kexec October 2021

kexec@lists.fedoraproject.org

5 participants
11 discussions

[PATCH] mkdumprd: allow spaces after 'path' config phrase when network dump
by Kazuhito Hagio 26 May '22

26 May '22

Without this patch, when there are two or more spaces after 'path' configuration phrase with ssh or nfs setting, SAVE_PATH is set to '/var/crash' in mkdumprd, and in most cases kdump service fails to start. ssh kdump(a)192.168.122.1 path /kdump ^^ This behavior would be too sensitive and different from the other configurations. With this patch, mkdumprd allows such spaces. Signed-off-by: Kazuhito Hagio <k-hagio(a)ab.jp.nec.com> --- mkdumprd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdumprd b/mkdumprd index a6f7fe8..aa0abfd 100644 --- a/mkdumprd +++ b/mkdumprd @@ -13,7 +13,7 @@ export IN_KDUMP=1 conf_file="/etc/kdump.conf" SSH_KEY_LOCATION="/root/.ssh/kdump_id_rsa" -SAVE_PATH=$(grep ^path $conf_file| cut -d' ' -f2) +SAVE_PATH=$(awk '/^path/ {print $2}' $conf_file) [ -z "$SAVE_PATH" ] && SAVE_PATH=$DEFAULT_PATH # strip the duplicated "/" SAVE_PATH=$(echo $SAVE_PATH | tr -s /) -- 2.18.0

4 3

[PATCH] Document/kexec-kdump-howto.txt: improve notes for kdump_pre and kdump_post scripts
by Pingfan Liu 15 Nov '21

15 Nov '21

Signed-off-by: Pingfan Liu <piliu(a)redhat.com> --- kdump.conf.5 | 7 +++++-- kexec-kdump-howto.txt | 6 ++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/kdump.conf.5 b/kdump.conf.5 index 2c5a2bc..385ae3e 100644 --- a/kdump.conf.5 +++ b/kdump.conf.5 @@ -118,8 +118,11 @@ All files under /etc/kdump/post.d are collectively sorted and executed in lexical order, before binary or script specified kdump_post parameter is executed. .PP -Note that scripts written for use with this directive must use -the /bin/bash interpreter. +Note that scripts written for use with this directive must use the /bin/bash +interpreter. And since these scripts run in kdump enviroment, the reference to +the storage or network device in the scripts should adhere to the section +'Supported dump target types and requirements' in kexec-kdump-howto.txt. + .RE .B kdump_pre <binary | script> diff --git a/kexec-kdump-howto.txt b/kexec-kdump-howto.txt index 88af607..1aeffc7 100644 --- a/kexec-kdump-howto.txt +++ b/kexec-kdump-howto.txt @@ -621,6 +621,9 @@ If /etc/kdump/post.d directory exist, All files in the directory are collectively sorted and executed in lexical order, before binary or script specified kdump_post parameter is executed. +In these scripts, the reference to the storage or network device should adhere +to the section 'Supported dump target types and requirements' + Kdump Pre-Capture Executable ---------------------------- @@ -634,6 +637,9 @@ kdump_pre parameter is executed. Even if the binary or script in /etc/kdump/pre.d directory returns non 0 exit status, the processing is continued. +In these scripts, the reference to the storage or network device should adhere +to the section 'Supported dump target types and requirements' + Extra Binaries -------------- -- 2.31.1

2 7

[PATCH 0/2] sysconfig: make kexec_file_load as default option
by Pingfan Liu 11 Nov '21

11 Nov '21

Pingfan Liu (2): sysconfig: make kexec_file_load as default option on aarch64 sysconfig: make kexec_file_load as default option on ppc64le kdump.sysconfig.aarch64 | 2 +- kdump.sysconfig.ppc64le | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.31.1

