Description

SONiC-VPP is a platform under SONIC that supports VPP data plane. For more details about VPP see What is VPP

This repo contains scripts, Makefiles, configuration file, Docker files etc to build a SONIC-VPP image. It also pulls some extra git repos and makes these repos part of SONiC build. In this process it will prompt for user/password while cloning. There are some VPP platform specific Makefile, config files which are applied to the sonic-buildimage repo to facilitate the successful build of the SONiC-VPP image.

Note: The first build takes good amount of time. The SONiC image build has two parts to it, backend and frontend. The backend consumes a lot of time when the build is done first time. The follow on builds only do the frontend.

Caveat- The documentation for this project is a work in progress and a bit terse. We hope to address this in coming weeks.

Prerequisites

• Linux host machine running Debian 12 ("Bookwork)", Ubuntu 18.x or later distribution (Ubuntu 20.x is preferred).
• Install the following packages

sudo apt-get install -y make automake autoconf
sudo apt install -y python3-pip
sudo pip3 install j2cli

• Install Docker and configure your system to allow running the 'docker' command without 'sudo':
  • Add current user to the docker group: sudo gpasswd -a ${USER} docker
  • Log out and log back in so that your group membership is re-evaluated

SONiC VPP image build

There are two types of sonic-vpp image build targets supported

• Single docker container image (docker-sonic-vpp.gz) with a subset of SONIC features
• Comprehensive SONiC-VPP qemu VM image

Building a single container image

git clone --recurse-submodules https://github.com/sonic-net/sonic-buildimage.git
cd sonic-buildimage
make init
NOBULLSEYE=1 NOBUSTER=1 make configure PLATFORM=vpp
NOBULLSEYE=1 NOBUSTER=1 BUILD_SKIP_TEST=y INCLUDE_FIPS=n \
    make SONIC_BUILD_JOBS=4 target/docker-sonic-vpp.gz

The two extra flags are currently required for the single-container target:

• INCLUDE_FIPS=n — the container pulls in libzmq3-dev, whose krb5-multidev dependency conflicts with the FIPS build of krb5 that ships in the base image when FIPS is enabled (the default). The single container is a reduced-feature demo/test image, so building it without FIPS is expected.
• BUILD_SKIP_TEST=y — skips a currently-failing upstream sonic-host-services unit test (unrelated to VPP). Drop it once that test is fixed upstream.

The build takes a while the first time (it also builds the sonic-slave container images). The Docker daemon that runs inside the slave container needs the legacy iptables kernel modules loaded on the host:

sudo modprobe ip_tables iptable_nat iptable_filter

Testing the single container image

Refer to the Getting started document in docs directory for details. NOTE: Unlike KVM image that goes through sonic-mgmt tests, there is no sanity test for container image.

Building a KVM VM image

1. git clone --recurse-submodules https://github.com/sonic-net/sonic-buildimage.git
2. make init
3. NOBULLSEYE=1 NOBUSTER=1 make configure PLATFORM=vpp
4. NOBULLSEYE=1 NOBUSTER=1 make SONIC_BUILD_JOBS=4 target/sonic-vpp.img.gz

Testing the qemu VM image

Refer to the document in docs directory for details.

How to run CI pipeline manually

CI pipeline runs vpp build and test. Below is the procedure to manually run the steps in the CI pipeline

NOBULLSEYE=1 NOBUSTER=1 NOBOOKWORM=1 make sonic-slave-bash
cd platform/vpp/vppbld
make ci-build; make ci-test

Or run some specific tests after ci-build

NOBULLSEYE=1 NOBUSTER=1 NOBOOKWORM=1 make sonic-slave-bash
cd platform/vpp/vppbld/repo
make test PLATFORM=vpp TEST=vxlan6.TestVxlan6.test_mcast_rcv*

VPP SAI compatibility CI

The Azure pipeline builds the Trixie VPP packages from the current commit and tests them with the VPP SAI unit-test framework published by sonic-sairedis. BuildSaiVppTestImage downloads the docker-sai-test-vpp artifact, replaces its libvppinfra, vpp, vpp-plugin-core, and vpp-plugin-dpdk packages with the current run's builds in a derivative image, verifies that every other Debian package is unchanged, and publishes combined provenance and checksums.

TestSaiVpp runs the four-module compatibility matrix on the sonictest pool. The expected matrix, stable-pass baseline, evaluator, and matrix generator come from the same sairedis artifact as the base image, so this repository does not carry a copy of sairedis test policy.

By default, the pipeline selects the latest successful (or partially successful) Azure.sonic-sairedis master artifact. Set the optional sairedis_run_id pipeline parameter to an Azure build ID to validate against a specific sairedis image. TestSaiVpp runs the test container with --privileged, so CI for pull requests from forks should only run after maintainer approval.

A failure in BuildSaiVppTestImage or TestSaiVpp shows as a red check on that job, but does not fail the run: the overall check stays green and the run ends partially succeeded. sairedis selects the latest successful or partially successful platform-vpp master run, so it still picks up VPP changes that break the SAI tests. A red SAI check on a pull request means the change is not compatible with the current sairedis and needs a sairedis follow-up.

For an intentional breaking change, prepare the sairedis fix first and validate the pair before merging: in the sairedis pull request, temporarily set the vpp_run_id default in azure-pipelines.yml to the platform-vpp pull request's Azure build ID (and, optionally, set sairedis_run_id in the platform-vpp pull request to the sairedis pull request's build ID). Remove the sairedis_run_id pin, if any, and merge the platform-vpp change, then remove the vpp_run_id override from the sairedis pull request so it runs against the new VPP master build.

Troubleshooting

http(s)_proxy driven make fails sometimes with package download failure. It says hash mismatch. This may be caused by some bug in the proxy which corrupts some bytes or downloaded package is incomplete. The fix is to run the make sonic_build again.

E: Failed to fetch http://debian-archive.trafficmanager.net/debian/pool/main/p/perl/libperl5.32_5.32.1-4%2bdeb11u2_amd64.deb  Hash Sum mismatch
   Hashes of expected file:
    - SHA256:224cafe65968deb83168113b74dff2d2f13b115a41d99eb209ed3b8f981df0b3
    - MD5Sum:4a5dab70f461660deab6fd03b2f991f6 [weak]
    - Filesize:4106072 [weak]
    - SHA512:6f65c014dc3d71538eeff28499e857315b001edf34b7d27f9ba63ba4ae84296b23a03cf4d3684f048d2cf3ae6591f961e808041015c8cbf87993b37fceae21fc
    - SHA1:70b59e8890820d4b278dee5bea5d6c09e94a5c6a [weak]
   Hashes of received file:
    - SHA512:62f8a2073aab62c19e5233c527057365e928d4c27eb37e0cb5081fd2982cda265ff7088baf4539af754333fa0625370e1b38e02715fba056e1f8bad1d589c2b1
    - SHA256:f7b2db46905d4209ffea09a103f8a1b6e836075a547d1cd173ea49a12ce2f6d0
    - SHA1:988a27690b32fafa9bed3a20574554bd27599e71 [weak]
    - MD5Sum:0816cefaa91ea671925de07760480d86 [weak]
    - Filesize:4106072 [weak]
   Last modification reported: Thu, 30 Sep 2021 21:42:11 +0000
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?