ipsec: fix AES CBC IV generation (CVE-2022-46397)

For AES-CBC, the IV must be unpredictable (see NIST SP800-38a Appendix
C). Chaining IVs like is done by ipsecmb and native backends for the
VNET_CRYPTO_OP_FLAG_INIT_IV is fully predictable.
Encrypt a counter as part of the message, making the (predictable)
counter-generated IV unpredictable.

Fixes: VPP-2037
Type: fix

Change-Id: If4f192d62bf97dda553e7573331c75efa11822ae
Signed-off-by: Benoît Ganne <bganne@cisco.com>

.clang-format

@@ -1,48 +1,38 @@
-# Minimal clang-format version is 11
-
-BasedOnStyle: GNU
-UseTab: Always
-SpaceAfterCStyleCast: true
+---
+AlignEscapedNewlinesLeft: true
+AlignTrailingComments: true
+AllowAllParametersOfDeclarationOnNextLine: true
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: false
+AlwaysBreakBeforeMultilineStrings: false
+BreakBeforeBinaryOperators: false
+BreakBeforeTernaryOperators: true
+BinPackParameters: true
+BreakBeforeBraces: GNU
+ColumnLimit:     79
+IndentCaseLabels: false
+MaxEmptyLinesToKeep: 1
+PenaltyBreakBeforeFirstCallParameter: 19
+PenaltyBreakComment: 60
+PenaltyBreakString: 1000
+PenaltyBreakFirstLessLess: 120
+PenaltyExcessCharacter: 1000000
+PenaltyReturnTypeOnItsOwnLine: 60
+PointerBindsToType: false
+SpaceBeforeAssignmentOperators: true
+SpaceBeforeParens: Always
+SpacesBeforeTrailingComments: 1
+SpacesInParentheses: false
+SpaceInEmptyParentheses: false
+SpacesInCStyleCastParentheses: false
+SpaceAfterControlStatementKeyword: true
+Cpp11BracedListStyle: true
+Standard:        Cpp11
 SortIncludes: false
-AlignConsecutiveMacros: true
-BreakBeforeTernaryOperators: false
-BreakBeforeBinaryOperators: None
-ContinuationIndentWidth: 2
-
-ForEachMacros:
-  - 'clib_bitmap_foreach'
-  - 'pool_foreach'
-  - 'pool_foreach_index'
-  - 'pool_foreach_pointer'
-  - 'vec_foreach'
-  - 'vec_foreach_backwards'
-  - 'vec_foreach_index'
-  - 'vec_foreach_index_backwards'
-  - 'vec_foreach_pointer'
-  - 'vlib_foreach_rx_tx'
-  - 'foreach_int'
-  - 'foreach_pointer'
-  - 'foreach_vlib_main'
-  - 'foreach_set_bit_index'
-  - 'foreach_vlib_frame_bitmap_set_bit_index'
-  - 'FOREACH_ARRAY_ELT'
-  - 'RTE_ETH_FOREACH_DEV'
-  - 'foreach_vnet_dev_rx_queue_runtime'
-  - 'foreach_vnet_dev_counter'
-  - 'foreach_vnet_dev_port_rx_queue'
-  - 'foreach_vnet_dev_port_tx_queue'
-  - 'foreach_vnet_dev_port'
-  - 'foreach_vnet_dev_args'
-  - 'foreach_vnet_dev_port_args'
-
-StatementMacros:
-  - 'CLIB_MULTIARCH_FN'
-  - 'VLIB_NODE_FN'
-  - 'VNET_DEV_NODE_FN'
-  - 'VNET_DEVICE_CLASS_TX_FN'
-  - '__clib_section'
-  - '__clib_aligned'
-
-WhitespaceSensitiveMacros:
-  - 'WARN_ON'
-  - 'WARN_OFF'
+IndentWidth:     2
+TabWidth:        4
+UseTab:          Never
+IndentFunctionDeclarationAfterType: false
+ContinuationIndentWidth: 4
+...

.clang-tidy

@@ -1,8 +0,0 @@
-Checks: "-*,\
-misc-*,\
-bugprone-*,\
--bugprone-reserved-identifier,\
--performance-*,\
-clang-analyzer-*,\
--clang-analyzer-valist.Uninitialized,\
-"

.github/workflows/close_prs.yml

@@ -1,21 +0,0 @@
----
-name: Close Pull Request
-
-on:
-  pull_request_target:
-    types: [opened]
-
-jobs:
-  run:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: superbrothers/close-pull-request@v3
-      with:
-        # Optional. Post a issue comment just before closing a pull request.
-        comment: "Thank you so much for your interest!  VPP takes patches at https://gerrit.fd.io/
-
-```
-git clone https://gerrit.fd.io/r/vpp
-```
-
-Using [git review](https://www.mediawiki.org/wiki/Gerrit/git-review) to contribute patches is recommended"

.gitignore

@@ -10,19 +10,21 @@
 /build-root/path_setup
 /build-root/deb/debian/vpp-plugins/
 /build-root/deb/.pybuild/
-/build-root/*.buildinfo
 /build-root/*.deb
 /build-root/*.rpm
 /build-root/*.tar.xz
 /build-root/*.changes
 /build-root/rpmbuild/
-/build-root/test-coverage/
-/build-root/test/
+/build-root/test-doc/
+/build-root/test-cov/
+/test/run/
+/test/build/
+/test/coverage/
 /build-config.mk
 /build/external/*.tar.gz
 /build/external/*.tar.xz
-/build/external/vpp-*
-/build/external/dpdk_mlx_default.sh
+/build/external/vpp-*.deb
+/build/external/vpp-*.changes
 /build/external/downloads/
 /path_setup
 /tools/
@@ -37,6 +39,7 @@ config.log
 config.guess
 config.sub
 config.status
+configure
 configure.scan
 coverage_report
 depcomp
@@ -77,12 +80,14 @@ GTAGS
 /build-root/docs
 /build-root/.doxygen-bootstrap.ok
 /build-root/.doxygen-siphon.dep
-/docs/venv
+/docs/_build
+/docs/dynamic_includes
+/sphinx_venv
+!/docs/Makefile
 
 # language servers
 compile_commands.json
 .clangd
-.cache
 
 # indent backup files
 *.BAK
@@ -108,32 +113,3 @@ compile_commands.json
 
 # extras gomemif build files
 /extras/gomemif/bazel*
-
-# vpptop build files
-/extras/vpptop/build/*
-
-# debian packaging
-.pc
-
-# No test log files
-**/test-run-*-*-*
-
-# host stack test framework
-/extras/hs-test/vpp-data
-/extras/hs-test/hs-test
-/extras/hs-test/http_server
-/extras/hs-test/.build.ok
-/extras/hs-test/summary/
-
-# ./configure
-/CMakeFiles
-/bin
-/lib
-/.ninja_deps
-/.ninja_log
-/.cmake
-/CMakeCache.txt
-/build.ninja
-/cmake_install.cmake
-/startup.conf
-/startup.vpp

