>>is attached patch ok? >>(in order to reduce kernel stack usage for ipsec output path. >>ipv6 part isn't tested.) > i don't think your patch changes the situation. and the patch needs more cpu time for extra function call, and it uses more kernel stack for function call frame. itojun