xref: /dflybsd-src/sys/net/bridge/if_bridge.c (revision d54592ee9e96c920b951af2e00cd72c0081ccae3)
1 /*
2  * Copyright 2001 Wasabi Systems, Inc.
3  * All rights reserved.
4  *
5  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed for the NetBSD Project by
18  *	Wasabi Systems, Inc.
19  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
20  *    or promote products derived from this software without specific prior
21  *    written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33  * POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /*
37  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
38  * All rights reserved.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  * 3. All advertising materials mentioning features or use of this software
49  *    must display the following acknowledgement:
50  *	This product includes software developed by Jason L. Wright
51  * 4. The name of the author may not be used to endorse or promote products
52  *    derived from this software without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
55  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
56  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
57  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
58  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
59  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
60  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
63  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
64  * POSSIBILITY OF SUCH DAMAGE.
65  *
66  * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
67  * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
68  * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
69  * $DragonFly: src/sys/net/bridge/if_bridge.c,v 1.42 2008/07/27 10:06:57 sephe Exp $
70  */
71 
72 /*
73  * Network interface bridge support.
74  *
75  * TODO:
76  *
77  *	- Currently only supports Ethernet-like interfaces (Ethernet,
78  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
79  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
80  *	  consider heterogenous bridges).
81  */
82 
83 #include <sys/cdefs.h>
84 
85 #include "opt_inet.h"
86 #include "opt_inet6.h"
87 
88 #include <sys/param.h>
89 #include <sys/mbuf.h>
90 #include <sys/malloc.h>
91 #include <sys/protosw.h>
92 #include <sys/systm.h>
93 #include <sys/time.h>
94 #include <sys/socket.h> /* for net/if.h */
95 #include <sys/sockio.h>
96 #include <sys/ctype.h>  /* string functions */
97 #include <sys/kernel.h>
98 #include <sys/random.h>
99 #include <sys/sysctl.h>
100 #include <sys/module.h>
101 #include <sys/proc.h>
102 #include <sys/lock.h>
103 #include <sys/thread.h>
104 #include <sys/thread2.h>
105 #include <sys/mpipe.h>
106 
107 #include <net/bpf.h>
108 #include <net/if.h>
109 #include <net/if_dl.h>
110 #include <net/if_types.h>
111 #include <net/if_var.h>
112 #include <net/pfil.h>
113 #include <net/ifq_var.h>
114 #include <net/if_clone.h>
115 
116 #include <netinet/in.h> /* for struct arpcom */
117 #include <netinet/in_systm.h>
118 #include <netinet/in_var.h>
119 #include <netinet/ip.h>
120 #include <netinet/ip_var.h>
121 #ifdef INET6
122 #include <netinet/ip6.h>
123 #include <netinet6/ip6_var.h>
124 #endif
125 #include <netinet/if_ether.h> /* for struct arpcom */
126 #include <net/bridge/if_bridgevar.h>
127 #include <net/if_llc.h>
128 #include <net/netmsg2.h>
129 
130 #include <net/route.h>
131 #include <sys/in_cksum.h>
132 
133 /*
134  * Size of the route hash table.  Must be a power of two.
135  */
136 #ifndef BRIDGE_RTHASH_SIZE
137 #define	BRIDGE_RTHASH_SIZE		1024
138 #endif
139 
140 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
141 
142 /*
143  * Maximum number of addresses to cache.
144  */
145 #ifndef BRIDGE_RTABLE_MAX
146 #define	BRIDGE_RTABLE_MAX		100
147 #endif
148 
149 /*
150  * Spanning tree defaults.
151  */
152 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
153 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
154 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
155 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
156 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
157 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
158 #define	BSTP_DEFAULT_PATH_COST		55
159 
160 /*
161  * Timeout (in seconds) for entries learned dynamically.
162  */
163 #ifndef BRIDGE_RTABLE_TIMEOUT
164 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
165 #endif
166 
167 /*
168  * Number of seconds between walks of the route list.
169  */
170 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
171 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
172 #endif
173 
174 /*
175  * List of capabilities to mask on the member interface.
176  */
177 #define	BRIDGE_IFCAPS_MASK		IFCAP_TXCSUM
178 
179 eventhandler_tag	bridge_detach_cookie = NULL;
180 
181 extern	struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
182 extern	int (*bridge_output_p)(struct ifnet *, struct mbuf *);
183 extern	void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
184 
185 typedef int	(*bridge_ctl_t)(struct bridge_softc *, void *);
186 
187 static int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
188 
189 static int	bridge_clone_create(struct if_clone *, int);
190 static void	bridge_clone_destroy(struct ifnet *);
191 
192 static int	bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
193 static void	bridge_mutecaps(struct bridge_iflist *, int);
194 static void	bridge_ifdetach(void *arg __unused, struct ifnet *);
195 static void	bridge_init(void *);
196 static void	bridge_stop(struct ifnet *);
197 static void	bridge_start(struct ifnet *);
198 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
199 static int	bridge_output(struct ifnet *, struct mbuf *);
200 
201 static void	bridge_forward(struct bridge_softc *, struct mbuf *m);
202 
203 static void	bridge_timer(void *);
204 
205 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
206 		    struct mbuf *, int);
207 static void	bridge_span(struct bridge_softc *, struct mbuf *);
208 
209 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
210 		    struct ifnet *, int, uint8_t);
211 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
212 static void	bridge_rttrim(struct bridge_softc *);
213 static void	bridge_rtage(struct bridge_softc *);
214 static void	bridge_rtflush(struct bridge_softc *, int);
215 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
216 
217 static int	bridge_rtable_init(struct bridge_softc *);
218 static void	bridge_rtable_fini(struct bridge_softc *);
219 
220 static int	bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
221 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
222 		    const uint8_t *);
223 static int	bridge_rtnode_insert(struct bridge_softc *,
224 		    struct bridge_rtnode *);
225 static void	bridge_rtnode_destroy(struct bridge_softc *,
226 		    struct bridge_rtnode *);
227 
228 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
229 		    const char *name);
230 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
231 		    struct ifnet *ifp);
232 static void	bridge_delete_member(struct bridge_softc *,
233 		    struct bridge_iflist *, int);
234 static void	bridge_delete_span(struct bridge_softc *,
235 		    struct bridge_iflist *);
236 
237 static int	bridge_control(struct bridge_softc *, u_long,
238 			       bridge_ctl_t, void *);
239 static int	bridge_ioctl_add(struct bridge_softc *, void *);
240 static int	bridge_ioctl_del(struct bridge_softc *, void *);
241 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
242 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
243 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
244 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
245 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
246 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
247 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
248 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
249 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
250 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
251 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
252 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
253 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
254 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
255 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
256 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
257 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
258 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
259 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
260 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
261 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
262 static int	bridge_ioctl_addspan(struct bridge_softc *, void *);
263 static int	bridge_ioctl_delspan(struct bridge_softc *, void *);
264 static int	bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
265 		    int);
266 static int	bridge_ip_checkbasic(struct mbuf **mp);
267 #ifdef INET6
268 static int	bridge_ip6_checkbasic(struct mbuf **mp);
269 #endif /* INET6 */
270 static int	bridge_fragment(struct ifnet *, struct mbuf *,
271 		    struct ether_header *, int, struct llc *);
272 static void	bridge_enqueue_internal(struct ifnet *, struct mbuf *m,
273 					netisr_fn_t);
274 static void	bridge_enqueue_handler(struct netmsg *);
275 static void	bridge_pfil_enqueue_handler(struct netmsg *);
276 static void	bridge_pfil_enqueue(struct ifnet *, struct mbuf *, int);
277 static void	bridge_handoff_notags(struct ifnet *, struct mbuf *);
278 static void	bridge_handoff(struct ifnet *, struct mbuf *);
279 
280 SYSCTL_DECL(_net_link);
281 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
282 
283 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
284 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
285 static int pfil_member = 1; /* run pfil hooks on the member interface */
286 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
287     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
288 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
289     &pfil_bridge, 0, "Packet filter on the bridge interface");
290 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
291     &pfil_member, 0, "Packet filter on the member interface");
292 
293 struct bridge_control {
294 	bridge_ctl_t	bc_func;
295 	int		bc_argsize;
296 	int		bc_flags;
297 };
298 
299 #define	BC_F_COPYIN		0x01	/* copy arguments in */
300 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
301 #define	BC_F_SUSER		0x04	/* do super-user check */
302 
303 const struct bridge_control bridge_control_table[] = {
304 	{ bridge_ioctl_add,		sizeof(struct ifbreq),
305 	  BC_F_COPYIN|BC_F_SUSER },
306 	{ bridge_ioctl_del,		sizeof(struct ifbreq),
307 	  BC_F_COPYIN|BC_F_SUSER },
308 
309 	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
310 	  BC_F_COPYIN|BC_F_COPYOUT },
311 	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
312 	  BC_F_COPYIN|BC_F_SUSER },
313 
314 	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
315 	  BC_F_COPYIN|BC_F_SUSER },
316 	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
317 	  BC_F_COPYOUT },
318 
319 	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
320 	  BC_F_COPYIN|BC_F_COPYOUT },
321 	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
322 	  BC_F_COPYIN|BC_F_COPYOUT },
323 
324 	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
325 	  BC_F_COPYIN|BC_F_SUSER },
326 
327 	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
328 	  BC_F_COPYIN|BC_F_SUSER },
329 	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
330 	  BC_F_COPYOUT },
331 
332 	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
333 	  BC_F_COPYIN|BC_F_SUSER },
334 
335 	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
336 	  BC_F_COPYIN|BC_F_SUSER },
337 
338 	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
339 	  BC_F_COPYOUT },
340 	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
341 	  BC_F_COPYIN|BC_F_SUSER },
342 
343 	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
344 	  BC_F_COPYOUT },
345 	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
346 	  BC_F_COPYIN|BC_F_SUSER },
347 
348 	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
349 	  BC_F_COPYOUT },
350 	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
351 	  BC_F_COPYIN|BC_F_SUSER },
352 
353 	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
354 	  BC_F_COPYOUT },
355 	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
356 	  BC_F_COPYIN|BC_F_SUSER },
357 
358 	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
359 	  BC_F_COPYIN|BC_F_SUSER },
360 
361 	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
362 	  BC_F_COPYIN|BC_F_SUSER },
363 
364 	{ bridge_ioctl_addspan,		sizeof(struct ifbreq),
365 	  BC_F_COPYIN|BC_F_SUSER },
366 	{ bridge_ioctl_delspan,		sizeof(struct ifbreq),
367 	  BC_F_COPYIN|BC_F_SUSER },
368 };
369 const int bridge_control_table_size =
370     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
371 
372 LIST_HEAD(, bridge_softc) bridge_list;
373 
374 struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
375 				bridge_clone_create,
376 				bridge_clone_destroy, 0, IF_MAXUNIT);
377 
378 static int
379 bridge_modevent(module_t mod, int type, void *data)
380 {
381 	switch (type) {
382 	case MOD_LOAD:
383 		LIST_INIT(&bridge_list);
384 		if_clone_attach(&bridge_cloner);
385 		bridge_input_p = bridge_input;
386 		bridge_output_p = bridge_output;
387 		bridge_detach_cookie = EVENTHANDLER_REGISTER(
388 		    ifnet_detach_event, bridge_ifdetach, NULL,
389 		    EVENTHANDLER_PRI_ANY);
390 #if notyet
391 		bstp_linkstate_p = bstp_linkstate;
392 #endif
393 		break;
394 	case MOD_UNLOAD:
395 		if (!LIST_EMPTY(&bridge_list))
396 			return (EBUSY);
397 		EVENTHANDLER_DEREGISTER(ifnet_detach_event,
398 		    bridge_detach_cookie);
399 		if_clone_detach(&bridge_cloner);
400 		bridge_input_p = NULL;
401 		bridge_output_p = NULL;
402 #if notyet
403 		bstp_linkstate_p = NULL;
404 #endif
405 		break;
406 	default:
407 		return (EOPNOTSUPP);
408 	}
409 	return (0);
410 }
411 
412 static moduledata_t bridge_mod = {
413 	"if_bridge",
414 	bridge_modevent,
415 	0
416 };
417 
418 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
419 
420 
421 /*
422  * bridge_clone_create:
423  *
424  *	Create a new bridge instance.
425  */
426 static int
427 bridge_clone_create(struct if_clone *ifc, int unit)
428 {
429 	struct bridge_softc *sc;
430 	struct ifnet *ifp;
431 	u_char eaddr[6];
432 
433 	sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
434 	ifp = sc->sc_ifp = &sc->sc_if;
435 
436 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
437 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
438 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
439 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
440 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
441 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
442 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
443 
444 	/* Initialize our routing table. */
445 	bridge_rtable_init(sc);
446 
447 	callout_init(&sc->sc_brcallout);
448 	callout_init(&sc->sc_bstpcallout);
449 
450 	LIST_INIT(&sc->sc_iflist);
451 	LIST_INIT(&sc->sc_spanlist);
452 
453 	ifp->if_softc = sc;
454 	if_initname(ifp, ifc->ifc_name, unit);
455 	ifp->if_mtu = ETHERMTU;
456 	ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
457 	ifp->if_ioctl = bridge_ioctl;
458 	ifp->if_start = bridge_start;
459 	ifp->if_init = bridge_init;
460 	ifp->if_type = IFT_BRIDGE;
461 	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
462 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
463 	ifq_set_ready(&ifp->if_snd);
464 	ifp->if_hdrlen = ETHER_HDR_LEN;
465 
466 	/*
467 	 * Generate a random ethernet address and use the private AC:DE:48
468 	 * OUI code.
469 	 */
470 	{
471 		int rnd = karc4random();
472 		bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
473 		rnd = karc4random();
474 		bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */
475 	}
476 	eaddr[0] &= ~1;		/* clear multicast bit */
477 	eaddr[0] |= 2;		/* set the LAA bit */
478 
479 	ether_ifattach(ifp, eaddr, NULL);
480 	/* Now undo some of the damage... */
481 	ifp->if_baudrate = 0;
482 	ifp->if_type = IFT_BRIDGE;
483 
484 	crit_enter();	/* XXX MP */
485 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
486 	crit_exit();
487 
488 	return (0);
489 }
490 
491 static void
492 bridge_delete_dispatch(struct netmsg *nmsg)
493 {
494 	struct lwkt_msg *lmsg = &nmsg->nm_lmsg;
495 	struct bridge_softc *sc = lmsg->u.ms_resultp;
496 	struct ifnet *bifp = sc->sc_ifp;
497 	struct bridge_iflist *bif;
498 
499 	lwkt_serialize_enter(bifp->if_serializer);
500 
501 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
502 		bridge_delete_member(sc, bif, 0);
503 
504 	while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL)
505 		bridge_delete_span(sc, bif);
506 
507 	lwkt_serialize_exit(bifp->if_serializer);
508 
509 	lwkt_replymsg(lmsg, 0);
510 }
511 
512 /*
513  * bridge_clone_destroy:
514  *
515  *	Destroy a bridge instance.
516  */
517 static void
518 bridge_clone_destroy(struct ifnet *ifp)
519 {
520 	struct bridge_softc *sc = ifp->if_softc;
521 	struct lwkt_msg *lmsg;
522 	struct netmsg nmsg;
523 
524 	lwkt_serialize_enter(ifp->if_serializer);
525 
526 	bridge_stop(ifp);
527 	ifp->if_flags &= ~IFF_UP;
528 
529 	callout_stop(&sc->sc_brcallout);
530 	callout_stop(&sc->sc_bstpcallout);
531 
532 	lwkt_serialize_exit(ifp->if_serializer);
533 
534 	netmsg_init(&nmsg, &curthread->td_msgport, 0, bridge_delete_dispatch);
535 	lmsg = &nmsg.nm_lmsg;
536 	lmsg->u.ms_resultp = sc;
537 	lwkt_domsg(cpu_portfn(0), lmsg, 0);
538 
539 	crit_enter();	/* XXX MP */
540 	LIST_REMOVE(sc, sc_list);
541 	crit_exit();
542 
543 	ether_ifdetach(ifp);
544 
545 	/* Tear down the routing table. */
546 	bridge_rtable_fini(sc);
547 
548 	kfree(sc, M_DEVBUF);
549 }
550 
551 /*
552  * bridge_ioctl:
553  *
554  *	Handle a control request from the operator.
555  */
556 static int
557 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
558 {
559 	struct bridge_softc *sc = ifp->if_softc;
560 	union {
561 		struct ifbreq ifbreq;
562 		struct ifbifconf ifbifconf;
563 		struct ifbareq ifbareq;
564 		struct ifbaconf ifbaconf;
565 		struct ifbrparam ifbrparam;
566 	} args;
567 	struct ifdrv *ifd = (struct ifdrv *) data;
568 	const struct bridge_control *bc;
569 	int error = 0;
570 
571 	ASSERT_SERIALIZED(ifp->if_serializer);
572 
573 	switch (cmd) {
574 	case SIOCADDMULTI:
575 	case SIOCDELMULTI:
576 		break;
577 
578 	case SIOCGDRVSPEC:
579 	case SIOCSDRVSPEC:
580 		if (ifd->ifd_cmd >= bridge_control_table_size) {
581 			error = EINVAL;
582 			break;
583 		}
584 		bc = &bridge_control_table[ifd->ifd_cmd];
585 
586 		if (cmd == SIOCGDRVSPEC &&
587 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
588 			error = EINVAL;
589 			break;
590 		} else if (cmd == SIOCSDRVSPEC &&
591 		    (bc->bc_flags & BC_F_COPYOUT) != 0) {
592 			error = EINVAL;
593 			break;
594 		}
595 
596 		if (bc->bc_flags & BC_F_SUSER) {
597 			error = suser_cred(cr, NULL_CRED_OKAY);
598 			if (error)
599 				break;
600 		}
601 
602 		if (ifd->ifd_len != bc->bc_argsize ||
603 		    ifd->ifd_len > sizeof(args)) {
604 			error = EINVAL;
605 			break;
606 		}
607 
608 		memset(&args, 0, sizeof(args));
609 		if (bc->bc_flags & BC_F_COPYIN) {
610 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
611 			if (error)
612 				break;
613 		}
614 
615 		error = bridge_control(sc, cmd, bc->bc_func, &args);
616 		if (error)
617 			break;
618 
619 		if (bc->bc_flags & BC_F_COPYOUT)
620 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
621 		break;
622 
623 	case SIOCSIFFLAGS:
624 		if (!(ifp->if_flags & IFF_UP) &&
625 		    (ifp->if_flags & IFF_RUNNING)) {
626 			/*
627 			 * If interface is marked down and it is running,
628 			 * then stop it.
629 			 */
630 			bridge_stop(ifp);
631 		} else if ((ifp->if_flags & IFF_UP) &&
632 		    !(ifp->if_flags & IFF_RUNNING)) {
633 			/*
634 			 * If interface is marked up and it is stopped, then
635 			 * start it.
636 			 */
637 			ifp->if_init(sc);
638 		}
639 		break;
640 
641 	case SIOCSIFMTU:
642 		/* Do not allow the MTU to be changed on the bridge */
643 		error = EINVAL;
644 		break;
645 
646 	default:
647 		error = ether_ioctl(ifp, cmd, data);
648 		break;
649 	}
650 	return (error);
651 }
652 
653 /*
654  * bridge_mutecaps:
655  *
656  *	Clear or restore unwanted capabilities on the member interface
657  */
658 static void
659 bridge_mutecaps(struct bridge_iflist *bif, int mute)
660 {
661 	struct ifnet *ifp = bif->bif_ifp;
662 	struct ifreq ifr;
663 	int error;
664 
665 	if (ifp->if_ioctl == NULL)
666 		return;
667 
668 	bzero(&ifr, sizeof(ifr));
669 	ifr.ifr_reqcap = ifp->if_capenable;
670 
671 	if (mute) {
672 		/* mask off and save capabilities */
673 		bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
674 		if (bif->bif_mutecap != 0)
675 			ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
676 	} else {
677 		/* restore muted capabilities */
678 		ifr.ifr_reqcap |= bif->bif_mutecap;
679 	}
680 
681 	if (bif->bif_mutecap != 0) {
682 		lwkt_serialize_enter(ifp->if_serializer);
683 		error = ifp->if_ioctl(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
684 		lwkt_serialize_exit(ifp->if_serializer);
685 	}
686 }
687 
688 /*
689  * bridge_lookup_member:
690  *
691  *	Lookup a bridge member interface.
692  */
693 static struct bridge_iflist *
694 bridge_lookup_member(struct bridge_softc *sc, const char *name)
695 {
696 	struct bridge_iflist *bif;
697 	struct ifnet *ifp;
698 
699 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
700 		ifp = bif->bif_ifp;
701 		if (strcmp(ifp->if_xname, name) == 0)
702 			return (bif);
703 	}
704 
705 	return (NULL);
706 }
707 
708 /*
709  * bridge_lookup_member_if:
710  *
711  *	Lookup a bridge member interface by ifnet*.
712  */
713 static struct bridge_iflist *
714 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
715 {
716 	struct bridge_iflist *bif;
717 
718 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
719 		if (bif->bif_ifp == member_ifp)
720 			return (bif);
721 	}
722 
723 	return (NULL);
724 }
725 
726 /*
727  * bridge_delete_member:
728  *
729  *	Delete the specified member interface.
730  */
731 static void
732 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
733     int gone)
734 {
735 	struct ifnet *ifs = bif->bif_ifp;
736 	struct ifnet *bifp = sc->sc_ifp;
737 
738 	ASSERT_SERIALIZED(bifp->if_serializer);
739 
740 	ifs->if_bridge = NULL;
741 
742 	/*
743 	 * Release bridge interface's serializer:
744 	 * - To avoid possible dead lock.
745 	 * - netmsg_service_sync will block current thread.
746 	 */
747 	lwkt_serialize_exit(bifp->if_serializer);
748 
749 	/*
750 	 * Make sure that all protocol threads see 'ifs' if_bridge change.
751 	 */
752 	netmsg_service_sync();
753 
754 	if (!gone) {
755 		switch (ifs->if_type) {
756 		case IFT_ETHER:
757 		case IFT_L2VLAN:
758 			/*
759 			 * Take the interface out of promiscuous mode.