.gitreview

@@ -2,4 +2,4 @@
 host=gerrit.fd.io
 port=29418
 project=vpp
-defaultbranch=stable/2406
+defaultbranch=stable/2009

INFO.yaml

@@ -4,11 +4,11 @@ project_creation_date: '2015-12-08'
 project_category: ''
 lifecycle_state: 'Incubation'
 project_lead: &vpp_ptl
-    name: 'Damjan Marion'
-    email: 'dmarion@me.com'
-    id: 'dmarion'
-    company: 'cisco'
-    timezone: 'Europe/Zagreb'
+    name: 'Dave Barach'
+    email: 'openvpp@barachs.net'
+    id: 'dbarach'
+    company: ''
+    timezone: ''
 primary_contact: *vpp_ptl
 issue_tracking:
     type: 'jira'
@@ -38,68 +38,74 @@ committers:
       company: 'cisco'
       email: 'openvpp@barachs.net'
       id: 'dbarach'
+      timezone: ''
     - name: 'Florin Coras'
       company: 'cisco'
       email: 'florin.coras@gmail.com'
       id: 'florin.coras'
+      timezone: ''
     - name: 'Benoit Ganne'
       company: 'cisco'
       email: 'bganne@cisco.com'
       id: 'bganne'
+      timezone: ''
     - name: 'John Lo'
       company: 'cisco'
       email: 'loj@cisco.com'
       id: 'lojohn'
+      timezone: ''
     - name: 'Chris Luke'
       company: 'comcast'
       email: 'chris_luke@comcast.com'
       id: 'chrisluke'
+      timezone: ''
+    - name: 'Damjan Marion'
+      company: 'cisco'
+      email: 'damarion@cisco.com'
+      id: 'dmarion'
+      timezone: ''
     - name: 'Neale Ranns'
       company: 'cisco'
       email: 'nranns@cisco.com'
       id: 'nranns'
+      timezone: ''
     - name: 'Matthew Smith'
       company: 'netgate'
       email: 'mgsmith@netgate.com'
       id: 'mgsmith'
+      timezone: ''
     - name: 'Ole Trøan'
       company: 'employees'
       email: 'otroan@employees.org'
       id: 'otroan'
+      timezone: ''
     - name: 'Paul Vinciguerra'
       company: 'vinciconsulting'
       email: 'pvinci@vinciconsulting.com'
       id: 'pvinci'
+      timezone: ''
     - name: 'Dave Wallace'
       company: 'gmail'
       email: 'dwallacelf@gmail.com'
       id: 'dwallacelf'
+      timezone: ''
     - name: 'Ed Warnicke'
       company: 'gmail'
       email: 'hagbard@gmail.com'
       id: 'hagbard'
+      timezone: ''
     - name: 'Andrew Yourtchenko'
       company: 'cisco'
       email: 'ayourtch@cisco.com'
       id: 'ayourtch'
-    - name: 'Fan Zhang'
-      company: 'intel'
-      email: 'roy.fan.zhang@intel.com'
-      id: 'royzhang1980'
-    - name: 'Mohammed HAWARI'
-      company: 'cisco'
-      email: 'momohawari@gmail.com'
-      id: 'momohawari'
+      timezone: ''
 tsc:
     # yamllint disable rule:line-length
-    approval: 'https://wiki.fd.io/view/TSC/Meeting_Minutes'
+    approval: ''
     changes:
-        - type: 'Promotion'
-          name: 'Damjan Marion'
-          link: 'https://lists.fd.io/g/vpp-dev/message/17521'
-        - type: 'Addition'
-          name: 'Fan Zhang'
-          link: 'https://lists.fd.io/g/vpp-dev/message/19068'
-        - type: 'Approval'
-          name: 'Mohammed HAWARI'
-          link: 'https://ircbot.wl.linuxfoundation.org/meetings/fdio-meeting/2023/fd_io_tsc/fdio-meeting-fd_io_tsc.2023-06-01-15.00.html'
+        - type: 'removal'
+          name: ''
+          link: ''
+        - type: 'promotion'
+          name: ''
+          link: ''

README.md

@@ -19,32 +19,32 @@ For more information on VPP and its features please visit the
 ## Changes
 
 Details of the changes leading up to this version of VPP can be found under
-doc/releasenotes.
+@ref release_notes.
 
 
 ## Directory layout
 
 | Directory name         | Description                                 |
 | ---------------------- | ------------------------------------------- |
-| build-data             | Build metadata                              |
-| build-root             | Build output directory                      |
-| docs                   | Sphinx Documentation                        |
-| dpdk                   | DPDK patches and build infrastructure       |
-| extras/libmemif        | Client library for memif                    |
-| src/examples           | VPP example code                            |
-| src/plugins            | VPP bundled plugins directory               |
-| src/svm                | Shared virtual memory allocation library    |
-| src/tests              | Standalone tests (not part of test harness) |
-| src/vat                | VPP API test program                        |
-| src/vlib               | VPP application library                     |
-| src/vlibapi            | VPP API library                             |
-| src/vlibmemory         | VPP Memory management                       |
-| src/vnet               | VPP networking                              |
-| src/vpp                | VPP application                             |
-| src/vpp-api            | VPP application API bindings                |
-| src/vppinfra           | VPP core library                            |
-| src/vpp/api            | Not-yet-relocated API bindings              |
-| test                   | Unit tests and Python test harness          |
+|      build-data        | Build metadata                              |
+|      build-root        | Build output directory                      |
+|      doxygen           | Documentation generator configuration       |
+|      dpdk              | DPDK patches and build infrastructure       |
+| @ref extras/libmemif   | Client library for memif                    |
+| @ref src/examples      | VPP example code                            |
+| @ref src/plugins       | VPP bundled plugins directory               |
+| @ref src/svm           | Shared virtual memory allocation library    |
+|      src/tests         | Standalone tests (not part of test harness) |
+|      src/vat           | VPP API test program                        |
+| @ref src/vlib          | VPP application library                     |
+| @ref src/vlibapi       | VPP API library                             |
+| @ref src/vlibmemory    | VPP Memory management                       |
+| @ref src/vnet          | VPP networking                              |
+| @ref src/vpp           | VPP application                             |
+| @ref src/vpp-api       | VPP application API bindings                |
+| @ref src/vppinfra      | VPP core library                            |
+| @ref src/vpp/api       | Not-yet-relocated API bindings              |
+|      test              | Unit tests and Python test harness          |
 
 ## Getting started
 
@@ -99,3 +99,8 @@ end-user-oriented information. Also see @subpage dev_doc for developer notes.
 Visit the [VPP wiki](https://wiki.fd.io/view/VPP) for details on more
 advanced building strategies and other development notes.
 
