[multicast] Bitmap-based multicast replication for sidecar-lite

This adds multicast replication to sidecar-lite, emulating DPD's
sidecar.p4

We manage 2 bitmaps per multicast destination (external, underlay),
in which replication is driven via the `Replicate` extern (from p4rs #240).
The ingress control block suppresses (or doesn't) these bitmaps based
on the geneve multicast option tag, and then merges both into a single
replication bitmap. This tag is read-only, matching DPD's sidecar.p4.
OPTE (would) stamp it before the packet reaches the switch.

Egress decap is gated on the reserved underlay subnet (ff04::/64, per
RFC 7346 admin-local scope + Omicron) and tag=2 (Both), matching DPD's
egress mcast_tag_check. Ports in the decap table get geneve stripped,
others keep encapsulation for OPTE to handle on the receiving sled.

Multicast dst MAC derivation (RFC 1112 for IPv4, RFC 2464 for IPv6)
and per-port source MAC rewrite run on every replicated copy. Egress
validates the outer IP multicast range before any mcast processing.

### References

This work depends on the P4(rs) work in
[#240](oxidecomputer/p4#240).

Author: zeeshanlakhani

Cargo.lock

@@ -6,9 +6,9 @@ members = [
 resolver = "2"
 
 [workspace.dependencies]
-p4rs = { git = "https://github.com/oxidecomputer/p4", branch = "main" }
-p4-macro = { git = "https://github.com/oxidecomputer/p4", branch = "main" }
-p4-test = { package = "tests", git = "https://github.com/oxidecomputer/p4", branch = "main" }
+p4rs = { git = "https://github.com/oxidecomputer/p4", branch = "zl/multicast" }
+p4-macro = { git = "https://github.com/oxidecomputer/p4", branch = "zl/multicast" }
+p4-test = { package = "tests", git = "https://github.com/oxidecomputer/p4", branch = "zl/multicast" }
 usdt = { git = "https://github.com/oxidecomputer/usdt" }
 
 base64 = { version = "0.22" }

Cargo.toml

@@ -1,4 +1,4 @@
-// Copyright 2025 Oxide Computer Company
+// Copyright 2026 Oxide Computer Company
 
 header sidecar_h {
     bit<8> sc_code;
@@ -96,7 +96,7 @@ header geneve_opt_h {
 }
 
 header oxg_opt_multicast_h {
-    bit<2> replication;
+    bit<2> mcast_tag;
     bit<30> reserved;
 }
 

p4/headers.p4

@@ -1,4 +1,4 @@
-// Copyright 2024 Oxide Computer Company
+// Copyright 2026 Oxide Computer Company
 
 parser parse(
     packet_in pkt,
@@ -46,6 +46,29 @@ parser parse(
 
     state ipv6 {
         pkt.extract(hdr.ipv6);
+        if (hdr.ipv6.dst[127:120] == 8w0xff) { transition ipv6_mcast; }
+        transition ipv6_proto;
+    }
+
+    state ipv6_mcast {
+        // Interface-local (ff01) must not be forwarded.
+        if (hdr.ipv6.dst[127:112] == 16w0xff01) { transition reject; }
+
+        // Link-local (ff02) is forwarded to scrimlet.
+        // Allow hop_limit == 1 (link-local scope) but still reject expired
+        // packets.
+        if (hdr.ipv6.dst[127:112] == 16w0xff02) {
+            if (hdr.ipv6.hop_limit == 8w0) { transition reject; }
+            transition ipv6_proto;
+        }
+
+        // Non-link-local multicast requires hop_limit > 1.
+        if (hdr.ipv6.hop_limit == 8w0) { transition reject; }
+        if (hdr.ipv6.hop_limit == 8w1) { transition reject; }
+        transition ipv6_proto;
+    }
+
+    state ipv6_proto {
         if (hdr.ipv6.next_hdr == 8w0xdd) { transition ddm; }
         if (hdr.ipv6.next_hdr == 8w58)   { transition icmp; }
         if (hdr.ipv6.next_hdr == 8w17)   { transition udp; }
@@ -82,6 +105,18 @@ parser parse(
 
     state ipv4 {
         pkt.extract(hdr.ipv4);
+        if (hdr.ipv4.dst[31:28] == 4w0xe) { transition ipv4_mcast; }
+        transition ipv4_proto;
+    }
+
+    state ipv4_mcast {
+        // Multicast with TTL <= 1 must not be forwarded (RFC 1112).
+        if (hdr.ipv4.ttl == 8w0) { transition reject; }
+        if (hdr.ipv4.ttl == 8w1) { transition reject; }
+        transition ipv4_proto;
+    }
+
+    state ipv4_proto {
         if (hdr.ipv4.protocol == 8w17) { transition udp; }
         if (hdr.ipv4.protocol == 8w6)  { transition tcp; }
         if (hdr.ipv4.protocol == 8w1)  { transition icmp; }