Re: [PATCH] SUPPORT.md: split XSM from Flask

[Daniel Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>]

---- On Tue, 30 Jul 2024 06:57:08 -0400 Jan Beulich  wrote ---

 > XSM is a generic framework, which in particular is also used by SILO. 
 > With this it can't really be experimental: Arm enables SILO by default. 
 >  
 > Signed-off-by: Jan Beulich jbeulich@xxxxxxxx> 
 >  
 > --- a/SUPPORT.md 
 > +++ b/SUPPORT.md 
 > @@ -768,13 +768,20 @@ Compile time disabled for ARM by default 
 >  
 >  Status, x86: Supported, not security supported 
 >  
 > -### XSM & FLASK 
 > +### XSM 
 > + 
 > +    Status: Supported 
 > + 
 > +See below for use with FLASK and SILO.  The dummy implementation is covered 
 > here 
 > +as well. 
 > + 
 > +### XSM + FLASK 

To me it would make more sense to say XSM FLASK Policy than XSM + FLASK.

 >  Status: Experimental 
 >  
 >  Compile time disabled by default. 
 >  
 > -Also note that using XSM 
 > +Also note that using FLASK 
 >  to delegate various domain control hypercalls 
 >  to particular other domains, rather than only permitting use by dom0, 
 >  is also specifically excluded from security support for many hypercalls. 
 > @@ -787,6 +794,10 @@ Please see XSA-77 for more details. 
 >  The default policy includes FLASK labels and roles for a "typical" 
 > Xen-based system 
 >  with dom0, driver domains, stub domains, domUs, and so on. 
 >  
 > +### XSM + SILO 

Same here, XSM SILO Policy.

 > +    Status: Supported 
 > + 
 >  ## Virtual Hardware, Hypervisor 
 >  
 >  ### x86/Nested PV 
 > 

v/r,
dps