Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Update on Linux hibernation support when lockdown is enabled

mjg59.dreamwidth.org

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Update on Linux hibernation support when lockdown is enabled

#21

Post by arminiusreturns »

yokoprime wrote: post #13
masklinn wrote: post #3

Earlier quoted context omitted.

> Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power. "modern standby" is such a scam and shit show. And completely opposite that, I was a bit shocked how aggressive modern macos (at least on M1 machines) are at hibernating, I have had to get used to `caffeinate` long-running process because on battery if that's not in use as soon…

Serious question: i'm back at daily driving macOS at work after using other platforms for a while. Caffeine vs Amphetamine (app), whats the preferred one these days?

May I suggest https://keepingyouawake.app/

As a gnu/linux person forced on Mac for work, this was what I settled on that worked reliably for me. (I found I would often crash iterm2 or alacritty and lose my terminal based caffiene commands)

Re: Update on Linux hibernation support when lockdown is enabled

#22

Post by kmeisthax »

josephcsible wrote: post #7
dcomp wrote: post #6

Earlier quoted context omitted.

You have a disk encrypted laptop. That key is protected by a password. Secure boot means that when you log in you can trust that the disk decryption screen is not a disk encryption key exfiltration screen waiting for you to enter your password so that a disk backup taken earlier can be decrypted. How? The disk encryption is based on a key in the TPM which only is decrypted with your password. That TPM gets wiped when…

That doesn't actually protect against that attack, though. The evil maid just steals the guts of your computer and replaces them with ones that always say "sorry, wrong password", while exfiltrating the password you tried over Wi-Fi or Bluetooth. Then they use your password to decrypt your unmodified hard drive with your unmodified TPM on your unmodified motherboard. Also, I don't think this is true: > That TPM gets…

There's one flaw in your scenario: if your computer suddenly stopped respecting valid credentials, it'd be extremely obvious that the motherboard had been replaced or tampered with.

Generally speaking most evil-maid attacks assume that the attacker wants to remain covert, otherwise the victim will start revoking stolen credentials, calling the authorities, etc. If you don't care about remaining covert then you don't need to do an evil-maid attack; just buy a wrench.

Re: Update on Linux hibernation support when lockdown is enabled

#23

Post by csdvrx »

masklinn wrote: post #12
bananabernhard wrote: post #10

Earlier quoted context omitted.

Does consumer hardware designed for linux even exist? Even bigger shops like system76 buy preconfigured laptops and install coreboot and PopOS! on it.

The XPS13 DE could be construed as that, it's only available with Linux, has different hardware than the standard XPS, and is very routinely called "Linux Developer Edition" by the press (though I couldn't say if Dell ever called it that).

I explored the situation on a few dells, and they have obvious bugs in their bios ACPI tables: it's as if they had been written by an intern discovering this technology.

Long story short, on at least a few ones I explored deeply (The 7275 or the 9250 can't remember) the dell just can't sleep right, even on Windows.

What saves the day is Windows proper sleep support, including hybrid sleep, that prepares for the worst (save an S4 hibernation image) and hopes for the best (wakes up time to time to check what's left in be battery, to decide when to give up when the power goes below what's called the sleep budget, to ensure the laptop will be able to wake up)

The beauty of it is when laptops have a wrong bios that just cant sleep, windows hides the bug away.

The sad part of it is that Windows takes the blame (the laptol takes a long time to wake up from suspend to disk, and shows the power has been almost exhusted) for the manufacturer incompetence.

I think this is why they introduced a change early on in Windows 10 that when tne measurements at the beginning of the sleep showed the power was going down with a dangerously steep slope, it was a clear sign Windows was running on a poorly designed laptop, and that it should abandon all hope of s2idle working right, and instead just powed off the poor laptop to put it out of its misery and instead try to do a fast start with the hibernation image the next time

The worst part is that the dangerously incompetent people at dell, unaware of their own incompetence (they couldnt write proper ACPI sleep in the first place) decided to double down on the stupidity and did some weird things to mislead windows and prevent it from giving up on s2idle.... which is why dell latops have acquired a reputation they may catch fire when in a bad.

It's all both funny and sad, so I applaud lenovo for finding ways to make S3 sleep work on laptops like the x10 gen1, which uses a generation of intel CPU where the excuse of manufacturer of 'made for linux' laptops is that S3 can't work because it was no longer supported by Intel anymore...

Re: Update on Linux hibernation support when lockdown is enabled

#24

Post by josephcsible »

kmeisthax wrote: post #22
josephcsible wrote: post #7

Earlier quoted context omitted.

