[PATCH net-next v2 0/5] seg6: add End.X PSP flavor support and selftests

[PATCH net-next v2 0/5] seg6: add End.X PSP flavor support and selftests

[Hangbin Liu]

This series adds End.X PSP flavor handling in seg6local and extends the
SRv6 selftests to cover it.

Patch 1 splits the final forwarding step out of end_flv8986_core() so
RFC8986 flavor logic can be reused outside the End path.
Patch 2 uses that to add End.X PSP support through the same
end_flv8986_core() path.
Patches 3-4 refactor the PSP selftest setup/cleanup so flavor tests can
be added more cleanly.
Patch 5 adds End.X PSP connectivity coverage and updates the selftest
policy parser to accept an explicit action field.

The goal is to make End.X PSP behavior consistent with End PSP, while
keeping the selftest structure easier to extend for later flavors.

Run all srv6 selftests on debug kernel. All passed without error.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Changes in v2:
- rebase on Andrea's "seg6: ensure packet data is writable before modifying SRH and IPv6 DA"
- Patch 2: Update end_flv8986_core() comment for End.X
- Patch 3: Move ret check in this patch
- Patch 4: Do not remove noflv route
- Link to v1: https://lore.kernel.org/r/20260922-srv6_flavors_endx-v1-0-4d01c05c47b7@kylinos.cn

---
Hangbin Liu (5):
      seg6: split final End process out of flavor processing
      seg6: add RFC8986 flavor support for End.X
      selftests: seg6: move SRv6 End PSP setup into its own helper
      selftest: seg6: add explicit cleanup for SRv6 End PSP test
      selftests: seg6: add End.X PSP selftest

 net/ipv6/seg6_local.c                              |  27 +++-
 .../testing/selftests/net/srv6_end_flavors_test.sh | 165 +++++++++++++++++++--
 2 files changed, 177 insertions(+), 15 deletions(-)
---
base-commit: d8674294aefef02266c4d47ad10131f1bffbe534
change-id: 20260922-srv6_flavors_endx-9489116d50c4

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

[PATCH net-next v2 1/5] seg6: split final End process out of flavor processing

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

Move the final End forwarding step out of end_flv8986_core() and return
success to the caller instead.

Currently end_flv8986_core() performs both RFC8986 flavor processing and
final End forwarding by calling input_action_end_finish(). That couples
flavor handling with the End-specific forwarding path, which makes it
hard to reuse the same flavor logic for other End variants.

Split the two steps so input_action_end() does:
  1) end_flv8986_core() for flavor processing
  2) input_action_end_finish() for final forwarding

This keeps end_flv8986_core() focused on RFC8986/PSP flavor semantics
and makes it easier to plug the same flavor core into End.X/T later.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 net/ipv6/seg6_local.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 0c3d1be7f129..4fcfcd48cfae 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -825,6 +825,9 @@ static bool seg6_pop_srh(struct sk_buff *skb, int srhoff)
 
 /* process the packet on the basis of the RFC8986 flavors set for the given
  * SRv6 End behavior instance.
+ *
+ * Returns with skb freed on failure. On success, the caller must complete
+ * final processing and forward the packet.
  */
 static int end_flv8986_core(struct sk_buff *skb, struct seg6_local_lwt *slwt)
 {
@@ -882,7 +885,7 @@ static int end_flv8986_core(struct sk_buff *skb, struct seg6_local_lwt *slwt)
 		goto drop;
 	}
 
-	return input_action_end_finish(skb, slwt);
+	return 0;
 
 drop:
 	kfree_skb_reason(skb, reason);
@@ -894,6 +897,7 @@ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt)
 {
 	const struct seg6_flavors_info *finfo = &slwt->flv_info;
 	__u32 fops = finfo->flv_ops;
+	int ret;
 
 	if (!fops)
 		return input_action_end_core(skb, slwt);
@@ -907,7 +911,11 @@ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt)
 	 * information extracted from the packet, e.g. presence/absence of SRH,
 	 * Segment Left = 0, etc.
 	 */
-	return end_flv8986_core(skb, slwt);
+	ret = end_flv8986_core(skb, slwt);
+	if (ret)
+		return ret;
+
+	return input_action_end_finish(skb, slwt);
 }
 
 /* regular endpoint, and forward to specified nexthop */

-- 
2.55.0

[PATCH net-next v2 2/5] seg6: add RFC8986 flavor support for End.X

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

Previously End.X only supported NEXT-C-SID, with a plain fallback to
input_action_end_x_core(). Add PSP End.X processing by reusing
end_flv8986_core().

