Re: [PATCH] x86/tdx: Remove the early #VE handler

[Kiryl Shutsemau <kas@kernel.org>]

On Thu, Sep 10, 2026 at 08:39:47PM +0000, Edgecombe, Rick P wrote:
> On Thu, 2026-09-10 at 12:28 -0600, Vishal Verma wrote:
> > tdx_early_handle_ve() emulates port I/O for #VEs taken before
> > idt_setup_early_traps() installs the real #VE gate. Per commit
> > 32e72854fa5f ("x86/tdx: Port I/O: Add early boot support"), it exists to
> > support earlyprintk's serial driver.
> > 
> > "earlyprintk=" and "earlycon=" are both early_param() handlers, so no
> > console can be registered before parse_early_param(), which runs from
> > setup_arch(), after idt_setup_early_traps() has replaced the early IDT.
> > Nothing in the window between idt_setup_early_handler() and
> > idt_setup_early_traps() does port I/O, so this emulation doesn't ever
> > get called.
> > 
> > Remove the handler. Any #VE in the early window now falls through to
> > early_fixup_exception(), as it previously did for #VEs that were not I/O
> > instructions.
> > 
> > Found with the help of an LLM observing that the real IDT is installed
> > before parse_early_param(). LLMs were also used to verify this. On a TDX
> > guest booted with earlyprintk, a counter added to tdx_early_handle_ve()
> > for testing remained 0 after boot.
> 
> The logic and history makes sense to me. I'm surprised early printk is not
> useful this early.
> 
> Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>

Rick, could you actually test it?

Are we sure there's no other port I/O in before idt_setup_early_traps()?

I don't see anything direct, but exception path is different story.

native_machine_emergency_restart() does port I/O for BOOT_KBD which
seems to be reachable and leads to #VE with the patch:

machine_emergency_restart()
  __machine_emergency_restart(1)
    machine_ops.emergency_restart()
      native_machine_emergency_restart()
        reboot_type == BOOT_ACPI (default)
	acpi_reboot()
	reboot_type = BOOT_KBD
  	  kb_wait()
            inb(0x64) --> #VE

Could you check if the patch changes panic() behaviour in the window
before idt_setup_early_traps()?

-- 
  Kiryl Shutsemau / Kirill A. Shutemov