Merge ~danilogondolfo/netplan/+git/ubuntu:jammy_sriov_sru into ~ubuntu-core-dev/netplan/+git/ubuntu:ubuntu-jammy

[Danilo Egea Gondolfo]

This MR incorporates the PRs below into Jammy

https://github.com/canonical/netplan/pull/439
https://github.com/canonical/netplan/pull/454

It was made necessary after a recent request https://bugs.launchpad.net/netplan/+bug/2083008

A PPA for Jammy is available here https://launchpad.net/~danilogondolfo/+archive/ubuntu/netplan-sru/+packages

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/amd64/n/netplan.io/20241008_134825_0a904@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/arm64/n/netplan.io/20241008_135202_82a54@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/s390x/n/netplan.io/20241008_125850_d109e@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/armhf/n/netplan.io/20241008_144601_8c1dc@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/ppc64el/n/netplan.io/20241008_151241_e977a@/log.gz

[Lukas Märdian (slyon)]

This is a preliminary review, as I didn't have time to review all the individual patches, yet. But I left a few inline comments already.

PR#454 is only included in Netplan v1.1 (in Oracular, but not in Noble, yet). So this needs a clear explanation on the SRU bug report. We usually want to ship the features/fixes top-down, so that people upgrading from older releases won't regress. This needs extra paper-work (SRU template) for https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/2020409

How do we avoid issues with phased updates this time around? https://ubuntu-archive-team.ubuntu.com/phased-updates.html

[Danilo Egea Gondolfo (danilogondolfo)]

PR#454 was cherry picked into netplan 1.0.1, which is in Noble :)

https://github.com/canonical/netplan/releases/tag/1.0.1
https://launchpad.net/ubuntu/+source/netplan.io/1.0.1-1ubuntu2~24.04.1

[Danilo Egea Gondolfo (danilogondolfo)]

I split the SRU paperwork. Each bug has its own description and test cases:

https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018

https://bugs.launchpad.net/netplan/+bug/2020409

[Lukas Märdian (slyon)]

- PR#454: Ah that's good. Indeed, it is already in 1.0.1/Noble. Sorry, I didn't spot this.

- lp1988018: Patches match upstream with unexpectedly little fuzz and any differences are sensible and explained. Great!

- lp2020409: Patches match upstream with unexpectedly little fuzz.

Overall, this is looking pretty good (besides the .symbols file version). Tests look fine, too, with only expected failures. Thanks for providing DEP-3 headers, providing test builds and autopkgtest logs!

We should double-check the phased-updates situation to see if we can do anything about it in this update.

[Lukas Märdian (slyon)]

thanks for the .symbol version string fixes.

See https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/2033259/comments/12 for my phased-updates suggestion.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 3249112..067a2ea 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+netplan.io (0.107.1-3ubuntu0.22.04.2) jammy; urgency=medium
+
+  * debian/patches/lp1988018: VF-LAG activation
+    Fixes the order in which SR-IOV configuration is performed and
+    cooperates with VF-LAG activation (LP: #1988018).
+  * debian/patches/lp2020409:
+    Enables setting the embedded-switch mode without having to define
+    virtual functions (LP: #2020409).
+  * debian/libnetplan0.symbols: New symbol _netplan_netdef_get_bond_mode.
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Mon, 07 Oct 2024 10:57:38 +0100
+
 netplan.io (0.107.1-3ubuntu0.22.04.1) jammy; urgency=medium
 
