Re: [PATCH v15 29/41] KVM: SEV: Synchronize MSR_IA32_XSS from the GHCB when it's valid

Kiryl Shutsemau
2025-09-22T09:54:27Z

On Mon, Sep 22, 2025 at 03:03:59PM +0530, Upadhyay, Neeraj wrote:
>
> >
> > In TDX case, VAPIC state is protected VMM. It covers ISR, so guest can
> > safely check ISR to detect if the exception is external or internal.
> >
> > IIUC, VAPIC state is controlled by VMM in SEV case and ISR is not
> > reliable.
> >
> > I am not sure if Secure AVIC[1] changes the situation for AMD.
> >
> > Neeraj?
> >
>
> For Secure AVIC enabled guests, guest's vAPIC ISR state is not visible to
> (and not controlled by) host or VMM.

In this case, I think you should make ia32_disable() in sme_early_init()
conditional on !Secure AVIC.

--
Kiryl Shutsemau / Kirill A. Shutemov