shuffle struct ifqueue so in flight mbufs are protected by a mutex.

the code is refactored so the IFQ macros call newly implemented ifq
functions. the ifq code is split so each discipline (priq and hfsc
in our case) is an opaque set of operations that the common ifq
code can call. the common code does the locking, accounting (ifq_len
manipulation), and freeing of the mbuf if the disciplines enqueue
function rejects it. theyre kind of like bufqs in the block layer
with their fifo and nscan disciplines.

the new api also supports atomic switching of disciplines at runtime.
the hfsc setup in pf_ioctl.c has been tweaked to build a complete
hfsc_if structure which it attaches to the send queue in a single
operation, rather than attaching to the interface up front and
building up a list of queues.

the send queue is now mutexed, which raises the expectation that
packets can be enqueued or purged on one cpu while another cpu is
dequeueing them in a driver for transmission. a lot of drivers use
IFQ_POLL to peek at an mbuf and attempt to fit it on the ring before
committing to it with a later IFQ_DEQUEUE operation. if the mbuf
gets freed in between the POLL and DEQUEUE operations, fireworks
will ensue.

to avoid this, the ifq api introduces ifq_deq_begin, ifq_deq_rollback,
and ifq_deq_commit. ifq_deq_begin allows a driver to take the ifq
mutex and get a reference to the mbuf they wish to try and tx. if
there's space, they can ifq_deq_commit it to remove the mbuf and
release the mutex. if there's no space, ifq_deq_rollback simply
releases the mutex. this api was developed to make updating the
drivers using IFQ_POLL easy, instead of having to do significant
semantic changes to avoid POLL that we cannot test on all the
hardware.

the common code has been tested pretty hard, and all the driver
modifications are straightforward except for de(4). if that breaks
it can be dealt with later.

ok mpi@ jmatthew@

16 files changed, 96 insertions, 62 deletions

diff --git a/sys/dev/ic/aic6915.c b/sys/dev/ic/aic6915.c
index fd90f712c38..13150cb0e93 100644
--- a/sys/dev/ic/aic6915.c
+++ b/sys/dev/ic/aic6915.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic6915.c,v 1.18 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: aic6915.c,v 1.19 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: aic6915.c,v 1.15 2005/12/24 20:27:29 perry Exp $	*/
 
 /*-
@@ -363,7 +363,7 @@ sf_start(struct ifnet *ifp)
 		/*
 		 * Grab a packet off the queue.
 		 */
-		IFQ_POLL(&ifp->if_snd, m0);
+		m0 = ifq_deq_begin(&ifp->if_snd);
 		if (m0 == NULL)
 			break;
 		m = NULL;
@@ -385,6 +385,7 @@ sf_start(struct ifnet *ifp)
 		    BUS_DMA_WRITE|BUS_DMA_NOWAIT) != 0) {
 			MGETHDR(m, M_DONTWAIT, MT_DATA);
 			if (m == NULL) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				printf("%s: unable to allocate Tx mbuf\n",
 				    sc->sc_dev.dv_xname);
 				break;
@@ -392,6 +393,7 @@ sf_start(struct ifnet *ifp)
 			if (m0->m_pkthdr.len > MHLEN) {
 				MCLGET(m, M_DONTWAIT);
 				if ((m->m_flags & M_EXT) == 0) {
+					ifq_deq_rollback(&ifp->if_snd, m0);
 					printf("%s: unable to allocate Tx "
 					    "cluster\n", sc->sc_dev.dv_xname);
 					m_freem(m);
@@ -403,6 +405,7 @@ sf_start(struct ifnet *ifp)
 			error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap,
 			    m, BUS_DMA_WRITE|BUS_DMA_NOWAIT);
 			if (error) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				printf("%s: unable to load Tx buffer, "
 				    "error = %d\n", sc->sc_dev.dv_xname, error);
 				m_freem(m);
@@ -413,7 +416,7 @@ sf_start(struct ifnet *ifp)
 		/*
 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
 		 */
-		IFQ_DEQUEUE(&ifp->if_snd, m0);
+		ifq_deq_commit(&ifp->if_snd, m0);
 		if (m != NULL) {
 			m_freem(m0);
 			m0 = m;
diff --git a/sys/dev/ic/an.c b/sys/dev/ic/an.c
index 1d29bfed8db..abb6bac0ac2 100644
--- a/sys/dev/ic/an.c
+++ b/sys/dev/ic/an.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: an.c,v 1.66 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: an.c,v 1.67 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: an.c,v 1.34 2005/06/20 02:49:18 atatat Exp $	*/
 /*
  * Copyright (c) 1997, 1998, 1999
@@ -1097,18 +1097,19 @@ an_start(struct ifnet *ifp)
 			DPRINTF(("an_start: not running %d\n", ic->ic_state));
 			break;
 		}
-		IFQ_POLL(&ifp->if_snd, m);
+		m = ifq_deq_begin(&ifp->if_snd);
 		if (m == NULL) {
 			DPRINTF2(("an_start: no pending mbuf\n"));
 			break;
 		}
 		if (sc->sc_txd[cur].d_inuse) {
+			ifq_deq_rollback(&ifp->if_snd, m);
 			DPRINTF2(("an_start: %x/%d busy\n",
 			    sc->sc_txd[cur].d_fid, cur));
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
-		IFQ_DEQUEUE(&ifp->if_snd, m);
+		ifq_deq_commit(&ifp->if_snd, m);
 		ifp->if_opackets++;
 #if NBPFILTER > 0
 		if (ifp->if_bpf)
diff --git a/sys/dev/ic/dc.c b/sys/dev/ic/dc.c
index 6a4a903cfe5..e45edf8f7d9 100644
--- a/sys/dev/ic/dc.c
+++ b/sys/dev/ic/dc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dc.c,v 1.145 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: dc.c,v 1.146 2015/11/20 03:35:22 dlg Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 1999
@@ -2618,7 +2618,7 @@ dc_start(struct ifnet *ifp)
 	idx = sc->dc_cdata.dc_tx_prod;
 