   * Backport netplan.io 0.107.1-3 to 22.04 (LP: #2058031):
diff --git a/debian/libnetplan0.symbols b/debian/libnetplan0.symbols
index 908927f..db07ea6 100644
--- a/debian/libnetplan0.symbols
+++ b/debian/libnetplan0.symbols
@@ -9,6 +9,7 @@ libnetplan.so.0.0 libnetplan0 #MINVER#
  _netplan_iter_defs_per_devtype_next@Base 0.104
  _netplan_nameserver_iter_free@Base 0.107
  _netplan_nameserver_iter_next@Base 0.107
+ _netplan_netdef_get_bond_mode@Base 0.107.1-3ubuntu0.22.04.2~
  _netplan_netdef_get_critical@Base 0.105
  _netplan_netdef_get_delay_vf_rebind@Base 0.106
  _netplan_netdef_get_embedded_switch_mode@Base 0.106
diff --git a/debian/patches/lp1988018/0018-libnetplan-add-a-getter-for-bond-mode.patch b/debian/patches/lp1988018/0018-libnetplan-add-a-getter-for-bond-mode.patch
new file mode 100644
index 0000000..d891729
--- /dev/null
+++ b/debian/patches/lp1988018/0018-libnetplan-add-a-getter-for-bond-mode.patch
@@ -0,0 +1,115 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Wed, 7 Feb 2024 10:53:13 +0000
+Subject: libnetplan: add a getter for bond mode
+
+Add a new internal function to expose the bond mode from
+netdef.bond_params.mode and a Python binding for it.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ python-cffi/netplan/_build_cffi.py |  1 +
+ python-cffi/netplan/netdef.py      |  4 ++++
+ src/types.c                        | 11 +++++++++++
+ src/util-internal.h                |  3 +++
+ tests/test_libnetplan.py           | 30 ++++++++++++++++++++++++++++++
+ 5 files changed, 49 insertions(+)
+
+diff --git a/python-cffi/netplan/_build_cffi.py b/python-cffi/netplan/_build_cffi.py
+index ba0af4e..f9a18b7 100644
+--- a/python-cffi/netplan/_build_cffi.py
++++ b/python-cffi/netplan/_build_cffi.py
+@@ -116,6 +116,7 @@ ffibuilder.cdef("""
+     gboolean _netplan_netdef_is_trivial_compound_itf(const NetplanNetDefinition* netdef);
+     int _netplan_state_get_vf_count_for_def(
+         const NetplanState* np_state, const NetplanNetDefinition* netdef, NetplanError** error);
++    ssize_t _netplan_netdef_get_bond_mode(const NetplanNetDefinition* netdef, char* out_buffer, size_t out_buf_size);
+ 
+     // Iterators (internal)
+     struct netdef_pertype_iter* _netplan_state_new_netdef_pertype_iter(NetplanState* np_state, const char* def_type);
+diff --git a/python-cffi/netplan/netdef.py b/python-cffi/netplan/netdef.py
+index cc23725..a323fff 100644
+--- a/python-cffi/netplan/netdef.py
++++ b/python-cffi/netplan/netdef.py
+@@ -143,6 +143,10 @@ class NetDefinition():
+             raise NetplanException(msg)
+         return count
+ 
++    @property
++    def _bond_mode(self) -> str:
++        return _string_realloc_call_no_error(lambda b: lib._netplan_netdef_get_bond_mode(self._ptr, b, len(b)))
++
+     @property
+     def _is_trivial_compound_itf(self) -> bool:
+         '''
+diff --git a/src/types.c b/src/types.c
+index b885e6c..2ce6925 100644
+--- a/src/types.c
++++ b/src/types.c
+@@ -619,3 +619,14 @@ _netplan_netdef_is_trivial_compound_itf(const NetplanNetDefinition* netdef)
+         return !complex_object_is_dirty(netdef, &netdef->bridge_params, sizeof(netdef->bridge_params));
+     return FALSE;
+ }
++
++ssize_t
++_netplan_netdef_get_bond_mode(const NetplanNetDefinition* netdef, char* out_buffer, size_t out_buf_size)
++{
++    g_assert(netdef);
++
++    if (netdef->type == NETPLAN_DEF_TYPE_BOND && netdef->bond_params.mode)
++        return netplan_copy_string(netdef->bond_params.mode, out_buffer, out_buf_size);
++    else
++        return FALSE;
++}
+diff --git a/src/util-internal.h b/src/util-internal.h
+index e9c2d13..54f962d 100644
+--- a/src/util-internal.h
++++ b/src/util-internal.h
+@@ -123,6 +123,9 @@ netplan_netdef_get_delay_virtual_functions_rebind(const NetplanNetDefinition* ne
+ NETPLAN_INTERNAL guint
+ _netplan_netdef_get_vlan_id(const NetplanNetDefinition* netdef);
+ 
++NETPLAN_INTERNAL ssize_t
++_netplan_netdef_get_bond_mode(const NetplanNetDefinition* netdef, char* out_buffer, size_t out_buf_size);
++
+ NETPLAN_INTERNAL gboolean
+ _netplan_netdef_is_trivial_compound_itf(const NetplanNetDefinition* netdef);
+ 
+diff --git a/tests/test_libnetplan.py b/tests/test_libnetplan.py
+index 134cfa0..395746a 100644
+--- a/tests/test_libnetplan.py
++++ b/tests/test_libnetplan.py
+@@ -984,3 +984,33 @@ tail:
+         '''
+         with self.assertRaises(ValueError):
+             netplan.NetplanParserException('not the expected file path, line and column', 0, 0)
++
++    def test_netdef_get_bond_mode(self):
++        state = state_from_yaml(self.confdir, '''network:
++  ethernets:
++    eth0:
++      dhcp4: false
++  bonds:
++    bond0:
++      parameters:
++        mode: active-backup
++      dhcp4: false
++      interfaces:
++        - eth0
++      ''')
++
++        self.assertEqual(state['bond0']._bond_mode, "active-backup")
++
++    def test_netdef_get_bond_mode_unset(self):
++        state = state_from_yaml(self.confdir, '''network:
++  ethernets:
++    eth0:
++      dhcp4: false
++  bonds:
++    bond0:
++      dhcp4: false
++      interfaces:
++        - eth0
++      ''')
++
++        self.assertIsNone(state['bond0']._bond_mode)
diff --git a/debian/patches/lp1988018/0019-sriov-move-the-udev-logic-to-a-service-unit.patch b/debian/patches/lp1988018/0019-sriov-move-the-udev-logic-to-a-service-unit.patch
new file mode 100644
index 0000000..99ea02a
--- /dev/null
+++ b/debian/patches/lp1988018/0019-sriov-move-the-udev-logic-to-a-service-unit.patch
@@ -0,0 +1,163 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 25 Jan 2024 12:25:40 +0000
+Subject: sriov: move the udev logic to a service unit
+
+netplan apply will be called multiple times in parallel when the udev
+rules matches multiple device. That might cause problems during boot.
+
+Move the call to "netplan apply --sriov-only" to a service so it will be
+called just once for all the interfaces. The sriov-rebind service must
+wait for this new service to finish before start running.
+
+This change was tested with real hardware and appears to work fine.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ src/sriov.c | 93 +++++++++++++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 81 insertions(+), 12 deletions(-)
+
+diff --git a/src/sriov.c b/src/sriov.c
+index 710f1a8..86881b2 100644
+--- a/src/sriov.c
++++ b/src/sriov.c
+@@ -40,6 +40,7 @@ write_sriov_rebind_systemd_unit(GHashTable* pfs, const char* rootdir, GError** e
+     GString* s = g_string_new("[Unit]\n");
+     g_string_append(s, "Description=(Re-)bind SR-IOV Virtual Functions to their driver\n");
+     g_string_append_printf(s, "After=network.target\n");
++    g_string_append_printf(s, "After=netplan-sriov-apply.service\n");
+ 
+     /* Run after udev */
+     g_hash_table_iter_init(&iter, pfs);
+@@ -51,19 +52,60 @@ write_sriov_rebind_systemd_unit(GHashTable* pfs, const char* rootdir, GError** e
+ 
+     g_string_append(s, "\n[Service]\nType=oneshot\n");
+     g_string_truncate(interfaces, interfaces->len-1); /* cut trailing whitespace */
+-    g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan rebind %s\n", interfaces->str);
++    g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan rebind --debug %s\n", interfaces->str);
+ 
+     g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
+     g_string_free(s, TRUE);
+     s = g_string_new(new_s);
+-    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
++    mode_t orig_umask = umask(022);
++    g_string_free_to_file(s, rootdir, path, NULL);
++    umask(orig_umask);
+     g_string_free(interfaces, TRUE);
+ 
+     safe_mkdir_p_dir(link);
+     if (symlink(path, link) < 0 && errno != EEXIST) {
+         // LCOV_EXCL_START
+         g_set_error(error, NETPLAN_FILE_ERROR, errno,
+-                    "failed to create enablement symlink: %m\n");
++                    "failed to create enablement symlink: %m");
++        return FALSE;
++        // LCOV_EXCL_STOP
++    }
++    return TRUE;
++}
++
++static gboolean
++write_sriov_apply_systemd_unit(GHashTable* pfs, const char* rootdir, GError** error)
++{
++    g_autofree gchar* id_escaped = NULL;
++    g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/multi-user.target.wants/netplan-sriov-apply.service", NULL);
++    g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-sriov-apply.service", NULL);
++    GHashTableIter iter;
++    gpointer key;
++
++    GString* s = g_string_new("[Unit]\n");
++    g_string_append(s, "Description=Apply SR-IOV configuration\n");
++    g_string_append_printf(s, "After=network.target\n");
++
++    g_hash_table_iter_init(&iter, pfs);
++    while (g_hash_table_iter_next (&iter, &key, NULL)) {
++        g_string_append_printf(s, "After=sys-subsystem-net-devices-%s.device\n", (gchar*) key);
++    }
++
++    g_string_append(s, "\n[Service]\nType=oneshot\n");
++    g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan apply --sriov-only\n");
++
++    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
++    g_string_free(s, TRUE);
++    s = g_string_new(new_s);
++    mode_t orig_umask = umask(022);
++    g_string_free_to_file(s, rootdir, path, NULL);
++    umask(orig_umask);
++
++    safe_mkdir_p_dir(link);
++    if (symlink(path, link) < 0 && errno != EEXIST) {
++        // LCOV_EXCL_START
++        g_set_error(error, G_MARKUP_ERROR, G_MARKUP_ERROR_INVALID_CONTENT,
++                    "failed to create enablement symlink: %m");
+         return FALSE;
+         // LCOV_EXCL_STOP
+     }
+@@ -83,6 +125,8 @@ netplan_state_finish_sriov_write(const NetplanState* np_state, const char* rootd
+ 
+     if (np_state) {
+         GHashTable* rebind_pfs = g_hash_table_new(g_str_hash, g_str_equal);
++        GHashTable* apply_pfs = g_hash_table_new(g_str_hash, g_str_equal);
++
+         /* Find netdev interface names for SR-IOV PFs*/
+         for (GList* iterator = np_state->netdefs_ordered; iterator; iterator = iterator->next) {
+             def = (NetplanNetDefinition*) iterator->data;
+@@ -93,6 +137,15 @@ netplan_state_finish_sriov_write(const NetplanState* np_state, const char* rootd
+                     pf = def;
+                 else if (def->sriov_link)
+                     pf = def->sriov_link;
++
++                if (pf) {
++                    if (pf->set_name)
++                        g_hash_table_add(apply_pfs, pf->set_name);
++                    else if (!pf->has_match) /* netdef_id == interface name */
++                        g_hash_table_add(apply_pfs, pf->id);
++                    else
++                        g_warning("%s: Cannot determine SR-IOV PF interface name.", pf->id);
++                }
+             }
+ 
+             if (pf && pf->sriov_delay_virtual_functions_rebind) {
+@@ -106,17 +159,33 @@ netplan_state_finish_sriov_write(const NetplanState* np_state, const char* rootd
+                               pf->id);
+             }
+         }
+-        if (g_hash_table_size(rebind_pfs) > 0) {
+-            ret = write_sriov_rebind_systemd_unit(rebind_pfs, rootdir, NULL);
++
++        if (any_sriov) {
++            ret = write_sriov_apply_systemd_unit(apply_pfs, rootdir, NULL);
++            if (!ret) {
++                // LCOV_EXCL_START
++                g_warning("netplan-sriov-apply.service cannot be created.");
++                goto error;
++                // LCOV_EXCL_STOP
++            }
++
++            /*
++             * The sriov-apply service will always be created (as long as there is any sr-iov configuration)
++             * and the sriov-rebind MUST only run after apply. As sriov-apply will always be there if sriov-rebind
++             * is present, using the After= dependency statement is enough (Requires= is not necessary).
++            */
++            if (g_hash_table_size(rebind_pfs) > 0) {
++                ret = write_sriov_rebind_systemd_unit(rebind_pfs, rootdir, NULL);
++                if (!ret)
++                // LCOV_EXCL_START
++                    g_warning("netplan-sriov-rebind.service cannot be created.");
++                // LCOV_EXCL_STOP
++            }
+         }
+-        g_hash_table_destroy(rebind_pfs);
+-    }
+ 
+-    if (any_sriov) {
+-        /* For now we execute apply --sriov-only everytime there is a new
+-        SR-IOV device appearing, which is fine as it's relatively fast */
+-        GString *udev_rule = g_string_new("ACTION==\"add\", SUBSYSTEM==\"net\", ATTRS{sriov_totalvfs}==\"?*\", RUN+=\"/usr/sbin/netplan apply --sriov-only\"\n");
+-        g_string_free_to_file(udev_rule, rootdir, "run/udev/rules.d/99-sriov-netplan-setup.rules", NULL);
++error:
++        g_hash_table_destroy(rebind_pfs);
++        g_hash_table_destroy(apply_pfs);
+     }
+ 
+     return ret;
diff --git a/debian/patches/lp1988018/0020-sriov-check-the-eswitch-mode-before-trying-to-change.patch b/debian/patches/lp1988018/0020-sriov-check-the-eswitch-mode-before-trying-to-change.patch
new file mode 100644
index 0000000..b3d1d62
--- /dev/null
+++ b/debian/patches/lp1988018/0020-sriov-check-the-eswitch-mode-before-trying-to-change.patch
@@ -0,0 +1,100 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 25 Jan 2024 14:59:44 +0000
+Subject: sriov: check the eswitch mode before trying to change it
+
+The eswitch mode will be modified with devlink regardless its current
+mode. It causes issues when VF LAG is enabled in the PF. This particular
+problem will only happen on Mellanox interfaces (hopefully) due to the
+VF LAG feature.
+
+Retrieving the eswitch mode with devlink seems to not work on all NICs.
+If it fails to get the information, the new method will return
+'undetermined' and we set the eswitch mode anyway.
+
+In a setup with Mellanox NICs with eswitch mode set to switchdev and VF
+LAG enabled, netplan apply will break the setup even if there is nothing
+to change in the SR-IOV NICs. This change will prevent it to happen.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ netplan_cli/cli/sriov.py | 52 ++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/netplan_cli/cli/sriov.py b/netplan_cli/cli/sriov.py
+index dbec831..4f3448c 100644
+--- a/netplan_cli/cli/sriov.py
++++ b/netplan_cli/cli/sriov.py
+@@ -16,6 +16,7 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
++import json
+ import logging
+ import os
+ import subprocess
+@@ -152,6 +153,35 @@ class PCIDevice(object):
+             ]
+         )
+ 
++    def devlink_eswitch_mode(self) -> str:
++        """Query eswitch mode via devlink for the PCI device
