
605+
kexec_mark_dm_crypt_keys(true);
585606
}
586607

587608
void arch_kexec_unprotect_crashkres(void)
588609
{
610+
kexec_mark_dm_crypt_keys(false);
589611
kexec_mark_crashkres(false);
590612
}
591613
#endif

‎drivers/nvme/target/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
config NVME_TARGET
44
tristate "NVMe Target support"
55
depends on BLOCK
6-
depends on CONFIGFS_FS
6+
select CONFIGFS_FS
77
select NVME_KEYRING if NVME_TARGET_TCP_TLS
88
select KEYS if NVME_TARGET_TCP_TLS
99
select SGL_ALLOC

‎fs/configfs/Kconfig‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
# SPDX-License-Identifier: GPL-2.0-only
22
config CONFIGFS_FS
33
tristate "Userspace-driven configuration filesystem"
4-
select SYSFS
54
help
65
configfs is a RAM-based filesystem that provides the converse
76
of sysfs's functionality. Where sysfs is a filesystem-based

0 commit comments

Comments
 (0)