0001 =======================================
0002 How to use dm-crypt and swsusp together
0003 =======================================
0004
0005 Author: Andreas Steinmetz <ast@domdv.de>
0006
0007
0008
0009 Some prerequisites:
0010 You know how dm-crypt works. If not, visit the following web page:
0011 http://www.saout.de/misc/dm-crypt/
0012 You have read Documentation/power/swsusp.rst and understand it.
0013 You did read Documentation/admin-guide/initrd.rst and know how an initrd works.
0014 You know how to create or how to modify an initrd.
0015
0016 Now your system is properly set up, your disk is encrypted except for
0017 the swap device(s) and the boot partition which may contain a mini
0018 system for crypto setup and/or rescue purposes. You may even have
0019 an initrd that does your current crypto setup already.
0020
0021 At this point you want to encrypt your swap, too. Still you want to
0022 be able to suspend using swsusp. This, however, means that you
0023 have to be able to either enter a passphrase or that you read
0024 the key(s) from an external device like a pcmcia flash disk
0025 or an usb stick prior to resume. So you need an initrd, that sets
0026 up dm-crypt and then asks swsusp to resume from the encrypted
0027 swap device.
0028
0029 The most important thing is that you set up dm-crypt in such
0030 a way that the swap device you suspend to/resume from has
0031 always the same major/minor within the initrd as well as
0032 within your running system. The easiest way to achieve this is
0033 to always set up this swap device first with dmsetup, so that
0034 it will always look like the following::
0035
0036 brw------- 1 root root 254, 0 Jul 28 13:37 /dev/mapper/swap0
0037
0038 Now set up your kernel to use /dev/mapper/swap0 as the default
0039 resume partition, so your kernel .config contains::
0040
0041 CONFIG_PM_STD_PARTITION="/dev/mapper/swap0"
0042
0043 Prepare your boot loader to use the initrd you will create or
0044 modify. For lilo the simplest setup looks like the following
0045 lines::
0046
0047 image=/boot/vmlinuz
0048 initrd=/boot/initrd.gz
0049 label=linux
0050 append="root=/dev/ram0 init=/linuxrc rw"
0051
0052 Finally you need to create or modify your initrd. Lets assume
0053 you create an initrd that reads the required dm-crypt setup
0054 from a pcmcia flash disk card. The card is formatted with an ext2
0055 fs which resides on /dev/hde1 when the card is inserted. The
0056 card contains at least the encrypted swap setup in a file
0057 named "swapkey". /etc/fstab of your initrd contains something
0058 like the following::
0059
0060 /dev/hda1 /mnt ext3 ro 0 0
0061 none /proc proc defaults,noatime,nodiratime 0 0
0062 none /sys sysfs defaults,noatime,nodiratime 0 0
0063
0064 /dev/hda1 contains an unencrypted mini system that sets up all
0065 of your crypto devices, again by reading the setup from the
0066 pcmcia flash disk. What follows now is a /linuxrc for your
0067 initrd that allows you to resume from encrypted swap and that
0068 continues boot with your mini system on /dev/hda1 if resume
0069 does not happen::
0070
0071 #!/bin/sh
0072 PATH=/sbin:/bin:/usr/sbin:/usr/bin
0073 mount /proc
0074 mount /sys
0075 mapped=0
0076 noresume=`grep -c noresume /proc/cmdline`
0077 if [ "$*" != "" ]
0078 then
0079 noresume=1
0080 fi
0081 dmesg -n 1
0082 /sbin/cardmgr -q
0083 for i in 1 2 3 4 5 6 7 8 9 0
0084 do
0085 if [ -f /proc/ide/hde/media ]
0086 then
0087 usleep 500000
0088 mount -t ext2 -o ro /dev/hde1 /mnt
0089 if [ -f /mnt/swapkey ]
0090 then
0091 dmsetup create swap0 /mnt/swapkey > /dev/null 2>&1 && mapped=1
0092 fi
0093 umount /mnt
0094 break
0095 fi
0096 usleep 500000
0097 done
0098 killproc /sbin/cardmgr
0099 dmesg -n 6
0100 if [ $mapped = 1 ]
0101 then
0102 if [ $noresume != 0 ]
0103 then
0104 mkswap /dev/mapper/swap0 > /dev/null 2>&1
0105 fi
0106 echo 254:0 > /sys/power/resume
0107 dmsetup remove swap0
0108 fi
0109 umount /sys
0110 mount /mnt
0111 umount /proc
0112 cd /mnt
0113 pivot_root . mnt
0114 mount /proc
0115 umount -l /mnt
0116 umount /proc
0117 exec chroot . /sbin/init $* < dev/console > dev/console 2>&1
0118
0119 Please don't mind the weird loop above, busybox's msh doesn't know
0120 the let statement. Now, what is happening in the script?
0121 First we have to decide if we want to try to resume, or not.
0122 We will not resume if booting with "noresume" or any parameters
0123 for init like "single" or "emergency" as boot parameters.
0124
0125 Then we need to set up dmcrypt with the setup data from the
0126 pcmcia flash disk. If this succeeds we need to reset the swap
0127 device if we don't want to resume. The line "echo 254:0 > /sys/power/resume"
0128 then attempts to resume from the first device mapper device.
0129 Note that it is important to set the device in /sys/power/resume,
0130 regardless if resuming or not, otherwise later suspend will fail.
0131 If resume starts, script execution terminates here.
0132
0133 Otherwise we just remove the encrypted swap device and leave it to the
0134 mini system on /dev/hda1 to set the whole crypto up (it is up to
0135 you to modify this to your taste).
0136
0137 What then follows is the well known process to change the root
0138 file system and continue booting from there. I prefer to unmount
0139 the initrd prior to continue booting but it is up to you to modify
0140 this.
