From 892787fed516a147f3edfd2bb4fa0cf67c599be6 Mon Sep 17 00:00:00 2001 From: Min Xu Date: Thu, 21 Apr 2022 08:45:29 +0800 Subject: [PATCH] OvmfPkg/OvmfPkgX64: Adjust load sequence of TdxDxe and AmdSevDxe driver BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3904 TdxDxe driver is introduced for Intel TDX feature. Unfortunately, this driver also breaks boot process in SEV-ES guest. The root cause is in the PciLib which is imported by TdxDxe driver. In a SEV-ES guest the AmdSevDxe driver performs a MemEncryptSevClearMmioPageEncMask() call against the PcdPciExpressBaseAddress range to mark it shared/unencrypted. However, the TdxDxe driver is loaded before the AmdSevDxe driver, and the PciLib in TdxDxe is DxePciLibI440FxQ35 which will access the PcdPciExpressBaseAddress range. Since the range has not been marked shared/unencrypted, the #VC handler terminates the guest for trying to do MMIO to an encrypted region. Adjusting the load sequence of TdxDxe and AmdSevDxe can fix the issue. Cc: Brijesh Singh Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky SEV-Tested-by: Tom Lendacky TDX-Tested-by: Min Xu Reviewed-by: Jiewen Yao Signed-off-by: Min Xu --- OvmfPkg/OvmfPkgX64.fdf | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index 71df28705e..6e72cdf345 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -214,8 +214,13 @@ READ_LOCK_STATUS = TRUE APRIORI DXE { INF MdeModulePkg/Universal/DevicePathDxe/DevicePathDxe.inf INF MdeModulePkg/Universal/PCD/Dxe/Pcd.inf - INF OvmfPkg/TdxDxe/TdxDxe.inf + # AmdSevDxe must be loaded before TdxDxe. Because in SEV guest AmdSevDxe + # driver performs a MemEncryptSevClearMmioPageEncMask() call against the + # PcdPciExpressBaseAddress range to mark it shared/unencrypted. + # Otherwise #VC handler terminates the guest for trying to do MMIO to an + # encrypted region (Since the range has not been marked shared/unencrypted). INF OvmfPkg/AmdSevDxe/AmdSevDxe.inf + INF OvmfPkg/TdxDxe/TdxDxe.inf !if $(SMM_REQUIRE) == FALSE INF OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FvbServicesRuntimeDxe.inf !endif -- 2.39.2