[vpp][testbed] Disable virtio ctrl_vlan on VPP KVM DUTs

[aaronber0614]

Why I did it

On VPP DUTs, the qemu virtio-net-pci NICs default to ctrl_vlan on and drop every VLAN-tagged frame before it reaches VPP or DPDK (which registers no VLANs). As a result, L3 sub-interface RIFs never work on the KVM testbed, so the iface_loopback_action test cannot pass for sub-port RIFs.

Feature tracking issue: sonic-net/sonic-buildimage#25788

How I did it

For asic_type equal to vpp DUTs only, add "-global virtio-net-pci.ctrl_vlan=off" via the qemu commandline in sonic.xml.j2, with an explanatory comment. There are no resource changes, and non-VPP DUTs are unaffected.

How to verify it

On a VPP KVM DUT, run a tagged versus untagged counter test: before the change, tagged frames do not arrive at VPP; after the change, they do. Confirm non-VPP DUTs are unchanged.

Which release branch to backport (provide reason below if selected)

None.

Description for the changelog

Disable virtio ctrl_vlan on VPP KVM DUTs so VLAN-tagged frames reach VPP.

Part of sonic-net/sonic-buildimage#25788.

---

PR series (landing order)

Tracking issue: sonic-net/sonic-buildimage#25788

1. HLD: [doc][vpp] HLD for Router Interface Loopback Packet Action on the VPP dataplane SONiC#2462
2. sonic_ext plugin, nodes and binary API: [vpp] Add sonic_ext RIF loopback packet action nodes and binary API sonic-platform-vpp#259
3. vslib/vpp SAI adapter and defect fixes: [vpp] SAI RIF loopback packet action and pre-existing VPP vslib defect fixes sonic-sairedis#1983 (depends on 2)
4. Testbed virtio ctrl_vlan off: [vpp][testbed] Disable virtio ctrl_vlan on VPP KVM DUTs #26035
5. Enablement, lands last: [vpp][ci] Enable iface_loopback_action test on the t1-lag-vpp testbed #26036 (depends on 2, 3, 4)

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[lolyu]

✅ What's Good

Tightly-scoped testbed fix. The {% if asic_type == 'vpp' %} gate means non-VPP DUTs get byte-identical libvirt XML — zero blast radius. The inline comment clearly explains why (VPP/DPDK drives the NIC directly and never registers VLANs on the virtio control plane, so qemu's default ctrl_vlan=on silently drops tagged frames before they reach VPP), which is exactly the context a future reader needs.

📝 Review Findings

⚠️ Major

None.

📝 Minor

• The qemu:commandline/qemu:arg elements require the xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0" namespace on the root <domain> element. Please confirm the domain template already declares it (it must, if any other qemu: override exists) — otherwise libvirt rejects the XML at define time. Worth a quick sanity virsh define on a VPP KVM DUT if not already covered by your verification.
• -global virtio-net-pci.ctrl_vlan=off applies to all virtio-net-pci devices on the domain, not just the dataplane NICs (mgmt included). That's harmless here (mgmt doesn't rely on the guest virtio VLAN filter), but noting it since it's a global, not per-device, override.

Recommendations

• Confirm the qemu XML namespace is declared on <domain> and that a VPP DUT actually boots with this template (your tagged-vs-untagged counter test covers the functional side).

Status

✅ Approved with suggestions — correct, VPP-gated, well-documented. Just verify the qemu namespace/define step if not already done.

[aaronber0614]

Thanks @lolyu! Both points addressed:

1. qemu namespace - confirmed present. The <domain> root element already declares xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0" (line 1 of sonic.xml.j2), so libvirt accepts the <qemu:commandline> block at define time. No change needed. The functional path is also covered: the iface_loopback_action sub-port RIF cases pass on this testbed template, which only works if the domain defines/boots and tagged frames reach VPP.

2. -global scope - correct, it applies to all virtio-net-pci devices on the domain, mgmt NIC included. That is intentional and harmless: the mgmt interface does not rely on the guest-side virtio VLAN filter, and ctrl_vlan=off only disables in-guest VLAN filtering (VPP/DPDK does its own VLAN handling). A per-device override would require per-NIC <qemu:arg> addressing that libvirt does not cleanly expose for the dynamically-numbered dataplane NICs, so the -global form is the simpler, safe choice. It is all VPP-gated, so non-VPP DUTs get byte-identical XML.