Core: Access narrow map values at their own width

A lookup local was always an i64*, whatever the map's value type, so a
c_uint32 value was read with an 8-byte load (the verifier rejects an
access past value_size) and its spare `v_tmp` slot, typed i32, could not
take the i64 a rebind stored into it. The local now points at the
value's own width for an integer value (a struct value keeps the generic
pointer; field access casts it), and the generic pointer the lookup
helper returns is cast to it on assignment.

The sites that read the local by its pointer type follow:
- A comparison reads it as get_typed_operand does, at its width and
  with the map's declared sign, so `u == 3` on a c_uint32 value is a
  zext and an unsigned compare where needed (on c_uint64 values it was a
  signed compare before).
- print() takes the format from the declared value type and widens by
  its sign: a c_uint8 value was about to print as a string (%s on i8*),
  and integers narrower than 32 bits now print as %d, promoted as C
  varargs are.
- A rebind converts the i64 result to the slot's width.

holds_map_int_value names the predicate those sites share.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: varun-r-mallya

pythonbpf/allocation_pass.py

@@ -228,8 +228,14 @@ def _allocate_for_map_method(
         _allocate_for_map_method_fallback(builder, var_name, local_sym_tab)
         return
 
-    # Main variable (pointer to pointer)
-    ir_type = ir.PointerType(ir.IntType(64))
+    # Main variable (pointer to pointer). An integer value is pointed at with
+    # its own width, so that reads and writes through it are value-sized: the
+    # verifier rejects an 8-byte access to a 4-byte map value. A struct value
+    # keeps the generic i64*; field access casts it to the struct type.
+    if isinstance(value_ir_type, ir.IntType):
+        ir_type = ir.PointerType(ir.IntType(value_ir_type.width))
+    else:
+        ir_type = ir.PointerType(ir.IntType(64))
     var = builder.alloca(ir_type, name=var_name)
     local_sym_tab[var_name] = LocalSymbol(var, ir_type, value_type)
     # Temporary variable for computed values

pythonbpf/assign_pass.py

@@ -226,15 +226,24 @@ def handle_variable_assignment(
             logger.info(
                 f"Creating temporary variable for pointer assignment to {var_name}"
             )
-            var_ptr_tmp = local_sym_tab[f"{var_name}_tmp"].var
-            builder.store(val, var_ptr_tmp)
-            val = var_ptr_tmp
+            tmp = local_sym_tab[f"{var_name}_tmp"]
+            # The spare slot has the map value's width; expressions are i64.
+            builder.store(convert(builder, val, val_type, tmp.ir_type), tmp.var)
+            val = tmp.var
         else:
             logger.error(
                 f"Type mismatch for variable {var_name}: {val_type} vs {var_type}"
             )
             return False
 
+    if (
+        isinstance(val.type, ir.PointerType)
+        and isinstance(var_type, ir.PointerType)
+        and val.type != var_type
+    ):
+        # A map lookup returns a generic pointer; the local is typed by the
+        # map's value, so the pointer is cast to it (no instruction in BPF).
+        val = builder.bitcast(val, var_type)
     builder.store(val, var_ptr)
     logger.info(f"Assigned value to variable {var_name}")
     return True

pythonbpf/expr/__init__.py

@@ -1,4 +1,4 @@
-from .expr_pass import eval_expr, handle_expr, get_typed_operand
+from .expr_pass import eval_expr, handle_expr, get_typed_operand, holds_map_int_value
 from .type_normalization import (
     convert_to_bool,
     get_base_type_and_depth,
@@ -20,6 +20,7 @@
     "canonicalise",
     "to_promoted",
     "get_typed_operand",
+    "holds_map_int_value",
     "usual_arithmetic_conversions",
     "get_base_type_and_depth",
     "deref_to_depth",

pythonbpf/expr/expr_pass.py

@@ -382,25 +382,41 @@ def _handle_ctypes_call(
     return value, expected_type
 
 
+def holds_map_int_value(sym):
+    """Whether a local is a lookup result on a map with an integer value: a
+    pointer to the value, with the value's ctype as its metadata. Such a local
+    is used by value, read through the pointer (see get_typed_operand)."""
+    return (
+        isinstance(sym.ir_type, ir.PointerType)
+        and isinstance(sym.metadata, str)
+        and is_ctypes(sym.metadata)
+    )
+
+
+def _compare_operand(func, compilation_context, builder, operand, local_sym_tab):
+    """Evaluate one side of a comparison. A map-lookup local compares by its
+    value, read at the map value's width and typed by its declared ctype,
+    exactly as it is read as an arithmetic operand."""
+    if (
+        isinstance(operand, ast.Name)
+        and operand.id in local_sym_tab
+        and holds_map_int_value(local_sym_tab[operand.id])
+    ):
+        return get_typed_operand(
+            func, compilation_context, operand, builder, local_sym_tab
+        )
+    return eval_expr(func, compilation_context, builder, operand, local_sym_tab)
+
+
 def _handle_compare(func, compilation_context, builder, cond, local_sym_tab):
     """Handle ast.Compare expressions."""
 
