Hi,

I am currently working on enabling Alternate Injection for AMD SEV-SNP guests and have encountered a design issue.

The Alternate Injection specification, which is still preliminary, defines a so-called SVSM APIC protocol through a subset 

of X2APIC MSRs while timer support is configurable. 

[ This means, if timer functionality is not supported, the guest must rely on the hypervisor to emulate timer 

 support through use of the #HV Timer GHCB protocol. ]

When the OVMF firmware starts, it is in XAPIC mode by default and then, later, during the init phase it switches the guest to X2APIC. 

However, with Alternate Injection enabled, the OVMF in its very first phase - SEC - does XAPIC accesses.

The SVSM, however, which is part of the guest, uses the so-called SVSM APIC protocol which uses a subset of the X2APIC MSRs.

The OVMF, however, assumes it starts off in XAPIC memory-mapped mode and thus there's a protocol mismatch of sorts 

because with Alternate Injection already enabled in the SEC phase, it mandates X2APIC MSR accesses.

The registers (timer registers) when not handled by SVSM will get routed to the hypervisor (KVM) which at that point is operating the guest

in XAPIC mode until the PEI phase switches to X2APIC.

If X2APIC enablement is moved from the PEI to the SEC phase, the problem can be resolved. I have tested it and it works. 

However, I dont know if there is any concern or potential design issues with that move.

Do folks think this is ok to do - i.e., move the X2APIC enablement to the SEC phase?

Or do you have any suggestions for a better solution?

Please feel free to ask questions if some concepts are unclear and I'll gladly expand on them.

I am new to this, sorry If I have CCed too many people.

Thanks,
Melody