2 6

Re: [dm-crypt] Kdump with full-disk LUKS encryption
by Kairui Song 05 Nov '21

05 Nov '21

Hi, Thanks a lot, these info are very helpful. Better to keep it for debugging for now, and ask users to use it very carefully. On Tue, Apr 20, 2021 at 3:54 PM Milan Broz <gmazyland(a)gmail.com> wrote: > > Hi, > > TL;DR what you are trying to do is to actually reverse many security measures > we added. It is perhaps acceptable for debugging but hardly for real generic system. > > - using memory-hard function increases cost of dictionary and brute-force > attacks > You can always decrease amount of memory needed, but you should do it only > if you know that security margin is ok (like password is randomly generated > with enough entropy). > > - key is in keyring to remove possibility for normal userspace to receive > the key from kernel. Moreover, there is no need to retain kernel in keyring once > dm-crypt device is activated. (It is still in kernel memory but only in crypto > functions context). (Systemd also uses keyring to cache passphrase but that's > different thing.) > > You can still use old way for activation with --disable-keyring activation, > but then you disable this possibility. > > More comments below. > > On 19/04/2021 12:00, Kairui Song wrote: > > Hi all, > > > > I'm currently trying to add kdump support for systemd with full-disk > > LUKS encryption. vmcores contain sensitive data so they should also be > > protected, and network dumps sometimes are not available. So kdump has > > to open the LUKS encrypted device in the kdump environment. > > > > I'm using systemd/dracut, my work machine is running Fedora 34, and > > there are several problems I'm trying to solve: > > 1. Users have to input the password in the kdump kernel environment. > > But users often don't have shell access to the kdump environment. > > (headless server, graphic card not working after kexec, both are very > > common) > > 2. LUKS2 prefers Argon2 as the key derivation function, designed to > > use a lot of memory. kdump is expected to use a minimal amount of > > memory. Users will have to reserve a huge amount of memory for kdump > > to work (eg. 1G reserve for kdump with 4G total memory which is not > > reasonable). > > When I added Argon2 to LUKS2, I actually expected such issues. Despite > some people beats me that they cannot use arbitrary amount of memory, > we have some hard limits that were selected that it should work on most recent > systems. Maybe kdump can live with it. > > - maximum memory cost limit is 4GB, no LUKS2 device can use more for Argon2 > - we never use more than half of available physical memory > (measured on the host where the device was formatted) > - required amount of memory is visible in LUKS2 metadata (luksDump) > for the particular keyslot (Memory: the value is in kB) > - we use benchmark to calculate memory cost with prefered unlocking > time 2 seconds (again, on the device where LUKS was formatted) > Small systems (like RPi2) the uses much smaller acceptable values. > You can configure all costs (time, memory, threads) during format > or even set them to predefined values. > > I am sorry, but there is really no way around this - and the requeired > memory must be physical memory (otherwise it slows down extremely). > This is a feature, not a bug :-) > > > > To fix these problems, I tried to pass the master key to the second > > kernel directly via initramfs. Kdump will modify the initramfs in > > ramfs to include the key, kexec_load it, and never write to any actual > > back storage. This worked with old LUKS configurations. > > Well, passing volume key this way is quite insecure, but perhaps > acceptable for debugging. > > > > > But LUKS2/cryptsetup now stores the key in the kernel keyring by > > default. The key is accessible from userspace. > > If you are talking about volume key (not passsphrase), it is not > available from userspace. Only reference to it. But you can use > this reference to construct in-kernel dm-crypt device. > Please read https://gitlab.com/cryptsetup/cryptsetup/-/blob/master/docs/Keyring.txt > > > Users can enter the password to start kdump manually and then it will > > work, but usually people expect kdump service to start automatically. > > > > (WIP patch series: > > https://lists.fedoraproject.org/archives/list/kexec@lists.fedoraproject.org…) > > > > I've several ideas about how to improve it but not sure which one is > > better, and if this is a good idea after all: > > 1. Simply introduce a config to let systemd-cryptsetup disable kernel > > keyring on setup, there is currently no such option. > > Well, that option could be useful anyway and we have support for it > in cryptsetup (--disable-keyring CLI option) and libcryptsetup, so why not. > Just this should not be a default option. > > This is should be patch for systemd-cryptsetup only as libcryptsetup supports it. > > ... > > > 2. If we can let the key stay in userspace for a little longer, eg. > > for systems booted with dracut/systemd, when > > systemd-cryptsetup(a)%s.service opens the crypt device, keep the key in > > dm-crypt. And later when services like kdump have finished loading, > > cryptsetup can refresh the device and store the key in the kernel > > keyring again. > > We invalidate volume key in keyring after libceyposetup operation > is finished (and kernel removes the reference once keyring garbage collection > is run). > > I can imagine to add some option to keep key inside keyring even after > call is finished, but as said above, this removes some security margin > we intentionally introduced here. I agree with your comments, thanks! These two approaches seem not a good idea now. > > ... > > Milan > How about plan 3 and 4? > 3. Let kdump use some custom helper/service to load all needed > resources in the early initrd boot stage, prior to > systemd-cryptsetup(a)%s.service. It will ask the password / parse the > keyfile and load kdump, then provide info for systemd-cryptsetup or > just do the setup. Or maybe let systemd-cryptsetup support some kind > of "plugins" so other tools can use it. Some details could be changed/improved, but systemd-cryptsetup(a)%s.service will prompt for a password or use a keyfile anyway. So I think at this point, loading kdump with the volume key should be safe? At least long as the kdump kernel/environment itself isn't compromised. Loaded kdump resources can be restricted to be only accessible from the kernel side. After panic, kernel kexec jumps to kdump kernel, and that's an minimized emergency environment that only lives for a very short period. > 4. A better and safer solution seems to keep a consistent key ring > between kexec boots but also more complex and difficult as different > arch implements kexec differently. Maybe plan 4 will be a good idea if doable? Since that keeps the key consistent in the kernel between kexec boots, and cryptsetup can just reuse it. -- Best Regards, Kairui Song

