use dma_alloc/dma_free instead of malloc to allocate buffers which need

to be in the right address space.
help from matthew and krw

9 files changed, 373 insertions, 297 deletions

diff --git a/sys/scsi/cd.c b/sys/scsi/cd.c
index 37ddf0529b4..24432963952 100644
--- a/sys/scsi/cd.c
+++ b/sys/scsi/cd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cd.c,v 1.197 2010/11/22 12:21:46 krw Exp $	*/
+/*	$OpenBSD: cd.c,v 1.198 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: cd.c,v 1.100 1997/04/02 02:29:30 mycroft Exp $	*/
 
 /*
@@ -58,6 +58,7 @@
 #include <sys/buf.h>
 #include <sys/uio.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/errno.h>
 #include <sys/device.h>
 #include <sys/disklabel.h>
@@ -922,37 +923,46 @@ cdioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
 		break;
 	}
 	case CDIOCREADSUBCHANNEL: {
-		struct ioc_read_subchannel *args
-		= (struct ioc_read_subchannel *)addr;
-		struct cd_sub_channel_info data;
+		struct ioc_read_subchannel *args =
+		    (struct ioc_read_subchannel *)addr;
+		struct cd_sub_channel_info *data;
 		int len = args->data_len;
-		if (len > sizeof(data) ||
+
+		if (len > sizeof(*data) ||
 		    len < sizeof(struct cd_sub_channel_header)) {
 			error = EINVAL;
 			break;
 		}
+		data = dma_alloc(sizeof(*data), PR_WAITOK);
 		error = cd_read_subchannel(sc, args->address_format,
-		    args->data_format, args->track, &data, len);
-		if (error)
+		    args->data_format, args->track, data, len);
+		if (error) {
+			dma_free(data, sizeof(*data));
 			break;
-		len = min(len, _2btol(data.header.data_len) +
+		}
+		len = min(len, _2btol(data->header.data_len) +
 		    sizeof(struct cd_sub_channel_header));
-		error = copyout(&data, args->data, len);
+		error = copyout(data, args->data, len);
+		dma_free(data, sizeof(*data));
 		break;
 	}
 	case CDIOREADTOCHEADER: {
-		struct ioc_toc_header th;
+		struct ioc_toc_header *th;
 
-		if ((error = cd_read_toc(sc, 0, 0, &th, sizeof(th), 0)) != 0)
+		th = dma_alloc(sizeof(*th), PR_WAITOK);
+		if ((error = cd_read_toc(sc, 0, 0, th, sizeof(*th), 0)) != 0) {
+			dma_free(th, sizeof(*th));
 			break;
+		}
 		if (sc->sc_link->quirks & ADEV_LITTLETOC)
-			th.len = letoh16(th.len);
+			th->len = letoh16(th->len);
 		else
-			th.len = betoh16(th.len);
-		if (th.len > 0)
-			bcopy(&th, addr, sizeof(th));
+			th->len = betoh16(th->len);
+		if (th->len > 0)
+			bcopy(th, addr, sizeof(*th));
 		else
 			error = EIO;
+		dma_free(th, sizeof(*th));
 		break;
 	}
 	case CDIOREADTOCENTRYS: {
@@ -964,20 +974,20 @@ cdioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
 		int len = te->data_len;
 		int ntracks;
 
-		toc = malloc(sizeof(*toc), M_TEMP, M_WAITOK | M_ZERO);
+		toc = dma_alloc(sizeof(*toc), PR_WAITOK | PR_ZERO);
 
 		th = &toc->header;
 
 		if (len > sizeof(toc->entries) ||
 		    len < sizeof(struct cd_toc_entry)) {
-			free(toc, M_TEMP);
+			dma_free(toc, sizeof(*toc));
 			error = EINVAL;
 			break;
 		}
 		error = cd_read_toc(sc, te->address_format, te->starting_track,
 		    toc, len + sizeof(struct ioc_toc_header), 0);
 		if (error) {
-			free(toc, M_TEMP);
+			dma_free(toc, sizeof(*toc));
 			break;
 		}
 		if (te->address_format == CD_LBA_FORMAT)
@@ -1002,7 +1012,7 @@ cdioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
 		    sizeof(th->ending_track)));
 
 		error = copyout(toc->entries, te->data, len);
-		free(toc, M_TEMP);
+		dma_free(toc, sizeof(*toc));
 		break;
 	}
 	case CDIOREADMSADDR: {
@@ -1015,14 +1025,14 @@ cdioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
 			break;
 		}
 
-		toc = malloc(sizeof(*toc), M_TEMP, M_WAITOK | M_ZERO);
+		toc = dma_alloc(sizeof(*toc), PR_WAITOK | PR_ZERO);
 
 		error = cd_read_toc(sc, 0, 0, toc,
 		    sizeof(struct ioc_toc_header) + sizeof(struct cd_toc_entry),
 		    0x40 /* control word for "get MS info" */);
 
 		if (error) {
-			free(toc, M_TEMP);
+			dma_free(toc, sizeof(*toc));
 			break;
 		}
 
@@ -1041,7 +1051,7 @@ cdioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
 
 		*(int *)addr = (toc->header.len >= 10 && cte->track > 1) ?
 			cte->addr.lba : 0;
-		free(toc, M_TEMP);
+		dma_free(toc, sizeof(*toc));
 		break;
 	}
 	case CDIOCSETPATCH: {
@@ -1186,8 +1196,6 @@ cdgetdisklabel(dev_t dev, struct cd_softc *sc, struct disklabel *lp,
 
 	bzero(lp, sizeof(struct disklabel));
 
-	toc = malloc(sizeof(*toc), M_TEMP, M_WAITOK | M_ZERO);
-
 	lp->d_secsize = sc->params.secsize;
 	lp->d_ntracks = 1;
 	lp->d_nsectors = 100;
@@ -1214,6 +1222,7 @@ cdgetdisklabel(dev_t dev, struct cd_softc *sc, struct disklabel *lp,
 	lp->d_magic2 = DISKMAGIC;
 	lp->d_checksum = dkcksum(lp);
 
+	toc = dma_alloc(sizeof(*toc), PR_WAITOK | PR_ZERO);
 	if (cd_load_toc(sc, toc, CD_LBA_FORMAT)) {
 		audioonly = 0; /* No valid TOC found == not an audio CD. */
 		goto done;
@@ -1227,7 +1236,7 @@ cdgetdisklabel(dev_t dev, struct cd_softc *sc, struct disklabel *lp,
 		}
 
 done:
-	free(toc, M_TEMP);
+	dma_free(toc, sizeof(*toc));
 
 	if (audioonly)
 		return (0);
@@ -1241,7 +1250,7 @@ cd_setchan(struct cd_softc *sc, int p0, int p1, int p2, int p3, int flags)
 	struct cd_audio_page *audio = NULL;
 	int error, big;
 
-	data = malloc(sizeof(*data), M_TEMP, M_NOWAIT);
+	data = dma_alloc(sizeof(*data), PR_NOWAIT);
 	if (data == NULL)
 		return (ENOMEM);
 
@@ -1263,7 +1272,7 @@ cd_setchan(struct cd_softc *sc, int p0, int p1, int p2, int p3, int flags)
 			    &data->hdr, flags, 20000);
 	}
 
-	free(data, M_TEMP);
+	dma_free(data, sizeof(*data));
 	return (error);
 }
 
@@ -1274,7 +1283,7 @@ cd_getvol(struct cd_softc *sc, struct ioc_vol *arg, int flags)
 	struct cd_audio_page *audio = NULL;
 	int error;
 
-	data = malloc(sizeof(*data), M_TEMP, M_NOWAIT);
+	data = dma_alloc(sizeof(*data), PR_NOWAIT);
 	if (data == NULL)
 		return (ENOMEM);
 
