crash_dump: retrieve dm crypt keys in kdump kernel

Crash kernel will retrieve the dm crypt keys based on the dmcryptkeys
command line parameter.  When user space writes the key description to
/sys/kernel/config/crash_dm_crypt_key/restore, the crash kernel will save
the encryption keys to the user keyring.  Then user space e.g.
cryptsetup's --volume-key-keyring API can use it to unlock the encrypted
device.

Link: https://lkml.kernel.org/r/20250502011246.99238-6-coxu@redhat.com
Signed-off-by: Coiby Xu <coxu@redhat.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: "Daniel P. Berrange" <berrange@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Jan Pazdziora <jpazdziora@redhat.com>
Cc: Liu Pingfan <kernelfans@gmail.com>
Cc: Milan Broz <gmazyland@gmail.com>
Cc: Ondrej Kozina <okozina@redhat.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
index 2e678223903436a2f5cca3a93c764b8e6cf78eca..d35726d6a415bca10fd44c7fcec34b76241b05f5 100644 (file)
--- a/include/linux/crash_core.h
+++ b/include/linux/crash_core.h
@@ -36,6 +36,7 @@ static inline void arch_kexec_unprotect_crashkres(void) { }
 
 #ifdef CONFIG_CRASH_DM_CRYPT
 int crash_load_dm_crypt_keys(struct kimage *image);
+ssize_t dm_crypt_keys_read(char *buf, size_t count, u64 *ppos);
 #else
 static inline int crash_load_dm_crypt_keys(struct kimage *image) {return 0; }
 #endif

diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
index 2f2555e6407ce2a8e1968d9b897dd67afb03eedb..dd6fc3b2133be7b03f5749f6a7b2f8171518ce1a 100644 (file)
--- a/include/linux/crash_dump.h
+++ b/include/linux/crash_dump.h
@@ -15,6 +15,8 @@
 extern unsigned long long elfcorehdr_addr;
 extern unsigned long long elfcorehdr_size;
 
+extern unsigned long long dm_crypt_keys_addr;
+
 #ifdef CONFIG_CRASH_DUMP
 extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size);
 extern void elfcorehdr_free(unsigned long long addr);

diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
index 5f4a623891507fa09c0cad9457a7fab1e68cf517..401423ba477da038d30037c98025be561f8bfea2 100644 (file)
--- a/kernel/crash_dump_dm_crypt.c
+++ b/kernel/crash_dump_dm_crypt.c
@@ -3,6 +3,7 @@
 #include <linux/keyctl.h>
 #include <keys/user-type.h>
 #include <linux/crash_dump.h>
+#include <linux/cc_platform.h>
 #include <linux/configfs.h>
 #include <linux/module.h>
 
@@ -28,6 +29,61 @@ static size_t get_keys_header_size(size_t total_keys)
        return struct_size(keys_header, keys, total_keys);
 }
 
+unsigned long long dm_crypt_keys_addr;
+EXPORT_SYMBOL_GPL(dm_crypt_keys_addr);
+
+static int __init setup_dmcryptkeys(char *arg)
+{
+       char *end;
+
+       if (!arg)
+               return -EINVAL;
+       dm_crypt_keys_addr = memparse(arg, &end);
+       if (end > arg)
+               return 0;
+
+       dm_crypt_keys_addr = 0;
+       return -EINVAL;
+}
+
+early_param("dmcryptkeys", setup_dmcryptkeys);
+
+/*
+ * Architectures may override this function to read dm crypt keys
+ */
+ssize_t __weak dm_crypt_keys_read(char *buf, size_t count, u64 *ppos)
+{
+       struct kvec kvec = { .iov_base = buf, .iov_len = count };
+       struct iov_iter iter;
+
+       iov_iter_kvec(&iter, READ, &kvec, 1, count);
+       return read_from_oldmem(&iter, count, ppos, cc_platform_has(CC_ATTR_MEM_ENCRYPT));
+}
+
+static int add_key_to_keyring(struct dm_crypt_key *dm_key,
+                             key_ref_t keyring_ref)
+{
+       key_ref_t key_ref;
+       int r;
+
+       /* create or update the requested key and add it to the target keyring */
+       key_ref = key_create_or_update(keyring_ref, "user", dm_key->key_desc,
+                                      dm_key->data, dm_key->key_size,
+                                      KEY_USR_ALL, KEY_ALLOC_IN_QUOTA);
+
+       if (!IS_ERR(key_ref)) {
+               r = key_ref_to_ptr(key_ref)->serial;
+               key_ref_put(key_ref);
+               kexec_dprintk("Success adding key %s", dm_key->key_desc);
+       } else {
+               r = PTR_ERR(key_ref);
+               kexec_dprintk("Error when adding key");
+       }
+
+       key_ref_put(keyring_ref);
+       return r;
+}
+
 static void get_keys_from_kdump_reserved_memory(void)
 {
        struct keys_header *keys_header_loaded;
@@ -42,6 +98,47 @@ static void get_keys_from_kdump_reserved_memory(void)
        arch_kexec_protect_crashkres();
 }
 
