swsusp-dmcrypt.rst 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
  1. =======================================
  2. How to use dm-crypt and swsusp together
  3. =======================================
  4. Author: Andreas Steinmetz <ast@domdv.de>
  5. Some prerequisites:
  6. You know how dm-crypt works. If not, visit the following web page:
  7. http://www.saout.de/misc/dm-crypt/
  8. You have read Documentation/power/swsusp.rst and understand it.
  9. You did read Documentation/admin-guide/initrd.rst and know how an initrd works.
  10. You know how to create or how to modify an initrd.
  11. Now your system is properly set up, your disk is encrypted except for
  12. the swap device(s) and the boot partition which may contain a mini
  13. system for crypto setup and/or rescue purposes. You may even have
  14. an initrd that does your current crypto setup already.
  15. At this point you want to encrypt your swap, too. Still you want to
  16. be able to suspend using swsusp. This, however, means that you
  17. have to be able to either enter a passphrase or that you read
  18. the key(s) from an external device like a pcmcia flash disk
  19. or an usb stick prior to resume. So you need an initrd, that sets
  20. up dm-crypt and then asks swsusp to resume from the encrypted
  21. swap device.
  22. The most important thing is that you set up dm-crypt in such
  23. a way that the swap device you suspend to/resume from has
  24. always the same major/minor within the initrd as well as
  25. within your running system. The easiest way to achieve this is
  26. to always set up this swap device first with dmsetup, so that
  27. it will always look like the following::
  28. brw------- 1 root root 254, 0 Jul 28 13:37 /dev/mapper/swap0
  29. Now set up your kernel to use /dev/mapper/swap0 as the default
  30. resume partition, so your kernel .config contains::
  31. CONFIG_PM_STD_PARTITION="/dev/mapper/swap0"
  32. Prepare your boot loader to use the initrd you will create or
  33. modify. For lilo the simplest setup looks like the following
  34. lines::
  35. image=/boot/vmlinuz
  36. initrd=/boot/initrd.gz
  37. label=linux
  38. append="root=/dev/ram0 init=/linuxrc rw"
  39. Finally you need to create or modify your initrd. Lets assume
  40. you create an initrd that reads the required dm-crypt setup
  41. from a pcmcia flash disk card. The card is formatted with an ext2
  42. fs which resides on /dev/hde1 when the card is inserted. The
  43. card contains at least the encrypted swap setup in a file
  44. named "swapkey". /etc/fstab of your initrd contains something
  45. like the following::
  46. /dev/hda1 /mnt ext3 ro 0 0
  47. none /proc proc defaults,noatime,nodiratime 0 0
  48. none /sys sysfs defaults,noatime,nodiratime 0 0
  49. /dev/hda1 contains an unencrypted mini system that sets up all
  50. of your crypto devices, again by reading the setup from the
  51. pcmcia flash disk. What follows now is a /linuxrc for your
  52. initrd that allows you to resume from encrypted swap and that
  53. continues boot with your mini system on /dev/hda1 if resume
  54. does not happen::
  55. #!/bin/sh
  56. PATH=/sbin:/bin:/usr/sbin:/usr/bin
  57. mount /proc
  58. mount /sys
  59. mapped=0
  60. noresume=`grep -c noresume /proc/cmdline`
  61. if [ "$*" != "" ]
  62. then
  63. noresume=1
  64. fi
  65. dmesg -n 1
  66. /sbin/cardmgr -q
  67. for i in 1 2 3 4 5 6 7 8 9 0
  68. do
  69. if [ -f /proc/ide/hde/media ]
  70. then
  71. usleep 500000
  72. mount -t ext2 -o ro /dev/hde1 /mnt
  73. if [ -f /mnt/swapkey ]
  74. then
  75. dmsetup create swap0 /mnt/swapkey > /dev/null 2>&1 && mapped=1
  76. fi
  77. umount /mnt
  78. break
  79. fi
  80. usleep 500000
  81. done
  82. killproc /sbin/cardmgr
  83. dmesg -n 6
  84. if [ $mapped = 1 ]
  85. then
  86. if [ $noresume != 0 ]
  87. then
  88. mkswap /dev/mapper/swap0 > /dev/null 2>&1
  89. fi
  90. echo 254:0 > /sys/power/resume
  91. dmsetup remove swap0
  92. fi
  93. umount /sys
  94. mount /mnt
  95. umount /proc
  96. cd /mnt
  97. pivot_root . mnt
  98. mount /proc
  99. umount -l /mnt
  100. umount /proc
  101. exec chroot . /sbin/init $* < dev/console > dev/console 2>&1
  102. Please don't mind the weird loop above, busybox's msh doesn't know
  103. the let statement. Now, what is happening in the script?
  104. First we have to decide if we want to try to resume, or not.
  105. We will not resume if booting with "noresume" or any parameters
  106. for init like "single" or "emergency" as boot parameters.
  107. Then we need to set up dmcrypt with the setup data from the
  108. pcmcia flash disk. If this succeeds we need to reset the swap
  109. device if we don't want to resume. The line "echo 254:0 > /sys/power/resume"
  110. then attempts to resume from the first device mapper device.
  111. Note that it is important to set the device in /sys/power/resume,
  112. regardless if resuming or not, otherwise later suspend will fail.
  113. If resume starts, script execution terminates here.
  114. Otherwise we just remove the encrypted swap device and leave it to the
  115. mini system on /dev/hda1 to set the whole crypto up (it is up to
  116. you to modify this to your taste).
  117. What then follows is the well known process to change the root
  118. file system and continue booting from there. I prefer to unmount
  119. the initrd prior to continue booting but it is up to you to modify
  120. this.