++        :return: the eswitch mode or '__undetermined' if it can't be retrieved
++        :rtype: str
++        """
++        pci = f"pci/{self.pci_addr}"
++        try:
++            output = subprocess.check_output(
++                [
++                    "/sbin/devlink",
++                    "-j",
++                    "dev",
++                    "eswitch",
++                    "show",
++                    pci,
++                ],
++                stderr=subprocess.DEVNULL,
++            )
++        except subprocess.CalledProcessError:
++            return '__undetermined'
++
++        json_output = json.loads(output)
++
++        # The JSON document looks like this when the 'mode' is available:
++        # {"dev":{"pci/0000:03:00.0":{"mode":"switchdev"}}}
++        # and like this when it's not available
++        # {"dev":{}}
++        return json_output.get("dev", {}).get(pci, {}).get('mode', '__undetermined')
++
+     def __str__(self) -> str:
+         """String represenation of object
+         :return: PCI address of string
+@@ -447,16 +477,18 @@ def apply_sriov_config(config_manager, rootdir='/'):
+         if eswitch_mode in ['switchdev', 'legacy']:
+             pci_addr = _get_pci_slot_name(iface)
+             pcidev = PCIDevice(pci_addr)
+-            if pcidev.is_pf:
+-                logging.debug("Found VFs of {}: {}".format(pcidev, pcidev.vf_addrs))
+-                if pcidev.vfs:
+-                    rebind_delayed = netdef._delay_virtual_functions_rebind
+-                    try:
+-                        unbind_vfs(pcidev.vfs, pcidev.driver)
+-                        pcidev.devlink_set('eswitch', 'mode', eswitch_mode)
+-                    finally:
+-                        if not rebind_delayed:
+-                            bind_vfs(pcidev.vfs, pcidev.driver)
++            current_eswitch_mode_system = pcidev.devlink_eswitch_mode()
++            if eswitch_mode != current_eswitch_mode_system:
++                if pcidev.is_pf:
++                    logging.debug("Found VFs of {}: {}".format(pcidev, pcidev.vf_addrs))
++                    if pcidev.vfs:
++                        rebind_delayed = netdef._delay_virtual_functions_rebind
++                        try:
++                            unbind_vfs(pcidev.vfs, pcidev.driver)
++                            pcidev.devlink_set('eswitch', 'mode', eswitch_mode)
++                        finally:
++                            if not rebind_delayed:
++                                bind_vfs(pcidev.vfs, pcidev.driver)
+ 
+     filtered_vlans_set = set()
+     for vlan, netdef in np_state.vlans.items():
diff --git a/debian/patches/lp1988018/0021-sriov_rebind-cooperate-with-VF-LAG-activation.patch b/debian/patches/lp1988018/0021-sriov_rebind-cooperate-with-VF-LAG-activation.patch
new file mode 100644
index 0000000..c61cb4a
--- /dev/null
+++ b/debian/patches/lp1988018/0021-sriov_rebind-cooperate-with-VF-LAG-activation.patch
@@ -0,0 +1,172 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 25 Jan 2024 17:27:40 +0000
+Subject: sriov_rebind: cooperate with VF LAG activation
+
+When a PF is part of a bond interface, the mlx5 driver will try to
+activate the VF LAG feature. While it happens, VFs can't be bound or the
+process will fail.
+
+This change adds a verification step to netplan rebind so, if the PF is
+part of a bond, it will wait for a few seconds until the VF LAG feature
+is reported as active by the driver.
+
+This is done through the debugfs interface provided by the mlx5 driver
+in newer version of the kernel (5.19+).
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ netplan_cli/cli/commands/sriov_rebind.py | 124 ++++++++++++++++++++++++++++++-
+ 1 file changed, 122 insertions(+), 2 deletions(-)
+
+diff --git a/netplan_cli/cli/commands/sriov_rebind.py b/netplan_cli/cli/commands/sriov_rebind.py
+index 373d9c8..a8c324f 100644
+--- a/netplan_cli/cli/commands/sriov_rebind.py
++++ b/netplan_cli/cli/commands/sriov_rebind.py
+@@ -18,9 +18,29 @@
+ '''netplan SR-IOV rebind command line'''
+ 
+ import logging
++import os
++from time import sleep
+ 
+ from .. import utils
+ from ..sriov import PCIDevice, bind_vfs, _get_pci_slot_name
++import netplan
++
++
++FALLBACK_WAIT_TIME_SEC = 3
++INTERVAL_SEC = 0.2
++MAX_WAITING_TIME_SEC = 5
++
++
++class MLX5VFLAGStateNotFound(Exception):
++    pass
++
++
++class MLX5VFLAGStateCannotBeRead(Exception):
++    pass
++
++
++class MLX5VFLAGStateDisabled(Exception):
++    pass
+ 
+ 
+ class NetplanSriovRebind(utils.NetplanCommand):
+@@ -31,6 +51,8 @@ class NetplanSriovRebind(utils.NetplanCommand):
+                          leaf=True)
+ 
+     def run(self):
++        self.parser.add_argument('--root-dir', default='/',
++                                 help='Search for configuration files in this root directory instead of /')
+         self.parser.add_argument('netdevs', type=str, nargs='*', default=[],
+                                  help='Space separated list of PF interface names')
+         self.func = self.command_rebind
+@@ -44,7 +66,105 @@ class NetplanSriovRebind(utils.NetplanCommand):
+             pci_addr = _get_pci_slot_name(iface)
+             pcidev = PCIDevice(pci_addr)
+             if not pcidev.is_pf:
+-                logging.warning('{} does not seem to be a SR-IOV physical function'.format(iface))
++                logging.debug('{} does not seem to be a SR-IOV physical function'.format(iface))
+                 continue
++
++            # There are some hardware-specific configuration that must happen *before* the bind
++            # of VFs to their drivers. Some settings take time to be effective and, when possible,
++            # we need to wait until the driver reports it's ready.
++            self._perform_hardware_specific_quirks(iface, pcidev)
++
+             bound_vfs = bind_vfs(pcidev.vfs, pcidev.driver)
+-            logging.info('{}: bound {} VFs'.format(pcidev, len(bound_vfs)))
++            logging.debug('{}: bound {} VFs'.format(pcidev, len(bound_vfs)))
++
++    def _perform_hardware_specific_quirks(self, iface: str, pf: PCIDevice):
++        """
++        Perform any hardware-specific quirks for the given SR-IOV device to make
++        sure it's ready before the bind.
++        """
++
++        if pf.driver in ['mlx5_core']:
++            # Mellanox specific quirks
++
++            parser = netplan.Parser()
++            parser.load_yaml_hierarchy(self.root_dir)
++            np_state = netplan.State()
++            np_state.import_parser_results(parser)
++
++            for netdef in np_state.ethernets.values():
++                if (netdef._has_match and netdef.set_name == iface) or netdef.id == iface:
++                    if bond_link := netdef.links.get('bond'):
++                        # VF LAG support. See LP: #1988018
++                        # If the PF is a member of a bond, the user might be trying to enable the
++                        # VF LAG feature.
++                        # Mellanox VF LAG requires that the LAG state reports as 'active'
++                        # *before* VFs can be bound to the driver. Performing the bind operation
++                        # before the device is ready will cause the VF LAG feature to never be enabled.
++
++                        # Another condition for the VF LAG activation is that the LAG mode
++                        # must be one of 'active-backup', 'balanced-xor' or '802.3ad'.
++                        bond_mode = bond_link._bond_mode
++                        if not self._is_bond_mode_supported(bond_mode):
++                            logging.debug(f'{iface} - LAG mode {bond_mode} is not supported by VF LAG')
++                            continue
++
++                        logging.debug(f'{iface} - waiting for the LAG state to be \'active\'')
++                        try:
++                            self._wait_for_mlx5_pf_lag_state_active(pf)
++                        except MLX5VFLAGStateCannotBeRead:
++                            logging.debug(f'{iface} - VF LAG state cannot be read')
++                        except MLX5VFLAGStateNotFound:
++                            logging.debug(f'{iface} - VF LAG state debugfs file not found')
++                        except MLX5VFLAGStateDisabled:
++                            logging.debug(f'{iface} - VF LAG state is still \'disabled\' after waiting')
++                        else:
++                            logging.debug(f'{iface} - VF LAG state is \'active\'')
++
++    def _wait_for_mlx5_pf_lag_state_active(self, pf: PCIDevice):
++        """
++        The mlx5 driver added support for debugfs in https://github.com/torvalds/linux/commit/7f46a0b7327a
++        It's available since kernel 5.19 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19
++        """
++        retries = int(MAX_WAITING_TIME_SEC / INTERVAL_SEC)
++        pci_addr = pf.pci_addr
++        path = f'/sys/kernel/debug/mlx5/{pci_addr}/lag/state'
++
++        if not os.path.exists(path):
++            # If the debugfs file doesn't exist, it might be because this version of the mlx5 driver
++            # still doesn't support it or because the debugfs is not mounted.
++            # In this case, we probably should still wait for a few seconds to give time for the
++            # driver to change state.
++            # Based on tests with a ConnectX-5 NIC, 1 second is enough time, so let's wait a bit more
++            # just in case. This delay will only be introduced if the PF is part of a bond.
++            sleep(FALLBACK_WAIT_TIME_SEC)
++            raise MLX5VFLAGStateNotFound
++
++        while retries > 0:
++            try:
++                if self._get_mlx5_vf_lag_state(pci_addr) != 'active':
++                    logging.debug(f'{pci_addr} VF LAG state is not active yet, retrying in 1 second...')
++                    # Based on tests with a ConnectX-5 NIC, a single 1-second cycle was enough time to
++                    # allow the interfaces to change state.
++                    sleep(INTERVAL_SEC)
++                else:
++                    return
++
++            except Exception:
++                raise MLX5VFLAGStateCannotBeRead
++
++            retries = retries - 1
++
++        raise MLX5VFLAGStateDisabled
++
++    def _is_bond_mode_supported(self, mode: str) -> bool:
++        '''
++        Return True or False if the bond mode is one of the supported modes
++        for the VG LAG activation.
++        '''
++        return mode in ['active-backup', 'balanced-xor', '802.3ad']
++
++    def _get_mlx5_vf_lag_state(self, pci_addr: str) -> str:
++        path = f'/sys/kernel/debug/mlx5/{pci_addr}/lag/state'
++
++        with open(path, 'r') as f:
++            return f.read().strip()
diff --git a/debian/patches/lp1988018/0022-sriov_rebind-netplan-rebind-debug-setup.patch b/debian/patches/lp1988018/0022-sriov_rebind-netplan-rebind-debug-setup.patch
new file mode 100644
index 0000000..7c15299
--- /dev/null
+++ b/debian/patches/lp1988018/0022-sriov_rebind-netplan-rebind-debug-setup.patch
@@ -0,0 +1,113 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 8 Feb 2024 15:36:30 +0000
+Subject: sriov_rebind: netplan rebind --debug setup
+
+All the subcommands support the parameter --debug but it's not really
+implemented (only the global netplan --debug is).
+
+The main reason for that is because the global --debug also enables glib
+debugging messages and I'd like to not have all that noise in the output
+of netplan rebind as --debug will be used by default in the systemd
+service unit.
+
+But the real reason for that is because it's really tricky to get the
+messages from the root logger from stderr in unit tests. Changing the
+root logger to log them to stdout will break many tests.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ netplan_cli/cli/commands/sriov_rebind.py | 36 ++++++++++++++++++++++++--------
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/netplan_cli/cli/commands/sriov_rebind.py b/netplan_cli/cli/commands/sriov_rebind.py
+index a8c324f..334dcaa 100644
+--- a/netplan_cli/cli/commands/sriov_rebind.py
++++ b/netplan_cli/cli/commands/sriov_rebind.py
+@@ -19,6 +19,7 @@
+ 
+ import logging
+ import os
++import sys
+ from time import sleep
+ 
+ from .. import utils
+@@ -57,7 +58,24 @@ class NetplanSriovRebind(utils.NetplanCommand):
+                                  help='Space separated list of PF interface names')
+         self.func = self.command_rebind
+ 
++        self.logger = logging.getLogger('sriov_rebind')
++        self.logger.propagate = False
++        log_handler = logging.StreamHandler(stream=sys.stdout)
++
+         self.parse_args()
++
++        # netplan rebind --debug setup
++        if self.debug:
++            self.logger.setLevel(logging.DEBUG)
++            log_handler.setLevel(logging.DEBUG)
++            log_handler.setFormatter(logging.Formatter('%(levelname)s:%(message)s'))
++        else:
++            self.logger.setLevel(logging.INFO)
++            log_handler.setLevel(logging.INFO)
++            log_handler.setFormatter(logging.Formatter('%(message)s'))
++
++        self.logger.addHandler(log_handler)
++
+         self.run_command()
+ 
+     def command_rebind(self):
+@@ -66,7 +84,7 @@ class NetplanSriovRebind(utils.NetplanCommand):
+             pci_addr = _get_pci_slot_name(iface)
+             pcidev = PCIDevice(pci_addr)
+             if not pcidev.is_pf:
+-                logging.debug('{} does not seem to be a SR-IOV physical function'.format(iface))
++                self.logger.debug('{} does not seem to be a SR-IOV physical function'.format(iface))
+                 continue
+ 
+             # There are some hardware-specific configuration that must happen *before* the bind
+@@ -75,7 +93,7 @@ class NetplanSriovRebind(utils.NetplanCommand):
+             self._perform_hardware_specific_quirks(iface, pcidev)
+ 
+             bound_vfs = bind_vfs(pcidev.vfs, pcidev.driver)
+-            logging.debug('{}: bound {} VFs'.format(pcidev, len(bound_vfs)))
++            self.logger.debug('{}: bound {} VFs'.format(pcidev, len(bound_vfs)))
+ 
+     def _perform_hardware_specific_quirks(self, iface: str, pf: PCIDevice):
+         """
+@@ -105,20 +123,20 @@ class NetplanSriovRebind(utils.NetplanCommand):
+                         # must be one of 'active-backup', 'balanced-xor' or '802.3ad'.
+                         bond_mode = bond_link._bond_mode
