From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (NAM11-DM6-obe.outbound.protection.outlook.com [40.107.223.65]) by mx.groups.io with SMTP id smtpd.web09.8912.1652451642093051938 for ; Fri, 13 May 2022 07:20:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=Gbo0pfBJ; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.223.65, mailfrom: michael.roth@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KQJMrB8nBfK3cH+R6vN9xhnZj9qk46QA0vuY2Jr9Jw1f/A0jKRB2SzZtr2N+aZfTO/+8Qhhb8NeXrZBEhVuGllFX2Jlem2GLIDbShaySDLSvXv2K/mviSD6Wjpjjl8iWeSO50ZCDXM1iFnB2za6vBBvz3v0pf8WvcJIzamYRSG01VlWas/5YeqxW8uiDbI16gXpaXEPf7afw8pN+YbJBvpGFXC8wA69di5iaKGqQC2x3NvG44WzNKkjbZJx9D366EHjcuUDpm4lLZaT/E/wQLiIfqiV9ev/tOTkTAiZjg9i2dt/FBNkdO6M2SGGs/L6kiZbZxKUK3FM/317uy+R4dg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aUxqdvMtQ+sS9RTLGWYTPYuv56YPnQee6okwVOoku6Y=; b=jePbeDmc63xaYMZ6cKu7tXLqVQFH3sLYYvoaZfu9NrAmVpf47mPlDapIkPKNa7eJFEm9AagvJf7caDKAn0R2AiK6UAOnVnYEeUN64rAJxm4Y4MbBObFOs1EkZH91nnfhN/C/JT7GIIZQ+fDWOBi7S68Z8Xi0PVm8B197EMtlYlGxHGNr6muhU8DU6F6r9T4Kl2hD4KooPcOtuBwwWVjOZBfn5e0YMNZWs+3S8w7bU9lfR50TJ0e9VmaNH4mmlo7yEKVCNneRHrl6U+pTSUnen5trvAJLLagYupT8ZUaT/yhEg6Z9LwrLe8GDAeCAxVtl6MjtvVk0MzgETlwzCSaqmA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aUxqdvMtQ+sS9RTLGWYTPYuv56YPnQee6okwVOoku6Y=; b=Gbo0pfBJC5w6bb9ufNS1a5IDppuao4RTK7whYggmy0XRMeEMJeep6MzlSavsO/FH6l15nX8uCwkFmZwYdnuk3RShJXz4Yj0Kp9ClBW0l3/QXLcKykHXpWXvxHF0I5XEporj1mKqGmktMjShaD1aRYLYXExgjIEtoQDbvw8CPegM= Received: from DS7PR03CA0077.namprd03.prod.outlook.com (2603:10b6:5:3bb::22) by BL3PR12MB6595.namprd12.prod.outlook.com (2603:10b6:208:38e::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5227.23; Fri, 13 May 2022 14:20:39 +0000 Received: from DM6NAM11FT052.eop-nam11.prod.protection.outlook.com (2603:10b6:5:3bb:cafe::7f) by DS7PR03CA0077.outlook.office365.com (2603:10b6:5:3bb::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5250.15 via Frontend Transport; Fri, 13 May 2022 14:20:39 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; Received: from SATLEXMB04.amd.com (165.204.84.17) by DM6NAM11FT052.mail.protection.outlook.com (10.13.172.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5250.13 via Frontend Transport; Fri, 13 May 2022 14:20:39 +0000 Received: from localhost (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Fri, 13 May 2022 09:20:37 -0500 Date: Fri, 13 May 2022 09:20:19 -0500 From: Michael Roth To: Tom Lendacky CC: Subject: Re: [PATCH] UefiCpuPkg: Store SEV-SNP AP jump table in the secrets page Message-ID: <20220513142019.rlri5zqieqaswndw@amd.com> References: <20220513132253.397679-1-michael.roth@amd.com> <62b8bc5f-3d0a-9ad6-1049-ea260cf01b19@amd.com> MIME-Version: 1.0 In-Reply-To: <62b8bc5f-3d0a-9ad6-1049-ea260cf01b19@amd.com> Return-Path: Michael.Roth@amd.com X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5d4a15b3-c9de-4fa4-e6ec-08da34ebc14b X-MS-TrafficTypeDiagnostic: BL3PR12MB6595:EE_ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: QiPcje9qmhjgpJ3WQJOuQbvjT6HF2Ax/fJ7cL7X+9zfMoAA9vNuyXzAevvqe82LpYTxwV9+4SRYwNO+CYK6G/GcqKgOTbaG2cSF9XNf75UtrwmFHS1y3ZQe6bh8LOVf3/eFzK6wakep2QzgzdtzU5Yj/uWgrjLHhBoU+ZqWGGaWBe5clgLE7DUVMkR1DeSL4FhWiCyntVWQ1+OYL8boq8n5NLogzDHkWGYCrHEUfPdHAAnbF4qW7XoLB/DY98sDrP28LRLo17U7iZvg+SC0IWv23JzWQ/LRMLA71QORqXtELX/usHFg6zKSvnN8S5UJAFVB+dJslBZBkd6ZtBJktwAgt1ibq/aC4uH9c+EpT6PEFmmj30XpJYXwtzJDq4GRViAkQbDqc4c6LpwrP4YYr8jjhpyaqK19HtuiZJYHfF1zCZ2HviBS0ZEEMN6xOjd6LT6lbLYzz1zhzYJlvSgoR33AkKQrvUxfrg+38fbWANTKwIYMdXYMRI5LhRFkDKk0XlU3XsVOzKLOFyBF8XkKDyTIZ96jPtPECSUWbRI69MzfBphkdA5N/bEzdhEyAPlp6//4obhJqfW0GV/bT6yjm24reTYxhxqGdFa4OXCi3es6MFtukEc8FdM2aTAaV8QJc3klTBH0ioOCLjztMXuCJU303zGwKeVZxzjxlhE4fJNbnzQK5HTZYvvYJiFwhcMPA9+adwLWp4FxZOg/ViffvpQ== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230001)(4636009)(46966006)(40470700004)(36840700001)(36756003)(8936002)(36860700001)(508600001)(6862004)(8676002)(81166007)(70586007)(2906002)(70206006)(6666004)(37006003)(83380400001)(6636002)(356005)(2616005)(40460700003)(186003)(19627235002)(4326008)(16526019)(53546011)(26005)(1076003)(44832011)(5660300002)(316002)(30864003)(86362001)(336012)(82310400005)(426003)(47076005)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 May 2022 14:20:39.0344 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5d4a15b3-c9de-4fa4-e6ec-08da34ebc14b X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT052.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR12MB6595 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline On Fri, May 13, 2022 at 08:56:06AM -0500, Tom Lendacky wrote: > On 5/13/22 08:22, Michael Roth wrote: > > A full-featured SEV-SNP guest will not rely on the AP jump table, and > > will instead use the AP Creation interface defined by the GHCB. However, > > a guest is still allowed to use the AP jump table if desired. > > > > However, unlike with SEV-ES guests, SEV-SNP guests should not > > store/retrieve the jump table address via GHCB requests to the > > hypervisor, they should instead store/retrieve it via the SEV-SNP > > secrets page. Implement the store side of this for OVMF. > > > > Suggested-by: Tom Lendacky > > Signed-off-by: Michael Roth > > --- > > MdePkg/Include/AmdSevSnpSecretsPage.h | 51 +++++++++++++++++++ > > MdePkg/MdePkg.dec | 4 ++ > > OvmfPkg/AmdSev/AmdSevX64.dsc | 3 ++ > > OvmfPkg/CloudHv/CloudHvX64.dsc | 3 ++ > > OvmfPkg/IntelTdx/IntelTdxX64.dsc | 3 ++ > > OvmfPkg/Microvm/MicrovmX64.dsc | 3 ++ > > OvmfPkg/OvmfPkgIa32.dsc | 3 ++ > > OvmfPkg/OvmfPkgIa32X64.dsc | 3 ++ > > OvmfPkg/OvmfPkgX64.dsc | 3 ++ > > OvmfPkg/PlatformPei/AmdSev.c | 5 ++ > > OvmfPkg/PlatformPei/PlatformPei.inf | 1 + > > UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf | 1 + > > UefiCpuPkg/Library/MpInitLib/DxeMpLib.c | 9 ++++ > > 13 files changed, 92 insertions(+) > > create mode 100644 MdePkg/Include/AmdSevSnpSecretsPage.h > > > > diff --git a/MdePkg/Include/AmdSevSnpSecretsPage.h b/MdePkg/Include/AmdSevSnpSecretsPage.h > > new file mode 100644 > > index 0000000000..55c7475ff0 > > --- /dev/null > > +++ b/MdePkg/Include/AmdSevSnpSecretsPage.h > > Just wondering if this should be in the MdePkg/Include/Register/Amd directory? That might be the better spot. I was thinking that was reserved for definitions related to specific registers, but I somehow missed that it's also where the GHCB struct is defined. So probably makes sense to put the secrets page definition there as well. > > > @@ -0,0 +1,51 @@ > > +/** @file > > +Definitions for AMD SEV-SNP Secrets Page > > + > > +Copyright (c) 2022 AMD Inc. All rights reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > + > > +#ifndef AMD_SEV_SNP_SECRETS_PAGE_H_ > > +#define AMD_SEV_SNP_SECRETS_PAGE_H_ > > + > > +// > > +// OS-defined area of secrets page > > +// > > +// As defined by "SEV-ES Guest-Hypervisor Communication Block Standardization", > > +// revision 1.50, section 2.7, "SEV-SNP Secrets Page". > > This should be using at least revision 2.00 (if not 2.01 which is in the > process of being published). 