Subject: Re: [PATCH 6/6] net: move qdisc ingress filtering on top of netfilter ingress hooks

From: Daniel Borkmann <[email-masked]>
Date: Thu, 30 Apr 2015 02:10:33 +0200

On 04/30/2015 01:32 AM, Pablo Neira Ayuso wrote:
...
> Actually, the extra cost is roughly (getting inlined stuff away and
> other non-relevant stuff):
>
>      `-> nf_hook_slow()
>       `-> [for each entry in hook list]
>        `-> nf_iterate()
>         `-> (*elemp)->hook()

Yep, agreed.

> as part of the generic hook infrastructure, which comes with extra
> flexibility in return. I think the main concern so far was not to harm
> the critical netif_receive_core() path, and this patchset proves not
> to affect this.

Correct, as you use the static key and hide everything behind it.