Make the NC2 rate limiter optional. Turning it off is unsafe, because

it opens up denial-of-service attacks, but can help performance when
everyone is trusted.

diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 0b875f03fb3c3e51064291ab44114da87494b2d5..cdf34a048e27e8182e46fe8e721c28346b8c1364 100644 (file)
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -234,6 +234,11 @@ config XEN_NETDEV2_FRONTEND
        depends on XEN_NETCHANNEL2
        default y
 
+config XEN_NETDEV2_RATELIMITER
+       bool "Net channel 2 rate limiter"
+       depends on XEN_NETCHANNEL2
+       default y
+
 config XEN_NETDEV2_VMQ
        bool "Net channel 2 support for multi-queue devices"
        depends on XEN_NETDEV2_BACKEND

diff --git a/drivers/xen/netchannel2/Makefile b/drivers/xen/netchannel2/Makefile
index 69d510282d893f7a6396f874a4f425b196a16914..79a55802ff758176f1e60013145f226b00ce84a0 100644 (file)
--- a/drivers/xen/netchannel2/Makefile
+++ b/drivers/xen/netchannel2/Makefile
@@ -3,9 +3,13 @@ sinclude $(M)/overrides.mk
 obj-$(CONFIG_XEN_NETCHANNEL2) += netchannel2.o
 
 netchannel2-objs := chan.o netchan2.o rscb.o util.o \
-       posted_buffers.o limiter.o xmit_packet.o offload.o recv_packet.o \
+       posted_buffers.o xmit_packet.o offload.o recv_packet.o \
        poll.o
 
+ifeq ($(CONFIG_XEN_NETDEV2_RATELIMITER),y)
+netchannel2-objs += limiter.o
+endif
+
 ifeq ($(CONFIG_XEN_NETDEV2_BYPASSABLE),y)
 netchannel2-objs += bypassee.o
 endif

diff --git a/drivers/xen/netchannel2/netchannel2_core.h b/drivers/xen/netchannel2/netchannel2_core.h
index 4a6fd36d452e578bf173e4777a83b965d3933695..c8903295af536b5f62b4a6bce11152d8fec2130d 100644 (file)
--- a/drivers/xen/netchannel2/netchannel2_core.h
+++ b/drivers/xen/netchannel2/netchannel2_core.h
@@ -138,6 +138,7 @@ static inline struct skb_cb_overlay *get_skb_overlay(struct sk_buff *skb)
 }
 
 
+#ifdef CONFIG_XEN_NETDEV2_RATELIMITER
 struct nc2_rate_limiter {
         unsigned max_tokens;
         unsigned tokens_per_tick_ord;
@@ -165,6 +166,33 @@ void nc2_rate_limiter_credit(struct nc2_rate_limiter *nrl,
                              unsigned nr_tokens);
 int nc2_rate_limiter_debit(struct nc2_rate_limiter *nrl,
                            unsigned nr_tokens);
+#else
+struct nc2_rate_limiter {
+};
+
+static inline void nc2_init_rate_limiter(struct nc2_rate_limiter *nrl,
+                           unsigned tokens_per_tick_ord,
+                           unsigned max_tokens,
+                           unsigned fill_granularity_tokens,
+                           void (*stop)(void *),
+                           void (*start)(void *),
+                           void *ctxt)
+{
+}
+static inline void nc2_cleanup_rate_limiter(struct nc2_rate_limiter *nrl)
+{
+}
+static inline void nc2_rate_limiter_credit(struct nc2_rate_limiter *nrl,
+                                           unsigned nr_tokens)
+{
+}
+static inline int nc2_rate_limiter_debit(struct nc2_rate_limiter *nrl,
+                                         unsigned nr_tokens)
+{
+        return 1;
+}
+#endif
+
 
 struct nc2_alternate_ring;