mlxsw/spectrum-2/tc_flower.sh

4 # This test is for checking the A-TCAM and C-TCAM operation in Spectrum-2.
46 	local tracepoint=$1
55 	local tracepoint=$1
58 	perf record -a -q -e $tracepoint sleep $seconds
64 	local tracepoint=$1
72 	local tracepoint=$1
77 		return 1
84 	local tracepoint=$1
88 		return 1
95 	# When only a single mask is required, the device uses the master
101 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
104 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
107 	tc_check_packets "dev $h2 ingress" 101 1
113 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
119 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \
122 	tc_check_packets "dev $h2 ingress" 102 1
125 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
127 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \
147 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
152 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
155 	tc_check_packets "dev $h2 ingress" 101 1
156 	check_err $? "Did not match A-TCAM filter"
158 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
160 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
163 	tc_check_packets "dev $h2 ingress" 102 1
164 	check_err $? "Did not match C-TCAM filter after A-TCAM delete"
169 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
173 	check_err $? "Did not match C-TCAM filter after A-TCAM add"
177 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
180 	tc_check_packets "dev $h2 ingress" 103 1
181 	check_err $? "Did not match A-TCAM filter after C-TCAM delete"
195 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
200 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
203 	tc_check_packets "dev $h2 ingress" 101 1
206 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
208 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
211 	tc_check_packets "dev $h2 ingress" 103 1
217 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
220 	tc_check_packets "dev $h2 ingress" 102 1
231 	# The number of masks in a region is limited. Once the maximum
249 	for i in $(eval echo {1..$NUM_MASKS}); do
253 			exp_hits=1
270 		$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 \
273 		tc_check_packets "dev $h2 ingress" $index 1
277 	for i in $(eval echo {$NUM_MASKS..1}); do
280 		$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 \
297 	# First case: C-TCAM is disabled when there are two A-TCAM masks.
298 	# We push a filter into the C-TCAM by using two identical filters
301 	# Filter goes into A-TCAM
302 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
307 	# Filter goes into A-TCAM
311 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
314 	tc_check_packets "dev $h2 ingress" 101 1
315 	check_err $? "Did not match A-TCAM filter"
317 	# Delete both A-TCAM and C-TCAM filters and make sure the remaining
318 	# A-TCAM filter still works
320 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
322 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
325 	tc_check_packets "dev $h2 ingress" 103 1
326 	check_err $? "Did not match A-TCAM filter"
337 	# Second case: C-TCAM is disabled when there is one A-TCAM mask.
340 	# Filter goes into A-TCAM
344 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
347 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
350 	tc_check_packets "dev $h2 ingress" 101 1
353 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
355 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
358 	tc_check_packets "dev $h2 ingress" 102 1
359 	check_err $? "Did not match A-TCAM filter"
370 	# Third case: C-TCAM is disabled when there are no A-TCAM masks
374 	# Filter goes into A-TCAM
375 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
381 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
411 		   pref 1 handle 101 flower $tcflags dst_ip 192.0.0.0/24 \
413 	tp_check_hits "objagg:objagg_obj_root_create" 1
421 	tp_check_hits "objagg:objagg_obj_parent_assign" 1
424 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
427 	tc_check_packets "dev $h2 ingress" 101 1
428 	check_fail $? "Matched a wrong filter"
430 	tc_check_packets "dev $h2 ingress" 102 1
434 		   pref 1 handle 101 flower"
440 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
448 	tp_check_hits "objagg:objagg_obj_parent_unassign" 1
450 	tp_check_hits "objagg:objagg_obj_root_destroy" 1
458 	# If 2 keys are the same and only differ in mask in a way that
469 		   pref 1 handle 101 flower $tcflags dst_ip 192.0.2.0/24 \
477 	tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 1
480 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
483 	tc_check_packets "dev $h2 ingress" 101 1
486 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
488 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
491 	tc_check_packets "dev $h2 ingress" 102 1
519 	sleep 1
521 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
528 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
531 	tc_check_packets "dev $h2 ingress" 101 1
532 	check_fail $? "Matched a wrong filter"
534 	tc_check_packets "dev $h2 ingress" 103 1
535 	check_fail $? "Matched a wrong filter"
537 	tc_check_packets "dev $h2 ingress" 102 1
555 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
558 	tc_check_packets "dev $h2 ingress" 101 1