2.01 uses some of the 40-byte reserved area to > hold the high 32-bits of the message sequence numbers (since the SNP API > changed after the GHCB spec was published to convert the sequence numbers > from 32-bit to 64-bit). The changes are backwards compatible, so not a big > deal as to whether to implement since OVMF doesn't make any guest request > API calls. Okay, will go ahead and update these while I'm at it and send a v2. Thanks! -Mike > > Thanks, > Tom > > > +// > > +typedef PACKED struct _SNP_SECRETS_OS_AREA { > > + UINT32 MsgSeqNum0; > > + UINT32 MsgSeqNum1; > > + UINT32 MsgSeqNum2; > > + UINT32 MsgSeqNum3; > > + UINT64 ApJumpTablePa; > > + UINT8 Reserved[40]; > > + UINT8 GuestUsage[32]; > > +} SNP_SECRETS_OS_AREA; > > + > > +#define VMPCK_KEY_LEN 32 > > + > > +// > > +// SEV-SNP Secrets page > > +// > > +// As defined by "SEV-SNP Firmware ABI", revision 1.51, section 8.17.2.5, > > +// "PAGE_TYPE_SECRETS". > > +// > > +typedef PACKED struct _SNP_SECRETS_PAGE { > > + UINT32 Version; > > + UINT32 ImiEn : 1, > > + Reserved : 31; > > + UINT32 Fms; > > + UINT32 Reserved2; > > + UINT8 Gosvw[16]; > > + UINT8 Vmpck0[VMPCK_KEY_LEN]; > > + UINT8 Vmpck1[VMPCK_KEY_LEN]; > > + UINT8 Vmpck2[VMPCK_KEY_LEN]; > > + UINT8 Vmpck3[VMPCK_KEY_LEN]; > > + SNP_SECRETS_OS_AREA OsArea; > > + UINT8 Reserved3[3840]; > > +} SNP_SECRETS_PAGE; > > + > > +#endif > > diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec > > index f1ebf9e251..a365bfcfe8 100644 > > --- a/MdePkg/MdePkg.dec > > +++ b/MdePkg/MdePkg.dec > > @@ -2417,5 +2417,9 @@ > > # @Prompt Memory encryption attribute > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0|UINT64|0x0000002e > > + ## This dynamic PCD indicates the location of the SEV-SNP secrets page. > > + # @Prompt SEV-SNP secrets page address > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0|UINT64|0x0000002f > > + > > [UserExtensions.TianoCore."ExtraFiles"] > > MdePkgExtra.uni > > diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc > > index f0700035c1..02306945fd 100644 > > --- a/OvmfPkg/AmdSev/AmdSevX64.dsc > > +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc > > @@ -575,6 +575,9 @@ > > # Set ConfidentialComputing defaults > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > !include OvmfPkg/OvmfTpmPcds.dsc.inc > > gEfiMdePkgTokenSpaceGuid.PcdFSBClock|100000000 > > diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc > > index d1c85f60c7..7143698253 100644 > > --- a/OvmfPkg/CloudHv/CloudHvX64.dsc > > +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc > > @@ -630,6 +630,9 @@ > > # Set ConfidentialComputing defaults > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > [PcdsDynamicHii] > > !include OvmfPkg/OvmfTpmPcdsHii.dsc.inc > > diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc > > index 80c331ea23..b19718c572 100644 > > --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc > > +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc > > @@ -512,6 +512,9 @@ > > gEfiMdePkgTokenSpaceGuid.PcdFSBClock|100000000 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > ################################################################################ > > # > > # Components Section - list of all EDK II Modules needed by this Platform. > > diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc > > index 20c3c9c4d8..42673c29ee 100644 > > --- a/OvmfPkg/Microvm/MicrovmX64.dsc > > +++ b/OvmfPkg/Microvm/MicrovmX64.dsc > > @@ -613,6 +613,9 @@ > > # Set ConfidentialComputing defaults > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > ################################################################################ > > # > > # Components Section - list of all EDK II Modules needed by this Platform. > > diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc > > index 533bbdb435..8ffef069a3 