From 4932bf6ee4ae6d507f28a592429116f485d99d90 Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Sat, 29 Aug 2026 09:37:28 +0000 Subject: [PATCH 1/8] [ci][do-not-merge] Point vpp and sairedis submodules at the ACL IN_PORTS branches Build a test image carrying the SAI ACL IN_PORTS support so it can be deployed to a dual-ToR VPP testbed. The two changes are a matched pair and cannot be tested apart. Adding in_sw_if_index to the VPP acl_rule type changes the layout of the acl_add_replace message and therefore its CRC, so a syncd built against one side cannot program ACLs on the other. platform/vpp -> lolyu/acl_match_in_port sonic-net/sonic-platform-vpp#278 src/sonic-sairedis -> lolyu/vpp_acl_in_port_match sonic-net/sonic-sairedis#2064 vpp.mk carries VPP_VERSION 2606-0.6 for the new patch series. That deb is not published, so the download step fails and vppbld/Makefile falls back to build_locally, which applies the patch series and builds VPP from source. The image build therefore also verifies that the patch applies and compiles under the real build flags. Signed-off-by: Longxiang Lyu Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Longxiang Lyu --- .gitmodules | 6 ++++-- platform/vpp | 2 +- src/sonic-sairedis | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitmodules b/.gitmodules index 7a75dfb0711..1f160f3190a 100644 --- a/.gitmodules +++ b/.gitmodules @@ -6,7 +6,8 @@ url = https://github.com/sonic-net/sonic-linux-kernel [submodule "sonic-sairedis"] path = src/sonic-sairedis - url = https://github.com/sonic-net/sonic-sairedis + url = https://github.com/lolyu/sonic-sairedis + branch = vpp_acl_in_port_match [submodule "sonic-swss"] path = src/sonic-swss url = https://github.com/sonic-net/sonic-swss @@ -128,7 +129,8 @@ url = https://github.com/Marvell-switching/sonic-platform-marvell.git [submodule "platform/vpp"] path = platform/vpp - url = https://github.com/sonic-net/sonic-platform-vpp.git + url = https://github.com/lolyu/sonic-platform-vpp.git + branch = acl_match_in_port [submodule "platform/marvell-prestera/mrvl-prestera"] path = platform/marvell-prestera/mrvl-prestera url = https://github.com/Marvell-switching/mrvl-prestera.git diff --git a/platform/vpp b/platform/vpp index a38dedf1eb7..5bc79f73467 160000 --- a/platform/vpp +++ b/platform/vpp @@ -1 +1 @@ -Subproject commit a38dedf1eb7b855a9dbd7ff75df8112e37af9757 +Subproject commit 5bc79f73467cfb0f4eb7b9cf18265c76c80e6dc6 diff --git a/src/sonic-sairedis b/src/sonic-sairedis index f6344f0b746..42594a4194e 160000 --- a/src/sonic-sairedis +++ b/src/sonic-sairedis @@ -1 +1 @@ -Subproject commit f6344f0b746a024f248b8b41cdf3ea6830aca28f +Subproject commit 42594a4194e9263aa570eba615d0369439ece467 From 44528a6d97b2a27346047609ebbedfca83fe15c7 Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Mon, 31 Aug 2026 05:37:13 +0000 Subject: [PATCH 2/8] [ci][do-not-merge] Add the intfsorch VLAN RIF MAC fix to the test image The first test image built from this PR failed every dualtor server traffic case: servers sent to their gateway and nothing came back. The ACL work is not at fault. A VPP trace on vlab-vpp-03 shows the frame is permitted by the ACL and then dropped two nodes later: acl-plugin-in-ip4-l2 action: 1 (permit), acl 1 rule 0 lsb_of_sw_if_index 22 l2-fwd dst 00:aa:bb:cc:dd:ee result [0xffff..., -1] error-drop l2-fwd: L2 forward misses bvi1000 carries the switch MAC 22:ff:ab:76:97:c0 while Vlan1000 in the kernel carries the shared gateway MAC 00:aa:bb:cc:dd:ee, and the bridge domain has unknown-unicast flooding set to drop. Every frame a server sends to its default gateway therefore misses the L2 FIB and is dropped. That is sonic-net/sonic-swss#4816: IntfsOrch::doTask() creates the RIF with the VLAN MAC and then immediately overwrites it with gMacAddress. The reference PR 29062 carried that branch; omitting it here left the testbed unable to route any server traffic. Point src/sonic-swss at test_vpp_acl_in_ports_swss, which is the current buildimage master pointer 93fc008c with the two fix commits cherry-picked on top. The PR branch itself is 18 commits behind that pointer, so using it directly would have regressed swss. Signed-off-by: Longxiang Lyu Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Longxiang