 	while(sc->dc_cdata.dc_tx_chain[idx].sd_mbuf == NULL) {
-		IFQ_POLL(&ifp->if_snd, m_head);
+		m_head = ifq_deq_begin(&ifp->if_snd);
 		if (m_head == NULL)
 			break;
 
@@ -2628,7 +2628,7 @@ dc_start(struct ifnet *ifp)
 			/* note: dc_coal breaks the poll-and-dequeue rule.
 			 * if dc_coal fails, we lose the packet.
 			 */
-			IFQ_DEQUEUE(&ifp->if_snd, m_head);
+			ifq_deq_commit(&ifp->if_snd, m_head);
 			if (dc_coal(sc, &m_head)) {
 				ifp->if_flags |= IFF_OACTIVE;
 				break;
@@ -2636,6 +2636,9 @@ dc_start(struct ifnet *ifp)
 		}
 
 		if (dc_encap(sc, m_head, &idx)) {
+			if ((sc->dc_flags & DC_TX_COALESCE) == 0)
+				ifq_deq_rollback(&ifp->if_snd, m_head);
+
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
@@ -2644,7 +2647,7 @@ dc_start(struct ifnet *ifp)
 		if (sc->dc_flags & DC_TX_COALESCE) {
 			/* if mbuf is coalesced, it is already dequeued */
 		} else
-			IFQ_DEQUEUE(&ifp->if_snd, m_head);
+			ifq_deq_commit(&ifp->if_snd, m_head);
 
 		/*
 		 * If there's a BPF listener, bounce a copy of this frame
diff --git a/sys/dev/ic/elink3.c b/sys/dev/ic/elink3.c
index 328a60e8495..726adc476bd 100644
--- a/sys/dev/ic/elink3.c
+++ b/sys/dev/ic/elink3.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: elink3.c,v 1.88 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: elink3.c,v 1.89 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: elink3.c,v 1.32 1997/05/14 00:22:00 thorpej Exp $	*/
 
 /*
@@ -954,7 +954,7 @@ epstart(struct ifnet *ifp)
 
 startagain:
 	/* Sneak a peek at the next packet */
-	IFQ_POLL(&ifp->if_snd, m0);
+	m0 = ifq_deq_begin(&ifp->if_snd);
 	if (m0 == NULL)
 		return;
 
