From patchwork Fri Mar 18 10:34:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Coiby Xu X-Patchwork-Id: 12786869 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2EDFEC433FE for ; Mon, 21 Mar 2022 06:54:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1647845698; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=bWllzaPauRMjFiuiZ/1rTgcqtxhXnE/Vuw1CfEeNJGY=; b=bNnYxTtLmrLr4F1PcMGUHpl2y/GXgitKvcZyqxZLbUkYJAn62JDL40gpIAuYJXfMeeGRpS 5+A9kgo+6EEfe/oYCt1HM5EVgm5VqFJ6WEigTmu4PQbqdoiaK2AsbUeGF18CD3PxnJt/Kt 5ELTuNeS1g6OP/KqIYSa8J4jsuVpfXY= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-171-Qk_YKAJyPdGBXGtP6u2BlQ-1; Mon, 21 Mar 2022 02:54:54 -0400 X-MC-Unique: Qk_YKAJyPdGBXGtP6u2BlQ-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 36D061857F16; Mon, 21 Mar 2022 06:54:53 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 12BC91121318; Mon, 21 Mar 2022 06:54:52 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 0DC3E1947BBD; Mon, 21 Mar 2022 06:54:51 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 5D5D41949763 for ; Fri, 18 Mar 2022 10:34:35 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 4FE491454559; Fri, 18 Mar 2022 10:34:35 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4BD0B1400E73 for ; Fri, 18 Mar 2022 10:34:35 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 33F8180B71C for ; Fri, 18 Mar 2022 10:34:35 +0000 (UTC) Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-486-M_S-PCfZNSW3U1JyyqhLhw-1; Fri, 18 Mar 2022 06:34:34 -0400 X-MC-Unique: M_S-PCfZNSW3U1JyyqhLhw-1 Received: by mail-pl1-f199.google.com with SMTP id x6-20020a1709029a4600b0014efe26b04fso3921869plv.21 for ; Fri, 18 Mar 2022 03:34:34 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=PODFzb3mjImlWQPxxoECM7lRSKqdrL/May27LmTIUmk=; b=Fxtkq7WlldDnczdUOvk+N2CyKIcuGR3wQLeymRgTPGGlcj4Qwc1CAg8wraYZgvvTAJ zV/+6f0Iths32e5SNzKQCldjhXdIKO9mmVNq+uvVeFSi5+8fnBTY6wOX4oEdolDqlBcB OSf4M8syCfzpW3NLDKxq4MebGgmdpz0vBfPzFMu+Nsq1crKwph0+cQVN75U5YsKsvOGg Wqb7GU4EGz7uWyW8I9cq23kDqNo60atPrR8i+gnO2MaqlUhogoxApqw+vhyHhCQJvBOR eeeL1blQafSQbyxdlpfps13Mxqy8L5Z5Nr8qaqfTRtvcEiT1x6NBV2r+SH6n452V+jck VjMQ== X-Gm-Message-State: AOAM531ETDxHYbUEyhQKoQXoX2o3cy8Pjf5yDJOboLWCoM2QPyClDyLG 8RAqsyOhAyjjTnr78u0lU/gNYCCRQeHv67Kb8V7Zuxr5fiDPbBo+YrB09FLgV9wDB8EiYmD1Fhm ayDp/Orn86JcfqKc= X-Received: by 2002:a05:6a00:1152:b0:4be:ab79:fcfa with SMTP id b18-20020a056a00115200b004beab79fcfamr9598491pfm.3.1647599671393; Fri, 18 Mar 2022 03:34:31 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwVqCTYHmMvd/+g0VOR29gw2GmqZvnV0UPmluByeNafGkhNa+o3V1s2U3kyohRsqW5FHTDTeA== X-Received: by 2002:a05:6a00:1152:b0:4be:ab79:fcfa with SMTP id b18-20020a056a00115200b004beab79fcfamr9598457pfm.3.1647599671120; Fri, 18 Mar 2022 03:34:31 -0700 (PDT) Received: from localhost ([240e:3a1:2e5:800:f995:6136:f760:a3d0]) by smtp.gmail.com with ESMTPSA id s20-20020a056a00179400b004f709998d13sm9657970pfg.10.2022.03.18.03.34.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Mar 2022 03:34:30 -0700 (PDT) From: Coiby Xu To: kexec@lists.infradead.org Date: Fri, 18 Mar 2022 18:34:20 +0800 Message-Id: <20220318103423.286410-2-coxu@redhat.com> In-Reply-To: <20220318103423.286410-1-coxu@redhat.com> References: <20220318103423.286410-1-coxu@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.7 X-Mailman-Approved-At: Mon, 21 Mar 2022 06:54:49 +0000 Subject: [dm-devel] [RFC 1/4] kexec, dm-crypt: receive LUKS master key from dm-crypt and pass it to kdump X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mike