+
+## Test Framework
+
+There is PyDoc generated documentation available for the VPP test framework.
+See @ref test_framework_doc for details.

build-data/packages/external.mk

@@ -29,17 +29,32 @@ ifneq ($(DPDK_MLX5_PMD),)
 DPDK_MAKE_ARGS += DPDK_MLX5_PMD=y
 endif
 
+DPDK_MLX_IBVERBS_DLOPEN=$(strip $($(PLATFORM)_uses_dpdk_ibverbs_link_dlopen))
+ifneq ($(DPDK_MLX_IBVERBS_DLOPEN),)
+DPDK_MAKE_ARGS += DPDK_MLX_IBVERBS_DLOPEN=y
+endif
+
 DPDK_MLX4_PMD=$(strip $($(PLATFORM)_uses_dpdk_mlx4_pmd))
 ifneq ($(DPDK_MLX4_PMD),)
 DPDK_MAKE_ARGS += DPDK_MLX4_PMD=y
 endif
 
-ifeq ("$(V)","1")
-DPDK_MAKE_ARGS += DPDK_VERBOSE=1
+DPDK_PLATFORM_TARGET=$(strip $($(PLATFORM)_dpdk_target))
+ifneq ($(DPDK_PLATFORM_TARGET),)
+DPDK_MAKE_ARGS += DPDK_TARGET=$(DPDK_PLATFORM_TARGET)
+endif
+
+ifneq (,$(TARGET_PLATFORM))
+DPDK_MAKE_ARGS += DPDK_AARCH64_GENERIC=n
+endif
+
+DPDK_MAKE_EXTRA_ARGS = $(strip $($(PLATFORM)_dpdk_make_extra_args))
+ifneq ($(DPDK_MAKE_EXTRA_ARGS),)
+DPDK_MAKE_ARGS += DPDK_MAKE_EXTRA_ARGS="$(DPDK_MAKE_EXTRA_ARGS)"
 endif
 
 external_configure = echo
 
-external_build = echo
+external_make_args = $(DPDK_MAKE_ARGS) -C external ebuild-build
 
-external_install =  $(MAKE) $(DPDK_MAKE_ARGS) -C external ebuild-build ebuild-install
+external_install =  make $(DPDK_MAKE_ARGS) -C external ebuild-install

build-data/packages/libmemif.mk

@@ -26,6 +26,11 @@ libmemif_cmake_args += -DCMAKE_C_FLAGS="$($(TAG)_TAG_CFLAGS)"
 libmemif_cmake_args += -DCMAKE_SHARED_LINKER_FLAGS="$($(TAG)_TAG_LDFLAGS)"
 libmemif_cmake_args += -DCMAKE_PREFIX_PATH:PATH="$(PACKAGE_INSTALL_DIR)/../vpp"
 
+# Use devtoolset on centos 7
+ifneq ($(wildcard /opt/rh/devtoolset-9/enable),)
+libmemif_cmake_args += -DCMAKE_PROGRAM_PATH:PATH="/opt/rh/devtoolset-9/root/bin"
+endif
+
 libmemif_configure = \
   cd $(PACKAGE_BUILD_DIR) && \
   $(CMAKE) -G Ninja $(libmemif_cmake_args) $(call find_source_fn,$(PACKAGE_SOURCE))$(PACKAGE_SUBDIR)

build-data/packages/sample-plugin.mk

@@ -30,6 +30,11 @@ sample-plugin_cmake_args += -DCMAKE_C_FLAGS="$($(TAG)_TAG_CFLAGS)"
 sample-plugin_cmake_args += -DCMAKE_SHARED_LINKER_FLAGS="$($(TAG)_TAG_LDFLAGS)"
 sample-plugin_cmake_args += -DCMAKE_PREFIX_PATH:PATH="$(PACKAGE_INSTALL_DIR)/../vpp"
 
+# Use devtoolset on centos 7
+ifneq ($(wildcard /opt/rh/devtoolset-9/enable),)
+sample-plugin_cmake_args += -DCMAKE_PROGRAM_PATH:PATH="/opt/rh/devtoolset-9/root/bin"
+endif
+
 sample-plugin_configure = \
   cd $(PACKAGE_BUILD_DIR) && \
   $(CMAKE) -G Ninja $(sample-plugin_cmake_args) \

build-data/packages/vpp.mk

@@ -30,14 +30,15 @@ vpp_cmake_args += -DCMAKE_PREFIX_PATH:PATH="$(vpp_cmake_prefix_path)"
 ifeq ("$(V)","1")
 vpp_cmake_args += -DCMAKE_VERBOSE_MAKEFILE:BOOL=ON
 endif
-ifneq ($(VPP_PLATFORM),)
-vpp_cmake_args += -DVPP_PLATFORM="$(VPP_PLATFORM)"
+ifeq (,$(TARGET_PLATFORM))
+ifeq ($(MACHINE),aarch64)
+vpp_cmake_args += -DVPP_LOG2_CACHE_LINE_SIZE=7
 endif
-ifneq ($(VPP_EXCLUDED_PLUGINS),)
-vpp_cmake_args += -DVPP_EXCLUDED_PLUGINS="$(VPP_EXCLUDED_PLUGINS)"
 endif
-ifneq (${SOURCE_DATE_EPOCH}),)
-vpp_cmake_args += -DVPP_SOURCE_DATE_EPOCH="$(SOURCE_DATE_EPOCH)"
+
+# Use devtoolset on centos 7
+ifneq ($(wildcard /opt/rh/devtoolset-9/enable),)
+vpp_cmake_args += -DCMAKE_PROGRAM_PATH:PATH="/opt/rh/devtoolset-9/root/bin"
 endif
 
 ifneq ($(VPP_EXTRA_CMAKE_ARGS),)
@@ -48,12 +49,13 @@ vpp_configure_depend += external-install
 vpp_configure = \
   cd $(PACKAGE_BUILD_DIR) && \
   $(CMAKE) -G Ninja $(vpp_cmake_args) $(call find_source_fn,$(PACKAGE_SOURCE))
+#vpp_make_args = --no-print-directory
 vpp_build = $(CMAKE) --build $(PACKAGE_BUILD_DIR) -- $(MAKE_PARALLEL_FLAGS)
 vpp_install = $(CMAKE) --build $(PACKAGE_BUILD_DIR) -- install | grep -v 'Set runtime path'
 
