Lock down the network interface queues. The queue mutex must be obtained

before adding/removing packets from the queue.  Also, the if_obytes and
if_omcasts fields should only be manipulated under protection of the mutex.

IF_ENQUEUE, IF_PREPEND, and IF_DEQUEUE perform all necessary locking on
the queue.  An IF_LOCK macro is provided, as well as the old (mutex-less)
versions of the macros in the form _IF_ENQUEUE, _IF_QFULL, for code which
needs them, but their use is discouraged.

Two new macros are introduced: IF_DRAIN() to drain a queue, and IF_HANDOFF,
which takes care of locking/enqueue, and also statistics updating/start
if necessary.

2 files changed, 16 insertions, 6 deletions

diff --git a/sys/dev/ar/if_ar.c b/sys/dev/ar/if_ar.c
index f43aef1..dfbc3ac 100644
--- a/sys/dev/ar/if_ar.c
+++ b/sys/dev/ar/if_ar.c
@@ -515,6 +515,8 @@ arattach(struct ar_hardc *hc)
 		callout_handle_init(&sc->handle);
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "ar_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "ar_xmitq_hipri", MTX_DEF);
 		sprintf(sc->nodename, "%s%d", NG_AR_NODE_TYPE, sc->unit);
 		if (ng_name_node(sc->node, sc->nodename)) {
 			ng_rmnode(sc->node);
@@ -2308,13 +2310,16 @@ ngar_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splimp();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	arstart(sc);
 	splx(s);
 	return (0);
diff --git a/sys/dev/ar/if_ar_isa.c b/sys/dev/ar/if_ar_isa.c
index f43aef1..dfbc3ac 100644
--- a/sys/dev/ar/if_ar_isa.c
+++ b/sys/dev/ar/if_ar_isa.c
@@ -515,6 +515,8 @@ arattach(struct ar_hardc *hc)
 		callout_handle_init(&sc->handle);
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "ar_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "ar_xmitq_hipri", MTX_DEF);
 		sprintf(sc->nodename, "%s%d", NG_AR_NODE_TYPE, sc->unit);
 		if (ng_name_node(sc->node, sc->nodename)) {
 			ng_rmnode(sc->node);
@@ -2308,13 +2310,16 @@ ngar_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splimp();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	arstart(sc);
 	splx(s);
 	return (0);