On some ASICs (DNX Broadcom as an example), the pfcwd ACL (egress) shares its PMF banks with L3 egress ACLs. This means that if L3 ACLs are configured and then PFCWD is attempted (with a storm), orchagent crashes trying to search for an ACL rule / table that does not exist. This occurs because of the following issues seen:
When those banks are exhausted, create_acl_table() fails; PfcWdAclHandler swallowed the failed AclOrch::addAclTable() and then built an AclRule against the missing table, whose ctor SWSS_LOG_THROWs uncaught → std::terminate → SIGABRT
The fix would be to ensure that we do not attempt to create the egress pfcwd rule + table, and also rollback the created ingress rule, ensuring no inconsistency is seen. To make sure this is also portrayed to the user, we can leverage the show command show pfcwd status (coming in as a part of PFCWD HW support) - where the PfcWdOrch publishes a key to STATE_DB signifying that the create failed and the show command can pick it up and show that pfcwd has really not been configured fully, but has failed.
On some ASICs (DNX Broadcom as an example), the pfcwd ACL (egress) shares its PMF banks with L3 egress ACLs. This means that if L3 ACLs are configured and then PFCWD is attempted (with a storm), orchagent crashes trying to search for an ACL rule / table that does not exist. This occurs because of the following issues seen:
When those banks are exhausted,
create_acl_table()fails;PfcWdAclHandlerswallowed the failedAclOrch::addAclTable()and then built anAclRuleagainst the missing table, whose ctorSWSS_LOG_THROWsuncaught →std::terminate→ SIGABRTThe fix would be to ensure that we do not attempt to create the egress pfcwd rule + table, and also rollback the created ingress rule, ensuring no inconsistency is seen. To make sure this is also portrayed to the user, we can leverage the show command
show pfcwd status(coming in as a part of PFCWD HW support) - where the PfcWdOrch publishes a key to STATE_DB signifying that the create failed and the show command can pick it up and show that pfcwd has really not been configured fully, but has failed.