On a device lock, a strawman design would encrypt all user-level state and most of the kernel state, except for kernel state needed for resuming the device, some low-level device drivers (e.g., cell telephony driver), and the code that handles decryption and device unlock.