xref: /dflybsd-src/sys/net/bridge/if_bridge.c (revision b272101acc636ac635f83d03265ef6a44a3ba51a)

/*
 * Copyright 2001 Wasabi Systems, Inc.
 * All rights reserved.
 *
 * Written by Jason R. Thorpe for Wasabi Systems, Inc.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed for the NetBSD Project by
 *	Wasabi Systems, Inc.
 * 4. The name of Wasabi Systems, Inc. may not be used to endorse
 *    or promote products derived from this software without specific prior
 *    written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed by Jason L. Wright
 * 4. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
 * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
 * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
 */

/*
 * Network interface bridge support.
 *
 * TODO:
 *
 *	- Currently only supports Ethernet-like interfaces (Ethernet,
 *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
 *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
 *	  consider heterogenous bridges).
 *
 *
 * Bridge's route information is duplicated to each CPUs:
 *
 *      CPU0          CPU1          CPU2          CPU3
 * +-----------+ +-----------+ +-----------+ +-----------+
 * |  rtnode   | |  rtnode   | |  rtnode   | |  rtnode   |
 * |           | |           | |           | |           |
 * | dst eaddr | | dst eaddr | | dst eaddr | | dst eaddr |
 * +-----------+ +-----------+ +-----------+ +-----------+
 *       |         |                     |         |
 *       |         |                     |         |
 *       |         |     +----------+    |         |
 *       |         |     |  rtinfo  |    |         |
 *       |         +---->|          |<---+         |
 *       |               |  flags   |              |
 *       +-------------->|  timeout |<-------------+
 *                       |  dst_ifp |
 *                       +----------+
 *
 * We choose to put timeout and dst_ifp into shared part, so updating
 * them will be cheaper than using message forwarding.  Also there is
 * not need to use spinlock to protect the updating: timeout and dst_ifp
 * is not related and specific field's updating order has no importance.
 * The cache pollution by the share part should not be heavy: in a stable
 * setup, dst_ifp probably will be not changed in rtnode's life time,
 * while timeout is refreshed once per second; most of the time, timeout
 * and dst_ifp are read-only accessed.
 *
 *
 * Bridge route information installation on bridge_input path:
 *
 *      CPU0           CPU1         CPU2          CPU3
 *
 *                                 netisr2
 *                                    |
 *                                alloc nmsg
 *                    snd nmsg        |
 *                    w/o rtinfo      |
 *     netisr0<-----------------------+
 *        |                           :
 *    lookup dst                      :
 *   rtnode exists?(Y)free nmsg       :
 *        |(N)                        :
 *        |                           :
 *  alloc rtinfo                      :
 *  alloc rtnode                      :
 * install rtnode                     :
 *        |                           :
 *        +---------->netisr1         :
 *        : fwd nmsg     |            :
 *        : w/ rtinfo    |            :
 *        :              |            :
 *        :              |            :
 *                  alloc rtnode      :
 *                (w/ nmsg's rtinfo)  :
 *                 install rtnode     :
 *                       |            :
 *                       +----------->|
 *                       : fwd nmsg   |
 *                       : w/ rtinfo  |
 *                       :            |
 *                       :     same as netisr1
 *                                    |
 *                                    +---------->netisr3
 *                                    : fwd nmsg     |
 *                                    : w/ rtinfo    |
 *                                    :              |
 *                                    :       same as netisr1
 *                                               free nmsg
 *                                                   :
 *                                                   :
 *
 * The netmsgs forwarded between netisr2 are allocated with
 * (M_WAITOK|M_NULLOK), so it will not fail under most cases (route
 * information is too precious to be not installed :).  Since multiple
 * netisrs may try to install route information for the same dst eaddr,
 * we look up route information in netisr0.  However, this looking up
 * only need to be performed on netisr0, which is the start point of
 * the route information installation process.
 *
 *
 * Bridge route information deleting/flushing:
 *
 *  CPU0            CPU1              CPU2             CPU3
 *
 * netisr0
 *    |
 *  find suitable rtnodes,
 *  mark their rtinfo dead
 *    |
 *    | domsg <-------------------------------------------+
 *    : delete rtnodes                                    | replymsg
 *    : w/ dead rtinfo                                    |
 *    :                                                   |
 *    :  fwdmsg             fwdmsg            fwdmsg      |
 *    :----------> netisr1 --------> netisr2 --------> netisr3
 *              delete rtnodes    delete rtnodes    delete rtnodes
 *              w/ dead rtinfo    w/ dead rtinfo    w/ dead rtinfo
 *                                                 free dead rtinfos
 *
 * All deleting/flushing operations are serialized by netisr0, so each
 * operation only reaps the route information marked dead by itself.
 *
 *
 * Bridge route information adding/deleting/flushing:
 * Since all operation is serialized by the fixed message flow between
 * netisrs, it is not possible to create corrupted per-cpu route
 * information.
 *
 *
 *
 * XXX This no longer applies.
 * Percpu member interface list iteration with blocking operation:
 * Since one bridge could only delete one member interface at a time and
 * the deleted member interface is not freed after netmsg_service_sync(),
 * following way is used to make sure that even if the certain member
 * interface is ripped from the percpu list during the blocking operation,
 * the iteration still could keep going:
 *
 * TAILQ_FOREACH_MUTABLE(bif, sc->sc_iflists[mycpuid], bif_next, nbif) {
 *     blocking operation;
 *     blocking operation;
 *     ...
 *     ...
 *     if (nbif != NULL && !nbif->bif_onlist) {
 *         KKASSERT(bif->bif_onlist);
 *         nbif = TAILQ_NEXT(bif, bif_next);
 *     }
 * }
 *
 * As mentioned above only one member interface could be unlinked from the
 * percpu member interface list, so either bif or nbif may be not on the list,
 * but _not_ both.  To keep the list iteration, we don't care about bif, but
 * only nbif.  Since removed member interface will only be freed after we
 * finish our work, it is safe to access any field in an unlinked bif (here
 * bif_onlist).  If nbif is no longer on the list, then bif must be on the
 * list, so we change nbif to the next element of bif and keep going.
 */

#include "opt_inet.h"
#include "opt_inet6.h"

#include <sys/param.h>
#include <sys/mbuf.h>
#include <sys/malloc.h>
#include <sys/protosw.h>
#include <sys/systm.h>
#include <sys/time.h>
#include <sys/socket.h> /* for net/if.h */
#include <sys/sockio.h>
#include <sys/ctype.h>  /* string functions */
#include <sys/kernel.h>
#include <sys/random.h>
#include <sys/sysctl.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/caps.h>
#include <sys/lock.h>
#include <sys/thread.h>
#include <sys/thread2.h>
#include <sys/mpipe.h>

#include <net/bpf.h>
#include <net/if.h>
#include <net/if_dl.h>
#include <net/if_types.h>
#include <net/if_var.h>
#include <net/pfil.h>
#include <net/ifq_var.h>
#include <net/if_clone.h>

#include <netinet/in.h> /* for struct arpcom */
#include <netinet/in_systm.h>
#include <netinet/in_var.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#ifdef INET6
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#endif
#include <netinet/if_ether.h> /* for struct arpcom */
#include <net/bridge/if_bridgevar.h>
#include <net/if_llc.h>
#include <net/netmsg2.h>
#include <net/netisr2.h>

#include <net/route.h>
#include <sys/in_cksum.h>

/*
 * Size of the route hash table.  Must be a power of two.
 */
#ifndef BRIDGE_RTHASH_SIZE
#define	BRIDGE_RTHASH_SIZE		1024
#endif

#define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)

/*
 * Maximum number of addresses to cache.
 */
#ifndef BRIDGE_RTABLE_MAX
#define	BRIDGE_RTABLE_MAX		4096
#endif

/*
 * Spanning tree defaults.
 */
#define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
#define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
#define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
#define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
#define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
#define	BSTP_DEFAULT_PORT_PRIORITY	0x80
#define	BSTP_DEFAULT_PATH_COST		55

/*
 * Timeout (in seconds) for entries learned dynamically.
 */
#ifndef BRIDGE_RTABLE_TIMEOUT
#define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
#endif

/*
 * Number of seconds between walks of the route list.
 */
#ifndef BRIDGE_RTABLE_PRUNE_PERIOD
#define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
#endif

/*
 * List of capabilities to mask on the member interface.
 */
#define	BRIDGE_IFCAPS_MASK		(IFCAP_TXCSUM | IFCAP_TSO)

typedef int	(*bridge_ctl_t)(struct bridge_softc *, void *);

struct netmsg_brctl {
	struct netmsg_base	base;
	bridge_ctl_t		bc_func;
	struct bridge_softc	*bc_sc;
	void			*bc_arg;
};

struct netmsg_brsaddr {
	struct netmsg_base	base;
	struct bridge_softc	*br_softc;
	struct ifnet		*br_dst_if;
	struct bridge_rtinfo	*br_rtinfo;
	int			br_setflags;
	uint8_t			br_dst[ETHER_ADDR_LEN];
	uint8_t			br_flags;
};

struct netmsg_braddbif {
	struct netmsg_base	base;
	struct bridge_softc	*br_softc;
	struct bridge_ifinfo	*br_bif_info;
	struct ifnet		*br_bif_ifp;
};

struct netmsg_brdelbif {
	struct netmsg_base	base;
	struct bridge_softc	*br_softc;
	struct bridge_ifinfo	*br_bif_info;
	struct bridge_iflist_head *br_bif_list;
};

struct netmsg_brsflags {
	struct netmsg_base	base;
	struct bridge_softc	*br_softc;
	struct bridge_ifinfo	*br_bif_info;
	uint32_t		br_bif_flags;
};

eventhandler_tag	bridge_detach_cookie = NULL;

extern	struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
extern	int (*bridge_output_p)(struct ifnet *, struct mbuf *);
extern	void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
extern  struct ifnet *(*bridge_interface_p)(void *if_bridge);

static int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;

static int	bridge_clone_create(struct if_clone *, int, caddr_t, caddr_t);
static int	bridge_clone_destroy(struct ifnet *);

static int	bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
static void	bridge_mutecaps(struct bridge_ifinfo *, struct ifnet *, int);
static void	bridge_ifdetach(void *, struct ifnet *);
static void	bridge_init(void *);
static int	bridge_from_us(struct bridge_softc *, struct ether_header *);
static void	bridge_stop(struct ifnet *);
static void	bridge_start(struct ifnet *, struct ifaltq_subque *);
static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
static int	bridge_output(struct ifnet *, struct mbuf *);
static struct ifnet *bridge_interface(void *if_bridge);

static void	bridge_forward(struct bridge_softc *, struct mbuf *m);

static void	bridge_timer_handler(netmsg_t);
static void	bridge_timer(void *);

static void	bridge_start_bcast(struct bridge_softc *, struct mbuf *);
static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
		    struct mbuf *);
static void	bridge_span(struct bridge_softc *, struct mbuf *);

static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
		    struct ifnet *, uint8_t);
static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
static void	bridge_rtreap(struct bridge_softc *);
static void	bridge_rtreap_async(struct bridge_softc *);
static void	bridge_rttrim(struct bridge_softc *);
static int	bridge_rtage_finddead(struct bridge_softc *);
static void	bridge_rtage(struct bridge_softc *);
static void	bridge_rtflush(struct bridge_softc *, int);
static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
static int	bridge_rtsaddr(struct bridge_softc *, const uint8_t *,
		    struct ifnet *, uint8_t);
static void	bridge_rtmsg_sync(struct bridge_softc *sc);
static void	bridge_rtreap_handler(netmsg_t);
static void	bridge_rtinstall_handler(netmsg_t);
static int	bridge_rtinstall_oncpu(struct bridge_softc *, const uint8_t *,
		    struct ifnet *, int, uint8_t, struct bridge_rtinfo **);

static void	bridge_rtable_init(struct bridge_softc *);
static void	bridge_rtable_fini(struct bridge_softc *);

static int	bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
		    const uint8_t *);
static void	bridge_rtnode_insert(struct bridge_softc *,
		    struct bridge_rtnode *);
static void	bridge_rtnode_destroy(struct bridge_softc *,
		    struct bridge_rtnode *);

static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
		    const char *name);
static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
		    struct ifnet *ifp);
static struct bridge_iflist *bridge_lookup_member_ifinfo(struct bridge_softc *,
		    struct bridge_ifinfo *);
static void	bridge_delete_member(struct bridge_softc *,
		    struct bridge_iflist *, int);
static void	bridge_delete_span(struct bridge_softc *,
		    struct bridge_iflist *);

static int	bridge_control(struct bridge_softc *, u_long,
			       bridge_ctl_t, void *);
static int	bridge_ioctl_init(struct bridge_softc *, void *);
static int	bridge_ioctl_stop(struct bridge_softc *, void *);
static int	bridge_ioctl_add(struct bridge_softc *, void *);
static int	bridge_ioctl_del(struct bridge_softc *, void *);
static void	bridge_ioctl_fillflags(struct bridge_softc *sc,
				struct bridge_iflist *bif, struct ifbreq *req);
static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
static int	bridge_ioctl_scache(struct bridge_softc *, void *);
static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
static int	bridge_ioctl_rts(struct bridge_softc *, void *);
static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
static int	bridge_ioctl_sto(struct bridge_softc *, void *);
static int	bridge_ioctl_gto(struct bridge_softc *, void *);
static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
static int	bridge_ioctl_flush(struct bridge_softc *, void *);
static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
static int	bridge_ioctl_spri(struct bridge_softc *, void *);
static int	bridge_ioctl_reinit(struct bridge_softc *, void *);
static int	bridge_ioctl_ght(struct bridge_softc *, void *);
static int	bridge_ioctl_sht(struct bridge_softc *, void *);
static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
static int	bridge_ioctl_gma(struct bridge_softc *, void *);
static int	bridge_ioctl_sma(struct bridge_softc *, void *);
static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
static int	bridge_ioctl_addspan(struct bridge_softc *, void *);
static int	bridge_ioctl_delspan(struct bridge_softc *, void *);
static int	bridge_ioctl_sifbondwght(struct bridge_softc *, void *);
static int	bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
		    int);
static int	bridge_ip_checkbasic(struct mbuf **mp);
#ifdef INET6
static int	bridge_ip6_checkbasic(struct mbuf **mp);
#endif /* INET6 */
static int	bridge_fragment(struct ifnet *, struct mbuf *,
		    struct ether_header *, int, struct llc *);
static void	bridge_enqueue_handler(netmsg_t);
static void	bridge_handoff(struct bridge_softc *, struct ifnet *,
		    struct mbuf *, int);

static void	bridge_del_bif_handler(netmsg_t);
static void	bridge_add_bif_handler(netmsg_t);
static void	bridge_del_bif(struct bridge_softc *, struct bridge_ifinfo *,
		    struct bridge_iflist_head *);
static void	bridge_add_bif(struct bridge_softc *, struct bridge_ifinfo *,
		    struct ifnet *);

