SCSI DMA correctness

scsiconf.c

 /*      $OpenBSD: scsiconf.c,v 1.167 2010/10/12 00:53:32 krw Exp $      */
 /*      $NetBSD: scsiconf.c,v 1.57 1996/05/02 01:09:01 neil Exp $       */
 
 /*
  * Copyright (c) 1994 Charles Hannum.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 36 matching lines @@
  * Ported to run under 386BSD by Julian Elischer (julian@tfs.com) Sept 1992
  */
 
 #include "bio.h"
 #include "mpath.h"
 
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/device.h>
 #include <sys/buf.h>
 #include <sys/lock.h>
 
 #include <scsi/scsi_all.h>
 #include <scsi/scsiconf.h>
 
 #if NBIO > 0
 #include <sys/ioctl.h>
 #include <sys/scsiio.h>
@@ skipping 307 matching lines @@
 
         if (scsi_probe_lun(sc, target, 0) == EINVAL)
                 return (EINVAL);
 
         link = scsi_get_link(sc, target, 0);
         if (link == NULL)
                 return (ENXIO);
 
         if ((link->flags & (SDEV_UMASS | SDEV_ATAPI)) == 0 &&
             SCSISPC(link->inqdata.version) > 2) {
-                report = malloc(sizeof(*report), M_TEMP, M_WAITOK);
+                report = dma_alloc(sizeof(*report), PR_WAITOK);
                 if (report == NULL)
                         goto dumbscan;
 
                 if (scsi_report_luns(link, REPORT_NORMAL, report,
                     sizeof(*report), scsi_autoconf | SCSI_SILENT |
                     SCSI_IGNORE_ILLEGAL_REQUEST | SCSI_IGNORE_NOT_READY |
                     SCSI_IGNORE_MEDIA_CHANGE, 10000) != 0) {
-                        free(report, M_TEMP);
+                        dma_free(report, sizeof(*report));
                         goto dumbscan;
                 }
 
                 /*
                  * XXX In theory we should check if data is full, which
                  * would indicate it needs to be enlarged and REPORT
                  * LUNS tried again. Solaris tries up to 3 times with
                  * larger sizes for data.
                  */
                 nluns = _4btol(report->length) / RPL_LUNDATA_SIZE;
                 for (i = 0; i < nluns; i++) {
                         if (report->luns[i].lundata[0] != 0)
                                 continue;
                         lun = report->luns[i].lundata[RPL_LUNDATA_T0LUN];
                         if (lun == 0)
                                 continue;
 
                         /* Probe the provided LUN. Don't check LUN 0. */
                         scsi_remove_link(sc, link);
                         scsi_probe_lun(sc, target, lun);
                         scsi_add_link(sc, link);
                 }
 
-                free(report, M_TEMP);
+                dma_free(report, sizeof(*report));
                 return (0);
         }
 
 dumbscan:
         for (i = 1; i < alink->luns; i++) {
                 if (scsi_probe_lun(sc, target, i) == EINVAL)
                         break;
         }
 
         return (0);
@@ skipping 702 matching lines @@
 
         return (bestmatch);
 }
 
 void
 scsi_devid(struct scsi_link *link)
 {
         struct {
                 struct scsi_vpd_hdr hdr;
                 u_int8_t list[32];
-        } __packed pg;
+        } __packed *pg;
         int pg80 = 0, pg83 = 0, i;
         size_t len;
 
         if (link->id != NULL)
                 return;
 
+        pg = dma_alloc(sizeof(*pg), PR_WAITOK | PR_ZERO);
+
         if (SCSISPC(link->inqdata.version) >= 2) {
-                if (scsi_inquire_vpd(link, &pg, sizeof(pg), SI_PG_SUPPORTED,
+                if (scsi_inquire_vpd(link, pg, sizeof(pg), SI_PG_SUPPORTED,

[Matthew Dempsky, 2011/03/12 02:06:00]

Need sizeof(*pg) here.

                     scsi_autoconf) != 0)
-                        return;
+                        goto done;
 
