1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3# Copyright 2020 NXP
4
5WAIT_TIME=1
6NUM_NETIFS=4
7STABLE_MAC_ADDRS=yes
8lib_dir=$(dirname $0)/../../../net/forwarding
9source $lib_dir/tc_common.sh
10source $lib_dir/lib.sh
11
12require_command tcpdump
13
14h1=${NETIFS[p1]}
15swp1=${NETIFS[p2]}
16swp2=${NETIFS[p3]}
17h2=${NETIFS[p4]}
18
19# Helpers to map a VCAP IS1 and VCAP IS2 lookup and policy to a chain number
20# used by the kernel driver. The numbers are:
21# VCAP IS1 lookup 0:            10000
22# VCAP IS1 lookup 1:            11000
23# VCAP IS1 lookup 2:            12000
24# VCAP IS2 lookup 0 policy 0:   20000
25# VCAP IS2 lookup 0 policy 1:   20001
26# VCAP IS2 lookup 0 policy 255: 20255
27# VCAP IS2 lookup 1 policy 0:   21000
28# VCAP IS2 lookup 1 policy 1:   21001
29# VCAP IS2 lookup 1 policy 255: 21255
30IS1()
31{
32	local lookup=$1
33
34	echo $((10000 + 1000 * lookup))
35}
36
37IS2()
38{
39	local lookup=$1
40	local pag=$2
41
42	echo $((20000 + 1000 * lookup + pag))
43}
44
45ES0()
46{
47	echo 0
48}
49
50# The Ocelot switches have a fixed ingress pipeline composed of:
51#
52# +----------------------------------------------+      +-----------------------------------------+
53# |                   VCAP IS1                   |      |                  VCAP IS2               |
54# |                                              |      |                                         |
55# | +----------+    +----------+    +----------+ |      |            +----------+    +----------+ |
56# | | Lookup 0 |    | Lookup 1 |    | Lookup 2 | | --+------> PAG 0: | Lookup 0 | -> | Lookup 1 | |
57# | +----------+ -> +----------+ -> +----------+ |   |  |            +----------+    +----------+ |
58# | |key&action|    |key&action|    |key&action| |   |  |            |key&action|    |key&action| |
59# | |key&action|    |key&action|    |key&action| |   |  |            |    ..    |    |    ..    | |
60# | |    ..    |    |    ..    |    |    ..    | |   |  |            +----------+    +----------+ |
61# | +----------+    +----------+    +----------+ |   |  |                                         |
62# |                                 selects PAG  |   |  |            +----------+    +----------+ |
63# +----------------------------------------------+   +------> PAG 1: | Lookup 0 | -> | Lookup 1 | |
64#                                                    |  |            +----------+    +----------+ |
65#                                                    |  |            |key&action|    |key&action| |
66#                                                    |  |            |    ..    |    |    ..    | |
67#                                                    |  |            +----------+    +----------+ |
68#                                                    |  |      ...                                |
69#                                                    |  |                                         |
70#                                                    |  |            +----------+    +----------+ |
71#                                                    +----> PAG 254: | Lookup 0 | -> | Lookup 1 | |
72#                                                    |  |            +----------+    +----------+ |
73#                                                    |  |            |key&action|    |key&action| |
74#                                                    |  |            |    ..    |    |    ..    | |
75#                                                    |  |            +----------+    +----------+ |
76#                                                    |  |                                         |
77#                                                    |  |            +----------+    +----------+ |
78#                                                    +----> PAG 255: | Lookup 0 | -> | Lookup 1 | |
79#                                                       |            +----------+    +----------+ |
80#                                                       |            |key&action|    |key&action| |
81#                                                       |            |    ..    |    |    ..    | |
82#                                                       |            +----------+    +----------+ |
83#                                                       +-----------------------------------------+
84#
85# Both the VCAP IS1 (Ingress Stage 1) and IS2 (Ingress Stage 2) are indexed
86# (looked up) multiple times: IS1 3 times, and IS2 2 times. Each filter
87# (key and action pair) can be configured to only match during the first, or
88# second, etc, lookup.
89#
90# During one TCAM lookup, the filter processing stops at the first entry that
91# matches, then the pipeline jumps to the next lookup.
