Core: Special-case packet-pointer context fields in arithmetic

xdp_md.data/data_end/data_meta and __sk_buff.data/data_end/data_meta are
u32 in C but packet pointers to the verifier, which rewrites their load
into a pointer load and prohibits 32-bit arithmetic on them. The
signedness rules ranked them as u32, so ctx.data - k lowered to a 32-bit
add (w0 += -1) and was rejected; C code avoids this with a cast through
(void *)(long).

A binary operation with a packet-pointer operand now bypasses the usual
arithmetic conversions: the pointer is used at 64 bits, an offset added
to or subtracted from it is taken as an unsigned 16-bit value (truncated,
zero-extended) because the verifier only tracks packet ranges up to
MAX_PACKET_OFF (0xffff), and the result is a 64-bit value. Pointer minus
pointer is an ordinary 64-bit length. A constant offset outside
0..65535, any other operator, and offset minus pointer are compile
errors rather than code the verifier would reject. Local inference
agrees (64-bit unsigned).

Only direct field reads are recognised; a local copied from one is an
integer again, and comparisons between packet pointers are the next site
of the same rule.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: r41k0u

pythonbpf/expr/expr_pass.py

@@ -24,6 +24,7 @@
     get_base_type_and_depth,
 )
 from .vmlinux_registry import VmlinuxHandlerRegistry
+from .packet_pointer import MAX_PACKET_OFF, is_packet_pointer
 from ..vmlinux_parser.dependency_node import Field
 
 logger: Logger = logging.getLogger(__name__)
@@ -284,12 +285,18 @@ def _handle_binary_op_impl(func, compilation_context, rval, builder, local_sym_t
     narrowed to it -- so u32 * u32 wraps at 32 bits even though the arithmetic
     itself runs in an i64 register. Returns (value, IntTy)."""
     op = rval.op
+    left_pkt = is_packet_pointer(rval.left, local_sym_tab)
+    right_pkt = is_packet_pointer(rval.right, local_sym_tab)
     left, left_ty = get_typed_operand(
         func, compilation_context, rval.left, builder, local_sym_tab
     )
     right, right_ty = get_typed_operand(
         func, compilation_context, rval.right, builder, local_sym_tab
     )
+    if left_pkt or right_pkt:
+        return _packet_pointer_binop(
+            builder, rval, left, left_ty, left_pkt, right, right_ty, right_pkt
+        )
     result_ty = usual_arithmetic_conversions(left_ty, right_ty)
     logger.info(
         f"binop {type(op).__name__}: {left_ty.describe()} x {right_ty.describe()} "
@@ -301,6 +308,51 @@ def _handle_binary_op_impl(func, compilation_context, rval, builder, local_sym_t
     return canonicalise(builder, result, result_ty), result_ty
 
 
+def _packet_pointer_binop(
+    builder, rval, left, left_ty, left_pkt, right, right_ty, right_pkt
+):
+    """A binary operation with a packet-pointer operand (see packet_pointer.py):
+    64-bit, never ranked as the field's declared u32, with the offset taken as
+    an unsigned 16-bit value so the verifier can track the packet range."""
+    op = rval.op
+    where = f"line {rval.lineno}: {ast.unparse(rval)}"
+    ptr_ty = IntTy(64, False)
+    if left_pkt and right_pkt:
+        if isinstance(op, ast.Sub):
+            # data_end - data: a length, an ordinary 64-bit scalar.
+            left = convert(builder, left, left_ty, ptr_ty)
+            right = convert(builder, right, right_ty, ptr_ty)
+            return builder.sub(left, right), ptr_ty
+        raise SyntaxError(
+            f"only subtraction is defined between packet pointers ({where})"
+        )
+    if not isinstance(op, (ast.Add, ast.Sub)):
+        raise SyntaxError(
+            f"only + and - with an offset are allowed on a packet pointer ({where})"
+        )
+    if right_pkt and isinstance(op, ast.Sub):
+        raise SyntaxError(f"cannot subtract a packet pointer from an offset ({where})")
+
+    ptr, ptr_src_ty, off, off_ty = (
+        (left, left_ty, right, right_ty)
+        if left_pkt
+        else (right, right_ty, left, left_ty)
+    )
+    if isinstance(off, ir.Constant) and isinstance(off.constant, int):
+        if not 0 <= off.constant <= MAX_PACKET_OFF:
+            raise SyntaxError(
+                f"packet offset {off.constant} is outside 0..{MAX_PACKET_OFF} "
+                f"({where}); subtract instead of adding a negative offset"
+            )
+    ptr = convert(builder, ptr, ptr_src_ty, ptr_ty)
+    # The offset as u16, widened with zero-extension: a value the verifier can
+    # bound to [0, 0xffff].
+    off = builder.trunc(off, ir.IntType(16)) if off.type.width > 16 else off
+    off = builder.zext(off, ir.IntType(64)) if off.type.width < 64 else off
+    result = builder.add(ptr, off) if isinstance(op, ast.Add) else builder.sub(ptr, off)
+    return result, ptr_ty
+
+
 def _handle_binary_op(
     func,
     compilation_context,

