xref: /dflybsd-src/sys/net/bridge/if_bridge.c (revision 16e9ff28733d8bd9941b9770d79be966ba221f5f)
1 /*
2  * Copyright 2001 Wasabi Systems, Inc.
3  * All rights reserved.
4  *
5  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed for the NetBSD Project by
18  *	Wasabi Systems, Inc.
19  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
20  *    or promote products derived from this software without specific prior
21  *    written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33  * POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /*
37  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
38  * All rights reserved.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  * 3. All advertising materials mentioning features or use of this software
49  *    must display the following acknowledgement:
50  *	This product includes software developed by Jason L. Wright
51  * 4. The name of the author may not be used to endorse or promote products
52  *    derived from this software without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
55  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
56  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
57  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
58  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
59  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
60  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
63  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
64  * POSSIBILITY OF SUCH DAMAGE.
65  *
66  * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
67  * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
68  * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
69  */
70 
71 /*
72  * Network interface bridge support.
73  *
74  * TODO:
75  *
76  *	- Currently only supports Ethernet-like interfaces (Ethernet,
77  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
78  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
79  *	  consider heterogenous bridges).
80  *
81  *
82  * Bridge's route information is duplicated to each CPUs:
83  *
84  *      CPU0          CPU1          CPU2          CPU3
85  * +-----------+ +-----------+ +-----------+ +-----------+
86  * |  rtnode   | |  rtnode   | |  rtnode   | |  rtnode   |
87  * |           | |           | |           | |           |
88  * | dst eaddr | | dst eaddr | | dst eaddr | | dst eaddr |
89  * +-----------+ +-----------+ +-----------+ +-----------+
90  *       |         |                     |         |
91  *       |         |                     |         |
92  *       |         |     +----------+    |         |
93  *       |         |     |  rtinfo  |    |         |
94  *       |         +---->|          |<---+         |
95  *       |               |  flags   |              |
96  *       +-------------->|  timeout |<-------------+
97  *                       |  dst_ifp |
98  *                       +----------+
99  *
100  * We choose to put timeout and dst_ifp into shared part, so updating
101  * them will be cheaper than using message forwarding.  Also there is
102  * not need to use spinlock to protect the updating: timeout and dst_ifp
103  * is not related and specific field's updating order has no importance.
104  * The cache pollution by the share part should not be heavy: in a stable
105  * setup, dst_ifp probably will be not changed in rtnode's life time,
106  * while timeout is refreshed once per second; most of the time, timeout
107  * and dst_ifp are read-only accessed.
108  *
109  *
110  * Bridge route information installation on bridge_input path:
111  *
112  *      CPU0           CPU1         CPU2          CPU3
113  *
114  *                               tcp_thread2
115  *                                    |
116  *                                alloc nmsg
117  *                    snd nmsg        |
118  *                    w/o rtinfo      |
119  *      ifnet0<-----------------------+
120  *        |                           :
121  *    lookup dst                      :
122  *   rtnode exists?(Y)free nmsg       :
123  *        |(N)                        :
124  *        |
125  *  alloc rtinfo
126  *  alloc rtnode
127  * install rtnode
128  *        |
129  *        +---------->ifnet1
130  *        : fwd nmsg    |
131  *        : w/ rtinfo   |
132  *        :             |
133  *        :             |
134  *                 alloc rtnode
135  *               (w/ nmsg's rtinfo)
136  *                install rtnode
137  *                      |
138  *                      +---------->ifnet2
139  *                      : fwd nmsg    |
140  *                      : w/ rtinfo   |
141  *                      :             |
142  *                      :         same as ifnet1
143  *                                    |
144  *                                    +---------->ifnet3
145  *                                    : fwd nmsg    |
146  *                                    : w/ rtinfo   |
147  *                                    :             |
148  *                                    :         same as ifnet1
149  *                                               free nmsg
150  *                                                  :
151  *                                                  :
152  *
153  * The netmsgs forwarded between protocol threads and ifnet threads are
154  * allocated with (M_WAITOK|M_NULLOK), so it will not fail under most
155  * cases (route information is too precious to be not installed :).
156  * Since multiple threads may try to install route information for the
157  * same dst eaddr, we look up route information in ifnet0.  However, this
158  * looking up only need to be performed on ifnet0, which is the start
159  * point of the route information installation process.
160  *
161  *
162  * Bridge route information deleting/flushing:
163  *
164  *  CPU0            CPU1             CPU2             CPU3
165  *
166  * netisr0
167  *   |
168  * find suitable rtnodes,
169  * mark their rtinfo dead
170  *   |
171  *   | domsg <------------------------------------------+
172  *   |                                                  | replymsg
173  *   |                                                  |
174  *   V     fwdmsg           fwdmsg           fwdmsg     |
175  * ifnet0 --------> ifnet1 --------> ifnet2 --------> ifnet3
176  * delete rtnodes   delete rtnodes   delete rtnodes   delete rtnodes
177  * w/ dead rtinfo   w/ dead rtinfo   w/ dead rtinfo   w/ dead rtinfo
178  *                                                    free dead rtinfos
179  *
180  * All deleting/flushing operations are serialized by netisr0, so each
181  * operation only reaps the route information marked dead by itself.
182  *
183  *
184  * Bridge route information adding/deleting/flushing:
185  * Since all operation is serialized by the fixed message flow between
186  * ifnet threads, it is not possible to create corrupted per-cpu route
187  * information.
188  *
189  *
190  *
191  * Percpu member interface list iteration with blocking operation:
192  * Since one bridge could only delete one member interface at a time and
193  * the deleted member interface is not freed after netmsg_service_sync(),
194  * following way is used to make sure that even if the certain member
195  * interface is ripped from the percpu list during the blocking operation,
196  * the iteration still could keep going:
197  *
198  * TAILQ_FOREACH_MUTABLE(bif, sc->sc_iflists[mycpuid], bif_next, nbif) {
199  *     blocking operation;
200  *     blocking operation;
201  *     ...
202  *     ...
203  *     if (nbif != NULL && !nbif->bif_onlist) {
204  *         KKASSERT(bif->bif_onlist);
205  *         nbif = TAILQ_NEXT(bif, bif_next);
206  *     }
207  * }
208  *
209  * As mentioned above only one member interface could be unlinked from the
210  * percpu member interface list, so either bif or nbif may be not on the list,
211  * but _not_ both.  To keep the list iteration, we don't care about bif, but
212  * only nbif.  Since removed member interface will only be freed after we
213  * finish our work, it is safe to access any field in an unlinked bif (here
214  * bif_onlist).  If nbif is no longer on the list, then bif must be on the
215  * list, so we change nbif to the next element of bif and keep going.
216  */
217 
218 #include "opt_inet.h"
219 #include "opt_inet6.h"
220 
221 #include <sys/param.h>
222 #include <sys/mbuf.h>
223 #include <sys/malloc.h>
224 #include <sys/protosw.h>
225 #include <sys/systm.h>
226 #include <sys/time.h>
227 #include <sys/socket.h> /* for net/if.h */
228 #include <sys/sockio.h>
229 #include <sys/ctype.h>  /* string functions */
230 #include <sys/kernel.h>
231 #include <sys/random.h>
232 #include <sys/sysctl.h>
233 #include <sys/module.h>
234 #include <sys/proc.h>
235 #include <sys/priv.h>
236 #include <sys/lock.h>
237 #include <sys/thread.h>
238 #include <sys/thread2.h>
239 #include <sys/mpipe.h>
240 
241 #include <net/bpf.h>
242 #include <net/if.h>
243 #include <net/if_dl.h>
244 #include <net/if_types.h>
245 #include <net/if_var.h>
246 #include <net/pfil.h>
247 #include <net/ifq_var.h>
248 #include <net/if_clone.h>
249 
250 #include <netinet/in.h> /* for struct arpcom */
251 #include <netinet/in_systm.h>
252 #include <netinet/in_var.h>
253 #include <netinet/ip.h>
254 #include <netinet/ip_var.h>
255 #ifdef INET6
256 #include <netinet/ip6.h>
257 #include <netinet6/ip6_var.h>
258 #endif
259 #include <netinet/if_ether.h> /* for struct arpcom */
260 #include <net/bridge/if_bridgevar.h>
261 #include <net/if_llc.h>
262 #include <net/netmsg2.h>
263 
264 #include <net/route.h>
265 #include <sys/in_cksum.h>
266 
267 /*
268  * Size of the route hash table.  Must be a power of two.
269  */
270 #ifndef BRIDGE_RTHASH_SIZE
271 #define	BRIDGE_RTHASH_SIZE		1024
272 #endif
273 
274 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
275 
276 /*
277  * Maximum number of addresses to cache.
278  */
279 #ifndef BRIDGE_RTABLE_MAX
280 #define	BRIDGE_RTABLE_MAX		100
281 #endif
282 
283 /*
284  * Spanning tree defaults.
285  */
286 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
287 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
288 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
289 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
290 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
291 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
292 #define	BSTP_DEFAULT_PATH_COST		55
293 
294 /*
295  * Timeout (in seconds) for entries learned dynamically.
296  */
297 #ifndef BRIDGE_RTABLE_TIMEOUT
298 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
299 #endif
300 
301 /*
302  * Number of seconds between walks of the route list.
303  */
304 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
305 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
306 #endif
307 
308 /*
309  * List of capabilities to mask on the member interface.
310  */
311 #define	BRIDGE_IFCAPS_MASK		IFCAP_TXCSUM
312 
313 typedef int	(*bridge_ctl_t)(struct bridge_softc *, void *);
314 
315 struct netmsg_brctl {
316 	struct netmsg_base	base;
317 	bridge_ctl_t		bc_func;
318 	struct bridge_softc	*bc_sc;
319 	void			*bc_arg;
320 };
321 
322 struct netmsg_brsaddr {
323 	struct netmsg_base	base;
324 	struct bridge_softc	*br_softc;
325 	struct ifnet		*br_dst_if;
326 	struct bridge_rtinfo	*br_rtinfo;
327 	int			br_setflags;
328 	uint8_t			br_dst[ETHER_ADDR_LEN];
329 	uint8_t			br_flags;
330 };
331 
332 struct netmsg_braddbif {
333 	struct netmsg_base	base;
334 	struct bridge_softc	*br_softc;
335 	struct bridge_ifinfo	*br_bif_info;
336 	struct ifnet		*br_bif_ifp;
337 };
338 
339 struct netmsg_brdelbif {
340 	struct netmsg_base	base;
341 	struct bridge_softc	*br_softc;
342 	struct bridge_ifinfo	*br_bif_info;
343 	struct bridge_iflist_head *br_bif_list;
344 };
345 
346 struct netmsg_brsflags {
347 	struct netmsg_base	base;
348 	struct bridge_softc	*br_softc;
349 	struct bridge_ifinfo	*br_bif_info;
350 	uint32_t		br_bif_flags;
351 };
352 
353 eventhandler_tag	bridge_detach_cookie = NULL;
354 
355 extern	struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
356 extern	int (*bridge_output_p)(struct ifnet *, struct mbuf *);
357 extern	void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
358 extern  struct ifnet *(*bridge_interface_p)(void *if_bridge);
359 
360 static int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
361 
362 static int	bridge_clone_create(struct if_clone *, int, caddr_t);
363 static int	bridge_clone_destroy(struct ifnet *);
364 
365 static int	bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
366 static void	bridge_mutecaps(struct bridge_ifinfo *, struct ifnet *, int);
367 static void	bridge_ifdetach(void *, struct ifnet *);
368 static void	bridge_init(void *);
369 static int	bridge_from_us(struct bridge_softc *, struct ether_header *);
370 static void	bridge_stop(struct ifnet *);
371 static void	bridge_start(struct ifnet *);
372 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
373 static int	bridge_output(struct ifnet *, struct mbuf *);
374 static struct ifnet *bridge_interface(void *if_bridge);
375 
376 static void	bridge_forward(struct bridge_softc *, struct mbuf *m);
377 
378 static void	bridge_timer_handler(netmsg_t);
379 static void	bridge_timer(void *);
380 
381 static void	bridge_start_bcast(struct bridge_softc *, struct mbuf *);
382 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
383 		    struct mbuf *);
384 static void	bridge_span(struct bridge_softc *, struct mbuf *);
385 
386 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
387 		    struct ifnet *, uint8_t);
388 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
389 static void	bridge_rtreap(struct bridge_softc *);
390 static void	bridge_rtreap_async(struct bridge_softc *);
391 static void	bridge_rttrim(struct bridge_softc *);
392 static int	bridge_rtage_finddead(struct bridge_softc *);
393 static void	bridge_rtage(struct bridge_softc *);
394 static void	bridge_rtflush(struct bridge_softc *, int);
395 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
396 static int	bridge_rtsaddr(struct bridge_softc *, const uint8_t *,
397 		    struct ifnet *, uint8_t);
398 static void	bridge_rtmsg_sync(struct bridge_softc *sc);
399 static void	bridge_rtreap_handler(netmsg_t);
400 static void	bridge_rtinstall_handler(netmsg_t);
401 static int	bridge_rtinstall_oncpu(struct bridge_softc *, const uint8_t *,
402 		    struct ifnet *, int, uint8_t, struct bridge_rtinfo **);
403 
404 static void	bridge_rtable_init(struct bridge_softc *);
405 static void	bridge_rtable_fini(struct bridge_softc *);
406 
407 static int	bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
408 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
409 		    const uint8_t *);
410 static void	bridge_rtnode_insert(struct bridge_softc *,
411 		    struct bridge_rtnode *);
412 static void	bridge_rtnode_destroy(struct bridge_softc *,
413 		    struct bridge_rtnode *);
414 
415 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
416 		    const char *name);
417 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
418 		    struct ifnet *ifp);
419 static struct bridge_iflist *bridge_lookup_member_ifinfo(struct bridge_softc *,
420 		    struct bridge_ifinfo *);
421 static void	bridge_delete_member(struct bridge_softc *,
422 		    struct bridge_iflist *, int);
423 static void	bridge_delete_span(struct bridge_softc *,
424 		    struct bridge_iflist *);
425 
426 static int	bridge_control(struct bridge_softc *, u_long,
427 			       bridge_ctl_t, void *);
428 static int	bridge_ioctl_init(struct bridge_softc *, void *);
429 static int	bridge_ioctl_stop(struct bridge_softc *, void *);
430 static int	bridge_ioctl_add(struct bridge_softc *, void *);
431 static int	bridge_ioctl_del(struct bridge_softc *, void *);
432 static void	bridge_ioctl_fillflags(struct bridge_softc *sc,
433 				struct bridge_iflist *bif, struct ifbreq *req);
434 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
435 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
436 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
437 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
438 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
439 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
440 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
441 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
442 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
443 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
444 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
445 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
446 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
447 static int	bridge_ioctl_reinit(struct bridge_softc *, void *);
448 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
449 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
450 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
451 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
452 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
453 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
454 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
455 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
456 static int	bridge_ioctl_addspan(struct bridge_softc *, void *);
457 static int	bridge_ioctl_delspan(struct bridge_softc *, void *);
458 static int	bridge_ioctl_sifbondwght(struct bridge_softc *, void *);
459 static int	bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
460 		    int);
461 static int	bridge_ip_checkbasic(struct mbuf **mp);
462 #ifdef INET6
463 static int	bridge_ip6_checkbasic(struct mbuf **mp);
464 #endif /* INET6 */
465 static int	bridge_fragment(struct ifnet *, struct mbuf *,
466 		    struct ether_header *, int, struct llc *);
467 static void	bridge_enqueue_handler(netmsg_t);
468 static void	bridge_handoff(struct bridge_softc *, struct ifnet *,
469 		    struct mbuf *, int);
470 
471 static void	bridge_del_bif_handler(netmsg_t);
472 static void	bridge_add_bif_handler(netmsg_t);
473 static void	bridge_del_bif(struct bridge_softc *, struct bridge_ifinfo *,
474 		    struct bridge_iflist_head *);
475 static void	bridge_add_bif(struct bridge_softc *, struct bridge_ifinfo *,
476 		    struct ifnet *);
477 
478 SYSCTL_DECL(_net_link);
479 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
480 
481 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
482 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
483 static int pfil_member = 1; /* run pfil hooks on the member interface */
484 static int bridge_debug;
485 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
486     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
487 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
488     &pfil_bridge, 0, "Packet filter on the bridge interface");
489 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
490     &pfil_member, 0, "Packet filter on the member interface");
491 SYSCTL_INT(_net_link_bridge, OID_AUTO, debug, CTLFLAG_RW,
492     &bridge_debug, 0, "Bridge debug mode");
493 
494 struct bridge_control_arg {
495 	union {
496 		struct ifbreq ifbreq;
497 		struct ifbifconf ifbifconf;
498 		struct ifbareq ifbareq;
499 		struct ifbaconf ifbaconf;
500 		struct ifbrparam ifbrparam;
501 	} bca_u;
502 	int	bca_len;
503 	void	*bca_uptr;
504 	void	*bca_kptr;
505 };
506 
507 struct bridge_control {
508 	bridge_ctl_t	bc_func;
509 	int		bc_argsize;
510 	int		bc_flags;
511 };
512 
513 #define	BC_F_COPYIN		0x01	/* copy arguments in */
514 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
515 #define	BC_F_SUSER		0x04	/* do super-user check */
516 
517 const struct bridge_control bridge_control_table[] = {
518 	{ bridge_ioctl_add,		sizeof(struct ifbreq),
519 	  BC_F_COPYIN|BC_F_SUSER },
520 	{ bridge_ioctl_del,		sizeof(struct ifbreq),
521 	  BC_F_COPYIN|BC_F_SUSER },
522 
523 	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
524 	  BC_F_COPYIN|BC_F_COPYOUT },
525 	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
526 	  BC_F_COPYIN|BC_F_SUSER },
527 
528 	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
529 	  BC_F_COPYIN|BC_F_SUSER },
530 	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
531 	  BC_F_COPYOUT },
532 
533 	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
534 	  BC_F_COPYIN|BC_F_COPYOUT },
535 	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
536 	  BC_F_COPYIN|BC_F_COPYOUT },
537 
538 	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
539 	  BC_F_COPYIN|BC_F_SUSER },
540 
541 	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
542 	  BC_F_COPYIN|BC_F_SUSER },
543 	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
544 	  BC_F_COPYOUT },
545 
546 	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
547 	  BC_F_COPYIN|BC_F_SUSER },
548 
549 	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
550 	  BC_F_COPYIN|BC_F_SUSER },
551 
552 	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
553 	  BC_F_COPYOUT },
554 	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
555 	  BC_F_COPYIN|BC_F_SUSER },
556 
557 	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
558 	  BC_F_COPYOUT },
559 	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
560 	  BC_F_COPYIN|BC_F_SUSER },
561 
562 	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
563 	  BC_F_COPYOUT },
564 	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
565 	  BC_F_COPYIN|BC_F_SUSER },
566 
567 	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
568 	  BC_F_COPYOUT },
569 	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
570 	  BC_F_COPYIN|BC_F_SUSER },
571 
572 	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
573 	  BC_F_COPYIN|BC_F_SUSER },
574 
575 	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
576 	  BC_F_COPYIN|BC_F_SUSER },
577 
578 	{ bridge_ioctl_addspan,		sizeof(struct ifbreq),
579 	  BC_F_COPYIN|BC_F_SUSER },
580 	{ bridge_ioctl_delspan,		sizeof(struct ifbreq),
581 	  BC_F_COPYIN|BC_F_SUSER },
582 
583 	{ bridge_ioctl_sifbondwght,	sizeof(struct ifbreq),
584 	  BC_F_COPYIN|BC_F_SUSER },
585 
586 };
587 static const int bridge_control_table_size = NELEM(bridge_control_table);
588 
589 LIST_HEAD(, bridge_softc) bridge_list;
590 
591 struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
592 				bridge_clone_create,
593 				bridge_clone_destroy, 0, IF_MAXUNIT);
594 
595 static int
596 bridge_modevent(module_t mod, int type, void *data)
597 {
598 	switch (type) {
599 	case MOD_LOAD:
600 		LIST_INIT(&bridge_list);
601 		if_clone_attach(&bridge_cloner);
602 		bridge_input_p = bridge_input;
603 		bridge_output_p = bridge_output;
604 		bridge_interface_p = bridge_interface;
605 		bridge_detach_cookie = EVENTHANDLER_REGISTER(
606 		    ifnet_detach_event, bridge_ifdetach, NULL,
607 		    EVENTHANDLER_PRI_ANY);
608 #if 0 /* notyet */
609 		bstp_linkstate_p = bstp_linkstate;
610 #endif
611 		break;
612 	case MOD_UNLOAD:
613 		if (!LIST_EMPTY(&bridge_list))
614 			return (EBUSY);
615 		EVENTHANDLER_DEREGISTER(ifnet_detach_event,
616 		    bridge_detach_cookie);
617 		if_clone_detach(&bridge_cloner);
618 		bridge_input_p = NULL;
619 		bridge_output_p = NULL;
620 		bridge_interface_p = NULL;
621 #if 0 /* notyet */
622 		bstp_linkstate_p = NULL;
623 #endif
624 		break;
625 	default:
626 		return (EOPNOTSUPP);
627 	}
628 	return (0);
629 }
630 
631 static moduledata_t bridge_mod = {
632 	"if_bridge",
633 	bridge_modevent,
634 	0
635 };
636 
637 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
638 
639 
640 /*
641  * bridge_clone_create:
642  *
643  *	Create a new bridge instance.