@@ -1290,7 +1299,7 @@ cd_getvol(struct cd_softc *sc, struct ioc_vol *arg, int flags)
 		arg->vol[3] = audio->port[3].volume;
 	}
 
-	free(data, M_TEMP);
+	dma_free(data, sizeof(*data));
 	return (0);
 }
 
@@ -1302,7 +1311,7 @@ cd_setvol(struct cd_softc *sc, const struct ioc_vol *arg, int flags)
 	u_int8_t mask_volume[4];
 	int error, big;
 
-	data = malloc(sizeof(*data), M_TEMP, M_NOWAIT);
+	data = dma_alloc(sizeof(*data), PR_NOWAIT);
 	if (data == NULL)
 		return (ENOMEM);
 
@@ -1312,7 +1321,7 @@ cd_setvol(struct cd_softc *sc, const struct ioc_vol *arg, int flags)
 	if (error == 0 && audio == NULL)
 		error = EIO;
 	if (error != 0) {
-		free(data, M_TEMP);
+		dma_free(data, sizeof(*data));
 		return (error);
 	}
 
@@ -1326,7 +1335,7 @@ cd_setvol(struct cd_softc *sc, const struct ioc_vol *arg, int flags)
 	if (error == 0 && audio == NULL)
 		error = EIO;
 	if (error != 0) {
-		free(data, M_TEMP);
+		dma_free(data, sizeof(*data));
 		return (error);
 	}
 
@@ -1342,7 +1351,7 @@ cd_setvol(struct cd_softc *sc, const struct ioc_vol *arg, int flags)
 		error = scsi_mode_select(sc->sc_link, SMS_PF,
 		    &data->hdr, flags, 20000);
 
-	free(data, M_TEMP);
+	dma_free(data, sizeof(*data));
 	return (error);
 }
 
@@ -1381,7 +1390,7 @@ cd_set_pa_immed(struct cd_softc *sc, int flags)
 		/* XXX Noop? */
 		return (0);
 
-	data = malloc(sizeof(*data), M_TEMP, M_NOWAIT);
+	data = dma_alloc(sizeof(*data), PR_NOWAIT);
 	if (data == NULL)
 		return (ENOMEM);
 
@@ -1404,7 +1413,7 @@ cd_set_pa_immed(struct cd_softc *sc, int flags)
 		}
 	}
 
-	free(data, M_TEMP);
+	dma_free(data, sizeof(*data));
 	return (error);
 }
 
@@ -1451,7 +1460,7 @@ cd_play_tracks(struct cd_softc *sc, int strack, int sindex, int etrack,
 	if (strack > etrack)
 		return (EINVAL);
 
-	toc = malloc(sizeof(*toc), M_TEMP, M_WAITOK | M_ZERO);
+	toc = dma_alloc(sizeof(*toc), PR_WAITOK | PR_ZERO);
 
 	if ((error = cd_load_toc(sc, toc, CD_MSF_FORMAT)) != 0)
 		goto done;
@@ -1490,7 +1499,7 @@ cd_play_tracks(struct cd_softc *sc, int strack, int sindex, int etrack,
 	    endm, ends, endf);
 
 done:
-	free(toc, M_TEMP);
+	dma_free(toc, sizeof(*toc));
 	return (error);
 }
 
@@ -1709,22 +1718,28 @@ cddump(dev_t dev, daddr64_t secno, caddr_t va, size_t size)
 #define	dvd_copy_key(dst, src)		bcopy((src), (dst), DVD_KEY_SIZE)
 #define	dvd_copy_challenge(dst, src)	bcopy((src), (dst), DVD_CHALLENGE_SIZE)
 
+#define DVD_AUTH_BUFSIZE		20
+
 int
 dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 {
 	struct scsi_generic *cmd;
 	struct scsi_xfer *xs;
-	u_int8_t buf[20];
+	u_int8_t *buf;
 	int error;
 
-	xs = scsi_xs_get(sc->sc_link, 0);
-	if (xs == NULL)
+	buf = dma_alloc(DVD_AUTH_BUFSIZE, PR_WAITOK | PR_ZERO);
+	if (buf == NULL)
 		return (ENOMEM);
+
+	xs = scsi_xs_get(sc->sc_link, 0);
+	if (xs == NULL) {
+		error = ENOMEM;
+		goto done;
+	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->timeout = 30000;
-	xs->data = (void *)&buf;
-
-	bzero(buf, sizeof(buf));
+	xs->data = buf;
 
 	cmd = xs->cmd;
 
@@ -1741,7 +1756,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 
 		if (error == 0)
 			a->lsa.agid = buf[7] >> 6;
-		return (error);
+		break;
 
 	case DVD_LU_SEND_CHALLENGE:
 		cmd->opcode = GPCMD_REPORT_KEY;
@@ -1754,7 +1769,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 		scsi_xs_put(xs);
 		if (error == 0)
 			dvd_copy_challenge(a->lsc.chal, &buf[4]);
-		return (error);
+		break;
 
 	case DVD_LU_SEND_KEY1:
 		cmd->opcode = GPCMD_REPORT_KEY;
@@ -1768,7 +1783,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 
 		if (error == 0)
 			dvd_copy_key(a->lsk.key, &buf[4]);
-		return (error);
+		break;
 
 	case DVD_LU_SEND_TITLE_KEY:
 		cmd->opcode = GPCMD_REPORT_KEY;
@@ -1787,7 +1802,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 			a->lstk.cgms = (buf[4] >> 4) & 3;
 			dvd_copy_key(a->lstk.title_key, &buf[5]);
 		}
-		return (error);
+		break;
 
 	case DVD_LU_SEND_ASF:
 		cmd->opcode = GPCMD_REPORT_KEY;
@@ -1801,7 +1816,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 
 		if (error == 0)
 			a->lsasf.asf = buf[7] & 1;
-		return (error);
+		break;
 
 	case DVD_HOST_SEND_CHALLENGE:
 		cmd->opcode = GPCMD_SEND_KEY;
@@ -1817,7 +1832,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 
 		if (error == 0)
 			a->type = DVD_LU_SEND_KEY1;
-		return (error);
+		break;
 
 	case DVD_HOST_SEND_KEY2:
 		cmd->opcode = GPCMD_SEND_KEY;
@@ -1835,7 +1850,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 			a->type = DVD_AUTH_ESTABLISHED;
 		else
 			a->type = DVD_AUTH_FAILURE;
-		return (error);
+		break;
 
 	case DVD_INVALIDATE_AGID:
 		cmd->opcode = GPCMD_REPORT_KEY;
@@ -1844,8 +1859,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 
 		error = scsi_xs_sync(xs);
 		scsi_xs_put(xs);
-
-		return (error);
+		break;
 
 	case DVD_LU_SEND_RPC_STATE:
 		cmd->opcode = GPCMD_REPORT_KEY;
@@ -1864,7 +1878,7 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 			a->lrpcs.region_mask = buf[5];
 			a->lrpcs.rpc_scheme = buf[6];
 		}
-		return (error);
+		break;
 
 	case DVD_HOST_SEND_RPC_STATE:
 		cmd->opcode = GPCMD_SEND_KEY;
@@ -1877,38 +1891,46 @@ dvd_auth(struct cd_softc *sc, union dvd_authinfo *a)
 
 		error = scsi_xs_sync(xs);
 		scsi_xs_put(xs);
-
-		return (error);
+		break;
 
 	default:
 		scsi_xs_put(xs);
-		return (ENOTTY);
+		error = ENOTTY;
+		break;
 	}
+done:
+	dma_free(buf, DVD_AUTH_BUFSIZE);
+	return (error);
 }
 