Snitzer , Baoquan He , dm-devel@redhat.com, linux-kernel@vger.kernel.org, Kairui Song , Eric Biederman , Thomas Staudt , Dave Young , Milan Broz , Alasdair Kergon Errors-To: dm-devel-bounces@redhat.com Sender: "dm-devel" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com After receiving the LUKS master key from driver/md/dm-crypt, kdump has 1 hour at maximum to ask kexec to pass the key before the key gets wiped by kexec. And after kdump retrieves the key, the key will be wiped immediately. Signed-off-by: Coiby Xu --- drivers/md/dm-crypt.c | 5 +++- include/linux/kexec.h | 3 ++ kernel/kexec_core.c | 66 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 73 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index d4ae31558826..41f9ca377312 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -41,6 +41,7 @@ #include #include +#include #include "dm-audit.h" @@ -2388,6 +2389,8 @@ static int crypt_setkey(struct crypt_config *cc) unsigned subkey_size; int err = 0, i, r; + /* save master key to kexec */ + kexec_save_luks_master_key(cc->key, cc->key_size); /* Ignore extra keys (which are used for IV etc) */ subkey_size = crypt_subkey_size(cc); @@ -3580,6 +3583,7 @@ static int crypt_message(struct dm_target *ti, unsigned argc, char **argv, DMWARN("not suspended during key manipulation."); return -EINVAL; } + if (argc == 3 && !strcasecmp(argv[1], "set")) { /* The key size may not be changed. */ key_size = get_key_size(&argv[2]); @@ -3587,7 +3591,6 @@ static int crypt_message(struct dm_target *ti, unsigned argc, char **argv, memset(argv[2], '0', strlen(argv[2])); return -EINVAL; } - ret = crypt_set_key(cc, argv[2]); if (ret) return ret; diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 0c994ae37729..91507bc684e2 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -205,6 +205,9 @@ int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf); extern int kexec_add_buffer(struct kexec_buf *kbuf); int kexec_locate_mem_hole(struct kexec_buf *kbuf); +extern int kexec_pass_luks_master_key(void **addr, unsigned long *sz); +extern int kexec_save_luks_master_key(u8 *key, unsigned int key_size); + /* Alignment required for elf header segment */ #define ELF_CORE_HEADER_ALIGN 4096 diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index 68480f731192..86df36b71443 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -1218,3 +1218,69 @@ void __weak arch_kexec_protect_crashkres(void) void __weak arch_kexec_unprotect_crashkres(void) {} + + +static u8 *luks_master_key; +static unsigned int luks_master_key_size; + +void wipe_luks_master_key(void) +{ + if (luks_master_key) { + memset(luks_master_key, 0, luks_master_key_size * sizeof(u8)); + kfree(luks_master_key); + luks_master_key = NULL; + } +} + +static void _wipe_luks_master_key(struct work_struct *dummy) +{ + wipe_luks_master_key(); +} + +static DECLARE_DELAYED_WORK(wipe_luks_master_key_work, _wipe_luks_master_key); + +static unsigned __read_mostly wipe_key_delay = 3600; /* 1 hour */ + +int kexec_save_luks_master_key(u8 *key, unsigned int key_size) +{ + if (luks_master_key) { + memset(luks_master_key, 0, luks_master_key_size * sizeof(u8)); + kfree(luks_master_key); + } + + luks_master_key = kmalloc(key_size * sizeof(u8), GFP_KERNEL); + + if (!luks_master_key) + return -ENOMEM; + memcpy(luks_master_key, key, key_size * sizeof(u8)); + luks_master_key_size = key_size; + pr_debug("LUKS master key (size=%u): %64ph\n", key_size, luks_master_key); + schedule_delayed_work(&wipe_luks_master_key_work, + round_jiffies_relative(wipe_key_delay * HZ)); + return 0; +} +EXPORT_SYMBOL(kexec_save_luks_master_key); + +int kexec_pass_luks_master_key(void **addr, unsigned long *sz) +{ + unsigned long luks_key_sz; + unsigned char *buf; + unsigned int *size_ptr; + + if (!luks_master_key) + return -EINVAL; + + luks_key_sz = sizeof(unsigned int) + luks_master_key_size * sizeof(u8); + + buf = vzalloc(luks_key_sz); + if (!buf) + return -ENOMEM; + + size_ptr = (unsigned int *)buf; + memcpy(size_ptr, &luks_master_key_size, sizeof(unsigned int)); + memcpy(size_ptr + 1, luks_master_key, luks_master_key_size * sizeof(u8)); + *addr = buf; + *sz = luks_key_sz; + wipe_luks_master_key(); + return 0; +} From patchwork Fri Mar 18 10:34:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Coiby Xu X-Patchwork-Id: 12786868 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7E590C433F5 for ; Mon, 21 Mar 2022 06:54:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1647845696; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=bXOPN4aJN5glTJihedVQaquVSqkpDlujbTq+Lco8Ei8=; b=TWoPYQ3iCkZNGdf+NxXCGnCO9awnZWHFd6kbHgzzFbj6rIRQf2Sj4ezgo75MY3s8sT5TpK LEEIUnXvY18RBx3NDNjGkvKMIC/wasj6bdMdt+e9KTPY/uTeB3N7gqjnvKH7cF5BbsPL4m 3PZRRcadEqHvwSKowJ2uyeG9lydXyEs= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-171-tDZM7q8_MdWQ2KNDHdzgkA-1; Mon, 21 Mar 2022 02:54:54 -0400 X-MC-Unique: tDZM7q8_MdWQ2KNDHdzgkA-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 36E831857F17; Mon, 21 Mar 2022 06:54:53 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4DCA01121314; Mon, 21 Mar 2022 06:54:51 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id EA39219451EF; Mon, 21 Mar 2022 06:54:50 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 0892B1949763 for ; Fri, 18 Mar 2022 10:34:40 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id ED31D56D1E0; Fri, 18 Mar 2022 10:34:39 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast08.extmail.prod.ext.rdu2.redhat.com [10.11.55.24]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E93BB56D17C for ; Fri, 18 Mar 2022 10:34:39 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CFA693811F29 for ; Fri, 18 Mar 2022 10:34:39 +0000 (UTC) Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-591-Vhjgj2kRNnaTTZtXMoPT7A-1; Fri, 18 Mar 2022 06:34:38 -0400 X-MC-Unique: Vhjgj2kRNnaTTZtXMoPT7A-1 Received: by mail-pl1-f198.google.com with SMTP id w24-20020a170902a71800b001538d7b076dso3928281plq.16 for ; Fri, 18 Mar 2022 03:34:38 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=EDf+Cue22NIq+++ettcFUZpGsy+wdzQQBWaXtBz9VhU=; b=NkXEjp4Et1lYvH/VLMHnpnaO/RxDKmoEDEwOu6+hr/uLzIW7ustcCL5Qc9lSYsNavF xRK0UplwlGrECCl7G4YbmXkWllIi230V1YTccWqOw4R3hutZNUaaid1gdu2NQIpAvWua u/Ce9G2snSUTHwccriqzp7r4JKvBUbv2T2XISr3yNjvhUqt2UxH2Lkvbkp5+0fvrhacG l1qBUD9uwr0DyKoKzkpShXKUpu7D2Ekel8EbUYiG2THruTtWDHG3OxBJhGv6TArhjgON oCN7+8SBTEnv9l5jOaSMCxXxIQI0JquPNvZGu85BNa5trwE8Cj8Wo+Z14LtqqIM1VKoL 90FQ== X-Gm-Message-State: AOAM533ktjl7+m4iuClRwW4c53C94uUDUG9NnQqnVmTybqJnAb1jUqtv w8GAixq8kWdEYbINeo4Yzcq4e7u53xbXKU4bM8RpgqxIFzB7sVAXSPCLPhMaQ3rIvdVJFqyLIeP W9WztXC+rfz/rnSk= X-Received: by 2002:a17:902:db10:b0:151:ef9a:7e27 with SMTP id m16-20020a170902db1000b00151ef9a7e27mr9211905plx.39.1647599677359; Fri, 18 Mar 2022 03:34:37 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw4eHzy4IQF50hT/ddKSZ0UY2J9cU8InbYVKChGw7aJVMkZmTYKHNSbfCTQcgf4H6bZpxJhpw== X-Received: by 2002:a17:902:db10:b0:151:ef9a:7e27 with SMTP id m16-20020a170902db1000b00151ef9a7e27mr9211781plx.39.1647599675619; Fri, 18 Mar 2022 03:34:35 -0700 (PDT) Received: from localhost ([240e:3a1:2e5:800:f995:6136:f760:a3d0]) by smtp.gmail.com with ESMTPSA id pi10-20020a17090b1e4a00b001bf9749b95bsm12445631pjb.50.2022.03.18.03.34.