name : tc_flower_chains.sh #!/bin/bash # SPDX-License-Identifier: GPL-2.0 # Copyright 2020 NXP WAIT_TIME=1 NUM_NETIFS=4 STABLE_MAC_ADDRS=yes lib_dir=$(dirname $0)/../../../net/forwarding source $lib_dir/tc_common.sh source $lib_dir/lib.sh require_command tcpdump h1=${NETIFS[p1]} swp1=${NETIFS[p2]} swp2=${NETIFS[p3]} h2=${NETIFS[p4]} # Helpers to map a VCAP IS1 and VCAP IS2 lookup and policy to a chain number # used by the kernel driver. The numbers are: # VCAP IS1 lookup 0: 10000 # VCAP IS1 lookup 1: 11000 # VCAP IS1 lookup 2: 12000 # VCAP IS2 lookup 0 policy 0: 20000 # VCAP IS2 lookup 0 policy 1: 20001 # VCAP IS2 lookup 0 policy 255: 20255 # VCAP IS2 lookup 1 policy 0: 21000 # VCAP IS2 lookup 1 policy 1: 21001 # VCAP IS2 lookup 1 policy 255: 21255 IS1() { local lookup=$1 echo $((10000 + 1000 * lookup)) } IS2() { local lookup=$1 local pag=$2 echo $((20000 + 1000 * lookup + pag)) } ES0() { echo 0 } # The Ocelot switches have a fixed ingress pipeline composed of: # # +----------------------------------------------+ +-----------------------------------------+ # | VCAP IS1 | | VCAP IS2 | # | | | | # | +----------+ +----------+ +----------+ | | +----------+ +----------+ | # | | Lookup 0 | | Lookup 1 | | Lookup 2 | | --+------> PAG 0: | Lookup 0 | -> | Lookup 1 | | # | +----------+ -> +----------+ -> +----------+ | | | +----------+ +----------+ | # | |key&action| |key&action| |key&action| | | | |key&action| |key&action| | # | |key&action| |key&action| |key&action| | | | | .. | | .. | | # | | .. | | .. | | .. | | | | +----------+ +----------+ | # | +----------+ +----------+ +----------+ | | | | # | selects PAG | | | +----------+ +----------+ | # +----------------------------------------------+ +------> PAG 1: | Lookup 0 | -> | Lookup 1 | | # | | +----------+ +----------+ | # | | |key&action| |key&action| | # | | | .. | | .. | | # | | +----------+ +----------+ | # | | ... | # | | | # | | +----------+ +----------+ | # +----> PAG 254: | Lookup 0 | -> | Lookup 1 | | # | | +----------+ +----------+ | # | | |key&action| |key&action| | # | | | .. | | .. | | # | | +----------+ +----------+ | # | | | # | | +----------+ +----------+ | # +----> PAG 255: | Lookup 0 | -> | Lookup 1 | | # | +----------+ +----------+ | # | |key&action| |key&action| | # | | .. | | .. | | # | +----------+ +----------+ | # +-----------------------------------------+ # # Both the VCAP IS1 (Ingress Stage 1) and IS2 (Ingress Stage 2) are indexed # (looked up) multiple times: IS1 3 times, and IS2 2 times. Each filter # (key and action pair) can be configured to only match during the first, or # second, etc, lookup. # # During one TCAM lookup, the filter processing stops at the first entry that # matches, then the pipeline jumps to the next lookup. # The driver maps each individual lookup of each individual ingress TCAM to a # separate chain number. For correct rule offloading, it is mandatory that each # filter installed in one TCAM is terminated by a non-optional GOTO action to # the next lookup from the fixed pipeline. # # A chain can only be used if there is a GOTO action correctly set up from the # prior lookup in the processing pipeline. Setting up all chains is not # mandatory. # NOTE: VCAP IS1 currently uses only S1_NORMAL half keys and VCAP IS2 # dynamically chooses between MAC_ETYPE, ARP, IP4_TCP_UDP, IP4_OTHER, which are # all half keys as well. create_tcam_skeleton() { local eth=$1 tc qdisc add dev $eth clsact # VCAP IS1 is the Ingress Classification TCAM and can offload the # following actions: # - skbedit priority # - vlan pop # - vlan modify # - goto (only in lookup 2, the last IS1 lookup) tc filter add dev $eth ingress chain 0 pref 49152 flower \ skip_sw action goto chain $(IS1 0) tc filter add dev $eth ingress chain $(IS1 0) pref 49152 \ flower skip_sw action goto chain $(IS1 1) tc filter add dev $eth ingress chain $(IS1 1) pref 49152 \ flower skip_sw action goto chain $(IS1 2) tc filter add dev $eth ingress chain $(IS1 2) pref 49152 \ flower skip_sw action goto chain $(IS2 0 0) # VCAP IS2 is the Security Enforcement ingress TCAM and can offload the # following actions: # - trap # - drop # - police # The two VCAP IS2 lookups can be segmented into up to 256 groups of # rules, called Policies. A Policy is selected through the Policy # Association Group (PAG) action of VCAP IS1 (which is the # GOTO offload). tc filter add dev $eth ingress chain $(IS2 0 0) pref 49152 \ flower skip_sw action goto chain $(IS2 1 0) } setup_prepare() { ip link set $swp1 up ip link set $swp2 up ip link set $h2 up ip link set $h1 up create_tcam_skeleton $swp1 ip link add br0 type bridge ip link set $swp1 master br0 ip link set $swp2 master br0 ip link set br0 up ip link add link $h1 name $h1.100 type vlan id 100 ip link set $h1.100 up ip link add link $h1 name $h1.200 type vlan id 200 ip link set $h1.200 up tc filter add dev $swp1 ingress chain $(IS1 1) pref 1 \ protocol 802.1Q flower skip_sw vlan_id 100 \ action vlan pop \ action goto chain $(IS1 2) tc filter add dev $swp1 egress chain $(ES0) pref 1 \ flower skip_sw indev $swp2 \ action vlan push protocol 802.1Q id 100 tc filter add dev $swp1 ingress chain $(IS1 0) pref 2 \ protocol ipv4 flower skip_sw src_ip 10.1.1.2 \ action skbedit priority 7 \ action goto chain $(IS1 1) tc filter add dev $swp1 ingress chain $(IS2 0 0) pref 1 \ protocol ipv4 flower skip_sw ip_proto udp dst_port 5201 \ action police rate 50mbit burst 64k conform-exceed drop/pipe \ action goto chain $(IS2 1 0) } cleanup() { ip link del $h1.200 ip link del $h1.100 tc qdisc del dev $swp1 clsact ip link del br0 } test_vlan_pop() { local h1_mac=$(mac_get $h1) local h2_mac=$(mac_get $h2) RET=0 tcpdump_start $h2 # Work around Mausezahn VLAN builder bug # (https://github.com/netsniff-ng/netsniff-ng/issues/225) by using # an 8021q upper $MZ $h1.100 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip sleep 1 tcpdump_stop $h2 tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, ethertype IPv4" check_err "$?" "untagged reception" tcpdump_cleanup $h2 log_test "VLAN pop" } test_vlan_push() { local h1_mac=$(mac_get $h1) local h2_mac=$(mac_get $h2) RET=0 tcpdump_start $h1.100 $MZ $h2 -q -c 1 -p 64 -a $h2_mac -b $h1_mac -t ip sleep 1 tcpdump_stop $h1.100 tcpdump_show $h1.100 | grep -q "$h2_mac > $h1_mac" check_err "$?" "tagged reception" tcpdump_cleanup $h1.100 log_test "VLAN push" } test_vlan_ingress_modify() { local h1_mac=$(mac_get $h1) local h2_mac=$(mac_get $h2) RET=0 ip link set br0 type bridge vlan_filtering 1 bridge vlan add dev $swp1 vid 200 bridge vlan add dev $swp1 vid 300 bridge vlan add dev $swp2 vid 300 tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \ protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \ action vlan modify id 300 \ action goto chain $(IS2 0 0) tcpdump_start $h2 $MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip sleep 1 tcpdump_stop $h2 tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300" check_err "$?" "tagged reception" tcpdump_cleanup $h2 tc filter del dev $swp1 ingress chain $(IS1 2) pref 3 bridge vlan del dev $swp1 vid 200 bridge vlan del dev $swp1 vid 300 bridge vlan del dev $swp2 vid 300 ip link set br0 type bridge vlan_filtering 0 log_test "Ingress VLAN modification" } test_vlan_egress_modify() { local h1_mac=$(mac_get $h1) local h2_mac=$(mac_get $h2) RET=0 tc qdisc add dev $swp2 clsact ip link set br0 type bridge vlan_filtering 1 bridge vlan add dev $swp1 vid 200 bridge vlan add dev $swp2 vid 200 tc filter add dev $swp2 egress chain $(ES0) pref 3 \ protocol 802.1Q flower skip_sw vlan_id 200 vlan_prio 0 \ action vlan modify id 300 priority 7 tcpdump_start $h2 $MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip sleep 1 tcpdump_stop $h2 tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300" check_err "$?" "tagged reception" tcpdump_cleanup $h2 tc filter del dev $swp2 egress chain $(ES0) pref 3 tc qdisc del dev $swp2 clsact bridge vlan del dev $swp1 vid 200 bridge vlan del dev $swp2 vid 200 ip link set br0 type bridge vlan_filtering 0 log_test "Egress VLAN modification" } test_skbedit_priority() { local h1_mac=$(mac_get $h1) local h2_mac=$(mac_get $h2) local num_pkts=100 before=$(ethtool_stats_get $swp1 'rx_green_prio_7') $MZ $h1 -q -c $num_pkts -p 64 -a $h1_mac -b $h2_mac -t ip -A 10.1.1.2 after=$(ethtool_stats_get $swp1 'rx_green_prio_7') if [ $((after - before)) = $num_pkts ]; then RET=0 else RET=1 fi log_test "Frame prioritization" } trap cleanup EXIT ALL_TESTS=" test_vlan_pop test_vlan_push test_vlan_ingress_modify test_vlan_egress_modify test_skbedit_priority " setup_prepare setup_wait tests_run exit $EXIT_STATUS