+                         if not self._is_bond_mode_supported(bond_mode):
+-                            logging.debug(f'{iface} - LAG mode {bond_mode} is not supported by VF LAG')
++                            self.logger.debug(f'{iface} - LAG mode {bond_mode} is not supported by VF LAG')
+                             continue
+ 
+-                        logging.debug(f'{iface} - waiting for the LAG state to be \'active\'')
++                        self.logger.debug(f'{iface} - waiting for the LAG state to be \'active\'')
+                         try:
+                             self._wait_for_mlx5_pf_lag_state_active(pf)
+                         except MLX5VFLAGStateCannotBeRead:
+-                            logging.debug(f'{iface} - VF LAG state cannot be read')
++                            self.logger.debug(f'{iface} - VF LAG state cannot be read')
+                         except MLX5VFLAGStateNotFound:
+-                            logging.debug(f'{iface} - VF LAG state debugfs file not found')
++                            self.logger.debug(f'{iface} - VF LAG state debugfs file not found')
+                         except MLX5VFLAGStateDisabled:
+-                            logging.debug(f'{iface} - VF LAG state is still \'disabled\' after waiting')
++                            self.logger.debug(f'{iface} - VF LAG state is still \'disabled\' after waiting')
+                         else:
+-                            logging.debug(f'{iface} - VF LAG state is \'active\'')
++                            self.logger.debug(f'{iface} - VF LAG state is \'active\'')
+ 
+     def _wait_for_mlx5_pf_lag_state_active(self, pf: PCIDevice):
+         """
+@@ -142,7 +160,7 @@ class NetplanSriovRebind(utils.NetplanCommand):
+         while retries > 0:
+             try:
+                 if self._get_mlx5_vf_lag_state(pci_addr) != 'active':
+-                    logging.debug(f'{pci_addr} VF LAG state is not active yet, retrying in 1 second...')
++                    self.logger.debug(f'{pci_addr} VF LAG state is not active yet, retrying...')
+                     # Based on tests with a ConnectX-5 NIC, a single 1-second cycle was enough time to
+                     # allow the interfaces to change state.
+                     sleep(INTERVAL_SEC)
diff --git a/debian/patches/lp1988018/0023-tests-sriov-adapt-tests-to-the-last-sr-iov-related-c.patch b/debian/patches/lp1988018/0023-tests-sriov-adapt-tests-to-the-last-sr-iov-related-c.patch
new file mode 100644
index 0000000..66eacb6
--- /dev/null
+++ b/debian/patches/lp1988018/0023-tests-sriov-adapt-tests-to-the-last-sr-iov-related-c.patch
@@ -0,0 +1,554 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 25 Jan 2024 17:42:34 +0000
+Subject: tests/sriov: adapt tests to the last sr-iov related changes
+
+And add a few more tests and delete tests that don't make sense anymore.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ tests/generator/base.py           |   6 -
+ tests/generator/test_ethernets.py | 109 +-------------
+ tests/test_sriov.py               | 299 +++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 294 insertions(+), 120 deletions(-)
+
+diff --git a/tests/generator/base.py b/tests/generator/base.py
+index d1298e3..f99fd73 100644
+--- a/tests/generator/base.py
++++ b/tests/generator/base.py
+@@ -378,12 +378,6 @@ class TestBase(unittest.TestCase):
+             with open(os.path.join(networkd_dir, '10-netplan-' + fname)) as f:
+                 self.assertEqual(f.read(), contents)
+ 
+-    def assert_additional_udev(self, file_contents_map):
+-        udev_dir = os.path.join(self.workdir.name, 'run', 'udev', 'rules.d')
+-        for fname, contents in file_contents_map.items():
+-            with open(os.path.join(udev_dir, fname)) as f:
+-                self.assertEqual(f.read(), contents)
+-
+     def assert_networkd_udev(self, file_contents_map):
+         udev_dir = os.path.join(self.workdir.name, 'run', 'udev', 'rules.d')
+         if not file_contents_map:
+diff --git a/tests/generator/test_ethernets.py b/tests/generator/test_ethernets.py
+index 6c1a101..b67b044 100644
+--- a/tests/generator/test_ethernets.py
++++ b/tests/generator/test_ethernets.py
+@@ -18,7 +18,7 @@
+ 
+ import os
+ 
+-from .base import TestBase, ND_DHCP4, UDEV_MAC_RULE, UDEV_NO_MAC_RULE, UDEV_SRIOV_RULE, \
++from .base import TestBase, ND_DHCP4, UDEV_MAC_RULE, UDEV_NO_MAC_RULE, \
+     NM_MANAGED, NM_UNMANAGED, NM_MANAGED_MAC, NM_UNMANAGED_MAC, \
+     NM_MANAGED_DRIVER, NM_UNMANAGED_DRIVER
+ 
+@@ -82,45 +82,6 @@ LinkLocalAddressing=ipv6
+ '''})
+         self.assert_networkd_udev(None)
+ 
+-    def test_eth_sriov_vlan_filterv_link(self):
+-        self.generate('''network:
+-  version: 2
+-  ethernets:
+-    enp1:
+-      dhcp4: n
+-    enp1s16f1:
+-      dhcp4: n
+-      link: enp1''')
+-
+-        self.assert_networkd({'enp1.network': '''[Match]
+-Name=enp1
+-
+-[Network]
+-LinkLocalAddressing=ipv6
+-''',
+-                              'enp1s16f1.network': '''[Match]
+-Name=enp1s16f1
+-
+-[Network]
+-LinkLocalAddressing=ipv6
+-'''})
+-        self.assert_additional_udev({'99-sriov-netplan-setup.rules': UDEV_SRIOV_RULE})
+-
+-    def test_eth_sriov_virtual_functions(self):
+-        self.generate('''network:
+-  version: 2
+-  ethernets:
+-    enp1:
+-      virtual-function-count: 8''')
+-
+-        self.assert_networkd({'enp1.network': '''[Match]
+-Name=enp1
+-
+-[Network]
+-LinkLocalAddressing=ipv6
+-'''})
+-        self.assert_additional_udev({'99-sriov-netplan-setup.rules': UDEV_SRIOV_RULE})
+-
+     def test_eth_match_by_driver_rename(self):
+         self.generate('''network:
+   version: 2
+@@ -384,74 +345,6 @@ method=link-local
+ method=ignore
+ '''})
+ 
+-    def test_eth_sriov_link(self):
+-        self.generate('''network:
+-  version: 2
+-  renderer: NetworkManager
+-  ethernets:
+-    enp1:
+-      dhcp4: n
+-    enp1s16f1:
+-      dhcp4: n
+-      link: enp1''')
+-
+-        self.assert_networkd({})
+-        self.assert_nm({'enp1': '''[connection]
+-id=netplan-enp1
+-type=ethernet
+-interface-name=enp1
+-
+-[ethernet]
+-wake-on-lan=0
+-
+-[ipv4]
+-method=link-local
+-
+-[ipv6]
+-method=ignore
+-''',
+-                        'enp1s16f1': '''[connection]
+-id=netplan-enp1s16f1
+-type=ethernet
+-interface-name=enp1s16f1
+-
+-[ethernet]
+-wake-on-lan=0
+-
+-[ipv4]
+-method=link-local
+-
+-[ipv6]
+-method=ignore
+-'''})
+-        self.assert_additional_udev({'99-sriov-netplan-setup.rules': UDEV_SRIOV_RULE})
+-
+-    def test_eth_sriov_virtual_functions(self):
+-        self.generate('''network:
+-  version: 2
+-  renderer: NetworkManager
+-  ethernets:
+-    enp1:
+-      dhcp4: n
+-      virtual-function-count: 8''')
+-
+-        self.assert_networkd({})
+-        self.assert_nm({'enp1': '''[connection]
+-id=netplan-enp1
+-type=ethernet
+-interface-name=enp1
+-
+-[ethernet]
+-wake-on-lan=0
+-
+-[ipv4]
+-method=link-local
+-
+-[ipv6]
+-method=ignore
+-'''})
+-        self.assert_additional_udev({'99-sriov-netplan-setup.rules': UDEV_SRIOV_RULE})
+-
+     def test_eth_set_mac(self):
+         self.generate('''network:
+   version: 2
+diff --git a/tests/test_sriov.py b/tests/test_sriov.py
+index 054500c..324a9e3 100644
+--- a/tests/test_sriov.py
++++ b/tests/test_sriov.py
+@@ -16,13 +16,16 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
++from io import StringIO
+ import os
++import subprocess
+ import tempfile
+ import unittest
+ 
+ from subprocess import CalledProcessError
+ from collections import defaultdict
+ from unittest.mock import patch, mock_open, call
++from netplan_cli.cli.commands.sriov_rebind import INTERVAL_SEC, MAX_WAITING_TIME_SEC, NetplanSriovRebind
+ 
+ import netplan
+ import netplan_cli.cli.sriov as sriov
+@@ -737,8 +740,9 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+     @patch('subprocess.check_call')
+     @patch('netplan_cli.cli.sriov.PCIDevice.bound', new_callable=unittest.mock.PropertyMock)
+     @patch('netplan_cli.cli.sriov.PCIDevice.sys', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.devlink_eswitch_mode')
+     @patch('netplan_cli.cli.sriov._get_pci_slot_name')
+-    def test_apply_sriov_config_eswitch_mode(self, gpsn, pcidevice_sys, pcidevice_bound,
++    def test_apply_sriov_config_eswitch_mode(self, gpsn, pcidevice_devlink, pcidevice_sys, pcidevice_bound,
+                                              scc, quirks, set_numvfs, get_counts, netifs):
+         handle = mock_open()
+         builtin_open = open  # save the unpatched version of open()
+@@ -765,6 +769,7 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+         enp2_pci_addr = '0000:03:00.1'
+         gpsn.side_effect = lambda iface: enp1_pci_addr if iface == 'enp1' else enp2_pci_addr
+         sys_path = os.path.join(self.workdir.name, 'sys')
++        pcidevice_devlink.return_value = '__undetermined'
+         pcidevice_sys.return_value = sys_path
+         pcidevice_bound.side_effect = [
+             True, True,  # 2x unbind (enp1 VFs)
+@@ -851,6 +856,242 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+                 call('0000:03:00.2'),
+                 call('0000:03:00.3')])
+ 
++    @patch('netplan_cli.cli.sriov.PCIDevice.is_pf', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.driver', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.commands.sriov_rebind._get_pci_slot_name')
++    @patch('netplan_cli.cli.commands.sriov_rebind.bind_vfs')
++    def test_cli_rebind_mellanox_with_unsupported_bond_mode(self, bind_mock, gpsn, driver_mock, is_pf_mock):
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    enp1:
++      embedded-switch-mode: "legacy"
++      delay-virtual-functions-rebind: true
++    enp1s16f1:
++      link: enp1
++    enp1s16f2:
++      link: enp1
++  bonds:
++    bond0:
++      parameters:
++        mode: balance-rr
++      interfaces:
++        - enp1
++''', file=fd)
++
++        gpsn.return_value = '0000:03:00.0'
++        bind_mock.return_value = []
++        driver_mock.return_value = 'mlx5_core'
++        is_pf_mock.return_value = True
++
++        out = call_cli(['rebind', '--debug', '--root-dir', self.workdir.name, 'enp1'])
++        self.assertIn('LAG mode balance-rr is not supported by VF LAG', out)
++
++    @patch('netplan_cli.cli.commands.sriov_rebind.sleep')
++    @patch('netplan_cli.cli.sriov.PCIDevice.is_pf', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.driver', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.commands.sriov_rebind._get_pci_slot_name')
++    @patch('netplan_cli.cli.commands.sriov_rebind.bind_vfs')
++    @patch('os.path.exists')
++    def test_cli_rebind_mellanox_state_file_not_found(self, path_mock, bind_mock, gpsn, driver_mock,
++                                                      is_pf_mock, sleep_mock):
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    enp1:
++      embedded-switch-mode: "legacy"
++      delay-virtual-functions-rebind: true
++    enp1s16f1:
++      link: enp1
++    enp1s16f2:
++      link: enp1
++  bonds:
++    bond0:
++      parameters:
++        mode: active-backup
++      interfaces:
++        - enp1
++''', file=fd)
++
++        sleep_mock.return_value = None
++        path_mock.return_value = False
++        gpsn.return_value = '0000:03:00.0'
++        bind_mock.return_value = []
++        driver_mock.return_value = 'mlx5_core'
++        is_pf_mock.return_value = True
++
++        out = call_cli(['rebind', '--debug', '--root-dir', self.workdir.name, 'enp1'])
++        self.assertIn('VF LAG state debugfs file not found', out)
++
++    @patch('netplan_cli.cli.commands.sriov_rebind.NetplanSriovRebind._get_mlx5_vf_lag_state')
++    @patch('netplan_cli.cli.commands.sriov_rebind.sleep')
++    @patch('netplan_cli.cli.sriov.PCIDevice.is_pf', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.driver', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.commands.sriov_rebind._get_pci_slot_name')
++    @patch('netplan_cli.cli.commands.sriov_rebind.bind_vfs')
++    @patch('os.path.exists')
++    def test_cli_rebind_mellanox_state_file_cannot_be_read(self, path_mock, bind_mock, gpsn, driver_mock,
++                                                           is_pf_mock, sleep_mock, get_mlx5_mock):
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    enp1:
++      embedded-switch-mode: "legacy"
++      delay-virtual-functions-rebind: true
++    enp1s16f1:
++      link: enp1
++    enp1s16f2:
++      link: enp1
++  bonds:
++    bond0:
++      parameters:
++        mode: active-backup
++      interfaces:
++        - enp1
++''', file=fd)
++
++        sleep_mock.return_value = None
++        path_mock.return_value = True
++        gpsn.return_value = '0000:03:00.0'
++        bind_mock.return_value = []
++        driver_mock.return_value = 'mlx5_core'
++        is_pf_mock.return_value = True
++        get_mlx5_mock.side_effect = Exception
++
++        out = call_cli(['rebind', '--debug', '--root-dir', self.workdir.name, 'enp1'])
++        self.assertIn('VF LAG state cannot be read', out)
++
++    @patch('netplan_cli.cli.commands.sriov_rebind.NetplanSriovRebind._get_mlx5_vf_lag_state')
++    @patch('netplan_cli.cli.commands.sriov_rebind.sleep')
++    @patch('netplan_cli.cli.sriov.PCIDevice.is_pf', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.driver', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.commands.sriov_rebind._get_pci_slot_name')
++    @patch('netplan_cli.cli.commands.sriov_rebind.bind_vfs')
++    @patch('os.path.exists')
++    def test_cli_rebind_mellanox_disabled_after_waiting(self, path_mock, bind_mock, gpsn, driver_mock,
++                                                        is_pf_mock, sleep_mock, get_mlx5_mock):
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    enp1:
++      embedded-switch-mode: "legacy"
++      delay-virtual-functions-rebind: true
++    enp1s16f1:
++      link: enp1
++    enp1s16f2:
++      link: enp1
++  bonds:
++    bond0:
++      parameters:
++        mode: active-backup
++      interfaces:
++        - enp1
++''', file=fd)
++
++        sleep_mock.return_value = None
++        path_mock.return_value = True
++        gpsn.return_value = '0000:03:00.0'
++        bind_mock.return_value = []
++        driver_mock.return_value = 'mlx5_core'
++        is_pf_mock.return_value = True
++        get_mlx5_mock.return_value = 'disabled'
++
++        out = call_cli(['rebind', '--debug', '--root-dir', self.workdir.name, 'enp1'])
++        self.assertIn('VF LAG state is still \'disabled\' after waiting', out)
