lkml.org 
[lkml]   [2021]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v8 02/11] x86/tdx: Introduce INTEL_TDX_GUEST config option
On Tue, Oct 05, 2021 at 07:29:12PM +0200, Borislav Petkov wrote:
> On Tue, Oct 05, 2021 at 07:48:25AM -0700, Kuppuswamy, Sathyanarayanan wrote:
> > Since x2APIC will always exist in TDX guest case, we have used select to
> > enable the support. But since we have dependency on it, I think "depends"
> > might be a better choice.
>
> Right, and while we're on the subject, this looks silly to me too:
>
> + depends on SECURITY
> ...
> + select SECURITY_LOCKDOWN_LSM
>
> because
>
> Symbol: SECURITY_LOCKDOWN_LSM [=n]
> │ Type : bool
> │ Defined at security/lockdown/Kconfig:1
> │ Prompt: Basic module for enforcing kernel lockdown
> │ Depends on: SECURITY [=n]
> ^^^^^^^^^
>
> so that symbol already depends on SECURITY.
>
> And I have SECURITY=n in my config so I still have to go select SECURITY
> by hand so that CONFIG_INTEL_TDX_GUEST becomes visible. And when I
> select it, SECURITY_LOCKDOWN_LSM gets enabled too.
>
> But since I have to go select SECURITY, I can just as well enable
> SECURITY_LOCKDOWN_LSM in order to have TDX guest support.
>
> IOW, I don't see the point for the evil "select"s - just make everything
> depends on and be done with it.
>
> Unless there's an aspect I'm missing...

It would also be helpful to explain the dependencies (particularly
X86_X2APIC and SECURITY_LOCKDOWN_LSM) in the commit message.

--
Josh

\
 
 \ /
  Last update: 2021-10-05 22:23    [W:0.112 / U:1.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site