+static int restore_dm_crypt_keys_to_thread_keyring(void)
+{
+       struct dm_crypt_key *key;
+       size_t keys_header_size;
+       key_ref_t keyring_ref;
+       u64 addr;
+
+       /* find the target keyring (which must be writable) */
+       keyring_ref =
+               lookup_user_key(KEY_SPEC_USER_KEYRING, 0x01, KEY_NEED_WRITE);
+       if (IS_ERR(keyring_ref)) {
+               kexec_dprintk("Failed to get the user keyring\n");
+               return PTR_ERR(keyring_ref);
+       }
+
+       addr = dm_crypt_keys_addr;
+       dm_crypt_keys_read((char *)&key_count, sizeof(key_count), &addr);
+       if (key_count < 0 || key_count > KEY_NUM_MAX) {
+               kexec_dprintk("Failed to read the number of dm-crypt keys\n");
+               return -1;
+       }
+
+       kexec_dprintk("There are %u keys\n", key_count);
+       addr = dm_crypt_keys_addr;
+
+       keys_header_size = get_keys_header_size(key_count);
+       keys_header = kzalloc(keys_header_size, GFP_KERNEL);
+       if (!keys_header)
+               return -ENOMEM;
+
+       dm_crypt_keys_read((char *)keys_header, keys_header_size, &addr);
+
+       for (int i = 0; i < keys_header->total_keys; i++) {
+               key = &keys_header->keys[i];
+               kexec_dprintk("Get key (size=%u)\n", key->key_size);
+               add_key_to_keyring(key, keyring_ref);
+       }
+
+       return 0;
+}
+
 static int read_key_from_user_keying(struct dm_crypt_key *dm_key)
 {
        const struct user_key_payload *ukp;
@@ -211,6 +308,37 @@ static const struct config_item_type config_keys_type = {
        .ct_owner = THIS_MODULE,
 };
 
+static bool restore;
+
+static ssize_t config_keys_restore_show(struct config_item *item, char *page)
+{
+       return sprintf(page, "%d\n", restore);
+}
+
+static ssize_t config_keys_restore_store(struct config_item *item,
+                                         const char *page, size_t count)
+{
+       if (!restore)
+               restore_dm_crypt_keys_to_thread_keyring();
+
+       if (kstrtobool(page, &restore))
+               return -EINVAL;
+
+       return count;
+}
+
+CONFIGFS_ATTR(config_keys_, restore);
+
+static struct configfs_attribute *kdump_config_keys_attrs[] = {
+       &config_keys_attr_restore,
+       NULL,
+};
+
+static const struct config_item_type kdump_config_keys_type = {
+       .ct_attrs = kdump_config_keys_attrs,
+       .ct_owner = THIS_MODULE,
+};
+
 static struct configfs_subsystem config_keys_subsys = {
        .su_group = {
                .cg_item = {
@@ -311,6 +439,11 @@ static int __init configfs_dmcrypt_keys_init(void)
 {
        int ret;
 
+       if (is_kdump_kernel()) {
+               config_keys_subsys.su_group.cg_item.ci_type =
+                       &kdump_config_keys_type;
+       }
+
        config_group_init(&config_keys_subsys.su_group);
        mutex_init(&config_keys_subsys.su_mutex);
        ret = configfs_register_subsystem(&config_keys_subsys);