Core: Rank ctx fields and map values by their declared types

Two descriptors were built from the physical value instead of the
declaration. A sub-register vmlinux field is widened to i64 by
load_ctx_field, and its descriptor took that width, so ctx.data - k with
a c_int32 k was a 64-bit subtraction where C makes it a u32 one. A
map-lookup local dereferenced past its slot took the physical pointee
(i64, signed by default) and dropped the map's declared value ctype kept
in the symbol's metadata, so p >> 63 on a c_uint64 value was an ashr.
Both now read the declaration; the physical width still comes from the
value, as everywhere else.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: r41k0u

pythonbpf/expr/expr_pass.py

@@ -6,6 +6,7 @@
 
 from pythonbpf.type_deducer import (
     ctypes_to_ir,
+    field_int_type,
     is_ctypes,
     IntTy,
     int_literal_type,
@@ -200,6 +201,11 @@ def _descriptor(val, ty):
     value is not an integer at all."""
     if isinstance(ty, ir.IntType):
         return IntTy(ty.width, signedness(ty))
+    field = field_int_type(ty)
+    if field is not None:
+        # A vmlinux field: load_ctx_field already widened the value, but C
+        # ranks it by its declared width (a c_uint32 field is unsigned int).
+        return field
     if val is not None and isinstance(val.type, ir.IntType):
         return IntTy(val.type.width, signedness(ty))
     return None
@@ -214,12 +220,21 @@ def get_typed_operand(func, compilation_context, operand, builder, local_sym_tab
             sym = local_sym_tab[operand.id]
             var = sym.var
             base_type, depth = get_base_type_and_depth(var.type)
-            val = (
-                builder.load(var)
-                if depth == 1
-                else deref_to_depth(func, builder, var, depth)
+            if depth == 1:
+                val = builder.load(var)
+                return val, _descriptor(val, sym.ir_type)
+            val = deref_to_depth(func, builder, var, depth)
+            # A map-lookup local: the slot points at the value, and the map's
+            # declared value ctype is the symbol's metadata. That, not the
+            # physical pointee, carries the sign (a c_uint64 value is unsigned).
+            declared = (
+                ctypes_to_ir(sym.metadata)
+                if isinstance(sym.metadata, str) and is_ctypes(sym.metadata)
+                else None
+            )
+            return val, _descriptor(
+                val, declared if declared is not None else base_type
             )
-            return val, _descriptor(val, sym.ir_type if depth == 1 else base_type)
         elif operand.id in compilation_context.bpf_globals:
             sym = compilation_context.bpf_globals[operand.id]
             return builder.load(sym.var), _descriptor(None, sym.ir_type)

pythonbpf/type_deducer.py

@@ -49,18 +49,24 @@ def int_literal_type(value: int) -> IntTy:
     return IntTy(32, True) if -(1 << 31) <= value < (1 << 31) else IntTy(64, True)
 
 
+def field_int_type(ty) -> "IntTy | None":
+    """The declared integer type behind a vmlinux Field descriptor (its ctypes
+    class), or None if the descriptor is not a Field with an integer ctype.
+    The loaded value may already be wider; C ranks it by the declared width."""
+    ctype = getattr(getattr(ty, "type", None), "__name__", None)
+    if ctype in _INT_CTYPE_WIDTHS:
+        return IntTy(_INT_CTYPE_WIDTHS[ctype], is_signed_ctype(ctype))
+    return None
+
+
 def signedness(ty) -> bool:
-    """Sign of a descriptor: an IntTy says; a vmlinux Field says through its
-    ctype; a 1-bit integer is a bool and never negative, whatever it is
-    wrapped in; anything else is signed, the pre-signedness default."""
+    """Sign of a descriptor. An IntTy carries it directly; a vmlinux Field
+    carries a ctypes class in .type, whose name decides; a 1-bit integer is a
+    bool and never negative, whatever it is wrapped in; a plain ir.IntType, a
+    site not yet taught to carry a sign, reads as signed, the compiler's
+    historical behaviour."""
     if isinstance(ty, ir.IntType) and ty.width == 1:
         return False
-    """Sign of an integer type descriptor.
-
-    IntTy carries it directly. A vmlinux Field carries a ctypes class in .type,
-    whose name decides. A plain ir.IntType -- a site that has not been taught to
-    carry a sign yet -- reads as signed, the compiler's historical behaviour.
-    """
     if hasattr(ty, "signed"):
         return ty.signed
     ctype = getattr(getattr(ty, "type", None), "__name__", None)