644  */
645 static int
646 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t param __unused)
647 {
648 	struct bridge_softc *sc;
649 	struct ifnet *ifp;
650 	u_char eaddr[6];
651 	int cpu, rnd;
652 
653 	sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK | M_ZERO);
654 	ifp = sc->sc_ifp = &sc->sc_if;
655 
656 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
657 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
658 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
659 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
660 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
661 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
662 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
663 
664 	/* Initialize our routing table. */
665 	bridge_rtable_init(sc);
666 
667 	callout_init(&sc->sc_brcallout);
668 	netmsg_init(&sc->sc_brtimemsg, NULL, &netisr_adone_rport,
669 		    MSGF_DROPABLE, bridge_timer_handler);
670 	sc->sc_brtimemsg.lmsg.u.ms_resultp = sc;
671 
672 	callout_init(&sc->sc_bstpcallout);
673 	netmsg_init(&sc->sc_bstptimemsg, NULL, &netisr_adone_rport,
674 		    MSGF_DROPABLE, bstp_tick_handler);
675 	sc->sc_bstptimemsg.lmsg.u.ms_resultp = sc;
676 
677 	/* Initialize per-cpu member iface lists */
678 	sc->sc_iflists = kmalloc(sizeof(*sc->sc_iflists) * ncpus,
679 				 M_DEVBUF, M_WAITOK);
680 	for (cpu = 0; cpu < ncpus; ++cpu)
681 		TAILQ_INIT(&sc->sc_iflists[cpu]);
682 
683 	TAILQ_INIT(&sc->sc_spanlist);
684 
685 	ifp->if_softc = sc;
686 	if_initname(ifp, ifc->ifc_name, unit);
687 	ifp->if_mtu = ETHERMTU;
688 	ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
689 	ifp->if_ioctl = bridge_ioctl;
690 	ifp->if_start = bridge_start;
691 	ifp->if_init = bridge_init;
692 	ifp->if_type = IFT_ETHER;
693 	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
694 	ifq_set_ready(&ifp->if_snd);
695 	ifp->if_hdrlen = ETHER_HDR_LEN;
696 
697 	/*
698 	 * Generate a random ethernet address and use the private AC:DE:48
699 	 * OUI code.
700 	 */
701 	rnd = karc4random();
702 	bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
703 	rnd = karc4random();
704 	bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */
705 
706 	eaddr[0] &= ~1;	/* clear multicast bit */
707 	eaddr[0] |= 2;	/* set the LAA bit */
708 
709 	ether_ifattach(ifp, eaddr, NULL);
710 	/* Now undo some of the damage... */
711 	ifp->if_baudrate = 0;
712 	/*ifp->if_type = IFT_BRIDGE;*/
713 
714 	crit_enter();	/* XXX MP */
715 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
716 	crit_exit();
717 
718 	return (0);
719 }
720 
721 static void
722 bridge_delete_dispatch(netmsg_t msg)
723 {
724 	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
725 	struct ifnet *bifp = sc->sc_ifp;
726 	struct bridge_iflist *bif;
727 
728 	ifnet_serialize_all(bifp);
729 
730 	while ((bif = TAILQ_FIRST(&sc->sc_iflists[mycpuid])) != NULL)
731 		bridge_delete_member(sc, bif, 0);
732 
733 	while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL)
734 		bridge_delete_span(sc, bif);
735 
736 	ifnet_deserialize_all(bifp);
737 
738 	lwkt_replymsg(&msg->lmsg, 0);
739 }
740 
741 /*
742  * bridge_clone_destroy:
743  *
744  *	Destroy a bridge instance.
745  */
746 static int
747 bridge_clone_destroy(struct ifnet *ifp)
748 {
749 	struct bridge_softc *sc = ifp->if_softc;
750 	struct netmsg_base msg;
751 
752 	ifnet_serialize_all(ifp);
753 
754 	bridge_stop(ifp);
755 	ifp->if_flags &= ~IFF_UP;
756 
757 	ifnet_deserialize_all(ifp);
758 
759 	netmsg_init(&msg, NULL, &curthread->td_msgport,
760 		    0, bridge_delete_dispatch);
761 	msg.lmsg.u.ms_resultp = sc;
762 	lwkt_domsg(BRIDGE_CFGPORT, &msg.lmsg, 0);
763 
764 	crit_enter();	/* XXX MP */
765 	LIST_REMOVE(sc, sc_list);
766 	crit_exit();
767 
768 	ether_ifdetach(ifp);
769 
770 	/* Tear down the routing table. */
771 	bridge_rtable_fini(sc);
772 
773 	/* Free per-cpu member iface lists */
774 	kfree(sc->sc_iflists, M_DEVBUF);
775 
776 	kfree(sc, M_DEVBUF);
777 
778 	return 0;
779 }
780 
781 /*
782  * bridge_ioctl:
783  *
784  *	Handle a control request from the operator.
785  */
786 static int
787 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
788 {
789 	struct bridge_softc *sc = ifp->if_softc;
790 	struct bridge_control_arg args;
791 	struct ifdrv *ifd = (struct ifdrv *) data;
792 	const struct bridge_control *bc;
793 	int error = 0;
794 
795 	ASSERT_IFNET_SERIALIZED_ALL(ifp);
796 
797 	switch (cmd) {
798 	case SIOCADDMULTI:
799 	case SIOCDELMULTI:
800 		break;
801 
802 	case SIOCGDRVSPEC:
803 	case SIOCSDRVSPEC:
804 		if (ifd->ifd_cmd >= bridge_control_table_size) {
805 			error = EINVAL;
806 			break;
807 		}
808 		bc = &bridge_control_table[ifd->ifd_cmd];
809 
810 		if (cmd == SIOCGDRVSPEC &&
811 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
812 			error = EINVAL;
813 			break;
814 		} else if (cmd == SIOCSDRVSPEC &&
815 			   (bc->bc_flags & BC_F_COPYOUT)) {
816 			error = EINVAL;
817 			break;
818 		}
819 
820 		if (bc->bc_flags & BC_F_SUSER) {
821 			error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY);
822 			if (error)
823 				break;
824 		}
825 
826 		if (ifd->ifd_len != bc->bc_argsize ||
827 		    ifd->ifd_len > sizeof(args.bca_u)) {
828 			error = EINVAL;
829 			break;
830 		}
831 
832 		memset(&args, 0, sizeof(args));
833 		if (bc->bc_flags & BC_F_COPYIN) {
834 			error = copyin(ifd->ifd_data, &args.bca_u,
835 				       ifd->ifd_len);
836 			if (error)
837 				break;
838 		}
839 
840 		error = bridge_control(sc, cmd, bc->bc_func, &args);
841 		if (error) {
842 			KKASSERT(args.bca_len == 0 && args.bca_kptr == NULL);
843 			break;
844 		}
845 
846 		if (bc->bc_flags & BC_F_COPYOUT) {
847 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
848 			if (args.bca_len != 0) {
849 				KKASSERT(args.bca_kptr != NULL);
850 				if (!error) {
851 					error = copyout(args.bca_kptr,
852 						args.bca_uptr, args.bca_len);
853 				}
854 				kfree(args.bca_kptr, M_TEMP);
855 			} else {
856 				KKASSERT(args.bca_kptr == NULL);
857 			}
858 		} else {
859 			KKASSERT(args.bca_len == 0 && args.bca_kptr == NULL);
860 		}
861 		break;
862 
863 	case SIOCSIFFLAGS:
864 		if (!(ifp->if_flags & IFF_UP) &&
865 		    (ifp->if_flags & IFF_RUNNING)) {
866 			/*
867 			 * If interface is marked down and it is running,
868 			 * then stop it.
869 			 */
870 			bridge_stop(ifp);
871 		} else if ((ifp->if_flags & IFF_UP) &&
872 		    !(ifp->if_flags & IFF_RUNNING)) {
873 			/*
874 			 * If interface is marked up and it is stopped, then
875 			 * start it.
876 			 */
877 			ifp->if_init(sc);
878 		}
879 
880 		/*
881 		 * If running and link flag state change we have to
882 		 * reinitialize as well.
883 		 */
884 		if ((ifp->if_flags & IFF_RUNNING) &&
885 		    (ifp->if_flags & (IFF_LINK0|IFF_LINK1|IFF_LINK2)) !=
886 		    sc->sc_copy_flags) {
887 			sc->sc_copy_flags = ifp->if_flags &
888 					(IFF_LINK0|IFF_LINK1|IFF_LINK2);
889 			bridge_control(sc, 0, bridge_ioctl_reinit, NULL);
890 		}
891 
892 		break;
893 
894 	case SIOCSIFMTU:
895 		/* Do not allow the MTU to be changed on the bridge */
896 		error = EINVAL;
897 		break;
898 
899 	default:
900 		error = ether_ioctl(ifp, cmd, data);
901 		break;
902 	}
903 	return (error);
904 }
905 
906 /*
907  * bridge_mutecaps:
908  *
909  *	Clear or restore unwanted capabilities on the member interface
910  */
911 static void
912 bridge_mutecaps(struct bridge_ifinfo *bif_info, struct ifnet *ifp, int mute)
913 {
914 	struct ifreq ifr;
915 	int error;
916 
917 	if (ifp->if_ioctl == NULL)
918 		return;
919 
920 	bzero(&ifr, sizeof(ifr));
921 	ifr.ifr_reqcap = ifp->if_capenable;
922 
923 	if (mute) {
924 		/* mask off and save capabilities */
925 		bif_info->bifi_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
926 		if (bif_info->bifi_mutecap != 0)
927 			ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
928 	} else {
929 		/* restore muted capabilities */
930 		ifr.ifr_reqcap |= bif_info->bifi_mutecap;
931 	}
932 
933 	if (bif_info->bifi_mutecap != 0) {
934 		ifnet_serialize_all(ifp);
935 		error = ifp->if_ioctl(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
936 		ifnet_deserialize_all(ifp);
937 	}
938 }
939 
940 /*
941  * bridge_lookup_member:
942  *
943  *	Lookup a bridge member interface.
944  */
945 static struct bridge_iflist *
946 bridge_lookup_member(struct bridge_softc *sc, const char *name)
947 {
948 	struct bridge_iflist *bif;
949 
950 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
951 		if (strcmp(bif->bif_ifp->if_xname, name) == 0)
952 			return (bif);
953 	}
954 	return (NULL);
955 }
956 
957 /*
958  * bridge_lookup_member_if:
959  *
960  *	Lookup a bridge member interface by ifnet*.
961  */
962 static struct bridge_iflist *
963 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
964 {
965 	struct bridge_iflist *bif;
966 
967 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
968 		if (bif->bif_ifp == member_ifp)
969 			return (bif);
970 	}
971 	return (NULL);
972 }
973 
974 /*
975  * bridge_lookup_member_ifinfo:
976  *
977  *	Lookup a bridge member interface by bridge_ifinfo.
978  */
979 static struct bridge_iflist *
980 bridge_lookup_member_ifinfo(struct bridge_softc *sc,
981 			    struct bridge_ifinfo *bif_info)
982 {
983 	struct bridge_iflist *bif;
984 
985 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
986 		if (bif->bif_info == bif_info)
987 			return (bif);
988 	}
989 	return (NULL);
990 }
991 
992 /*
993  * bridge_delete_member:
994  *
995  *	Delete the specified member interface.
996  */
997 static void
998 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
999     int gone)
1000 {
1001 	struct ifnet *ifs = bif->bif_ifp;
1002 	struct ifnet *bifp = sc->sc_ifp;
1003 	struct bridge_ifinfo *bif_info = bif->bif_info;
1004 	struct bridge_iflist_head saved_bifs;
1005 
1006 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
1007 	KKASSERT(bif_info != NULL);
1008 
1009 	ifs->if_bridge = NULL;
1010 
1011 	/*
1012 	 * Release bridge interface's serializer:
1013 	 * - To avoid possible dead lock.
1014 	 * - Various sync operation will block the current thread.
1015 	 */
1016 	ifnet_deserialize_all(bifp);
1017 
1018 	if (!gone) {
1019 		switch (ifs->if_type) {
1020 		case IFT_ETHER:
1021 		case IFT_L2VLAN:
1022 			/*
1023 			 * Take the interface out of promiscuous mode.
1024 			 */
1025 			ifpromisc(ifs, 0);
1026 			bridge_mutecaps(bif_info, ifs, 0);
1027 			break;
1028 
1029 		case IFT_GIF:
1030 			break;
1031 
1032 		default:
1033 			panic("bridge_delete_member: impossible");
1034 			break;
1035 		}
1036 	}
1037 
1038 	/*
1039 	 * Remove bifs from percpu linked list.
1040 	 *
1041 	 * Removed bifs are not freed immediately, instead,
1042 	 * they are saved in saved_bifs.  They will be freed
1043 	 * after we make sure that no one is accessing them,
1044 	 * i.e. after following netmsg_service_sync()
1045 	 */
1046 	TAILQ_INIT(&saved_bifs);
1047 	bridge_del_bif(sc, bif_info, &saved_bifs);
1048 
1049 	/*
1050 	 * Make sure that all protocol threads:
1051 	 * o  see 'ifs' if_bridge is changed
1052 	 * o  know that bif is removed from the percpu linked list
1053 	 */
1054 	netmsg_service_sync();
1055 
1056 	/*
1057 	 * Free the removed bifs
1058 	 */
1059 	KKASSERT(!TAILQ_EMPTY(&saved_bifs));
1060 	while ((bif = TAILQ_FIRST(&saved_bifs)) != NULL) {
1061 		TAILQ_REMOVE(&saved_bifs, bif, bif_next);
1062 		kfree(bif, M_DEVBUF);
1063 	}
1064 
1065 	/* See the comment in bridge_ioctl_stop() */
1066 	bridge_rtmsg_sync(sc);
1067 	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL | IFBF_FLUSHSYNC);
1068 
1069 	ifnet_serialize_all(bifp);
1070 
1071 	if (bifp->if_flags & IFF_RUNNING)
1072 		bstp_initialization(sc);
1073 
1074 	/*
1075 	 * Free the bif_info after bstp_initialization(), so that
1076 	 * bridge_softc.sc_root_port will not reference a dangling
1077 	 * pointer.
1078 	 */
1079 	kfree(bif_info, M_DEVBUF);
1080 }
1081 
1082 /*
1083  * bridge_delete_span:
1084  *
1085  *	Delete the specified span interface.
1086  */
1087 static void
1088 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
1089 {
1090 	KASSERT(bif->bif_ifp->if_bridge == NULL,
1091 	    ("%s: not a span interface", __func__));
1092 
1093 	TAILQ_REMOVE(&sc->sc_iflists[mycpuid], bif, bif_next);
1094 	kfree(bif, M_DEVBUF);
1095 }
1096 
1097 static int
1098 bridge_ioctl_init(struct bridge_softc *sc, void *arg __unused)
1099 {
1100 	struct ifnet *ifp = sc->sc_ifp;
1101 
1102 	if (ifp->if_flags & IFF_RUNNING)
1103 		return 0;
1104 
1105 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1106 	    bridge_timer, sc);
1107 
1108 	ifp->if_flags |= IFF_RUNNING;
1109 	bstp_initialization(sc);
1110 	return 0;
1111 }
1112 
1113 static int
1114 bridge_ioctl_stop(struct bridge_softc *sc, void *arg __unused)
1115 {
1116 	struct ifnet *ifp = sc->sc_ifp;
1117 	struct lwkt_msg *lmsg;
1118 
1119 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1120 		return 0;
1121 
1122 	callout_stop(&sc->sc_brcallout);
1123 
1124 	crit_enter();
1125 	lmsg = &sc->sc_brtimemsg.lmsg;
1126 	if ((lmsg->ms_flags & MSGF_DONE) == 0) {
1127 		/* Pending to be processed; drop it */
1128 		lwkt_dropmsg(lmsg);
1129 	}
1130 	crit_exit();
1131 
1132 	bstp_stop(sc);
1133 
1134 	ifp->if_flags &= ~IFF_RUNNING;
1135 
1136 	ifnet_deserialize_all(ifp);
1137 
1138 	/* Let everyone know that we are stopped */
1139 	netmsg_service_sync();
1140 
1141 	/*
1142 	 * Sync ifnetX msgports in the order we forward rtnode
1143 	 * installation message.  This is used to make sure that
1144 	 * all rtnode installation messages sent by bridge_rtupdate()
1145 	 * during above netmsg_service_sync() are flushed.