Lyu --- .gitmodules | 3 ++- src/sonic-swss | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitmodules b/.gitmodules index 1f160f3190a..e0bdb7f7716 100644 --- a/.gitmodules +++ b/.gitmodules @@ -10,7 +10,8 @@ branch = vpp_acl_in_port_match [submodule "sonic-swss"] path = src/sonic-swss - url = https://github.com/sonic-net/sonic-swss + url = https://github.com/lolyu/sonic-swss + branch = test_vpp_acl_in_ports_swss [submodule "src/p4c-bm/p4c-bm"] path = platform/p4/p4c-bm/p4c-bm url = https://github.com/krambn/p4c-bm diff --git a/src/sonic-swss b/src/sonic-swss index ffb60db7299..8855e07074b 160000 --- a/src/sonic-swss +++ b/src/sonic-swss @@ -1 +1 @@ -Subproject commit ffb60db7299a209ba927539d1a541f5e460dbf58 +Subproject commit 8855e07074b86fb05ff8ed2a94041be98aa0a6a4 From 88352225530d7012f2893cc3a61d6a8cbbbfb899 Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Tue, 1 Sep 2026 12:38:33 +0000 Subject: [PATCH 3/8] [ci][do-not-merge] Pick up the ACL policy-drop counter fix Bump platform/vpp to 3f6f3f8, which adds VPP patch 0019 so an ACL deny no longer increments the ingress interface drop counter. The previous test image passed dualtor traffic correctly but failed dualtor_io/test_normal_op.py::test_upstream_standby_rx_drop_check: Ethernet16 on the standby ToR reported RX_DRP +5706 against a threshold of 10, because VPP charged every intentional ACL deny to /if/drops, which surfaces as RX_DRP. VPP_VERSION moves to 2606-0.7 with this bump, so the image build will again build VPP from source rather than fetching a cached deb. Signed-off-by: Longxiang Lyu Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Longxiang Lyu --- platform/vpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/vpp b/platform/vpp index 5bc79f73467..3f6f3f8de46 160000 --- a/platform/vpp +++ b/platform/vpp @@ -1 +1 @@ -Subproject commit 5bc79f73467cfb0f4eb7b9cf18265c76c80e6dc6 +Subproject commit 3f6f3f8de4653e1257e0bb820619c678d3ac3e36 From 129df7a4135ee5239970e31db9260639f5d29eba Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Wed, 2 Sep 2026 05:58:22 +0000 Subject: [PATCH 4/8] [ci][do-not-merge] Refresh the ACL IN_PORTS test submodules sonic-platform-vpp: the branch this pointed at carried both the IN_PORTS plugin patch and the ACL policy-drop counter fix. Those have since been split into two independent PRs (#278 and #280), so no single review branch holds both any more. Point at test_acl_in_ports_combined, which merges them for CI only, with the patches renumbered 0018/0019 and VPP_VERSION at 2606-0.7 - the same combination already validated on the vms-kvm-dual-vpp-t0-1 testbed. Note that merging the two branches conflicts only in patches/series; rules/vpp.mk auto-resolves silently because both sides set 2606-0.6 identically, so the version was bumped to 0.7 by hand. Leaving it at 0.6 would have published a deb under a version minted for one patch series while containing two. sonic-sairedis: pick up the egress-stage guard, so an IN_PORTS entry in an egress table emits no rule instead of being matched against the TX interface. Signed-off-by: Longxiang Lyu --- .gitmodules | 2 +- platform/vpp | 2 +- src/sonic-sairedis | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitmodules b/.gitmodules index e0bdb7f7716..0f8fe8c44c6 100644 --- a/.gitmodules +++ b/.gitmodules @@ -131,7 +131,7 @@ [submodule "platform/vpp"] path = platform/vpp url = https://github.com/lolyu/sonic-platform-vpp.git - branch = acl_match_in_port + branch = test_acl_in_ports_combined [submodule "platform/marvell-prestera/mrvl-prestera"] path = platform/marvell-prestera/mrvl-prestera url = https://github.com/Marvell-switching/mrvl-prestera.git diff --git a/platform/vpp b/platform/vpp index 3f6f3f8de46..326e8c4169a 160000 --- a/platform/vpp +++ b/platform/vpp @@ -1 +1 @@ -Subproject commit 3f6f3f8de4653e1257e0bb820619c678d3ac3e36 +Subproject commit 326e8c4169a2b87680af76cb6f817c58d27411df diff --git a/src/sonic-sairedis b/src/sonic-sairedis index 42594a4194e..e0de9e7119e 160000 --- a/src/sonic-sairedis +++ b/src/sonic-sairedis @@ -1 +1 @@ -Subproject commit 42594a4194e9263aa570eba615d0369439ece467 +Subproject commit e0de9e7119eabb71f764ebfecfb231df3a68903a From 48bdb7bd7bfb940684dbcd8db019a22d710be24d Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Thu, 3 Sep 2026 04:19:38 +0000 Subject: [PATCH 5/8] [ci][do-not-merge] Swap the two VPP ACL patch numbers The IN_PORTS patch had been renumbered to 0019 when the policy-drop fix was split into its own PR and took 0018. 