Kernel gate: print the verifier log for a rejected object; socket tap loads on 6.1

First run of the matrix: 6.12 clean, wire rejected on 6.1 and 6.6 after
~1600 processed insns, walk rejected on bpf-next (7.3-rc4), and the socket
tap loaded everywhere, its iov_iter reads being CO-RE guarded. The gate
ran veristat at log level 0, so none of the reasons reached CI. It now
reloads just the rejected objects with -v -l1 and a rotated 64 KiB log,
tail-bounded, before failing.

Correct the README and workflow header: the 6.4 floor for the socket tap
is for the build host's vmlinux.h, not for the kernel it loads on.

Author: julian-goldstein

.github/workflows/kernel-matrix.yml

@@ -26,11 +26,11 @@ name: kernel-matrix
 # old stamps.
 #
 # Expected failures are part of the signal: the wire tap attaches with TCX
-# (6.6+), and the legacy socket tap reads `iov_iter.__iov`, which only exists
-# from 6.4 — so a rejection of those on 6.1 marks the floor, not a regression.
-# The CO-RE objects themselves are compiled against the runner's own kernel
-# BTF (vmlinux.h is generated by `make bpf`), so the build host must be 6.4+
-# for the socket tap to compile at all; ubuntu-latest is.
+# (6.6+), so a rejection of it on 6.1 marks the floor, not a regression. The
+# legacy socket tap names `iov_iter.__iov`, which only exists from 6.4, but
+# its reads are CO-RE guarded, so it loads on older kernels; the 6.4 floor is
+# for the build host, since vmlinux.h is generated from the runner's own BTF
+# by `make bpf`. ubuntu-latest is well past it.
 
 on:
   workflow_dispatch:

README.md

@@ -471,9 +471,9 @@ buffer held before — a response head where curl's body should be.
   bpf-next under cilium's little-vm-helper, and runs the vendored static
   veristat in each VM via `build/verify-kernel.sh`. The summary is a grid
   of (object, program) × kernel, since `peer_sendmsg`/`peer_recvmsg`
-  recur across the TLS taps. Rejections on 6.1 are expected for the wire
-  tap (TCX attach, 6.6+) and the socket tap (`iov_iter.__iov`, 6.4+);
-  they mark the floor. `make veristat-matrix` runs the same thing
+  recur across the TLS taps. The socket tap loads on 6.1 despite the
+  header note above: its `iov_iter` reads are CO-RE guarded, so the 6.4
+  floor is for the build host only. `make veristat-matrix` runs the same thing
   locally with lvh + a static qemu (Linux, KVM, root for the VM), and
   `make veristat` is the single-kernel check against this host.
 

build/verify-kernel.sh

@@ -56,7 +56,22 @@ if [ -n "${OUT_CSV:-}" ]; then
 fi
 
 # Drop the header row; fail if any program's verdict is not "success".
-if printf '%s\n' "$csv" | tail -n +2 | grep -q ',failure$'; then
+# Before failing, reload just the rejected objects in verbose mode so the
+# verifier's own explanation lands in the CI log — the first pass runs at
+# log level 0 and only reports the verdict. The log is rotated to its tail
+# (that is where the rejection reason is), bounded so a long program's
+# trace does not swamp the job output.
+failed="$(printf '%s\n' "$csv" | tail -n +2 | grep ',failure$' | cut -d, -f1 | sort -u || true)"
+if [ -n "$failed" ]; then
+	objs=""
+	for f in $failed; do
+		for o in $OBJS; do
+			[ "$(basename "$o")" = "$f" ] && objs="$objs $o"
+		done
+	done
+	echo ">> verifier log for the rejected object(s):$objs"
+	# shellcheck disable=SC2086
+	"$VERISTAT" -v -l1 --log-size=65536 $objs 2>&1 | grep -v '^\s*$' | tail -n 200 || true
 	echo "::error::BPF verifier rejected a program on kernel $KREL" >&2
 	exit 1
 fi