That doesn't actually protect against that attack, though. The evil maid just steals the guts of your computer and replaces them with ones that always say "sorry, wrong password", while exfiltrating the password you tried over Wi-Fi or Bluetooth. Then they use your password to decrypt your unmodified hard drive with your unmodified TPM on your unmodified motherboard. Also, I don't think this is true: > That TPM gets…

There's one flaw in your scenario: if your computer suddenly stopped respecting valid credentials, it'd be extremely obvious that the motherboard had been replaced or tampered with. Generally speaking most evil-maid attacks assume that the attacker wants to remain covert, otherwise the victim will start revoking stolen credentials, calling the authorities, etc. If you don't care about remaining covert then you don't…

The evil maid could use the credentials within seconds of you typing them in, so you wouldn't have time to revoke anything. With rubber-hose attacks, you might give the attacker a duress code rather than the real password, which wouldn't happen with this one. And let's face it: it's probably nation-states that would do this kind of attack, so calling the authorities wouldn't be helpful anyway.

Re: Update on Linux hibernation support when lockdown is enabled

#25

Post by TingPing »

trelane wrote: post #19
bananabernhard wrote: post #10

Earlier quoted context omitted.

Does consumer hardware designed for linux even exist? Even bigger shops like system76 buy preconfigured laptops and install coreboot and PopOS! on it.

Yes. System76 partnered with Clevo to do their laptops, but it's not the exact same hardware as when you buy Clevo directly. E.g. https://twitter.com/jeremy_soller/status/1322954964549824512 I recall also discussing this with them when I was waiting for a laptop to get refreshed. There were working with Clevo to get some firmware issue fixed before they would ship it. Of course, their Thelio hardware is very much not…

Their Thelio hardware is off the shelf, mine has a regular Gigabyte board.

Re: Update on Linux hibernation support when lockdown is enabled

#26

Post by lozenge »

csdvrx wrote: post #23
masklinn wrote: post #12

Earlier quoted context omitted.

The XPS13 DE could be construed as that, it's only available with Linux, has different hardware than the standard XPS, and is very routinely called "Linux Developer Edition" by the press (though I couldn't say if Dell ever called it that).

I explored the situation on a few dells, and they have obvious bugs in their bios ACPI tables: it's as if they had been written by an intern discovering this technology. Long story short, on at least a few ones I explored deeply (The 7275 or the 9250 can't remember) the dell just can't sleep right, even on Windows. What saves the day is Windows proper sleep support, including hybrid sleep, that prepares for the worst…

The default sleep budget on my Dell is 30%. It's willing to spend 30% of the battery doing absolutely nothing useful with the lid closed. Who designed this...

Re: Update on Linux hibernation support when lockdown is enabled

#27

Post by trelane »

TingPing wrote: post #25
trelane wrote: post #19

Earlier quoted context omitted.

Yes. System76 partnered with Clevo to do their laptops, but it's not the exact same hardware as when you buy Clevo directly. E.g. https://twitter.com/jeremy_soller/status/1322954964549824512 I recall also discussing this with them when I was waiting for a laptop to get refreshed. There were working with Clevo to get some firmware issue fixed before they would ship it. Of course, their Thelio hardware is very much not…

Their Thelio hardware is off the shelf, mine has a regular Gigabyte board.

I don't think they fab their own chips either. It's a stretch to say the whole system is off the shelf because it has a commercially available motherboard with custom firmware, e.g. https://tech-docs.system76.com/models/thelio-massive-b1.2/RE...

Re: Update on Linux hibernation support when lockdown is enabled

#29

Post by noodlesUK »

trelane wrote: post #5
noodlesUK wrote: post #2

This would make a huge difference in battery life for Linux laptops with secure boot enabled. Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power.

Is this only true of Windows hardware, or does it include hardware designed for Linux?

Yes even the project sputnik laptops have it removed, which is incredibly frustrating. I got a precision 5530 replaced by dell with a precision 5550 and the new one doesn’t sleep.

Re: Update on Linux hibernation support when lockdown is enabled

#30

Post by lettergram »

The amount of setup required to make a laptop go into hibernation and boot to the same state every time is pretty substantial:

https://austingwalters.com/increasing-battery-life-on-an-arc...

This would make things a tad easier, but at the end of the day. Still think it’s gonna be a hard setup, plus it’ll slow boot up by wiping memory (should save power if I understand that correctly).

Post reply on HN