 vpp-package-deb: vpp-install
-	@$(CMAKE) --build $(PACKAGE_BUILD_DIR)/vpp -- pkg-deb
+	@$(CMAKE) --build $(PACKAGE_BUILD_DIR)/vpp -- package-deb
 	@find $(PACKAGE_BUILD_DIR) \
-          -maxdepth 2 \
+          -maxdepth 1 \
           \( -name '*.changes' -o -name '*.deb' -o -name '*.buildinfo' \) \
           -exec mv {} $(CURDIR) \;

build-data/platforms/arm32.mk

@@ -0,0 +1,45 @@
+# Copyright (c) 2016 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# vector packet processor
+arm32_arch = native
+arm32_native_tools = vppapigen
+
+arm32_uses_dpdk = yes
+arm32_uses_openssl = no
+
+arm32_root_packages = vpp vlib vlib-api vnet svm vpp-api-test \
+	gmod
+
+vlib_configure_args_arm32 = --with-pre-data=128
+vnet_configure_args_arm32 = --with-dpdk --without-libssl
+vpp_configure_args_arm32 = --with-dpdk --without-libssl
+
+arm32_dpdk_arch = "armv7a"
+arm32_dpdk_target = "arm-armv7a-linuxapp-gcc"
+arm32_dpdk_make_extra_args = "CPU_CFLAGS='-mfloat-abi=hard' \
+	CONFIG_RTE_EAL_IGB_UIO=y \
+	CONFIG_RTE_LIBRTE_E1000_PMD=y \
+	CONFIG_RTE_MAX_LCORE=4 \
+	CONFIG_RTE_MAX_NUMA_NODES=1"
+
+
+arm32_debug_TAG_CFLAGS = -g -O0 -DCLIB_DEBUG -DFORTIFY_SOURCE=2 -DVLIB_MAX_CPUS=4 -march=armv7-a \
+	-fstack-protector-all -fPIC -Werror
+arm32_debug_TAG_LDFLAGS = -g -O0 -DCLIB_DEBUG -DFORTIFY_SOURCE=2 -DVLIB_MAX_CPUS=4 -march=armv7-a \
+	-fstack-protector-all -fPIC -Werror
+
+arm32_TAG_CFLAGS = -g -O2 -DFORTIFY_SOURCE=2 -DVLIB_MAX_CPUS=4 -march=armv7-a \
+	-fstack-protector -fPIC -Werror
+arm32_TAG_LDFLAGS = -g -O2 -DFORTIFY_SOURCE=2 -DVLIB_MAX_CPUS=4 -march=armv7-a \
+	-fstack-protector -fPIC -Werror

build-data/platforms/dpaa.mk

@@ -0,0 +1,87 @@
+# Copyright 2018 NXP
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Configuration for NXP DPAA1/DPAA2 ARM64 based platform
+MACHINE=$(shell uname -m)
+
+dpaa_mtune = cortex-A72
+dpaa_march = "armv8-a+fp+simd+crc+crypto"
+
+ifeq ($(MACHINE),aarch64)
+dpaa_arch = native
+else
+dpaa_arch = aarch64
+dpaa_os = linux-gnu
+dpaa_target = aarch64-fsl-linux
+dpaa_cross_ldflags = \
+	-Wl,--dynamic-linker=/lib/ld-linux-aarch64.so.1 \
+	-Wl,-rpath=/usr/lib64 \
+	-Wl,-rpath=./.libs \
+	-Wl,-rpath=$(OPENSSL_PATH)/lib
+endif
+
+# Re-write Default configuration, if requied
+ifneq ($(CROSS_PREFIX),)
+# like: aarch64-linux-gnu
+dpaa_target = $(CROSS_PREFIX)
+endif
+
+ifneq ($(CPU_MTUNE),)
+# like: cortex-A53
+dpaa_mtune = $(CPU_MTUNE)
+endif
+
+dpaa_native_tools = vppapigen
+dpaa_root_packages = vpp
+
+# DPDK configuration parameters
+dpaa_uses_dpdk = yes
+
+# Compile with external DPDK only if "DPDK_PATH" variable is defined where we have
+# installed DPDK libraries and headers.
+ifeq ($(PLATFORM),dpaa)
+ifneq ($(DPDK_PATH),)
+#dpaa_dpdk_shared_lib = yes
+dpaa_uses_external_dpdk = yes
+dpaa_dpdk_inc_dir = $(DPDK_PATH)/include/dpdk
+dpaa_dpdk_lib_dir = $(DPDK_PATH)/lib
+else
+# compile using internal DPDK + NXP DPAA2 Driver patch
+dpaa_dpdk_arch = "armv8a"
+dpaa_dpdk_target = "arm64-dpaa-linuxapp-gcc"
+dpaa_dpdk_make_extra_args = "CONFIG_RTE_KNI_KMOD=n"
+endif
+endif
+
+# Disable the unused plugins in order to decrease the VPP pacakage size.
+vpp_configure_args_dpaa = --without-ipv6sr --with-pre-data=128 --without-libnuma
+
+# Other optional vpp_configure_args
+ifneq ($(VPP_CFG_ARGS),)
+vpp_configure_args_dpaa += $(VPP_CFG_ARGS)
+endif
+
+
+dpaa_debug_TAG_CFLAGS = -g -O0 -DCLIB_DEBUG -fPIC -fstack-protector-all -DFORTIFY_SOURCE=2 -mtls-dialect=trad \
+			-march=$(MARCH) -Werror -DCLIB_LOG2_CACHE_LINE_BYTES=6 -I$(OPENSSL_PATH)/include
+dpaa_debug_TAG_LDFLAGS = -g -O0 -DCLIB_DEBUG -fstack-protector-all -DFORTIFY_SOURCE=2 \
+			-march=$(MARCH) -Werror -DCLIB_LOG2_CACHE_LINE_BYTES=6 -L$(OPENSSL_PATH)/lib
+
+
+# Use -rdynamic is for stack tracing, O0 for debugging....default is O2
+# Use -DCLIB_LOG2_CACHE_LINE_BYTES to change cache line size
+dpaa_TAG_CFLAGS = -g -Ofast -fPIC -march=$(MARCH) -mcpu=$(dpaa_mtune) -mtls-dialect=trad \
+		-mtune=$(dpaa_mtune) -funroll-all-loops -DCLIB_LOG2_CACHE_LINE_BYTES=6 -I$(OPENSSL_PATH)/include
+dpaa_TAG_LDFLAGS = -g -Ofast -fPIC -march=$(MARCH) -mcpu=$(dpaa_mtune) \
+		-mtune=$(dpaa_mtune) -funroll-all-loops -DCLIB_LOG2_CACHE_LINE_BYTES=6 -L$(OPENSSL_PATH)/lib
+

