Re: [PATCH] KVM: allow compiling out SMM support

[Paolo Bonzini]

On 9/29/22 17:49, Maciej S. Szmigiero wrote:
> On 27.09.2022 17:22, Paolo Bonzini wrote:
> > Some users of KVM implement the UEFI variable store through a 
> > paravirtual device
> > that does not require the "SMM lockbox" component of edk2; allow them to
> > compile out system management mode, which is not a full implementation
> > especially in how it interacts with nested virtualization.
> >
> > Suggested-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> > Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> > ---
> >     The patch isn't pretty.  I could skip all the changes to add WARNs
> >     to called functions, but the point of adding the config symbol is
> >     to make sure that those functions, and all the baggage they bring,
> >     are dead.
>
> Out of curiosity: why the SMM support is so special that it's worth to
> add a dedicated Kconfig entry for it?

Yeah, that's a good point.  In general the module parameters either:

1) change between two behaviors (e.g. tdp_mmu) or

2) can be toggled at runtime or

3) disable _hardware_ features

The two Kconfig entries for SMM and XEN are more for things that you 
want to remove to reduce attack surface than for testing.

> Looking at the patch it doesn't seem to disable that much of code (like,
> significantly slim down the binary) and where it does disable something
> it mostly relies on compiler dead code removal rather than explicit
> #ifdefs (which would guarantee that the disabled code did not end in
> the binary).

Yeah, v2 will actually remove much more.

Paolo