On Fri, Sep 13, 2024 at 8:03 AM Yonghong Song <yonghong.song@xxxxxxxxx> wrote: > > + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | > + BPF_OP(BPF_ADD) | BPF_K, BPF_REG_AX, > + 0, 0, 1), > + BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | > + BPF_JGT | BPF_K, BPF_REG_AX, > + 0, 4, 1), > + BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | > + BPF_JEQ | BPF_K, BPF_REG_AX, > + 0, 1, 0), > + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | > + BPF_OP(BPF_MOV) | BPF_K, insn->dst_reg, > + 0, 0, 0), > + /* BPF_NEG(LLONG_MIN) == -LLONG_MIN == LLONG_MIN */ > + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | > + BPF_OP(BPF_NEG) | BPF_K, insn->dst_reg, lgtm, but all of BPF_OP(..) are confusing. What's the point? We use BPF_OP(insn->code) to reuse the code when we create a new opcode, but BPF_OP(BPF_NEG) == BPF_NEG and BPF_OP(BPF_MOV) == BPF_MOV, so why? If I'm not missing anything I can remove these BPF_OP wrapping when applying. wdyt?