1177 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03 4# This test is for checking the A-TCAM and C-TCAM operation in Spectrum-2.5# It tries to exercise as many code paths in the eRP state machine as6# possible.7 8lib_dir=$(dirname $0)/../../../../net/forwarding9 10ALL_TESTS="single_mask_test identical_filters_test two_masks_test \11 multiple_masks_test ctcam_edge_cases_test delta_simple_test \12 delta_two_masks_one_key_test delta_simple_rehash_test \13 bloom_simple_test bloom_complex_test bloom_delta_test \14 max_erp_entries_test max_group_size_test collision_test"15NUM_NETIFS=216source $lib_dir/lib.sh17source $lib_dir/tc_common.sh18source $lib_dir/devlink_lib.sh19 20tcflags="skip_hw"21 22h1_create()23{24 simple_if_init $h1 192.0.2.1/24 198.51.100.1/2425}26 27h1_destroy()28{29 simple_if_fini $h1 192.0.2.1/24 198.51.100.1/2430}31 32h2_create()33{34 simple_if_init $h2 192.0.2.2/24 198.51.100.2/2435 tc qdisc add dev $h2 clsact36}37 38h2_destroy()39{40 tc qdisc del dev $h2 clsact41 simple_if_fini $h2 192.0.2.2/24 198.51.100.2/2442}43 44tp_record()45{46 local tracepoint=$147 local cmd=$248 49 perf record -q -e $tracepoint $cmd50 return $?51}52 53tp_record_all()54{55 local tracepoint=$156 local seconds=$257 58 perf record -a -q -e $tracepoint sleep $seconds59 return $?60}61 62__tp_hit_count()63{64 local tracepoint=$165 66 local perf_output=`perf script -F trace:event,trace`67 return `echo $perf_output | grep "$tracepoint:" | wc -l`68}69 70tp_check_hits()71{72 local tracepoint=$173 local count=$274 75 __tp_hit_count $tracepoint76 if [[ "$?" -ne "$count" ]]; then77 return 178 fi79 return 080}81 82tp_check_hits_any()83{84 local tracepoint=$185 86 __tp_hit_count $tracepoint87 if [[ "$?" -eq "0" ]]; then88 return 189 fi90 return 091}92 93single_mask_test()94{95 # When only a single mask is required, the device uses the master96 # mask and not the eRP table. Verify that under this mode the right97 # filter is matched98 99 RET=0100 101 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \102 $tcflags dst_ip 192.0.2.2 action drop103 104 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \105 -t ip -q106 107 tc_check_packets "dev $h2 ingress" 101 1108 check_err $? "Single filter - did not match"109 110 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \111 $tcflags dst_ip 198.51.100.2 action drop112 113 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \114 -t ip -q115 116 tc_check_packets "dev $h2 ingress" 101 2117 check_err $? "Two filters - did not match highest priority"118 119 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \120 -t ip -q121 122 tc_check_packets "dev $h2 ingress" 102 1123 check_err $? "Two filters - did not match lowest priority"124 125 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower126 127 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \128 -t ip -q129 130 tc_check_packets "dev $h2 ingress" 102 2131 check_err $? "Single filter - did not match after delete"132 133 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower134 135 log_test "single mask test ($tcflags)"136}137 138identical_filters_test()139{140 # When two filters that only differ in their priority are used,141 # one needs to be inserted into the C-TCAM. This test verifies142 # that filters are correctly spilled to C-TCAM and that the right143 # filter is matched144 145 RET=0146 147 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \148 $tcflags dst_ip 192.0.2.2 action drop149 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \150 $tcflags dst_ip 192.0.2.2 action drop151 152 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \153 -t ip -q154 155 tc_check_packets "dev $h2 ingress" 101 1156 check_err $? "Did not match A-TCAM filter"157 158 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower159 160 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \161 -t ip -q162 163 tc_check_packets "dev $h2 ingress" 102 1164 check_err $? "Did not match C-TCAM filter after A-TCAM delete"165 166 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \167 $tcflags dst_ip 192.0.2.2 action drop168 169 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \170 -t ip -q171 172 tc_check_packets "dev $h2 ingress" 102 2173 check_err $? "Did not match C-TCAM filter after A-TCAM add"174 175 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower176 177 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \178 -t ip -q179 180 tc_check_packets "dev $h2 ingress" 103 1181 check_err $? "Did not match A-TCAM filter after C-TCAM delete"182 183 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower184 185 log_test "identical filters test ($tcflags)"186}187 188two_masks_test()189{190 # When more than one mask is required, the eRP table is used. This191 # test verifies that the eRP table is correctly allocated and used192 193 RET=0194 195 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \196 $tcflags dst_ip 192.0.2.2 action drop197 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \198 $tcflags dst_ip 192.0.0.0/8 action drop199 200 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \201 -t ip -q202 203 tc_check_packets "dev $h2 ingress" 101 1204 check_err $? "Two filters - did not match highest priority"205 206 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower207 208 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \209 -t ip -q210 211 tc_check_packets "dev $h2 ingress" 103 1212 check_err $? "Single filter - did not match"213 214 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \215 $tcflags dst_ip 192.0.2.0/24 action drop216 217 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \218 -t ip -q219 220 tc_check_packets "dev $h2 ingress" 102 1221 check_err $? "Two filters - did not match highest priority after add"222 223 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower224 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower225 226 log_test "two masks test ($tcflags)"227}228 229multiple_masks_test()230{231 # The number of masks in a region is limited. Once the maximum232 # number of masks has been reached filters that require new233 # masks are spilled to the C-TCAM. This test verifies that234 # spillage is performed correctly and that the right filter is235 # matched236 237 if [[ "$tcflags" != "skip_sw" ]]; then238 return 0;239 fi240 241 local index242 243 RET=0244 245 NUM_MASKS=32246 NUM_ERPS=16247 BASE_INDEX=100248 249 for i in $(eval echo {1..$NUM_MASKS}); do250 index=$((BASE_INDEX - i))251 252 if ((i > NUM_ERPS)); then253 exp_hits=1254 err_msg="$i filters - C-TCAM spill did not happen when it was expected"255 else256 exp_hits=0257 err_msg="$i filters - C-TCAM spill happened when it should not"258 fi259 260 tp_record "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" \261 "tc filter add dev $h2 ingress protocol ip pref $index \262 handle $index \263 flower $tcflags \264 dst_ip 192.0.2.2/${i} src_ip 192.0.2.1/${i} \265 action drop"266 tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" \267 $exp_hits268 check_err $? "$err_msg"269 270 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 \271 -B 192.0.2.2 -t ip -q272 273 tc_check_packets "dev $h2 ingress" $index 1274 check_err $? "$i filters - did not match highest priority (add)"275 done276 277 for i in $(eval echo {$NUM_MASKS..1}); do278 index=$((BASE_INDEX - i))279 280 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 \281 -B 192.0.2.2 -t ip -q282 283 tc_check_packets "dev $h2 ingress" $index 2284 check_err $? "$i filters - did not match highest priority (del)"285 286 tc filter del dev $h2 ingress protocol ip pref $index \287 handle $index flower288 done289 290 log_test "multiple masks test ($tcflags)"291}292 293ctcam_two_atcam_masks_test()294{295 RET=0296 297 # First case: C-TCAM is disabled when there are two A-TCAM masks.298 # We push a filter into the C-TCAM by using two identical filters299 # as in identical_filters_test()300 301 # Filter goes into A-TCAM302 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \303 $tcflags dst_ip 192.0.2.2 action drop304 # Filter goes into C-TCAM305 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \306 $tcflags dst_ip 192.0.2.2 action drop307 # Filter goes into A-TCAM308 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \309 $tcflags dst_ip 192.0.0.0/16 action drop310 311 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \312 -t ip -q313 314 tc_check_packets "dev $h2 ingress" 101 1315 check_err $? "Did not match A-TCAM filter"316 317 # Delete both A-TCAM and C-TCAM filters and make sure the remaining318 # A-TCAM filter still works319 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower320 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower321 322 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \323 -t ip -q324 325 tc_check_packets "dev $h2 ingress" 103 1326 check_err $? "Did not match A-TCAM filter"327 328 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower329 330 log_test "ctcam with two atcam masks test ($tcflags)"331}332 333ctcam_one_atcam_mask_test()334{335 RET=0336 337 # Second case: C-TCAM is disabled when there is one A-TCAM mask.338 # The test is similar to identical_filters_test()339 340 # Filter goes into A-TCAM341 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \342 $tcflags dst_ip 192.0.2.2 action drop343 # Filter goes into C-TCAM344 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \345 $tcflags dst_ip 192.0.2.2 action drop346 347 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \348 -t ip -q349 350 tc_check_packets "dev $h2 ingress" 101 1351 check_err $? "Did not match C-TCAM filter"352 353 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower354 355 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \356 -t ip -q357 358 tc_check_packets "dev $h2 ingress" 102 1359 check_err $? "Did not match A-TCAM filter"360 361 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower362 363 log_test "ctcam with one atcam mask test ($tcflags)"364}365 366ctcam_no_atcam_masks_test()367{368 RET=0369 370 # Third case: C-TCAM is disabled when there are no A-TCAM masks371 # This test exercises the code path that transitions the eRP table372 # to its initial state after deleting the last C-TCAM mask373 374 # Filter goes into A-TCAM375 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \376 $tcflags dst_ip 192.0.2.2 action drop377 # Filter goes into C-TCAM378 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \379 $tcflags dst_ip 192.0.2.2 action drop380 381 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower382 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower383 384 log_test "ctcam with no atcam masks test ($tcflags)"385}386 387ctcam_edge_cases_test()388{389 # When the C-TCAM is disabled after deleting the last C-TCAM390 # mask, we want to make sure the eRP state machine is put in391 # the correct state392 393 ctcam_two_atcam_masks_test394 ctcam_one_atcam_mask_test395 ctcam_no_atcam_masks_test396}397 398delta_simple_test()399{400 # The first filter will create eRP, the second filter will fit into401 # the first eRP with delta. Remove the first rule then and check that402 # the eRP stays (referenced by the second filter).403 404 RET=0405 406 if [[ "$tcflags" != "skip_sw" ]]; then407 return 0;408 fi409 410 tp_record "objagg:*" "tc filter add dev $h2 ingress protocol ip \411 pref 1 handle 101 flower $tcflags dst_ip 192.0.0.0/24 \412 action drop"413 tp_check_hits "objagg:objagg_obj_root_create" 1414 check_err $? "eRP was not created"415 416 tp_record "objagg:*" "tc filter add dev $h2 ingress protocol ip \417 pref 2 handle 102 flower $tcflags dst_ip 192.0.2.2 \418 action drop"419 tp_check_hits "objagg:objagg_obj_root_create" 0420 check_err $? "eRP was incorrectly created"421 tp_check_hits "objagg:objagg_obj_parent_assign" 1422 check_err $? "delta was not created"423 424 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \425 -t ip -q426 427 tc_check_packets "dev $h2 ingress" 101 1428 check_fail $? "Matched a wrong filter"429 430 tc_check_packets "dev $h2 ingress" 102 1431 check_err $? "Did not match on correct filter"432 433 tp_record "objagg:*" "tc filter del dev $h2 ingress protocol ip \434 pref 1 handle 101 flower"435 tp_check_hits "objagg:objagg_obj_root_destroy" 0436 check_err $? "eRP was incorrectly destroyed"437 tp_check_hits "objagg:objagg_obj_parent_unassign" 0438 check_err $? "delta was incorrectly destroyed"439 440 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \441 -t ip -q442 443 tc_check_packets "dev $h2 ingress" 102 2444 check_err $? "Did not match on correct filter after the first was removed"445 446 tp_record "objagg:*" "tc filter del dev $h2 ingress protocol ip \447 pref 2 handle 102 flower"448 tp_check_hits "objagg:objagg_obj_parent_unassign" 1449 check_err $? "delta was not destroyed"450 tp_check_hits "objagg:objagg_obj_root_destroy" 1451 check_err $? "eRP was not destroyed"452 453 log_test "delta simple test ($tcflags)"454}455 456delta_two_masks_one_key_test()457{458 # If 2 keys are the same and only differ in mask in a way that459 # they belong under the same ERP (second is delta of the first),460 # there should be C-TCAM spill.461 462 RET=0463 464 if [[ "$tcflags" != "skip_sw" ]]; then465 return 0;466 fi467 468 tp_record "mlxsw:*" "tc filter add dev $h2 ingress protocol ip \469 pref 1 handle 101 flower $tcflags dst_ip 192.0.2.0/24 \470 action drop"471 tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 0472 check_err $? "incorrect C-TCAM spill while inserting the first rule"473 474 tp_record "mlxsw:*" "tc filter add dev $h2 ingress protocol ip \475 pref 2 handle 102 flower $tcflags dst_ip 192.0.2.2 \476 action drop"477 tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 1478 check_err $? "C-TCAM spill did not happen while inserting the second rule"479 480 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \481 -t ip -q482 483 tc_check_packets "dev $h2 ingress" 101 1484 check_err $? "Did not match on correct filter"485 486 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower487 488 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \489 -t ip -q490 491 tc_check_packets "dev $h2 ingress" 102 1492 check_err $? "Did not match on correct filter"493 494 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower495 496 log_test "delta two masks one key test ($tcflags)"497}498 499delta_simple_rehash_test()500{501 RET=0502 503 if [[ "$tcflags" != "skip_sw" ]]; then504 return 0;505 fi506 507 devlink dev param set $DEVLINK_DEV \508 name acl_region_rehash_interval cmode runtime value 0509 check_err $? "Failed to set ACL region rehash interval"510 511 tp_record_all mlxsw:mlxsw_sp_acl_tcam_vregion_rehash 7512 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash513 check_fail $? "Rehash trace was hit even when rehash should be disabled"514 515 devlink dev param set $DEVLINK_DEV \516 name acl_region_rehash_interval cmode runtime value 3000517 check_err $? "Failed to set ACL region rehash interval"518 519 sleep 1520 521 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \522 $tcflags dst_ip 192.0.1.0/25 action drop523 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \524 $tcflags dst_ip 192.0.2.2 action drop525 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \526 $tcflags dst_ip 192.0.3.0/24 action drop527 528 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \529 -t ip -q530 531 tc_check_packets "dev $h2 ingress" 101 1532 check_fail $? "Matched a wrong filter"533 534 tc_check_packets "dev $h2 ingress" 103 1535 check_fail $? "Matched a wrong filter"536 537 tc_check_packets "dev $h2 ingress" 102 1538 check_err $? "Did not match on correct filter"539 540 tp_record_all mlxsw:* 3541 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash542 check_err $? "Rehash trace was not hit"543 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate544 check_err $? "Migrate trace was not hit"545 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate_end546 check_err $? "Migrate end trace was not hit"547 tp_record_all mlxsw:* 3548 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash549 check_err $? "Rehash trace was not hit"550 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate551 check_fail $? "Migrate trace was hit when no migration should happen"552 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate_end553 check_fail $? "Migrate end trace was hit when no migration should happen"554 555 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \556 -t ip -q557 558 tc_check_packets "dev $h2 ingress" 101 1559 check_fail $? "Matched a wrong filter after rehash"560 561 tc_check_packets "dev $h2 ingress" 103 1562 check_fail $? "Matched a wrong filter after rehash"563 564 tc_check_packets "dev $h2 ingress" 102 2565 check_err $? "Did not match on correct filter after rehash"566 567 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower568 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower569 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower570 571 log_test "delta simple rehash test ($tcflags)"572}573 574delta_simple_ipv6_rehash_test()575{576 RET=0577 578 if [[ "$tcflags" != "skip_sw" ]]; then579 return 0;580 fi581 582 devlink dev param set $DEVLINK_DEV \583 name acl_region_rehash_interval cmode runtime value 0584 check_err $? "Failed to set ACL region rehash interval"585 586 tp_record_all mlxsw:mlxsw_sp_acl_tcam_vregion_rehash 7587 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash588 check_fail $? "Rehash trace was hit even when rehash should be disabled"589 590 devlink dev param set $DEVLINK_DEV \591 name acl_region_rehash_interval cmode runtime value 3000592 check_err $? "Failed to set ACL region rehash interval"593 594 sleep 1595 596 tc filter add dev $h2 ingress protocol ipv6 pref 1 handle 101 flower \597 $tcflags dst_ip 2001:db8:1::0/121 action drop598 tc filter add dev $h2 ingress protocol ipv6 pref 2 handle 102 flower \599 $tcflags dst_ip 2001:db8:2::2 action drop600 tc filter add dev $h2 ingress protocol ipv6 pref 3 handle 103 flower \601 $tcflags dst_ip 2001:db8:3::0/120 action drop602 603 $MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \604 -A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q605 606 tc_check_packets "dev $h2 ingress" 101 1607 check_fail $? "Matched a wrong filter"608 609 tc_check_packets "dev $h2 ingress" 103 1610 check_fail $? "Matched a wrong filter"611 612 tc_check_packets "dev $h2 ingress" 102 1613 check_err $? "Did not match on correct filter"614 615 tp_record_all mlxsw:* 3616 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash617 check_err $? "Rehash trace was not hit"618 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate619 check_err $? "Migrate trace was not hit"620 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate_end621 check_err $? "Migrate end trace was not hit"622 tp_record_all mlxsw:* 3623 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash624 check_err $? "Rehash trace was not hit"625 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate626 check_fail $? "Migrate trace was hit when no migration should happen"627 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_migrate_end628 check_fail $? "Migrate end trace was hit when no migration should happen"629 630 $MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \631 -A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q632 633 tc_check_packets "dev $h2 ingress" 101 1634 check_fail $? "Matched a wrong filter after rehash"635 636 tc_check_packets "dev $h2 ingress" 103 1637 check_fail $? "Matched a wrong filter after rehash"638 639 tc_check_packets "dev $h2 ingress" 102 2640 check_err $? "Did not match on correct filter after rehash"641 642 tc filter del dev $h2 ingress protocol ipv6 pref 3 handle 103 flower643 tc filter del dev $h2 ingress protocol ipv6 pref 2 handle 102 flower644 tc filter del dev $h2 ingress protocol ipv6 pref 1 handle 101 flower645 646 log_test "delta simple IPv6 rehash test ($tcflags)"647}648 649TEST_RULE_BASE=256650declare -a test_rules_inserted651 652test_rule_add()653{654 local iface=$1655 local tcflags=$2656 local index=$3657 658 if ! [ ${test_rules_inserted[$index]} ] ; then659 test_rules_inserted[$index]=false660 fi661 if ${test_rules_inserted[$index]} ; then662 return663 fi664 665 local number=$(( $index + $TEST_RULE_BASE ))666 printf -v hexnumber '%x' $number667 668 batch="${batch}filter add dev $iface ingress protocol ipv6 pref 1 \669 handle $number flower $tcflags \670 src_ip 2001:db8:1::$hexnumber action drop\n"671 test_rules_inserted[$index]=true672}673 674test_rule_del()675{676 local iface=$1677 local index=$2678 679 if ! [ ${test_rules_inserted[$index]} ] ; then680 test_rules_inserted[$index]=false681 fi682 if ! ${test_rules_inserted[$index]} ; then683 return684 fi685 686 local number=$(( $index + $TEST_RULE_BASE ))687 printf -v hexnumber '%x' $number688 689 batch="${batch}filter del dev $iface ingress protocol ipv6 pref 1 \690 handle $number flower\n"691 test_rules_inserted[$index]=false692}693 694test_rule_add_or_remove()695{696 local iface=$1697 local tcflags=$2698 local index=$3699 700 if ! [ ${test_rules_inserted[$index]} ] ; then701 test_rules_inserted[$index]=false702 fi703 if ${test_rules_inserted[$index]} ; then704 test_rule_del $iface $index705 else706 test_rule_add $iface $tcflags $index707 fi708}709 710test_rule_add_or_remove_random_batch()711{712 local iface=$1713 local tcflags=$2714 local total_count=$3715 local skip=0716 local count=0717 local MAXSKIP=20718 local MAXCOUNT=20719 720 for ((i=1;i<=total_count;i++)); do721 if (( $skip == 0 )) && (($count == 0)); then722 ((skip=$RANDOM % $MAXSKIP + 1))723 ((count=$RANDOM % $MAXCOUNT + 1))724 fi725 if (( $skip != 0 )); then726 ((skip-=1))727 else728 ((count-=1))729 test_rule_add_or_remove $iface $tcflags $i730 fi731 done732}733 734delta_massive_ipv6_rehash_test()735{736 RET=0737 738 if [[ "$tcflags" != "skip_sw" ]]; then739 return 0;740 fi741 742 devlink dev param set $DEVLINK_DEV \743 name acl_region_rehash_interval cmode runtime value 0744 check_err $? "Failed to set ACL region rehash interval"745 746 tp_record_all mlxsw:mlxsw_sp_acl_tcam_vregion_rehash 7747 tp_check_hits_any mlxsw:mlxsw_sp_acl_tcam_vregion_rehash748 check_fail $? "Rehash trace was hit even when rehash should be disabled"749 750 RANDOM=4432897751 declare batch=""752 test_rule_add_or_remove_random_batch $h2 $tcflags 5000753 754 echo -n -e $batch | tc -b -755 756 declare batch=""757 test_rule_add_or_remove_random_batch $h2 $tcflags 5000758 759 devlink dev param set $DEVLINK_DEV \760 name acl_region_rehash_interval cmode runtime value 3000761 check_err $? "Failed to set ACL region rehash interval"762 763 sleep 1764 765 tc filter add dev $h2 ingress protocol ipv6 pref 1 handle 101 flower \766 $tcflags dst_ip 2001:db8:1::0/121 action drop767 tc filter add dev $h2 ingress protocol ipv6 pref 2 handle 102 flower \768 $tcflags dst_ip 2001:db8:2::2 action drop769 tc filter add dev $h2 ingress protocol ipv6 pref 3 handle 103 flower \770 $tcflags dst_ip 2001:db8:3::0/120 action drop771 772 $MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \773 -A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q774 775 tc_check_packets "dev $h2 ingress" 101 1776 check_fail $? "Matched a wrong filter"777 778 tc_check_packets "dev $h2 ingress" 103 1779 check_fail $? "Matched a wrong filter"780 781 tc_check_packets "dev $h2 ingress" 102 1782 check_err $? "Did not match on correct filter"783 784 echo -n -e $batch | tc -b -785 786 devlink dev param set $DEVLINK_DEV \787 name acl_region_rehash_interval cmode runtime value 0788 check_err $? "Failed to set ACL region rehash interval"789 790 $MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \791 -A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q792 793 tc_check_packets "dev $h2 ingress" 101 1794 check_fail $? "Matched a wrong filter after rehash"795 796 tc_check_packets "dev $h2 ingress" 103 1797 check_fail $? "Matched a wrong filter after rehash"798 799 tc_check_packets "dev $h2 ingress" 102 2800 check_err $? "Did not match on correct filter after rehash"801 802 tc filter del dev $h2 ingress protocol ipv6 pref 3 handle 103 flower803 tc filter del dev $h2 ingress protocol ipv6 pref 2 handle 102 flower804 tc filter del dev $h2 ingress protocol ipv6 pref 1 handle 101 flower805 806 declare batch=""807 for i in {1..5000}; do808 test_rule_del $h2 $tcflags $i809 done810 echo -e $batch | tc -b -811 812 log_test "delta massive IPv6 rehash test ($tcflags)"813}814 815bloom_simple_test()816{817 # Bloom filter requires that the eRP table is used. This test818 # verifies that Bloom filter is not harming correctness of ACLs.819 # First, make sure that eRP table is used and then set rule patterns820 # which are distant enough and will result skipping a lookup after821 # consulting the Bloom filter. Although some eRP lookups are skipped,822 # the correct filter should be hit.823 824 RET=0825 826 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \827 $tcflags dst_ip 192.0.2.2 action drop828 tc filter add dev $h2 ingress protocol ip pref 5 handle 104 flower \829 $tcflags dst_ip 198.51.100.2 action drop830 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \831 $tcflags dst_ip 192.0.0.0/8 action drop832 833 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \834 -t ip -q835 836 tc_check_packets "dev $h2 ingress" 101 1837 check_err $? "Two filters - did not match highest priority"838 839 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \840 -t ip -q841 842 tc_check_packets "dev $h2 ingress" 104 1843 check_err $? "Single filter - did not match"844 845 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower846 847 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \848 -t ip -q849 850 tc_check_packets "dev $h2 ingress" 103 1851 check_err $? "Low prio filter - did not match"852 853 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \854 $tcflags dst_ip 198.0.0.0/8 action drop855 856 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \857 -t ip -q858 859 tc_check_packets "dev $h2 ingress" 102 1860 check_err $? "Two filters - did not match highest priority after add"861 862 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower863 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower864 tc filter del dev $h2 ingress protocol ip pref 5 handle 104 flower865 866 log_test "bloom simple test ($tcflags)"867}868 869bloom_complex_test()870{871 # Bloom filter index computation is affected from region ID, eRP872 # ID and from the region key size. In order to exercise those parts873 # of the Bloom filter code, use a series of regions, each with a874 # different key size and send packet that should hit all of them.875 local index876 877 RET=0878 NUM_CHAINS=4879 BASE_INDEX=100880 881 # Create chain with up to 2 key blocks (ip_proto only)882 tc chain add dev $h2 ingress chain 1 protocol ip flower \883 ip_proto tcp &> /dev/null884 # Create chain with 2-4 key blocks (ip_proto, src MAC)885 tc chain add dev $h2 ingress chain 2 protocol ip flower \886 ip_proto tcp \887 src_mac 00:00:00:00:00:00/FF:FF:FF:FF:FF:FF &> /dev/null888 # Create chain with 4-8 key blocks (ip_proto, src & dst MAC, IPv4 dest)889 tc chain add dev $h2 ingress chain 3 protocol ip flower \890 ip_proto tcp \891 dst_mac 00:00:00:00:00:00/FF:FF:FF:FF:FF:FF \892 src_mac 00:00:00:00:00:00/FF:FF:FF:FF:FF:FF \893 dst_ip 0.0.0.0/32 &> /dev/null894 # Default chain contains all fields and therefore is 8-12 key blocks895 tc chain add dev $h2 ingress chain 4896 897 # We need at least 2 rules in every region to have eRP table active898 # so create a dummy rule per chain using a different pattern899 for i in $(eval echo {0..$NUM_CHAINS}); do900 index=$((BASE_INDEX - 1 - i))901 tc filter add dev $h2 ingress chain $i protocol ip \902 pref 2 handle $index flower \903 $tcflags ip_proto tcp action drop904 done905 906 # Add rules to test Bloom filter, each in a different chain907 index=$BASE_INDEX908 tc filter add dev $h2 ingress protocol ip \909 pref 1 handle $((++index)) flower \910 $tcflags dst_ip 192.0.0.0/16 action goto chain 1911 tc filter add dev $h2 ingress chain 1 protocol ip \912 pref 1 handle $((++index)) flower \913 $tcflags action goto chain 2914 tc filter add dev $h2 ingress chain 2 protocol ip \915 pref 1 handle $((++index)) flower \916 $tcflags src_mac $h1mac action goto chain 3917 tc filter add dev $h2 ingress chain 3 protocol ip \918 pref 1 handle $((++index)) flower \919 $tcflags dst_ip 192.0.0.0/8 action goto chain 4920 tc filter add dev $h2 ingress chain 4 protocol ip \921 pref 1 handle $((++index)) flower \922 $tcflags src_ip 192.0.2.0/24 action drop923 924 # Send a packet that is supposed to hit all chains925 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \926 -t ip -q927 928 for i in $(eval echo {0..$NUM_CHAINS}); do929 index=$((BASE_INDEX + i + 1))930 tc_check_packets "dev $h2 ingress" $index 1931 check_err $? "Did not match chain $i"932 done933 934 # Rules cleanup935 for i in $(eval echo {$NUM_CHAINS..0}); do936 index=$((BASE_INDEX - i - 1))937 tc filter del dev $h2 ingress chain $i \938 pref 2 handle $index flower939 index=$((BASE_INDEX + i + 1))940 tc filter del dev $h2 ingress chain $i \941 pref 1 handle $index flower942 done943 944 # Chains cleanup945 for i in $(eval echo {$NUM_CHAINS..1}); do946 tc chain del dev $h2 ingress chain $i947 done948 949 log_test "bloom complex test ($tcflags)"950}951 952 953bloom_delta_test()954{955 # When multiple masks are used, the eRP table is activated. When956 # masks are close enough (delta) the masks reside on the same957 # eRP table. This test verifies that the eRP table is correctly958 # allocated and used in delta condition and that Bloom filter is959 # still functional with delta.960 961 RET=0962 963 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \964 $tcflags dst_ip 192.1.0.0/16 action drop965 966 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.1.2.1 -B 192.1.2.2 \967 -t ip -q968 969 tc_check_packets "dev $h2 ingress" 103 1970 check_err $? "Single filter - did not match"971 972 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \973 $tcflags dst_ip 192.2.1.0/24 action drop974 975 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.2.1.1 -B 192.2.1.2 \976 -t ip -q977 978 tc_check_packets "dev $h2 ingress" 102 1979 check_err $? "Delta filters - did not match second filter"980 981 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower982 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower983 984 log_test "bloom delta test ($tcflags)"985}986 987max_erp_entries_test()988{989 # The number of eRP entries is limited. Once the maximum number of eRPs990 # has been reached, filters cannot be added. This test verifies that991 # when this limit is reached, inserstion fails without crashing.992 993 RET=0994 995 local num_masks=32996 local num_regions=15997 local chain_failed998 local mask_failed999 local ret1000 1001 if [[ "$tcflags" != "skip_sw" ]]; then1002 return 0;1003 fi1004 1005 for ((i=1; i < $num_regions; i++)); do1006 for ((j=$num_masks; j >= 0; j--)); do1007 tc filter add dev $h2 ingress chain $i protocol ip \1008 pref $i handle $j flower $tcflags \1009 dst_ip 192.1.0.0/$j &> /dev/null1010 ret=$?1011 1012 if [ $ret -ne 0 ]; then1013 chain_failed=$i1014 mask_failed=$j1015 break 21016 fi1017 done1018 done1019 1020 # We expect to exceed the maximum number of eRP entries, so that1021 # insertion eventually fails. Otherwise, the test should be adjusted to1022 # add more filters.1023 check_fail $ret "expected to exceed number of eRP entries"1024 1025 for ((; i >= 1; i--)); do1026 for ((j=0; j <= $num_masks; j++)); do1027 tc filter del dev $h2 ingress chain $i protocol ip \1028 pref $i handle $j flower &> /dev/null1029 done1030 done1031 1032 log_test "max eRP entries test ($tcflags). " \1033 "max chain $chain_failed, mask $mask_failed"1034}1035 1036max_group_size_test()1037{1038 # The number of ACLs in an ACL group is limited. Once the maximum1039 # number of ACLs has been reached, filters cannot be added. This test1040 # verifies that when this limit is reached, insertion fails without1041 # crashing.1042 1043 RET=01044 1045 local num_acls=321046 local max_size1047 local ret1048 1049 if [[ "$tcflags" != "skip_sw" ]]; then1050 return 0;1051 fi1052 1053 for ((i=1; i < $num_acls; i++)); do1054 if [[ $(( i % 2 )) == 1 ]]; then1055 tc filter add dev $h2 ingress pref $i proto ipv4 \1056 flower $tcflags dst_ip 198.51.100.1/32 \1057 ip_proto tcp tcp_flags 0x01/0x01 \1058 action drop &> /dev/null1059 else1060 tc filter add dev $h2 ingress pref $i proto ipv6 \1061 flower $tcflags dst_ip 2001:db8:1::1/128 \1062 action drop &> /dev/null1063 fi1064 1065 ret=$?1066 [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break1067 done1068 1069 # We expect to exceed the maximum number of ACLs in a group, so that1070 # insertion eventually fails. Otherwise, the test should be adjusted to1071 # add more filters.1072 check_fail $ret "expected to exceed number of ACLs in a group"1073 1074 for ((; i >= 1; i--)); do1075 if [[ $(( i % 2 )) == 1 ]]; then1076 tc filter del dev $h2 ingress pref $i proto ipv4 \1077 flower $tcflags dst_ip 198.51.100.1/32 \1078 ip_proto tcp tcp_flags 0x01/0x01 \1079 action drop &> /dev/null1080 else1081 tc filter del dev $h2 ingress pref $i proto ipv6 \1082 flower $tcflags dst_ip 2001:db8:1::1/128 \1083 action drop &> /dev/null1084 fi1085 done1086 1087 log_test "max ACL group size test ($tcflags). max size $max_size"1088}1089 1090collision_test()1091{1092 # Filters cannot share an eRP if in the common unmasked part (i.e.,1093 # without the delta bits) they have the same values. If the driver does1094 # not prevent such configuration (by spilling into the C-TCAM), then1095 # multiple entries will be present in the device with the same key,1096 # leading to collisions and a reduced scale.1097 #1098 # Create such a scenario and make sure all the filters are successfully1099 # added.1100 1101 RET=01102 1103 local ret1104 1105 if [[ "$tcflags" != "skip_sw" ]]; then1106 return 0;1107 fi1108 1109 # Add a single dst_ip/24 filter and multiple dst_ip/32 filters that all1110 # have the same values in the common unmasked part (dst_ip/24).1111 1112 tc filter add dev $h2 ingress pref 1 proto ipv4 handle 101 \1113 flower $tcflags dst_ip 198.51.100.0/24 \1114 action drop1115 1116 for i in {0..255}; do1117 tc filter add dev $h2 ingress pref 2 proto ipv4 \1118 handle $((102 + i)) \1119 flower $tcflags dst_ip 198.51.100.${i}/32 \1120 action drop1121 ret=$?1122 [[ $ret -ne 0 ]] && break1123 done1124 1125 check_err $ret "failed to add all the filters"1126 1127 for i in {255..0}; do1128 tc filter del dev $h2 ingress pref 2 proto ipv4 \1129 handle $((102 + i)) flower1130 done1131 1132 tc filter del dev $h2 ingress pref 1 proto ipv4 handle 101 flower1133 1134 log_test "collision test ($tcflags)"1135}1136 1137setup_prepare()1138{1139 h1=${NETIFS[p1]}1140 h2=${NETIFS[p2]}1141 h1mac=$(mac_get $h1)1142 h2mac=$(mac_get $h2)1143 1144 vrf_prepare1145 1146 h1_create1147 h2_create1148}1149 1150cleanup()1151{1152 pre_cleanup1153 1154 h2_destroy1155 h1_destroy1156 1157 vrf_cleanup1158}1159 1160trap cleanup EXIT1161 1162setup_prepare1163setup_wait1164 1165tests_run1166 1167if ! tc_offload_check; then1168 check_err 1 "Could not test offloaded functionality"1169 log_test "mlxsw-specific tests for tc flower"1170 exit1171else1172 tcflags="skip_sw"1173 tests_run1174fi1175 1176exit $EXIT_STATUS1177