build-data/platforms/qppc.mk

@@ -0,0 +1,47 @@
+# Copyright (c) 2015 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Qemu "p-series" powerpc64 
+
+qppc_os = linux-gnu
+
+qppc_cross_ldflags = \
+    -Wl,--dynamic-linker=/lib64/ld64.so.1
+
+qppc_arch = powerpc
+
+qppc_root_packages = vppinfra vlib vlib-api vnet svm \
+	vpp vpp-api-test
+
+vnet_configure_args_qppc = \
+	--without-libssl
+
+vpp_configure_args_qppc = \
+	--without-libssl
+
+vlib_configure_args_qppc = --with-pre-data=128
+
+qppc_march=powerpc64
+
+# native tool chain additions for this platform
+qppc_native_tools = vppapigen
+
+qppc_uses_dpdk = no
+
+qppc_debug_TAG_CFLAGS = -m64 -g -O0 -DCLIB_DEBUG -DCLIB_LOG2_CACHE_LINE_BYTES=6 -maltivec
+qppc_debug_TAG_LDFLAGS = -m64 -g -O0 -DCLIB_DEBUG -DCLIB_LOG2_CACHE_LINE_BYTES=6 -maltivec
+
+qppc_TAG_CFLAGS = -m64 -g -O2 -DCLIB_LOG2_CACHE_LINE_BYTES=6 -maltivec
+qppc_TAG_LDFLAGS = -m64 -g -O2 -DCLIB_LOG2_CACHE_LINE_BYTES=6 -maltivec
+
+

build-data/platforms/vpp.mk

@@ -16,8 +16,11 @@
 MACHINE=$(shell uname -m)
 
 vpp_arch = native
+ifeq ($(TARGET_PLATFORM),thunderx)
+vpp_dpdk_target = arm64-thunderx-linuxapp-gcc
+endif
 
-vpp_root_packages = vpp
+vpp_root_packages = vpp vom
 
 vpp_debug_TAG_BUILD_TYPE = debug
 vpp_TAG_BUILD_TYPE = release

build-root/Makefile

@@ -39,7 +39,7 @@
 ######################################################################
 
 # Scripts require non-POSIX parts of bash
-SHELL := $(shell which bash)
+SHELL := /bin/bash
 
 # Where this makefile lives
 MU_BUILD_ROOT_DIR = $(shell pwd)
@@ -243,11 +243,11 @@ TAG_PREFIX = $(if $(TAG),$(TAG)-)
 tag_var_with_added_space_fn = $(if $($(TAG)_TAG_$(1)),$($(TAG)_TAG_$(1)) )
 
 # TAG=debug for debugging
-debug_TAG_CFLAGS = -g -O0 -DCLIB_DEBUG -march=$(MARCH) \
+debug_TAG_CFLAGS = -g -O0 -DCLIB_DEBUG -DFORTIFY_SOURCE=2 -march=$(MARCH) \
 		   -fstack-protector-all -fPIC
-debug_TAG_CXXFLAGS = -g -O0 -DCLIB_DEBUG -march=$(MARCH) \
+debug_TAG_CXXFLAGS = -g -O0 -DCLIB_DEBUG -DFORTIFY_SOURCE=2 -march=$(MARCH) \
 		   -fstack-protector-all -fPIC
-debug_TAG_LDFLAGS = -g -O0 -DCLIB_DEBUG -march=$(MARCH) \
+debug_TAG_LDFLAGS = -g -O0 -DCLIB_DEBUG -DFORTIFY_SOURCE=2 -march=$(MARCH) \
 		   -fstack-protector-all -fPIC
 
 BUILD_PREFIX_package = build-$(TAG_PREFIX)
@@ -365,7 +365,7 @@ NATIVE_TOOLS_$(IS_LINUX) += $(NATIVE_TOOLS_LINUX)
 CROSS_TOOLS_$(IS_LINUX) += glibc gcc
 
 # must be first for bootstrapping
-NATIVE_TOOLS = findutils $(MAKE)
+NATIVE_TOOLS = findutils make
 
 # basic tools needed for build system
 NATIVE_TOOLS += git automake autoconf libtool texinfo tar
@@ -416,7 +416,7 @@ find_filter += -and -not -path '*/.mu_build_*'
 find_newer_filtered_fn =			\
   (! -f $(1)					\
     || -n $(call find_newer_files_fn,$(1),$(3))	\
-    || -n "`find -L $(2) 			\
+    || -n "`find -H $(2)			\
 	      -type f				\
               -and -newer $(1)			\
 	      -and \( $(4) \)			\
@@ -614,7 +614,7 @@ check_platform =								\
        -a ! -x "`which 2> /dev/null $${target_gcc}`" ] ; then			\
     $(call build_msg_fn,							\
 	   No cross-compiler found for platform $(PLATFORM) target $(TARGET);	\
-	     try $(MAKE) PLATFORM=$(PLATFORM) install-tools) ;			\
+	     try make PLATFORM=$(PLATFORM) install-tools) ;			\
     exit 1 ;									\
   fi
 
@@ -650,18 +650,11 @@ configure_check_timestamp =						\
 # /proc/cpuinfo does not exist on platforms without a /proc and on some
 # platforms, notably inside containers, it has no content. In those cases
 # we assume there's 1 processor; we use 2*ncpu for the -j option.
-#
-# On FreeBSD we can call nproc to get the number of processors.
-#
 # NB: GNU Make 4.2 will let us use '$(file </proc/cpuinfo)' to both test
 # for file presence and content; for now this will have to do.
 ifndef MAKE_PARALLEL_JOBS
-ifeq ($(shell uname), FreeBSD)
-MAKE_PARALLEL_JOBS = $(shell nproc)
-else
 MAKE_PARALLEL_JOBS = $(if $(shell [ -f /proc/cpuinfo ] && head /proc/cpuinfo), \
 	$(shell grep -c ^processor /proc/cpuinfo), 2)
-endif	# FreeBSD
 endif
 MAKE_PARALLEL_FLAGS ?= $(if $($(PACKAGE)_make_parallel_fails),,-j $(MAKE_PARALLEL_JOBS))
 
@@ -807,7 +800,7 @@ pull-all:
 	$(call build_msg_fn,Git pull build tools) ;				\
 	$(call tool_make_target_fn,pull-all) ;					\
 	$(call build_msg_fn,Git pull packages for platform $(PLATFORM)) ;	\
-	$(MAKE) PLATFORM=$(PLATFORM) $(patsubst %,%-pull-all,$(ROOT_PACKAGES))
+	make PLATFORM=$(PLATFORM) $(patsubst %,%-pull-all,$(ROOT_PACKAGES))
 
