Wei Dai

Fix cross-switch stale interface routes in DSF Summary: Fix S648783 bug where remote interface route deletes in DSF only matched by prefix, not by interface ID. When two remote DSF switches independently restart with swapped interface IPs, one switch's old-address cleanup could delete a route that now belongs to the other switch. ## Problem Consider three DSF switches: A, B, and C (subscriber). Initial state on switch C (routes learned via DsfSubscriber): | Prefix | Next-hop intf | Owned by | |----------------------------------|---------------|----------| | 2401:db00:e702:50:1000::20/127 | intf 401 | Switch A | | 2401:db00:e702:58:1000::/127 | intf 501 | Switch B | Now switch A and B swap their interface IPs: Switch A: 2401:db00:e702:50:1000::21/127 → 2401:db00:e702:58:1000::1/127 Switch B: 2401:db00:e702:58:1000::1/127 → 2401:db00:e702:50:1000::21/127 Each restart triggers a separate DsfSubscriber update on switch C. The bug is symmetric — whichever switch restarts second triggers it. **Step 1 — Switch A restarts first (separate getUpdatedState call):** processRemoteInterfaceRoutes for changed intf 401: delete 2401:db00:e702:50:1000::20/127 (A's old prefix) add 2401:db00:e702:58:1000::/127 (A's new prefix = B's old prefix) The add overwrites the existing route for 2401:db00:e702:58:1000::/127 (previously owned by switch B's intf 501) via addOrReplaceRouteImpl. State on switch C after step 1: | Prefix | Next-hop intf | Owned by | Change | |----------------------------------|---------------|----------|-------------| | 2401:db00:e702:50:1000::20/127 | | | DELETED | | 2401:db00:e702:58:1000::/127 | intf 401 | Switch A | REPLACED | **Step 2 — Switch B restarts second (separate getUpdatedState call):** processRemoteInterfaceRoutes for changed intf 501: delete 2401:db00:e702:58:1000::/127 (B's old prefix = A's new prefix) add 2401:db00:e702:50:1000::20/127 (B's new prefix = A's old prefix) WITHOUT THE FIX — the RIB deletes 2401:db00:e702:58:1000::/127 because it only matches by prefix, not by interface. This removes switch A's route that was just added in step 1: | Prefix | Next-hop intf | Owned by | Change | |----------------------------------|---------------|----------|--------------| | 2401:db00:e702:50:1000::20/127 | intf 501 | Switch B | ADDED | | 2401:db00:e702:58:1000::/127 | | | BUG: DELETED | Switch A's route is LOST. Traffic to 2401:db00:e702:58:1000::/127 is blackholed until switch A's DsfSubscription does a full resync. WITH THE FIX — the RIB checks that the existing route's next-hop interface (intf 401) does NOT match the requesting interface (intf 501), so the delete is skipped: | Prefix | Next-hop intf | Owned by | Change | |----------------------------------|---------------|----------|--------------| | 2401:db00:e702:50:1000::20/127 | intf 501 | Switch B | ADDED | | 2401:db00:e702:58:1000::/127 | intf 401 | Switch A | (unchanged) | Both routes exist. ✓ ## Root cause RouterIDToPrefixes (the delete table) only stored CIDRNetwork prefixes without tracking which interface originated each delete. The RIB's delRoute matched only by prefix, so a delete from one remote switch could remove a route owned by a different switch. ## Fix 1. Changed RouterIDToPrefixes from vector<CIDRNetwork> to vector<pair<CIDRNetwork, InterfaceID>> (PrefixWithIntf), so each delete entry carries the originating interface ID. 2. In RibRouteTables::updateRemoteInterfaceRoutes, before deleting a route, look up the existing route and check if its next-hop interface matches the requesting interface. If the route was already replaced by a different interface (from a prior DSF update from another remote switch), skip the delete. Reviewed By: zechengh09 Differential Revision: D101811635 fbshipit-source-id: a8369d4181b2ca88eda1b09493764a47a5ad39d7

Program ACL table bind points Summary: Create separate SWITCH-bound and PORT-bound SAI ACL table groups identified by stage and bind point. Create ACL tables with the matching SAI bind point, attach multiple tables to the port-bound group, and process both switch-state group maps. Reviewed By: jasmeetbagga Differential Revision: D117445897 fbshipit-source-id: cda23e45a0d13a0704553a14508b14b80b067476

