Re: [edk2-devel] [PATCH] OvmfPkg: Set PciLib for TdxDxe driver

["Yao, Jiewen" <jiewen.yao@intel.com>]

Hi
If TdxDxe breaks SEV, should we skip the TdxDxe in SEV path?

I don't understand why we need use Cfg8.

Thank you
Yao Jiewen


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Min Xu
> Sent: Tuesday, April 19, 2022 9:58 AM
> To: devel@edk2.groups.io
> Cc: Xu, Min M <min.m.xu@intel.com>; Brijesh Singh <brijesh.singh@amd.com>;
> Aktas, Erdem <erdemaktas@google.com>; James Bottomley
> <jejb@linux.ibm.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> <thomas.lendacky@amd.com>
> Subject: [edk2-devel] [PATCH] OvmfPkg: Set PciLib for TdxDxe driver
> 
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3904
> 
> TdxDxe driver is introduced for Intel TDX feature. Unfortunately, this
> driver also breaks boot process in SEV-ES guest. The root cause is in
> the PciLib which is imported by TdxDxe driver.
> 
> In a SEV-ES guest the AmdSevDxe driver performs a
> MemEncryptSevClearMmioPageEncMask() call against the
> PcdPciExpressBaseAddress range to mark it shared/unencrypted. However,
> the TdxDxe driver is loaded before the AmdSevDxe driver, and the PciLib
> in TdxDxe is DxePciLibI440FxQ35 which will access the
> PcdPciExpressBaseAddress range. Since the range has not been marked
> shared/unencrypted, the #VC handler terminates the guest for trying to
> do MMIO to an encrypted region.
> 
> To fix the issue TdxDxe driver set the PciLib to BasePciLibCf8.inf as
> AmdSevDxe driver does.
> 
> Cc: Brijesh Singh <brijesh.singh@amd.com>
> Cc: Erdem Aktas <erdemaktas@google.com>
> Cc: James Bottomley <jejb@linux.ibm.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> SEV-Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
> TDX-Tested-by: Min Xu <min.m.xu@intel.com>
> Signed-off-by: Min Xu <min.m.xu@intel.com>
> ---
>  OvmfPkg/IntelTdx/IntelTdxX64.dsc | 5 ++++-
>  OvmfPkg/OvmfPkgX64.dsc           | 5 ++++-
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
> b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
> index 245155d41b..f58f14a1d8 100644
> --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
> +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
> @@ -704,7 +704,10 @@
>    OvmfPkg/PlatformDxe/Platform.inf
>    OvmfPkg/IoMmuDxe/IoMmuDxe.inf
> 
> -  OvmfPkg/TdxDxe/TdxDxe.inf
> +  OvmfPkg/TdxDxe/TdxDxe.inf {
> +    <LibraryClasses>
> +    PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf
> +  }
> 
>    #
>    # Variable driver stack (non-SMM)
> diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
> index fb2899f8a1..68e7d051d0 100644
> --- a/OvmfPkg/OvmfPkgX64.dsc
> +++ b/OvmfPkg/OvmfPkgX64.dsc
> @@ -967,7 +967,10 @@
>    }
>    OvmfPkg/IoMmuDxe/IoMmuDxe.inf
> 
> -  OvmfPkg/TdxDxe/TdxDxe.inf
> +  OvmfPkg/TdxDxe/TdxDxe.inf {
> +    <LibraryClasses>
> +    PciLib|MdePkg/Library/BasePciLibCf8/BasePciLibCf8.inf
> +  }
> 
>  !if $(SMM_REQUIRE) == TRUE
>    OvmfPkg/SmmAccess/SmmAccess2Dxe.inf
> --
> 2.29.2.windows.2
> 
> 
> 
> 
>