+#define DVD_READ_PHYSICAL_BUFSIZE (4 + 4 * 20)
 int
 dvd_read_physical(struct cd_softc *sc, union dvd_struct *s)
 {
 	struct scsi_generic *cmd;
 	struct dvd_layer *layer;
 	struct scsi_xfer *xs;
-	u_int8_t buf[4 + 4 * 20], *bufp;
+	u_int8_t *buf, *bufp;
 	int error, i;
 
-	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
-	if (xs == NULL)
+	buf = dma_alloc(DVD_READ_PHYSICAL_BUFSIZE, PR_WAITOK | PR_ZERO);
+	if (buf == NULL)
 		return (ENOMEM);
+
+	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
+	if (xs == NULL) {
+		error = ENOMEM;
+		goto done;
+	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->data = buf;
-	xs->datalen = sizeof(buf);
+	xs->datalen = DVD_READ_PHYSICAL_BUFSIZE;
 	xs->timeout = 30000;
 
-	bzero(buf, sizeof(buf));
-
 	cmd = xs->cmd;
 	cmd->opcode = GPCMD_READ_DVD_STRUCTURE;
 	cmd->bytes[6] = s->type;
-	_lto2b(sizeof(buf), &cmd->bytes[7]);
+	_lto2b(xs->datalen, &cmd->bytes[7]);
 
 	cmd->bytes[5] = s->physical.layer_num;
 
@@ -1934,31 +1956,38 @@ dvd_read_physical(struct cd_softc *sc, union dvd_struct *s)
 			layer->bca = bufp[16] >> 7;
 		}
 	}
+done:
+	dma_free(buf, DVD_READ_PHYSICAL_BUFSIZE);
 	return (error);
 }
 
+#define DVD_READ_COPYRIGHT_BUFSIZE	8
 int
 dvd_read_copyright(struct cd_softc *sc, union dvd_struct *s)
 {
 	struct scsi_generic *cmd;
 	struct scsi_xfer *xs;
-	u_int8_t buf[8];
+	u_int8_t *buf;
 	int error;
 
-	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
-	if (xs == NULL)
+	buf = dma_alloc(DVD_READ_COPYRIGHT_BUFSIZE, PR_WAITOK | PR_ZERO);
+	if (buf == NULL)
 		return (ENOMEM);
+
+	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
+	if (xs == NULL) {
+		error = ENOMEM;
+		goto done;
+	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->data = buf;
-	xs->datalen = sizeof(buf);
+	xs->datalen = DVD_READ_COPYRIGHT_BUFSIZE;
 	xs->timeout = 30000;
 
-	bzero(buf, sizeof(buf));
-
 	cmd = xs->cmd;
 	cmd->opcode = GPCMD_READ_DVD_STRUCTURE;
 	cmd->bytes[6] = s->type;
-	_lto2b(sizeof(buf), &cmd->bytes[7]);
+	_lto2b(xs->datalen, &cmd->bytes[7]);
 
 	cmd->bytes[5] = s->copyright.layer_num;
 
@@ -1969,7 +1998,8 @@ dvd_read_copyright(struct cd_softc *sc, union dvd_struct *s)
 		s->copyright.cpst = buf[4];
 		s->copyright.rmi = buf[5];
 	}
-
+done:
+	dma_free(buf, DVD_READ_COPYRIGHT_BUFSIZE);
 	return (error);
 }
 
@@ -1981,14 +2011,14 @@ dvd_read_disckey(struct cd_softc *sc, union dvd_struct *s)
 	struct scsi_xfer *xs;
 	int error;
 
-	buf = malloc(sizeof(*buf), M_TEMP, M_WAITOK | M_ZERO);
+	buf = dma_alloc(sizeof(*buf), PR_WAITOK | PR_ZERO);
 	if (buf == NULL)
 		return (ENOMEM);
 
 	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
 	if (xs == NULL) {
-		free(buf, M_TEMP);
-		return (ENOMEM);
+		error = ENOMEM;
+		goto done;
 	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->data = (void *)buf;
@@ -1999,40 +2029,46 @@ dvd_read_disckey(struct cd_softc *sc, union dvd_struct *s)
 	cmd->opcode = GPCMD_READ_DVD_STRUCTURE;
 	cmd->format = s->type;
 	cmd->agid = s->disckey.agid << 6;
-	_lto2b(sizeof(*buf), cmd->length);
+	_lto2b(xs->datalen, cmd->length);
 
 	error = scsi_xs_sync(xs);
 	scsi_xs_put(xs);
 
 	if (error == 0)
 		bcopy(buf->data, s->disckey.value, sizeof(s->disckey.value));
-
-	free(buf, M_TEMP);
+done:
+	dma_free(buf, sizeof(*buf));
 	return (error);
 }
 
+#define DVD_READ_BCA_BUFLEN (4 + 188)
+
 int
 dvd_read_bca(struct cd_softc *sc, union dvd_struct *s)
 {
 	struct scsi_generic *cmd;
 	struct scsi_xfer *xs;
-	u_int8_t buf[4 + 188];
+	u_int8_t *buf;
 	int error;
 
-	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
-	if (xs == NULL)
+	buf = dma_alloc(DVD_READ_BCA_BUFLEN, PR_WAITOK | PR_ZERO);
+	if (buf == NULL)
 		return (ENOMEM);
+
+	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
+	if (xs == NULL) {
+		error = ENOMEM;
+		goto done;
+	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->data = buf;
-	xs->datalen = sizeof(buf);
+	xs->datalen = DVD_READ_BCA_BUFLEN;
 	xs->timeout = 30000;
 
-	bzero(buf, sizeof(buf));
-
 	cmd = xs->cmd;
 	cmd->opcode = GPCMD_READ_DVD_STRUCTURE;
 	cmd->bytes[6] = s->type;
-	_lto2b(sizeof(buf), &cmd->bytes[7]);
+	_lto2b(xs->datalen, &cmd->bytes[7]);
 
 	error = scsi_xs_sync(xs);
 	scsi_xs_put(xs);
@@ -2043,6 +2079,8 @@ dvd_read_bca(struct cd_softc *sc, union dvd_struct *s)
 			return (EIO);
 		bcopy(&buf[4], s->bca.value, s->bca.len);
 	}
+done:
+	dma_free(buf, DVD_READ_BCA_BUFLEN);
 	return (error);
 }
 
@@ -2054,14 +2092,14 @@ dvd_read_manufact(struct cd_softc *sc, union dvd_struct *s)
 	struct scsi_xfer *xs;
 	int error;
 
-	buf = malloc(sizeof(*buf), M_TEMP, M_WAITOK | M_ZERO);
+	buf = dma_alloc(sizeof(*buf), PR_WAITOK | PR_ZERO);
 	if (buf == NULL)
 		return (ENOMEM);
 
 	xs = scsi_xs_get(sc->sc_link, SCSI_DATA_IN);
 	if (xs == NULL) {
-		free(buf, M_TEMP);
-		return (ENOMEM);
+		error = ENOMEM;
+		goto done;
 	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->data = (void *)buf;
@@ -2071,7 +2109,7 @@ dvd_read_manufact(struct cd_softc *sc, union dvd_struct *s)
 	cmd = (struct scsi_read_dvd_structure *)xs->cmd;
 	cmd->opcode = GPCMD_READ_DVD_STRUCTURE;
 	cmd->format = s->type;
-	_lto2b(sizeof(*buf), cmd->length);
+	_lto2b(xs->datalen, cmd->length);
 
 	error = scsi_xs_sync(xs);
 	scsi_xs_put(xs);
@@ -2083,8 +2121,8 @@ dvd_read_manufact(struct cd_softc *sc, union dvd_struct *s)
 		else
 			error = EIO;
 	}
-
-	free(buf, M_TEMP);
+done:
+	dma_free(buf, sizeof(*buf));
 	return (error);
 }
 
diff --git a/sys/scsi/ch.c b/sys/scsi/ch.c
index 9429c09a91f..4369c6d0935 100644
--- a/sys/scsi/ch.c
+++ b/sys/scsi/ch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ch.c,v 1.43 2010/08/30 02:47:56 matthew Exp $	*/
+/*	$OpenBSD: ch.c,v 1.44 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: ch.c,v 1.26 1997/02/21 22:06:52 thorpej Exp $	*/
 