SYSCTL_DECL(_net_link);
SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");

static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
static int pfil_member = 1; /* run pfil hooks on the member interface */
static int bridge_debug;
SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
    &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
    &pfil_bridge, 0, "Packet filter on the bridge interface");
SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
    &pfil_member, 0, "Packet filter on the member interface");
SYSCTL_INT(_net_link_bridge, OID_AUTO, debug, CTLFLAG_RW,
    &bridge_debug, 0, "Bridge debug mode");

struct bridge_control_arg {
	union {
		struct ifbreq ifbreq;
		struct ifbifconf ifbifconf;
		struct ifbareq ifbareq;
		struct ifbaconf ifbaconf;
		struct ifbrparam ifbrparam;
	} bca_u;
	int	bca_len;
	void	*bca_uptr;
	void	*bca_kptr;
};

struct bridge_control {
	bridge_ctl_t	bc_func;
	int		bc_argsize;
	int		bc_flags;
};

#define	BC_F_COPYIN		0x01	/* copy arguments in */
#define	BC_F_COPYOUT		0x02	/* copy arguments out */
#define	BC_F_SUSER		0x04	/* do super-user check */

const struct bridge_control bridge_control_table[] = {
	{ bridge_ioctl_add,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },
	{ bridge_ioctl_del,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_COPYOUT },
	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
	  BC_F_COPYIN|BC_F_SUSER },
	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
	  BC_F_COPYOUT },

	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
	  BC_F_COPYIN|BC_F_COPYOUT },
	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
	  BC_F_COPYIN|BC_F_COPYOUT },

	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
	  BC_F_COPYIN|BC_F_SUSER },
	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
	  BC_F_COPYOUT },

	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
	  BC_F_COPYOUT },
	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
	  BC_F_COPYOUT },
	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
	  BC_F_COPYOUT },
	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
	  BC_F_COPYOUT },
	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_addspan,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },
	{ bridge_ioctl_delspan,		sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

	{ bridge_ioctl_sifbondwght,	sizeof(struct ifbreq),
	  BC_F_COPYIN|BC_F_SUSER },

};
static const int bridge_control_table_size = NELEM(bridge_control_table);

LIST_HEAD(, bridge_softc) bridge_list;

struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
				bridge_clone_create,
				bridge_clone_destroy, 0, IF_MAXUNIT);

static int
bridge_modevent(module_t mod, int type, void *data)
{
	switch (type) {
	case MOD_LOAD:
		LIST_INIT(&bridge_list);
		if_clone_attach(&bridge_cloner);
		bridge_input_p = bridge_input;
		bridge_output_p = bridge_output;
		bridge_interface_p = bridge_interface;
		bridge_detach_cookie = EVENTHANDLER_REGISTER(
		    ifnet_detach_event, bridge_ifdetach, NULL,
		    EVENTHANDLER_PRI_ANY);
#if 0 /* notyet */
		bstp_linkstate_p = bstp_linkstate;
#endif
		break;
	case MOD_UNLOAD:
		if (!LIST_EMPTY(&bridge_list))
			return (EBUSY);
		EVENTHANDLER_DEREGISTER(ifnet_detach_event,
		    bridge_detach_cookie);
		if_clone_detach(&bridge_cloner);
		bridge_input_p = NULL;
		bridge_output_p = NULL;
		bridge_interface_p = NULL;
#if 0 /* notyet */
		bstp_linkstate_p = NULL;
#endif
		break;
	default:
		return (EOPNOTSUPP);
	}
	return (0);
}

static moduledata_t bridge_mod = {
	"if_bridge",
	bridge_modevent,
	0
};

DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);

/*#define BRIDGE_DEBUG_ENABLE*/
#ifdef BRIDGE_DEBUG_ENABLE

static void
BRIDGE_DEBUG(const char *str, struct ifnet *src_if, struct ifnet *dst_if,
             struct mbuf *m)
{
	if ((bridge_debug & 2) == 0)
		return;

	if (str)
		kprintf("%s", str);
	if (src_if)
		kprintf(" src={%s,%s%d}",
			src_if->if_xname, src_if->if_dname, src_if->if_dunit);
	if (dst_if)
		kprintf(" dst={%s,%s%d}",
			dst_if->if_xname, dst_if->if_dname, dst_if->if_dunit);
	if (m) {
		struct ether_header *eh;
		struct ip *ip;

		eh = mtod(m, struct ether_header *);

		kprintf(" %02x:%02x:%02x:%02x:%02x:%02x "
			"%02x:%02x:%02x:%02x:%02x:%02x type %04x ",
			eh->ether_dhost[0],
			eh->ether_dhost[1],
			eh->ether_dhost[2],
			eh->ether_dhost[3],
			eh->ether_dhost[4],
			eh->ether_dhost[5],
			eh->ether_shost[0],
			eh->ether_shost[1],
			eh->ether_shost[2],
			eh->ether_shost[3],
			eh->ether_shost[4],
			eh->ether_shost[5],
			eh->ether_type);
		ip = (void *)(eh + 1);
		kprintf("%u.%u.%u.%u -> %u.%u.%u.%u",
			(uint8_t)(ip->ip_src.s_addr >> 24),
			(uint8_t)(ip->ip_src.s_addr >> 16),
			(uint8_t)(ip->ip_src.s_addr >> 8),
			(uint8_t)(ip->ip_src.s_addr),
			(uint8_t)(ip->ip_dst.s_addr >> 24),
			(uint8_t)(ip->ip_dst.s_addr >> 16),
			(uint8_t)(ip->ip_dst.s_addr >> 8),
			(uint8_t)(ip->ip_dst.s_addr));
		kprintf("\n");
	}
}

#else

#define BRIDGE_DEBUG(ctl, sif, dif, m)

#endif

/*
 * bridge_clone_create:
 *
 *	Create a new bridge instance.
 */
static int
bridge_clone_create(struct if_clone *ifc, int unit,
		    caddr_t params __unused, caddr_t data __unused)
{
	struct bridge_softc *sc;
	struct ifnet *ifp;
	u_char eaddr[6];
	int cpu, rnd;

	sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK | M_ZERO);
	ifp = sc->sc_ifp = &sc->sc_if;

	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;

	/* Initialize our routing table. */
	bridge_rtable_init(sc);

	callout_init_mp(&sc->sc_brcallout);
	netmsg_init(&sc->sc_brtimemsg, NULL, &netisr_adone_rport,
		    MSGF_DROPABLE, bridge_timer_handler);
	sc->sc_brtimemsg.lmsg.u.ms_resultp = sc;

	callout_init_mp(&sc->sc_bstpcallout);
	netmsg_init(&sc->sc_bstptimemsg, NULL, &netisr_adone_rport,
		    MSGF_DROPABLE, bstp_tick_handler);
	sc->sc_bstptimemsg.lmsg.u.ms_resultp = sc;

	/* Initialize per-cpu member iface lists */
	sc->sc_iflists = kmalloc(sizeof(*sc->sc_iflists) * netisr_ncpus,
				 M_DEVBUF, M_WAITOK);
	for (cpu = 0; cpu < netisr_ncpus; ++cpu)
		TAILQ_INIT(&sc->sc_iflists[cpu]);

	TAILQ_INIT(&sc->sc_spanlist);

	ifp->if_softc = sc;
	if_initname(ifp, ifc->ifc_name, unit);
	ifp->if_mtu = ETHERMTU;
	ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST | IFF_ISBRIDGE;
	ifp->if_ioctl = bridge_ioctl;
	ifp->if_start = bridge_start;
	ifp->if_init = bridge_init;
	ifp->if_type = IFT_ETHER;
	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
	ifq_set_ready(&ifp->if_snd);
	ifp->if_hdrlen = ETHER_HDR_LEN;

	/*
	 * Generate a random ethernet address and use the private AC:DE:48
	 * OUI code.
	 */
	rnd = karc4random();
	bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
	rnd = karc4random();
	bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */

	eaddr[0] &= ~1;	/* clear multicast bit */
	eaddr[0] |= 2;	/* set the LAA bit */

	ether_ifattach(ifp, eaddr, NULL);
	/* Now undo some of the damage... */
	ifp->if_baudrate = 0;
	/*ifp->if_type = IFT_BRIDGE;*/

	crit_enter();	/* XXX MP */
	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
	crit_exit();

	return (0);
}

static void
bridge_delete_dispatch(netmsg_t msg)
{
	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
	struct ifnet *bifp = sc->sc_ifp;
	struct bridge_iflist *bif;

	ifnet_serialize_all(bifp);

	while ((bif = TAILQ_FIRST(&sc->sc_iflists[mycpuid])) != NULL)
		bridge_delete_member(sc, bif, 0);

	while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL)
		bridge_delete_span(sc, bif);

	ifnet_deserialize_all(bifp);

	lwkt_replymsg(&msg->lmsg, 0);
}

/*
 * bridge_clone_destroy:
 *
 *	Destroy a bridge instance.
 */
static int
bridge_clone_destroy(struct ifnet *ifp)
{
	struct bridge_softc *sc = ifp->if_softc;
	struct netmsg_base msg;

	ifnet_serialize_all(ifp);

	bridge_stop(ifp);
	ifp->if_flags &= ~IFF_UP;

	ifnet_deserialize_all(ifp);

	netmsg_init(&msg, NULL, &curthread->td_msgport,
		    0, bridge_delete_dispatch);
	msg.lmsg.u.ms_resultp = sc;
	lwkt_domsg(BRIDGE_CFGPORT, &msg.lmsg, 0);

	crit_enter();	/* XXX MP */
	LIST_REMOVE(sc, sc_list);
	crit_exit();

	ether_ifdetach(ifp);

	/* Tear down the routing table. */
	bridge_rtable_fini(sc);

	/* Free per-cpu member iface lists */
	kfree(sc->sc_iflists, M_DEVBUF);

	kfree(sc, M_DEVBUF);

	return 0;
}

/*
 * bridge_ioctl:
 *
 *	Handle a control request from the operator.
 */
static int
bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
{
	struct bridge_softc *sc = ifp->if_softc;
	struct bridge_control_arg args;
	struct ifdrv *ifd = (struct ifdrv *) data;
	const struct bridge_control *bc;
	int error = 0;

	ASSERT_IFNET_SERIALIZED_ALL(ifp);

	switch (cmd) {
	case SIOCADDMULTI:
	case SIOCDELMULTI:
		break;

	case SIOCGDRVSPEC:
	case SIOCSDRVSPEC:
		if (ifd->ifd_cmd >= bridge_control_table_size) {
			error = EINVAL;
			break;
		}
		bc = &bridge_control_table[ifd->ifd_cmd];

		if (cmd == SIOCGDRVSPEC &&
		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
			error = EINVAL;
			break;
		} else if (cmd == SIOCSDRVSPEC &&
			   (bc->bc_flags & BC_F_COPYOUT)) {
			error = EINVAL;
			break;
		}

		if (bc->bc_flags & BC_F_SUSER) {
			error = caps_priv_check(cr, SYSCAP_RESTRICTEDROOT |
						    __SYSCAP_NULLCRED);
			if (error)
				break;
		}

		if (ifd->ifd_len != bc->bc_argsize ||
		    ifd->ifd_len > sizeof(args.bca_u)) {
			error = EINVAL;
			break;
		}

		memset(&args, 0, sizeof(args));
		if (bc->bc_flags & BC_F_COPYIN) {
			error = copyin(ifd->ifd_data, &args.bca_u,
				       ifd->ifd_len);
			if (error)
				break;
		}

		error = bridge_control(sc, cmd, bc->bc_func, &args);
		if (error) {
			KKASSERT(args.bca_len == 0 && args.bca_kptr == NULL);
			break;
		}

		if (bc->bc_flags & BC_F_COPYOUT) {
			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
			if (args.bca_len != 0) {
				KKASSERT(args.bca_kptr != NULL);
				if (!error) {
					error = copyout(args.bca_kptr,
						args.bca_uptr, args.bca_len);
				}
				kfree(args.bca_kptr, M_TEMP);
			} else {
				KKASSERT(args.bca_kptr == NULL);
			}
		} else {
			KKASSERT(args.bca_len == 0 && args.bca_kptr == NULL);
		}
		break;

	case SIOCSIFFLAGS:
		if (!(ifp->if_flags & IFF_UP) &&
		    (ifp->if_flags & IFF_RUNNING)) {
			/*
			 * If interface is marked down and it is running,
			 * then stop it.
			 */
			bridge_stop(ifp);
		} else if ((ifp->if_flags & IFF_UP) &&
		    !(ifp->if_flags & IFF_RUNNING)) {
			/*
			 * If interface is marked up and it is stopped, then
			 * start it.
			 */
			ifp->if_init(sc);
		}

		/*
		 * If running and link flag state change we have to
		 * reinitialize as well.
		 */
		if ((ifp->if_flags & IFF_RUNNING) &&
		    (ifp->if_flags & (IFF_LINK0|IFF_LINK1|IFF_LINK2)) !=
		    sc->sc_copy_flags) {
			sc->sc_copy_flags = ifp->if_flags &
					(IFF_LINK0|IFF_LINK1|IFF_LINK2);
			bridge_control(sc, 0, bridge_ioctl_reinit, NULL);
		}

		break;

	case SIOCSIFMTU:
		/* Do not allow the MTU to be changed on the bridge */
		error = EINVAL;
		break;

	default:
		error = ether_ioctl(ifp, cmd, data);
		break;
	}
	return (error);
}

/*
 * bridge_mutecaps:
 *
 *	Clear or restore unwanted capabilities on the member interface
 */
static void
bridge_mutecaps(struct bridge_ifinfo *bif_info, struct ifnet *ifp, int mute)
{
	struct ifreq ifr;

	if (ifp->if_ioctl == NULL)
		return;

	bzero(&ifr, sizeof(ifr));
	ifr.ifr_reqcap = ifp->if_capenable;

	if (mute) {
		/* mask off and save capabilities */
		bif_info->bifi_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
		if (bif_info->bifi_mutecap != 0)
			ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
	} else {
		/* restore muted capabilities */
		ifr.ifr_reqcap |= bif_info->bifi_mutecap;
	}

	if (bif_info->bifi_mutecap != 0) {
		ifnet_serialize_all(ifp);
		ifp->if_ioctl(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
		ifnet_deserialize_all(ifp);
	}
}

/*
 * bridge_lookup_member:
 *
 *	Lookup a bridge member interface.
 */
static struct bridge_iflist *
bridge_lookup_member(struct bridge_softc *sc, const char *name)
{
	struct bridge_iflist *bif;

	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		if (strcmp(bif->bif_ifp->if_xname, name) == 0)
			return (bif);
	}
	return (NULL);
}

/*
 * bridge_lookup_member_if:
 *
 *	Lookup a bridge member interface by ifnet*.
 */
static struct bridge_iflist *
bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
{
	struct bridge_iflist *bif;

	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		if (bif->bif_ifp == member_ifp)
			return (bif);
	}
	return (NULL);
}

/*
 * bridge_lookup_member_ifinfo:
 *
 *	Lookup a bridge member interface by bridge_ifinfo.
 */
static struct bridge_iflist *
bridge_lookup_member_ifinfo(struct bridge_softc *sc,
			    struct bridge_ifinfo *bif_info)
{
	struct bridge_iflist *bif;

	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		if (bif->bif_info == bif_info)
			return (bif);
	}
	return (NULL);
}

/*
 * bridge_delete_member:
 *
 *	Delete the specified member interface.
 */
static void
bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
    int gone)
{
	struct ifnet *ifs = bif->bif_ifp;
	struct ifnet *bifp = sc->sc_ifp;
	struct bridge_ifinfo *bif_info = bif->bif_info;
	struct bridge_iflist_head saved_bifs;

	ASSERT_IFNET_SERIALIZED_ALL(bifp);
	KKASSERT(bif_info != NULL);

	ifs->if_bridge = NULL;