++
++        # check if are we retrying the expected number of times
++        retries = int(MAX_WAITING_TIME_SEC / INTERVAL_SEC)
++        sleep_calls = [call(INTERVAL_SEC)] * retries
++        self.assertEqual(sleep_mock.call_args_list, sleep_calls)
++
++    @patch('netplan_cli.cli.commands.sriov_rebind.NetplanSriovRebind._get_mlx5_vf_lag_state')
++    @patch('netplan_cli.cli.commands.sriov_rebind.sleep')
++    @patch('netplan_cli.cli.sriov.PCIDevice.is_pf', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.driver', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.commands.sriov_rebind._get_pci_slot_name')
++    @patch('netplan_cli.cli.commands.sriov_rebind.bind_vfs')
++    @patch('os.path.exists')
++    def test_cli_rebind_mellanox_vf_lag_state_is_active(self, path_mock, bind_mock, gpsn, driver_mock,
++                                                        is_pf_mock, sleep_mock, get_mlx5_mock):
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    enp1:
++      embedded-switch-mode: "legacy"
++      delay-virtual-functions-rebind: true
++    enp1s16f1:
++      link: enp1
++    enp1s16f2:
++      link: enp1
++  bonds:
++    bond0:
++      parameters:
++        mode: active-backup
++      interfaces:
++        - enp1
++''', file=fd)
++
++        sleep_mock.return_value = None
++        path_mock.return_value = True
++        gpsn.return_value = '0000:03:00.0'
++        bind_mock.return_value = []
++        driver_mock.return_value = 'mlx5_core'
++        is_pf_mock.return_value = True
++        get_mlx5_mock.return_value = 'active'
++
++        out = call_cli(['rebind', '--debug', '--root-dir', self.workdir.name, 'enp1'])
++        self.assertIn('VF LAG state is \'active\'', out)
++
++    def test_get_mlx5_vf_lag_state(self):
++        rebind = NetplanSriovRebind()
++
++        f = StringIO()
++        f.write(' active')
++        f.seek(0)
++
++        with patch('builtins.open') as open_mock:
++            open_mock.return_value = f
++            state = rebind._get_mlx5_vf_lag_state('fake_pci_address')
++
++            self.assertEqual(state, 'active')
++
++    @patch('subprocess.check_output')
++    def test_PCIDevice_devlink_eswitch_mode_query(self, check_output_mock):
++        pcidev = sriov.PCIDevice('0000:03:00.0')
++        check_output_mock.return_value = '{"dev":{"pci/0000:03:00.0":{"mode":"switchdev"}}}'
++        self.assertEqual(pcidev.devlink_eswitch_mode(), 'switchdev')
++        check_output_mock.assert_has_calls([
++            call(['/sbin/devlink', '-j', 'dev', 'eswitch', 'show', 'pci/0000:03:00.0'], stderr=-3),
++        ])
++
++    @patch('subprocess.check_output')
++    def test_PCIDevice_devlink_eswitch_mode_query_not_supported(self, check_output_mock):
++        pcidev = sriov.PCIDevice('0000:03:00.0')
++        check_output_mock.return_value = '{"dev":{}}'
++        self.assertEqual(pcidev.devlink_eswitch_mode(), '__undetermined')
++        check_output_mock.assert_has_calls([
++            call(['/sbin/devlink', '-j', 'dev', 'eswitch', 'show', 'pci/0000:03:00.0'], stderr=-3),
++        ])
++
++    @patch('subprocess.check_output')
++    def test_PCIDevice_devlink_eswitch_mode_query_failure(self, check_output_mock):
++        pcidev = sriov.PCIDevice('0000:03:00.0')
++        check_output_mock.side_effect = subprocess.CalledProcessError(1, None)
++        self.assertEqual(pcidev.devlink_eswitch_mode(), '__undetermined')
++        check_output_mock.assert_has_calls([
++            call(['/sbin/devlink', '-j', 'dev', 'eswitch', 'show', 'pci/0000:03:00.0'], stderr=-3),
++        ])
++
+ 
+ class TestParser(TestBase):
+     def test_eswitch_mode(self):
+@@ -871,12 +1112,22 @@ class TestParser(TestBase):
+         self.assert_sriov({'rebind.service': '''[Unit]
+ Description=(Re-)bind SR-IOV Virtual Functions to their driver
+ After=network.target
++After=netplan-sriov-apply.service
+ After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/netplan rebind enblue engreen
++ExecStart=/usr/sbin/netplan rebind --debug enblue engreen
++''', 'apply.service': '''[Unit]
++Description=Apply SR-IOV configuration
++After=network.target
++After=sys-subsystem-net-devices-enblue.device
++After=sys-subsystem-net-devices-engreen.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan apply --sriov-only
+ '''})
+ 
+     def test_rebind_service_generation(self):
+@@ -907,12 +1158,22 @@ ExecStart=/usr/sbin/netplan rebind enblue engreen
+         self.assert_sriov({'rebind.service': '''[Unit]
+ Description=(Re-)bind SR-IOV Virtual Functions to their driver
+ After=network.target
++After=netplan-sriov-apply.service
++After=sys-subsystem-net-devices-enblue.device
++After=sys-subsystem-net-devices-engreen.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan rebind --debug enblue engreen
++''', 'apply.service': '''[Unit]
++Description=Apply SR-IOV configuration
++After=network.target
+ After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/netplan rebind enblue engreen
++ExecStart=/usr/sbin/netplan apply --sriov-only
+ '''})
+ 
+     def test_escaping_semicolons_from_unit_file(self):
+@@ -936,12 +1197,23 @@ ExecStart=/usr/sbin/netplan rebind enblue engreen
+         self.assert_sriov({'rebind.service': '''[Unit]
+ Description=(Re-)bind SR-IOV Virtual Functions to their driver
+ After=network.target
++After=netplan-sriov-apply.service
++After=sys-subsystem-net-devices-engreen.device
+ After=sys-subsystem-net-devices-;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan rebind --debug engreen ;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc
++''', 'apply.service': '''[Unit]
++Description=Apply SR-IOV configuration
++DefaultDependencies=no
++Before=network-pre.target
+ After=sys-subsystem-net-devices-engreen.device
++After=sys-subsystem-net-devices-;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc.device
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/netplan rebind ;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc engreen
++ExecStart=/usr/sbin/netplan apply --sriov-only
+ '''})
+ 
+     def test_rebind_not_delayed(self):
+@@ -953,7 +1225,15 @@ ExecStart=/usr/sbin/netplan rebind ;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc eng
+       delay-virtual-functions-rebind: false
+     sriov_vf:
+       link: engreen''')
+-        self.assert_sriov({})
++        self.assert_sriov({'apply.service': '''[Unit]
++Description=Apply SR-IOV configuration
++After=network.target
++After=sys-subsystem-net-devices-engreen.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan apply --sriov-only
++'''})
+ 
+     def test_rebind_no_iface(self):
+         out = self.generate('''network:
+@@ -965,7 +1245,14 @@ ExecStart=/usr/sbin/netplan rebind ;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc eng
+       delay-virtual-functions-rebind: true
+     sriov_vf:
+       link: engreen''')
+-        self.assert_sriov({})
++        self.assert_sriov({'apply.service': '''[Unit]
++Description=Apply SR-IOV configuration
++After=network.target
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan apply --sriov-only
++'''})
+         self.assertIn('engreen: Cannot rebind SR-IOV virtual functions, unknown interface name.', out)
+ 
+     def test_invalid_not_a_pf(self):
diff --git a/debian/patches/lp1988018/0024-sriov_apply-execute-apply-sriov-only-before-network-.patch b/debian/patches/lp1988018/0024-sriov_apply-execute-apply-sriov-only-before-network-.patch
new file mode 100644
index 0000000..62f53b5
--- /dev/null
+++ b/debian/patches/lp1988018/0024-sriov_apply-execute-apply-sriov-only-before-network-.patch
@@ -0,0 +1,83 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Fri, 23 Feb 2024 10:08:34 +0000
+Subject: sriov_apply: execute apply --sriov-only before network-pre.target
+
+When activating VF LAG and at the same time changing the e-switch mode
+to switchdev, the e-switch change MUST be performed before the bonding.
+Trying to change it after the bond is created will fail and the driver
+will report that the e-switch is busy.
+
+In fact, all the SR-IOV initial setup must happen before the networking
+configuration.
+
+Change the order in which we call netplan apply --sriov-only to happen
+before network-pre.target.
+
+Also, add DefaultDependencies=no to the service to prevent the creation
+of dependency cycles.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1988018
+Origin: https://github.com/canonical/netplan/pull/439
+---
+ src/sriov.c         |  3 ++-
+ tests/test_sriov.py | 12 ++++++++----
+ 2 files changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/src/sriov.c b/src/sriov.c
+index 86881b2..4c54207 100644
+--- a/src/sriov.c
++++ b/src/sriov.c
+@@ -84,7 +84,8 @@ write_sriov_apply_systemd_unit(GHashTable* pfs, const char* rootdir, GError** er
+ 
+     GString* s = g_string_new("[Unit]\n");
+     g_string_append(s, "Description=Apply SR-IOV configuration\n");
+-    g_string_append_printf(s, "After=network.target\n");
++    g_string_append(s, "DefaultDependencies=no\n");
++    g_string_append(s, "Before=network-pre.target\n");
+ 
+     g_hash_table_iter_init(&iter, pfs);
+     while (g_hash_table_iter_next (&iter, &key, NULL)) {
+diff --git a/tests/test_sriov.py b/tests/test_sriov.py
+index 324a9e3..ca297cb 100644
+--- a/tests/test_sriov.py
++++ b/tests/test_sriov.py
+@@ -1121,7 +1121,8 @@ Type=oneshot
+ ExecStart=/usr/sbin/netplan rebind --debug enblue engreen
+ ''', 'apply.service': '''[Unit]
+ Description=Apply SR-IOV configuration
+-After=network.target
++DefaultDependencies=no
++Before=network-pre.target
+ After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
+ 
+@@ -1167,7 +1168,8 @@ Type=oneshot
+ ExecStart=/usr/sbin/netplan rebind --debug enblue engreen
+ ''', 'apply.service': '''[Unit]
+ Description=Apply SR-IOV configuration
+-After=network.target
++DefaultDependencies=no
++Before=network-pre.target
+ After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
+ 
+@@ -1227,7 +1229,8 @@ ExecStart=/usr/sbin/netplan apply --sriov-only
+       link: engreen''')
+         self.assert_sriov({'apply.service': '''[Unit]
+ Description=Apply SR-IOV configuration
+-After=network.target
++DefaultDependencies=no
++Before=network-pre.target
+ After=sys-subsystem-net-devices-engreen.device
+ 
+ [Service]
+@@ -1247,7 +1250,8 @@ ExecStart=/usr/sbin/netplan apply --sriov-only
+       link: engreen''')
+         self.assert_sriov({'apply.service': '''[Unit]
+ Description=Apply SR-IOV configuration
+-After=network.target
++DefaultDependencies=no
++Before=network-pre.target
+ 
+ [Service]
+ Type=oneshot
diff --git a/debian/patches/lp2020409/0025-sriov-accept-setting-the-eswitch-mode-without-VFs.patch b/debian/patches/lp2020409/0025-sriov-accept-setting-the-eswitch-mode-without-VFs.patch
new file mode 100644
index 0000000..bd2cd6f
--- /dev/null
+++ b/debian/patches/lp2020409/0025-sriov-accept-setting-the-eswitch-mode-without-VFs.patch
@@ -0,0 +1,148 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Tue, 9 Apr 2024 12:43:31 +0100
+Subject: sriov: accept setting the eswitch mode without VFs
+
+The embedded switch mode can be set even if the interface doesn't have
+any virtual functions. This is a requisite to use the PF with only
+scalable functions for example.
+
+With this change, the presence of the 'embedded-switch-mode' will be
+enough to identify the interface as a PF and emit the systemd services
+required to apply the configuration.
+
+The changes required by the CLI will be done is the next commit.
+
+Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2020409
+Origin: https://github.com/canonical/netplan/pull/454
+---
+ src/sriov.c         | 11 ++++++++---
+ src/validation.c    |  7 ++++---
+ tests/test_sriov.py | 39 +++++++++++++++++++++++++++++++++------
+ 3 files changed, 45 insertions(+), 12 deletions(-)
+
+diff --git a/src/sriov.c b/src/sriov.c
+index 4c54207..0962533 100644
+--- a/src/sriov.c
++++ b/src/sriov.c
+@@ -128,13 +128,18 @@ netplan_state_finish_sriov_write(const NetplanState* np_state, const char* rootd
+         GHashTable* rebind_pfs = g_hash_table_new(g_str_hash, g_str_equal);
+         GHashTable* apply_pfs = g_hash_table_new(g_str_hash, g_str_equal);
+ 
+-        /* Find netdev interface names for SR-IOV PFs*/
++        /* Find netdev interface names for SR-IOV PFs
++         * We consider an interface to be a PF if at least of the conditions below is true:
++         * 1) the user explicitly set a desired number of VFs
++         * 2) there is at least one interface with a link to it (meaning the interface is a VF of this PF)
++         * 3) the user set the embedded-switch-mode (which can be applied regardless if the interface has VFs) 
++         * */
+         for (GList* iterator = np_state->netdefs_ordered; iterator; iterator = iterator->next) {
+             def = (NetplanNetDefinition*) iterator->data;
+             pf = NULL;
+-            if (def->sriov_explicit_vf_count < G_MAXUINT || def->sriov_link) {
++            if (def->sriov_explicit_vf_count < G_MAXUINT || def->sriov_link || def->embedded_switch_mode) {
+                 any_sriov = TRUE;
+-                if (def->sriov_explicit_vf_count < G_MAXUINT)
++                if (def->sriov_explicit_vf_count < G_MAXUINT || def->embedded_switch_mode)
+                     pf = def;
+                 else if (def->sriov_link)
+                     pf = def->sriov_link;
+diff --git a/src/validation.c b/src/validation.c
+index 23b5808..b6d3bf3 100644
+--- a/src/validation.c
++++ b/src/validation.c
+@@ -475,9 +475,10 @@ validate_sriov_rules(const NetplanParser* npp, NetplanNetDefinition* nd, GError*
+                 }
+             }
+         }
+-        gboolean eswitch_mode = (nd->embedded_switch_mode ||
+-                                 nd->sriov_delay_virtual_functions_rebind);
+-        if (eswitch_mode && !is_sriov_pf) {
++        /* Does it set the eswitch mode? It can be set regardless if the interface has VFs */
++        if (nd->embedded_switch_mode)
++            is_sriov_pf = TRUE;
++        if (nd->sriov_delay_virtual_functions_rebind && !is_sriov_pf) {
+             valid = yaml_error(npp, node, error, "%s: This is not a SR-IOV PF", nd->id);
+             goto sriov_rules_error;
+         }
+diff --git a/tests/test_sriov.py b/tests/test_sriov.py
+index ca297cb..670e67e 100644
+--- a/tests/test_sriov.py
++++ b/tests/test_sriov.py
+@@ -1113,17 +1113,44 @@ class TestParser(TestBase):
