Re: [PATCH] x86/tdx: Remove the early #VE handler

[Edgecombe, Rick P]

On Thu, 2026-09-10 at 12:28 -0600, Vishal Verma wrote:
> tdx_early_handle_ve() emulates port I/O for #VEs taken before
> idt_setup_early_traps() installs the real #VE gate. Per commit
> 32e72854fa5f ("x86/tdx: Port I/O: Add early boot support"), it exists to
> support earlyprintk's serial driver.
> 
> "earlyprintk=" and "earlycon=" are both early_param() handlers, so no
> console can be registered before parse_early_param(), which runs from
> setup_arch(), after idt_setup_early_traps() has replaced the early IDT.
> Nothing in the window between idt_setup_early_handler() and
> idt_setup_early_traps() does port I/O, so this emulation doesn't ever
> get called.
> 
> Remove the handler. Any #VE in the early window now falls through to
> early_fixup_exception(), as it previously did for #VEs that were not I/O
> instructions.
> 
> Found with the help of an LLM observing that the real IDT is installed
> before parse_early_param(). LLMs were also used to verify this. On a TDX
> guest booted with earlyprintk, a counter added to tdx_early_handle_ve()
> for testing remained 0 after boot.

The logic and history makes sense to me. I'm surprised early printk is not
useful this early.

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx>

I see do_early_exception() -> handle_vc_boot_ghcb() has some early_printks().
Presumably these don't work for the same reason?

> 
> Signed-off-by: Vishal Verma <vishal.l.verma@xxxxxxxxx>
> Cc: Andi Kleen <ak@xxxxxxxxxxxxxxx>
> Cc: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx>
> ---
>  arch/x86/include/asm/tdx.h |  4 ----
>  arch/x86/coco/tdx/tdx.c    | 22 ----------------------
>  arch/x86/kernel/head64.c   |  3 ---
>  3 files changed, 29 deletions(-)
> 
> diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
> index 89e97d5761d8..495154a7d77d 100644
> --- a/arch/x86/include/asm/tdx.h
> +++ b/arch/x86/include/asm/tdx.h
> @@ -75,8 +75,6 @@ bool tdx_handle_virt_exception(struct pt_regs *regs, struct ve_info *ve);
>  
>  void tdx_halt(void);
>  
> -bool tdx_early_handle_ve(struct pt_regs *regs);
> -
>  int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport);
>  
>  int tdx_mcall_extend_rtmr(u8 index, u8 *data);
> @@ -91,8 +89,6 @@ void __init tdx_dump_td_ctls(u64 td_ctls);
>  static inline void tdx_early_init(void) { };
>  static inline void tdx_halt(void) { };
>  
> -static inline bool tdx_early_handle_ve(struct pt_regs *regs) { return false; }
> -
>  #endif /* CONFIG_INTEL_TDX_GUEST */
>  
>  #if defined(CONFIG_KVM_GUEST) && defined(CONFIG_INTEL_TDX_GUEST)
> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> index f904a636d449..9bc78cb28710 100644
> --- a/arch/x86/coco/tdx/tdx.c
> +++ b/arch/x86/coco/tdx/tdx.c
> @@ -755,28 +755,6 @@ static int handle_io(struct pt_regs *regs, struct ve_info *ve)
>  	return ve_instr_len(ve);
>  }
>  
> -/*
> - * Early #VE exception handler. Only handles a subset of port I/O.
> - * Intended only for earlyprintk. If failed, return false.
> - */
> -__init bool tdx_early_handle_ve(struct pt_regs *regs)
> -{
> -	struct ve_info ve;
> -	int insn_len;
> -
> -	tdx_get_ve_info(&ve);
> -
> -	if (ve.exit_reason != EXIT_REASON_IO_INSTRUCTION)
> -		return false;
> -
> -	insn_len = handle_io(regs, &ve);
> -	if (insn_len < 0)
> -		return false;
> -
> -	regs->ip += insn_len;
> -	return true;
> -}
> -
>  void tdx_get_ve_info(struct ve_info *ve)
>  {
>  	struct tdx_module_args args = {};
> diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
> index fd28b53dbac5..7b8b13f45454 100644
> --- a/arch/x86/kernel/head64.c
> +++ b/arch/x86/kernel/head64.c
> @@ -166,9 +166,6 @@ void __init do_early_exception(struct pt_regs *regs, int trapnr)
>  	    trapnr == X86_TRAP_VC && handle_vc_boot_ghcb(regs))
>  		return;
>  
> -	if (trapnr == X86_TRAP_VE && tdx_early_handle_ve(regs))
> -		return;
> -
>  	early_fixup_exception(regs, trapnr);
>  }
>  
> 
> ---
> base-commit: df2908090cda368b01ff43709f51890076c56157
> change-id: 20260828-b4-tdx_remove_early_ve_handler-7c1463cf0f63
> 
> Best regards,
> --  
> Vishal Verma <vishal.l.verma@xxxxxxxxx>
>