From 0e14a811f8f50630241fd4169187186fff5e12f0 Mon Sep 17 00:00:00 2001
From: Martin Teichmann <martin.teichmann@gmail.com>
Date: Fri, 24 Feb 2023 13:39:13 +0000
Subject: [PATCH] immediate values are signed

this makes a difference with signed extension to 64 bit
---
 ebpfcat/ebpf.py      | 4 ++--
 ebpfcat/ebpf_test.py | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/ebpfcat/ebpf.py b/ebpfcat/ebpf.py
index da2efbf..974ef3e 100644
--- a/ebpfcat/ebpf.py
+++ b/ebpfcat/ebpf.py
@@ -665,7 +665,7 @@ class Binary(Expression):
                         + Opcode.LONG * ((r_long or l_long)
                                          if long is None else long),
                         dst, src, 0, 0)
-            elif -0x80000000 <= self.right < 0x100000000:
+            elif -0x80000000 <= self.right < 0x80000000:
                 self.ebpf.append(self.operator + Opcode.LONG * long,
                                  dst, 0, 0, self.right)
             else:
@@ -1332,7 +1332,7 @@ class EBPF:
         raise AssembleError("not enough registers")
 
     def _load_value(self, no, value):
-        if -0x80000000 <= value < 0x100000000:
+        if -0x80000000 <= value < 0x80000000:
             self.append(Opcode.MOV + Opcode.LONG, no, 0, 0, value)
         else:
             self.append(Opcode.DW, no, 0, 0, value & 0xffffffff)
diff --git a/ebpfcat/ebpf_test.py b/ebpfcat/ebpf_test.py
index b450fe2..01900e9 100644
--- a/ebpfcat/ebpf_test.py
+++ b/ebpfcat/ebpf_test.py
@@ -632,7 +632,9 @@ class Tests(TestCase):
             Instruction(opcode=O.DW, dst=0, src=0, off=0, imm=878082192),
             Instruction(opcode=O.W, dst=0, src=0, off=0, imm=18),
             Instruction(opcode=O.LONG+O.REG+O.ADD, dst=3, src=0, off=0, imm=0),
-            Instruction(opcode=O.LONG+O.MOV, dst=3, src=0, off=0, imm=2415919104),
+            Instruction(opcode=O.DW, dst=3, src=0, off=0, imm=2415919104),
+            Instruction(opcode=O.W, dst=0, src=0, off=0, imm=0),
+
         ])
 
     def test_simple_binary(self):
-- 
GitLab