From: Coiby Xu <coxu@redhat.com>
To: kexec@lists.infradead.org
Cc: "Ondrej Kozina" <okozina@redhat.com>,
"Milan Broz" <gmazyland@gmail.com>,
"Thomas Staudt" <tstaudt@de.ibm.com>,
"Daniel P . Berrangé" <berrange@redhat.com>,
"Kairui Song" <ryncsn@gmail.com>,
"Jan Pazdziora" <jpazdziora@redhat.com>,
"Pingfan Liu" <kernelfans@gmail.com>,
"Baoquan He" <bhe@redhat.com>, "Dave Young" <dyoung@redhat.com>,
linux-kernel@vger.kernel.org, x86@kernel.org,
"Dave Hansen" <dave.hansen@intel.com>,
"Vitaly Kuznetsov" <vkuznets@redhat.com>,
"Greg KH" <gregkh@linuxfoundation.org>,
"Vivek Goyal" <vgoyal@redhat.com>
Subject: [PATCH v5 4/7] crash_dump: reuse saved dm crypt keys for CPU/memory hot-plugging
Date: Fri, 7 Jun 2024 20:26:14 +0800 [thread overview]
Message-ID: <20240607122622.167228-5-coxu@redhat.com> (raw)
In-Reply-To: <20240607122622.167228-1-coxu@redhat.com>
When there are CPU and memory hot un/plugs, the crash elfcorehdr which
describes CPUs and memory in the system needs to be updated for the
kdump kernel.
Currently, there are two solutions to support this case. One is to
utilizes udev to instruct user space to reload the kdump kernel image
and initrd, elfcorehdr and etc. again. The other is to only update the
elfcorehdr segment. For the 1st solution, the dm crypt keys need to be
reloaded again. The user space can write the "reuse" command to
/sys/kernel/crash_dm_crypt_key so the stored keys can be re-saved again.
Note only x86 (commit ea53ad9cf73b ("x86/crash: add x86 crash
hotplug support")) and ppc (WIP) supports the new infrastructure
(commit 247262756121 ("crash: add generic infrastructure for crash
hotplug support")). If the new infrastructure get extended to all arches,
this patch can be dropped.
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
Documentation/ABI/testing/crash_dm_crypt_keys | 2 ++
kernel/crash_dump_dm_crypt.c | 32 ++++++++++++++++---
2 files changed, 30 insertions(+), 4 deletions(-)
diff --git a/Documentation/ABI/testing/crash_dm_crypt_keys b/Documentation/ABI/testing/crash_dm_crypt_keys
index e6a6f6be5a9e..7426c9d8de97 100644
--- a/Documentation/ABI/testing/crash_dm_crypt_keys
+++ b/Documentation/ABI/testing/crash_dm_crypt_keys
@@ -15,6 +15,8 @@ Description: read/write
Record a key description. For security reason, the key must be a logon
key whose payload can't be read by user space. For details, please refer
to security/keys/core.rst.
+ - "reuse"
+ Reuse the dm crypt keys stored in kdump reserved memory.
And you can also read this API to know the command eructation status,
- fresh
diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
index 0033152668ae..9a6bd39adf76 100644
--- a/kernel/crash_dump_dm_crypt.c
+++ b/kernel/crash_dump_dm_crypt.c
@@ -15,13 +15,15 @@ static enum STATE_ENUM {
INITIALIZED,
RECORDED,
LOADED,
+ REUSE,
} state;
static const char * const STATE_STR[] = {
[FRESH] = "fresh",
[INITIALIZED] = "initialized",
[RECORDED] = "recorded",
- [LOADED] = "loaded"
+ [LOADED] = "loaded",
+ [REUSE] = "reuse"
};
static unsigned int key_count;
@@ -107,12 +109,32 @@ static int record_key_desc(const char *buf, struct dm_crypt_key *dm_key)
return 0;
}
+static void get_keys_from_kdump_reserved_memory(void)
+{
+ struct keys_header *keys_header_loaded;
+
+ arch_kexec_unprotect_crashkres();
+
+ keys_header_loaded = kmap_local_page(pfn_to_page(
+ kexec_crash_image->dm_crypt_keys_addr >> PAGE_SHIFT));
+
+ memcpy(keys_header, keys_header_loaded, keys_header_size);
+ kunmap_local(keys_header_loaded);
+ state = RECORDED;
+ arch_kexec_protect_crashkres();
+}
+
static int process_cmd(const char *buf, size_t count)
{
if (strncmp(buf, "init ", 5) == 0)
return init(buf);
else if (strncmp(buf, "record ", 7) == 0 && count == KEY_DESC_LEN + 6)
return record_key_desc(buf, &keys_header->keys[key_count]);
+ else if (!strcmp(buf, "reuse")) {
+ state = REUSE;
+ get_keys_from_kdump_reserved_memory();
+ return 0;
+ }
return -EINVAL;
}
@@ -192,9 +214,11 @@ int crash_load_dm_crypt_keys(struct kimage *image)
}
image->dm_crypt_keys_addr = 0;
- r = build_keys_header();
- if (r)
- return r;
+ if (state != REUSE) {
+ r = build_keys_header();
+ if (r)
+ return r;
+ }
kbuf.buffer = keys_header;
kbuf.bufsz = keys_header_size;
--
2.45.1
next prev parent reply other threads:[~2024-06-07 12:26 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-07 12:26 [PATCH v4 0/7] Support kdump with LUKS encryption by reusing LUKS volume keys Coiby Xu
2024-06-07 12:26 ` [PATCH v5 1/7] kexec_file: allow to place kexec_buf randomly Coiby Xu
2024-06-08 3:51 ` kernel test robot
2024-06-08 4:23 ` kernel test robot
2024-06-08 9:12 ` Greg KH
2024-06-07 12:26 ` [PATCH v5 2/7] crash_dump: make dm crypt keys persist for the kdump kernel Coiby Xu
2024-06-08 9:19 ` Greg KH
2024-06-07 12:26 ` [PATCH v5 3/7] crash_dump: store dm crypt keys in kdump reserved memory Coiby Xu
2024-06-07 12:26 ` Coiby Xu [this message]
2024-06-07 12:26 ` [PATCH v5 5/7] crash_dump: retrieve dm crypt keys in kdump kernel Coiby Xu
2024-06-07 12:26 ` [PATCH v5 6/7] x86/crash: pass dm crypt keys to " Coiby Xu
2024-06-07 12:26 ` [PATCH v5 7/7] x86/crash: make the page that stores the dm crypt keys inaccessible Coiby Xu
2024-06-08 1:26 ` [PATCH v4 0/7] Support kdump with LUKS encryption by reusing LUKS volume keys Coiby Xu
2024-06-08 9:10 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240607122622.167228-5-coxu@redhat.com \
--to=coxu@redhat.com \
--cc=berrange@redhat.com \
--cc=bhe@redhat.com \
--cc=dave.hansen@intel.com \
--cc=dyoung@redhat.com \
--cc=gmazyland@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=jpazdziora@redhat.com \
--cc=kernelfans@gmail.com \
--cc=kexec@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=okozina@redhat.com \
--cc=ryncsn@gmail.com \
--cc=tstaudt@de.ibm.com \
--cc=vgoyal@redhat.com \
--cc=vkuznets@redhat.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox