From: Stefano Stabellini <sstabellini@kernel.org>
To: Julien Grall <julien@xen.org>
Cc: Stefano Stabellini <sstabellini@kernel.org>,
xen-devel@lists.xenproject.org, andrew.cooper3@citrix.com,
george.dunlap@citrix.com, jbeulich@suse.com, iwj@xenproject.org,
wl@xen.org
Subject: Re: [PATCH] SUPPORT.md: add Dom0less as Supported
Date: Wed, 14 Jul 2021 12:28:48 -0700 (PDT) [thread overview]
Message-ID: <alpine.DEB.2.21.2107141224550.23286@sstabellini-ThinkPad-T480s> (raw)
In-Reply-To: <47749630-ff78-e00f-63c0-8ff71a6a04c9@xen.org>
On Wed, 14 Jul 2021, Julien Grall wrote:
> Hi Stefano,
>
> On 14/07/2021 01:39, Stefano Stabellini wrote:
> > Add Dom0less to SUPPORT.md to clarify its support status. The feature is
> > mature enough and small enough to make it security supported.
> >
> > Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
> >
> > diff --git a/SUPPORT.md b/SUPPORT.md
> > index 317392d8f3..c777f3da72 100644
> > --- a/SUPPORT.md
> > +++ b/SUPPORT.md
> > @@ -832,6 +832,12 @@ OVMF firmware implements the UEFI boot protocol.
> > Status, qemu-xen: Supported
> > +## Dom0less
> > +
> > +Guest creation from the hypervisor at boot without Dom0 intervention.
> > +
> > + Status, ARM: Supported
> > +
>
> After XSA-372, we will not scrubbed memory assigned to dom0less DomU when
> bootscrub=on.
Do you mean *before* XSA-372, right? I thought the XSA-372 patches take
care of the problem?
> Do we want to exclude this combination or mention that XSAs will
> not be issued if the domU can read secret from unscrubbed memory?
I could say that if bootscrub=off then we won't issue XSAs for domUs reading
secrets from unscrubbed memory. But it is kind of obvious anyway? I am
happy to add it if you think it is good to clarify.
next prev parent reply other threads:[~2021-07-14 19:29 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-14 0:39 [PATCH] SUPPORT.md: add Dom0less as Supported Stefano Stabellini
2021-07-14 18:01 ` Julien Grall
2021-07-14 19:28 ` Stefano Stabellini [this message]
2021-07-14 19:43 ` Julien Grall
2021-07-14 23:46 ` Stefano Stabellini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.21.2107141224550.23286@sstabellini-ThinkPad-T480s \
--to=sstabellini@kernel.org \
--cc=andrew.cooper3@citrix.com \
--cc=george.dunlap@citrix.com \
--cc=iwj@xenproject.org \
--cc=jbeulich@suse.com \
--cc=julien@xen.org \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).