Re: [PATCH v2] SUPPORT.md: add Dom0less as Supported

From: Julien Grall <julien@xen.org>
To: Stefano Stabellini <sstabellini@kernel.org>,
	xen-devel@lists.xenproject.org
Cc: andrew.cooper3@citrix.com, george.dunlap@citrix.com,
	jbeulich@suse.com, iwj@xenproject.org, wl@xen.org,
	Stefano Stabellini <stefano.stabellini@xilinx.com>
Subject: Re: [PATCH v2] SUPPORT.md: add Dom0less as Supported
Date: Thu, 15 Jul 2021 10:10:26 +0100	[thread overview]
Message-ID: <04d06f53-4489-1a08-e744-fa36679a2287@xen.org> (raw)
In-Reply-To: <20210714234809.30483-1-sstabellini@kernel.org>

Hi Stefano,

On 15/07/2021 00:48, Stefano Stabellini wrote:
> Add Dom0less to SUPPORT.md to clarify its support status. The feature is
> mature enough and small enough to make it security supported.

I would suggest to explain the restriction in the commit message (and 
give a link to XSA-372 commit).

> Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
> ---
> Changes in v2:
> - clarify memory scrubbing
> ---
>   SUPPORT.md | 9 +++++++++
>   1 file changed, 9 insertions(+)
> 
> diff --git a/SUPPORT.md b/SUPPORT.md
> index 317392d8f3..524cab9c8d 100644
> --- a/SUPPORT.md
> +++ b/SUPPORT.md
> @@ -832,6 +832,15 @@ OVMF firmware implements the UEFI boot protocol.
>   
>       Status, qemu-xen: Supported
>   
> +## Dom0less
> +
> +Guest creation from the hypervisor at boot without Dom0 intervention.
> +
> +    Status, ARM: Supported
> +
> +Memory of dom0less DomUs is not scrubbed at boot (even with
> +bootscrub=on); no XSAs will be issues due to unscrubbed memory.

The memory will not be scrubbed for bootscrub=on and bootscrub=off. 
However, it should be scrubbed for bootscrub=idle (the default).

Cheers,

-- 
Julien Grall