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Mar 2022 03:34:34 -0700 (PDT) From: Coiby Xu To: kexec@lists.infradead.org Date: Fri, 18 Mar 2022 18:34:21 +0800 Message-Id: <20220318103423.286410-3-coxu@redhat.com> In-Reply-To: <20220318103423.286410-1-coxu@redhat.com> References: <20220318103423.286410-1-coxu@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 X-Mailman-Approved-At: Mon, 21 Mar 2022 06:54:49 +0000 Subject: [dm-devel] [RFC 2/4] kdump, x86: pass the LUKS master key to kdump kernel using a kernel command line parameter luksmasterkey X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "maintainer:X86 ARCHITECTURE 32-BIT AND 64-BIT" , "H. Peter Anvin" , Mike Snitzer , Baoquan He , Dave Hansen , dm-devel@redhat.com, linux-kernel@vger.kernel.org, Kairui Song , Ingo Molnar , Borislav Petkov , Eric Biederman , Thomas Staudt , Thomas Gleixner , Dave Young , Milan Broz Errors-To: dm-devel-bounces@redhat.com Sender: "dm-devel" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com kdump will build up the kernel command parameter luksmasterkey as similar to elfcorehdr to pass the memory address of the stored info of LUKS master key to kdump kernel. Signed-off-by: Coiby Xu --- arch/x86/include/asm/crash.h | 1 + arch/x86/kernel/crash.c | 42 ++++++++++++++++++++++++++++++- arch/x86/kernel/kexec-bzimage64.c | 7 ++++++ include/linux/kexec.h | 4 +++ 4 files changed, 53 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h index 8b6bd63530dc..757374389296 100644 --- a/arch/x86/include/asm/crash.h +++ b/arch/x86/include/asm/crash.h @@ -4,6 +4,7 @@ struct kimage; +int crash_load_luks_key(struct kimage *image); int crash_load_segments(struct kimage *image); int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params); diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c index e8326a8d1c5d..6d117da62da4 100644 --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -304,6 +304,7 @@ static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem, unsigned long long mend) { unsigned long start, end; + int r; cmem->ranges[0].start = mstart; cmem->ranges[0].end = mend; @@ -312,7 +313,19 @@ static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem, /* Exclude elf header region */ start = image->elf_load_addr; end = start + image->elf_headers_sz - 1; - return crash_exclude_mem_range(cmem, start, end); + r = crash_exclude_mem_range(cmem, start, end); + + if (r) + return r; + + /* Exclude LUKS master key region */ + if (image->luks_master_key_addr) { + start = image->luks_master_key_addr; + end = start + image->luks_master_key_sz - 1; + return crash_exclude_mem_range(cmem, start, end); + } + + return r; } /* Prepare memory map for crash dump kernel */ @@ -383,6 +396,33 @@ int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params) return ret; } +int crash_load_luks_key(struct kimage *image) +{ + int ret; + struct kexec_buf kbuf = { .image = image, .buf_min = 0, + .buf_max = ULONG_MAX, .top_down = false }; + + image->luks_master_key_addr = 0; + ret = kexec_pass_luks_master_key(&kbuf.buffer, &kbuf.bufsz); + if (ret) + return ret; + + kbuf.memsz = kbuf.bufsz; + kbuf.buf_align = ELF_CORE_HEADER_ALIGN; + kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; + ret = kexec_add_buffer(&kbuf); + if (ret) { + vfree((void *)kbuf.buffer); + return ret; + } + image->luks_master_key_addr = kbuf.mem; + image->luks_master_key_sz = kbuf.bufsz; + pr_debug("Loaded LUKS master key at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + image->luks_master_key_addr, kbuf.bufsz, kbuf.bufsz); + + return ret; +} + int crash_load_segments(struct kimage *image) { int ret; diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c index 170d0fd68b1f..64ea3b6a5768 100644 --- a/arch/x86/kernel/kexec-bzimage64.c +++ b/arch/x86/kernel/kexec-bzimage64.c @@ -76,6 +76,10 @@ static int setup_cmdline(struct kimage *image, struct boot_params *params, if (image->type == KEXEC_TYPE_CRASH) { len = sprintf(cmdline_ptr, "elfcorehdr=0x%lx ", image->elf_load_addr); + + if (image->luks_master_key_addr != 0) + len += sprintf(cmdline_ptr + len, + "luksmasterkey=0x%lx ", image->luks_master_key_addr); } memcpy(cmdline_ptr + len, cmdline, cmdline_len); cmdline_len += len; @@ -372,6 +376,9 @@ static void *bzImage64_load(struct kimage *image, char *kernel, ret = crash_load_segments(image); if (ret) return ERR_PTR(ret); + ret = crash_load_luks_key(image); + if (ret) + pr_debug("Either no LUKS master key or error to retrieve the LUKS master key\n"); } /* diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 91507bc684e2..456a5bc28518 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -316,6 +316,10 @@ struct kimage { void *elf_headers; unsigned long elf_headers_sz; unsigned long elf_load_addr; + + /* LUKS master key buffer */ + unsigned long luks_master_key_addr; + unsigned long luks_master_key_sz; }; /* kexec interface functions */ From patchwork Fri Mar 18 10:34:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Coiby Xu X-Patchwork-Id: 12786872 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 98802C43219 for ; Mon, 21 Mar 2022 06:55:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1647845703; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=400Gvn5r+nwRiqtCdotVQv5kXmuBO1kMUlIGI8Ahk1g=; b=Zmc97WWlxjpuzgJ6XDpPdMjZg8rTxhrpLWV7YG74koM1F716KndKyac0ZT8BjrEjPkD/Tt yz28d6ZLCKBRcxYBA1KWqiG0kFRdefBrmzJu1TUnnzwxMA7uFi36IThrSFnicU1moOQJVc g+lBlZDN2OKp2tYyvqlQNyUBstB+BXM= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-264-oFmpt665MJ266tYINj-98A-1; Mon, 21 Mar 2022 02:54:59 -0400 X-MC-Unique: oFmpt665MJ266tYINj-98A-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id E0CA03C01B98; Mon, 21 Mar 2022 06:54:57 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id CD84242D3B3; Mon, 21 Mar 2022 06:54:57 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 3EE7A1953552; Mon, 21 Mar 2022 06:54:56 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 856F61949761 for ; Fri, 18 Mar 2022 10:34:42 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 739FCC3326C; Fri, 18 Mar 2022 10:34:42 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7009BC3326B for ; Fri, 18 Mar 2022 10:34:42 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 55FFB101A54C for ; Fri, 18 Mar 2022 10:34:42 +0000 (UTC) Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-447-ivjHMnKjM9uC6ZbizzPmRQ-1; Fri, 18 Mar 2022 06:34:41 -0400 X-MC-Unique: ivjHMnKjM9uC6ZbizzPmRQ-1 Received: by mail-pl1-f198.google.com with SMTP id g1-20020a170902fe0100b00153f95629f7so1711532plj.12 for ; Fri, 18 Mar 2022 03:34:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=kuGSMiWQ1weBzk6gT/GPrRoo3pCEcdrOBhI/gZQe7L8=; b=qMB+0y3gTfBGUKm78C3cF83SHOmu6KYBLhmm+n2ZpO+is4Umn9CfsgaKEhhunhywWp 