 .PHONY: %-diff
 %-diff:
@@ -969,13 +962,13 @@ $(PLATFORM_IMAGE_DIR)/ro.img ro-image: $(patsubst %,%-find-source,$(ROOT_PACKAGE
 	chmod 0755 $${tmp_dir} ;					\
 	cd $${tmp_dir} ;						\
 	trap "rm -rf $${tmp_dir}" err ;					\
-	fakeroot $(SHELL) -c "{					\
+	fakeroot /bin/bash -c "{					\
 	  set -eu$(BUILD_DEBUG) ;					\
 	  $(MAKE) -C $(MU_BUILD_ROOT_DIR) IMAGE_INSTALL_DIR=$${tmp_dir}	\
 	    $(patsubst %,%-image_install,				\
 	      basic_system						\
 	      $(ROOT_PACKAGES)) ;					\
-	  : $(MAKE) dev directory ;					\
+	  : make dev directory ;					\
 	  $(linuxrc_makedev) ;						\
 	  echo @@@@ Relocating ELF executables to run in / @@@@ ;	\
 	  scripts/set-rpath /$(arch_lib_dir):/lib ;			\
@@ -1061,7 +1054,7 @@ rw-image: rw-image-check-type ro-image
 	chmod 0755 $${tmp_dir} ;				\
 	cd $${tmp_dir} ;					\
 	trap "rm -rf $${tmp_dir}" err ;				\
-	fakeroot $(SHELL) -c "{				\
+	fakeroot /bin/bash -c "{				\
 	  set -eu$(BUILD_DEBUG) ;				\
 	  $(linuxrc_makedev) ;					\
 	  $(call rw_image_embed_ro_image_fn,$${ro_image}) ;	\

build-root/config.site

@@ -0,0 +1,112 @@
+# Copyright (c) 2015 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+######################################################################
+# glibc
+######################################################################
+
+# glibc needs this for cross compiling 
+libc_cv_forced_unwind=yes
+libc_cv_c_cleanup=yes
+libc_cv_ssp=no
+# fixes gentoo build; not sure why?
+libc_cv_uname_release=""
+libc_cv_uname_version=""
+ac_cv_header_cpuid_h=yes
+######################################################################
+# bash
+######################################################################
+
+# Bash configure.in uses this to work around an autoconf 2.53 bug
+ac_cv_func_setvbuf_reversed=no
+ac_cv_rl_version=5.1
+bash_cv_termcap_lib=libncurses
+
+# These mostly come from debian bash-2.05b changes
+# They are needed to make a functioning bash.  Without these
+# settings gdbserver exiting would cause the invoking bash to
+# exit also.
+bash_cv_have_mbstate_t=yes
+bash_cv_dup2_broken=no
+bash_cv_pgrp_pipe=no
+bash_cv_sys_siglist=yes
+bash_cv_under_sys_siglist=yes
+bash_cv_opendir_not_robust=no
+bash_cv_printf_declared=yes
+bash_cv_ulimit_maxfds=yes
+bash_cv_getenv_redef=yes
+bash_cv_getcwd_calls_popen=no
+bash_cv_func_strcoll_broken=no
+bash_cv_must_reinstall_sighandlers=no
+bash_cv_type_quad_t=yes
+bash_cv_func_sigsetjmp=present
+bash_cv_job_control_missing=present
+bash_cv_sys_named_pipes=present
+bash_cv_type_rlimit=long
+bash_cv_printf_a_format=yes
+bash_cv_unusable_rtsigs=no
+
+######################################################################
+# Apache
+######################################################################
+ac_cv_func_setpgrp_void=yes
+apr_cv_process_shared_works=yes
+apr_cv_tcp_nodelay_with_cork=yes
+ap_void_ptr_lt_long=no
+
+case ${host_cpu} in
+x86_64 | alpha)
+  ac_cv_sizeof_ssize_t=8
+  ac_cv_sizeof_size_t=8
+  ac_cv_sizeof_pid_t=4
+  ;;
+*)
+  ac_cv_sizeof_ssize_t=4
+  ac_cv_sizeof_size_t=4
+  ac_cv_sizeof_pid_t=4
+  ;;
+esac
+
+######################################################################
+# gdb
+######################################################################
+gdb_cv_func_ptrace_args=int,int,long,long
+
+######################################################################
+# dpkg
+######################################################################
+dpkg_cv_va_copy=yes
+
+######################################################################
+# coreutils
+######################################################################
+ac_cv_search_clock_gettime=no
+gl_cv_fs_space=yes
+
+######################################################################
+# tcpdump
+######################################################################
+ac_cv_linux_vers=2
+ac_cv_func_pcap_findalldevs=no
+
+######################################################################
+# flex
+######################################################################
+ac_cv_func_malloc_0_nonnull=yes
+ac_cv_func_realloc_0_nonnull=yes
+
+######################################################################
+# tar
+######################################################################
+tar_gl_cv_func_mknod_works=yes

