Re: [PATCH v15 29/41] KVM: SEV: Synchronize MSR_IA32_XSS from the GHCB when it's valid

Upadhyay, Neeraj
2025-09-22T09:34:13Z

>
> In TDX case, VAPIC state is protected VMM. It covers ISR, so guest can
> safely check ISR to detect if the exception is external or internal.
>
> IIUC, VAPIC state is controlled by VMM in SEV case and ISR is not
> reliable.
>
> I am not sure if Secure AVIC[1] changes the situation for AMD.
>
> Neeraj?
>

For Secure AVIC enabled guests, guest's vAPIC ISR state is not visible
to (and not controlled by) host or VMM.

- Neeraj