Add SEG6_LOCAL_FLV8986_SUPP_OPS to SEG6_LOCAL_END_X_FLV_SUPP_OPS so
End.X advertises PSP flavor support.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---

For Sashiko:

With the SEG6_LOCAL_END_X_FLV_SUPP_OPS mask widened, parse_nla_flavors()
now accept the combination next-csid plus psp for an End.X instance. And
the current code is unable to handle this combination. The End instance
also has this issue. Andrea is preparing a fix for this bug.
---
 net/ipv6/seg6_local.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 4fcfcd48cfae..521a9b0c0929 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -121,7 +121,8 @@ struct bpf_lwt_prog {
 
 #define SEG6_LOCAL_END_FLV_SUPP_OPS	(SEG6_F_LOCAL_FLV_NEXT_CSID | \
 					 SEG6_LOCAL_FLV8986_SUPP_OPS)
-#define SEG6_LOCAL_END_X_FLV_SUPP_OPS	SEG6_F_LOCAL_FLV_NEXT_CSID
+#define SEG6_LOCAL_END_X_FLV_SUPP_OPS	(SEG6_F_LOCAL_FLV_NEXT_CSID | \
+					 SEG6_LOCAL_FLV8986_SUPP_OPS)
 
 struct seg6_flavors_info {
 	/* Flavor operations */
@@ -824,7 +825,7 @@ static bool seg6_pop_srh(struct sk_buff *skb, int srhoff)
 }
 
 /* process the packet on the basis of the RFC8986 flavors set for the given
- * SRv6 End behavior instance.
+ * SRv6 End, End.X behavior instance.
  *
  * Returns with skb freed on failure. On success, the caller must complete
  * final processing and forward the packet.
@@ -923,12 +924,20 @@ static int input_action_end_x(struct sk_buff *skb, struct seg6_local_lwt *slwt)
 {
 	const struct seg6_flavors_info *finfo = &slwt->flv_info;
 	__u32 fops = finfo->flv_ops;
+	int ret;
+
+	if (!fops)
+		return input_action_end_x_core(skb, slwt);
 
 	/* check for the presence of NEXT-C-SID since it applies first */
 	if (seg6_next_csid_enabled(fops))
 		return end_x_next_csid_core(skb, slwt);
 
-	return input_action_end_x_core(skb, slwt);
+	ret = end_flv8986_core(skb, slwt);
+	if (ret)
+		return ret;
+
+	return input_action_end_x_finish(skb, slwt);
 }
 
 static int input_action_end_t(struct sk_buff *skb, struct seg6_local_lwt *slwt)

-- 
2.55.0

[PATCH net-next v2 3/5] selftests: seg6: move SRv6 End PSP setup into its own helper

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

Currently setup() installs both the base topology and the End PSP
policy. That couples general SRv6 test setup with a specific flavor
test case, which makes it hard to add other flavor scenarios cleanly.

Extract the End PSP policy setup from setup() into setup_end_flv_psp(),
So extend PSP test cases can setup and later cleanup independently. The
matching cleanup_end_flv_psp() arrives in the following patch.

Use set -e around the PSP setup block so failures during setup are
treated as errors instead of silently continuing into the connectivity
checks.

Since SETUP_ERR is not set in one setup function, and the middle test may
set ret to 1, we also need to check ret before setting the result as SKIP

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/srv6_end_flavors_test.sh | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/net/srv6_end_flavors_test.sh b/tools/testing/selftests/net/srv6_end_flavors_test.sh
index 30a939392eea..5ebd6a0344d6 100755
--- a/tools/testing/selftests/net/srv6_end_flavors_test.sh
+++ b/tools/testing/selftests/net/srv6_end_flavors_test.sh
@@ -328,7 +328,7 @@ cleanup()
 	# check whether the setup phase was completed successfully or not. In
 	# case of an error during the setup phase of the testing environment,
 	# the selftest is considered as "skipped".
-	if [ "${SETUP_ERR}" -ne 0 ]; then
+	if [ "${SETUP_ERR}" -ne 0 ] && [ "$ret" -ne "$ksft_fail" ]; then
 		echo "SKIP: Setting up the testing environment failed"
 		exit "${ksft_skip}"
 	fi
@@ -628,6 +628,12 @@ setup()
 	setup_rt_local_sids 3 "1 2 4"
 	setup_rt_local_sids 4 "1 2 3"
 
