From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5281019F42F for ; Wed, 21 May 2025 17:48:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747849732; cv=none; b=dIO6HJdA1q/0zwnvebR9AN/qTesN+Nrm67Q24utkbUBoVcxxA25tpDIl5HuRt+uKjd6oflj96EP886ztIZD2XsAC/B7d+j8NINFhE3cdG7BhciZPqCdxuBn0pRHhMO8TwAdk3YBGlIB0DeGeoTbaKJ69JoZkCU2QJre7nxBD14g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747849732; c=relaxed/simple; bh=FA268U8kg3/+oeHZleSTvtH3TYD1g7Az7IHZjkprAWk=; h=Date:To:From:Subject:Message-Id; b=YSDxYXWNVt+XAs/icVY1r/ZhgZf5sUGUOvk397IGWY4Z2cWlglJUxXILGtjBoIZ75D08EYUeVrUAyWlOPo73kCaK4iMF4oQM9hcHjE4i+CQw+zqKahQHOHXml22m3TNoJ3IiMX8Hj19t96w+f2xcerzmFuhzLVmht5NErgP+myw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=Xyo9AJOD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="Xyo9AJOD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 225F7C4CEE4; Wed, 21 May 2025 17:48:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1747849732; bh=FA268U8kg3/+oeHZleSTvtH3TYD1g7Az7IHZjkprAWk=; h=Date:To:From:Subject:From; b=Xyo9AJOD5jj4ysX/6efacDGJPiyXzOXMQ4jgU5FwZIkb8RSBPjX4bADmd7+jbabSb Hb6/s1ElkrRU5/10cB0aA+P5veaaNJJaqobNCoWs3+gVkhPOLZ01SNDICi9JaTf9ck XvYbKMWc+cA4xNfsfPz051tIKmKhsYlb45dvWQgQ= Date: Wed, 21 May 2025 10:48:51 -0700 To: mm-commits@vger.kernel.org,vkuznets@redhat.com,okozina@redhat.com,kernelfans@gmail.com,jpazdziora@redhat.com,gmazyland@gmail.com,dyoung@redhat.com,dave.hansen@intel.com,bhe@redhat.com,berrange@redhat.com,coxu@redhat.com,akpm@linux-foundation.org From: Andrew Morton Subject: [merged mm-nonmm-stable] crash_dump-store-dm-crypt-keys-in-kdump-reserved-memory.patch removed from -mm tree Message-Id: <20250521174852.225F7C4CEE4@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The quilt patch titled Subject: crash_dump: store dm crypt keys in kdump reserved memory has been removed from the -mm tree. Its filename was crash_dump-store-dm-crypt-keys-in-kdump-reserved-memory.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Coiby Xu Subject: crash_dump: store dm crypt keys in kdump reserved memory Date: Fri, 2 May 2025 09:12:37 +0800 When the kdump kernel image and initrd are loaded, the dm crypts keys will be read from keyring and then stored in kdump reserved memory. Assume a key won't exceed 256 bytes thus MAX_KEY_SIZE=256 according to "cryptsetup benchmark". Link: https://lkml.kernel.org/r/20250502011246.99238-4-coxu@redhat.com Signed-off-by: Coiby Xu Acked-by: Baoquan He Cc: "Daniel P. Berrange" Cc: Dave Hansen Cc: Dave Young Cc: Jan Pazdziora Cc: Liu Pingfan Cc: Milan Broz Cc: Ondrej Kozina Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton --- include/linux/crash_core.h | 6 + include/linux/kexec.h | 4 kernel/crash_dump_dm_crypt.c | 133 +++++++++++++++++++++++++++++++++ 3 files changed, 142 insertions(+), 1 deletion(-) --- a/include/linux/crash_core.h~crash_dump-store-dm-crypt-keys-in-kdump-reserved-memory +++ a/include/linux/crash_core.h @@ -34,7 +34,11 @@ static inline void arch_kexec_protect_cr static inline void arch_kexec_unprotect_crashkres(void) { } #endif - +#ifdef CONFIG_CRASH_DM_CRYPT +int crash_load_dm_crypt_keys(struct kimage *image); +#else +static inline int crash_load_dm_crypt_keys(struct kimage *image) {return 0; } +#endif #ifndef arch_crash_handle_hotplug_event static inline void arch_crash_handle_hotplug_event(struct kimage *image, void *arg) { } --- a/include/linux/kexec.h~crash_dump-store-dm-crypt-keys-in-kdump-reserved-memory +++ a/include/linux/kexec.h @@ -405,6 +405,10 @@ struct kimage { void *elf_headers; unsigned long elf_headers_sz; unsigned long elf_load_addr; + + /* dm crypt keys buffer */ + unsigned long dm_crypt_keys_addr; + unsigned long dm_crypt_keys_sz; }; /* kexec