From: Isaku Yamahata <isaku.yamahata@intel.com>

So far the processor compatibility check is not done on resume. It should
be done.  The resume is called for resuming from S3/S4.  CPUs can be
replaced or the kernel can resume from S4 on a different machine.  So
compatibility check is desirable.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
---
 virt/kvm/kvm_main.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 0ac00c711384..fc55447c4dba 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -5715,6 +5715,13 @@ static int kvm_suspend(void)
 
 static void kvm_resume(void)
 {
+	if (kvm_arch_check_processor_compat())
+		/*
+		 * No warning here because kvm_arch_check_processor_compat()
+		 * would have warned with more information.
+		 */
+		return; /* FIXME: disable KVM */
+
 	if (kvm_usage_count) {
 		lockdep_assert_not_held(&kvm_count_lock);
 		hardware_enable_nolock((void *)__func__);
-- 
2.25.1

On Thu, Sep 08, 2022 at 04:25:25PM -0700, isaku.yamahata@intel.com wrote:
>From: Isaku Yamahata <isaku.yamahata@intel.com>
>
>So far the processor compatibility check is not done on resume. It should
>be done.  The resume is called for resuming from S3/S4.  CPUs can be
>replaced or the kernel can resume from S4 on a different machine.  So

Are they valid cases handled by other kernel components? Trying to
handle them in KVM only doesn't help as kernel is likely to fail
somewhere else.

On Fri, Sep 09, 2022 at 10:15:16AM +0800,
Chao Gao <chao.gao@intel.com> wrote:

> On Thu, Sep 08, 2022 at 04:25:25PM -0700, isaku.yamahata@intel.com wrote:
> >From: Isaku Yamahata <isaku.yamahata@intel.com>
> >
> >So far the processor compatibility check is not done on resume. It should
> >be done.  The resume is called for resuming from S3/S4.  CPUs can be
> >replaced or the kernel can resume from S4 on a different machine.  So
> 
> Are they valid cases handled by other kernel components? Trying to
> handle them in KVM only doesn't help as kernel is likely to fail
> somewhere else.

I guess no.  Actually without the compatibility check, kvm_resume() tries to
enable it by calling hardware_enable_nolock().  The real effect on error case of
this patch is to print out (potentially) more helpful message gracefully by
check_processor_compatibility instead of error message of haredware_enable.
-- 
Isaku Yamahata <isaku.yamahata@gmail.com>