141 lines · plain
1=======================================2How to use dm-crypt and swsusp together3=======================================4 5Author: Andreas Steinmetz <ast@domdv.de>6 7 8 9Some prerequisites:10You know how dm-crypt works. If not, visit the following web page:11http://www.saout.de/misc/dm-crypt/12You have read Documentation/power/swsusp.rst and understand it.13You did read Documentation/admin-guide/initrd.rst and know how an initrd works.14You know how to create or how to modify an initrd.15 16Now your system is properly set up, your disk is encrypted except for17the swap device(s) and the boot partition which may contain a mini18system for crypto setup and/or rescue purposes. You may even have19an initrd that does your current crypto setup already.20 21At this point you want to encrypt your swap, too. Still you want to22be able to suspend using swsusp. This, however, means that you23have to be able to either enter a passphrase or that you read24the key(s) from an external device like a pcmcia flash disk25or an usb stick prior to resume. So you need an initrd, that sets26up dm-crypt and then asks swsusp to resume from the encrypted27swap device.28 29The most important thing is that you set up dm-crypt in such30a way that the swap device you suspend to/resume from has31always the same major/minor within the initrd as well as32within your running system. The easiest way to achieve this is33to always set up this swap device first with dmsetup, so that34it will always look like the following::35 36 brw------- 1 root root 254, 0 Jul 28 13:37 /dev/mapper/swap037 38Now set up your kernel to use /dev/mapper/swap0 as the default39resume partition, so your kernel .config contains::40 41 CONFIG_PM_STD_PARTITION="/dev/mapper/swap0"42 43Prepare your boot loader to use the initrd you will create or44modify. For lilo the simplest setup looks like the following45lines::46 47 image=/boot/vmlinuz48 initrd=/boot/initrd.gz49 label=linux50 append="root=/dev/ram0 init=/linuxrc rw"51 52Finally you need to create or modify your initrd. Lets assume53you create an initrd that reads the required dm-crypt setup54from a pcmcia flash disk card. The card is formatted with an ext255fs which resides on /dev/hde1 when the card is inserted. The56card contains at least the encrypted swap setup in a file57named "swapkey". /etc/fstab of your initrd contains something58like the following::59 60 /dev/hda1 /mnt ext3 ro 0 061 none /proc proc defaults,noatime,nodiratime 0 062 none /sys sysfs defaults,noatime,nodiratime 0 063 64/dev/hda1 contains an unencrypted mini system that sets up all65of your crypto devices, again by reading the setup from the66pcmcia flash disk. What follows now is a /linuxrc for your67initrd that allows you to resume from encrypted swap and that68continues boot with your mini system on /dev/hda1 if resume69does not happen::70 71 #!/bin/sh72 PATH=/sbin:/bin:/usr/sbin:/usr/bin73 mount /proc74 mount /sys75 mapped=076 noresume=`grep -c noresume /proc/cmdline`77 if [ "$*" != "" ]78 then79 noresume=180 fi81 dmesg -n 182 /sbin/cardmgr -q83 for i in 1 2 3 4 5 6 7 8 9 084 do85 if [ -f /proc/ide/hde/media ]86 then87 usleep 50000088 mount -t ext2 -o ro /dev/hde1 /mnt89 if [ -f /mnt/swapkey ]90 then91 dmsetup create swap0 /mnt/swapkey > /dev/null 2>&1 && mapped=192 fi93 umount /mnt94 break95 fi96 usleep 50000097 done98 killproc /sbin/cardmgr99 dmesg -n 6100 if [ $mapped = 1 ]101 then102 if [ $noresume != 0 ]103 then104 mkswap /dev/mapper/swap0 > /dev/null 2>&1105 fi106 echo 254:0 > /sys/power/resume107 dmsetup remove swap0108 fi109 umount /sys110 mount /mnt111 umount /proc112 cd /mnt113 pivot_root . mnt114 mount /proc115 umount -l /mnt116 umount /proc117 exec chroot . /sbin/init $* < dev/console > dev/console 2>&1118 119Please don't mind the weird loop above, busybox's msh doesn't know120the let statement. Now, what is happening in the script?121First we have to decide if we want to try to resume, or not.122We will not resume if booting with "noresume" or any parameters123for init like "single" or "emergency" as boot parameters.124 125Then we need to set up dmcrypt with the setup data from the126pcmcia flash disk. If this succeeds we need to reset the swap127device if we don't want to resume. The line "echo 254:0 > /sys/power/resume"128then attempts to resume from the first device mapper device.129Note that it is important to set the device in /sys/power/resume,130regardless if resuming or not, otherwise later suspend will fail.131If resume starts, script execution terminates here.132 133Otherwise we just remove the encrypted swap device and leave it to the134mini system on /dev/hda1 to set the whole crypto up (it is up to135you to modify this to your taste).136 137What then follows is the well known process to change the root138file system and continue booting from there. I prefer to unmount139the initrd prior to continue booting but it is up to you to modify140this.141