559 	check_fail $? "Matched a wrong filter after rehash"
561 	tc_check_packets "dev $h2 ingress" 103 1
562 	check_fail $? "Matched a wrong filter after rehash"
569 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
594 	sleep 1
596 	tc filter add dev $h2 ingress protocol ipv6 pref 1 handle 101 flower \
597 		$tcflags dst_ip 2001:db8:1::0/121 action drop
603 	$MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \
604 		-A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q
606 	tc_check_packets "dev $h2 ingress" 101 1
607 	check_fail $? "Matched a wrong filter"
609 	tc_check_packets "dev $h2 ingress" 103 1
610 	check_fail $? "Matched a wrong filter"
612 	tc_check_packets "dev $h2 ingress" 102 1
630 	$MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \
631 		-A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q
633 	tc_check_packets "dev $h2 ingress" 101 1
634 	check_fail $? "Matched a wrong filter after rehash"
636 	tc_check_packets "dev $h2 ingress" 103 1
637 	check_fail $? "Matched a wrong filter after rehash"
644 	tc filter del dev $h2 ingress protocol ipv6 pref 1 handle 101 flower
650 declare -a test_rules_inserted
654 	local iface=$1
668 	batch="${batch}filter add dev $iface ingress protocol ipv6 pref 1 \
670 		src_ip 2001:db8:1::$hexnumber action drop\n"
676 	local iface=$1
689 	batch="${batch}filter del dev $iface ingress protocol ipv6 pref 1 \
696 	local iface=$1
712 	local iface=$1
720 	for ((i=1;i<=total_count;i++)); do
722 			((skip=$RANDOM % $MAXSKIP + 1))
723 			((count=$RANDOM % $MAXCOUNT + 1))
726 			((skip-=1))
728 			((count-=1))
763 	sleep 1
765 	tc filter add dev $h2 ingress protocol ipv6 pref 1 handle 101 flower \
766 		$tcflags dst_ip 2001:db8:1::0/121 action drop
772 	$MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \
773 		-A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q
775 	tc_check_packets "dev $h2 ingress" 101 1
776 	check_fail $? "Matched a wrong filter"
778 	tc_check_packets "dev $h2 ingress" 103 1
779 	check_fail $? "Matched a wrong filter"
781 	tc_check_packets "dev $h2 ingress" 102 1
790 	$MZ $h1 -6 -c 1 -p 64 -a $h1mac -b $h2mac \
791 		-A 2001:db8:2::1 -B 2001:db8:2::2 -t udp -q
793 	tc_check_packets "dev $h2 ingress" 101 1
794 	check_fail $? "Matched a wrong filter after rehash"
796 	tc_check_packets "dev $h2 ingress" 103 1
797 	check_fail $? "Matched a wrong filter after rehash"
804 	tc filter del dev $h2 ingress protocol ipv6 pref 1 handle 101 flower
807 	for i in {1..5000}; do
820 	# which are distant enough and will result skipping a lookup after
826 	tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
833 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
836 	tc_check_packets "dev $h2 ingress" 101 1
839 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \
842 	tc_check_packets "dev $h2 ingress" 104 1
845 	tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
847 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
850 	tc_check_packets "dev $h2 ingress" 103 1
856 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \
859 	tc_check_packets "dev $h2 ingress" 102 1
873 	# of the Bloom filter code, use a series of regions, each with a
882 	tc chain add dev $h2 ingress chain 1 protocol ip flower \
898 	# so create a dummy rule per chain using a different pattern
900 		index=$((BASE_INDEX - 1 - i))
906 	# Add rules to test Bloom filter, each in a different chain
909 		pref 1 handle $((++index)) flower \
910 		$tcflags dst_ip 192.0.0.0/16 action goto chain 1
911 	tc filter add dev $h2 ingress chain 1 protocol ip \
912 		pref 1 handle $((++index)) flower \
915 		pref 1 handle $((++index)) flower \
918 		pref 1 handle $((++index)) flower \
921 		pref 1 handle $((++index)) flower \
924 	# Send a packet that is supposed to hit all chains
925 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
929 		index=$((BASE_INDEX + i + 1))
930 		tc_check_packets "dev $h2 ingress" $index 1
936 		index=$((BASE_INDEX - i - 1))
939 		index=$((BASE_INDEX + i + 1))
941 			pref 1 handle $index flower
945 	for i in $(eval echo {$NUM_CHAINS..1}); do
966 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.1.2.1 -B 192.1.2.2 \
969 	tc_check_packets "dev $h2 ingress" 103 1
975 	$MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.2.1.1 -B 192.2.1.2 \
978 	tc_check_packets "dev $h2 ingress" 102 1
1005 	for ((i=1; i < $num_regions; i++)); do
1025 	for ((; i >= 1; i--)); do
1053 	for ((i=1; i < $num_acls; i++)); do
1054 		if [[ $(( i % 2 )) == 1 ]]; then
1061 				flower $tcflags dst_ip 2001:db8:1::1/128 \
1066 		[[ $ret -ne 0 ]] && max_size=$((i - 1)) && break
1069 	# We expect to exceed the maximum number of ACLs in a group, so that
1072 	check_fail $ret "expected to exceed number of ACLs in a group"
1074 	for ((; i >= 1; i--)); do
1075 		if [[ $(( i % 2 )) == 1 ]]; then
1082 				flower $tcflags dst_ip 2001:db8:1::1/128 \
1096 	# leading to collisions and a reduced scale.
1098 	# Create such a scenario and make sure all the filters are successfully
1109 	# Add a single dst_ip/24 filter and multiple dst_ip/32 filters that all
1112 	tc filter add dev $h2 ingress pref 1 proto ipv4 handle 101 \
1132 	tc filter del dev $h2 ingress pref 1 proto ipv4 handle 101 flower
1168 	check_err 1 "Could not test offloaded functionality"