3 4

[Fedora rawhide][PATCH] mkdumprd: drop mountaddr/mountproto nfs mount options
by Tao Liu 01 Nov '21

01 Nov '21

nfs service will append extra mount options to kernel mount options. Such as mountaddr/mountproto options. These options only represent current mounting details of the 1st kernel, but may not appropriate for the 2nd kernel. This patch will remove these options. Signed-off-by: Tao Liu <ltao(a)redhat.com> --- mkdumprd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mkdumprd b/mkdumprd index c6cb001..d87d588 100644 --- a/mkdumprd +++ b/mkdumprd @@ -70,8 +70,8 @@ to_mount() if [[ $_fstype == "nfs"* ]]; then _pdev=$_target - _sed_cmd+='s/,addr=[^,]*//;' - _sed_cmd+='s/,proto=[^,]*//;' + _sed_cmd+='s/,$mount$\?addr=[^,]*//g;' + _sed_cmd+='s/,$mount$\?proto=[^,]*//g;' _sed_cmd+='s/,clientaddr=[^,]*//;' else # for non-nfs _target converting to use udev persistent name -- 2.29.2

2 3

[PATCH v2] support tests against Fedora 35 Cloud Base Image
by Coiby Xu 19 Oct '21

19 Oct '21

Fedora 33 and 34 Cloud Base Images have only partition with the following directory structure, . ├── bin -> usr/bin ├── boot ├── dev ├── etc ├── home ├── root By comparison, Fedora 35 Cloud Base Image has multiple partitions. The root partition which is the last partition has the following directory, . ├── home └── root ├── bin -> usr/bin ├── boot ├── dev ├── etc ├── home ├── root and the first partition is the boot partition. This patch address the above changes by mounting {LAST_PARTITION}/root as to TEMP_ROOT and mount FIRST_PARTITION to TEMP_ROOT/boot. So the test image can be built successfully. Signed-off-by: Coiby Xu <coxu(a)redhat.com> --- v2: - check LAST_PARTITION/root/root instead of LAST_PARTITION/root [Kairui] - improve commit message --- tests/scripts/image-init-lib.sh | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/tests/scripts/image-init-lib.sh b/tests/scripts/image-init-lib.sh index 0a1524b..a30c09a 100644 --- a/tests/scripts/image-init-lib.sh +++ b/tests/scripts/image-init-lib.sh @@ -23,6 +23,7 @@ is_mounted() clean_up() { for _mnt in ${MNTS[@]}; do + is_mounted $_mnt/root/boot && $SUDO umount -f $_mnt/root/boot is_mounted $_mnt && $SUDO umount -f $_mnt done @@ -81,6 +82,21 @@ get_mountable_dev() { fi } +# get the separate boot partition +# return the first partition as boot partition +get_mount_boot() { + local dev=$1 parts + + $SUDO partprobe $dev && sync + parts="$(ls -1 ${dev}p*)" + if [ -n "$parts" ]; then + if [ $(echo "$parts" | wc -l) -gt 1 ]; then + echo "$parts" | head -1 + fi + fi +} + + prepare_loop() { [ -n "$(lsmod | grep "^loop")" ] && return @@ -133,7 +149,7 @@ image_lock() # Mount a device, will umount it automatially when shell exits mount_image() { local image=$1 fmt - local dev mnt mnt_dev + local dev mnt mnt_dev boot root # Lock the image just in case user run this script in parrel image_lock $image @@ -166,12 +182,19 @@ mount_image() { $SUDO mount $mnt_dev $mnt [ $? -ne 0 ] && perror_exit "failed to mount device '$mnt_dev'" + boot=$(get_mount_boot "$dev") + if [[ -n "$boot" ]]; then + root=$(get_image_mount_root $image) + $SUDO mount $boot $root/boot + [ $? -ne 0 ] && perror_exit "failed to mount the bootable partition for device '$mnt_dev'" + fi } get_image_mount_root() { local image=$1 local root=${MNTS[$image]} + [ -d "$root/root/root" ] && root=$root/root echo $root if [ -z "$root" ]; then @@ -213,7 +236,7 @@ run_in_image() { inst_in_image() { local image=$1 src=$2 dst=$3 - local root=${MNTS[$image]} + local root=$(get_image_mount_root $1) $SUDO cp $src $root/$dst } -- 2.31.1

