[ciq-6.18.y] Multiple patches tested (6 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

bpf: name the enum for BPF_FUNC_skb_adjust_room flags

commit-author Nick Hudson <nhudson@akamai.com>
commit 5e4bcad6171d4baf426e49a39580cdb79254ea36

bpf: refactor masks for ADJ_ROOM flags and encap validation

commit-author Nick Hudson <nhudson@akamai.com>
commit 7b2ea1151e04d3506030db8734c48c5c2bec1392
upstream-diff |
  applied with line offset fuzz due to absence of bool decap
    variable (present in bpf-next, not in this tree). Code changes
    are identical to upstream.

bpf: add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation

commit-author Nick Hudson <nhudson@akamai.com>
commit da199070bc6209bf5db970f8f84c7db4210fe511

bpf: allow new DECAP flags and add guard rails

commit-author Nick Hudson <nhudson@akamai.com>
commit 3a39c214fd2c3dd8266649e7f9f85ca1439eb738

bpf: clear decap state on skb_adjust_room shrink path

commit-author Nick Hudson <nhudson@akamai.com>
commit ec20dee2f2c4796c0f7c0a7d8a3a3e8a9e9da7a4

selftests/bpf: tc_tunnel - pass decap flags for tunnel type

commit-author Nick Hudson <nhudson@akamai.com>
commit adb771973026efe54627bcbe927e7205d04d6c68
upstream-diff |
  The upstream patch targets bpf-next where the BPF program has been
  converted to use vmlinux.h (commit 86433db93256) and the test runner
  has been migrated from a shell script to a C-based test_progs harness
  (commit 8517b1abe5ea). This tree has neither of those prerequisites,
  so the following upstream changes were dropped:
  - Post-decap GSO gso_type and skb->encapsulation validation
    via bpf_cast_to_kern_ctx/bpf_core_cast into skb_shared_info.
    These require vmlinux.h to access kernel-internal structs
    (sk_buff, skb_shared_info) and SKB_GSO_* constants.
  - TSO disable removal from prog_tests/test_tc_tunnel.c (file absent;
    this tree still uses test_tc_tunnel.sh).
  The CO-RE enum existence checks, functional flag-passing changes
  (DECAP_L4_GRE, DECAP_L4_UDP, DECAP_IPXIP4, DECAP_IPXIP6), and
  ipxip_flag parameter plumbing through decap_internal/decap_ipv4/
  decap_ipv6 are applied as in upstream. The test exercises the new
  kernel flag acceptance path and will fail to load on kernels lacking
  the new enum values, but does not validate post-decap skb state.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	35m 25s	36m 14s
aarch64	24m 10s	24m 45s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	443	67	ciq-6.18.y	⚠️ No baseline available
aarch64	375	59	ciq-6.18.y	⚠️ No baseline available

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1479	81	ciq-6.18.y	⚠️ No baseline available
aarch64	1452	82	ciq-6.18.y	⚠️ No baseline available

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 32744234732

[bmastbergen]

Test results:

Test: BPF_F_ADJ_ROOM_DECAP_* GSO state verification
Host: VM running patched 6.18 kernel
Date: 2026-08-21

== Method ==

A kprobe BPF checker program hooks ip_rcv() and reads the real
sk_buff fields (skb->encapsulation and skb_shinfo(skb)->gso_type)
after tc ingress processing (where the BPF decap program runs)
but before TCP delivery. This directly verifies that the kernel
cleared the tunnel GSO bits and encapsulation flag, rather than
just checking whether traffic flows.

The test sends 64KB payloads with TSO enabled to trigger GSO
segmentation, then verifies that no tunnel GSO bits (SKB_GSO_GRE,
SKB_GSO_IPXIP4, SKB_GSO_UDP_TUNNEL, etc.) remain set after
bpf_skb_adjust_room() with the new DECAP flags.

== Results ==

=== building checker ===
  checker built OK
=== loading checker kprobe ===
  attached to ip_rcv

=== BPF decap flags GSO test ===
  kernel: 6.18.43-bmastbergen_bpf_skb_adjust_room_ciq-6.18.y-eb2f26ded6+

--- GSO path (64KB, TSO on) ---
  ipip     (DECAP_IPXIP4)                           PASS (13 pkts, GSO clean)
  gre      (DECAP_L4_GRE+IPXIP4)                    SKIP (checker saw 0 pkts)
  gre+eth  (DECAP_L4_GRE+IPXIP4)                    SKIP (checker saw 0 pkts)
  sit      (DECAP_IPXIP4)                           PASS (12 pkts, GSO clean)

--- non-GSO baseline (100B) ---
  ipip 100B                                         PASS (5 pkts, GSO clean)
  gre  100B                                         SKIP (checker saw 0 pkts)

--- trace log ---
(no trace output)

=== Results: 3 passed, 0 failed ===

== Notes ==

- PASS means the kprobe checker confirmed gso_type has no tunnel
  bits set and skb->encapsulation == 0 after BPF decap.
- SKIP on GRE: the existing test_tc_tunnel BPF encap/decap programs
  use section-name-based loading via tc (not skeleton), and the GRE
  tunnel path requires both encap and decap to properly handshake
  through a veth pair. The IPIP/SIT tunnel types exercise the core
  DECAP_IPXIP4 flag path which is the primary GSO cleanup codepath.
- The "trace log" section is empty because the trace buffer is
  cleared between subtests. Sample trace output from earlier runs:

    nc-14804 [006] ..s31 934.159609: bpf_trace_printk: CHECKER: gso_type=0x1 encap=0 CLEAN (GOOD)
    nc-14804 [006] ..s31 934.159699: bpf_trace_printk: CHECKER: gso_type=0x1 encap=0 CLEAN (GOOD)

  gso_type=0x1 is SKB_GSO_TCPV4 (the only GSO bit that should
  remain after tunnel decapsulation).

test-decap-gso-618.sh

[PlaidCat]

Still need to review this BUT its been merged upstream as well.

[bmastbergen]

Still need to review this BUT its been merged upstream as well.

Commit headers updated with upstream shas. Thanks!

[PlaidCat]

Unless we want to fix up the signed-off-by: Brett and not indent it.
and
selftests/bpf: tc_tunnel - pass decap flags for tunnel type commit message differs significantly from upstream
adb7719

[PlaidCat]

I guess in Commit 2 and Commit 5 we're also missing the reviewed-by that is present in the upstream commits

[PlaidCat]

Whoops

[bmastbergen]

I guess in Commit 2 and Commit 5 we're also missing the reviewed-by that is present in the upstream commits

Ah yea, I just updated the commit line, but didn't think about the fact that the upstream commits might be different in other ways. Updated all commits to be in sync with the upstream commits, plus our headers and trailers.