Lock down the network interface queues. The queue mutex must be obtained

before adding/removing packets from the queue.  Also, the if_obytes and
if_omcasts fields should only be manipulated under protection of the mutex.

IF_ENQUEUE, IF_PREPEND, and IF_DEQUEUE perform all necessary locking on
the queue.  An IF_LOCK macro is provided, as well as the old (mutex-less)
versions of the macros in the form _IF_ENQUEUE, _IF_QFULL, for code which
needs them, but their use is discouraged.

Two new macros are introduced: IF_DRAIN() to drain a queue, and IF_HANDOFF,
which takes care of locking/enqueue, and also statistics updating/start
if necessary.

17 files changed, 114 insertions, 126 deletions

diff --git a/sys/dev/ar/if_ar.c b/sys/dev/ar/if_ar.c
index f43aef1..dfbc3ac 100644
--- a/sys/dev/ar/if_ar.c
+++ b/sys/dev/ar/if_ar.c
@@ -515,6 +515,8 @@ arattach(struct ar_hardc *hc)
 		callout_handle_init(&sc->handle);
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "ar_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "ar_xmitq_hipri", MTX_DEF);
 		sprintf(sc->nodename, "%s%d", NG_AR_NODE_TYPE, sc->unit);
 		if (ng_name_node(sc->node, sc->nodename)) {
 			ng_rmnode(sc->node);
@@ -2308,13 +2310,16 @@ ngar_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splimp();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	arstart(sc);
 	splx(s);
 	return (0);
diff --git a/sys/dev/ar/if_ar_isa.c b/sys/dev/ar/if_ar_isa.c
index f43aef1..dfbc3ac 100644
--- a/sys/dev/ar/if_ar_isa.c
+++ b/sys/dev/ar/if_ar_isa.c
@@ -515,6 +515,8 @@ arattach(struct ar_hardc *hc)
 		callout_handle_init(&sc->handle);
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "ar_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "ar_xmitq_hipri", MTX_DEF);
 		sprintf(sc->nodename, "%s%d", NG_AR_NODE_TYPE, sc->unit);
 		if (ng_name_node(sc->node, sc->nodename)) {
 			ng_rmnode(sc->node);
@@ -2308,13 +2310,16 @@ ngar_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splimp();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	arstart(sc);
 	splx(s);
 	return (0);
diff --git a/sys/dev/awi/awi.c b/sys/dev/awi/awi.c
index 023796b..749e042 100644
--- a/sys/dev/awi/awi.c
+++ b/sys/dev/awi/awi.c
@@ -876,17 +876,12 @@ awi_stop(sc)
 	ifp->if_timer = 0;
 	sc->sc_tx_timer = sc->sc_rx_timer = sc->sc_mgt_timer = 0;
 	for (;;) {
-		IF_DEQUEUE(&sc->sc_mgtq, m);
-		if (m == NULL)
-			break;
-		m_freem(m);
-	}
-	for (;;) {
-		IF_DEQUEUE(&ifp->if_snd, m);
+		_IF_DEQUEUE(&sc->sc_mgtq, m);
 		if (m == NULL)
 			break;
 		m_freem(m);
 	}
+	IF_DRAIN(&ifp->if_snd);
 	while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
 		TAILQ_REMOVE(&sc->sc_scan, bp, list);
 		free(bp, M_DEVBUF);
@@ -955,10 +950,10 @@ awi_start(ifp)
 
 	for (;;) {
 		txd = sc->sc_txnext;
-		IF_DEQUEUE(&sc->sc_mgtq, m0);
+		_IF_DEQUEUE(&sc->sc_mgtq, m0);
 		if (m0 != NULL) {
 			if (awi_next_txd(sc, m0->m_pkthdr.len, &frame, &ntxd)) {
-				IF_PREPEND(&sc->sc_mgtq, m0);
+				_IF_PREPEND(&sc->sc_mgtq, m0);
 				ifp->if_flags |= IFF_OACTIVE;
 				break;
 			}
@@ -2096,7 +2091,7 @@ awi_send_deauth(sc)
 	deauth += 2;
 
 	m->m_pkthdr.len = m->m_len = deauth - mtod(m, u_int8_t *);
-	IF_ENQUEUE(&sc->sc_mgtq, m);
+	_IF_ENQUEUE(&sc->sc_mgtq, m);
 	awi_start(ifp);
 	awi_drvstate(sc, AWI_DRV_INFTOSS);
 }
@@ -2141,7 +2136,7 @@ awi_send_auth(sc, seq)
 	auth += 2;
 