1146 	 */
1147 	bridge_rtmsg_sync(sc);
1148 	bridge_rtflush(sc, IFBF_FLUSHDYN | IFBF_FLUSHSYNC);
1149 
1150 	ifnet_serialize_all(ifp);
1151 	return 0;
1152 }
1153 
1154 static int
1155 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
1156 {
1157 	struct ifbreq *req = arg;
1158 	struct bridge_iflist *bif;
1159 	struct bridge_ifinfo *bif_info;
1160 	struct ifnet *ifs, *bifp;
1161 	int error = 0;
1162 
1163 	bifp = sc->sc_ifp;
1164 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
1165 
1166 	ifs = ifunit(req->ifbr_ifsname);
1167 	if (ifs == NULL)
1168 		return (ENOENT);
1169 
1170 	/* If it's in the span list, it can't be a member. */
1171 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1172 		if (ifs == bif->bif_ifp)
1173 			return (EBUSY);
1174 
1175 	/* Allow the first Ethernet member to define the MTU */
1176 	if (ifs->if_type != IFT_GIF) {
1177 		if (TAILQ_EMPTY(&sc->sc_iflists[mycpuid])) {
1178 			bifp->if_mtu = ifs->if_mtu;
1179 		} else if (bifp->if_mtu != ifs->if_mtu) {
1180 			if_printf(bifp, "invalid MTU for %s\n", ifs->if_xname);
1181 			return (EINVAL);
1182 		}
1183 	}
1184 
1185 	if (ifs->if_bridge == sc)
1186 		return (EEXIST);
1187 
1188 	if (ifs->if_bridge != NULL)
1189 		return (EBUSY);
1190 
1191 	bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);
1192 	bif_info->bifi_priority = BSTP_DEFAULT_PORT_PRIORITY;
1193 	bif_info->bifi_path_cost = BSTP_DEFAULT_PATH_COST;
1194 	bif_info->bifi_ifp = ifs;
1195 	bif_info->bifi_bond_weight = 1;
1196 
1197 	/*
1198 	 * Release bridge interface's serializer:
1199 	 * - To avoid possible dead lock.
1200 	 * - Various sync operation will block the current thread.
1201 	 */
1202 	ifnet_deserialize_all(bifp);
1203 
1204 	switch (ifs->if_type) {
1205 	case IFT_ETHER:
1206 	case IFT_L2VLAN:
1207 		/*
1208 		 * Place the interface into promiscuous mode.
1209 		 */
1210 		error = ifpromisc(ifs, 1);
1211 		if (error) {
1212 			ifnet_serialize_all(bifp);
1213 			goto out;
1214 		}
1215 		bridge_mutecaps(bif_info, ifs, 1);
1216 		break;
1217 
1218 	case IFT_GIF: /* :^) */
1219 		break;
1220 
1221 	default:
1222 		error = EINVAL;
1223 		ifnet_serialize_all(bifp);
1224 		goto out;
1225 	}
1226 
1227 	/*
1228 	 * Add bifs to percpu linked lists
1229 	 */
1230 	bridge_add_bif(sc, bif_info, ifs);
1231 
1232 	ifnet_serialize_all(bifp);
1233 
1234 	if (bifp->if_flags & IFF_RUNNING)
1235 		bstp_initialization(sc);
1236 	else
1237 		bstp_stop(sc);
1238 
1239 	/*
1240 	 * Everything has been setup, so let the member interface
1241 	 * deliver packets to this bridge on its input/output path.
1242 	 */
1243 	ifs->if_bridge = sc;
1244 out:
1245 	if (error) {
1246 		if (bif_info != NULL)
1247 			kfree(bif_info, M_DEVBUF);
1248 	}
1249 	return (error);
1250 }
1251 
1252 static int
1253 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
1254 {
1255 	struct ifbreq *req = arg;
1256 	struct bridge_iflist *bif;
1257 
1258 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1259 	if (bif == NULL)
1260 		return (ENOENT);
1261 
1262 	bridge_delete_member(sc, bif, 0);
1263 
1264 	return (0);
1265 }
1266 
1267 static int
1268 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1269 {
1270 	struct ifbreq *req = arg;
1271 	struct bridge_iflist *bif;
1272 
1273 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1274 	if (bif == NULL)
1275 		return (ENOENT);
1276 	bridge_ioctl_fillflags(sc, bif, req);
1277 	return (0);
1278 }
1279 
1280 static void
1281 bridge_ioctl_fillflags(struct bridge_softc *sc, struct bridge_iflist *bif,
1282 		       struct ifbreq *req)
1283 {
1284 	req->ifbr_ifsflags = bif->bif_flags;
1285 	req->ifbr_state = bif->bif_state;
1286 	req->ifbr_priority = bif->bif_priority;
1287 	req->ifbr_path_cost = bif->bif_path_cost;
1288 	req->ifbr_bond_weight = bif->bif_bond_weight;
1289 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
1290 	if (bif->bif_flags & IFBIF_STP) {
1291 		req->ifbr_peer_root = bif->bif_peer_root;
1292 		req->ifbr_peer_bridge = bif->bif_peer_bridge;
1293 		req->ifbr_peer_cost = bif->bif_peer_cost;
1294 		req->ifbr_peer_port = bif->bif_peer_port;
1295 		if (bstp_supersedes_port_info(sc, bif)) {
1296 			req->ifbr_designated_root = bif->bif_peer_root;
1297 			req->ifbr_designated_bridge = bif->bif_peer_bridge;
1298 			req->ifbr_designated_cost = bif->bif_peer_cost;
1299 			req->ifbr_designated_port = bif->bif_peer_port;
1300 		} else {
1301 			req->ifbr_designated_root = sc->sc_bridge_id;
1302 			req->ifbr_designated_bridge = sc->sc_bridge_id;
1303 			req->ifbr_designated_cost = bif->bif_path_cost +
1304 						    bif->bif_peer_cost;
1305 			req->ifbr_designated_port = bif->bif_port_id;
1306 		}
1307 	} else {
1308 		req->ifbr_peer_root = 0;
1309 		req->ifbr_peer_bridge = 0;
1310 		req->ifbr_peer_cost = 0;
1311 		req->ifbr_peer_port = 0;
1312 		req->ifbr_designated_root = 0;
1313 		req->ifbr_designated_bridge = 0;
1314 		req->ifbr_designated_cost = 0;
1315 		req->ifbr_designated_port = 0;
1316 	}
1317 }
1318 
1319 static int
1320 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1321 {
1322 	struct ifbreq *req = arg;
1323 	struct bridge_iflist *bif;
1324 	struct ifnet *bifp = sc->sc_ifp;
1325 
1326 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1327 	if (bif == NULL)
1328 		return (ENOENT);
1329 
1330 	if (req->ifbr_ifsflags & IFBIF_SPAN) {
1331 		/* SPAN is readonly */
1332 		return (EINVAL);
1333 	}
1334 
1335 	if (req->ifbr_ifsflags & IFBIF_STP) {
1336 		switch (bif->bif_ifp->if_type) {
1337 		case IFT_ETHER:
1338 			/* These can do spanning tree. */
1339 			break;
1340 
1341 		default:
1342 			/* Nothing else can. */
1343 			return (EINVAL);
1344 		}
1345 	}
1346 
1347 	bif->bif_flags = (bif->bif_flags & IFBIF_KEEPMASK) |
1348 			 (req->ifbr_ifsflags & ~IFBIF_KEEPMASK);
1349 	if (bifp->if_flags & IFF_RUNNING)
1350 		bstp_initialization(sc);
1351 
1352 	return (0);
1353 }
1354 
1355 static int
1356 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1357 {
1358 	struct ifbrparam *param = arg;
1359 	struct ifnet *ifp = sc->sc_ifp;
1360 
1361 	sc->sc_brtmax = param->ifbrp_csize;
1362 
1363 	ifnet_deserialize_all(ifp);
1364 	bridge_rttrim(sc);
1365 	ifnet_serialize_all(ifp);
1366 
1367 	return (0);
1368 }
1369 
1370 static int
1371 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1372 {
1373 	struct ifbrparam *param = arg;
1374 
1375 	param->ifbrp_csize = sc->sc_brtmax;
1376 
1377 	return (0);
1378 }
1379 
1380 static int
1381 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1382 {
1383 	struct bridge_control_arg *bc_arg = arg;
1384 	struct ifbifconf *bifc = arg;
1385 	struct bridge_iflist *bif;
1386 	struct ifbreq *breq;
1387 	int count, len;
1388 
1389 	count = 0;
1390 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next)
1391 		count++;
1392 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1393 		count++;
1394 
1395 	if (bifc->ifbic_len == 0) {
1396 		bifc->ifbic_len = sizeof(*breq) * count;
1397 		return 0;
1398 	} else if (count == 0 || bifc->ifbic_len < sizeof(*breq)) {
1399 		bifc->ifbic_len = 0;
1400 		return 0;
1401 	}
1402 
1403 	len = min(bifc->ifbic_len, sizeof(*breq) * count);
1404 	KKASSERT(len >= sizeof(*breq));
1405 
1406 	breq = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
1407 	if (breq == NULL) {
1408 		bifc->ifbic_len = 0;
1409 		return ENOMEM;
1410 	}
1411 	bc_arg->bca_kptr = breq;
1412 
1413 	count = 0;
1414 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
1415 		if (len < sizeof(*breq))
1416 			break;
1417 
1418 		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
1419 			sizeof(breq->ifbr_ifsname));
1420 		bridge_ioctl_fillflags(sc, bif, breq);
1421 		breq++;
1422 		count++;
1423 		len -= sizeof(*breq);
1424 	}
1425 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1426 		if (len < sizeof(*breq))
1427 			break;
1428 
1429 		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
1430 			sizeof(breq->ifbr_ifsname));
1431 		breq->ifbr_ifsflags = bif->bif_flags;
1432 		breq->ifbr_portno = bif->bif_ifp->if_index & 0xff;
1433 		breq++;
1434 		count++;
1435 		len -= sizeof(*breq);
1436 	}
1437 
1438 	bifc->ifbic_len = sizeof(*breq) * count;
1439 	KKASSERT(bifc->ifbic_len > 0);
1440 
1441 	bc_arg->bca_len = bifc->ifbic_len;
1442 	bc_arg->bca_uptr = bifc->ifbic_req;
1443 	return 0;
1444 }
1445 
1446 static int
1447 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1448 {
1449 	struct bridge_control_arg *bc_arg = arg;
1450 	struct ifbaconf *bac = arg;
1451 	struct bridge_rtnode *brt;
1452 	struct ifbareq *bareq;
1453 	int count, len;
1454 
1455 	count = 0;
1456 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list)
1457 		count++;
1458 
1459 	if (bac->ifbac_len == 0) {
1460 		bac->ifbac_len = sizeof(*bareq) * count;
1461 		return 0;
1462 	} else if (count == 0 || bac->ifbac_len < sizeof(*bareq)) {
1463 		bac->ifbac_len = 0;
1464 		return 0;
1465 	}
1466 
1467 	len = min(bac->ifbac_len, sizeof(*bareq) * count);
1468 	KKASSERT(len >= sizeof(*bareq));
1469 
1470 	bareq = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
1471 	if (bareq == NULL) {
1472 		bac->ifbac_len = 0;
1473 		return ENOMEM;
1474 	}
1475 	bc_arg->bca_kptr = bareq;
1476 
1477 	count = 0;
1478 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
1479 		struct bridge_rtinfo *bri = brt->brt_info;
1480 		unsigned long expire;
1481 
1482 		if (len < sizeof(*bareq))
1483 			break;
1484 
1485 		strlcpy(bareq->ifba_ifsname, bri->bri_ifp->if_xname,
1486 			sizeof(bareq->ifba_ifsname));
1487 		memcpy(bareq->ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1488 		expire = bri->bri_expire;
1489 		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1490 		    time_second < expire)
1491 			bareq->ifba_expire = expire - time_second;
1492 		else
1493 			bareq->ifba_expire = 0;
1494 		bareq->ifba_flags = bri->bri_flags;
1495 		bareq++;
1496 		count++;
1497 		len -= sizeof(*bareq);
1498 	}
1499 
1500 	bac->ifbac_len = sizeof(*bareq) * count;
1501 	KKASSERT(bac->ifbac_len > 0);
1502 
1503 	bc_arg->bca_len = bac->ifbac_len;
1504 	bc_arg->bca_uptr = bac->ifbac_req;
1505 	return 0;
1506 }
1507 
1508 static int
1509 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1510 {
1511 	struct ifbareq *req = arg;
1512 	struct bridge_iflist *bif;
1513 	struct ifnet *ifp = sc->sc_ifp;
1514 	int error;
1515 
1516 	ASSERT_IFNET_SERIALIZED_ALL(ifp);
1517 
1518 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
1519 	if (bif == NULL)
1520 		return (ENOENT);
1521 
1522 	ifnet_deserialize_all(ifp);
1523 	error = bridge_rtsaddr(sc, req->ifba_dst, bif->bif_ifp,
1524 			       req->ifba_flags);
1525 	ifnet_serialize_all(ifp);
1526 	return (error);
1527 }
1528 
1529 static int
1530 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1531 {
1532 	struct ifbrparam *param = arg;
1533 
1534 	sc->sc_brttimeout = param->ifbrp_ctime;
1535 
1536 	return (0);
1537 }
1538 
1539 static int
1540 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1541 {
1542 	struct ifbrparam *param = arg;
1543 
1544 	param->ifbrp_ctime = sc->sc_brttimeout;
1545 
1546 	return (0);
1547 }
1548 
1549 static int
1550 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1551 {
1552 	struct ifbareq *req = arg;
1553 	struct ifnet *ifp = sc->sc_ifp;
1554 	int error;
1555 
1556 	ifnet_deserialize_all(ifp);
1557 	error = bridge_rtdaddr(sc, req->ifba_dst);
1558 	ifnet_serialize_all(ifp);
1559 	return error;
1560 }
1561 
1562 static int
1563 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1564 {
1565 	struct ifbreq *req = arg;
1566 	struct ifnet *ifp = sc->sc_ifp;
1567 
1568 	ifnet_deserialize_all(ifp);
1569 	bridge_rtflush(sc, req->ifbr_ifsflags | IFBF_FLUSHSYNC);
1570 	ifnet_serialize_all(ifp);
1571 
1572 	return (0);
1573 }
1574 
1575 static int
1576 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1577 {
1578 	struct ifbrparam *param = arg;
1579 
1580 	param->ifbrp_prio = sc->sc_bridge_priority;
1581 
1582 	return (0);
1583 }
1584 
1585 static int
1586 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1587 {
1588 	struct ifbrparam *param = arg;
1589 
1590 	sc->sc_bridge_priority = param->ifbrp_prio;
1591 
1592 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1593 		bstp_initialization(sc);
1594 
1595 	return (0);
1596 }
1597 
1598 static int
1599 bridge_ioctl_reinit(struct bridge_softc *sc, void *arg __unused)
1600 {
1601 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1602 		bstp_initialization(sc);
1603 	return (0);
1604 }
1605 
1606 static int
1607 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1608 {
1609 	struct ifbrparam *param = arg;
1610 
1611 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1612 
1613 	return (0);
1614 }
1615 
1616 static int
1617 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1618 {
1619 	struct ifbrparam *param = arg;
1620 
1621 	if (param->ifbrp_hellotime == 0)
1622 		return (EINVAL);
1623 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1624 
1625 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1626 		bstp_initialization(sc);
1627 
1628 	return (0);
1629 }
1630 
1631 static int
1632 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1633 {
1634 	struct ifbrparam *param = arg;
1635 
1636 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1637 
1638 	return (0);
1639 }
1640 
1641 static int
1642 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1643 {
1644 	struct ifbrparam *param = arg;
1645 
1646 	if (param->ifbrp_fwddelay == 0)
1647 		return (EINVAL);
1648 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1649 
1650 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1651 		bstp_initialization(sc);
1652 
1653 	return (0);
1654 }
1655 
1656 static int
1657 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1658 {
1659 	struct ifbrparam *param = arg;
1660 
1661 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1662 
1663 	return (0);
1664 }
1665 
1666 static int
1667 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1668 {
1669 	struct ifbrparam *param = arg;
1670 
1671 	if (param->ifbrp_maxage == 0)
1672 		return (EINVAL);
1673 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1674 
1675 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1676 		bstp_initialization(sc);
1677 
1678 	return (0);
1679 }
1680 
1681 static int
1682 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1683 {
1684 	struct ifbreq *req = arg;
1685 	struct bridge_iflist *bif;
1686 
1687 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1688 	if (bif == NULL)
1689 		return (ENOENT);
1690 
1691 	bif->bif_priority = req->ifbr_priority;
1692 
1693 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1694 		bstp_initialization(sc);
1695 
1696 	return (0);
1697 }
1698 
1699 static int
1700 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1701 {
1702 	struct ifbreq *req = arg;
1703 	struct bridge_iflist *bif;
1704 
1705 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1706 	if (bif == NULL)
1707 		return (ENOENT);
1708 
1709 	bif->bif_path_cost = req->ifbr_path_cost;
1710 
1711 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1712 		bstp_initialization(sc);
1713 
1714 	return (0);
1715 }
1716 
1717 static int
1718 bridge_ioctl_sifbondwght(struct bridge_softc *sc, void *arg)
1719 {
1720 	struct ifbreq *req = arg;
1721 	struct bridge_iflist *bif;
1722 
1723 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1724 	if (bif == NULL)
1725 		return (ENOENT);
1726 
1727 	bif->bif_bond_weight = req->ifbr_bond_weight;
1728 
1729 	/* no reinit needed */
1730 
1731 	return (0);
1732 }
1733 
1734 static int
1735 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1736 {
1737 	struct ifbreq *req = arg;
1738 	struct bridge_iflist *bif;
1739 	struct ifnet *ifs;
1740 	struct bridge_ifinfo *bif_info;
1741 
1742 	ifs = ifunit(req->ifbr_ifsname);
1743 	if (ifs == NULL)
1744 		return (ENOENT);
1745 
1746 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1747 		if (ifs == bif->bif_ifp)
1748 			return (EBUSY);
1749 
1750 	if (ifs->if_bridge != NULL)
1751 		return (EBUSY);
1752 
1753 	switch (ifs->if_type) {
1754 	case IFT_ETHER:
1755 	case IFT_GIF:
1756 	case IFT_L2VLAN:
1757 		break;
1758 
1759 	default:
1760 		return (EINVAL);
1761 	}
1762 
1763 	/*
1764 	 * bif_info is needed for bif_flags
1765 	 */
1766         bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);
1767         bif_info->bifi_ifp = ifs;
1768 
1769 	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK | M_ZERO);
1770 	bif->bif_ifp = ifs;
1771 	bif->bif_info = bif_info;
1772 	bif->bif_flags = IFBIF_SPAN;
1773 	/* NOTE: span bif does not need bridge_ifinfo */
1774 
1775 	TAILQ_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1776 
1777 	sc->sc_span = 1;
1778 
1779 	return (0);
1780 }
1781 
1782 static int
1783 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1784 {
1785 	struct ifbreq *req = arg;
1786 	struct bridge_iflist *bif;
1787 	struct ifnet *ifs;
1788 
1789 	ifs = ifunit(req->ifbr_ifsname);
1790 	if (ifs == NULL)
1791 		return (ENOENT);
1792 
1793 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1794 		if (ifs == bif->bif_ifp)
1795 			break;
1796 
1797 	if (bif == NULL)
1798 		return (ENOENT);
1799 
1800 	bridge_delete_span(sc, bif);
1801 
1802 	if (TAILQ_EMPTY(&sc->sc_spanlist))
1803 		sc->sc_span = 0;
1804 
1805 	return (0);
1806 }
1807 
1808 static void
1809 bridge_ifdetach_dispatch(netmsg_t msg)
1810 {
1811 	struct ifnet *ifp, *bifp;
1812 	struct bridge_softc *sc;
1813 	struct bridge_iflist *bif;
1814 
1815 	ifp = msg->lmsg.u.ms_resultp;
1816 	sc = ifp->if_bridge;
1817 
1818 	/* Check if the interface is a bridge member */
1819 	if (sc != NULL) {
1820 		bifp = sc->sc_ifp;
1821 
1822 		ifnet_serialize_all(bifp);
1823 
1824 		bif = bridge_lookup_member_if(sc, ifp);
1825 		if (bif != NULL) {
1826 			bridge_delete_member(sc, bif, 1);
1827 		} else {
1828 			/* XXX Why bif will be NULL? */
1829 		}
1830 
1831 		ifnet_deserialize_all(bifp);
1832 		goto reply;
1833 	}
1834 
1835 	crit_enter();	/* XXX MP */
1836 
1837 	/* Check if the interface is a span port */
1838 	LIST_FOREACH(sc, &bridge_list, sc_list) {
1839 		bifp = sc->sc_ifp;
1840 
1841 		ifnet_serialize_all(bifp);
1842 
1843 		TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1844 			if (ifp == bif->bif_ifp) {
1845 				bridge_delete_span(sc, bif);
1846 				break;
1847 			}
1848 
1849 		ifnet_deserialize_all(bifp);
1850 	}
1851 
1852 	crit_exit();
1853 
1854 reply:
1855 	lwkt_replymsg(&msg->lmsg, 0);
1856 }
1857 
1858 /*
1859  * bridge_ifdetach:
1860  *
1861  *	Detach an interface from a bridge.  Called when a member
1862  *	interface is detaching.