     if len(cond.ops) != 1 or len(cond.comparators) != 1:
         logger.error("Only single comparisons are supported")
         return None
-    lhs = eval_expr(
-        func,
-        compilation_context,
-        builder,
-        cond.left,
-        local_sym_tab,
-    )
-    rhs = eval_expr(
-        func,
-        compilation_context,
-        builder,
-        cond.comparators[0],
-        local_sym_tab,
+    lhs = _compare_operand(func, compilation_context, builder, cond.left, local_sym_tab)
+    rhs = _compare_operand(
+        func, compilation_context, builder, cond.comparators[0], local_sym_tab
     )
 
     if lhs is None or rhs is None:

pythonbpf/helper/printk_formatter.py

@@ -2,7 +2,15 @@
 import logging
 
 from llvmlite import ir
-from pythonbpf.expr import eval_expr, get_base_type_and_depth, deref_to_depth, convert
+from pythonbpf.expr import (
+    eval_expr,
+    get_base_type_and_depth,
+    deref_to_depth,
+    convert,
+    get_typed_operand,
+    holds_map_int_value,
+)
+from pythonbpf.type_deducer import ctypes_to_ir
 from pythonbpf.expr.vmlinux_registry import VmlinuxHandlerRegistry
 from pythonbpf.helper.helper_utils import get_char_array_ptr_and_size
 
@@ -107,7 +115,13 @@ def _process_name_in_fval(
 ):
     """Process name nodes in formatted values."""
     if local_sym_tab and name_node.id in local_sym_tab:
-        _, var_type, tmp = local_sym_tab[name_node.id]
+        sym = local_sym_tab[name_node.id]
+        # A map-lookup local prints as its value, of the map's value type;
+        # its pointer type alone would make a c_uint8 value look like a string.
+        if holds_map_int_value(sym):
+            var_type = ctypes_to_ir(sym.metadata)
+        else:
+            var_type = sym.ir_type
         _populate_fval(var_type, name_node, fmt_parts, exprs)
     elif name_node.id in compilation_context.bpf_globals:
         var_type = compilation_context.bpf_globals[name_node.id].ir_type
@@ -159,7 +173,8 @@ def _populate_fval(ftype, node, fmt_parts, exprs):
         if ftype.width == 64:
             fmt_parts.append("%lld")
             exprs.append(node)
-        elif ftype.width == 32:
+        elif ftype.width <= 32:
+            # Narrower integers are promoted to int, as C varargs do.
             fmt_parts.append("%d")
             exprs.append(node)
         else:
@@ -229,6 +244,18 @@ def _prepare_expr_args(expr, func, compilation_context, builder, local_sym_tab):
         if char_array_ptr:
             return char_array_ptr
 
+    # A map-lookup local: its value, widened per the map's value type
+    if (
+        isinstance(expr, ast.Name)
+        and local_sym_tab
+        and expr.id in local_sym_tab
+        and holds_map_int_value(local_sym_tab[expr.id])
+    ):
+        val, ty = get_typed_operand(
+            func, compilation_context, expr, builder, local_sym_tab
+        )
+        return _handle_int_arg(val, builder, ty)
+
     # Regular expression evaluation
     val, _ = eval_expr(func, compilation_context, builder, expr, local_sym_tab)
 

tests/passing_tests/signedness/map_value_narrow.py

@@ -0,0 +1,56 @@
+# Map values narrower than 64 bits are read and written at their own width:
+# the verifier rejects an 8-byte access to a 4-byte value. Each value is then
+# widened per its declared sign -- zext for c_uint32 and c_uint8, sext for
+# c_int32 -- in arithmetic, comparisons and printing alike, and a c_uint8
+# value prints as a number, not as a string.
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from ctypes import c_void_p, c_int64, c_uint32, c_int32, c_uint8
+
+
+@bpf
+@map
+def u32s() -> HashMap:
+    return HashMap(key=c_uint32, value=c_uint32, max_entries=4)
+
+
+@bpf
+@map
+def i32s() -> HashMap:
+    return HashMap(key=c_uint32, value=c_int32, max_entries=4)
+
+
+@bpf
+@map
+def u8s() -> HashMap:
+    return HashMap(key=c_uint32, value=c_uint8, max_entries=4)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    k = c_uint32(0)
+    u = u32s.lookup(k)
+    i = i32s.lookup(k)
+    b = u8s.lookup(k)
+    if u:
+        if u == 3:
+            print(f"u {u}")
+        u32s.update(k, u + 1)
+    if i:
+        n = i - 1
+        print(f"i {i} n {n}")
+    if b:
+        print(f"b {b}")
+        b = b + 2
+        return b
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/test_signedness_ir.py

@@ -81,6 +81,19 @@
         [r"trunc i64 .* to i32", r"zext i32 .* to i64"],
         [r"sext i32 .* to i64"],
     ),
+    # A narrow map value is loaded at its width, widened per its sign, and
+    # never read with an 8-byte load; a c_uint8 value is printed by value.
+    "signedness/map_value_narrow.py": (
+        [
+            r"load i32, i32\* %\"deref",
+            r"load i8, i8\* %\"deref",
+            r"zext i32 %\"deref",
+            r"sext i32 %\"deref",
+            r"zext i8 %\"deref",
+            r"store i8 .*, i8\* %\"b_tmp\"",
+        ],
+        [r"load i64, i64\* %\"deref", r"i8\* %\"deref[^\"]*\"\)$"],
+    ),
     # `return p` on a map lookup dereferences through a null check and returns
     # the i64, never the pointer.
     "return/map_value.py": (