This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] RFC: virtual network access control

To: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Subject: Re: [Xen-devel] RFC: virtual network access control
From: Reiner Sailer <sailer@xxxxxxxxxx>
Date: Fri, 28 Jul 2006 12:30:50 -0400
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx, xense-devel@xxxxxxxxxxxxxxxxxxx, Bryan D Payne <bdpayne@xxxxxxxxxx>
Delivery-date: Fri, 28 Jul 2006 09:36:30 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <409ef10e77d37de5c12024a3cbf3ba7a@xxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

Keir Fraser <Keir.Fraser@xxxxxxxxxxxx> wrote on 07/28/2006 11:06:22 AM:

> On 28 Jul 2006, at 15:56, Reiner Sailer wrote:
> You mean tag a packet when it arrives from a source domain and then use
> that if/when it boomerangs back at you on a different virtual
> interface?

It is a one-liner to set the input device in the skb.

> In terms of cost, an extra hypercall per packet will have measurable
> cost, at least in CPU usage, for high-bandwidth network transfers.
>   -- Keir

You only make the decision once for the first packet exchanged between two interfaces. Afterwards you reuse this decision for this interface pair (local cache). You basically have the cost of looking up a decision locally.

Xen-devel mailing list