@@ -973,7 +973,7 @@ startagain:
 	if (len + pad > ETHER_MAX_LEN) {
 		/* packet is obviously too large: toss it */
 		++ifp->if_oerrors;
-		IFQ_DEQUEUE(&ifp->if_snd, m0);
+		ifq_deq_commit(&ifp->if_snd, m0);
 		m_freem(m0);
 		goto readcheck;
 	}
@@ -983,6 +983,7 @@ startagain:
 		bus_space_write_2(iot, ioh, EP_COMMAND,
 		    SET_TX_AVAIL_THRESH | ((len + pad + 4) >> sc->txashift));
 		/* not enough room in FIFO */
+		ifq_deq_rollback(&ifp->if_snd, m0);
 		ifp->if_flags |= IFF_OACTIVE;
 		return;
 	} else {
@@ -990,7 +991,7 @@ startagain:
 		    SET_TX_AVAIL_THRESH | EP_THRESH_DISABLE);
 	}
 
-	IFQ_DEQUEUE(&ifp->if_snd, m0);
+	ifq_deq_commit(&ifp->if_snd, m0);
 	if (m0 == NULL)
 		return;
 
diff --git a/sys/dev/ic/fxp.c b/sys/dev/ic/fxp.c
index 78388fc26d7..e31e1863368 100644
--- a/sys/dev/ic/fxp.c
+++ b/sys/dev/ic/fxp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fxp.c,v 1.123 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: fxp.c,v 1.124 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: if_fxp.c,v 1.2 1997/06/05 02:01:55 thorpej Exp $	*/
 
 /*
@@ -689,19 +689,22 @@ fxp_start(struct ifnet *ifp)
 
 		txs = txs->tx_next;
 
-		IFQ_POLL(&ifp->if_snd, m0);
+		m0 = ifq_deq_begin(&ifp->if_snd);
 		if (m0 == NULL)
 			break;
 
 		if (bus_dmamap_load_mbuf(sc->sc_dmat, txs->tx_map,
 		    m0, BUS_DMA_NOWAIT) != 0) {
 			MGETHDR(m, M_DONTWAIT, MT_DATA);
-			if (m == NULL)
+			if (m == NULL) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				break;
+			}
 			if (m0->m_pkthdr.len > MHLEN) {
 				MCLGET(m, M_DONTWAIT);
 				if (!(m->m_flags & M_EXT)) {
 					m_freem(m);
+					ifq_deq_rollback(&ifp->if_snd, m0);
 					break;
 				}
 			}
@@ -710,11 +713,12 @@ fxp_start(struct ifnet *ifp)
 			if (bus_dmamap_load_mbuf(sc->sc_dmat, txs->tx_map,
 			    m, BUS_DMA_NOWAIT) != 0) {
 				m_freem(m);
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				break;
 			}
 		}
 
-		IFQ_DEQUEUE(&ifp->if_snd, m0);
+		ifq_deq_commit(&ifp->if_snd, m0);
 		if (m != NULL) {
 			m_freem(m0);
 			m0 = m;
diff --git a/sys/dev/ic/gem.c b/sys/dev/ic/gem.c
index 62cc2070bce..f00ada669fe 100644
--- a/sys/dev/ic/gem.c
+++ b/sys/dev/ic/gem.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gem.c,v 1.114 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: gem.c,v 1.115 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: gem.c,v 1.1 2001/09/16 00:11:43 eeh Exp $ */
 
 /*
@@ -1657,7 +1657,7 @@ gem_start(struct ifnet *ifp)
 		return;
 
 	while (sc->sc_txd[sc->sc_tx_prod].sd_mbuf == NULL) {
-		IFQ_POLL(&ifp->if_snd, m);
+		m = ifq_deq_begin(&ifp->if_snd);
 		if (m == NULL)
 			break;
 
@@ -1685,12 +1685,13 @@ gem_start(struct ifnet *ifp)
 
 		if ((sc->sc_tx_cnt + map->dm_nsegs) > (GEM_NTXDESC - 2)) {
 			bus_dmamap_unload(sc->sc_dmatag, map);
+			ifq_deq_rollback(&ifp->if_snd, m);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
 
 		/* We are now committed to transmitting the packet. */
-		IFQ_DEQUEUE(&ifp->if_snd, m);
+		ifq_deq_commit(&ifp->if_snd, m);
 
 #if NBPFILTER > 0
 		/*
@@ -1736,7 +1737,7 @@ gem_start(struct ifnet *ifp)
 	return;
 
  drop:
-	IFQ_DEQUEUE(&ifp->if_snd, m);
+	ifq_deq_commit(&ifp->if_snd, m);
 	m_freem(m);
 	ifp->if_oerrors++;
 }
diff --git a/sys/dev/ic/hme.c b/sys/dev/ic/hme.c
index 41da924046a..b946c441dfb 100644
--- a/sys/dev/ic/hme.c
+++ b/sys/dev/ic/hme.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hme.c,v 1.75 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: hme.c,v 1.76 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: hme.c,v 1.21 2001/07/07 15:59:37 thorpej Exp $	*/
 
