…form (#2572)

/etc/init.d/sxdkernel stop may take up to 15 sec which has impact on
control plane downtime

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>

…to INFO (#2576)

* Add a log message for each notification of add/del TACACS server.

Signed-off-by: Renuka Manavalan <remanava@microsoft.com>

* Moved another syslog message from DEBUG to INFO to be able to see those notifications.

All these changes are to help with a one-time-seen-bug, that hostcfgd did not act upon changes to redis for TACACS servers. We could not repro the bug.

Signed-off-by: Renuka Manavalan <remanava@microsoft.com>

Signed-off-by: Guohan Lu <gulv@microsoft.com>

…r config and reload with default l2 configuration. (#2536)

'show vlan config' not displaying the VLAN members, after clear config done loaded with default l2 configuration.

need to flush asic db in swss.sh instead of syncd.sh

orchagent might already started in swss.sh and put commands
into asic db before asic db is flushed in syncd.sh. This
causes race condition such as INIT_VIEW not passing to syncd.

Signed-off-by: Guohan Lu <gulv@microsoft.com>

Signed-off-by: Mykola Faryma <mykolaf@mellanox.com>

Conflicts:
	src/sonic-config-engine/tests/sample_output/ports.json
	src/sonic-config-engine/tests/test_cfggen.py

- removing -g to disable jump when time difference is greater than 1000s
- add -x to disable initial jump

…#2494)" (#2590)

This reverts commit 33fe8d2.

Signed-off-by: Mykola Faryma <mykolaf@mellanox.com>

…2594)

* [201811 submodules] advance sairedis, swss, swss-common, utilities

Submodule src/sonic-sairedis d57222a..54b02a1:
  > Add support for fdb_event MOVE and check fdb event oids (#420)
  > [vslib] add missing port attributes for virtual switch (#419)

Submodule src/sonic-swss 584490c..62e2a20:
  > [fdborch] Store vlan id of FDB entry instead of port pvid into stateD… (#759)
  > [portsorch] Change speed set flow (#764)
  > Create egress ACL table group during the PFCWD stats list installment (#787)

Submodule src/sonic-swss-common 286ef34..2592b0c:
  > Add support for WarmStart::setDataCheckState() (#242)

Submodule src/sonic-utilities b44b462..d409987:
  > [sonic_installer] Improve error handling (#460)
  > [clock] sync os time to CMOS before rebooting (#465)
  > [intfstat] add intfstat script to output RIF counters (#439)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [201811 utilties] add 201811 branch for sonic-utilities repo

Submodule src/sonic-utilities d409987...ff1448c:
  > [sonic_installer] Improve error handling (#460)
  > [clock] sync os time to CMOS before rebooting (#465)
  < [sonic_installer] Improve error handling (#460)
  < [clock] sync os time to CMOS before rebooting (#465)
  < [intfstat] add intfstat script to output RIF counters (#439)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Mykola Faryma <mykolaf@mellanox.com>

Submodule src/sonic-swss 62e2a20..4b489ce:
  > Fix incorrect ACL CRM increment, resulting orchagent crash (#800)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Andriy Moroz <c_andriym@mellanox.com>

)

Submodule src/sonic-utilities ff1448c..f95da07:
  > [fast/warm reboot] set default reboot method to "kexec -e" (#473)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Andriy Moroz <c_andriym@mellanox.com>

…ices (#2634)

* [services] Ensure swss and syncd services start before dependent services

* Add 'attach' functions to scripts which get installed to /usr/local/bin so that services only reference the one script each

* Add 'After=swss.service' to syncd.service

…aces to be ready before starting radvd (#2558)

…efactor patch (#2624)

Rate limiting at 20,000 messages per 5-minute interval

start() is called by service startPre method, which is blocking. Starting
syncd service here is causing deadlock.

attach() is called by service start method, which is non-blocking.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Wenda Ni <wenni@microsoft.com>

Submodule src/sonic-swss 4b489ce..90eb25d:
  > [portsorch] fix bug in speed set (#806)

Submodule src/sonic-swss-common 2592b0c..c674e64:
  > Add multiple fields hdel support (#267)
  > Update PFC_WD table name in CONFIG_DB (#266)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Nazarii Hnydyn <nazariig@mellanox.com>

Submodule src/sonic-sairedis 54b02a1..8182916:
  > Add pre match to comparison logic and unittests (#423)
  > Drop FDB notifications if they contain invalid OIDs (#428)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

PFC_WD table naming change is not ready to be included yet.

Submodule src/sonic-swss-common c674e64..2592b0c (rewind):
  < Add multiple fields hdel support (#267)
  < Update PFC_WD table name in CONFIG_DB (#266)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Mykola Faryma <mykolaf@mellanox.com>

…isted in <Devices> section (#2522)

Signed-off-by: Nadiya.Stetskovych <nstetskovych@barefootnetworks.com>

Lossy traffic does not need to be mapped to different ingress PGs. They can all share the same ingress PG.

Signed-off-by: Wenda Ni <wenni@microsoft.com>

…2659)

Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>

…ead of 'docker attach' (#2661)

Fixes "No ISSU version file found /etc/mlnx/issu-version"
when rebooting to different image;
Add aditional check condition.