 	m->m_pkthdr.len = m->m_len = auth - mtod(m, u_int8_t *);
-	IF_ENQUEUE(&sc->sc_mgtq, m);
+	_IF_ENQUEUE(&sc->sc_mgtq, m);
 	awi_start(ifp);
 
 	sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
@@ -2261,7 +2256,7 @@ awi_send_asreq(sc, reassoc)
 	asreq += 2 + asreq[1];
 
 	m->m_pkthdr.len = m->m_len = asreq - mtod(m, u_int8_t *);
-	IF_ENQUEUE(&sc->sc_mgtq, m);
+	_IF_ENQUEUE(&sc->sc_mgtq, m);
 	awi_start(ifp);
 
 	sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
diff --git a/sys/dev/de/if_de.c b/sys/dev/de/if_de.c
index aa624cd..108518e 100644
--- a/sys/dev/de/if_de.c
+++ b/sys/dev/de/if_de.c
@@ -3201,7 +3201,7 @@ tulip_reset(
 	bus_dmamap_t map;
 #endif
 	struct mbuf *m;
-	IF_DEQUEUE(&sc->tulip_txq, m);
+	_IF_DEQUEUE(&sc->tulip_txq, m);
 	if (m == NULL)
 	    break;
 #if defined(TULIP_BUS_DMA) && !defined(TULIP_BUS_DMA_NOTX)
@@ -3247,7 +3247,7 @@ tulip_reset(
 	bus_dmamap_t map;
 #endif
 	struct mbuf *m;
-	IF_DEQUEUE(&sc->tulip_rxq, m);
+	_IF_DEQUEUE(&sc->tulip_rxq, m);
 	if (m == NULL)
 	    break;
 #if defined(TULIP_BUS_DMA) && !defined(TULIP_BUS_DMA_NORX)
@@ -3382,7 +3382,7 @@ tulip_rx_intr(
 	 */
 	TULIP_RXDESC_POSTSYNC(sc, eop, sizeof(*eop));
 	if ((((volatile tulip_desc_t *) eop)->d_status & (TULIP_DSTS_OWNER|TULIP_DSTS_RxFIRSTDESC|TULIP_DSTS_RxLASTDESC)) == (TULIP_DSTS_RxFIRSTDESC|TULIP_DSTS_RxLASTDESC)) {
-	    IF_DEQUEUE(&sc->tulip_rxq, ms);
+	    _IF_DEQUEUE(&sc->tulip_rxq, ms);
 	    me = ms;
 	} else {
 	    /*
@@ -3422,7 +3422,7 @@ tulip_rx_intr(
 	     * won't go into the loop and thereby saving a ourselves from
 	     * doing a multiplication by 0 in the normal case).
 	     */
-	    IF_DEQUEUE(&sc->tulip_rxq, ms);
+	    _IF_DEQUEUE(&sc->tulip_rxq, ms);
 	    for (me = ms; total_len > 0; total_len--) {
 #if defined(TULIP_BUS_DMA) && !defined(TULIP_BUS_DMA_NORX)
 		map = M_GETCTX(me, bus_dmamap_t);
@@ -3435,7 +3435,7 @@ tulip_rx_intr(
 #endif /* TULIP_BUS_DMA */
 		me->m_len = TULIP_RX_BUFLEN;
 		last_offset += TULIP_RX_BUFLEN;
-		IF_DEQUEUE(&sc->tulip_rxq, me->m_next);
+		_IF_DEQUEUE(&sc->tulip_rxq, me->m_next);
 		me = me->m_next;
 	    }
 	}
@@ -3644,7 +3644,7 @@ tulip_rx_intr(
 		ri->ri_nextout = ri->ri_first;
 	    me = ms->m_next;
 	    ms->m_next = NULL;
-	    IF_ENQUEUE(&sc->tulip_rxq, ms);
+	    _IF_ENQUEUE(&sc->tulip_rxq, ms);
 	} while ((ms = me) != NULL);
 
 	if (sc->tulip_rxq.ifq_len >= TULIP_RXQ_TARGET)
@@ -3702,7 +3702,7 @@ tulip_tx_intr(
 		}
 	    } else {
 		const u_int32_t d_status = ri->ri_nextin->d_status;
-		IF_DEQUEUE(&sc->tulip_txq, m);
+		_IF_DEQUEUE(&sc->tulip_txq, m);
 		if (m != NULL) {
 #if defined(TULIP_BUS_DMA) && !defined(TULIP_BUS_DMA_NOTX)
 		    bus_dmamap_t map = M_GETCTX(m, bus_dmamap_t);
@@ -4343,7 +4343,7 @@ tulip_txput(
      * The descriptors have been filled in.  Now get ready
      * to transmit.
      */
-    IF_ENQUEUE(&sc->tulip_txq, m);
+    _IF_ENQUEUE(&sc->tulip_txq, m);
     m = NULL;
 
