[RFC PATCH 0/3] PM: hibernate: encrypted snapshots under lockdown

[Sean Rhodes <sean@starlabs.systems>]

This is an RFC for allowing hibernate with lockdown enabled.

The kernel still refuses plain hibernate images under lockdown. This adds an
encrypted snapshot path instead. Early userspace gives the kernel a seed, the
kernel locks it, and /dev/snapshot can then create/load encrypted images. If
that seed is not present and locked, lockdown keeps blocking hibernate as it
does today.

This is based on the older encrypted hibernate work, but with the TPM policy
pushed out of the kernel. The kernel side just handles the snapshot encryption
and the seed ABI.

Testing on Star Labs StarFighter: dmesg shows the seed was locked, S4
entry/exit, and no errors.

Sending as RFC because the ABI and early-userspace split need review before
this should be a proper v1.

Evan Green (1):
  PM: hibernate: add seed-wrapped encrypted snapshots

Sean Rhodes (2):
  PM: hibernate: permit encrypted snapshot device under lockdown
  PM: hibernate: document encrypted snapshot seed ABI

 Documentation/ABI/testing/sysfs-power   |  14 +
 Documentation/power/userland-swsusp.rst |  19 +
 include/uapi/linux/suspend_ioctls.h     |  31 +-
 kernel/power/Kconfig                    |  15 +
 kernel/power/Makefile                   |   1 +
 kernel/power/hibernate.c                |  32 +
 kernel/power/power.h                    |   2 +
 kernel/power/snapenc.c                  | 878 ++++++++++++++++++++++++
 kernel/power/snapshot.c                 |   5 +
 kernel/power/user.c                     |  94 ++-
 kernel/power/user.h                     | 133 ++++
 11 files changed, 1204 insertions(+), 20 deletions(-)
 create mode 100644 kernel/power/snapenc.c
 create mode 100644 kernel/power/user.h


base-commit: dd3210c47e8d3ac6b4e9141fc68acc03b38c0ba3
-- 
2.53.0