	/*
	 * Release bridge interface's serializer:
	 * - To avoid possible dead lock.
	 * - Various sync operation will block the current thread.
	 */
	ifnet_deserialize_all(bifp);

	if (!gone) {
		switch (ifs->if_type) {
		case IFT_ETHER:
		case IFT_L2VLAN:
			/*
			 * Take the interface out of promiscuous mode.
			 */
			ifpromisc(ifs, 0);
			bridge_mutecaps(bif_info, ifs, 0);
			break;

		case IFT_GIF:
			break;

		default:
			panic("bridge_delete_member: impossible");
			break;
		}
	}

	/*
	 * Remove bifs from percpu linked list.
	 *
	 * Removed bifs are not freed immediately, instead,
	 * they are saved in saved_bifs.  They will be freed
	 * after we make sure that no one is accessing them,
	 * i.e. after following netmsg_service_sync()
	 */
	TAILQ_INIT(&saved_bifs);
	bridge_del_bif(sc, bif_info, &saved_bifs);

	/*
	 * Make sure that all protocol threads:
	 * o  see 'ifs' if_bridge is changed
	 * o  know that bif is removed from the percpu linked list
	 */
	netmsg_service_sync();

	/*
	 * Free the removed bifs
	 */
	KKASSERT(!TAILQ_EMPTY(&saved_bifs));
	while ((bif = TAILQ_FIRST(&saved_bifs)) != NULL) {
		TAILQ_REMOVE(&saved_bifs, bif, bif_next);
		kfree(bif, M_DEVBUF);
	}

	/* See the comment in bridge_ioctl_stop() */
	bridge_rtmsg_sync(sc);
	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL | IFBF_FLUSHSYNC);

	ifnet_serialize_all(bifp);

	if (bifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	/*
	 * Free the bif_info after bstp_initialization(), so that
	 * bridge_softc.sc_root_port will not reference a dangling
	 * pointer.
	 */
	kfree(bif_info, M_DEVBUF);
}

/*
 * bridge_delete_span:
 *
 *	Delete the specified span interface.
 */
static void
bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
{
	KASSERT(bif->bif_ifp->if_bridge == NULL,
	    ("%s: not a span interface", __func__));

	TAILQ_REMOVE(&sc->sc_iflists[mycpuid], bif, bif_next);
	kfree(bif, M_DEVBUF);
}

static int
bridge_ioctl_init(struct bridge_softc *sc, void *arg __unused)
{
	struct ifnet *ifp = sc->sc_ifp;

	if (ifp->if_flags & IFF_RUNNING)
		return 0;

	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
	    bridge_timer, sc);

	ifp->if_flags |= IFF_RUNNING;
	bstp_initialization(sc);
	return 0;
}

static int
bridge_ioctl_stop(struct bridge_softc *sc, void *arg __unused)
{
	struct ifnet *ifp = sc->sc_ifp;

	if ((ifp->if_flags & IFF_RUNNING) == 0)
		return 0;

	callout_stop(&sc->sc_brcallout);

	crit_enter();
	lwkt_dropmsg(&sc->sc_brtimemsg.lmsg);
	crit_exit();

	bstp_stop(sc);

	ifp->if_flags &= ~IFF_RUNNING;

	ifnet_deserialize_all(ifp);

	/* Let everyone know that we are stopped */
	netmsg_service_sync();

	/*
	 * Sync ifnetX msgports in the order we forward rtnode
	 * installation message.  This is used to make sure that
	 * all rtnode installation messages sent by bridge_rtupdate()
	 * during above netmsg_service_sync() are flushed.
	 */
	bridge_rtmsg_sync(sc);
	bridge_rtflush(sc, IFBF_FLUSHDYN | IFBF_FLUSHSYNC);

	ifnet_serialize_all(ifp);
	return 0;
}

static int
bridge_ioctl_add(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;
	struct bridge_ifinfo *bif_info;
	struct ifnet *ifs, *bifp;
	int error = 0;

	bifp = sc->sc_ifp;
	ASSERT_IFNET_SERIALIZED_ALL(bifp);

	ifs = ifunit_netisr(req->ifbr_ifsname);
	if (ifs == NULL)
		return (ENOENT);

	/* If it's in the span list, it can't be a member. */
	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
		if (ifs == bif->bif_ifp)
			return (EBUSY);

	/* Allow the first Ethernet member to define the MTU */
	if (ifs->if_type != IFT_GIF) {
		if (TAILQ_EMPTY(&sc->sc_iflists[mycpuid])) {
			bifp->if_mtu = ifs->if_mtu;
		} else if (bifp->if_mtu != ifs->if_mtu) {
			if_printf(bifp, "invalid MTU for %s\n", ifs->if_xname);
			return (EINVAL);
		}
	}

	if (ifs->if_bridge == sc)
		return (EEXIST);

	if (ifs->if_bridge != NULL)
		return (EBUSY);

	bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);
	bif_info->bifi_priority = BSTP_DEFAULT_PORT_PRIORITY;
	bif_info->bifi_path_cost = BSTP_DEFAULT_PATH_COST;
	bif_info->bifi_ifp = ifs;
	bif_info->bifi_bond_weight = 1;

	/*
	 * Release bridge interface's serializer:
	 * - To avoid possible dead lock.
	 * - Various sync operation will block the current thread.
	 */
	ifnet_deserialize_all(bifp);

	switch (ifs->if_type) {
	case IFT_ETHER:
	case IFT_L2VLAN:
		/*
		 * Place the interface into promiscuous mode.
		 */
		error = ifpromisc(ifs, 1);
		if (error) {
			ifnet_serialize_all(bifp);
			goto out;
		}
		bridge_mutecaps(bif_info, ifs, 1);
		break;

	case IFT_GIF: /* :^) */
		break;

	default:
		error = EINVAL;
		ifnet_serialize_all(bifp);
		goto out;
	}

	/*
	 * Add bifs to percpu linked lists
	 */
	bridge_add_bif(sc, bif_info, ifs);

	ifnet_serialize_all(bifp);

	if (bifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);
	else
		bstp_stop(sc);

	/*
	 * Everything has been setup, so let the member interface
	 * deliver packets to this bridge on its input/output path.
	 */
	ifs->if_bridge = sc;
out:
	if (error) {
		if (bif_info != NULL)
			kfree(bif_info, M_DEVBUF);
	}
	return (error);
}

static int
bridge_ioctl_del(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;

	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
	if (bif == NULL)
		return (ENOENT);

	bridge_delete_member(sc, bif, 0);

	return (0);
}

static int
bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;

	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
	if (bif == NULL)
		return (ENOENT);
	bridge_ioctl_fillflags(sc, bif, req);
	return (0);
}

static void
bridge_ioctl_fillflags(struct bridge_softc *sc, struct bridge_iflist *bif,
		       struct ifbreq *req)
{
	req->ifbr_ifsflags = bif->bif_flags;
	req->ifbr_state = bif->bif_state;
	req->ifbr_priority = bif->bif_priority;
	req->ifbr_path_cost = bif->bif_path_cost;
	req->ifbr_bond_weight = bif->bif_bond_weight;
	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
	if (bif->bif_flags & IFBIF_STP) {
		req->ifbr_peer_root = bif->bif_peer_root;
		req->ifbr_peer_bridge = bif->bif_peer_bridge;
		req->ifbr_peer_cost = bif->bif_peer_cost;
		req->ifbr_peer_port = bif->bif_peer_port;
		if (bstp_supersedes_port_info(sc, bif)) {
			req->ifbr_designated_root = bif->bif_peer_root;
			req->ifbr_designated_bridge = bif->bif_peer_bridge;
			req->ifbr_designated_cost = bif->bif_peer_cost;
			req->ifbr_designated_port = bif->bif_peer_port;
		} else {
			req->ifbr_designated_root = sc->sc_bridge_id;
			req->ifbr_designated_bridge = sc->sc_bridge_id;
			req->ifbr_designated_cost = bif->bif_path_cost +
						    bif->bif_peer_cost;
			req->ifbr_designated_port = bif->bif_port_id;
		}
	} else {
		req->ifbr_peer_root = 0;
		req->ifbr_peer_bridge = 0;
		req->ifbr_peer_cost = 0;
		req->ifbr_peer_port = 0;
		req->ifbr_designated_root = 0;
		req->ifbr_designated_bridge = 0;
		req->ifbr_designated_cost = 0;
		req->ifbr_designated_port = 0;
	}
}

static int
bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;
	struct ifnet *bifp = sc->sc_ifp;

	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
	if (bif == NULL)
		return (ENOENT);

	if (req->ifbr_ifsflags & IFBIF_SPAN) {
		/* SPAN is readonly */
		return (EINVAL);
	}

	if (req->ifbr_ifsflags & IFBIF_STP) {
		switch (bif->bif_ifp->if_type) {
		case IFT_ETHER:
			/* These can do spanning tree. */
			break;

		default:
			/* Nothing else can. */
			return (EINVAL);
		}
	}

	bif->bif_flags = (bif->bif_flags & IFBIF_KEEPMASK) |
			 (req->ifbr_ifsflags & ~IFBIF_KEEPMASK);
	if (bifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;
	struct ifnet *ifp = sc->sc_ifp;

	sc->sc_brtmax = param->ifbrp_csize;

	ifnet_deserialize_all(ifp);
	bridge_rttrim(sc);
	ifnet_serialize_all(ifp);

	return (0);
}

static int
bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	param->ifbrp_csize = sc->sc_brtmax;

	return (0);
}

static int
bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
{
	struct bridge_control_arg *bc_arg = arg;
	struct ifbifconf *bifc = arg;
	struct bridge_iflist *bif;
	struct ifbreq *breq;
	int count, len;

	count = 0;
	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next)
		count++;
	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
		count++;

	if (bifc->ifbic_len == 0) {
		bifc->ifbic_len = sizeof(*breq) * count;
		return 0;
	} else if (count == 0 || bifc->ifbic_len < sizeof(*breq)) {
		bifc->ifbic_len = 0;
		return 0;
	}

	len = min(bifc->ifbic_len, sizeof(*breq) * count);
	KKASSERT(len >= sizeof(*breq));

	breq = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
	if (breq == NULL) {
		bifc->ifbic_len = 0;
		return ENOMEM;
	}
	bc_arg->bca_kptr = breq;

	count = 0;
	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		if (len < sizeof(*breq))
			break;

		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
			sizeof(breq->ifbr_ifsname));
		bridge_ioctl_fillflags(sc, bif, breq);
		breq++;
		count++;
		len -= sizeof(*breq);
	}
	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
		if (len < sizeof(*breq))
			break;

		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
			sizeof(breq->ifbr_ifsname));
		breq->ifbr_ifsflags = bif->bif_flags;
		breq->ifbr_portno = bif->bif_ifp->if_index & 0xff;
		breq++;
		count++;
		len -= sizeof(*breq);
	}

	bifc->ifbic_len = sizeof(*breq) * count;
	KKASSERT(bifc->ifbic_len > 0);

	bc_arg->bca_len = bifc->ifbic_len;
	bc_arg->bca_uptr = bifc->ifbic_req;
	return 0;
}

static int
bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
{
	struct bridge_control_arg *bc_arg = arg;
	struct ifbaconf *bac = arg;
	struct bridge_rtnode *brt;
	struct ifbareq *bareq;
	int count, len;

	count = 0;
	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list)
		count++;

	if (bac->ifbac_len == 0) {
		bac->ifbac_len = sizeof(*bareq) * count;
		return 0;
	} else if (count == 0 || bac->ifbac_len < sizeof(*bareq)) {
		bac->ifbac_len = 0;
		return 0;
	}

	len = min(bac->ifbac_len, sizeof(*bareq) * count);
	KKASSERT(len >= sizeof(*bareq));

	bareq = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
	if (bareq == NULL) {
		bac->ifbac_len = 0;
		return ENOMEM;
	}
	bc_arg->bca_kptr = bareq;

	count = 0;
	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
		struct bridge_rtinfo *bri = brt->brt_info;
		time_t expire;

		if (len < sizeof(*bareq))
			break;

		strlcpy(bareq->ifba_ifsname, bri->bri_ifp->if_xname,
			sizeof(bareq->ifba_ifsname));
		memcpy(bareq->ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
		expire = bri->bri_expire;
		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
		    time_uptime < expire)
			bareq->ifba_expire = expire - time_uptime;
		else
			bareq->ifba_expire = 0;
		bareq->ifba_flags = bri->bri_flags;
		bareq++;
		count++;
		len -= sizeof(*bareq);
	}

	bac->ifbac_len = sizeof(*bareq) * count;
	KKASSERT(bac->ifbac_len > 0);

	bc_arg->bca_len = bac->ifbac_len;
	bc_arg->bca_uptr = bac->ifbac_req;
	return 0;
}

static int
bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
{
	struct ifbareq *req = arg;
	struct bridge_iflist *bif;
	struct ifnet *ifp = sc->sc_ifp;
	int error;

	ASSERT_IFNET_SERIALIZED_ALL(ifp);

	bif = bridge_lookup_member(sc, req->ifba_ifsname);
	if (bif == NULL)
		return (ENOENT);

	ifnet_deserialize_all(ifp);
	error = bridge_rtsaddr(sc, req->ifba_dst, bif->bif_ifp,
			       req->ifba_flags);
	ifnet_serialize_all(ifp);
	return (error);
}

static int
bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	sc->sc_brttimeout = param->ifbrp_ctime;

	return (0);
}

static int
bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	param->ifbrp_ctime = sc->sc_brttimeout;

	return (0);
}

static int
bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
{
	struct ifbareq *req = arg;
	struct ifnet *ifp = sc->sc_ifp;
	int error;

	ifnet_deserialize_all(ifp);
	error = bridge_rtdaddr(sc, req->ifba_dst);
	ifnet_serialize_all(ifp);
	return error;
}

static int
bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct ifnet *ifp = sc->sc_ifp;

	ifnet_deserialize_all(ifp);
	bridge_rtflush(sc, req->ifbr_ifsflags | IFBF_FLUSHSYNC);
	ifnet_serialize_all(ifp);

	return (0);
}

static int
bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	param->ifbrp_prio = sc->sc_bridge_priority;

	return (0);
}

static int
bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	sc->sc_bridge_priority = param->ifbrp_prio;

	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_reinit(struct bridge_softc *sc, void *arg __unused)
{
	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);
	return (0);
}

static int
bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;

	return (0);
}

static int
bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	if (param->ifbrp_hellotime == 0)
		return (EINVAL);
	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;

	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;

	return (0);
}

static int
bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	if (param->ifbrp_fwddelay == 0)
		return (EINVAL);
	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;

	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;

	return (0);
}

static int
bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
{
	struct ifbrparam *param = arg;

	if (param->ifbrp_maxage == 0)
		return (EINVAL);
	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;

	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;

	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
	if (bif == NULL)
		return (ENOENT);

	bif->bif_priority = req->ifbr_priority;

	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;

	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
	if (bif == NULL)
		return (ENOENT);

	bif->bif_path_cost = req->ifbr_path_cost;

	if (sc->sc_ifp->if_flags & IFF_RUNNING)
		bstp_initialization(sc);

	return (0);
}

static int
bridge_ioctl_sifbondwght(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;

	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
	if (bif == NULL)
		return (ENOENT);

	bif->bif_bond_weight = req->ifbr_bond_weight;

