Tests: Integer signedness cases mirroring the C reference

Seven programs under passing_tests/signedness, one per case in
tests/c-form/signedness.bpf.c: unsigned and signed widening, mixed
division and remainder, unsigned comparison, u32 * u32 wrapping before
the widening, right shifts, and literal rank. Levels 1 and 2 compile
them like any other case; test_signedness_ir.py asserts the shape of the
IR against what clang emits for the C (zext vs sext, udiv vs sdiv,
icmp ugt vs sgt, lshr vs ashr, the trunc/zext pair around the wrap).

The XDP xfail note no longer claims the guard is a signed compare.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BSDVsZH5NtoASyxB8FCtGU

Author: r41k0u

tests/passing_tests/signedness/literal_rank.py

@@ -0,0 +1,45 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_uint32
+
+
+@bpf
+@bpfglobal
+def u32_ten() -> c_uint32:
+    return c_uint32(10)
+
+
+@bpf
+@bpfglobal
+def by_literal() -> c_uint32:
+    return c_uint32(0)
+
+
+@bpf
+@bpfglobal
+def wide() -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global by_literal, wide
+    # A literal has C's `int` type, so u32 / -2 promotes to u32: an unsigned
+    # division by 0xFFFFFFFE (udiv), exactly as `u32_ten / -2` in C
+    by_literal = u32_ten / -2
+    # A literal that does not fit in int is a `long long`; the sum is 64-bit
+    wide = 5000000000 + 1
+    # i32-ranked literals are still 64-bit slots for an undeclared local
+    small = 7 * 6
+    return c_int64(small)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/signedness/mixed_division.py

@@ -0,0 +1,52 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_int32, c_uint32
+
+
+@bpf
+@bpfglobal
+def u32_ten() -> c_uint32:
+    return c_uint32(10)
+
+
+@bpf
+@bpfglobal
+def s32_neg2() -> c_int32:
+    return c_int32(-2)
+
+
+@bpf
+@bpfglobal
+def mixed_div() -> c_uint32:
+    return c_uint32(0)
+
+
+@bpf
+@bpfglobal
+def mixed_mod() -> c_uint32:
+    return c_uint32(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global mixed_div, mixed_mod
+    # u32 / s32: the usual arithmetic conversions make both u32, so this is an
+    # unsigned division: 10 / 0xFFFFFFFE == 0, not -5
+    mixed_div = u32_ten / s32_neg2
+    mixed_mod = u32_ten % s32_neg2
+    # both signed: an ordinary signed division
+    a = c_int32(-7)
+    b = c_int32(2)
+    q = a / b
+    return c_int64(q)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/signedness/narrow_wrap.py

@@ -0,0 +1,43 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_uint32, c_uint64
+
+
+@bpf
+@bpfglobal
+def u32_half() -> c_uint32:
+    return c_uint32(0x80000000)
+
+
+@bpf
+@bpfglobal
+def u32_two() -> c_uint32:
+    return c_uint32(2)
+
+
+@bpf
+@bpfglobal
+def narrow_wrap() -> c_uint64:
+    return c_uint64(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global narrow_wrap
+    # u32 * u32 is a u32 multiplication: 0x80000000 * 2 wraps to 0 before the
+    # widening to u64 (the LHS never widens the operands)
+    narrow_wrap = u32_half * u32_two
+    # narrowing truncates: only the low 32 bits of the u64 survive
+    small = c_uint32(narrow_wrap)
+    return c_int64(small)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/signedness/right_shift.py

