APRIORI DXE {\r
INF MdeModulePkg/Universal/DevicePathDxe/DevicePathDxe.inf\r
INF MdeModulePkg/Universal/PCD/Dxe/Pcd.inf\r
- INF OvmfPkg/TdxDxe/TdxDxe.inf\r
+ # AmdSevDxe must be loaded before TdxDxe. Because in SEV guest AmdSevDxe\r
+ # driver performs a MemEncryptSevClearMmioPageEncMask() call against the\r
+ # PcdPciExpressBaseAddress range to mark it shared/unencrypted.\r
+ # Otherwise #VC handler terminates the guest for trying to do MMIO to an\r
+ # encrypted region (Since the range has not been marked shared/unencrypted).\r
INF OvmfPkg/AmdSevDxe/AmdSevDxe.inf\r
+ INF OvmfPkg/TdxDxe/TdxDxe.inf\r
!if $(SMM_REQUIRE) == FALSE\r
INF OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FvbServicesRuntimeDxe.inf\r
!endif\r