760 			 */
761 			ifpromisc(ifs, 0);
762 			bridge_mutecaps(bif, 0);
763 			break;
764 
765 		case IFT_GIF:
766 			break;
767 
768 		default:
769 			panic("bridge_delete_member: impossible");
770 			break;
771 		}
772 	}
773 
774 	lwkt_serialize_enter(bifp->if_serializer);
775 
776 	LIST_REMOVE(bif, bif_next);
777 
778 	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
779 
780 	kfree(bif, M_DEVBUF);
781 
782 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
783 		bstp_initialization(sc);
784 }
785 
786 /*
787  * bridge_delete_span:
788  *
789  *	Delete the specified span interface.
790  */
791 static void
792 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
793 {
794 	KASSERT(bif->bif_ifp->if_bridge == NULL,
795 	    ("%s: not a span interface", __func__));
796 
797 	LIST_REMOVE(bif, bif_next);
798 	kfree(bif, M_DEVBUF);
799 }
800 
801 static int
802 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
803 {
804 	struct ifbreq *req = arg;
805 	struct bridge_iflist *bif = NULL;
806 	struct ifnet *ifs, *bifp;
807 	int error = 0;
808 
809 	bifp = sc->sc_ifp;
810 	ASSERT_SERIALIZED(bifp->if_serializer);
811 
812 	ifs = ifunit(req->ifbr_ifsname);
813 	if (ifs == NULL)
814 		return (ENOENT);
815 
816 	/* If it's in the span list, it can't be a member. */
817 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
818 		if (ifs == bif->bif_ifp)
819 			return (EBUSY);
820 
821 	/* Allow the first Ethernet member to define the MTU */
822 	if (ifs->if_type != IFT_GIF) {
823 		if (LIST_EMPTY(&sc->sc_iflist)) {
824 			bifp->if_mtu = ifs->if_mtu;
825 		} else if (bifp->if_mtu != ifs->if_mtu) {
826 			if_printf(bifp, "invalid MTU for %s\n", ifs->if_xname);
827 			return (EINVAL);
828 		}
829 	}
830 
831 	if (ifs->if_bridge == sc)
832 		return (EEXIST);
833 
834 	if (ifs->if_bridge != NULL)
835 		return (EBUSY);
836 
837 	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
838 	bif->bif_ifp = ifs;
839 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
840 	bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
841 	bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
842 
843 	switch (ifs->if_type) {
844 	case IFT_ETHER:
845 	case IFT_L2VLAN:
846 		/*
847 		 * Release bridge interface's serializer to
848 		 * avoid possible dead lock.
849 		 */
850 		lwkt_serialize_exit(bifp->if_serializer);
851 
852 		/*
853 		 * Place the interface into promiscuous mode.
854 		 */
855 		error = ifpromisc(ifs, 1);
856 		if (error) {
857 			lwkt_serialize_enter(bifp->if_serializer);
858 			goto out;
859 		}
860 
861 		bridge_mutecaps(bif, 1);
862 
863 		lwkt_serialize_enter(bifp->if_serializer);
864 		break;
865 
866 	case IFT_GIF: /* :^) */
867 		break;
868 
869 	default:
870 		error = EINVAL;
871 		goto out;
872 	}
873 
874 	LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
875 
876 	if (bifp->if_flags & IFF_RUNNING)
877 		bstp_initialization(sc);
878 	else
879 		bstp_stop(sc);
880 
881 	/*
882 	 * Everything has been setup, so let the member interface
883 	 * deliver packets to this bridge on its input/output path.
884 	 */
885 	ifs->if_bridge = sc;
886 out:
887 	if (error) {
888 		if (bif != NULL)
889 			kfree(bif, M_DEVBUF);
890 	}
891 	return (error);
892 }
893 
894 static int
895 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
896 {
897 	struct ifbreq *req = arg;
898 	struct bridge_iflist *bif;
899 
900 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
901 	if (bif == NULL)
902 		return (ENOENT);
903 
904 	bridge_delete_member(sc, bif, 0);
905 
906 	return (0);
907 }
908 
909 static int
910 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
911 {
912 	struct ifbreq *req = arg;
913 	struct bridge_iflist *bif;
914 
915 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
916 	if (bif == NULL)
917 		return (ENOENT);
918 
919 	req->ifbr_ifsflags = bif->bif_flags;
920 	req->ifbr_state = bif->bif_state;
921 	req->ifbr_priority = bif->bif_priority;
922 	req->ifbr_path_cost = bif->bif_path_cost;
923 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
924 
925 	return (0);
926 }
927 
928 static int
929 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
930 {
931 	struct ifbreq *req = arg;
932 	struct bridge_iflist *bif;
933 
934 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
935 	if (bif == NULL)
936 		return (ENOENT);
937 
938 	if (req->ifbr_ifsflags & IFBIF_SPAN)
939 		/* SPAN is readonly */
940 		return (EINVAL);
941 
942 	if (req->ifbr_ifsflags & IFBIF_STP) {
943 		switch (bif->bif_ifp->if_type) {
944 		case IFT_ETHER:
945 			/* These can do spanning tree. */
946 			break;
947 
948 		default:
949 			/* Nothing else can. */
950 			return (EINVAL);
951 		}
952 	}
953 
954 	bif->bif_flags = req->ifbr_ifsflags;
955 
956 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
957 		bstp_initialization(sc);
958 
959 	return (0);
960 }
961 
962 static int
963 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
964 {
965 	struct ifbrparam *param = arg;
966 
967 	sc->sc_brtmax = param->ifbrp_csize;
968 	bridge_rttrim(sc);
969 
970 	return (0);
971 }
972 
973 static int
974 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
975 {
976 	struct ifbrparam *param = arg;
977 
978 	param->ifbrp_csize = sc->sc_brtmax;
979 
980 	return (0);
981 }
982 
983 static int
984 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
985 {
986 	struct ifbifconf *bifc = arg;
987 	struct bridge_iflist *bif;
988 	struct ifbreq breq;
989 	int count, len, error = 0;
990 
991 	count = 0;
992 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
993 		count++;
994 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
995 		count++;
996 
997 	if (bifc->ifbic_len == 0) {
998 		bifc->ifbic_len = sizeof(breq) * count;
999 		return (0);
1000 	}
1001 
1002 	count = 0;
1003 	len = bifc->ifbic_len;
1004 	memset(&breq, 0, sizeof breq);
1005 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1006 		if (len < sizeof(breq))
1007 			break;
1008 
1009 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1010 		    sizeof(breq.ifbr_ifsname));
1011 		breq.ifbr_ifsflags = bif->bif_flags;
1012 		breq.ifbr_state = bif->bif_state;
1013 		breq.ifbr_priority = bif->bif_priority;
1014 		breq.ifbr_path_cost = bif->bif_path_cost;
1015 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1016 		error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1017 		if (error)
1018 			break;
1019 		count++;
1020 		len -= sizeof(breq);
1021 	}
1022 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1023 		if (len < sizeof(breq))
1024 			break;
1025 
1026 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1027 		    sizeof(breq.ifbr_ifsname));
1028 		breq.ifbr_ifsflags = bif->bif_flags;
1029 		breq.ifbr_state = bif->bif_state;
1030 		breq.ifbr_priority = bif->bif_priority;
1031 		breq.ifbr_path_cost = bif->bif_path_cost;
1032 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1033 		error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1034 		if (error)
1035 			break;
1036 		count++;
1037 		len -= sizeof(breq);
1038 	}
1039 
1040 	bifc->ifbic_len = sizeof(breq) * count;
1041 	return (error);
1042 }
1043 
1044 static int
1045 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1046 {
1047 	struct ifbaconf *bac = arg;
1048 	struct bridge_rtnode *brt;
1049 	struct ifbareq bareq;
1050 	int count = 0, error = 0, len;
1051 
1052 	if (bac->ifbac_len == 0)
1053 		return (0);
1054 
1055 	len = bac->ifbac_len;
1056 	memset(&bareq, 0, sizeof(bareq));
1057 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1058 		if (len < sizeof(bareq))
1059 			goto out;
1060 		strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1061 		    sizeof(bareq.ifba_ifsname));
1062 		memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1063 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1064 				time_second < brt->brt_expire)
1065 			bareq.ifba_expire = brt->brt_expire - time_second;
1066 		else
1067 			bareq.ifba_expire = 0;
1068 		bareq.ifba_flags = brt->brt_flags;
1069 
1070 		error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1071 		if (error)
1072 			goto out;
1073 		count++;
1074 		len -= sizeof(bareq);
1075 	}
1076 out:
1077 	bac->ifbac_len = sizeof(bareq) * count;
1078 	return (error);
1079 }
1080 
1081 static int
1082 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1083 {
1084 	struct ifbareq *req = arg;
1085 	struct bridge_iflist *bif;
1086 	int error;
1087 
1088 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
1089 	if (bif == NULL)
1090 		return (ENOENT);
1091 
1092 	error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1093 	    req->ifba_flags);
1094 
1095 	return (error);
1096 }
1097 
1098 static int
1099 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1100 {
1101 	struct ifbrparam *param = arg;
1102 
1103 	sc->sc_brttimeout = param->ifbrp_ctime;
1104 
1105 	return (0);
1106 }
1107 
1108 static int
1109 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1110 {
1111 	struct ifbrparam *param = arg;
1112 
1113 	param->ifbrp_ctime = sc->sc_brttimeout;
1114 
1115 	return (0);
1116 }
1117 
1118 static int
1119 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1120 {
1121 	struct ifbareq *req = arg;
1122 
1123 	return (bridge_rtdaddr(sc, req->ifba_dst));
1124 }
1125 
1126 static int
1127 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1128 {
1129 	struct ifbreq *req = arg;
1130 
1131 	bridge_rtflush(sc, req->ifbr_ifsflags);
1132 
1133 	return (0);
1134 }
1135 
1136 static int
1137 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1138 {
1139 	struct ifbrparam *param = arg;
1140 
1141 	param->ifbrp_prio = sc->sc_bridge_priority;
1142 
1143 	return (0);
1144 }
1145 
1146 static int
1147 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1148 {
1149 	struct ifbrparam *param = arg;
1150 
1151 	sc->sc_bridge_priority = param->ifbrp_prio;
1152 
1153 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1154 		bstp_initialization(sc);
1155 
1156 	return (0);
1157 }
1158 
1159 static int
1160 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1161 {
1162 	struct ifbrparam *param = arg;
1163 
1164 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1165 
1166 	return (0);
1167 }
1168 
1169 static int
1170 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1171 {
1172 	struct ifbrparam *param = arg;
1173 
1174 	if (param->ifbrp_hellotime == 0)
1175 		return (EINVAL);
1176 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1177 
1178 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1179 		bstp_initialization(sc);
1180 
