From: Daniel De Graaf <dgdegra@tycho.nsa.gov>
To: David Vrabel <david.vrabel@citrix.com>
Cc: David Vrabel <dvrabel@cantab.net>, Keir Fraser <keir@xen.org>,
Jan Beulich <jbeulich@suse.com>,
xen-devel@lists.xen.org
Subject: Re: [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use
Date: Fri, 27 Sep 2013 10:29:00 -0400 [thread overview]
Message-ID: <5245962C.7050304@tycho.nsa.gov> (raw)
In-Reply-To: <1380279359-28817-10-git-send-email-david.vrabel@citrix.com>
On 09/27/2013 06:55 AM, David Vrabel wrote:
> From: David Vrabel <dvrabel@cantab.net>
>
> Add XEN_DOMCTL_set_max_evtchn which may be used during domain creation to
> set the maximum event channel port a domain may use. This may be used to
> limit the amount of Xen resources (global mapping space and xenheap) that
> a domain may use for event channels.
>
> A domain that does not have a limit set may use all the event channels
> supported by the event channel ABI in use.
>
> Signed-off-by: David Vrabel <david.vrabel@citrix.com>
> Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
> ---
[...]
> diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
> index 5dfe13b..03a8e64 100644
> --- a/xen/xsm/flask/policy/access_vectors
> +++ b/xen/xsm/flask/policy/access_vectors
> @@ -157,6 +157,8 @@ class domain
> set_misc_info
> # XEN_DOMCTL_set_virq_handler
> set_virq_handler
> +# XEN_DOMCTL_set_max_evtchn
> + set_max_evtchn
> }
>
> # This is a continuation of class domain, since only 32 permissions can be
> # defined per class
> class domain2
The new domctl access vector must be added to the "domain2" class, not
"domain" which is full (already has 32 items). While the hypervisor
compilation does not currently report this as an error, attempting to
compile the policy (tools/flask/policy) will report it.
--
Daniel De Graaf
National Security Agency
next prev parent reply other threads:[~2013-09-27 14:29 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-27 10:55 [PATCHv4 0/11] Xen: FIFO-based event channel ABI David Vrabel
2013-09-27 10:55 ` [PATCH 01/11] debug: remove some event channel info from the 'i' and 'q' debug keys David Vrabel
2013-09-27 10:55 ` [PATCH 02/11] evtchn: refactor low-level event channel port ops David Vrabel
2013-09-27 10:55 ` [PATCH 03/11] evtchn: print ABI specific state with the 'e' debug key David Vrabel
2013-09-27 10:55 ` [PATCH 04/11] evtchn: use a per-domain variable for the max number of event channels David Vrabel
2013-09-27 10:55 ` [PATCH 05/11] evtchn: allow many more evtchn objects to be allocated per domain David Vrabel
2013-09-27 10:55 ` [PATCH 06/11] evtchn: add FIFO-based event channel ABI David Vrabel
2013-09-27 10:55 ` [PATCH 07/11] evtchn: implement EVTCHNOP_set_priority and add the set_priority hook David Vrabel
2013-09-27 10:55 ` [PATCH 08/11] evtchn: add FIFO-based event channel hypercalls and port ops David Vrabel
2013-09-27 12:34 ` Jan Beulich
2013-09-27 10:55 ` [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use David Vrabel
2013-09-27 12:40 ` Jan Beulich
2013-09-27 14:29 ` Daniel De Graaf [this message]
2013-09-27 10:55 ` [PATCH 10/11] libxc: add xc_domain_set_max_evtchn() David Vrabel
2013-10-01 12:30 ` Ian Campbell
2013-09-27 10:55 ` [PATCH 11/11] libxl, xl: add event_channels option to xl configuration file David Vrabel
2013-10-01 12:36 ` Ian Campbell
2013-10-01 12:53 ` David Vrabel
2013-09-27 12:41 ` [PATCHv4 0/11] Xen: FIFO-based event channel ABI Jan Beulich
2013-09-30 18:41 ` Konrad Rzeszutek Wilk
2013-10-01 10:25 ` Jan Beulich
2013-10-01 14:22 ` Konrad Rzeszutek Wilk
2013-10-01 14:41 ` Jan Beulich
-- strict thread matches above, loose matches on Subject: below --
2013-10-02 16:35 [PATCHv5 " David Vrabel
2013-10-02 16:35 ` [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use David Vrabel
2013-10-02 17:06 ` David Vrabel
2013-10-04 11:56 ` David Vrabel
2013-10-04 16:02 ` Jan Beulich
2013-10-07 16:00 ` Daniel De Graaf
2013-10-08 12:40 [PATCHv6 00/11] Xen: FIFO-based event channel ABI David Vrabel
2013-10-08 12:40 ` [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use David Vrabel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5245962C.7050304@tycho.nsa.gov \
--to=dgdegra@tycho.nsa.gov \
--cc=david.vrabel@citrix.com \
--cc=dvrabel@cantab.net \
--cc=jbeulich@suse.com \
--cc=keir@xen.org \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).