 /*
@@ -46,6 +46,7 @@
 #include <sys/chio.h>
 #include <sys/device.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/conf.h>
 #include <sys/fcntl.h>
 
@@ -580,8 +581,9 @@ ch_usergetelemstatus(sc, cesr)
 	 * we can allocate enough storage for all of them.  We assume
 	 * that the first one can fit into 1k.
 	 */
-	data = malloc(1024, M_DEVBUF, M_WAITOK);
-	error = ch_getelemstatus(sc, sc->sc_firsts[chet], 1, data, 1024,
+	size = 1024;
+	data = dma_alloc(size, PR_WAITOK);
+	error = ch_getelemstatus(sc, sc->sc_firsts[chet], 1, data, size,
 	    want_voltags);
 	if (error)
 		goto done;
@@ -590,16 +592,16 @@ ch_usergetelemstatus(sc, cesr)
 	pg_hdr = (struct read_element_status_page_header *) (st_hdr + 1);
 	desclen = _2btol(pg_hdr->edl);
 
-	size = sizeof(struct read_element_status_header) +
-	    sizeof(struct read_element_status_page_header) +
-	    (desclen * sc->sc_counts[chet]);
+	dma_free(data, size);
 
 	/*
 	 * Reallocate storage for descriptors and get them from the
 	 * device.
 	 */
-	free(data, M_DEVBUF);
-	data = malloc(size, M_DEVBUF, M_WAITOK);
+	size = sizeof(struct read_element_status_header) +
+	    sizeof(struct read_element_status_page_header) +
+	    (desclen * sc->sc_counts[chet]);
+	data = dma_alloc(size, PR_WAITOK);
 	error = ch_getelemstatus(sc, sc->sc_firsts[chet],
 	    sc->sc_counts[chet], data, size, want_voltags);
 	if (error)
@@ -633,7 +635,7 @@ ch_usergetelemstatus(sc, cesr)
 
  done:
 	if (data != NULL)
-		free(data, M_DEVBUF);
+		dma_free(data, size);
 	if (user_data != NULL)
 		free(user_data, M_DEVBUF);
 	return (error);
@@ -693,7 +695,7 @@ ch_get_params(sc, flags)
 	int error, from;
 	u_int8_t *moves, *exchanges;
 
-	data = malloc(sizeof(*data), M_TEMP, M_NOWAIT);
+	data = dma_alloc(sizeof(*data), PR_NOWAIT);
 	if (data == NULL)
 		return (ENOMEM);
 
@@ -709,7 +711,7 @@ ch_get_params(sc, flags)
 		printf("%s: could not sense element address page\n",
 		    sc->sc_dev.dv_xname);
 #endif
-		free(data, M_TEMP);
+		dma_free(data, sizeof(*data));
 		return (error);
 	}
 
@@ -736,7 +738,7 @@ ch_get_params(sc, flags)
 		printf("%s: could not sense capabilities page\n",
 		    sc->sc_dev.dv_xname);
 #endif
-		free(data, M_TEMP);
+		dma_free(data, sizeof(*data));
 		return (error);
 	}
 
@@ -750,7 +752,7 @@ ch_get_params(sc, flags)
 	}
 
 	sc->sc_link->flags |= SDEV_MEDIA_LOADED;
-	free(data, M_TEMP);
+	dma_free(data, sizeof(*data));
 	return (0);
 }
 
diff --git a/sys/scsi/safte.c b/sys/scsi/safte.c
index 941d621f86e..cd76518a9c2 100644
--- a/sys/scsi/safte.c
+++ b/sys/scsi/safte.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: safte.c,v 1.46 2010/09/27 19:49:43 thib Exp $ */
+/*	$OpenBSD: safte.c,v 1.47 2011/03/17 21:30:24 deraadt Exp $ */
 
 /*
  * Copyright (c) 2005 David Gwynne <dlg@openbsd.org>
@@ -23,6 +23,7 @@
 #include <sys/device.h>
 #include <sys/scsiio.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/proc.h>
 #include <sys/rwlock.h>
 #include <sys/queue.h>
@@ -108,7 +109,7 @@ int64_t	safte_temp2uK(u_int8_t, int);
 int
 safte_match(struct device *parent, void *match, void *aux)
 {
-	struct scsi_inquiry_data inqbuf;
+	struct scsi_inquiry_data *inqbuf;
 	struct scsi_attach_args	*sa = aux;
 	struct scsi_inquiry_data *inq = sa->sa_inqbuf;
 	struct scsi_inquiry *cmd;
@@ -116,8 +117,6 @@ safte_match(struct device *parent, void *match, void *aux)
 	struct safte_inq *si;
 	int error, flags = 0, length;
 
-	si = (struct safte_inq *)&inqbuf.extra;
-
 	if (inq == NULL)
 		return (0);
 
@@ -126,7 +125,7 @@ safte_match(struct device *parent, void *match, void *aux)
 	    SCSISPC(inq->version) == 3)
 		return (2);
 
-	if ((inq->device & SID_TYPE) != T_PROCESSOR ||
+ 	if ((inq->device & SID_TYPE) != T_PROCESSOR ||
 	    SCSISPC(inq->version) != 2 ||
 	    (inq->response_format & SID_ANSII) != 2)
 		return (0);
@@ -134,16 +133,22 @@ safte_match(struct device *parent, void *match, void *aux)
 	length = inq->additional_length + SAFTE_EXTRA_OFFSET;
 	if (length < SAFTE_INQ_LEN)
 		return (0);
-	if (length > sizeof(inqbuf))
-		length = sizeof(inqbuf);
+	if (length > sizeof(*inqbuf))
+		length = sizeof(*inqbuf);
+
+	inqbuf = dma_alloc(sizeof(*inqbuf), PR_NOWAIT | PR_ZERO);
+	if (inqbuf == NULL)
+		return (0);
+
+	memset(inqbuf->extra, ' ', sizeof(inqbuf->extra));
 
 	if (cold)
 		flags |= SCSI_AUTOCONF;
 	xs = scsi_xs_get(sa->sa_sc_link, flags | SCSI_DATA_IN);
 	if (xs == NULL)
-		return (0);
+		goto fail;
 	xs->cmdlen = sizeof(*cmd);
-	xs->data = (void *)&inqbuf;
+	xs->data = (void *)inqbuf;
 	xs->datalen = length;
 	xs->retries = 2;
 	xs->timeout = 10000;
@@ -152,18 +157,20 @@ safte_match(struct device *parent, void *match, void *aux)
 	cmd->opcode = INQUIRY;
 	_lto2b(length, cmd->length);
 
-	memset(&inqbuf, 0, sizeof(inqbuf));
-	memset(&inqbuf.extra, ' ', sizeof(inqbuf.extra));
-
 	error = scsi_xs_sync(xs);
 	scsi_xs_put(xs);
 
 	if (error)
-		return (0);
+		goto fail;
 
-	if (memcmp(si->ident, SAFTE_IDENT, sizeof(si->ident)) == 0)
+	si = (struct safte_inq *)&inqbuf->extra;
+	if (memcmp(si->ident, SAFTE_IDENT, sizeof(si->ident)) == 0) {
+		dma_free(inqbuf, sizeof(*inqbuf));
 		return (2);
+	}
 
