2 # SPDX-License-Identifier: GPL-2.0
4 # This test is for checking the A-TCAM and C-TCAM operation in Spectrum-2.
5 # It tries to exercise as many code paths in the eRP state machine as
8 lib_dir=$(dirname $0)/../../../../net/forwarding
10 ALL_TESTS="single_mask_test identical_filters_test two_masks_test \
11 multiple_masks_test ctcam_edge_cases_test"
13 source $lib_dir/tc_common.sh
14 source $lib_dir/lib.sh
20 simple_if_init $h1 192.0.2.1/24 198.51.100.1/24
25 simple_if_fini $h1 192.0.2.1/24 198.51.100.1/24
30 simple_if_init $h2 192.0.2.2/24 198.51.100.2/24
31 tc qdisc add dev $h2 clsact
36 tc qdisc del dev $h2 clsact
37 simple_if_fini $h2 192.0.2.2/24 198.51.100.2/24
42 # When only a single mask is required, the device uses the master
43 # mask and not the eRP table. Verify that under this mode the right
48 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
49 $tcflags dst_ip 192.0.2.2 action drop
51 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
54 tc_check_packets "dev $h2 ingress" 101 1
55 check_err $? "Single filter - did not match"
57 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
58 $tcflags dst_ip 198.51.100.2 action drop
60 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
63 tc_check_packets "dev $h2 ingress" 101 2
64 check_err $? "Two filters - did not match highest priority"
66 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \
69 tc_check_packets "dev $h2 ingress" 102 1
70 check_err $? "Two filters - did not match lowest priority"
72 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
74 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 198.51.100.1 -B 198.51.100.2 \
77 tc_check_packets "dev $h2 ingress" 102 2
78 check_err $? "Single filter - did not match after delete"
80 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
82 log_test "single mask test ($tcflags)"
85 identical_filters_test()
87 # When two filters that only differ in their priority are used,
88 # one needs to be inserted into the C-TCAM. This test verifies
89 # that filters are correctly spilled to C-TCAM and that the right
94 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
95 $tcflags dst_ip 192.0.2.2 action drop
96 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
97 $tcflags dst_ip 192.0.2.2 action drop
99 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
102 tc_check_packets "dev $h2 ingress" 101 1
103 check_err $? "Did not match A-TCAM filter"
105 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
107 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
110 tc_check_packets "dev $h2 ingress" 102 1
111 check_err $? "Did not match C-TCAM filter after A-TCAM delete"
113 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
114 $tcflags dst_ip 192.0.2.2 action drop
116 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
119 tc_check_packets "dev $h2 ingress" 102 2
120 check_err $? "Did not match C-TCAM filter after A-TCAM add"
122 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
124 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
127 tc_check_packets "dev $h2 ingress" 103 1
128 check_err $? "Did not match A-TCAM filter after C-TCAM delete"
130 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
132 log_test "identical filters test ($tcflags)"
137 # When more than one mask is required, the eRP table is used. This
138 # test verifies that the eRP table is correctly allocated and used
142 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
143 $tcflags dst_ip 192.0.2.2 action drop
144 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
145 $tcflags dst_ip 192.0.0.0/16 action drop
147 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
150 tc_check_packets "dev $h2 ingress" 101 1
151 check_err $? "Two filters - did not match highest priority"
153 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
155 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
158 tc_check_packets "dev $h2 ingress" 103 1
159 check_err $? "Single filter - did not match"
161 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
162 $tcflags dst_ip 192.0.2.0/24 action drop
164 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
167 tc_check_packets "dev $h2 ingress" 102 1
168 check_err $? "Two filters - did not match highest priority after add"
170 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
171 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
173 log_test "two masks test ($tcflags)"
176 multiple_masks_test()
178 # The number of masks in a region is limited. Once the maximum
179 # number of masks has been reached filters that require new
180 # masks are spilled to the C-TCAM. This test verifies that
181 # spillage is performed correctly and that the right filter is
191 for i in $(eval echo {1..$NUM_MASKS}); do
192 index=$((BASE_INDEX - i))
194 tc filter add dev $h2 ingress protocol ip pref $index \
196 flower $tcflags dst_ip 192.0.2.2/${i} src_ip 192.0.2.1 \
199 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 \
200 -B 192.0.2.2 -t ip -q
202 tc_check_packets "dev $h2 ingress" $index 1
203 check_err $? "$i filters - did not match highest priority (add)"
206 for i in $(eval echo {$NUM_MASKS..1}); do
207 index=$((BASE_INDEX - i))
209 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 \
210 -B 192.0.2.2 -t ip -q
212 tc_check_packets "dev $h2 ingress" $index 2
213 check_err $? "$i filters - did not match highest priority (del)"
215 tc filter del dev $h2 ingress protocol ip pref $index \
219 log_test "multiple masks test ($tcflags)"
222 ctcam_two_atcam_masks_test()
226 # First case: C-TCAM is disabled when there are two A-TCAM masks.