1181 	return (0);
1182 }
1183 
1184 static int
1185 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1186 {
1187 	struct ifbrparam *param = arg;
1188 
1189 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1190 
1191 	return (0);
1192 }
1193 
1194 static int
1195 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1196 {
1197 	struct ifbrparam *param = arg;
1198 
1199 	if (param->ifbrp_fwddelay == 0)
1200 		return (EINVAL);
1201 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1202 
1203 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1204 		bstp_initialization(sc);
1205 
1206 	return (0);
1207 }
1208 
1209 static int
1210 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1211 {
1212 	struct ifbrparam *param = arg;
1213 
1214 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1215 
1216 	return (0);
1217 }
1218 
1219 static int
1220 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1221 {
1222 	struct ifbrparam *param = arg;
1223 
1224 	if (param->ifbrp_maxage == 0)
1225 		return (EINVAL);
1226 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1227 
1228 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1229 		bstp_initialization(sc);
1230 
1231 	return (0);
1232 }
1233 
1234 static int
1235 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1236 {
1237 	struct ifbreq *req = arg;
1238 	struct bridge_iflist *bif;
1239 
1240 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1241 	if (bif == NULL)
1242 		return (ENOENT);
1243 
1244 	bif->bif_priority = req->ifbr_priority;
1245 
1246 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1247 		bstp_initialization(sc);
1248 
1249 	return (0);
1250 }
1251 
1252 static int
1253 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1254 {
1255 	struct ifbreq *req = arg;
1256 	struct bridge_iflist *bif;
1257 
1258 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1259 	if (bif == NULL)
1260 		return (ENOENT);
1261 
1262 	bif->bif_path_cost = req->ifbr_path_cost;
1263 
1264 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
1265 		bstp_initialization(sc);
1266 
1267 	return (0);
1268 }
1269 
1270 static int
1271 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1272 {
1273 	struct ifbreq *req = arg;
1274 	struct bridge_iflist *bif = NULL;
1275 	struct ifnet *ifs;
1276 
1277 	ifs = ifunit(req->ifbr_ifsname);
1278 	if (ifs == NULL)
1279 		return (ENOENT);
1280 
1281 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1282 		if (ifs == bif->bif_ifp)
1283 			return (EBUSY);
1284 
1285 	if (ifs->if_bridge != NULL)
1286 		return (EBUSY);
1287 
1288 	switch (ifs->if_type) {
1289 		case IFT_ETHER:
1290 		case IFT_GIF:
1291 		case IFT_L2VLAN:
1292 			break;
1293 		default:
1294 			return (EINVAL);
1295 	}
1296 
1297 	bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
1298 
1299 	bif->bif_ifp = ifs;
1300 	bif->bif_flags = IFBIF_SPAN;
1301 
1302 	LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1303 
1304 	return (0);
1305 }
1306 
1307 static int
1308 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1309 {
1310 	struct ifbreq *req = arg;
1311 	struct bridge_iflist *bif;
1312 	struct ifnet *ifs;
1313 
1314 	ifs = ifunit(req->ifbr_ifsname);
1315 	if (ifs == NULL)
1316 		return (ENOENT);
1317 
1318 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1319 		if (ifs == bif->bif_ifp)
1320 			break;
1321 
1322 	if (bif == NULL)
1323 		return (ENOENT);
1324 
1325 	bridge_delete_span(sc, bif);
1326 
1327 	return (0);
1328 }
1329 
1330 static void
1331 bridge_ifdetach_dispatch(struct netmsg *nmsg)
1332 {
1333 	struct lwkt_msg *lmsg = &nmsg->nm_lmsg;
1334 	struct ifnet *ifp, *bifp;
1335 	struct bridge_softc *sc;
1336 	struct bridge_iflist *bif;
1337 
1338 	ifp = lmsg->u.ms_resultp;
1339 	sc = ifp->if_bridge;
1340 
1341 	/* Check if the interface is a bridge member */
1342 	if (sc != NULL) {
1343 		bifp = sc->sc_ifp;
1344 
1345 		lwkt_serialize_enter(bifp->if_serializer);
1346 
1347 		bif = bridge_lookup_member_if(sc, ifp);
1348 		if (bif != NULL) {
1349 			bridge_delete_member(sc, bif, 1);
1350 		} else {
1351 			/* XXX Why bif will be NULL? */
1352 		}
1353 
1354 		lwkt_serialize_exit(bifp->if_serializer);
1355 		goto reply;
1356 	}
1357 
1358 	crit_enter();	/* XXX MP */
1359 
1360 	/* Check if the interface is a span port */
1361 	LIST_FOREACH(sc, &bridge_list, sc_list) {
1362 		bifp = sc->sc_ifp;
1363 
1364 		lwkt_serialize_enter(bifp->if_serializer);
1365 
1366 		LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1367 			if (ifp == bif->bif_ifp) {
1368 				bridge_delete_span(sc, bif);
1369 				break;
1370 			}
1371 
1372 		lwkt_serialize_exit(bifp->if_serializer);
1373 	}
1374 
1375 	crit_exit();
1376 
1377 reply:
1378 	lwkt_replymsg(lmsg, 0);
1379 }
1380 
1381 /*
1382  * bridge_ifdetach:
1383  *
1384  *	Detach an interface from a bridge.  Called when a member
1385  *	interface is detaching.
1386  */
1387 static void
1388 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1389 {
1390 	struct lwkt_msg *lmsg;
1391 	struct netmsg nmsg;
1392 
1393 	netmsg_init(&nmsg, &curthread->td_msgport, 0, bridge_ifdetach_dispatch);
1394 	lmsg = &nmsg.nm_lmsg;
1395 	lmsg->u.ms_resultp = ifp;
1396 
1397 	lwkt_domsg(cpu_portfn(0), lmsg, 0);
1398 }
1399 
1400 /*
1401  * bridge_init:
1402  *
1403  *	Initialize a bridge interface.
1404  */
1405 static void
1406 bridge_init(void *xsc)
1407 {
1408 	struct bridge_softc *sc = (struct bridge_softc *)xsc;
1409 	struct ifnet *ifp = sc->sc_ifp;
1410 
1411 	ASSERT_SERIALIZED(ifp->if_serializer);
1412 
1413 	if (ifp->if_flags & IFF_RUNNING)
1414 		return;
1415 
1416 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1417 	    bridge_timer, sc);
1418 
1419 	ifp->if_flags |= IFF_RUNNING;
1420 	bstp_initialization(sc);
1421 	return;
1422 }
1423 
1424 /*
1425  * bridge_stop:
1426  *
1427  *	Stop the bridge interface.
1428  */
1429 static void
1430 bridge_stop(struct ifnet *ifp)
1431 {
1432 	struct bridge_softc *sc = ifp->if_softc;
1433 
1434 	ASSERT_SERIALIZED(ifp->if_serializer);
1435 
1436 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1437 		return;
1438 
1439 	callout_stop(&sc->sc_brcallout);
1440 	bstp_stop(sc);
1441 
1442 	bridge_rtflush(sc, IFBF_FLUSHDYN);
1443 
1444 	ifp->if_flags &= ~IFF_RUNNING;
1445 }
1446 
1447 static void
1448 bridge_enqueue_internal(struct ifnet *dst_ifp, struct mbuf *m,
1449 			netisr_fn_t handler)
1450 {
1451 	struct netmsg_packet *nmp;
1452 	lwkt_port_t port;
1453 	int cpu = mycpu->gd_cpuid;
1454 
1455 	while (m->m_type == MT_TAG) {
1456 		/* XXX see ether_output_frame for full rules check */
1457 		m = m->m_next;
1458 	}
1459 
1460 	nmp = &m->m_hdr.mh_netmsg;
1461 	netmsg_init(&nmp->nm_netmsg, &netisr_apanic_rport, 0, handler);
1462 	nmp->nm_packet = m;
1463 	nmp->nm_netmsg.nm_lmsg.u.ms_resultp = dst_ifp;
1464 
1465 	port = cpu_portfn(cpu);
1466 	lwkt_sendmsg(port, &nmp->nm_netmsg.nm_lmsg);
1467 }
1468 
1469 static void
1470 bridge_pfil_enqueue(struct ifnet *dst_ifp, struct mbuf *m,
1471 		    int runfilt)
1472 {
1473 	netisr_fn_t handler;
1474 
1475 	if (runfilt && (inet_pfil_hook.ph_hashooks > 0
1476 #ifdef INET6
1477 	    || inet6_pfil_hook.ph_hashooks > 0
1478 #endif
1479 	    )) {
1480 		handler = bridge_pfil_enqueue_handler;
1481 	} else {
1482 		handler = bridge_enqueue_handler;
1483 	}
1484 	bridge_enqueue_internal(dst_ifp, m, handler);
1485 }
1486 
1487 /*
1488  * bridge_enqueue:
1489  *
1490  *	Enqueue a packet on a bridge member interface.
1491  *
1492  */
1493 void
1494 bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
1495 {
1496 	bridge_enqueue_internal(dst_ifp, m, bridge_enqueue_handler);
1497 }
1498 
1499 /*
1500  * bridge_output:
1501  *
1502  *	Send output from a bridge member interface.  This
1503  *	performs the bridging function for locally originated
1504  *	packets.
1505  *
1506  *	The mbuf has the Ethernet header already attached.  We must
1507  *	enqueue or free the mbuf before returning.
1508  */
1509 static int
1510 bridge_output(struct ifnet *ifp, struct mbuf *m)
1511 {
1512 	struct bridge_softc *sc = ifp->if_bridge;
1513 	struct ether_header *eh;
1514 	struct ifnet *dst_if;
1515 
1516 	ASSERT_NOT_SERIALIZED(ifp->if_serializer);
1517 
1518 	/*
1519 	 * Make sure that we are still a member of a bridge interface.
1520 	 */
1521 	if (sc == NULL) {
1522 		m_freem(m);
1523 		return (0);
1524 	}
1525 
1526 	if (m->m_len < ETHER_HDR_LEN) {
1527 		m = m_pullup(m, ETHER_HDR_LEN);
1528 		if (m == NULL)
1529 			return (0);
1530 	}
1531 
1532 	/* Serialize our bridge interface. */
1533 	lwkt_serialize_enter(sc->sc_ifp->if_serializer);
1534 
1535 	eh = mtod(m, struct ether_header *);
1536 
1537 	/*
1538 	 * If bridge is down, but the original output interface is up,
1539 	 * go ahead and send out that interface.  Otherwise, the packet
1540 	 * is dropped below.
1541 	 */
1542 	if ((sc->sc_ifp->if_flags & IFF_RUNNING) == 0) {
1543 		dst_if = ifp;
1544 		goto sendunicast;
1545 	}
1546 
1547 	/*
1548 	 * If the packet is a multicast, or we don't know a better way to
1549 	 * get there, send to all interfaces.
1550 	 */
1551 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
1552 		dst_if = NULL;
1553 	else
1554 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1555 	if (dst_if == NULL) {
1556 		struct bridge_iflist *bif;
1557 		struct mbuf *mc;
1558 		int used = 0;
1559 
1560 		bridge_span(sc, m);
1561 
1562 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1563 			dst_if = bif->bif_ifp;
1564 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
1565 				continue;
1566 
1567 			/*
1568 			 * If this is not the original output interface,
1569 			 * and the interface is participating in spanning
1570 			 * tree, make sure the port is in a state that
1571 			 * allows forwarding.
1572 			 */
1573 			if (dst_if != ifp &&
1574 			    (bif->bif_flags & IFBIF_STP) != 0) {
1575 				switch (bif->bif_state) {
1576 				case BSTP_IFSTATE_BLOCKING:
1577 				case BSTP_IFSTATE_LISTENING:
1578 				case BSTP_IFSTATE_DISABLED:
1579 					continue;
1580 				}
1581 			}
1582 
1583 			if (LIST_NEXT(bif, bif_next) == NULL) {
1584 				used = 1;
1585 				mc = m;
1586 			} else {
1587 				mc = m_copypacket(m, MB_DONTWAIT);
1588 				if (mc == NULL) {
1589 					sc->sc_ifp->if_oerrors++;
1590 					continue;
1591 				}
1592 			}
1593 			bridge_enqueue(dst_if, mc);
1594 		}
1595 		if (used == 0)
1596 			m_freem(m);
1597 		lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1598 		return (0);
1599 	}
1600 
1601 sendunicast:
1602 	/*
1603 	 * XXX Spanning tree consideration here?