+	# testing environment was set up successfully
+	SETUP_ERR=0
+}
+
+setup_end_flv_psp()
+{
 	# set up SRv6 policies
 	# create a connection between hosts hs-1 and hs-2.
 	# The path between hs-1 and hs-2 traverses SRv6 aware routers.
@@ -644,9 +650,6 @@ setup()
 	#  - rt-1 (SRv6 End flavor PSP with SL=1)
 	setup_rt_policy_ipv6 2 1 "3:noflv 4:psp 2:psp"
 	setup_rt_policy_ipv6 1 2 "1:psp"
-
-	# testing environment was set up successfully
-	SETUP_ERR=0
 }
 
 check_rt_connectivity()
@@ -741,7 +744,13 @@ host2gateway_tests()
 
 host_srv6_end_flv_psp_tests()
 {
-	log_section "SRv6 connectivity test hosts (h1 <-> h2, PSP flavor)"
+	set -e
+	SETUP_ERR=1
+	setup_end_flv_psp
+	SETUP_ERR=0
+	set +e
+
+	log_section "SRv6 connectivity test hosts (h1 <-> h2, End flavor PSP)"
 
 	check_and_log_hs_connectivity 1 2
 	check_and_log_hs_connectivity 2 1

-- 
2.55.0

[PATCH net-next v2 4/5] selftest: seg6: add explicit cleanup for SRv6 End PSP test

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

The PSP test installs policy and route state, but relies on global
cleanup to tear it down. That can leave flavor-specific state around
when later tests are added to the same script.

Add cleanup_end_flv_psp() and run it at the end of
host_srv6_end_flv_psp_tests().

The host proxies are needed by all PSP testing. So move it to common
setup() and no need to delete.

The `set +e` is not added in the cleanup phase as del cmd usually doesn't
fail. And even it failed, we can catch it on setup phase.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 .../testing/selftests/net/srv6_end_flavors_test.sh | 71 ++++++++++++++++++++--
 1 file changed, 67 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/net/srv6_end_flavors_test.sh b/tools/testing/selftests/net/srv6_end_flavors_test.sh
index 5ebd6a0344d6..a57e92541a04 100755
--- a/tools/testing/selftests/net/srv6_end_flavors_test.sh
+++ b/tools/testing/selftests/net/srv6_end_flavors_test.sh
@@ -547,10 +547,6 @@ __setup_rt_policy()
 		add "${IPv6_HS_NETWORK}::${dst}" \
 		encap seg6 mode inline segs "${policy}" \
 		dev "${DUMMY_DEVNAME}"
-
-	ip -netns "${in_nsname}" -6 neigh \
-		add proxy "${IPv6_HS_NETWORK}::${dst}" \
-		dev "${RT2HS_DEVNAME}"
 }
 
