KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest

Disable interception of the GHCB MSR if and only if the VM is an SEV-ES
guest.  While the exact behavior is completely undocumented in the APM,
common sense and testing on SEV-ES capable CPUs says that accesses to the
GHCB from non-SEV-ES guests will #GP.  I.e. from the guest's perspective,
no functional change intended.

Fixes: 376c6d285017 ("KVM: SVM: Provide support for SEV-ES vCPU creation/loading")
Link: https://lore.kernel.org/r/20250610225737.156318-16-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index d0981264a0a5f4e591f794979747194677f66a34..66a52f31b86b0c6f5a54acaec9bdb38d73664024 100644 (file)
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4487,7 +4487,8 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm)
        /* Can't intercept XSETBV, HV can't modify XCR0 directly */
        svm_clr_intercept(svm, INTERCEPT_XSETBV);
 
-       /* Clear intercepts on selected MSRs */
+       /* Clear intercepts on MSRs that are context switched by hardware. */
+       svm_disable_intercept_for_msr(vcpu, MSR_AMD64_SEV_ES_GHCB, MSR_TYPE_RW);
        svm_disable_intercept_for_msr(vcpu, MSR_EFER, MSR_TYPE_RW);
        svm_disable_intercept_for_msr(vcpu, MSR_IA32_CR_PAT, MSR_TYPE_RW);
 }

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index c6d8edb399a1faca732d0ed4e05af7e9f393c95d..7cdb6503b88a1e1978244b804f178c443b5de8c5 100644 (file)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -111,7 +111,7 @@ static const struct svm_direct_access_msrs {
        { .index = MSR_IA32_XSS,                        .always = false },
        { .index = MSR_EFER,                            .always = false },
        { .index = MSR_IA32_CR_PAT,                     .always = false },
-       { .index = MSR_AMD64_SEV_ES_GHCB,               .always = true  },
+       { .index = MSR_AMD64_SEV_ES_GHCB,               .always = false },
        { .index = MSR_TSC_AUX,                         .always = false },
        { .index = X2APIC_MSR(APIC_ID),                 .always = false },
        { .index = X2APIC_MSR(APIC_LVR),                .always = false },