 /*-
@@ -644,7 +644,7 @@ hme_start(struct ifnet *ifp)
 		return;
 
 	while (sc->sc_txd[sc->sc_tx_prod].sd_mbuf == NULL) {
-		IFQ_POLL(&ifp->if_snd, m);
+		m = ifq_deq_begin(&ifp->if_snd);
 		if (m == NULL)
 			break;
 
@@ -672,12 +672,13 @@ hme_start(struct ifnet *ifp)
 
 		if ((HME_TX_RING_SIZE - (sc->sc_tx_cnt + map->dm_nsegs)) < 5) {
 			bus_dmamap_unload(sc->sc_dmatag, map);
+			ifq_deq_rollback(&ifp->if_snd, m);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
 
 		/* We are now committed to transmitting the packet. */
-		IFQ_DEQUEUE(&ifp->if_snd, m);
+		ifq_deq_commit(&ifp->if_snd, m);
 
 #if NBPFILTER > 0
 		/*
@@ -732,7 +733,7 @@ hme_start(struct ifnet *ifp)
 	return;
 
  drop:
-	IFQ_DEQUEUE(&ifp->if_snd, m);
+	ifq_deq_commit(&ifp->if_snd, m);
 	m_freem(m);
 	ifp->if_oerrors++;
 }
diff --git a/sys/dev/ic/lemac.c b/sys/dev/ic/lemac.c
index 9b9a8bdcd18..c9c1078f1ed 100644
--- a/sys/dev/ic/lemac.c
+++ b/sys/dev/ic/lemac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: lemac.c,v 1.22 2015/10/25 12:48:46 mpi Exp $ */
+/* $OpenBSD: lemac.c,v 1.23 2015/11/20 03:35:22 dlg Exp $ */
 /* $NetBSD: lemac.c,v 1.20 2001/06/13 10:46:02 wiz Exp $ */
 
 /*-
@@ -641,13 +641,14 @@ lemac_ifstart(struct ifnet *ifp)
 		struct mbuf *m0;
 		int tx_pg;
 
-		IFQ_POLL(&ifp->if_snd, m);
+		m = ifq_deq_begin(&ifp->if_snd);
 		if (m == NULL)
 			break;
 
 		if ((sc->sc_csr.csr_tqc = LEMAC_INB(sc, LEMAC_REG_TQC)) >=
 		    lemac_txmax) {
 			sc->sc_cntrs.cntr_txfull++;
+			ifq_deq_rollback(&ifp->if_snd, m);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
@@ -662,11 +663,12 @@ lemac_ifstart(struct ifnet *ifp)
 		 */
 		if (tx_pg == 0 || tx_pg > sc->sc_lastpage) {
 			sc->sc_cntrs.cntr_txnospc++;
+			ifq_deq_rollback(&ifp->if_snd, m);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
 
-		IFQ_DEQUEUE(&ifp->if_snd, m);
+		ifq_deq_commit(&ifp->if_snd, m);
 
