1 #include <linux/kernel.h>
2 #include <linux/netdevice.h>
3 #include <linux/rtnetlink.h>
4 #include <linux/slab.h>
5 #include <net/switchdev.h>
7 #include "br_private.h"
9 static inline int br_vlan_cmp(struct rhashtable_compare_arg *arg,
12 const struct net_bridge_vlan *vle = ptr;
13 u16 vid = *(u16 *)arg->key;
15 return vle->vid != vid;
18 static const struct rhashtable_params br_vlan_rht_params = {
19 .head_offset = offsetof(struct net_bridge_vlan, vnode),
20 .key_offset = offsetof(struct net_bridge_vlan, vid),
21 .key_len = sizeof(u16),
24 .max_size = VLAN_N_VID,
25 .obj_cmpfn = br_vlan_cmp,
26 .automatic_shrinking = true,
29 static struct net_bridge_vlan *br_vlan_lookup(struct rhashtable *tbl, u16 vid)
31 return rhashtable_lookup_fast(tbl, &vid, br_vlan_rht_params);
34 static void __vlan_add_pvid(struct net_bridge_vlan_group *vg, u16 vid)
43 static void __vlan_delete_pvid(struct net_bridge_vlan_group *vg, u16 vid)
52 static void __vlan_add_flags(struct net_bridge_vlan *v, u16 flags)
54 struct net_bridge_vlan_group *vg;
56 if (br_vlan_is_master(v))
61 if (flags & BRIDGE_VLAN_INFO_PVID)
62 __vlan_add_pvid(vg, v->vid);
64 __vlan_delete_pvid(vg, v->vid);
66 if (flags & BRIDGE_VLAN_INFO_UNTAGGED)
67 v->flags |= BRIDGE_VLAN_INFO_UNTAGGED;
69 v->flags &= ~BRIDGE_VLAN_INFO_UNTAGGED;
72 static int __vlan_vid_add(struct net_device *dev, struct net_bridge *br,
75 const struct net_device_ops *ops = dev->netdev_ops;
78 /* If driver uses VLAN ndo ops, use 8021q to install vid
79 * on device, otherwise try switchdev ops to install vid.
82 if (ops->ndo_vlan_rx_add_vid) {
83 err = vlan_vid_add(dev, br->vlan_proto, vid);
85 struct switchdev_obj_port_vlan v = {
91 err = switchdev_port_obj_add(dev, SWITCHDEV_OBJ_ID_PORT_VLAN,
93 if (err == -EOPNOTSUPP)
100 static void __vlan_add_list(struct net_bridge_vlan *v)
102 struct list_head *headp, *hpos;
103 struct net_bridge_vlan *vent;
105 headp = br_vlan_is_master(v) ? &v->br->vlgrp->vlan_list :
106 &v->port->vlgrp->vlan_list;
107 list_for_each_prev(hpos, headp) {
108 vent = list_entry(hpos, struct net_bridge_vlan, vlist);
109 if (v->vid < vent->vid)
114 list_add(&v->vlist, hpos);
117 static void __vlan_del_list(struct net_bridge_vlan *v)
122 static int __vlan_vid_del(struct net_device *dev, struct net_bridge *br,
125 const struct net_device_ops *ops = dev->netdev_ops;
128 /* If driver uses VLAN ndo ops, use 8021q to delete vid
129 * on device, otherwise try switchdev ops to delete vid.
