diff options
Diffstat (limited to 'Documentation/power')
-rw-r--r-- | Documentation/power/swsusp-dmcrypt.txt | 138 |
1 files changed, 138 insertions, 0 deletions
diff --git a/Documentation/power/swsusp-dmcrypt.txt b/Documentation/power/swsusp-dmcrypt.txt new file mode 100644 index 000000000000..59931b46ff7e --- /dev/null +++ b/Documentation/power/swsusp-dmcrypt.txt | |||
@@ -0,0 +1,138 @@ | |||
1 | Author: Andreas Steinmetz <ast@domdv.de> | ||
2 | |||
3 | |||
4 | How to use dm-crypt and swsusp together: | ||
5 | ======================================== | ||
6 | |||
7 | Some prerequisites: | ||
8 | You know how dm-crypt works. If not, visit the following web page: | ||
9 | http://www.saout.de/misc/dm-crypt/ | ||
10 | You have read Documentation/power/swsusp.txt and understand it. | ||
11 | You did read Documentation/initrd.txt and know how an initrd works. | ||
12 | You know how to create or how to modify an initrd. | ||
13 | |||
14 | Now your system is properly set up, your disk is encrypted except for | ||
15 | the swap device(s) and the boot partition which may contain a mini | ||
16 | system for crypto setup and/or rescue purposes. You may even have | ||
17 | an initrd that does your current crypto setup already. | ||
18 | |||
19 | At this point you want to encrypt your swap, too. Still you want to | ||
20 | be able to suspend using swsusp. This, however, means that you | ||
21 | have to be able to either enter a passphrase or that you read | ||
22 | the key(s) from an external device like a pcmcia flash disk | ||
23 | or an usb stick prior to resume. So you need an initrd, that sets | ||
24 | up dm-crypt and then asks swsusp to resume from the encrypted | ||
25 | swap device. | ||
26 | |||
27 | The most important thing is that you set up dm-crypt in such | ||
28 | a way that the swap device you suspend to/resume from has | ||
29 | always the same major/minor within the initrd as well as | ||
30 | within your running system. The easiest way to achieve this is | ||
31 | to always set up this swap device first with dmsetup, so that | ||
32 | it will always look like the following: | ||
33 | |||
34 | brw------- 1 root root 254, 0 Jul 28 13:37 /dev/mapper/swap0 | ||
35 | |||
36 | Now set up your kernel to use /dev/mapper/swap0 as the default | ||
37 | resume partition, so your kernel .config contains: | ||
38 | |||
39 | CONFIG_PM_STD_PARTITION="/dev/mapper/swap0" | ||
40 | |||
41 | Prepare your boot loader to use the initrd you will create or | ||
42 | modify. For lilo the simplest setup looks like the following | ||
43 | lines: | ||
44 | |||
45 | image=/boot/vmlinuz | ||
46 | initrd=/boot/initrd.gz | ||
47 | label=linux | ||
48 | append="root=/dev/ram0 init=/linuxrc rw" | ||
49 | |||
50 | Finally you need to create or modify your initrd. Lets assume | ||
51 | you create an initrd that reads the required dm-crypt setup | ||
52 | from a pcmcia flash disk card. The card is formatted with an ext2 | ||
53 | fs which resides on /dev/hde1 when the card is inserted. The | ||
54 | card contains at least the encrypted swap setup in a file | ||
55 | named "swapkey". /etc/fstab of your initrd contains something | ||
56 | like the following: | ||
57 | |||
58 | /dev/hda1 /mnt ext3 ro 0 0 | ||
59 | none /proc proc defaults,noatime,nodiratime 0 0 | ||
60 | none /sys sysfs defaults,noatime,nodiratime 0 0 | ||
61 | |||
62 | /dev/hda1 contains an unencrypted mini system that sets up all | ||
63 | of your crypto devices, again by reading the setup from the | ||
64 | pcmcia flash disk. What follows now is a /linuxrc for your | ||
65 | initrd that allows you to resume from encrypted swap and that | ||
66 | continues boot with your mini system on /dev/hda1 if resume | ||
67 | does not happen: | ||
68 | |||
69 | #!/bin/sh | ||
70 | PATH=/sbin:/bin:/usr/sbin:/usr/bin | ||
71 | mount /proc | ||
72 | mount /sys | ||
73 | mapped=0 | ||
74 | noresume=`grep -c noresume /proc/cmdline` | ||
75 | if [ "$*" != "" ] | ||
76 | then | ||
77 | noresume=1 | ||
78 | fi | ||
79 | dmesg -n 1 | ||
80 | /sbin/cardmgr -q | ||
81 | for i in 1 2 3 4 5 6 7 8 9 0 | ||
82 | do | ||
83 | if [ -f /proc/ide/hde/media ] | ||
84 | then | ||
85 | usleep 500000 | ||
86 | mount -t ext2 -o ro /dev/hde1 /mnt | ||
87 | if [ -f /mnt/swapkey ] | ||
88 | then | ||
89 | dmsetup create swap0 /mnt/swapkey > /dev/null 2>&1 && mapped=1 | ||
90 | fi | ||
91 | umount /mnt | ||
92 | break | ||
93 | fi | ||
94 | usleep 500000 | ||
95 | done | ||
96 | killproc /sbin/cardmgr | ||
97 | dmesg -n 6 | ||
98 | if [ $mapped = 1 ] | ||
99 | then | ||
100 | if [ $noresume != 0 ] | ||
101 | then | ||
102 | mkswap /dev/mapper/swap0 > /dev/null 2>&1 | ||
103 | fi | ||
104 | echo 254:0 > /sys/power/resume | ||
105 | dmsetup remove swap0 | ||
106 | fi | ||
107 | umount /sys | ||
108 | mount /mnt | ||
109 | umount /proc | ||
110 | cd /mnt | ||
111 | pivot_root . mnt | ||
112 | mount /proc | ||
113 | umount -l /mnt | ||
114 | umount /proc | ||
115 | exec chroot . /sbin/init $* < dev/console > dev/console 2>&1 | ||
116 | |||
117 | Please don't mind the weird loop above, busybox's msh doesn't know | ||
118 | the let statement. Now, what is happening in the script? | ||
119 | First we have to decide if we want to try to resume, or not. | ||
120 | We will not resume if booting with "noresume" or any parameters | ||
121 | for init like "single" or "emergency" as boot parameters. | ||
122 | |||
123 | Then we need to set up dmcrypt with the setup data from the | ||
124 | pcmcia flash disk. If this succeeds we need to reset the swap | ||
125 | device if we don't want to resume. The line "echo 254:0 > /sys/power/resume" | ||
126 | then attempts to resume from the first device mapper device. | ||
127 | Note that it is important to set the device in /sys/power/resume, | ||
128 | regardless if resuming or not, otherwise later suspend will fail. | ||
129 | If resume starts, script execution terminates here. | ||
130 | |||
131 | Otherwise we just remove the encrypted swap device and leave it to the | ||
132 | mini system on /dev/hda1 to set the whole crypto up (it is up to | ||
133 | you to modify this to your taste). | ||
134 | |||
135 | What then follows is the well known process to change the root | ||
136 | file system and continue booting from there. I prefer to unmount | ||
137 | the initrd prior to continue booting but it is up to you to modify | ||
138 | this. | ||