 		/*
 		 * The first four bytes of each transmit buffer are for
diff --git a/sys/dev/ic/pgt.c b/sys/dev/ic/pgt.c
index ef6c8174a31..aa35c109a6b 100644
--- a/sys/dev/ic/pgt.c
+++ b/sys/dev/ic/pgt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pgt.c,v 1.79 2015/10/25 12:48:46 mpi Exp $  */
+/*	$OpenBSD: pgt.c,v 1.80 2015/11/20 03:35:22 dlg Exp $  */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -2120,15 +2120,17 @@ pgt_start(struct ifnet *ifp)
 	for (; sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] <
 	    PGT_QUEUE_FULL_THRESHOLD && !IFQ_IS_EMPTY(&ifp->if_snd);) {
 		pd = TAILQ_FIRST(&sc->sc_freeq[PGT_QUEUE_DATA_LOW_TX]);
-		IFQ_POLL(&ifp->if_snd, m);
+		m = ifq_deq_begin(&ifp->if_snd);
 		if (m == NULL)
 			break;
 		if (m->m_pkthdr.len <= PGT_FRAG_SIZE) {
 			error = pgt_load_tx_desc_frag(sc,
 			    PGT_QUEUE_DATA_LOW_TX, pd);
-			if (error)
+			if (error) {
+				ifq_deq_rollback(&ifp->if_snd, m);
 				break;
-			IFQ_DEQUEUE(&ifp->if_snd, m);
+			}
+			ifq_deq_commit(&ifp->if_snd, m);
 			m_copydata(m, 0, m->m_pkthdr.len, pd->pd_mem);
 			pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
 			    pd, m->m_pkthdr.len, 0);
@@ -2142,8 +2144,10 @@ pgt_start(struct ifnet *ifp)
 			 * even support a full two.)
 			 */
 			if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] + 2 >
-			    PGT_QUEUE_FULL_THRESHOLD)
+			    PGT_QUEUE_FULL_THRESHOLD) {
+				ifq_deq_rollback(&ifp->if_snd, m);
 				break;
+			}
 			pd2 = TAILQ_NEXT(pd, pd_link);
 			error = pgt_load_tx_desc_frag(sc,
 			    PGT_QUEUE_DATA_LOW_TX, pd);
@@ -2157,9 +2161,11 @@ pgt_start(struct ifnet *ifp)
 					    pd_link);
 				}
 			}
-			if (error)
+			if (error) {
+				ifq_deq_rollback(&ifp->if_snd, m);
 				break;
-			IFQ_DEQUEUE(&ifp->if_snd, m);
+			}
+			ifq_deq_commit(&ifp->if_snd, m);
 			m_copydata(m, 0, PGT_FRAG_SIZE, pd->pd_mem);
 			pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
 			    pd, PGT_FRAG_SIZE, 1);
@@ -2168,7 +2174,7 @@ pgt_start(struct ifnet *ifp)
 			pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
 			    pd2, m->m_pkthdr.len - PGT_FRAG_SIZE, 0);
 		} else {
-			IFQ_DEQUEUE(&ifp->if_snd, m);
+			ifq_deq_commit(&ifp->if_snd, m);
 			ifp->if_oerrors++;
 			m_freem(m);
 			m = NULL;
diff --git a/sys/dev/ic/re.c b/sys/dev/ic/re.c
index 7161304df00..2f0c2ca5c98 100644
--- a/sys/dev/ic/re.c
+++ b/sys/dev/ic/re.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: re.c,v 1.183 2015/11/14 17:54:57 mpi Exp $	*/
+/*	$OpenBSD: re.c,v 1.184 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$FreeBSD: if_re.c,v 1.31 2004/09/04 07:54:05 ru Exp $	*/
 /*
  * Copyright (c) 1997, 1998-2003
@@ -1848,29 +1848,31 @@ re_start(struct ifnet *ifp)
 	idx = sc->rl_ldata.rl_txq_prodidx;
 
 	for (;;) {
-		IFQ_POLL(&ifp->if_snd, m);
+		m = ifq_deq_begin(&ifp->if_snd);
 		if (m == NULL)
 			break;
 
 		if (sc->rl_ldata.rl_txq[idx].txq_mbuf != NULL) {
 			KASSERT(idx == sc->rl_ldata.rl_txq_considx);
+			ifq_deq_rollback(&ifp->if_snd, m);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
 
 		error = re_encap(sc, m, &idx);
 		if (error != 0 && error != ENOBUFS) {
+			ifq_deq_rollback(&ifp->if_snd, m);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		} else if (error != 0) {
-			IFQ_DEQUEUE(&ifp->if_snd, m);
+			ifq_deq_commit(&ifp->if_snd, m);
 			m_freem(m);
 			ifp->if_oerrors++;
 			continue;
 		}
 
 		/* now we are committed to transmit the packet */
-		IFQ_DEQUEUE(&ifp->if_snd, m);
+		ifq_deq_commit(&ifp->if_snd, m);
 		queued++;
 
 #if NBPFILTER > 0
diff --git a/sys/dev/ic/rt2560.c b/sys/dev/ic/rt2560.c
index e766fe3cb0a..75b69c79cb2 100644
--- a/sys/dev/ic/rt2560.c
+++ b/sys/dev/ic/rt2560.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2560.c,v 1.74 2015/11/04 12:11:59 dlg Exp $  */
+/*	$OpenBSD: rt2560.c,v 1.75 2015/11/20 03:35:22 dlg Exp $  */
 