7ubUsAYHcbNI4EA067xgbLISgJpCDm4HrDYGlTDC7JvD6iWFr2nDwtHe2QeHYwQK/QdJ ThYn+ZlL9yTl4q6dWfoup5eYHgPRyhHLaUG/ysrZFKWzYOZk2NypRErCr8Z+LroeVCEu /rksHD0CLH5oYtmCwSkeFt5ySK+OytymOTYkcW08SG3cJpaP+4DL6bETXXqgy3QC2s3S dyZcM+finIFxUBWwuyiY1sNDt8eDCAC4H1yVYbkQBb57ySXlqZZ+W01foE7KKNkrU6mK bKNw== X-Gm-Message-State: AOAM530hz+4Ry9ES8kt3tAZxPQXZoRkfVg64wFxMlY9MMMjc1Bez+g5e DLnWa284cIAbc74x5Yszw/Nu6ywrwsmxIlb6IgjYKe0nxmD0hcGRgeOgPwr44IiOBVgqxQ+rDAY vbYMTYeDrpuGiag8= X-Received: by 2002:a63:4560:0:b0:370:1f21:36b8 with SMTP id u32-20020a634560000000b003701f2136b8mr7182291pgk.181.1647599679834; Fri, 18 Mar 2022 03:34:39 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyhyV5GISqvWydR24KI3Wp7EU8nU5i/FqatRN/HUbpQQsjZ2tGrMtTSM/bkqPiyk99D7Hj1wA== X-Received: by 2002:a63:4560:0:b0:370:1f21:36b8 with SMTP id u32-20020a634560000000b003701f2136b8mr7182281pgk.181.1647599679569; Fri, 18 Mar 2022 03:34:39 -0700 (PDT) Received: from localhost ([240e:3a1:2e5:800:f995:6136:f760:a3d0]) by smtp.gmail.com with ESMTPSA id p125-20020a622983000000b004f6c5d58225sm9146730pfp.90.2022.03.18.03.34.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Mar 2022 03:34:39 -0700 (PDT) From: Coiby Xu To: kexec@lists.infradead.org Date: Fri, 18 Mar 2022 18:34:22 +0800 Message-Id: <20220318103423.286410-4-coxu@redhat.com> In-Reply-To: <20220318103423.286410-1-coxu@redhat.com> References: <20220318103423.286410-1-coxu@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 X-Mailman-Approved-At: Mon, 21 Mar 2022 06:54:49 +0000 Subject: [dm-devel] [RFC 3/4] crash_dump: retrieve LUKS master key in kdump kernel X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mike Snitzer , Baoquan He , dm-devel@redhat.com, linux-kernel@vger.kernel.org, Kairui Song , Thomas Staudt , Dave Young , Milan Broz , Vivek Goyal Errors-To: dm-devel-bounces@redhat.com Sender: "dm-devel" X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com kdump will retrieve the LUKS master key based on the luksmasterkey command line parameter. Signed-off-by: Coiby Xu --- include/linux/crash_dump.h | 4 +++ kernel/crash_dump.c | 69 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h index 620821549b23..24acb84b716e 100644 --- a/include/linux/crash_dump.h +++ b/include/linux/crash_dump.h @@ -15,6 +15,8 @@ extern unsigned long long elfcorehdr_addr; extern unsigned long long elfcorehdr_size; +extern unsigned long long luks_master_key_addr; + #ifdef CONFIG_CRASH_DUMP extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size); extern void elfcorehdr_free(unsigned long long addr); @@ -32,6 +34,8 @@ extern ssize_t copy_oldmem_page_encrypted(unsigned long pfn, char *buf, void vmcore_cleanup(void); +int retrive_kdump_luks_master_key(u8 *buffer, unsigned int *sz); + /* Architecture code defines this if there are other possible ELF * machine types, e.g. on bi-arch capable hardware. */ #ifndef vmcore_elf_check_arch_cross diff --git a/kernel/crash_dump.c b/kernel/crash_dump.c index 92da32275af5..ee32de300b9e 100644 --- a/kernel/crash_dump.c +++ b/kernel/crash_dump.c @@ -15,6 +15,8 @@ unsigned long long elfcorehdr_addr = ELFCORE_ADDR_MAX; EXPORT_SYMBOL_GPL(elfcorehdr_addr); +unsigned long long luks_master_key_addr; +EXPORT_SYMBOL_GPL(luks_master_key_addr); /* * stores the size of elf header of crash image */ @@ -39,3 +41,70 @@ static int __init setup_elfcorehdr(char *arg) return end > arg ? 