Core: Carry signedness from every declaration and inference site

Sign now originates wherever a type is declared or inferred, and emitted IR
changes only where a value is widened out of a type now known to be unsigned:

- Helper return types are typed per the kernel signature: ktime_get_ns,
  get_current_pid_tgid, get_current_uid_gid, get_current_cgroup_id,
  get_prandom_u32 and get_smp_processor_id are unsigned; the probe_read
  family, perf_event_output and get_stack return long.
- Undeclared locals are 64-bit with the sign of their initializer -- from the
  helper registry for helper results, and for binary operations from a small
  static inference (expr/type_inference.py) applying the same usual arithmetic
  conversions the code generator will.
- Integer literals are typed as C types them (int if it fits, else long long)
  while remaining 64-bit constants; this rank is what makes u32 / -2 promote
  to an unsigned 32-bit division.
- signedness() understands vmlinux Field descriptors, and load_ctx_field
  sign-extends signed sub-64-bit context fields instead of always
  zero-extending them.
- printk widening goes through convert.

Two sites decided whether to emit a conversion from descriptor *equality*.
With literal descriptors now narrower than the constants that carry them, that
skipped required truncations (storing an i64 into an i32 slot). Assignment and
the ctypes cast handler now always run convert, which is a no-op when the
physical widths already agree.

Corpus: the following programs change, every changed line a sext->zext swap on
a value of known unsigned type:
  failing_tests/xdp/xdp_test_1.py.ll
  passing_tests/assign/augassign_struct_field.py.ll
  passing_tests/helpers/smp_processor_id.py.ll

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BSDVsZH5NtoASyxB8FCtGU

Author: r41k0u

pythonbpf/allocation_pass.py

@@ -6,7 +6,8 @@
 from pythonbpf.helper import HelperHandlerRegistry
 from pythonbpf.vmlinux_parser.dependency_node import Field
 from .expr import VmlinuxHandlerRegistry
-from pythonbpf.type_deducer import ctypes_to_ir
+from pythonbpf.type_deducer import ctypes_to_ir, IntTy, signedness
+from pythonbpf.expr.type_inference import infer_int_type
 from pythonbpf.maps import BPFMapType
 
 logger = logging.getLogger(__name__)
@@ -72,7 +73,9 @@ def handle_assign_allocation(compilation_context, builder, stmt, local_sym_tab):
         elif isinstance(rval, ast.Constant):
             _allocate_for_constant(builder, var_name, rval, local_sym_tab)
         elif isinstance(rval, ast.BinOp):
-            _allocate_for_binop(builder, var_name, local_sym_tab)
+            _allocate_for_binop(
+                builder, var_name, rval, local_sym_tab, compilation_context
+            )
         elif isinstance(rval, ast.Name):
             # Variable-to-variable assignment (b = a)
             _allocate_for_name(builder, var_name, rval, local_sym_tab)
@@ -104,7 +107,11 @@ def _allocate_for_call(builder, var_name, rval, local_sym_tab, compilation_conte
 
         # Helper functions
         elif HelperHandlerRegistry.has_handler(call_type):
-            ir_type = ir.IntType(64)  # Assume i64 return type
+            # Undeclared locals are 64-bit; the sign comes from the helper.
+            ret = HelperHandlerRegistry.get_return_type(call_type)
+            ir_type = IntTy(
+                64, signedness(ret) if isinstance(ret, ir.IntType) else True
+            )
             var = builder.alloca(ir_type, name=var_name)
             var.align = 8
             local_sym_tab[var_name] = LocalSymbol(var, ir_type)
@@ -270,9 +277,17 @@ def _allocate_for_constant(builder, var_name, rval, local_sym_tab):
         )
 
 
-def _allocate_for_binop(builder, var_name, local_sym_tab):
-    """Allocate memory for variable assigned from a binary operation."""
-    ir_type = ir.IntType(64)  # Assume i64 result
+def _allocate_for_binop(builder, var_name, rval, local_sym_tab, compilation_context):
+    """Allocate memory for variable assigned from a binary operation.
+
+    Undeclared locals are 64-bit; the sign is that of the expression's C type,
+    inferred statically. Falls back to signed when the expression involves
+    something the inference does not know.
+    """
+    inferred = infer_int_type(rval, local_sym_tab, compilation_context)
+    if inferred is None:
+        logger.debug(f"Could not infer a type for {var_name}, assuming signed i64")
+    ir_type = IntTy(64, signedness(inferred) if inferred is not None else True)
     var = builder.alloca(ir_type, name=var_name)
     var.align = 8
     local_sym_tab[var_name] = LocalSymbol(var, ir_type)

pythonbpf/assign_pass.py

@@ -151,7 +151,12 @@ def handle_variable_assignment(
         f"Evaluated value for {var_name}: {val} of type {val_type}, expected {var_type}"
     )
 
