xref: /dflybsd-src/sys/net/bridge/if_bridge.c (revision 52e9aa73cf3364e912d7cc4bd5c662f17d48674c)
1 /*
2  * Copyright 2001 Wasabi Systems, Inc.
3  * All rights reserved.
4  *
5  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed for the NetBSD Project by
18  *	Wasabi Systems, Inc.
19  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
20  *    or promote products derived from this software without specific prior
21  *    written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33  * POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /*
37  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
38  * All rights reserved.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  * 3. All advertising materials mentioning features or use of this software
49  *    must display the following acknowledgement:
50  *	This product includes software developed by Jason L. Wright
51  * 4. The name of the author may not be used to endorse or promote products
52  *    derived from this software without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
55  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
56  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
57  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
58  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
59  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
60  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
63  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
64  * POSSIBILITY OF SUCH DAMAGE.
65  *
66  * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
67  * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
68  * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
69  */
70 
71 /*
72  * Network interface bridge support.
73  *
74  * TODO:
75  *
76  *	- Currently only supports Ethernet-like interfaces (Ethernet,
77  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
78  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
79  *	  consider heterogenous bridges).
80  *
81  *
82  * Bridge's route information is duplicated to each CPUs:
83  *
84  *      CPU0          CPU1          CPU2          CPU3
85  * +-----------+ +-----------+ +-----------+ +-----------+
86  * |  rtnode   | |  rtnode   | |  rtnode   | |  rtnode   |
87  * |           | |           | |           | |           |
88  * | dst eaddr | | dst eaddr | | dst eaddr | | dst eaddr |
89  * +-----------+ +-----------+ +-----------+ +-----------+
90  *       |         |                     |         |
91  *       |         |                     |         |
92  *       |         |     +----------+    |         |
93  *       |         |     |  rtinfo  |    |         |
94  *       |         +---->|          |<---+         |
95  *       |               |  flags   |              |
96  *       +-------------->|  timeout |<-------------+
97  *                       |  dst_ifp |
98  *                       +----------+
99  *
100  * We choose to put timeout and dst_ifp into shared part, so updating
101  * them will be cheaper than using message forwarding.  Also there is
102  * not need to use spinlock to protect the updating: timeout and dst_ifp
103  * is not related and specific field's updating order has no importance.
104  * The cache pollution by the share part should not be heavy: in a stable
105  * setup, dst_ifp probably will be not changed in rtnode's life time,
106  * while timeout is refreshed once per second; most of the time, timeout
107  * and dst_ifp are read-only accessed.
108  *
109  *
110  * Bridge route information installation on bridge_input path:
111  *
112  *      CPU0           CPU1         CPU2          CPU3
113  *
114  *                               tcp_thread2
115  *                                    |
116  *                                alloc nmsg
117  *                    snd nmsg        |
118  *                    w/o rtinfo      |
119  *      ifnet0<-----------------------+
120  *        |                           :
121  *    lookup dst                      :
122  *   rtnode exists?(Y)free nmsg       :
123  *        |(N)                        :
124  *        |
125  *  alloc rtinfo
126  *  alloc rtnode
127  * install rtnode
128  *        |
129  *        +---------->ifnet1
130  *        : fwd nmsg    |
131  *        : w/ rtinfo   |
132  *        :             |
133  *        :             |
134  *                 alloc rtnode
135  *               (w/ nmsg's rtinfo)
136  *                install rtnode
137  *                      |
138  *                      +---------->ifnet2
139  *                      : fwd nmsg    |
140  *                      : w/ rtinfo   |
141  *                      :             |
142  *                      :         same as ifnet1
143  *                                    |
144  *                                    +---------->ifnet3
145  *                                    : fwd nmsg    |
146  *                                    : w/ rtinfo   |
147  *                                    :             |
148  *                                    :         same as ifnet1
149  *                                               free nmsg
150  *                                                  :
151  *                                                  :
152  *
153  * The netmsgs forwarded between protocol threads and ifnet threads are
154  * allocated with (M_WAITOK|M_NULLOK), so it will not fail under most
155  * cases (route information is too precious to be not installed :).
156  * Since multiple threads may try to install route information for the
157  * same dst eaddr, we look up route information in ifnet0.  However, this
158  * looking up only need to be performed on ifnet0, which is the start
159  * point of the route information installation process.
160  *
161  *
162  * Bridge route information deleting/flushing:
163  *
164  *  CPU0            CPU1             CPU2             CPU3
165  *
166  * netisr0
167  *   |
168  * find suitable rtnodes,
169  * mark their rtinfo dead
170  *   |
171  *   | domsg <------------------------------------------+
172  *   |                                                  | replymsg
173  *   |                                                  |
174  *   V     fwdmsg           fwdmsg           fwdmsg     |
175  * ifnet0 --------> ifnet1 --------> ifnet2 --------> ifnet3
176  * delete rtnodes   delete rtnodes   delete rtnodes   delete rtnodes
177  * w/ dead rtinfo   w/ dead rtinfo   w/ dead rtinfo   w/ dead rtinfo
178  *                                                    free dead rtinfos
179  *
180  * All deleting/flushing operations are serialized by netisr0, so each
181  * operation only reaps the route information marked dead by itself.
182  *
183  *
184  * Bridge route information adding/deleting/flushing:
185  * Since all operation is serialized by the fixed message flow between
186  * ifnet threads, it is not possible to create corrupted per-cpu route
187  * information.
188  *
189  *
190  *
191  * Percpu member interface list iteration with blocking operation:
192  * Since one bridge could only delete one member interface at a time and
193  * the deleted member interface is not freed after netmsg_service_sync(),
194  * following way is used to make sure that even if the certain member
195  * interface is ripped from the percpu list during the blocking operation,
196  * the iteration still could keep going:
197  *
198  * TAILQ_FOREACH_MUTABLE(bif, sc->sc_iflists[mycpuid], bif_next, nbif) {
199  *     blocking operation;
200  *     blocking operation;
201  *     ...
202  *     ...
203  *     if (nbif != NULL && !nbif->bif_onlist) {
204  *         KKASSERT(bif->bif_onlist);
205  *         nbif = TAILQ_NEXT(bif, bif_next);
206  *     }
207  * }
208  *
209  * As mentioned above only one member interface could be unlinked from the
210  * percpu member interface list, so either bif or nbif may be not on the list,
211  * but _not_ both.  To keep the list iteration, we don't care about bif, but
212  * only nbif.  Since removed member interface will only be freed after we
213  * finish our work, it is safe to access any field in an unlinked bif (here
214  * bif_onlist).  If nbif is no longer on the list, then bif must be on the
215  * list, so we change nbif to the next element of bif and keep going.
216  */
217 
218 #include "opt_inet.h"
219 #include "opt_inet6.h"
220 
221 #include <sys/param.h>
222 #include <sys/mbuf.h>
223 #include <sys/malloc.h>
224 #include <sys/protosw.h>
225 #include <sys/systm.h>
226 #include <sys/time.h>
227 #include <sys/socket.h> /* for net/if.h */
228 #include <sys/sockio.h>
229 #include <sys/ctype.h>  /* string functions */
230 #include <sys/kernel.h>
231 #include <sys/random.h>
232 #include <sys/sysctl.h>
233 #include <sys/module.h>
234 #include <sys/proc.h>
235 #include <sys/priv.h>
236 #include <sys/lock.h>
237 #include <sys/thread.h>
238 #include <sys/thread2.h>
239 #include <sys/mpipe.h>
240 
241 #include <net/bpf.h>
242 #include <net/if.h>
243 #include <net/if_dl.h>
244 #include <net/if_types.h>
245 #include <net/if_var.h>
246 #include <net/pfil.h>
247 #include <net/ifq_var.h>
248 #include <net/if_clone.h>
249 
250 #include <netinet/in.h> /* for struct arpcom */
251 #include <netinet/in_systm.h>
252 #include <netinet/in_var.h>
253 #include <netinet/ip.h>
254 #include <netinet/ip_var.h>
255 #ifdef INET6
256 #include <netinet/ip6.h>
257 #include <netinet6/ip6_var.h>
258 #endif
259 #include <netinet/if_ether.h> /* for struct arpcom */
260 #include <net/bridge/if_bridgevar.h>
261 #include <net/if_llc.h>
262 #include <net/netmsg2.h>
263 
264 #include <net/route.h>
265 #include <sys/in_cksum.h>
266 
267 /*
268  * Size of the route hash table.  Must be a power of two.
269  */
270 #ifndef BRIDGE_RTHASH_SIZE
271 #define	BRIDGE_RTHASH_SIZE		1024
272 #endif
273 
274 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
275 
276 /*
277  * Maximum number of addresses to cache.
278  */
279 #ifndef BRIDGE_RTABLE_MAX
280 #define	BRIDGE_RTABLE_MAX		100
281 #endif
282 
283 /*
284  * Spanning tree defaults.
285  */
286 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
287 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
288 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
289 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
290 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
291 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
292 #define	BSTP_DEFAULT_PATH_COST		55
293 
294 /*
295  * Timeout (in seconds) for entries learned dynamically.
296  */
297 #ifndef BRIDGE_RTABLE_TIMEOUT
298 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
299 #endif
300 
301 /*
302  * Number of seconds between walks of the route list.
303  */
304 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
305 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
306 #endif
307 
308 /*
309  * List of capabilities to mask on the member interface.
310  */
311 #define	BRIDGE_IFCAPS_MASK		IFCAP_TXCSUM
312 
313 typedef int	(*bridge_ctl_t)(struct bridge_softc *, void *);
314 
315 struct netmsg_brctl {
316 	struct netmsg_base	base;
317 	bridge_ctl_t		bc_func;
318 	struct bridge_softc	*bc_sc;
319 	void			*bc_arg;
320 };
321 
322 struct netmsg_brsaddr {
323 	struct netmsg_base	base;
324 	struct bridge_softc	*br_softc;
325 	struct ifnet		*br_dst_if;
326 	struct bridge_rtinfo	*br_rtinfo;
327 	int			br_setflags;
328 	uint8_t			br_dst[ETHER_ADDR_LEN];
329 	uint8_t			br_flags;
330 };
331 
332 struct netmsg_braddbif {
333 	struct netmsg_base	base;
334 	struct bridge_softc	*br_softc;
335 	struct bridge_ifinfo	*br_bif_info;
336 	struct ifnet		*br_bif_ifp;
337 };
338 
339 struct netmsg_brdelbif {
340 	struct netmsg_base	base;
341 	struct bridge_softc	*br_softc;
342 	struct bridge_ifinfo	*br_bif_info;
343 	struct bridge_iflist_head *br_bif_list;
344 };
345 
346 struct netmsg_brsflags {
347 	struct netmsg_base	base;
348 	struct bridge_softc	*br_softc;
349 	struct bridge_ifinfo	*br_bif_info;
350 	uint32_t		br_bif_flags;
351 };
352 
353 eventhandler_tag	bridge_detach_cookie = NULL;
354 
355 extern	struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
356 extern	int (*bridge_output_p)(struct ifnet *, struct mbuf *);
357 extern	void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
358 extern  struct ifnet *(*bridge_interface_p)(void *if_bridge);
359 
360 static int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
361 
362 static int	bridge_clone_create(struct if_clone *, int, caddr_t);
363 static int	bridge_clone_destroy(struct ifnet *);
364 
365 static int	bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
366 static void	bridge_mutecaps(struct bridge_ifinfo *, struct ifnet *, int);
367 static void	bridge_ifdetach(void *, struct ifnet *);
368 static void	bridge_init(void *);
369 static int	bridge_from_us(struct bridge_softc *, struct ether_header *);
370 static void	bridge_stop(struct ifnet *);
371 static void	bridge_start(struct ifnet *, struct ifaltq_subque *);
372 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
373 static int	bridge_output(struct ifnet *, struct mbuf *);
374 static struct ifnet *bridge_interface(void *if_bridge);
375 
376 static void	bridge_forward(struct bridge_softc *, struct mbuf *m);
377 
378 static void	bridge_timer_handler(netmsg_t);
379 static void	bridge_timer(void *);
380 
381 static void	bridge_start_bcast(struct bridge_softc *, struct mbuf *);
382 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
383 		    struct mbuf *);
384 static void	bridge_span(struct bridge_softc *, struct mbuf *);
385 
386 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
387 		    struct ifnet *, uint8_t);
388 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
389 static void	bridge_rtreap(struct bridge_softc *);
390 static void	bridge_rtreap_async(struct bridge_softc *);
391 static void	bridge_rttrim(struct bridge_softc *);
392 static int	bridge_rtage_finddead(struct bridge_softc *);
393 static void	bridge_rtage(struct bridge_softc *);
394 static void	bridge_rtflush(struct bridge_softc *, int);
395 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
396 static int	bridge_rtsaddr(struct bridge_softc *, const uint8_t *,
397 		    struct ifnet *, uint8_t);
398 static void	bridge_rtmsg_sync(struct bridge_softc *sc);
399 static void	bridge_rtreap_handler(netmsg_t);
400 static void	bridge_rtinstall_handler(netmsg_t);
401 static int	bridge_rtinstall_oncpu(struct bridge_softc *, const uint8_t *,
402 		    struct ifnet *, int, uint8_t, struct bridge_rtinfo **);
403 
404 static void	bridge_rtable_init(struct bridge_softc *);
405 static void	bridge_rtable_fini(struct bridge_softc *);
406 
407 static int	bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
408 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
409 		    const uint8_t *);
410 static void	bridge_rtnode_insert(struct bridge_softc *,
411 		    struct bridge_rtnode *);
412 static void	bridge_rtnode_destroy(struct bridge_softc *,
413 		    struct bridge_rtnode *);
414 
415 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
416 		    const char *name);
417 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
418 		    struct ifnet *ifp);
419 static struct bridge_iflist *bridge_lookup_member_ifinfo(struct bridge_softc *,
420 		    struct bridge_ifinfo *);
421 static void	bridge_delete_member(struct bridge_softc *,
422 		    struct bridge_iflist *, int);
423 static void	bridge_delete_span(struct bridge_softc *,
424 		    struct bridge_iflist *);
425 
426 static int	bridge_control(struct bridge_softc *, u_long,
427 			       bridge_ctl_t, void *);
428 static int	bridge_ioctl_init(struct bridge_softc *, void *);
429 static int	bridge_ioctl_stop(struct bridge_softc *, void *);
430 static int	bridge_ioctl_add(struct bridge_softc *, void *);
431 static int	bridge_ioctl_del(struct bridge_softc *, void *);
432 static void	bridge_ioctl_fillflags(struct bridge_softc *sc,
433 				struct bridge_iflist *bif, struct ifbreq *req);
434 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
435 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
436 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
437 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
438 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
439 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
440 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
441 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
442 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
443 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
444 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
445 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
446 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
447 static int	bridge_ioctl_reinit(struct bridge_softc *, void *);
448 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
449 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
450 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
451 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
452 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
453 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
454 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
455 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
456 static int	bridge_ioctl_addspan(struct bridge_softc *, void *);
457 static int	bridge_ioctl_delspan(struct bridge_softc *, void *);
458 static int	bridge_ioctl_sifbondwght(struct bridge_softc *, void *);
459 static int	bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
460 		    int);
461 static int	bridge_ip_checkbasic(struct mbuf **mp);
462 #ifdef INET6
463 static int	bridge_ip6_checkbasic(struct mbuf **mp);
464 #endif /* INET6 */
465 static int	bridge_fragment(struct ifnet *, struct mbuf *,
466 		    struct ether_header *, int, struct llc *);
467 static void	bridge_enqueue_handler(netmsg_t);
468 static void	bridge_handoff(struct bridge_softc *, struct ifnet *,
469 		    struct mbuf *, int);
470 
471 static void	bridge_del_bif_handler(netmsg_t);
472 static void	bridge_add_bif_handler(netmsg_t);
473 static void	bridge_del_bif(struct bridge_softc *, struct bridge_ifinfo *,
474 		    struct bridge_iflist_head *);
475 static void	bridge_add_bif(struct bridge_softc *, struct bridge_ifinfo *,
476 		    struct ifnet *);
477 
478 SYSCTL_DECL(_net_link);
479 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
480 
481 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
482 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
483 static int pfil_member = 1; /* run pfil hooks on the member interface */
484 static int bridge_debug;
485 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
486     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
487 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
488     &pfil_bridge, 0, "Packet filter on the bridge interface");
489 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
490     &pfil_member, 0, "Packet filter on the member interface");
491 SYSCTL_INT(_net_link_bridge, OID_AUTO, debug, CTLFLAG_RW,
492     &bridge_debug, 0, "Bridge debug mode");
493 
494 struct bridge_control_arg {
495 	union {
496 		struct ifbreq ifbreq;
497 		struct ifbifconf ifbifconf;
498 		struct ifbareq ifbareq;
499 		struct ifbaconf ifbaconf;
500 		struct ifbrparam ifbrparam;
501 	} bca_u;
502 	int	bca_len;
503 	void	*bca_uptr;
504 	void	*bca_kptr;
505 };
506 
507 struct bridge_control {
508 	bridge_ctl_t	bc_func;
509 	int		bc_argsize;
510 	int		bc_flags;
511 };
512 
513 #define	BC_F_COPYIN		0x01	/* copy arguments in */
514 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
515 #define	BC_F_SUSER		0x04	/* do super-user check */
516 
517 const struct bridge_control bridge_control_table[] = {
518 	{ bridge_ioctl_add,		sizeof(struct ifbreq),
519 	  BC_F_COPYIN|BC_F_SUSER },
520 	{ bridge_ioctl_del,		sizeof(struct ifbreq),
521 	  BC_F_COPYIN|BC_F_SUSER },
522 
523 	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
524 	  BC_F_COPYIN|BC_F_COPYOUT },
525 	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
526 	  BC_F_COPYIN|BC_F_SUSER },
527 
528 	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
529 	  BC_F_COPYIN|BC_F_SUSER },
530 	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
531 	  BC_F_COPYOUT },
532 
533 	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
534 	  BC_F_COPYIN|BC_F_COPYOUT },
535 	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
536 	  BC_F_COPYIN|BC_F_COPYOUT },
537 
538 	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
539 	  BC_F_COPYIN|BC_F_SUSER },
540 
541 	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
542 	  BC_F_COPYIN|BC_F_SUSER },
543 	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
544 	  BC_F_COPYOUT },
545 
546 	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
547 	  BC_F_COPYIN|BC_F_SUSER },
548 
549 	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
550 	  BC_F_COPYIN|BC_F_SUSER },
551 
552 	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
553 	  BC_F_COPYOUT },
554 	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
555 	  BC_F_COPYIN|BC_F_SUSER },
556 
557 	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
558 	  BC_F_COPYOUT },
559 	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
560 	  BC_F_COPYIN|BC_F_SUSER },
561 
562 	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
563 	  BC_F_COPYOUT },
564 	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
565 	  BC_F_COPYIN|BC_F_SUSER },
566 
567 	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
568 	  BC_F_COPYOUT },
569 	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
570 	  BC_F_COPYIN|BC_F_SUSER },
571 
572 	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
573 	  BC_F_COPYIN|BC_F_SUSER },
574 
575 	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
576 	  BC_F_COPYIN|BC_F_SUSER },
577 
578 	{ bridge_ioctl_addspan,		sizeof(struct ifbreq),
579 	  BC_F_COPYIN|BC_F_SUSER },
580 	{ bridge_ioctl_delspan,		sizeof(struct ifbreq),
581 	  BC_F_COPYIN|BC_F_SUSER },
582 
583 	{ bridge_ioctl_sifbondwght,	sizeof(struct ifbreq),
584 	  BC_F_COPYIN|BC_F_SUSER },
585 
586 };
587 static const int bridge_control_table_size = NELEM(bridge_control_table);
588 
589 LIST_HEAD(, bridge_softc) bridge_list;
590 
591 struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
592 				bridge_clone_create,
593 				bridge_clone_destroy, 0, IF_MAXUNIT);
594 
595 static int
596 bridge_modevent(module_t mod, int type, void *data)
597 {
598 	switch (type) {
599 	case MOD_LOAD:
600 		LIST_INIT(&bridge_list);
601 		if_clone_attach(&bridge_cloner);
602 		bridge_input_p = bridge_input;
603 		bridge_output_p = bridge_output;
604 		bridge_interface_p = bridge_interface;
605 		bridge_detach_cookie = EVENTHANDLER_REGISTER(
606 		    ifnet_detach_event, bridge_ifdetach, NULL,
607 		    EVENTHANDLER_PRI_ANY);
608 #if 0 /* notyet */
609 		bstp_linkstate_p = bstp_linkstate;
610 #endif
611 		break;
612 	case MOD_UNLOAD:
613 		if (!LIST_EMPTY(&bridge_list))
614 			return (EBUSY);
615 		EVENTHANDLER_DEREGISTER(ifnet_detach_event,
616 		    bridge_detach_cookie);
617 		if_clone_detach(&bridge_cloner);
618 		bridge_input_p = NULL;
619 		bridge_output_p = NULL;
620 		bridge_interface_p = NULL;
621 #if 0 /* notyet */
622 		bstp_linkstate_p = NULL;
623 #endif
624 		break;
625 	default:
626 		return (EOPNOTSUPP);
627 	}
628 	return (0);
629 }
630 
631 static moduledata_t bridge_mod = {
632 	"if_bridge",
633 	bridge_modevent,
634 	0
635 };
636 
637 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
638 
639 
640 /*
641  * bridge_clone_create:
642  *
643  *	Create a new bridge instance.