	/* no reinit needed */

	return (0);
}

static int
bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;
	struct ifnet *ifs;
	struct bridge_ifinfo *bif_info;

	ifs = ifunit_netisr(req->ifbr_ifsname);
	if (ifs == NULL)
		return (ENOENT);

	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
		if (ifs == bif->bif_ifp)
			return (EBUSY);

	if (ifs->if_bridge != NULL)
		return (EBUSY);

	switch (ifs->if_type) {
	case IFT_ETHER:
	case IFT_GIF:
	case IFT_L2VLAN:
		break;

	default:
		return (EINVAL);
	}

	/*
	 * bif_info is needed for bif_flags
	 */
        bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);
        bif_info->bifi_ifp = ifs;

	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK | M_ZERO);
	bif->bif_ifp = ifs;
	bif->bif_info = bif_info;
	bif->bif_flags = IFBIF_SPAN;
	/* NOTE: span bif does not need bridge_ifinfo */

	TAILQ_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);

	sc->sc_span = 1;

	return (0);
}

static int
bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
{
	struct ifbreq *req = arg;
	struct bridge_iflist *bif;
	struct ifnet *ifs;

	ifs = ifunit_netisr(req->ifbr_ifsname);
	if (ifs == NULL)
		return (ENOENT);

	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
		if (ifs == bif->bif_ifp)
			break;

	if (bif == NULL)
		return (ENOENT);

	bridge_delete_span(sc, bif);

	if (TAILQ_EMPTY(&sc->sc_spanlist))
		sc->sc_span = 0;

	return (0);
}

static void
bridge_ifdetach_dispatch(netmsg_t msg)
{
	struct ifnet *ifp, *bifp;
	struct bridge_softc *sc;
	struct bridge_iflist *bif;

	ifp = msg->lmsg.u.ms_resultp;
	sc = ifp->if_bridge;

	/* Check if the interface is a bridge member */
	if (sc != NULL) {
		bifp = sc->sc_ifp;

		ifnet_serialize_all(bifp);

		bif = bridge_lookup_member_if(sc, ifp);
		if (bif != NULL) {
			bridge_delete_member(sc, bif, 1);
		} else {
			/* XXX Why bif will be NULL? */
		}

		ifnet_deserialize_all(bifp);
		goto reply;
	}

	crit_enter();	/* XXX MP */

	/* Check if the interface is a span port */
	LIST_FOREACH(sc, &bridge_list, sc_list) {
		bifp = sc->sc_ifp;

		ifnet_serialize_all(bifp);

		TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
			if (ifp == bif->bif_ifp) {
				bridge_delete_span(sc, bif);
				break;
			}

		ifnet_deserialize_all(bifp);
	}

	crit_exit();

reply:
	lwkt_replymsg(&msg->lmsg, 0);
}

/*
 * bridge_ifdetach:
 *
 *	Detach an interface from a bridge.  Called when a member
 *	interface is detaching.
 */
static void
bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
{
	struct netmsg_base msg;

	netmsg_init(&msg, NULL, &curthread->td_msgport,
		    0, bridge_ifdetach_dispatch);
	msg.lmsg.u.ms_resultp = ifp;

	lwkt_domsg(BRIDGE_CFGPORT, &msg.lmsg, 0);
}

/*
 * bridge_init:
 *
 *	Initialize a bridge interface.
 */
static void
bridge_init(void *xsc)
{
	bridge_control(xsc, SIOCSIFFLAGS, bridge_ioctl_init, NULL);
}

/*
 * bridge_stop:
 *
 *	Stop the bridge interface.
 */
static void
bridge_stop(struct ifnet *ifp)
{
	bridge_control(ifp->if_softc, SIOCSIFFLAGS, bridge_ioctl_stop, NULL);
}

/*
 * Returns TRUE if the packet is being sent 'from us'... from our bridge
 * interface or from any member of our bridge interface.  This is used
 * later on to force the MAC to be the MAC of our bridge interface.
 */
static int
bridge_from_us(struct bridge_softc *sc, struct ether_header *eh)
{
	struct bridge_iflist *bif;

	if (memcmp(eh->ether_shost, IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN) == 0)
		return (1);

	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		if (memcmp(eh->ether_shost, IF_LLADDR(bif->bif_ifp),
			   ETHER_ADDR_LEN) == 0)
	        {
			return (1);
		}
	}
	return (0);
}

/*
 * bridge_enqueue:
 *
 *	Enqueue a packet on a bridge member interface.
 *
 */
void
bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
{
	struct netmsg_packet *nmp;

	mbuftrackid(m, 64);

	nmp = &m->m_hdr.mh_netmsg;
	netmsg_init(&nmp->base, NULL, &netisr_apanic_rport,
		    0, bridge_enqueue_handler);
	nmp->nm_packet = m;
	nmp->base.lmsg.u.ms_resultp = dst_ifp;

	lwkt_sendmsg_oncpu(netisr_cpuport(mycpuid), &nmp->base.lmsg);
}

/*
 * After looking up dst_if in our forwarding table we still have to
 * deal with channel bonding.  Find the best interface in the bonding set.
 */
static struct ifnet *
bridge_select_unicast(struct bridge_softc *sc, struct ifnet *dst_if,
		      int from_blocking, struct mbuf *m)
{
	struct bridge_iflist *bif, *alt_bif, *nbif;
	int alt_priority, alt_count;
	uint8_t alt_state;

	/*
	 * Unicast, kinda replicates the output side of bridge_output().
	 *
	 * Even though this is a uni-cast packet we may have to select
	 * an interface from a bonding set.
	 */
	bif = bridge_lookup_member_if(sc, dst_if);
	if (bif == NULL) {
		/* Not a member of the bridge (anymore?) */
		return NULL;
	}

	/*
	 * Send directly if the interface is not part of the spanning
	 * tree.
	 */
	if ((bif->bif_flags & IFBIF_STP) == 0) {
		goto sendunicast;
	}

	/*
	 * If STP is enabled on the target we are an equal opportunity
	 * employer and do not necessarily output to dst_if.  Instead
	 * scan available links with the same MAC as the current dst_if
	 * and choose the best one.
	 *
	 * We also need to do this because arp or other cached entries might
	 * be tagged to the wrong port after a fail-over.  We don't want to
	 * route packets to dead ports when perfectly good ones exist.
	 *
	 * If LINK2 is set on the bridge, any interfaces in the same bonding
	 * set as dst_if with the same priority will be round-robined.  If
	 * different priorities, only the highest priority is chosen.  In
	 * this case links in a STP FORWARDING or BONDED state are allowed
	 * for unicast packets.
	 */
	alt_state = BSTP_IFSTATE_LEARNING;
	alt_bif = NULL;
	alt_priority = 0;
	alt_count = 0;

	TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid], bif_next, nbif) {
		/*
		 * Ignore interfaces not in the same bonding set as dst_if
		 * or which are not running.
		 */
		if (memcmp(IF_LLADDR(bif->bif_ifp), IF_LLADDR(dst_if),
			   ETHER_ADDR_LEN) != 0)
		{
			continue;
		}

		if ((bif->bif_ifp->if_flags & IFF_RUNNING) == 0)
			continue;

		/*
		 * NOTE: We allow tranmissions through a BLOCKING
		 *	 or LEARNING interface only as a last resort.
		 *	 We DISALLOW both cases if the receiving
		 *
		 * NOTE: If we send a packet through a learning
		 *	 interface the receiving end (if also in
		 *	 LEARNING) will throw it away, so this is
		 *	 the ultimate last resort.
		 */
		switch(bif->bif_state) {
		case BSTP_IFSTATE_LEARNING:
			if (from_blocking == 0 &&
			    alt_state == BSTP_IFSTATE_LEARNING &&
			    bif->bif_priority > alt_priority)
			{
				alt_priority = bif->bif_priority;
				alt_bif = bif;
			}
			break;
		case BSTP_IFSTATE_BLOCKING:
			if (from_blocking == 0 &&
			    (alt_state == BSTP_IFSTATE_LEARNING ||
			     (alt_state == BSTP_IFSTATE_BLOCKING &&
			      bif->bif_priority > alt_priority)))
			{
				alt_state = BSTP_IFSTATE_BLOCKING;
				alt_priority = bif->bif_priority;
				alt_bif = bif;
			}
			break;
		case BSTP_IFSTATE_L1BLOCKING:
		case BSTP_IFSTATE_LISTENING:
		case BSTP_IFSTATE_DISABLED:
			break;
		default:
			/*
			 * Select the best interface in the FORWARDING
			 * set (or BONDING, but there shouldn't be any
			 * when LINK2 is not set).
			 */
			if (alt_state != BSTP_IFSTATE_BONDED ||
			    bif->bif_priority > alt_priority)
			{
				alt_state = BSTP_IFSTATE_BONDED;
				alt_priority = bif->bif_priority;
				alt_bif = bif;
				alt_count = 0;
			} else if (alt_state == BSTP_IFSTATE_BONDED &&
				   bif->bif_priority == alt_priority)
			{
				/*
				 * Round-robin
				 */
				++alt_count;
			}
			break;
		}
	}

	/*
	 * If bonding is enabled (LINK2) and there were multiple interfaces
	 * at the selected priority level, count packets and switch the
	 * output interface.
	 *
	 * XXX need to use the toepliz hash or something like that instead
	 * of a dumb packet round-robin.
	 */
	if (alt_count && (sc->sc_ifp->if_flags & IFF_LINK2)) {
		if (++alt_bif->bif_bond_count >= alt_bif->bif_bond_weight) {
			alt_bif->bif_bond_count = 0;
			TAILQ_REMOVE(&sc->sc_iflists[mycpuid],
				     alt_bif, bif_next);
			TAILQ_INSERT_TAIL(
				     &sc->sc_iflists[mycpuid],
				     alt_bif, bif_next);
		}
	}

	/*
	 * After loop, alt_if is the interface we selected.  alt_if can
	 * be NULL.
	 */
	if (alt_bif)
		dst_if = alt_bif->bif_ifp;

sendunicast:
	/*
	 * At this point, we're dealing with a unicast frame
	 * going to a different interface.
	 */
	if ((dst_if->if_flags & IFF_RUNNING) == 0)
		dst_if = NULL;
	return (dst_if);
}


/*
 * bridge_output
 *
 * Issue locally originated (not forwarded) packet to the bridge.  ifp
 * is the nominal interface the system route table is trying to send
 * it to, but we get here because that interface is part of the bridge
 * so really the packet is being sent to the whole bridge.
 *
 * The mbuf has the Ethernet header already attached.  We must
 * enqueue or free the mbuf before returning.
 */
static int
bridge_output(struct ifnet *ifp, struct mbuf *m)
{
	struct bridge_softc *sc = ifp->if_bridge;
	struct bridge_iflist *bif, *nbif;
	struct ether_header *eh;
	struct ifnet *dst_if, *alt_if, *bifp;
	int from_us;
	int alt_priority;
	uint8_t alt_state;
	struct mbuf *mc;
	int used;
	int found;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
	ASSERT_NETISR_NCPUS(mycpuid);
	mbuftrackid(m, 65);

	/*
	 * Make sure that we are still a member of a bridge interface.
	 */
	if (sc == NULL) {
		m_freem(m);
		return (0);
	}
	bifp = sc->sc_ifp;

	/*
	 * Acquire header
	 */
	if (m->m_len < ETHER_HDR_LEN) {
		m = m_pullup(m, ETHER_HDR_LEN);
		if (m == NULL) {
			IFNET_STAT_INC(bifp, oerrors, 1);
			return (0);
		}
	}
	eh = mtod(m, struct ether_header *);
	from_us = bridge_from_us(sc, eh);

	/*
	 * If bridge is down, but the original output interface is up,
	 * go ahead and send out that interface.  Otherwise, the packet
	 * is dropped below.
	 */
	if ((bifp->if_flags & IFF_RUNNING) == 0) {
		dst_if = ifp;
		goto sendunicast;
	}

	/*
	 * If the packet is a broadcast or multicast, or we don't know a better
	 * way to get there, send to all interfaces except the originating one.
	 */
	if (ETHER_IS_MULTICAST(eh->ether_dhost))
		dst_if = NULL;
	else
		dst_if = bridge_rtlookup(sc, eh->ether_dhost);

	if (dst_if)
		goto sendunicast;

	used = 0;
	found = 0;

	if (sc->sc_span)
		bridge_span(sc, m);

	alt_if = NULL;
	alt_priority = 0;
	alt_state = BSTP_IFSTATE_LEARNING;

	TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid], bif_next, nbif) {
		dst_if = bif->bif_ifp;

		/*
		 * Ignore interfaces marked down
		 *
		 * NOTE: Since the packet is originated on the machine, the
		 *	 original interface the system tried to send it to
		 *	 (ifp), which is part of the bridge, is not treated
		 *	 specially verses other interfaces on the bridge.
		 */
		if ((dst_if->if_flags & IFF_RUNNING) == 0)
			continue;

		/*
		 * Issue to all FORWARDING STP-enabled interfaces and
		 * to all non-STP interfaces.  Keep track of a possible
		 * backup to a BONDED, BLOCKING, or LEARNING interfaces
		 * (in that priority) in case no other interfaces are found.
		 */
		if (bif->bif_flags & IFBIF_STP) {
			switch (bif->bif_state) {
			case BSTP_IFSTATE_BONDED:
				if (alt_state != BSTP_IFSTATE_BONDED ||
				    bif->bif_priority > alt_priority)
				{
					alt_state = BSTP_IFSTATE_BONDED;
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				continue;
			case BSTP_IFSTATE_BLOCKING:
				if (alt_state == BSTP_IFSTATE_LEARNING ||
				    (alt_state == BSTP_IFSTATE_BLOCKING &&
				     bif->bif_priority > alt_priority))
				{
					alt_state = BSTP_IFSTATE_BLOCKING;
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				continue;
			case BSTP_IFSTATE_LEARNING:
				if (alt_state == BSTP_IFSTATE_LEARNING &&
				    bif->bif_priority > alt_priority)
				{
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				continue;
			case BSTP_IFSTATE_L1BLOCKING:
			case BSTP_IFSTATE_LISTENING:
			case BSTP_IFSTATE_DISABLED:
				/*
				 * Ignore interfaces in these states
				 */
				continue;
			default:
				/* FORWARDING */
				break;
			}
		}

		/*
		 * Copy the packet to dstif
		 */
		KKASSERT(used == 0);
		if (TAILQ_NEXT(bif, bif_next) == NULL) {
			used = 1;
			mc = m;
		} else {
			mc = m_copypacket(m, M_NOWAIT);
			if (mc == NULL) {
				IFNET_STAT_INC(bifp, oerrors, 1);
				continue;
			}
		}

		/*
		 * If the packet is 'from' us override ether_shost.
		 */
		bridge_handoff(sc, dst_if, mc, from_us);
		found = 1;

		if (nbif != NULL && !nbif->bif_onlist) {
			KKASSERT(bif->bif_onlist);
			nbif = TAILQ_NEXT(bif, bif_next);
		}
	}

	/*
	 * If we couldn't find anything use the backup interface
	 * if we have one.
	 */
	if (found == 0 && alt_if) {
		KKASSERT(used == 0);
		mc = m;
		used = 1;
		bridge_handoff(sc, alt_if, mc, from_us);
	}

	if (used == 0)
		m_freem(m);
	return (0);

