Sayeed Tasnim

This commit **adds comprehensive unit tests** for the **IPFIX and XGS PSAMP MoD packet structures** within the `fboss/agent/packet/bcm` library. This **testing enhancement** specifically targets `IpfixHeader`, `XgsPsampTemplateHeader`, `XgsPsampData`, and `XgsPsampModPacket`, validating their serialization, deserialization, and robust handling of truncated buffers, version validation, and length mismatches. By ensuring correct round-trip functionality and real-world packet deserialization, this work significantly improves the **quality assurance** and reliability of **Broadcom-specific packet processing** for network monitoring. The new tests are integrated into the build system via `cmake/AgentPacket.cmake` and `fboss/agent/packet/bcm/test/BUCK`, with the test logic residing in `fboss/agent/packet/bcm/test/XgsPsampModTest.cpp`.

This commit introduces a **new hardware test case**, `XgsModAclDrop`, within `fboss/agent/test/agent_hw_tests/AgentMirrorOnDropTests.cpp` to validate the **Mirror on Drop (MoD)** functionality on **XGS platforms**. The test specifically verifies that packets dropped by **ACL rules** are correctly captured and reported by the MoD mechanism. By simulating a DENY ACL on destination IP and sending a matching packet, it confirms a MoD packet is generated and captured. This addition enhances **testing coverage** for network diagnostic features, ensuring reliable packet capture for policy-based drops.

This commit introduces **new packet parsing capabilities** to the `fboss/agent/packet` module by adding data structures and serialization/deserialization logic for **IPFIX/PSAMP Mirror-on-Drop (MoD) packets**. It defines a standard `IpfixHeader` for general IPFIX messages and **Broadcom XGS-specific PSAMP MoD structures** (`XgsPsampMod`) to handle vendor-specific deviations like fixed template IDs and proprietary metadata. This **new feature** enables the FBOSS agent to correctly interpret and process these specialized monitoring packets, enhancing network diagnostics and drop visibility on Broadcom XGS platforms.

This commit **enhances the XGS Mirror-on-Drop (MoD) test suite** by introducing robust packet deserialization and verification helpers. It adds `deserializeXgsModPacket` and `verifyXgsModCapturedPacket` functions to `AgentMirrorOnDropTests.cpp` to ensure that captured PSAMP MoD packets conform to expected formats and content. These new verification steps are integrated into all three existing MoD tests: `XgsModDefaultRouteDrop`, `XgsModAclDrop`, and `XgsModMmuDrop`, significantly **improving the reliability and coverage** of these hardware tests. Additionally, common packet values like `kPacketSrcIp_` are refactored into constants to reduce duplication and improve test readability.

This commit provides a **bug fix** for the **Sflow Mirror Test** (`AgentSflowMirrorTest.cpp`) to resolve `VerifySampledPacketRate` failures observed during **warm boot roundtrips**, particularly with cross-binary transitions. The core issue was inaccurate sample count verification due to cumulative counter discrepancies; the fix now uses **per-interval deltas for stats collection**, eliminating baseline offsets regardless of their source. This change also refines port handling and skips intervals with zero traffic, significantly improving the **reliability and accuracy of Sflow sampling verification** during warm boot transitions.

This commit introduces a **new capability** by **enabling Mirror on Drop (MoD) to capture MMU drop types** on **XGS platforms**, extending its existing support for ingress drops. The `SaiTamManager` in `fboss/agent/hw/sai/switch/npu/bcm` is updated to include these new drop types via the `addXgsMirrorOnDropReport` function. To validate this, a new **integration test**, `XgsModMmuDrop`, is added to verify that MoD correctly generates packets for MMU drops caused by buffer exhaustion on TH5. This enhancement improves network observability by providing critical insights into internal packet drops, with full PSAMP packet verification to be implemented in a subsequent commit.

This commit **refactors** the **test suite** by **renaming** the `XgsMod` test case within `fboss/agent/test/agent_hw_tests/AgentMirrorOnDropTests.cpp` to `XgsModDefaultRouteDrop`. This change significantly improves the **clarity and readability** of the **Agent's hardware tests**, specifically for scenarios involving the **XGS module**. The new name accurately reflects that the test verifies packet dropping behavior when there is **no matching route or a default route discard**, aligning with existing naming conventions for other drop scenarios. This **maintenance** effort ensures better understanding of test intent for future development and debugging of the **AgentMirrorOnDrop** feature.

