clang-9 and clang-10 BTF miscompilation

clang-9 and clang-10 BTF miscompilation

[Lorenz Bauer]

Hi Yonghong, Andrii,

Given the following C source:

typedef struct {
    unsigned char thing[36];
} foo_t;

struct {
    __uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
    __uint(key_size, sizeof(unsigned int));
    __uint(max_entries, 1);
    __array(
        values, struct {
            __uint(type, BPF_MAP_TYPE_HASH);
            __uint(max_entries, 1);
            __type(key, unsigned int);
            __type(value, foo_t);
        });
} btf_map __section(".maps");

__section("socket") int filter() {
    unsigned int key = 0;
    void *value      = bpf_map_lookup_elem(&btf_map, (void *)&key);
    if (value)
        return *(int *)value;
    return 0;
}

I get this BTF from clang-9 and clang-10:

[1] STRUCT '(anon)' size=24 vlen=4
    'type' type_id=2 bits_offset=0
    'key_size' type_id=6 bits_offset=64
    'max_entries' type_id=8 bits_offset=128
    'values' type_id=16 bits_offset=192
[2] PTR '(anon)' type_id=4
[3] INT 'int' size=4 bits_offset=0 nr_bits=32 encoding=SIGNED
[4] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=12
[5] INT '__ARRAY_SIZE_TYPE__' size=4 bits_offset=0 nr_bits=32 encoding=(none)
[6] PTR '(anon)' type_id=7
[7] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=4
[8] PTR '(anon)' type_id=9
[9] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=1
[10] PTR '(anon)' type_id=11
[11] STRUCT '(anon)' size=32 vlen=4
    'type' type_id=8 bits_offset=0
    'max_entries' type_id=8 bits_offset=64
    'key' type_id=12 bits_offset=128
    'value' type_id=14 bits_offset=192
[12] PTR '(anon)' type_id=13
[13] INT 'unsigned int' size=4 bits_offset=0 nr_bits=32 encoding=(none)
[14] PTR '(anon)' type_id=15
[15] TYPEDEF 'foo_t' type_id=1
[16] ARRAY '(anon)' type_id=10 index_type_id=5 nr_elems=0
[17] VAR 'btf_map' type_id=1, linkage=global-alloc
[18] FUNC_PROTO '(anon)' ret_type_id=3 vlen=0
[19] FUNC 'filter' type_id=18
[20] INT 'char' size=1 bits_offset=0 nr_bits=8 encoding=SIGNED
[21] ARRAY '(anon)' type_id=20 index_type_id=5 nr_elems=4
[22] VAR '__license' type_id=21, linkage=global-alloc
[23] DATASEC '.maps' size=0 vlen=1
    type_id=17 offset=0 size=24
[24] DATASEC 'license' size=0 vlen=1
    type_id=22 offset=0 size=4

Note that [15] TYPEDEF 'foo_t' type_id=1 resolves to type 1, which is a
BTF map definition. Clang-11 seems to fix this, so maybe you are already aware.

Best
Lorenz

-- 
Lorenz Bauer  |  Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK

www.cloudflare.com

Re: clang-9 and clang-10 BTF miscompilation

[Yonghong Song]

On 3/11/21 3:23 AM, Lorenz Bauer wrote:
> Hi Yonghong, Andrii,
> 
> Given the following C source:
> 
> typedef struct {
>      unsigned char thing[36];
> } foo_t;
> 
> struct {
>      __uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
>      __uint(key_size, sizeof(unsigned int));
>      __uint(max_entries, 1);
>      __array(
>          values, struct {
>              __uint(type, BPF_MAP_TYPE_HASH);
>              __uint(max_entries, 1);
>              __type(key, unsigned int);
>              __type(value, foo_t);
>          });
> } btf_map __section(".maps");
> 
> __section("socket") int filter() {
>      unsigned int key = 0;
>      void *value      = bpf_map_lookup_elem(&btf_map, (void *)&key);
>      if (value)
>          return *(int *)value;
>      return 0;
> }
> 
> I get this BTF from clang-9 and clang-10:
> 
> [1] STRUCT '(anon)' size=24 vlen=4
>      'type' type_id=2 bits_offset=0
>      'key_size' type_id=6 bits_offset=64
>      'max_entries' type_id=8 bits_offset=128
>      'values' type_id=16 bits_offset=192
> [2] PTR '(anon)' type_id=4
> [3] INT 'int' size=4 bits_offset=0 nr_bits=32 encoding=SIGNED
> [4] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=12
> [5] INT '__ARRAY_SIZE_TYPE__' size=4 bits_offset=0 nr_bits=32 encoding=(none)
> [6] PTR '(anon)' type_id=7
> [7] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=4
> [8] PTR '(anon)' type_id=9
> [9] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=1
> [10] PTR '(anon)' type_id=11
> [11] STRUCT '(anon)' size=32 vlen=4
>      'type' type_id=8 bits_offset=0
>      'max_entries' type_id=8 bits_offset=64
>      'key' type_id=12 bits_offset=128
>      'value' type_id=14 bits_offset=192
> [12] PTR '(anon)' type_id=13
> [13] INT 'unsigned int' size=4 bits_offset=0 nr_bits=32 encoding=(none)
> [14] PTR '(anon)' type_id=15
> [15] TYPEDEF 'foo_t' type_id=1

The type does not match with code. foo_t here points a map definition
but the code foo_t is used as a value type.

But anyway, I think you mean map definition type is typedef.
Yes, this is fixed in llvm11 by this patch
https://reviews.llvm.org/D83638.


> [16] ARRAY '(anon)' type_id=10 index_type_id=5 nr_elems=0
> [17] VAR 'btf_map' type_id=1, linkage=global-alloc
> [18] FUNC_PROTO '(anon)' ret_type_id=3 vlen=0
> [19] FUNC 'filter' type_id=18
> [20] INT 'char' size=1 bits_offset=0 nr_bits=8 encoding=SIGNED
> [21] ARRAY '(anon)' type_id=20 index_type_id=5 nr_elems=4
> [22] VAR '__license' type_id=21, linkage=global-alloc
> [23] DATASEC '.maps' size=0 vlen=1
>      type_id=17 offset=0 size=24
> [24] DATASEC 'license' size=0 vlen=1
>      type_id=22 offset=0 size=4
> 
> Note that [15] TYPEDEF 'foo_t' type_id=1 resolves to type 1, which is a
> BTF map definition. Clang-11 seems to fix this, so maybe you are already aware.
> 
> Best
> Lorenz
>