view Documentation/power/swsusp-dmcrypt.txt @ 524:7f8b544237bf

netfront: Allow netfront in domain 0.

This is useful if your physical network device is in a utility domain.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
author Keir Fraser <keir.fraser@citrix.com>
date Tue Apr 15 15:18:58 2008 +0100 (2008-04-15)
parents 831230e53067
line source
1 Author: Andreas Steinmetz <ast@domdv.de>
4 How to use dm-crypt and swsusp together:
5 ========================================
7 Some prerequisites:
8 You know how dm-crypt works. If not, visit the following web page:
9 http://www.saout.de/misc/dm-crypt/
10 You have read Documentation/power/swsusp.txt and understand it.
11 You did read Documentation/initrd.txt and know how an initrd works.
12 You know how to create or how to modify an initrd.
14 Now your system is properly set up, your disk is encrypted except for
15 the swap device(s) and the boot partition which may contain a mini
16 system for crypto setup and/or rescue purposes. You may even have
17 an initrd that does your current crypto setup already.
19 At this point you want to encrypt your swap, too. Still you want to
20 be able to suspend using swsusp. This, however, means that you
21 have to be able to either enter a passphrase or that you read
22 the key(s) from an external device like a pcmcia flash disk
23 or an usb stick prior to resume. So you need an initrd, that sets
24 up dm-crypt and then asks swsusp to resume from the encrypted
25 swap device.
27 The most important thing is that you set up dm-crypt in such
28 a way that the swap device you suspend to/resume from has
29 always the same major/minor within the initrd as well as
30 within your running system. The easiest way to achieve this is
31 to always set up this swap device first with dmsetup, so that
32 it will always look like the following:
34 brw------- 1 root root 254, 0 Jul 28 13:37 /dev/mapper/swap0
36 Now set up your kernel to use /dev/mapper/swap0 as the default
37 resume partition, so your kernel .config contains:
39 CONFIG_PM_STD_PARTITION="/dev/mapper/swap0"
41 Prepare your boot loader to use the initrd you will create or
42 modify. For lilo the simplest setup looks like the following
43 lines:
45 image=/boot/vmlinuz
46 initrd=/boot/initrd.gz
47 label=linux
48 append="root=/dev/ram0 init=/linuxrc rw"
50 Finally you need to create or modify your initrd. Lets assume
51 you create an initrd that reads the required dm-crypt setup
52 from a pcmcia flash disk card. The card is formatted with an ext2
53 fs which resides on /dev/hde1 when the card is inserted. The
54 card contains at least the encrypted swap setup in a file
55 named "swapkey". /etc/fstab of your initrd contains something
56 like the following:
58 /dev/hda1 /mnt ext3 ro 0 0
59 none /proc proc defaults,noatime,nodiratime 0 0
60 none /sys sysfs defaults,noatime,nodiratime 0 0
62 /dev/hda1 contains an unencrypted mini system that sets up all
63 of your crypto devices, again by reading the setup from the
64 pcmcia flash disk. What follows now is a /linuxrc for your
65 initrd that allows you to resume from encrypted swap and that
66 continues boot with your mini system on /dev/hda1 if resume
67 does not happen:
69 #!/bin/sh
70 PATH=/sbin:/bin:/usr/sbin:/usr/bin
71 mount /proc
72 mount /sys
73 mapped=0
74 noresume=`grep -c noresume /proc/cmdline`
75 if [ "$*" != "" ]
76 then
77 noresume=1
78 fi
79 dmesg -n 1
80 /sbin/cardmgr -q
81 for i in 1 2 3 4 5 6 7 8 9 0
82 do
83 if [ -f /proc/ide/hde/media ]
84 then
85 usleep 500000
86 mount -t ext2 -o ro /dev/hde1 /mnt
87 if [ -f /mnt/swapkey ]
88 then
89 dmsetup create swap0 /mnt/swapkey > /dev/null 2>&1 && mapped=1
90 fi
91 umount /mnt
92 break
93 fi
94 usleep 500000
95 done
96 killproc /sbin/cardmgr
97 dmesg -n 6
98 if [ $mapped = 1 ]
99 then
100 if [ $noresume != 0 ]
101 then
102 mkswap /dev/mapper/swap0 > /dev/null 2>&1
103 fi
104 echo 254:0 > /sys/power/resume
105 dmsetup remove swap0
106 fi
107 umount /sys
108 mount /mnt
109 umount /proc
110 cd /mnt
111 pivot_root . mnt
112 mount /proc
113 umount -l /mnt
114 umount /proc
115 exec chroot . /sbin/init $* < dev/console > dev/console 2>&1
117 Please don't mind the weird loop above, busybox's msh doesn't know
118 the let statement. Now, what is happening in the script?
119 First we have to decide if we want to try to resume, or not.
120 We will not resume if booting with "noresume" or any parameters
121 for init like "single" or "emergency" as boot parameters.
123 Then we need to set up dmcrypt with the setup data from the
124 pcmcia flash disk. If this succeeds we need to reset the swap
125 device if we don't want to resume. The line "echo 254:0 > /sys/power/resume"
126 then attempts to resume from the first device mapper device.
127 Note that it is important to set the device in /sys/power/resume,
128 regardless if resuming or not, otherwise later suspend will fail.
129 If resume starts, script execution terminates here.
131 Otherwise we just remove the encrypted swap device and leave it to the
132 mini system on /dev/hda1 to set the whole crypto up (it is up to
133 you to modify this to your taste).
135 What then follows is the well known process to change the root
136 file system and continue booting from there. I prefer to unmount
137 the initrd prior to continue booting but it is up to you to modify
138 this.