Re: clang-9 and clang-10 BTF miscompilation

[Yonghong Song <yhs@xxxxxx>]

On 3/11/21 3:23 AM, Lorenz Bauer wrote:
> Hi Yonghong, Andrii,
>
> Given the following C source:
>
> typedef struct {
>      unsigned char thing[36];
> } foo_t;
>
> struct {
>      __uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
>      __uint(key_size, sizeof(unsigned int));
>      __uint(max_entries, 1);
>      __array(
>          values, struct {
>              __uint(type, BPF_MAP_TYPE_HASH);
>              __uint(max_entries, 1);
>              __type(key, unsigned int);
>              __type(value, foo_t);
>          });
> } btf_map __section(".maps");
>
> __section("socket") int filter() {
>      unsigned int key = 0;
>      void *value      = bpf_map_lookup_elem(&btf_map, (void *)&key);
>      if (value)
>          return *(int *)value;
>      return 0;
> }
>
> I get this BTF from clang-9 and clang-10:
>
> [1] STRUCT '(anon)' size=24 vlen=4
>      'type' type_id=2 bits_offset=0
>      'key_size' type_id=6 bits_offset=64
>      'max_entries' type_id=8 bits_offset=128
>      'values' type_id=16 bits_offset=192
> [2] PTR '(anon)' type_id=4
> [3] INT 'int' size=4 bits_offset=0 nr_bits=32 encoding=SIGNED
> [4] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=12
> [5] INT '__ARRAY_SIZE_TYPE__' size=4 bits_offset=0 nr_bits=32 encoding=(none)
> [6] PTR '(anon)' type_id=7
> [7] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=4
> [8] PTR '(anon)' type_id=9
> [9] ARRAY '(anon)' type_id=3 index_type_id=5 nr_elems=1
> [10] PTR '(anon)' type_id=11
> [11] STRUCT '(anon)' size=32 vlen=4
>      'type' type_id=8 bits_offset=0
>      'max_entries' type_id=8 bits_offset=64
>      'key' type_id=12 bits_offset=128
>      'value' type_id=14 bits_offset=192
> [12] PTR '(anon)' type_id=13
> [13] INT 'unsigned int' size=4 bits_offset=0 nr_bits=32 encoding=(none)
> [14] PTR '(anon)' type_id=15
> [15] TYPEDEF 'foo_t' type_id=1

The type does not match with code. foo_t here points a map definition
but the code foo_t is used as a value type.

But anyway, I think you mean map definition type is typedef.
Yes, this is fixed in llvm11 by this patch
https://reviews.llvm.org/D83638.


> [16] ARRAY '(anon)' type_id=10 index_type_id=5 nr_elems=0
> [17] VAR 'btf_map' type_id=1, linkage=global-alloc
> [18] FUNC_PROTO '(anon)' ret_type_id=3 vlen=0
> [19] FUNC 'filter' type_id=18
> [20] INT 'char' size=1 bits_offset=0 nr_bits=8 encoding=SIGNED
> [21] ARRAY '(anon)' type_id=20 index_type_id=5 nr_elems=4
> [22] VAR '__license' type_id=21, linkage=global-alloc
> [23] DATASEC '.maps' size=0 vlen=1
>      type_id=17 offset=0 size=24
> [24] DATASEC 'license' size=0 vlen=1
>      type_id=22 offset=0 size=4
>
> Note that [15] TYPEDEF 'foo_t' type_id=1 resolves to type 1, which is a
> BTF map definition. Clang-11 seems to fix this, so maybe you are already aware.
>
> Best
> Lorenz