Nexthop sync 6.12.94 update

.artifactignore

@@ -1,2 +1,3 @@
 **/*
 !*.deb
+!kconfig-diff-*.rst

.azure-pipelines/build-template.yml

@@ -6,43 +6,91 @@ parameters:
   - armhf
   - arm64
 
+- name: platform
+  type: string
+  values:
+  - vs
+  - pensando
+  default: vs
+
 - name: pool
   type: string
   values:
-  - sonicbld
-  - sonicbld_8c
-  default: sonicbld
+  - sonicso1ES-amd64
+  - sonicso1ES-arm64
+  - sonicso1ES-armhf
+  default: sonicso1ES-amd64
 
 - name: timeout
   type: number
-  default: 600
+  default: 180
+
+- name: old_artifact_name
+  type: string
 
-- name: sonic_slave
+- name: old_linux_deb_pattern
   type: string
 
 - name: artifact_name
   type: string
 
+- name: linux_deb_pattern
+  type: string
+
+- name: secure_boot
+  type: boolean
+  default: false
+
 jobs:
 - job:
   pool: ${{ parameters.pool }}
-  displayName: ${{ parameters.arch }}
+  displayName: ${{ parameters.platform }}-${{ parameters.arch }} (Secure boot ${{ parameters.secure_boot }})
   timeoutInMinutes: ${{ parameters.timeout }}
 
   container:
-    image: sonicdev-microsoft.azurecr.io:443/${{ parameters.sonic_slave }}:latest
+    image: sonicdev-microsoft.azurecr.io:443/sonic-slave-trixie:$(BUILD_BRANCH)-${{ parameters.arch }}
 
   steps:
   - checkout: self
     clean: true
-    displayName: 'Checkout code'
+    displayName: 'Checkout code'  
+  - task: DownloadPipelineArtifact@2
+    inputs:
+      source: specific
+      project: build
+      pipelineId: 499053
+      artifact: ${{ parameters.old_artifact_name }}
+      runVersion: 'specific'
+      itemPattern: ${{ parameters.old_linux_deb_pattern }}
+      targetPath: $(Agent.TempDirectory)/
+    displayName: "Download the linux-image artifact from the last build with a different kernel version"
   - script: |
-      git config --global user.email "lguohan@build.com"
-      git config --global user.name "Guohan Lu"
-      export kernel_procure_method=build
+      openssl req -new -noenc -utf8 -sha256 -days 30 -batch -x509 -subj "/CN=Autogenerated pipeline build key" -outform PEM -out build_trusted_key.pem -keyout /dev/null
+    displayName: "Generate additional secure boot certificate"
+    condition: ${{ eq(parameters.secure_boot, true) }}
+  - script: |
+      set -x
       cat /proc/cpuinfo
-      CONFIGURED_ARCH=${{ parameters.arch }} make
+      if [[ ${{ parameters.secure_boot }} = "True" ]]; then
+          export SECURE_UPGRADE_MODE=dev
+          export SECURE_UPGRADE_SIGNING_CERT=$(System.DefaultWorkingDirectory)/build_trusted_key.pem
+      fi
+      CONFIGURED_ARCH=${{ parameters.arch }} CONFIGURED_PLATFORM=${{ parameters.platform }} make
     displayName: "Compile sonic kernel"
+  - script: |
+      set -e
+      dpkg-deb -x $(Agent.TempDirectory)/${{ parameters.old_linux_deb_pattern }} $(Agent.TempDirectory)/old
+      dpkg-deb -x $(System.DefaultWorkingDirectory)/${{ parameters.linux_deb_pattern }} $(Agent.TempDirectory)/new
+      pip3 install tabulate
+      python3 $(System.DefaultWorkingDirectory)/.azure-pipelines/kcfg-diff.py \
+              --buildid $(Build.BuildId) \
+              --ref_buildid 499053 \
+              --arch ${{ parameters.arch }} \
+              --old_kcfg $(Agent.TempDirectory)/old/boot/ \
+              --new_kcfg $(Agent.TempDirectory)/new/boot/ \
+              --output $(System.DefaultWorkingDirectory)/kconfig-diff-${{ parameters.platform }}-${{ parameters.arch }}.rst
+      cat $(System.DefaultWorkingDirectory)/kconfig-diff-${{ parameters.platform }}-${{ parameters.arch }}.rst
+    displayName: "Compute the kconfig diff"
   - publish: $(System.DefaultWorkingDirectory)/
     artifact: ${{ parameters.artifact_name }}
     displayName: "Archive sonic kernel debian packages"