132 if (ops->ndo_vlan_rx_kill_vid) {
133 vlan_vid_del(dev, br->vlan_proto, vid);
135 struct switchdev_obj_port_vlan v = {
140 err = switchdev_port_obj_del(dev, SWITCHDEV_OBJ_ID_PORT_VLAN,
142 if (err == -EOPNOTSUPP)
149 /* This is the shared VLAN add function which works for both ports and bridge
150 * devices. There are four possible calls to this function in terms of the
152 * 1. vlan is being added on a port (no master flags, global entry exists)
153 * 2. vlan is being added on a bridge (both master and brvlan flags)
154 * 3. vlan is being added on a port, but a global entry didn't exist which
155 * is being created right now (master flag set, brvlan flag unset), the
156 * global entry is used for global per-vlan features, but not for filtering
157 * 4. same as 3 but with both master and brvlan flags set so the entry
158 * will be used for filtering in both the port and the bridge
160 static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
162 struct net_bridge_vlan *masterv = NULL;
163 struct net_bridge_port *p = NULL;
164 struct rhashtable *tbl;
165 struct net_device *dev;
166 struct net_bridge *br;
169 if (br_vlan_is_master(v)) {
172 tbl = &br->vlgrp->vlan_hash;
177 tbl = &p->vlgrp->vlan_hash;
181 u16 master_flags = flags;
183 /* Add VLAN to the device filter if it is supported.
184 * This ensures tagged traffic enters the bridge when
185 * promiscuous mode is disabled by br_manage_promisc().
187 err = __vlan_vid_add(dev, br, v->vid, flags);
191 /* need to work on the master vlan too */
192 if (flags & BRIDGE_VLAN_INFO_MASTER) {
193 master_flags |= BRIDGE_VLAN_INFO_BRENTRY;
194 err = br_vlan_add(br, v->vid, master_flags);
199 masterv = br_vlan_find(br->vlgrp, v->vid);
201 /* missing global ctx, create it now */
202 err = br_vlan_add(br, v->vid, 0);
205 masterv = br_vlan_find(br->vlgrp, v->vid);
208 atomic_inc(&masterv->refcnt);
212 /* Add the dev mac only if it's a usable vlan */
213 if (br_vlan_should_use(v)) {
214 err = br_fdb_insert(br, p, dev->dev_addr, v->vid);
216 br_err(br, "failed insert local address into bridge forwarding table\n");
221 err = rhashtable_lookup_insert_fast(tbl, &v->vnode, br_vlan_rht_params);
226 __vlan_add_flags(v, flags);
227 if (br_vlan_is_master(v)) {
228 if (br_vlan_is_brentry(v))
229 br->vlgrp->num_vlans++;
231 p->vlgrp->num_vlans++;
237 br_fdb_find_delete_local(br, p, br->dev->dev_addr, v->vid);
241 __vlan_vid_del(dev, br, v->vid);
243 atomic_dec(&masterv->refcnt);
251 static int __vlan_del(struct net_bridge_vlan *v)
253 struct net_bridge_vlan *masterv = v;
254 struct net_bridge_vlan_group *vg;
255 struct net_bridge_port *p = NULL;
256 struct net_bridge *br;
259 if (br_vlan_is_master(v)) {
269 __vlan_delete_pvid(vg, v->vid);
271 err = __vlan_vid_del(p->dev, p->br, v->vid);
276 if (br_vlan_is_master(v)) {
277 if (br_vlan_is_brentry(v)) {
278 v->flags &= ~BRIDGE_VLAN_INFO_BRENTRY;
279 br->vlgrp->num_vlans--;
282 p->vlgrp->num_vlans--;
286 rhashtable_remove_fast(&vg->vlan_hash, &v->vnode,
292 if (atomic_dec_and_test(&masterv->refcnt)) {
293 rhashtable_remove_fast(&masterv->br->vlgrp->vlan_hash,
294 &masterv->vnode, br_vlan_rht_params);
295 __vlan_del_list(masterv);
296 kfree_rcu(masterv, rcu);
302 static void __vlan_flush(struct net_bridge_vlan_group *vlgrp)
304 struct net_bridge_vlan *vlan, *tmp;
306 __vlan_delete_pvid(vlgrp, vlgrp->pvid);
307 list_for_each_entry_safe(vlan, tmp, &vlgrp->vlan_list, vlist)
309 rhashtable_destroy(&vlgrp->vlan_hash);
313 struct sk_buff *br_handle_vlan(struct net_bridge *br,
314 struct net_bridge_vlan_group *vg,
317 struct net_bridge_vlan *v;
320 /* If this packet was not filtered at input, let it pass */
321 if (!BR_INPUT_SKB_CB(skb)->vlan_filtered)
324 /* At this point, we know that the frame was filtered and contains
325 * a valid vlan id. If the vlan id has untagged flag set,
326 * send untagged; otherwise, send tagged.
