Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #275028 > unrolled thread

Trying to configure hibernate / resume

Back to article view | Back to linux.debian.user

Contents

  Trying to configure hibernate / resume Richmond <dnomhcir@gmx.com> - 2024-11-30 19:00 +0100
    Re: Trying to configure hibernate / resume Richmond <dnomhcir@gmx.com> - 2024-11-30 21:10 +0100
      Re: Trying to configure hibernate / resume "Andrew M.A. Cater" <amacater@einval.com> - 2024-11-30 21:30 +0100
        Re: Trying to configure hibernate / resume Stefan Monnier <monnier@iro.umontreal.ca> - 2024-11-30 23:10 +0100
          Re: Trying to configure hibernate / resume "Andrew M.A. Cater" <amacater@einval.com> - 2024-12-01 00:10 +0100
            Re: Trying to configure hibernate / resume Stefan Monnier <monnier@iro.umontreal.ca> - 2024-12-03 15:30 +0100
        Re: Trying to configure hibernate / resume Anssi Saari <anssi.saari@debian-user.mail.kapsi.fi> - 2024-12-02 12:50 +0100

#275028 — Trying to configure hibernate / resume

Hibernate does not seem to be available on my system. My desktop is
Mate. When the system was installed I accepted the default swap space
size but this was way to small, only 1G for a system with 8G of RAM.

So I made a new swap space and set it up in /etc/fstab and set it up as
resume.

"
systemctl hibernate 
Call to Hibernate failed: Sleep verb "hibernate" not supported
"

So, I check that I have only one swap space and it is larger than RAM. I
have it configured in /etc/fstab

I also make sure that this is in /etc/initramfs-tools/conf.d/resume

I run:

update-initramfs -u
update-grub2

But when I check:

cd /etc/grub.d/
find . -print|xargs grep resume

There is no resume command line parameter for kernel 6 which I am using,
although there are for older kernels, but they have the wrong resume
partition in them.

Also I reboot the system and edit the debian menu entry and see there is
no resume command line parameter.

How do I get that resume space as a command line parameter and enable
hibernation?

[toc] | [next] | [standalone]

#275049

It's because secure boot prevents it.

:(

[toc] | [prev] | [next] | [standalone]

#275052

On Sat, Nov 30, 2024 at 07:57:14PM +0000, Richmond wrote:
> It's because secure boot prevents it.
> 
> :(
>

Hi Richmond,

A quick search with a search engine: boot is restricted, not impossible.

The answer seems to be to install with LVM and encryption. That ensures
that the swap area is encrypted and *cannot* be messed with while the
device is hibernated (which is the rationale for Secure Boot not allowing
hibernation to a "naked" swap partition). 

That answer came from Stack Exchange but the poster suggests this as
possible under (at least) Red Hat, SUSE and Debian.

Hope this helps

Andy
(amacater@debian.org)

[toc] | [prev] | [next] | [standalone]

#275057

> The answer seems to be to install with LVM and encryption. That ensures
> that the swap area is encrypted and *cannot* be messed with while the
> device is hibernated (which is the rationale for Secure Boot not allowing
> hibernation to a "naked" swap partition).

How does UEFI know about Debian's swap and how does it know whether
it's encrypted?


        Stefan

[toc] | [prev] | [next] | [standalone]

#275064

On Sat, Nov 30, 2024 at 05:08:29PM -0500, Stefan Monnier wrote:
> > The answer seems to be to install with LVM and encryption. That ensures
> > that the swap area is encrypted and *cannot* be messed with while the
> > device is hibernated (which is the rationale for Secure Boot not allowing
> > hibernation to a "naked" swap partition).
> 
> How does UEFI know about Debian's swap and how does it know whether
> it's encrypted?
> 

Hi Stefan,

Booting via UEFI is orthogonal to Secure Boot.

If SB is *enabled* then certain functions are restricted when considering
what can be done by kernel modules.
.
https://wiki.debian.org/SecureBoot#Secure_Boot_limitations suggests
that one of those may be hibernation/resume.

if you have partitioned "all in one partition" with encrypted KVM,
the ESP is not encrypted but everything else is. The swap partition
is encrypted so cannot be modified outside the control of the modules.

That's how I read it, anyway

All the very best, as ever,

Andy

> 
>         Stefan
> 

[toc] | [prev] | [next] | [standalone]

#275191

>> > The answer seems to be to install with LVM and encryption. That ensures
>> > that the swap area is encrypted and *cannot* be messed with while the
>> > device is hibernated (which is the rationale for Secure Boot not allowing
>> > hibernation to a "naked" swap partition).
>> How does UEFI know about Debian's swap and how does it know whether
>> it's encrypted?
> If SB is *enabled* then certain functions are restricted when considering
> what can be done by kernel modules.

So IIUC the restriction is imposed by the Linux kernel rather than by
the machine's firmware (BIOS/UEFI/...)?
That would indeed explain how it knows whether it's encrypted.  🙂


        Stefan

[toc] | [prev] | [next] | [standalone]

#275125

"Andrew M.A. Cater" <amacater@einval.com> writes:

> A quick search with a search engine: boot is restricted, not impossible.
>
> The answer seems to be to install with LVM and encryption. That ensures
> that the swap area is encrypted and *cannot* be messed with while the
> device is hibernated (which is the rationale for Secure Boot not allowing
> hibernation to a "naked" swap partition). 
>
> That answer came from Stack Exchange but the poster suggests this as
> possible under (at least) Red Hat, SUSE and Debian.

If it was
https://unix.stackexchange.com/questions/747938/how-can-linux-hibernation-be-enabled-under-uefi-secure-boot-with-kernel-lockdown
it doesn't seem to me he suggests anything of the sort. Works (a little
clunkily) for OpenSUSE but nothing is stated about anything else.

However, high time to update Debian wiki if it is actually possible
now. Hm, maybe it could work in Debian with OpenSUSE's kernel?

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web