+fail:
+	dma_free(inqbuf, sizeof(*inqbuf));
 	return (0);
 }
 
@@ -220,7 +227,7 @@ safte_attach(struct device *parent, struct device *self, void *aux)
 	if (i) /* if we're doing something, then preinit encbuf and sensors */
 		safte_read_encstat(sc);
 	else {
-		free(sc->sc_encbuf, M_DEVBUF);
+		dma_free(sc->sc_encbuf, sc->sc_encbuflen);
 		sc->sc_encbuf = NULL;
 	}
 }
@@ -249,7 +256,7 @@ safte_detach(struct device *self, int flags)
 	}
 
 	if (sc->sc_encbuf != NULL)
-		free(sc->sc_encbuf, M_DEVBUF);
+		dma_free(sc->sc_encbuf, sc->sc_encbuflen);
 
 	rw_exit_write(&sc->sc_lock);
 
@@ -259,20 +266,26 @@ safte_detach(struct device *self, int flags)
 int
 safte_read_config(struct safte_softc *sc)
 {
-	struct safte_config config;
+	struct safte_config *config = NULL;
 	struct safte_readbuf_cmd *cmd;
 	struct safte_sensor *s;
 	struct scsi_xfer *xs;
-	int error, flags = 0, i, j;
+	int error = 0, flags = 0, i, j;
+
+	config = dma_alloc(sizeof(*config), PR_NOWAIT);
+	if (config == NULL)
+		return (1);
 
 	if (cold)
 		flags |= SCSI_AUTOCONF;
 	xs = scsi_xs_get(sc->sc_link, flags | SCSI_DATA_IN | SCSI_SILENT);
-	if (xs == NULL)
-		return (1);
+	if (xs == NULL) {
+		error = 1;
+		goto done;
+	}
 	xs->cmdlen = sizeof(*cmd);
-	xs->data = (void *)&config;
-	xs->datalen = sizeof(config);
+	xs->data = (void *)config;
+	xs->datalen = sizeof(*config);
 	xs->retries = 2;
 	xs->timeout = 30000;
 
@@ -280,42 +293,47 @@ safte_read_config(struct safte_softc *sc)
 	cmd->opcode = READ_BUFFER;
 	cmd->flags |= SAFTE_RD_MODE;
 	cmd->bufferid = SAFTE_RD_CONFIG;
-	cmd->length = htobe16(sizeof(config));
+	cmd->length = htobe16(sizeof(*config));
 
 	error = scsi_xs_sync(xs);
 	scsi_xs_put(xs);
 
-	if (error != 0)
-		return (1);
+	if (error != 0) {
+		error = 1;
+		goto done;
+	}
 
 	DPRINTF(("%s: nfans: %d npwrsup: %d nslots: %d doorlock: %d ntemps: %d"
-	    " alarm: %d celsius: %d ntherm: %d\n", DEVNAME(sc), config.nfans,
-	    config.npwrsup, config.nslots, config.doorlock, config.ntemps,
-	    config.alarm, SAFTE_CFG_CELSIUS(config.therm),
-	    SAFTE_CFG_NTHERM(config.therm)));
-
-	sc->sc_encbuflen = config.nfans * sizeof(u_int8_t) + /* fan status */
-	    config.npwrsup * sizeof(u_int8_t) + /* power supply status */
-	    config.nslots * sizeof(u_int8_t) + /* device scsi id (lun) */
+	    " alarm: %d celsius: %d ntherm: %d\n", DEVNAME(sc), config->nfans,
+	    config->npwrsup, config->nslots, config->doorlock, config->ntemps,
+	    config->alarm, SAFTE_CFG_CELSIUS(config->therm),
+	    SAFTE_CFG_NTHERM(config->therm)));
+
+	sc->sc_encbuflen = config->nfans * sizeof(u_int8_t) + /* fan status */
+	    config->npwrsup * sizeof(u_int8_t) + /* power supply status */
+	    config->nslots * sizeof(u_int8_t) + /* device scsi id (lun) */
 	    sizeof(u_int8_t) + /* door lock status */
 	    sizeof(u_int8_t) + /* speaker status */
-	    config.ntemps * sizeof(u_int8_t) + /* temp sensors */
+	    config->ntemps * sizeof(u_int8_t) + /* temp sensors */
 	    sizeof(u_int16_t); /* temp out of range sensors */
 
-	sc->sc_encbuf = malloc(sc->sc_encbuflen, M_DEVBUF, M_NOWAIT);
-	if (sc->sc_encbuf == NULL)
-		return (1);
+	sc->sc_encbuf = dma_alloc(sc->sc_encbuflen, PR_NOWAIT);
+	if (sc->sc_encbuf == NULL) {
+		error = 1;
+		goto done;
+	}
 
-	sc->sc_nsensors = config.nfans + config.npwrsup + config.ntemps + 
-		(config.doorlock ? 1 : 0) + (config.alarm ? 1 : 0);
+	sc->sc_nsensors = config->nfans + config->npwrsup + config->ntemps + 
+		(config->doorlock ? 1 : 0) + (config->alarm ? 1 : 0);
 
 	sc->sc_sensors = malloc(sc->sc_nsensors * sizeof(struct safte_sensor),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_sensors == NULL) {
-		free(sc->sc_encbuf, M_DEVBUF);
+		dma_free(sc->sc_encbuf, sc->sc_encbuflen);
 		sc->sc_encbuf = NULL;
 		sc->sc_nsensors = 0;
-		return (1);
+		error = 1;
+		goto done;
 	}
 
 	strlcpy(sc->sc_sensordev.xname, DEVNAME(sc),
@@ -323,7 +341,7 @@ safte_read_config(struct safte_softc *sc)
 
 	s = sc->sc_sensors;
 
-	for (i = 0; i < config.nfans; i++) {
+	for (i = 0; i < config->nfans; i++) {
 		s->se_type = SAFTE_T_FAN;
 		s->se_field = (u_int8_t *)(sc->sc_encbuf + i);
 		s->se_sensor.type = SENSOR_INDICATOR;
@@ -332,9 +350,9 @@ safte_read_config(struct safte_softc *sc)
 
 		s++;
 	}
-	j = config.nfans;
+	j = config->nfans;
 
-	for (i = 0; i < config.npwrsup; i++) {
+	for (i = 0; i < config->npwrsup; i++) {
 		s->se_type = SAFTE_T_PWRSUP;
 		s->se_field = (u_int8_t *)(sc->sc_encbuf + j + i);
 		s->se_sensor.type = SENSOR_INDICATOR;
@@ -343,15 +361,15 @@ safte_read_config(struct safte_softc *sc)
 
 		s++;
 	}
-	j += config.npwrsup;
+	j += config->npwrsup;
 
 #if NBIO > 0
-	sc->sc_nslots = config.nslots;
+	sc->sc_nslots = config->nslots;
 	sc->sc_slots = (u_int8_t *)(sc->sc_encbuf + j);
 #endif
-	j += config.nslots;
+	j += config->nslots;
 
-	if (config.doorlock) {
+	if (config->doorlock) {
 		s->se_type = SAFTE_T_DOORLOCK;
 		s->se_field = (u_int8_t *)(sc->sc_encbuf + j);
 		s->se_sensor.type = SENSOR_INDICATOR;
@@ -362,7 +380,7 @@ safte_read_config(struct safte_softc *sc)
 	}
 	j++;
 
