fboss

Summary Adds two new subcommands under for configuring ACL table groups and tables: — sets (enum: , , , , or numeric 0–3) — sets (non-negative i16) The Thrift model has a two-level key structure (AclTableGroup → AclTable). Both commands target (field 56, the preferred form); the deprecated (field 45) is not supported. When is set, both changes are applied at runtime via in SaiSwitch with no warmboot-prohibited guard, so the CLI marks them HITLESS. When that flag is off (the default on some platforms today), changes take a different code path in SaiSwitch; this PR only adds the CLI plumbing and was validated against a DUT with the flag off, so the flag-on runtime path is not covered by the included tests (see Test Plan). Group/table lookup logic shared between the two subcommand handlers lives in rather than being duplicated between the and handlers. Test Plan Unit tests (19/19 passing) The seed config includes two table groups (the first with two tables), so tests can assert that mutating the targeted group/table leaves its siblings untouched, and dedicated tests target the non-first group/table by name — with only one group/table, or only ever mutating index 0, a bug that matched "first element" instead of "match by name" would pass undetected. A separate fixture with no at all covers the "no aclTableGroups configured" error branch shared by both handlers. Integration tests (NH-4010-F — skipped: DUT has no sw.aclTableGroups) The NH-4010-F DUT used for testing uses a single flat ACL map without ACL table groups ( is off / field 56 absent). The integration tests detect this and skip gracefully: Sample CLI transcript (NH-4010-F)

Pre-submission checklist** [x] I've ran the linters locally and fixed lint errors related to the files I modified in this PR. You can install the linters by running [x] Summary Adds alongside the existing (renamed from ), backed by one shared implementation () instead of two. Also adds the matching (the delete side previously only supported copp) and drops leftover -specific naming/messages that the original rename missed on the delete side. Supersedes #1379: its cpu-traffic-policy command is folded in here rather than landing separately. This is also the design #1379's review asked for against #1183 — the rule-side rich actions #1183 was adding are deprecated in favor of the two policy-scoped verbs above. The one behavioral point not visible from the diff: which policy a rule belongs to isn't cosmetic. resolves a rule to the CPU policy first and falls back to the data-plane one, so a rule can't usefully belong to both — the config side now refuses that case up front instead of silently ignoring one side. Test Plan Unit tests included in this diff (, the config and delete commands for both policies) cover each action shape, the shared parser's validation, the cross-policy refusal, and the delete/prune-empty-entry behavior. Not independently re-run against this exact squashed commit locally; relying on CI to build and test it.

Pre-submission checklist [x] I've ran the linters locally and fixed lint errors related to the files I modified in this PR. You can install the linters by running [x] Stacked on #1466. This branch includes the delete-copp commits from #1466 (the rename below touches files that PR introduces). The commits unique to this PR are , , and . Once #1466 merges, a rebase shrinks this PR to just those. Summary What: Follow-up to the review feedback on #1466 (@joseph5wu). Four changes: 1. Rename to across config and delete. Hard rename, no alias; classes and directories follow ( -> , -> ). copp already means control plane, so the cpu- prefix said nothing. 2. now takes every attribute handles: reserved-bytes, shared-bytes, weight, scaling-factor, scheduling, stream-type, buffer-pool-name, active-queue-management. The existing and forms still work, and attributes combine in one invocation. holds the same as the qos queue-config lists, so copp reuses the qos attribute parser/applier unchanged (see 4 for where it lives). The one copp-specific check is the WRR weight cap of [1, 255], since the SAI scheduler profile stores weight as a uint8 (). This is exact parity with ; three fields (, , ) remain un-settable in both command families. 3. takes an optional , which places the entry at 0-based index n of instead of always appending. The list is position-sensitive. Without , behavior is unchanged: existing reasons keep their position, new ones append. 4. The shared attribute helper moves to a neutral home so copp does not include headers from the qos command tree. , , and operate on bare and now live in . The qos-only pieces ( and the named queue-config list lookups) stay in the qos tree, renamed to so the two headers can't be confused. Code moved verbatim; only includes and build files changed. How: parses the same way does (aqm consumes the tail), intercepts and , and forwards the rest to . Queue edits apply onto a copy and splice back on success, so a rejected attribute leaves the session config untouched. All edits save HITLESS; cpuQueues and rxReason changes flow through . Test Plan Unit tests (full cmd_config_test suite): The suite was re-run after the helper move (change 4) and still passes. Integration tests on a hardware DUT (T0), including the new , , and ; clean afterwards: Sample usage on the same device: Build/test note: the runs above were performed on our internal tree, whose copp CLI sources are identical to this branch apart from internal-only command families; this upstream branch itself relies on CI for build verification.