 # see __setup_rt_policy
@@ -559,6 +555,57 @@ setup_rt_policy_ipv6()
 	__setup_rt_policy "$1" "$2" "$3"
 }
 
+cleanup_rt_policy_ipv6()
+{
+	local dst="$1"
+	local encap_rt="$2"
+	local policy_rts="$3"
+	local in_nsname
+	local rt_nsname
+	local function
+	local fullsid
+	local op_type
+	local node
+	local n
+
+	in_nsname="$(get_rtname "${encap_rt}")"
+
+	for n in ${policy_rts}; do
+		node="$(__get_srv6_rtcfg_id "${n}")"
+		op_type="$(__get_srv6_rtcfg_op "${n}")"
+		rt_nsname="$(get_rtname "${node}")"
+
+		case "${op_type}" in
+		"noflv")
+			function="${END_FUNC}"
+			;;
+
+		"psp")
+			function="${END_PSP_FUNC}"
+			;;
+
+		*)
+			break
+			;;
+		esac
+
+		fullsid="${LOCATOR_SERVICE}:${node}::${function}"
+
+		# Remove SRv6 Endpoint behavior for the selected router
+		# Skip noflv END_FUNC which is added in common setup.
+		if ! echo "${fullsid}" | grep -q "${END_FUNC}"; then
+			ip -netns "${rt_nsname}" -6 route \
+				del "${fullsid}" \
+				table "${LOCALSID_TABLE_ID}" \
+				dev "${DUMMY_DEVNAME}"
+		fi
+	done
+
+	# Remove SRv6 policy for incoming traffic sent by connected hosts
+	ip -netns "${in_nsname}" -6 route \
+		del "${IPv6_HS_NETWORK}::${dst}" dev "${DUMMY_DEVNAME}"
+}
+
 setup_hs()
 {
 	local hs="$1"
@@ -628,6 +675,14 @@ setup()
 	setup_rt_local_sids 3 "1 2 4"
 	setup_rt_local_sids 4 "1 2 3"
 
+	# setup proxy on route entries for hosts
+	ip -netns "$(get_rtname 1)" -6 neigh add \
+		proxy "${IPv6_HS_NETWORK}::2" \
+		dev "${RT2HS_DEVNAME}"
+	ip -netns "$(get_rtname 2)" -6 neigh add \
+		proxy "${IPv6_HS_NETWORK}::1" \
+		dev "${RT2HS_DEVNAME}"
+
 	# testing environment was set up successfully
 	SETUP_ERR=0
 }
@@ -652,6 +707,12 @@ setup_end_flv_psp()
 	setup_rt_policy_ipv6 1 2 "1:psp"
 }
 
+cleanup_end_flv_psp()
+{
+	cleanup_rt_policy_ipv6 2 1 "3:noflv 4:psp 2:psp"
+	cleanup_rt_policy_ipv6 1 2 "1:psp"
+}
+
 check_rt_connectivity()
 {
 	local rtsrc="$1"
@@ -754,6 +815,8 @@ host_srv6_end_flv_psp_tests()
 
 	check_and_log_hs_connectivity 1 2
 	check_and_log_hs_connectivity 2 1
+
+	cleanup_end_flv_psp
 }
 
 test_iproute2_supp_or_ksft_skip()

-- 
2.55.0

[PATCH net-next v2 5/5] selftests: seg6: add End.X PSP selftest

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

The current selftest only exercises End with PSP. Add a new test that
uses End.X on the PSP path so the kernel's End.X flavor handling is
validated end to end.

Extend __setup_rt_policy() to parse End.X action field from the
router description, allowing entries like:
  4:psp:End.X,4,2
  3:psp:End.X,3,1

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 .../testing/selftests/net/srv6_end_flavors_test.sh | 77 +++++++++++++++++++++-
 1 file changed, 75 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/srv6_end_flavors_test.sh b/tools/testing/selftests/net/srv6_end_flavors_test.sh
index a57e92541a04..4ba93ace8656 100755
--- a/tools/testing/selftests/net/srv6_end_flavors_test.sh
+++ b/tools/testing/selftests/net/srv6_end_flavors_test.sh
@@ -397,6 +397,36 @@ __get_srv6_rtcfg_op()
 		xargs | sed 's/ /,/g'
 }
 
+# Given the description of a router <id:op:act> as an input, the function
+# returns the <act> token which represents the action (e.g. End, End.X,
+# End.T behavior with or without route table, out interface) configured
+# for the node.
+#
+# Support End, End.X at present. When omit, return default End behavior.
+# i.e. input: "1:psp:End.X,1,3"
+#      output: "End.X nh6 fcf0:0:1:3::3 oif veth-rt-1-3"
+__get_srv6_rtcfg_act()
+{
+	local element="$1"
+	local net_prefix
+	local acts
+	local out
+
+	acts="$(echo "${element}" | cut -d':' -f3)"
+	act="$(echo "${acts}" | cut -d',' -f1)"
+	act="${act:-"End"}"
+
+	rt="$(echo "${acts}" | cut -d',' -f2)"
+	neigh="$(echo "${acts}" | cut -d',' -f3)"
+
+	if [ "$act" == "End" ]; then
+		echo "End"
+	elif [ "$act" == "End.X" ]; then
+		net_prefix="$(get_network_prefix "${rt}" "${neigh}")"
+		echo "End.X nh6 ${net_prefix}::${neigh} oif veth-rt-${rt}-${neigh}"
+	fi
+}
+
 # Setup the basic networking for the routers
 setup_rt_networking()
 {
@@ -497,6 +527,7 @@ __setup_rt_policy()
 	local function
 	local fullsid
 	local op_type
+	local action
 	local node
 	local n
 