1604 	 */
1605 
1606 	bridge_span(sc, m);
1607 	lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1608 	if ((dst_if->if_flags & IFF_RUNNING) == 0)
1609 		m_freem(m);
1610 	else
1611 		bridge_enqueue(dst_if, m);
1612 	return (0);
1613 }
1614 
1615 /*
1616  * bridge_start:
1617  *
1618  *	Start output on a bridge.
1619  *
1620  */
1621 static void
1622 bridge_start(struct ifnet *ifp)
1623 {
1624 	struct bridge_softc *sc = ifp->if_softc;
1625 
1626 	ASSERT_SERIALIZED(ifp->if_serializer);
1627 
1628 	ifp->if_flags |= IFF_OACTIVE;
1629 	for (;;) {
1630 		struct ifnet *dst_if = NULL;
1631 		struct ether_header *eh;
1632 		struct mbuf *m;
1633 
1634 		m = ifq_dequeue(&ifp->if_snd, NULL);
1635 		if (m == NULL)
1636 			break;
1637 
1638 		if (m->m_len < sizeof(*eh)) {
1639 			m = m_pullup(m, sizeof(*eh));
1640 			if (m == NULL) {
1641 				ifp->if_oerrors++;
1642 				continue;
1643 			}
1644 		}
1645 		eh = mtod(m, struct ether_header *);
1646 
1647 		BPF_MTAP(ifp, m);
1648 		ifp->if_opackets++;
1649 
1650 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
1651 			dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1652 
1653 		if (dst_if == NULL)
1654 			bridge_broadcast(sc, ifp, m, 0);
1655 		else
1656 			bridge_enqueue(dst_if, m);
1657 	}
1658 	ifp->if_flags &= ~IFF_OACTIVE;
1659 }
1660 
1661 /*
1662  * bridge_forward:
1663  *
1664  *	The forwarding function of the bridge.
1665  */
1666 static void
1667 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1668 {
1669 	struct bridge_iflist *bif;
1670 	struct ifnet *src_if, *dst_if, *ifp;
1671 	struct ether_header *eh;
1672 
1673 	src_if = m->m_pkthdr.rcvif;
1674 	ifp = sc->sc_ifp;
1675 
1676 	ASSERT_SERIALIZED(ifp->if_serializer);
1677 
1678 	ifp->if_ipackets++;
1679 	ifp->if_ibytes += m->m_pkthdr.len;
1680 
1681 	/*
1682 	 * Look up the bridge_iflist.
1683 	 */
1684 	bif = bridge_lookup_member_if(sc, src_if);
1685 	if (bif == NULL) {
1686 		/* Interface is not a bridge member (anymore?) */
1687 		m_freem(m);
1688 		return;
1689 	}
1690 
1691 	if (bif->bif_flags & IFBIF_STP) {
1692 		switch (bif->bif_state) {
1693 		case BSTP_IFSTATE_BLOCKING:
1694 		case BSTP_IFSTATE_LISTENING:
1695 		case BSTP_IFSTATE_DISABLED:
1696 			m_freem(m);
1697 			return;
1698 		}
1699 	}
1700 
1701 	eh = mtod(m, struct ether_header *);
1702 
1703 	/*
1704 	 * If the interface is learning, and the source
1705 	 * address is valid and not multicast, record
1706 	 * the address.
1707 	 */
1708 	if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1709 	    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1710 	    (eh->ether_shost[0] == 0 &&
1711 	     eh->ether_shost[1] == 0 &&
1712 	     eh->ether_shost[2] == 0 &&
1713 	     eh->ether_shost[3] == 0 &&
1714 	     eh->ether_shost[4] == 0 &&
1715 	     eh->ether_shost[5] == 0) == 0) {
1716 		bridge_rtupdate(sc, eh->ether_shost, src_if, 0, IFBAF_DYNAMIC);
1717 	}
1718 
1719 	if ((bif->bif_flags & IFBIF_STP) != 0 &&
1720 	    bif->bif_state == BSTP_IFSTATE_LEARNING) {
1721 		m_freem(m);
1722 		return;
1723 	}
1724 
1725 	/*
1726 	 * At this point, the port either doesn't participate
1727 	 * in spanning tree or it is in the forwarding state.
1728 	 */
1729 
1730 	/*
1731 	 * If the packet is unicast, destined for someone on
1732 	 * "this" side of the bridge, drop it.
1733 	 */
1734 	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1735 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1736 		if (src_if == dst_if) {
1737 			m_freem(m);
1738 			return;
1739 		}
1740 	} else {
1741 		/* ...forward it to all interfaces. */
1742 		sc->sc_ifp->if_imcasts++;
1743 		dst_if = NULL;
1744 	}
1745 
1746 	if (dst_if == NULL) {
1747 		bridge_broadcast(sc, src_if, m, 1);
1748 		return;
1749 	}
1750 
1751 	/*
1752 	 * At this point, we're dealing with a unicast frame
1753 	 * going to a different interface.
1754 	 */
1755 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1756 		m_freem(m);
1757 		return;
1758 	}
1759 	bif = bridge_lookup_member_if(sc, dst_if);
1760 	if (bif == NULL) {
1761 		/* Not a member of the bridge (anymore?) */
1762 		m_freem(m);
1763 		return;
1764 	}
1765 
1766 	if (bif->bif_flags & IFBIF_STP) {
1767 		switch (bif->bif_state) {
1768 		case BSTP_IFSTATE_DISABLED:
1769 		case BSTP_IFSTATE_BLOCKING:
1770 			m_freem(m);
1771 			return;
1772 		}
1773 	}
1774 
1775 	lwkt_serialize_exit(ifp->if_serializer);
1776 
1777 	/* run the packet filter */
1778 	if (inet_pfil_hook.ph_hashooks > 0
1779 #ifdef INET6
1780 	    || inet6_pfil_hook.ph_hashooks > 0
1781 #endif
1782 	    ) {
1783 		if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1784 			goto done;
1785 		if (m == NULL)
1786 			goto done;
1787 
1788 		if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
1789 			goto done;
1790 		if (m == NULL)
1791 			goto done;
1792 	}
1793 	bridge_handoff(dst_if, m);
1794 
1795 	/*
1796 	 * ifp's serializer was held on entry and is expected to be held
1797 	 * on return.
1798 	 */
1799 done:
1800 	lwkt_serialize_enter(ifp->if_serializer);
1801 }
1802 
1803 /*
1804  * bridge_input:
1805  *
1806  *	Receive input from a member interface.  Queue the packet for
1807  *	bridging if it is not for us.
1808  */
1809 static struct mbuf *
1810 bridge_input(struct ifnet *ifp, struct mbuf *m)
1811 {
1812 	struct bridge_softc *sc = ifp->if_bridge;
1813 	struct bridge_iflist *bif;
1814 	struct ifnet *bifp, *new_ifp;
1815 	struct ether_header *eh;
1816 	struct mbuf *mc, *mc2;
1817 
1818 	/*
1819 	 * Make sure that we are still a member of a bridge interface.
1820 	 */
1821 	if (sc == NULL)
1822 		return m;
1823 
1824 	new_ifp = NULL;
1825 	bifp = sc->sc_ifp;
1826 
1827 	lwkt_serialize_enter(bifp->if_serializer);
1828 
1829 	if ((bifp->if_flags & IFF_RUNNING) == 0)
1830 		goto out;
1831 
1832 	/*
1833 	 * Implement support for bridge monitoring. If this flag has been
1834 	 * set on this interface, discard the packet once we push it through
1835 	 * the bpf(4) machinery, but before we do, increment the byte and
1836 	 * packet counters associated with this interface.
1837 	 */
1838 	 if ((bifp->if_flags & IFF_MONITOR) != 0) {
1839 	 	m->m_pkthdr.rcvif = bifp;
1840 		BPF_MTAP(bifp, m);
1841 		bifp->if_ipackets++;
1842 		bifp->if_ibytes += m->m_pkthdr.len;
1843 		m_freem(m);
1844 		m = NULL;
1845 		goto out;
1846 	}
1847 
1848 	eh = mtod(m, struct ether_header *);
1849 
1850 	m->m_flags &= ~M_PROTO1; /* XXX Hack - loop prevention */
1851 
1852 	if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
1853 		/*
1854 		 * If the packet is for us, set the packets source as the
1855 		 * bridge, and return the packet back to ifnet.if_input for
1856 		 * local processing.
1857 		 */
1858 		KASSERT(bifp->if_bridge == NULL,
1859 			("loop created in bridge_input"));
1860 		new_ifp = bifp;
1861 		goto out;
1862 	}
1863 
1864 	/*
1865 	 * Tap all packets arriving on the bridge, no matter if
1866 	 * they are local destinations or not.  In is in.
1867 	 */
1868 	BPF_MTAP(bifp, m);
1869 
1870 	bif = bridge_lookup_member_if(sc, ifp);
1871 	if (bif == NULL)
1872 		goto out;
1873 
1874 	bridge_span(sc, m);
1875 
1876 	if (m->m_flags & (M_BCAST | M_MCAST)) {
1877 		/* Tap off 802.1D packets; they do not get forwarded. */
1878 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
1879 		    ETHER_ADDR_LEN) == 0) {
1880 			m = bstp_input(sc, bif, m);
1881 			KASSERT(m == NULL,
1882 				("attempt to deliver 802.1D packet\n"));
1883 			goto out;
1884 		}
1885 
1886 		if (bif->bif_flags & IFBIF_STP) {
1887 			switch (bif->bif_state) {
1888 			case BSTP_IFSTATE_BLOCKING:
1889 			case BSTP_IFSTATE_LISTENING:
1890 			case BSTP_IFSTATE_DISABLED:
1891 				goto out;
1892 			}
1893 		}
1894 
1895 		/*
1896 		 * Make a deep copy of the packet and enqueue the copy
1897 		 * for bridge processing; return the original packet for
1898 		 * local processing.
1899 		 */
1900 		mc = m_dup(m, MB_DONTWAIT);
1901 		if (mc == NULL)
1902 			goto out;
1903 
1904 		bridge_forward(sc, mc);
1905 
1906 		/*
1907 		 * Reinject the mbuf as arriving on the bridge so we have a
1908 		 * chance at claiming multicast packets. We can not loop back
1909 		 * here from ether_input as a bridge is never a member of a
1910 		 * bridge.
1911 		 */
1912 		KASSERT(bifp->if_bridge == NULL,
1913 			("loop created in bridge_input"));
1914 		mc2 = m_dup(m, MB_DONTWAIT);
1915 #ifdef notyet
1916 		if (mc2 != NULL) {
1917 			/* Keep the layer3 header aligned */
1918 			int i = min(mc2->m_pkthdr.len, max_protohdr);
1919 			mc2 = m_copyup(mc2, i, ETHER_ALIGN);
1920 		}
1921 #endif
1922 		if (mc2 != NULL) {
1923 			mc2->m_pkthdr.rcvif = bifp;
1924 			bifp->if_ipackets++;
1925 			bifp->if_input(bifp, mc2);
1926 		}
1927 
1928 		/* Return the original packet for local processing. */
1929 		goto out;
1930 	}
1931 
1932 	if (bif->bif_flags & IFBIF_STP) {
1933 		switch (bif->bif_state) {
1934 		case BSTP_IFSTATE_BLOCKING:
1935 		case BSTP_IFSTATE_LISTENING:
1936 		case BSTP_IFSTATE_DISABLED:
1937 			goto out;
1938 		}
1939 	}
1940 
1941 	/*
1942 	 * Unicast.  Make sure it's not for us.