 /*-
  * Copyright (c) 2005, 2006
@@ -1948,15 +1948,16 @@ rt2560_start(struct ifnet *ifp)
 		} else {
 			if (ic->ic_state != IEEE80211_S_RUN)
 				break;
-			IFQ_POLL(&ifp->if_snd, m0);
+			m0 = ifq_deq_begin(&ifp->if_snd);
 			if (m0 == NULL)
 				break;
 			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				ifp->if_flags |= IFF_OACTIVE;
 				sc->sc_flags |= RT2560_DATA_OACTIVE;
 				break;
 			}
-			IFQ_DEQUEUE(&ifp->if_snd, m0);
+			ifq_deq_commit(&ifp->if_snd, m0);
 #if NBPFILTER > 0
 			if (ifp->if_bpf != NULL)
 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/ic/rt2661.c b/sys/dev/ic/rt2661.c
index 55fed910a64..1fefe88c366 100644
--- a/sys/dev/ic/rt2661.c
+++ b/sys/dev/ic/rt2661.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2661.c,v 1.84 2015/11/04 12:11:59 dlg Exp $	*/
+/*	$OpenBSD: rt2661.c,v 1.85 2015/11/20 03:35:22 dlg Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -1952,15 +1952,16 @@ rt2661_start(struct ifnet *ifp)
 		} else {
 			if (ic->ic_state != IEEE80211_S_RUN)
 				break;
-			IFQ_POLL(&ifp->if_snd, m0);
+			m0 = ifq_deq_begin(&ifp->if_snd);
 			if (m0 == NULL)
 				break;
 			if (sc->txq[0].queued >= RT2661_TX_RING_COUNT - 1) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				/* there is no place left in this ring */
 				ifp->if_flags |= IFF_OACTIVE;
 				break;
 			}
-			IFQ_DEQUEUE(&ifp->if_snd, m0);
+			ifq_deq_commit(&ifp->if_snd, m0);
 #if NBPFILTER > 0
 			if (ifp->if_bpf != NULL)
 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/ic/rtw.c b/sys/dev/ic/rtw.c
index 07c66cb5dfb..ebf94678520 100644
--- a/sys/dev/ic/rtw.c
+++ b/sys/dev/ic/rtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtw.c,v 1.92 2015/11/04 12:11:59 dlg Exp $	*/
+/*	$OpenBSD: rtw.c,v 1.93 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
 
 /*-
@@ -2755,7 +2755,7 @@ rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
 
 	*mp = NULL;
 
-	IFQ_POLL(&ifp->if_snd, m0);
+	m0 = ifq_deq_begin(&ifp->if_snd);
 	if (m0 == NULL) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame ready\n",
 		    __func__));
@@ -2764,12 +2764,13 @@ rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
 
 	if (rtw_txring_choose(sc, tsbp, tdbp, RTW_TXPRIMD) == -1) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no descriptor\n", __func__));
+		ifq_deq_rollback(&ifp->if_snd, m0);
 		*if_flagsp |= IFF_OACTIVE;
 		sc->sc_if.if_timer = 1;
 		return 0;
 	}
 
-	IFQ_DEQUEUE(&ifp->if_snd, m0);
+	ifq_deq_commit(&ifp->if_snd, m0);
 	if (m0 == NULL) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: no frame/ring ready\n",
 		    __func__));
diff --git a/sys/dev/ic/smc83c170.c b/sys/dev/ic/smc83c170.c
index c5cf4458a3d..8940373ec28 100644
--- a/sys/dev/ic/smc83c170.c
+++ b/sys/dev/ic/smc83c170.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: smc83c170.c,v 1.23 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: smc83c170.c,v 1.24 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: smc83c170.c,v 1.59 2005/02/27 00:27:02 perry Exp $	*/
 
 /*-
@@ -352,7 +352,7 @@ epic_start(struct ifnet *ifp)
 		/*
 		 * Grab a packet off the queue.
 		 */
-		IFQ_POLL(&ifp->if_snd, m0);
+		m0 = ifq_deq_begin(&ifp->if_snd);
 		if (m0 == NULL)
 			break;
 		m = NULL;
@@ -380,12 +380,15 @@ epic_start(struct ifnet *ifp)
 				bus_dmamap_unload(sc->sc_dmat, dmamap);
 