0 : -EINVAL; } early_param("elfcorehdr", setup_elfcorehdr); + +static int __init setup_luksmasterkey(char *arg) +{ + char *end; + + if (!arg) + return -EINVAL; + luks_master_key_addr = memparse(arg, &end); + if (end > arg) + return 0; + + luks_master_key_addr = 0; + return -EINVAL; +} + +early_param("luksmasterkey", setup_luksmasterkey); + +/* + * Architectures may override this function to read LUKS master key + */ +ssize_t __weak luks_key_read(char *buf, size_t count, u64 *ppos) +{ + return read_from_oldmem(buf, count, ppos, 0, false); +} + +int retrive_kdump_luks_master_key(u8 *buffer, unsigned int *sz) +{ + unsigned int key_size; + size_t lukskeybuf_sz; + unsigned int *size_ptr; + char *lukskeybuf; + u64 addr; + int r; + + if (luks_master_key_addr == 0) { + pr_debug("LUKS master key memory address inaccessible"); + return -EINVAL; + } + + addr = luks_master_key_addr; + + /* Read LUKS master key size */ + r = luks_key_read((char *)&key_size, sizeof(unsigned int), &addr); + + if (r < 0) + return r; + + pr_debug("Retrieve LUKS master key: size=%u\n", key_size); + /* Read in LUKS maste rkey */ + lukskeybuf_sz = sizeof(unsigned int) + key_size * sizeof(u8); + lukskeybuf = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, + get_order(lukskeybuf_sz)); + if (!lukskeybuf) + return -ENOMEM; + + addr = luks_master_key_addr; + r = luks_key_read((char *)lukskeybuf, lukskeybuf_sz, &addr); + + if (r < 0) + return r; + size_ptr = (unsigned int *)lukskeybuf; + memcpy(buffer, size_ptr + 1, key_size * sizeof(u8)); + pr_debug("Retrieve LUKS master key (size=%u): %48ph...\n", key_size, buffer); + *sz = key_size; + return 0; +} +EXPORT_SYMBOL(retrive_kdump_luks_master_key); From patchwork Fri Mar 18 10:34:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Coiby Xu X-Patchwork-Id: 12786871 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4E1CBC433FE for ; Mon, 21 Mar 2022 06:55:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1647845702; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=XRFYNW+EJqnvJsPzutlxoaf9V0GxsQIC1jVFM0wJElE=; b=B2DuJeWzfhyFe4zUoi4TtpC2t09f0j57H0NP2jrxLXygYAEkaz4O68Kr1ruPb4MwTKp/sy 5ctxdWyabu0hjv1L1zw40E2ttPaIIf3NHBjqjZcH45JNOgJnJHuzdk5fGUvM+c2ytp6Ifb SmXARuI+QrrK9DgzbILK4KOoHPMyZkY= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-577-OL40jjRHN62-_qTcfTxX4A-1; Mon, 21 Mar 2022 02:55:00 -0400 X-MC-Unique: OL40jjRHN62-_qTcfTxX4A-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 6C4C3833974; Mon, 21 Mar 2022 06:54:58 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5876F4010A03; Mon, 21 Mar 2022 06:54:58 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id D296E19451F3; Mon, 21 Mar 2022 06:54:57 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 05DA91949761 for ; Fri, 18 Mar 2022 10:34:46 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id CC16956D1E0; Fri, 18 Mar 2022 10:34:45 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast07.extmail.prod.ext.rdu2.redhat.com [10.11.55.23]) by smtp.corp.redhat.com (Postfix) with ESMTPS id C800A56D17C for ; Fri, 18 Mar 2022 10:34:45 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B101D3C14CCD for ; Fri, 18 Mar 2022 10:34:45 +0000 (UTC) Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-144-juy8CuqcP1OpnixI0f1ADQ-1; Fri, 18 Mar 2022 06:34:44 -0400 X-MC-Unique: juy8CuqcP1OpnixI0f1ADQ-1 Received: by mail-pj1-f70.google.com with SMTP id q21-20020a17090a2e1500b001c44f70fd38so4812679pjd.6 for ; Fri, 18 Mar 2022 03:34:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=e6SFRMKes32y2Epjb9bRfBHy+sHjP48gM2WVhKsacmY=; b=TCdovSmuBDCfpBgyO9wmqscO48AEGryi3B6AwvQDQ19v69KBNfWho8GRQhBuCLZ3Mv