0018 is the next free slot after master's 0017, and it belongs to the feature PR, so the two have been swapped back: sonic-platform-vpp#278 is 0018 and #280 is 0019. Numbers only; the patch contents are unchanged and the two touch disjoint files, so the combined series still applies in either order. VPP_VERSION stays at 2606-0.7 for the CI image. Signed-off-by: Longxiang Lyu --- platform/vpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/vpp b/platform/vpp index 326e8c4169a..02abe7d3228 160000 --- a/platform/vpp +++ b/platform/vpp @@ -1 +1 @@ -Subproject commit 326e8c4169a2b87680af76cb6f817c58d27411df +Subproject commit 02abe7d3228b64220a4614aa5e4e197f5ca2dd56 From 317f654db7102717e33390344746aed34d42bcd9 Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Thu, 3 Sep 2026 07:59:32 +0000 Subject: [PATCH 6/8] [ci][do-not-merge] Pick up the IN_PORTS resolution-failure fix sonic-sairedis: an entry whose IN_PORTS cannot be resolved now emits no rule for that entry instead of failing the whole ACL table. Relevant to this image because IngressTableDrop is shared between MuxOrch and the PFC watchdog, so the old behaviour could freeze the mux drop table on a startup port-ordering race. Signed-off-by: Longxiang Lyu --- src/sonic-sairedis | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sonic-sairedis b/src/sonic-sairedis index e0de9e7119e..a6f0a407b32 160000 --- a/src/sonic-sairedis +++ b/src/sonic-sairedis @@ -1 +1 @@ -Subproject commit e0de9e7119eabb71f764ebfecfb231df3a68903a +Subproject commit a6f0a407b32bfc927bbc881139e3fa5b7495bd2b From 3f935f359c6be94c8966625444103c1af28e4c60 Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Thu, 3 Sep 2026 12:07:24 +0000 Subject: [PATCH 7/8] [ci][do-not-merge] Point platform/vpp at the policy-drop branch sonic-platform-vpp#278 has merged, so the hand-merged test_acl_in_ports_combined branch is no longer needed: patch 0018 is on master and #280 has been rebased onto it, which leaves that branch carrying both patches at VPP_VERSION 2606-0.7 by itself. Point the submodule at acl_policy_drop_not_if_drop instead. The tree is identical to the combined branch apart from one stray blank line in series, so this changes nothing about what is built, but the image now tracks a branch that is actually under review rather than a throwaway merge that has to be re-created by hand every time either side moves. Signed-off-by: Longxiang Lyu --- .gitmodules | 2 +- platform/vpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitmodules b/.gitmodules index 0f8fe8c44c6..72fa5e14726 100644 --- a/.gitmodules +++ b/.gitmodules @@ -131,7 +131,7 @@ [submodule "platform/vpp"] path = platform/vpp url = https://github.com/lolyu/sonic-platform-vpp.git - branch = test_acl_in_ports_combined + branch = acl_policy_drop_not_if_drop [submodule "platform/marvell-prestera/mrvl-prestera"] path = platform/marvell-prestera/mrvl-prestera url = https://github.com/Marvell-switching/mrvl-prestera.git diff --git a/platform/vpp b/platform/vpp index 02abe7d3228..a35d58072d5 160000 --- a/platform/vpp +++ b/platform/vpp @@ -1 +1 @@ -Subproject commit 02abe7d3228b64220a4614aa5e4e197f5ca2dd56 +Subproject commit a35d58072d536167b353ab84fad95e0d26771937 From f0d588a399939f7faea13cb056e12819731cb58e Mon Sep 17 00:00:00 2001 From: Longxiang Lyu Date: Sat, 5 Sep 2026 07:23:15 +0000 Subject: [PATCH 8/8] [ci][do-not-merge] Pick up the ACL attribute truncation warning sonic-sairedis: warn when an ACL entry's attribute dump hits MAX_ACL_ATTRS, since resolving IN_PORTS now depends on that qualifier surviving a cap that drops attributes by name order. Signed-off-by: Longxiang Lyu --- src/sonic-sairedis | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sonic-sairedis b/src/sonic-sairedis index 0c92e8b5e50..b51bb24f0fe 160000 --- a/src/sonic-sairedis +++ b/src/sonic-sairedis @@ -1 +1 @@ -Subproject commit 0c92e8b5e50f68106de7df894e9d899d0a6ba71f +Subproject commit b51bb24f0fe67917a56e52baf111745f43ba42f8