+ Description=(Re-)bind SR-IOV Virtual Functions to their driver
+ After=network.target
+ After=netplan-sriov-apply.service
+-After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
++After=sys-subsystem-net-devices-enblue.device
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/netplan rebind --debug enblue engreen
++ExecStart=/usr/sbin/netplan rebind --debug engreen enblue
+ ''', 'apply.service': '''[Unit]
+ Description=Apply SR-IOV configuration
+ DefaultDependencies=no
+ Before=network-pre.target
++After=sys-subsystem-net-devices-engreen.device
+ After=sys-subsystem-net-devices-enblue.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan apply --sriov-only
++'''})
++
++    def test_eswitch_mode_sets_interface_as_pf(self):
++        self.generate('''network:
++  version: 2
++  ethernets:
++    engreen:
++      embedded-switch-mode: switchdev
++      delay-virtual-functions-rebind: true''')
++        self.assert_sriov({'rebind.service': '''[Unit]
++Description=(Re-)bind SR-IOV Virtual Functions to their driver
++After=network.target
++After=netplan-sriov-apply.service
++After=sys-subsystem-net-devices-engreen.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan rebind --debug engreen
++''', 'apply.service': '''[Unit]
++Description=Apply SR-IOV configuration
++DefaultDependencies=no
++Before=network-pre.target
+ After=sys-subsystem-net-devices-engreen.device
+ 
+ [Service]
+@@ -1160,18 +1187,18 @@ ExecStart=/usr/sbin/netplan apply --sriov-only
+ Description=(Re-)bind SR-IOV Virtual Functions to their driver
+ After=network.target
+ After=netplan-sriov-apply.service
+-After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
++After=sys-subsystem-net-devices-enblue.device
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/netplan rebind --debug enblue engreen
++ExecStart=/usr/sbin/netplan rebind --debug engreen enblue
+ ''', 'apply.service': '''[Unit]
+ Description=Apply SR-IOV configuration
+ DefaultDependencies=no
+ Before=network-pre.target
+-After=sys-subsystem-net-devices-enblue.device
+ After=sys-subsystem-net-devices-engreen.device
++After=sys-subsystem-net-devices-enblue.device
+ 
+ [Service]
+ Type=oneshot
+@@ -1264,7 +1291,7 @@ ExecStart=/usr/sbin/netplan apply --sriov-only
+   version: 2
+   ethernets:
+     engreen:
+-      embedded-switch-mode: legacy''', expect_fail=True)
++      delay-virtual-functions-rebind: true''', expect_fail=True)
+         self.assertIn("This is not a SR-IOV PF", err)
+ 
+     def test_invalid_eswitch_mode(self):
diff --git a/debian/patches/lp2020409/0026-cli-sriov-refactoring.patch b/debian/patches/lp2020409/0026-cli-sriov-refactoring.patch
new file mode 100644
index 0000000..97ea245
--- /dev/null
+++ b/debian/patches/lp2020409/0026-cli-sriov-refactoring.patch
@@ -0,0 +1,768 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 11 Apr 2024 15:52:44 +0100
+Subject: cli/sriov: refactoring
+
+Refactor get_vf_count_and_functions() in 3 different ones. It was doing
+too many things and was hard to read. Three of its 5 parameters were being
+used as output and one of them was being changed by
+_get_target_interface() in the same call chain.
+
+The new _get_physical_functions() will also return interfaces that only
+have the property embedded_switch_mode. This is a requirement to enable
+netplan to change the eswitch mode even if it doesn't have VFs.
+See LP: #2020409
+
+Adapt the unit tests to the new functions and implement new tests.
+
+Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2020409
+Origin: https://github.com/canonical/netplan/pull/454
+---
+ netplan_cli/cli/sriov.py | 149 ++++++++++++++--------
+ tests/test_sriov.py      | 314 ++++++++++++++++++++++++++++++++++++++---------
+ 2 files changed, 351 insertions(+), 112 deletions(-)
+
+diff --git a/netplan_cli/cli/sriov.py b/netplan_cli/cli/sriov.py
+index 4f3448c..3e03695 100644
+--- a/netplan_cli/cli/sriov.py
++++ b/netplan_cli/cli/sriov.py
+@@ -21,8 +21,7 @@ import logging
+ import os
+ import subprocess
+ import typing
+-
+-from collections import defaultdict
++from typing import Dict, List, Optional, Set
+ 
+ from . import utils
+ from ..configmanager import ConfigurationError
+@@ -212,37 +211,47 @@ def unbind_vfs(vfs: typing.Iterable[PCIDevice], driver) -> typing.Iterable[PCIDe
+     return unbound_vfs
+ 
+ 
+-def _get_target_interface(interfaces, np_state, pf_link, pfs):
+-    if pf_link not in pfs:
+-        # handle the match: syntax, get the actual device name
+-        pf_dev = np_state[pf_link]
+-        if pf_dev._has_match:
+-            # now here it's a bit tricky
+-            set_name = pf_dev.set_name
+-            if set_name and set_name in interfaces:
+-                # if we had a match: stanza and set-name: this means we should
+-                # assume that, if found, the interface has already been
+-                # renamed - use the new name
+-                pfs[pf_link] = set_name
+-            else:
+-                for interface in interfaces:
+-                    if not pf_dev._match_interface(
+-                            iface_name=interface,
+-                            iface_driver=utils.get_interface_driver_name(interface),
+-                            iface_mac=utils.get_interface_macaddress(interface)):
+-                        continue
+-                    # we have a matching PF
+-                    # store the matching interface in the dictionary of
+-                    # active PFs, but error out if we matched more than one
+-                    if pf_link in pfs:
+-                        raise ConfigurationError('matched more than one interface for a PF device: %s' % pf_link)
+-                    pfs[pf_link] = interface
+-        else:
+-            # no match field, assume entry name is the interface name
+-            if pf_link in interfaces:
+-                pfs[pf_link] = pf_link
++def _interface_matches(netdef: netplan.NetDefinition, interface: str) -> bool:
++    return netdef._match_interface(
++        iface_name=interface,
++        iface_driver=utils.get_interface_driver_name(interface),
++        iface_mac=utils.get_interface_macaddress(interface))
+ 
+-    return pfs.get(pf_link, None)
++
++def _get_interface_name_for_netdef(netdef: netplan.NetDefinition) -> Optional[str]:
++    """
++    Try to match a netdef with the real system network interface.
++    Throws ConfigurationError if there is more than one match.
++    """
++    interfaces: List[str] = netifaces.interfaces()
++    if netdef._has_match:
++        # now here it's a bit tricky
++        set_name: str = netdef.set_name
++        if set_name and set_name in interfaces:
++            # if we had a match: stanza and set-name: this means we should
++            # assume that, if found, the interface has already been
++            # renamed - use the new name
++            return set_name
++        else:
++            matches: Set[str] = set()
++            # we walk through all the system interfaces to determine if there is
++            # more than one matched interface
++            for interface in interfaces:
++                if not _interface_matches(netdef, interface):
++                    continue
++                # we have a matching PF
++                # error out if we matched more than one
++                if len(matches) > 1:
++                    raise ConfigurationError('matched more than one interface for a PF device: %s' % netdef.id)
++                matches.add(interface)
++            if matches:
++                return list(matches)[0]
++    else:
++        # no match field, assume entry name is the interface name
++        if netdef.id in interfaces:
++            return netdef.id
++
++    return None
+ 
+ 
+ def _get_pci_slot_name(netdev):
+@@ -262,27 +271,67 @@ def _get_pci_slot_name(netdev):
+         raise RuntimeError('failed parsing PCI slot name for %s: %s' % (netdev, str(e)))
+ 
+ 
+-def get_vf_count_and_functions(interfaces, np_state,
+-                               vf_counts, vfs, pfs):
++def _get_physical_functions(np_state: netplan.State) -> Dict[str, str]:
+     """
+     Go through the list of netplan ethernet devices and identify which are
+-    PFs and VFs, matching the former with actual networking interfaces.
+-    Count how many VFs each PF will need.
++    PFs matching them with actual network interfaces.
+     """
+-    for nid, netdef in np_state.ethernets.items():
+-        if netdef.links.get('sriov') and _get_target_interface(interfaces, np_state, netdef.links.get('sriov').id, pfs):
+-            vfs[nid] = None
++    pfs = {}
++    for netdef in np_state.ethernets.values():
++        # If the sriov_link is present, the interface is a VF and link is the PF
++        if link := netdef.links.get('sriov'):
++            if iface := _get_interface_name_for_netdef(np_state[link.id]):
++                pfs[link.id] = iface
++        else:
++            # If a netdef also defines the embedded_switch_mode key we consider it's a PF
++            # This enables us to change the eswitch mode even when the PF has no VFs.
++            if netdef._embedded_switch_mode:
++                if iface := _get_interface_name_for_netdef(netdef):
++                    pfs[netdef.id] = iface
++
++            # If the netdef has any (positive) number of VFs that's because it's a PF
++            try:
++                count = netdef._vf_count
++            except netplan.NetplanException as e:
++                raise ConfigurationError(str(e))
++            if count > 0:
++                if iface := _get_interface_name_for_netdef(netdef):
++                    pfs[netdef.id] = iface
++
++    return pfs
+ 
++
++def _get_vf_number_per_pf(np_state: netplan.State) -> Dict[str, int]:
++    """
++    Go through the list of netplan ethernet devices and identify which ones
++    have VFs. netdef._vf_count ultimately calls _netplan_state_get_vf_count_for_def
++    from libnetplan which return MAX(sriov_explicit_vf_count, number of VF netdefs).
++    """
++    vf_counts = {}
++    for netdef in np_state.ethernets.values():
+         try:
+             count = netdef._vf_count
+         except netplan.NetplanException as e:
+             raise ConfigurationError(str(e))
+-        if count == 0:
+-            continue
++        if count > 0:
++            if iface := _get_interface_name_for_netdef(netdef):
++                vf_counts[iface] = count
+ 
+-        pf = _get_target_interface(interfaces, np_state, nid, pfs)
+-        if pf:
+-            vf_counts[pf] = count
++    return vf_counts
++
++
++def _get_virtual_functions(np_state: netplan.State) -> Set[str]:
++    """
++    Go through the list of netplan ethernet devices and identify which ones
++    are virtual functions
++    """
++    vfs = set()
++    for netdef in np_state.ethernets.values():
++        # If the sriov_link is present and the PF is also present in the system we save the VF
++        if link := netdef.links.get('sriov'):
++            if _get_interface_name_for_netdef(np_state[link.id]):
++                vfs.add(netdef.id)
++    return vfs
+ 
+ 
+ def set_numvfs_for_pf(pf, vf_count):
+@@ -419,14 +468,11 @@ def apply_sriov_config(config_manager, rootdir='/'):
+     # pointing to an PF. So let's browse through all ethernet devices,
+     # find all that are VFs and count how many of those are linked to
+     # particular PFs, as we need to then set the numvfs for each.
+-    vf_counts = defaultdict(int)
++    vf_counts = _get_vf_number_per_pf(np_state)
+     # we also store all matches between VF/PF netplan entry names and
+     # interface that they're currently matching to
+-    vfs = {}
+-    pfs = {}
+-
+-    get_vf_count_and_functions(
+-        interfaces, np_state, vf_counts, vfs, pfs)
++    vfs_set = _get_virtual_functions(np_state)
++    pfs = _get_physical_functions(np_state)
+ 
+     # setup the required number of VFs per PF
+     # at the same time store which PFs got changed in case the NICs
+@@ -454,7 +500,8 @@ def apply_sriov_config(config_manager, rootdir='/'):
+     # entries to existing interfaces, otherwise we won't be able to set
+     # filtered VLANs for those.
+     # XXX: does matching those even make sense?
+-    for vf in vfs:
++    vfs = {}
++    for vf in vfs_set:
+         netdef = np_state[vf]
+         if netdef._has_match:
+             # right now we only match by name, as I don't think matching per
+diff --git a/tests/test_sriov.py b/tests/test_sriov.py
+index 670e67e..c4ffd4f 100644
+--- a/tests/test_sriov.py
++++ b/tests/test_sriov.py
+@@ -23,7 +23,6 @@ import tempfile
+ import unittest
+ 
+ from subprocess import CalledProcessError
+-from collections import defaultdict
+ from unittest.mock import patch, mock_open, call
+ from netplan_cli.cli.commands.sriov_rebind import INTERVAL_SEC, MAX_WAITING_TIME_SEC, NetplanSriovRebind
+ 
+@@ -60,15 +59,6 @@ class MockSRIOVOpen():
+         self.open.return_value.write.side_effect = sriov_write
+ 
+ 
+-def mock_set_counts(interfaces, config_manager, vf_counts, active_vfs, active_pfs):
+-    counts = {'enp1': 2, 'enp2': 1}
+-    vfs = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
+-    pfs = {'enp1': 'enp1', 'enpx': 'enp2'}
+-    vf_counts.update(counts)
+-    active_vfs.update(vfs)
+-    active_pfs.update(pfs)
+-
+-
+ class TestSRIOV(unittest.TestCase):
+     def setUp(self):
+         self.workdir = tempfile.TemporaryDirectory()
+@@ -146,13 +136,15 @@ class TestSRIOV(unittest.TestCase):
+         for i in range(len(vfs)):
+             os.symlink(os.path.join('../../..', vfs[i][1]), os.path.join(pf_dev_path, 'virtfn'+str(i)))
+ 
++    @patch('netifaces.interfaces')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+-    def test_get_vf_count_and_functions(self, gim, gidn):
++    def test_get_vf_count_vfs_and_pfs(self, gim, gidn, ifaces):
+         # we mock-out get_interface_driver_name and get_interface_macaddress
+         # to return useful values for the test
+         gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
+         gidn.side_effect = lambda x: 'foo' if x == 'enp2' else 'bar'
++        ifaces.return_value = ['enp1', 'enp2', 'enp3', 'enp5', 'enp0', 'enp8', 'enp10']
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+   version: 2
+@@ -175,6 +167,8 @@ class TestSRIOV(unittest.TestCase):
+     enp8:
+       virtual-function-count: 7
+     enp9: {}
++    enp10:
++      embedded-switch-mode: switchdev
+     wlp6s0: {}
+     enp1s16f1:
+       link: enp1