zkewj6QlBL67Prs6dtvHLtmBT/fLMOUnhkim725Wow9t6VcKQ3xYzq9jy0UmYkpS/8Wz X6T0RHEnQHkrkAVO+lHwtyMtNil3dSQyz+QDdDtf6Pzz3xp8VR4Lkn2Jiy2/+tsRh7Ve XWfwkU1GudO05gPpwZi77hDtCP8LivaTggXEhjIuTmv2j+w7H8jFQ7M6YsopLXo05UVK Okm+DneH3W9+uZh4GXS59pOIGLY4FTR40EIkOsCW8JTKes91qSaoxwI4ENdn5EpqMr34 VtoQ== X-Gm-Message-State: AOAM530zNjkj7W3oTN27Hrii/drUj5YZejOtoYXkAoEnbbf4+FXfLRK+ w2LXKNAFHnoVo5x6bABaTFhPeMtCfA1HU2rZARIUhiVtVtQXl1paYsKE+k92g6eOxTKi7fRThPw nB608qmKWZKHQY0w= X-Received: by 2002:a17:902:a5c7:b0:14f:e424:3579 with SMTP id t7-20020a170902a5c700b0014fe4243579mr9761877plq.74.1647599683226; Fri, 18 Mar 2022 03:34:43 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwydLGW4oyMokHqUNqgiEVlQJ73WsUZSlWeUuNnFSrLoT8M8+9OxbPejRrRKRSgMpl8ZFsEyw== X-Received: by 2002:a17:902:a5c7:b0:14f:e424:3579 with SMTP id t7-20020a170902a5c700b0014fe4243579mr9761859plq.74.1647599682974; Fri, 18 Mar 2022 03:34:42 -0700 (PDT) Received: from localhost ([240e:3a1:2e5:800:f995:6136:f760:a3d0]) by smtp.gmail.com with ESMTPSA id o24-20020a17090a5b1800b001c6aaafa5fbsm1575423pji.24.2022.03.18.03.34.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Mar 2022 03:34:42 -0700 (PDT) From: Coiby Xu To: kexec@lists.infradead.org Date: Fri, 18 Mar 2022 18:34:23 +0800 Message-Id: <20220318103423.286410-5-coxu@redhat.com> In-Reply-To: <20220318103423.286410-1-coxu@redhat.com> References: <20220318103423.286410-1-coxu@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 X-Mailman-Approved-At: Mon, 21 Mar 2022 06:54:49 +0000 Subject: [dm-devel] [RFC 4/4] dm-crypt: reuse LUKS master key in kdump kernel X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mike Snitzer , Baoquan He , dm-devel@redhat.com, linux-kernel@vger.kernel.org, Kairui Song , Thomas Staudt , Dave Young , Milan Broz , Alasdair Kergon Errors-To: dm-devel-bounces@redhat.com Sender: "dm-devel" X-Scanned-By: MIMEDefang 2.84 on 10.11.54.2 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com When libcryptsetup passes key string starting with ":kdump", dm-crypt will interpret it as reusing the LUKS master key in kdump kernel. Signed-off-by: Coiby Xu --- drivers/md/dm-crypt.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 41f9ca377312..f3986036ec40 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -42,6 +42,7 @@ #include #include +#include #include "dm-audit.h" @@ -2602,13 +2603,17 @@ static int crypt_set_key(struct crypt_config *cc, char *key) { int r = -EINVAL; int key_string_len = strlen(key); + bool retrieve_kdump_key = false; + + if (is_kdump_kernel() && !strncmp(key, ":kdump", 5)) + retrieve_kdump_key = true; /* Hyphen (which gives a key_size of zero) means there is no key. */ - if (!cc->key_size && strcmp(key, "-")) + if (!retrieve_kdump_key && !cc->key_size && strcmp(key, "-")) goto out; /* ':' means the key is in kernel keyring, short-circuit normal key processing */ - if (key[0] == ':') { + if (!retrieve_kdump_key && key[0] == ':') { r = crypt_set_keyring_key(cc, key + 1); goto out; } @@ -2620,9 +2625,15 @@ static int crypt_set_key(struct crypt_config *cc, char *key) kfree_sensitive(cc->key_string); cc->key_string = NULL; - /* Decode key from its hex representation. */ - if (cc->key_size && hex2bin(cc->key, key, cc->key_size) < 0) - goto out; + if (retrieve_kdump_key) { + r = retrive_kdump_luks_master_key(cc->key, &cc->key_size); + if (r < 0) + goto out; + } else { + /* Decode key from its hex representation. */ + if (cc->key_size && hex2bin(cc->key, key, cc->key_size) < 0) + goto out; + } r = crypt_setkey(cc); if (!r)