mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-13 21:58:06 +04:00
Gennaro Cimmino
f286d9af81
Routes through one gateway share a single L2 entry: the second route to be installed finds the first one already there and takes it as it is. Nothing recorded that, so the first route to be torn down took the next hop bit off the entry the others were still forwarding through, and when the driver had created that entry itself it was invalidated outright and the row handed back to the switch. Count them. Taking a next hop claims a reference on its entry, dropping one releases it, and the entry is only given back when the last is gone and the bridge is not holding it either. The reference is keyed on the flag that already says whether the next hop is in hardware, because the caller runs this again for every route behind a gateway on every neighbour event, and an unconditional count would climb for as long as the neighbour keeps changing state. A next hop that moves to another row - a gateway whose MAC changed - releases the row it left, after asking that row whether it is still the one the reference was taken on, because whoever claims a dropped row next counts itself from zero. When that was the last reference the row is given back there and then, by the same step a removal uses, because nothing would ever come looking for it again. An entry that was invalid when it was claimed has its count zeroed first: nothing clears the map when the switch ages a row out by itself, so what is in the cell may belong to a route that is long gone. The count pins at its ceiling instead of wrapping. Seven bits hold 127 where the vendor SDK gives the same counter, nh_used_cnt, sixteen; an entry that reached the ceiling is never freed by the driver again, which leaves a row in use but never hands a live one to somebody else. Both checks stay in front of the count, the way the removal already tested the entry before touching it. An entry that is still the one that was installed but no longer a next hop is left alone, and its reference is not dropped. Inside the driver only the release clears that bit, and it runs once the count has reached zero; the switch can also take the row away on its own, and a row re-learnt under that address afterwards carries a count nobody will spend - the same staleness the paragraph above bounds, not a new one. The search, the count and the write now happen under priv->reg_mutex, which is what the bridge FDB handlers already hold across the same read-modify-write, so nothing can come between them. That mutex is also ctrl->lock, so an L3 caller must not hold it across these two; none does. The add still runs inside an RCU read-side section it should not, which it did before this patch as well - the table accessors it already called sleep. Functionally tested on a Hasivo S1100W-8XGT-SE (RTL9303), kernel 6.18.52, with CONFIG_NET_DSA_RTL83XX_RTL930X_L3_OFFLOAD=y and ip_forward=0, so only the hardware can forward. Two routes through one gateway share one L2 entry; removing either of them leaves it valid and still a next hop, and the other route keeps forwarding. Removing the second one takes the next hop bit off it. The row a moved next hop leaves behind was not exercised: a second MAC for the gateway cannot be arranged from the test image, so that path is by inspection. That kernel carries no atomic-sleep or lock debugging, so a clean log says nothing about the RCU section above. Not exercised on RTL838x or RTL931x: neither config carries a setup op, which is what both notifiers gate on, so the routing side never reaches them. RTL839x does reach it and is untested - no hardware here. Compile-tested on realtek/rtl930x and realtek/rtl839x. Assisted-by: Claude:claude-opus-5 Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net> Link: https://github.com/openwrt/openwrt/pull/25231 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>