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>

…#2679)

Submodule src/sonic-utilities f95da07..2fe01fe:
  > neighbor advertiser script (#469)
  > [aclshow] restore PRIO column and sort entries by priority (#476)
  > Update watermark default polling interval to 10s (#470)
  > show interface status <interface-name> throws error (fixes #427) (#440)

Submodule src/sonic-swss 90eb25d..91171b6:
  > fix a unstable swss egress acl test (#776)
  > [aclorch] Remove  L4 port range support limitation on egress ACL table and add new SWSS virtual test. (#741)
  > Fix orchagent SEGV when PortConfigDone not set (#803)

Submodule src/sonic-swss-common 2592b0c..5f4abd9:
  > Force only supported commands on consumer table (#261)
  > Add multiple fields hdel support (#267)


Signed-off-by: Ying Xie <ying.xie@microsoft.com>

New SAI fixes getting of queue buffer profile

Signed-off-by: Andriy Moroz <c_andriym@mellanox.com>

* fix lpmode set failure issue by skipping nvport

…er (#2683)

database container doesn't mount hwsku folder.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Just so that the folder will be clean and make working on new patches
much easier.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Submodule src/sonic-utilities 2fe01fe..9d9aaa0:
  > [warm/fast reboot] setup control plane assistant when available (#487)
  > [reboot script] add -h, -? options (#484)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

…2707)

* [jessie repo] remove one dependency on jessie-backport repo

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [build] remove dependency on retried jessie-backports repo

The downloaded Jessie docker image still reference jessie-updates.
Removing it from the list.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* fix typo

* move chunk

* [docker-ptf] avoid using retired Jessie repos

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

…ng neighbor… (#2602)

* Skip setting the same hwaddr to lag port to avoid disrupting neighbor entries

Signed-off-by: Jipan Yang <jipan.yang@alibaba-inc.com>

Race condition has been noticed after warm reboot: sometimes when
port_changed notification was received, the link message didn't
have the device name. Without device name, creating team port
would fail.

Registering to the interface information change notification, so
later when device name becomes available, retry creating team port.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

Signed-off-by: Andriy Moroz <c_andriym@mellanox.com>

…verlay SNMP (#2721)

* [snmpagent][swss-common] advance sub module head to include overlay SNMP

Submodule src/sonic-snmpagent 0f2bbd7..26f0495:
  > Remove verbose feature missing logs (#102)
  > Enable overriding interface counters OIDs (#98)

Submodule src/sonic-swss-common 5f4abd9..36fd5e9:
  > Add new DB index for SNMP_OVERLAY_DB (#262)

Note: overlay DB also requires change in swss-common, which has been
      moved ahead.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [utilities] advance utilities sub-module head

Submodule src/sonic-utilities 9d9aaa0..d1070b2:
  > [warm-reboot] initialize warm reboot state table before warm rebooting (#492)
  > Allow config shutdown and startup operations on valid PortChannel interface names (#474)

After warm reboot is done, we need to disable warm reboot flag and
tear down anything setup for warm reboot and persisted across.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [vm build] force Linux to drop cache before calling kvm

KVM need to allocate 2G memory for this build. The system memory might
be occupied by cache at the moment and doesn't have 2G chunk to give
out. Forcing Kernel to drop cache to boost the chance of getting 2G
memory.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [make] add option to enable/disable VS build memory preparation

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [teamd service] teamd service should start after syncd

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* combine after lines

When adding a lag member dynamically after system boots up, teamd
port priv change handler could re-entrant itself and causing adding
operation to fail.

While handling PORT_CHANGE event, teamd_per_port.c port priv change
handler was called, it will then call runner_lacp to add port to lag,
the later causes IFINFO_CHANGE to be notified and calls the priv change
handler again, this re-entrance would cause runner_lacp port_added to
be called again and messes up with the previous adding sequence. Then
fails the lag member adding operation.

Prevent per port priv change handler re-entrance solves the problem.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

…#2728)

Submodule src/sonic-sairedis 8182916..483c89e:
  > Notify OA about exception and process only restart query events (#437)

Submodule src/sonic-swss 91171b6..d22b2de:
  > Allow ACL entry creation without ACL counter (#818)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

- Cherry-picked one change:

Submodule src/sonic-platform-common d4bf78c..42119e1:
  > remove gang port parsing (#24)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* removing dhcp changes from initrd

* removing mgmt-intf-dhcp file

…" (#2733)

This reverts commit 0d1efb1.

Submodule src/sonic-utilities d1070b2..bae21e7:
  > Update neighbor advertiser (#498)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

This implies that by default, if TACACS is configured properly and it reported auth_err, then don't try fail through to traditional unix authentication through /etc/passwd.

If this failthrough is intended, make it explicit through "sudo config aaa authentication failthrough enable"

Removed an unused variable "aaa.fallback"

Tested manually. Note the presence of 'auth_err=die' in all cases except when failthrough is explicitly enabled.

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough default; date
Wed Apr  3 23:05:18 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1316 Apr  3 23:05 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough enable; date ; h4 "AAA|authentication"
Wed Apr  3 23:06:37 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1294 Apr  3 23:06 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore]     pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore]     pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough disable; date ; h4 "AAA|authentication"
Wed Apr  3 23:07:09 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1321 Apr  3 23:07 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

#2759)

Submodule src/sonic-sairedis 483c89e..97dd2a8:
  > Fix compilation issues in stretch docker with gcc-6.3 (#426)
  >  Make object list deterministic when iterating (#438)
  > Ignore ACL_COUNTER bytes and packets during comparison logic (#443)

Submodule src/sonic-swss d22b2de..ae74a27:
  > Survive pfc watchdog storm action across warm-reboot (#794)

Submodule src/sonic-swss-common 36fd5e9..24c0ff7:
  > Update PFC_WD table name in CONFIG_DB (#266)

Submodule src/sonic-utilities bae21e7..6aee909:
  > [neighbor advertiser] convert int to string before concatenating (#505)
  > [config]: Change the order of interface commands (#504)
  > Change PFC watchdog CONFIG_DB table name from PFC_WD_TABLE to PFC_WD (#475)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>