@@ -505,19 +536,20 @@ __setup_rt_policy()
 	for n in ${policy_rts}; do
 		node="$(__get_srv6_rtcfg_id "${n}")"
 		op_type="$(__get_srv6_rtcfg_op "${n}")"
+		action="$(__get_srv6_rtcfg_act "${n}")"
 		rt_nsname="$(get_rtname "${node}")"
 
 		case "${op_type}" in
 		"noflv")
 			policy="${policy}${LOCATOR_SERVICE}:${node}::${END_FUNC},"
 			function="${END_FUNC}"
-			behavior_cfg="End"
+			behavior_cfg="${action}"
 			;;
 
 		"psp")
 			policy="${policy}${LOCATOR_SERVICE}:${node}::${END_PSP_FUNC},"
 			function="${END_PSP_FUNC}"
-			behavior_cfg="End flavors psp"
+			behavior_cfg="${action} flavors psp"
 			;;
 
 		*)
@@ -713,6 +745,30 @@ cleanup_end_flv_psp()
 	cleanup_rt_policy_ipv6 1 2 "1:psp"
 }
 
+setup_endx_flv_psp()
+{
+	# Direction hs-1 -> hs-2 (End.X PSP flavor)
+	# SID List=fcff:3::e,fcff:4::ef1,cafe::2
+	#  - rt-1 (SRv6 H.Insert policy)
+	#  - rt-3 (SRv6 End behavior)
+	#  - rt-4 (SRv6 End.X flavor PSP with SL=1, route to rt-2 via nh/oif)
+	#  - rt-2 (Route to hs-2 with same subnet)
+	#
+	# Direction hs-2 -> hs-1 (End.X PSP flavor)
+	# SID List=fcff:3::ef1,cafe::1
+	#  - rt-2 (SRv6 H.Insert policy)
+	#  - rt-3 (SRv6 End.X flavor PSP with SL=1, route to rt-1 via nh/oif)
+	#  - rt-1 (Route to hs-1 with same subnet)
+	setup_rt_policy_ipv6 2 1 "3:noflv:End 4:psp:End.X,4,2"
+	setup_rt_policy_ipv6 1 2 "3:psp:End.X,3,1"
+}
+
+cleanup_endx_flv_psp()
+{
+	cleanup_rt_policy_ipv6 2 1 "3:noflv 4:psp"
+	cleanup_rt_policy_ipv6 1 2 "3:psp"
+}
+
 check_rt_connectivity()
 {
 	local rtsrc="$1"
@@ -819,6 +875,22 @@ host_srv6_end_flv_psp_tests()
 	cleanup_end_flv_psp
 }
 
+host_srv6_endx_flv_psp_tests()
+{
+	set -e
+	SETUP_ERR=1
+	setup_endx_flv_psp
+	SETUP_ERR=0
+	set +e
+
+	log_section "SRv6 connectivity test hosts (h1 <-> h2, End.X flavor PSP)"
+
+	check_and_log_hs_connectivity 1 2
+	check_and_log_hs_connectivity 2 1
+
+	cleanup_endx_flv_psp
+}
+
 test_iproute2_supp_or_ksft_skip()
 {
 	local flavor="$1"
@@ -920,5 +992,6 @@ set +e
 router_tests
 host2gateway_tests
 host_srv6_end_flv_psp_tests
+host_srv6_endx_flv_psp_tests
 
 print_log_test_results

-- 
2.55.0

Re: [PATCH net-next v2 2/5] seg6: add RFC8986 flavor support for End.X

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] End.X now accepts the flavor pair NEXT-C-SID + PSP but only
  applies NEXT-C-SID.

