On Fri, 14 Aug 2009 12:23:46 am Arnd Bergmann wrote: > On Thursday 13 August 2009, Michael S. Tsirkin wrote: > > The best way to do this IMO would be to add zero copy support to raw > > sockets, vhost will then get it basically for free. > > Yes, that would be nice. I wonder if that could lead to security > problems on TX though. I guess It will only bring significant performance > improvements if we leave the data writable in the user space or guest > during the operation. If the user finds the right timing, it could > modify the frame headers after they have been checked using netfilter, > or while the frames are being consumed in the kernel (e.g. an NFS > server running in a guest).
For this reason, we always linearize parts of packets we're filtering. ie. copy. Cheers, Rusty. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