1863  */
1864 static void
1865 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1866 {
1867 	struct netmsg_base msg;
1868 
1869 	netmsg_init(&msg, NULL, &curthread->td_msgport,
1870 		    0, bridge_ifdetach_dispatch);
1871 	msg.lmsg.u.ms_resultp = ifp;
1872 
1873 	lwkt_domsg(BRIDGE_CFGPORT, &msg.lmsg, 0);
1874 }
1875 
1876 /*
1877  * bridge_init:
1878  *
1879  *	Initialize a bridge interface.
1880  */
1881 static void
1882 bridge_init(void *xsc)
1883 {
1884 	bridge_control(xsc, SIOCSIFFLAGS, bridge_ioctl_init, NULL);
1885 }
1886 
1887 /*
1888  * bridge_stop:
1889  *
1890  *	Stop the bridge interface.
1891  */
1892 static void
1893 bridge_stop(struct ifnet *ifp)
1894 {
1895 	bridge_control(ifp->if_softc, SIOCSIFFLAGS, bridge_ioctl_stop, NULL);
1896 }
1897 
1898 /*
1899  * Returns TRUE if the packet is being sent 'from us'... from our bridge
1900  * interface or from any member of our bridge interface.  This is used
1901  * later on to force the MAC to be the MAC of our bridge interface.
1902  */
1903 static int
1904 bridge_from_us(struct bridge_softc *sc, struct ether_header *eh)
1905 {
1906 	struct bridge_iflist *bif;
1907 
1908 	if (memcmp(eh->ether_shost, IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN) == 0)
1909 		return (1);
1910 
1911 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
1912 		if (memcmp(eh->ether_shost, IF_LLADDR(bif->bif_ifp),
1913 			   ETHER_ADDR_LEN) == 0) {
1914 			return (1);
1915 		}
1916 	}
1917 	return (0);
1918 }
1919 
1920 /*
1921  * bridge_enqueue:
1922  *
1923  *	Enqueue a packet on a bridge member interface.
1924  *
1925  */
1926 void
1927 bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
1928 {
1929 	struct netmsg_packet *nmp;
1930 
1931 	nmp = &m->m_hdr.mh_netmsg;
1932 	netmsg_init(&nmp->base, NULL, &netisr_apanic_rport,
1933 		    0, bridge_enqueue_handler);
1934 	nmp->nm_packet = m;
1935 	nmp->base.lmsg.u.ms_resultp = dst_ifp;
1936 
1937 	lwkt_sendmsg(ifnet_portfn(mycpu->gd_cpuid), &nmp->base.lmsg);
1938 }
1939 
1940 /*
1941  * bridge_output:
1942  *
1943  *	Send output from a bridge member interface.  This
1944  *	performs the bridging function for locally originated
1945  *	packets.
1946  *
1947  *	The mbuf has the Ethernet header already attached.  We must
1948  *	enqueue or free the mbuf before returning.
1949  */
1950 static int
1951 bridge_output(struct ifnet *ifp, struct mbuf *m)
1952 {
1953 	struct bridge_softc *sc = ifp->if_bridge;
1954 	struct bridge_iflist *bif, *nbif;
1955 	struct ether_header *eh;
1956 	struct ifnet *dst_if, *alt_if, *bifp;
1957 	int from_us;
1958 	int priority;
1959 	int alt_priority;
1960 
1961 	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
1962 
1963 	/*
1964 	 * Make sure that we are still a member of a bridge interface.
1965 	 */
1966 	if (sc == NULL) {
1967 		m_freem(m);
1968 		return (0);
1969 	}
1970 	bifp = sc->sc_ifp;
1971 
1972 	/*
1973 	 * Acquire header
1974 	 */
1975 	if (m->m_len < ETHER_HDR_LEN) {
1976 		m = m_pullup(m, ETHER_HDR_LEN);
1977 		if (m == NULL) {
1978 			bifp->if_oerrors++;
1979 			return (0);
1980 		}
1981 	}
1982 	eh = mtod(m, struct ether_header *);
1983 	from_us = bridge_from_us(sc, eh);
1984 
1985 	/*
1986 	 * If bridge is down, but the original output interface is up,
1987 	 * go ahead and send out that interface.  Otherwise, the packet
1988 	 * is dropped below.
1989 	 */
1990 	if ((bifp->if_flags & IFF_RUNNING) == 0) {
1991 		dst_if = ifp;
1992 		goto sendunicast;
1993 	}
1994 
1995 	/*
1996 	 * If the packet is a multicast, or we don't know a better way to
1997 	 * get there, send to all interfaces.
1998 	 */
1999 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
2000 		dst_if = NULL;
2001 	else
2002 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
2003 
2004 	if (dst_if == NULL) {
2005 		struct mbuf *mc;
2006 		int used = 0;
2007 		int found = 0;
2008 
2009 		if (sc->sc_span)
2010 			bridge_span(sc, m);
2011 
2012 		alt_if = NULL;
2013 		alt_priority = 0;
2014 		TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid],
2015 				     bif_next, nbif) {
2016 			dst_if = bif->bif_ifp;
2017 
2018 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
2019 				continue;
2020 
2021 			/*
2022 			 * If this is not the original output interface,
2023 			 * and the interface is participating in spanning
2024 			 * tree, make sure the port is in a state that
2025 			 * allows forwarding.
2026 			 *
2027 			 * We keep track of a possible backup IF if we are
2028 			 * unable to find any interfaces to forward through.
2029 			 *
2030 			 * NOTE: Currently round-robining is not implemented
2031 			 *	 across bonded interface groups (needs an
2032 			 *	 algorithm to track each group somehow).
2033 			 *
2034 			 *	 Similarly we track only one alternative
2035 			 *	 interface if no suitable interfaces are
2036 			 *	 found.
2037 			 */
2038 			if (dst_if != ifp &&
2039 			    (bif->bif_flags & IFBIF_STP) != 0) {
2040 				switch (bif->bif_state) {
2041 				case BSTP_IFSTATE_BONDED:
2042 					if (bif->bif_priority + 512 >
2043 					    alt_priority) {
2044 						alt_priority =
2045 						    bif->bif_priority + 512;
2046 						alt_if = bif->bif_ifp;
2047 					}
2048 					continue;
2049 				case BSTP_IFSTATE_BLOCKING:
2050 					if (bif->bif_priority + 256 >
2051 					    alt_priority) {
2052 						alt_priority =
2053 						    bif->bif_priority + 256;
2054 						alt_if = bif->bif_ifp;
2055 					}
2056 					continue;
2057 				case BSTP_IFSTATE_LEARNING:
2058 					if (bif->bif_priority > alt_priority) {
2059 						alt_priority =
2060 						    bif->bif_priority;
2061 						alt_if = bif->bif_ifp;
2062 					}
2063 					continue;
2064 				case BSTP_IFSTATE_L1BLOCKING:
2065 				case BSTP_IFSTATE_LISTENING:
2066 				case BSTP_IFSTATE_DISABLED:
2067 					continue;
2068 				default:
2069 					/* FORWARDING */
2070 					break;
2071 				}
2072 			}
2073 
2074 			KKASSERT(used == 0);
2075 			if (TAILQ_NEXT(bif, bif_next) == NULL) {
2076 				used = 1;
2077 				mc = m;
2078 			} else {
2079 				mc = m_copypacket(m, MB_DONTWAIT);
2080 				if (mc == NULL) {
2081 					bifp->if_oerrors++;
2082 					continue;
2083 				}
2084 			}
2085 
2086 			/*
2087 			 * If the packet is 'from' us override ether_shost.
2088 			 */
2089 			bridge_handoff(sc, dst_if, mc, from_us);
2090 			found = 1;
2091 
2092 			if (nbif != NULL && !nbif->bif_onlist) {
2093 				KKASSERT(bif->bif_onlist);
2094 				nbif = TAILQ_NEXT(bif, bif_next);
2095 			}
2096 		}
2097 
2098 		/*
2099 		 * If we couldn't find anything use the backup interface
2100 		 * if we have one.
2101 		 */
2102 		if (found == 0 && alt_if) {
2103 			KKASSERT(used == 0);
2104 			mc = m;
2105 			used = 1;
2106 			bridge_handoff(sc, alt_if, mc, from_us);
2107 		}
2108 
2109 		if (used == 0)
2110 			m_freem(m);
2111 		return (0);
2112 	}
2113 
2114 sendunicast:
2115 	/*
2116 	 * If STP is enabled on the target we are an equal opportunity
2117 	 * employer and do not necessarily output to dst_if.  Instead
2118 	 * scan available links with the same MAC as the current dst_if
2119 	 * and choose the best one.
2120 	 *
2121 	 * We also need to do this because arp entries tag onto a particular
2122 	 * interface and if it happens to be dead then the packets will
2123 	 * go into a bit bucket.
2124 	 *
2125 	 * If LINK2 is set the matching links are bonded and we-round robin.
2126 	 * (the MAC address must be the same for the participating links).
2127 	 * In this case links in a STP FORWARDING or BONDED state are
2128 	 * allowed for unicast packets.
2129 	 */
2130 	bif = bridge_lookup_member_if(sc, dst_if);
2131 	if (bif->bif_flags & IFBIF_STP) {
2132 		alt_if = NULL;
2133 		priority = 0;
2134 		alt_priority = 0;
2135 
2136 		TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid],
2137 				     bif_next, nbif) {
2138 			/*
2139 			 * Ignore member interfaces which aren't running.
2140 			 */
2141 			if ((bif->bif_ifp->if_flags & IFF_RUNNING) == 0)
2142 				continue;
2143 
2144 			/*
2145 			 * member interfaces with the same MAC (usually TAPs)
2146 			 * are considered to be the same.  Select the best
2147 			 * one from BONDED or FORWARDING and keep track of
2148 			 * the best one in the BLOCKING state if no
2149 			 * candidates are available otherwise.
2150 			 */
2151 			if (memcmp(IF_LLADDR(bif->bif_ifp),
2152 				   IF_LLADDR(dst_if),
2153 				   ETHER_ADDR_LEN) != 0) {
2154 				continue;
2155 			}
2156 
2157 			switch(bif->bif_state) {
2158 			case BSTP_IFSTATE_BLOCKING:
2159 				if (bif->bif_priority > alt_priority + 256) {
2160 					alt_priority = bif->bif_priority + 256;
2161 					alt_if = bif->bif_ifp;
2162 				}
2163 				continue;
2164 			case BSTP_IFSTATE_LEARNING:
2165 				if (bif->bif_priority > alt_priority) {
2166 					alt_priority = bif->bif_priority;
2167 					alt_if = bif->bif_ifp;
2168 				}
2169 				continue;
2170 			case BSTP_IFSTATE_L1BLOCKING:
2171 			case BSTP_IFSTATE_LISTENING:
2172 			case BSTP_IFSTATE_DISABLED:
2173 				continue;
2174 			default:
2175 				/* bonded, forwarding */
2176 				break;
2177 			}
2178 
2179 			/*
2180 			 * XXX we need to use the toepliz hash or
2181 			 *     something like that instead of
2182 			 *     round-robining.
2183 			 */
2184 			if (sc->sc_ifp->if_flags & IFF_LINK2) {
2185 				dst_if = bif->bif_ifp;
2186 				if (++bif->bif_bond_count >=
2187 				    bif->bif_bond_weight) {
2188 					bif->bif_bond_count = 0;
2189 					TAILQ_REMOVE(&sc->sc_iflists[mycpuid],
2190 						     bif, bif_next);
2191 					TAILQ_INSERT_TAIL(
2192 						     &sc->sc_iflists[mycpuid],
2193 						     bif, bif_next);
2194 				}
2195 				priority = 1;
2196 				break;
2197 			}
2198 			if (bif->bif_priority > priority) {
2199 				priority = bif->bif_priority;
2200 				dst_if = bif->bif_ifp;
2201 			}
2202 		}
2203 
2204 		/*
2205 		 * Interface of last resort if nothing was found.
2206 		 */
2207 		if (priority == 0 && alt_if)
2208 			dst_if = alt_if;
2209 	}
2210 
2211 	if (sc->sc_span)
2212 		bridge_span(sc, m);
2213 	if ((dst_if->if_flags & IFF_RUNNING) == 0)
2214 		m_freem(m);
2215 	else
2216 		bridge_handoff(sc, dst_if, m, from_us);
2217 	return (0);
2218 }
2219 
2220 /*
2221  * Returns the bridge interface associated with an ifc.
2222  * Pass ifp->if_bridge (must not be NULL).  Used by the ARP
2223  * code to supply the bridge for the is-at info, making
2224  * the bridge responsible for matching local addresses.
2225  *
2226  * Without this the ARP code will supply bridge member interfaces
2227  * for the is-at which makes it difficult the bridge to fail-over
2228  * interfaces (amoung other things).
2229  */
2230 static struct ifnet *
2231 bridge_interface(void *if_bridge)
2232 {
2233 	struct bridge_softc *sc = if_bridge;
2234 	return (sc->sc_ifp);
2235 }
2236 
2237 /*
2238  * bridge_start:
2239  *
2240  *	Start output on a bridge.
2241  */
2242 static void
2243 bridge_start(struct ifnet *ifp)
2244 {
2245 	struct bridge_softc *sc = ifp->if_softc;
2246 
2247 	ASSERT_IFNET_SERIALIZED_TX(ifp);
2248 
2249 	ifp->if_flags |= IFF_OACTIVE;
2250 	for (;;) {
2251 		struct ifnet *dst_if = NULL;
2252 		struct ether_header *eh;
2253 		struct mbuf *m;
2254 
2255 		m = ifq_dequeue(&ifp->if_snd, NULL);
2256 		if (m == NULL)
2257 			break;
2258 
2259 		if (m->m_len < sizeof(*eh)) {
2260 			m = m_pullup(m, sizeof(*eh));
2261 			if (m == NULL) {
2262 				ifp->if_oerrors++;
2263 				continue;
2264 			}
2265 		}
2266 		eh = mtod(m, struct ether_header *);
2267 
2268 		BPF_MTAP(ifp, m);
2269 		ifp->if_opackets++;
2270 
2271 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
2272 			dst_if = bridge_rtlookup(sc, eh->ether_dhost);
2273 
2274 		if (dst_if == NULL)
2275 			bridge_start_bcast(sc, m);
2276 		else
2277 			bridge_enqueue(dst_if, m);
2278 	}
2279 	ifp->if_flags &= ~IFF_OACTIVE;
2280 }
2281 
2282 /*
2283  * bridge_forward:
2284  *
2285  *	Forward packets received on a bridge interface via the input
2286  *	path.
2287  *
2288  *	This implements the forwarding function of the bridge.
2289  */
2290 static void
2291 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
2292 {
2293 	struct bridge_iflist *bif, *nbif;
2294 	struct ifnet *src_if, *dst_if, *alt_if, *ifp;
2295 	struct ether_header *eh;
2296 	int priority;
2297 	int alt_priority;
2298 	int from_blocking;
2299 
2300 	src_if = m->m_pkthdr.rcvif;
2301 	ifp = sc->sc_ifp;
2302 
2303 	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
2304 
2305 	ifp->if_ipackets++;
2306 	ifp->if_ibytes += m->m_pkthdr.len;
2307 
2308 	/*
2309 	 * Look up the bridge_iflist.
2310 	 */
2311 	bif = bridge_lookup_member_if(sc, src_if);
2312 	if (bif == NULL) {
2313 		/* Interface is not a bridge member (anymore?) */
2314 		m_freem(m);
2315 		return;
2316 	}
2317 
2318 	/*
2319 	 * In spanning tree mode receiving a packet from an interface
2320 	 * in a BLOCKING state is allowed, it could be a member of last
2321 	 * resort from the sender's point of view, but forwarding it is
2322 	 * not allowed.