     /*
diff --git a/sys/dev/en/midway.c b/sys/dev/en/midway.c
index 56558fb..0f24ed0 100644
--- a/sys/dev/en/midway.c
+++ b/sys/dev/en/midway.c
@@ -1366,13 +1366,13 @@ struct en_softc *sc;
       continue;
     slot = sc->rxvc2slot[lcv];
     while (1) {
-      IF_DEQUEUE(&sc->rxslot[slot].indma, m);
+      _IF_DEQUEUE(&sc->rxslot[slot].indma, m);
       if (m == NULL) 
 	break;		/* >>> exit 'while(1)' here <<< */
       m_freem(m);
     }
     while (1) {
-      IF_DEQUEUE(&sc->rxslot[slot].q, m);
+      _IF_DEQUEUE(&sc->rxslot[slot].q, m);
       if (m == NULL) 
 	break;		/* >>> exit 'while(1)' here <<< */
       m_freem(m);
@@ -1393,13 +1393,13 @@ struct en_softc *sc;
 
   for (lcv = 0 ; lcv < EN_NTX ; lcv++) {
     while (1) {
-      IF_DEQUEUE(&sc->txslot[lcv].indma, m);
+      _IF_DEQUEUE(&sc->txslot[lcv].indma, m);
       if (m == NULL) 
 	break;		/* >>> exit 'while(1)' here <<< */
       m_freem(m);
     }
     while (1) {
-      IF_DEQUEUE(&sc->txslot[lcv].q, m);
+      _IF_DEQUEUE(&sc->txslot[lcv].q, m);
       if (m == NULL) 
 	break;		/* >>> exit 'while(1)' here <<< */
       m_freem(m);
@@ -1725,7 +1725,7 @@ struct ifnet *ifp;
 		sc->txslot[txchan].mbsize);
 #endif
 
-      IF_ENQUEUE(&sc->txslot[txchan].q, m);
+      _IF_ENQUEUE(&sc->txslot[txchan].q, m);
 
       en_txdma(sc, txchan);
 
@@ -2093,7 +2093,7 @@ again:
    * it is a go, commit!  dequeue mbuf start working on the xfer.
    */
 
-  IF_DEQUEUE(&sc->txslot[chan].q, tmp);
+  _IF_DEQUEUE(&sc->txslot[chan].q, tmp);
 #ifdef EN_DIAG
   if (launch.t != tmp)
     panic("en dequeue");
@@ -2145,7 +2145,7 @@ again:
    */
 
   sc->txslot[chan].bfree -= launch.need;
-  IF_ENQUEUE(&sc->txslot[chan].indma, launch.t);
+  _IF_ENQUEUE(&sc->txslot[chan].indma, launch.t);
   goto again;
 
   /*
@@ -2157,7 +2157,7 @@ again:
    */
 
 dequeue_drop:
-  IF_DEQUEUE(&sc->txslot[chan].q, tmp);
+  _IF_DEQUEUE(&sc->txslot[chan].q, tmp);
   if (launch.t != tmp)
     panic("en dequeue drop");
   m_freem(launch.t);
@@ -2624,7 +2624,7 @@ void *arg;
       if ((dtq = sc->dtq[idx]) != 0) {
         sc->dtq[idx] = 0;	/* don't forget to zero it out when done */
 	slot = EN_DQ_SLOT(dtq);
-	IF_DEQUEUE(&sc->txslot[slot].indma, m);
+	_IF_DEQUEUE(&sc->txslot[slot].indma, m);
 	if (!m) panic("enintr: dtqsync");
 	sc->txslot[slot].mbsize -= EN_DQ_LEN(dtq);
 #ifdef EN_DEBUG
@@ -2675,7 +2675,7 @@ void *arg;
         if (EN_DQ_LEN(drq) == 0) {  /* "JK" trash DMA? */
           m = NULL;
         } else {
-	  IF_DEQUEUE(&sc->rxslot[slot].indma, m);
+	  _IF_DEQUEUE(&sc->rxslot[slot].indma, m);
 	  if (!m)
 	    panic("enintr: drqsync: %s: lost mbuf in slot %d!",
 		  sc->sc_dev.dv_xname, slot);
@@ -2978,7 +2978,7 @@ defer:					/* defer processing */
       EN_COUNT(sc->rxqnotus);
     } else {
       EN_COUNT(sc->rxqus);
-      IF_DEQUEUE(&sc->rxslot[slot].q, m);
+      _IF_DEQUEUE(&sc->rxslot[slot].q, m);
       drqneed = sav[1];
 #ifdef EN_DEBUG
       printf("%s: rx%d: recovered q'ed mbuf %p (drqneed=%d)\n", 
@@ -3026,7 +3026,7 @@ defer:					/* defer processing */
     sav = mtod(m, u_int32_t *);
     sav[0] = cur;
     sav[1] = drqneed;
-    IF_ENQUEUE(&sc->rxslot[slot].q, m);
+    _IF_ENQUEUE(&sc->rxslot[slot].q, m);
     EN_COUNT(sc->rxdrqout);
 #ifdef EN_DEBUG
     printf("%s: rx%d: out of DRQs\n", sc->sc_dev.dv_xname, slot);
@@ -3218,7 +3218,7 @@ done:
       m->m_pkthdr.len -= cnt;
       m->m_data += cnt;
     }
-    IF_ENQUEUE(&sc->rxslot[slot].indma, m);
+    _IF_ENQUEUE(&sc->rxslot[slot].indma, m);
   }
   sc->rxslot[slot].cur = cur;		/* update master copy of 'cur' */
 