interface functions */ --- a/kernel/crash_dump_dm_crypt.c~crash_dump-store-dm-crypt-keys-in-kdump-reserved-memory +++ a/kernel/crash_dump_dm_crypt.c @@ -1,14 +1,62 @@ // SPDX-License-Identifier: GPL-2.0-only +#include +#include #include #include #include #include #define KEY_NUM_MAX 128 /* maximum dm crypt keys */ +#define KEY_SIZE_MAX 256 /* maximum dm crypt key size */ #define KEY_DESC_MAX_LEN 128 /* maximum dm crypt key description size */ static unsigned int key_count; +struct dm_crypt_key { + unsigned int key_size; + char key_desc[KEY_DESC_MAX_LEN]; + u8 data[KEY_SIZE_MAX]; +}; + +static struct keys_header { + unsigned int total_keys; + struct dm_crypt_key keys[] __counted_by(total_keys); +} *keys_header; + +static size_t get_keys_header_size(size_t total_keys) +{ + return struct_size(keys_header, keys, total_keys); +} + +static int read_key_from_user_keying(struct dm_crypt_key *dm_key) +{ + const struct user_key_payload *ukp; + struct key *key; + + kexec_dprintk("Requesting logon key %s", dm_key->key_desc); + key = request_key(&key_type_logon, dm_key->key_desc, NULL); + + if (IS_ERR(key)) { + pr_warn("No such logon key %s\n", dm_key->key_desc); + return PTR_ERR(key); + } + + ukp = user_key_payload_locked(key); + if (!ukp) + return -EKEYREVOKED; + + if (ukp->datalen > KEY_SIZE_MAX) { + pr_err("Key size %u exceeds maximum (%u)\n", ukp->datalen, KEY_SIZE_MAX); + return -EINVAL; + } + + memcpy(dm_key->data, ukp->data, ukp->datalen); + dm_key->key_size = ukp->datalen; + kexec_dprintk("Get dm crypt key (size=%u) %s: %8ph\n", dm_key->key_size, + dm_key->key_desc, dm_key->data); + return 0; +} + struct config_key { struct config_item item; const char *description; @@ -130,6 +178,91 @@ static struct configfs_subsystem config_ }, }; +static int build_keys_header(void) +{ + struct config_item *item = NULL; + struct config_key *key; + int i, r; + + if (keys_header != NULL) + kvfree(keys_header); + + keys_header = kzalloc(get_keys_header_size(key_count), GFP_KERNEL); + if (!keys_header) + return -ENOMEM; + + keys_header->total_keys = key_count; + + i = 0; + list_for_each_entry(item, &config_keys_subsys.su_group.cg_children, + ci_entry) { + if (item->ci_type != &config_key_type) + continue; + + key = to_config_key(item); + + if (!key->description) { + pr_warn("No key description for key %s\n", item->ci_name); + return -EINVAL; + } + + strscpy(keys_header->keys[i].key_desc, key->description, + KEY_DESC_MAX_LEN); + r = read_key_from_user_keying(&keys_header->keys[i]); + if (r != 0) { + kexec_dprintk("Failed to read key %s\n", + keys_header->keys[i].key_desc); + return r; + } + i++; + kexec_dprintk("Found key: %s\n", item->ci_name); + } + + return 0; +} + +int crash_load_dm_crypt_keys(struct kimage *image) +{ + struct kexec_buf kbuf = { + .image = image, + .buf_min = 0, + .buf_max = ULONG_MAX, + .top_down = false, + .random = true, + }; + int r; + + + if (key_count <= 0) { + kexec_dprintk("No dm-crypt keys\n"); + return -ENOENT; + } + + image->dm_crypt_keys_addr = 0; + r = build_keys_header(); + if (r) + return r; + + kbuf.buffer = keys_header; + kbuf.bufsz = get_keys_header_size(key_count); + + kbuf.memsz = kbuf.bufsz; + kbuf.buf_align = ELF_CORE_HEADER_ALIGN; + kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; + r = kexec_add_buffer(&kbuf); + if (r) { + kvfree((void *)kbuf.buffer); + return r; + } + image->dm_crypt_keys_addr = kbuf.mem; + image->dm_crypt_keys_sz = kbuf.bufsz; + kexec_dprintk( + "Loaded dm crypt keys to kexec_buffer bufsz=0x%lx memsz=0x%lx\n", + kbuf.bufsz, kbuf.memsz); + + return r; +} + static int __init configfs_dmcrypt_keys_init(void) { int ret; _ Patches currently in -mm which might be from coxu@redhat.com are