2 1

[PATCH] support tests against Fedora 35 Cloud Base Image
by Coiby Xu 18 Oct '21

18 Oct '21

Fedora 35 Cloud Base Image has multiple partitions and existing tests couldn't run due to the following two changes, - the last partition is the root partition and the files now resides in a folder named root - the first partition is the boot partition This patch address the above changes by mounting {LAST_PARTITION}/root as to TEMP_ROOT and mount FIRST_PARTITION to TEMP_ROOT/boot. So the test image can be built successfully. Signed-off-by: Coiby Xu <coxu(a)redhat.com> --- tests/scripts/image-init-lib.sh | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/tests/scripts/image-init-lib.sh b/tests/scripts/image-init-lib.sh index 0a1524b..c1c1c4e 100644 --- a/tests/scripts/image-init-lib.sh +++ b/tests/scripts/image-init-lib.sh @@ -23,6 +23,7 @@ is_mounted() clean_up() { for _mnt in ${MNTS[@]}; do + is_mounted $_mnt/root/boot && $SUDO umount -f $_mnt/root/boot is_mounted $_mnt && $SUDO umount -f $_mnt done @@ -81,6 +82,21 @@ get_mountable_dev() { fi } +# get the separate boot partition +# return the first partition as boot partition +get_mount_boot() { + local dev=$1 parts + + $SUDO partprobe $dev && sync + parts="$(ls -1 ${dev}p*)" + if [ -n "$parts" ]; then + if [ $(echo "$parts" | wc -l) -gt 1 ]; then + echo "$parts" | head -1 + fi + fi +} + + prepare_loop() { [ -n "$(lsmod | grep "^loop")" ] && return @@ -133,7 +149,7 @@ image_lock() # Mount a device, will umount it automatially when shell exits mount_image() { local image=$1 fmt - local dev mnt mnt_dev + local dev mnt mnt_dev boot root # Lock the image just in case user run this script in parrel image_lock $image @@ -166,12 +182,19 @@ mount_image() { $SUDO mount $mnt_dev $mnt [ $? -ne 0 ] && perror_exit "failed to mount device '$mnt_dev'" + boot=$(get_mount_boot "$dev") + if [[ -n "$boot" ]]; then + root=$(get_image_mount_root $image) + $SUDO mount $boot $root/boot + [ $? -ne 0 ] && perror_exit "failed to mount the bootable partition for device '$mnt_dev'" + fi } get_image_mount_root() { local image=$1 local root=${MNTS[$image]} + [ -d "$root/root" ] && root=$root/root echo $root if [ -z "$root" ]; then @@ -213,7 +236,7 @@ run_in_image() { inst_in_image() { local image=$1 src=$2 dst=$3 - local root=${MNTS[$image]} + local root=$(get_image_mount_root $1) $SUDO cp $src $root/$dst } -- 2.31.1

2 4

[PATCH v4] selftest: kill VM reliably by recursively kill children processes
by Coiby Xu 15 Oct '21