2323 	 *
2324 	 * The sender's spanning tree will eventually sync up and the
2325 	 * sender will go into a BLOCKING state too (but this still may be
2326 	 * an interface of last resort during state changes).
2327 	 */
2328 	if (bif->bif_flags & IFBIF_STP) {
2329 		switch (bif->bif_state) {
2330 		case BSTP_IFSTATE_L1BLOCKING:
2331 		case BSTP_IFSTATE_LISTENING:
2332 		case BSTP_IFSTATE_DISABLED:
2333 			m_freem(m);
2334 			return;
2335 		default:
2336 			/* learning, blocking, bonded, forwarding */
2337 			break;
2338 		}
2339 	}
2340 	from_blocking = (bif->bif_state == BSTP_IFSTATE_BLOCKING);
2341 
2342 	eh = mtod(m, struct ether_header *);
2343 
2344 	/*
2345 	 * If the interface is learning, and the source
2346 	 * address is valid and not multicast, record
2347 	 * the address.
2348 	 */
2349 	if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
2350 	    from_blocking == 0 &&
2351 	    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
2352 	    (eh->ether_shost[0] == 0 &&
2353 	     eh->ether_shost[1] == 0 &&
2354 	     eh->ether_shost[2] == 0 &&
2355 	     eh->ether_shost[3] == 0 &&
2356 	     eh->ether_shost[4] == 0 &&
2357 	     eh->ether_shost[5] == 0) == 0) {
2358 		bridge_rtupdate(sc, eh->ether_shost, src_if, IFBAF_DYNAMIC);
2359 	}
2360 
2361 	/*
2362 	 * Don't forward from an interface in the listening or learning
2363 	 * state.  That is, in the learning state we learn information
2364 	 * but we throw away the packets.
2365 	 *
2366 	 * We let through packets on interfaces in the blocking state.
2367 	 * The blocking state is applicable to the send side, not the
2368 	 * receive side.
2369 	 */
2370 	if ((bif->bif_flags & IFBIF_STP) != 0 &&
2371 	    (bif->bif_state == BSTP_IFSTATE_LISTENING ||
2372 	     bif->bif_state == BSTP_IFSTATE_LEARNING)) {
2373 		m_freem(m);
2374 		return;
2375 	}
2376 
2377 	/*
2378 	 * At this point, the port either doesn't participate
2379 	 * in spanning tree or it is in the forwarding state.
2380 	 */
2381 
2382 	/*
2383 	 * If the packet is unicast, destined for someone on
2384 	 * "this" side of the bridge, drop it.
2385 	 *
2386 	 * src_if implies the entire bonding set so we have to compare MAC
2387 	 * addresses and not just if pointers.
2388 	 */
2389 	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
2390 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
2391 		if (dst_if && memcmp(IF_LLADDR(src_if), IF_LLADDR(dst_if),
2392 				     ETHER_ADDR_LEN) == 0) {
2393 			m_freem(m);
2394 			return;
2395 		}
2396 	} else {
2397 		/* ...forward it to all interfaces. */
2398 		ifp->if_imcasts++;
2399 		dst_if = NULL;
2400 	}
2401 
2402 	/*
2403 	 * Brodcast if we do not have forwarding information.  However, if
2404 	 * we received the packet on a blocking interface we do not do this
2405 	 * (unless you really want to blow up your network).
2406 	 */
2407 	if (dst_if == NULL) {
2408 		if (from_blocking)
2409 			m_freem(m);
2410 		else
2411 			bridge_broadcast(sc, src_if, m);
2412 		return;
2413 	}
2414 
2415 	/*
2416 	 * Unicast, kinda replicates the output side of bridge_output().
2417 	 *
2418 	 * Even though this is a uni-cast packet we may have to select
2419 	 * an interface from a bonding set.
2420 	 */
2421 	bif = bridge_lookup_member_if(sc, dst_if);
2422 	if (bif == NULL) {
2423 		/* Not a member of the bridge (anymore?) */
2424 		m_freem(m);
2425 		return;
2426 	}
2427 
2428 	if (bif->bif_flags & IFBIF_STP) {
2429 		alt_if = NULL;
2430 		alt_priority = 0;
2431 		priority = 0;
2432 
2433 		TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid],
2434 				     bif_next, nbif) {
2435 			/*
2436 			 * dst_if may imply a bonding set so we must compare
2437 			 * MAC addresses.
2438 			 */
2439 			if (memcmp(IF_LLADDR(bif->bif_ifp),
2440 				   IF_LLADDR(dst_if),
2441 				   ETHER_ADDR_LEN) != 0) {
2442 				continue;
2443 			}
2444 
2445 			if ((bif->bif_ifp->if_flags & IFF_RUNNING) == 0)
2446 				continue;
2447 
2448 			/*
2449 			 * NOTE: We allow tranmissions through a BLOCKING
2450 			 *	 or LEARNING interface only as a last resort.
2451 			 *	 We DISALLOW both cases if the receiving
2452 			 *
2453 			 * NOTE: If we send a packet through a learning
2454 			 *	 interface the receiving end (if also in
2455 			 *	 LEARNING) will throw it away, so this is
2456 			 *	 the ultimate last resort.
2457 			 */
2458 			switch(bif->bif_state) {
2459 			case BSTP_IFSTATE_BLOCKING:
2460 				if (from_blocking == 0 &&
2461 				    bif->bif_priority + 256 > alt_priority) {
2462 					alt_priority = bif->bif_priority + 256;
2463 					alt_if = bif->bif_ifp;
2464 				}
2465 				continue;
2466 			case BSTP_IFSTATE_LEARNING:
2467 				if (from_blocking == 0 &&
2468 				    bif->bif_priority > alt_priority) {
2469 					alt_priority = bif->bif_priority;
2470 					alt_if = bif->bif_ifp;
2471 				}
2472 				continue;
2473 			case BSTP_IFSTATE_L1BLOCKING:
2474 			case BSTP_IFSTATE_LISTENING:
2475 			case BSTP_IFSTATE_DISABLED:
2476 				continue;
2477 			default:
2478 				/* FORWARDING, BONDED */
2479 				break;
2480 			}
2481 
2482 			/*
2483 			 * XXX we need to use the toepliz hash or
2484 			 *     something like that instead of
2485 			 *     round-robining.
2486 			 */
2487 			if (sc->sc_ifp->if_flags & IFF_LINK2) {
2488 				dst_if = bif->bif_ifp;
2489 				if (++bif->bif_bond_count >=
2490 				    bif->bif_bond_weight) {
2491 					bif->bif_bond_count = 0;
2492 					TAILQ_REMOVE(&sc->sc_iflists[mycpuid],
2493 						     bif, bif_next);
2494 					TAILQ_INSERT_TAIL(
2495 						     &sc->sc_iflists[mycpuid],
2496 						     bif, bif_next);
2497 				}
2498 				priority = 1;
2499 				break;
2500 			}
2501 
2502 			/*
2503 			 * Select best interface in the FORWARDING or
2504 			 * BONDED set.  Well, there shouldn't be any
2505 			 * in a BONDED state if LINK2 is not set (they
2506 			 * will all be in a BLOCKING) state, but there
2507 			 * could be a transitory condition here.
2508 			 */
2509 			if (bif->bif_priority > priority) {
2510 				priority = bif->bif_priority;
2511 				dst_if = bif->bif_ifp;
2512 			}
2513 		}
2514 
2515 		/*
2516 		 * If no suitable interfaces were found but a suitable
2517 		 * alternative interface was found, use the alternative
2518 		 * interface.
2519 		 */
2520 		if (priority == 0 && alt_if)
2521 			dst_if = alt_if;
2522 	}
2523 
2524 	/*
2525 	 * At this point, we're dealing with a unicast frame
2526 	 * going to a different interface.
2527 	 */
2528 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
2529 		m_freem(m);
2530 		return;
2531 	}
2532 
2533 	if (inet_pfil_hook.ph_hashooks > 0
2534 #ifdef INET6
2535 	    || inet6_pfil_hook.ph_hashooks > 0
2536 #endif
2537 	    ) {
2538 		if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
2539 			return;
2540 		if (m == NULL)
2541 			return;
2542 
2543 		if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
2544 			return;
2545 		if (m == NULL)
2546 			return;
2547 	}
2548 	bridge_handoff(sc, dst_if, m, 0);
2549 }
2550 
2551 /*
2552  * bridge_input:
2553  *
2554  *	Receive input from a member interface.  Queue the packet for
2555  *	bridging if it is not for us.
2556  */
2557 static struct mbuf *
2558 bridge_input(struct ifnet *ifp, struct mbuf *m)
2559 {
2560 	struct bridge_softc *sc = ifp->if_bridge;
2561 	struct bridge_iflist *bif;
2562 	struct ifnet *bifp, *new_ifp;
2563 	struct ether_header *eh;
2564 	struct mbuf *mc, *mc2;
2565 	int from_blocking;
2566 
2567 	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
2568 
2569 	/*
2570 	 * Make sure that we are still a member of a bridge interface.
2571 	 */
2572 	if (sc == NULL)
2573 		return m;
2574 
2575 	new_ifp = NULL;
2576 	bifp = sc->sc_ifp;
2577 
2578 	if ((bifp->if_flags & IFF_RUNNING) == 0)
2579 		goto out;
2580 
2581 	/*
2582 	 * Implement support for bridge monitoring.  If this flag has been
2583 	 * set on this interface, discard the packet once we push it through
2584 	 * the bpf(4) machinery, but before we do, increment various counters
2585 	 * associated with this bridge.
2586 	 */
2587 	if (bifp->if_flags & IFF_MONITOR) {
2588 	 	/* Change input interface to this bridge */
2589 		m->m_pkthdr.rcvif = bifp;
2590 
2591 		BPF_MTAP(bifp, m);
2592 
2593 		/* Update bridge's ifnet statistics */
2594 		bifp->if_ipackets++;
2595 		bifp->if_ibytes += m->m_pkthdr.len;
2596 		if (m->m_flags & (M_MCAST | M_BCAST))
2597 			bifp->if_imcasts++;
2598 
2599 		m_freem(m);
2600 		m = NULL;
2601 		goto out;
2602 	}
2603 
2604 	/*
2605 	 * Handle the ether_header
2606 	 *
2607 	 * In all cases if the packet is destined for us via our MAC
2608 	 * we must clear BRIDGE_MBUF_TAGGED to ensure that we don't
2609 	 * repeat the source MAC out the same interface.
2610 	 *
2611 	 * This first test against our bridge MAC is the fast-path.
2612 	 *
2613 	 * NOTE!  The bridge interface can serve as an endpoint for
2614 	 *	  communication but normally there are no IPs associated
2615 	 *	  with it so you cannot route through it.  Instead what
2616 	 *	  you do is point your default route *THROUGH* the bridge
2617 	 *	  to the actual default router for one of the bridged spaces.
2618 	 *
2619 	 *	  Another possibility is to put all your IP specifications
2620 	 *	  on the bridge instead of on the individual interfaces.  If
2621 	 *	  you do this it should be possible to use the bridge as an
2622 	 *	  end point and route (rather than switch) through it using
2623 	 *	  the default route or ipfw forwarding rules.
2624 	 */
2625 
2626 	/*
2627 	 * Acquire header
2628 	 */
2629 	if (m->m_len < ETHER_HDR_LEN) {
2630 		m = m_pullup(m, ETHER_HDR_LEN);
2631 		if (m == NULL)
2632 			goto out;
2633 	}
2634 	eh = mtod(m, struct ether_header *);
2635 	m->m_pkthdr.fw_flags |= BRIDGE_MBUF_TAGGED;
2636 	bcopy(eh, &m->m_pkthdr.br.ether, sizeof(*eh));
2637 
2638 	if ((bridge_debug & 1) &&
2639 	    (ntohs(eh->ether_type) == ETHERTYPE_ARP ||
2640 	    ntohs(eh->ether_type) == ETHERTYPE_REVARP)) {
2641 		kprintf("%02x:%02x:%02x:%02x:%02x:%02x "
2642 			"%02x:%02x:%02x:%02x:%02x:%02x type %04x "
2643 			"lla %02x:%02x:%02x:%02x:%02x:%02x\n",
2644 			eh->ether_dhost[0],
2645 			eh->ether_dhost[1],
2646 			eh->ether_dhost[2],
2647 			eh->ether_dhost[3],
2648 			eh->ether_dhost[4],
2649 			eh->ether_dhost[5],
2650 			eh->ether_shost[0],
2651 			eh->ether_shost[1],
2652 			eh->ether_shost[2],
2653 			eh->ether_shost[3],
2654 			eh->ether_shost[4],
2655 			eh->ether_shost[5],
2656 			eh->ether_type,
2657 			((u_char *)IF_LLADDR(bifp))[0],
2658 			((u_char *)IF_LLADDR(bifp))[1],
2659 			((u_char *)IF_LLADDR(bifp))[2],
2660 			((u_char *)IF_LLADDR(bifp))[3],
2661 			((u_char *)IF_LLADDR(bifp))[4],
2662 			((u_char *)IF_LLADDR(bifp))[5]
2663 		);
2664 	}
2665 
2666 	if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
2667 		/*
2668 		 * If the packet is for us, set the packets source as the
2669 		 * bridge, and return the packet back to ifnet.if_input for
2670 		 * local processing.
2671 		 */
2672 		m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
2673 		KASSERT(bifp->if_bridge == NULL,
2674 			("loop created in bridge_input"));
2675 		if (pfil_member != 0) {
2676 			if (inet_pfil_hook.ph_hashooks > 0
2677 #ifdef INET6
2678 			    || inet6_pfil_hook.ph_hashooks > 0
2679 #endif
2680 			) {
2681 				if (bridge_pfil(&m, NULL, ifp, PFIL_IN) != 0)
2682 					goto out;
2683 				if (m == NULL)
2684 					goto out;
2685 			}
2686 		}
2687 		new_ifp = bifp;
2688 		goto out;
2689 	}
2690 
2691 	/*
2692 	 * Tap all packets arriving on the bridge, no matter if
2693 	 * they are local destinations or not.  In is in.
2694 	 */
2695 	BPF_MTAP(bifp, m);
2696 
2697 	bif = bridge_lookup_member_if(sc, ifp);
2698 	if (bif == NULL)
2699 		goto out;
2700 
2701 	if (sc->sc_span)
2702 		bridge_span(sc, m);
2703 
2704 	if (m->m_flags & (M_BCAST | M_MCAST)) {
2705 		/*
2706 		 * Tap off 802.1D packets; they do not get forwarded.
2707 		 */
2708 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
2709 			    ETHER_ADDR_LEN) == 0) {
2710 			ifnet_serialize_all(bifp);
2711 			bstp_input(sc, bif, m);
2712 			ifnet_deserialize_all(bifp);
2713 
2714 			/* m is freed by bstp_input */
2715 			m = NULL;
2716 			goto out;
2717 		}
2718 
2719 		/*
2720 		 * Other than 802.11d packets, ignore packets if the
2721 		 * interface is not in a good state.
2722 		 *
2723 		 * NOTE: Broadcast/mcast packets received on a blocking or
2724 		 *	 learning interface are allowed for local processing.
2725 		 *
2726 		 *	 The sending side of a blocked port will stop
2727 		 *	 transmitting when a better alternative is found.
2728 		 *	 However, later on we will disallow the forwarding
2729 		 *	 of bcast/mcsat packets over a blocking interface.
2730 		 */
2731 		if (bif->bif_flags & IFBIF_STP) {
2732 			switch (bif->bif_state) {
2733 			case BSTP_IFSTATE_L1BLOCKING:
2734 			case BSTP_IFSTATE_LISTENING:
2735 			case BSTP_IFSTATE_DISABLED:
2736 				goto out;
2737 			default:
2738 				/* blocking, learning, bonded, forwarding */
2739 				break;
2740 			}
2741 		}
2742 
2743 		/*
2744 		 * Make a deep copy of the packet and enqueue the copy
2745 		 * for bridge processing; return the original packet for
2746 		 * local processing.
2747 		 */
2748 		mc = m_dup(m, MB_DONTWAIT);
2749 		if (mc == NULL)
2750 			goto out;
2751 
2752 		/*
2753 		 * It's just too dangerous to allow bcast/mcast over a
2754 		 * blocked interface, eventually the network will sort
2755 		 * itself out and a better path will be found.
2756 		 */
2757 		if ((bif->bif_flags & IFBIF_STP) == 0 ||
2758 		    bif->bif_state != BSTP_IFSTATE_BLOCKING) {
2759 			bridge_forward(sc, mc);
2760 		}
2761 
2762 		/*
2763 		 * Reinject the mbuf as arriving on the bridge so we have a
2764 		 * chance at claiming multicast packets. We can not loop back
2765 		 * here from ether_input as a bridge is never a member of a
2766 		 * bridge.
2767 		 */
2768 		KASSERT(bifp->if_bridge == NULL,
2769 			("loop created in bridge_input"));
2770 		mc2 = m_dup(m, MB_DONTWAIT);
2771 #ifdef notyet
2772 		if (mc2 != NULL) {
2773 			/* Keep the layer3 header aligned */
2774 			int i = min(mc2->m_pkthdr.len, max_protohdr);
2775 			mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2776 		}
2777 #endif
2778 		if (mc2 != NULL) {
2779 			/*
2780 			 * Don't tap to bpf(4) again; we have already done
2781 			 * the tapping.
2782 			 *
2783 			 * Leave m_pkthdr.rcvif alone, so ARP replies are
2784 			 * processed as coming in on the correct interface.
2785 			 *
2786 			 * Clear the bridge flag for local processing in
2787 			 * case the packet gets routed.
2788 			 */
2789 			mc2->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
2790 			ether_reinput_oncpu(bifp, mc2, 0);
2791 		}
2792 
2793 		/* Return the original packet for local processing. */
2794 		goto out;
2795 	}
2796 
2797 	/*
2798 	 * Input of a unicast packet.  We have to allow unicast packets
2799 	 * input from links in the BLOCKING state as this might be an
2800 	 * interface of last resort.
2801 	 *
2802 	 * NOTE: We explicitly ignore normal packets received on a link
2803 	 *	 in the BLOCKING state.  The point of being in that state
2804 	 *	 is to avoid getting duplicate packets.
2805 	 *
2806 	 *	 HOWEVER, if LINK2 is set the normal spanning tree code
2807 	 *	 will mark an interface BLOCKING to avoid multi-cast/broadcast
2808 	 *	 loops.  Unicast packets CAN still loop if we allow the
2809 	 *	 case (hence we only do it in LINK2), but it isn't quite as
2810 	 *	 bad as a broadcast packet looping.