.azure-pipelines/kcfg-diff.py

@@ -0,0 +1,160 @@
+import argparse
+import os
+import glob
+import sys
+import re
+from tabulate import tabulate
+
+COLUMN_WIDTH_MAX = 40
+MODIF_COLUMN_WIDTH_MAX = 80
+
+RST_TEMPLATE = '''\
+SONiC-linux-kernel KConfig Difference:
+==========
+
+Reference Kernel
+------------
+- Version: {}
+- BuildID: https://dev.azure.com/mssonic/build/_build/results?buildId={}&view=results
+
+Latest Kernel
+------------
+- Version: {}
+- BuildID: https://dev.azure.com/mssonic/build/_build/results?buildId={}&view=results
+
+
+Additions & Deletions
+------------
+{}
+
+Modifications
+------------
+{}
+'''
+
+def read_data(file1):
+    data = []
+    try:
+        with open(file1, 'r') as f1:
+            data = f1.readlines()
+    except Exception as e:
+        print("ABORT: Reading failed from {}, {}".format(file1, str(e)))
+        sys.exit(1)
+
+    data = filter(lambda line: not(line.startswith('#')), data)
+    ret = dict()
+    for line in data:
+        tokens = line.split('=')
+        if len(tokens) == 2:
+            key, val = tokens[0].strip(), tokens[-1].strip()
+            ret[key] = val
+    return ret
+
+def write_data(fname, data):
+    try:
+        with open(fname, 'w') as f:
+            f.write(data)
+    except Exception as e:
+        print("ABORT: Writing to the file {} failed {}".format(fname, str(e)))
+        sys.exit(1)
+
+def generate_diff(file1, file2):
+    data_f1 = read_data(file1)
+    data_f2 = read_data(file2)
+
+    additions = []
+    modifications = []
+    deletions = []
+
+    for key_old, val_old in data_f1.items():
+        val_new = data_f2.get(key_old, None)
+        if not val_new:
+            deletions.append("{}={}".format(key_old, val_old))
+        elif val_old != val_new:
+            modifications.append("{}={}->{}".format(key_old, val_old, val_new))
+        if val_new:
+            del data_f2[key_old]
+
+    for key, val in data_f2.items():
+        additions.append("{}={}".format(key, val))
+    return additions, modifications, deletions
+
+def restrict_column_width(lis, width):
+    for i in range(0, len(lis)):
+        curr_width = len(lis[i])
+        new_val = ''
+        num_newlines = int(curr_width/width)
+        for j in range(0, num_newlines+1):
+            if (j+1)*width < curr_width:
+                new_val += lis[i][j*width:(j+1)*width]
+                new_val += "\n"
+            else:
+                new_val += lis[i][j*width:]
+        lis[i] = new_val
+
+def format_diff_table(additions, modifications, deletions):
+    max_len = max(len(additions), len(deletions))
+    additions += [''] * (max_len - len(additions))
+    deletions += [''] * (max_len - len(deletions))
+
+    restrict_column_width(additions, COLUMN_WIDTH_MAX)
+    restrict_column_width(deletions, COLUMN_WIDTH_MAX)
+    restrict_column_width(modifications, MODIF_COLUMN_WIDTH_MAX)
+
+    table_data = list(zip(additions, deletions))
+    headers = ["ADDITIONS", "DELETIONS"]
+
+    add_del = tabulate(table_data, headers=headers, tablefmt="grid")
+    mod = tabulate(list(zip(modifications)), headers=["MODIFICATIONS"], tablefmt="grid")
+    return add_del, mod
+
+def parse_kver(loc):
+    files = glob.glob(os.path.join(loc, "config-*"))
+    if len(files) > 1:
+        print("WARNING: Multiple config- files present under {}, {}".format(loc, files))
+    result = re.search(r"config-(.*)", os.path.basename(files[-1]))
+    return result.group(1)
+
+def create_parser():
+    # Create argument parser
+    parser = argparse.ArgumentParser()
+
+    # Optional arguments
+    parser.add_argument("--arch", type=str, required=True)
+    parser.add_argument("--old_kcfg", type=str, required=True)
+    parser.add_argument("--new_kcfg", type=str, required=True)
+    parser.add_argument("--output", type=str, required=True)
+    parser.add_argument("--ref_buildid", type=str, required=True)
+    parser.add_argument("--buildid", type=str, required=True)
+    return parser
+
+def verify_args(args):
+    if not glob.glob(os.path.join(args.old_kcfg, "config-*")):
+        print("ABORT: config file missing under {}".format(args.old_kcfg))
+        return False
+
+    if not glob.glob(os.path.join(args.new_kcfg, "config-*")):
+        print("ABORT: config file missing under {}".format(args.new_kcfg))
+        return False
+
+    if not os.path.exists(os.path.dirname(args.output)):
+        print("ABORT: Output Folder {} doesn't exist".format(args.output))
+        return False
+    return True
+
+if __name__ == "__main__":
+    parser = create_parser()
+    args = parser.parse_args()
+    if not verify_args(args):
+        sys.exit(1)
+
+    ver_old = parse_kver(args.old_kcfg)
+    ver_new = parse_kver(args.new_kcfg)
+    f_old = os.path.join(args.old_kcfg, 'config-{}'.format(ver_old))
+    f_new = os.path.join(args.new_kcfg, 'config-{}'.format(ver_new))
+
+    additions, modifications, deletions = generate_diff(f_old, f_new)
+    add_del, mod = format_diff_table(additions, modifications, deletions)
+
+    diff = RST_TEMPLATE.format(ver_old, args.ref_buildid, ver_new, args.buildid, add_del, mod)
+    write_data(args.output, diff)