build-root/scripts/checkstyle.sh

@@ -0,0 +1,155 @@
+#!/bin/bash
+
+# Copyright (c) 2015 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+VPP_DIR=`dirname $0`/../../
+EXIT_CODE=0
+FIX="0"
+FULL="0"
+CHECKSTYLED_FILES=""
+UNCHECKSTYLED_FILES=""
+
+# If the user provides --fix, then actually fix things
+# Note: this is meant for use outside of the CI Jobs, by users cleaning things up
+
+while true; do
+	case ${1} in
+		--fix)
+			FIX="1"
+			;;
+		--full)
+			FULL="1"
+			;;
+	esac
+	shift || break
+done
+
+if [ "${FULL}" == "1" ]; then
+	FILELIST=$(git ls-tree -r HEAD --name-only)
+else
+	FILELIST=$((git diff HEAD~1.. --name-only; git ls-files -m ) | sort -u)
+fi
+
+# Check to make sure we have indent.  Exit if we don't with an error message, but
+# don't *fail*.
+command -v indent > /dev/null
+if [ $? != 0 ]; then
+    echo "Cound not find required command \"indent\".  Checkstyle aborted"
+    exit ${EXIT_CODE}
+fi
+indent --version
+
+# Check to make sure we have clang-format.  Exit if we don't with an error message, but
+# don't *fail*.
+HAVE_CLANG_FORMAT=0
+command -v clang-format > /dev/null
+if [ $? != 0 ]; then
+    echo "Could not find command \"clang-format\". Checking C++ files will cause abort"
+else
+    clang-format --version
+    x=$(echo "" | clang-format 2>&1)
+    if [[ "$x" == "" ]]; then
+        HAVE_CLANG_FORMAT=1
+    else
+	echo "Output produced while formatting empty file (expected empty string):"
+	echo "$x"
+        echo "Could not find working \"clang-format\". Checking C++ files will cause abort"
+    fi
+fi
+
+cd ${VPP_DIR}
+git status
+for i in ${FILELIST}; do
+    if [ -f ${i} ] && [ ${i} != "build-root/scripts/checkstyle.sh" ] && [ ${i} != "extras/emacs/fix-coding-style.el" ]; then
+        grep -q '>>>>>>>' ${i}
+        if [ $? == 0 ]; then
+            echo "Unresolved merge conflict detected in" ${i} "... Abort."
+            exit 1
+        fi
+        grep -q "fd.io coding-style-patch-verification: ON" ${i}
+        if [ $? == 0 ]; then
+            EXTENSION=`basename ${i} | sed 's/^\w\+.//'`
+            case ${EXTENSION} in
+                hpp|cpp|cc|hh)
+                    CMD="clang-format"
+                    if [ ${HAVE_CLANG_FORMAT} == 0 ]; then
+                            echo "C++ file detected. Abort. (missing clang-format)"
+                            exit ${EXIT_CODE}
+                    fi
+                    ;;
+                *)
+                    CMD="indent"
+                    ;;
+            esac
+            CHECKSTYLED_FILES="${CHECKSTYLED_FILES} ${i}"
+            if [ ${FIX} == 0 ]; then
+                if [ "${CMD}" == "clang-format" ]
+                then
+                    clang-format ${i} > ${i}.out2
+                else
+                    indent ${i} -o ${i}.out1 > /dev/null 2>&1
+                    indent ${i}.out1 -o ${i}.out2 > /dev/null 2>&1
+                fi
+                # Remove trailing whitespace
+                sed -i -e 's/[[:space:]]*$//' ${i}.out2
+                diff -q ${i} ${i}.out2
+            else
+                if [ "${CMD}" == "clang-format" ]; then
+                    clang-format -i ${i} > /dev/null 2>&1
+                else
+                    indent ${i}
+                    indent ${i}
+                fi
+                # Remove trailing whitespace
+                sed -i -e 's/[[:space:]]*$//' ${i}
+            fi
+            if [ $? != 0 ]; then
+                EXIT_CODE=1
+                echo
+                echo "Checkstyle failed for ${i}."
+                if [ "${CMD}" == "clang-format" ]; then
+                    echo "Run clang-format as shown to fix the problem:"
+                    echo "clang-format -i ${VPP_DIR}${i}"
+                else
+                    echo "Run indent (twice!) as shown to fix the problem:"
+                    echo "indent ${VPP_DIR}${i}"
+                    echo "indent ${VPP_DIR}${i}"
+                fi
+            fi
+            if [ -f ${i}.out1 ]; then
+                rm ${i}.out1
+            fi
+            if [ -f ${i}.out2 ]; then
+                rm ${i}.out2
+            fi
+        else
+            UNCHECKSTYLED_FILES="${UNCHECKSTYLED_FILES} ${i}"
+        fi
+    else
+        UNCHECKSTYLED_FILES="${UNCHECKSTYLED_FILES} ${i}"
+    fi
+done
+
+if [ ${EXIT_CODE} == 0 ]; then
+    echo "*******************************************************************"
+    echo "* VPP CHECKSTYLE SUCCESSFULLY COMPLETED"
+    echo "*******************************************************************"
+else
+    echo "*******************************************************************"
+    echo "* VPP CHECKSTYLE FAILED"
+    echo "* CONSULT FAILURE LOG ABOVE"
+    echo "* NOTE: Running 'build-root/scripts/checkstyle.sh --fix' *MAY* fix the issue"
+    echo "*******************************************************************"
+fi
+exit ${EXIT_CODE}

build-root/scripts/set-rpath

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # Copyright (c) 2015 Cisco and/or its affiliates.
 # Licensed under the Apache License, Version 2.0 (the "License");

build/external/Makefile

@@ -12,21 +12,17 @@
 # limitations under the License.
 
 # Scripts require non-POSIX parts of bash
-SHELL := $(shell which bash)
+SHELL := /bin/bash
 
 DL_CACHE_DIR = $(HOME)/Downloads
+MAKE ?= make
 MAKE_ARGS ?= -j
 BUILD_DIR        ?= $(CURDIR)/_build
 INSTALL_DIR      ?= $(CURDIR)/_install
-PKG_VERSION ?= $(shell git describe --abbrev=0 --match 'v[0-9]*' | cut -d- -f1 | cut -dv -f2 | cut -d. -f1,2)
+PKG_VERSION ?= $(shell git describe --abbrev=0 | cut -d- -f1 | cut -dv -f2 | cut -d. -f1,2)
 PKG_SUFFIX ?= $(shell git log --oneline v$(PKG_VERSION)-rc0.. . | wc -l)
-SOURCE_DATE_EPOCH ?= $(shell git log -1 --pretty=%ct .)
-ifeq ($shell(uname), FreeBSD)
-JOBS := $(shell nproc)
-else
 JOBS := $(if $(shell [ -f /proc/cpuinfo ] && head /proc/cpuinfo),\
 	$(shell grep -c ^processor /proc/cpuinfo), 2)
-endif	# FreeBSD
 
 B := $(BUILD_DIR)
 I := $(INSTALL_DIR)
@@ -37,36 +33,23 @@ else
 CMAKE?=cmake
 endif
 
-ARCH_X86_64=$(filter x86_64,$(shell uname -m))
-AARCH64=$(filter aarch64,$(shell uname -m))
-
 include packages.mk
+include packages/nasm.mk
 include packages/ipsec-mb.mk
 include packages/quicly.mk
-ifneq ($(shell uname), FreeBSD)
-include packages/rdma-core.mk
 include packages/dpdk.mk
-include packages/xdp-tools.mk
-include packages/octeon-roc.mk
-endif	# FreeBSD
+include packages/rdma-core.mk
+include packages/libbpf.mk
 
 .PHONY: clean
 clean:
 	@rm -rf $(B) $(I)
 
 .PHONY: install
-ifeq ($(shell uname), FreeBSD)
-install: $(if $(ARCH_X86_64), ipsec-mb-install) quicly-install
-else
-install: $(if $(ARCH_X86_64), ipsec-mb-install) dpdk-install rdma-core-install quicly-install xdp-tools-install $(if $(AARCH64), octeon-roc-install)
-endif	# FreeBSD
+install: dpdk-install rdma-core-install quicly-install libbpf-install
 