92# The driver maps each individual lookup of each individual ingress TCAM to a
93# separate chain number. For correct rule offloading, it is mandatory that each
94# filter installed in one TCAM is terminated by a non-optional GOTO action to
95# the next lookup from the fixed pipeline.
96#
97# A chain can only be used if there is a GOTO action correctly set up from the
98# prior lookup in the processing pipeline. Setting up all chains is not
99# mandatory.
100
101# NOTE: VCAP IS1 currently uses only S1_NORMAL half keys and VCAP IS2
102# dynamically chooses between MAC_ETYPE, ARP, IP4_TCP_UDP, IP4_OTHER, which are
103# all half keys as well.
104
105create_tcam_skeleton()
106{
107	local eth=$1
108
109	tc qdisc add dev $eth clsact
110
111	# VCAP IS1 is the Ingress Classification TCAM and can offload the
112	# following actions:
113	# - skbedit priority
114	# - vlan pop
115	# - vlan modify
116	# - goto (only in lookup 2, the last IS1 lookup)
117	tc filter add dev $eth ingress chain 0 pref 49152 flower \
118		skip_sw action goto chain $(IS1 0)
119	tc filter add dev $eth ingress chain $(IS1 0) pref 49152 \
120		flower skip_sw action goto chain $(IS1 1)
121	tc filter add dev $eth ingress chain $(IS1 1) pref 49152 \
122		flower skip_sw action goto chain $(IS1 2)
123	tc filter add dev $eth ingress chain $(IS1 2) pref 49152 \
124		flower skip_sw action goto chain $(IS2 0 0)
125
126	# VCAP IS2 is the Security Enforcement ingress TCAM and can offload the
127	# following actions:
128	# - trap
129	# - drop
130	# - police
131	# The two VCAP IS2 lookups can be segmented into up to 256 groups of
132	# rules, called Policies. A Policy is selected through the Policy
133	# Association Group (PAG) action of VCAP IS1 (which is the
134	# GOTO offload).
135	tc filter add dev $eth ingress chain $(IS2 0 0) pref 49152 \
136		flower skip_sw action goto chain $(IS2 1 0)
137}
138
139setup_prepare()
140{
141	ip link set $swp1 up
142	ip link set $swp2 up
143	ip link set $h2 up
144	ip link set $h1 up
145
146	create_tcam_skeleton $swp1
147
148	ip link add br0 type bridge
149	ip link set $swp1 master br0
150	ip link set $swp2 master br0
151	ip link set br0 up
152
153	ip link add link $h1 name $h1.100 type vlan id 100
154	ip link set $h1.100 up
155
156	ip link add link $h1 name $h1.200 type vlan id 200
157	ip link set $h1.200 up
158
159	tc filter add dev $swp1 ingress chain $(IS1 1) pref 1 \
160		protocol 802.1Q flower skip_sw vlan_id 100 \
161		action vlan pop \
162		action goto chain $(IS1 2)
163
164	tc filter add dev $swp1 egress chain $(ES0) pref 1 \
165		flower skip_sw indev $swp2 \
166		action vlan push protocol 802.1Q id 100
167
168	tc filter add dev $swp1 ingress chain $(IS1 0) pref 2 \
169		protocol ipv4 flower skip_sw src_ip 10.1.1.2 \
170		action skbedit priority 7 \
171		action goto chain $(IS1 1)
172
173	tc filter add dev $swp1 ingress chain $(IS2 0 0) pref 1 \
174		protocol ipv4 flower skip_sw ip_proto udp dst_port 5201 \
175		action police rate 50mbit burst 64k conform-exceed drop/pipe \
176		action goto chain $(IS2 1 0)
177}
178
179cleanup()
180{
181	ip link del $h1.200
182	ip link del $h1.100
183	tc qdisc del dev $swp1 clsact
184	ip link del br0
185}
186
187test_vlan_pop()
188{
189	local h1_mac=$(mac_get $h1)
190	local h2_mac=$(mac_get $h2)
191
192	RET=0
193
194	tcpdump_start $h2
195
196	# Work around Mausezahn VLAN builder bug
197	# (https://github.com/netsniff-ng/netsniff-ng/issues/225) by using