+@@ -195,35 +189,213 @@ class TestSRIOV(unittest.TestCase):
+       link: enp9
+ ''', file=fd)
+         self.configmanager.parse()
+-        interfaces = ['enp1', 'enp2', 'enp3', 'enp5', 'enp0', 'enp8']
+-        vf_counts = defaultdict(int)
+-        vfs = {}
+-        pfs = {}
+ 
+-        # call the function under test
+-        sriov.get_vf_count_and_functions(interfaces, self.configmanager.np_state,
+-                                         vf_counts, vfs, pfs)
++        vf_counts = sriov._get_vf_number_per_pf(self.configmanager.np_state)
++        vfs = sriov._get_virtual_functions(self.configmanager.np_state)
++        pfs = sriov._get_physical_functions(self.configmanager.np_state)
++
+         # check if the right vf counts have been recorded in vf_counts
+         self.assertDictEqual(
+             vf_counts,
+             {'enp1': 2, 'enp2': 2, 'enp3': 1, 'enp5': 1, 'enp8': 7})
+         # also check if the vfs and pfs dictionaries got properly set
+-        self.assertDictEqual(
++        self.assertSetEqual(
+             vfs,
+-            {'enp1s16f1': None, 'enp1s16f2': None, 'enp2s16f1': None,
+-             'enp2s16f2': None, 'enp3s16f1': None, 'enpxs16f1': None})
++            {'enp1s16f1', 'enp1s16f2', 'enp2s16f1',
++             'enp2s16f2', 'enp3s16f1', 'enpxs16f1'})
++        self.assertDictEqual(
++            pfs,
++            {'enp1': 'enp1', 'enp2': 'enp2', 'enp3': 'enp3',
++             'enpx': 'enp5', 'enp8': 'enp8', 'enp10': 'enp10'})
++
++    @patch('netifaces.interfaces')
++    @patch('netplan_cli.cli.utils.get_interface_driver_name')
++    @patch('netplan_cli.cli.utils.get_interface_macaddress')
++    def test_get_physical_functions(self, gim, gidn, ifaces):
++        # we mock-out get_interface_driver_name and get_interface_macaddress
++        # to return useful values for the test
++        gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
++        gidn.side_effect = lambda x: 'foo' if x == 'enp2' else 'bar'
++        ifaces.return_value = ['enp1', 'enp2', 'enp3', 'enp5', 'enp0', 'enp8', 'enp10']
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    renderer: networkd
++    enp1:
++      mtu: 9000
++    enp2:
++      match:
++        driver: foo
++    enp3:
++      match:
++        macaddress: 00:01:02:03:04:05
++    enpx:
++      match:
++        name: enp[4-5]
++    enp0:
++      mtu: 9000
++    enp8:
++      virtual-function-count: 7
++    enp9: {}
++    enp10:
++      embedded-switch-mode: switchdev
++    wlp6s0: {}
++    enp1s16f1:
++      link: enp1
++      macaddress: 01:02:03:04:05:00
++    enp1s16f2:
++      link: enp1
++      macaddress: 01:02:03:04:05:01
++    enp2s16f1:
++      link: enp2
++    enp2s16f2: {link: enp2}
++    enp3s16f1:
++      link: enp3
++    enpxs16f1:
++      match:
++        name: enp[4-5]s16f1
++      link: enpx
++    enp9s16f1:
++      link: enp9
++''', file=fd)
++        self.configmanager.parse()
++
++        pfs = sriov._get_physical_functions(self.configmanager.np_state)
++
+         self.assertDictEqual(
+             pfs,
+             {'enp1': 'enp1', 'enp2': 'enp2', 'enp3': 'enp3',
+-             'enpx': 'enp5', 'enp8': 'enp8'})
++             'enpx': 'enp5', 'enp8': 'enp8', 'enp10': 'enp10'})
++
++    @patch('netifaces.interfaces')
++    @patch('netplan_cli.cli.utils.get_interface_driver_name')
++    @patch('netplan_cli.cli.utils.get_interface_macaddress')
++    def test_get_vf_number_per_pf(self, gim, gidn, ifaces):
++        # we mock-out get_interface_driver_name and get_interface_macaddress
++        # to return useful values for the test
++        gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
++        gidn.side_effect = lambda x: 'foo' if x == 'enp2' else 'bar'
++        ifaces.return_value = ['enp1', 'enp2', 'enp3', 'enp5', 'enp0', 'enp8']
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    renderer: networkd
++    enp1:
++      mtu: 9000
++    enp2:
++      match:
++        driver: foo
++    enp3:
++      match:
++        macaddress: 00:01:02:03:04:05
++    enpx:
++      match:
++        name: enp[4-5]
++    enp0:
++      mtu: 9000
++    enp8:
++      virtual-function-count: 7
++    enp9: {}
++    wlp6s0: {}
++    enp1s16f1:
++      link: enp1
++      macaddress: 01:02:03:04:05:00
++    enp1s16f2:
++      link: enp1
++      macaddress: 01:02:03:04:05:01
++    enp2s16f1:
++      link: enp2
++    enp2s16f2: {link: enp2}
++    enp3s16f1:
++      link: enp3
++    enpxs16f1:
++      match:
++        name: enp[4-5]s16f1
++      link: enpx
++    enp9s16f1:
++      link: enp9
++''', file=fd)
++        self.configmanager.parse()
++
++        vf_counts = sriov._get_vf_number_per_pf(self.configmanager.np_state)
++
++        # check if the right vf counts have been recorded in vf_counts
++        self.assertDictEqual(
++            vf_counts,
++            {'enp1': 2, 'enp2': 2, 'enp3': 1, 'enp5': 1, 'enp8': 7})
++
++    @patch('netifaces.interfaces')
++    @patch('netplan_cli.cli.utils.get_interface_driver_name')
++    @patch('netplan_cli.cli.utils.get_interface_macaddress')
++    def test_get_virtual_functions(self, gim, gidn, ifaces):
++        # we mock-out get_interface_driver_name and get_interface_macaddress
++        # to return useful values for the test
++        gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
++        gidn.side_effect = lambda x: 'foo' if x == 'enp2' else 'bar'
++        ifaces.return_value = ['enp1', 'enp2', 'enp3', 'enp5', 'enp0', 'enp8']
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    renderer: networkd
++    enp1:
++      mtu: 9000
++    enp2:
++      match:
++        driver: foo
++    enp3:
++      match:
++        macaddress: 00:01:02:03:04:05
++    enpx:
++      match:
++        name: enp[4-5]
++    enp0:
++      mtu: 9000
++    enp8:
++      virtual-function-count: 7
++    enp9: {}
++    wlp6s0: {}
++    enp1s16f1:
++      link: enp1
++      macaddress: 01:02:03:04:05:00
++    enp1s16f2:
++      link: enp1
++      macaddress: 01:02:03:04:05:01
++    enp2s16f1:
++      link: enp2
++    enp2s16f2: {link: enp2}
++    enp3s16f1:
++      link: enp3
++    enpxs16f1:
++      match:
++        name: enp[4-5]s16f1
++      link: enpx
++    enp9s16f1:
++      link: enp9
++''', file=fd)
++        self.configmanager.parse()
++
++        vfs = sriov._get_virtual_functions(self.configmanager.np_state)
+ 
++        self.assertSetEqual(
++            vfs,
++            {'enp1s16f1', 'enp1s16f2', 'enp2s16f1',
++             'enp2s16f2', 'enp3s16f1', 'enpxs16f1'})
++
++    @patch('netifaces.interfaces')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+-    def test_get_vf_count_and_functions_set_name(self, gim, gidn):
++    def test_get_vf_count_vfs_and_pfs_set_name(self, gim, gidn, ifaces):
+         # we mock-out get_interface_driver_name and get_interface_macaddress
+         # to return useful values for the test
+         gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
+         gidn.side_effect = lambda x: 'foo' if x == 'enp1' else 'bar'
++        ifaces.return_value = ['pf1', 'enp8', 'enp1s16f1']
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+   version: 2
+@@ -244,14 +416,10 @@ class TestSRIOV(unittest.TestCase):
+       macaddress: 01:02:03:04:05:00
+ ''', file=fd)
+         self.configmanager.parse()
+-        interfaces = ['pf1', 'enp8']
+-        vf_counts = defaultdict(int)
+-        vfs = {}
+-        pfs = {}
++        vf_counts = sriov._get_vf_number_per_pf(self.configmanager.np_state)
++        vfs = sriov._get_virtual_functions(self.configmanager.np_state)
++        pfs = sriov._get_physical_functions(self.configmanager.np_state)
+ 
+-        # call the function under test
+-        sriov.get_vf_count_and_functions(interfaces, self.configmanager.np_state,
+-                                         vf_counts, vfs, pfs)
+         # check if the right vf counts have been recorded in vf_counts -
+         # we expect netplan to take into consideration the renamed interface
+         # names here
+@@ -259,20 +427,22 @@ class TestSRIOV(unittest.TestCase):
+             vf_counts,
+             {'pf1': 1, 'enp8': 7})
+         # also check if the vfs and pfs dictionaries got properly set
+-        self.assertDictEqual(
++        self.assertSetEqual(
+             vfs,
+-            {'enp1s16f1': None})
++            {'enp1s16f1'})
+         self.assertDictEqual(
+             pfs,
+             {'enp1': 'pf1', 'enp8': 'enp8'})
+ 
++    @patch('netifaces.interfaces')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+-    def test_get_vf_count_and_functions_many_match(self, gim, gidn):
++    def test_get_vf_count_vfs_and_pfs_many_match(self, gim, gidn, ifaces):
+         # we mock-out get_interface_driver_name and get_interface_macaddress
+         # to return useful values for the test
+         gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
+         gidn.side_effect = lambda x: 'foo' if x == 'enp2' else 'bar'
++        ifaces.return_value = ['enp1', 'wlp6s0', 'enp2', 'enp3']
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+   version: 2
+@@ -287,26 +457,23 @@ class TestSRIOV(unittest.TestCase):
+       link: enpx
+ ''', file=fd)
+         self.configmanager.parse()
+-        interfaces = ['enp1', 'wlp6s0', 'enp2', 'enp3']
+-        vf_counts = defaultdict(int)
+-        vfs = {}
+-        pfs = {}
+ 
+         # call the function under test
+         with self.assertRaises(ConfigurationError) as e:
+-            sriov.get_vf_count_and_functions(interfaces, self.configmanager.np_state,
+-                                             vf_counts, vfs, pfs)
++            _ = sriov._get_physical_functions(self.configmanager.np_state)
+ 
+         self.assertIn('matched more than one interface for a PF device: enpx',
+                       str(e.exception))
+ 
++    @patch('netifaces.interfaces')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+-    def test_get_vf_count_and_functions_not_enough_explicit(self, gim, gidn):
++    def test_get_vf_count_vfs_and_pfs_not_enough_explicit(self, gim, gidn, ifaces):
+         # we mock-out get_interface_driver_name and get_interface_macaddress
+         # to return useful values for the test
+         gim.side_effect = lambda x: '00:01:02:03:04:05' if x == 'enp3' else '00:00:00:00:00:00'
+         gidn.side_effect = lambda x: 'foo' if x == 'enp2' else 'bar'
++        ifaces.return_value = ['enp1', 'wlp6s0']
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+   version: 2
+@@ -324,15 +491,17 @@ class TestSRIOV(unittest.TestCase):
+       link: enp1
+ ''', file=fd)
+         self.configmanager.parse()
+-        interfaces = ['enp1', 'wlp6s0']
+-        vf_counts = defaultdict(int)
+-        vfs = {}
+-        pfs = {}
+ 
+         # call the function under test
+         with self.assertRaises(ConfigurationError) as e:
+-            sriov.get_vf_count_and_functions(interfaces, self.configmanager.np_state,
+-                                             vf_counts, vfs, pfs)
++            _ = sriov._get_vf_number_per_pf(self.configmanager.np_state)
++
++        self.assertIn('more VFs allocated than the explicit size declared: 3 > 2',
++                      str(e.exception))
++
++        # _get_pkysical_functions() also might raise ConfigurationError()
++        with self.assertRaises(ConfigurationError) as e:
++            _ = sriov._get_physical_functions(self.configmanager.np_state)
+ 
+         self.assertIn('more VFs allocated than the explicit size declared: 3 > 2',
+                       str(e.exception))
+@@ -479,14 +648,16 @@ class TestSRIOV(unittest.TestCase):
+                       str(e.exception))
+ 
+     @patch('netifaces.interfaces')
+-    @patch('netplan_cli.cli.sriov.get_vf_count_and_functions')
++    @patch('netplan_cli.cli.sriov._get_vf_number_per_pf')
++    @patch('netplan_cli.cli.sriov._get_virtual_functions')
++    @patch('netplan_cli.cli.sriov._get_physical_functions')
+     @patch('netplan_cli.cli.sriov.set_numvfs_for_pf')
+     @patch('netplan_cli.cli.sriov.perform_hardware_specific_quirks')
+     @patch('netplan_cli.cli.sriov.apply_vlan_filter_for_vf')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+     def test_apply_sriov_config(self, gim, gidn, apply_vlan, quirks,
+-                                set_numvfs, get_counts, netifs):
++                                set_numvfs, get_phys, get_virt, get_num, netifs):
+         # set up the environment
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+@@ -516,11 +687,14 @@ class TestSRIOV(unittest.TestCase):
+         # set up all the mock objects
+         netifs.return_value = ['enp1', 'enp2', 'enp5', 'wlp6s0',
+                                'enp1s16f1', 'enp1s16f2', 'enp2s16f1']
+-        get_counts.side_effect = mock_set_counts
+         set_numvfs.side_effect = lambda pf, _: False if pf == 'enp2' else True
+         gidn.return_value = 'foodriver'
+         gim.return_value = '00:01:02:03:04:05'
+ 
++        get_num.return_value = {'enp1': 2, 'enp2': 1}
++        get_virt.return_value = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
++        get_phys.return_value = {'enp1': 'enp1', 'enpx': 'enp2'}
++
+         # call method under test
+         sriov.apply_sriov_config(self.configmanager, rootdir=self.workdir.name)
+ 
+@@ -539,14 +713,16 @@ class TestSRIOV(unittest.TestCase):
+         apply_vlan.assert_called_once_with('enp2', 'enp2s16f1', 'vf1.15', 15)
+ 
+     @patch('netifaces.interfaces')
+-    @patch('netplan_cli.cli.sriov.get_vf_count_and_functions')
++    @patch('netplan_cli.cli.sriov._get_vf_number_per_pf')
++    @patch('netplan_cli.cli.sriov._get_virtual_functions')
++    @patch('netplan_cli.cli.sriov._get_physical_functions')
+     @patch('netplan_cli.cli.sriov.set_numvfs_for_pf')
+     @patch('netplan_cli.cli.sriov.perform_hardware_specific_quirks')
+     @patch('netplan_cli.cli.sriov.apply_vlan_filter_for_vf')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+     def test_apply_sriov_config_invalid_vlan(self, gim, gidn, apply_vlan, quirks,
+-                                             set_numvfs, get_counts, netifs):
++                                             set_numvfs, get_phys, get_virt, get_num, netifs):
+         # set up the environment
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+@@ -575,7 +751,9 @@ class TestSRIOV(unittest.TestCase):
+         # set up all the mock objects
+         netifs.return_value = ['enp1', 'enp2', 'enp5', 'wlp6s0',