644  */
645 static int
646 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t param __unused)
647 {
648 	struct bridge_softc *sc;
649 	struct ifnet *ifp;
650 	u_char eaddr[6];
651 	int cpu, rnd;
652 
653 	sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK | M_ZERO);
654 	ifp = sc->sc_ifp = &sc->sc_if;
655 
656 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
657 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
658 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
659 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
660 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
661 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
662 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
663 
664 	/* Initialize our routing table. */
665 	bridge_rtable_init(sc);
666 
667 	callout_init(&sc->sc_brcallout);
668 	netmsg_init(&sc->sc_brtimemsg, NULL, &netisr_adone_rport,
669 		    MSGF_DROPABLE, bridge_timer_handler);
670 	sc->sc_brtimemsg.lmsg.u.ms_resultp = sc;
671 
672 	callout_init(&sc->sc_bstpcallout);
673 	netmsg_init(&sc->sc_bstptimemsg, NULL, &netisr_adone_rport,
674 		    MSGF_DROPABLE, bstp_tick_handler);
675 	sc->sc_bstptimemsg.lmsg.u.ms_resultp = sc;
676 
677 	/* Initialize per-cpu member iface lists */
678 	sc->sc_iflists = kmalloc(sizeof(*sc->sc_iflists) * ncpus,
679 				 M_DEVBUF, M_WAITOK);
680 	for (cpu = 0; cpu < ncpus; ++cpu)
681 		TAILQ_INIT(&sc->sc_iflists[cpu]);
682 
683 	TAILQ_INIT(&sc->sc_spanlist);
684 
685 	ifp->if_softc = sc;
686 	if_initname(ifp, ifc->ifc_name, unit);
687 	ifp->if_mtu = ETHERMTU;
688 	ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
689 	ifp->if_ioctl = bridge_ioctl;
690 	ifp->if_start = bridge_start;
691 	ifp->if_init = bridge_init;
692 	ifp->if_type = IFT_ETHER;
693 	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
694 	ifq_set_ready(&ifp->if_snd);
695 	ifp->if_hdrlen = ETHER_HDR_LEN;
696 
697 	/*
698 	 * Generate a random ethernet address and use the private AC:DE:48
699 	 * OUI code.
700 	 */
701 	rnd = karc4random();
702 	bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
703 	rnd = karc4random();
704 	bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */
705 
706 	eaddr[0] &= ~1;	/* clear multicast bit */
707 	eaddr[0] |= 2;	/* set the LAA bit */
708 
709 	ether_ifattach(ifp, eaddr, NULL);
710 	/* Now undo some of the damage... */
711 	ifp->if_baudrate = 0;
712 	/*ifp->if_type = IFT_BRIDGE;*/
713 
714 	crit_enter();	/* XXX MP */
715 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
716 	crit_exit();
717 
718 	return (0);
719 }
720 
721 static void
722 bridge_delete_dispatch(netmsg_t msg)
723 {
724 	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
725 	struct ifnet *bifp = sc->sc_ifp;
726 	struct bridge_iflist *bif;
727 
728 	ifnet_serialize_all(bifp);
729 
730 	while ((bif = TAILQ_FIRST(&sc->sc_iflists[mycpuid])) != NULL)
731 		bridge_delete_member(sc, bif, 0);
732 
733 	while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL)
734 		bridge_delete_span(sc, bif);
735 
736 	ifnet_deserialize_all(bifp);
737 
738 	lwkt_replymsg(&msg->lmsg, 0);
739 }
740 
741 /*
742  * bridge_clone_destroy:
743  *
744  *	Destroy a bridge instance.
745  */
746 static int
747 bridge_clone_destroy(struct ifnet *ifp)
748 {
749 	struct bridge_softc *sc = ifp->if_softc;
750 	struct netmsg_base msg;
751 
752 	ifnet_serialize_all(ifp);
753 
754 	bridge_stop(ifp);
755 	ifp->if_flags &= ~IFF_UP;
756 
757 	ifnet_deserialize_all(ifp);
758 
759 	netmsg_init(&msg, NULL, &curthread->td_msgport,
760 		    0, bridge_delete_dispatch);
761 	msg.lmsg.u.ms_resultp = sc;
762 	lwkt_domsg(BRIDGE_CFGPORT, &msg.lmsg, 0);
763 
764 	crit_enter();	/* XXX MP */
765 	LIST_REMOVE(sc, sc_list);
766 	crit_exit();
767 
768 	ether_ifdetach(ifp);
769 
770 	/* Tear down the routing table. */
771 	bridge_rtable_fini(sc);
772 
773 	/* Free per-cpu member iface lists */
774 	kfree(sc->sc_iflists, M_DEVBUF);
775 
776 	kfree(sc, M_DEVBUF);
777 
778 	return 0;
779 }
780 
781 /*
782  * bridge_ioctl:
783  *
784  *	Handle a control request from the operator.
785  */
786 static int
787 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
788 {
789 	struct bridge_softc *sc = ifp->if_softc;
790 	struct bridge_control_arg args;
791 	struct ifdrv *ifd = (struct ifdrv *) data;
792 	const struct bridge_control *bc;
793 	int error = 0;
794 
795 	ASSERT_IFNET_SERIALIZED_ALL(ifp);
796 
797 	switch (cmd) {
798 	case SIOCADDMULTI:
799 	case SIOCDELMULTI:
800 		break;
801 
802 	case SIOCGDRVSPEC:
803 	case SIOCSDRVSPEC:
804 		if (ifd->ifd_cmd >= bridge_control_table_size) {
805 			error = EINVAL;
806 			break;
807 		}
808 		bc = &bridge_control_table[ifd->ifd_cmd];
809 
810 		if (cmd == SIOCGDRVSPEC &&
811 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
812 			error = EINVAL;
813 			break;
814 		} else if (cmd == SIOCSDRVSPEC &&
815 			   (bc->bc_flags & BC_F_COPYOUT)) {
816 			error = EINVAL;
817 			break;
818 		}
819 
820 		if (bc->bc_flags & BC_F_SUSER) {
821 			error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY);
822 			if (error)
823 				break;
824 		}
825 
826 		if (ifd->ifd_len != bc->bc_argsize ||
827 		    ifd->ifd_len > sizeof(args.bca_u)) {
828 			error = EINVAL;
829 			break;
830 		}
831 
832 		memset(&args, 0, sizeof(args));
833 		if (bc->bc_flags & BC_F_COPYIN) {
834 			error = copyin(ifd->ifd_data, &args.bca_u,
835 				       ifd->ifd_len);
836 			if (error)
837 				break;
838 		}
839 
840 		error = bridge_control(sc, cmd, bc->bc_func, &args);
841 		if (error) {
842 			KKASSERT(args.bca_len == 0 && args.bca_kptr == NULL);
843 			break;
844 		}
845 
846 		if (bc->bc_flags & BC_F_COPYOUT) {
847 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
848 			if (args.bca_len != 0) {
849 				KKASSERT(args.bca_kptr != NULL);
850 				if (!error) {
851 					error = copyout(args.bca_kptr,
852 						args.bca_uptr, args.bca_len);
853 				}
854 				kfree(args.bca_kptr, M_TEMP);
855 			} else {
856 				KKASSERT(args.bca_kptr == NULL);
857 			}
858 		} else {
859 			KKASSERT(args.bca_len == 0 && args.bca_kptr == NULL);
860 		}
861 		break;
862 
863 	case SIOCSIFFLAGS:
864 		if (!(ifp->if_flags & IFF_UP) &&
865 		    (ifp->if_flags & IFF_RUNNING)) {
866 			/*
867 			 * If interface is marked down and it is running,
868 			 * then stop it.
869 			 */
870 			bridge_stop(ifp);
871 		} else if ((ifp->if_flags & IFF_UP) &&
872 		    !(ifp->if_flags & IFF_RUNNING)) {
873 			/*
874 			 * If interface is marked up and it is stopped, then
875 			 * start it.
876 			 */
877 			ifp->if_init(sc);
878 		}
879 
880 		/*
881 		 * If running and link flag state change we have to
882 		 * reinitialize as well.
883 		 */
884 		if ((ifp->if_flags & IFF_RUNNING) &&
885 		    (ifp->if_flags & (IFF_LINK0|IFF_LINK1|IFF_LINK2)) !=
886 		    sc->sc_copy_flags) {
887 			sc->sc_copy_flags = ifp->if_flags &
888 					(IFF_LINK0|IFF_LINK1|IFF_LINK2);
889 			bridge_control(sc, 0, bridge_ioctl_reinit, NULL);
890 		}
891 
892 		break;
893 
894 	case SIOCSIFMTU:
895 		/* Do not allow the MTU to be changed on the bridge */
896 		error = EINVAL;
897 		break;
898 
899 	default:
900 		error = ether_ioctl(ifp, cmd, data);
901 		break;
902 	}
903 	return (error);
904 }
905 
906 /*
907  * bridge_mutecaps:
908  *
909  *	Clear or restore unwanted capabilities on the member interface
910  */
911 static void
912 bridge_mutecaps(struct bridge_ifinfo *bif_info, struct ifnet *ifp, int mute)
913 {
914 	struct ifreq ifr;
915 	int error;
916 
917 	if (ifp->if_ioctl == NULL)
918 		return;
919 
920 	bzero(&ifr, sizeof(ifr));
921 	ifr.ifr_reqcap = ifp->if_capenable;
922 
923 	if (mute) {
924 		/* mask off and save capabilities */
925 		bif_info->bifi_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
926 		if (bif_info->bifi_mutecap != 0)
927 			ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
928 	} else {
929 		/* restore muted capabilities */
930 		ifr.ifr_reqcap |= bif_info->bifi_mutecap;
931 	}
932 
933 	if (bif_info->bifi_mutecap != 0) {
934 		ifnet_serialize_all(ifp);
935 		error = ifp->if_ioctl(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
936 		ifnet_deserialize_all(ifp);
937 	}
938 }
939 
940 /*
941  * bridge_lookup_member:
942  *
943  *	Lookup a bridge member interface.
944  */
945 static struct bridge_iflist *
946 bridge_lookup_member(struct bridge_softc *sc, const char *name)
947 {
948 	struct bridge_iflist *bif;
949 
950 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
951 		if (strcmp(bif->bif_ifp->if_xname, name) == 0)
952 			return (bif);
953 	}
954 	return (NULL);
955 }
956 
957 /*
958  * bridge_lookup_member_if:
959  *
960  *	Lookup a bridge member interface by ifnet*.
961  */
962 static struct bridge_iflist *
963 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
964 {
965 	struct bridge_iflist *bif;
966 
967 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
968 		if (bif->bif_ifp == member_ifp)
969 			return (bif);
970 	}
971 	return (NULL);
972 }
973 
974 /*
975  * bridge_lookup_member_ifinfo:
976  *
977  *	Lookup a bridge member interface by bridge_ifinfo.
978  */
979 static struct bridge_iflist *
980 bridge_lookup_member_ifinfo(struct bridge_softc *sc,
981 			    struct bridge_ifinfo *bif_info)
982 {
983 	struct bridge_iflist *bif;
984 
985 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
986 		if (bif->bif_info == bif_info)
987 			return (bif);
988 	}
989 	return (NULL);
990 }
991 
992 /*
993  * bridge_delete_member:
994  *
995  *	Delete the specified member interface.
996  */
997 static void
998 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
999     int gone)
1000 {
1001 	struct ifnet *ifs = bif->bif_ifp;
1002 	struct ifnet *bifp = sc->sc_ifp;
1003 	struct bridge_ifinfo *bif_info = bif->bif_info;
1004 	struct bridge_iflist_head saved_bifs;
1005 
1006 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
1007 	KKASSERT(bif_info != NULL);
1008 
1009 	ifs->if_bridge = NULL;
1010 
1011 	/*
1012 	 * Release bridge interface's serializer:
1013 	 * - To avoid possible dead lock.
1014 	 * - Various sync operation will block the current thread.
1015 	 */
1016 	ifnet_deserialize_all(bifp);
1017 
1018 	if (!gone) {
1019 		switch (ifs->if_type) {
1020 		case IFT_ETHER:
1021 		case IFT_L2VLAN:
1022 			/*
1023 			 * Take the interface out of promiscuous mode.
1024 			 */
1025 			ifpromisc(ifs, 0);
1026 			bridge_mutecaps(bif_info, ifs, 0);
1027 			break;
1028 
1029 		case IFT_GIF:
1030 			break;
1031 
1032 		default:
1033 			panic("bridge_delete_member: impossible");
1034 			break;
1035 		}
1036 	}
1037 
1038 	/*
1039 	 * Remove bifs from percpu linked list.
1040 	 *
1041 	 * Removed bifs are not freed immediately, instead,
1042 	 * they are saved in saved_bifs.  They will be freed
1043 	 * after we make sure that no one is accessing them,
1044 	 * i.e. after following netmsg_service_sync()
1045 	 */
1046 	TAILQ_INIT(&saved_bifs);
1047 	bridge_del_bif(sc, bif_info, &saved_bifs);
1048 
1049 	/*
1050 	 * Make sure that all protocol threads:
1051 	 * o  see 'ifs' if_bridge is changed
1052 	 * o  know that bif is removed from the percpu linked list
1053 	 */
1054 	netmsg_service_sync();
1055 
1056 	/*
1057 	 * Free the removed bifs
1058 	 */
1059 	KKASSERT(!TAILQ_EMPTY(&saved_bifs));
1060 	while ((bif = TAILQ_FIRST(&saved_bifs)) != NULL) {
1061 		TAILQ_REMOVE(&saved_bifs, bif, bif_next);
1062 		kfree(bif, M_DEVBUF);
1063 	}
1064 
1065 	/* See the comment in bridge_ioctl_stop() */
1066 	bridge_rtmsg_sync(sc);
1067 	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL | IFBF_FLUSHSYNC);
1068 
1069 	ifnet_serialize_all(bifp);
1070 
1071 	if (bifp->if_flags & IFF_RUNNING)
1072 		bstp_initialization(sc);
1073 
1074 	/*
1075 	 * Free the bif_info after bstp_initialization(), so that
1076 	 * bridge_softc.sc_root_port will not reference a dangling
1077 	 * pointer.
1078 	 */
1079 	kfree(bif_info, M_DEVBUF);
1080 }
1081 
1082 /*
1083  * bridge_delete_span:
1084  *
1085  *	Delete the specified span interface.
1086  */
1087 static void
1088 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
1089 {
1090 	KASSERT(bif->bif_ifp->if_bridge == NULL,
1091 	    ("%s: not a span interface", __func__));
1092 
1093 	TAILQ_REMOVE(&sc->sc_iflists[mycpuid], bif, bif_next);
1094 	kfree(bif, M_DEVBUF);
1095 }
1096 
1097 static int
1098 bridge_ioctl_init(struct bridge_softc *sc, void *arg __unused)
1099 {
1100 	struct ifnet *ifp = sc->sc_ifp;
1101 
1102 	if (ifp->if_flags & IFF_RUNNING)
1103 		return 0;
1104 
1105 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1106 	    bridge_timer, sc);
1107 
1108 	ifp->if_flags |= IFF_RUNNING;
1109 	bstp_initialization(sc);
1110 	return 0;
1111 }
1112 
1113 static int
1114 bridge_ioctl_stop(struct bridge_softc *sc, void *arg __unused)
1115 {
1116 	struct ifnet *ifp = sc->sc_ifp;
1117 	struct lwkt_msg *lmsg;
1118 
1119 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1120 		return 0;
1121 
1122 	callout_stop(&sc->sc_brcallout);
1123 
1124 	crit_enter();
1125 	lmsg = &sc->sc_brtimemsg.lmsg;
1126 	if ((lmsg->ms_flags & MSGF_DONE) == 0) {
1127 		/* Pending to be processed; drop it */
1128 		lwkt_dropmsg(lmsg);
1129 	}
1130 	crit_exit();
1131 
1132 	bstp_stop(sc);
1133 
1134 	ifp->if_flags &= ~IFF_RUNNING;
1135 
1136 	ifnet_deserialize_all(ifp);
1137 
1138 	/* Let everyone know that we are stopped */
1139 	netmsg_service_sync();
1140 
1141 	/*
1142 	 * Sync ifnetX msgports in the order we forward rtnode
1143 	 * installation message.  This is used to make sure that
1144 	 * all rtnode installation messages sent by bridge_rtupdate()
1145 	 * during above netmsg_service_sync() are flushed.