-    if val_type != var_type:
+    if isinstance(val_type, ir.IntType) and isinstance(var_type, ir.IntType):
+        # The descriptor may be narrower than the constant carrying the value
+        # (a literal is a 64-bit constant typed as C int), so never decide
+        # from descriptor equality: convert is a no-op when widths match.
+        val = convert(builder, val, val_type, var_type)
+    elif val_type != var_type:
         # Handle vmlinux struct pointers - they're represented as Python classes but are i64 pointers
         if isclass(val_type) and (val_type.__module__ == "vmlinux"):
             logger.info("Handling vmlinux struct pointer assignment")
@@ -216,8 +221,6 @@ def handle_variable_assignment(
                     f"Failed to assign ctype struct field to {var_name}: {val_type} != {var_type}"
                 )
                 return False
-        elif isinstance(val_type, ir.IntType) and isinstance(var_type, ir.IntType):
-            val = convert(builder, val, val_type, var_type)
         elif isinstance(val_type, ir.IntType) and isinstance(var_type, ir.PointerType):
             # NOTE: This is assignment to a PTR_TO_MAP_VALUE_OR_NULL
             logger.info(

pythonbpf/expr/expr_pass.py

@@ -4,7 +4,7 @@
 import logging
 from typing import Dict
 
-from pythonbpf.type_deducer import ctypes_to_ir, is_ctypes
+from pythonbpf.type_deducer import ctypes_to_ir, is_ctypes, IntTy
 from .call_registry import CallHandlerRegistry
 from .ir_ops import deref_to_depth, access_struct_field
 from .operators import apply_binop, UNARY_OPS, BOOL_OPS
@@ -49,7 +49,11 @@ def _handle_name_expr(
 def _handle_constant_expr(compilation_context, builder, expr: ast.Constant):
     """Handle ast.Constant expressions."""
     if isinstance(expr.value, int) or isinstance(expr.value, bool):
-        return ir.Constant(ir.IntType(64), int(expr.value)), ir.IntType(64)
+        # C gives a literal the type int if it fits, otherwise long long. That
+        # rank is what makes `u32 / -2` an unsigned 32-bit division as in C.
+        v = int(expr.value)
+        lit_ty = IntTy(32, True) if -(1 << 31) <= v < (1 << 31) else IntTy(64, True)
+        return ir.Constant(ir.IntType(64), v), lit_ty
     elif isinstance(expr.value, str):
         str_name = f".str.{id(expr)}"
         str_bytes = expr.value.encode("utf-8") + b"\x00"
@@ -307,32 +311,17 @@ def _handle_ctypes_call(
     else:
         actual_ir_type = val_type
 
-    if actual_ir_type != expected_type:
-        # NOTE: We are only considering casting to and from int types for now
-        if isinstance(actual_ir_type, ir.IntType) and isinstance(
-            expected_type, ir.IntType
-        ):
-            if actual_ir_type.width < expected_type.width:
-                value = builder.sext(value, expected_type)
-                logger.info(
-                    f"Sign-extended from i{actual_ir_type.width} to i{
-                        expected_type.width
-                    }"
-                )
-            elif actual_ir_type.width > expected_type.width:
-                value = builder.trunc(value, expected_type)
-                logger.info(
-                    f"Truncated from i{actual_ir_type.width} to i{expected_type.width}"
-                )
-            else:
-                # Same width, just use as-is (e.g., both i64)
-                pass
-        else:
-            raise ValueError(
-                f"Type mismatch: expected {expected_type}, got {
-                    actual_ir_type
-                } (original type: {val_type})"
-            )
+    if isinstance(actual_ir_type, ir.IntType) and isinstance(expected_type, ir.IntType):
+        # A cast is truncate-or-extend per the source's sign; the result then
+        # takes the cast's type. Decide from the value's physical width (as
+        # convert does), never from descriptor equality: a literal is a 64-bit
+        # constant whose descriptor may already read as C int.
+        value = convert(builder, value, actual_ir_type, expected_type)
+    elif actual_ir_type != expected_type:
+        raise ValueError(
+            f"Type mismatch: expected {expected_type}, got {actual_ir_type} "
+            f"(original type: {val_type})"
+        )
 