100644 > > --- a/OvmfPkg/OvmfPkgIa32.dsc > > +++ b/OvmfPkg/OvmfPkgIa32.dsc > > @@ -649,6 +649,9 @@ > > # Set ConfidentialComputing defaults > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > !if $(CSM_ENABLE) == FALSE > > gEfiMdePkgTokenSpaceGuid.PcdFSBClock|100000000 > > !endif > > diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc > > index cb68e612bd..0b4d5001b2 100644 > > --- a/OvmfPkg/OvmfPkgIa32X64.dsc > > +++ b/OvmfPkg/OvmfPkgIa32X64.dsc > > @@ -657,6 +657,9 @@ > > # Set ConfidentialComputing defaults > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > !if $(CSM_ENABLE) == FALSE > > gEfiMdePkgTokenSpaceGuid.PcdFSBClock|100000000 > > !endif > > diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc > > index 71526bba31..3a3223be6b 100644 > > --- a/OvmfPkg/OvmfPkgX64.dsc > > +++ b/OvmfPkg/OvmfPkgX64.dsc > > @@ -680,6 +680,9 @@ > > # Set ConfidentialComputing defaults > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr|0 > > + # Set SEV-SNP Secrets page address default > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress|0 > > + > > !if $(CSM_ENABLE) == FALSE > > gEfiMdePkgTokenSpaceGuid.PcdFSBClock|100000000 > > !endif > > diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c > > index 385562b44c..70352ca43b 100644 > > --- a/OvmfPkg/PlatformPei/AmdSev.c > > +++ b/OvmfPkg/PlatformPei/AmdSev.c > > @@ -408,6 +408,11 @@ AmdSevInitialize ( > > // > > if (MemEncryptSevSnpIsEnabled ()) { > > PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSevSnp); > > + ASSERT_RETURN_ERROR (PcdStatus); > > + PcdStatus = PcdSet64S ( > > + PcdSevSnpSecretsAddress, > > + (UINT64)(UINTN)PcdGet32 (PcdOvmfSnpSecretsBase) > > + ); > > } else if (MemEncryptSevEsIsEnabled ()) { > > PcdStatus = PcdSet64S (PcdConfidentialComputingGuestAttr, CCAttrAmdSevEs); > > } else { > > diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf > > index 00372fa0eb..c688e4ee24 100644 > > --- a/OvmfPkg/PlatformPei/PlatformPei.inf > > +++ b/OvmfPkg/PlatformPei/PlatformPei.inf > > @@ -114,6 +114,7 @@ > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr > > gUefiCpuPkgTokenSpaceGuid.PcdGhcbHypervisorFeatures > > gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress > > [FixedPcd] > > gUefiOvmfPkgTokenSpaceGuid.PcdOvmfCpuidBase > > diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf > > index e1cd0b3500..d8cfddcd82 100644 > > --- a/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf > > +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf > > @@ -80,3 +80,4 @@ > > gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard ## CONSUMES > > gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase ## CONSUMES > > gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr ## CONSUMES > > + gEfiMdePkgTokenSpaceGuid.PcdSevSnpSecretsAddress ## CONSUMES > > diff --git a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c > > index 60d14a5a0e..6014dce136 100644 > > --- a/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c > > +++ b/UefiCpuPkg/Library/MpInitLib/DxeMpLib.c > > @@ -15,6 +15,7 @@ > > #include > > #include > > #include > > +#include > > #include > > @@ -216,6 +217,14 @@ GetSevEsAPMemory ( > > DEBUG ((DEBUG_INFO, "Dxe: SevEsAPMemory = %lx\n", (UINTN)StartAddress)); > > + if (ConfidentialComputingGuestHas (CCAttrAmdSevSnp)) { > > + SNP_SECRETS_PAGE *Secrets = (SNP_SECRETS_PAGE *)(INTN)PcdGet64 (PcdSevSnpSecretsAddress); > > + > > + Secrets->OsArea.ApJumpTablePa = (UINT64)(UINTN)StartAddress; > > + > > + return (UINTN)StartAddress; > > + } > > + > > // > > // Save the SevEsAPMemory as the AP jump table. > > //