-	if (config.alarm) {
+	if (config->alarm) {
 		s->se_type = SAFTE_T_ALARM;
 		s->se_field = (u_int8_t *)(sc->sc_encbuf + j);
 		s->se_sensor.type = SENSOR_INDICATOR;
@@ -376,21 +394,22 @@ safte_read_config(struct safte_softc *sc)
 	 * stash the temp info so we can get out of range status. limit the
 	 * number so the out of temp checks cant go into memory it doesnt own
 	 */
-	sc->sc_ntemps = (config.ntemps > 15) ? 15 : config.ntemps;
+	sc->sc_ntemps = (config->ntemps > 15) ? 15 : config->ntemps;
 	sc->sc_temps = s;
-	sc->sc_celsius = SAFTE_CFG_CELSIUS(config.therm);
-	for (i = 0; i < config.ntemps; i++) {
+	sc->sc_celsius = SAFTE_CFG_CELSIUS(config->therm);
+	for (i = 0; i < config->ntemps; i++) {
 		s->se_type = SAFTE_T_TEMP;
 		s->se_field = (u_int8_t *)(sc->sc_encbuf + j + i);
 		s->se_sensor.type = SENSOR_TEMP;
 
 		s++;
 	}
-	j += config.ntemps;
+	j += config->ntemps;
 
 	sc->sc_temperrs = (u_int8_t *)(sc->sc_encbuf + j);
-
-	return (0);
+done:
+	dma_free(config, sizeof(*config));
+	return (error);
 }
 
 void
@@ -583,7 +602,7 @@ safte_bio_blink(struct safte_softc *sc, struct bioc_blink *blink)
 	if (slot >= sc->sc_nslots)
 		return (ENODEV);
 
-	op = malloc(sizeof(*op), M_TEMP, M_WAITOK|M_ZERO);
+	op = dma_alloc(sizeof(*op), PR_WAITOK | PR_ZERO);
 
 	op->opcode = SAFTE_WRITE_SLOTOP;
 	op->slot = slot;
@@ -593,7 +612,7 @@ safte_bio_blink(struct safte_softc *sc, struct bioc_blink *blink)
 		flags |= SCSI_AUTOCONF;
 	xs = scsi_xs_get(sc->sc_link, flags | SCSI_DATA_OUT | SCSI_SILENT);
 	if (xs == NULL) {
-		free(op, M_TEMP);
+		dma_free(op, sizeof(*op));
 		return (ENOMEM);
 	}
 	xs->cmdlen = sizeof(*cmd);
@@ -613,7 +632,7 @@ safte_bio_blink(struct safte_softc *sc, struct bioc_blink *blink)
 	if (error != 0) {
 		error = EIO;
 	}
-	free(op, M_TEMP);
+	dma_free(op, sizeof(*op));
 
 	return (error);
 }
diff --git a/sys/scsi/scsi_base.c b/sys/scsi/scsi_base.c
index ecfb3c8f70a..ab4d1bacd5c 100644
--- a/sys/scsi/scsi_base.c
+++ b/sys/scsi/scsi_base.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scsi_base.c,v 1.198 2011/03/02 04:38:01 krw Exp $	*/
+/*	$OpenBSD: scsi_base.c,v 1.199 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: scsi_base.c,v 1.43 1997/04/02 02:29:36 mycroft Exp $	*/
 
 /*
@@ -41,7 +41,6 @@
 #include <sys/kernel.h>
 #include <sys/buf.h>
 #include <sys/uio.h>
-#include <sys/malloc.h>
 #include <sys/errno.h>
 #include <sys/device.h>
 #include <sys/proc.h>
@@ -783,14 +782,14 @@ scsi_size(struct scsi_link *sc_link, int flags, u_int32_t *blksize)
 	/*
 	 * Start with a READ CAPACITY(10).
 	 */
-	rdcap = malloc(sizeof(*rdcap), M_TEMP, ((flags & SCSI_NOSLEEP) ?
-	    M_NOWAIT : M_WAITOK) | M_ZERO);
+	rdcap = dma_alloc(sizeof(*rdcap), ((flags & SCSI_NOSLEEP) ?
+	    PR_NOWAIT : PR_WAITOK) | PR_ZERO);
 	if (rdcap == NULL)
 		return (0);
 
 	xs = scsi_xs_get(sc_link, flags | SCSI_DATA_IN | SCSI_SILENT);
 	if (xs == NULL) {
-		free(rdcap, M_TEMP);
+		dma_free(rdcap, sizeof(*rdcap));
 		return (0);
 	}
 	xs->cmdlen = sizeof(*cmd10);
@@ -807,14 +806,14 @@ scsi_size(struct scsi_link *sc_link, int flags, u_int32_t *blksize)
 	if (error) {
 		SC_DEBUG(sc_link, SDEV_DB1, ("READ CAPACITY error (%#x)\n",
 		    error));
-		free(rdcap, M_TEMP);
+		dma_free(rdcap, sizeof(*rdcap));
 		return (0);
 	}
 
 	max_addr = _4btol(rdcap->addr);
 	if (blksize != NULL)
 		*blksize = _4btol(rdcap->length);
-	free(rdcap, M_TEMP);
+	dma_free(rdcap, sizeof(*rdcap));
 
 	if (SCSISPC(sc_link->inqdata.version) < 3 && max_addr != 0xffffffff)
 		goto exit;
@@ -823,14 +822,14 @@ scsi_size(struct scsi_link *sc_link, int flags, u_int32_t *blksize)
 	 * SCSI-3 devices, or devices reporting more than 2^32-1 sectors can
 	 * try READ CAPACITY(16).
 	 */
-	rdcap16 = malloc(sizeof(*rdcap16), M_TEMP, ((flags & SCSI_NOSLEEP) ?
-	    M_NOWAIT : M_WAITOK) | M_ZERO);
+	rdcap16 = dma_alloc(sizeof(*rdcap16), ((flags & SCSI_NOSLEEP) ?
+	    PR_NOWAIT : PR_WAITOK) | PR_ZERO);
 	if (rdcap16 == NULL)
 		goto exit;
 
 	xs = scsi_xs_get(sc_link, flags | SCSI_DATA_IN | SCSI_SILENT);
 	if (xs == NULL) {
-		free(rdcap16, M_TEMP);
+		dma_free(rdcap16, sizeof(*rdcap16));
 		goto exit;
 	}
 	xs->cmdlen = sizeof(*cmd);
@@ -848,7 +847,7 @@ scsi_size(struct scsi_link *sc_link, int flags, u_int32_t *blksize)
 	if (error) {
 		SC_DEBUG(sc_link, SDEV_DB1, ("READ CAPACITY 16 error (%#x)\n",
 		    error));
-		free(rdcap16, M_TEMP);
+		dma_free(rdcap16, sizeof(*rdcap16));
 		goto exit;
 	}
 
@@ -856,7 +855,7 @@ scsi_size(struct scsi_link *sc_link, int flags, u_int32_t *blksize)
 	if (blksize != NULL)
 		*blksize = _4btol(rdcap16->length);
 	/* XXX The other READ CAPACITY(16) info could be stored away. */
-	free(rdcap16, M_TEMP);
+	dma_free(rdcap16, sizeof(*rdcap16));
 
 	return (max_addr + 1);
 
@@ -952,8 +951,6 @@ scsi_inquire_vpd(struct scsi_link *sc_link, void *buf, u_int buflen,
 	struct scsi_xfer *xs;
 	int error;
 
-	bzero(buf, buflen);
-
 	if (sc_link->flags & SDEV_UMASS)
 		return (EJUSTRETURN);
 
diff --git a/sys/scsi/scsi_ioctl.c b/sys/scsi/scsi_ioctl.c
index 6eadc4b7862..51443b2ba10 100644
--- a/sys/scsi/scsi_ioctl.c
+++ b/sys/scsi/scsi_ioctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scsi_ioctl.c,v 1.46 2010/07/22 05:32:10 matthew Exp $	*/
+/*	$OpenBSD: scsi_ioctl.c,v 1.47 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: scsi_ioctl.c,v 1.23 1996/10/12 23:23:17 christos Exp $	*/
 
