Wire tap: a capture length the 6.6 verifier can bound; the matrix starts at 6.6

The first matrix run put the floor at 6.6, not 6.1: 6.1 refuses the wire
tap's TCX attach type at load, with zero instructions verified, and every
other object loads there. The socket tap's iov_iter reads are CO-RE
guarded, so its 6.4 note is for the build host only.

On 6.6 the wire tap was rejected inside emit(): "R4 invalid zero-sized
read: u64=[0,4094]" at bpf_skb_load_bytes. The size was guarded by
`cap && ...`, but a verifier before 6.9 does not narrow a register on the
`!= 0` branch, so it still saw a possible zero. Submit the empty record
first, then rebuild the bound by arithmetic the verifier does track:
((cap - 1) & CAP_MASK) + 1 is [1, CAP_MASK + 1] and an identity on the
range that reaches it; barrier_var keeps clang from folding it away.

Matrix: 6.6, 6.12, 6.18, 7.2 gate; bpf-next runs with continue-on-error.
On 7.3-rc4 the walk VM's bpf_loop callbacks cost 850k verifier
instructions against 14k on 6.12 and hit the 1M limit. That is worth
seeing on every run, but a moving target should not block a merge until
the change ships in a release. The local harness defaults to the same
spread.

Author: julian-goldstein

.github/workflows/kernel-matrix.yml

@@ -25,12 +25,15 @@ name: kernel-matrix
 # tracking the latest build, with no tag to bump and immune to quay's pruning of
 # old stamps.
 #
-# Expected failures are part of the signal: the wire tap attaches with TCX
-# (6.6+), so a rejection of it on 6.1 marks the floor, not a regression. The
-# legacy socket tap names `iov_iter.__iov`, which only exists from 6.4, but
-# its reads are CO-RE guarded, so it loads on older kernels; the 6.4 floor is
-# for the build host, since vmlinux.h is generated from the runner's own BTF
-# by `make bpf`. ubuntu-latest is well past it.
+# The floor is 6.6: the wire tap attaches with TCX, which 6.1 refuses at load
+# (zero instructions verified), and every other object loads on 6.1 — the
+# legacy socket tap names `iov_iter.__iov` (6.4+) but its reads are CO-RE
+# guarded, so that 6.4 floor is for the build host only, where vmlinux.h is
+# generated from the runner's own BTF by `make bpf`. So the gating lines are
+# the LTS and stable kernels from 6.6 up. bpf-next is run but does not gate:
+# it is a moving target, and 7.3-rc4 made the walk VM's bpf_loop callbacks
+# cost 850k verifier instructions against 14k on 6.12, which is worth seeing
+# but not worth blocking a merge on until it lands in a release.
 
 on:
   workflow_dispatch:
@@ -50,11 +53,18 @@ jobs:
         # Kernel lines to verify. Each is resolved to its newest date-stamped
         # lvh image at run time (see the header).
         kernel:
-          - '6.1'
           - '6.6'
           - '6.12'
+          - '6.18'
+          - '7.2'
           - 'bpf-next'
+        # bpf-next is informational: a failure there is recorded in the grid
+        # but does not fail the job, so the summary's gate ignores it.
+        include:
+          - kernel: 'bpf-next'
+            informational: true
     name: kernel ${{ matrix.kernel }}
+    continue-on-error: ${{ matrix.informational == true }}
     steps:
       - uses: actions/checkout@v4
 
@@ -197,7 +207,7 @@ jobs:
                       cells.append("❌"); fail += 1
               print(f"| `{obj}` | `{prog}` | " + " | ".join(cells) + " |")
           print()
-          print("✅ accepted · ❌ rejected · ⚪ not run\n")
+          print("✅ accepted · ❌ rejected · ⚪ not run · bpf-next is informational and does not gate\n")
           total = len(progs) * len([k for k in kernels if data[k] is not None])
           verb = "all programs loaded on every kernel" if fail == 0 else f"{fail} of {total} program×kernel checks failed"
           print(f"**{len(progs)} program(s) × {len(kernels)} kernel(s) — {verb}.**")

