[PATCH v2] x86/tdx: Remove the early #VE handler

[Vishal Verma <vishal.l.verma@intel.com>]

tdx_early_handle_ve() emulates port I/O for #VEs taken before
idt_setup_early_traps() installs the real #VE gate. Per commit
32e72854fa5f ("x86/tdx: Port I/O: Add early boot support"), it exists to
support earlyprintk's serial driver.

"earlyprintk=" and "earlycon=" are both early_param() handlers, so no
console can be registered before parse_early_param(), which runs from
setup_arch(), after idt_setup_early_traps() has replaced the early IDT.
Nothing in the window between idt_setup_early_handler() and
idt_setup_early_traps() does port I/O, so this emulation doesn't ever
get called.

Remove the handler. Any #VE in the early window now falls through to
early_fixup_exception().

Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
---
Changes in v2:
- Add review tags (Rick, Kiryl, Nikolay)
- Move LLM attribution below the ---
- Rebase to v7.4-rc1
- Link to v1: https://patch.msgid.link/20260910-b4-tdx_remove_early_ve_handler-v1-1-bf47a4d360c5@intel.com
---
Found with the help of an LLM observing that the real IDT is installed
before parse_early_param(). LLMs were also used to verify this. On a TDX
guest booted with earlyprintk, a counter added to tdx_early_handle_ve()
for testing remained 0 after boot.
---
 arch/x86/include/asm/tdx.h |  4 ----
 arch/x86/coco/tdx/tdx.c    | 22 ----------------------
 arch/x86/kernel/head64.c   |  3 ---
 3 files changed, 29 deletions(-)

diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
index 1fcfaed515fec..3f7a96b85beb0 100644
--- a/arch/x86/include/asm/tdx.h
+++ b/arch/x86/include/asm/tdx.h
@@ -76,8 +76,6 @@ bool tdx_handle_virt_exception(struct pt_regs *regs, struct ve_info *ve);
 
 void tdx_halt(void);
 
-bool tdx_early_handle_ve(struct pt_regs *regs);
-
 int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport);
 
 int tdx_mcall_extend_rtmr(u8 index, u8 *data);
@@ -94,8 +92,6 @@ void __init tdx_dump_td_ctls(u64 td_ctls);
 static inline void tdx_early_init(void) { };
 static inline void tdx_halt(void) { };
 
-static inline bool tdx_early_handle_ve(struct pt_regs *regs) { return false; }
-
 #endif /* CONFIG_INTEL_TDX_GUEST */
 
 #if defined(CONFIG_KVM_GUEST) && defined(CONFIG_INTEL_TDX_GUEST)
diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index 8bacbef62891f..288142062991e 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -737,28 +737,6 @@ static int handle_io(struct pt_regs *regs, struct ve_info *ve)
 	return ve_instr_len(ve);
 }
 
-/*
- * Early #VE exception handler. Only handles a subset of port I/O.
- * Intended only for earlyprintk. If failed, return false.
- */
-__init bool tdx_early_handle_ve(struct pt_regs *regs)
-{
-	struct ve_info ve;
-	int insn_len;
-
-	tdx_get_ve_info(&ve);
-
-	if (ve.exit_reason != EXIT_REASON_IO_INSTRUCTION)
-		return false;
-
-	insn_len = handle_io(regs, &ve);
-	if (insn_len < 0)
-		return false;
-
-	regs->ip += insn_len;
-	return true;
-}
-
 void tdx_get_ve_info(struct ve_info *ve)
 {
 	struct tdx_module_args args = {};
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index fd28b53dbac51..7b8b13f454545 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -166,9 +166,6 @@ void __init do_early_exception(struct pt_regs *regs, int trapnr)
 	    trapnr == X86_TRAP_VC && handle_vc_boot_ghcb(regs))
 		return;
 
-	if (trapnr == X86_TRAP_VE && tdx_early_handle_ve(regs))
-		return;
-
 	early_fixup_exception(regs, trapnr);
 }
 

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20260828-b4-tdx_remove_early_ve_handler-7c1463cf0f63

Best regards,
--  
Vishal Verma <vishal.l.verma@intel.com>