--

seg6: add RFC8986 flavor support for End.X

This patch adds PSP flavor processing to the SRv6 End.X behavior by reusing
end_flv8986_core(). It also widens SEG6_LOCAL_END_X_FLV_SUPP_OPS so that
End.X advertises PSP support alongside NEXT-C-SID.

> diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
> index 4fcfcd48cfaed..521a9b0c09290 100644
> --- a/net/ipv6/seg6_local.c
> +++ b/net/ipv6/seg6_local.c
> @@ -121,7 +121,8 @@ struct bpf_lwt_prog {
>  
>  #define SEG6_LOCAL_END_FLV_SUPP_OPS	(SEG6_F_LOCAL_FLV_NEXT_CSID | \
>  					 SEG6_LOCAL_FLV8986_SUPP_OPS)
> -#define SEG6_LOCAL_END_X_FLV_SUPP_OPS	SEG6_F_LOCAL_FLV_NEXT_CSID
> +#define SEG6_LOCAL_END_X_FLV_SUPP_OPS	(SEG6_F_LOCAL_FLV_NEXT_CSID | \
> +					 SEG6_LOCAL_FLV8986_SUPP_OPS)
>  
>  struct seg6_flavors_info {
>  	/* Flavor operations */

[ ... ]

> @@ -923,12 +924,20 @@ static int input_action_end_x(struct sk_buff *skb, struct seg6_local_lwt *slwt)
>  {
>  	const struct seg6_flavors_info *finfo = &slwt->flv_info;
>  	__u32 fops = finfo->flv_ops;
> +	int ret;
> +
> +	if (!fops)
> +		return input_action_end_x_core(skb, slwt);
>  
>  	/* check for the presence of NEXT-C-SID since it applies first */
>  	if (seg6_next_csid_enabled(fops))
>  		return end_x_next_csid_core(skb, slwt);

[Severity: Medium]
Now that SEG6_LOCAL_END_X_FLV_SUPP_OPS is wider, what happens when an
End.X instance is configured with both next-csid and psp?

parse_nla_flavors() only rejects bits that fall outside the supported mask:

net/ipv6/seg6_local.c:parse_nla_flavors() {
    ...
	if (rc < 0 || (fops & ~supp_fops)) {
		NL_SET_ERR_MSG(extack, "Unsupported Flavor operation(s)");
		return -EOPNOTSUPP;
	}
    ...
}

So NEXT_CSID|PSP is now accepted for SEG6_LOCAL_ACTION_END_X. It gets
stored in flv_ops and reported back to userspace as configured.

On the data path, input_action_end_x() returns through the NEXT-C-SID
branch above and never reaches end_flv8986_core(). Once the C-SID argument
is used up, end_x_next_csid_core() falls back to plain End.X processing:

net/ipv6/seg6_local.c:end_x_next_csid_core() {
    ...
	if (seg6_next_csid_is_arg_zero(daddr, finfo))
		return input_action_end_x_core(skb, slwt);
    ...
}

input_action_end_x_core() only calls advance_nextseg() and then
input_action_end_x_finish(). It never calls seg6_pop_srh(), even when
SL == 1.

Does that mean the configured psp flavor is silently ignored, and packets
leave with the SRH still attached? A downstream node with seg6_enabled=0
would then drop them, and nothing reports an error at configuration time.

This also seems to contradict the comment above
seg6_flv_supp_ops_by_action():

 * ... if a user specifies a
 * flavor combination that is not supported by a given End* behavior, the
 * kernel refuses to instantiate the tunnel reporting the error.

Before this patch, End.X refused psp entirely. End already has the same
mismatch in input_action_end(); this patch carries it over to End.X.

The note below the --- line says this combination is not handled and that
Andrea is preparing a fix. That note won't be in the commit log, though.
Nothing in the code or the commit message rejects or documents the
combination, and net/ipv6/seg6_local.c is not changed again after this
patch.

Could parse_nla_flavors() reject NEXT_CSID combined with any RFC8986
flavor? Or could the End.X mask stay at SEG6_F_LOCAL_FLV_NEXT_CSID until
combined processing is in place?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009-srv6_flavors_endx-v2-0-56ac7f838f41%40kylinos.cn

Re: [PATCH net-next v2 3/5] selftests: seg6: move SRv6 End PSP setup into its own helper

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found more severe
issue(s) in other patches of this series. This mail is only an FYI, in case
you want to address the nit picks below when you respin.