	/*
	 * Unicast
	 */
sendunicast:
	dst_if = bridge_select_unicast(sc, dst_if, 0, m);

	if (sc->sc_span)
		bridge_span(sc, m);
	if (dst_if == NULL)
		m_freem(m);
	else
		bridge_handoff(sc, dst_if, m, from_us);
	return (0);
}

/*
 * Returns the bridge interface associated with an ifc.
 * Pass ifp->if_bridge (must not be NULL).  Used by the ARP
 * code to supply the bridge for the is-at info, making
 * the bridge responsible for matching local addresses.
 *
 * Without this the ARP code will supply bridge member interfaces
 * for the is-at which makes it difficult the bridge to fail-over
 * interfaces (among other things).
 */
static struct ifnet *
bridge_interface(void *if_bridge)
{
	struct bridge_softc *sc = if_bridge;
	return (sc->sc_ifp);
}

/*
 * bridge_start:
 *
 *	Start output on a bridge.
 */
static void
bridge_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
{
	struct bridge_softc *sc = ifp->if_softc;

	ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
	ASSERT_ALTQ_SQ_SERIALIZED_HW(ifsq);
	ASSERT_NETISR_NCPUS(mycpuid);

	ifsq_set_oactive(ifsq);
	for (;;) {
		struct ifnet *dst_if = NULL;
		struct ether_header *eh;
		struct mbuf *m;

		m = ifsq_dequeue(ifsq);
		if (m == NULL)
			break;
		mbuftrackid(m, 75);

		if (m->m_len < sizeof(*eh)) {
			m = m_pullup(m, sizeof(*eh));
			if (m == NULL) {
				IFNET_STAT_INC(ifp, oerrors, 1);
				continue;
			}
		}
		eh = mtod(m, struct ether_header *);

		BPF_MTAP(ifp, m);
		IFNET_STAT_INC(ifp, opackets, 1);

		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
			dst_if = bridge_rtlookup(sc, eh->ether_dhost);

		/*
		 * Multicast or broadcast
		 */
		if (dst_if == NULL) {
			bridge_start_bcast(sc, m);
			continue;
		}

		/*
		 * Unicast
		 */
		dst_if = bridge_select_unicast(sc, dst_if, 0, m);

		if (dst_if == NULL)
			m_freem(m);
		else
			bridge_enqueue(dst_if, m);
	}
	ifsq_clr_oactive(ifsq);
}

/*
 * bridge_forward:
 *
 *	Forward packets received on a bridge interface via the input
 *	path.
 *
 *	This implements the forwarding function of the bridge.
 */
static void
bridge_forward(struct bridge_softc *sc, struct mbuf *m)
{
	struct bridge_iflist *bif;
	struct ifnet *src_if, *dst_if, *ifp;
	struct ether_header *eh;
	int from_blocking;

	mbuftrackid(m, 66);
	src_if = m->m_pkthdr.rcvif;
	ifp = sc->sc_ifp;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);

	/*
	 * packet coming in on the bridge is also going out on the bridge,
	 * but ether code won't adjust output stats for the bridge because
	 * we are changing the interface to something else.
	 */
	IFNET_STAT_INC(ifp, opackets, 1);
	IFNET_STAT_INC(ifp, obytes, m->m_pkthdr.len);

	/*
	 * Look up the bridge_iflist.
	 */
	bif = bridge_lookup_member_if(sc, src_if);
	if (bif == NULL) {
		/* Interface is not a bridge member (anymore?) */
		m_freem(m);
		return;
	}

	/*
	 * In spanning tree mode receiving a packet from an interface
	 * in a BLOCKING state is allowed, it could be a member of last
	 * resort from the sender's point of view, but forwarding it is
	 * not allowed.
	 *
	 * The sender's spanning tree will eventually sync up and the
	 * sender will go into a BLOCKING state too (but this still may be
	 * an interface of last resort during state changes).
	 */
	if (bif->bif_flags & IFBIF_STP) {
		switch (bif->bif_state) {
		case BSTP_IFSTATE_L1BLOCKING:
		case BSTP_IFSTATE_LISTENING:
		case BSTP_IFSTATE_DISABLED:
			m_freem(m);
			return;
		default:
			/* learning, blocking, bonded, forwarding */
			break;
		}
		from_blocking = (bif->bif_state == BSTP_IFSTATE_BLOCKING);
	} else {
		from_blocking = 0;
	}

	eh = mtod(m, struct ether_header *);

	/*
	 * If the interface is learning, and the source
	 * address is valid and not multicast, record
	 * the address.
	 */
	if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
	    from_blocking == 0 &&
	    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
	    (eh->ether_shost[0] == 0 &&
	     eh->ether_shost[1] == 0 &&
	     eh->ether_shost[2] == 0 &&
	     eh->ether_shost[3] == 0 &&
	     eh->ether_shost[4] == 0 &&
	     eh->ether_shost[5] == 0) == 0)
	{
		bridge_rtupdate(sc, eh->ether_shost, src_if, IFBAF_DYNAMIC);
	}

	/*
	 * Don't forward from an interface in the listening or learning
	 * state.  That is, in the learning state we learn information
	 * but we throw away the packets.
	 *
	 * We let through packets on interfaces in the blocking state.
	 * The blocking state is applicable to the send side, not the
	 * receive side.
	 */
	if ((bif->bif_flags & IFBIF_STP) != 0 &&
	    (bif->bif_state == BSTP_IFSTATE_LISTENING ||
	     bif->bif_state == BSTP_IFSTATE_LEARNING)) {
		m_freem(m);
		return;
	}

	/*
	 * At this point, the port either doesn't participate
	 * in spanning tree or it is in the forwarding state.
	 */

	/*
	 * If the packet is unicast, destined for someone on
	 * "this" side of the bridge, drop it.
	 *
	 * src_if implies the entire bonding set so we have to compare MAC
	 * addresses and not just if pointers.
	 */
	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
		if (dst_if && memcmp(IF_LLADDR(src_if), IF_LLADDR(dst_if),
				     ETHER_ADDR_LEN) == 0) {
			m_freem(m);
			return;
		}
	} else {
		/* ...forward it to all interfaces. */
		IFNET_STAT_INC(ifp, imcasts, 1);
		dst_if = NULL;
	}

	/*
	 * Brodcast if we do not have forwarding information.  However, if
	 * we received the packet on a blocking interface we do not do this
	 * (unless you really want to blow up your network).
	 */
	if (dst_if == NULL) {
		if (from_blocking)
			m_freem(m);
		else
			bridge_broadcast(sc, src_if, m);
		return;
	}

	dst_if = bridge_select_unicast(sc, dst_if, from_blocking, m);

	if (dst_if == NULL) {
		m_freem(m);
		return;
	}

	if (inet_pfil_hook.ph_hashooks > 0
#ifdef INET6
	    || inet6_pfil_hook.ph_hashooks > 0
#endif
	    ) {
		if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
			return;
		if (m == NULL)
			return;

		if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
			return;
		if (m == NULL)
			return;
	}
	bridge_handoff(sc, dst_if, m, 0);
}

/*
 * bridge_input:
 *
 *	Receive input from a member interface.  Queue the packet for
 *	bridging if it is not for us.
 */
static struct mbuf *
bridge_input(struct ifnet *ifp, struct mbuf *m)
{
	struct bridge_softc *sc = ifp->if_bridge;
	struct bridge_iflist *bif;
	struct ifnet *bifp, *new_ifp;
	struct ether_header *eh;
	struct mbuf *mc, *mc2;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
	ASSERT_NETISR_NCPUS(mycpuid);
	mbuftrackid(m, 67);

	/*
	 * Make sure that we are still a member of a bridge interface.
	 */
	if (sc == NULL)
		return m;

	new_ifp = NULL;
	bifp = sc->sc_ifp;

	if ((bifp->if_flags & IFF_RUNNING) == 0)
		goto out;

	/*
	 * Implement support for bridge monitoring.  If this flag has been
	 * set on this interface, discard the packet once we push it through
	 * the bpf(4) machinery, but before we do, increment various counters
	 * associated with this bridge.
	 */
	if (bifp->if_flags & IFF_MONITOR) {
		/*
		 * Change input interface to this bridge
		 *
		 * Update bridge's ifnet statistics
		 */
		m->m_pkthdr.rcvif = bifp;

		BPF_MTAP(bifp, m);
		IFNET_STAT_INC(bifp, ipackets, 1);
		IFNET_STAT_INC(bifp, ibytes, m->m_pkthdr.len);
		if (m->m_flags & (M_MCAST | M_BCAST))
			IFNET_STAT_INC(bifp, imcasts, 1);

		m_freem(m);
		m = NULL;
		goto out;
	}

	/*
	 * Handle the ether_header
	 *
	 * In all cases if the packet is destined for us via our MAC
	 * we must clear BRIDGE_MBUF_TAGGED to ensure that we don't
	 * repeat the source MAC out the same interface.
	 *
	 * This first test against our bridge MAC is the fast-path.
	 *
	 * NOTE!  The bridge interface can serve as an endpoint for
	 *	  communication but normally there are no IPs associated
	 *	  with it so you cannot route through it.  Instead what
	 *	  you do is point your default route *THROUGH* the bridge
	 *	  to the actual default router for one of the bridged spaces.
	 *
	 *	  Another possibility is to put all your IP specifications
	 *	  on the bridge instead of on the individual interfaces.  If
	 *	  you do this it should be possible to use the bridge as an
	 *	  end point and route (rather than switch) through it using
	 *	  the default route or ipfw forwarding rules.
	 */

	/*
	 * Acquire header
	 */
	if (m->m_len < ETHER_HDR_LEN) {
		m = m_pullup(m, ETHER_HDR_LEN);
		if (m == NULL)
			goto out;
	}
	eh = mtod(m, struct ether_header *);
	m->m_pkthdr.fw_flags |= BRIDGE_MBUF_TAGGED;
	bcopy(eh->ether_shost, m->m_pkthdr.ether_br_shost, ETHER_ADDR_LEN);

	if ((bridge_debug & 1) &&
	    (ntohs(eh->ether_type) == ETHERTYPE_ARP ||
	    ntohs(eh->ether_type) == ETHERTYPE_REVARP)) {
		kprintf("%02x:%02x:%02x:%02x:%02x:%02x "
			"%02x:%02x:%02x:%02x:%02x:%02x type %04x "
			"lla %02x:%02x:%02x:%02x:%02x:%02x\n",
			eh->ether_dhost[0],
			eh->ether_dhost[1],
			eh->ether_dhost[2],
			eh->ether_dhost[3],
			eh->ether_dhost[4],
			eh->ether_dhost[5],
			eh->ether_shost[0],
			eh->ether_shost[1],
			eh->ether_shost[2],
			eh->ether_shost[3],
			eh->ether_shost[4],
			eh->ether_shost[5],
			eh->ether_type,
			((u_char *)IF_LLADDR(bifp))[0],
			((u_char *)IF_LLADDR(bifp))[1],
			((u_char *)IF_LLADDR(bifp))[2],
			((u_char *)IF_LLADDR(bifp))[3],
			((u_char *)IF_LLADDR(bifp))[4],
			((u_char *)IF_LLADDR(bifp))[5]
		);
	}

	/*
	 * If the packet is for us, set the packets source as the
	 * bridge, and return the packet back to ifnet.if_input for
	 * local processing.
	 */
	if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
		/*
		 * We must still record the source interface in our
		 * addr cache, otherwise our bridge won't know where
		 * to send responses and will broadcast them.
		 */
		bif = bridge_lookup_member_if(sc, ifp);
		if ((bif->bif_flags & IFBIF_LEARNING) &&
		    ((bif->bif_flags & IFBIF_STP) == 0 ||
		     bif->bif_state != BSTP_IFSTATE_BLOCKING))
		{
			bridge_rtupdate(sc, eh->ether_shost,
					ifp, IFBAF_DYNAMIC);
		}

		/*
		 * Perform pfil hooks.
		 */
		m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
		KASSERT(bifp->if_bridge == NULL,
			("loop created in bridge_input"));
		if (pfil_member != 0) {
			if (inet_pfil_hook.ph_hashooks > 0
#ifdef INET6
			    || inet6_pfil_hook.ph_hashooks > 0
#endif
			) {
				if (bridge_pfil(&m, NULL, ifp, PFIL_IN) != 0)
					goto out;
				if (m == NULL)
					goto out;
			}
		}

		/*
		 * Set new_ifp and skip to the end.  This will trigger code
		 * to reinput the packet and run it into our stack.
		 */
		new_ifp = bifp;
		goto out;
	}

	/*
	 * Tap all packets arriving on the bridge, no matter if
	 * they are local destinations or not.  In is in.
	 *
	 * Update bridge's ifnet statistics
	 */
	BPF_MTAP(bifp, m);
	IFNET_STAT_INC(bifp, ipackets, 1);
	IFNET_STAT_INC(bifp, ibytes, m->m_pkthdr.len);
	if (m->m_flags & (M_MCAST | M_BCAST))
		IFNET_STAT_INC(bifp, imcasts, 1);

	bif = bridge_lookup_member_if(sc, ifp);
	if (bif == NULL)
		goto out;

	if (sc->sc_span)
		bridge_span(sc, m);

	if (m->m_flags & (M_BCAST | M_MCAST)) {
		/*
		 * Tap off 802.1D packets; they do not get forwarded.
		 */
		if (memcmp(eh->ether_dhost, bstp_etheraddr,
			    ETHER_ADDR_LEN) == 0) {
			ifnet_serialize_all(bifp);
			bstp_input(sc, bif, m);
			ifnet_deserialize_all(bifp);

			/* m is freed by bstp_input */
			m = NULL;
			goto out;
		}

		/*
		 * Other than 802.11d packets, ignore packets if the
		 * interface is not in a good state.
		 *
		 * NOTE: Broadcast/mcast packets received on a blocking or
		 *	 learning interface are allowed for local processing.
		 *
		 *	 The sending side of a blocked port will stop
		 *	 transmitting when a better alternative is found.
		 *	 However, later on we will disallow the forwarding
		 *	 of bcast/mcsat packets over a blocking interface.
		 */
		if (bif->bif_flags & IFBIF_STP) {
			switch (bif->bif_state) {
			case BSTP_IFSTATE_L1BLOCKING:
			case BSTP_IFSTATE_LISTENING:
			case BSTP_IFSTATE_DISABLED:
				goto out;
			default:
				/* blocking, learning, bonded, forwarding */
				break;
			}
		}

		/*
		 * Make a deep copy of the packet and enqueue the copy
		 * for bridge processing; return the original packet for
		 * local processing.
		 */
		mc = m_dup(m, M_NOWAIT);
		if (mc == NULL)
			goto out;

		/*
		 * It's just too dangerous to allow bcast/mcast over a
		 * blocked interface, eventually the network will sort
		 * itself out and a better path will be found.
		 */
		if ((bif->bif_flags & IFBIF_STP) == 0 ||
		    bif->bif_state != BSTP_IFSTATE_BLOCKING)
		{
			bridge_forward(sc, mc);
		}