This commit introduces a **new capability** to the **SaiTamManager** by integrating **SamplePacket creation** for **XGS Mirror-on-Drop (MoD) reports**. It modifies `SaiTamManager.h` to include `SaiSamplePacketManager.h` and extends the `addTam()` signature, while `SaiTamManager.cpp` now creates and associates `SaiSamplePacket` instances with TAM events when a `samplingRate` is configured. This enables **packet sampling for MoD on Tomahawk5 (TH5) platforms**, ensuring that only a fraction of dropped packets are sent to the collector, optimizing monitoring resources.

This commit introduces a **new capability** by adding the `IngressSamplepacketEnable` attribute to the **SAI API's `SaiTamEventTraits`**. This attribute allows for **configuring ingress samplepacket enablement** on **TAM events**, enhancing their flexibility and control. The change required updates across the core `TamApi.h` definition, platform-specific implementations (BCM, Tajo, OSS), the **Fake SAI** for testing, and **tracing** mechanisms. Notably, the attribute is excluded from the `AdapterHostKey` to prevent warmboot state mismatches caused by `SAI_NULL_OBJECT_ID` when the attribute is not explicitly set. This ensures robust **TAM event management** and proper state reconciliation.

This commit **refactors** the **FBOSS agent's hardware tests** by **extracting key utility functions** into reusable components. Specifically, `makeXgsModReport` for **XGS Mirror on Drop (MoD) report configuration**, `configureErspanMirror` for **ERSPAN GRE tunnel mirror setup**, and `waitForStatsToStabilize` for port statistics polling are now available. This effort improves test code organization and **simplifies future test development** within the **Mirror on Drop (MoD)** and **ERSPAN mirroring** subsystems. An existing `XgsMod` test in `AgentMirrorOnDropTests.cpp` has been updated to leverage the newly extracted `makeXgsModReport` function.

This commit introduces a **new test case**, `XgsModWithSampling`, within `AgentMirrorOnDropTests.cpp` to thoroughly validate **Mirror-on-Drop (MoD) sampling** functionality on **XGS platforms**. The test configures a MoD report with a specific `samplingRate` and verifies its correct application by sending packets and asserting the expected number of sampled MoD packets, thereby exercising the `SamplePacket` integration for TAM event sampling via `SAI_TAM_EVENT_ATTR_INGRESS_SAMPLEPACKET_ENABLE` on Tomahawk5 (TH5). A new helper function, `makeXgsModReport()`, is added to simplify MoD report configuration, and existing packet creation helpers are refined to support variable payload sizes. This **enhances test coverage** for a critical network monitoring feature, ensuring its reliability.

This commit introduces a **new capability** to the **Mirror-on-Drop (MOD) reporting** system by adding an optional `samplingRate` field to its configuration and state. This field, integrated into `switch_config.thrift` and `switch_state.thrift`, allows administrators to specify that only a sampled subset of MOD packets should be reported to collectors, rather than every single one. The `MirrorOnDropReport` class in `MirrorOnDropReport.h/.cpp` has been extended to accept and store this new parameter, with `ApplyThriftConfig.cpp` updated to pass the value from the configuration. This enhancement provides **resource optimization** by reducing the volume of reports and offers more granular control over MOD packet monitoring.

This commit **fixes a race condition** in the **Mirror-on-Drop (MoD) feature** on **DNX/VOQ switches** by preventing the `TamManager` from spuriously tearing down and re-adding TAM objects. It achieves this by skipping collector IP resolution in `TamManager::resolveMirrorOnDropReports()` for DNX platforms, where such resolution is unnecessary and causes state changes that trigger full TAM reprogramming. Additionally, `waitForStateUpdates()` calls were added to affected `AgentMirrorOnDropDnxTest` cases to prevent future race conditions. This **bug fix** ensures **TAM stability** and resolves **flaky test failures** related to MoD on DNX.

