On 03/02/2019 01:04 AM, Song Liu wrote: > On Fri, Mar 1, 2019 at 3:27 PM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote: >> On 03/02/2019 12:22 AM, Song Liu wrote: >>> On Fri, Mar 1, 2019 at 1:10 PM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote: [...] > > I see, so the *2 comes from > > BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7) Yes, exactly the place we need to test for here. > Thanks for the explanation. np Thanks, Daniel