Re: [Xen-devel] RFC: virtual network access control

[Reiner Sailer <sailer@xxxxxxxxxx>]

Keir Fraser <Keir.Fraser@xxxxxxxxxxxx> wrote
on 07/28/2006 11:06:22 AM:

> 
> On 28 Jul 2006, at 15:56, Reiner Sailer wrote:
> 
> 
> You mean tag a packet when it arrives from a source domain and then
use 
> that if/when it boomerangs back at you on a different virtual 
> interface?

It is a one-liner to set the input device in the skb.


> In terms of cost, an extra hypercall per packet will have measurable
> cost, at least in CPU usage, for high-bandwidth network transfers.
> 
>   -- Keir
> 

You only make the decision once for the first packet
exchanged between two interfaces. Afterwards you reuse this decision for
this interface pair (local cache). You basically have the cost of looking
up a decision locally.

Reiner
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel