353 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03# Copyright 2020 NXP4 5WAIT_TIME=16NUM_NETIFS=47STABLE_MAC_ADDRS=yes8lib_dir=$(dirname $0)/../../../net/forwarding9source $lib_dir/tc_common.sh10source $lib_dir/lib.sh11 12require_command tcpdump13 14h1=${NETIFS[p1]}15swp1=${NETIFS[p2]}16swp2=${NETIFS[p3]}17h2=${NETIFS[p4]}18 19# Helpers to map a VCAP IS1 and VCAP IS2 lookup and policy to a chain number20# used by the kernel driver. The numbers are:21# VCAP IS1 lookup 0: 1000022# VCAP IS1 lookup 1: 1100023# VCAP IS1 lookup 2: 1200024# VCAP IS2 lookup 0 policy 0: 2000025# VCAP IS2 lookup 0 policy 1: 2000126# VCAP IS2 lookup 0 policy 255: 2025527# VCAP IS2 lookup 1 policy 0: 2100028# VCAP IS2 lookup 1 policy 1: 2100129# VCAP IS2 lookup 1 policy 255: 2125530IS1()31{32 local lookup=$133 34 echo $((10000 + 1000 * lookup))35}36 37IS2()38{39 local lookup=$140 local pag=$241 42 echo $((20000 + 1000 * lookup + pag))43}44 45ES0()46{47 echo 048}49 50# The Ocelot switches have a fixed ingress pipeline composed of:51#52# +----------------------------------------------+ +-----------------------------------------+53# | VCAP IS1 | | VCAP IS2 |54# | | | |55# | +----------+ +----------+ +----------+ | | +----------+ +----------+ |56# | | Lookup 0 | | Lookup 1 | | Lookup 2 | | --+------> PAG 0: | Lookup 0 | -> | Lookup 1 | |57# | +----------+ -> +----------+ -> +----------+ | | | +----------+ +----------+ |58# | |key&action| |key&action| |key&action| | | | |key&action| |key&action| |59# | |key&action| |key&action| |key&action| | | | | .. | | .. | |60# | | .. | | .. | | .. | | | | +----------+ +----------+ |61# | +----------+ +----------+ +----------+ | | | |62# | selects PAG | | | +----------+ +----------+ |63# +----------------------------------------------+ +------> PAG 1: | Lookup 0 | -> | Lookup 1 | |64# | | +----------+ +----------+ |65# | | |key&action| |key&action| |66# | | | .. | | .. | |67# | | +----------+ +----------+ |68# | | ... |69# | | |70# | | +----------+ +----------+ |71# +----> PAG 254: | Lookup 0 | -> | Lookup 1 | |72# | | +----------+ +----------+ |73# | | |key&action| |key&action| |74# | | | .. | | .. | |75# | | +----------+ +----------+ |76# | | |77# | | +----------+ +----------+ |78# +----> PAG 255: | Lookup 0 | -> | Lookup 1 | |79# | +----------+ +----------+ |80# | |key&action| |key&action| |81# | | .. | | .. | |82# | +----------+ +----------+ |83# +-----------------------------------------+84#85# Both the VCAP IS1 (Ingress Stage 1) and IS2 (Ingress Stage 2) are indexed86# (looked up) multiple times: IS1 3 times, and IS2 2 times. Each filter87# (key and action pair) can be configured to only match during the first, or88# second, etc, lookup.89#90# During one TCAM lookup, the filter processing stops at the first entry that91# matches, then the pipeline jumps to the next lookup.92# The driver maps each individual lookup of each individual ingress TCAM to a93# separate chain number. For correct rule offloading, it is mandatory that each94# filter installed in one TCAM is terminated by a non-optional GOTO action to95# the next lookup from the fixed pipeline.96#97# A chain can only be used if there is a GOTO action correctly set up from the98# prior lookup in the processing pipeline. Setting up all chains is not99# mandatory.100 101# NOTE: VCAP IS1 currently uses only S1_NORMAL half keys and VCAP IS2102# dynamically chooses between MAC_ETYPE, ARP, IP4_TCP_UDP, IP4_OTHER, which are103# all half keys as well.104 105create_tcam_skeleton()106{107 local eth=$1108 109 tc qdisc add dev $eth clsact110 111 # VCAP IS1 is the Ingress Classification TCAM and can offload the112 # following actions:113 # - skbedit priority114 # - vlan pop115 # - vlan modify116 # - goto (only in lookup 2, the last IS1 lookup)117 tc filter add dev $eth ingress chain 0 pref 49152 flower \118 skip_sw action goto chain $(IS1 0)119 tc filter add dev $eth ingress chain $(IS1 0) pref 49152 \120 flower skip_sw action goto chain $(IS1 1)121 tc filter add dev $eth ingress chain $(IS1 1) pref 49152 \122 flower skip_sw action goto chain $(IS1 2)123 tc filter add dev $eth ingress chain $(IS1 2) pref 49152 \124 flower skip_sw action goto chain $(IS2 0 0)125 126 # VCAP IS2 is the Security Enforcement ingress TCAM and can offload the127 # following actions:128 # - trap129 # - drop130 # - police131 # The two VCAP IS2 lookups can be segmented into up to 256 groups of132 # rules, called Policies. A Policy is selected through the Policy133 # Association Group (PAG) action of VCAP IS1 (which is the134 # GOTO offload).135 tc filter add dev $eth ingress chain $(IS2 0 0) pref 49152 \136 flower skip_sw action goto chain $(IS2 1 0)137}138 139setup_prepare()140{141 ip link set $swp1 up142 ip link set $swp2 up143 