Low priority / nit picks for your consideration:

- [Low] The comment in cleanup()
  (tools/testing/selftests/net/srv6_end_flavors_test.sh, lines 328-330)…

--

selftests: seg6: move SRv6 End PSP setup into its own helper

This commit moves the End PSP policy setup out of setup() and into a new
helper, setup_end_flv_psp(). host_srv6_end_flv_psp_tests() now calls that
helper with set -e and SETUP_ERR wrapped around it. cleanup() also changes
so that a setup error only gives SKIP when ret is not already ksft_fail.

> diff --git a/tools/testing/selftests/net/srv6_end_flavors_test.sh b/tools/testing/selftests/net/srv6_end_flavors_test.sh
> index 30a939392eea4..5ebd6a0344d69 100755
> --- a/tools/testing/selftests/net/srv6_end_flavors_test.sh
> +++ b/tools/testing/selftests/net/srv6_end_flavors_test.sh
> @@ -328,7 +328,7 @@ cleanup()
>  	# check whether the setup phase was completed successfully or not. In
>  	# case of an error during the setup phase of the testing environment,
>  	# the selftest is considered as "skipped".
> -	if [ "${SETUP_ERR}" -ne 0 ]; then
> +	if [ "${SETUP_ERR}" -ne 0 ] && [ "$ret" -ne "$ksft_fail" ]; then

[Severity: Low]
This isn't a bug, but the comment above this condition in cleanup() still
says that any setup error makes the selftest "skipped". Should it be
updated to match the new condition?

With this patch, host_srv6_end_flv_psp_tests() starts a second setup
phase after router_tests and host2gateway_tests have already run.

Suppose one of those earlier tests sets ret to ksft_fail, and then
setup_end_flv_psp() fails. cleanup() then runs with SETUP_ERR=1 and ret=1.
The SKIP branch is not taken, and the script exits 1 instead of
ksft_skip.

I couldn't find a later patch in the series that updates this comment.

>  		echo "SKIP: Setting up the testing environment failed"
>  		exit "${ksft_skip}"
>  	fi

[ ... ]

> @@ -741,7 +744,13 @@ host2gateway_tests()
>  
>  host_srv6_end_flv_psp_tests()
>  {
> -	log_section "SRv6 connectivity test hosts (h1 <-> h2, PSP flavor)"
> +	set -e
> +	SETUP_ERR=1
> +	setup_end_flv_psp
> +	SETUP_ERR=0
> +	set +e

[ ... ]

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009-srv6_flavors_endx-v2-0-56ac7f838f41%40kylinos.cn

Re: [PATCH net-next v2 5/5] selftests: seg6: add End.X PSP selftest

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 1

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The End.X PSP test in
  tools/testing/selftests/net/srv6_end_flavors_test.sh does not check…
- [Low] The patch adds an `<id:op:act>` descriptor syntax and an End.X
  PSP scenario, but the script's documentation was not updated.

--

selftests: seg6: add End.X PSP selftest

This commit adds an End.X PSP test to srv6_end_flavors_test.sh. A new
helper, __get_srv6_rtcfg_act(), lets __setup_rt_policy() parse an
optional action field in the router description, e.g. "4:psp:End.X,4,2".

