On 26/02/2018 11:49, Borislav Petkov wrote: >> I think it is the host admin(e.g. cloud provider)'s responsibility to >> set an expected microcode revision. > + vcpu->arch.microcode_version = 0x1; > > That already looks pretty arbitrary and non-sensical to me.
It's actually 0x100000000. >> In addition, the non-sensical value which is written by the guest will >> not reflect to guest-visible microcode revision and just be ignored in >> this implementation. > > Huh? How so? > > So a guest will have *two* microcode revisions - both of which are most > likely wrong?! I don't understand this either. Actually I think this patch makes sense, since some errata actually can be worked around in the guest in the same way as the host. However, it should also be tied to the recently introduced mechanism to read MSR contents from the host. Paolo