15 Oct '21

qemu is launched in nested subprocess and can't be killed by simply killing the job ids, PID Command 2269634 │ ├─ sshd: root [priv] 2269637 │ │ └─ sshd: root@pts/0 2269638 │ │ └─ -bash 2269744 │ │ └─ make test-run V=1 2273117 │ │ └─ /bin/bash /root/kexec-tools-300/tests/scripts/run-test.sh 2273712 │ │ ├─ /bin/bash /root/kexec-tools-300/tests/scripts/run-test.sh 2273714 │ │ │ └─ /bin/bash /root/kexec-tools-300/tests/scripts/run-test.sh 2273737 │ │ │ └─ timeout --foreground 10m /root/kexec-tools-300/tests/scripts/run-qemu -nodefaults -nographic -smp 2 -m 768M -monitor no 2273738 │ │ │ └─ /usr/bin/qemu-system-x86_64 -enable-kvm -cpu host -nodefaults -nographic -smp 2 -m 768M -monitor none -serial stdio 2273746 │ │ │ ├─ /usr/bin/qemu-system-x86_64 -enable-kvm -cpu host -nodefaults -nographic -smp 2 -m 768M -monitor none -serial std 2273797 │ │ ├─ /bin/bash /root/kexec-tools-300/tests/scripts/run-test.sh 2273798 │ │ │ └─ /bin/bash /root/kexec-tools-300/tests/scripts/run-test.sh 2273831 │ │ │ └─ timeout --foreground 10m /root/kexec-tools-300/tests/scripts/run-qemu -nodefaults -nographic -smp 2 -m 768M -monitor no 2273832 │ │ │ └─ /usr/bin/qemu-system-x86_64 -enable-kvm -cpu host -nodefaults -nographic -smp 2 -m 768M -monitor none -serial stdio 2273840 │ │ │ ├─ /usr/bin/qemu-system-x86_64 -enable-kvm -cpu host -nodefaults -nographic -smp 2 -m 768M -monitor none -serial std This led to the error "qemu-system-x86_64: can't bind ip=0.0.0.0 to socket: Address already in use". This patch will kill qemu by killing all the children of the job id. Signed-off-by: Coiby Xu <coxu(a)redhat.com> --- Thanks to Kairui for finding out an error and an issue about previous version, - "$_job" should be used instead "$job" - "Ctrl-c" leads to the failure of parsing pstree result This version stops parsing pstree and use pgrep to get the children of a process and kill them recursively instead. --- tests/scripts/run-test.sh | 37 +++++++++++++++++++++++++++++++++---- tests/scripts/test-lib.sh | 3 +-- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/tests/scripts/run-test.sh b/tests/scripts/run-test.sh index a68504d..7113be8 100755 --- a/tests/scripts/run-test.sh +++ b/tests/scripts/run-test.sh @@ -1,9 +1,38 @@ #!/bin/bash -_kill_all_jobs() { - local _jobs=$(jobs -r -p) +_kill_if_valid_pid() { + local _pid="$1" + if ps -p $_pid > /dev/null + then + kill $_pid + fi +} + +_recursive_kill() { + local _pid="$1" + local _children _child + + _children=$(pgrep -P $_pid) + if [ -n "$_children" ]; then + for _child in $_children + do + _recursive_kill $_child + _kill_if_valid_pid $_child + done + fi + _kill_if_valid_pid $_pid +} - [ -n "$_jobs" ] && kill $_jobs +_kill_all_jobs() { + local _jobs=$(jobs -r -p) + local _job + + if [ -n "$_jobs" ]; then + for _job in $_jobs + do + _recursive_kill $_job + done + fi } trap ' @@ -121,7 +150,7 @@ for test_case in $testcases; do [ $? -ne 0 ] && ret=$(expr $ret + 1) results[$test_case]="$res" - + _kill_all_jobs echo -e "-------- Test finished: $test_case $res --------" for script in $scripts; do script="$testdir/$script" diff --git a/tests/scripts/test-lib.sh b/tests/scripts/test-lib.sh index f8a2249..8b24b2a 100644 --- a/tests/scripts/test-lib.sh +++ b/tests/scripts/test-lib.sh @@ -146,8 +146,7 @@ watch_test_outputs() { ret=$? if [ $ret -ne 255 ]; then - # Test finished, kill VMs - kill $(jobs -p) + # Test finished break 2 fi done -- 2.32.0

2 1

Why NM seems to behave differently in initrd from in real root?
by Coiby Xu 15 Oct '21

