[vpp][copp] Unskip CoPP tests on sonic-vpp - #27726
Open
nhegde-microsoft wants to merge 9 commits into
Open
nhegde-microsoft wants to merge 9 commits into
nhegde-microsoft wants to merge 9 commits into
Conversation
sonic-sairedis and sonic-platform-vpp now implement genuine CoPP dataplane enforcement for the sonic-vpp platform via a new copp_punt_policer VPP device-input plugin (classify + police + punt for ARP, LACP, LLDP, UDLD, and TTL_ERROR control-plane traffic; BGP, DHCP/DHCPv6, and IP2ME already rode VPP's existing ip4/ip6-unicast policer-classify feature). Lift the copp skip for the specific subtests now validated passing: - test_verify_copp_configuration_cli - test_policer[ARP|LACP|LLDP|UDLD|Default|DHCP|DHCP6] Leave skipped (no dataplane support yet, or not yet exercised): - test_policer_mtu[IP2ME|SNMP|SSH|BGP] - test_trap_neighbor_miss - test_add_new_trap - test_remove_trap[delete_feature_entry|disable_feature_status] - test_trap_config_save_after_reboot Also add copp/test_copp.py to the t1-lag-vpp PR test list so these subtests actually run in CI once an image containing the fix is available, instead of just being reachable-but-never-scheduled. Depends on: - sonic-net/sonic-sairedis (nhegde-microsoft/sonic-sairedis@copp-vpp-enablement) - sonic-net/sonic-platform-vpp (nhegde-microsoft/sonic-platform-vpp@copp-vpp-enablement) - sonic-net/sonic-buildimage submodule bump (buildimage PR #29340) HLD: nhegde-microsoft/SONiC doc/vpp/vpp_copp_HLD.md (branch copp-vpp-enablement) Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
/azp run |
github-actions
Bot
requested review from
wangxin,
xwjiang-ms and
yutongzhang-microsoft
September 3, 2026 19:59
|
@StormLiangMS @wangxin @yxieca A user wants to merge changes to the conditional mark files into |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
The pre-commit check-conditional-mark-sort hook requires top-level keys in tests_mark_conditions_sonic_vpp.yaml to be alphabetically sorted. Reorder the copp entries (fallback key first, then per-subtest keys alphabetically) to satisfy this. Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Verified via a real DUT reboot on vlab-vpp-01 (config save + reboot + wait + verify): CoPP trap/policer configuration correctly persists across reboot. Also clarify the remaining copp: fallback skip reason with real test_policer_mtu results (BGP passes at all packet sizes; IP2ME/SNMP/SSH all fail with zero packets received -- a genuine, separate, pre-existing gap in the ip4/ip6-unicast policer-classify path unrelated to this effort's copp_punt_policer plugin, root cause not yet identified, so left skipped rather than claimed passing). Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
nhegde-microsoft
marked this pull request as ready for review
September 3, 2026 22:07
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
nhegde-microsoft
changed the title
The copp: block comment already documented BGP as passing at all packet sizes (verified 2026-09-08), but no per-test override entry was ever added for it, unlike ARP/DHCP/DHCP6/LACP/LLDP/UDLD/Default. Add the same conditions: ["False"] override, matching the HLD's existing Status table entry for this test. Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
nhegde-microsoft
changed the title
…gap in BGPTest Both tests passed live after fixing a false-failure in the PTF harness: BGPTest's BGP test packet uses ip_ttl=1, which also matches the separate, always-installed TTL_ERROR default trap (independent of the BGP trap's own state). The harness already excuses this exact platform behavior for broadcom/marvell-teralynx asic_types via a lenient check; added 'vpp' to that exception list in copp_tests.py so it gets the same treatment. Verified live on vlab-vpp-01: test_add_new_trap PASSED, test_remove_trap[delete_feature_entry] PASSED, test_remove_trap[disable_feature_status] PASSED. Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
Convert the copp: blanket skip + per-test conditions:["False"] override entries into a plain denylist matching the cacl section's convention: list only the tests that are still actually broken, with a real asic_type in ['vpp'] predicate, and let everything else run unconditionally. CoPP dataplane enforcement on vpp (copp_punt_policer VPP device-input plugin) now covers the large majority of copp/test_copp.py, so the blanket-skip-plus-overrides shape (appropriate when the section started from zero) no longer reflects reality. Only 3 real, still-failing combos remain: test_policer_mtu[IP2ME/SNMP/SSH] at all 3 packet sizes (zero packets received, suspected ip4-unicast classify-binding-scope gap, unrelated to the copp_punt_policer plugin). Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
…er_mtu[IP2ME/SNMP/SSH] - IP2METest/SNMPTest never set ip_src (defaulted to unroutable 192.168.0.1), which VPP's uRPF check silently dropped. Added ip_src=self.myip, matching SSHTest's existing pattern. - All 3 test_policer_mtu subtests (IP2ME/SNMP/SSH) now pass live on vlab-vpp-01 (RX PPS 600, within 540-780 window) with the new copp_ip2me_policer VPP plugin (ip4-punt arc). Removed the corresponding skip entries for VPP asic_type. Signed-off-by: Nikhil Hegde <nikhilhegde@microsoft.com>
nhegde-microsoft
force-pushed
the
copp-vpp-enablement
branch
from
September 10, 2026 18:43
0583a33 to
b47f820
Compare
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
tests/copp/test_copp.pywas fully skipped forasic_type in ['vpp']("Unsupported"). SONiC-VPP's SAI config plane for CoPP worked, butsaivpphad no dataplane mechanism to classify, rate-limit, or punt control-plane traffic.Companion PRs add real dataplane enforcement:
Do not merge yet — should land after the companion PRs merge and produce a real SONiC-VPP image.
How I did it
Removed the
copp:skip entirely intests/common/plugins/conditional_mark/tests_mark_conditions_sonic_vpp.yaml. Addedcopp/test_copp.pyto thet1-lag-vpplist in.azure-pipelines/pr_test_scripts.yaml(wasn't scheduled there before). Addedip_srctoIP2METest/SNMPTestpacket construction (previously defaulted to an unroutable address, failing VPP's uRPF check).How to verify it
Note on this PR's own CI: the scheduler builds against the currently-published image, which doesn't yet contain the companion fixes — this PR's CI is expected to still fail until those merge and a new image is built. All results below are from manual validation against a real image with the fix, on
vlab-vpp-01(t1-lag-vpp).All 24
tests/copp/test_copp.pysubtests pass — zero skips remaining.