Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 5 Oct 2021 13:21:46 -0700
From:   Josh Poimboeuf <jpoimboe@redhat.com>
To:     Borislav Petkov <bp@alien8.de>
Cc:     "Kuppuswamy, Sathyanarayanan" 
        <sathyanarayanan.kuppuswamy@linux.intel.com>,
        Sathyanarayanan Kuppuswamy Natarajan 
        <sathyanarayanan.nkuppuswamy@gmail.com>,
        Randy Dunlap <rdunlap@infradead.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, x86@kernel.org,
        Paolo Bonzini <pbonzini@redhat.com>,
        David Hildenbrand <david@redhat.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        Juergen Gross <jgross@suse.com>, Deep Shah <sdeep@vmware.com>,
        VMware Inc <pv-drivers@vmware.com>,
        Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>, Peter H Anvin <hpa@zytor.com>,
        Dave Hansen <dave.hansen@intel.com>,
        Tony Luck <tony.luck@intel.com>,
        Dan Williams <dan.j.williams@intel.com>,
        Andi Kleen <ak@linux.intel.com>,
        Kirill Shutemov <kirill.shutemov@linux.intel.com>,
        Sean Christopherson <seanjc@google.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v8 02/11] x86/tdx: Introduce INTEL_TDX_GUEST config option
Message-ID: <20211005202146.s3ptxhabwyz3nacm@treble>
References: <20211005025205.1784480-1-sathyanarayanan.kuppuswamy@linux.intel.com>
 <20211005025205.1784480-3-sathyanarayanan.kuppuswamy@linux.intel.com>
 <cf33750f-615a-1edd-0fee-28e720bb38ce@infradead.org>
 <CAC41dw-U85dCGDm_QzyyOQfhbbaZZ5m9CvLuDjdXjuxEyid8qw@mail.gmail.com>
 <YVxdhtRbJfd9feA4@zn.tnic>
 <ba068e29-aefd-8e78-48e0-5431abd93f31@linux.intel.com>
 <YVyLaLTK6MgLi/rS@zn.tnic>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <YVyLaLTK6MgLi/rS@zn.tnic>
Precedence: bulk

On Tue, Oct 05, 2021 at 07:29:12PM +0200, Borislav Petkov wrote:
> On Tue, Oct 05, 2021 at 07:48:25AM -0700, Kuppuswamy, Sathyanarayanan wrote:
> > Since x2APIC will always exist in TDX guest case, we have used select to
> > enable the support. But since we have dependency on it, I  think "depends"
> > might be a better choice.
> 
> Right, and while we're on the subject, this looks silly to me too:
> 
> +       depends on SECURITY
> ...
> +       select SECURITY_LOCKDOWN_LSM
> 
> because
> 
> Symbol: SECURITY_LOCKDOWN_LSM [=n]
>   │ Type  : bool
>   │ Defined at security/lockdown/Kconfig:1
>   │   Prompt: Basic module for enforcing kernel lockdown
>   │   Depends on: SECURITY [=n]
> 		  ^^^^^^^^^
> 
> so that symbol already depends on SECURITY.
> 
> And I have SECURITY=n in my config so I still have to go select SECURITY
> by hand so that CONFIG_INTEL_TDX_GUEST becomes visible. And when I
> select it, SECURITY_LOCKDOWN_LSM gets enabled too.
> 
> But since I have to go select SECURITY, I can just as well enable
> SECURITY_LOCKDOWN_LSM in order to have TDX guest support.
> 
> IOW, I don't see the point for the evil "select"s - just make everything
> depends on and be done with it.
> 
> Unless there's an aspect I'm missing...

It would also be helpful to explain the dependencies (particularly
X86_X2APIC and SECURITY_LOCKDOWN_LSM) in the commit message.

-- 
Josh