15 Oct '21

Hi NM developers, This is Coiby from the Red Hat Kernel Debug team who is responsible for Fedora/RHEL's kexec-tools. Currently, kexec-tools parses ifcfg-* or .nmconnection to build up dracut cmdline parameter like ip= to set up kdump initrd network which is tedious and error-prone. Recently, I'm implementing a different approach which is to set up kdump initrd network by copying connection profiles from real root to initrd directly. However, one unexpected thing is NM seems to behave differently in initrd from in real root and the same connection profiles copied from the real root lead to different result in kdump initrd. So is there a general reason why NM behaves differently in initrd and real root? Is it a better approach that kexec-tools sets up kdump initrd network by copying connection profiles from real root to kdump initrd? It will be appreciated if NM developers could provide answers or comments on these questions since you are experts on this type of problems. For the details of how NM behaves differently in kdump initrd, I've reported some of the inconsistent behaviours as bugs [1] [2]. connection.wait-device-timeout=6000 and connection.autoconnect=false could be used to bypass [1] and [2] respectively so the same connections could be brought up in initrd. A third issue for which I haven't found a workaround is the case of bridging network over VLAN network over teaming network where I create a teaming network interface which is used as the parent interface of a VLAN interface which is in turn a slave interface of network bridge. The problem is the network bridge sometimes gets the IP address belonging the VLAN subnet but sometimes not. Btw, the third issue is found on a physical machine and can't be reproduced on a VM. I've tested the modified kexec-tools [3] by setting up different networks including the aforementioned bridging network over VLAN network over teaming network. Other tests including bridging network over physical interface/bonding network/teaming network/VLAN network, VLAN network over physical interface/bonding network/teaming work and etc. All tests have passed for VM. And except for the bridging network over VLAN network over teaming network, the tests have also passed for one physical machine. But I'm not sure if they are sufficient considering there is machine-specific issue like znet network device. Any suggestion is welcome. Thanks! [1] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/803 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2007563 [3] https://src.fedoraproject.org/fork/coiby/rpms/kexec-tools/commits/direct_nm -- Best regards, Coiby

2 2

[PATCH] kdump-lib.sh: Add helper to check if memory encryption is enabled
by Kairui Song 13 Oct '21

13 Oct '21

Check if SEV/SME is enabled, by looking at cpu flags, kernel config, and kernel cmdline. We can check MSR by looking at /dev/cpu/0/msr, but using kernel config and cmdline is sufficient. Signed-off-by: Kairui Song <kasong(a)redhat.com> --- kdump-lib.sh | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/kdump-lib.sh b/kdump-lib.sh index 2e2775c9..55388807 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -780,6 +780,48 @@ prepare_cmdline() echo "$cmdline" } +get_kdump_kernel_config() +{ + local _config_opt="$1" + local _config_file + + # Make sure KDUMP_KERNELVER is set before calling this function + local _config_file="/boot/config-${KDUMP_KERNELVER:?}" + [[ ! -s $_config_file ]] && _config_file="/lib/modules/${KDUMP_KERNELVER:?}/config" + [[ -s $_config_file ]] || return + + sed -ne "s/^$_config_opt=//p" "$_config_file" +} + + +# Check if memory encription is enabled +# returns 1 if disabled +# returns 0 if enabled +check_memory_encrypt_enabled() +{ + local _cpu_flags _kernel_config _kernel_cmdline + local _cpu_enabled _runtime_enabled + + _cpu_flags=$(sed -ne "s/^flags\s*:\s*//p" /proc/cpuinfo) + [[ " $_cpu_flags " == *" sme "* ]] && _cpu_enabled=1 + [[ " $_cpu_flags " == *" sev "* ]] && _cpu_enabled=1 + [[ " $_cpu_flags " == *" seves "* ]] && _cpu_enabled=1 + + [[ $_cpu_enabled ]] || return 1 + + if _kernel_config=$(get_kdump_kernel_config CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT); then + [[ "$_kernel_config" == "y" ]] && _runtime_enabled=1 + fi + + _kernel_cmdline=$(sed -ne "s/^.*\<mem_encrypt=$\S\+$.*/\1/p" /proc/cmdline) + [[ $_kernel_cmdline == "on" ]] && _runtime_enabled=1 + [[ $_kernel_cmdline == "off" ]] && _runtime_enabled=0 + + [[ $_runtime_enabled == 0 ]] && return 1 + + return 0 +} + #get system memory size in the unit of GB get_system_size() { -- 2.31.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

kexec October 2021