linux-kernel - Re: KVM broken after suspend in most recent kernels.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200527051354.GL31696@linux.intel.com>
Date:   Tue, 26 May 2020 22:13:55 -0700
From:   Sean Christopherson <sean.j.christopherson@...el.com>
To:     Brad Campbell <lists2009@...rfbargle.com>
Cc:     Maxim Levitsky <mlevitsk@...hat.com>, kvm@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: KVM broken after suspend in most recent kernels.

On Mon, May 25, 2020 at 09:15:57PM +0800, Brad Campbell wrote:
> >When you mean that KVM is broken after suspend, you mean that you can't
> >start new VMs after suspend, or do VMs that were running before suspend
> >break?  I see the later on my machine. I have AMD system though, so most
> >likely this is another bug.
> >
> >Looking at the commit, I suspect that we indeed should set the IA32_FEAT_CTL
> >after resume from ram, since suspend to ram might count as a complete CPU
> >reset.
> >
> 
> One of those "I should have clarified that" moments immediately after I
> pressed send.  I've not tried suspending with a VM running. It's "can't start
> new VMs after suspend".

Don't bother testing suspending with a VM, the only thing that will be
different is that your system will hang on resume instead when running a
VM.  If there are active VMs, KVM automatically re-enables VMX via VMXON
after resume, and VMXON is what's faulting.

Odds are good the firmware simply isn't initializing IA32_FEAT_CTL, ever.
The kernel handles the boot-time case, but I (obviously) didn't consider
the suspend case.  I'll work on a patch.