328 br_vlan_get_tag(skb, &vid);
329 v = br_vlan_find(vg, vid);
330 /* Vlan entry must be configured at this point. The
331 * only exception is the bridge is set in promisc mode and the
332 * packet is destined for the bridge device. In this case
333 * pass the packet as is.
335 if (!v || !br_vlan_should_use(v)) {
336 if ((br->dev->flags & IFF_PROMISC) && skb->dev == br->dev) {
343 if (v->flags & BRIDGE_VLAN_INFO_UNTAGGED)
350 /* Called under RCU */
351 static bool __allowed_ingress(struct net_bridge_vlan_group *vg, __be16 proto,
352 struct sk_buff *skb, u16 *vid)
354 const struct net_bridge_vlan *v;
357 BR_INPUT_SKB_CB(skb)->vlan_filtered = true;
358 /* If vlan tx offload is disabled on bridge device and frame was
359 * sent from vlan device on the bridge device, it does not have
360 * HW accelerated vlan tag.
362 if (unlikely(!skb_vlan_tag_present(skb) &&
363 skb->protocol == proto)) {
364 skb = skb_vlan_untag(skb);
369 if (!br_vlan_get_tag(skb, vid)) {
371 if (skb->vlan_proto != proto) {
372 /* Protocol-mismatch, empty out vlan_tci for new tag */
373 skb_push(skb, ETH_HLEN);
374 skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
375 skb_vlan_tag_get(skb));
379 skb_pull(skb, ETH_HLEN);
380 skb_reset_mac_len(skb);
392 u16 pvid = br_get_pvid(vg);
394 /* Frame had a tag with VID 0 or did not have a tag.
395 * See if pvid is set on this port. That tells us which
396 * vlan untagged or priority-tagged traffic belongs to.
401 /* PVID is set on this port. Any untagged or priority-tagged
402 * ingress frame is considered to belong to this vlan.
406 /* Untagged Frame. */
407 __vlan_hwaccel_put_tag(skb, proto, pvid);
409 /* Priority-tagged Frame.
410 * At this point, We know that skb->vlan_tci had
411 * VLAN_TAG_PRESENT bit and its VID field was 0x000.
412 * We update only VID field and preserve PCP field.
414 skb->vlan_tci |= pvid;
419 /* Frame had a valid vlan tag. See if vlan is allowed */
420 v = br_vlan_find(vg, *vid);
421 if (v && br_vlan_should_use(v))
428 bool br_allowed_ingress(const struct net_bridge *br,
429 struct net_bridge_vlan_group *vg, struct sk_buff *skb,
432 /* If VLAN filtering is disabled on the bridge, all packets are
435 if (!br->vlan_enabled) {
436 BR_INPUT_SKB_CB(skb)->vlan_filtered = false;
440 return __allowed_ingress(vg, br->vlan_proto, skb, vid);
443 /* Called under RCU. */
444 bool br_allowed_egress(struct net_bridge_vlan_group *vg,
445 const struct sk_buff *skb)
447 const struct net_bridge_vlan *v;
450 /* If this packet was not filtered at input, let it pass */
451 if (!BR_INPUT_SKB_CB(skb)->vlan_filtered)
454 br_vlan_get_tag(skb, &vid);
455 v = br_vlan_find(vg, vid);
456 if (v && br_vlan_should_use(v))
462 /* Called under RCU */
463 bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
465 struct net_bridge_vlan_group *vg;
466 struct net_bridge *br = p->br;
468 /* If filtering was disabled at input, let it pass. */
469 if (!br->vlan_enabled)
473 if (!vg || !vg->num_vlans)
476 if (!br_vlan_get_tag(skb, vid) && skb->vlan_proto != br->vlan_proto)
480 *vid = br_get_pvid(vg);
487 if (br_vlan_find(vg, *vid))
493 /* Must be protected by RTNL.
