`FieldProcessor`

Manage Field Processor

FieldProcessor

Shortest form: fp.

Manage the Field Processor (FP): the TCAM classifier that matches packet fields (qualifiers) and applies actions such as drop, copy to CPU, redirect, police and count. Rules live in groups (one or more TCAM slices with a fixed qualifier set) and are made of entries. On Trident 3 there are lookup (VFP), ingress (IFP), egress (EFP) and exact-match stages. The usual abbreviation is fp.

How the arguments work:

Sub-command keywords must be typed in full: fp entry create works, fp ent create does not. Case does not matter. Only fp itself can be abbreviated. Name=value parameters (PolId=, StatId= …) can be shortened to their upper-case letters as usual.
IDs and numbers can be decimal or 0x hex.
Qualifier and action names are the SDK names without their prefix, for example DstIp, InPort, L4DstPort, Drop and CopyToCpu. Case does not matter. fp list qualifiers and fp list actions list them.
fp qset … builds a qualifier set that the shell remembers between commands. fp group create and fp group set use it.
fp alone, or an unknown sub-command, prints the usage.

Where the built-in help differs: it lists a top-level status, but the shell does not accept it (fp status prints the usage); use fp group status <gid>. Several working forms are missing from the help: group status, group mode, group lookup, list user, qual <eid> <QUAL> ?, show qset, show presel and show wbcachesize. list quals is accepted for list qualifiers. The help line sanity works only on chips that support it.

Warning

On SONiC the FP belongs to the SAI. ACL tables and rules, and the CoPP traps that send control packets (LLDP, BGP, ARP …) to the CPU, are FP groups and entries. fp init, fp detach, fp entry destroy with no ID, and fp policer destroy all delete them, so control-plane traffic stops reaching the CPU until syncd is restarted. Any other change made here is invisible to SONiC and may be overwritten, or may make later ACL updates fail. The show, list and get forms are read-only.

What a SONiC switch has in the FP: group 1 on the ingress stage holds the CoPP traps and ACL rules (entries with GpCopyToCpu, CosQCpuNew, RpDrop, Drop and policers), group 2 on the lookup stage holds a handful of DoNotLearn/DoNotCheckVlan entries, and group 3 on the egress stage is empty. Range checker 1 also belongs to SONiC. Pick IDs well away from these (the examples here use group 100, entry 1000 and range 100) and remove what you create.

When an FP call fails, the shell prints FP(unit 0) Error: <function>() failed: <reason> and then Failed to execute the diagnostic command. Error: Operation failed.; bcmcmd still exits 0. Entry not found means the entry, group, counter or action named does not exist.

Hardware-validated — Dump all FP groups and entries (read-only)

drivshell> fp show
FP: Range ID=1, flag=0x1, min=34048, max=35072, hw_index=0(0), style=BCM56504
FP:  unit 0:
PIPELINE STAGE INGRESS
FP:        :tcam_sz=18432(0x4800), tcam_slices=12, tcam_ext_numb=0,
PIPELINE STAGE EGRESS
FP:        :tcam_sz=2048(0x800), tcam_slices=4, tcam_ext_numb=0,
PIPELINE STAGE LOOKUP
FP:        :tcam_sz=1024(0x400), tcam_slices=4, tcam_ext_numb=0,
GID          3: gid=0x3, instance=0 mode=Double, stage=Egress lookup=Enabled, ActionResId={-1}, pbmp={0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000888888888888888c2222222222223e23}
         qset={StageEgress, MirrorCopy, CpuQueue, IngressClassField, HiGigDstGport},
         selcodes[0]=
{
         FPF3=KEY6
         Intraslice=Primary slice.
 {StageEgress->HiGigDstGport},
         selcodes[1]=
{
         FPF3=KEY4
         Intraslice=Primary slice.
 {MirrorCopy->CpuQueue->IngressClassField},

         group_priority= -2147483647
         slice_primary =  {slice_number=0, Entry count=512(0x200), Entry free=512(0x200)},
         slice_secondary = {slice_number=1}
         group_status={prio_min=-2147483647, prio_max=2147483647, entries_total=1024, entries_free=1024,
                       counters_total=2048, counters_free=2048, meters_total=1536, meters_free=1536}
Intra-slice double wide group, GID          2: gid=0x2, instance=0 mode=IntraSliceDouble, stage=Lookup lookup=Enabled, ActionResId={-1}, pbmp={0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000888888888888888c2222222222223e23}
         qset={SrcMac, DstMac, InPort, EtherType, StageLookup, IpFrag},
         selcodes[0]=
{
...

Hardware-validated — Build a drop rule by hand (changes the ASIC)

drivshell> fp qset clear
drivshell> fp qset add DstIp
BCM_FIELD_QSET_ADD(DstIp) okay
drivshell> fp group create 10 100
drivshell> fp entry create 100 1000
drivshell> fp qual 1000 DstIp 192.0.2.1 255.255.255.255
drivshell> fp action add 1000 Drop
drivshell> fp entry install 1000

Each step prints nothing on success. fp show entry 1000 then shows the installed entry. Remove it again with fp entry destroy 1000, fp group destroy 100 and fp qset clear.

Show

FieldProcessor show [brief]

Without an argument, dump every group and entry with their qualifiers, actions, policers and counters. brief prints a short summary per group. Read-only.

On Trident 3 the dump starts with the range checkers and the TCAM size of each stage (ingress 12 slices, egress 4, lookup 4), then each group with its mode, stage, port bitmap, qualifier set, select codes and group_status, followed by its entries. Each entry shows its slice, priority, flags, qualifiers with DATA/MASK, one action={…} line per action, its policer and its counter (statistics={stat id <n> …}). A SONiC switch prints about 1800 lines. brief keeps the group headers and leaves out the entries.

Output from older Trident+ (BCM56846) switches is in EdgeNOS: How Cumulus/switchd programs an ACL in the BCM56846 FP (+ raw fp show / FP_TCAM captures) and Edgecore AS5610-52X reverse engineering: Cumulus 2.5 baseline captures.

Hardware-validated

drivshell> fp show brief
FP:       unit 0:
 tcam_slices=0, tcam_ext_numb=0,
PIPELINE STAGE INGRESS
FP:             :tcam_sz=18432(0x4800), tcam_slices=12, tcam_ext_numb=0,
FP: Range ID=1, flag=0x1, min=34048, max=35072, hw_index=0(0), style=BCM56504
PIPELINE STAGE EGRESS
FP:             :tcam_sz=2048(0x800), tcam_slices=4, tcam_ext_numb=0,
PIPELINE STAGE LOOKUP
FP:             :tcam_sz=1024(0x400), tcam_slices=4, tcam_ext_numb=0,
GID          3: gid=0x3, mode=Double, stage=Egress lookup=Enabled, ActionResId={-1}, pbmp={0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000888888888888888c2222222222223e23}
         qset={StageEgress, MirrorCopy, CpuQueue, IngressClassField, HiGigDstGport},
         selcodes[0]=
{
         FPF3=KEY6
         Intraslice=Primary slice.
 {StageEgress->HiGigDstGport},
         selcodes[1]=
{
         FPF3=KEY4
         Intraslice=Primary slice.
 {MirrorCopy->CpuQueue->IngressClassField},

         slice_pri= -2147483647    {slice_number=0, Entry count=512(0x200), Entry free=512(0x200)},
         slice_sec = {slice_number=1}
         group_status={prio_min=-2147483647, prio_max=2147483647, entries_total=1024, entries_free=1024,
                       counters_total=2048, counters_free=2048, meters_total=1536, meters_free=1536}
Intra-slice double wide group, GID          2: gid=0x2, mode=IntraSliceDouble, stage=Lookup lookup=Enabled, ActionResId={-1}, pbmp={0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000888888888888888c2222222222223e23}
         qset={SrcMac, DstMac, InPort, EtherType, StageLookup, IpFrag},
         selcodes[0]=
{
...

FieldProcessor show entry <eid>

Dump one entry. Read-only.

Hardware-validated

drivshell> fp show entry 1000
EID 0x000003e8: gid=0x64,
 slice=3, slice_idx=0, part=0, prio=0, flags=0x810602, Installed, Enabled, color_indep=1
 slice=4, slice_idx=0, part=1, prio=0, flags=0x810604, Installed, Enabled, color_indep=1

 DstIp
    Part:0 Offset0:  0 Width0:  16
    Part:0 Offset1: 20 Width1:  16
    DATA=0xc0000201
    MASK=0xffffffff
         action={act=Drop, param0=0(0), param1=0(0), param2=0(0), param3=0(0)}
         policer=
         statistics=NULL
         Extended statistics=NULL

FieldProcessor show group <gid> [brief]

Dump one group and its entries, or with brief a summary. Read-only.

Hardware-validated

drivshell> fp show group 100 brief
GID        100: gid=0x64, mode=Double, stage=Ingress lookup=Enabled, ActionResId={-1}, pbmp={0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000888888888888888c2222222222223e23}
         qset={DstIp, Stage},
         selcodes[0]=
{ {DstIp},
         selcodes[1]=
{ {},

         slice_pri= 10    {slice_number=3, Entry count=768(0x300), Entry free=768(0x300)},
         slice_sec = {slice_number=4}
         group_status={prio_min=-2147483647, prio_max=2147483647, entries_total=2304, entries_free=2304,
                       counters_total=83968, counters_free=57856, meters_total=6144, meters_free=5376}

FieldProcessor show qset

Print the qualifier set the shell is building with fp qset. Read-only.

Hardware-validated

drivshell> fp show qset
qset={}

FieldProcessor show class [brief | entry <eid> | group <gid> [brief]]

Show the class stage, or one of its entries or groups. Read-only. Trident 3 prints a table of the class types with the entries used and available; SONiC uses none of them.

Hardware-validated

drivshell> fp show class brief
CLASS:    unit 0:PIPELINE STAGE CLASS
ClassPipe  ClassType        Flags  Entries Used  Entries Available
---------  ---------------  -----  ------------  -----------------
  Default  EtherType           0             0                 16
  Default  TTL                 0             0                256
  Default  TOS                 0             0                256
  Default  IPProtocol          0             0                256
  Default  L4SrcPort           0             0                 16
  Default  L4DstPort           0             0                 16
  Default  TCP                 0             0                256
  Default  SrcCompression      0             0                128
  Default  DstCompression      0             0                128

FieldProcessor show presel [<id>]

Dump all preselectors, or one. Read-only. SONiC creates no preselectors, so on a SONiC switch it prints nothing.

Hardware-validated

drivshell> fp show presel

FieldProcessor show wbcachesize

Print the size of the FP warm-boot cache. On chips that do not support it the shell prints Command not supported for this device. Read-only.

Trident 3 prints the not supported line.

Hardware-validated

drivshell> fp show wbcachesize
Command not supported for this device

FieldProcessor status

Shown in the built-in help, but the shell does not accept it and prints the usage instead. Use FieldProcessor group status.

Hardware-validated — prints the usage text

drivshell> fp status
Usage (FieldProcessor):  Where <cmd> is:
  action <add|get|remove> <eid> [act] [p0] [p1]
  action ports <add|get> <eid> <act> [<pbmp>]
  action mac <add|get> <eid> <act> [<mac>]
  action oam_stat <add|delete [all] |get [all]> <eid>
         object=<StatObj> mode=<mode_id> action=<action>
  aset <add|delete|show|clear> <gid> [action|action list]
  control <ctrl_num> [<status>]
  detach
  entry create <gid> [<eid>]
  entry copy <src_eid> [<dst_eid>]
  entry install|reinstall|remove|destroy <eid>
  entry enable|disable <eid>
  entry prio <eid> [highest|lowest|dontcare|default|<priority>]
  entry oper <eid> [backup|restore|cleanup]
  group create <pri> [<gid>] [mode] [pbmp|pipe0|pipe1|pipe2|pipe3] [size]
  group destroy|get|set <gid>
  group compress <gid>
  init
  list actions|qualifiers [stage]
  range create [<rid>] [<flags>] [<min>] [<max>]
  range group create [<rid>] [<flags>] [<min>] [<max>] [<group>]
  range get|destroy <rid>
  resync
  policer create PolId=<polcerid> mode=<mode> cbs=<cbs>
          cir=<cir> ebs=<ebs> eir=<eir> ColorBlind=<bool>
          ColorMergeOr=<bool> PacketBased=<bool>
  policer set PolId=<polcerid> mode=<mode> cbs=<cbs>
          cir=<cir> ebs=<ebs> eir=<eir> ColorBlind=<bool>
          ColorMergeOr=<bool> PacketBased=<bool>
...

FieldProcessor sanity

Run the FP software/hardware consistency check, on chips that support it. On other chips the shell prints the usage. What it checks and whether it repairs anything is not documented, so do not run it on a production switch.

Unvalidated

drivshell> fp sanity

Module control

FieldProcessor init

Re-initialise the FP. This deletes every group, entry, range, policer and counter, and clears the shell’s qualifier set.

Warning

On SONiC this removes all ACLs and CPU traps.

sonic-mgmt test suite files invoking bcmcmd (19 files) uses fp detach followed by fp init on test switches.

Unvalidated

drivshell> fp init

FieldProcessor detach

Shut the FP down. FP commands then fail until fp init.

Warning

On SONiC this removes all ACLs and CPU traps.

Unvalidated

drivshell> fp detach

FieldProcessor resync

Rebuild the SDK’s FP state from the hardware, as done after a warm boot. Changes SDK state.

Unvalidated

drivshell> fp resync

FieldProcessor control <control> [<status>]

Show an FP control value, or set it when <status> is given. <control> is a number or a control name. Shown as FP element=<name>: status=<n>. Read-only without <status>.

Unvalidated

drivshell> fp control 0

FieldProcessor list <actions | qualifiers | quals | user | users> [<stage>]

List the action or qualifier names a stage supports, or (user) the user-defined-field flags. <stage> is lookup (or vfp), ingress (ifp), egress (efp), external (ext), exactmatch (exa), class (cla), flowtracker (flo), amftfp or aeftfp. The default is the ingress stage. Read-only.

Hardware-validated

drivshell> fp list qualifiers ingress
------------------------ FP STAGE: ingress ----------------------
QUALIFIER            DATA                                     MASK
SrcIp6               Source IPv6 Address                      IPv6 Address mask
DstIp6               Destination IPv6 Address                 IPv6 Address mask
SrcIp6High           Top 64-bits of Source IPv6 Address       64-bits of IPv6 Address mask
DstIp6High           Top 64-bits of Destination IPv6 Address  64-bits of IPv6 Address mask
SrcIp6Low            Lower 64-bits of Source IPv6 Address     64-bits of IPv6 Address mask
DstIp6Low            Lower 64-bits of Destination IPv6 Address 64-bits of IPv6 Address mask
SrcIp                Source IPv4 Address                      IPv4 Address mask
DstIp                Destination IPv4 Address                 IPv4 Address
InPort               Single Input Port                        Port Mask
InPorts              Input Port Bitmap                        Port Bitmap Mask
Drop                 0 or 1                                   0 or 1
Ip6FlowLabel         20-bit IPv6 Flow Label                   20-bit mask
OuterVlan            Outer VLAN tag                           16-bit mask
OuterVlanId          Outer VLAN id                            12-bit mask
OuterVlanPri         Outer VLAN priority                      3-bit mask
OuterVlanCfi         Outer VLAN CFI                           1-bit mask
InnerVlan            Inner VLAN tag                           16-bit mask
InnerVlanId          Inner VLAN id                            12-bit mask
InnerVlanPri         Inner VLAN priority                      3-bit mask
InnerVlanCfi         Inner VLAN CFI                           1-bit mask
RangeCheck           Range ID                                 Normal=0, Invert=1
L4SrcPort            TCP/UDP Source port                      16-bit mask
L4DstPort            TCP/UDP Destination port                 16-bit mask
EtherType            Ethernet Type                            16-bit mask
IpProtocol           IPv6 Next Header                         8-bit mask
DSCP                 IPv6 Next Header                         8-bit mask
Ttl                  IPv6 Hop Limit                           8-bit mask
SrcTrunk             Source Trunk Group ID                    8-bit mask
...

Qualifier and action sets

FieldProcessor qset clear

Empty the shell’s qualifier set. Changes only the shell.

Hardware-validated

drivshell> fp qset clear

FieldProcessor qset add <qualifier> [<qualifier> …]

Add qualifiers to the shell’s qualifier set. qset add Data <qual_id> adds a user-defined data qualifier (see fp data create). Changes only the shell.

Hardware-validated

drivshell> fp qset add InPort
BCM_FIELD_QSET_ADD(InPort) okay

FieldProcessor qset set <qualifier-list>

Replace the shell’s qualifier set with a list. Write the list as one word with commas. Prints fp_qset_set(<list>) okay. Changes only the shell.

Hardware-validated

drivshell> fp qset set DstIp,SrcIp
fp_qset_set({SrcIp DstIp}) okay

FieldProcessor qset show

Print the shell’s qualifier set. Read-only.

Hardware-validated

drivshell> fp qset show
qset={InPort}

FieldProcessor aset add <gid> <action> [<action> …]

Add actions to a group’s action set and print the resulting set as fp_aset_add({…}) okay. A group created without an explicit action set already has the stage’s full default set (about 200 actions on the ingress stage), so the list is long. Changes the ASIC.

Hardware-validated

drivshell> fp aset add 100 Drop
fp_aset_add({CosQNew CosQCpuNew UcastCosQNew McastCosQNew PrioPktCopy PrioPktNew PrioPktTos PrioPktCancel PrioIntCopy PrioIntNew PrioIntTos PrioIntCancel DscpNew DscpCancel EcnNew CopyToCpu CopyToCpuCancel SwitchToCpuCancel SwitchToCpuReinstate TimeStampToCpu TimeStampToCpuCancel RedirectPort RedirectTrunk RedirectCancel RedirectPbmp RedirectIpmc RedirectMcast RedirectVlan RedirectBcastPbmp EgressMask EgressPortsAdd Drop DropCancel MirrorOverride MirrorIngress MirrorEgress L3Switch L3SwitchCancel DropPrecedence RpDrop RpDropCancel RpDropPrecedence RpCopyToCpu RpCopyToCpuCancel RpSwitchToCpuCancel RpSwitchToCpuReinstate RpTimeStampToCpu RpTimeStampToCpuCancel RpDscpNew RpDscpCancel RpEcnNew RpPrioPktCopy RpPrioPktNew RpPrioPktTos RpPrioPktCancel RpCosQNew RpUcastCosQNew RpMcastCosQNew RpPrioIntCopy RpPrioIntNew RpPrioIntTos RpPrioIntCancel YpDrop YpDropCancel YpDropPrecedence YpCopyToCpu YpCopyToCpuCancel YpSwitchToCpuCancel YpSwitchToCpuReinstate YpTimeStampToCpu YpTimeStampToCpuCancel YpDscpNew YpDscpCancel YpEcnNew YpPrioPktCopy YpPrioPktNew YpPrioPktTos YpPrioPktCancel YpCosQNew YpUcastCosQNew YpMcastCosQNew YpPrioIntCopy YpPrioIntNew YpPrioIntTos YpPrioIntCancel ColorIndependent GpDrop GpDropCancel GpDropPrecedence GpCopyToCpu GpCopyToCpuCancel GpSwitchToCpuCancel GpSwitchToCpuReinstate GpTimeStampToCpu GpTimeStampToCpuCancel GpDscpNew GpDscpCancel GpEcnNew GpTosPrecedenceNew GpTosPrecedenceCopy GpPrioPktCopy GpPrioPktNew GpPrioPktTos GpPrioPktCancel GpCosQNew GpUcastCosQNew GpMcastCosQNew GpPrioIntCopy GpPrioIntNew GpPrioIntTos GpPrioIntCancel DoNotChangeTtl DoNotCheckUrpf NewClassId MultipathHash FabricQueue DynamicHgTrunkCancel ServicePoolIdNew RedirectEgrNextHop EcmpLoadBalanceCancel EgressClassSelect HiGigClassSelect PolicerGroup StatGroup NatCancel Nat NatEgressOverride FibreChanVsanId FibreChanZoneCheckActionCancel FibreChanIntVsanPri IngSampleEnable UnmodifiedPacketRedirectPort PfcClassNew RpIntCongestionNotificationNew YpIntCongestionNotificationNew GpIntCongestionNotificationNew RecoverableDropCancel FabricEHAddOrUpdate Dot1pPreserve GpDot1pPreserve YpDot1pPreserve RpDot1pPreserve DscpPreserve GpDscpPreserve YpDscpPreserve RpDscpPreserve ChangeL2FieldsCancel BFDSessionIdNew CosMapNew GpCosMapNew YpCosMapNew RpCosMapNew ChangeL2Fields HgTrunkRandomRoundRobinHashCancel TrunkRandomRoundRobinHashCancel EcmpRandomRoundRobinHashCancel PacketTraceEnable UntaggedPacketPriorityNew DoNotCutThrough ServicePoolIdPrecedenceNew EgressTimeStampInsert IngressTimeStampInsert IngressTimeStampInsertCancel EgressTimeStampInsertCancel DynamicEcmpEnable Dgm DgmThreshold DgmBias DgmCost DynamicHgTrunkEnable TrunkResilientHashEnable TrunkResilientHashDisable EcmpResilientHashEnable EcmpResilientHashDisable HiGigTrunkResilientHashEnable HiGigTrunkResilientHashDisable IntEncapEnable IntTurnAround AddIngOuterVlanToEgrOuterVlan Erspan3HdrVlanCosPktCopy IntEncapUpdate LoopbackType NshEncapEnable NshServicePathId NshServiceIndex GbpClassifierAdd GbpSrcIdNew AssignOpaqueObject1 AssignOpaqueObject2 AssignOpaqueObject3 AssignOpaqueObject4 AssignExtractionCtrlId AssignEditCtrlId GbpSrcMacMcastBitSet GbpDstIdNew LoopbackSubtype EgressFlowControlEnable EgressFlowEncapEnable AssignNatClassId AssignChangeL2FieldsClassId EncapIfaMetadataHdr LoopbackCustomSubtype}) okay

FieldProcessor aset delete <gid> <action> [<action> …]

Remove actions from a group’s action set. Changes the ASIC.

Hardware-validated

drivshell> fp aset delete 100 Drop

FieldProcessor aset show <gid>

Print a group’s action set. Read-only.

Hardware-validated

drivshell> fp aset show 100
Gid 100. aset={CosQNew, CosQCpuNew, UcastCosQNew, McastCosQNew, PrioPktCopy, PrioPktNew, PrioPktTos, PrioPktCancel, PrioIntCopy, PrioIntNew, PrioIntTos, PrioIntCancel, DscpNew, DscpCancel, EcnNew, CopyToCpu, CopyToCpuCancel, SwitchToCpuCancel, SwitchToCpuReinstate, TimeStampToCpu, TimeStampToCpuCancel, RedirectPort, RedirectTrunk, RedirectCancel, RedirectPbmp, RedirectIpmc, RedirectMcast, RedirectVlan, RedirectBcastPbmp, EgressMask, EgressPortsAdd, Drop, DropCancel, MirrorOverride, MirrorIngress, MirrorEgress, L3Switch, L3SwitchCancel, DropPrecedence, RpDrop, RpDropCancel, RpDropPrecedence, RpCopyToCpu, RpCopyToCpuCancel, RpSwitchToCpuCancel, RpSwitchToCpuReinstate, RpTimeStampToCpu, RpTimeStampToCpuCancel, RpDscpNew, RpDscpCancel, RpEcnNew, RpPrioPktCopy, RpPrioPktNew, RpPrioPktTos, RpPrioPktCancel, RpCosQNew, RpUcastCosQNew, RpMcastCosQNew, RpPrioIntCopy, RpPrioIntNew, RpPrioIntTos, RpPrioIntCancel, YpDrop, YpDropCancel, YpDropPrecedence, YpCopyToCpu, YpCopyToCpuCancel, YpSwitchToCpuCancel, YpSwitchToCpuReinstate, YpTimeStampToCpu, YpTimeStampToCpuCancel, YpDscpNew, YpDscpCancel, YpEcnNew, YpPrioPktCopy, YpPrioPktNew, YpPrioPktTos, YpPrioPktCancel, YpCosQNew, YpUcastCosQNew, YpMcastCosQNew, YpPrioIntCopy, YpPrioIntNew, YpPrioIntTos, YpPrioIntCancel, ColorIndependent, GpDrop, GpDropCancel, GpDropPrecedence, GpCopyToCpu, GpCopyToCpuCancel, GpSwitchToCpuCancel, GpSwitchToCpuReinstate, GpTimeStampToCpu, GpTimeStampToCpuCancel, GpDscpNew, GpDscpCancel, GpEcnNew, GpTosPrecedenceNew, GpTosPrecedenceCopy, GpPrioPktCopy, GpPrioPktNew, GpPrioPktTos, GpPrioPktCancel, GpCosQNew, GpUcastCosQNew, GpMcastCosQNew, GpPrioIntCopy, GpPrioIntNew, GpPrioIntTos, GpPrioIntCancel, DoNotChangeTtl, DoNotCheckUrpf, NewClassId, MultipathHash, FabricQueue, DynamicHgTrunkCancel, ServicePoolIdNew, RedirectEgrNextHop, EcmpLoadBalanceCancel, EgressClassSelect, HiGigClassSelect, PolicerGroup, StatGroup, NatCancel, Nat, NatEgressOverride, FibreChanVsanId, FibreChanZoneCheckActionCancel, FibreChanIntVsanPri, IngSampleEnable, UnmodifiedPacketRedirectPort, PfcClassNew, RpIntCongestionNotificationNew, YpIntCongestionNotificationNew, GpIntCongestionNotificationNew, RecoverableDropCancel, FabricEHAddOrUpdate, Dot1pPreserve, GpDot1pPreserve, YpDot1pPreserve, RpDot1pPreserve, DscpPreserve, GpDscpPreserve, YpDscpPreserve, RpDscpPreserve, ChangeL2FieldsCancel, BFDSessionIdNew, CosMapNew, GpCosMapNew, YpCosMapNew, RpCosMapNew, ChangeL2Fields, HgTrunkRandomRoundRobinHashCancel, TrunkRandomRoundRobinHashCancel, EcmpRandomRoundRobinHashCancel, PacketTraceEnable, UntaggedPacketPriorityNew, DoNotCutThrough, ServicePoolIdPrecedenceNew, EgressTimeStampInsert, IngressTimeStampInsert, IngressTimeStampInsertCancel, EgressTimeStampInsertCancel, DynamicEcmpEnable, Dgm, DgmThreshold, DgmBias, DgmCost, DynamicHgTrunkEnable, TrunkResilientHashEnable, TrunkResilientHashDisable, EcmpResilientHashEnable, EcmpResilientHashDisable, HiGigTrunkResilientHashEnable, HiGigTrunkResilientHashDisable, IntEncapEnable, IntTurnAround, AddIngOuterVlanToEgrOuterVlan, Erspan3HdrVlanCosPktCopy, IntEncapUpdate, LoopbackType, NshEncapEnable, NshServicePathId, NshServiceIndex, GbpClassifierAdd, GbpSrcIdNew, AssignOpaqueObject1, AssignOpaqueObject2, AssignOpaqueObject3, AssignOpaqueObject4, AssignExtractionCtrlId, AssignEditCtrlId, GbpSrcMacMcastBitSet, GbpDstIdNew, LoopbackSubtype, EgressFlowControlEnable, EgressFlowEncapEnable, AssignNatClassId, AssignChangeL2FieldsClassId, EncapIfaMetadataHdr, LoopbackCustomSubtype}

FieldProcessor aset clear <gid>

Empty a group’s action set. Changes the ASIC.

On Trident 3 this fails for a group created with the default action set, as below: the SDK rejects the resulting action set for the group’s mode (New Aset size =80 cannotbe accomodated in this group mode) and the group keeps its old set.

Hardware-validated

drivshell> fp aset clear 100
0:_field_td3_field_group_aset_update: FP(unit 0) Error: New Aset size =80 cannotbe accomodated in this group mode.
FP(unit 0) Error: bcm_field_group_action_set() failed: Invalid parameter

Failed to execute the diagnostic command. Error: Operation failed.

Groups

FieldProcessor group create <pri> [<gid>] [<mode>] [<pbmp> | pipe0 | pipe1 | pipe2 | pipe3] [<size>]

Create a group from the shell’s qualifier set, with priority <pri> and optionally a fixed group ID, a group mode (number or name), and a port bitmap or pipe. The pipeN forms work only on chips with per-pipe FP. It prints nothing on success. Changes the ASIC.

Without a mode the SDK picks one; on Trident 3 a group with only DstIp became an ingress Double group across two slices, with 2304 entries. fp group get shows that the SDK adds Stage to the qualifier set.

Hardware-validated

drivshell> fp group create 10 100

FieldProcessor group destroy <gid>

Delete a group. It must be empty. Changes the ASIC.

Hardware-validated

drivshell> fp group destroy 100

FieldProcessor group get <gid>

Print a group’s qualifier set. Read-only.

Hardware-validated

drivshell> fp group get 100
qset={DstIp, Stage}

FieldProcessor group set <gid>

Replace a group’s qualifier set with the shell’s. Changes the ASIC.

Unvalidated

drivshell> fp group set 100

FieldProcessor group status <gid>

Print a group’s resource use as group_status={…}: priority range, total and free entries, counters and meters. The counter and meter numbers are for the whole stage, so they also count what SONiC uses. Read-only.

Hardware-validated

drivshell> fp group status 100
group_status={    prio_min=-2147483647,           prio_max=2147483647,            entries_total=2304,     entries_free=2304,
          counters_total=83968,   counters_free=57856,    meters_total=6144,      meters_free=5376}

FieldProcessor group mode <gid>

Print a group’s mode (single, double, intra-slice …) as group mode=<mode>. Read-only.

Hardware-validated

drivshell> fp group mode 100
group mode=Double

FieldProcessor group lookup <gid> [enable | disable]

Show whether the group is active. enable and disable switch the whole group on or off in hardware, which changes the ASIC.

Hardware-validated

drivshell> fp group lookup 100
GID 100: lookup=Enabled

FieldProcessor group compress <gid>

Repack the group’s entries into fewer TCAM slices. Changes the ASIC.

Unvalidated

drivshell> fp group compress 100

Entries

FieldProcessor entry create <gid> [<eid>]

Create an entry in a group, with an automatic or a given ID. Changes SDK state; the entry reaches hardware with entry install.

Hardware-validated

drivshell> fp entry create 100 1000

FieldProcessor entry copy <src_eid> [<dst_eid>]

Duplicate an entry. Changes SDK state.

Hardware-validated

drivshell> fp entry copy 1000 1001

FieldProcessor entry install <eid>

Write an entry to hardware. Changes the ASIC.

Hardware-validated

drivshell> fp entry install 1000

FieldProcessor entry reinstall <eid>

Rewrite an installed entry after changing its qualifiers or actions. Changes the ASIC.

Hardware-validated

drivshell> fp entry reinstall 1000

FieldProcessor entry remove <eid>

Take an entry out of hardware but keep it in the SDK. Changes the ASIC.

Hardware-validated

drivshell> fp entry remove 1000

FieldProcessor entry destroy [<eid>]

Delete one entry. The built-in help shows the ID as required, but without it the shell deletes every entry on the unit.

Warning

fp entry destroy without an ID removes all SONiC ACL rules and CPU traps.

Hardware-validated

drivshell> fp entry destroy 1000

FieldProcessor entry enable <eid>

Enable an installed entry. Changes the ASIC.

Hardware-validated

drivshell> fp entry enable 1000

FieldProcessor entry disable <eid>

Disable an entry without removing it. Changes the ASIC.

Hardware-validated

drivshell> fp entry disable 1000

FieldProcessor entry prio <eid> [highest | lowest | dontcare | default | <priority>]

Show an entry’s priority as FP entry=<eid>: prio=<n>, or set it when a value is given. A new entry has priority 0. Read-only without a value.

Hardware-validated

drivshell> fp entry prio 1000
FP entry=1000: prio=0

FieldProcessor entry oper <eid> <backup | restore | cleanup>

Save an entry’s state, restore the saved state, or drop the saved copy. The built-in help shows the operation as optional, but it is required. Changes SDK and ASIC state.

Unvalidated

drivshell> fp entry oper 1000 backup

FieldProcessor install <eid>

Old form of FieldProcessor entry install. Changes the ASIC.

Hardware-validated

drivshell> fp install 1000

Qualifiers and actions

FieldProcessor qual <eid> <QUAL> [<udf_id> | <data_qual_id>] <data> <mask>

Set a qualifier of an entry. The format of data and mask depends on the qualifier: IP addresses and masks, MAC addresses, port bitmaps (InPorts), numbers, or names for enumerated qualifiers (IpType, L2Format, Color …). Other forms:

qual <eid> <QUAL> ? (or show) prints the table of all qualifiers of all stages (FP STAGE: All, about 1700 lines) with the data and mask format of each; find the line of your qualifier in it. Read-only.
qual <eid> delete <QUAL> removes one qualifier from the entry.
qual <eid> clear removes all of them.

Reinstall the entry for a change to reach hardware.

Hardware-validated — Ask for the argument format, then set it

drivshell> fp qual 1000 DstIp ?
------------------------ FP STAGE: All ----------------------
QUALIFIER            DATA                                     MASK
SrcIp6               Source IPv6 Address                      IPv6 Address mask
DstIp6               Destination IPv6 Address                 IPv6 Address mask
SrcIp6High           Top 64-bits of Source IPv6 Address       64-bits of IPv6 Address mask
DstIp6High           Top 64-bits of Destination IPv6 Address  64-bits of IPv6 Address mask
SrcIp6Low            Lower 64-bits of Source IPv6 Address     64-bits of IPv6 Address mask
DstIp6Low            Lower 64-bits of Destination IPv6 Address 64-bits of IPv6 Address mask
Snap                 n/a                                      n/a
SrcIp                Source IPv4 Address                      IPv4 Address mask
DstIp                Destination IPv4 Address                 IPv4 Address
Llc                  n/a                                      n/a
InPort               Single Input Port                        Port Mask
InPorts              Input Port Bitmap                        Port Bitmap Mask
OutPorts             Output Port Bitmap                       Port Bitmap Mask
Drop                 0 or 1                                   0 or 1
Ip6FlowLabel         20-bit IPv6 Flow Label                   20-bit mask
OuterVlan            Outer VLAN tag                           16-bit mask
OuterVlanId          Outer VLAN id                            12-bit mask
OuterVlanPri         Outer VLAN priority                      3-bit mask
OuterVlanCfi         Outer VLAN CFI                           1-bit mask
InnerVlan            Inner VLAN tag                           16-bit mask
InnerVlanId          Inner VLAN id                            12-bit mask
InnerVlanPri         Inner VLAN priority                      3-bit mask
InnerVlanCfi         Inner VLAN CFI                           1-bit mask
RangeCheck           Range ID                                 Normal=0, Invert=1
L4SrcPort            TCP/UDP Source port                      16-bit mask
L4DstPort            TCP/UDP Destination port                 16-bit mask
EtherType            Ethernet Type                            16-bit mask
IpProtocol           IPv6 Next Header                         8-bit mask
...
drivshell> fp qual 1000 DstIp 192.0.2.1 255.255.255.255

FieldProcessor action add <eid> <action> [<p0>] [<p1>]

Add an action to an entry. <action> is a name or number, and p0/p1 are its parameters, for example a CPU queue or a destination port. Reinstall the entry for it to take effect.

Actions that take parameters need them on the command line: Drop works alone, but CopyToCpu without p0 and p1 only prints the usage, as in the first example below. The second example gives both.

Hardware-validated

drivshell> fp action add 1000 CopyToCpu
Usage (FieldProcessor):  Where <cmd> is:
  action <add|get|remove> <eid> [act] [p0] [p1]
  action ports <add|get> <eid> <act> [<pbmp>]
  action mac <add|get> <eid> <act> [<mac>]
  action oam_stat <add|delete [all] |get [all]> <eid>
         object=<StatObj> mode=<mode_id> action=<action>
  aset <add|delete|show|clear> <gid> [action|action list]
  control <ctrl_num> [<status>]
  detach
  entry create <gid> [<eid>]
  entry copy <src_eid> [<dst_eid>]
  entry install|reinstall|remove|destroy <eid>
  entry enable|disable <eid>
  entry prio <eid> [highest|lowest|dontcare|default|<priority>]
  entry oper <eid> [backup|restore|cleanup]
  group create <pri> [<gid>] [mode] [pbmp|pipe0|pipe1|pipe2|pipe3] [size]
  group destroy|get|set <gid>
  group compress <gid>
  init
  list actions|qualifiers [stage]
  range create [<rid>] [<flags>] [<min>] [<max>]
  range group create [<rid>] [<flags>] [<min>] [<max>] [<group>]
  range get|destroy <rid>
  resync
  policer create PolId=<polcerid> mode=<mode> cbs=<cbs>
          cir=<cir> ebs=<ebs> eir=<eir> ColorBlind=<bool>
          ColorMergeOr=<bool> PacketBased=<bool>
  policer set PolId=<polcerid> mode=<mode> cbs=<cbs>
          cir=<cir> ebs=<ebs> eir=<eir> ColorBlind=<bool>
          ColorMergeOr=<bool> PacketBased=<bool>
...

Hardware-validated — With its parameters

drivshell> fp action add 1000 CopyToCpu 0 0

FieldProcessor action get <eid> <action>

Print an action’s parameters as FP action get: action=<name>, p0=<n>, p1=<n>. Read-only. If the entry does not have that action (here, because the action add above failed), the shell prints Entry not found.

On a SONiC switch you can read the actions of SONiC’s own entries; take an entry ID and action name from fp show.

Hardware-validated

drivshell> fp action get 1000 CopyToCpu
FP(unit 0) Error: bcm_field_action_get() failed: Entry not found

Failed to execute the diagnostic command. Error: Operation failed.

Hardware-validated — An action of a SONiC CoPP entry

drivshell> fp action get 9 CosQCpuNew
FP action get: action=CosQCpuNew, p0=0, p1=0

FieldProcessor action remove <eid> [<action>]

Remove one action, or all actions if none is named. Changes SDK state.

Hardware-validated

drivshell> fp action remove 1000 CopyToCpu
FP(unit 0) Error: bcm_field_action_remove() failed: Entry not found

Failed to execute the diagnostic command. Error: Operation failed.

FieldProcessor action ports <add | get> <eid> <action> [<pbmp>]

Add or show an action that takes a port bitmap, such as RedirectPbmp. add changes SDK state. The example below names an entry that does not exist, so it fails with Entry not found.

Hardware-validated

drivshell> fp action ports get 1000 RedirectPbmp
FP(unit 0) Error: bcm_field_action_ports_get() failed: Entry not found

Failed to execute the diagnostic command. Error: Operation failed.

FieldProcessor action mac <add | get> <eid> <action> [<mac>]

Add or show an action that takes a MAC address, such as SrcMacNew. get prints FP action mac get: action=<name>, mac=<mac>. add changes SDK state. The example below names an entry that does not exist, so it fails with Entry not found.

Hardware-validated

drivshell> fp action mac get 1000 SrcMacNew
FP(unit 0) Error: bcm_field_action_mac_get() failed: Entry not found

Failed to execute the diagnostic command. Error: Operation failed.

FieldProcessor action oam_stat <add | delete [all] | get [all]> <eid> [object=<StatObj>] [mode=<mode_id>] [action=<action>]

Manage OAM statistics actions on an entry. Trident 3 does not support them: get fails with Feature unavailable. add and delete change SDK state.

Hardware-validated

drivshell> fp action oam_stat get all 1000
FP(unit 0) Error: bcm_field_oam_stat_action_get() failed: Feature unavailable

Failed to execute the diagnostic command. Error: Operation failed.

Ranges

FieldProcessor range create [<rid>] [<flags>] [<min>] [<max>]

Create a range checker (for example an L4 port range) for the RangeCheck qualifier. Prints RID <n> created!. Changes the ASIC. On SONiC, range 1 is already in use; pick another ID.

Hardware-validated

drivshell> fp range create 100 0x2 1024 2047

FieldProcessor range group create [<rid>] [<flags>] [<min>] [<max>] [<group>]

Create a range checker that belongs to one group. Changes the ASIC.

Unvalidated

drivshell> fp range group create 101 0x2 1024 2047 100

FieldProcessor range get <rid>

Print a range’s bounds and flags as FP range get: rid=<n>, min=<n> max=<n> flags=<hex> <flag names>. Read-only. On a SONiC switch range 1 is SONiC’s source-port range.

Hardware-validated

drivshell> fp range get 1
FP range get: rid=1, min=34048 max=35072 flags=0x1 SRCPORT

FieldProcessor range destroy <rid>

Delete a range checker. Changes the ASIC. Do not delete range 1 on a SONiC switch; it is SONiC’s.

Hardware-validated

drivshell> fp range destroy 100

Policers

FieldProcessor policer create PolId=<id> Mode=<mode> [cbs=<kbits>] [cir=<kbps>] [ebs=<kbits>] [eir=<kbps>] [ColorBlind=<0|1>] [ColorMergeOr=<0|1>] [PacketBased=<0|1>] [PoolId=<id>] [PoolIdGiven=<0|1>]

Create a policer. Mode is SrTcm, TrTcm, TrTcmDs, Committed, Green, PassThrough and similar. The help shows ColorBlind, ColorMergeOr and PacketBased as booleans, but they take 0 or 1. The shell also accepts PoolId and PoolIdGiven, which the help does not show. Changes the ASIC.

Unvalidated

drivshell> fp policer create PolId=1 mode=SrTcm cir=10000 cbs=512 eir=0 ebs=512

FieldProcessor policer set PolId=<id> Mode=<mode> [cbs=<kbits>] [cir=<kbps>] [ebs=<kbits>] [eir=<kbps>] [ColorBlind=<0|1>] [ColorMergeOr=<0|1>] [PacketBased=<0|1>]

Change an existing policer. The parameters are the same as for create. Changes the ASIC.

Unvalidated

drivshell> fp policer set PolId=1 mode=SrTcm cir=20000 cbs=512

FieldProcessor policer destroy <all | PolId=<id>>

Delete one policer, or every policer on the unit.

Warning

all also deletes the policers SONiC uses for CoPP and ACLs.

Unvalidated

drivshell> fp policer destroy PolId=1

FieldProcessor policer attach entry=<eid> level=<level> PolId=<id>

Attach a policer to an entry at level 0 or 1. Changes the ASIC.

Unvalidated

drivshell> fp policer attach entry=1000 level=0 PolId=1

FieldProcessor policer detach entry=<eid> level=<level>

Detach the policer at that level from an entry. Changes the ASIC.

Unvalidated

drivshell> fp policer detach entry=1000 level=0

Counters

FieldProcessor stat create group=<gid> type0=<stat_type> [type1=<stat_type> …]

Create a counter object for a group, with the listed counter types: Packets, Bytes, GreenPackets, RedBytes and so on. stat attach uses the last one created by default. Changes the ASIC.

Unvalidated

drivshell> fp stat create group=100 type0=Packets type1=Bytes

FieldProcessor stat destroy StatId=<id>

Delete a counter object. Changes the ASIC.

Unvalidated

drivshell> fp stat destroy StatId=1

FieldProcessor stat attach entry=<eid> [StatId=<id>]

Attach a counter object to an entry. The default is the last one created in this shell. Changes the ASIC.

Unvalidated

drivshell> fp stat attach entry=1000 StatId=1

FieldProcessor stat detach entry=<eid> StatId=<id>

Detach a counter object from an entry. Changes the ASIC.

Unvalidated

drivshell> fp stat detach entry=1000 StatId=1

FieldProcessor stat set StatId=<id> type=<stat_type> val=<value>

Set a counter to a value. This also changes ACL counters that SONiC reports.

Unvalidated

drivshell> fp stat set StatId=1 type=Packets val=0

FieldProcessor stat get StatId=<id> type=<stat_type>

Print one counter as <type>, value is: 0x<value>. Read-only. The counter IDs on the switch are listed in fp show as statistics={stat id <n> …} together with the counter types they hold. An ID that does not exist fails with Entry not found, as in the first example.

Hardware-validated

drivshell> fp stat get statid=93 type=packets
FP(unit 0) Error: bcm_field_stat_get() failed: Entry not found

Failed to execute the diagnostic command. Error: Operation failed.

Hardware-validated — A counter that exists on a SONiC switch

drivshell> fp stat get StatId=1 type=Packets
The value is: 0x000000000

User-defined data qualifiers

FieldProcessor data create OffsetBase=<offset_base> offset=<offset> length=<length>

Create a data qualifier that matches length bytes at offset from a base: PacketStart, OuterL3Header, InnerL3Header, OuterL4Header, InnerL4Header, HigigHeader or Higig2Header. Use it with qset add Data <qual_id> and qual <eid> Data …. Changes the ASIC.

