Commit 62f17d9d authored by Coiby Xu's avatar Coiby Xu Committed by Andrew Morton
Browse files

crash_dump: retrieve dm crypt keys in kdump kernel 

Crash kernel will retrieve the dm crypt keys based on the dmcryptkeys
command line parameter.  When user space writes the key description to
/sys/kernel/config/crash_dm_crypt_key/restore, the crash kernel will save
the encryption keys to the user keyring.  Then user space e.g. 
cryptsetup's --volume-key-keyring API can use it to unlock the encrypted
device.

Link: https://lkml.kernel.org/r/20250502011246.99238-6-coxu@redhat.com


Signed-off-by: default avatarCoiby Xu <coxu@redhat.com>
Acked-by: default avatarBaoquan He <bhe@redhat.com>
Cc: "Daniel P. Berrange" <berrange@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Jan Pazdziora <jpazdziora@redhat.com>
Cc: Liu Pingfan <kernelfans@gmail.com>
Cc: Milan Broz <gmazyland@gmail.com>
Cc: Ondrej Kozina <okozina@redhat.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 9ebfa8dc

include/linux/crash_core.h

+1 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ static inline void arch_kexec_unprotect_crashkres(void) { } 


#ifdef CONFIG_CRASH_DM_CRYPT

int crash_load_dm_crypt_keys(struct kimage *image);

ssize_t dm_crypt_keys_read(char *buf, size_t count, u64 *ppos);

#else

static inline int crash_load_dm_crypt_keys(struct kimage *image) {return 0; }

#endif

include/linux/crash_dump.h

+2 −0
Original line number Diff line number Diff line
@@ -15,6 +15,8 @@ 
extern unsigned long long elfcorehdr_addr;

extern unsigned long long elfcorehdr_size;



extern unsigned long long dm_crypt_keys_addr;



#ifdef CONFIG_CRASH_DUMP

extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size);

extern void elfcorehdr_free(unsigned long long addr);

kernel/crash_dump_dm_crypt.c

+133 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
#include <linux/keyctl.h>

#include <keys/user-type.h>

#include <linux/crash_dump.h>

#include <linux/cc_platform.h>

#include <linux/configfs.h>

#include <linux/module.h>
@@ -28,6 +29,61 @@ static size_t get_keys_header_size(size_t total_keys) 
	return struct_size(keys_header, keys, total_keys);

}



unsigned long long dm_crypt_keys_addr;

EXPORT_SYMBOL_GPL(dm_crypt_keys_addr);



static int __init setup_dmcryptkeys(char *arg)

{

	char *end;



	if (!arg)

		return -EINVAL;

	dm_crypt_keys_addr = memparse(arg, &end);

	if (end > arg)

		return 0;



	dm_crypt_keys_addr = 0;

	return -EINVAL;

}



early_param("dmcryptkeys", setup_dmcryptkeys);



/*

 * Architectures may override this function to read dm crypt keys

 */

ssize_t __weak dm_crypt_keys_read(char *buf, size_t count, u64 *ppos)

{

	struct kvec kvec = { .iov_base = buf, .iov_len = count };

	struct iov_iter iter;



	iov_iter_kvec(&iter, READ, &kvec, 1, count);

	return read_from_oldmem(&iter, count, ppos, cc_platform_has(CC_ATTR_MEM_ENCRYPT));

}



static int add_key_to_keyring(struct dm_crypt_key *dm_key,

			      key_ref_t keyring_ref)

{

	key_ref_t key_ref;

	int r;



	/* create or update the requested key and add it to the target keyring */

	key_ref = key_create_or_update(keyring_ref, "user", dm_key->key_desc,

				       dm_key->data, dm_key->key_size,

				       KEY_USR_ALL, KEY_ALLOC_IN_QUOTA);



	if (!IS_ERR(key_ref)) {

		r = key_ref_to_ptr(key_ref)->serial;

		key_ref_put(key_ref);

		kexec_dprintk("Success adding key %s", dm_key->key_desc);

	} else {

		r = PTR_ERR(key_ref);

		kexec_dprintk("Error when adding key");

	}



	key_ref_put(keyring_ref);

	return r;

}



static void get_keys_from_kdump_reserved_memory(void)

{

	struct keys_header *keys_header_loaded;
@@ -42,6 +98,47 @@ static void get_keys_from_kdump_reserved_memory(void) 
	arch_kexec_protect_crashkres();

}



static int restore_dm_crypt_keys_to_thread_keyring(void)

{

	struct dm_crypt_key *key;

	size_t keys_header_size;

	key_ref_t keyring_ref;

	u64 addr;



	/* find the target keyring (which must be writable) */

	keyring_ref =

		lookup_user_key(KEY_SPEC_USER_KEYRING, 0x01, KEY_NEED_WRITE);

	if (IS_ERR(keyring_ref)) {

		kexec_dprintk("Failed to get the user keyring\n");

		return PTR_ERR(keyring_ref);

	}



	addr = dm_crypt_keys_addr;

	dm_crypt_keys_read((char *)&key_count, sizeof(key_count), &addr);

	if (key_count < 0 || key_count > KEY_NUM_MAX) {

		kexec_dprintk("Failed to read the number of dm-crypt keys\n");

		return -1;

	}



	kexec_dprintk("There are %u keys\n", key_count);

	addr = dm_crypt_keys_addr;



	keys_header_size = get_keys_header_size(key_count);

	keys_header = kzalloc(keys_header_size, GFP_KERNEL);

	if (!keys_header)

		return -ENOMEM;



	dm_crypt_keys_read((char *)keys_header, keys_header_size, &addr);



	for (int i = 0; i < keys_header->total_keys; i++) {

		key = &keys_header->keys[i];

		kexec_dprintk("Get key (size=%u)\n", key->key_size);

		add_key_to_keyring(key, keyring_ref);

	}



	return 0;

}



static int read_key_from_user_keying(struct dm_crypt_key *dm_key)

{

	const struct user_key_payload *ukp;
@@ -211,6 +308,37 @@ static const struct config_item_type config_keys_type = { 
	.ct_owner = THIS_MODULE,

};



static bool restore;



static ssize_t config_keys_restore_show(struct config_item *item, char *page)

{

	return sprintf(page, "%d\n", restore);

}



static ssize_t config_keys_restore_store(struct config_item *item,

					  const char *page, size_t count)

{

	if (!restore)

		restore_dm_crypt_keys_to_thread_keyring();



	if (kstrtobool(page, &restore))

		return -EINVAL;



	return count;

}



CONFIGFS_ATTR(config_keys_, restore);



static struct configfs_attribute *kdump_config_keys_attrs[] = {

	&config_keys_attr_restore,

	NULL,

};



static const struct config_item_type kdump_config_keys_type = {

	.ct_attrs = kdump_config_keys_attrs,

	.ct_owner = THIS_MODULE,

};



static struct configfs_subsystem config_keys_subsys = {

	.su_group = {

		.cg_item = {
@@ -311,6 +439,11 @@ static int __init configfs_dmcrypt_keys_init(void) 
{

	int ret;



	if (is_kdump_kernel()) {

		config_keys_subsys.su_group.cg_item.ci_type =

			&kdump_config_keys_type;

	}



	config_group_init(&config_keys_subsys.su_group);

	mutex_init(&config_keys_subsys.su_mutex);

	ret = configfs_register_subsystem(&config_keys_subsys);