diff --git a/sys/dev/hea/eni_receive.c b/sys/dev/hea/eni_receive.c
index fd4eb98..8e87752 100644
--- a/sys/dev/hea/eni_receive.c
+++ b/sys/dev/hea/eni_receive.c
@@ -585,7 +585,7 @@ send_dma:
 		        /*
 		         * Place buffer on receive queue waiting for RX_DMA
 		         */
-		        if ( IF_QFULL ( &eup->eu_rxqueue ) ) {
+		        if ( _IF_QFULL ( &eup->eu_rxqueue ) ) {
 			    /*
 			     * We haven't done anything we can't back out
 			     * of. Drop request and service it next time.
@@ -605,7 +605,7 @@ send_dma:
 			    vct->vci_control &= ~VCI_IN_SERVICE;
 			    return;
 		        } else { 
-		            IF_ENQUEUE ( &eup->eu_rxqueue, m );
+		            _IF_ENQUEUE ( &eup->eu_rxqueue, m );
 			    /*
 			     * Advance the RX_WR pointer to cause
 			     * the adapter to work on this DMA list.
@@ -685,7 +685,7 @@ eni_recv_drain ( eup )
 
 	s = splimp();
 	/* Pop first buffer */
-	IF_DEQUEUE ( &eup->eu_rxqueue, m );
+	_IF_DEQUEUE ( &eup->eu_rxqueue, m );
 	while ( m ) {
 		u_long	*up;
 		u_long	pdulen;
@@ -712,12 +712,12 @@ eni_recv_drain ( eup )
 		 */
 		if ( start > stop ) {		/* We wrapped */
 			if ( !(DMA_Rdptr >= stop && DMA_Rdptr < start) ) {
-				IF_PREPEND ( &eup->eu_rxqueue, m );
+				_IF_PREPEND ( &eup->eu_rxqueue, m );
 				goto finish;
 			}
 		} else {
 			if ( DMA_Rdptr < stop && DMA_Rdptr >= start ) {
-				IF_PREPEND ( &eup->eu_rxqueue, m );
+				_IF_PREPEND ( &eup->eu_rxqueue, m );
 				goto finish;
 			}
 		}
@@ -802,9 +802,8 @@ eni_recv_drain ( eup )
 			/*
 			 * Schedule callback
 			 */
-			if ( !IF_QFULL ( &atm_intrq ) ) {
+			if (IF_HANDOFF(&atm_intrq, m, NULL)) {
 				que++;
-				IF_ENQUEUE ( &atm_intrq, m );
 			} else {
 				eup->eu_stats.eni_st_drv.drv_rv_intrq++;
 				eup->eu_pif.pif_ierrors++;
@@ -812,7 +811,6 @@ eni_recv_drain ( eup )
 				log ( LOG_ERR,
 "eni_receive_drain: ATM_INTRQ is full. Unable to pass up stack.\n" );
 #endif
-				KB_FREEALL ( m );
 			}
 		} else {
 			/*
@@ -825,7 +823,7 @@ next_buffer:
 		/*
 		 * Look for next buffer
 		 */
-		IF_DEQUEUE ( &eup->eu_rxqueue, m );
+		_IF_DEQUEUE ( &eup->eu_rxqueue, m );
 	}
 finish:
 	(void) splx(s);
diff --git a/sys/dev/hea/eni_transmit.c b/sys/dev/hea/eni_transmit.c
index 2f6f945..2fd5b24 100644
--- a/sys/dev/hea/eni_transmit.c
+++ b/sys/dev/hea/eni_transmit.c
@@ -271,7 +271,7 @@ eni_xmit_drain ( eup )
 	/*
 	 * Pull the top element (PDU) off
 	 */
-	IF_DEQUEUE ( &eup->eu_txqueue, m );
+	_IF_DEQUEUE ( &eup->eu_txqueue, m );
 	/*
 	 * As long as there are valid elements
 	 */
@@ -317,7 +317,7 @@ eni_xmit_drain ( eup )
 			 * Haven't finished this PDU yet - replace
 			 * it as the head of list.
 			 */
-			IF_PREPEND ( &eup->eu_txqueue, m );
+			_IF_PREPEND ( &eup->eu_txqueue, m );
 			/*
 			 * If this one isn't done, none of the others
 			 * are either.
@@ -331,7 +331,7 @@ eni_xmit_drain ( eup )
 			 * Haven't finished this PDU yet - replace
 			 * it as the head of list.
 			 */
-			IF_PREPEND ( &eup->eu_txqueue, m );
+			_IF_PREPEND ( &eup->eu_txqueue, m );
 			/*
 			 * If this one isn't done, none of the others
 			 * are either.
@@ -388,7 +388,7 @@ eni_xmit_drain ( eup )
 		/*
 		 * Look for next completed transmit PDU
 		 */
-		IF_DEQUEUE ( &eup->eu_txqueue, m );
+		_IF_DEQUEUE ( &eup->eu_txqueue, m );
 	}
 	/*
 	 * We've drained the queue...
@@ -823,7 +823,7 @@ retry:
 	 * Place buffers onto transmit queue for draining
 	 */
 	s2 = splimp();
-	IF_ENQUEUE ( &eup->eu_txqueue, m );
+	_IF_ENQUEUE ( &eup->eu_txqueue, m );
 	(void) splx(s2);
 
 	/*
diff --git a/sys/dev/hfa/fore_receive.c b/sys/dev/hfa/fore_receive.c
index 0c7f4da..5b88883 100644
--- a/sys/dev/hfa/fore_receive.c
+++ b/sys/dev/hfa/fore_receive.c
@@ -480,12 +480,10 @@ retry:
 		/*
 		 * Schedule callback
 		 */
-		if (!IF_QFULL(&atm_intrq)) {
-			IF_ENQUEUE(&atm_intrq, mhead);
+		if (IF_HANDOFF(&atm_intrq, mhead, NULL)) {
 			SCHED_ATM;
 		} else {
 			fup->fu_stats->st_drv.drv_rv_ifull++;
-			KB_FREEALL(mhead);
 			goto free_ent;
 		}
 
diff --git a/sys/dev/iicbus/if_ic.c b/sys/dev/iicbus/if_ic.c
index c001110..fa8ffdf 100644
--- a/sys/dev/iicbus/if_ic.c
+++ b/sys/dev/iicbus/if_ic.c
@@ -306,11 +306,6 @@ icintr (device_t dev, int event, char *ptr)
 	  if (len <= ICHDRLEN)
 	    goto err;
 
-	  if (IF_QFULL(&ipintrq)) {
-	    IF_DROP(&ipintrq);
-	    break;
-	  }
-
 	  len -= ICHDRLEN;
 	  sc->ic_if.if_ipackets ++;
 	  sc->ic_if.if_ibytes += len;
@@ -321,8 +316,8 @@ icintr (device_t dev, int event, char *ptr)
 	  top = m_devget(sc->ic_ifbuf + ICHDRLEN, len, 0, &sc->ic_if, 0);
 
 	  if (top) {
-	    IF_ENQUEUE(&ipintrq, top);
-	    schednetisr(NETISR_IP);
+	    if (IF_HANDOFF(&ipintrq, top, NULL))
+	      schednetisr(NETISR_IP);
 	  }
 	  break;
 
