Re: [PATCH v2] SUPPORT.md: add Dom0less as Supported

[Jan Beulich <jbeulich@xxxxxxxx>]

On 16.07.2021 22:29, Stefano Stabellini wrote:
> On Thu, 15 Jul 2021, Julien Grall wrote:
>> Hi Stefano,
>>
>> On 15/07/2021 00:48, Stefano Stabellini wrote:
>>> Add Dom0less to SUPPORT.md to clarify its support status. The feature is
>>> mature enough and small enough to make it security supported.
>>
>> I would suggest to explain the restriction in the commit message (and give a
>> link to XSA-372 commit).
>>
>>> Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxx>
>>> ---
>>> Changes in v2:
>>> - clarify memory scrubbing
>>> ---
>>>   SUPPORT.md | 9 +++++++++
>>>   1 file changed, 9 insertions(+)
>>>
>>> diff --git a/SUPPORT.md b/SUPPORT.md
>>> index 317392d8f3..524cab9c8d 100644
>>> --- a/SUPPORT.md
>>> +++ b/SUPPORT.md
>>> @@ -832,6 +832,15 @@ OVMF firmware implements the UEFI boot protocol.
>>>         Status, qemu-xen: Supported
>>>   +## Dom0less
>>> +
>>> +Guest creation from the hypervisor at boot without Dom0 intervention.
>>> +
>>> +    Status, ARM: Supported
>>> +
>>> +Memory of dom0less DomUs is not scrubbed at boot (even with
>>> +bootscrub=on); no XSAs will be issues due to unscrubbed memory.
>>
>> The memory will not be scrubbed for bootscrub=on and bootscrub=off. However,
>> it should be scrubbed for bootscrub=idle (the default).
> 
> With bootscrub=idle, do you know if it is guaranteed to complete the
> scrubbing before dom0less domUs start? I assumed it wasn't guaranteed,
> but if it is, then we should rephrase the statement.

Idle scrubbing never touches pages already owned by a domain. Hence the
question isn't whether scrubbing happens before these DomU-s start, but
whether they have their memory scrubbed before or while being allocated /
assigned to them. init_heap_pages() has

    if ( system_state < SYS_STATE_active && opt_bootscrub == BOOTSCRUB_IDLE )
        idle_scrub = true;

i.e. all memory given to the page allocator early enough will be _marked_
for scrubbing. If idle scrubbing didn't make it far enough,
alloc_heap_pages() will recognize this and scrub the page(s) synchronously
(of course unless passed MEMF_no_scrub).

Jan