198	# an 8021q upper
199	$MZ $h1.100 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip
200
201	sleep 1
202
203	tcpdump_stop $h2
204
205	tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, ethertype IPv4"
206	check_err "$?" "untagged reception"
207
208	tcpdump_cleanup $h2
209
210	log_test "VLAN pop"
211}
212
213test_vlan_push()
214{
215	local h1_mac=$(mac_get $h1)
216	local h2_mac=$(mac_get $h2)
217
218	RET=0
219
220	tcpdump_start $h1.100
221
222	$MZ $h2 -q -c 1 -p 64 -a $h2_mac -b $h1_mac -t ip
223
224	sleep 1
225
226	tcpdump_stop $h1.100
227
228	tcpdump_show $h1.100 | grep -q "$h2_mac > $h1_mac"
229	check_err "$?" "tagged reception"
230
231	tcpdump_cleanup $h1.100
232
233	log_test "VLAN push"
234}
235
236test_vlan_ingress_modify()
237{
238	local h1_mac=$(mac_get $h1)
239	local h2_mac=$(mac_get $h2)
240
241	RET=0
242
243	ip link set br0 type bridge vlan_filtering 1
244	bridge vlan add dev $swp1 vid 200
245	bridge vlan add dev $swp1 vid 300
246	bridge vlan add dev $swp2 vid 300
247
248	tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \
249		protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \
250		action vlan modify id 300 \
251		action goto chain $(IS2 0 0)
252
253	tcpdump_start $h2
254
255	$MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip
256
257	sleep 1
258
259	tcpdump_stop $h2
260
261	tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300"
262	check_err "$?" "tagged reception"
263
264	tcpdump_cleanup $h2
265
266	tc filter del dev $swp1 ingress chain $(IS1 2) pref 3
267
268	bridge vlan del dev $swp1 vid 200
269	bridge vlan del dev $swp1 vid 300
270	bridge vlan del dev $swp2 vid 300
271	ip link set br0 type bridge vlan_filtering 0
272
273	log_test "Ingress VLAN modification"
274}
275
276test_vlan_egress_modify()
277{
278	local h1_mac=$(mac_get $h1)
279	local h2_mac=$(mac_get $h2)
280
281	RET=0
282
283	tc qdisc add dev $swp2 clsact
284
285	ip link set br0 type bridge vlan_filtering 1
286	bridge vlan add dev $swp1 vid 200
287	bridge vlan add dev $swp2 vid 200
288
289	tc filter add dev $swp2 egress chain $(ES0) pref 3 \
290		protocol 802.1Q flower skip_sw vlan_id 200 vlan_prio 0 \
291		action vlan modify id 300 priority 7
292
293	tcpdump_start $h2
294
295	$MZ $h1.200 -q -c 1 -p 64 -a $h1_mac -b $h2_mac -t ip
296
297	sleep 1
298
299	tcpdump_stop $h2
300
301	tcpdump_show $h2 | grep -q "$h1_mac > $h2_mac, .* vlan 300"
302	check_err "$?" "tagged reception"
303
304	tcpdump_cleanup $h2
305
306	tc filter del dev $swp2 egress chain $(ES0) pref 3
307	tc qdisc del dev $swp2 clsact
308
309	bridge vlan del dev $swp1 vid 200
310	bridge vlan del dev $swp2 vid 200
311	ip link set br0 type bridge vlan_filtering 0
312
313	log_test "Egress VLAN modification"
314}
315
316test_skbedit_priority()
317{
318	local h1_mac=$(mac_get $h1)
319	local h2_mac=$(mac_get $h2)
320	local num_pkts=100
321
322	before=$(ethtool_stats_get $swp1 'rx_green_prio_7')
323
324	$MZ $h1 -q -c $num_pkts -p 64 -a $h1_mac -b $h2_mac -t ip -A 10.1.1.2
325
326	after=$(ethtool_stats_get $swp1 'rx_green_prio_7')
327
328	if [ $((after - before)) = $num_pkts ]; then
329		RET=0
330	else
331		RET=1
332	fi
333
334	log_test "Frame prioritization"
335}
336
337trap cleanup EXIT
338
339ALL_TESTS="
340	test_vlan_pop
341	test_vlan_push
342	test_vlan_ingress_modify
343	test_vlan_egress_modify
344	test_skbedit_priority
345"
346
347setup_prepare
348setup_wait
349
350tests_run
351
352exit $EXIT_STATUS
353