pythonbpf/expr/packet_pointer.py

@@ -0,0 +1,46 @@
+"""Packet-pointer context fields.
+
+A few context fields are declared u32 in C but are packet pointers to the
+verifier: it rewrites the context load into a 64-bit pointer load. C's
+integer rules (which rank them as u32) therefore produce code the verifier
+rejects ("32-bit pointer arithmetic prohibited"); C programs dodge that by
+casting through (void *)(long). The compiler special-cases them instead, so
+users never need the cast:
+
+- the field is used at 64 bits, as the pointer it is;
+- an offset added to or subtracted from it is taken as an unsigned 16-bit
+  value (truncated, then zero-extended), because the verifier only tracks a
+  packet range whose offset stays within MAX_PACKET_OFF (0xffff);
+- pointer - pointer (e.g. data_end - data) is an ordinary 64-bit length.
+
+Only direct field reads (`ctx.data`) are recognised so far; a local copied
+from one (`d = ctx.data`) is an ordinary integer again. Comparisons between
+packet pointers are the next site of the same rule.
+"""
+
+import ast
+
+# Context struct -> fields the verifier treats as packet pointers. Taken from
+# the verifier's is_valid_access callbacks, restricted to the fields that
+# vmlinux declares as 32-bit integers.
+PACKET_POINTER_FIELDS = {
+    "struct_xdp_md": {"data", "data_end", "data_meta"},
+    "struct___sk_buff": {"data", "data_end", "data_meta"},
+}
+
+MAX_PACKET_OFF = 0xFFFF
+
+
+def is_packet_pointer(expr, local_sym_tab) -> bool:
+    """True for `ctx.<field>` where ctx is a context parameter of one of the
+    structs above and the field is one of its packet-pointer fields."""
+    if not (isinstance(expr, ast.Attribute) and isinstance(expr.value, ast.Name)):
+        return False
+    sym = (local_sym_tab or {}).get(expr.value.id)
+    if sym is None:
+        return False
+    meta = sym.metadata
+    struct_name = meta if isinstance(meta, str) else getattr(meta, "__name__", None)
+    if not isinstance(struct_name, str):
+        return False
+    return expr.attr in PACKET_POINTER_FIELDS.get(struct_name, set())

pythonbpf/expr/type_inference.py

@@ -21,6 +21,7 @@
 )
 from .operators import usual_arithmetic_conversions
 from .vmlinux_registry import VmlinuxHandlerRegistry
+from .packet_pointer import is_packet_pointer
 
 
 def _as_intty(ty):
@@ -46,6 +47,10 @@ def infer_int_type(expr, local_sym_tab, compilation_context):
         return None
 
     if isinstance(expr, ast.BinOp):
+        if is_packet_pointer(expr.left, local_sym_tab) or is_packet_pointer(
+            expr.right, local_sym_tab
+        ):
+            return IntTy(64, False)  # packet-pointer arithmetic is 64-bit
         left = infer_int_type(expr.left, local_sym_tab, compilation_context)
         right = infer_int_type(expr.right, local_sym_tab, compilation_context)
         if left is None or right is None:

tests/failing_tests/vmlinux/ctx_data_arith.py

@@ -0,0 +1,21 @@
+# 70000 cannot be a packet offset: the verifier tracks packet ranges only
+# up to 0xffff. Rejected at compile time rather than silently wrapped.
+from ctypes import c_int64
+from pythonbpf import bpf, section, bpfglobal, compile
+from vmlinux import struct_xdp_md
+
+
+@bpf
+@section("xdp")
+def prog(ctx: struct_xdp_md) -> c_int64:
+    d = ctx.data + 70000
+    return c_int64(d)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/failing_tests/vmlinux/ctx_data_offset_too_big.py