494 * Must be called with vid in range from 1 to 4094 inclusive.
496 int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
498 struct net_bridge_vlan *vlan;
503 vlan = br_vlan_find(br->vlgrp, vid);
505 if (!br_vlan_is_brentry(vlan)) {
506 /* Trying to change flags of non-existent bridge vlan */
507 if (!(flags & BRIDGE_VLAN_INFO_BRENTRY))
509 /* It was only kept for port vlans, now make it real */
510 ret = br_fdb_insert(br, NULL, br->dev->dev_addr,
513 br_err(br, "failed insert local address into bridge forwarding table\n");
516 atomic_inc(&vlan->refcnt);
517 vlan->flags |= BRIDGE_VLAN_INFO_BRENTRY;
518 br->vlgrp->num_vlans++;
520 __vlan_add_flags(vlan, flags);
524 vlan = kzalloc(sizeof(*vlan), GFP_KERNEL);
529 vlan->flags = flags | BRIDGE_VLAN_INFO_MASTER;
530 vlan->flags &= ~BRIDGE_VLAN_INFO_PVID;
532 if (flags & BRIDGE_VLAN_INFO_BRENTRY)
533 atomic_set(&vlan->refcnt, 1);
534 ret = __vlan_add(vlan, flags);
541 /* Must be protected by RTNL.
542 * Must be called with vid in range from 1 to 4094 inclusive.
544 int br_vlan_delete(struct net_bridge *br, u16 vid)
546 struct net_bridge_vlan *v;
550 v = br_vlan_find(br->vlgrp, vid);
551 if (!v || !br_vlan_is_brentry(v))
554 br_fdb_find_delete_local(br, NULL, br->dev->dev_addr, vid);
556 return __vlan_del(v);
559 void br_vlan_flush(struct net_bridge *br)
563 __vlan_flush(br_vlan_group(br));
566 struct net_bridge_vlan *br_vlan_find(struct net_bridge_vlan_group *vg, u16 vid)
571 return br_vlan_lookup(&vg->vlan_hash, vid);
574 /* Must be protected by RTNL. */
575 static void recalculate_group_addr(struct net_bridge *br)
577 if (br->group_addr_set)
580 spin_lock_bh(&br->lock);
581 if (!br->vlan_enabled || br->vlan_proto == htons(ETH_P_8021Q)) {
582 /* Bridge Group Address */
583 br->group_addr[5] = 0x00;
584 } else { /* vlan_enabled && ETH_P_8021AD */
585 /* Provider Bridge Group Address */
586 br->group_addr[5] = 0x08;
588 spin_unlock_bh(&br->lock);
591 /* Must be protected by RTNL. */
592 void br_recalculate_fwd_mask(struct net_bridge *br)
594 if (!br->vlan_enabled || br->vlan_proto == htons(ETH_P_8021Q))
595 br->group_fwd_mask_required = BR_GROUPFWD_DEFAULT;
596 else /* vlan_enabled && ETH_P_8021AD */
597 br->group_fwd_mask_required = BR_GROUPFWD_8021AD &
598 ~(1u << br->group_addr[5]);
601 int __br_vlan_filter_toggle(struct net_bridge *br, unsigned long val)
603 if (br->vlan_enabled == val)
606 br->vlan_enabled = val;
607 br_manage_promisc(br);
608 recalculate_group_addr(br);
609 br_recalculate_fwd_mask(br);
614 int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val)
617 return restart_syscall();
619 __br_vlan_filter_toggle(br, val);
625 int __br_vlan_set_proto(struct net_bridge *br, __be16 proto)