Unvalidated

drivshell> fp data create OffsetBase=PacketStart offset=12 length=2

FieldProcessor data destroy <all | QualId=<qual_id>>

Delete one or all data qualifiers. Changes the ASIC.

Unvalidated

drivshell> fp data destroy QualId=1

FieldProcessor data format <add | delete> QualId=<qual_id> RelativeOffset=<offset> [L2=<l2>] [VlanTag=<tag_format>] [OuterIp=<outer_ip>] [InnerIp=<inner_ip>] [Tunnel=<tunnel>] [mpls=<mpls>] [Higig=<higig>] [Vntag=<vntag>] [Cntag=<cntag>] [Etag=<etag>] [Icnm=<icnm>]

Add or remove a packet format for which a data qualifier applies, for example L2=Ethernet2 VlanTag=SingleTagged OuterIp=Ip4. Changes the ASIC.

Unvalidated

drivshell> fp data format add QualId=1 RelativeOffset=0 L2=Ethernet2 VlanTag=SingleTagged OuterIp=Ip4

FieldProcessor data ethertype <add | delete> QualId=<qual_id> RelativeOffset=<offset> etype=<ethertype> [VlanTag=<tag_format>] [L2=<l2>] [Higig=<higig>] [Vntag=<vntag>] [Cntag=<cntag>] [Etag=<etag>] [Icnm=<icnm>]

Add or remove an EtherType after which a data qualifier applies. Changes the ASIC.

Unvalidated

drivshell> fp data ethertype add QualId=1 RelativeOffset=0 etype=0x88cc

FieldProcessor data ipproto <add | delete> QualId=<qual_id> RelativeOffset=<offset> protocol=<protocol> [VlanTag=<tag_format>] [L2=<l2>] [IpVer=<ip_version>]

Add or remove an IP protocol after which a data qualifier applies. Changes the ASIC.

Unvalidated

drivshell> fp data ipproto add QualId=1 RelativeOffset=0 protocol=17

Built-in help

Where <cmd> is:
   action <add|get|remove> <eid> [act] [p0] [p1]
   action ports <add|get> <eid> <act> [<pbmp>]
   action mac <add|get> <eid> <act> [<mac>]
   action oam_stat <add|delete [all] |get [all]> <eid>
          object=<StatObj> mode=<mode_id> action=<action>
   aset <add|delete|show|clear> <gid> [action|action list]
   control <ctrl_num> [<status>]
   detach
   entry create <gid> [<eid>]
   entry copy <src_eid> [<dst_eid>]
   entry install|reinstall|remove|destroy <eid>
   entry enable|disable <eid>
   entry prio <eid> [highest|lowest|dontcare|default|<priority>]
   entry oper <eid> [backup|restore|cleanup]
   group create <pri> [<gid>] [mode] [pbmp|pipe0|pipe1|pipe2|pipe3] [size]
   group destroy|get|set <gid>
   group compress <gid>
   init
   list actions|qualifiers [stage]
   range create [<rid>] [<flags>] [<min>] [<max>]
   range group create [<rid>] [<flags>] [<min>] [<max>] [<group>]
   range get|destroy <rid>
   resync
   policer create PolId=<polcerid> mode=<mode> cbs=<cbs>
           cir=<cir> ebs=<ebs> eir=<eir> ColorBlind=<bool>
           ColorMergeOr=<bool> PacketBased=<bool>
   policer set PolId=<polcerid> mode=<mode> cbs=<cbs>
           cir=<cir> ebs=<ebs> eir=<eir> ColorBlind=<bool>
           ColorMergeOr=<bool> PacketBased=<bool>
   policer destroy [all] or PolId=<polcerid>]
   policer attach entry=<eid> level=<level> PolId=<polcerid>
   policer detach entry=<eid> level=<level>
   stat create group=<group> type0=<stat_type0> type1=<stat_type1>
           type2=<stat_type2> typeX=<stat_typeX>
   stat destroy StatId=<statid>
   stat attach entry=<eid> [StatId=<statid>]*
            (*if not specified, last created StatId is used)
   stat detach entry=<eid> StatId=<statid>
   stat set StatId=<statid> type=<stat_type> val=<value>
   stat get StatId=<statid> type=<stat_type>
   data create OffsetBase=<offset_base> offset=<offset> length=<length>
   data destroy [all] or QualId=<qualid>
   data format add QualId=<qualid> RelativeOffset=<relative_offset>
        L2=<l2> VlanTag=<tag_format> OuterIp=<outer_ip> InnerIp=<inner_ip>
        Tunnel=<tunnel> mpls=<mpls> Higig=<higig> Vntag=<vntag>
        Cntag=<cntag> Etag=<etag> Icnm=<icnm>
   data format delete QualId=<qualid> RelativeOffset=<relative_offset>
        L2=<l2> VlanTag=<tag_format> OuterIp=<outer_ip> InnerIp=<inner_ip>
        Tunnel=<tunnel> mpls=<mpls> Higig=<higig> Vntag=<vntag>
        Cntag=<cntag> Etag=<etag> Icnm=<icnm>
   data ethertype add QualId=<qualid> RelativeOffset=<relative_offset>
        etype=<ethertype> VlanTag=<tag_format> L2=<l2> Higig=<higig>
        Vntag=<vntag> Cntag=<cntag> Etag=<etag> Icnm=<icnm>
   data ethertype delete QualId=<qualid> RelativeOffset=<relative_offset>
        etype=<ethertype> VlanTag=<tag_format> L2=<l2> Higig=<higig>
        Vntag=<vntag> Cntag=<cntag> Etag=<etag> Icnm=<icnm>
   data ipproto add QualId=<qualid> RelativeOffset=<relative_offset>
        protocol=<protocol> VlanTag=<tag_format> L2=<l2> IpVer=<ip_version>
   data ipproto delete QualId=<qualid> RelativeOffset=<relative_offset>
        protocol=<protocol> VlanTag=<tag_format> L2=<l2> IpVer=<ip_version>
   qual <eid> <QUAL> [<udf_id*>/<data_qual_id>] data mask
           (*required for QUAL=UserDefined or Data)
   qual <eid> delete <QUAL>
   qual <eid> clear
   qset add|clear|set|show [qualifier|qualifier list]
   show [class] [group|entry] [id] [brief]
   status
   sanity