1146 	 */
1147 	bridge_rtmsg_sync(sc);
1148 	bridge_rtflush(sc, IFBF_FLUSHDYN | IFBF_FLUSHSYNC);
1149 
1150 	ifnet_serialize_all(ifp);
1151 	return 0;
1152 }
1153 
1154 static int
1155 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
1156 {
1157 	struct ifbreq *req = arg;
1158 	struct bridge_iflist *bif;
1159 	struct bridge_ifinfo *bif_info;
1160 	struct ifnet *ifs, *bifp;
1161 	int error = 0;
1162 
1163 	bifp = sc->sc_ifp;
1164 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
1165 
1166 	ifs = ifunit(req->ifbr_ifsname);
1167 	if (ifs == NULL)
1168 		return (ENOENT);
1169 
1170 	/* If it's in the span list, it can't be a member. */
1171 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1172 		if (ifs == bif->bif_ifp)
1173 			return (EBUSY);
1174 
1175 	/* Allow the first Ethernet member to define the MTU */
1176 	if (ifs->if_type != IFT_GIF) {
1177 		if (TAILQ_EMPTY(&sc->sc_iflists[mycpuid])) {
1178 			bifp->if_mtu = ifs->if_mtu;
1179 		} else if (bifp->if_mtu != ifs->if_mtu) {
1180 			if_printf(bifp, "invalid MTU for %s\n", ifs->if_xname);
1181 			return (EINVAL);
1182 		}
1183 	}
1184 
1185 	if (ifs->if_bridge == sc)
1186 		return (EEXIST);
1187 
1188 	if (ifs->if_bridge != NULL)
1189 		return (EBUSY);
1190 
1191 	bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);
1192 	bif_info->bifi_priority = BSTP_DEFAULT_PORT_PRIORITY;
1193 	bif_info->bifi_path_cost = BSTP_DEFAULT_PATH_COST;
1194 	bif_info->bifi_ifp = ifs;
1195 	bif_info->bifi_bond_weight = 1;
1196 
1197 	/*
1198 	 * Release bridge interface's serializer:
1199 	 * - To avoid possible dead lock.
1200 	 * - Various sync operation will block the current thread.
1201 	 */
1202 	ifnet_deserialize_all(bifp);
1203 
1204 	switch (ifs->if_type) {
1205 	case IFT_ETHER:
1206 	case IFT_L2VLAN:
1207 		/*
1208 		 * Place the interface into promiscuous mode.
1209 		 */
1210 		error = ifpromisc(ifs, 1);
1211 		if (error) {
1212 			ifnet_serialize_all(bifp);
1213 			goto out;
1214 		}
1215 		bridge_mutecaps(bif_info, ifs, 1);
1216 		break;
1217 
1218 	case IFT_GIF: /* :^) */
1219 		break;
1220 
1221 	default:
1222 		error = EINVAL;
1223 		ifnet_serialize_all(bifp);
1224 		goto out;
1225 	}
1226 
1227 	/*
1228 	 * Add bifs to percpu linked lists
1229 	 */
1230 	bridge_add_bif(sc, bif_info, ifs);
1231 
1232 	ifnet_serialize_all(bifp);
1233 
1234 	if (bifp->if_flags & IFF_RUNNING)
1235 		bstp_initialization(sc);
1236 	else
1237 		bstp_stop(sc);
1238 
1239 	/*
1240 	 * Everything has been setup, so let the member interface
1241 	 * deliver packets to this bridge on its input/output path.
1242 	 */
1243 	ifs->if_bridge = sc;
1244 out:
1245 	if (error) {
1246 		if (bif_info != NULL)
1247 			kfree(bif_info, M_DEVBUF);
1248 	}
1249 	return (error);
1250 }
1251 
1252 static int
1253 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
1254 {
1255 	struct ifbreq *req = arg;
1256 	struct bridge_iflist *bif;
1257 
1258 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1259 	if (bif == NULL)
1260 		return (ENOENT);
1261 
1262 	bridge_delete_member(sc, bif, 0);
1263 
1264 	return (0);
1265 }
1266 
1267 static int
1268 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1269 {
1270 	struct ifbreq *req = arg;
1271 	struct bridge_iflist *bif;
1272 
1273 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1274 	if (bif == NULL)
1275 		return (ENOENT);
1276 	bridge_ioctl_fillflags(sc, bif, req);
1277 	return (0);
1278 }
1279 
1280 static void
1281 bridge_ioctl_fillflags(struct bridge_softc *sc, struct bridge_iflist *bif,
1282 		       struct ifbreq *req)
1283 {
1284 	req->ifbr_ifsflags = bif->bif_flags;
1285 	req->ifbr_state = bif->bif_state;
1286 	req->ifbr_priority = bif->bif_priority;
1287 	req->ifbr_path_cost = bif->bif_path_cost;
1288 	req->ifbr_bond_weight = bif->bif_bond_weight;
1289 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
1290 	if (bif->bif_flags & IFBIF_STP) {
1291 		req->ifbr_peer_root = bif->bif_peer_root;
1292 		req->ifbr_peer_bridge = bif->bif_peer_bridge;
1293 		req->ifbr_peer_cost = bif->bif_peer_cost;
1294 		req->ifbr_peer_port = bif->bif_peer_port;
1295 		if (bstp_supersedes_port_info(sc, bif)) {
1296 			req->ifbr_designated_root = bif->bif_peer_root;
1297 			req->ifbr_designated_bridge = bif->bif_peer_bridge;
1298 			req->ifbr_designated_cost = bif->bif_peer_cost;
1299 			req->ifbr_designated_port = bif->bif_peer_port;
1300 		} else {
1301 			req->ifbr_designated_root = sc->sc_bridge_id;
1302 			req->ifbr_designated_bridge = sc->sc_bridge_id;
1303 			req->ifbr_designated_cost = bif->bif_path_cost +
1304 						    bif->bif_peer_cost;
1305 			req->ifbr_designated_port = bif->bif_port_id;
1306 		}
1307 	} else {
1308 		req->ifbr_peer_root = 0;
1309 		req->ifbr_peer_bridge = 0;
1310 		req->ifbr_peer_cost = 0;
1311 		req->ifbr_peer_port = 0;
1312 		req->ifbr_designated_root = 0;
1313 		req->ifbr_designated_bridge = 0;
1314 		req->ifbr_designated_cost = 0;
1315 		req->ifbr_designated_port = 0;
1316 	}
1317 }
1318 
1319 static int
1320 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1321 {
1322 	struct ifbreq *req = arg;
1323 	struct bridge_iflist *bif;
1324 	struct ifnet *bifp = sc->sc_ifp;
1325 
1326 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1327 	if (bif == NULL)
1328 		return (ENOENT);
1329 
1330 	if (req->ifbr_ifsflags & IFBIF_SPAN) {
1331 		/* SPAN is readonly */
1332 		return (EINVAL);
1333 	}
1334 
1335 	if (req->ifbr_ifsflags & IFBIF_STP) {
1336 		switch (bif->bif_ifp->if_type) {
1337 		case IFT_ETHER:
1338 			/* These can do spanning tree. */
1339 			break;
1340 
1341 		default:
1342 			/* Nothing else can. */
1343 			return (EINVAL);
1344 		}
1345 	}
1346 
1347 	bif->bif_flags = (bif->bif_flags & IFBIF_KEEPMASK) |
1348 			 (req->ifbr_ifsflags & ~IFBIF_KEEPMASK);
1349 	if (bifp->if_flags & IFF_RUNNING)
1350 		bstp_initialization(sc);
1351 
1352 	return (0);
1353 }
1354 
1355 static int
1356 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1357 {
1358 	struct ifbrparam *param = arg;
1359 	struct ifnet *ifp = sc->sc_ifp;
1360 
1361 	sc->sc_brtmax = param->ifbrp_csize;
1362 
1363 	ifnet_deserialize_all(ifp);
1364 	bridge_rttrim(sc);
1365 	ifnet_serialize_all(ifp);
1366 
1367 	return (0);
1368 }
1369 
1370 static int
1371 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1372 {
1373 	struct ifbrparam *param = arg;
1374 
1375 	param->ifbrp_csize = sc->sc_brtmax;
1376 
1377 	return (0);
1378 }
1379 
1380 static int
1381 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1382 {
1383 	struct bridge_control_arg *bc_arg = arg;
1384 	struct ifbifconf *bifc = arg;
1385 	struct bridge_iflist *bif;
1386 	struct ifbreq *breq;
1387 	int count, len;
1388 
1389 	count = 0;
1390 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next)
1391 		count++;
1392 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1393 		count++;
1394 
1395 	if (bifc->ifbic_len == 0) {
1396 		bifc->ifbic_len = sizeof(*breq) * count;
1397 		return 0;
1398 	} else if (count == 0 || bifc->ifbic_len < sizeof(*breq)) {
1399 		bifc->ifbic_len = 0;
1400 		return 0;
1401 	}
1402 
1403 	len = min(bifc->ifbic_len, sizeof(*breq) * count);
1404 	KKASSERT(len >= sizeof(*breq));
1405 
1406 	breq = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
1407 	if (breq == NULL) {
1408 		bifc->ifbic_len = 0;
1409 		return ENOMEM;
1410 	}
1411 	bc_arg->bca_kptr = breq;
1412 
1413 	count = 0;
1414 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
1415 		if (len < sizeof(*breq))
1416 			break;
1417 
1418 		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
1419 			sizeof(breq->ifbr_ifsname));
1420 		bridge_ioctl_fillflags(sc, bif, breq);
1421 		breq++;
1422 		count++;
1423 		len -= sizeof(*breq);
1424 	}
1425 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1426 		if (len < sizeof(*breq))
1427 			break;
1428 
1429 		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
1430 			sizeof(breq->ifbr_ifsname));
1431 		breq->ifbr_ifsflags = bif->bif_flags;
1432 		breq->ifbr_portno = bif->bif_ifp->if_index & 0xff;
1433 		breq++;
1434 		count++;
1435 		len -= sizeof(*breq);
1436 	}
1437 
1438 	bifc->ifbic_len = sizeof(*breq) * count;
1439 	KKASSERT(bifc->ifbic_len > 0);
1440 
1441 	bc_arg->bca_len = bifc->ifbic_len;
1442 	bc_arg->bca_uptr = bifc->ifbic_req;
1443 	return 0;
1444 }
1445 
1446 static int
1447 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1448 {
1449 	struct bridge_control_arg *bc_arg = arg;
1450 	struct ifbaconf *bac = arg;
1451 	struct bridge_rtnode *brt;
1452 	struct ifbareq *bareq;
1453 	int count, len;
1454 
1455 	count = 0;
1456 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list)
1457 		count++;
1458 
1459 	if (bac->ifbac_len == 0) {
1460 		bac->ifbac_len = sizeof(*bareq) * count;
1461 		return 0;
1462 	} else if (count == 0 || bac->ifbac_len < sizeof(*bareq)) {
1463 		bac->ifbac_len = 0;
1464 		return 0;
1465 	}
1466 
1467 	len = min(bac->ifbac_len, sizeof(*bareq) * count);
1468 	KKASSERT(len >= sizeof(*bareq));
1469 
1470 	bareq = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
1471 	if (bareq == NULL) {
1472 		bac->ifbac_len = 0;
1473 		return ENOMEM;
1474 	}
1475 	bc_arg->bca_kptr = bareq;
1476 
1477 	count = 0;
1478 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
1479 		struct bridge_rtinfo *bri = brt->brt_info;
1480 		unsigned long expire;
1481 
1482 		if (len < sizeof(*bareq))
1483 			break;
1484 
1485 		strlcpy(bareq->ifba_ifsname, bri->bri_ifp->if_xname,
1486 			sizeof(bareq->ifba_ifsname));
1487 		memcpy(bareq->ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1488 		expire = bri->bri_expire;
1489 		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1490 		    time_second < expire)
1491 			bareq->ifba_expire = expire - time_second;
1492 		else
1493 			bareq->ifba_expire = 0;
1494 		bareq->ifba_flags = bri->bri_flags;
1495 		bareq++;
1496 		count++;
1497 		len -= sizeof(*bareq);
1498 	}
1499 
1500 	bac->ifbac_len = sizeof(*bareq) * count;
1501 	KKASSERT(bac->ifbac_len > 0);
1502 
1503 	bc_arg->bca_len = bac->ifbac_len;
1504 	bc_arg->bca_uptr = bac->ifbac_req;
1505 	return 0;
1506 }
1507 
1508 static int
1509 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1510 {
1511 	struct ifbareq *req = arg;
1512 	struct bridge_iflist *bif;
1513 	struct ifnet *ifp = sc->sc_ifp;
1514 	int error;
1515 
1516 	ASSERT_IFNET_SERIALIZED_ALL(ifp);
1517 
1518 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
1519 	if (bif == NULL)
1520 		return (ENOENT);
1521 
1522 	ifnet_deserialize_all(ifp);
1523 	error = bridge_rtsaddr(sc, req->ifba_dst, bif->bif_ifp,
1524 			       req->ifba_flags);
1525 	ifnet_serialize_all(ifp);
1526 	return (error);
1527 }
1528 
1529 static int
1530 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1531 {
1532 	struct ifbrparam *param = arg;
1533 
1534 	sc->sc_brttimeout = param->ifbrp_ctime;
1535 
1536 	return (0);
1537 }
1538 
1539 static int
1540 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1541 {
1542 	struct ifbrparam *param = arg;
1543 
1544 	param->ifbrp_ctime = sc->sc_brttimeout;
1545 
1546 	return (0);
1547 }
1548 
1549 static int
1550 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1551 {
1552 	struct ifbareq *req = arg;
1553 	struct ifnet *ifp = sc->sc_ifp;
1554 	int error;
1555 
1556 	ifnet_deserialize_all(ifp);
1557 	error = bridge_rtdaddr(sc, req->ifba_dst);
1558 	ifnet_serialize_all(ifp);
1559 	return error;
1560 }
1561 
1562 static int
1563 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1564 {
1565 	struct ifbreq *req = arg;
1566 	struct ifnet *ifp = sc->sc_ifp;
1567 
1568 	ifnet_deserialize_all(ifp);
1569 	bridge_rtflush(sc, req->ifbr_ifsflags | IFBF_FLUSHSYNC);
1570 	ifnet_serialize_all(ifp);
1571 
1572 	return (0);
1573 }
1574 
1575 static int
1576 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1577 {
1578 	struct ifbrparam *param = arg;
1579 
1580 	param->ifbrp_prio = sc->sc_bridge_priority;
1581 
1582 	return (0);
1583 }
1584 
1585 static int
1586 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1587 {
1588 	struct ifbrparam *param = arg;
1589 
1590 	sc->sc_bridge_priority = param->ifbrp_prio;
1591 
1592 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1593 		bstp_initialization(sc);
1594 
1595 	return (0);
1596 }
1597 
1598 static int
1599 bridge_ioctl_reinit(struct bridge_softc *sc, void *arg __unused)
1600 {
1601 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1602 		bstp_initialization(sc);
1603 	return (0);
1604 }
1605 
1606 static int
1607 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1608 {
1609 	struct ifbrparam *param = arg;
1610 
1611 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1612 
1613 	return (0);
1614 }
1615 
1616 static int
1617 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1618 {
1619 	struct ifbrparam *param = arg;
1620 
1621 	if (param->ifbrp_hellotime == 0)
1622 		return (EINVAL);
1623 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1624 
1625 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1626 		bstp_initialization(sc);
1627 
1628 	return (0);
1629 }
1630 
1631 static int
1632 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1633 {
1634 	struct ifbrparam *param = arg;
1635 
1636 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1637 
1638 	return (0);
1639 }
1640 
1641 static int
1642 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1643 {
1644 	struct ifbrparam *param = arg;
1645 
1646 	if (param->ifbrp_fwddelay == 0)
1647 		return (EINVAL);
1648 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1649 
1650 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1651 		bstp_initialization(sc);
1652 
1653 	return (0);
1654 }
1655 
1656 static int
1657 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1658 {
1659 	struct ifbrparam *param = arg;
1660 
1661 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1662 
1663 	return (0);
1664 }
1665 
1666 static int
1667 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1668 {
1669 	struct ifbrparam *param = arg;
1670 
1671 	if (param->ifbrp_maxage == 0)
1672 		return (EINVAL);
1673 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1674 
1675 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1676 		bstp_initialization(sc);
1677 
1678 	return (0);
1679 }
1680 
1681 static int
1682 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1683 {
1684 	struct ifbreq *req = arg;
1685 	struct bridge_iflist *bif;
1686 
1687 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1688 	if (bif == NULL)
1689 		return (ENOENT);
1690 
1691 	bif->bif_priority = req->ifbr_priority;
1692 
1693 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1694 		bstp_initialization(sc);
1695 
1696 	return (0);
1697 }
1698 
1699 static int
1700 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1701 {
1702 	struct ifbreq *req = arg;
1703 	struct bridge_iflist *bif;
1704 
1705 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1706 	if (bif == NULL)
1707 		return (ENOENT);
1708 
1709 	bif->bif_path_cost = req->ifbr_path_cost;
1710 
1711 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1712 		bstp_initialization(sc);
1713 
1714 	return (0);
1715 }
1716 
1717 static int
1718 bridge_ioctl_sifbondwght(struct bridge_softc *sc, void *arg)
1719 {
1720 	struct ifbreq *req = arg;
1721 	struct bridge_iflist *bif;
1722 
1723 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1724 	if (bif == NULL)
1725 		return (ENOENT);
1726 
1727 	bif->bif_bond_weight = req->ifbr_bond_weight;
1728 
1729 	/* no reinit needed */
1730 
1731 	return (0);
1732 }
1733 
1734 static int
1735 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1736 {
1737 	struct ifbreq *req = arg;
1738 	struct bridge_iflist *bif;
1739 	struct ifnet *ifs;
1740 	struct bridge_ifinfo *bif_info;
1741 
1742 	ifs = ifunit(req->ifbr_ifsname);
1743 	if (ifs == NULL)
1744 		return (ENOENT);
1745 
1746 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1747 		if (ifs == bif->bif_ifp)
1748 			return (EBUSY);
1749 
1750 	if (ifs->if_bridge != NULL)
1751 		return (EBUSY);
1752 
1753 	switch (ifs->if_type) {
1754 	case IFT_ETHER:
1755 	case IFT_GIF:
1756 	case IFT_L2VLAN:
1757 		break;
1758 
1759 	default:
1760 		return (EINVAL);
1761 	}
1762 
1763 	/*
1764 	 * bif_info is needed for bif_flags
1765 	 */
1766         bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);
1767         bif_info->bifi_ifp = ifs;
1768 
1769 	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK | M_ZERO);
1770 	bif->bif_ifp = ifs;
1771 	bif->bif_info = bif_info;
1772 	bif->bif_flags = IFBIF_SPAN;
1773 	/* NOTE: span bif does not need bridge_ifinfo */
1774 
1775 	TAILQ_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1776 
1777 	sc->sc_span = 1;
1778 
1779 	return (0);
1780 }
1781 
1782 static int
1783 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1784 {
1785 	struct ifbreq *req = arg;
1786 	struct bridge_iflist *bif;
1787 	struct ifnet *ifs;
1788 
1789 	ifs = ifunit(req->ifbr_ifsname);
1790 	if (ifs == NULL)
1791 		return (ENOENT);
1792 
1793 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1794 		if (ifs == bif->bif_ifp)
1795 			break;
1796 
1797 	if (bif == NULL)
1798 		return (ENOENT);
1799 
1800 	bridge_delete_span(sc, bif);
1801 
1802 	if (TAILQ_EMPTY(&sc->sc_spanlist))
1803 		sc->sc_span = 0;
1804 
1805 	return (0);
1806 }
1807 
1808 static void
1809 bridge_ifdetach_dispatch(netmsg_t msg)
1810 {
1811 	struct ifnet *ifp, *bifp;
1812 	struct bridge_softc *sc;
1813 	struct bridge_iflist *bif;
1814 
1815 	ifp = msg->lmsg.u.ms_resultp;
1816 	sc = ifp->if_bridge;
1817 
1818 	/* Check if the interface is a bridge member */
1819 	if (sc != NULL) {
1820 		bifp = sc->sc_ifp;
1821 
1822 		ifnet_serialize_all(bifp);
1823 
1824 		bif = bridge_lookup_member_if(sc, ifp);
1825 		if (bif != NULL) {
1826 			bridge_delete_member(sc, bif, 1);
1827 		} else {
1828 			/* XXX Why bif will be NULL? */
1829 		}
1830 
1831 		ifnet_deserialize_all(bifp);
1832 		goto reply;
1833 	}
1834 
1835 	crit_enter();	/* XXX MP */
1836 
1837 	/* Check if the interface is a span port */
1838 	LIST_FOREACH(sc, &bridge_list, sc_list) {
1839 		bifp = sc->sc_ifp;
1840 
1841 		ifnet_serialize_all(bifp);
1842 
1843 		TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
1844 			if (ifp == bif->bif_ifp) {
1845 				bridge_delete_span(sc, bif);
1846 				break;
1847 			}
1848 
1849 		ifnet_deserialize_all(bifp);
1850 	}
1851 
1852 	crit_exit();
1853 
1854 reply:
1855 	lwkt_replymsg(&msg->lmsg, 0);
1856 }
1857 
1858 /*
1859  * bridge_ifdetach:
1860  *
1861  *	Detach an interface from a bridge.  Called when a member
1862  *	interface is detaching.