Gate SAI precoding on port config Summary: Program per-lane TX and RX precoding values from the platform mapping only when the matching optional port config is enabled and link training is disabled. Use the per-port linkTraining config directly instead of a separate ASIC/port support gate, and reject configs that enable linkTraining together with either TX or RX precoding. On live config transitions, independently apply mapped values or reset the direction that relinquishes manual precoding ownership. Reviewed By: jasmeetbagga Differential Revision: D115774691 fbshipit-source-id: 6f209634ea61e84d1713314c4fa1e2ea843f063b

Populate port-bound ingress ACL state Summary: Populate a separate stage-keyed port-bound ACL table group map in switch state, store `ingressAclTableName` on each port, and validate that the referenced table exists in the PORT-bound ingress group. Reuse the existing ACL config application flow with a small table-name lookup across the switch-bound and port-bound state maps. Reviewed By: jasmeetbagga Differential Revision: D117461521 fbshipit-source-id: 8d0d5a4a47d05806f187d84cf438d71a709dbc34

Filter local system ports from remote system ports Summary: Remote system ports are derived from global-scoped system ports. Filter local-scoped system ports before building the remote-system-port multi-switch map, since local system ports can be scoped to multiple local VOQ switches. Reviewed By: shri-khare Differential Revision: D109376321 fbshipit-source-id: 536e11c0ae1f820a658337a505aa5826a82e70db

Add `fboss2` cable length measurement trigger Summary: Add `fboss2 start port <ports> cable-length-measurement` to trigger one-shot cable length measurement through the HW agent thrift API. The command resolves queried port names to port IDs per HW agent and calls `triggerCableLengthMeasurement`. Reviewed By: simuthus-fb Differential Revision: D108769449 fbshipit-source-id: 459b801c4ca0f5b663ec3611ed8b05d053d940ac

Remove Trident2 ASIC support Summary: Remove `ASIC_TYPE_TRIDENT2`, `Trident2Asic`, BCM TD2 queue defaults, factory and build wiring, and the remaining Trident2-specific branches and tests from `fboss/agent`, since this is not used anywhere now. Simplify behavior shared by the remaining supported ASICs, including EAPOL and lookup-class qualifier setup and the 40G MAC loopback test. Reviewed By: Tianyu-Meta Differential Revision: D114112847 fbshipit-source-id: e9725aa92a2c91c86f8bf1fd561f9744238c39ea

Gate SAI precoding on port config Summary: re-apply D115774691, excluded linkTrainingSupportedOnPort part for now, this diff only focused on precoding programming. Program per-lane TX and RX precoding values from the platform mapping only when the matching optional port config is enabled. Preserve the `montblanc_precoding` flag as a fallback while port configs are populated, and reject configs that enable `linkTraining` together with either TX or RX precoding. Reviewed By: simuthus-fb Differential Revision: D117294466 fbshipit-source-id: 554918261fafca95f83a966efef78ddbdd08def3

Split SAI platform construction by vendor Summary: Just move around codes for now. This final goal of this diff stack is to make wedge_agent, wedge_agent_csco, wedge_agent_nvda binaries only build with related broadcom, cisco, nvidia platforms codes, respectively, see buck target improvements in later D113583401 Move SAI platform and port construction into vendor-specific translation units while preserving the existing broad source inclusion. This prepares the platform library for source-list narrowing without changing behavior in this layer. Reviewed By: simuthus-fb Differential Revision: D113583404 fbshipit-source-id: 72b03eb6c00649108de6981dc79183a5cc9dadee

Account for port range in DSF inband sysport ID Summary: processUpdatedDsfNodes() computed an interface node inband system-port ID as globalSystemPortOffset + inbandPortId. That works only when inbandPortId is an offset in the node's port range. On multi-NPU platforms where the configured inbandPortId is the absolute port ID, this can produce a non-existent interface ID. For DSF interface nodes modeled in switchIdToSwitchInfo, require the inband port ID to fall within the modeled portIdRange and include portIdRange.minimum when computing the system port ID. If the switch info or global system port offset is missing, or the modeled inband port is outside the range, throw FbossError instead of silently computing an invalid system port ID. Update the state tests that previously added an unmodeled remote interface DSF node at runtime to assert that this invalid config is rejected, while keeping fabric-node update coverage and direct RemoteInterfaceType::STATIC_ENTRY coverage. Reviewed By: simuthus-fb Differential Revision: D109384419 fbshipit-source-id: 34a029291fbed2d176523f13f69947be04f416c0