Re: [PATCH v2 01/13] kexec: add CRASH_WIPE_SECRETS to wipe secrets before kdump

[Baoquan He <baoquan.he@linux.dev>]

On 08/11/26 at 07:52pm, Jan Sebastian Götte wrote:
.....snip...
> @@ -142,6 +170,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
>  			crash_save_vmcoreinfo();
>  			machine_crash_shutdown(&fixed_regs);
>  			crash_cma_clear_pending_dma();
> +			crash_wipe_secrets();

I remember when crash_cma added this, we argued a lot about the risk,
finally it's added in with an added note to tell it's an opt-in feature
and risky. I don't know if it opens a Pandora box, I think anything
wanted being here need prove anything else has been tried, and the thing
is very very important. If we don't guard the door well, one day one guy
cold come and said I need ask Oracle database to do some transactions
before juming into kdump kernel because the actions will save billions
of dollar. 

And what does security people say about this wiping? Is it very
important information and wiping is mandotary? There's no any other way
to wipe it or pollute it, no way in kdump kernel? I noticed it's
happening on en embedded target, is it possible you do this on your
embedded kernel tree, but not mainline tree?

Anyone who wants to do thing like this, please prepare answers for them,
and be ready to accept failure.

Thanks
Baoquan

>  			machine_kexec(kexec_crash_image);
>  		}
>  		kexec_unlock();
> 
> -- 
> 2.53.0
>