[PATCH v2 0/4] PM: hibernate: encrypted snapshots under lockdown

v1 was sent as an RFC. This version keeps TPM policy and seed unsealing in
early userspace, while the kernel encrypts and authenticates the uswsusp image
from a locked seed.

The stack adds the snapshot_seed ABI, permits the snapshot device under
lockdown only once encryption is enabled, documents the userspace flow, and
restricts lockdown-time block writes to the active encrypted snapshot
image/header path.

Changes in v2:
- Keep raw writes to active swap blocked under lockdown.
- Track encrypted snapshot bytes and header writes before allowing
  lockdown-time image writes.
- Only split the encrypted stream at the metadata boundary when a user key
  switch is used.
- Return -EFAULT for userspace copy failures.
- Document resume meta_size handling.

Tested on StarFighter MTL with a TPM-sealed seed: encrypted uswsusp
suspend/resume completed and restored the image. Also tested with lockdown
enabled through the encrypted snapshot device path.

Evan Green (1):
  PM: hibernate: add seed-wrapped encrypted snapshots

Sean Rhodes (3):
  PM: hibernate: permit encrypted snapshot device under lockdown
  PM: hibernate: document encrypted snapshot seed ABI
  PM: hibernate: harden encrypted snapshot write path

 Documentation/ABI/testing/sysfs-power   |  14 +
 Documentation/power/userland-swsusp.rst |  20 +
 block/fops.c                            |  55 +-
 include/linux/suspend.h                 |  22 +
 include/linux/swap.h                    |  16 +
 include/uapi/linux/suspend_ioctls.h     |  31 +-
 kernel/power/Kconfig                    |  15 +
 kernel/power/Makefile                   |   1 +
 kernel/power/hibernate.c                |  32 +
 kernel/power/power.h                    |   4 +
 kernel/power/snapenc.c                  | 940 ++++++++++++++++++++++++
 kernel/power/snapshot.c                 |   5 +
 kernel/power/swap.c                     |  98 +++
 kernel/power/user.c                     | 247 ++++++-
 kernel/power/user.h                     | 151 ++++
 mm/swapfile.c                           |  32 +
 16 files changed, 1651 insertions(+), 32 deletions(-)
 create mode 100644 kernel/power/snapenc.c
 create mode 100644 kernel/power/user.h