PERFORCE change 139290 for review

[Sam Leffler]

http://perforce.freebsd.org/chv.cgi?CH=139290

Change 139290 by sam at sam_ebb on 2008/04/03 20:58:31

	Bite the bullet and hold the com lock across driver callbacks
	to close various races and make state machine locking more sane:
	o hold the com lock across the ioctl call to mark the parent
	  device up/down; this mostly causes problems for devices that
	  load firmware in their init routine as the filesystem calls
	  used by firwmare(9) malloc memory with M_WAITOK and we have
	  no way, short of dropping the lock inside the driver, to cope
	  (this is really an issue that needs to be resolved in firmware et al)
	o hold the com lock while locking the vap list to stop all vap's;
	  this is a noop as this routine is currently unused but closes
	  another case of unlocked vap list traversal
	
	While here add an assert to ieee80211_new_state_locked.

Affected files ...

.. //depot/projects/vap/sys/net80211/ieee80211_proto.c#27 edit

Differences ...

==== //depot/projects/vap/sys/net80211/ieee80211_proto.c#27 (text+ko) ====

@@ -1088,10 +1088,7 @@
 			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
 			    "%s: up parent %s\n", __func__, parent->if_xname);
 			parent->if_flags |= IFF_UP;
-			/* XXX drop lock */
-			IEEE80211_UNLOCK(ic);
 			parent->if_ioctl(parent, SIOCSIFFLAGS, NULL);
-			IEEE80211_LOCK(ic);
 		}
 		/*
 		 * Mark us running.  Note that we do this after
@@ -1242,14 +1239,15 @@
 	struct ifnet *parent = ic->ic_ifp;
 	struct ieee80211vap *vap;
 
+	IEEE80211_LOCK(ic);
 	/* XXX shouldn't touch driver state */
 	parent->if_drv_flags &= ~IFF_DRV_RUNNING;
-	/* XXX locking */
 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 		struct ifnet *ifp = vap->iv_ifp;
 		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
-			ieee80211_stop(vap);
+			ieee80211_stop_locked(vap);
 	}
+	IEEE80211_UNLOCK(ic);
 }
 
 /*
@@ -1540,6 +1538,8 @@
 	enum ieee80211_state ostate;
 	int nrunning, nscanning, rc;
 
+	IEEE80211_LOCK_ASSERT(ic);
+
 	nrunning = nscanning = 0;
 	/* XXX can track this state instead of calculating */
 	TAILQ_FOREACH(vp, &ic->ic_vaps, iv_next) {