diff --git a/sys/dev/lmc/if_lmc.c b/sys/dev/lmc/if_lmc.c
index b2815fe..a6c91a9 100644
--- a/sys/dev/lmc/if_lmc.c
+++ b/sys/dev/lmc/if_lmc.c
@@ -522,7 +522,7 @@ lmc_rx_intr(lmc_softc_t * const sc)
 		 * optimize for that case.
 		 */
 		if ((((volatile tulip_desc_t *) eop)->d_status & (TULIP_DSTS_OWNER|TULIP_DSTS_RxFIRSTDESC|TULIP_DSTS_RxLASTDESC)) == (TULIP_DSTS_RxFIRSTDESC|TULIP_DSTS_RxLASTDESC)) {
-			IF_DEQUEUE(&sc->lmc_rxq, ms);
+			_IF_DEQUEUE(&sc->lmc_rxq, ms);
 			me = ms;
 		} else {
 			/*
@@ -559,11 +559,11 @@ lmc_rx_intr(lmc_softc_t * const sc)
 			 * saving a ourselves from doing a multiplication
 			 * by 0 in the normal case).
 			 */
-			IF_DEQUEUE(&sc->lmc_rxq, ms);
+			_IF_DEQUEUE(&sc->lmc_rxq, ms);
 			for (me = ms; total_len > 0; total_len--) {
 				me->m_len = LMC_RX_BUFLEN;
 				last_offset += LMC_RX_BUFLEN;
-				IF_DEQUEUE(&sc->lmc_rxq, me->m_next);
+				_IF_DEQUEUE(&sc->lmc_rxq, me->m_next);
 				me = me->m_next;
 			}
 		}
@@ -650,7 +650,7 @@ lmc_rx_intr(lmc_softc_t * const sc)
 				ri->ri_nextout = ri->ri_first;
 			me = ms->m_next;
 			ms->m_next = NULL;
-			IF_ENQUEUE(&sc->lmc_rxq, ms);
+			_IF_ENQUEUE(&sc->lmc_rxq, ms);
 		} while ((ms = me) != NULL);
 
 		if (sc->lmc_rxq.ifq_len >= LMC_RXQ_TARGET)
@@ -676,7 +676,7 @@ lmc_tx_intr(lmc_softc_t * const sc)
 	d_flag = ri->ri_nextin->d_flag;
 	if (d_flag & TULIP_DFLAG_TxLASTSEG) {
 		const u_int32_t d_status = ri->ri_nextin->d_status;
-		IF_DEQUEUE(&sc->lmc_txq, m);
+		_IF_DEQUEUE(&sc->lmc_txq, m);
 		if (m != NULL) {
 #if NBPFILTER > 0
 		    if (sc->lmc_bpf != NULL)
@@ -994,7 +994,7 @@ lmc_txput(lmc_softc_t * const sc, struct mbuf *m)
 	 * The descriptors have been filled in.  Now get ready
 	 * to transmit.
 	 */
-	IF_ENQUEUE(&sc->lmc_txq, m);
+	_IF_ENQUEUE(&sc->lmc_txq, m);
 	m = NULL;
 
 	/*
@@ -1133,6 +1133,8 @@ lmc_attach(lmc_softc_t * const sc)
 	callout_handle_init(&sc->lmc_handle);
 	sc->lmc_xmitq.ifq_maxlen = IFQ_MAXLEN;
 	sc->lmc_xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+	mtx_init(&sc->lmc_xmitq.ifq_mtx, "lmc_xmitq", MTX_DEF);
+	mtx_init(&sc->lmc_xmitq_hipri.ifq_mtx, "lmc_xmitq_hipri", MTX_DEF);
 	sprintf(sc->lmc_nodename, "%s%d", NG_LMC_NODE_TYPE, sc->lmc_unit);
 	if (ng_name_node(sc->lmc_node, sc->lmc_nodename)) {
 		ng_rmnode(sc->lmc_node);
@@ -1419,13 +1421,16 @@ ng_lmc_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
                 xmitq_p = (&sc->lmc_xmitq);
         }
         s = splimp();
-        if (IF_QFULL(xmitq_p)) {
-                IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+        if (_IF_QFULL(xmitq_p)) {
+                _IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
                 splx(s);
                 error = ENOBUFS;
                 goto bad;
         }
-        IF_ENQUEUE(xmitq_p, m);
+        _IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
         lmc_ifstart_one(sc);
         splx(s);
         return (0);
diff --git a/sys/dev/lmc/if_lmc_common.c b/sys/dev/lmc/if_lmc_common.c
index 69514cf..fabcea2 100644
--- a/sys/dev/lmc/if_lmc_common.c
+++ b/sys/dev/lmc/if_lmc_common.c
@@ -208,7 +208,7 @@ lmc_dec_reset(lmc_softc_t * const sc)
 	for (;;) {
 		struct mbuf *m;
 