628 struct net_bridge_port *p;
629 struct net_bridge_vlan *vlan;
632 if (br->vlan_proto == proto)
635 /* Add VLANs for the new proto to the device filter. */
636 list_for_each_entry(p, &br->port_list, list) {
637 list_for_each_entry(vlan, &p->vlgrp->vlan_list, vlist) {
638 err = vlan_vid_add(p->dev, proto, vlan->vid);
644 oldproto = br->vlan_proto;
645 br->vlan_proto = proto;
647 recalculate_group_addr(br);
648 br_recalculate_fwd_mask(br);
650 /* Delete VLANs for the old proto from the device filter. */
651 list_for_each_entry(p, &br->port_list, list)
652 list_for_each_entry(vlan, &p->vlgrp->vlan_list, vlist)
653 vlan_vid_del(p->dev, oldproto, vlan->vid);
658 list_for_each_entry_continue_reverse(vlan, &p->vlgrp->vlan_list, vlist)
659 vlan_vid_del(p->dev, proto, vlan->vid);
661 list_for_each_entry_continue_reverse(p, &br->port_list, list)
662 list_for_each_entry(vlan, &p->vlgrp->vlan_list, vlist)
663 vlan_vid_del(p->dev, proto, vlan->vid);
668 int br_vlan_set_proto(struct net_bridge *br, unsigned long val)
672 if (val != ETH_P_8021Q && val != ETH_P_8021AD)
673 return -EPROTONOSUPPORT;
676 return restart_syscall();
678 err = __br_vlan_set_proto(br, htons(val));
684 static bool vlan_default_pvid(struct net_bridge_vlan_group *vg, u16 vid)
686 struct net_bridge_vlan *v;
691 v = br_vlan_lookup(&vg->vlan_hash, vid);
692 if (v && br_vlan_should_use(v) &&
693 (v->flags & BRIDGE_VLAN_INFO_UNTAGGED))
699 static void br_vlan_disable_default_pvid(struct net_bridge *br)
701 struct net_bridge_port *p;
702 u16 pvid = br->default_pvid;
704 /* Disable default_pvid on all ports where it is still
707 if (vlan_default_pvid(br->vlgrp, pvid))
708 br_vlan_delete(br, pvid);
710 list_for_each_entry(p, &br->port_list, list) {
711 if (vlan_default_pvid(p->vlgrp, pvid))
712 nbp_vlan_delete(p, pvid);
715 br->default_pvid = 0;
718 static int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid)
720 const struct net_bridge_vlan *pvent;
721 struct net_bridge_port *p;
724 unsigned long *changed;
726 changed = kcalloc(BITS_TO_LONGS(BR_MAX_PORTS), sizeof(unsigned long),
731 old_pvid = br->default_pvid;
733 /* Update default_pvid config only if we do not conflict with
734 * user configuration.
736 pvent = br_vlan_find(br->vlgrp, pvid);
737 if ((!old_pvid || vlan_default_pvid(br->vlgrp, old_pvid)) &&
738 (!pvent || !br_vlan_should_use(pvent))) {
739 err = br_vlan_add(br, pvid,
740 BRIDGE_VLAN_INFO_PVID |
741 BRIDGE_VLAN_INFO_UNTAGGED |
742 BRIDGE_VLAN_INFO_BRENTRY);
745 br_vlan_delete(br, old_pvid);
749 list_for_each_entry(p, &br->port_list, list) {
750 /* Update default_pvid config only if we do not conflict with
751 * user configuration.