.github/copilot-instructions.md

@@ -0,0 +1,87 @@
+# Copilot Instructions for sonic-linux-kernel
+
+## Project Overview
+
+sonic-linux-kernel contains the build scripts, patches, and kernel configuration for the SONiC Linux kernel. SONiC uses a single shared kernel across all platforms, preferring out-of-tree kernel modules for platform-specific hardware support. This repo manages kernel patches, configuration options, and the Debian kernel package build.
+
+## Architecture
+
+```
+sonic-linux-kernel/
+├── Makefile              # Top-level build — produces Debian kernel packages
+├── patch/                # Kernel configuration and patch management
+│   ├── kconfig-exclusions  # Kernel options to remove (reduce build time)
+│   ├── kconfig-inclusions  # Kernel options to add
+│   └── series            # Patch application order
+├── patches-sonic/        # SONiC-specific kernel patches
+├── patches-debian/       # Debian-specific kernel patches
+├── config.local          # Local kernel config overrides
+├── manage-config         # Script to manage kernel configuration
+├── .azure-pipelines/     # Azure DevOps CI
+└── azure-pipelines.yml   # CI pipeline
+```
+
+### Key Concepts
+- **Single kernel for all platforms**: All SONiC platforms share the same kernel image
+- **Out-of-tree modules**: Platform-specific drivers should be built as external modules
+- **kconfig management**: Options excluded via `kconfig-exclusions`, included via `kconfig-inclusions`
+- **Patch layers**: `patches-sonic/` for SONiC-specific, `patches-debian/` for Debian-derived patches
+
+## Language & Style
+
+- **Primary languages**: Shell scripts, Makefiles, C (kernel patches)
+- **Kernel patches**: Must pass `checkpatch.pl` validation
+- **Patch format**: Standard kernel patch format with upstream commit reference when applicable
+- **Commit messages**: Include original upstream commit ID and message for backported patches
+
+## Build Instructions
+
+```bash
+# Build kernel Debian packages
+make DEST=<destination_path>
+
+# If DEST is not set, packages stay in current directory
+make
+```
+
+## Kernel Configuration Changes
+
+### Excluding Options (speed up builds)
+Add to `patch/kconfig-exclusions`:
+```
+CONFIG_REISERFS_FS
+CONFIG_JFS_FS
+CONFIG_XFS_FS
+```
+
+### Including Options
+Add to `patch/kconfig-inclusions` with the desired value:
+```
+CONFIG_MY_DRIVER=m
+```
+
+## Patch Acceptance Criteria
+
+Kernel patches are accepted under these conditions:
+1. **Enable existing modules**: Enabling built-in kernel modules for SONiC use
+2. **Upstream patches**: Backported patches that are already accepted upstream (include upstream commit ID)
+3. **Common platform modules**: New modules needed by all/most platforms
+4. **Platform-specific (exception)**: Only when impossible or very difficult to build out-of-tree
+
+## PR Guidelines
+
+- **Signed-off-by**: Required on all commits
+- **CLA**: Sign Linux Foundation EasyCLA
+- **checkpatch.pl**: All kernel patches MUST pass `checkpatch.pl`
+- **Upstream first**: Prefer upstream patches — include the original commit hash
+- **Justification**: Explain why a patch is needed and why it can't be done out-of-tree
+- **CI**: Azure pipeline checks must pass
+
+## Gotchas
+
+- **Build time**: Full kernel build is slow — use kconfig-exclusions to remove unnecessary drivers
+- **All platforms affected**: Kernel changes impact every SONiC platform
+- **ABI stability**: Kernel ABI changes can break out-of-tree platform modules
+- **Patch rebasing**: During kernel version upgrades, all patches must be ported — minimize the patch set
+- **Config conflicts**: `kconfig-exclusions` and `kconfig-inclusions` can conflict — exclusions take priority
+- **Out-of-tree preference**: Reviewers will push back on patches that could be out-of-tree modules

CODEOWNERS

@@ -0,0 +1,11 @@
+# This is a comment.
+# Each line is a file pattern followed by one or more owners.
+
+# rules are explained here
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# @user will be requested for review when someone opens
+# a pull request.
+*       @sonic-net/sonic-linux-kernel-maintainer