1943 	 */
1944 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1945 		if (bif->bif_ifp->if_type != IFT_ETHER)
1946 			continue;
1947 
1948 		/* It is destined for us. */
1949 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
1950 		    ETHER_ADDR_LEN) == 0) {
1951 			if (bif->bif_flags & IFBIF_LEARNING) {
1952 				bridge_rtupdate(sc,
1953 				    eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1954 			}
1955 
1956 			if (bif->bif_ifp != ifp) {
1957 				/* XXX loop prevention */
1958 				m->m_flags |= M_PROTO1;
1959 				new_ifp = bif->bif_ifp;
1960 			}
1961 			goto out;
1962 		}
1963 
1964 		/* We just received a packet that we sent out. */
1965 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
1966 		    ETHER_ADDR_LEN) == 0) {
1967 			m_freem(m);
1968 			m = NULL;
1969 			goto out;
1970 		}
1971 	}
1972 
1973 	/* Perform the bridge forwarding function. */
1974 	bridge_forward(sc, m);
1975 	m = NULL;
1976 out:
1977 	lwkt_serialize_exit(bifp->if_serializer);
1978 
1979 	if (new_ifp != NULL) {
1980 		lwkt_serialize_enter(new_ifp->if_serializer);
1981 
1982 		m->m_pkthdr.rcvif = new_ifp;
1983 		new_ifp->if_ipackets++;
1984 		new_ifp->if_input(new_ifp, m);
1985 		m = NULL;
1986 
1987 		lwkt_serialize_exit(new_ifp->if_serializer);
1988 	}
1989 	return (m);
1990 }
1991 
1992 /*
1993  * bridge_broadcast:
1994  *
1995  *	Send a frame to all interfaces that are members of
1996  *	the bridge, except for the one on which the packet
1997  *	arrived.
1998  */
1999 static void
2000 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2001     struct mbuf *m, int runfilt)
2002 {
2003 	struct bridge_iflist *bif;
2004 	struct mbuf *mc;
2005 	struct ifnet *dst_if, *bifp;
2006 	int used = 0;
2007 
2008 	bifp = sc->sc_ifp;
2009 
2010 	ASSERT_SERIALIZED(bifp->if_serializer);
2011 
2012 	/* run the packet filter */
2013 	if (runfilt && (inet_pfil_hook.ph_hashooks > 0
2014 #ifdef INET6
2015 	    || inet6_pfil_hook.ph_hashooks > 0
2016 #endif
2017 	    )) {
2018 		lwkt_serialize_exit(bifp->if_serializer);
2019 
2020 		/* Filter on the bridge interface before broadcasting */
2021 
2022 		if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
2023 			goto filt;
2024 		if (m == NULL)
2025 			goto filt;
2026 
2027 		if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
2028 			m = NULL;
2029 filt:
2030 		lwkt_serialize_enter(bifp->if_serializer);
2031 		if (m == NULL)
2032 			return;
2033 	}
2034 
2035 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2036 		dst_if = bif->bif_ifp;
2037 		if (dst_if == src_if)
2038 			continue;
2039 
2040 		if (bif->bif_flags & IFBIF_STP) {
2041 			switch (bif->bif_state) {
2042 			case BSTP_IFSTATE_BLOCKING:
2043 			case BSTP_IFSTATE_DISABLED:
2044 				continue;
2045 			}
2046 		}
2047 
2048 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2049 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2050 			continue;
2051 
2052 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
2053 			continue;
2054 
2055 		if (LIST_NEXT(bif, bif_next) == NULL) {
2056 			mc = m;
2057 			used = 1;
2058 		} else {
2059 			mc = m_copypacket(m, MB_DONTWAIT);
2060 			if (mc == NULL) {
2061 				sc->sc_ifp->if_oerrors++;
2062 				continue;
2063 			}
2064 		}
2065 		bridge_pfil_enqueue(dst_if, mc, runfilt);
2066 	}
2067 	if (used == 0)
2068 		m_freem(m);
2069 }
2070 
2071 /*
2072  * bridge_span:
2073  *
2074  *	Duplicate a packet out one or more interfaces that are in span mode,
2075  *	the original mbuf is unmodified.
2076  */
2077 static void
2078 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2079 {
2080 	struct bridge_iflist *bif;
2081 	struct ifnet *dst_if;
2082 	struct mbuf *mc;
2083 
2084 	if (LIST_EMPTY(&sc->sc_spanlist))
2085 		return;
2086 
2087 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2088 		dst_if = bif->bif_ifp;
2089 
2090 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
2091 			continue;
2092 
2093 		mc = m_copypacket(m, MB_DONTWAIT);
2094 		if (mc == NULL) {
2095 			sc->sc_ifp->if_oerrors++;
2096 			continue;
2097 		}
2098 
2099 		bridge_enqueue(dst_if, mc);
2100 	}
2101 }
2102 
2103 /*
2104  * bridge_rtupdate:
2105  *
2106  *	Add a bridge routing entry.
2107  *	Can be called from interrupt context.
2108  */
2109 static int
2110 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2111     struct ifnet *dst_if, int setflags, uint8_t flags)
2112 {
2113 	struct bridge_rtnode *brt;
2114 	int error;
2115 
2116 	/*
2117 	 * A route for this destination might already exist.  If so,
2118 	 * update it, otherwise create a new one.
2119 	 */
2120 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2121 		if (sc->sc_brtcnt >= sc->sc_brtmax)
2122 			return (ENOSPC);
2123 
2124 		/*
2125 		 * Allocate a new bridge forwarding node, and
2126 		 * initialize the expiration time and Ethernet
2127 		 * address.
2128 		 */
2129 		brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
2130 			      M_INTNOWAIT|M_ZERO);
2131 		if (brt == NULL)
2132 			return (ENOMEM);
2133 
2134 		brt->brt_flags = IFBAF_DYNAMIC;
2135 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2136 
2137 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2138 			kfree(brt, M_DEVBUF);
2139 			return (error);
2140 		}
2141 	}
2142 
2143 	if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2144 		brt->brt_ifp = dst_if;
2145 	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2146 		brt->brt_expire = time_second + sc->sc_brttimeout;
2147 	if (setflags)
2148 		brt->brt_flags = flags;
2149 
2150 	return (0);
2151 }
2152 
2153 /*
2154  * bridge_rtlookup:
2155  *
2156  *	Lookup the destination interface for an address.
2157  */
2158 static struct ifnet *
2159 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2160 {
2161 	struct bridge_rtnode *brt;
2162 
2163 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2164 		return (NULL);
2165 
2166 	return (brt->brt_ifp);
2167 }
2168 
2169 /*
2170  * bridge_rttrim:
2171  *
2172  *	Trim the routine table so that we have a number
2173  *	of routing entries less than or equal to the
2174  *	maximum number.
2175  */
2176 static void
2177 bridge_rttrim(struct bridge_softc *sc)
2178 {
2179 	struct bridge_rtnode *brt, *nbrt;
2180 
2181 	/* Make sure we actually need to do this. */
2182 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2183 		return;
2184 
2185 	/* Force an aging cycle; this might trim enough addresses. */
2186 	bridge_rtage(sc);
2187 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2188 		return;
2189 
2190 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2191 		nbrt = LIST_NEXT(brt, brt_list);
2192 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2193 			bridge_rtnode_destroy(sc, brt);
2194 			if (sc->sc_brtcnt <= sc->sc_brtmax)
2195 				return;
2196 		}
2197 	}
2198 }
2199 
2200 /*
2201  * bridge_timer:
2202  *
2203  *	Aging timer for the bridge.
2204  */
2205 static void
2206 bridge_timer(void *arg)
2207 {
2208 	struct bridge_softc *sc = arg;
2209 
2210 	lwkt_serialize_enter(sc->sc_ifp->if_serializer);
2211 
2212 	bridge_rtage(sc);
2213 
2214 	if (sc->sc_ifp->if_flags & IFF_RUNNING)
2215 		callout_reset(&sc->sc_brcallout,
2216 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
2217 
2218 	lwkt_serialize_exit(sc->sc_ifp->if_serializer);
2219 }
2220 
2221 /*
2222  * bridge_rtage:
2223  *
2224  *	Perform an aging cycle.
2225  */
2226 static void
2227 bridge_rtage(struct bridge_softc *sc)
2228 {
2229 	struct bridge_rtnode *brt, *nbrt;
2230 
2231 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2232 		nbrt = LIST_NEXT(brt, brt_list);
2233 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2234 			if (time_second >= brt->brt_expire)
2235 				bridge_rtnode_destroy(sc, brt);
2236 		}
2237 	}
2238 }
2239 
2240 /*
2241  * bridge_rtflush:
2242  *
2243  *	Remove all dynamic addresses from the bridge.
2244  */
2245 static void
2246 bridge_rtflush(struct bridge_softc *sc, int full)
2247 {
2248 	struct bridge_rtnode *brt, *nbrt;
2249 
2250 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2251 		nbrt = LIST_NEXT(brt, brt_list);
2252 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2253 			bridge_rtnode_destroy(sc, brt);
2254 	}
2255 }
2256 
2257 /*
2258  * bridge_rtdaddr:
2259  *
2260  *	Remove an address from the table.
2261  */
2262 static int
2263 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2264 {
2265 	struct bridge_rtnode *brt;
2266 
2267 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2268 		return (ENOENT);
2269 
2270 	bridge_rtnode_destroy(sc, brt);
2271 	return (0);
2272 }
2273 
2274 /*
2275  * bridge_rtdelete:
2276  *
2277  *	Delete routes to a speicifc member interface.
2278  */
2279 void
2280 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2281 {
2282 	struct bridge_rtnode *brt, *nbrt;
2283 
2284 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2285 		nbrt = LIST_NEXT(brt, brt_list);
2286 		if (brt->brt_ifp == ifp && (full ||
2287 			    (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2288 			bridge_rtnode_destroy(sc, brt);
2289 	}
2290 }
2291 
2292 /*
2293  * bridge_rtable_init:
2294  *
2295  *	Initialize the route table for this bridge.
2296  */
2297 static int
2298 bridge_rtable_init(struct bridge_softc *sc)
2299 {
2300 	int i;
2301 
2302 	sc->sc_rthash = kmalloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2303 	    M_DEVBUF, M_WAITOK);
2304 
2305 	for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2306 		LIST_INIT(&sc->sc_rthash[i]);
2307 
2308 	sc->sc_rthash_key = karc4random();
2309 
2310 	LIST_INIT(&sc->sc_rtlist);
2311 
2312 	return (0);
2313 }
2314 
2315 /*
2316  * bridge_rtable_fini:
2317  *
2318  *	Deconstruct the route table for this bridge.