-		IF_DEQUEUE(&sc->lmc_txq, m);
+		_IF_DEQUEUE(&sc->lmc_txq, m);
 		if (m == NULL)
 			break;
 		m_freem(m);
@@ -239,7 +239,7 @@ lmc_dec_reset(lmc_softc_t * const sc)
 	}
 	for (;;) {
 		struct mbuf *m;
-		IF_DEQUEUE(&sc->lmc_rxq, m);
+		_IF_DEQUEUE(&sc->lmc_rxq, m);
 		if (m == NULL)
 			break;
 		m_freem(m);
diff --git a/sys/dev/pdq/pdq_ifsubr.c b/sys/dev/pdq/pdq_ifsubr.c
index fab0c44..ac9d3d2 100644
--- a/sys/dev/pdq/pdq_ifsubr.c
+++ b/sys/dev/pdq/pdq_ifsubr.c
@@ -131,13 +131,7 @@ pdq_ifwatchdog(
 
     ifp->if_flags &= ~IFF_OACTIVE;
     ifp->if_timer = 0;
-    for (;;) {
-	struct mbuf *m;
-	IF_DEQUEUE(&ifp->if_snd, m);
-	if (m == NULL)
-	    return;
-	m_freem(m);
-    }
+    IF_DRAIN(&ifp->if_snd);
 }
 
 ifnet_ret_t
diff --git a/sys/dev/ppbus/if_plip.c b/sys/dev/ppbus/if_plip.c
index 2410afe..ee379fe 100644
--- a/sys/dev/ppbus/if_plip.c
+++ b/sys/dev/ppbus/if_plip.c
@@ -513,11 +513,6 @@ lp_intr (void *arg)
 
 	    sc->sc_iferrs = 0;
 
-	    if (IF_QFULL(&ipintrq)) {
-	        lprintf("DROP");
-	        IF_DROP(&ipintrq);
-		goto done;
-	    }
 	    len -= CLPIPHDRLEN;
 	    sc->sc_if.if_ipackets++;
 	    sc->sc_if.if_ibytes += len;
@@ -525,8 +520,11 @@ lp_intr (void *arg)
 	    if (top) {
 		if (sc->sc_if.if_bpf)
 		    lptap(&sc->sc_if, top);
-	        IF_ENQUEUE(&ipintrq, top);
-	        schednetisr(NETISR_IP);
+                if (! IF_HANDOFF(&ipintrq, top, NULL)) {
+	            lprintf("DROP");
+                } else {
+	            schednetisr(NETISR_IP);
+	        }
 	    }
 	    goto done;
 	}
@@ -564,11 +562,6 @@ lp_intr (void *arg)
 
 	    sc->sc_iferrs = 0;
 
-	    if (IF_QFULL(&ipintrq)) {
-		lprintf("DROP");
-		IF_DROP(&ipintrq);
-		goto done;
-	    }
 	    len -= LPIPHDRLEN;
 	    sc->sc_if.if_ipackets++;
 	    sc->sc_if.if_ibytes += len;
@@ -576,8 +569,11 @@ lp_intr (void *arg)
 	    if (top) {
 		if (sc->sc_if.if_bpf)
 		    lptap(&sc->sc_if, top);
-		IF_ENQUEUE(&ipintrq, top);
-		schednetisr(NETISR_IP);
+                if (! IF_HANDOFF(&ipintrq, top, NULL))  {
+		    lprintf("DROP");
+                } else {
+		    schednetisr(NETISR_IP);
+	        }
 	    }
 	}
 	goto done;
diff --git a/sys/dev/sr/if_sr.c b/sys/dev/sr/if_sr.c
index 9af963b..89b2c99 100644
--- a/sys/dev/sr/if_sr.c
+++ b/sys/dev/sr/if_sr.c
@@ -941,6 +941,8 @@ srattach(struct sr_hardc *hc)
 		callout_handle_init(&sc->handle);
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "sr_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "sr_xmitq_hipri", MTX_DEF);
 		sprintf(sc->nodename, "%s%d", NG_SR_NODE_TYPE, sc->unit);
 		if (ng_name_node(sc->node, sc->nodename)) {
 			ng_rmnode(sc->node);
@@ -3264,13 +3266,16 @@ ngsr_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splimp();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	srstart(sc);
 	splx(s);
 	return (0);
diff --git a/sys/dev/sr/if_sr_isa.c b/sys/dev/sr/if_sr_isa.c
index 9af963b..89b2c99 100644
--- a/sys/dev/sr/if_sr_isa.c
+++ b/sys/dev/sr/if_sr_isa.c
@@ -941,6 +941,8 @@ srattach(struct sr_hardc *hc)
 		callout_handle_init(&sc->handle);
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "sr_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "sr_xmitq_hipri", MTX_DEF);
 		sprintf(sc->nodename, "%s%d", NG_SR_NODE_TYPE, sc->unit);
 		if (ng_name_node(sc->node, sc->nodename)) {
 			ng_rmnode(sc->node);
@@ -3264,13 +3266,16 @@ ngsr_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splimp();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	srstart(sc);
 	splx(s);
 	return (0);
diff --git a/sys/dev/usb/udbp.c b/sys/dev/usb/udbp.c
index 71eb710..d75e1f2 100644
--- a/sys/dev/usb/udbp.c
+++ b/sys/dev/usb/udbp.c
@@ -359,6 +359,8 @@ USB_ATTACH(udbp)
 		sc->node->private = sc;
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "usb_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "usb_xmitq_hipri", MTX_DEF);
 		sprintf(nodename, "%s", USBDEVNAME(sc->sc_dev));
 		if ((err = ng_name_node(sc->node, nodename))) {
 			ng_rmnode(sc->node);
@@ -737,13 +739,16 @@ ng_udbp_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splusb();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	if (!(sc->flags & OUT_BUSY))
 		udbp_setup_out_transfer(sc);
 	splx(s);
@@ -772,16 +777,8 @@ ng_udbp_rmnode(node_p node)
 	ng_cutlinks(node);
 
