From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C83E435202C for ; Mon, 13 Jul 2026 15:39:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957197; cv=none; b=A7qNBsRZ6Y5hVdCrKY0PcIWE0XWqh/MzsxvanlT1sr4rl87mLR1J+OhYa67BoQ3M5Yb8WuuTESIPj3lvMAavspCW0JNL/8+Hv7HUUsQj8u9FGxVkFUX99FaLNqkg2kfT4pN981cEpjephkFEqV8Quw44SBmobwF9aJM9KCI9JAM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957197; c=relaxed/simple; bh=yTdMyO+i2E2fqL0HAbZQyuFHUHHTDwBD3/WMsL7u6eI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Cs9JQDsC2k12ODBZ5NykqK2zhl/HwYSCiaubXH9llChV2EIMCL8ChnZ6Vm4/9+kMEY77O/MXWa7dLTG8AU9nd+6PQp6tGhOkyMypYPJ007a5owZmEkS0+OJ/psmyhXng5sE6ClpS348uXBGggV8YgHqDl85ORcsRpyHo7b08C+w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=starlabs.systems; spf=pass smtp.mailfrom=starlabs.systems; dkim=pass (2048-bit key) header.d=starlabs-systems.20251104.gappssmtp.com header.i=@starlabs-systems.20251104.gappssmtp.com header.b=O4as8Kr9; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=starlabs.systems Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=starlabs.systems Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=starlabs-systems.20251104.gappssmtp.com header.i=@starlabs-systems.20251104.gappssmtp.com header.b="O4as8Kr9" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-493c52cde9eso29739385e9.3 for ; Mon, 13 Jul 2026 08:39:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=starlabs-systems.20251104.gappssmtp.com; s=20251104; t=1783957193; x=1784561993; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=WeDwmwYsyldgwys09XPYSkZKv49CSC/GW7zpDU3Wo8g=; b=O4as8Kr95k/89bNhHOHBLNHAaKPevkhVkDHZQl/2kQAanzX4LlSJeXiL4VTTcUH4Z2 XB4l41yjLrsoyFVaDwC4rdGY7PA3eRmxwprF+P4jPELdgDPocJvfLl4oYfRAafC0EXQq 6vjsBXhEW2oEiv7FMXD6u0wjj8C+TULFGrkEAyjR6a4Aq49952KGV/8pPf1kaX2jBkp1 tZ8aRBM3obEz+92QkoGH3Jt2Hn83lw/dws//0tY5NEJ+ccSBkUv6zkhuOq+y7e6/2Hyw uwvNuIlHdkzA0PACT7tdNxovcTy+b8Cc11fqOAXENEvfHpl00KIfQQMxyLMi1FrDzuYJ jWIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783957193; x=1784561993; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WeDwmwYsyldgwys09XPYSkZKv49CSC/GW7zpDU3Wo8g=; b=G+9LVrREZ5sGyVw/MvFMAhpS+RkaOn7WJap+268MtJRoppEsm/R+l0sY9bs8GzpFuE H42ge9P9mDKkAPIUbzUWTsiYPt3BbNabGPt6KgZ4xJKwl8SYUK7uuKra06d6ExivKYTX vdodm7RpXwyV/arsX3HP3w/EwGPrcgvQgHo6Hdc6zxbkSCaLi4zzqcJFiSkZDAMDSWN9 MKXd0yCyQAgOYyLn0AkJbtaX1Qu+g2cU+nU8W4wEXGek/dgwvMjg0whj8fMrziPdcizH T41sc/+tCUUotN/fXOxRQJUVGMlV0IfXNftsPQxfKWGJESh2891+cuRCEwJDCx/37/oQ l7hg== X-Forwarded-Encrypted: i=1; AHgh+Rrdm9b5KtSfDjKGLUm59les5Ll/9e0xItLajLgORC6fD5jTtiX+D8SQruDseyrZurJbLpq25o0oFz6htZg=@vger.kernel.org X-Gm-Message-State: AOJu0Yyb/f99xE1gxRRz7rPIkVm7cUNnI7G3GixNcJxBQCI9uBuAPfEZ VHBnWiJzexltY9ZSNJtuwSXaklXKF5831MzCIP94/G75xDn0337OlVoEVqgTm88/Zw== X-Gm-Gg: AfdE7cmS1QmElxIwCGuOYBdF/kiTbaHq3uh8HW0O/tDqZ96oLJkqQseFxktDNiA22hN GYoJubFvTtcufEOC630TFlC5MNj3+c42rrNTXprOXSzzagzz5mw7aGZgYLPM1rNNiC+H+GMQMB4 w0Sx17wO7qyjvGSeWhynh0DZ8lCFOUzWP1udgFewQwdK3z4ZluB9GMV6pQDw0GMDqZ3ieLQEDS9 YK/QI61nLtFi16VGgIsbPMWhO7eRKP9QJeQHKnYDSpKsCnR/2DoeHNUe6IKqPcKjh0Tgejqdru9 urgN80v9+iS8nx8f0cdxnRhenoUaidO3zYek0py8/NPn+PCTMG37OlApj9G5R/3IyGvJbd3oqO/ 63sucsgBnKwkneC8D6Zn2pnpfxT0EmxfPn0LEMWL2nsti8UdSfRZ0VUhS9Oq71ZdKtll/6o73Zv 9kPuMfPYWf72Hw/rV93RVlEQMLxYvhmj0swLDiVp+voL/d0rxAlQD+Z49zPb/P3xaZyCI= X-Received: by 2002:a05:600c:b99:b0:493:aaa2:f034 with SMTP id 5b1f17b1804b1-493f882ae23mr102205915e9.26.1783957192599; Mon, 13 Jul 2026 08:39:52 -0700 (PDT) Received: from horizon.localdomain ([150.228.38.212]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4950a32c65asm3135735e9.14.2026.07.13.08.39.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 08:39:52 -0700 (PDT) From: Sean Rhodes To: "Rafael J. Wysocki" , Len Brown , Pavel Machek , linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Evan Green , Xueqin Luo Subject: [RFC PATCH 0/3] PM: hibernate: encrypted snapshots under lockdown Date: Mon, 13 Jul 2026 16:39:47 +0100 Message-ID: X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This is an RFC for allowing hibernate with lockdown enabled. The kernel still refuses plain hibernate images under lockdown. This adds an encrypted snapshot path instead. Early userspace gives the kernel a seed, the kernel locks it, and /dev/snapshot can then create/load encrypted images. If that seed is not present and locked, lockdown keeps blocking hibernate as it does today. This is based on the older encrypted hibernate work, but with the TPM policy pushed out of the kernel. The kernel side just handles the snapshot encryption and the seed ABI. Testing on Star Labs StarFighter: dmesg shows the seed was locked, S4 entry/exit, and no errors. Sending as RFC because the ABI and early-userspace split need review before this should be a proper v1. Evan Green (1): PM: hibernate: add seed-wrapped encrypted snapshots Sean Rhodes (2): PM: hibernate: permit encrypted snapshot device under lockdown PM: hibernate: document encrypted snapshot seed ABI Documentation/ABI/testing/sysfs-power | 14 + Documentation/power/userland-swsusp.rst | 19 + include/uapi/linux/suspend_ioctls.h | 31 +- kernel/power/Kconfig | 15 + kernel/power/Makefile | 1 + kernel/power/hibernate.c | 32 + kernel/power/power.h | 2 + kernel/power/snapenc.c | 878 ++++++++++++++++++++++++ kernel/power/snapshot.c | 5 + kernel/power/user.c | 94 ++- kernel/power/user.h | 133 ++++ 11 files changed, 1204 insertions(+), 20 deletions(-) create mode 100644 kernel/power/snapenc.c create mode 100644 kernel/power/user.h base-commit: dd3210c47e8d3ac6b4e9141fc68acc03b38c0ba3 -- 2.53.0