PM: hibernate: encrypted snapshots under lockdown

Lockdown disables hibernation because resume restores kernel memory from an image userspace can modify. This also prevents a TPM-backed uswsusp implementation from using /dev/snapshot under lockdown.

This series encrypts and authenticates the snapshot in the kernel. The kernel generates the image key and wraps it with a seed supplied by trusted early userspace. TPM policy and unsealing remain outside the PM code.

The seed interface is first-writer-wins and does not provide freshness. Trusted early userspace must provision it before untrusted privileged code runs and enforce the required TPM policy, rollback protection and recovery handling.

Tested on StarFighter MTL with Secure Boot disabled, integrity lockdown selected manually and a TPM-sealed seed. Keyless and user-key S4 cycles resumed the same process and boot ID with the swap header restored. Corrupted wrapped data, invalid magic, a corrupted complete-chunk tag and a wrong user key were rejected. On exact v3, the user-key cycle and the allocation, free and reallocation path used by swap-write confinement also passed.

Previous version as it was updated whist waiting review:
https://lore.kernel.org/all/[email protected]/

Changes in v3:
- Rebase on current upstream master.
- Preserve and validate the saved encrypted metadata boundary on resume.
- Drain buffered metadata before a late user-key transition.
- Reserve enough encrypted image space if userspace adds a user key after querying the image size.
- Apply swap-write confinement before enabling the lockdown exception, while preserving the ordinary availability check which routes lockdown writes to the confined path.
- Account the pages actually allocated through the snapshot API instead of assuming a userspace swap-map format.
- Document the first-writer, anti-replay and userspace I/O requirements.
- Remove an unused swap reverse-mapping helper and tighten local naming.

Changes in v2:
- Keep raw writes to active swap blocked under lockdown.
- Track encrypted snapshot bytes and header writes before allowing lockdown-time image writes.
- Split the encrypted stream at the metadata boundary only when a user-key transition is used.
- Return -EFAULT for userspace copy failures.
- Document resume meta_size handling.

Evan Green (1):
PM: hibernate: add seed-wrapped encrypted snapshots

Sean Rhodes (3):
PM: hibernate: confine encrypted snapshot writes
PM: hibernate: permit encrypted snapshot device under lockdown
PM: hibernate: document encrypted snapshot seed ABI

 Documentation/ABI/testing/sysfs-power   |  18 +
 Documentation/power/userland-swsusp.rst |  33 +
 block/fops.c                            |  58 +-
 include/linux/suspend.h                 |  24 +
 include/linux/swap.h                    |   9 +
 include/uapi/linux/suspend_ioctls.h     |  31 +-
 kernel/power/Kconfig                    |  15 +
 kernel/power/Makefile                   |   1 +
 kernel/power/hibernate.c                |  32 +
 kernel/power/power.h                    |   3 +
 kernel/power/snapenc.c                  | 952 ++++++++++++++++++++++++
 kernel/power/snapshot.c                 |   5 +
 kernel/power/swap.c                     |  87 +++
 kernel/power/user.c                     | 272 ++++++-
 kernel/power/user.h                     | 150 ++++
 mm/swapfile.c                           |  25 +
 16 files changed, 1683 insertions(+), 32 deletions(-)
 create mode 100644 kernel/power/snapenc.c
 create mode 100644 kernel/power/user.h