This commit provides a **bug fix** for a **UBSan error** occurring in the **SAI TAM (Telemetry, Analytics, and Monitoring) subsystem**. The issue stemmed from vendor-specific extension enum values, such as `SAI_TAM_TRANSPORT_TYPE_PORT`, exceeding the valid range of their base SAI enum types, leading to undefined behavior when passed as narrow enum parameters. To resolve this, the parameter types for `createTamTransport` and `createTamReport` in `SaiTamManager` have been changed from specific SAI enum types to `sai_int32_t`. This adjustment aligns the function signatures with how the SAI attribute layer already correctly handles these values, thereby improving **runtime stability** and removing redundant `static_cast` operations.

This commit introduces a **refactoring** by adding a shared helper method, `StateDelta::hasRouteOrNeighborChanges()`, to consolidate logic for detecting network state changes. This new utility encapsulates checks for modifications in **FIB maps, VLAN ARP/NDP entries, and Interface ARP/NDP entries**. The primary impact is on the **`MirrorManager`**, which now utilizes this method to identify route and neighbor changes, eliminating previously duplicated inline logic. This **code consolidation** also makes this essential detection functionality reusable for other modules, such as `TamManager` for its MirrorOnDropReport next-hop resolution, improving maintainability and consistency across the codebase.

This commit introduces a new `NextHopResolver` template class, providing a reusable multi-stage pipeline for resolving destination IP addresses to next hop ports and MAC addresses. This **new capability** extracts common resolution logic previously embedded in `MirrorManagerImpl`, making it available for both the existing **`MirrorManager`** (for SPAN/ERSPAN) and a **future `TamManager`** (for Mirror on Drop on TH5 switches). By centralizing this complex resolution, the commit performs a significant **refactoring** that lays the groundwork for **Mirror on Drop functionality** on Tomahawk5 switches.

This commit **introduces comprehensive unit tests** for the **`TamManager`** class, specifically validating its core functionality of resolving `MirrorOnDropReport` collector IPs to MAC addresses and egress ports. The tests cover various scenarios, including successful resolution, cases where reports remain unresolved due to missing routes or neighbor entries, and dynamic updates when network conditions like routes or neighbors change. This **new testing capability** ensures the correctness and robustness of the `TamManager`'s resolution logic across both IPv4 and IPv6, and for different neighbor table types. The addition of `TamManagerTest.cpp` to the build system facilitates continuous validation of this critical component.

This commit **enhances** the **Mirror-on-Drop (MoD) functionality** by integrating `TamManager`'s IP resolution with the SAI layer, primarily affecting **XGS platforms**. `SaiTamManager` now dynamically retrieves the **resolved next-hop MAC address and egress port** from `TamManager`'s `MirrorOnDropReport` state for MoD reports, rather than using hardcoded or configured values. This **new capability** updates `ApplyThriftConfig` to set the mirror port ID to 0 for NPU switches, allowing `TamManager` to handle egress port resolution dynamically, and ensures only fully resolved reports are programmed. Consequently, this improves the **accuracy and robustness** of MoD reporting by ensuring mirrored packets are sent to the correct destination based on actual network state, while also simplifying configuration by removing the need for an explicit mirror port.

This commit **refactors** the **MirrorManagerImpl** to centralize its next-hop, neighbor, and interface resolution logic by integrating the new `NextHopResolver` utility. The `MirrorManagerImpl` now delegates tasks like route lookup, ARP/NDP resolution, and egress port determination to `resolver_`, significantly reducing code duplication within `updateMirror()` and `resolveMirrorTunnel()`. This **refactoring** improves the maintainability and testability of the **mirroring subsystem** by abstracting complex resolution logic. Furthermore, it lays the groundwork for future use of `NextHopResolver` in `TamManager` for Mirror on Drop collector resolution.

This commit introduces `TamManager`, a **new capability** acting as a `StateObserver` within the `SwSwitch` to resolve collector IP addresses for **Mirror on Drop (MoD) reports**. The `TamManager` monitors changes in `MirrorOnDropReport` entries, FIBs, and neighbor states, leveraging `NextHopResolver` to determine the correct MAC addresses and egress ports for MoD collector IPs. This **feature addition** is crucial for enabling proper forwarding of MoD reports on **Tomahawk5 (TH5) switches** running on the XGS platform, ensuring that mirrored traffic reaches its intended destination. The manager updates the `MirrorOnDropReport` state with resolved values, optimizing performance by only applying changes when resolution actually differs.