 .PHONY: config
-ifeq ($(shell uname), FreeBSD)
-config: $(if $(ARCH_X86_64), ipsec-mb-config) quicly-build
-else
-config: $(if $(ARCH_X86_64), ipsec-mb-config) dpdk-config rdma-core-config quicly-build
-endif	# FreeBSD
+config: dpdk-config rdma-core-config
 
 ##############################################################################
 # .deb packaging
@@ -84,7 +67,7 @@ deb/debian/changelog: Makefile
 	@echo "" >> $@
 	@echo "  * Version $(DEB_VER)" >> $@
 	@echo "" >> $@
-	@echo " -- VPP Dev <vpp-dev@lists.fd.io>  $(shell date -R --date=@${SOURCE_DATE_EPOCH})" >> $@
+	@echo " -- VPP Dev <vpp-dev@lists.fd.io>  $(shell date -R)" >> $@
 
 $(DEV_DEB): deb/debian/changelog
 	@cd deb && dpkg-buildpackage -b -uc -us
@@ -121,7 +104,7 @@ endif
 RPM_VER := $(PKG_VERSION)
 RPM_ARCH=$(shell rpm --eval "%{_arch}" 2> /dev/null)
 DEV_RPM=vpp-ext-deps-$(RPM_VER)-$(PKG_SUFFIX).$(RPM_ARCH).rpm
-INSTALLED_RPM_VER=$(shell rpm -q --queryformat '%{VERSION}-%{RELEASE}' vpp-ext-deps 2> /dev/null | grep -v "vpp-ext-deps")
+INSTALLED_RPM_VER=$(shell rpm -q --queryformat '%{VERSION}-%{RELEASE}' vpp-ext-deps 2> /dev/null | grep -v "not inst")
 
 .PHONY: build-rpm install-rpm check-rpm
 
@@ -172,17 +155,17 @@ ifeq ($(INSTALLED_VER)$(INSTALLED_RPM_VER),)
 	@echo "development package by invoking 'make install-ext-deps'"
 	@echo "from the top level directory"
 	@echo "=========================================================="
-	$(MAKE) config
+	make config
 else
 ifneq ($(INSTALLED_VER),)
 	make check-deb
 endif
 ifneq ($(INSTALLED_RPM_VER),)
-	$(MAKE) check-rpm
+	make check-rpm
 endif
 endif
 
 ebuild-install:
 ifeq ($(INSTALLED_VER)$(INSTALLED_RPM_VER),)
-	$(MAKE) install
+	make install
 endif

build/external/deb/debian/compat

@@ -1 +1 @@
-10
+9

build/external/deb/debian/rules

@@ -1,9 +1,6 @@
 #!/usr/bin/make -f
 DH_VERBOSE = 1
 DEB_BUILD_OPTIONS = noddebs
-DEB_CFLAGS_MAINT_STRIP = -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -O2
-DEB_LDFLAGS_MAINT_STRIP = -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects
-DEB_CFLAGS_MAINT_APPEND = -O3
 PKG=vpp-ext-deps
 
 VERSION = $(shell dpkg-parsechangelog | sed -nr '/^Version:/s/Version: //p')
@@ -26,8 +23,5 @@ override_dh_auto_configure:
 
 override_dh_install:
 	make $(MAKE_ARGS) install
-	@mkdir -p $(INSTALL_DIR)
 	dh_install -p$(PKG) --autodest /opt
 
-override_dh_shlibdeps:
-	dh_shlibdeps -l$(INSTALL_DIR)lib/

build/external/mlx_rdma_dpdk_matrix.txt

@@ -1,2 +0,0 @@
-rdma=49.0 dpdk=23.11
-rdma=51.0 dpdk=24.03

build/external/packages.mk

@@ -79,7 +79,7 @@ $(B)/.$1.patch.ok: $(B)/.$1.extract.ok
 ifneq ($$(wildcard $$($1_patch_dir)/*.patch),)
 	@for f in $$($1_patch_dir)/*.patch ; do \
 		echo "Applying patch: $$$$(basename $$$$f)" ; \
-		patch -p1 -d $$($1_src_dir) < $$$$f ; \
+		patch -p1 -d $$($1_src_dir) --no-backup-if-mismatch < $$$$f ; \
 	done
 endif
 	@touch $$@
@@ -101,18 +101,11 @@ define $1_config_cmds
 endef
 endif
 
-ifneq ($(filter $1,$(VPP_SKIP_EXTERNAL)), $1)
-$(B)/.$1.config.ok: $(B)/.$1.patch.ok $(addprefix $(B)/.,$(addsuffix .install.ok,$($1_depends)))
+$(B)/.$1.config.ok: $(B)/.$1.patch.ok $(addsuffix -install,$($1_depends))
 	$$(call h1,"configuring $1 $($1_version) - log: $$($1_config_log)")
 	@mkdir -p $$($1_build_dir)
 	$$(call $1_config_cmds)
 	@touch $$@
-else
-$(B)/.$1.config.ok:
-	$$(call h1,"Skipping $1 $($1_version)")
-	@mkdir -p $(B)
-	@touch $$@
-endif
 
 .PHONY: $1-config
 $1-config: $(B)/.$1.config.ok
@@ -127,17 +120,10 @@ define $1_build_cmds
 endef
 endif
 
-ifneq ($(filter $1,$(VPP_SKIP_EXTERNAL)), $1)
 $(B)/.$1.build.ok: $(B)/.$1.config.ok
 	$$(call h1,"building $1 $($1_version) - log: $$($1_build_log)")
 	$$(call $1_build_cmds)
 	@touch $$@
-else
-$(B)/.$1.build.ok:
-	$$(call h1,"Skipping $1 $($1_version)")
-	@mkdir -p $(B)
-	@touch $$@
-endif
 
 .PHONY: $1-build
 $1-build: $(B)/.$1.build.ok
@@ -152,24 +138,13 @@ define $1_install_cmds
 endef
 endif
 
-ifneq ($(filter $1,$(VPP_SKIP_EXTERNAL)), $1)
 $(B)/.$1.install.ok: $(B)/.$1.build.ok
 	$$(call h1,"installing $1 $($1_version) - log: $$($1_install_log)")
 	$$(call $1_install_cmds)
 	@touch $$@
-else
-$(B)/.$1.install.ok:
-	$$(call h1,"Skipping $1 $($1_version)")
-	@mkdir -p $(B)
-	@touch $$@
-endif
 
 .PHONY: $1-install
 $1-install: $(B)/.$1.install.ok
 
-.PHONY: $1-show-%
-$1-show-%:
-	@echo $$($$*)
-
 ALL_TARGETS += $1-install
 endef