1863  */
1864 static void
1865 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1866 {
1867 	struct netmsg_base msg;
1868 
1869 	netmsg_init(&msg, NULL, &curthread->td_msgport,
1870 		    0, bridge_ifdetach_dispatch);
1871 	msg.lmsg.u.ms_resultp = ifp;
1872 
1873 	lwkt_domsg(BRIDGE_CFGPORT, &msg.lmsg, 0);
1874 }
1875 
1876 /*
1877  * bridge_init:
1878  *
1879  *	Initialize a bridge interface.
1880  */
1881 static void
1882 bridge_init(void *xsc)
1883 {
1884 	bridge_control(xsc, SIOCSIFFLAGS, bridge_ioctl_init, NULL);
1885 }
1886 
1887 /*
1888  * bridge_stop:
1889  *
1890  *	Stop the bridge interface.
1891  */
1892 static void
1893 bridge_stop(struct ifnet *ifp)
1894 {
1895 	bridge_control(ifp->if_softc, SIOCSIFFLAGS, bridge_ioctl_stop, NULL);
1896 }
1897 
1898 /*
1899  * Returns TRUE if the packet is being sent 'from us'... from our bridge
1900  * interface or from any member of our bridge interface.  This is used
1901  * later on to force the MAC to be the MAC of our bridge interface.
1902  */
1903 static int
1904 bridge_from_us(struct bridge_softc *sc, struct ether_header *eh)
1905 {
1906 	struct bridge_iflist *bif;
1907 
1908 	if (memcmp(eh->ether_shost, IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN) == 0)
1909 		return (1);
1910 
1911 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
1912 		if (memcmp(eh->ether_shost, IF_LLADDR(bif->bif_ifp),
1913 			   ETHER_ADDR_LEN) == 0) {
1914 			return (1);
1915 		}
1916 	}
1917 	return (0);
1918 }
1919 
1920 /*
1921  * bridge_enqueue:
1922  *
1923  *	Enqueue a packet on a bridge member interface.
1924  *
1925  */
1926 void
1927 bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
1928 {
1929 	struct netmsg_packet *nmp;
1930 
1931 	mbuftrackid(m, 64);
1932 
1933 	nmp = &m->m_hdr.mh_netmsg;
1934 	netmsg_init(&nmp->base, NULL, &netisr_apanic_rport,
1935 		    0, bridge_enqueue_handler);
1936 	nmp->nm_packet = m;
1937 	nmp->base.lmsg.u.ms_resultp = dst_ifp;
1938 
1939 	lwkt_sendmsg(netisr_portfn(mycpu->gd_cpuid), &nmp->base.lmsg);
1940 }
1941 
1942 /*
1943  * After looking up dst_if in our forwarding table we still have to
1944  * deal with channel bonding.  Find the best interface in the bonding set.
1945  */
1946 static struct ifnet *
1947 bridge_select_unicast(struct bridge_softc *sc, struct ifnet *dst_if,
1948 		      int from_blocking, struct mbuf *m)
1949 {
1950 	struct bridge_iflist *bif, *nbif;
1951 	struct ifnet *alt_if;
1952 	int alt_priority;
1953 	int priority;
1954 
1955 	/*
1956 	 * Unicast, kinda replicates the output side of bridge_output().
1957 	 *
1958 	 * Even though this is a uni-cast packet we may have to select
1959 	 * an interface from a bonding set.
1960 	 */
1961 	bif = bridge_lookup_member_if(sc, dst_if);
1962 	if (bif == NULL) {
1963 		/* Not a member of the bridge (anymore?) */
1964 		return NULL;
1965 	}
1966 
1967 	/*
1968 	 * If STP is enabled on the target we are an equal opportunity
1969 	 * employer and do not necessarily output to dst_if.  Instead
1970 	 * scan available links with the same MAC as the current dst_if
1971 	 * and choose the best one.
1972 	 *
1973 	 * We also need to do this because arp entries tag onto a particular
1974 	 * interface and if it happens to be dead then the packets will
1975 	 * go into a bit bucket.
1976 	 *
1977 	 * If LINK2 is set the matching links are bonded and we-round robin.
1978 	 * (the MAC address must be the same for the participating links).
1979 	 * In this case links in a STP FORWARDING or BONDED state are
1980 	 * allowed for unicast packets.
1981 	 */
1982 	if (bif->bif_flags & IFBIF_STP) {
1983 		alt_if = NULL;
1984 		alt_priority = 0;
1985 		priority = 0;
1986 
1987 		TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid],
1988 				     bif_next, nbif) {
1989 			/*
1990 			 * dst_if may imply a bonding set so we must compare
1991 			 * MAC addresses.
1992 			 */
1993 			if (memcmp(IF_LLADDR(bif->bif_ifp),
1994 				   IF_LLADDR(dst_if),
1995 				   ETHER_ADDR_LEN) != 0) {
1996 				continue;
1997 			}
1998 
1999 			if ((bif->bif_ifp->if_flags & IFF_RUNNING) == 0)
2000 				continue;
2001 
2002 			/*
2003 			 * NOTE: We allow tranmissions through a BLOCKING
2004 			 *	 or LEARNING interface only as a last resort.
2005 			 *	 We DISALLOW both cases if the receiving
2006 			 *
2007 			 * NOTE: If we send a packet through a learning
2008 			 *	 interface the receiving end (if also in
2009 			 *	 LEARNING) will throw it away, so this is
2010 			 *	 the ultimate last resort.
2011 			 */
2012 			switch(bif->bif_state) {
2013 			case BSTP_IFSTATE_BLOCKING:
2014 				if (from_blocking == 0 &&
2015 				    bif->bif_priority + 256 > alt_priority) {
2016 					alt_priority = bif->bif_priority + 256;
2017 					alt_if = bif->bif_ifp;
2018 				}
2019 				continue;
2020 			case BSTP_IFSTATE_LEARNING:
2021 				if (from_blocking == 0 &&
2022 				    bif->bif_priority > alt_priority) {
2023 					alt_priority = bif->bif_priority;
2024 					alt_if = bif->bif_ifp;
2025 				}
2026 				continue;
2027 			case BSTP_IFSTATE_L1BLOCKING:
2028 			case BSTP_IFSTATE_LISTENING:
2029 			case BSTP_IFSTATE_DISABLED:
2030 				continue;
2031 			default:
2032 				/* FORWARDING, BONDED */
2033 				break;
2034 			}
2035 
2036 			/*
2037 			 * XXX we need to use the toepliz hash or
2038 			 *     something like that instead of
2039 			 *     round-robining.
2040 			 */
2041 			if (sc->sc_ifp->if_flags & IFF_LINK2) {
2042 				dst_if = bif->bif_ifp;
2043 				if (++bif->bif_bond_count >=
2044 				    bif->bif_bond_weight) {
2045 					bif->bif_bond_count = 0;
2046 					TAILQ_REMOVE(&sc->sc_iflists[mycpuid],
2047 						     bif, bif_next);
2048 					TAILQ_INSERT_TAIL(
2049 						     &sc->sc_iflists[mycpuid],
2050 						     bif, bif_next);
2051 				}
2052 				priority = 1;
2053 				break;
2054 			}
2055 
2056 			/*
2057 			 * Select best interface in the FORWARDING or
2058 			 * BONDED set.  Well, there shouldn't be any
2059 			 * in a BONDED state if LINK2 is not set (they
2060 			 * will all be in a BLOCKING) state, but there
2061 			 * could be a transitory condition here.
2062 			 */
2063 			if (bif->bif_priority > priority) {
2064 				priority = bif->bif_priority;
2065 				dst_if = bif->bif_ifp;
2066 			}
2067 		}
2068 
2069 		/*
2070 		 * If no suitable interfaces were found but a suitable
2071 		 * alternative interface was found, use the alternative
2072 		 * interface.
2073 		 */
2074 		if (priority == 0 && alt_if)
2075 			dst_if = alt_if;
2076 	}
2077 
2078 	/*
2079 	 * At this point, we're dealing with a unicast frame
2080 	 * going to a different interface.
2081 	 */
2082 	if ((dst_if->if_flags & IFF_RUNNING) == 0)
2083 		dst_if = NULL;
2084 	return (dst_if);
2085 }
2086 
2087 
2088 /*
2089  * bridge_output:
2090  *
2091  *	Send output from a bridge member interface.  This
2092  *	performs the bridging function for locally originated
2093  *	packets.
2094  *
2095  *	The mbuf has the Ethernet header already attached.  We must
2096  *	enqueue or free the mbuf before returning.
2097  */
2098 static int
2099 bridge_output(struct ifnet *ifp, struct mbuf *m)
2100 {
2101 	struct bridge_softc *sc = ifp->if_bridge;
2102 	struct bridge_iflist *bif, *nbif;
2103 	struct ether_header *eh;
2104 	struct ifnet *dst_if, *alt_if, *bifp;
2105 	int from_us;
2106 	int alt_priority;
2107 
2108 	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
2109 	mbuftrackid(m, 65);
2110 
2111 	/*
2112 	 * Make sure that we are still a member of a bridge interface.
2113 	 */
2114 	if (sc == NULL) {
2115 		m_freem(m);
2116 		return (0);
2117 	}
2118 	bifp = sc->sc_ifp;
2119 
2120 	/*
2121 	 * Acquire header
2122 	 */
2123 	if (m->m_len < ETHER_HDR_LEN) {
2124 		m = m_pullup(m, ETHER_HDR_LEN);
2125 		if (m == NULL) {
2126 			bifp->if_oerrors++;
2127 			return (0);
2128 		}
2129 	}
2130 	eh = mtod(m, struct ether_header *);
2131 	from_us = bridge_from_us(sc, eh);
2132 
2133 	/*
2134 	 * If bridge is down, but the original output interface is up,
2135 	 * go ahead and send out that interface.  Otherwise, the packet
2136 	 * is dropped below.
2137 	 */
2138 	if ((bifp->if_flags & IFF_RUNNING) == 0) {
2139 		dst_if = ifp;
2140 		goto sendunicast;
2141 	}
2142 
2143 	/*
2144 	 * If the packet is a multicast, or we don't know a better way to
2145 	 * get there, send to all interfaces.
2146 	 */
2147 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
2148 		dst_if = NULL;
2149 	else
2150 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
2151 
2152 	if (dst_if == NULL) {
2153 		struct mbuf *mc;
2154 		int used = 0;
2155 		int found = 0;
2156 
2157 		if (sc->sc_span)
2158 			bridge_span(sc, m);
2159 
2160 		alt_if = NULL;
2161 		alt_priority = 0;
2162 		TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid],
2163 				     bif_next, nbif) {
2164 			dst_if = bif->bif_ifp;
2165 
2166 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
2167 				continue;
2168 
2169 			/*
2170 			 * If this is not the original output interface,
2171 			 * and the interface is participating in spanning
2172 			 * tree, make sure the port is in a state that
2173 			 * allows forwarding.
2174 			 *
2175 			 * We keep track of a possible backup IF if we are
2176 			 * unable to find any interfaces to forward through.
2177 			 *
2178 			 * NOTE: Currently round-robining is not implemented
2179 			 *	 across bonded interface groups (needs an
2180 			 *	 algorithm to track each group somehow).
2181 			 *
2182 			 *	 Similarly we track only one alternative
2183 			 *	 interface if no suitable interfaces are
2184 			 *	 found.
2185 			 */
2186 			if (dst_if != ifp &&
2187 			    (bif->bif_flags & IFBIF_STP) != 0) {
2188 				switch (bif->bif_state) {
2189 				case BSTP_IFSTATE_BONDED:
2190 					if (bif->bif_priority + 512 >
2191 					    alt_priority) {
2192 						alt_priority =
2193 						    bif->bif_priority + 512;
2194 						alt_if = bif->bif_ifp;
2195 					}
2196 					continue;
2197 				case BSTP_IFSTATE_BLOCKING:
2198 					if (bif->bif_priority + 256 >
2199 					    alt_priority) {
2200 						alt_priority =
2201 						    bif->bif_priority + 256;
2202 						alt_if = bif->bif_ifp;
2203 					}
2204 					continue;
2205 				case BSTP_IFSTATE_LEARNING:
2206 					if (bif->bif_priority > alt_priority) {
2207 						alt_priority =
2208 						    bif->bif_priority;
2209 						alt_if = bif->bif_ifp;
2210 					}
2211 					continue;
2212 				case BSTP_IFSTATE_L1BLOCKING:
2213 				case BSTP_IFSTATE_LISTENING:
2214 				case BSTP_IFSTATE_DISABLED:
2215 					continue;
2216 				default:
2217 					/* FORWARDING */
2218 					break;
2219 				}
2220 			}
2221 
2222 			KKASSERT(used == 0);
2223 			if (TAILQ_NEXT(bif, bif_next) == NULL) {
2224 				used = 1;
2225 				mc = m;
2226 			} else {
2227 				mc = m_copypacket(m, MB_DONTWAIT);
2228 				if (mc == NULL) {
2229 					bifp->if_oerrors++;
2230 					continue;
2231 				}
2232 			}
2233 
2234 			/*
2235 			 * If the packet is 'from' us override ether_shost.
2236 			 */
2237 			bridge_handoff(sc, dst_if, mc, from_us);
2238 			found = 1;
2239 
2240 			if (nbif != NULL && !nbif->bif_onlist) {
2241 				KKASSERT(bif->bif_onlist);
2242 				nbif = TAILQ_NEXT(bif, bif_next);
2243 			}
2244 		}
2245 
2246 		/*
2247 		 * If we couldn't find anything use the backup interface
2248 		 * if we have one.
2249 		 */
2250 		if (found == 0 && alt_if) {
2251 			KKASSERT(used == 0);
2252 			mc = m;
2253 			used = 1;
2254 			bridge_handoff(sc, alt_if, mc, from_us);
2255 		}
2256 
2257 		if (used == 0)
2258 			m_freem(m);
2259 		return (0);
2260 	}
2261 
2262 	/*
2263 	 * Unicast
2264 	 */
2265 sendunicast:
2266 	dst_if = bridge_select_unicast(sc, dst_if, 0, m);
2267 
2268 	if (sc->sc_span)
2269 		bridge_span(sc, m);
2270 	if (dst_if == NULL)
2271 		m_freem(m);
2272 	else
2273 		bridge_handoff(sc, dst_if, m, from_us);
2274 	return (0);
2275 }
2276 
2277 /*
2278  * Returns the bridge interface associated with an ifc.
2279  * Pass ifp->if_bridge (must not be NULL).  Used by the ARP
2280  * code to supply the bridge for the is-at info, making
2281  * the bridge responsible for matching local addresses.
2282  *
2283  * Without this the ARP code will supply bridge member interfaces
2284  * for the is-at which makes it difficult the bridge to fail-over
2285  * interfaces (amoung other things).
2286  */
2287 static struct ifnet *
2288 bridge_interface(void *if_bridge)
2289 {
2290 	struct bridge_softc *sc = if_bridge;
2291 	return (sc->sc_ifp);
2292 }
2293 
2294 /*
2295  * bridge_start:
2296  *
2297  *	Start output on a bridge.