 /*
@@ -42,7 +42,7 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/file.h>
-#include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/buf.h>
 #include <sys/device.h>
 #include <sys/fcntl.h>
@@ -116,9 +116,7 @@ scsi_ioc_cmd(struct scsi_link *link, scsireq_t *screq)
 	xs->cmdlen = screq->cmdlen;
 
 	if (screq->datalen > 0) {
-		/* XXX dma accessible */
-		xs->data = malloc(screq->datalen, M_TEMP,
-		    M_WAITOK | M_CANFAIL | M_ZERO);
+		xs->data = dma_alloc(screq->datalen, PR_WAITOK | PR_ZERO);
 		if (xs->data == NULL) {
 			err = ENOMEM;
 			goto err;
@@ -193,7 +191,7 @@ scsi_ioc_cmd(struct scsi_link *link, scsireq_t *screq)
 
 err:
 	if (xs->data)
-		free(xs->data, M_TEMP);
+		dma_free(xs->data, screq->datalen);
 	scsi_xs_put(xs);
 
 	return (err);
@@ -240,9 +238,7 @@ scsi_ioc_ata_cmd(struct scsi_link *link, atareq_t *atareq)
 	xs->cmdlen = sizeof(*cdb);
 
 	if (atareq->datalen > 0) {
-		/* XXX dma accessible */
-		xs->data = malloc(atareq->datalen, M_TEMP,
-		    M_WAITOK | M_CANFAIL | M_ZERO);
+		xs->data = dma_alloc(atareq->datalen, PR_WAITOK | PR_ZERO);
 		if (xs->data == NULL) {
 			err = ENOMEM;
 			goto err;
@@ -292,7 +288,7 @@ scsi_ioc_ata_cmd(struct scsi_link *link, atareq_t *atareq)
 
 err:
 	if (xs->data)
-		free(xs->data, M_TEMP);
+		dma_free(xs->data, atareq->datalen);
 	scsi_xs_put(xs);
 
 	return (err);
diff --git a/sys/scsi/scsiconf.c b/sys/scsi/scsiconf.c
index 839f43624c0..92844a9c9e8 100644
--- a/sys/scsi/scsiconf.c
+++ b/sys/scsi/scsiconf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scsiconf.c,v 1.167 2010/10/12 00:53:32 krw Exp $	*/
+/*	$OpenBSD: scsiconf.c,v 1.168 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: scsiconf.c,v 1.57 1996/05/02 01:09:01 neil Exp $	*/
 
 /*
@@ -54,6 +54,7 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/device.h>
 #include <sys/buf.h>
 #include <sys/lock.h>
@@ -381,7 +382,7 @@ scsi_probe_target(struct scsibus_softc *sc, int target)
 
 	if ((link->flags & (SDEV_UMASS | SDEV_ATAPI)) == 0 &&
 	    SCSISPC(link->inqdata.version) > 2) {
-		report = malloc(sizeof(*report), M_TEMP, M_WAITOK);
+		report = dma_alloc(sizeof(*report), PR_WAITOK);
 		if (report == NULL)
 			goto dumbscan;
 
@@ -389,7 +390,7 @@ scsi_probe_target(struct scsibus_softc *sc, int target)
 		    sizeof(*report), scsi_autoconf | SCSI_SILENT |
 		    SCSI_IGNORE_ILLEGAL_REQUEST | SCSI_IGNORE_NOT_READY |
 		    SCSI_IGNORE_MEDIA_CHANGE, 10000) != 0) {
-			free(report, M_TEMP);
+			dma_free(report, sizeof(*report));
 			goto dumbscan;
 		}
 
@@ -413,7 +414,7 @@ scsi_probe_target(struct scsibus_softc *sc, int target)
 			scsi_add_link(sc, link);
 		}
 
-		free(report, M_TEMP);
+		dma_free(report, sizeof(*report));
 		return (0);
 	}
 
@@ -1136,21 +1137,23 @@ scsi_devid(struct scsi_link *link)
 	struct {
 		struct scsi_vpd_hdr hdr;
 		u_int8_t list[32];
-	} __packed pg;
+	} __packed *pg;
 	int pg80 = 0, pg83 = 0, i;
 	size_t len;
 
 	if (link->id != NULL)
 		return;
 
+	pg = dma_alloc(sizeof(*pg), PR_WAITOK | PR_ZERO);
+
 	if (SCSISPC(link->inqdata.version) >= 2) {
-		if (scsi_inquire_vpd(link, &pg, sizeof(pg), SI_PG_SUPPORTED,
+		if (scsi_inquire_vpd(link, pg, sizeof(*pg), SI_PG_SUPPORTED,
 		    scsi_autoconf) != 0)
-			return;
+			goto done;
 
-		len = MIN(sizeof(pg.list), _2btol(pg.hdr.page_length));
+		len = MIN(sizeof(pg->list), _2btol(pg->hdr.page_length));
 		for (i = 0; i < len; i++) {
-			switch (pg.list[i]) {
+			switch (pg->list[i]) {
 			case SI_PG_SERIAL:
 				pg80 = 1;
 				break;
@@ -1161,49 +1164,53 @@ scsi_devid(struct scsi_link *link)
 		}
 
 		if (pg83 && scsi_devid_pg83(link) == 0)
-			return;
+			goto done;
 #ifdef notyet
 		if (pg80 && scsi_devid_pg80(link) == 0)
-			return;
+			goto done;
 #endif
 	}
+done:
+	dma_free(pg, sizeof(*pg));
 }
 
 int
 scsi_devid_pg83(struct scsi_link *link)
 {
-	struct scsi_vpd_hdr hdr;
+	struct scsi_vpd_hdr *hdr = NULL;
 	struct scsi_vpd_devid_hdr dhdr, chdr;
-	u_int8_t *pg, *id;
+	u_int8_t *pg = NULL, *id;
 	int type, idtype = 0;
 	u_char idflags;
 	int len, pos;
 	int rv;
 
-	rv = scsi_inquire_vpd(link, &hdr, sizeof(hdr), SI_PG_DEVID,
+	hdr = dma_alloc(sizeof(*hdr), PR_WAITOK | PR_ZERO);
+
+	rv = scsi_inquire_vpd(link, hdr, sizeof(*hdr), SI_PG_DEVID,
 	    scsi_autoconf);
 	if (rv != 0)
-		return (rv);
+		goto done;
 
-	len = sizeof(hdr) + _2btol(hdr.page_length);
-	pg = malloc(len, M_TEMP, M_WAITOK);
+	len = sizeof(*hdr) + _2btol(hdr->page_length);
+	pg = dma_alloc(len, PR_WAITOK | PR_ZERO);
 
 	rv = scsi_inquire_vpd(link, pg, len, SI_PG_DEVID, scsi_autoconf);
 	if (rv != 0)
-		goto err;
+		goto done;
 
-	pos = sizeof(hdr);
+	pos = sizeof(*hdr);
 
 	do {
 		if (len - pos < sizeof(dhdr)) {
 			rv = EIO;
-			goto err;
+			goto done;
 		}
 		memcpy(&dhdr, &pg[pos], sizeof(dhdr));
 		pos += sizeof(dhdr);
 		if (len - pos < dhdr.len) {
 			rv = EIO;
-			goto err;
+			goto done;
 		}
 
 		if (VPD_DEVID_ASSOC(dhdr.flags) == VPD_DEVID_ASSOC_LU) {
@@ -1254,8 +1261,11 @@ scsi_devid_pg83(struct scsi_link *link)
 	} else
 		rv = ENODEV;
 
-err:
-	free(pg, M_TEMP);
+done:
+	if (pg)
+		dma_free(pg, len);
+	if (hdr)
+		dma_free(hdr, sizeof(*hdr));
 	return (rv);
 }
 
diff --git a/sys/scsi/sd.c b/sys/scsi/sd.c
index 69870d445a9..07c26a9b0bb 100644
--- a/sys/scsi/sd.c
+++ b/sys/scsi/sd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sd.c,v 1.220 2011/02/21 20:51:02 krw Exp $	*/
+/*	$OpenBSD: sd.c,v 1.221 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: sd.c,v 1.111 1997/04/02 02:29:41 mycroft Exp $	*/
 