ip link set $h2 up144 ip link set $h1 up145 146 create_tcam_skeleton $swp1147 148 ip link add br0 type bridge149 ip link set $swp1 master br0150 ip link set $swp2 master br0151 ip link set br0 up152 153 ip link add link $h1 name $h1.100 type vlan id 100154 ip link set $h1.100 up155 156 ip link add link $h1 name $h1.200 type vlan id 200157 ip link set $h1.200 up158 159 tc filter add dev $swp1 ingress chain $(IS1 1) pref 1 \160 protocol 802.1Q flower skip_sw vlan_id 100 \161 action vlan pop \162 action goto chain $(IS1 2)163 164 tc filter add dev $swp1 egress chain $(ES0) pref 1 \165 flower skip_sw indev $swp2 \166 action vlan push protocol 802.1Q id 100167 168 tc filter add dev $swp1 ingress chain $(IS1 0) pref 2 \169 protocol ipv4 flower skip_sw src_ip 10.1.1.2 \170 action skbedit priority 7 \171 action goto chain $(IS1 1)172 173 tc filter add dev $swp1 ingress chain $(IS2 0 0) pref 1 \174 protocol ipv4 flower skip_sw ip_proto udp dst_port 5201 \175 action police rate 50mbit burst 64k conform-exceed drop/pipe \176 action goto chain $(IS2 1 0)177}178 179cleanup()180{181 ip link del $h1.200182 ip link del $h1.100183 tc qdisc del dev $swp1 clsact184 ip link del br0185}186 187test_vlan_pop()188{189 local h1_mac=$(mac_get $h1)190 local h2_mac=$(mac_get $h2)191 192 RET=0193 194 tcpdump_start $h2195 196 # Work around Mausezahn VLAN builder bug197 # (https://github.com/netsniff-ng/netsniff-ng/issues/225) by using198 # an 8021q upper199 $MZ $h1.100 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip200 201 sleep 1202 203 tcpdump_stop $h2204 205 tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, ethertype IPv4"206 check_err "$?" "untagged reception"207 208 tcpdump_cleanup $h2209 210 log_test "VLAN pop"211}212 213test_vlan_push()214{215 local h1_mac=$(mac_get $h1)216 local h2_mac=$(mac_get $h2)217 218 RET=0219 220 tcpdump_start $h1.100221 222 $MZ $h2 -q -c 1 -p 64 -a $h2_mac -b $h1_mac -t ip223 224 sleep 1225 226 tcpdump_stop $h1.100227 228 tcpdump_show $h1.100 | grep -q "$h2_mac > $h1_mac"229 check_err "$?" "tagged reception"230 231 tcpdump_cleanup $h1.100232 233 log_test "VLAN push"234}235 236test_vlan_ingress_modify()237{238 local h1_mac=$(mac_get $h1)239 local h2_mac=$(mac_get $h2)240 241 RET=0242 243 ip link set br0 type bridge vlan_filtering 1244 bridge vlan add dev $swp1 vid 200245 bridge vlan add dev $swp1 vid 300246 bridge vlan add dev $swp2 vid 300247 248 tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \249 protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \250 action vlan modify id 300 \251 action goto chain $(IS2 0 0)252 253 tcpdump_start $h2254 255 $MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip256 257 sleep 1258 259 tcpdump_stop $h2260 261 tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300"262 check_err "$?" "tagged reception"263 264 tcpdump_cleanup $h2265 266 tc filter del dev $swp1 ingress chain $(IS1 2) pref 3267 268 bridge vlan del dev $swp1 vid 200269 bridge vlan del dev $swp1 vid 300270 bridge vlan del dev $swp2 vid 300271 ip link set br0 type bridge vlan_filtering 0272 273 log_test "Ingress VLAN modification"274}275 276test_vlan_egress_modify()277{278 local h1_mac=$(mac_get $h1)279 local h2_mac=$(mac_get $h2)280 281 RET=0282 283 tc qdisc add dev $swp2 clsact284 285 ip link set br0 type bridge vlan_filtering 1286 bridge vlan add dev $swp1 vid 200287 bridge vlan add dev $swp2 vid 200288 289 tc filter add dev $swp2 egress chain $(ES0) pref 3 \290 protocol 802.1Q flower skip_sw vlan_id 200 vlan_prio 0 \291 action vlan modify id 300 priority 7292 293 tcpdump_start $h2294 295 $MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip296 297 sleep 1298 299 tcpdump_stop $h2300 301 tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300"302 check_err "$?" "tagged reception"303 304 tcpdump_cleanup $h2305 306 tc filter del dev $swp2 egress chain $(ES0) pref 3307 tc qdisc del dev $swp2 clsact308 309 bridge vlan del dev $swp1 vid 200310 bridge vlan del dev $swp2 vid 200311 ip link set br0 type bridge vlan_filtering 0312 313 log_test "Egress VLAN modification"314}315 316test_skbedit_priority()317{318 local h1_mac=$(mac_get $h1)319 local h2_mac=$(mac_get $h2)320 local num_pkts=100321 322 before=$(ethtool_stats_get $swp1 'rx_green_prio_7')323 324 $MZ $h1 -q -c $num_pkts -p 64 -a $h1_mac -b $h2_mac -t ip -A 10.1.1.2325 326 after=$(ethtool_stats_get $swp1 'rx_green_prio_7')327 328 if [ $((after - before)) = $num_pkts ]; then329 RET=0330 else331 RET=1332 fi333 334 log_test "Frame prioritization"335}336 337trap cleanup EXIT338 339ALL_TESTS="340 test_vlan_pop341 test_vlan_push342 test_vlan_ingress_modify343 test_vlan_egress_modify344 test_skbedit_priority345"346 347setup_prepare348setup_wait349 350tests_run351 352exit $EXIT_STATUS353