2298  */
2299 static void
2300 bridge_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
2301 {
2302 	struct bridge_softc *sc = ifp->if_softc;
2303 
2304 	ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
2305 	ASSERT_IFNET_SERIALIZED_TX(ifp, ifsq);
2306 
2307 	ifsq_set_oactive(ifsq);
2308 	for (;;) {
2309 		struct ifnet *dst_if = NULL;
2310 		struct ether_header *eh;
2311 		struct mbuf *m;
2312 
2313 		m = ifsq_dequeue(ifsq, NULL);
2314 		if (m == NULL)
2315 			break;
2316 		mbuftrackid(m, 75);
2317 
2318 		if (m->m_len < sizeof(*eh)) {
2319 			m = m_pullup(m, sizeof(*eh));
2320 			if (m == NULL) {
2321 				ifp->if_oerrors++;
2322 				continue;
2323 			}
2324 		}
2325 		eh = mtod(m, struct ether_header *);
2326 
2327 		BPF_MTAP(ifp, m);
2328 		ifp->if_opackets++;
2329 
2330 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
2331 			dst_if = bridge_rtlookup(sc, eh->ether_dhost);
2332 
2333 		/*
2334 		 * Multicast or broadcast
2335 		 */
2336 		if (dst_if == NULL) {
2337 			bridge_start_bcast(sc, m);
2338 			continue;
2339 		}
2340 
2341 		/*
2342 		 * Unicast
2343 		 */
2344 		dst_if = bridge_select_unicast(sc, dst_if, 0, m);
2345 
2346 		if (dst_if == NULL)
2347 			m_freem(m);
2348 		else
2349 			bridge_enqueue(dst_if, m);
2350 	}
2351 	ifsq_clr_oactive(ifsq);
2352 }
2353 
2354 /*
2355  * bridge_forward:
2356  *
2357  *	Forward packets received on a bridge interface via the input
2358  *	path.
2359  *
2360  *	This implements the forwarding function of the bridge.
2361  */
2362 static void
2363 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
2364 {
2365 	struct bridge_iflist *bif;
2366 	struct ifnet *src_if, *dst_if, *ifp;
2367 	struct ether_header *eh;
2368 	int from_blocking;
2369 
2370 	mbuftrackid(m, 66);
2371 	src_if = m->m_pkthdr.rcvif;
2372 	ifp = sc->sc_ifp;
2373 
2374 	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
2375 
2376 	ifp->if_ipackets++;
2377 	ifp->if_ibytes += m->m_pkthdr.len;
2378 
2379 	/*
2380 	 * Look up the bridge_iflist.
2381 	 */
2382 	bif = bridge_lookup_member_if(sc, src_if);
2383 	if (bif == NULL) {
2384 		/* Interface is not a bridge member (anymore?) */
2385 		m_freem(m);
2386 		return;
2387 	}
2388 
2389 	/*
2390 	 * In spanning tree mode receiving a packet from an interface
2391 	 * in a BLOCKING state is allowed, it could be a member of last
2392 	 * resort from the sender's point of view, but forwarding it is
2393 	 * not allowed.
2394 	 *
2395 	 * The sender's spanning tree will eventually sync up and the
2396 	 * sender will go into a BLOCKING state too (but this still may be
2397 	 * an interface of last resort during state changes).
2398 	 */
2399 	if (bif->bif_flags & IFBIF_STP) {
2400 		switch (bif->bif_state) {
2401 		case BSTP_IFSTATE_L1BLOCKING:
2402 		case BSTP_IFSTATE_LISTENING:
2403 		case BSTP_IFSTATE_DISABLED:
2404 			m_freem(m);
2405 			return;
2406 		default:
2407 			/* learning, blocking, bonded, forwarding */
2408 			break;
2409 		}
2410 	}
2411 	from_blocking = (bif->bif_state == BSTP_IFSTATE_BLOCKING);
2412 
2413 	eh = mtod(m, struct ether_header *);
2414 
2415 	/*
2416 	 * If the interface is learning, and the source
2417 	 * address is valid and not multicast, record
2418 	 * the address.
2419 	 */
2420 	if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
2421 	    from_blocking == 0 &&
2422 	    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
2423 	    (eh->ether_shost[0] == 0 &&
2424 	     eh->ether_shost[1] == 0 &&
2425 	     eh->ether_shost[2] == 0 &&
2426 	     eh->ether_shost[3] == 0 &&
2427 	     eh->ether_shost[4] == 0 &&
2428 	     eh->ether_shost[5] == 0) == 0) {
2429 		bridge_rtupdate(sc, eh->ether_shost, src_if, IFBAF_DYNAMIC);
2430 	}
2431 
2432 	/*
2433 	 * Don't forward from an interface in the listening or learning
2434 	 * state.  That is, in the learning state we learn information
2435 	 * but we throw away the packets.
2436 	 *
2437 	 * We let through packets on interfaces in the blocking state.
2438 	 * The blocking state is applicable to the send side, not the
2439 	 * receive side.
2440 	 */
2441 	if ((bif->bif_flags & IFBIF_STP) != 0 &&
2442 	    (bif->bif_state == BSTP_IFSTATE_LISTENING ||
2443 	     bif->bif_state == BSTP_IFSTATE_LEARNING)) {
2444 		m_freem(m);
2445 		return;
2446 	}
2447 
2448 	/*
2449 	 * At this point, the port either doesn't participate
2450 	 * in spanning tree or it is in the forwarding state.
2451 	 */
2452 
2453 	/*
2454 	 * If the packet is unicast, destined for someone on
2455 	 * "this" side of the bridge, drop it.
2456 	 *
2457 	 * src_if implies the entire bonding set so we have to compare MAC
2458 	 * addresses and not just if pointers.
2459 	 */
2460 	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
2461 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
2462 		if (dst_if && memcmp(IF_LLADDR(src_if), IF_LLADDR(dst_if),
2463 				     ETHER_ADDR_LEN) == 0) {
2464 			m_freem(m);
2465 			return;
2466 		}
2467 	} else {
2468 		/* ...forward it to all interfaces. */
2469 		ifp->if_imcasts++;
2470 		dst_if = NULL;
2471 	}
2472 
2473 	/*
2474 	 * Brodcast if we do not have forwarding information.  However, if
2475 	 * we received the packet on a blocking interface we do not do this
2476 	 * (unless you really want to blow up your network).
2477 	 */
2478 	if (dst_if == NULL) {
2479 		if (from_blocking)
2480 			m_freem(m);
2481 		else
2482 			bridge_broadcast(sc, src_if, m);
2483 		return;
2484 	}
2485 
2486 	dst_if = bridge_select_unicast(sc, dst_if, from_blocking, m);
2487 
2488 	if (dst_if == NULL) {
2489 		m_freem(m);
2490 		return;
2491 	}
2492 
2493 	if (inet_pfil_hook.ph_hashooks > 0
2494 #ifdef INET6
2495 	    || inet6_pfil_hook.ph_hashooks > 0
2496 #endif
2497 	    ) {
2498 		if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
2499 			return;
2500 		if (m == NULL)
2501 			return;
2502 
2503 		if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
2504 			return;
2505 		if (m == NULL)
2506 			return;
2507 	}
2508 	bridge_handoff(sc, dst_if, m, 0);
2509 }
2510 
2511 /*
2512  * bridge_input:
2513  *
2514  *	Receive input from a member interface.  Queue the packet for
2515  *	bridging if it is not for us.
2516  */
2517 static struct mbuf *
2518 bridge_input(struct ifnet *ifp, struct mbuf *m)
2519 {
2520 	struct bridge_softc *sc = ifp->if_bridge;
2521 	struct bridge_iflist *bif;
2522 	struct ifnet *bifp, *new_ifp;
2523 	struct ether_header *eh;
2524 	struct mbuf *mc, *mc2;
2525 
2526 	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
2527 	mbuftrackid(m, 67);
2528 
2529 	/*
2530 	 * Make sure that we are still a member of a bridge interface.
2531 	 */
2532 	if (sc == NULL)
2533 		return m;
2534 
2535 	new_ifp = NULL;
2536 	bifp = sc->sc_ifp;
2537 
2538 	if ((bifp->if_flags & IFF_RUNNING) == 0)
2539 		goto out;
2540 
2541 	/*
2542 	 * Implement support for bridge monitoring.  If this flag has been
2543 	 * set on this interface, discard the packet once we push it through
2544 	 * the bpf(4) machinery, but before we do, increment various counters
2545 	 * associated with this bridge.
2546 	 */
2547 	if (bifp->if_flags & IFF_MONITOR) {
2548 	 	/* Change input interface to this bridge */
2549 		m->m_pkthdr.rcvif = bifp;
2550 
2551 		BPF_MTAP(bifp, m);
2552 
2553 		/* Update bridge's ifnet statistics */
2554 		bifp->if_ipackets++;
2555 		bifp->if_ibytes += m->m_pkthdr.len;
2556 		if (m->m_flags & (M_MCAST | M_BCAST))
2557 			bifp->if_imcasts++;
2558 
2559 		m_freem(m);
2560 		m = NULL;
2561 		goto out;
2562 	}
2563 
2564 	/*
2565 	 * Handle the ether_header
2566 	 *
2567 	 * In all cases if the packet is destined for us via our MAC
2568 	 * we must clear BRIDGE_MBUF_TAGGED to ensure that we don't
2569 	 * repeat the source MAC out the same interface.
2570 	 *
2571 	 * This first test against our bridge MAC is the fast-path.
2572 	 *
2573 	 * NOTE!  The bridge interface can serve as an endpoint for
2574 	 *	  communication but normally there are no IPs associated
2575 	 *	  with it so you cannot route through it.  Instead what
2576 	 *	  you do is point your default route *THROUGH* the bridge
2577 	 *	  to the actual default router for one of the bridged spaces.
2578 	 *
2579 	 *	  Another possibility is to put all your IP specifications
2580 	 *	  on the bridge instead of on the individual interfaces.  If
2581 	 *	  you do this it should be possible to use the bridge as an
2582 	 *	  end point and route (rather than switch) through it using
2583 	 *	  the default route or ipfw forwarding rules.
2584 	 */
2585 
2586 	/*
2587 	 * Acquire header
2588 	 */
2589 	if (m->m_len < ETHER_HDR_LEN) {
2590 		m = m_pullup(m, ETHER_HDR_LEN);
2591 		if (m == NULL)
2592 			goto out;
2593 	}
2594 	eh = mtod(m, struct ether_header *);
2595 	m->m_pkthdr.fw_flags |= BRIDGE_MBUF_TAGGED;
2596 	bcopy(eh, &m->m_pkthdr.br.ether, sizeof(*eh));
2597 
2598 	if ((bridge_debug & 1) &&
2599 	    (ntohs(eh->ether_type) == ETHERTYPE_ARP ||
2600 	    ntohs(eh->ether_type) == ETHERTYPE_REVARP)) {
2601 		kprintf("%02x:%02x:%02x:%02x:%02x:%02x "
2602 			"%02x:%02x:%02x:%02x:%02x:%02x type %04x "
2603 			"lla %02x:%02x:%02x:%02x:%02x:%02x\n",
2604 			eh->ether_dhost[0],
2605 			eh->ether_dhost[1],
2606 			eh->ether_dhost[2],
2607 			eh->ether_dhost[3],
2608 			eh->ether_dhost[4],
2609 			eh->ether_dhost[5],
2610 			eh->ether_shost[0],
2611 			eh->ether_shost[1],
2612 			eh->ether_shost[2],
2613 			eh->ether_shost[3],
2614 			eh->ether_shost[4],
2615 			eh->ether_shost[5],
2616 			eh->ether_type,
2617 			((u_char *)IF_LLADDR(bifp))[0],
2618 			((u_char *)IF_LLADDR(bifp))[1],
2619 			((u_char *)IF_LLADDR(bifp))[2],
2620 			((u_char *)IF_LLADDR(bifp))[3],
2621 			((u_char *)IF_LLADDR(bifp))[4],
2622 			((u_char *)IF_LLADDR(bifp))[5]
2623 		);
2624 	}
2625 
2626 	if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
2627 		/*
2628 		 * If the packet is for us, set the packets source as the
2629 		 * bridge, and return the packet back to ifnet.if_input for
2630 		 * local processing.
2631 		 */
2632 		m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
2633 		KASSERT(bifp->if_bridge == NULL,
2634 			("loop created in bridge_input"));
2635 		if (pfil_member != 0) {
2636 			if (inet_pfil_hook.ph_hashooks > 0
2637 #ifdef INET6
2638 			    || inet6_pfil_hook.ph_hashooks > 0
2639 #endif
2640 			) {
2641 				if (bridge_pfil(&m, NULL, ifp, PFIL_IN) != 0)
2642 					goto out;
2643 				if (m == NULL)
2644 					goto out;
2645 			}
2646 		}
2647 		new_ifp = bifp;
2648 		goto out;
2649 	}
2650 
2651 	/*
2652 	 * Tap all packets arriving on the bridge, no matter if
2653 	 * they are local destinations or not.  In is in.
2654 	 */
2655 	BPF_MTAP(bifp, m);
2656 
2657 	bif = bridge_lookup_member_if(sc, ifp);
2658 	if (bif == NULL)
2659 		goto out;
2660 
2661 	if (sc->sc_span)
2662 		bridge_span(sc, m);
2663 
2664 	if (m->m_flags & (M_BCAST | M_MCAST)) {
2665 		/*
2666 		 * Tap off 802.1D packets; they do not get forwarded.
2667 		 */
2668 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
2669 			    ETHER_ADDR_LEN) == 0) {
2670 			ifnet_serialize_all(bifp);
2671 			bstp_input(sc, bif, m);
2672 			ifnet_deserialize_all(bifp);
2673 
2674 			/* m is freed by bstp_input */
2675 			m = NULL;
2676 			goto out;
2677 		}
2678 
2679 		/*
2680 		 * Other than 802.11d packets, ignore packets if the
2681 		 * interface is not in a good state.
2682 		 *
2683 		 * NOTE: Broadcast/mcast packets received on a blocking or
2684 		 *	 learning interface are allowed for local processing.
2685 		 *
2686 		 *	 The sending side of a blocked port will stop
2687 		 *	 transmitting when a better alternative is found.
2688 		 *	 However, later on we will disallow the forwarding
2689 		 *	 of bcast/mcsat packets over a blocking interface.
2690 		 */
2691 		if (bif->bif_flags & IFBIF_STP) {
2692 			switch (bif->bif_state) {
2693 			case BSTP_IFSTATE_L1BLOCKING:
2694 			case BSTP_IFSTATE_LISTENING:
2695 			case BSTP_IFSTATE_DISABLED:
2696 				goto out;
2697 			default:
2698 				/* blocking, learning, bonded, forwarding */
2699 				break;
2700 			}
2701 		}
2702 
2703 		/*
2704 		 * Make a deep copy of the packet and enqueue the copy
2705 		 * for bridge processing; return the original packet for
2706 		 * local processing.
2707 		 */
2708 		mc = m_dup(m, MB_DONTWAIT);
2709 		if (mc == NULL)
2710 			goto out;
2711 
2712 		/*
2713 		 * It's just too dangerous to allow bcast/mcast over a
2714 		 * blocked interface, eventually the network will sort
2715 		 * itself out and a better path will be found.
2716 		 */
2717 		if ((bif->bif_flags & IFBIF_STP) == 0 ||
2718 		    bif->bif_state != BSTP_IFSTATE_BLOCKING) {
2719 			bridge_forward(sc, mc);
2720 		}
2721 
2722 		/*
2723 		 * Reinject the mbuf as arriving on the bridge so we have a
2724 		 * chance at claiming multicast packets. We can not loop back
2725 		 * here from ether_input as a bridge is never a member of a
2726 		 * bridge.
2727 		 */
2728 		KASSERT(bifp->if_bridge == NULL,
2729 			("loop created in bridge_input"));
2730 		mc2 = m_dup(m, MB_DONTWAIT);
2731 #ifdef notyet
2732 		if (mc2 != NULL) {
2733 			/* Keep the layer3 header aligned */
2734 			int i = min(mc2->m_pkthdr.len, max_protohdr);
2735 			mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2736 		}
2737 #endif
2738 		if (mc2 != NULL) {
2739 			/*
2740 			 * Don't tap to bpf(4) again; we have already done
2741 			 * the tapping.
2742 			 *
2743 			 * Leave m_pkthdr.rcvif alone, so ARP replies are
2744 			 * processed as coming in on the correct interface.
2745 			 *
2746 			 * Clear the bridge flag for local processing in
2747 			 * case the packet gets routed.
2748 			 */
2749 			mc2->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
2750 			ether_reinput_oncpu(bifp, mc2, 0);
2751 		}
2752 
2753 		/* Return the original packet for local processing. */
2754 		goto out;
2755 	}
2756 
2757 	/*
2758 	 * Input of a unicast packet.  We have to allow unicast packets
2759 	 * input from links in the BLOCKING state as this might be an
2760 	 * interface of last resort.
2761 	 *
2762 	 * NOTE: We explicitly ignore normal packets received on a link
2763 	 *	 in the BLOCKING state.  The point of being in that state
2764 	 *	 is to avoid getting duplicate packets.
2765 	 *
2766 	 *	 HOWEVER, if LINK2 is set the normal spanning tree code
2767 	 *	 will mark an interface BLOCKING to avoid multi-cast/broadcast
2768 	 *	 loops.  Unicast packets CAN still loop if we allow the
2769 	 *	 case (hence we only do it in LINK2), but it isn't quite as
2770 	 *	 bad as a broadcast packet looping.
2771 	 */
2772 	if (bif->bif_flags & IFBIF_STP) {
2773 		switch (bif->bif_state) {
2774 		case BSTP_IFSTATE_L1BLOCKING:
2775 		case BSTP_IFSTATE_LISTENING:
2776 		case BSTP_IFSTATE_DISABLED:
2777 			goto out;
2778 		default:
2779 			/* blocking, bonded, forwarding, learning */
2780 			break;
2781 		}
2782 	}
2783 
2784 	/*
2785 	 * Unicast.  Make sure it's not for us.
2786 	 *
2787 	 * This loop is MPSAFE; the only blocking operation (bridge_rtupdate)
2788 	 * is followed by breaking out of the loop.
2789 	 */
2790 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
2791 		if (bif->bif_ifp->if_type != IFT_ETHER)
2792 			continue;
2793 
2794 		/*
2795 		 * It is destined for an interface linked to the bridge.
