[RFC PATCH V4 17/18] Only allow extended event channel on Dom0 and driver domains

[Wei Liu <wei.liu2@citrix.com>]

For non-Dom0 domains, add a flag to indicate whether it can use any extended
event channel ABIs. Admins can specify this flag when creating a driver
domain.

The rationale behind this option is, extended event channel ABIs will consume
global mapping space in Xen, Admin should have control over these features.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
 xen/common/domain.c         |    3 +++
 xen/common/domctl.c         |    6 +++++-
 xen/common/event_channel.c  |    9 ++++++++-
 xen/include/public/domctl.h |    3 +++
 xen/include/xen/sched.h     |    5 +++++
 5 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/xen/common/domain.c b/xen/common/domain.c
index b360de1..f648601 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -250,6 +250,9 @@ struct domain *domain_create(
     if ( domcr_flags & DOMCRF_dummy )
         return d;
 
+    if ( domcr_flags & DOMCRF_evtchn_extended_allowed )
+        d->evtchn_extended_allowed = 1;
+
     if ( !is_idle_domain(d) )
     {
         if ( (err = xsm_domain_create(XSM_HOOK, d, ssidref)) != 0 )
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index b7f6619..bb15da4 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -369,7 +369,8 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
         if ( supervisor_mode_kernel ||
              (op->u.createdomain.flags &
              ~(XEN_DOMCTL_CDF_hvm_guest | XEN_DOMCTL_CDF_hap |
-               XEN_DOMCTL_CDF_s3_integrity | XEN_DOMCTL_CDF_oos_off)) )
+               XEN_DOMCTL_CDF_s3_integrity | XEN_DOMCTL_CDF_oos_off |
+               XEN_DOMCTL_CDF_evtchn_extended_allowed)) )
             break;
 
         dom = op->domain;
@@ -405,6 +406,9 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
             domcr_flags |= DOMCRF_s3_integrity;
         if ( op->u.createdomain.flags & XEN_DOMCTL_CDF_oos_off )
             domcr_flags |= DOMCRF_oos_off;
+        if ( op->u.createdomain.flags & XEN_DOMCTL_CDF_evtchn_extended_allowed )
+            domcr_flags |= DOMCRF_evtchn_extended_allowed;
+
 
         d = domain_create(dom, domcr_flags, op->u.createdomain.ssidref);
         if ( IS_ERR(d) )
diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index 504d769..a49fe3b 100644
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -1409,7 +1409,11 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 
     case EVTCHNOP_query_extended_abis: {
         struct evtchn_query_extended_abis query;
-        query.abis = extended_event_channel;
+        struct domain *d = current->domain;
+        if ( d->domain_id == 0 || d->evtchn_extended_allowed )
+            query.abis = extended_event_channel;
+        else
+            query.abis = 0;
         rc = 0;
         if ( __copy_to_guest(arg, &query, 1) )
             rc = -EFAULT;
@@ -1418,6 +1422,9 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 
     case EVTCHNOP_register_3level: {
         struct evtchn_register_3level reg;
+        struct domain *d = current->domain;
+        if ( d->domain_id != 0 && !d->evtchn_extended_allowed )
+            return -EPERM;
         if ( copy_from_guest(&reg, arg, 1) != 0 )
             return -EFAULT;
         rc = evtchn_register_3level(&reg);
diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
index deb19db..40e9486 100644
--- a/xen/include/public/domctl.h
+++ b/xen/include/public/domctl.h
@@ -59,6 +59,9 @@ struct xen_domctl_createdomain {
  /* Disable out-of-sync shadow page tables? */
 #define _XEN_DOMCTL_CDF_oos_off       3
 #define XEN_DOMCTL_CDF_oos_off        (1U<<_XEN_DOMCTL_CDF_oos_off)
+ /* Can this domain use any extended event channel ABIs? */
+#define _XEN_DOMCTL_CDF_evtchn_extended_allowed 4
+#define XEN_DOMCTL_CDF_evtchn_extended_allowed  (1U<<_XEN_DOMCTL_CDF_evtchn_extended_allowed)
     uint32_t flags;
 };
 typedef struct xen_domctl_createdomain xen_domctl_createdomain_t;
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index cca5e7f..b190fd0 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -256,6 +256,8 @@ struct domain
     bool_t           is_paused_by_controller;
     /* Domain's VCPUs are pinned 1:1 to physical CPUs? */
     bool_t           is_pinned;
+    /* Can this domain use any extended event channel ABIs? */
+    bool_t           evtchn_extended_allowed;
 
     /* Are any VCPUs polling event channels (SCHEDOP_poll)? */
 #if MAX_VIRT_CPUS <= BITS_PER_LONG
@@ -411,6 +413,9 @@ struct domain *domain_create(
  /* DOMCRF_oos_off: dont use out-of-sync optimization for shadow page tables */
 #define _DOMCRF_oos_off         4
 #define DOMCRF_oos_off          (1U<<_DOMCRF_oos_off)
+/* DOMCRF_evtchn_extended_allowed: this domain can use extended evtchn ABIs */
+#define _DOMCRF_evtchn_extended_allowed 5
+#define DOMCRF_evtchn_extended_allowed  (1U<<_DOMCRF_evtchn_extended_allowed)
 
 /*
  * rcu_lock_domain_by_id() is more efficient than get_domain_by_id().
-- 
1.7.10.4