Re: [PATCH 1/3] x86/tdx: Share tdx_panic() with the EFI stub

[Ard Biesheuvel]

On Tue, 15 Sep 2026, at 05:11, Borislav Petkov wrote:
> On Mon, Sep 14, 2026 at 08:37:47PM +0200, Ard Biesheuvel wrote:
>> Move the implementation of tdx_panic() into the source file that is
>> shared with the decompressor and the EFI stub.
>> 
>> Use memcpy() and strnlen() instead of strtomem_pad(), as the latter does
>> not exist in the early boot code.
>> 
>> Note that __tdx_hypercall() may call __tdx_hypercall_failed() if the
>> hypercall returns with an error (while it should never return to begin
>> with). __tdx_hypercall_failed() calls the decompressor's error()
>> routine, which prints a message and then loops forever.
>> 
>> When called from the EFI stub, this error() call may attempt to use port
>> I/O to the default serial port rather than the TDX hypercalls which the
>> decompressor uses normally to print diagnostics to the console, but this
>> is fine: given that this situation only occurs after a catastrophic
>> error, and a subsequent spurious return from tdx_panic(), whether
>> error() uses port I/O or not is rather moot at that point, as long as it
>> never returns.
>> 
>> Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
>> ---
>>  arch/x86/coco/tdx/tdx-shared.c    | 35 ++++++++++++++++++++
>>  arch/x86/coco/tdx/tdx.c           | 35 --------------------
>>  arch/x86/include/asm/shared/tdx.h |  1 +
>>  3 files changed, 36 insertions(+), 35 deletions(-)
>
> Nah, that doesn't work:
>
> ld: arch/x86/boot/compressed/tdx-shared.o: in function `tdx_panic':
> tdx-shared.c:(.text+0x2a3): undefined reference to `__fortify_panic'
> ld: tdx-shared.c:(.text+0x2b2): undefined reference to `__fortify_panic'
> ld: arch/x86/boot/compressed/vmlinux: hidden symbol `__SCK__WARN_trap' 
> isn't defined
> ld: final link failed: bad value
> make[3]: *** [arch/x86/boot/compressed/Makefile:117: 
> arch/x86/boot/compressed/vmlinux] Error 1
> make[2]: *** [arch/x86/boot/Makefile:96: 
> arch/x86/boot/compressed/vmlinux] Error 2
> make[1]: *** [arch/x86/Makefile:304: bzImage] Error 2
> make: *** [Makefile:248: __sub-make] Error 2
>

The bot hit this error too, but without your change so it is something
I will need to address anyway, e.g., by doing

--- a/arch/x86/boot/compressed/tdx-shared.c
+++ b/arch/x86/boot/compressed/tdx-shared.c
@@ -1,2 +1,3 @@
+#define __NO_FORTIFY
 #include "error.h"
 #include "../../coco/tdx/tdx-shared.c"

But I realized the whole union thing is redundant in the first place. We
might just do

--- a/arch/x86/coco/tdx/tdx-shared.c
+++ b/arch/x86/coco/tdx/tdx-shared.c
@@ -97,15 +97,13 @@ void __noreturn tdx_panic(const char *msg)
                .r11 = TDVMCALL_REPORT_FATAL_ERROR,
                .r12 = 0, /* Error code: 0 is Panic */
        };
-       union {
-               /* Define register order according to the GHCI */
-               struct { u64 r14, r15, rbx, rdi, rsi, r8, r9, rdx; };
-
-               char bytes[64] __nonstring;
+       /* Define register order according to the GHCI */
+       struct {
+               u64 r14, r15, rbx, rdi, rsi, r8, r9, rdx;
        } message = {};
 
        /* VMM assumes '\0' in byte 65, if the message took all 64 bytes */
-       memcpy(message.bytes, msg, strnlen(msg, sizeof(message)));
+       memcpy(&message, msg, strnlen(msg, sizeof(message)));
 
        args.r8  = message.r8;
        args.r9  = message.r9;