2796 		 * We want the bridge itself to take care of link level
2797 		 * forwarding to member interfaces so reinput on the bridge.
2798 		 * i.e. if you ping an IP on a target interface associated
2799 		 * with the bridge, the arp is-at response should indicate
2800 		 * the bridge MAC.
2801 		 *
2802 		 * Only update our addr list when learning if the port
2803 		 * is not in a blocking state.  If it is we still allow
2804 		 * the packet but we do not try to learn from it.
2805 		 */
2806 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
2807 			   ETHER_ADDR_LEN) == 0) {
2808 			if (bif->bif_ifp != ifp) {
2809 				/* XXX loop prevention */
2810 				m->m_flags |= M_ETHER_BRIDGED;
2811 			}
2812 			if ((bif->bif_flags & IFBIF_LEARNING) &&
2813 			    bif->bif_state != BSTP_IFSTATE_BLOCKING) {
2814 				bridge_rtupdate(sc, eh->ether_shost,
2815 						ifp, IFBAF_DYNAMIC);
2816 			}
2817 			new_ifp = bifp; /* not bif->bif_ifp */
2818 			m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
2819 			goto out;
2820 		}
2821 
2822 		/*
2823 		 * Ignore received packets that were sent by us.
2824 		 */
2825 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
2826 			   ETHER_ADDR_LEN) == 0) {
2827 			m_freem(m);
2828 			m = NULL;
2829 			goto out;
2830 		}
2831 	}
2832 
2833 	/*
2834 	 * It isn't for us.
2835 	 *
2836 	 * Perform the bridge forwarding function, but disallow bridging
2837 	 * to interfaces in the blocking state if the packet came in on
2838 	 * an interface in the blocking state.
2839 	 */
2840 	bridge_forward(sc, m);
2841 	m = NULL;
2842 
2843 	/*
2844 	 * ether_reinput_oncpu() will reprocess rcvif as
2845 	 * coming from new_ifp (since we do not specify
2846 	 * REINPUT_KEEPRCVIF).
2847 	 */
2848 out:
2849 	if (new_ifp != NULL) {
2850 		/*
2851 		 * Clear the bridge flag for local processing in
2852 		 * case the packet gets routed.
2853 		 */
2854 		ether_reinput_oncpu(new_ifp, m, REINPUT_RUNBPF);
2855 		m = NULL;
2856 	}
2857 	return (m);
2858 }
2859 
2860 /*
2861  * bridge_start_bcast:
2862  *
2863  *	Broadcast the packet sent from bridge to all member
2864  *	interfaces.
2865  *	This is a simplified version of bridge_broadcast(), however,
2866  *	this function expects caller to hold bridge's serializer.
2867  */
2868 static void
2869 bridge_start_bcast(struct bridge_softc *sc, struct mbuf *m)
2870 {
2871 	struct bridge_iflist *bif;
2872 	struct mbuf *mc;
2873 	struct ifnet *dst_if, *alt_if, *bifp;
2874 	int used = 0;
2875 	int found = 0;
2876 	int alt_priority;
2877 
2878 	mbuftrackid(m, 68);
2879 	bifp = sc->sc_ifp;
2880 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
2881 
2882 	/*
2883 	 * Following loop is MPSAFE; nothing is blocking
2884 	 * in the loop body.
2885 	 *
2886 	 * NOTE: We transmit through an member in the BLOCKING state only
2887 	 *	 as a last resort.
2888 	 */
2889 	alt_if = NULL;
2890 	alt_priority = 0;
2891 
2892 	TAILQ_FOREACH(bif, &sc->sc_iflists[mycpuid], bif_next) {
2893 		dst_if = bif->bif_ifp;
2894 
2895 		if (bif->bif_flags & IFBIF_STP) {
2896 			switch (bif->bif_state) {
2897 			case BSTP_IFSTATE_BLOCKING:
2898 				if (bif->bif_priority > alt_priority) {
2899 					alt_priority = bif->bif_priority;
2900 					alt_if = bif->bif_ifp;
2901 				}
2902 				/* fall through */
2903 			case BSTP_IFSTATE_L1BLOCKING:
2904 			case BSTP_IFSTATE_DISABLED:
2905 				continue;
2906 			default:
2907 				/* listening, learning, bonded, forwarding */
2908 				break;
2909 			}
2910 		}
2911 
2912 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2913 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2914 			continue;
2915 
2916 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
2917 			continue;
2918 
2919 		if (TAILQ_NEXT(bif, bif_next) == NULL) {
2920 			mc = m;
2921 			used = 1;
2922 		} else {
2923 			mc = m_copypacket(m, MB_DONTWAIT);
2924 			if (mc == NULL) {
2925 				bifp->if_oerrors++;
2926 				continue;
2927 			}
2928 		}
2929 		found = 1;
2930 		bridge_enqueue(dst_if, mc);
2931 	}
2932 
2933 	if (found == 0 && alt_if) {
2934 		KKASSERT(used == 0);
2935 		mc = m;
2936 		used = 1;
2937 		bridge_enqueue(alt_if, mc);
2938 	}
2939 
2940 	if (used == 0)
2941 		m_freem(m);
2942 }
2943 
2944 /*
2945  * bridge_broadcast:
2946  *
2947  *	Send a frame to all interfaces that are members of
2948  *	the bridge, except for the one on which the packet
2949  *	arrived.
2950  */
2951 static void
2952 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2953 		 struct mbuf *m)
2954 {
2955 	struct bridge_iflist *bif, *nbif;
2956 	struct ether_header *eh;
2957 	struct mbuf *mc;
2958 	struct ifnet *dst_if, *alt_if, *bifp;
2959 	int used;
2960 	int found;
2961 	int alt_priority;
2962 	int from_us;
2963 
2964 	mbuftrackid(m, 69);
2965 	bifp = sc->sc_ifp;
2966 	ASSERT_IFNET_NOT_SERIALIZED_ALL(bifp);
2967 
2968 	eh = mtod(m, struct ether_header *);
2969 	from_us = bridge_from_us(sc, eh);
2970 
2971 	if (inet_pfil_hook.ph_hashooks > 0
2972 #ifdef INET6
2973 	    || inet6_pfil_hook.ph_hashooks > 0
2974 #endif
2975 	    ) {
2976 		if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
2977 			return;
2978 		if (m == NULL)
2979 			return;
2980 
2981 		/* Filter on the bridge interface before broadcasting */
2982 		if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
2983 			return;
2984 		if (m == NULL)
2985 			return;
2986 	}
2987 
2988 	alt_if = NULL;
2989 	alt_priority = 0;
2990 	found = 0;
2991 	used = 0;
2992 
2993 	TAILQ_FOREACH_MUTABLE(bif, &sc->sc_iflists[mycpuid], bif_next, nbif) {
2994 		dst_if = bif->bif_ifp;
2995 
2996 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
2997 			continue;
2998 
2999 		/*
3000 		 * Don't bounce the packet out the same interface it came
3001 		 * in on.  We have to test MAC addresses because a packet
3002 		 * can come in a bonded interface and we don't want it to
3003 		 * be echod out the forwarding interface for the same bonding
3004 		 * set.
3005 		 */
3006 		if (src_if && memcmp(IF_LLADDR(src_if), IF_LLADDR(dst_if),
3007 				     ETHER_ADDR_LEN) == 0) {
3008 			continue;
3009 		}
3010 
3011 		/*
3012 		 * Generally speaking we only broadcast through forwarding
3013 		 * interfaces.  If no interfaces are available we select
3014 		 * a BONDED, BLOCKING, or LEARNING interface to forward
3015 		 * through.
3016 		 */
3017 		if (bif->bif_flags & IFBIF_STP) {
3018 			switch (bif->bif_state) {
3019 			case BSTP_IFSTATE_BONDED:
3020 				if (bif->bif_priority + 512 > alt_priority) {
3021 					alt_priority = bif->bif_priority + 512;
3022 					alt_if = bif->bif_ifp;
3023 				}
3024 				continue;
3025 			case BSTP_IFSTATE_BLOCKING:
3026 				if (bif->bif_priority + 256 > alt_priority) {
3027 					alt_priority = bif->bif_priority + 256;
3028 					alt_if = bif->bif_ifp;
3029 				}
3030 				continue;
3031 			case BSTP_IFSTATE_LEARNING:
3032 				if (bif->bif_priority > alt_priority) {
3033 					alt_priority = bif->bif_priority;
3034 					alt_if = bif->bif_ifp;
3035 				}
3036 				continue;
3037 			case BSTP_IFSTATE_L1BLOCKING:
3038 			case BSTP_IFSTATE_DISABLED:
3039 			case BSTP_IFSTATE_LISTENING:
3040 				continue;
3041 			default:
3042 				/* forwarding */
3043 				break;
3044 			}
3045 		}
3046 
3047 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
3048 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0) {
3049 			continue;
3050 		}
3051 
3052 		if (TAILQ_NEXT(bif, bif_next) == NULL) {
3053 			mc = m;
3054 			used = 1;
3055 		} else {
3056 			mc = m_copypacket(m, MB_DONTWAIT);
3057 			if (mc == NULL) {
3058 				sc->sc_ifp->if_oerrors++;
3059 				continue;
3060 			}
3061 		}
3062 		found = 1;
3063 
3064 		/*
3065 		 * Filter on the output interface.  Pass a NULL bridge
3066 		 * interface pointer so we do not redundantly filter on
3067 		 * the bridge for each interface we broadcast on.
3068 		 */
3069 		if (inet_pfil_hook.ph_hashooks > 0
3070 #ifdef INET6
3071 		    || inet6_pfil_hook.ph_hashooks > 0
3072 #endif
3073 		    ) {
3074 			if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
3075 				continue;
3076 			if (mc == NULL)
3077 				continue;
3078 		}
3079 		bridge_handoff(sc, dst_if, mc, from_us);
3080 
3081 		if (nbif != NULL && !nbif->bif_onlist) {
3082 			KKASSERT(bif->bif_onlist);
3083 			nbif = TAILQ_NEXT(bif, bif_next);
3084 		}
3085 	}
3086 
3087 	if (found == 0 && alt_if) {
3088 		KKASSERT(used == 0);
3089 		mc = m;
3090 		used = 1;
3091 		bridge_enqueue(alt_if, mc);
3092 	}
3093 
3094 	if (used == 0)
3095 		m_freem(m);
3096 }
3097 
3098 /*
3099  * bridge_span:
3100  *
3101  *	Duplicate a packet out one or more interfaces that are in span mode,
3102  *	the original mbuf is unmodified.
3103  */
3104 static void
3105 bridge_span(struct bridge_softc *sc, struct mbuf *m)
3106 {
3107 	struct bridge_iflist *bif;
3108 	struct ifnet *dst_if, *bifp;
3109 	struct mbuf *mc;
3110 
3111 	mbuftrackid(m, 70);
3112 	bifp = sc->sc_ifp;
3113 	ifnet_serialize_all(bifp);
3114 
3115 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
3116 		dst_if = bif->bif_ifp;
3117 
3118 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
3119 			continue;
3120 
3121 		mc = m_copypacket(m, MB_DONTWAIT);
3122 		if (mc == NULL) {
3123 			sc->sc_ifp->if_oerrors++;
3124 			continue;
3125 		}
3126 		bridge_enqueue(dst_if, mc);
3127 	}
3128 
3129 	ifnet_deserialize_all(bifp);
3130 }
3131 
3132 static void
3133 bridge_rtmsg_sync_handler(netmsg_t msg)
3134 {
3135 	ifnet_forwardmsg(&msg->lmsg, mycpuid + 1);
3136 }
3137 
3138 static void
3139 bridge_rtmsg_sync(struct bridge_softc *sc)
3140 {
3141 	struct netmsg_base msg;
3142 
3143 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3144 
3145 	netmsg_init(&msg, NULL, &curthread->td_msgport,
3146 		    0, bridge_rtmsg_sync_handler);
3147 	ifnet_domsg(&msg.lmsg, 0);
3148 }
3149 
3150 static __inline void
3151 bridge_rtinfo_update(struct bridge_rtinfo *bri, struct ifnet *dst_if,
3152 		     int setflags, uint8_t flags, uint32_t timeo)
3153 {
3154 	if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
3155 	    bri->bri_ifp != dst_if)
3156 		bri->bri_ifp = dst_if;
3157 	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
3158 	    bri->bri_expire != time_second + timeo)
3159 		bri->bri_expire = time_second + timeo;
3160 	if (setflags)
3161 		bri->bri_flags = flags;
3162 }
3163 
3164 static int
3165 bridge_rtinstall_oncpu(struct bridge_softc *sc, const uint8_t *dst,
3166 		       struct ifnet *dst_if, int setflags, uint8_t flags,
3167 		       struct bridge_rtinfo **bri0)
3168 {
3169 	struct bridge_rtnode *brt;
3170 	struct bridge_rtinfo *bri;
3171 
3172 	if (mycpuid == 0) {
3173 		brt = bridge_rtnode_lookup(sc, dst);
3174 		if (brt != NULL) {
3175 			/*
3176 			 * rtnode for 'dst' already exists.  We inform the
3177 			 * caller about this by leaving bri0 as NULL.  The
3178 			 * caller will terminate the intallation upon getting
3179 			 * NULL bri0.  However, we still need to update the
3180 			 * rtinfo.
3181 			 */
3182 			KKASSERT(*bri0 == NULL);
3183 
3184 			/* Update rtinfo */
3185 			bridge_rtinfo_update(brt->brt_info, dst_if, setflags,
3186 					     flags, sc->sc_brttimeout);
3187 			return 0;
3188 		}
3189 
3190 		/*
3191 		 * We only need to check brtcnt on CPU0, since if limit
3192 		 * is to be exceeded, ENOSPC is returned.  Caller knows
3193 		 * this and will terminate the installation.
3194 		 */
3195 		if (sc->sc_brtcnt >= sc->sc_brtmax)
3196 			return ENOSPC;
3197 
3198 		KKASSERT(*bri0 == NULL);
3199 		bri = kmalloc(sizeof(struct bridge_rtinfo), M_DEVBUF,
3200 				  M_WAITOK | M_ZERO);
3201 		*bri0 = bri;
3202 
3203 		/* Setup rtinfo */
3204 		bri->bri_flags = IFBAF_DYNAMIC;
3205 		bridge_rtinfo_update(bri, dst_if, setflags, flags,
3206 				     sc->sc_brttimeout);
3207 	} else {
3208 		bri = *bri0;
3209 		KKASSERT(bri != NULL);
3210 	}
3211 
3212 	brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
3213 		      M_WAITOK | M_ZERO);
3214 	memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
3215 	brt->brt_info = bri;
3216 
3217 	bridge_rtnode_insert(sc, brt);
3218 	return 0;
3219 }
3220 
3221 static void
3222 bridge_rtinstall_handler(netmsg_t msg)
3223 {
3224 	struct netmsg_brsaddr *brmsg = (struct netmsg_brsaddr *)msg;
3225 	int error;
3226 
3227 	error = bridge_rtinstall_oncpu(brmsg->br_softc,
3228 				       brmsg->br_dst, brmsg->br_dst_if,
3229 				       brmsg->br_setflags, brmsg->br_flags,
3230 				       &brmsg->br_rtinfo);
3231 	if (error) {
3232 		KKASSERT(mycpuid == 0 && brmsg->br_rtinfo == NULL);
3233 		lwkt_replymsg(&brmsg->base.lmsg, error);
3234 		return;
3235 	} else if (brmsg->br_rtinfo == NULL) {
3236 		/* rtnode already exists for 'dst' */
3237 		KKASSERT(mycpuid == 0);
3238 		lwkt_replymsg(&brmsg->base.lmsg, 0);
3239 		return;
3240 	}
3241 	ifnet_forwardmsg(&brmsg->base.lmsg, mycpuid + 1);
3242 }
3243 
3244 /*
3245  * bridge_rtupdate:
3246  *
3247  *	Add/Update a bridge routing entry.
3248  */
3249 static int
3250 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
3251 		struct ifnet *dst_if, uint8_t flags)
3252 {
3253 	struct bridge_rtnode *brt;
3254 
3255 	/*
3256 	 * A route for this destination might already exist.  If so,
3257 	 * update it, otherwise create a new one.
3258 	 */
3259 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
3260 		struct netmsg_brsaddr *brmsg;
3261 
3262 		if (sc->sc_brtcnt >= sc->sc_brtmax)
3263 			return ENOSPC;
3264 
3265 		brmsg = kmalloc(sizeof(*brmsg), M_LWKTMSG, M_WAITOK | M_NULLOK);
3266 		if (brmsg == NULL)
3267 			return ENOMEM;
3268 
3269 		netmsg_init(&brmsg->base, NULL, &netisr_afree_rport,
3270 			    0, bridge_rtinstall_handler);
3271 		memcpy(brmsg->br_dst, dst, ETHER_ADDR_LEN);
3272 		brmsg->br_dst_if = dst_if;
3273 		brmsg->br_flags = flags;
3274 		brmsg->br_setflags = 0;
3275 		brmsg->br_softc = sc;
3276 		brmsg->br_rtinfo = NULL;
3277 
3278 		ifnet_sendmsg(&brmsg->base.lmsg, 0);
3279 		return 0;
3280 	}
3281 	bridge_rtinfo_update(brt->brt_info, dst_if, 0, flags,
3282 			     sc->sc_brttimeout);
3283 	return 0;
3284 }
3285 
3286 static int
3287 bridge_rtsaddr(struct bridge_softc *sc, const uint8_t *dst,
3288 	       struct ifnet *dst_if, uint8_t flags)
3289 {
3290 	struct netmsg_brsaddr brmsg;
3291 
3292 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3293 
3294 	netmsg_init(&brmsg.base, NULL, &curthread->td_msgport,
3295 		    0, bridge_rtinstall_handler);
3296 	memcpy(brmsg.br_dst, dst, ETHER_ADDR_LEN);
3297 	brmsg.br_dst_if = dst_if;
3298 	brmsg.br_flags = flags;
3299 	brmsg.br_setflags = 1;
3300 	brmsg.br_softc = sc;
3301 	brmsg.br_rtinfo = NULL;
3302 
3303 	return ifnet_domsg(&brmsg.base.lmsg, 0);
3304 }
3305 
3306 /*
3307  * bridge_rtlookup:
3308  *
3309  *	Lookup the destination interface for an address.
