[ciq-6.18.y] Multiple patches tested (6 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
commit-author Nick Hudson <nhudson@akamai.com>
commit 5e4bcad6171d4baf426e49a39580cdb79254ea36

bpf: Refactor masks for ADJ_ROOM flags and encap validation
commit-author Nick Hudson <nhudson@akamai.com>
commit 7b2ea1151e04d3506030db8734c48c5c2bec1392
upstream-diff |
applied with line offset fuzz due to absence of bool decap
variable (present in bpf-next, not in this tree). Code changes
are identical to upstream.

bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
commit-author Nick Hudson <nhudson@akamai.com>
commit da199070bc6209bf5db970f8f84c7db4210fe511

bpf: Allow new DECAP flags and add guard rails
commit-author Nick Hudson <nhudson@akamai.com>
commit 3a39c214fd2c3dd8266649e7f9f85ca1439eb738

bpf: Clear decap state on skb_adjust_room shrink path
commit-author Nick Hudson <nhudson@akamai.com>
commit ec20dee2f2c4796c0f7c0a7d8a3a3e8a9e9da7a4

selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
commit-author Nick Hudson <nhudson@akamai.com>
commit adb771973026efe54627bcbe927e7205d04d6c68
upstream-diff |
The upstream patch targets bpf-next where the BPF program has been
converted to use vmlinux.h (commit 86433db93256) and the test runner
has been migrated from a shell script to a C-based test_progs harness
(commit 8517b1abe5ea). This tree has neither of those prerequisites,
so the following upstream changes were dropped:
- Post-decap GSO gso_type and skb->encapsulation validation
via bpf_cast_to_kern_ctx/bpf_core_cast into skb_shared_info.
These require vmlinux.h to access kernel-internal structs
(sk_buff, skb_shared_info) and SKB_GSO_* constants.
- TSO disable removal from prog_tests/test_tc_tunnel.c (file absent;
this tree still uses test_tc_tunnel.sh).
The CO-RE enum existence checks, functional flag-passing changes
(DECAP_L4_GRE, DECAP_L4_UDP, DECAP_IPXIP4, DECAP_IPXIP6), and
ipxip_flag parameter plumbing through decap_internal/decap_ipv4/
decap_ipv6 are applied as in upstream. The test exercises the new
kernel flag acceptance path and will fail to load on kernels lacking
the new enum values, but does not validate post-decap skb state.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	37m 40s	38m 27s
aarch64	23m 44s	24m 20s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	447	63	ciq-6.18.y	⚠️ No baseline available
aarch64	378	56	ciq-6.18.y	⚠️ No baseline available

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1478	82	ciq-6.18.y	⚠️ No baseline available
aarch64	1452	82	ciq-6.18.y	⚠️ No baseline available

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 32773041301

[bmastbergen]

Test results:

Test: BPF_F_ADJ_ROOM_DECAP_* GSO state verification
Host: VM running patched 6.18 kernel
Date: 2026-08-21
== Method ==
A kprobe BPF checker program hooks ip_rcv() and reads the real
sk_buff fields (skb->encapsulation and skb_shinfo(skb)->gso_type)
after tc ingress processing (where the BPF decap program runs)
but before TCP delivery. This directly verifies that the kernel
cleared the tunnel GSO bits and encapsulation flag, rather than
just checking whether traffic flows.
The test sends 64KB payloads with TSO enabled to trigger GSO
segmentation, then verifies that no tunnel GSO bits (SKB_GSO_GRE,
SKB_GSO_IPXIP4, SKB_GSO_UDP_TUNNEL, etc.) remain set after
bpf_skb_adjust_room() with the new DECAP flags.
== Results ==
=== building checker ===
checker built OK
=== loading checker kprobe ===
attached to ip_rcv
=== BPF decap flags GSO test ===
kernel: 6.18.43-bmastbergen_bpf_skb_adjust_room_ciq-6.18.y-eb2f26ded6+
--- GSO path (64KB, TSO on) ---
ipip (DECAP_IPXIP4) PASS (13 pkts, GSO clean)
gre (DECAP_L4_GRE+IPXIP4) SKIP (checker saw 0 pkts)
gre+eth (DECAP_L4_GRE+IPXIP4) SKIP (checker saw 0 pkts)
sit (DECAP_IPXIP4) PASS (12 pkts, GSO clean)
--- non-GSO baseline (100B) ---
ipip 100B PASS (5 pkts, GSO clean)
gre 100B SKIP (checker saw 0 pkts)
--- trace log ---
(no trace output)
=== Results: 3 passed, 0 failed ===
== Notes ==
- PASS means the kprobe checker confirmed gso_type has no tunnel
bits set and skb->encapsulation == 0 after BPF decap.
- SKIP on GRE: the existing test_tc_tunnel BPF encap/decap programs
use section-name-based loading via tc (not skeleton), and the GRE
tunnel path requires both encap and decap to properly handshake
through a veth pair. The IPIP/SIT tunnel types exercise the core
DECAP_IPXIP4 flag path which is the primary GSO cleanup codepath.
- The "trace log" section is empty because the trace buffer is
cleared between subtests. Sample trace output from earlier runs:
nc-14804 [006] ..s31 934.159609: bpf_trace_printk: CHECKER: gso_type=0x1 encap=0 CLEAN (GOOD)
nc-14804 [006] ..s31 934.159699: bpf_trace_printk: CHECKER: gso_type=0x1 encap=0 CLEAN (GOOD)
gso_type=0x1 is SKB_GSO_TCPV4 (the only GSO bit that should
remain after tunnel decapsulation).

test-decap-gso-618.sh

[PlaidCat]

Still need to review this BUT its been merged upstream as well.

[bmastbergen]

Still need to review this BUT its been merged upstream as well.

Commit headers updated with upstream shas. Thanks!

[PlaidCat]

Unless we want to fix up the signed-off-by: Brett and not indent it.
and
selftests/bpf: tc_tunnel - pass decap flags for tunnel type commit message differs significantly from upstream
adb7719

[PlaidCat]

I guess in Commit 2 and Commit 5 we're also missing the reviewed-by that is present in the upstream commits

[PlaidCat]

Whoops

[bmastbergen]

I guess in Commit 2 and Commit 5 we're also missing the reviewed-by that is present in the upstream commits

Ah yea, I just updated the commit line, but didn't think about the fact that the upstream commits might be different in other ways. Updated all commits to be in sync with the upstream commits, plus our headers and trailers.

[kerneltoast]

I iterated with Claude (Feeble 5) reviewing this. Nothing that's a blocker in this PR. Here's the feedback written by Claude:

---

The upstream-diff note on 192a27a ("bpf: Refactor masks for ADJ_ROOM flags and encap validation") attributes the missing bool decap context line to bpf-next, but that line actually comes from 699f47e ("net: Clear the dst when performing encap / decap"), which has been in mainline since v7.1. Preferably backport 699f47e as a prerequisite, since it's a small filter.c-only patch and with it the patched functions come out byte-identical to upstream; otherwise correct the note.

The four bpf_core_enum_value_exists() checks kept in test_tc_tunnel.c here were dropped on #1546, whose note cites iproute2's legacy tc loader. Both ciq-6.18.y and ciqlts9_6 carry byte-identical copies of test_tc_tunnel.sh and load the program the same way, so whichever rationale is right applies to both PRs; see the comment on #1546 for the suggested resolution.

The kprobe checker results above cover the DECAP_IPXIP4 paths (ipip and sit), but every GRE row is a SKIP and there are no UDP or IPXIP6 rows, so the new L4 decap handling never got exercised: the guard-rail length math for GRE/UDP headers and the SKB_GSO_GRE*/SKB_GSO_UDP_TUNNEL* clearing in the shrink path. Worth closing that gap before this ships, even if it takes extending the test-decap-gso-618.sh harness you attached.