-                len = MIN(sizeof(pg.list), _2btol(pg.hdr.page_length));
+                len = MIN(sizeof(pg->list), _2btol(pg->hdr.page_length));
                 for (i = 0; i < len; i++) {
-                        switch (pg.list[i]) {
+                        switch (pg->list[i]) {
                         case SI_PG_SERIAL:
                                 pg80 = 1;
                                 break;
                         case SI_PG_DEVID:
                                 pg83 = 1;
                                 break;
                         }
                 }
 
                 if (pg83 && scsi_devid_pg83(link) == 0)
-                        return;
+                        goto done;
 #ifdef notyet
                 if (pg80 && scsi_devid_pg80(link) == 0)
-                        return;
+                        goto done;
 #endif
         }
+done:
+        dma_free(pg, sizeof(*pg));
 }
 
 int
 scsi_devid_pg83(struct scsi_link *link)
 {
-        struct scsi_vpd_hdr hdr;
+        struct scsi_vpd_hdr *hdr = NULL;
         struct scsi_vpd_devid_hdr dhdr, chdr;
-        u_int8_t *pg, *id;
+        u_int8_t *pg = NULL, *id;
         int type, idtype = 0;
         u_char idflags;
         int len, pos;
         int rv;
 
-        rv = scsi_inquire_vpd(link, &hdr, sizeof(hdr), SI_PG_DEVID,
+        hdr = dma_alloc(sizeof(*hdr), PR_WAITOK | PR_ZERO);
+
+        rv = scsi_inquire_vpd(link, hdr, sizeof(*hdr), SI_PG_DEVID,
             scsi_autoconf);
         if (rv != 0)
-                return (rv);
+                goto done;
 
-        len = sizeof(hdr) + _2btol(hdr.page_length);
-        pg = malloc(len, M_TEMP, M_WAITOK);
+        len = sizeof(*hdr) + _2btol(hdr->page_length);
+        pg = dma_alloc(len, PR_WAITOK | PR_ZERO);
 
         rv = scsi_inquire_vpd(link, pg, len, SI_PG_DEVID, scsi_autoconf);
         if (rv != 0)
-                goto err;
+                goto done;
 
-        pos = sizeof(hdr);
+        pos = sizeof(*hdr);
 
         do {
                 if (len - pos < sizeof(dhdr)) {
                         rv = EIO;
-                        goto err;
+                        goto done;
                 }
                 memcpy(&dhdr, &pg[pos], sizeof(dhdr));
                 pos += sizeof(dhdr);
                 if (len - pos < dhdr.len) {
                         rv = EIO;
-                        goto err;
+                        goto done;
                 }
 
                 if (VPD_DEVID_ASSOC(dhdr.flags) == VPD_DEVID_ASSOC_LU) {
                         type = VPD_DEVID_TYPE(dhdr.flags);
                         switch (type) {
                         case VPD_DEVID_TYPE_NAA:
                         case VPD_DEVID_TYPE_EUI64:
                         case VPD_DEVID_TYPE_T10:
                                 if (type >= idtype) {
                                         idtype = type;
@@ skipping 30 matching lines @@
                         idflags = DEVID_F_PRINT;
                         break;
                 default:
                         idflags = 0;
                         break;
                 }
                 link->id = devid_alloc(idtype, idflags, chdr.len, id);
         } else
                 rv = ENODEV;
 
-err:
-        free(pg, M_TEMP);
+done:
+        if (pg)
+                dma_free(pg, sizeof(*pg));

[Matthew Dempsky, 2011/03/12 02:06:00]

Should be dma_free(pg, len).

+        if (hdr)
+                dma_free(hdr, len);

[Matthew Dempsky, 2011/03/12 02:06:00]

Should be dma_free(hdr, sizeof(*hdr)).

         return (rv);
 }
 
 /*
  * scsi_minphys member of struct scsi_adapter for drivers which don't
  * need any specific routine.
  */
 void
 scsi_minphys(struct buf *bp, struct scsi_link *sl)
 {
@@ skipping 24 matching lines @@
         d->d_refcount++;
         return (d);
 }
 
 void
 devid_free(struct devid *d)
 {
         if (--d->d_refcount == 0)
                 free(d, M_DEVBUF);
 }