+                                'enp1s16f1', 'enp1s16f2', 'enp2s16f1']
+-        get_counts.side_effect = mock_set_counts
++        get_num.return_value = {'enp1': 2, 'enp2': 1}
++        get_virt.return_value = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
++        get_phys.return_value = {'enp1': 'enp1', 'enpx': 'enp2'}
+         set_numvfs.side_effect = lambda pf, _: False if pf == 'enp2' else True
+         gidn.return_value = 'foodriver'
+         gim.return_value = '00:01:02:03:04:05'
+@@ -607,14 +785,16 @@ class TestSRIOV(unittest.TestCase):
+                           logs.output[0])
+ 
+     @patch('netifaces.interfaces')
+-    @patch('netplan_cli.cli.sriov.get_vf_count_and_functions')
++    @patch('netplan_cli.cli.sriov._get_vf_number_per_pf')
++    @patch('netplan_cli.cli.sriov._get_virtual_functions')
++    @patch('netplan_cli.cli.sriov._get_physical_functions')
+     @patch('netplan_cli.cli.sriov.set_numvfs_for_pf')
+     @patch('netplan_cli.cli.sriov.perform_hardware_specific_quirks')
+     @patch('netplan_cli.cli.sriov.apply_vlan_filter_for_vf')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+     def test_apply_sriov_config_too_many_vlans(self, gim, gidn, apply_vlan, quirks,
+-                                               set_numvfs, get_counts, netifs):
++                                               set_numvfs, get_phys, get_virt, get_num, netifs):
+         # set up the environment
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+@@ -648,7 +828,9 @@ class TestSRIOV(unittest.TestCase):
+         # set up all the mock objects
+         netifs.return_value = ['enp1', 'enp2', 'enp5', 'wlp6s0',
+                                'enp1s16f1', 'enp1s16f2', 'enp2s16f1']
+-        get_counts.side_effect = mock_set_counts
++        get_num.return_value = {'enp1': 2, 'enp2': 1}
++        get_virt.return_value = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
++        get_phys.return_value = {'enp1': 'enp1', 'enpx': 'enp2'}
+         set_numvfs.side_effect = lambda pf, _: False if pf == 'enp2' else True
+         gidn.return_value = 'foodriver'
+         gim.return_value = '00:01:02:03:04:05'
+@@ -662,14 +844,16 @@ class TestSRIOV(unittest.TestCase):
+         self.assertEqual(apply_vlan.call_count, 1)
+ 
+     @patch('netifaces.interfaces')
+-    @patch('netplan_cli.cli.sriov.get_vf_count_and_functions')
++    @patch('netplan_cli.cli.sriov._get_vf_number_per_pf')
++    @patch('netplan_cli.cli.sriov._get_virtual_functions')
++    @patch('netplan_cli.cli.sriov._get_physical_functions')
+     @patch('netplan_cli.cli.sriov.set_numvfs_for_pf')
+     @patch('netplan_cli.cli.sriov.perform_hardware_specific_quirks')
+     @patch('netplan_cli.cli.sriov.apply_vlan_filter_for_vf')
+     @patch('netplan_cli.cli.utils.get_interface_driver_name')
+     @patch('netplan_cli.cli.utils.get_interface_macaddress')
+     def test_apply_sriov_config_many_match(self, gim, gidn, apply_vlan, quirks,
+-                                           set_numvfs, get_counts, netifs):
++                                           set_numvfs, get_phys, get_virt, get_num, netifs):
+         # set up the environment
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+             print('''network:
+@@ -694,7 +878,9 @@ class TestSRIOV(unittest.TestCase):
+         # set up all the mock objects
+         netifs.return_value = ['enp1', 'enp2', 'enp5', 'wlp6s0',
+                                'enp1s16f1', 'enp1s16f2', 'enp2s16f1']
+-        get_counts.side_effect = mock_set_counts
++        get_num.return_value = {'enp1': 2, 'enp2': 1}
++        get_virt.return_value = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
++        get_phys.return_value = {'enp1': 'enp1', 'enpx': 'enp2'}
+         set_numvfs.side_effect = lambda pf, _: False if pf == 'enp2' else True
+         gidn.return_value = 'foodriver'
+         gim.return_value = '00:01:02:03:04:05'
+@@ -733,8 +919,11 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+             open(os.path.join(self.workdir.name, 'sys_mock/bus/pci/devices/0000:00:1f.6/physfn'), 'a').close()
+             self.assertTrue(pcidev.is_vf)
+ 
++    @patch('netplan_cli.cli.utils.get_interface_macaddress')
+     @patch('netifaces.interfaces')
+-    @patch('netplan_cli.cli.sriov.get_vf_count_and_functions')
++    @patch('netplan_cli.cli.sriov._get_vf_number_per_pf')
++    @patch('netplan_cli.cli.sriov._get_virtual_functions')
++    @patch('netplan_cli.cli.sriov._get_physical_functions')
+     @patch('netplan_cli.cli.sriov.set_numvfs_for_pf')
+     @patch('netplan_cli.cli.sriov.perform_hardware_specific_quirks')
+     @patch('subprocess.check_call')
+@@ -743,7 +932,7 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+     @patch('netplan_cli.cli.sriov.PCIDevice.devlink_eswitch_mode')
+     @patch('netplan_cli.cli.sriov._get_pci_slot_name')
+     def test_apply_sriov_config_eswitch_mode(self, gpsn, pcidevice_devlink, pcidevice_sys, pcidevice_bound,
+-                                             scc, quirks, set_numvfs, get_counts, netifs):
++                                             scc, quirks, set_numvfs, get_phys, get_virt, get_num, netifs, gima):
+         handle = mock_open()
+         builtin_open = open  # save the unpatched version of open()
+ 
+@@ -775,6 +964,7 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+             True, True,  # 2x unbind (enp1 VFs)
+             True, True, True, True,  # 4x unbind (enpx/enp2 VFs)
+             False, False, False, False]  # 4x re-bind (enpx/enp2 VFs)
++        gima.return_value = '00:11:22:33:44:55'
+ 
+         # YAML config
+         with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
+@@ -802,7 +992,9 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+         # set up all the mock objects
+         netifs.return_value = ['enp1', 'enp2', 'enp5', 'wlp6s0',
+                                'enp1s16f1', 'enp1s16f2', 'enp2s16f1']
+-        get_counts.side_effect = mock_set_counts
++        get_num.return_value = {'enp1': 2, 'enp2': 1}
++        get_virt.return_value = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
++        get_phys.return_value = {'enp1': 'enp1', 'enpx': 'enp2'}
+         writes = [
+             ('/sys/bus/pci/drivers/mlx5_core/unbind', '0000:03:00.2'),
+             ('/sys/bus/pci/drivers/mlx5_core/unbind', '0000:03:00.3'),
diff --git a/debian/patches/lp2020409/0027-cli-sriov-set-eswitch-regardless-of-pcidev.vfs.patch b/debian/patches/lp2020409/0027-cli-sriov-set-eswitch-regardless-of-pcidev.vfs.patch
new file mode 100644
index 0000000..6acce65
--- /dev/null
+++ b/debian/patches/lp2020409/0027-cli-sriov-set-eswitch-regardless-of-pcidev.vfs.patch
@@ -0,0 +1,132 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Tue, 16 Apr 2024 10:26:22 +0100
+Subject: cli/sriov: set eswitch regardless of pcidev.vfs
+
+The call to pcidev.devlink_set was still inside a check for the
+existence of VFs. Move it to outside of it.
+
+Add a test to cover the case where the unbind_vfs operation fails.
+
+Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2020409
+Origin: https://github.com/canonical/netplan/pull/454
+---
+ netplan_cli/cli/sriov.py | 14 +++++----
+ tests/test_sriov.py      | 78 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 87 insertions(+), 5 deletions(-)
+
+diff --git a/netplan_cli/cli/sriov.py b/netplan_cli/cli/sriov.py
+index 3e03695..0e1c6ef 100644
+--- a/netplan_cli/cli/sriov.py
++++ b/netplan_cli/cli/sriov.py
+@@ -529,13 +529,17 @@ def apply_sriov_config(config_manager, rootdir='/'):
+                 if pcidev.is_pf:
+                     logging.debug("Found VFs of {}: {}".format(pcidev, pcidev.vf_addrs))
+                     if pcidev.vfs:
+-                        rebind_delayed = netdef._delay_virtual_functions_rebind
+                         try:
+                             unbind_vfs(pcidev.vfs, pcidev.driver)
+-                            pcidev.devlink_set('eswitch', 'mode', eswitch_mode)
+-                        finally:
+-                            if not rebind_delayed:
+-                                bind_vfs(pcidev.vfs, pcidev.driver)
++                        except Exception as e:
++                            logging.warning(f'Unbinding of VFs for {netdef_id} failed: {str(e)}')
++
++                    logging.debug(f'Changing eswitch mode from {current_eswitch_mode_system} to {eswitch_mode} for: {netdef_id}')
++                    pcidev.devlink_set('eswitch', 'mode', eswitch_mode)
++
++                    if pcidev.vfs:
++                        if not netdef._delay_virtual_functions_rebind:
++                            bind_vfs(pcidev.vfs, pcidev.driver)
+ 
+     filtered_vlans_set = set()
+     for vlan, netdef in np_state.vlans.items():
+diff --git a/tests/test_sriov.py b/tests/test_sriov.py
+index c4ffd4f..b2577aa 100644
+--- a/tests/test_sriov.py
++++ b/tests/test_sriov.py
+@@ -1021,6 +1021,84 @@ MODALIAS=pci:v00008086d0000156Fsv000017AAsd00002245bc02sc00i00
+             call(['/sbin/devlink', 'dev', 'eswitch', 'set', 'pci/0000:03:00.1', 'mode', 'switchdev'])
+         ])
+ 
++    @patch('netplan_cli.cli.sriov.unbind_vfs')
++    @patch('netplan_cli.cli.utils.get_interface_macaddress')
++    @patch('netifaces.interfaces')
++    @patch('netplan_cli.cli.sriov._get_vf_number_per_pf')
++    @patch('netplan_cli.cli.sriov._get_virtual_functions')
++    @patch('netplan_cli.cli.sriov._get_physical_functions')
++    @patch('netplan_cli.cli.sriov.set_numvfs_for_pf')
++    @patch('netplan_cli.cli.sriov.perform_hardware_specific_quirks')
++    @patch('subprocess.check_call')
++    @patch('netplan_cli.cli.sriov.PCIDevice.bound', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.sys', new_callable=unittest.mock.PropertyMock)
++    @patch('netplan_cli.cli.sriov.PCIDevice.devlink_eswitch_mode')
++    @patch('netplan_cli.cli.sriov._get_pci_slot_name')
++    def test_apply_sriov_config_eswitch_mode_unbind_failed(self, gpsn, pcidevice_devlink, pcidevice_sys, pcidevice_bound,
++                                                           scc, quirks, set_numvfs, get_phys, get_virt, get_num, netifs,
++                                                           gima, ubind):
++        # set up the mock sysfs environment
++        self._prepare_sysfs_dir_structure(pf=('enp1', '0000:03:00.0'),
++                                          vfs=[('enp1s16f1', '0000:03:00.2'),
++                                               ('enp1s16f2', '0000:03:00.3')],
++                                          pf_driver='mlx5_core')
++        self._prepare_sysfs_dir_structure(pf=('enp2', '0000:03:00.1'),
++                                          vfs=[('enp2s14f1', '0000:03:08.2'),
++                                               ('enp2s15f1', '0000:03:08.3'),
++                                               ('enp2s16f1', '0000:03:08.4'),
++                                               ('enp2s17f1', '0000:03:08.5')],
++                                          pf_driver='mlx5_core')
++        enp1_pci_addr = '0000:03:00.0'
++        enp2_pci_addr = '0000:03:00.1'
++        gpsn.side_effect = lambda iface: enp1_pci_addr if iface == 'enp1' else enp2_pci_addr
++        sys_path = os.path.join(self.workdir.name, 'sys')
++        pcidevice_devlink.return_value = '__undetermined'
++        pcidevice_sys.return_value = sys_path
++        pcidevice_bound.side_effect = [
++            True, True,  # 2x unbind (enp1 VFs)
++            True, True, True, True,  # 4x unbind (enpx/enp2 VFs)
++            False, False, False, False]  # 4x re-bind (enpx/enp2 VFs)
++        gima.return_value = '00:11:22:33:44:55'
++
++        # YAML config
++        with open(os.path.join(self.workdir.name, "etc/netplan/test.yaml"), 'w') as fd:
++            print('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    enp1:
++      embedded-switch-mode: "legacy"
++      delay-virtual-functions-rebind: true
++    enpx:
++      match:
++        name: enp[2-3]
++      embedded-switch-mode: "switchdev"
++    enp1s16f1:
++      link: enp1
++    enp1s16f2:
++      link: enp1
++    customvf1:
++      match:
++        name: enp[2-3]s16f[1-4]
++      link: enpx
++''', file=fd)
++
++        # set up all the mock objects
++        netifs.return_value = ['enp1', 'enp2', 'enp5', 'wlp6s0',
++                               'enp1s16f1', 'enp1s16f2', 'enp2s16f1']
++        get_num.return_value = {'enp1': 2, 'enp2': 1}
++        get_virt.return_value = {'enp1s16f1': None, 'enp1s16f2': None, 'customvf1': None}
++        get_phys.return_value = {'enp1': 'enp1', 'enpx': 'enp2'}
++
++        ubind.side_effect = Exception('some IO error related to mlx5_core/unbind')
++
++        # test success case
++        with patch('logging.warning') as log:
++            sriov.apply_sriov_config(self.configmanager, rootdir=self.workdir.name)
++            log.assert_has_calls([
++                call('Unbinding of VFs for enp1 failed: some IO error related to mlx5_core/unbind'),
++                call('Unbinding of VFs for enpx failed: some IO error related to mlx5_core/unbind')])
++
+     @patch('netplan_cli.cli.sriov.PCIDevice.bound', new_callable=unittest.mock.PropertyMock)
+     @patch('netplan_cli.cli.sriov.PCIDevice.sys', new_callable=unittest.mock.PropertyMock)
+     @patch('netplan_cli.cli.commands.sriov_rebind._get_pci_slot_name')
diff --git a/debian/patches/series b/debian/patches/series
index 0f33be3..e3cc142 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -15,3 +15,15 @@ lp2066258/0015-backends-escape-file-paths.patch
 lp2066258/0016-backends-escape-semicolons-in-service-units.patch
 0017-emitter-allow-unicode-characters-in-the-emitter.patch
 0018-parse-do-not-escape-all-non-ascii-bytes.patch
+
+# SR-IOV improvements
+lp1988018/0018-libnetplan-add-a-getter-for-bond-mode.patch
+lp1988018/0019-sriov-move-the-udev-logic-to-a-service-unit.patch
+lp1988018/0020-sriov-check-the-eswitch-mode-before-trying-to-change.patch
+lp1988018/0021-sriov_rebind-cooperate-with-VF-LAG-activation.patch
+lp1988018/0022-sriov_rebind-netplan-rebind-debug-setup.patch
+lp1988018/0023-tests-sriov-adapt-tests-to-the-last-sr-iov-related-c.patch
+lp1988018/0024-sriov_apply-execute-apply-sriov-only-before-network-.patch
+lp2020409/0025-sriov-accept-setting-the-eswitch-mode-without-VFs.patch
+lp2020409/0026-cli-sriov-refactoring.patch
+lp2020409/0027-cli-sriov-set-eswitch-regardless-of-pcidev.vfs.patch