		/*
		 * Reinject the mbuf as arriving on the bridge so we have a
		 * chance at claiming multicast packets. We can not loop back
		 * here from ether_input as a bridge is never a member of a
		 * bridge.
		 */
		KASSERT(bifp->if_bridge == NULL,
			("loop created in bridge_input"));
		mc2 = m_dup(m, M_NOWAIT);
#ifdef notyet
		if (mc2 != NULL) {
			/* Keep the layer3 header aligned */
			int i = min(mc2->m_pkthdr.len, max_protohdr);
			mc2 = m_copyup(mc2, i, ETHER_ALIGN);
		}
#endif
		if (mc2 != NULL) {
			/*
			 * Don't tap to bpf(4) again; we have already done
			 * the tapping.
			 *
			 * Leave m_pkthdr.rcvif alone, so ARP replies are
			 * processed as coming in on the correct interface.
			 *
			 * Clear the bridge flag for local processing in
			 * case the packet gets routed.
			 */
			mc2->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
			ether_reinput_oncpu(bifp, mc2, 0);
		}

		/* Return the original packet for local processing. */
		goto out;
	}

	/*
	 * Input of a unicast packet.  We have to allow unicast packets
	 * input from links in the BLOCKING state as this might be an
	 * interface of last resort.
	 *
	 * NOTE: We explicitly ignore normal packets received on a link
	 *	 in the BLOCKING state.  The point of being in that state
	 *	 is to avoid getting duplicate packets.
	 *
	 *	 HOWEVER, if LINK2 is set the normal spanning tree code
	 *	 will mark an interface BLOCKING to avoid multi-cast/broadcast
	 *	 loops.  Unicast packets CAN still loop if we allow the
	 *	 case (hence we only do it in LINK2), but it isn't quite as
	 *	 bad as a broadcast packet looping.
	 */
	if (bif->bif_flags & IFBIF_STP) {
		switch (bif->bif_state) {
		case BSTP_IFSTATE_L1BLOCKING:
		case BSTP_IFSTATE_LISTENING:
		case BSTP_IFSTATE_DISABLED:
			goto out;
		default:
			/* blocking, bonded, forwarding, learning */
			break;
		}
	}

	/*
	 * Unicast.  Make sure it's not for us.
	 *
	 * This loop is MPSAFE; the only blocking operation (bridge_rtupdate)
	 * is followed by breaking out of the loop.
	 */
	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		if (bif->bif_ifp->if_type != IFT_ETHER)
			continue;

		/*
		 * It is destined for an interface linked to the bridge.
		 * We want the bridge itself to take care of link level
		 * forwarding to member interfaces so reinput on the bridge.
		 * i.e. if you ping an IP on a target interface associated
		 * with the bridge, the arp is-at response should indicate
		 * the bridge MAC.
		 *
		 * Only update our addr list when learning if the port
		 * is not in a blocking state.  If it is we still allow
		 * the packet but we do not try to learn from it.
		 */
		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
			   ETHER_ADDR_LEN) == 0) {
			if (bif->bif_ifp != ifp) {
				/* XXX loop prevention */
				m->m_flags |= M_ETHER_BRIDGED;
			}
			if ((bif->bif_flags & IFBIF_LEARNING) &&
			    ((bif->bif_flags & IFBIF_STP) == 0 ||
			     bif->bif_state != BSTP_IFSTATE_BLOCKING)) {
				bridge_rtupdate(sc, eh->ether_shost,
						ifp, IFBAF_DYNAMIC);
			}
			new_ifp = bifp; /* not bif->bif_ifp */
			m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
			goto out;
		}

		/*
		 * Ignore received packets that were sent by us.
		 */
		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
			   ETHER_ADDR_LEN) == 0) {
			m_freem(m);
			m = NULL;
			goto out;
		}
	}

	/*
	 * It isn't for us.
	 *
	 * Perform the bridge forwarding function, but disallow bridging
	 * to interfaces in the blocking state if the packet came in on
	 * an interface in the blocking state.
	 *
	 * (bridge_forward also updates the addr cache).
	 */
	bridge_forward(sc, m);
	m = NULL;

	/*
	 * ether_reinput_oncpu() will reprocess rcvif as
	 * coming from new_ifp (since we do not specify
	 * REINPUT_KEEPRCVIF).
	 */
out:
	if (new_ifp != NULL) {
		/*
		 * Clear the bridge flag for local processing in
		 * case the packet gets routed.
		 */
		ether_reinput_oncpu(new_ifp, m, REINPUT_RUNBPF);
		m = NULL;
	}
	return (m);
}

/*
 * bridge_start_bcast:
 *
 *	Broadcast the packet sent from bridge to all member
 *	interfaces.
 *	This is a simplified version of bridge_broadcast(), however,
 *	this function expects caller to hold bridge's serializer.
 */
static void
bridge_start_bcast(struct bridge_softc *sc, struct mbuf *m)
{
	struct bridge_iflist *bif;
	struct mbuf *mc;
	struct ifnet *dst_if, *alt_if, *bifp;
	int used = 0;
	int found = 0;
	int alt_priority;

	mbuftrackid(m, 68);
	bifp = sc->sc_ifp;
	ASSERT_IFNET_SERIALIZED_ALL(bifp);

	/*
	 * Following loop is MPSAFE; nothing is blocking
	 * in the loop body.
	 *
	 * NOTE: We transmit through an member in the BLOCKING state only
	 *	 as a last resort.
	 */
	alt_if = NULL;
	alt_priority = 0;

	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
		dst_if = bif->bif_ifp;

		if (bif->bif_flags & IFBIF_STP) {
			switch (bif->bif_state) {
			case BSTP_IFSTATE_BLOCKING:
				if (bif->bif_priority > alt_priority) {
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				/* fall through */
			case BSTP_IFSTATE_L1BLOCKING:
			case BSTP_IFSTATE_DISABLED:
				continue;
			default:
				/* listening, learning, bonded, forwarding */
				break;
			}
		}

		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
			continue;

		if ((dst_if->if_flags & IFF_RUNNING) == 0)
			continue;

		if (TAILQ_NEXT(bif, bif_next) == NULL) {
			mc = m;
			used = 1;
		} else {
			mc = m_copypacket(m, M_NOWAIT);
			if (mc == NULL) {
				IFNET_STAT_INC(bifp, oerrors, 1);
				continue;
			}
		}
		found = 1;
		bridge_enqueue(dst_if, mc);
	}

	if (found == 0 && alt_if) {
		KKASSERT(used == 0);
		mc = m;
		used = 1;
		bridge_enqueue(alt_if, mc);
	}

	if (used == 0)
		m_freem(m);
}

/*
 * bridge_broadcast:
 *
 * Send a frame to all interfaces that are members of the bridge, except
 * for the one on which the packet arrived.
 */
static void
bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if, struct mbuf *m)
{
	struct bridge_iflist *bif, *nbif;
	struct ether_header *eh;
	struct mbuf *mc;
	struct ifnet *dst_if, *alt_if, *bifp;
	int used;
	int found;
	int alt_priority;
	int from_us;
	uint8_t alt_state;

	mbuftrackid(m, 69);
	bifp = sc->sc_ifp;
	ASSERT_IFNET_NOT_SERIALIZED_ALL(bifp);

	eh = mtod(m, struct ether_header *);
	from_us = bridge_from_us(sc, eh);

	if (inet_pfil_hook.ph_hashooks > 0
#ifdef INET6
	    || inet6_pfil_hook.ph_hashooks > 0
#endif
	    )
	{
		if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
			return;
		if (m == NULL)
			return;

		/* Filter on the bridge interface before broadcasting */
		if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
			return;
		if (m == NULL)
			return;
	}

	alt_state = BSTP_IFSTATE_LEARNING;
	alt_if = NULL;
	alt_priority = 0;
	found = 0;
	used = 0;

	TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid], bif_next, nbif) {
		dst_if = bif->bif_ifp;

		if ((dst_if->if_flags & IFF_RUNNING) == 0)
			continue;

		/*
		 * Don't bounce the packet out the same interface it came
		 * in on.  We have to test MAC addresses because a packet
		 * can come in a bonded interface and we don't want it to
		 * be echod out the forwarding interface for the same bonding
		 * set.
		 */
		if (src_if &&
		    memcmp(IF_LLADDR(src_if), IF_LLADDR(dst_if),
			   ETHER_ADDR_LEN) == 0)
	        {
			continue;
		}

		/*
		 * Generally speaking we only broadcast through forwarding
		 * interfaces.  If no interfaces are available we select
		 * a BONDED, BLOCKING, or LEARNING interface to forward
		 * through.
		 */
		if (bif->bif_flags & IFBIF_STP) {
			switch (bif->bif_state) {
			case BSTP_IFSTATE_LEARNING:
				if (alt_state == BSTP_IFSTATE_LEARNING &&
				    bif->bif_priority > alt_priority)
				{
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				continue;
			case BSTP_IFSTATE_BLOCKING:
				if (alt_state == BSTP_IFSTATE_LEARNING ||
				    (alt_state == BSTP_IFSTATE_BLOCKING &&
				     bif->bif_priority > alt_priority))
				{
					alt_state = BSTP_IFSTATE_BLOCKING;
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				continue;
			case BSTP_IFSTATE_BONDED:
				if (alt_state != BSTP_IFSTATE_BONDED ||
				    bif->bif_priority > alt_priority)
				{
					alt_state = BSTP_IFSTATE_BONDED;
					alt_priority = bif->bif_priority;
					alt_if = bif->bif_ifp;
				}
				continue;
			case BSTP_IFSTATE_L1BLOCKING:
			case BSTP_IFSTATE_DISABLED:
			case BSTP_IFSTATE_LISTENING:
				continue;
			default:
				/* forwarding */
				break;
			}
		}

		/*
		 * FORWARDING
		 */
		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
		{
			continue;
		}

		/*
		 * Last interface in list?
		 */
		if (TAILQ_NEXT(bif, bif_next) == NULL) {
			mc = m;
			used = 1;
		} else {
			mc = m_copypacket(m, M_NOWAIT);
			if (mc == NULL) {
				IFNET_STAT_INC(sc->sc_ifp, oerrors, 1);
				continue;
			}
		}
		found = 1;

		/*
		 * Filter on the output interface.  Pass a NULL bridge
		 * interface pointer so we do not redundantly filter on
		 * the bridge for each interface we broadcast on.
		 */
		if (inet_pfil_hook.ph_hashooks > 0
#ifdef INET6
		    || inet6_pfil_hook.ph_hashooks > 0
#endif
		    )
		{
			if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
				continue;
			if (mc == NULL)
				continue;
		}
		bridge_handoff(sc, dst_if, mc, from_us);

		if (nbif != NULL && !nbif->bif_onlist) {
			KKASSERT(bif->bif_onlist);
			nbif = TAILQ_NEXT(bif, bif_next);
		}
	}

	if (found == 0 && alt_if) {
		KKASSERT(used == 0);
		mc = m;
		used = 1;
		bridge_enqueue(alt_if, mc);
	}

	if (used == 0)
		m_freem(m);
}

/*
 * bridge_span:
 *
 *	Duplicate a packet out one or more interfaces that are in span mode,
 *	the original mbuf is unmodified.
 */
static void
bridge_span(struct bridge_softc *sc, struct mbuf *m)
{
	struct bridge_iflist *bif;
	struct ifnet *dst_if, *bifp;
	struct mbuf *mc;

	mbuftrackid(m, 70);
	bifp = sc->sc_ifp;
	ifnet_serialize_all(bifp);

	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
		dst_if = bif->bif_ifp;

		if ((dst_if->if_flags & IFF_RUNNING) == 0)
			continue;

		mc = m_copypacket(m, M_NOWAIT);
		if (mc == NULL) {
			IFNET_STAT_INC(sc->sc_ifp, oerrors, 1);
			continue;
		}
		bridge_enqueue(dst_if, mc);
	}

	ifnet_deserialize_all(bifp);
}

static void
bridge_rtmsg_sync_handler(netmsg_t msg)
{
	netisr_forwardmsg(&msg->base, mycpuid + 1);
}

static void
bridge_rtmsg_sync(struct bridge_softc *sc)
{
	struct netmsg_base msg;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	/* XXX use netmsg_service_sync */
	netmsg_init(&msg, NULL, &curthread->td_msgport,
		    0, bridge_rtmsg_sync_handler);
	netisr_domsg(&msg, 0);
}

static __inline void
bridge_rtinfo_update(struct bridge_rtinfo *bri, struct ifnet *dst_if,
		     int setflags, uint8_t flags, uint32_t timeo)
{
	if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
	    bri->bri_ifp != dst_if)
		bri->bri_ifp = dst_if;
	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
	    bri->bri_expire != time_uptime + timeo)
		bri->bri_expire = time_uptime + timeo;
	if (setflags)
		bri->bri_flags = flags;
}

static int
bridge_rtinstall_oncpu(struct bridge_softc *sc, const uint8_t *dst,
		       struct ifnet *dst_if, int setflags, uint8_t flags,
		       struct bridge_rtinfo **bri0)
{
	struct bridge_rtnode *brt;
	struct bridge_rtinfo *bri;

	if (mycpuid == 0) {
		brt = bridge_rtnode_lookup(sc, dst);
		if (brt != NULL) {
			/*
			 * rtnode for 'dst' already exists.  We inform the
			 * caller about this by leaving bri0 as NULL.  The
			 * caller will terminate the intallation upon getting
			 * NULL bri0.  However, we still need to update the
			 * rtinfo.
			 */
			KKASSERT(*bri0 == NULL);

			/* Update rtinfo */
			bridge_rtinfo_update(brt->brt_info, dst_if, setflags,
					     flags, sc->sc_brttimeout);
			return 0;
		}

		/*
		 * We only need to check brtcnt on CPU0, since if limit
		 * is to be exceeded, ENOSPC is returned.  Caller knows
		 * this and will terminate the installation.
		 */
		if (sc->sc_brtcnt >= sc->sc_brtmax)
			return ENOSPC;

		KKASSERT(*bri0 == NULL);
		bri = kmalloc(sizeof(struct bridge_rtinfo), M_DEVBUF,
				  M_WAITOK | M_ZERO);
		*bri0 = bri;

		/* Setup rtinfo */
		bri->bri_flags = IFBAF_DYNAMIC;
		bridge_rtinfo_update(bri, dst_if, setflags, flags,
				     sc->sc_brttimeout);
	} else {
		bri = *bri0;
		KKASSERT(bri != NULL);
	}

	brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
		      M_WAITOK | M_ZERO);
	memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
	brt->brt_info = bri;
	atomic_add_int(&bri->bri_refs, 1);

	bridge_rtnode_insert(sc, brt);
	return 0;
}

static void
bridge_rtinstall_handler(netmsg_t msg)
{
	struct netmsg_brsaddr *brmsg = (struct netmsg_brsaddr *)msg;
	int error;

	error = bridge_rtinstall_oncpu(brmsg->br_softc,
				       brmsg->br_dst, brmsg->br_dst_if,
				       brmsg->br_setflags, brmsg->br_flags,
				       &brmsg->br_rtinfo);
	if (error) {
		KKASSERT(mycpuid == 0 && brmsg->br_rtinfo == NULL);
		netisr_replymsg(&brmsg->base, error);
		return;
	} else if (brmsg->br_rtinfo == NULL) {
		/* rtnode already exists for 'dst' */
		KKASSERT(mycpuid == 0);
		netisr_replymsg(&brmsg->base, 0);
		return;
	}
	netisr_forwardmsg(&brmsg->base, mycpuid + 1);
}

/*
 * bridge_rtupdate:
 *
 *	Add/Update a bridge routing entry.
 */
static int
bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
		struct ifnet *dst_if, uint8_t flags)
{
	struct bridge_rtnode *brt;