@@ -0,0 +1,26 @@
+# xdp_md.data is declared u32, but the verifier treats it as a packet pointer
+# and prohibits 32-bit arithmetic on it. C's integer rules would rank
+# ctx.data - k as a u32 subtraction (w0 += -1, rejected with "R0 32-bit
+# pointer arithmetic prohibited"); the compiler special-cases packet-pointer
+# fields instead (pythonbpf/expr/packet_pointer.py): 64-bit arithmetic, the
+# offset taken as u16, so this is r0 += -1 and no cast is needed.
+from ctypes import c_int32, c_int64
+from pythonbpf import bpf, section, bpfglobal, compile
+from vmlinux import struct_xdp_md
+
+
+@bpf
+@section("xdp")
+def prog(ctx: struct_xdp_md) -> c_int64:
+    k = c_int32(1)
+    d = ctx.data - k
+    return c_int64(d)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/vmlinux/ctx_data_arith.py

@@ -0,0 +1,21 @@
+# Pointer minus pointer is a length: an ordinary 64-bit subtraction, with no
+# 16-bit clamp on either side.
+from ctypes import c_int64
+from pythonbpf import bpf, section, bpfglobal, compile
+from vmlinux import struct_xdp_md
+
+
+@bpf
+@section("xdp")
+def prog(ctx: struct_xdp_md) -> c_int64:
+    n = ctx.data_end - ctx.data
+    return c_int64(n)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/vmlinux/ctx_data_length.py

@@ -0,0 +1,21 @@
+# Adding a constant to a packet pointer is 64-bit pointer arithmetic
+# (r0 += 1), not the u32 addition C's integer rules would give xdp_md.data.
+from ctypes import c_int64
+from pythonbpf import bpf, section, bpfglobal, compile
+from vmlinux import struct_xdp_md
+
+
+@bpf
+@section("xdp")
+def prog(ctx: struct_xdp_md) -> c_int64:
+    d = ctx.data + 1
+    return c_int64(d)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/vmlinux/ctx_data_plus_one.py

@@ -0,0 +1,24 @@
+# A runtime offset added to a packet pointer is taken as an unsigned 16-bit
+# value (masked to 0xffff, zero-extended), so the verifier can bound the
+# packet range; the addition itself is 64-bit.
+from ctypes import c_int64
+from pythonbpf import bpf, section, bpfglobal, compile
+from pythonbpf.helper import random
+from vmlinux import struct_xdp_md
+
+
+@bpf
+@section("xdp")
+def prog(ctx: struct_xdp_md) -> c_int64:
+    off = random()
+    d = ctx.data + off
+    return c_int64(d)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/vmlinux/ctx_data_runtime_offset.py

@@ -61,6 +61,6 @@
 
 "failing_tests/loops/for_map_items.py" = {reason = "for/while loops not implemented: no sugar over bpf_for_each_map_elem()-style map iteration exists yet", level = "ir"}
 
-# 32-bit arithmetic on a packet-pointer context field. IR and llc succeed; the
-# verifier rejects it with "R0 32-bit pointer arithmetic prohibited".
-"failing_tests/vmlinux/ctx_data_arith.py" = {reason = "xdp_md.data is u32 in C but a packet pointer to the verifier; 32-bit arithmetic on it is prohibited until packet-pointer fields get 64-bit pointer rank", level = "verifier"}
+
+# A packet offset has to fit the verifier's 16-bit packet range.
+"failing_tests/vmlinux/ctx_data_offset_too_big.py" = {reason = "A constant packet offset outside 0..65535 is a compile error (the verifier tracks packet ranges up to MAX_PACKET_OFF)", level = "ir"}