 	/* Drain the queues */
-	do {
-		IF_DEQUEUE(&sc->xmitq_hipri, m);
-		if (m)
-			m_freem(m);
-	} while (m);
-	do {
-		IF_DEQUEUE(&sc->xmitq, m);
-		if (m)
-			m_freem(m);
-	} while (m);
+	IF_DRAIN(&sc->xmitq_hipri);
+	IF_DRAIN(&sc->xmitq);
 
 	sc->packets_in = 0;		/* reset stats */
 	sc->packets_out = 0;
diff --git a/sys/dev/usb/usb_ethersubr.c b/sys/dev/usb/usb_ethersubr.c
index c02ed7d..3065c47 100644
--- a/sys/dev/usb/usb_ethersubr.c
+++ b/sys/dev/usb/usb_ethersubr.c
@@ -73,9 +73,7 @@ Static const char rcsid[] =
 #endif
 
 Static struct ifqueue usbq_rx;
-Static struct mtx usbq_rx_mtx;
 Static struct ifqueue usbq_tx;
-Static struct mtx usbq_tx_mtx;
 Static int mtx_inited = 0;
 
 Static void usbintr		__P((void));
@@ -89,9 +87,7 @@ Static void usbintr()
 
 	/* Check the RX queue */
 	while(1) {
-		mtx_enter(&usbq_rx_mtx, MTX_DEF);
 		IF_DEQUEUE(&usbq_rx, m);
-		mtx_exit(&usbq_rx_mtx, MTX_DEF);
 		if (m == NULL)
 			break;
 		eh = mtod(m, struct ether_header *);
@@ -109,9 +105,7 @@ Static void usbintr()
 
 	/* Check the TX queue */
 	while(1) {
-		mtx_enter(&usbq_tx_mtx, MTX_DEF);
 		IF_DEQUEUE(&usbq_tx, m);
-		mtx_exit(&usbq_tx_mtx, MTX_DEF);
 		if (m == NULL)
 			break;
 		ifp = m->m_pkthdr.rcvif;
@@ -128,8 +122,8 @@ void usb_register_netisr()
 	if (mtx_inited)
 		return;
 	register_netisr(NETISR_USB, usbintr);
-	mtx_init(&usbq_tx_mtx, "usbq_tx_mtx", MTX_DEF);
-	mtx_init(&usbq_rx_mtx, "usbq_rx_mtx", MTX_DEF);
+	mtx_init(&usbq_tx.ifq_mtx, "usbq_tx_mtx", MTX_DEF);
+	mtx_init(&usbq_rx.ifq_mtx, "usbq_rx_mtx", MTX_DEF);
 	mtx_inited++;
 	return;
 }
@@ -141,9 +135,7 @@ void usb_register_netisr()
 void usb_ether_input(m)
 	struct mbuf		*m;
 {
-	mtx_enter(&usbq_rx_mtx, MTX_DEF);
 	IF_ENQUEUE(&usbq_rx, m);
-	mtx_exit(&usbq_rx_mtx, MTX_DEF);
 	schednetisr(NETISR_USB);
 
 	return;
@@ -152,9 +144,7 @@ void usb_ether_input(m)
 void usb_tx_done(m)
 	struct mbuf		*m;
 {
-	mtx_enter(&usbq_tx_mtx, MTX_DEF);
 	IF_ENQUEUE(&usbq_tx, m);
-	mtx_exit(&usbq_tx_mtx, MTX_DEF);
 	schednetisr(NETISR_USB);
 
 	return;