From 8ec7763c807f252e930c9647a0631253db2844a7 Mon Sep 17 00:00:00 2001 From: David Vrabel Date: Mon, 14 Oct 2013 10:23:10 +0200 Subject: Add DOMCTL to limit the number of event channels a domain may use Add XEN_DOMCTL_set_max_evtchn which may be used during domain creation to set the maximum event channel port a domain may use. This may be used to limit the amount of Xen resources (global mapping space and xenheap) that a domain may use for event channels. A domain that does not have a limit set may use all the event channels supported by the event channel ABI in use. Signed-off-by: David Vrabel Reviewed-by: Jan Beulich Acked-by: Daniel De Graaf Acked-by: Keir Fraser --- xen/xsm/flask/hooks.c | 3 +++ xen/xsm/flask/policy/access_vectors | 2 ++ 2 files changed, 5 insertions(+) (limited to 'xen/xsm') diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fa0589a2d7..b1e2593378 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -727,6 +727,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_audit_p2m: return current_has_perm(d, SECCLASS_HVM, HVM__AUDIT_P2M); + case XEN_DOMCTL_set_max_evtchn: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_MAX_EVTCHN); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 5dfe13b016..1fbe241ef4 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -194,6 +194,8 @@ class domain2 setscheduler # XENMEM_claim_pages setclaim +# XEN_DOMCTL_set_max_evtchn + set_max_evtchn } # Similar to class domain, but primarily contains domctls related to HVM domains -- cgit v1.2.3