> diff --git a/tools/testing/selftests/net/srv6_end_flavors_test.sh b/tools/testing/selftests/net/srv6_end_flavors_test.sh
> index a57e92541a046..4ba93ace86563 100755
> --- a/tools/testing/selftests/net/srv6_end_flavors_test.sh
> +++ b/tools/testing/selftests/net/srv6_end_flavors_test.sh
> @@ -397,6 +397,36 @@ __get_srv6_rtcfg_op()
>  		xargs | sed 's/ /,/g'
>  }
>  
> +# Given the description of a router <id:op:act> as an input, the function
> +# returns the <act> token which represents the action (e.g. End, End.X,
> +# End.T behavior with or without route table, out interface) configured
> +# for the node.
> +#
> +# Support End, End.X at present. When omit, return default End behavior.
> +# i.e. input: "1:psp:End.X,1,3"
> +#      output: "End.X nh6 fcf0:0:1:3::3 oif veth-rt-1-3"
> +__get_srv6_rtcfg_act()
> +{
> +	local element="$1"
> +	local net_prefix
> +	local acts
> +	local out
> +
> +	acts="$(echo "${element}" | cut -d':' -f3)"
> +	act="$(echo "${acts}" | cut -d',' -f1)"
> +	act="${act:-"End"}"
> +
> +	rt="$(echo "${acts}" | cut -d',' -f2)"
> +	neigh="$(echo "${acts}" | cut -d',' -f3)"
> +
> +	if [ "$act" == "End" ]; then
> +		echo "End"
> +	elif [ "$act" == "End.X" ]; then
> +		net_prefix="$(get_network_prefix "${rt}" "${neigh}")"
> +		echo "End.X nh6 ${net_prefix}::${neigh} oif veth-rt-${rt}-${neigh}"
> +	fi
> +}

[Severity: Low]
What should happen when act is something other than End or End.X? The
comment above mentions End.T, but there is no else branch. For End.T, a
typo, or a case mismatch, the function prints an empty string, and
__setup_rt_policy() builds:

    encap seg6local action  flavors psp

Under set -e that shows up as an environment setup SKIP, not as a clear
error in the test description.

A few smaller points in the same helper:

act, rt and neigh are not declared local, but the unused out is.

The End.X form repeats the node id ("4:psp:End.X,4,2") and never checks
that the two ids match.

Some existing comments in the file also look stale after this change:

The file header still says "Currently in this selftest we consider only
the PSP flavor for the SRv6 End behavior."

The Local SID table still says "fcff:x::ef1 is associated with the SRv6
End behavior with PSP flavor". In the new test, fcff:3::ef1 and
fcff:4::ef1 are End.X PSP.

The $3 description for __setup_rt_policy() still talks only about
<nodeid:op> elements and does not mention the new act field.

[ ... ]

> @@ -819,6 +875,22 @@ host_srv6_end_flv_psp_tests()
>  	cleanup_end_flv_psp
>  }
>  
> +host_srv6_endx_flv_psp_tests()
> +{
> +	set -e
> +	SETUP_ERR=1
> +	setup_endx_flv_psp
> +	SETUP_ERR=0
> +	set +e

[Severity: Medium]
Does this need a kernel support check for End.X with the PSP flavor?
The only kernel probe is "test_kernel_supp_or_ksft_skip psp", and it only
installs "action End flavors psp". It never tries End.X, End.X with
flavors, or End.X with oif.

Before the series commit "seg6: add RFC8986 flavor support for End.X",
net/ipv6/seg6_local.c had:

    #define SEG6_LOCAL_END_X_FLV_SUPP_OPS	SEG6_F_LOCAL_FLV_NEXT_CSID

On those kernels parse_nla_flavors() rejects "flavors psp" on End.X with
-EOPNOTSUPP.

When that happens, the End.X route add from setup_endx_flv_psp() fails
under set -e and the EXIT trap runs cleanup(). The earlier test groups
passed, so ret is still ksft_skip, and cleanup() takes this path:

	if [ "${SETUP_ERR}" -ne 0 ] && [ "$ret" -ne "$ksft_fail" ]; then
		echo "SKIP: Setting up the testing environment failed"
		exit "${ksft_skip}"
	fi

Would this turn a previous PASS on older or stable kernels into a SKIP
for the whole script? print_log_test_results() never runs, so the End
PSP results that already passed are dropped.

On a kernel that is supposed to support End.X PSP, a regression that
breaks this route install would also be reported as SKIP rather than
FAIL.

Could End.X PSP support be checked up front, so that only this test
group is skipped when the kernel lacks it?

> +
> +	log_section "SRv6 connectivity test hosts (h1 <-> h2, End.X flavor PSP)"
> +
> +	check_and_log_hs_connectivity 1 2
> +	check_and_log_hs_connectivity 2 1
> +
> +	cleanup_endx_flv_psp
> +}

[ ... ]

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009-srv6_flavors_endx-v2-0-56ac7f838f41%40kylinos.cn