CO-RE: Weird immediate for bpf_core_field_exists

From: Lorenz Bauer <lmb@cloudflare.com>
To: Andrii Nakryiko <andrii@kernel.org>, Yonghong Song <yhs@fb.com>
Cc: bpf <bpf@vger.kernel.org>
Subject: CO-RE: Weird immediate for bpf_core_field_exists
Date: Thu, 29 Apr 2021 11:29:38 +0100	[thread overview]
Message-ID: <CACAyw99n-cMEtVst7aK-3BfHb99GMEChmRLCvhrjsRpHhPrtvA@mail.gmail.com> (raw)

Hi Andrii and Yonghong,

This is probably a case of me holding it wrong, but I figured I would
share this nonetheless. Given the following C:

struct s {
    int _1;
    char _2;
};

typedef struct s s_t;

union u {
    int *_1;
    char *_2;
};

__section("socket_filter/fields") int fields() {
    struct t {
        union {
            s_t s[10];
        };
        struct {
            union u u;
        };
    } bar;
    return bpf_core_field_exists((&bar)[1]);
}

clang-12 generates the following instructions:

0000000000000000 <fields>:
;     return bpf_core_field_exists((&bar)[1]);
       0:    b7 00 00 00 58 00 00 00    r0 = 88
       1:    95 00 00 00 00 00 00 00    exit

The weird bit is that the immediate for instruction 0 isn't 1 but 88.
Coincidentally sizeof(bar) is also 88 bytes.

$ clang-12 --version
Ubuntu clang version
12.0.0-++20210126113614+510b3d4b3e02-1~exp1~20210126104320.178

I've tried clang-13 as well, same result.

Best,
Lorenz

-- 
Lorenz Bauer  |  Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK

www.cloudflare.com