2319  */
2320 static void
2321 bridge_rtable_fini(struct bridge_softc *sc)
2322 {
2323 
2324 	kfree(sc->sc_rthash, M_DEVBUF);
2325 }
2326 
2327 /*
2328  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2329  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2330  */
2331 #define	mix(a, b, c)							\
2332 do {									\
2333 	a -= b; a -= c; a ^= (c >> 13);					\
2334 	b -= c; b -= a; b ^= (a << 8);					\
2335 	c -= a; c -= b; c ^= (b >> 13);					\
2336 	a -= b; a -= c; a ^= (c >> 12);					\
2337 	b -= c; b -= a; b ^= (a << 16);					\
2338 	c -= a; c -= b; c ^= (b >> 5);					\
2339 	a -= b; a -= c; a ^= (c >> 3);					\
2340 	b -= c; b -= a; b ^= (a << 10);					\
2341 	c -= a; c -= b; c ^= (b >> 15);					\
2342 } while (/*CONSTCOND*/0)
2343 
2344 static __inline uint32_t
2345 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2346 {
2347 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2348 
2349 	b += addr[5] << 8;
2350 	b += addr[4];
2351 	a += addr[3] << 24;
2352 	a += addr[2] << 16;
2353 	a += addr[1] << 8;
2354 	a += addr[0];
2355 
2356 	mix(a, b, c);
2357 
2358 	return (c & BRIDGE_RTHASH_MASK);
2359 }
2360 
2361 #undef mix
2362 
2363 static int
2364 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2365 {
2366 	int i, d;
2367 
2368 	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2369 		d = ((int)a[i]) - ((int)b[i]);
2370 	}
2371 
2372 	return (d);
2373 }
2374 
2375 /*
2376  * bridge_rtnode_lookup:
2377  *
2378  *	Look up a bridge route node for the specified destination.
2379  */
2380 static struct bridge_rtnode *
2381 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2382 {
2383 	struct bridge_rtnode *brt;
2384 	uint32_t hash;
2385 	int dir;
2386 
2387 	hash = bridge_rthash(sc, addr);
2388 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2389 		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2390 		if (dir == 0)
2391 			return (brt);
2392 		if (dir > 0)
2393 			return (NULL);
2394 	}
2395 
2396 	return (NULL);
2397 }
2398 
2399 /*
2400  * bridge_rtnode_insert:
2401  *
2402  *	Insert the specified bridge node into the route table.  We
2403  *	assume the entry is not already in the table.
2404  */
2405 static int
2406 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2407 {
2408 	struct bridge_rtnode *lbrt;
2409 	uint32_t hash;
2410 	int dir;
2411 
2412 	hash = bridge_rthash(sc, brt->brt_addr);
2413 
2414 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2415 	if (lbrt == NULL) {
2416 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2417 		goto out;
2418 	}
2419 
2420 	do {
2421 		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2422 		if (dir == 0)
2423 			return (EEXIST);
2424 		if (dir > 0) {
2425 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2426 			goto out;
2427 		}
2428 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2429 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2430 			goto out;
2431 		}
2432 		lbrt = LIST_NEXT(lbrt, brt_hash);
2433 	} while (lbrt != NULL);
2434 
2435 #ifdef DIAGNOSTIC
2436 	panic("bridge_rtnode_insert: impossible");
2437 #endif
2438 
2439 out:
2440 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2441 	sc->sc_brtcnt++;
2442 
2443 	return (0);
2444 }
2445 
2446 /*
2447  * bridge_rtnode_destroy:
2448  *
2449  *	Destroy a bridge rtnode.
2450  */
2451 static void
2452 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2453 {
2454 
2455 	LIST_REMOVE(brt, brt_hash);
2456 
2457 	LIST_REMOVE(brt, brt_list);
2458 	sc->sc_brtcnt--;
2459 	kfree(brt, M_DEVBUF);
2460 }
2461 
2462 /*
2463  * Send bridge packets through pfil if they are one of the types pfil can deal
2464  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2465  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2466  * that interface.
2467  */
2468 static int
2469 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2470 {
2471 	int snap, error, i, hlen;
2472 	struct ether_header *eh1, eh2;
2473 	struct ip *ip;
2474 	struct llc llc1;
2475 	u_int16_t ether_type;
2476 
2477 	snap = 0;
2478 	error = -1;	/* Default error if not error == 0 */
2479 
2480 	if (pfil_bridge == 0 && pfil_member == 0)
2481 		return (0); /* filtering is disabled */
2482 
2483 	i = min((*mp)->m_pkthdr.len, max_protohdr);
2484 	if ((*mp)->m_len < i) {
2485 	    *mp = m_pullup(*mp, i);
2486 	    if (*mp == NULL) {
2487 		kprintf("%s: m_pullup failed\n", __func__);
2488 		return (-1);
2489 	    }
2490 	}
2491 
2492 	eh1 = mtod(*mp, struct ether_header *);
2493 	ether_type = ntohs(eh1->ether_type);
2494 
2495 	/*
2496 	 * Check for SNAP/LLC.
2497 	 */
2498 	if (ether_type < ETHERMTU) {
2499 		struct llc *llc2 = (struct llc *)(eh1 + 1);
2500 
2501 		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2502 		    llc2->llc_dsap == LLC_SNAP_LSAP &&
2503 		    llc2->llc_ssap == LLC_SNAP_LSAP &&
2504 		    llc2->llc_control == LLC_UI) {
2505 			ether_type = htons(llc2->llc_un.type_snap.ether_type);
2506 			snap = 1;
2507 		}
2508 	}
2509 
2510 	/*
2511 	 * If we're trying to filter bridge traffic, don't look at anything
2512 	 * other than IP and ARP traffic.  If the filter doesn't understand
2513 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
2514 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
2515 	 * but of course we don't have an AppleTalk filter to begin with.
2516 	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
2517 	 * ARP traffic.)
2518 	 */
2519 	switch (ether_type) {
2520 		case ETHERTYPE_ARP:
2521 		case ETHERTYPE_REVARP:
2522 			return (0); /* Automatically pass */
2523 		case ETHERTYPE_IP:
2524 #ifdef INET6
2525 		case ETHERTYPE_IPV6:
2526 #endif /* INET6 */
2527 			break;
2528 		default:
2529 			/*
2530 			 * Check to see if the user wants to pass non-ip
2531 			 * packets, these will not be checked by pfil(9) and
2532 			 * passed unconditionally so the default is to drop.
2533 			 */
2534 			if (pfil_onlyip)
2535 				goto bad;
2536 	}
2537 
2538 	/* Strip off the Ethernet header and keep a copy. */
2539 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2540 	m_adj(*mp, ETHER_HDR_LEN);
2541 
2542 	/* Strip off snap header, if present */
2543 	if (snap) {
2544 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2545 		m_adj(*mp, sizeof(struct llc));
2546 	}
2547 
2548 	/*
2549 	 * Check the IP header for alignment and errors
2550 	 */
2551 	if (dir == PFIL_IN) {
2552 		switch (ether_type) {
2553 			case ETHERTYPE_IP:
2554 				error = bridge_ip_checkbasic(mp);
2555 				break;
2556 #ifdef INET6
2557 			case ETHERTYPE_IPV6:
2558 				error = bridge_ip6_checkbasic(mp);
2559 				break;
2560 #endif /* INET6 */
2561 			default:
2562 				error = 0;
2563 		}
2564 		if (error)
2565 			goto bad;
2566 	}
2567 
2568 	error = 0;
2569 
2570 	/*
2571 	 * Run the packet through pfil
2572 	 */
2573 	switch (ether_type)
2574 	{
2575 	case ETHERTYPE_IP :
2576 		/*
2577 		 * before calling the firewall, swap fields the same as
2578 		 * IP does. here we assume the header is contiguous
2579 		 */
2580 		ip = mtod(*mp, struct ip *);
2581 
2582 		ip->ip_len = ntohs(ip->ip_len);
2583 		ip->ip_off = ntohs(ip->ip_off);
2584 
2585 		/*
2586 		 * Run pfil on the member interface and the bridge, both can
2587 		 * be skipped by clearing pfil_member or pfil_bridge.
2588 		 *
2589 		 * Keep the order:
2590 		 *   in_if -> bridge_if -> out_if
2591 		 */
2592 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2593 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2594 					dir);
2595 
2596 		if (*mp == NULL || error != 0) /* filter may consume */
2597 			break;
2598 
2599 		if (pfil_member && ifp != NULL)
2600 			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2601 					dir);
2602 
2603 		if (*mp == NULL || error != 0) /* filter may consume */
2604 			break;
2605 
2606 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2607 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2608 					dir);
2609 
2610 		if (*mp == NULL || error != 0) /* filter may consume */
2611 			break;
2612 
2613 		/* check if we need to fragment the packet */
2614 		if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2615 			i = (*mp)->m_pkthdr.len;
2616 			if (i > ifp->if_mtu) {
2617 				error = bridge_fragment(ifp, *mp, &eh2, snap,
2618 					    &llc1);
2619 				return (error);
2620 			}
2621 		}
2622 
2623 		/* Recalculate the ip checksum and restore byte ordering */
2624 		ip = mtod(*mp, struct ip *);
2625 		hlen = ip->ip_hl << 2;
2626 		if (hlen < sizeof(struct ip))
2627 			goto bad;
2628 		if (hlen > (*mp)->m_len) {
2629 			if ((*mp = m_pullup(*mp, hlen)) == 0)
2630 				goto bad;
2631 			ip = mtod(*mp, struct ip *);
2632 			if (ip == NULL)
2633 				goto bad;
2634 		}
2635 		ip->ip_len = htons(ip->ip_len);
2636 		ip->ip_off = htons(ip->ip_off);
2637 		ip->ip_sum = 0;
2638 		if (hlen == sizeof(struct ip))
2639 			ip->ip_sum = in_cksum_hdr(ip);
2640 		else
2641 			ip->ip_sum = in_cksum(*mp, hlen);
2642 
2643 		break;
2644 #ifdef INET6
2645 	case ETHERTYPE_IPV6 :
2646 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2647 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2648 					dir);
2649 
2650 		if (*mp == NULL || error != 0) /* filter may consume */
2651 			break;
2652 
2653 		if (pfil_member && ifp != NULL)
2654 			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2655 					dir);
2656 
2657 		if (*mp == NULL || error != 0) /* filter may consume */
2658 			break;
2659 
2660 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2661 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2662 					dir);
2663 		break;
2664 #endif
2665 	default :
2666 		error = 0;
2667 		break;
2668 	}
2669 
2670 	if (*mp == NULL)
2671 		return (error);
2672 	if (error != 0)
2673 		goto bad;
2674 
2675 	error = -1;
2676 
2677 	/*
2678 	 * Finally, put everything back the way it was and return
2679 	 */
2680 	if (snap) {
2681 		M_PREPEND(*mp, sizeof(struct llc), MB_DONTWAIT);
2682 		if (*mp == NULL)
2683 			return (error);
2684 		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2685 	}
2686 
2687 	M_PREPEND(*mp, ETHER_HDR_LEN, MB_DONTWAIT);
2688 	if (*mp == NULL)
2689 		return (error);
2690 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2691 
2692 	return (0);
2693 
2694 bad:
2695 	m_freem(*mp);
2696 	*mp = NULL;
2697 	return (error);
2698 }
2699 
2700 /*
2701  * Perform basic checks on header size since
2702  * pfil assumes ip_input has already processed
2703  * it for it.  Cut-and-pasted from ip_input.c.
2704  * Given how simple the IPv6 version is,
2705  * does the IPv4 version really need to be
2706  * this complicated?
2707  *
2708  * XXX Should we update ipstat here, or not?
2709  * XXX Right now we update ipstat but not
2710  * XXX csum_counter.