 			MGETHDR(m, M_DONTWAIT, MT_DATA);
-			if (m == NULL)
+			if (m == NULL) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				break;
+			}
 			if (m0->m_pkthdr.len > MHLEN) {
 				MCLGET(m, M_DONTWAIT);
 				if ((m->m_flags & M_EXT) == 0) {
 					m_freem(m);
+					ifq_deq_rollback(&ifp->if_snd, m0);
 					break;
 				}
 			}
@@ -393,10 +396,12 @@ epic_start(struct ifnet *ifp)
 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
 			error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap,
 			    m, BUS_DMA_WRITE|BUS_DMA_NOWAIT);
-			if (error)
+			if (error) {
+				ifq_deq_rollback(&ifp->if_snd, m0);
 				break;
+			}
 		}
-		IFQ_DEQUEUE(&ifp->if_snd, m0);
+		ifq_deq_commit(&ifp->if_snd, m0);
 		if (m != NULL) {
 			m_freem(m0);
 			m0 = m;
diff --git a/sys/dev/ic/smc91cxx.c b/sys/dev/ic/smc91cxx.c
index 22f13c0b086..6d36e9a75f0 100644
--- a/sys/dev/ic/smc91cxx.c
+++ b/sys/dev/ic/smc91cxx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: smc91cxx.c,v 1.42 2015/10/25 12:48:46 mpi Exp $	*/
+/*	$OpenBSD: smc91cxx.c,v 1.43 2015/11/20 03:35:22 dlg Exp $	*/
 /*	$NetBSD: smc91cxx.c,v 1.11 1998/08/08 23:51:41 mycroft Exp $	*/
 
 /*-
@@ -548,7 +548,7 @@ smc91cxx_start(ifp)
 	/*
 	 * Peek at the next packet.
 	 */
-	IFQ_POLL(&ifp->if_snd, m);
+	m = ifq_deq_begin(&ifp->if_snd);
 	if (m == NULL)
 		return;
 
@@ -568,7 +568,7 @@ smc91cxx_start(ifp)
 	if ((len + pad) > (ETHER_MAX_LEN - ETHER_CRC_LEN)) {
 		printf("%s: large packet discarded\n", sc->sc_dev.dv_xname);
 		ifp->if_oerrors++;
-		IFQ_DEQUEUE(&ifp->if_snd, m);
+		ifq_deq_commit(&ifp->if_snd, m);
 		m_freem(m);
 		goto readcheck;
 	}
@@ -620,6 +620,7 @@ smc91cxx_start(ifp)
 		ifp->if_timer = 5;
 		ifp->if_flags |= IFF_OACTIVE;
 
+		ifq_deq_rollback(&ifp->if_snd, m);
 		return;
 	}
 
@@ -645,7 +646,7 @@ smc91cxx_start(ifp)
 	 * Get the packet from the kernel.  This will include the Ethernet
 	 * frame header, MAC address, etc.
 	 */
-	IFQ_DEQUEUE(&ifp->if_snd, m);
+	ifq_deq_commit(&ifp->if_snd, m);
 
 	/*
 	 * Push the packet out to the card.
diff --git a/sys/dev/ic/ti.c b/sys/dev/ic/ti.c
index e40dd748c25..fb49a965d6c 100644
--- a/sys/dev/ic/ti.c
+++ b/sys/dev/ic/ti.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ti.c,v 1.19 2015/11/14 17:54:57 mpi Exp $	*/
+/*	$OpenBSD: ti.c,v 1.20 2015/11/20 03:35:22 dlg Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 1999
@@ -1961,7 +1961,7 @@ ti_start(struct ifnet *ifp)
 	prodidx = sc->ti_tx_saved_prodidx;
 
 	while(sc->ti_cdata.ti_tx_chain[prodidx] == NULL) {
-		IFQ_POLL(&ifp->if_snd, m_head);
+		m_head = ifq_deq_begin(&ifp->if_snd);
 		if (m_head == NULL)
 			break;
 
@@ -1976,12 +1976,13 @@ ti_start(struct ifnet *ifp)
 			error = ti_encap_tigon2(sc, m_head, &prodidx);
 
 		if (error) {
+			ifq_deq_rollback(&ifp->if_snd, m_head);
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
 		}
 
 		/* now we are committed to transmit the packet */
-		IFQ_DEQUEUE(&ifp->if_snd, m_head);
+		ifq_deq_commit(&ifp->if_snd, m_head);
 		pkts++;
 
 		/*