RE: [RFC PATCH 04/15] virt: tdx-guest: Support devsec TSM for secure devices

[Duan, Zhenzhong]

>-----Original Message-----
>From: Xu Yilun <yilun.xu@xxxxxxxxxxxxxxx>
>Subject: Re: [RFC PATCH 04/15] virt: tdx-guest: Support devsec TSM for
>secure devices
>
>> diff --git a/drivers/virt/coco/tdx-guest/Kconfig b/drivers/virt/coco/tdx-
>guest/Kconfig
>> index dbbdc14383b1..2e9407f8bc70 100644
>> --- a/drivers/virt/coco/tdx-guest/Kconfig
>> +++ b/drivers/virt/coco/tdx-guest/Kconfig
>> @@ -10,3 +10,18 @@ config TDX_GUEST_DRIVER
>>
>>  	  To compile this driver as module, choose M here. The module will
>>  	  be called tdx-guest.
>> +
>> +config TDX_CONNECT_GUEST
>
>I asked the similar question on host side series On host, we enable all
>tdx-module-supported features regardless. Then why should we make the
>driver support configurable, any good reason to switch the driver off?

It provides a build-time choice to omit TDX Connect support when it
is not needed, reducing kernel size and excluding unused code paths.
The runtime check cannot provide that choice.

>
>> +	bool "Intel TDX Connect Guest Support"
>> +	depends on TDX_GUEST_DRIVER
>> +	depends on PCI_TSM
>> +	default y
>> +	help
>> +	  Support Trust Device Interface (TDI) feature enumeration,
>> +	  validation, and activation within an Intel TDX guest.
>> +
>> +	  This option enables the guest kernel to establish secure,
>> +	  isolated connections with trusted devices assigned to the TD,
>> +	  validating MMIO maps and authorizing DMA remapping tables.
>> +
>> +	  If unsure, say Y.