@@ -0,0 +1,48 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_int32, c_uint32
+
+
+@bpf
+@bpfglobal
+def u32_max() -> c_uint32:
+    return c_uint32(0xFFFFFFFF)
+
+
+@bpf
+@bpfglobal
+def s32_neg() -> c_int32:
+    return c_int32(-1)
+
+
+@bpf
+@bpfglobal
+def shr_unsigned() -> c_uint32:
+    return c_uint32(0)
+
+
+@bpf
+@bpfglobal
+def shr_signed() -> c_int32:
+    return c_int32(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global shr_unsigned, shr_signed
+    # u32 >> 4 shifts zeros in (lshr): 0x0FFFFFFF
+    shr_unsigned = u32_max >> 4
+    # s32 >> 4 shifts the sign in (ashr): -1 stays -1
+    shr_signed = s32_neg >> 4
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/signedness/unsigned_compare.py

@@ -0,0 +1,52 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_uint64
+
+
+@bpf
+@bpfglobal
+def u64_ten() -> c_uint64:
+    return c_uint64(10)
+
+
+@bpf
+@bpfglobal
+def s64_neg() -> c_int64:
+    return c_int64(-1)
+
+
+@bpf
+@bpfglobal
+def unsigned_cmp() -> c_uint64:
+    return c_uint64(0)
+
+
+@bpf
+@bpfglobal
+def signed_cmp() -> c_uint64:
+    return c_uint64(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global unsigned_cmp, signed_cmp
+    # u64 > s64: the comparison happens in u64, so -1 is the largest value and
+    # 10 > -1 is false (icmp ugt)
+    if u64_ten > s64_neg:
+        unsigned_cmp = 1
+    # s64 > s64 stays a signed comparison (icmp sgt)
+    a = c_int64(10)
+    if a > s64_neg:
+        signed_cmp = 1
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/signedness/widen_signed.py

@@ -0,0 +1,36 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+@bpf
+@bpfglobal
+def s32_neg() -> c_int32:
+    return c_int32(-1)
+
+
+@bpf
+@bpfglobal
+def widen_signed() -> c_uint64:
+    return c_uint64(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global widen_signed
+    # u64 = s32: -1 sign-extends to 0xffffffffffffffff (sext), as in C and ctypes
+    widen_signed = s32_neg
+    x = c_int32(-5)
+    y = c_int64(x)
+    return y
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/signedness/widen_unsigned.py

@@ -0,0 +1,44 @@
+# Mirrors tests/c-form/signedness.bpf.c; the IR clang emits for that file is
+# the specification (see tests/test_signedness_ir.py for the ops asserted).
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_int32, c_uint32
+
+
+@bpf
+@bpfglobal
+def u32_max() -> c_uint32:
+    return c_uint32(0xFFFFFFFF)
+
+
+@bpf
+@bpfglobal
+def widen_unsigned() -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def reinterpret() -> c_int32:
+    return c_int32(0)
+
+
+@bpf
+@section("tracepoint/raw_syscalls/sys_enter")
+def prog(ctx: c_void_p) -> c_int64:
+    global widen_unsigned, reinterpret
+    # s64 = u32: value-preserving, so 0xFFFFFFFF stays 4294967295 (zext, not sext)
+    widen_unsigned = u32_max
+    # s32 = u32: same width, the bits are reinterpreted (-1)
+    reinterpret = u32_max
+    # a local copied from a global takes the global's type: a c_uint32 slot
+    also = u32_max
+    return c_int64(also)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/test_config.toml

@@ -16,8 +16,9 @@
 "failing_tests/conditionals/struct_ptr.py" = {reason = "Struct pointer used directly as boolean condition not supported", level = "ir"}
 
 # Compiles cleanly; rejected by the kernel. The `data + 34 < data_end` guard is
-# emitted as a signed compare over values round-tripped through the stack, so the
-# verifier never narrows the packet range (it stays r=0) and the later
+# emitted as a compare over values round-tripped through the stack (an unsigned
+# compare now that c_uint fields carry their sign; recheck at the verifier
+# level), so the verifier never narrows the packet range (it stays r=0) and the later
 # `iph.saddr` read fails with "invalid access to packet, off=26 size=4" /
 # "R1 offset is outside of the packet". Direct packet access needs bounds checks
 # in a form the verifier can follow.