2811 	 */
2812 	from_blocking = 0;
2813 	if (bif->bif_flags & IFBIF_STP) {
2814 		switch (bif->bif_state) {
2815 		case BSTP_IFSTATE_L1BLOCKING:
2816 		case BSTP_IFSTATE_LISTENING:
2817 		case BSTP_IFSTATE_DISABLED:
2818 			goto out;
2819 		case BSTP_IFSTATE_BLOCKING:
2820 			from_blocking = 1;
2821 			/* fall through */
2822 		default:
2823 			/* blocking, bonded, forwarding, learning */
2824 			break;
2825 		}
2826 	}
2827 
2828 	/*
2829 	 * Unicast.  Make sure it's not for us.
2830 	 *
2831 	 * This loop is MPSAFE; the only blocking operation (bridge_rtupdate)
2832 	 * is followed by breaking out of the loop.
2833 	 */
2834 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
2835 		if (bif->bif_ifp->if_type != IFT_ETHER)
2836 			continue;
2837 
2838 		/*
2839 		 * It is destined for an interface linked to the bridge.
2840 		 * We want the bridge itself to take care of link level
2841 		 * forwarding to member interfaces so reinput on the bridge.
2842 		 * i.e. if you ping an IP on a target interface associated
2843 		 * with the bridge, the arp is-at response should indicate
2844 		 * the bridge MAC.
2845 		 *
2846 		 * Only update our addr list when learning if the port
2847 		 * is not in a blocking state.  If it is we still allow
2848 		 * the packet but we do not try to learn from it.
2849 		 */
2850 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
2851 			   ETHER_ADDR_LEN) == 0) {
2852 			if (bif->bif_ifp != ifp) {
2853 				/* XXX loop prevention */
2854 				m->m_flags |= M_ETHER_BRIDGED;
2855 			}
2856 			if ((bif->bif_flags & IFBIF_LEARNING) &&
2857 			    bif->bif_state != BSTP_IFSTATE_BLOCKING) {
2858 				bridge_rtupdate(sc, eh->ether_shost,
2859 						ifp, IFBAF_DYNAMIC);
2860 			}
2861 			new_ifp = bifp; /* not bif->bif_ifp */
2862 			m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
2863 			goto out;
2864 		}
2865 
2866 		/*
2867 		 * Ignore received packets that were sent by us.
2868 		 */
2869 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
2870 			   ETHER_ADDR_LEN) == 0) {
2871 			m_freem(m);
2872 			m = NULL;
2873 			goto out;
2874 		}
2875 	}
2876 
2877 	/*
2878 	 * It isn't for us.
2879 	 *
2880 	 * Perform the bridge forwarding function, but disallow bridging
2881 	 * to interfaces in the blocking state if the packet came in on
2882 	 * an interface in the blocking state.
2883 	 */
2884 	bridge_forward(sc, m);
2885 	m = NULL;
2886 
2887 	/*
2888 	 * ether_reinput_oncpu() will reprocess rcvif as
2889 	 * coming from new_ifp (since we do not specify
2890 	 * REINPUT_KEEPRCVIF).
2891 	 */
2892 out:
2893 	if (new_ifp != NULL) {
2894 		/*
2895 		 * Clear the bridge flag for local processing in
2896 		 * case the packet gets routed.
2897 		 */
2898 		ether_reinput_oncpu(new_ifp, m, REINPUT_RUNBPF);
2899 		m = NULL;
2900 	}
2901 	return (m);
2902 }
2903 
2904 /*
2905  * bridge_start_bcast:
2906  *
2907  *	Broadcast the packet sent from bridge to all member
2908  *	interfaces.
2909  *	This is a simplified version of bridge_broadcast(), however,
2910  *	this function expects caller to hold bridge's serializer.
2911  */
2912 static void
2913 bridge_start_bcast(struct bridge_softc *sc, struct mbuf *m)
2914 {
2915 	struct bridge_iflist *bif;
2916 	struct mbuf *mc;
2917 	struct ifnet *dst_if, *alt_if, *bifp;
2918 	int used = 0;
2919 	int found = 0;
2920 	int alt_priority;
2921 
2922 	bifp = sc->sc_ifp;
2923 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
2924 
2925 	/*
2926 	 * Following loop is MPSAFE; nothing is blocking
2927 	 * in the loop body.
2928 	 *
2929 	 * NOTE: We transmit through an member in the BLOCKING state only
2930 	 *	 as a last resort.
2931 	 */
2932 	alt_if = NULL;
2933 	alt_priority = 0;
2934 
2935 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
2936 		dst_if = bif->bif_ifp;
2937 
2938 		if (bif->bif_flags & IFBIF_STP) {
2939 			switch (bif->bif_state) {
2940 			case BSTP_IFSTATE_BLOCKING:
2941 				if (bif->bif_priority > alt_priority) {
2942 					alt_priority = bif->bif_priority;
2943 					alt_if = bif->bif_ifp;
2944 				}
2945 				/* fall through */
2946 			case BSTP_IFSTATE_L1BLOCKING:
2947 			case BSTP_IFSTATE_DISABLED:
2948 				continue;
2949 			default:
2950 				/* listening, learning, bonded, forwarding */
2951 				break;
2952 			}
2953 		}
2954 
2955 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2956 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2957 			continue;
2958 
2959 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
2960 			continue;
2961 
2962 		if (TAILQ_NEXT(bif, bif_next) == NULL) {
2963 			mc = m;
2964 			used = 1;
2965 		} else {
2966 			mc = m_copypacket(m, MB_DONTWAIT);
2967 			if (mc == NULL) {
2968 				bifp->if_oerrors++;
2969 				continue;
2970 			}
2971 		}
2972 		found = 1;
2973 		bridge_enqueue(dst_if, mc);
2974 	}
2975 
2976 	if (found == 0 && alt_if) {
2977 		KKASSERT(used == 0);
2978 		mc = m;
2979 		used = 1;
2980 		bridge_enqueue(alt_if, mc);
2981 	}
2982 
2983 	if (used == 0)
2984 		m_freem(m);
2985 }
2986 
2987 /*
2988  * bridge_broadcast:
2989  *
2990  *	Send a frame to all interfaces that are members of
2991  *	the bridge, except for the one on which the packet
2992  *	arrived.
2993  */
2994 static void
2995 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2996 		 struct mbuf *m)
2997 {
2998 	struct bridge_iflist *bif, *nbif;
2999 	struct ether_header *eh;
3000 	struct mbuf *mc;
3001 	struct ifnet *dst_if, *alt_if, *bifp;
3002 	int used;
3003 	int found;
3004 	int alt_priority;
3005 	int from_us;
3006 
3007 	bifp = sc->sc_ifp;
3008 	ASSERT_IFNET_NOT_SERIALIZED_ALL(bifp);
3009 
3010 	eh = mtod(m, struct ether_header *);
3011 	from_us = bridge_from_us(sc, eh);
3012 
3013 	if (inet_pfil_hook.ph_hashooks > 0
3014 #ifdef INET6
3015 	    || inet6_pfil_hook.ph_hashooks > 0
3016 #endif
3017 	    ) {
3018 		if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
3019 			return;
3020 		if (m == NULL)
3021 			return;
3022 
3023 		/* Filter on the bridge interface before broadcasting */
3024 		if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
3025 			return;
3026 		if (m == NULL)
3027 			return;
3028 	}
3029 
3030 	alt_if = 0;
3031 	alt_priority = 0;
3032 	found = 0;
3033 	used = 0;
3034 
3035 	TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid], bif_next, nbif) {
3036 		dst_if = bif->bif_ifp;
3037 
3038 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
3039 			continue;
3040 
3041 		/*
3042 		 * Don't bounce the packet out the same interface it came
3043 		 * in on.  We have to test MAC addresses because a packet
3044 		 * can come in a bonded interface and we don't want it to
3045 		 * be echod out the forwarding interface for the same bonding
3046 		 * set.
3047 		 */
3048 		if (src_if && memcmp(IF_LLADDR(src_if), IF_LLADDR(dst_if),
3049 				     ETHER_ADDR_LEN) == 0) {
3050 			continue;
3051 		}
3052 
3053 		/*
3054 		 * Generally speaking we only broadcast through forwarding
3055 		 * interfaces.  If no interfaces are available we select
3056 		 * a BONDED, BLOCKING, or LEARNING interface to forward
3057 		 * through.
3058 		 */
3059 		if (bif->bif_flags & IFBIF_STP) {
3060 			switch (bif->bif_state) {
3061 			case BSTP_IFSTATE_BONDED:
3062 				if (bif->bif_priority + 512 > alt_priority) {
3063 					alt_priority = bif->bif_priority + 512;
3064 					alt_if = bif->bif_ifp;
3065 				}
3066 				continue;
3067 			case BSTP_IFSTATE_BLOCKING:
3068 				if (bif->bif_priority + 256 > alt_priority) {
3069 					alt_priority = bif->bif_priority + 256;
3070 					alt_if = bif->bif_ifp;
3071 				}
3072 				continue;
3073 			case BSTP_IFSTATE_LEARNING:
3074 				if (bif->bif_priority > alt_priority) {
3075 					alt_priority = bif->bif_priority;
3076 					alt_if = bif->bif_ifp;
3077 				}
3078 				continue;
3079 			case BSTP_IFSTATE_L1BLOCKING:
3080 			case BSTP_IFSTATE_DISABLED:
3081 			case BSTP_IFSTATE_LISTENING:
3082 				continue;
3083 			default:
3084 				/* forwarding */
3085 				break;
3086 			}
3087 		}
3088 
3089 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
3090 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0) {
3091 			continue;
3092 		}
3093 
3094 		if (TAILQ_NEXT(bif, bif_next) == NULL) {
3095 			mc = m;
3096 			used = 1;
3097 		} else {
3098 			mc = m_copypacket(m, MB_DONTWAIT);
3099 			if (mc == NULL) {
3100 				sc->sc_ifp->if_oerrors++;
3101 				continue;
3102 			}
3103 		}
3104 		found = 1;
3105 
3106 		/*
3107 		 * Filter on the output interface.  Pass a NULL bridge
3108 		 * interface pointer so we do not redundantly filter on
3109 		 * the bridge for each interface we broadcast on.
3110 		 */
3111 		if (inet_pfil_hook.ph_hashooks > 0
3112 #ifdef INET6
3113 		    || inet6_pfil_hook.ph_hashooks > 0
3114 #endif
3115 		    ) {
3116 			if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
3117 				continue;
3118 			if (mc == NULL)
3119 				continue;
3120 		}
3121 		bridge_handoff(sc, dst_if, mc, from_us);
3122 
3123 		if (nbif != NULL && !nbif->bif_onlist) {
3124 			KKASSERT(bif->bif_onlist);
3125 			nbif = TAILQ_NEXT(bif, bif_next);
3126 		}
3127 	}
3128 
3129 	if (found == 0 && alt_if) {
3130 		KKASSERT(used == 0);
3131 		mc = m;
3132 		used = 1;
3133 		bridge_enqueue(alt_if, mc);
3134 	}
3135 
3136 	if (used == 0)
3137 		m_freem(m);
3138 }
3139 
3140 /*
3141  * bridge_span:
3142  *
3143  *	Duplicate a packet out one or more interfaces that are in span mode,
3144  *	the original mbuf is unmodified.
3145  */
3146 static void
3147 bridge_span(struct bridge_softc *sc, struct mbuf *m)
3148 {
3149 	struct bridge_iflist *bif;
3150 	struct ifnet *dst_if, *bifp;
3151 	struct mbuf *mc;
3152 
3153 	bifp = sc->sc_ifp;
3154 	ifnet_serialize_all(bifp);
3155 
3156 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
3157 		dst_if = bif->bif_ifp;
3158 
3159 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
3160 			continue;
3161 
3162 		mc = m_copypacket(m, MB_DONTWAIT);
3163 		if (mc == NULL) {
3164 			sc->sc_ifp->if_oerrors++;
3165 			continue;
3166 		}
3167 		bridge_enqueue(dst_if, mc);
3168 	}
3169 
3170 	ifnet_deserialize_all(bifp);
3171 }
3172 
3173 static void
3174 bridge_rtmsg_sync_handler(netmsg_t msg)
3175 {
3176 	ifnet_forwardmsg(&msg->lmsg, mycpuid + 1);
3177 }
3178 
3179 static void
3180 bridge_rtmsg_sync(struct bridge_softc *sc)
3181 {
3182 	struct netmsg_base msg;
3183 
3184 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3185 
3186 	netmsg_init(&msg, NULL, &curthread->td_msgport,
3187 		    0, bridge_rtmsg_sync_handler);
3188 	ifnet_domsg(&msg.lmsg, 0);
3189 }
3190 
3191 static __inline void
3192 bridge_rtinfo_update(struct bridge_rtinfo *bri, struct ifnet *dst_if,
3193 		     int setflags, uint8_t flags, uint32_t timeo)
3194 {
3195 	if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
3196 	    bri->bri_ifp != dst_if)
3197 		bri->bri_ifp = dst_if;
3198 	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
3199 	    bri->bri_expire != time_second + timeo)
3200 		bri->bri_expire = time_second + timeo;
3201 	if (setflags)
3202 		bri->bri_flags = flags;
3203 }
3204 
3205 static int
3206 bridge_rtinstall_oncpu(struct bridge_softc *sc, const uint8_t *dst,
3207 		       struct ifnet *dst_if, int setflags, uint8_t flags,
3208 		       struct bridge_rtinfo **bri0)
3209 {
3210 	struct bridge_rtnode *brt;
3211 	struct bridge_rtinfo *bri;
3212 
3213 	if (mycpuid == 0) {
3214 		brt = bridge_rtnode_lookup(sc, dst);
3215 		if (brt != NULL) {
3216 			/*
3217 			 * rtnode for 'dst' already exists.  We inform the
3218 			 * caller about this by leaving bri0 as NULL.  The
3219 			 * caller will terminate the intallation upon getting
3220 			 * NULL bri0.  However, we still need to update the
3221 			 * rtinfo.
3222 			 */
3223 			KKASSERT(*bri0 == NULL);
3224 
3225 			/* Update rtinfo */
3226 			bridge_rtinfo_update(brt->brt_info, dst_if, setflags,
3227 					     flags, sc->sc_brttimeout);
3228 			return 0;
3229 		}
3230 
3231 		/*
3232 		 * We only need to check brtcnt on CPU0, since if limit
3233 		 * is to be exceeded, ENOSPC is returned.  Caller knows
3234 		 * this and will terminate the installation.
3235 		 */
3236 		if (sc->sc_brtcnt >= sc->sc_brtmax)
3237 			return ENOSPC;
3238 
3239 		KKASSERT(*bri0 == NULL);
3240 		bri = kmalloc(sizeof(struct bridge_rtinfo), M_DEVBUF,
3241 				  M_WAITOK | M_ZERO);
3242 		*bri0 = bri;
3243 
3244 		/* Setup rtinfo */
3245 		bri->bri_flags = IFBAF_DYNAMIC;
3246 		bridge_rtinfo_update(bri, dst_if, setflags, flags,
3247 				     sc->sc_brttimeout);
3248 	} else {
3249 		bri = *bri0;
3250 		KKASSERT(bri != NULL);
3251 	}
3252 
3253 	brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
3254 		      M_WAITOK | M_ZERO);
3255 	memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
3256 	brt->brt_info = bri;
3257 
3258 	bridge_rtnode_insert(sc, brt);
3259 	return 0;
3260 }
3261 
3262 static void
3263 bridge_rtinstall_handler(netmsg_t msg)
3264 {
3265 	struct netmsg_brsaddr *brmsg = (struct netmsg_brsaddr *)msg;
3266 	int error;
3267 
3268 	error = bridge_rtinstall_oncpu(brmsg->br_softc,
3269 				       brmsg->br_dst, brmsg->br_dst_if,
3270 				       brmsg->br_setflags, brmsg->br_flags,
3271 				       &brmsg->br_rtinfo);
3272 	if (error) {
3273 		KKASSERT(mycpuid == 0 && brmsg->br_rtinfo == NULL);
3274 		lwkt_replymsg(&brmsg->base.lmsg, error);
3275 		return;
3276 	} else if (brmsg->br_rtinfo == NULL) {
3277 		/* rtnode already exists for 'dst' */
3278 		KKASSERT(mycpuid == 0);
3279 		lwkt_replymsg(&brmsg->base.lmsg, 0);
3280 		return;
3281 	}
3282 	ifnet_forwardmsg(&brmsg->base.lmsg, mycpuid + 1);
3283 }
3284 
3285 /*
3286  * bridge_rtupdate:
3287  *
3288  *	Add/Update a bridge routing entry.
3289  */
3290 static int
3291 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
3292 		struct ifnet *dst_if, uint8_t flags)
3293 {
3294 	struct bridge_rtnode *brt;
3295 
3296 	/*
3297 	 * A route for this destination might already exist.  If so,
3298 	 * update it, otherwise create a new one.
3299 	 */
3300 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
3301 		struct netmsg_brsaddr *brmsg;
3302 
3303 		if (sc->sc_brtcnt >= sc->sc_brtmax)
3304 			return ENOSPC;
3305 
3306 		brmsg = kmalloc(sizeof(*brmsg), M_LWKTMSG, M_WAITOK | M_NULLOK);
3307 		if (brmsg == NULL)
3308 			return ENOMEM;
3309 
3310 		netmsg_init(&brmsg->base, NULL, &netisr_afree_rport,
3311 			    0, bridge_rtinstall_handler);
3312 		memcpy(brmsg->br_dst, dst, ETHER_ADDR_LEN);
3313 		brmsg->br_dst_if = dst_if;
3314 		brmsg->br_flags = flags;
3315 		brmsg->br_setflags = 0;
3316 		brmsg->br_softc = sc;
3317 		brmsg->br_rtinfo = NULL;
3318 
3319 		ifnet_sendmsg(&brmsg->base.lmsg, 0);
3320 		return 0;
3321 	}
3322 	bridge_rtinfo_update(brt->brt_info, dst_if, 0, flags,
3323 			     sc->sc_brttimeout);
3324 	return 0;
3325 }
3326 
3327 static int
3328 bridge_rtsaddr(struct bridge_softc *sc, const uint8_t *dst,
3329 	       struct ifnet *dst_if, uint8_t flags)
3330 {
3331 	struct netmsg_brsaddr brmsg;
3332 
3333 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3334 
3335 	netmsg_init(&brmsg.base, NULL, &curthread->td_msgport,
3336 		    0, bridge_rtinstall_handler);
3337 	memcpy(brmsg.br_dst, dst, ETHER_ADDR_LEN);
3338 	brmsg.br_dst_if = dst_if;
3339 	brmsg.br_flags = flags;
3340 	brmsg.br_setflags = 1;
3341 	brmsg.br_softc = sc;
3342 	brmsg.br_rtinfo = NULL;
3343 
3344 	return ifnet_domsg(&brmsg.base.lmsg, 0);
3345 }
3346 
3347 /*
3348  * bridge_rtlookup:
3349  *
3350  *	Lookup the destination interface for an address.