     return value, expected_type
 

pythonbpf/expr/type_inference.py

@@ -0,0 +1,100 @@
+"""Static integer typing of an expression, for the allocation pass.
+
+The allocation pass runs before code generation and must size and type a slot
+for `x = <expr>` without evaluating <expr>. Undeclared locals are always 64-bit
+(declare with a ctypes constructor for a narrower type); what this decides is
+their sign, by walking the expression with the same usual-arithmetic-conversion
+rule the code generator applies.
+"""
+
+import ast
+import ctypes
+
+from llvmlite import ir
+
+from pythonbpf.type_deducer import (
+    IntTy,
+    ctypes_to_ir,
+    is_ctypes,
+    is_signed_ctype,
+    signedness,
+)
+from .operators import usual_arithmetic_conversions
+from .vmlinux_registry import VmlinuxHandlerRegistry
+
+
+def _as_intty(ty):
+    if isinstance(ty, ir.IntType):
+        return IntTy(ty.width, signedness(ty))
+    return None
+
+
+def infer_int_type(expr, local_sym_tab, compilation_context):
+    """Best static integer type of `expr`, or None when it cannot be determined."""
+    if isinstance(expr, ast.Constant) and isinstance(expr.value, (int, bool)):
+        v = int(expr.value)
+        return IntTy(32, True) if -(1 << 31) <= v < (1 << 31) else IntTy(64, True)
+
+    if isinstance(expr, ast.Name):
+        if expr.id in local_sym_tab:
+            return _as_intty(local_sym_tab[expr.id].ir_type)
+        if expr.id in compilation_context.bpf_globals:
+            return _as_intty(compilation_context.bpf_globals[expr.id].ir_type)
+        if VmlinuxHandlerRegistry.handle_name(expr.id) is not None:
+            return IntTy(64, True)  # enum constants are emitted as i64
+        return None
+
+    if isinstance(expr, ast.BinOp):
+        left = infer_int_type(expr.left, local_sym_tab, compilation_context)
+        right = infer_int_type(expr.right, local_sym_tab, compilation_context)
+        if left is None or right is None:
+            return None
+        return usual_arithmetic_conversions(left, right)
+
+    if isinstance(expr, ast.UnaryOp):
+        inner = infer_int_type(expr.operand, local_sym_tab, compilation_context)
+        return None if inner is None else usual_arithmetic_conversions(inner, inner)
+
+    if isinstance(expr, ast.Call) and isinstance(expr.func, ast.Name):
+        from pythonbpf.helper import HelperHandlerRegistry  # avoid an import cycle
+
+        name = expr.func.id
+        if is_ctypes(name):
+            return _as_intty(ctypes_to_ir(name))
+        if HelperHandlerRegistry.has_handler(name):
+            return _as_intty(HelperHandlerRegistry.get_return_type(name))
+        return None
+
+    if isinstance(expr, ast.Call) and isinstance(expr.func, ast.Attribute):
+        # map.lookup(k) used as a value: the map's declared value type
+        map_name = getattr(expr.func.value, "id", None)
+        sym = compilation_context.map_sym_tab.get(map_name)
+        value = (sym.params or {}).get("value") if sym else None
+        return (
+            _as_intty(ctypes_to_ir(value))
+            if isinstance(value, str) and is_ctypes(value)
+            else None
+        )
+
+    if isinstance(expr, ast.Attribute) and isinstance(expr.value, ast.Name):
+        base = local_sym_tab.get(expr.value.id)
+        if base is None:
+            return None
+        meta = base.metadata
+        if meta in compilation_context.structs_sym_tab:
+            return _as_intty(
+                compilation_context.structs_sym_tab[meta].field_type(expr.attr)
+            )
+        if getattr(meta, "__module__", None) == "vmlinux":
+            try:
+                _, field = VmlinuxHandlerRegistry.get_field_type(
+                    meta.__name__, expr.attr
+                )
+                cname = field.type.__name__
+                if is_ctypes(cname):
+                    return IntTy(ctypes.sizeof(field.type) * 8, is_signed_ctype(cname))
+            except Exception:
+                return None
+        return None
+
+    return None