2711  */
2712 static int
2713 bridge_ip_checkbasic(struct mbuf **mp)
2714 {
2715 	struct mbuf *m = *mp;
2716 	struct ip *ip;
2717 	int len, hlen;
2718 	u_short sum;
2719 
2720 	if (*mp == NULL)
2721 		return (-1);
2722 #if notyet
2723 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2724 		if ((m = m_copyup(m, sizeof(struct ip),
2725 			(max_linkhdr + 3) & ~3)) == NULL) {
2726 			/* XXXJRT new stat, please */
2727 			ipstat.ips_toosmall++;
2728 			goto bad;
2729 		}
2730 	} else
2731 #endif
2732 #ifndef __predict_false
2733 #define __predict_false(x) x
2734 #endif
2735 	 if (__predict_false(m->m_len < sizeof (struct ip))) {
2736 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2737 			ipstat.ips_toosmall++;
2738 			goto bad;
2739 		}
2740 	}
2741 	ip = mtod(m, struct ip *);
2742 	if (ip == NULL) goto bad;
2743 
2744 	if (ip->ip_v != IPVERSION) {
2745 		ipstat.ips_badvers++;
2746 		goto bad;
2747 	}
2748 	hlen = ip->ip_hl << 2;
2749 	if (hlen < sizeof(struct ip)) { /* minimum header length */
2750 		ipstat.ips_badhlen++;
2751 		goto bad;
2752 	}
2753 	if (hlen > m->m_len) {
2754 		if ((m = m_pullup(m, hlen)) == 0) {
2755 			ipstat.ips_badhlen++;
2756 			goto bad;
2757 		}
2758 		ip = mtod(m, struct ip *);
2759 		if (ip == NULL) goto bad;
2760 	}
2761 
2762 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
2763 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
2764 	} else {
2765 		if (hlen == sizeof(struct ip)) {
2766 			sum = in_cksum_hdr(ip);
2767 		} else {
2768 			sum = in_cksum(m, hlen);
2769 		}
2770 	}
2771 	if (sum) {
2772 		ipstat.ips_badsum++;
2773 		goto bad;
2774 	}
2775 
2776 	/* Retrieve the packet length. */
2777 	len = ntohs(ip->ip_len);
2778 
2779 	/*
2780 	 * Check for additional length bogosity
2781 	 */
2782 	if (len < hlen) {
2783 		ipstat.ips_badlen++;
2784 		goto bad;
2785 	}
2786 
2787 	/*
2788 	 * Check that the amount of data in the buffers
2789 	 * is as at least much as the IP header would have us expect.
2790 	 * Drop packet if shorter than we expect.
2791 	 */
2792 	if (m->m_pkthdr.len < len) {
2793 		ipstat.ips_tooshort++;
2794 		goto bad;
2795 	}
2796 
2797 	/* Checks out, proceed */
2798 	*mp = m;
2799 	return (0);
2800 
2801 bad:
2802 	*mp = m;
2803 	return (-1);
2804 }
2805 
2806 #ifdef INET6
2807 /*
2808  * Same as above, but for IPv6.
2809  * Cut-and-pasted from ip6_input.c.
2810  * XXX Should we update ip6stat, or not?
2811  */
2812 static int
2813 bridge_ip6_checkbasic(struct mbuf **mp)
2814 {
2815 	struct mbuf *m = *mp;
2816 	struct ip6_hdr *ip6;
2817 
2818 	/*
2819 	 * If the IPv6 header is not aligned, slurp it up into a new
2820 	 * mbuf with space for link headers, in the event we forward
2821 	 * it.  Otherwise, if it is aligned, make sure the entire base
2822 	 * IPv6 header is in the first mbuf of the chain.
2823 	 */
2824 #if notyet
2825 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2826 		struct ifnet *inifp = m->m_pkthdr.rcvif;
2827 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2828 			    (max_linkhdr + 3) & ~3)) == NULL) {
2829 			/* XXXJRT new stat, please */
2830 			ip6stat.ip6s_toosmall++;
2831 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2832 			goto bad;
2833 		}
2834 	} else
2835 #endif
2836 	if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2837 		struct ifnet *inifp = m->m_pkthdr.rcvif;
2838 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2839 			ip6stat.ip6s_toosmall++;
2840 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2841 			goto bad;
2842 		}
2843 	}
2844 
2845 	ip6 = mtod(m, struct ip6_hdr *);
2846 
2847 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2848 		ip6stat.ip6s_badvers++;
2849 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2850 		goto bad;
2851 	}
2852 
2853 	/* Checks out, proceed */
2854 	*mp = m;
2855 	return (0);
2856 
2857 bad:
2858 	*mp = m;
2859 	return (-1);
2860 }
2861 #endif /* INET6 */
2862 
2863 /*
2864  * bridge_fragment:
2865  *
2866  *	Return a fragmented mbuf chain.
2867  */
2868 static int
2869 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
2870     int snap, struct llc *llc)
2871 {
2872 	struct mbuf *m0;
2873 	struct ip *ip;
2874 	int error = -1;
2875 
2876 	if (m->m_len < sizeof(struct ip) &&
2877 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
2878 		goto out;
2879 	ip = mtod(m, struct ip *);
2880 
2881 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
2882 		    CSUM_DELAY_IP);
2883 	if (error)
2884 		goto out;
2885 
2886 	/* walk the chain and re-add the Ethernet header */
2887 	for (m0 = m; m0; m0 = m0->m_nextpkt) {
2888 		if (error == 0) {
2889 			if (snap) {
2890 				M_PREPEND(m0, sizeof(struct llc), MB_DONTWAIT);
2891 				if (m0 == NULL) {
2892 					error = ENOBUFS;
2893 					continue;
2894 				}
2895 				bcopy(llc, mtod(m0, caddr_t),
2896 				    sizeof(struct llc));
2897 			}
2898 			M_PREPEND(m0, ETHER_HDR_LEN, MB_DONTWAIT);
2899 			if (m0 == NULL) {
2900 				error = ENOBUFS;
2901 				continue;
2902 			}
2903 			bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
2904 		} else
2905 			m_freem(m);
2906 	}
2907 
2908 	if (error == 0)
2909 		ipstat.ips_fragmented++;
2910 
2911 	return (error);
2912 
2913 out:
2914 	if (m != NULL)
2915 		m_freem(m);
2916 	return (error);
2917 }
2918 
2919 static void
2920 bridge_enqueue_handler(struct netmsg *nmsg)
2921 {
2922 	struct netmsg_packet *nmp;
2923 	struct ifnet *dst_ifp;
2924 	struct mbuf *m;
2925 
2926 	nmp = (struct netmsg_packet *)nmsg;
2927 	m = nmp->nm_packet;
2928 	dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2929 
2930 	bridge_handoff_notags(dst_ifp, m);
2931 }
2932 
2933 static void
2934 bridge_pfil_enqueue_handler(struct netmsg *nmsg)
2935 {
2936 	struct netmsg_packet *nmp;
2937 	struct ifnet *dst_ifp;
2938 	struct mbuf *m;
2939 
2940 	nmp = (struct netmsg_packet *)nmsg;
2941 	m = nmp->nm_packet;
2942 	dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2943 
2944 	/*
2945 	 * Filter on the output interface. Pass a NULL bridge interface
2946 	 * pointer so we do not redundantly filter on the bridge for
2947 	 * each interface we broadcast on.
2948 	 */
2949 	if (inet_pfil_hook.ph_hashooks > 0
2950 #ifdef INET6
2951 	    || inet6_pfil_hook.ph_hashooks > 0
2952 #endif
2953 	    ) {
2954 		if (bridge_pfil(&m, NULL, dst_ifp, PFIL_OUT) != 0)
2955 			return;
2956 		if (m == NULL)
2957 			return;
2958 	}
2959 	bridge_handoff_notags(dst_ifp, m);
2960 }
2961 
2962 static void
2963 bridge_handoff(struct ifnet *dst_ifp, struct mbuf *m)
2964 {
2965 	while (m->m_type == MT_TAG) {
2966 		/* XXX see ether_output_frame for full rules check */
2967 		m = m->m_next;
2968 	}
2969 	bridge_handoff_notags(dst_ifp, m);
2970 }
2971 
2972 static void
2973 bridge_handoff_notags(struct ifnet *dst_ifp, struct mbuf *m)
2974 {
2975 	struct mbuf *m0;
2976 
2977 	KKASSERT(m->m_type != MT_TAG);
2978 
2979 	lwkt_serialize_enter(dst_ifp->if_serializer);
2980 
2981 	/* We may be sending a fragment so traverse the mbuf */
2982 	for (; m; m = m0) {
2983 		struct altq_pktattr pktattr;
2984 
2985 		m0 = m->m_nextpkt;
2986 		m->m_nextpkt = NULL;
2987 
2988 		if (ifq_is_enabled(&dst_ifp->if_snd))
2989 			altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
2990 
2991 		ifq_handoff(dst_ifp, m, &pktattr);
2992 	}
2993 
2994 	lwkt_serialize_exit(dst_ifp->if_serializer);
2995 }
2996 
2997 struct netmsg_brgctl {
2998 	struct netmsg		bc_nmsg;
2999 	bridge_ctl_t		bc_func;
3000 	struct bridge_softc	*bc_sc;
3001 	void			*bc_arg;
3002 };
3003 
3004 static void
3005 bridge_control_dispatch(struct netmsg *nmsg)
3006 {
3007 	struct netmsg_brgctl *bc_msg = (struct netmsg_brgctl *)nmsg;
3008 	struct ifnet *bifp = bc_msg->bc_sc->sc_ifp;
3009 	int error;
3010 
3011 	lwkt_serialize_enter(bifp->if_serializer);
3012 	error = bc_msg->bc_func(bc_msg->bc_sc, bc_msg->bc_arg);
3013 	lwkt_serialize_exit(bifp->if_serializer);
3014 
3015 	lwkt_replymsg(&nmsg->nm_lmsg, error);
3016 }
3017 
3018 static int
3019 bridge_control(struct bridge_softc *sc, u_long cmd,
3020 	       bridge_ctl_t bc_func, void *bc_arg)
3021 {
3022 	struct ifnet *bifp = sc->sc_ifp;
3023 	struct netmsg_brgctl bc_msg;
3024 	struct netmsg *nmsg;
3025 	int error;
3026 
3027 	ASSERT_SERIALIZED(bifp->if_serializer);
3028 
3029 	if (cmd == SIOCGDRVSPEC) {
3030 		/*
3031 		 * Don't dispatch 'get' ioctl to netisr0;
3032 		 * there are copyouts down deep inside
3033 		 * specific bridge ioctl functions.
3034 		 */
3035 		return bc_func(sc, bc_arg);
3036 	}
3037 
3038 	bzero(&bc_msg, sizeof(bc_msg));
3039 	nmsg = &bc_msg.bc_nmsg;
3040 
3041 	netmsg_init(nmsg, &curthread->td_msgport, 0, bridge_control_dispatch);
3042 	bc_msg.bc_func = bc_func;
3043 	bc_msg.bc_sc = sc;
3044 	bc_msg.bc_arg = bc_arg;
3045 
3046 	lwkt_serialize_exit(bifp->if_serializer);
3047 	error = lwkt_domsg(cpu_portfn(0), &nmsg->nm_lmsg, 0);
3048 	lwkt_serialize_enter(bifp->if_serializer);
3049 	return error;
3050 }
3051