	/*
	 * A route for this destination might already exist.  If so,
	 * update it, otherwise create a new one.
	 */
	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
		struct netmsg_brsaddr *brmsg;

		if (sc->sc_brtcnt >= sc->sc_brtmax)
			return ENOSPC;

		brmsg = kmalloc(sizeof(*brmsg), M_LWKTMSG, M_WAITOK | M_NULLOK);
		if (brmsg == NULL)
			return ENOMEM;

		netmsg_init(&brmsg->base, NULL, &netisr_afree_rport,
			    0, bridge_rtinstall_handler);
		memcpy(brmsg->br_dst, dst, ETHER_ADDR_LEN);
		brmsg->br_dst_if = dst_if;
		brmsg->br_flags = flags;
		brmsg->br_setflags = 0;
		brmsg->br_softc = sc;
		brmsg->br_rtinfo = NULL;

		netisr_sendmsg(&brmsg->base, 0);
		return 0;
	}
	bridge_rtinfo_update(brt->brt_info, dst_if, 0, flags,
			     sc->sc_brttimeout);
	return 0;
}

static int
bridge_rtsaddr(struct bridge_softc *sc, const uint8_t *dst,
	       struct ifnet *dst_if, uint8_t flags)
{
	struct netmsg_brsaddr brmsg;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	netmsg_init(&brmsg.base, NULL, &curthread->td_msgport,
		    0, bridge_rtinstall_handler);
	memcpy(brmsg.br_dst, dst, ETHER_ADDR_LEN);
	brmsg.br_dst_if = dst_if;
	brmsg.br_flags = flags;
	brmsg.br_setflags = 1;
	brmsg.br_softc = sc;
	brmsg.br_rtinfo = NULL;

	return netisr_domsg(&brmsg.base, 0);
}

/*
 * bridge_rtlookup:
 *
 *	Lookup the destination interface for an address.
 */
static struct ifnet *
bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
{
	struct bridge_rtnode *brt;

	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
		return NULL;
	return brt->brt_info->bri_ifp;
}

static void
bridge_rtreap_handler(netmsg_t msg)
{
	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
	struct bridge_rtnode *brt, *nbrt;

	LIST_FOREACH_MUTABLE(brt, &sc->sc_rtlists[mycpuid], brt_list, nbrt) {
		if (brt->brt_info->bri_dead)
			bridge_rtnode_destroy(sc, brt);
	}
	netisr_forwardmsg(&msg->base, mycpuid + 1);
}

static void
bridge_rtreap(struct bridge_softc *sc)
{
	struct netmsg_base msg;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	netmsg_init(&msg, NULL, &curthread->td_msgport,
		    0, bridge_rtreap_handler);
	msg.lmsg.u.ms_resultp = sc;

	netisr_domsg(&msg, 0);
}

static void
bridge_rtreap_async(struct bridge_softc *sc)
{
	struct netmsg_base *msg;

	msg = kmalloc(sizeof(*msg), M_LWKTMSG, M_WAITOK);

	netmsg_init(msg, NULL, &netisr_afree_rport,
		    0, bridge_rtreap_handler);
	msg->lmsg.u.ms_resultp = sc;

	netisr_sendmsg(msg, 0);
}

/*
 * bridge_rttrim:
 *
 *	Trim the routine table so that we have a number
 *	of routing entries less than or equal to the
 *	maximum number.
 */
static void
bridge_rttrim(struct bridge_softc *sc)
{
	struct bridge_rtnode *brt;
	int dead;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	/* Make sure we actually need to do this. */
	if (sc->sc_brtcnt <= sc->sc_brtmax)
		return;

	/*
	 * Find out how many rtnodes are dead
	 */
	dead = bridge_rtage_finddead(sc);
	KKASSERT(dead <= sc->sc_brtcnt);

	if (sc->sc_brtcnt - dead <= sc->sc_brtmax) {
		/* Enough dead rtnodes are found */
		bridge_rtreap(sc);
		return;
	}

	/*
	 * Kill some dynamic rtnodes to meet the brtmax
	 */
	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
		struct bridge_rtinfo *bri = brt->brt_info;

		if (bri->bri_dead) {
			/*
			 * We have counted this rtnode in
			 * bridge_rtage_finddead()
			 */
			continue;
		}

		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
			bri->bri_dead = 1;
			++dead;
			KKASSERT(dead <= sc->sc_brtcnt);

			if (sc->sc_brtcnt - dead <= sc->sc_brtmax) {
				/* Enough rtnodes are collected */
				break;
			}
		}
	}
	if (dead)
		bridge_rtreap(sc);
}

/*
 * bridge_timer:
 *
 *	Aging timer for the bridge.
 */
static void
bridge_timer(void *arg)
{
	struct bridge_softc *sc = arg;
	struct netmsg_base *msg;

	KKASSERT(mycpuid == BRIDGE_CFGCPU);

	crit_enter();

	if (callout_pending(&sc->sc_brcallout) ||
	    !callout_active(&sc->sc_brcallout)) {
		crit_exit();
		return;
	}
	callout_deactivate(&sc->sc_brcallout);

	msg = &sc->sc_brtimemsg;
	KKASSERT(msg->lmsg.ms_flags & MSGF_DONE);
	lwkt_sendmsg_oncpu(BRIDGE_CFGPORT, &msg->lmsg);

	crit_exit();
}

static void
bridge_timer_handler(netmsg_t msg)
{
	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;

	KKASSERT(&curthread->td_msgport == BRIDGE_CFGPORT);

	crit_enter();
	/* Reply ASAP */
	lwkt_replymsg(&msg->lmsg, 0);
	crit_exit();

	bridge_rtage(sc);
	if (sc->sc_ifp->if_flags & IFF_RUNNING) {
		callout_reset(&sc->sc_brcallout,
		    bridge_rtable_prune_period * hz, bridge_timer, sc);
	}
}

static int
bridge_rtage_finddead(struct bridge_softc *sc)
{
	struct bridge_rtnode *brt;
	int dead = 0;

	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
		struct bridge_rtinfo *bri = brt->brt_info;

		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
		    time_uptime >= bri->bri_expire) {
			bri->bri_dead = 1;
			++dead;
			KKASSERT(dead <= sc->sc_brtcnt);
		}
	}
	return dead;
}

/*
 * bridge_rtage:
 *
 *	Perform an aging cycle.
 */
static void
bridge_rtage(struct bridge_softc *sc)
{
	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	if (bridge_rtage_finddead(sc))
		bridge_rtreap(sc);
}

/*
 * bridge_rtflush:
 *
 *	Remove all dynamic addresses from the bridge.
 */
static void
bridge_rtflush(struct bridge_softc *sc, int bf)
{
	struct bridge_rtnode *brt;
	int reap;

	reap = 0;
	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
		struct bridge_rtinfo *bri = brt->brt_info;

		if ((bf & IFBF_FLUSHALL) ||
		    (bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
			bri->bri_dead = 1;
			reap = 1;
		}
	}
	if (reap) {
		if (bf & IFBF_FLUSHSYNC)
			bridge_rtreap(sc);
		else
			bridge_rtreap_async(sc);
	}
}

/*
 * bridge_rtdaddr:
 *
 *	Remove an address from the table.
 */
static int
bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
{
	struct bridge_rtnode *brt;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
		return (ENOENT);

	/* TODO: add a cheaper delete operation */
	brt->brt_info->bri_dead = 1;
	bridge_rtreap(sc);
	return (0);
}

/*
 * bridge_rtdelete:
 *
 *	Delete routes to a speicifc member interface.
 */
void
bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int bf)
{
	struct bridge_rtnode *brt;
	int reap;

	reap = 0;
	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
		struct bridge_rtinfo *bri = brt->brt_info;

		if (bri->bri_ifp == ifp &&
		    ((bf & IFBF_FLUSHALL) ||
		     (bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)) {
			bri->bri_dead = 1;
			reap = 1;
		}
	}
	if (reap) {
		if (bf & IFBF_FLUSHSYNC)
			bridge_rtreap(sc);
		else
			bridge_rtreap_async(sc);
	}
}

/*
 * bridge_rtable_init:
 *
 *	Initialize the route table for this bridge.
 */
static void
bridge_rtable_init(struct bridge_softc *sc)
{
	int cpu;

	/*
	 * Initialize per-cpu hash tables
	 */
	sc->sc_rthashs = kmalloc(sizeof(*sc->sc_rthashs) * netisr_ncpus,
				 M_DEVBUF, M_WAITOK);
	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
		int i;

		sc->sc_rthashs[cpu] =
		kmalloc(sizeof(struct bridge_rtnode_head) * BRIDGE_RTHASH_SIZE,
			M_DEVBUF, M_WAITOK);

		for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
			LIST_INIT(&sc->sc_rthashs[cpu][i]);
	}
	sc->sc_rthash_key = karc4random();

	/*
	 * Initialize per-cpu lists
	 */
	sc->sc_rtlists =
	    kmalloc(sizeof(struct bridge_rtnode_head) * netisr_ncpus,
	    M_DEVBUF, M_WAITOK);
	for (cpu = 0; cpu < netisr_ncpus; ++cpu)
		LIST_INIT(&sc->sc_rtlists[cpu]);
}

/*
 * bridge_rtable_fini:
 *
 *	Deconstruct the route table for this bridge.
 */
static void
bridge_rtable_fini(struct bridge_softc *sc)
{
	int cpu;

	/*
	 * Free per-cpu hash tables
	 */
	for (cpu = 0; cpu < netisr_ncpus; ++cpu)
		kfree(sc->sc_rthashs[cpu], M_DEVBUF);
	kfree(sc->sc_rthashs, M_DEVBUF);

	/*
	 * Free per-cpu lists
	 */
	kfree(sc->sc_rtlists, M_DEVBUF);
}

/*
 * The following hash function is adapted from "Hash Functions" by Bob Jenkins
 * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
 */
#define	mix(a, b, c)							\
do {									\
	a -= b; a -= c; a ^= (c >> 13);					\
	b -= c; b -= a; b ^= (a << 8);					\
	c -= a; c -= b; c ^= (b >> 13);					\
	a -= b; a -= c; a ^= (c >> 12);					\
	b -= c; b -= a; b ^= (a << 16);					\
	c -= a; c -= b; c ^= (b >> 5);					\
	a -= b; a -= c; a ^= (c >> 3);					\
	b -= c; b -= a; b ^= (a << 10);					\
	c -= a; c -= b; c ^= (b >> 15);					\
} while (/*CONSTCOND*/0)

static __inline uint32_t
bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
{
	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;

	b += addr[5] << 8;
	b += addr[4];
	a += addr[3] << 24;
	a += addr[2] << 16;
	a += addr[1] << 8;
	a += addr[0];

	mix(a, b, c);

	return (c & BRIDGE_RTHASH_MASK);
}

#undef mix

static int
bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
{
	int i, d;

	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
		d = ((int)a[i]) - ((int)b[i]);
	}

	return (d);
}

/*
 * bridge_rtnode_lookup:
 *
 *	Look up a bridge route node for the specified destination.
 */
static struct bridge_rtnode *
bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
{
	struct bridge_rtnode *brt;
	uint32_t hash;
	int dir;

	hash = bridge_rthash(sc, addr);
	LIST_FOREACH(brt, &sc->sc_rthashs[mycpuid][hash], brt_hash) {
		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
		if (dir == 0)
			return (brt);
		if (dir > 0)
			return (NULL);
	}

	return (NULL);
}

/*
 * bridge_rtnode_insert:
 *
 *	Insert the specified bridge node into the route table.
 *	Caller has to make sure that rtnode does not exist.
 */
static void
bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
{
	struct bridge_rtnode *lbrt;
	uint32_t hash;
	int dir;

	hash = bridge_rthash(sc, brt->brt_addr);

	lbrt = LIST_FIRST(&sc->sc_rthashs[mycpuid][hash]);
	if (lbrt == NULL) {
		LIST_INSERT_HEAD(&sc->sc_rthashs[mycpuid][hash],
				  brt, brt_hash);
		goto out;
	}

	do {
		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
		KASSERT(dir != 0, ("rtnode already exist"));

		if (dir > 0) {
			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
			goto out;
		}
		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
			goto out;
		}
		lbrt = LIST_NEXT(lbrt, brt_hash);
	} while (lbrt != NULL);

	panic("no suitable position found for rtnode");
out:
	LIST_INSERT_HEAD(&sc->sc_rtlists[mycpuid], brt, brt_list);
	if (mycpuid == 0) {
		/*
		 * Update the brtcnt.
		 * We only need to do it once and we do it on CPU0.
		 */
		sc->sc_brtcnt++;
	}
}

/*
 * bridge_rtnode_destroy:
 *
 *	Destroy a bridge rtnode.
 */
static void
bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
{
	struct bridge_rtinfo *bri;

	LIST_REMOVE(brt, brt_hash);
	LIST_REMOVE(brt, brt_list);

	bri = brt->brt_info;

	/*
	 * The bri_dead flag can be set asynchronously and catch some gc's
	 * in the middle, don't free bri until all references have actually
	 * gone away.
	 */
	if (atomic_fetchadd_int(&bri->bri_refs, -1) == 1) {
		/* Free rtinfo associated with rtnode on the last cpu */
		kfree(bri, M_DEVBUF);
		brt->brt_info = NULL;	/* safety */
	}
	kfree(brt, M_DEVBUF);

	if (mycpuid == 0) {
		/* Update brtcnt only on CPU0 */
		sc->sc_brtcnt--;
	}
}

static __inline int
bridge_post_pfil(struct mbuf *m)
{
	if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED)
		return EOPNOTSUPP;

	/* Not yet */
	if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED)
		return EOPNOTSUPP;

	return 0;
}

/*
 * Send bridge packets through pfil if they are one of the types pfil can deal
 * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
 * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
 * that interface.
 */
static int
bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
{
	int snap, error, i, hlen;
	struct ether_header *eh1, eh2;
	struct ip *ip;
	struct llc llc1;
	u_int16_t ether_type;

	snap = 0;
	error = -1;	/* Default error if not error == 0 */

	if (pfil_bridge == 0 && pfil_member == 0)
		return (0); /* filtering is disabled */

	i = min((*mp)->m_pkthdr.len, max_protohdr);
	if ((*mp)->m_len < i) {
		*mp = m_pullup(*mp, i);
		if (*mp == NULL) {
			kprintf("%s: m_pullup failed\n", __func__);
			return (-1);
		}
	}

	eh1 = mtod(*mp, struct ether_header *);
	ether_type = ntohs(eh1->ether_type);

	/*
	 * Check for SNAP/LLC.
	 */
	if (ether_type < ETHERMTU) {
		struct llc *llc2 = (struct llc *)(eh1 + 1);

		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
		    llc2->llc_dsap == LLC_SNAP_LSAP &&
		    llc2->llc_ssap == LLC_SNAP_LSAP &&
		    llc2->llc_control == LLC_UI) {
			ether_type = htons(llc2->llc_un.type_snap.ether_type);
			snap = 1;
		}
	}