3310  */
3311 static struct ifnet *
3312 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
3313 {
3314 	struct bridge_rtnode *brt;
3315 
3316 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
3317 		return NULL;
3318 	return brt->brt_info->bri_ifp;
3319 }
3320 
3321 static void
3322 bridge_rtreap_handler(netmsg_t msg)
3323 {
3324 	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
3325 	struct bridge_rtnode *brt, *nbrt;
3326 
3327 	LIST_FOREACH_MUTABLE(brt, &sc->sc_rtlists[mycpuid], brt_list, nbrt) {
3328 		if (brt->brt_info->bri_dead)
3329 			bridge_rtnode_destroy(sc, brt);
3330 	}
3331 	ifnet_forwardmsg(&msg->lmsg, mycpuid + 1);
3332 }
3333 
3334 static void
3335 bridge_rtreap(struct bridge_softc *sc)
3336 {
3337 	struct netmsg_base msg;
3338 
3339 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3340 
3341 	netmsg_init(&msg, NULL, &curthread->td_msgport,
3342 		    0, bridge_rtreap_handler);
3343 	msg.lmsg.u.ms_resultp = sc;
3344 
3345 	ifnet_domsg(&msg.lmsg, 0);
3346 }
3347 
3348 static void
3349 bridge_rtreap_async(struct bridge_softc *sc)
3350 {
3351 	struct netmsg_base *msg;
3352 
3353 	msg = kmalloc(sizeof(*msg), M_LWKTMSG, M_WAITOK);
3354 
3355 	netmsg_init(msg, NULL, &netisr_afree_rport,
3356 		    0, bridge_rtreap_handler);
3357 	msg->lmsg.u.ms_resultp = sc;
3358 
3359 	ifnet_sendmsg(&msg->lmsg, 0);
3360 }
3361 
3362 /*
3363  * bridge_rttrim:
3364  *
3365  *	Trim the routine table so that we have a number
3366  *	of routing entries less than or equal to the
3367  *	maximum number.
3368  */
3369 static void
3370 bridge_rttrim(struct bridge_softc *sc)
3371 {
3372 	struct bridge_rtnode *brt;
3373 	int dead;
3374 
3375 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3376 
3377 	/* Make sure we actually need to do this. */
3378 	if (sc->sc_brtcnt <= sc->sc_brtmax)
3379 		return;
3380 
3381 	/*
3382 	 * Find out how many rtnodes are dead
3383 	 */
3384 	dead = bridge_rtage_finddead(sc);
3385 	KKASSERT(dead <= sc->sc_brtcnt);
3386 
3387 	if (sc->sc_brtcnt - dead <= sc->sc_brtmax) {
3388 		/* Enough dead rtnodes are found */
3389 		bridge_rtreap(sc);
3390 		return;
3391 	}
3392 
3393 	/*
3394 	 * Kill some dynamic rtnodes to meet the brtmax
3395 	 */
3396 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3397 		struct bridge_rtinfo *bri = brt->brt_info;
3398 
3399 		if (bri->bri_dead) {
3400 			/*
3401 			 * We have counted this rtnode in
3402 			 * bridge_rtage_finddead()
3403 			 */
3404 			continue;
3405 		}
3406 
3407 		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
3408 			bri->bri_dead = 1;
3409 			++dead;
3410 			KKASSERT(dead <= sc->sc_brtcnt);
3411 
3412 			if (sc->sc_brtcnt - dead <= sc->sc_brtmax) {
3413 				/* Enough rtnodes are collected */
3414 				break;
3415 			}
3416 		}
3417 	}
3418 	if (dead)
3419 		bridge_rtreap(sc);
3420 }
3421 
3422 /*
3423  * bridge_timer:
3424  *
3425  *	Aging timer for the bridge.
3426  */
3427 static void
3428 bridge_timer(void *arg)
3429 {
3430 	struct bridge_softc *sc = arg;
3431 	struct netmsg_base *msg;
3432 
3433 	KKASSERT(mycpuid == BRIDGE_CFGCPU);
3434 
3435 	crit_enter();
3436 
3437 	if (callout_pending(&sc->sc_brcallout) ||
3438 	    !callout_active(&sc->sc_brcallout)) {
3439 		crit_exit();
3440 		return;
3441 	}
3442 	callout_deactivate(&sc->sc_brcallout);
3443 
3444 	msg = &sc->sc_brtimemsg;
3445 	KKASSERT(msg->lmsg.ms_flags & MSGF_DONE);
3446 	lwkt_sendmsg(BRIDGE_CFGPORT, &msg->lmsg);
3447 
3448 	crit_exit();
3449 }
3450 
3451 static void
3452 bridge_timer_handler(netmsg_t msg)
3453 {
3454 	struct bridge_softc *sc = msg->lmsg.u.ms_resultp;
3455 
3456 	KKASSERT(&curthread->td_msgport == BRIDGE_CFGPORT);
3457 
3458 	crit_enter();
3459 	/* Reply ASAP */
3460 	lwkt_replymsg(&msg->lmsg, 0);
3461 	crit_exit();
3462 
3463 	bridge_rtage(sc);
3464 	if (sc->sc_ifp->if_flags & IFF_RUNNING) {
3465 		callout_reset(&sc->sc_brcallout,
3466 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
3467 	}
3468 }
3469 
3470 static int
3471 bridge_rtage_finddead(struct bridge_softc *sc)
3472 {
3473 	struct bridge_rtnode *brt;
3474 	int dead = 0;
3475 
3476 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3477 		struct bridge_rtinfo *bri = brt->brt_info;
3478 
3479 		if ((bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
3480 		    time_second >= bri->bri_expire) {
3481 			bri->bri_dead = 1;
3482 			++dead;
3483 			KKASSERT(dead <= sc->sc_brtcnt);
3484 		}
3485 	}
3486 	return dead;
3487 }
3488 
3489 /*
3490  * bridge_rtage:
3491  *
3492  *	Perform an aging cycle.
3493  */
3494 static void
3495 bridge_rtage(struct bridge_softc *sc)
3496 {
3497 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3498 
3499 	if (bridge_rtage_finddead(sc))
3500 		bridge_rtreap(sc);
3501 }
3502 
3503 /*
3504  * bridge_rtflush:
3505  *
3506  *	Remove all dynamic addresses from the bridge.
3507  */
3508 static void
3509 bridge_rtflush(struct bridge_softc *sc, int bf)
3510 {
3511 	struct bridge_rtnode *brt;
3512 	int reap;
3513 
3514 	reap = 0;
3515 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3516 		struct bridge_rtinfo *bri = brt->brt_info;
3517 
3518 		if ((bf & IFBF_FLUSHALL) ||
3519 		    (bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
3520 			bri->bri_dead = 1;
3521 			reap = 1;
3522 		}
3523 	}
3524 	if (reap) {
3525 		if (bf & IFBF_FLUSHSYNC)
3526 			bridge_rtreap(sc);
3527 		else
3528 			bridge_rtreap_async(sc);
3529 	}
3530 }
3531 
3532 /*
3533  * bridge_rtdaddr:
3534  *
3535  *	Remove an address from the table.
3536  */
3537 static int
3538 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
3539 {
3540 	struct bridge_rtnode *brt;
3541 
3542 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
3543 
3544 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
3545 		return (ENOENT);
3546 
3547 	/* TODO: add a cheaper delete operation */
3548 	brt->brt_info->bri_dead = 1;
3549 	bridge_rtreap(sc);
3550 	return (0);
3551 }
3552 
3553 /*
3554  * bridge_rtdelete:
3555  *
3556  *	Delete routes to a speicifc member interface.
3557  */
3558 void
3559 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int bf)
3560 {
3561 	struct bridge_rtnode *brt;
3562 	int reap;
3563 
3564 	reap = 0;
3565 	LIST_FOREACH(brt, &sc->sc_rtlists[mycpuid], brt_list) {
3566 		struct bridge_rtinfo *bri = brt->brt_info;
3567 
3568 		if (bri->bri_ifp == ifp &&
3569 		    ((bf & IFBF_FLUSHALL) ||
3570 		     (bri->bri_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)) {
3571 			bri->bri_dead = 1;
3572 			reap = 1;
3573 		}
3574 	}
3575 	if (reap) {
3576 		if (bf & IFBF_FLUSHSYNC)
3577 			bridge_rtreap(sc);
3578 		else
3579 			bridge_rtreap_async(sc);
3580 	}
3581 }
3582 
3583 /*
3584  * bridge_rtable_init:
3585  *
3586  *	Initialize the route table for this bridge.
3587  */
3588 static void
3589 bridge_rtable_init(struct bridge_softc *sc)
3590 {
3591 	int cpu;
3592 
3593 	/*
3594 	 * Initialize per-cpu hash tables
3595 	 */
3596 	sc->sc_rthashs = kmalloc(sizeof(*sc->sc_rthashs) * ncpus,
3597 				 M_DEVBUF, M_WAITOK);
3598 	for (cpu = 0; cpu < ncpus; ++cpu) {
3599 		int i;
3600 
3601 		sc->sc_rthashs[cpu] =
3602 		kmalloc(sizeof(struct bridge_rtnode_head) * BRIDGE_RTHASH_SIZE,
3603 			M_DEVBUF, M_WAITOK);
3604 
3605 		for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
3606 			LIST_INIT(&sc->sc_rthashs[cpu][i]);
3607 	}
3608 	sc->sc_rthash_key = karc4random();
3609 
3610 	/*
3611 	 * Initialize per-cpu lists
3612 	 */
3613 	sc->sc_rtlists = kmalloc(sizeof(struct bridge_rtnode_head) * ncpus,
3614 				 M_DEVBUF, M_WAITOK);
3615 	for (cpu = 0; cpu < ncpus; ++cpu)
3616 		LIST_INIT(&sc->sc_rtlists[cpu]);
3617 }
3618 
3619 /*
3620  * bridge_rtable_fini:
3621  *
3622  *	Deconstruct the route table for this bridge.
3623  */
3624 static void
3625 bridge_rtable_fini(struct bridge_softc *sc)
3626 {
3627 	int cpu;
3628 
3629 	/*
3630 	 * Free per-cpu hash tables
3631 	 */
3632 	for (cpu = 0; cpu < ncpus; ++cpu)
3633 		kfree(sc->sc_rthashs[cpu], M_DEVBUF);
3634 	kfree(sc->sc_rthashs, M_DEVBUF);
3635 
3636 	/*
3637 	 * Free per-cpu lists
3638 	 */
3639 	kfree(sc->sc_rtlists, M_DEVBUF);
3640 }
3641 
3642 /*
3643  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
3644  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
3645  */
3646 #define	mix(a, b, c)							\
3647 do {									\
3648 	a -= b; a -= c; a ^= (c >> 13);					\
3649 	b -= c; b -= a; b ^= (a << 8);					\
3650 	c -= a; c -= b; c ^= (b >> 13);					\
3651 	a -= b; a -= c; a ^= (c >> 12);					\
3652 	b -= c; b -= a; b ^= (a << 16);					\
3653 	c -= a; c -= b; c ^= (b >> 5);					\
3654 	a -= b; a -= c; a ^= (c >> 3);					\
3655 	b -= c; b -= a; b ^= (a << 10);					\
3656 	c -= a; c -= b; c ^= (b >> 15);					\
3657 } while (/*CONSTCOND*/0)
3658 
3659 static __inline uint32_t
3660 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
3661 {
3662 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
3663 
3664 	b += addr[5] << 8;
3665 	b += addr[4];
3666 	a += addr[3] << 24;
3667 	a += addr[2] << 16;
3668 	a += addr[1] << 8;
3669 	a += addr[0];
3670 
3671 	mix(a, b, c);
3672 
3673 	return (c & BRIDGE_RTHASH_MASK);
3674 }
3675 
3676 #undef mix
3677 
3678 static int
3679 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
3680 {
3681 	int i, d;
3682 
3683 	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
3684 		d = ((int)a[i]) - ((int)b[i]);
3685 	}
3686 
3687 	return (d);
3688 }
3689 
3690 /*
3691  * bridge_rtnode_lookup:
3692  *
3693  *	Look up a bridge route node for the specified destination.
3694  */
3695 static struct bridge_rtnode *
3696 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
3697 {
3698 	struct bridge_rtnode *brt;
3699 	uint32_t hash;
3700 	int dir;
3701 
3702 	hash = bridge_rthash(sc, addr);
3703 	LIST_FOREACH(brt, &sc->sc_rthashs[mycpuid][hash], brt_hash) {
3704 		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
3705 		if (dir == 0)
3706 			return (brt);
3707 		if (dir > 0)
3708 			return (NULL);
3709 	}
3710 
3711 	return (NULL);
3712 }
3713 
3714 /*
3715  * bridge_rtnode_insert:
3716  *
3717  *	Insert the specified bridge node into the route table.
3718  *	Caller has to make sure that rtnode does not exist.
3719  */
3720 static void
3721 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
3722 {
3723 	struct bridge_rtnode *lbrt;
3724 	uint32_t hash;
3725 	int dir;
3726 
3727 	hash = bridge_rthash(sc, brt->brt_addr);
3728 
3729 	lbrt = LIST_FIRST(&sc->sc_rthashs[mycpuid][hash]);
3730 	if (lbrt == NULL) {
3731 		LIST_INSERT_HEAD(&sc->sc_rthashs[mycpuid][hash],
3732 				  brt, brt_hash);
3733 		goto out;
3734 	}
3735 
3736 	do {
3737 		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
3738 		KASSERT(dir != 0, ("rtnode already exist"));
3739 
3740 		if (dir > 0) {
3741 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
3742 			goto out;
3743 		}
3744 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
3745 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
3746 			goto out;
3747 		}
3748 		lbrt = LIST_NEXT(lbrt, brt_hash);
3749 	} while (lbrt != NULL);
3750 
3751 	panic("no suitable position found for rtnode");
3752 out:
3753 	LIST_INSERT_HEAD(&sc->sc_rtlists[mycpuid], brt, brt_list);
3754 	if (mycpuid == 0) {
3755 		/*
3756 		 * Update the brtcnt.
3757 		 * We only need to do it once and we do it on CPU0.
3758 		 */
3759 		sc->sc_brtcnt++;
3760 	}
3761 }
3762 
3763 /*
3764  * bridge_rtnode_destroy:
3765  *
3766  *	Destroy a bridge rtnode.
3767  */
3768 static void
3769 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
3770 {
3771 	LIST_REMOVE(brt, brt_hash);
3772 	LIST_REMOVE(brt, brt_list);
3773 
3774 	if (mycpuid + 1 == ncpus) {
3775 		/* Free rtinfo associated with rtnode on the last cpu */
3776 		kfree(brt->brt_info, M_DEVBUF);
3777 	}
3778 	kfree(brt, M_DEVBUF);
3779 
3780 	if (mycpuid == 0) {
3781 		/* Update brtcnt only on CPU0 */
3782 		sc->sc_brtcnt--;
3783 	}
3784 }
3785 
3786 static __inline int
3787 bridge_post_pfil(struct mbuf *m)
3788 {
3789 	if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED)
3790 		return EOPNOTSUPP;
3791 
3792 	/* Not yet */
3793 	if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED)
3794 		return EOPNOTSUPP;
3795 
3796 	return 0;
3797 }
3798 
3799 /*
3800  * Send bridge packets through pfil if they are one of the types pfil can deal
3801  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
3802  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
3803  * that interface.
3804  */
3805 static int
3806 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
3807 {
3808 	int snap, error, i, hlen;
3809 	struct ether_header *eh1, eh2;
3810 	struct ip *ip;
3811 	struct llc llc1;
3812 	u_int16_t ether_type;
3813 
3814 	snap = 0;
3815 	error = -1;	/* Default error if not error == 0 */
3816 
3817 	if (pfil_bridge == 0 && pfil_member == 0)
3818 		return (0); /* filtering is disabled */
3819 
3820 	i = min((*mp)->m_pkthdr.len, max_protohdr);
3821 	if ((*mp)->m_len < i) {
3822 		*mp = m_pullup(*mp, i);
3823 		if (*mp == NULL) {
3824 			kprintf("%s: m_pullup failed\n", __func__);
3825 			return (-1);
3826 		}
3827 	}
3828 
3829 	eh1 = mtod(*mp, struct ether_header *);
3830 	ether_type = ntohs(eh1->ether_type);
3831 
3832 	/*
3833 	 * Check for SNAP/LLC.
3834 	 */
3835 	if (ether_type < ETHERMTU) {
3836 		struct llc *llc2 = (struct llc *)(eh1 + 1);
3837 
3838 		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
3839 		    llc2->llc_dsap == LLC_SNAP_LSAP &&
3840 		    llc2->llc_ssap == LLC_SNAP_LSAP &&
3841 		    llc2->llc_control == LLC_UI) {
3842 			ether_type = htons(llc2->llc_un.type_snap.ether_type);
3843 			snap = 1;
3844 		}
3845 	}
3846 
3847 	/*
3848 	 * If we're trying to filter bridge traffic, don't look at anything
3849 	 * other than IP and ARP traffic.  If the filter doesn't understand
3850 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
3851 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
3852 	 * but of course we don't have an AppleTalk filter to begin with.
3853 	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
3854 	 * ARP traffic.)
3855 	 */
3856 	switch (ether_type) {
3857 	case ETHERTYPE_ARP:
3858 	case ETHERTYPE_REVARP:
3859 		return (0); /* Automatically pass */
3860 
3861 	case ETHERTYPE_IP:
3862 #ifdef INET6
3863 	case ETHERTYPE_IPV6:
3864 #endif /* INET6 */
3865 		break;
3866 
3867 	default:
3868 		/*
3869 		 * Check to see if the user wants to pass non-ip
3870 		 * packets, these will not be checked by pfil(9)
3871 		 * and passed unconditionally so the default is to drop.
3872 		 */
3873 		if (pfil_onlyip)
3874 			goto bad;
3875 	}
3876 
3877 	/* Strip off the Ethernet header and keep a copy. */
3878 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
3879 	m_adj(*mp, ETHER_HDR_LEN);
3880 
3881 	/* Strip off snap header, if present */
3882 	if (snap) {
3883 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
3884 		m_adj(*mp, sizeof(struct llc));
3885 	}
3886 
3887 	/*
3888 	 * Check the IP header for alignment and errors
3889 	 */
3890 	if (dir == PFIL_IN) {
3891 		switch (ether_type) {
3892 		case ETHERTYPE_IP:
3893 			error = bridge_ip_checkbasic(mp);
3894 			break;
3895 #ifdef INET6
3896 		case ETHERTYPE_IPV6:
3897 			error = bridge_ip6_checkbasic(mp);
3898 			break;
3899 #endif /* INET6 */
3900 		default:
3901 			error = 0;
3902 		}
3903 		if (error)
3904 			goto bad;
3905 	}
3906 
3907 	error = 0;
3908 
3909 	/*
3910 	 * Run the packet through pfil
3911 	 */
3912 	switch (ether_type) {
3913 	case ETHERTYPE_IP:
3914 		/*
3915 		 * before calling the firewall, swap fields the same as
3916 		 * IP does. here we assume the header is contiguous
3917 		 */
3918 		ip = mtod(*mp, struct ip *);
3919 
3920 		ip->ip_len = ntohs(ip->ip_len);
3921 		ip->ip_off = ntohs(ip->ip_off);
3922 
3923 		/*
3924 		 * Run pfil on the member interface and the bridge, both can
3925 		 * be skipped by clearing pfil_member or pfil_bridge.
