On Thu, Oct 01, 2026 at 05:41:55PM +1000, Jonathan Gray wrote:
> The limited AMD documentation on mitigations does not mention
> hypervisors at all.
>
> It seems we can only assume hypervisors implement all workarounds.
> And don't implement most MSRs.
Indeed, there was no guidance at all when I added this mitigation.
ok brynet@
> Index: sys/arch/amd64/amd64/cpu.c
> ===================================================================
> RCS file: /cvs/src/sys/arch/amd64/amd64/cpu.c,v
> diff -u -p -r1.207 cpu.c
> --- sys/arch/amd64/amd64/cpu.c 28 Sep 2026 04:50:24 -0000 1.207
> +++ sys/arch/amd64/amd64/cpu.c 1 Oct 2026 07:26:15 -0000
> @@ -1287,7 +1287,8 @@ cpu_fix_msrs(struct cpu_info *ci)
> * This MSR is available on all AMD families >= 10h, except 11h
> * where LFENCE is always serializing.
> */
> - if (family >= 0x10 && family != 0x11) {
> + if (family >= 0x10 && family != 0x11 &&
> + (cpu_ecxfeature & CPUIDECX_HV) == 0) {
> nmsr = msr = rdmsr(MSR_DE_CFG);
> nmsr |= DE_CFG_SERIALIZE_LFENCE;
> if (msr != nmsr)
> Index: sys/arch/i386/i386/machdep.c
> ===================================================================
> RCS file: /cvs/src/sys/arch/i386/i386/machdep.c,v
> diff -u -p -r1.680 machdep.c
> --- sys/arch/i386/i386/machdep.c 14 May 2026 01:39:38 -0000 1.680
> +++ sys/arch/i386/i386/machdep.c 1 Oct 2026 07:26:19 -0000
> @@ -2013,7 +2013,8 @@ identifycpu(struct cpu_info *ci)
> * where LFENCE is always serializing.
> */
> if (!strcmp(cpu_vendor, "AuthenticAMD")) {
> - if (ci->ci_family >= 0x10 && ci->ci_family != 0x11) {
> + if (ci->ci_family >= 0x10 && ci->ci_family != 0x11 &&
> + (cpu_ecxfeature & CPUIDECX_HV) == 0) {
> nmsr = msr = rdmsr(MSR_DE_CFG);
> nmsr |= DE_CFG_SERIALIZE_LFENCE;
> if (msr != nmsr)
>
>