3351  */
3352 static struct ifnet *
3353 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
3354 {
3355 	struct bridge_rtnode *brt;
3356 
3357 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
3358 		return NULL;
3359 	return brt->brt_info->bri_ifp;
3360 }
3361 
3362 static void
3363 bridge_rtreap_handler(netmsg_t msg)
3364 {
3365 	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
3366 	struct bridge_rtnode *brt, *nbrt;
3367 
3368 	LIST_FOREACH_MUTABLE(brt, &sc->sc_rtlists[mycpuid], brt_list, nbrt) {
3369 		if (brt->brt_info->bri_dead)
3370 			bridge_rtnode_destroy(sc, brt);
3371 	}
3372 	ifnet_forwardmsg(&msg->lmsg, mycpuid + 1);
3373 }
3374 
3375 static void
3376 bridge_rtreap(struct bridge_softc *sc)
3377 {
3378 	struct netmsg_base msg;
3379 
3380 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3381 
3382 	netmsg_init(&msg, NULL, &curthread->td_msgport,
3383 		    0, bridge_rtreap_handler);
3384 	msg.lmsg.u.ms_resultp = sc;
3385 
3386 	ifnet_domsg(&msg.lmsg, 0);
3387 }
3388 
3389 static void
3390 bridge_rtreap_async(struct bridge_softc *sc)
3391 {
3392 	struct netmsg_base *msg;
3393 
3394 	msg = kmalloc(sizeof(*msg), M_LWKTMSG, M_WAITOK);
3395 
3396 	netmsg_init(msg, NULL, &netisr_afree_rport,
3397 		    0, bridge_rtreap_handler);
3398 	msg->lmsg.u.ms_resultp = sc;
3399 
3400 	ifnet_sendmsg(&msg->lmsg, 0);
3401 }
3402 
3403 /*
3404  * bridge_rttrim:
3405  *
3406  *	Trim the routine table so that we have a number
3407  *	of routing entries less than or equal to the
3408  *	maximum number.
3409  */
3410 static void
3411 bridge_rttrim(struct bridge_softc *sc)
3412 {
3413 	struct bridge_rtnode *brt;
3414 	int dead;
3415 
3416 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3417 
3418 	/* Make sure we actually need to do this. */
3419 	if (sc->sc_brtcnt <= sc->sc_brtmax)
3420 		return;
3421 
3422 	/*
3423 	 * Find out how many rtnodes are dead
3424 	 */
3425 	dead = bridge_rtage_finddead(sc);
3426 	KKASSERT(dead <= sc->sc_brtcnt);
3427 
3428 	if (sc->sc_brtcnt - dead <= sc->sc_brtmax) {
3429 		/* Enough dead rtnodes are found */
3430 		bridge_rtreap(sc);
3431 		return;
3432 	}
3433 
3434 	/*
3435 	 * Kill some dynamic rtnodes to meet the brtmax
3436 	 */
3437 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3438 		struct bridge_rtinfo *bri = brt->brt_info;
3439 
3440 		if (bri->bri_dead) {
3441 			/*
3442 			 * We have counted this rtnode in
3443 			 * bridge_rtage_finddead()
3444 			 */
3445 			continue;
3446 		}
3447 
3448 		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
3449 			bri->bri_dead = 1;
3450 			++dead;
3451 			KKASSERT(dead <= sc->sc_brtcnt);
3452 
3453 			if (sc->sc_brtcnt - dead <= sc->sc_brtmax) {
3454 				/* Enough rtnodes are collected */
3455 				break;
3456 			}
3457 		}
3458 	}
3459 	if (dead)
3460 		bridge_rtreap(sc);
3461 }
3462 
3463 /*
3464  * bridge_timer:
3465  *
3466  *	Aging timer for the bridge.
3467  */
3468 static void
3469 bridge_timer(void *arg)
3470 {
3471 	struct bridge_softc *sc = arg;
3472 	struct netmsg_base *msg;
3473 
3474 	KKASSERT(mycpuid == BRIDGE_CFGCPU);
3475 
3476 	crit_enter();
3477 
3478 	if (callout_pending(&sc->sc_brcallout) ||
3479 	    !callout_active(&sc->sc_brcallout)) {
3480 		crit_exit();
3481 		return;
3482 	}
3483 	callout_deactivate(&sc->sc_brcallout);
3484 
3485 	msg = &sc->sc_brtimemsg;
3486 	KKASSERT(msg->lmsg.ms_flags & MSGF_DONE);
3487 	lwkt_sendmsg(BRIDGE_CFGPORT, &msg->lmsg);
3488 
3489 	crit_exit();
3490 }
3491 
3492 static void
3493 bridge_timer_handler(netmsg_t msg)
3494 {
3495 	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
3496 
3497 	KKASSERT(&curthread->td_msgport == BRIDGE_CFGPORT);
3498 
3499 	crit_enter();
3500 	/* Reply ASAP */
3501 	lwkt_replymsg(&msg->lmsg, 0);
3502 	crit_exit();
3503 
3504 	bridge_rtage(sc);
3505 	if (sc->sc_ifp->if_flags & IFF_RUNNING) {
3506 		callout_reset(&sc->sc_brcallout,
3507 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
3508 	}
3509 }
3510 
3511 static int
3512 bridge_rtage_finddead(struct bridge_softc *sc)
3513 {
3514 	struct bridge_rtnode *brt;
3515 	int dead = 0;
3516 
3517 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3518 		struct bridge_rtinfo *bri = brt->brt_info;
3519 
3520 		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
3521 		    time_second >= bri->bri_expire) {
3522 			bri->bri_dead = 1;
3523 			++dead;
3524 			KKASSERT(dead <= sc->sc_brtcnt);
3525 		}
3526 	}
3527 	return dead;
3528 }
3529 
3530 /*
3531  * bridge_rtage:
3532  *
3533  *	Perform an aging cycle.
3534  */
3535 static void
3536 bridge_rtage(struct bridge_softc *sc)
3537 {
3538 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3539 
3540 	if (bridge_rtage_finddead(sc))
3541 		bridge_rtreap(sc);
3542 }
3543 
3544 /*
3545  * bridge_rtflush:
3546  *
3547  *	Remove all dynamic addresses from the bridge.
3548  */
3549 static void
3550 bridge_rtflush(struct bridge_softc *sc, int bf)
3551 {
3552 	struct bridge_rtnode *brt;
3553 	int reap;
3554 
3555 	reap = 0;
3556 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3557 		struct bridge_rtinfo *bri = brt->brt_info;
3558 
3559 		if ((bf & IFBF_FLUSHALL) ||
3560 		    (bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
3561 			bri->bri_dead = 1;
3562 			reap = 1;
3563 		}
3564 	}
3565 	if (reap) {
3566 		if (bf & IFBF_FLUSHSYNC)
3567 			bridge_rtreap(sc);
3568 		else
3569 			bridge_rtreap_async(sc);
3570 	}
3571 }
3572 
3573 /*
3574  * bridge_rtdaddr:
3575  *
3576  *	Remove an address from the table.
3577  */
3578 static int
3579 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
3580 {
3581 	struct bridge_rtnode *brt;
3582 
3583 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3584 
3585 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
3586 		return (ENOENT);
3587 
3588 	/* TODO: add a cheaper delete operation */
3589 	brt->brt_info->bri_dead = 1;
3590 	bridge_rtreap(sc);
3591 	return (0);
3592 }
3593 
3594 /*
3595  * bridge_rtdelete:
3596  *
3597  *	Delete routes to a speicifc member interface.
3598  */
3599 void
3600 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int bf)
3601 {
3602 	struct bridge_rtnode *brt;
3603 	int reap;
3604 
3605 	reap = 0;
3606 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3607 		struct bridge_rtinfo *bri = brt->brt_info;
3608 
3609 		if (bri->bri_ifp == ifp &&
3610 		    ((bf & IFBF_FLUSHALL) ||
3611 		     (bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)) {
3612 			bri->bri_dead = 1;
3613 			reap = 1;
3614 		}
3615 	}
3616 	if (reap) {
3617 		if (bf & IFBF_FLUSHSYNC)
3618 			bridge_rtreap(sc);
3619 		else
3620 			bridge_rtreap_async(sc);
3621 	}
3622 }
3623 
3624 /*
3625  * bridge_rtable_init:
3626  *
3627  *	Initialize the route table for this bridge.
3628  */
3629 static void
3630 bridge_rtable_init(struct bridge_softc *sc)
3631 {
3632 	int cpu;
3633 
3634 	/*
3635 	 * Initialize per-cpu hash tables
3636 	 */
3637 	sc->sc_rthashs = kmalloc(sizeof(*sc->sc_rthashs) * ncpus,
3638 				 M_DEVBUF, M_WAITOK);
3639 	for (cpu = 0; cpu < ncpus; ++cpu) {
3640 		int i;
3641 
3642 		sc->sc_rthashs[cpu] =
3643 		kmalloc(sizeof(struct bridge_rtnode_head) * BRIDGE_RTHASH_SIZE,
3644 			M_DEVBUF, M_WAITOK);
3645 
3646 		for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
3647 			LIST_INIT(&sc->sc_rthashs[cpu][i]);
3648 	}
3649 	sc->sc_rthash_key = karc4random();
3650 
3651 	/*
3652 	 * Initialize per-cpu lists
3653 	 */
3654 	sc->sc_rtlists = kmalloc(sizeof(struct bridge_rtnode_head) * ncpus,
3655 				 M_DEVBUF, M_WAITOK);
3656 	for (cpu = 0; cpu < ncpus; ++cpu)
3657 		LIST_INIT(&sc->sc_rtlists[cpu]);
3658 }
3659 
3660 /*
3661  * bridge_rtable_fini:
3662  *
3663  *	Deconstruct the route table for this bridge.
3664  */
3665 static void
3666 bridge_rtable_fini(struct bridge_softc *sc)
3667 {
3668 	int cpu;
3669 
3670 	/*
3671 	 * Free per-cpu hash tables
3672 	 */
3673 	for (cpu = 0; cpu < ncpus; ++cpu)
3674 		kfree(sc->sc_rthashs[cpu], M_DEVBUF);
3675 	kfree(sc->sc_rthashs, M_DEVBUF);
3676 
3677 	/*
3678 	 * Free per-cpu lists
3679 	 */
3680 	kfree(sc->sc_rtlists, M_DEVBUF);
3681 }
3682 
3683 /*
3684  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
3685  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
3686  */
3687 #define	mix(a, b, c)							\
3688 do {									\
3689 	a -= b; a -= c; a ^= (c >> 13);					\
3690 	b -= c; b -= a; b ^= (a << 8);					\
3691 	c -= a; c -= b; c ^= (b >> 13);					\
3692 	a -= b; a -= c; a ^= (c >> 12);					\
3693 	b -= c; b -= a; b ^= (a << 16);					\
3694 	c -= a; c -= b; c ^= (b >> 5);					\
3695 	a -= b; a -= c; a ^= (c >> 3);					\
3696 	b -= c; b -= a; b ^= (a << 10);					\
3697 	c -= a; c -= b; c ^= (b >> 15);					\
3698 } while (/*CONSTCOND*/0)
3699 
3700 static __inline uint32_t
3701 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
3702 {
3703 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
3704 
3705 	b += addr[5] << 8;
3706 	b += addr[4];
3707 	a += addr[3] << 24;
3708 	a += addr[2] << 16;
3709 	a += addr[1] << 8;
3710 	a += addr[0];
3711 
3712 	mix(a, b, c);
3713 
3714 	return (c & BRIDGE_RTHASH_MASK);
3715 }
3716 
3717 #undef mix
3718 
3719 static int
3720 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
3721 {
3722 	int i, d;
3723 
3724 	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
3725 		d = ((int)a[i]) - ((int)b[i]);
3726 	}
3727 
3728 	return (d);
3729 }
3730 
3731 /*
3732  * bridge_rtnode_lookup:
3733  *
3734  *	Look up a bridge route node for the specified destination.
3735  */
3736 static struct bridge_rtnode *
3737 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
3738 {
3739 	struct bridge_rtnode *brt;
3740 	uint32_t hash;
3741 	int dir;
3742 
3743 	hash = bridge_rthash(sc, addr);
3744 	LIST_FOREACH(brt, &sc->sc_rthashs[mycpuid][hash], brt_hash) {
3745 		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
3746 		if (dir == 0)
3747 			return (brt);
3748 		if (dir > 0)
3749 			return (NULL);
3750 	}
3751 
3752 	return (NULL);
3753 }
3754 
3755 /*
3756  * bridge_rtnode_insert:
3757  *
3758  *	Insert the specified bridge node into the route table.
3759  *	Caller has to make sure that rtnode does not exist.
3760  */
3761 static void
3762 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
3763 {
3764 	struct bridge_rtnode *lbrt;
3765 	uint32_t hash;
3766 	int dir;
3767 
3768 	hash = bridge_rthash(sc, brt->brt_addr);
3769 
3770 	lbrt = LIST_FIRST(&sc->sc_rthashs[mycpuid][hash]);
3771 	if (lbrt == NULL) {
3772 		LIST_INSERT_HEAD(&sc->sc_rthashs[mycpuid][hash],
3773 				  brt, brt_hash);
3774 		goto out;
3775 	}
3776 
3777 	do {
3778 		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
3779 		KASSERT(dir != 0, ("rtnode already exist\n"));
3780 
3781 		if (dir > 0) {
3782 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
3783 			goto out;
3784 		}
3785 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
3786 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
3787 			goto out;
3788 		}
3789 		lbrt = LIST_NEXT(lbrt, brt_hash);
3790 	} while (lbrt != NULL);
3791 
3792 	panic("no suitable position found for rtnode\n");
3793 out:
3794 	LIST_INSERT_HEAD(&sc->sc_rtlists[mycpuid], brt, brt_list);
3795 	if (mycpuid == 0) {
3796 		/*
3797 		 * Update the brtcnt.
3798 		 * We only need to do it once and we do it on CPU0.
3799 		 */
3800 		sc->sc_brtcnt++;
3801 	}
3802 }
3803 
3804 /*
3805  * bridge_rtnode_destroy:
3806  *
3807  *	Destroy a bridge rtnode.
3808  */
3809 static void
3810 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
3811 {
3812 	LIST_REMOVE(brt, brt_hash);
3813 	LIST_REMOVE(brt, brt_list);
3814 
3815 	if (mycpuid + 1 == ncpus) {
3816 		/* Free rtinfo associated with rtnode on the last cpu */
3817 		kfree(brt->brt_info, M_DEVBUF);
3818 	}
3819 	kfree(brt, M_DEVBUF);
3820 
3821 	if (mycpuid == 0) {
3822 		/* Update brtcnt only on CPU0 */
3823 		sc->sc_brtcnt--;
3824 	}
3825 }
3826 
3827 static __inline int
3828 bridge_post_pfil(struct mbuf *m)
3829 {
3830 	if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED)
3831 		return EOPNOTSUPP;
3832 
3833 	/* Not yet */
3834 	if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED)
3835 		return EOPNOTSUPP;
3836 
3837 	return 0;
3838 }
3839 
3840 /*
3841  * Send bridge packets through pfil if they are one of the types pfil can deal
3842  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
3843  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
3844  * that interface.
3845  */
3846 static int
3847 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
3848 {
3849 	int snap, error, i, hlen;
3850 	struct ether_header *eh1, eh2;
3851 	struct ip *ip;
3852 	struct llc llc1;
3853 	u_int16_t ether_type;
3854 
3855 	snap = 0;
3856 	error = -1;	/* Default error if not error == 0 */
3857 
3858 	if (pfil_bridge == 0 && pfil_member == 0)
3859 		return (0); /* filtering is disabled */
3860 
3861 	i = min((*mp)->m_pkthdr.len, max_protohdr);
3862 	if ((*mp)->m_len < i) {
3863 		*mp = m_pullup(*mp, i);
3864 		if (*mp == NULL) {
3865 			kprintf("%s: m_pullup failed\n", __func__);
3866 			return (-1);
3867 		}
3868 	}
3869 
3870 	eh1 = mtod(*mp, struct ether_header *);
3871 	ether_type = ntohs(eh1->ether_type);
3872 
3873 	/*
3874 	 * Check for SNAP/LLC.
3875 	 */
3876 	if (ether_type < ETHERMTU) {
3877 		struct llc *llc2 = (struct llc *)(eh1 + 1);
3878 
3879 		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
3880 		    llc2->llc_dsap == LLC_SNAP_LSAP &&
3881 		    llc2->llc_ssap == LLC_SNAP_LSAP &&
3882 		    llc2->llc_control == LLC_UI) {
3883 			ether_type = htons(llc2->llc_un.type_snap.ether_type);
3884 			snap = 1;
3885 		}
3886 	}
3887 
3888 	/*
3889 	 * If we're trying to filter bridge traffic, don't look at anything
3890 	 * other than IP and ARP traffic.  If the filter doesn't understand
3891 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
3892 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
3893 	 * but of course we don't have an AppleTalk filter to begin with.
3894 	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
3895 	 * ARP traffic.)
3896 	 */
3897 	switch (ether_type) {
3898 	case ETHERTYPE_ARP:
3899 	case ETHERTYPE_REVARP:
3900 		return (0); /* Automatically pass */
3901 
3902 	case ETHERTYPE_IP:
3903 #ifdef INET6
3904 	case ETHERTYPE_IPV6:
3905 #endif /* INET6 */
3906 		break;
3907 
3908 	default:
3909 		/*
3910 		 * Check to see if the user wants to pass non-ip
3911 		 * packets, these will not be checked by pfil(9)
3912 		 * and passed unconditionally so the default is to drop.
