linux-kernel - Re: [PATCH 02/14] KVM: monolithic: x86: disable linking vmx and svm at the same time into the kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 15 Oct 2019 10:21:59 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Sean Christopherson <sean.j.christopherson@...el.com>,
        Andrea Arcangeli <aarcange@...hat.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Vitaly Kuznetsov <vkuznets@...hat.com>
Subject: Re: [PATCH 02/14] KVM: monolithic: x86: disable linking vmx and svm
 at the same time into the kernel

On 15/10/19 05:16, Sean Christopherson wrote:
> I think short and sweet is enough for the prompt, with the details of how
> build both buried in the help text.
> 
> choice
> 	prompt "KVM built-in support"
> 	help
> 	  Here be a long and detailed help text.
> 
> config KVM_AMD_STATIC
> 	select KVM_AMD
> 	bool "KVM AMD"
> 
> config KVM_INTEL_STATIC
> 	select KVM_INTEL
> 	bool "KVM Intel"

Or even just

	bool "AMD"
	...
	bool "Intel"

> endchoice
> 
> The ends up looking like:
> 
>    <*>   Kernel-based Virtual Machine (KVM) support
>            KVM built-in support (KVM Intel)  --->
>    -*-   KVM for Intel processors support

On top of this, it's also nice to hide the KVM_INTEL/KVM_AMD prompts if
linking statically.  You can achieve that with

config KVM_INTEL
    tristate
    prompt "KVM for Intel processors support" if KVM=m
    depends on (KVM=m && m) || KVM_INTEL_STATIC

config KVM_AMD
    tristate
    prompt "KVM for AMD processors support" if KVM=m
    depends on (KVM=m && m) || KVM_AMD_STATIC

The left side of the "||" ensures that, if KVM=m, you can only choose
module build for both KVM_INTEL and KVM_AMD.  Having just "depends on
KVM" would allow a pre-existing .config to choose the now-invalid
combination

	CONFIG_KVM=y
	CONFIG_KVM_INTEL=y
	CONFIG_KVM_AMD=y

The right side of the "||" part is just for documentation, to avoid that
a selected symbol does not satisfy its dependencies.

Thanks,

Paolo