pythonbpf/helper/bpf_helper_handler.py

@@ -3,6 +3,7 @@
 from enum import Enum
 
 from .helper_registry import HelperHandlerRegistry
+from pythonbpf.type_deducer import IntTy
 from .helper_utils import (
     get_or_create_ptr_from_arg,
     get_flags_val,
@@ -45,7 +46,7 @@ class BPFHelperID(Enum):
 @HelperHandlerRegistry.register(
     "ktime",
     param_types=[],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, False),
 )
 def bpf_ktime_get_ns_emitter(
     call,
@@ -70,7 +71,7 @@ def bpf_ktime_get_ns_emitter(
 @HelperHandlerRegistry.register(
     "get_current_cgroup_id",
     param_types=[],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, False),
 )
 def bpf_get_current_cgroup_id(
     call,
@@ -310,7 +311,7 @@ def bpf_map_delete_elem_emitter(
 @HelperHandlerRegistry.register(
     "comm",
     param_types=[ir.PointerType(ir.IntType(8))],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def bpf_get_current_comm_emitter(
     call,
@@ -369,7 +370,7 @@ def bpf_get_current_comm_emitter(
 @HelperHandlerRegistry.register(
     "pid",
     param_types=[],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, False),
 )
 def bpf_get_current_pid_tgid_emitter(
     call,
@@ -496,7 +497,7 @@ def bpf_ringbuf_output_emitter(
 @HelperHandlerRegistry.register(
     "output",
     param_types=[ir.PointerType(ir.IntType(8))],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def handle_output_helper(
     call,
@@ -566,7 +567,7 @@ def emit_probe_read_kernel_str_call(builder, dst_ptr, dst_size, src_ptr):
         ir.PointerType(ir.IntType(8)),
         ir.PointerType(ir.IntType(8)),
     ],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def bpf_probe_read_kernel_str_emitter(
     call,
@@ -633,7 +634,7 @@ def emit_probe_read_kernel_call(builder, dst_ptr, dst_size, src_ptr):
         ir.PointerType(ir.IntType(8)),
         ir.PointerType(ir.IntType(8)),
     ],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def bpf_probe_read_kernel_emitter(
     call,
@@ -670,7 +671,7 @@ def bpf_probe_read_kernel_emitter(
 @HelperHandlerRegistry.register(
     "random",
     param_types=[],
-    return_type=ir.IntType(32),
+    return_type=IntTy(32, False),
 )
 def bpf_get_prandom_u32_emitter(
     call,
@@ -698,7 +699,7 @@ def bpf_get_prandom_u32_emitter(
         ir.IntType(32),
         ir.PointerType(ir.IntType(8)),
     ],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def bpf_probe_read_emitter(
     call,
@@ -763,7 +764,7 @@ def bpf_probe_read_emitter(
 @HelperHandlerRegistry.register(
     "smp_processor_id",
     param_types=[],
-    return_type=ir.IntType(32),
+    return_type=IntTy(32, False),
 )
 def bpf_get_smp_processor_id_emitter(
     call,
@@ -788,7 +789,7 @@ def bpf_get_smp_processor_id_emitter(
 @HelperHandlerRegistry.register(
     "uid",
     param_types=[],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, False),
 )
 def bpf_get_current_uid_gid_emitter(
     call,
@@ -822,7 +823,7 @@ def bpf_get_current_uid_gid_emitter(
         ir.IntType(32),
         ir.IntType(64),
     ],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def bpf_skb_store_bytes_emitter(
     call,
@@ -1010,7 +1011,7 @@ def bpf_ringbuf_submit_emitter(
 @HelperHandlerRegistry.register(
     "get_stack",
     param_types=[ir.PointerType(ir.IntType(8)), ir.IntType(64)],
-    return_type=ir.IntType(64),
+    return_type=IntTy(64, True),
 )
 def bpf_get_stack_emitter(
     call,

pythonbpf/helper/printk_formatter.py

@@ -2,7 +2,7 @@
 import logging
 
 from llvmlite import ir
-from pythonbpf.expr import eval_expr, get_base_type_and_depth, deref_to_depth
+from pythonbpf.expr import eval_expr, get_base_type_and_depth, deref_to_depth, convert
 from pythonbpf.expr.vmlinux_registry import VmlinuxHandlerRegistry
 from pythonbpf.helper.helper_utils import get_char_array_ptr_and_size
 
@@ -267,8 +267,6 @@ def _handle_pointer_arg(val, func, builder):
     return ir.Constant(ir.IntType(64), 0)
 
 
-def _handle_int_arg(val, builder):
-    """Convert integer type for bpf_printk (sign-extend to i64)."""
-    if val.type.width < 64:
-        return builder.sext(val, ir.IntType(64))
-    return val
+def _handle_int_arg(val, builder, ty=None):
+    """Widen an integer for bpf_printk to i64, per the value's sign."""
+    return convert(builder, val, ty if ty is not None else val.type, ir.IntType(64))