README.md

@@ -467,13 +467,20 @@ buffer held before — a response head where curl's body should be.
   yeetkit dependency is by absolute path for now.
 - **Kernel matrix**: `.github/workflows/kernel-matrix.yml` (the one
   `yeet new` scaffolds, adapted to this repo's per-directory objects)
-  builds every `bin/*.bpf.o` on the runner, boots 6.1, 6.6, 6.12 and
-  bpf-next under cilium's little-vm-helper, and runs the vendored static
-  veristat in each VM via `build/verify-kernel.sh`. The summary is a grid
-  of (object, program) × kernel, since `peer_sendmsg`/`peer_recvmsg`
-  recur across the TLS taps. The socket tap loads on 6.1 despite the
-  header note above: its `iov_iter` reads are CO-RE guarded, so the 6.4
-  floor is for the build host only. `make veristat-matrix` runs the same thing
+  builds every `bin/*.bpf.o` on the runner, boots 6.6, 6.12, 6.18, 7.2
+  and bpf-next under cilium's little-vm-helper, and runs the vendored
+  static veristat in each VM via `build/verify-kernel.sh`. The summary
+  is a grid of (object, program) × kernel, since
+  `peer_sendmsg`/`peer_recvmsg` recur across the TLS taps. The floor is
+  6.6: 6.1 refuses the wire tap's TCX attach type at load, and every
+  other object loads there (the socket tap's `iov_iter` reads are CO-RE
+  guarded, so the 6.4 note above is for the build host only). The first
+  run also caught the 6.6 verifier rejecting the wire tap's
+  `bpf_skb_load_bytes` size as possibly zero, since a verifier before
+  6.9 does not narrow a register on a `!= 0` branch; the bound is now
+  rebuilt by arithmetic. bpf-next runs but does not gate: on 7.3-rc4 the
+  walk VM's `bpf_loop` callbacks cost 850k verifier instructions against
+  14k on 6.12 and hit the one-million limit. `make veristat-matrix` runs the same thing
   locally with lvh + a static qemu (Linux, KVM, root for the VM), and
   `make veristat` is the single-kernel check against this host.
 

bpf/wire/wire.bpf.c

@@ -208,9 +208,20 @@ static __always_inline void emit(struct __sk_buff *skb, struct pkt *p, __u8 hook
         __u32 cap = len > off ? len - off : 0;
         if (cap > CAP_MASK)
             cap = CAP_MASK;
+        if (cap == 0) {
+            e->cap_len = 0;
+            bpf_ringbuf_submit(e, 0);
+            return;
+        }
+        /* bpf_skb_load_bytes refuses a size that may be zero, and a
+         * verifier before 6.9 does not narrow a register on the
+         * `!= 0` branch above (6.6 rejects: "R4 invalid zero-sized
+         * read: u64=[0,4094]"). Rebuild the bound by arithmetic it
+         * does track: [1, CAP_MASK + 1], an identity on [1, CAP_MASK].
+         * The barrier keeps clang from folding it away. */
         barrier_var(cap);
-        cap &= CAP_MASK;
-        if (cap && bpf_skb_load_bytes(skb, p->data_off + off, e->data, cap))
+        cap = ((cap - 1) & CAP_MASK) + 1;
+        if (bpf_skb_load_bytes(skb, p->data_off + off, e->data, cap))
             cap = 0;
         e->cap_len = cap;
         bpf_ringbuf_submit(e, 0);

build/kernel-matrix.sh

@@ -4,7 +4,7 @@
 # matrix.yml. This is a TEST HARNESS, not part of the build, and needs a
 # Linux host (ideally with /dev/kvm; without it QEMU falls back to slow TCG).
 #
-#   build/kernel-matrix.sh [kernel ...]      # default: an LTS spread + bpf-next
+#   build/kernel-matrix.sh [kernel ...]      # default: 6.6 (the TCX floor) up, + bpf-next
 #   make veristat-matrix                      # same, via the Makefile
 #
 # It uses cilium's lvh + QEMU to boot quay.io/lvh-images/kind:<kernel> images.
@@ -18,7 +18,7 @@
 
 set -eu
 
-KERNELS=${*:-"5.10-main 5.15-main 6.1-main 6.6-main 6.12-main bpf-next-main"}
+KERNELS=${*:-"6.6-main 6.12-main 6.18-main 7.2-main bpf-next-main"}
 LVH_VERSION="${LVH_VERSION:-v0.0.30}"
 SSH_PORT="${SSH_PORT:-2222}"
 MON_PORT="${MON_PORT:-45454}"