	/*
	 * If we're trying to filter bridge traffic, don't look at anything
	 * other than IP and ARP traffic.  If the filter doesn't understand
	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
	 * but of course we don't have an AppleTalk filter to begin with.
	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
	 * ARP traffic.)
	 */
	switch (ether_type) {
	case ETHERTYPE_ARP:
	case ETHERTYPE_REVARP:
		return (0); /* Automatically pass */

	case ETHERTYPE_IP:
#ifdef INET6
	case ETHERTYPE_IPV6:
#endif /* INET6 */
		break;

	default:
		/*
		 * Check to see if the user wants to pass non-ip
		 * packets, these will not be checked by pfil(9)
		 * and passed unconditionally so the default is to drop.
		 */
		if (pfil_onlyip)
			goto bad;
	}

	/* Strip off the Ethernet header and keep a copy. */
	m_copydata(*mp, 0, ETHER_HDR_LEN, &eh2);
	m_adj(*mp, ETHER_HDR_LEN);

	/* Strip off snap header, if present */
	if (snap) {
		m_copydata(*mp, 0, sizeof(struct llc), &llc1);
		m_adj(*mp, sizeof(struct llc));
	}

	/*
	 * Check the IP header for alignment and errors
	 */
	if (dir == PFIL_IN) {
		switch (ether_type) {
		case ETHERTYPE_IP:
			error = bridge_ip_checkbasic(mp);
			break;
#ifdef INET6
		case ETHERTYPE_IPV6:
			error = bridge_ip6_checkbasic(mp);
			break;
#endif /* INET6 */
		default:
			error = 0;
		}
		if (error)
			goto bad;
	}

	error = 0;

	/*
	 * Run the packet through pfil
	 */
	switch (ether_type) {
	case ETHERTYPE_IP:
		/*
		 * Run pfil on the member interface and the bridge, both can
		 * be skipped by clearing pfil_member or pfil_bridge.
		 *
		 * Keep the order:
		 *   in_if -> bridge_if -> out_if
		 */
		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL) {
			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
			if (*mp == NULL || error != 0) /* filter may consume */
				break;
			error = bridge_post_pfil(*mp);
			if (error)
				break;
		}

		if (pfil_member && ifp != NULL) {
			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp, dir);
			if (*mp == NULL || error != 0) /* filter may consume */
				break;
			error = bridge_post_pfil(*mp);
			if (error)
				break;
		}

		if (pfil_bridge && dir == PFIL_IN && bifp != NULL) {
			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
			if (*mp == NULL || error != 0) /* filter may consume */
				break;
			error = bridge_post_pfil(*mp);
			if (error)
				break;
		}

		/* check if we need to fragment the packet */
		if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
			i = (*mp)->m_pkthdr.len;
			if (i > ifp->if_mtu) {
				error = bridge_fragment(ifp, *mp, &eh2, snap,
					    &llc1);
				return (error);
			}
		}

		/* Recalculate the ip checksum and restore byte ordering */
		ip = mtod(*mp, struct ip *);
		hlen = ip->ip_hl << 2;
		if (hlen < sizeof(struct ip))
			goto bad;
		if (hlen > (*mp)->m_len) {
			if ((*mp = m_pullup(*mp, hlen)) == NULL)
				goto bad;
			ip = mtod(*mp, struct ip *);
			if (ip == NULL)
				goto bad;
		}
		ip->ip_sum = 0;
		if (hlen == sizeof(struct ip))
			ip->ip_sum = in_cksum_hdr(ip);
		else
			ip->ip_sum = in_cksum(*mp, hlen);

		break;
#ifdef INET6
	case ETHERTYPE_IPV6:
		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
					dir);

		if (*mp == NULL || error != 0) /* filter may consume */
			break;

		if (pfil_member && ifp != NULL)
			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
					dir);

		if (*mp == NULL || error != 0) /* filter may consume */
			break;

		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
					dir);
		break;
#endif
	default:
		error = 0;
		break;
	}

	if (*mp == NULL)
		return (error);
	if (error != 0)
		goto bad;

	error = -1;

	/*
	 * Finally, put everything back the way it was and return
	 */
	if (snap) {
		M_PREPEND(*mp, sizeof(struct llc), M_NOWAIT);
		if (*mp == NULL)
			return (error);
		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
	}

	M_PREPEND(*mp, ETHER_HDR_LEN, M_NOWAIT);
	if (*mp == NULL)
		return (error);
	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);

	return (0);

bad:
	m_freem(*mp);
	*mp = NULL;
	return (error);
}

/*
 * Perform basic checks on header size since
 * pfil assumes ip_input has already processed
 * it for it.  Cut-and-pasted from ip_input.c.
 * Given how simple the IPv6 version is,
 * does the IPv4 version really need to be
 * this complicated?
 *
 * XXX Should we update ipstat here, or not?
 * XXX Right now we update ipstat but not
 * XXX csum_counter.
 */
static int
bridge_ip_checkbasic(struct mbuf **mp)
{
	struct mbuf *m = *mp;
	struct ip *ip;
	int len, hlen;
	u_short sum;

	if (*mp == NULL)
		return (-1);
#if 0 /* notyet */
	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
		if ((m = m_copyup(m, sizeof(struct ip),
			(max_linkhdr + 3) & ~3)) == NULL) {
			/* XXXJRT new stat, please */
			ipstat.ips_toosmall++;
			goto bad;
		}
	} else
#endif
#ifndef __predict_false
#define __predict_false(x) x
#endif
	 if (__predict_false(m->m_len < sizeof (struct ip))) {
		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
			ipstat.ips_toosmall++;
			goto bad;
		}
	}
	ip = mtod(m, struct ip *);
	if (ip == NULL) goto bad;

	if (ip->ip_v != IPVERSION) {
		ipstat.ips_badvers++;
		goto bad;
	}
	hlen = ip->ip_hl << 2;
	if (hlen < sizeof(struct ip)) { /* minimum header length */
		ipstat.ips_badhlen++;
		goto bad;
	}
	if (hlen > m->m_len) {
		if ((m = m_pullup(m, hlen)) == NULL) {
			ipstat.ips_badhlen++;
			goto bad;
		}
		ip = mtod(m, struct ip *);
		if (ip == NULL) goto bad;
	}

	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
	} else {
		if (hlen == sizeof(struct ip)) {
			sum = in_cksum_hdr(ip);
		} else {
			sum = in_cksum(m, hlen);
		}
	}
	if (sum) {
		ipstat.ips_badsum++;
		goto bad;
	}

	/* Retrieve the packet length. */
	len = ntohs(ip->ip_len);

	/*
	 * Check for additional length bogosity
	 */
	if (len < hlen) {
		ipstat.ips_badlen++;
		goto bad;
	}

	/*
	 * Check that the amount of data in the buffers
	 * is as at least much as the IP header would have us expect.
	 * Drop packet if shorter than we expect.
	 */
	if (m->m_pkthdr.len < len) {
		ipstat.ips_tooshort++;
		goto bad;
	}

	/* Checks out, proceed */
	*mp = m;
	return (0);

bad:
	*mp = m;
	return (-1);
}

#ifdef INET6
/*
 * Same as above, but for IPv6.
 * Cut-and-pasted from ip6_input.c.
 * XXX Should we update ip6stat, or not?
 */
static int
bridge_ip6_checkbasic(struct mbuf **mp)
{
	struct mbuf *m = *mp;
	struct ip6_hdr *ip6;

	/*
	 * If the IPv6 header is not aligned, slurp it up into a new
	 * mbuf with space for link headers, in the event we forward
	 * it.  Otherwise, if it is aligned, make sure the entire base
	 * IPv6 header is in the first mbuf of the chain.
	 */
#if 0 /* notyet */
	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
		struct ifnet *inifp = m->m_pkthdr.rcvif;
		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
			    (max_linkhdr + 3) & ~3)) == NULL) {
			/* XXXJRT new stat, please */
			ip6stat.ip6s_toosmall++;
			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
			goto bad;
		}
	} else
#endif
	if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
		struct ifnet *inifp = m->m_pkthdr.rcvif;
		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
			ip6stat.ip6s_toosmall++;
			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
			goto bad;
		}
	}

	ip6 = mtod(m, struct ip6_hdr *);

	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
		ip6stat.ip6s_badvers++;
		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
		goto bad;
	}

	/* Checks out, proceed */
	*mp = m;
	return (0);

bad:
	*mp = m;
	return (-1);
}
#endif /* INET6 */

/*
 * bridge_fragment:
 *
 *	Return a fragmented mbuf chain.
 */
static int
bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
    int snap, struct llc *llc)
{
	struct mbuf *m0;
	struct ip *ip;
	int error = -1;

	if (m->m_len < sizeof(struct ip) &&
	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
		goto out;
	ip = mtod(m, struct ip *);

	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
		    CSUM_DELAY_IP);
	if (error)
		goto out;

	/* walk the chain and re-add the Ethernet header */
	for (m0 = m; m0; m0 = m0->m_nextpkt) {
		if (error == 0) {
			if (snap) {
				M_PREPEND(m0, sizeof(struct llc), M_NOWAIT);
				if (m0 == NULL) {
					error = ENOBUFS;
					continue;
				}
				bcopy(llc, mtod(m0, caddr_t),
				    sizeof(struct llc));
			}
			M_PREPEND(m0, ETHER_HDR_LEN, M_NOWAIT);
			if (m0 == NULL) {
				error = ENOBUFS;
				continue;
			}
			bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
		} else
			m_freem(m);
	}

	if (error == 0)
		ipstat.ips_fragmented++;

	return (error);

out:
	if (m != NULL)
		m_freem(m);
	return (error);
}

static void
bridge_enqueue_handler(netmsg_t msg)
{
	struct netmsg_packet *nmp;
	struct ifnet *dst_ifp;
	struct mbuf *m;

	nmp = &msg->packet;
	m = nmp->nm_packet;
	dst_ifp = nmp->base.lmsg.u.ms_resultp;
	mbuftrackid(m, 71);

	bridge_handoff(dst_ifp->if_bridge, dst_ifp, m, 1);
}

static void
bridge_handoff(struct bridge_softc *sc, struct ifnet *dst_ifp,
	       struct mbuf *m, int from_us)
{
	struct mbuf *m0;
	struct ifnet *bifp;

	bifp = sc->sc_ifp;
	mbuftrackid(m, 72);

	/* We may be sending a fragment so traverse the mbuf */
	for (; m; m = m0) {
		struct altq_pktattr pktattr;

		m0 = m->m_nextpkt;
		m->m_nextpkt = NULL;

		/*
		 * If being sent from our host override ether_shost
		 * with the bridge MAC.  This is mandatory for ARP
		 * so things don't get confused.  In particular we
		 * don't want ARPs to get associated with link interfaces
		 * under the bridge which might or might not stay valid.
		 *
		 * Also override ether_shost when relaying a packet out
		 * the same interface it came in on, due to multi-homed
		 * addresses & default routes, otherwise switches will
		 * get very confused.
		 *
		 * Otherwise if we are in transparent mode.
		 */
		if (from_us || m->m_pkthdr.rcvif == dst_ifp) {
			m_copyback(m,
				   offsetof(struct ether_header, ether_shost),
				   ETHER_ADDR_LEN, IF_LLADDR(sc->sc_ifp));
		} else if ((bifp->if_flags & IFF_LINK0) &&
			   (m->m_pkthdr.fw_flags & BRIDGE_MBUF_TAGGED)) {
			m_copyback(m,
				   offsetof(struct ether_header, ether_shost),
				   ETHER_ADDR_LEN,
				   m->m_pkthdr.ether_br_shost);
		} /* else retain shost */

		if (ifq_is_enabled(&dst_ifp->if_snd))
			altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);

		ifq_dispatch(dst_ifp, m, &pktattr);
	}
}

static void
bridge_control_dispatch(netmsg_t msg)
{
	struct netmsg_brctl *bc_msg = (struct netmsg_brctl *)msg;
	struct ifnet *bifp = bc_msg->bc_sc->sc_ifp;
	int error;

	ifnet_serialize_all(bifp);
	error = bc_msg->bc_func(bc_msg->bc_sc, bc_msg->bc_arg);
	ifnet_deserialize_all(bifp);

	lwkt_replymsg(&bc_msg->base.lmsg, error);
}

static int
bridge_control(struct bridge_softc *sc, u_long cmd,
	       bridge_ctl_t bc_func, void *bc_arg)
{
	struct ifnet *bifp = sc->sc_ifp;
	struct netmsg_brctl bc_msg;
	int error;

	ASSERT_IFNET_SERIALIZED_ALL(bifp);

	bzero(&bc_msg, sizeof(bc_msg));

	netmsg_init(&bc_msg.base, NULL, &curthread->td_msgport,
		    0, bridge_control_dispatch);
	bc_msg.bc_func = bc_func;
	bc_msg.bc_sc = sc;
	bc_msg.bc_arg = bc_arg;

	ifnet_deserialize_all(bifp);
	error = lwkt_domsg(BRIDGE_CFGPORT, &bc_msg.base.lmsg, 0);
	ifnet_serialize_all(bifp);
	return error;
}

static void
bridge_add_bif_handler(netmsg_t msg)
{
	struct netmsg_braddbif *amsg = (struct netmsg_braddbif *)msg;
	struct bridge_softc *sc;
	struct bridge_iflist *bif;

	sc = amsg->br_softc;

	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK | M_ZERO);
	bif->bif_ifp = amsg->br_bif_ifp;
	bif->bif_onlist = 1;
	bif->bif_info = amsg->br_bif_info;

	/*
	 * runs through bif_info
	 */
	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;

	TAILQ_INSERT_HEAD(&sc->sc_iflists[mycpuid], bif, bif_next);

	netisr_forwardmsg(&amsg->base, mycpuid + 1);
}

static void
bridge_add_bif(struct bridge_softc *sc, struct bridge_ifinfo *bif_info,
	       struct ifnet *ifp)
{
	struct netmsg_braddbif amsg;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	netmsg_init(&amsg.base, NULL, &curthread->td_msgport,
		    0, bridge_add_bif_handler);
	amsg.br_softc = sc;
	amsg.br_bif_info = bif_info;
	amsg.br_bif_ifp = ifp;

	netisr_domsg(&amsg.base, 0);
}

static void
bridge_del_bif_handler(netmsg_t msg)
{
	struct netmsg_brdelbif *dmsg = (struct netmsg_brdelbif *)msg;
	struct bridge_softc *sc;
	struct bridge_iflist *bif;

	sc = dmsg->br_softc;

	/*
	 * Locate the bif associated with the br_bif_info
	 * on the current CPU
	 */
	bif = bridge_lookup_member_ifinfo(sc, dmsg->br_bif_info);
	KKASSERT(bif != NULL && bif->bif_onlist);

	/* Remove the bif from the current CPU's iflist */
	bif->bif_onlist = 0;
	TAILQ_REMOVE(dmsg->br_bif_list, bif, bif_next);

	/* Save the removed bif for later freeing */
	TAILQ_INSERT_HEAD(dmsg->br_bif_list, bif, bif_next);

	netisr_forwardmsg(&dmsg->base, mycpuid + 1);
}

static void
bridge_del_bif(struct bridge_softc *sc, struct bridge_ifinfo *bif_info,
	       struct bridge_iflist_head *saved_bifs)
{
	struct netmsg_brdelbif dmsg;

	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);

	netmsg_init(&dmsg.base, NULL, &curthread->td_msgport,
		    0, bridge_del_bif_handler);
	dmsg.br_softc = sc;
	dmsg.br_bif_info = bif_info;
	dmsg.br_bif_list = saved_bifs;

	netisr_domsg(&dmsg.base, 0);
}