227 # We push a filter into the C-TCAM by using two identical filters
228 # as in identical_filters_test()
230 # Filter goes into A-TCAM
231 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
232 $tcflags dst_ip 192.0.2.2 action drop
233 # Filter goes into C-TCAM
234 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
235 $tcflags dst_ip 192.0.2.2 action drop
236 # Filter goes into A-TCAM
237 tc filter add dev $h2 ingress protocol ip pref 3 handle 103 flower \
238 $tcflags dst_ip 192.0.2.0/24 action drop
240 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
243 tc_check_packets "dev $h2 ingress" 101 1
244 check_err $? "Did not match A-TCAM filter"
246 # Delete both A-TCAM and C-TCAM filters and make sure the remaining
247 # A-TCAM filter still works
248 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
249 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
251 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
254 tc_check_packets "dev $h2 ingress" 103 1
255 check_err $? "Did not match A-TCAM filter"
257 tc filter del dev $h2 ingress protocol ip pref 3 handle 103 flower
259 log_test "ctcam with two atcam masks test ($tcflags)"
262 ctcam_one_atcam_mask_test()
266 # Second case: C-TCAM is disabled when there is one A-TCAM mask.
267 # The test is similar to identical_filters_test()
269 # Filter goes into A-TCAM
270 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
271 $tcflags dst_ip 192.0.2.2 action drop
272 # Filter goes into C-TCAM
273 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
274 $tcflags dst_ip 192.0.2.2 action drop
276 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
279 tc_check_packets "dev $h2 ingress" 101 1
280 check_err $? "Did not match C-TCAM filter"
282 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
284 $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \
287 tc_check_packets "dev $h2 ingress" 102 1
288 check_err $? "Did not match A-TCAM filter"
290 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
292 log_test "ctcam with one atcam mask test ($tcflags)"
295 ctcam_no_atcam_masks_test()
299 # Third case: C-TCAM is disabled when there are no A-TCAM masks
300 # This test exercises the code path that transitions the eRP table
301 # to its initial state after deleting the last C-TCAM mask
303 # Filter goes into A-TCAM
304 tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
305 $tcflags dst_ip 192.0.2.2 action drop
306 # Filter goes into C-TCAM
307 tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \
308 $tcflags dst_ip 192.0.2.2 action drop
310 tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
311 tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
313 log_test "ctcam with no atcam masks test ($tcflags)"
316 ctcam_edge_cases_test()
318 # When the C-TCAM is disabled after deleting the last C-TCAM
319 # mask, we want to make sure the eRP state machine is put in
322 ctcam_two_atcam_masks_test
323 ctcam_one_atcam_mask_test
324 ctcam_no_atcam_masks_test
357 if ! tc_offload_check; then
358 check_err 1 "Could not test offloaded functionality"
359 log_test "mlxsw-specific tests for tc flower"