3913 		 */
3914 		if (pfil_onlyip)
3915 			goto bad;
3916 	}
3917 
3918 	/* Strip off the Ethernet header and keep a copy. */
3919 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
3920 	m_adj(*mp, ETHER_HDR_LEN);
3921 
3922 	/* Strip off snap header, if present */
3923 	if (snap) {
3924 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
3925 		m_adj(*mp, sizeof(struct llc));
3926 	}
3927 
3928 	/*
3929 	 * Check the IP header for alignment and errors
3930 	 */
3931 	if (dir == PFIL_IN) {
3932 		switch (ether_type) {
3933 		case ETHERTYPE_IP:
3934 			error = bridge_ip_checkbasic(mp);
3935 			break;
3936 #ifdef INET6
3937 		case ETHERTYPE_IPV6:
3938 			error = bridge_ip6_checkbasic(mp);
3939 			break;
3940 #endif /* INET6 */
3941 		default:
3942 			error = 0;
3943 		}
3944 		if (error)
3945 			goto bad;
3946 	}
3947 
3948 	error = 0;
3949 
3950 	/*
3951 	 * Run the packet through pfil
3952 	 */
3953 	switch (ether_type) {
3954 	case ETHERTYPE_IP:
3955 		/*
3956 		 * before calling the firewall, swap fields the same as
3957 		 * IP does. here we assume the header is contiguous
3958 		 */
3959 		ip = mtod(*mp, struct ip *);
3960 
3961 		ip->ip_len = ntohs(ip->ip_len);
3962 		ip->ip_off = ntohs(ip->ip_off);
3963 
3964 		/*
3965 		 * Run pfil on the member interface and the bridge, both can
3966 		 * be skipped by clearing pfil_member or pfil_bridge.
3967 		 *
3968 		 * Keep the order:
3969 		 *   in_if -> bridge_if -> out_if
3970 		 */
3971 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL) {
3972 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
3973 			if (*mp == NULL || error != 0) /* filter may consume */
3974 				break;
3975 			error = bridge_post_pfil(*mp);
3976 			if (error)
3977 				break;
3978 		}
3979 
3980 		if (pfil_member && ifp != NULL) {
3981 			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp, dir);
3982 			if (*mp == NULL || error != 0) /* filter may consume */
3983 				break;
3984 			error = bridge_post_pfil(*mp);
3985 			if (error)
3986 				break;
3987 		}
3988 
3989 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL) {
3990 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
3991 			if (*mp == NULL || error != 0) /* filter may consume */
3992 				break;
3993 			error = bridge_post_pfil(*mp);
3994 			if (error)
3995 				break;
3996 		}
3997 
3998 		/* check if we need to fragment the packet */
3999 		if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
4000 			i = (*mp)->m_pkthdr.len;
4001 			if (i > ifp->if_mtu) {
4002 				error = bridge_fragment(ifp, *mp, &eh2, snap,
4003 					    &llc1);
4004 				return (error);
4005 			}
4006 		}
4007 
4008 		/* Recalculate the ip checksum and restore byte ordering */
4009 		ip = mtod(*mp, struct ip *);
4010 		hlen = ip->ip_hl << 2;
4011 		if (hlen < sizeof(struct ip))
4012 			goto bad;
4013 		if (hlen > (*mp)->m_len) {
4014 			if ((*mp = m_pullup(*mp, hlen)) == 0)
4015 				goto bad;
4016 			ip = mtod(*mp, struct ip *);
4017 			if (ip == NULL)
4018 				goto bad;
4019 		}
4020 		ip->ip_len = htons(ip->ip_len);
4021 		ip->ip_off = htons(ip->ip_off);
4022 		ip->ip_sum = 0;
4023 		if (hlen == sizeof(struct ip))
4024 			ip->ip_sum = in_cksum_hdr(ip);
4025 		else
4026 			ip->ip_sum = in_cksum(*mp, hlen);
4027 
4028 		break;
4029 #ifdef INET6
4030 	case ETHERTYPE_IPV6:
4031 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
4032 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
4033 					dir);
4034 
4035 		if (*mp == NULL || error != 0) /* filter may consume */
4036 			break;
4037 
4038 		if (pfil_member && ifp != NULL)
4039 			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
4040 					dir);
4041 
4042 		if (*mp == NULL || error != 0) /* filter may consume */
4043 			break;
4044 
4045 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
4046 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
4047 					dir);
4048 		break;
4049 #endif
4050 	default:
4051 		error = 0;
4052 		break;
4053 	}
4054 
4055 	if (*mp == NULL)
4056 		return (error);
4057 	if (error != 0)
4058 		goto bad;
4059 
4060 	error = -1;
4061 
4062 	/*
4063 	 * Finally, put everything back the way it was and return
4064 	 */
4065 	if (snap) {
4066 		M_PREPEND(*mp, sizeof(struct llc), MB_DONTWAIT);
4067 		if (*mp == NULL)
4068 			return (error);
4069 		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
4070 	}
4071 
4072 	M_PREPEND(*mp, ETHER_HDR_LEN, MB_DONTWAIT);
4073 	if (*mp == NULL)
4074 		return (error);
4075 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
4076 
4077 	return (0);
4078 
4079 bad:
4080 	m_freem(*mp);
4081 	*mp = NULL;
4082 	return (error);
4083 }
4084 
4085 /*
4086  * Perform basic checks on header size since
4087  * pfil assumes ip_input has already processed
4088  * it for it.  Cut-and-pasted from ip_input.c.
4089  * Given how simple the IPv6 version is,
4090  * does the IPv4 version really need to be
4091  * this complicated?
4092  *
4093  * XXX Should we update ipstat here, or not?
4094  * XXX Right now we update ipstat but not
4095  * XXX csum_counter.
4096  */
4097 static int
4098 bridge_ip_checkbasic(struct mbuf **mp)
4099 {
4100 	struct mbuf *m = *mp;
4101 	struct ip *ip;
4102 	int len, hlen;
4103 	u_short sum;
4104 
4105 	if (*mp == NULL)
4106 		return (-1);
4107 #if 0 /* notyet */
4108 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
4109 		if ((m = m_copyup(m, sizeof(struct ip),
4110 			(max_linkhdr + 3) & ~3)) == NULL) {
4111 			/* XXXJRT new stat, please */
4112 			ipstat.ips_toosmall++;
4113 			goto bad;
4114 		}
4115 	} else
4116 #endif
4117 #ifndef __predict_false
4118 #define __predict_false(x) x
4119 #endif
4120 	 if (__predict_false(m->m_len < sizeof (struct ip))) {
4121 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
4122 			ipstat.ips_toosmall++;
4123 			goto bad;
4124 		}
4125 	}
4126 	ip = mtod(m, struct ip *);
4127 	if (ip == NULL) goto bad;
4128 
4129 	if (ip->ip_v != IPVERSION) {
4130 		ipstat.ips_badvers++;
4131 		goto bad;
4132 	}
4133 	hlen = ip->ip_hl << 2;
4134 	if (hlen < sizeof(struct ip)) { /* minimum header length */
4135 		ipstat.ips_badhlen++;
4136 		goto bad;
4137 	}
4138 	if (hlen > m->m_len) {
4139 		if ((m = m_pullup(m, hlen)) == 0) {
4140 			ipstat.ips_badhlen++;
4141 			goto bad;
4142 		}
4143 		ip = mtod(m, struct ip *);
4144 		if (ip == NULL) goto bad;
4145 	}
4146 
4147 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
4148 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
4149 	} else {
4150 		if (hlen == sizeof(struct ip)) {
4151 			sum = in_cksum_hdr(ip);
4152 		} else {
4153 			sum = in_cksum(m, hlen);
4154 		}
4155 	}
4156 	if (sum) {
4157 		ipstat.ips_badsum++;
4158 		goto bad;
4159 	}
4160 
4161 	/* Retrieve the packet length. */
4162 	len = ntohs(ip->ip_len);
4163 
4164 	/*
4165 	 * Check for additional length bogosity
4166 	 */
4167 	if (len < hlen) {
4168 		ipstat.ips_badlen++;
4169 		goto bad;
4170 	}
4171 
4172 	/*
4173 	 * Check that the amount of data in the buffers
4174 	 * is as at least much as the IP header would have us expect.
4175 	 * Drop packet if shorter than we expect.
4176 	 */
4177 	if (m->m_pkthdr.len < len) {
4178 		ipstat.ips_tooshort++;
4179 		goto bad;
4180 	}
4181 
4182 	/* Checks out, proceed */
4183 	*mp = m;
4184 	return (0);
4185 
4186 bad:
4187 	*mp = m;
4188 	return (-1);
4189 }
4190 
4191 #ifdef INET6
4192 /*
4193  * Same as above, but for IPv6.
4194  * Cut-and-pasted from ip6_input.c.
4195  * XXX Should we update ip6stat, or not?
4196  */
4197 static int
4198 bridge_ip6_checkbasic(struct mbuf **mp)
4199 {
4200 	struct mbuf *m = *mp;
4201 	struct ip6_hdr *ip6;
4202 
4203 	/*
4204 	 * If the IPv6 header is not aligned, slurp it up into a new
4205 	 * mbuf with space for link headers, in the event we forward
4206 	 * it.  Otherwise, if it is aligned, make sure the entire base
4207 	 * IPv6 header is in the first mbuf of the chain.
4208 	 */
4209 #if 0 /* notyet */
4210 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
4211 		struct ifnet *inifp = m->m_pkthdr.rcvif;
4212 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
4213 			    (max_linkhdr + 3) & ~3)) == NULL) {
4214 			/* XXXJRT new stat, please */
4215 			ip6stat.ip6s_toosmall++;
4216 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
4217 			goto bad;
4218 		}
4219 	} else
4220 #endif
4221 	if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
4222 		struct ifnet *inifp = m->m_pkthdr.rcvif;
4223 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
4224 			ip6stat.ip6s_toosmall++;
4225 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
4226 			goto bad;
4227 		}
4228 	}
4229 
4230 	ip6 = mtod(m, struct ip6_hdr *);
4231 
4232 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
4233 		ip6stat.ip6s_badvers++;
4234 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
4235 		goto bad;
4236 	}
4237 
4238 	/* Checks out, proceed */
4239 	*mp = m;
4240 	return (0);
4241 
4242 bad:
4243 	*mp = m;
4244 	return (-1);
4245 }
4246 #endif /* INET6 */
4247 
4248 /*
4249  * bridge_fragment:
4250  *
4251  *	Return a fragmented mbuf chain.
4252  */
4253 static int
4254 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
4255     int snap, struct llc *llc)
4256 {
4257 	struct mbuf *m0;
4258 	struct ip *ip;
4259 	int error = -1;
4260 
4261 	if (m->m_len < sizeof(struct ip) &&
4262 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
4263 		goto out;
4264 	ip = mtod(m, struct ip *);
4265 
4266 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
4267 		    CSUM_DELAY_IP);
4268 	if (error)
4269 		goto out;
4270 
4271 	/* walk the chain and re-add the Ethernet header */
4272 	for (m0 = m; m0; m0 = m0->m_nextpkt) {
4273 		if (error == 0) {
4274 			if (snap) {
4275 				M_PREPEND(m0, sizeof(struct llc), MB_DONTWAIT);
4276 				if (m0 == NULL) {
4277 					error = ENOBUFS;
4278 					continue;
4279 				}
4280 				bcopy(llc, mtod(m0, caddr_t),
4281 				    sizeof(struct llc));
4282 			}
4283 			M_PREPEND(m0, ETHER_HDR_LEN, MB_DONTWAIT);
4284 			if (m0 == NULL) {
4285 				error = ENOBUFS;
4286 				continue;
4287 			}
4288 			bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
4289 		} else
4290 			m_freem(m);
4291 	}
4292 
4293 	if (error == 0)
4294 		ipstat.ips_fragmented++;
4295 
4296 	return (error);
4297 
4298 out:
4299 	if (m != NULL)
4300 		m_freem(m);
4301 	return (error);
4302 }
4303 
4304 static void
4305 bridge_enqueue_handler(netmsg_t msg)
4306 {
4307 	struct netmsg_packet *nmp;
4308 	struct ifnet *dst_ifp;
4309 	struct mbuf *m;
4310 
4311 	nmp = &msg->packet;
4312 	m = nmp->nm_packet;
4313 	dst_ifp = nmp->base.lmsg.u.ms_resultp;
4314 
4315 	bridge_handoff(dst_ifp->if_bridge, dst_ifp, m, 1);
4316 }
4317 
4318 static void
4319 bridge_handoff(struct bridge_softc *sc, struct ifnet *dst_ifp,
4320 	       struct mbuf *m, int from_us)
4321 {
4322 	struct mbuf *m0;
4323 	struct ifnet *bifp;
4324 
4325 	bifp = sc->sc_ifp;
4326 
4327 	/* We may be sending a fragment so traverse the mbuf */
4328 	for (; m; m = m0) {
4329 		struct altq_pktattr pktattr;
4330 
4331 		m0 = m->m_nextpkt;
4332 		m->m_nextpkt = NULL;
4333 
4334 		/*
4335 		 * If being sent from our host override ether_shost
4336 		 * with the bridge MAC.  This is mandatory for ARP
4337 		 * so things don't get confused.  In particular we
4338 		 * don't want ARPs to get associated with link interfaces
4339 		 * under the bridge which might or might not stay valid.
4340 		 *
4341 		 * Also override ether_shost when relaying a packet out
4342 		 * the same interface it came in on, due to multi-homed
4343 		 * addresses & default routes, otherwise switches will
4344 		 * get very confused.
4345 		 *
4346 		 * Otherwise if we are in transparent mode.
4347 		 */
4348 		if (from_us || m->m_pkthdr.rcvif == dst_ifp) {
4349 			m_copyback(m,
4350 				   offsetof(struct ether_header, ether_shost),
4351 				   ETHER_ADDR_LEN, IF_LLADDR(sc->sc_ifp));
4352 		} else if ((bifp->if_flags & IFF_LINK0) &&
4353 			   (m->m_pkthdr.fw_flags & BRIDGE_MBUF_TAGGED)) {
4354 			m_copyback(m,
4355 				   offsetof(struct ether_header, ether_shost),
4356 				   ETHER_ADDR_LEN,
4357 				   m->m_pkthdr.br.ether.ether_shost);
4358 		} /* else retain shost */
4359 
4360 		if (ifq_is_enabled(&dst_ifp->if_snd))
4361 			altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
4362 
4363 		ifq_dispatch(dst_ifp, m, &pktattr);
4364 	}
4365 }
4366 
4367 static void
4368 bridge_control_dispatch(netmsg_t msg)
4369 {
4370 	struct netmsg_brctl *bc_msg = (struct netmsg_brctl *)msg;
4371 	struct ifnet *bifp = bc_msg->bc_sc->sc_ifp;
4372 	int error;
4373 
4374 	ifnet_serialize_all(bifp);
4375 	error = bc_msg->bc_func(bc_msg->bc_sc, bc_msg->bc_arg);
4376 	ifnet_deserialize_all(bifp);
4377 
4378 	lwkt_replymsg(&bc_msg->base.lmsg, error);
4379 }
4380 
4381 static int
4382 bridge_control(struct bridge_softc *sc, u_long cmd,
4383 	       bridge_ctl_t bc_func, void *bc_arg)
4384 {
4385 	struct ifnet *bifp = sc->sc_ifp;
4386 	struct netmsg_brctl bc_msg;
4387 	int error;
4388 
4389 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
4390 
4391 	bzero(&bc_msg, sizeof(bc_msg));
4392 
4393 	netmsg_init(&bc_msg.base, NULL, &curthread->td_msgport,
4394 		    0, bridge_control_dispatch);
4395 	bc_msg.bc_func = bc_func;
4396 	bc_msg.bc_sc = sc;
4397 	bc_msg.bc_arg = bc_arg;
4398 
4399 	ifnet_deserialize_all(bifp);
4400 	error = lwkt_domsg(BRIDGE_CFGPORT, &bc_msg.base.lmsg, 0);
4401 	ifnet_serialize_all(bifp);
4402 	return error;
4403 }
4404 
4405 static void
4406 bridge_add_bif_handler(netmsg_t msg)
4407 {
4408 	struct netmsg_braddbif *amsg = (struct netmsg_braddbif *)msg;
4409 	struct bridge_softc *sc;
4410 	struct bridge_iflist *bif;
4411 
4412 	sc = amsg->br_softc;
4413 
4414 	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK | M_ZERO);
4415 	bif->bif_ifp = amsg->br_bif_ifp;
4416 	bif->bif_onlist = 1;
4417 	bif->bif_info = amsg->br_bif_info;
4418 
4419 	/*
4420 	 * runs through bif_info
4421 	 */
4422 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
4423 
4424 	TAILQ_INSERT_HEAD(&sc->sc_iflists[mycpuid], bif, bif_next);
4425 
4426 	ifnet_forwardmsg(&amsg->base.lmsg, mycpuid + 1);
4427 }
4428 
4429 static void
4430 bridge_add_bif(struct bridge_softc *sc, struct bridge_ifinfo *bif_info,
4431 	       struct ifnet *ifp)
4432 {
4433 	struct netmsg_braddbif amsg;
4434 
4435 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
4436 
4437 	netmsg_init(&amsg.base, NULL, &curthread->td_msgport,
4438 		    0, bridge_add_bif_handler);
4439 	amsg.br_softc = sc;
4440 	amsg.br_bif_info = bif_info;
4441 	amsg.br_bif_ifp = ifp;
4442 
4443 	ifnet_domsg(&amsg.base.lmsg, 0);
4444 }
4445 
4446 static void
4447 bridge_del_bif_handler(netmsg_t msg)
4448 {
4449 	struct netmsg_brdelbif *dmsg = (struct netmsg_brdelbif *)msg;
4450 	struct bridge_softc *sc;
4451 	struct bridge_iflist *bif;
4452 
4453 	sc = dmsg->br_softc;
4454 
4455 	/*
4456 	 * Locate the bif associated with the br_bif_info
4457 	 * on the current CPU
4458 	 */
4459 	bif = bridge_lookup_member_ifinfo(sc, dmsg->br_bif_info);
4460 	KKASSERT(bif != NULL && bif->bif_onlist);
4461 
4462 	/* Remove the bif from the current CPU's iflist */
4463 	bif->bif_onlist = 0;
4464 	TAILQ_REMOVE(dmsg->br_bif_list, bif, bif_next);
4465 
4466 	/* Save the removed bif for later freeing */
4467 	TAILQ_INSERT_HEAD(dmsg->br_bif_list, bif, bif_next);
4468 
4469 	ifnet_forwardmsg(&dmsg->base.lmsg, mycpuid + 1);
4470 }
4471 
4472 static void
4473 bridge_del_bif(struct bridge_softc *sc, struct bridge_ifinfo *bif_info,
4474 	       struct bridge_iflist_head *saved_bifs)
4475 {
4476 	struct netmsg_brdelbif dmsg;
4477 
4478 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
4479 
4480 	netmsg_init(&dmsg.base, NULL, &curthread->td_msgport,
4481 		    0, bridge_del_bif_handler);
4482 	dmsg.br_softc = sc;
4483 	dmsg.br_bif_info = bif_info;
4484 	dmsg.br_bif_list = saved_bifs;
4485 
4486 	ifnet_domsg(&dmsg.base.lmsg, 0);
4487 }
4488