754 !vlan_default_pvid(p->vlgrp, old_pvid)) ||
755 br_vlan_find(p->vlgrp, pvid))
758 err = nbp_vlan_add(p, pvid,
759 BRIDGE_VLAN_INFO_PVID |
760 BRIDGE_VLAN_INFO_UNTAGGED);
763 nbp_vlan_delete(p, old_pvid);
764 set_bit(p->port_no, changed);
767 br->default_pvid = pvid;
774 list_for_each_entry_continue_reverse(p, &br->port_list, list) {
775 if (!test_bit(p->port_no, changed))
779 nbp_vlan_add(p, old_pvid,
780 BRIDGE_VLAN_INFO_PVID |
781 BRIDGE_VLAN_INFO_UNTAGGED);
782 nbp_vlan_delete(p, pvid);
785 if (test_bit(0, changed)) {
787 br_vlan_add(br, old_pvid,
788 BRIDGE_VLAN_INFO_PVID |
789 BRIDGE_VLAN_INFO_UNTAGGED |
790 BRIDGE_VLAN_INFO_BRENTRY);
791 br_vlan_delete(br, pvid);
796 int br_vlan_set_default_pvid(struct net_bridge *br, unsigned long val)
801 if (val >= VLAN_VID_MASK)
805 return restart_syscall();
807 if (pvid == br->default_pvid)
810 /* Only allow default pvid change when filtering is disabled */
811 if (br->vlan_enabled) {
812 pr_info_once("Please disable vlan filtering to change default_pvid\n");
818 br_vlan_disable_default_pvid(br);
820 err = __br_vlan_set_default_pvid(br, pvid);
827 int br_vlan_init(struct net_bridge *br)
831 br->vlgrp = kzalloc(sizeof(struct net_bridge_vlan_group), GFP_KERNEL);
834 ret = rhashtable_init(&br->vlgrp->vlan_hash, &br_vlan_rht_params);
837 INIT_LIST_HEAD(&br->vlgrp->vlan_list);
838 br->vlan_proto = htons(ETH_P_8021Q);
839 br->default_pvid = 1;
840 ret = br_vlan_add(br, 1,
841 BRIDGE_VLAN_INFO_PVID | BRIDGE_VLAN_INFO_UNTAGGED |
842 BRIDGE_VLAN_INFO_BRENTRY);
850 rhashtable_destroy(&br->vlgrp->vlan_hash);
857 int nbp_vlan_init(struct net_bridge_port *p)
859 struct net_bridge_vlan_group *vg;
862 vg = kzalloc(sizeof(struct net_bridge_vlan_group), GFP_KERNEL);
866 ret = rhashtable_init(&vg->vlan_hash, &br_vlan_rht_params);
869 INIT_LIST_HEAD(&vg->vlan_list);
870 /* Make sure everything's committed before publishing vg */
873 if (p->br->default_pvid) {
874 ret = nbp_vlan_add(p, p->br->default_pvid,
875 BRIDGE_VLAN_INFO_PVID |
876 BRIDGE_VLAN_INFO_UNTAGGED);
884 rhashtable_destroy(&vg->vlan_hash);
891 /* Must be protected by RTNL.
892 * Must be called with vid in range from 1 to 4094 inclusive.
894 int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
896 struct net_bridge_vlan *vlan;
901 vlan = br_vlan_find(port->vlgrp, vid);
903 __vlan_add_flags(vlan, flags);
907 vlan = kzalloc(sizeof(*vlan), GFP_KERNEL);
913 ret = __vlan_add(vlan, flags);
920 /* Must be protected by RTNL.
921 * Must be called with vid in range from 1 to 4094 inclusive.
923 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
925 struct net_bridge_vlan *v;
929 v = br_vlan_find(port->vlgrp, vid);
932 br_fdb_find_delete_local(port->br, port, port->dev->dev_addr, vid);
933 br_fdb_delete_by_port(port->br, port, vid, 0);
935 return __vlan_del(v);
938 void nbp_vlan_flush(struct net_bridge_port *port)
940 struct net_bridge_vlan *vlan;
944 list_for_each_entry(vlan, &port->vlgrp->vlan_list, vlist)
945 vlan_vid_del(port->dev, port->br->vlan_proto, vlan->vid);
947 __vlan_flush(nbp_vlan_group(port));