> >>Which is obviously wrong. So why do you want to keep that patch? > > Yes,I think you are right, we can revert that patch. I think we need PVEFW-SET-ACCEPT-MARK for groups, but could simple use RETURN inside tapXXXiY-OUT? Although I am not sure if we gain much speedup from that.