3926 		 *
3927 		 * Keep the order:
3928 		 *   in_if -> bridge_if -> out_if
3929 		 */
3930 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL) {
3931 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
3932 			if (*mp == NULL || error != 0) /* filter may consume */
3933 				break;
3934 			error = bridge_post_pfil(*mp);
3935 			if (error)
3936 				break;
3937 		}
3938 
3939 		if (pfil_member && ifp != NULL) {
3940 			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp, dir);
3941 			if (*mp == NULL || error != 0) /* filter may consume */
3942 				break;
3943 			error = bridge_post_pfil(*mp);
3944 			if (error)
3945 				break;
3946 		}
3947 
3948 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL) {
3949 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
3950 			if (*mp == NULL || error != 0) /* filter may consume */
3951 				break;
3952 			error = bridge_post_pfil(*mp);
3953 			if (error)
3954 				break;
3955 		}
3956 
3957 		/* check if we need to fragment the packet */
3958 		if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
3959 			i = (*mp)->m_pkthdr.len;
3960 			if (i > ifp->if_mtu) {
3961 				error = bridge_fragment(ifp, *mp, &eh2, snap,
3962 					    &llc1);
3963 				return (error);
3964 			}
3965 		}
3966 
3967 		/* Recalculate the ip checksum and restore byte ordering */
3968 		ip = mtod(*mp, struct ip *);
3969 		hlen = ip->ip_hl << 2;
3970 		if (hlen < sizeof(struct ip))
3971 			goto bad;
3972 		if (hlen > (*mp)->m_len) {
3973 			if ((*mp = m_pullup(*mp, hlen)) == NULL)
3974 				goto bad;
3975 			ip = mtod(*mp, struct ip *);
3976 			if (ip == NULL)
3977 				goto bad;
3978 		}
3979 		ip->ip_len = htons(ip->ip_len);
3980 		ip->ip_off = htons(ip->ip_off);
3981 		ip->ip_sum = 0;
3982 		if (hlen == sizeof(struct ip))
3983 			ip->ip_sum = in_cksum_hdr(ip);
3984 		else
3985 			ip->ip_sum = in_cksum(*mp, hlen);
3986 
3987 		break;
3988 #ifdef INET6
3989 	case ETHERTYPE_IPV6:
3990 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3991 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
3992 					dir);
3993 
3994 		if (*mp == NULL || error != 0) /* filter may consume */
3995 			break;
3996 
3997 		if (pfil_member && ifp != NULL)
3998 			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
3999 					dir);
4000 
4001 		if (*mp == NULL || error != 0) /* filter may consume */
4002 			break;
4003 
4004 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
4005 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
4006 					dir);
4007 		break;
4008 #endif
4009 	default:
4010 		error = 0;
4011 		break;
4012 	}
4013 
4014 	if (*mp == NULL)
4015 		return (error);
4016 	if (error != 0)
4017 		goto bad;
4018 
4019 	error = -1;
4020 
4021 	/*
4022 	 * Finally, put everything back the way it was and return
4023 	 */
4024 	if (snap) {
4025 		M_PREPEND(*mp, sizeof(struct llc), MB_DONTWAIT);
4026 		if (*mp == NULL)
4027 			return (error);
4028 		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
4029 	}
4030 
4031 	M_PREPEND(*mp, ETHER_HDR_LEN, MB_DONTWAIT);
4032 	if (*mp == NULL)
4033 		return (error);
4034 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
4035 
4036 	return (0);
4037 
4038 bad:
4039 	m_freem(*mp);
4040 	*mp = NULL;
4041 	return (error);
4042 }
4043 
4044 /*
4045  * Perform basic checks on header size since
4046  * pfil assumes ip_input has already processed
4047  * it for it.  Cut-and-pasted from ip_input.c.
4048  * Given how simple the IPv6 version is,
4049  * does the IPv4 version really need to be
4050  * this complicated?
4051  *
4052  * XXX Should we update ipstat here, or not?
4053  * XXX Right now we update ipstat but not
4054  * XXX csum_counter.
4055  */
4056 static int
4057 bridge_ip_checkbasic(struct mbuf **mp)
4058 {
4059 	struct mbuf *m = *mp;
4060 	struct ip *ip;
4061 	int len, hlen;
4062 	u_short sum;
4063 
4064 	if (*mp == NULL)
4065 		return (-1);
4066 #if 0 /* notyet */
4067 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
4068 		if ((m = m_copyup(m, sizeof(struct ip),
4069 			(max_linkhdr + 3) & ~3)) == NULL) {
4070 			/* XXXJRT new stat, please */
4071 			ipstat.ips_toosmall++;
4072 			goto bad;
4073 		}
4074 	} else
4075 #endif
4076 #ifndef __predict_false
4077 #define __predict_false(x) x
4078 #endif
4079 	 if (__predict_false(m->m_len < sizeof (struct ip))) {
4080 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
4081 			ipstat.ips_toosmall++;
4082 			goto bad;
4083 		}
4084 	}
4085 	ip = mtod(m, struct ip *);
4086 	if (ip == NULL) goto bad;
4087 
4088 	if (ip->ip_v != IPVERSION) {
4089 		ipstat.ips_badvers++;
4090 		goto bad;
4091 	}
4092 	hlen = ip->ip_hl << 2;
4093 	if (hlen < sizeof(struct ip)) { /* minimum header length */
4094 		ipstat.ips_badhlen++;
4095 		goto bad;
4096 	}
4097 	if (hlen > m->m_len) {
4098 		if ((m = m_pullup(m, hlen)) == NULL) {
4099 			ipstat.ips_badhlen++;
4100 			goto bad;
4101 		}
4102 		ip = mtod(m, struct ip *);
4103 		if (ip == NULL) goto bad;
4104 	}
4105 
4106 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
4107 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
4108 	} else {
4109 		if (hlen == sizeof(struct ip)) {
4110 			sum = in_cksum_hdr(ip);
4111 		} else {
4112 			sum = in_cksum(m, hlen);
4113 		}
4114 	}
4115 	if (sum) {
4116 		ipstat.ips_badsum++;
4117 		goto bad;
4118 	}
4119 
4120 	/* Retrieve the packet length. */
4121 	len = ntohs(ip->ip_len);
4122 
4123 	/*
4124 	 * Check for additional length bogosity
4125 	 */
4126 	if (len < hlen) {
4127 		ipstat.ips_badlen++;
4128 		goto bad;
4129 	}
4130 
4131 	/*
4132 	 * Check that the amount of data in the buffers
4133 	 * is as at least much as the IP header would have us expect.
4134 	 * Drop packet if shorter than we expect.
4135 	 */
4136 	if (m->m_pkthdr.len < len) {
4137 		ipstat.ips_tooshort++;
4138 		goto bad;
4139 	}
4140 
4141 	/* Checks out, proceed */
4142 	*mp = m;
4143 	return (0);
4144 
4145 bad:
4146 	*mp = m;
4147 	return (-1);
4148 }
4149 
4150 #ifdef INET6
4151 /*
4152  * Same as above, but for IPv6.
4153  * Cut-and-pasted from ip6_input.c.
4154  * XXX Should we update ip6stat, or not?
4155  */
4156 static int
4157 bridge_ip6_checkbasic(struct mbuf **mp)
4158 {
4159 	struct mbuf *m = *mp;
4160 	struct ip6_hdr *ip6;
4161 
4162 	/*
4163 	 * If the IPv6 header is not aligned, slurp it up into a new
4164 	 * mbuf with space for link headers, in the event we forward
4165 	 * it.  Otherwise, if it is aligned, make sure the entire base
4166 	 * IPv6 header is in the first mbuf of the chain.
4167 	 */
4168 #if 0 /* notyet */
4169 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
4170 		struct ifnet *inifp = m->m_pkthdr.rcvif;
4171 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
4172 			    (max_linkhdr + 3) & ~3)) == NULL) {
4173 			/* XXXJRT new stat, please */
4174 			ip6stat.ip6s_toosmall++;
4175 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
4176 			goto bad;
4177 		}
4178 	} else
4179 #endif
4180 	if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
4181 		struct ifnet *inifp = m->m_pkthdr.rcvif;
4182 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
4183 			ip6stat.ip6s_toosmall++;
4184 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
4185 			goto bad;
4186 		}
4187 	}
4188 
4189 	ip6 = mtod(m, struct ip6_hdr *);
4190 
4191 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
4192 		ip6stat.ip6s_badvers++;
4193 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
4194 		goto bad;
4195 	}
4196 
4197 	/* Checks out, proceed */
4198 	*mp = m;
4199 	return (0);
4200 
4201 bad:
4202 	*mp = m;
4203 	return (-1);
4204 }
4205 #endif /* INET6 */
4206 
4207 /*
4208  * bridge_fragment:
4209  *
4210  *	Return a fragmented mbuf chain.
4211  */
4212 static int
4213 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
4214     int snap, struct llc *llc)
4215 {
4216 	struct mbuf *m0;
4217 	struct ip *ip;
4218 	int error = -1;
4219 
4220 	if (m->m_len < sizeof(struct ip) &&
4221 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
4222 		goto out;
4223 	ip = mtod(m, struct ip *);
4224 
4225 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
4226 		    CSUM_DELAY_IP);
4227 	if (error)
4228 		goto out;
4229 
4230 	/* walk the chain and re-add the Ethernet header */
4231 	for (m0 = m; m0; m0 = m0->m_nextpkt) {
4232 		if (error == 0) {
4233 			if (snap) {
4234 				M_PREPEND(m0, sizeof(struct llc), MB_DONTWAIT);
4235 				if (m0 == NULL) {
4236 					error = ENOBUFS;
4237 					continue;
4238 				}
4239 				bcopy(llc, mtod(m0, caddr_t),
4240 				    sizeof(struct llc));
4241 			}
4242 			M_PREPEND(m0, ETHER_HDR_LEN, MB_DONTWAIT);
4243 			if (m0 == NULL) {
4244 				error = ENOBUFS;
4245 				continue;
4246 			}
4247 			bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
4248 		} else
4249 			m_freem(m);
4250 	}
4251 
4252 	if (error == 0)
4253 		ipstat.ips_fragmented++;
4254 
4255 	return (error);
4256 
4257 out:
4258 	if (m != NULL)
4259 		m_freem(m);
4260 	return (error);
4261 }
4262 
4263 static void
4264 bridge_enqueue_handler(netmsg_t msg)
4265 {
4266 	struct netmsg_packet *nmp;
4267 	struct ifnet *dst_ifp;
4268 	struct mbuf *m;
4269 
4270 	nmp = &msg->packet;
4271 	m = nmp->nm_packet;
4272 	dst_ifp = nmp->base.lmsg.u.ms_resultp;
4273 	mbuftrackid(m, 71);
4274 
4275 	bridge_handoff(dst_ifp->if_bridge, dst_ifp, m, 1);
4276 }
4277 
4278 static void
4279 bridge_handoff(struct bridge_softc *sc, struct ifnet *dst_ifp,
4280 	       struct mbuf *m, int from_us)
4281 {
4282 	struct mbuf *m0;
4283 	struct ifnet *bifp;
4284 
4285 	bifp = sc->sc_ifp;
4286 	mbuftrackid(m, 72);
4287 
4288 	/* We may be sending a fragment so traverse the mbuf */
4289 	for (; m; m = m0) {
4290 		struct altq_pktattr pktattr;
4291 
4292 		m0 = m->m_nextpkt;
4293 		m->m_nextpkt = NULL;
4294 
4295 		/*
4296 		 * If being sent from our host override ether_shost
4297 		 * with the bridge MAC.  This is mandatory for ARP
4298 		 * so things don't get confused.  In particular we
4299 		 * don't want ARPs to get associated with link interfaces
4300 		 * under the bridge which might or might not stay valid.
4301 		 *
4302 		 * Also override ether_shost when relaying a packet out
4303 		 * the same interface it came in on, due to multi-homed
4304 		 * addresses & default routes, otherwise switches will
4305 		 * get very confused.
4306 		 *
4307 		 * Otherwise if we are in transparent mode.
4308 		 */
4309 		if (from_us || m->m_pkthdr.rcvif == dst_ifp) {
4310 			m_copyback(m,
4311 				   offsetof(struct ether_header, ether_shost),
4312 				   ETHER_ADDR_LEN, IF_LLADDR(sc->sc_ifp));
4313 		} else if ((bifp->if_flags & IFF_LINK0) &&
4314 			   (m->m_pkthdr.fw_flags & BRIDGE_MBUF_TAGGED)) {
4315 			m_copyback(m,
4316 				   offsetof(struct ether_header, ether_shost),
4317 				   ETHER_ADDR_LEN,
4318 				   m->m_pkthdr.br.ether.ether_shost);
4319 		} /* else retain shost */
4320 
4321 		if (ifq_is_enabled(&dst_ifp->if_snd))
4322 			altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
4323 
4324 		ifq_dispatch(dst_ifp, m, &pktattr);
4325 	}
4326 }
4327 
4328 static void
4329 bridge_control_dispatch(netmsg_t msg)
4330 {
4331 	struct netmsg_brctl *bc_msg = (struct netmsg_brctl *)msg;
4332 	struct ifnet *bifp = bc_msg->bc_sc->sc_ifp;
4333 	int error;
4334 
4335 	ifnet_serialize_all(bifp);
4336 	error = bc_msg->bc_func(bc_msg->bc_sc, bc_msg->bc_arg);
4337 	ifnet_deserialize_all(bifp);
4338 
4339 	lwkt_replymsg(&bc_msg->base.lmsg, error);
4340 }
4341 
4342 static int
4343 bridge_control(struct bridge_softc *sc, u_long cmd,
4344 	       bridge_ctl_t bc_func, void *bc_arg)
4345 {
4346 	struct ifnet *bifp = sc->sc_ifp;
4347 	struct netmsg_brctl bc_msg;
4348 	int error;
4349 
4350 	ASSERT_IFNET_SERIALIZED_ALL(bifp);
4351 
4352 	bzero(&bc_msg, sizeof(bc_msg));
4353 
4354 	netmsg_init(&bc_msg.base, NULL, &curthread->td_msgport,
4355 		    0, bridge_control_dispatch);
4356 	bc_msg.bc_func = bc_func;
4357 	bc_msg.bc_sc = sc;
4358 	bc_msg.bc_arg = bc_arg;
4359 
4360 	ifnet_deserialize_all(bifp);
4361 	error = lwkt_domsg(BRIDGE_CFGPORT, &bc_msg.base.lmsg, 0);
4362 	ifnet_serialize_all(bifp);
4363 	return error;
4364 }
4365 
4366 static void
4367 bridge_add_bif_handler(netmsg_t msg)
4368 {
4369 	struct netmsg_braddbif *amsg = (struct netmsg_braddbif *)msg;
4370 	struct bridge_softc *sc;
4371 	struct bridge_iflist *bif;
4372 
4373 	sc = amsg->br_softc;
4374 
4375 	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK | M_ZERO);
4376 	bif->bif_ifp = amsg->br_bif_ifp;
4377 	bif->bif_onlist = 1;
4378 	bif->bif_info = amsg->br_bif_info;
4379 
4380 	/*
4381 	 * runs through bif_info
4382 	 */
4383 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
4384 
4385 	TAILQ_INSERT_HEAD(&sc->sc_iflists[mycpuid], bif, bif_next);
4386 
4387 	ifnet_forwardmsg(&amsg->base.lmsg, mycpuid + 1);
4388 }
4389 
4390 static void
4391 bridge_add_bif(struct bridge_softc *sc, struct bridge_ifinfo *bif_info,
4392 	       struct ifnet *ifp)
4393 {
4394 	struct netmsg_braddbif amsg;
4395 
4396 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
4397 
4398 	netmsg_init(&amsg.base, NULL, &curthread->td_msgport,
4399 		    0, bridge_add_bif_handler);
4400 	amsg.br_softc = sc;
4401 	amsg.br_bif_info = bif_info;
4402 	amsg.br_bif_ifp = ifp;
4403 
4404 	ifnet_domsg(&amsg.base.lmsg, 0);
4405 }
4406 
4407 static void
4408 bridge_del_bif_handler(netmsg_t msg)
4409 {
4410 	struct netmsg_brdelbif *dmsg = (struct netmsg_brdelbif *)msg;
4411 	struct bridge_softc *sc;
4412 	struct bridge_iflist *bif;
4413 
4414 	sc = dmsg->br_softc;
4415 
4416 	/*
4417 	 * Locate the bif associated with the br_bif_info
4418 	 * on the current CPU
4419 	 */
4420 	bif = bridge_lookup_member_ifinfo(sc, dmsg->br_bif_info);
4421 	KKASSERT(bif != NULL && bif->bif_onlist);
4422 
4423 	/* Remove the bif from the current CPU's iflist */
4424 	bif->bif_onlist = 0;
4425 	TAILQ_REMOVE(dmsg->br_bif_list, bif, bif_next);
4426 
4427 	/* Save the removed bif for later freeing */
4428 	TAILQ_INSERT_HEAD(dmsg->br_bif_list, bif, bif_next);
4429 
4430 	ifnet_forwardmsg(&dmsg->base.lmsg, mycpuid + 1);
4431 }
4432 
4433 static void
4434 bridge_del_bif(struct bridge_softc *sc, struct bridge_ifinfo *bif_info,
4435 	       struct bridge_iflist_head *saved_bifs)
4436 {
4437 	struct netmsg_brdelbif dmsg;
4438 
4439 	ASSERT_IFNET_NOT_SERIALIZED_ALL(sc->sc_ifp);
4440 
4441 	netmsg_init(&dmsg.base, NULL, &curthread->td_msgport,
4442 		    0, bridge_del_bif_handler);
4443 	dmsg.br_softc = sc;
4444 	dmsg.br_bif_info = bif_info;
4445 	dmsg.br_bif_list = saved_bifs;
4446 
4447 	ifnet_domsg(&dmsg.base.lmsg, 0);
4448 }
4449