Re: [PATCH v8 02/11] x86/tdx: Introduce INTEL_TDX_GUEST config option

[Josh Poimboeuf]

On Tue, Oct 05, 2021 at 07:29:12PM +0200, Borislav Petkov wrote:
> On Tue, Oct 05, 2021 at 07:48:25AM -0700, Kuppuswamy, Sathyanarayanan wrote:
> > Since x2APIC will always exist in TDX guest case, we have used select to
> > enable the support. But since we have dependency on it, I  think "depends"
> > might be a better choice.
> 
> Right, and while we're on the subject, this looks silly to me too:
> 
> +       depends on SECURITY
> ...
> +       select SECURITY_LOCKDOWN_LSM
> 
> because
> 
> Symbol: SECURITY_LOCKDOWN_LSM [=n]
>   │ Type  : bool
>   │ Defined at security/lockdown/Kconfig:1
>   │   Prompt: Basic module for enforcing kernel lockdown
>   │   Depends on: SECURITY [=n]
> 		  ^^^^^^^^^
> 
> so that symbol already depends on SECURITY.
> 
> And I have SECURITY=n in my config so I still have to go select SECURITY
> by hand so that CONFIG_INTEL_TDX_GUEST becomes visible. And when I
> select it, SECURITY_LOCKDOWN_LSM gets enabled too.
> 
> But since I have to go select SECURITY, I can just as well enable
> SECURITY_LOCKDOWN_LSM in order to have TDX guest support.
> 
> IOW, I don't see the point for the evil "select"s - just make everything
> depends on and be done with it.
> 
> Unless there's an aspect I'm missing...

It would also be helpful to explain the dependencies (particularly
X86_X2APIC and SECURITY_LOCKDOWN_LSM) in the commit message.

-- 
Josh