 /*-
@@ -59,6 +59,7 @@
 #include <sys/buf.h>
 #include <sys/uio.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/errno.h>
 #include <sys/device.h>
 #include <sys/disklabel.h>
@@ -1010,7 +1011,9 @@ sdioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
 int
 sd_ioctl_inquiry(struct sd_softc *sc, struct dk_inquiry *di)
 {
-	struct scsi_vpd_serial vpd;
+	struct scsi_vpd_serial *vpd;
+
+	vpd = dma_alloc(sizeof(*vpd), PR_WAITOK | PR_ZERO);
 
 	bzero(di, sizeof(struct dk_inquiry));
 	scsi_strvis(di->vendor, sc->sc_link->inqdata.vendor,
@@ -1021,12 +1024,13 @@ sd_ioctl_inquiry(struct sd_softc *sc, struct dk_inquiry *di)
 	    sizeof(sc->sc_link->inqdata.revision));
 
 	/* the serial vpd page is optional */
-	if (scsi_inquire_vpd(sc->sc_link, &vpd, sizeof(vpd),
+	if (scsi_inquire_vpd(sc->sc_link, vpd, sizeof(*vpd),
 	    SI_PG_SERIAL, 0) == 0)
-		scsi_strvis(di->serial, vpd.serial, sizeof(vpd.serial));
+		scsi_strvis(di->serial, vpd->serial, sizeof(vpd->serial));
 	else
-		strlcpy(di->serial, "(unknown)", sizeof(vpd.serial));
+		strlcpy(di->serial, "(unknown)", sizeof(vpd->serial));
 
+	dma_free(vpd, sizeof(*vpd));
 	return (0);
 }
 
@@ -1044,11 +1048,10 @@ sd_ioctl_cache(struct sd_softc *sc, long cmd, struct dk_cache *dkc)
 
 	/* see if the adapter has special handling */
 	rv = scsi_do_ioctl(sc->sc_link, cmd, (caddr_t)dkc, 0);
-	if (rv != ENOTTY) {
+	if (rv != ENOTTY)
 		return (rv);
-	}
 
-	buf = malloc(sizeof(*buf), M_TEMP, M_WAITOK|M_CANFAIL);
+	buf = dma_alloc(sizeof(*buf), PR_WAITOK);
 	if (buf == NULL)
 		return (ENOMEM);
 
@@ -1097,7 +1100,7 @@ sd_ioctl_cache(struct sd_softc *sc, long cmd, struct dk_cache *dkc)
 	}
 
 done:
-	free(buf, M_TEMP);
+	dma_free(buf, sizeof(*buf));
 	return (rv);
 }
 
@@ -1417,7 +1420,7 @@ sd_get_parms(struct sd_softc *sc, struct disk_parms *dp, int flags)
 
 	dp->disksize = scsi_size(sc->sc_link, flags, &sssecsize);
 
-	buf = malloc(sizeof(*buf), M_TEMP, M_NOWAIT);
+	buf = dma_alloc(sizeof(*buf), PR_NOWAIT);
 	if (buf == NULL)
 		goto validate;
 
@@ -1503,7 +1506,7 @@ sd_get_parms(struct sd_softc *sc, struct disk_parms *dp, int flags)
 
 validate:
 	if (buf)
-		free(buf, M_TEMP);
+		dma_free(buf, sizeof(*buf));
 
 	if (dp->disksize == 0)
 		return (SDGP_RESULT_OFFLINE);
diff --git a/sys/scsi/ses.c b/sys/scsi/ses.c
index 4cbe7596586..c91e9a3113e 100644
--- a/sys/scsi/ses.c
+++ b/sys/scsi/ses.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ses.c,v 1.50 2010/08/30 02:47:56 matthew Exp $ */
+/*	$OpenBSD: ses.c,v 1.51 2011/03/17 21:30:24 deraadt Exp $ */
 
 /*
  * Copyright (c) 2005 David Gwynne <dlg@openbsd.org>
@@ -23,6 +23,7 @@
 #include <sys/device.h>
 #include <sys/scsiio.h>
 #include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/proc.h>
 #include <sys/rwlock.h>
 #include <sys/queue.h>
@@ -207,7 +208,7 @@ ses_attach(struct device *parent, struct device *self, void *aux)
 	    && TAILQ_EMPTY(&sc->sc_slots)
 #endif
 	    ) {
-		free(sc->sc_buf, M_DEVBUF);
+		dma_free(sc->sc_buf, sc->sc_buflen);
 		sc->sc_buf = NULL;
 	}
 }
@@ -247,7 +248,7 @@ ses_detach(struct device *self, int flags)
 	}
 
 	if (sc->sc_buf != NULL)
-		free(sc->sc_buf, M_DEVBUF);
+		dma_free(sc->sc_buf, sc->sc_buflen);
 
 	rw_exit_write(&sc->sc_lock);
 
@@ -266,10 +267,10 @@ ses_read_config(struct ses_softc *sc)
 	struct ses_enc_hdr *enc;
 	struct scsi_xfer *xs;
 	u_char *buf, *p;
-	int error, i;
+	int error = 0, i;
 	int flags = 0, ntypes = 0, nelems = 0;
 
-	buf = malloc(SES_BUFLEN, M_DEVBUF, M_NOWAIT | M_ZERO);
+	buf = dma_alloc(SES_BUFLEN, PR_NOWAIT | PR_ZERO);
 	if (buf == NULL)
 		return (1);
 
@@ -277,8 +278,8 @@ ses_read_config(struct ses_softc *sc)
 		flags |= SCSI_AUTOCONF;
 	xs = scsi_xs_get(sc->sc_link, flags | SCSI_DATA_IN | SCSI_SILENT);
 	if (xs == NULL) {
-		free(buf, M_DEVBUF);
-		return (1);
+		error = 1;
+		goto done;
 	}
 	xs->cmdlen = sizeof(*cmd);
 	xs->data = buf;
@@ -296,15 +297,15 @@ ses_read_config(struct ses_softc *sc)
 	scsi_xs_put(xs);
 
 	if (error) {
-		free(buf, M_DEVBUF);
-		return (1);
+		error = 1;
+		goto done;
 	}
 
 	cfg = (struct ses_config_hdr *)buf;
 	if (cfg->pgcode != SES_PAGE_CONFIG || betoh16(cfg->length) >
 	    SES_BUFLEN) {
-		free(buf, M_DEVBUF);
-		return (1);
+		error = 1;
+		goto done;
 	}
 
 	DPRINTF("%s: config: n_subenc: %d length: %d\n", DEVNAME(sc),
@@ -347,21 +348,23 @@ ses_read_config(struct ses_softc *sc)
 #endif /* SES_DEBUG */
 
 	sc->sc_buflen = SES_STAT_LEN(ntypes, nelems);
-	sc->sc_buf = malloc(sc->sc_buflen, M_DEVBUF, M_NOWAIT);
+	sc->sc_buf = dma_alloc(sc->sc_buflen, PR_NOWAIT);
 	if (sc->sc_buf == NULL) {
-		free(buf, M_DEVBUF);
-		return (1);
+		error = 1;
+		goto done;
 	}
 
 	/* get the status page and then use it to generate a list of sensors */
 	if (ses_make_sensors(sc, tdlist, ntypes) != 0) {
-		free(buf, M_DEVBUF);
-		free(sc->sc_buf, M_DEVBUF);
-		return (1);
+		dma_free(sc->sc_buf, sc->sc_buflen);
+		error = 1;
+		goto done;
 	}
 
-	free(buf, M_DEVBUF);
-	return (0);
+done:
+	if (buf)
+		dma_free(buf, SES_BUFLEN);
+	return (error);
 }
 
 int
diff --git a/sys/scsi/st.c b/sys/scsi/st.c
index f5323b61eb0..7f81323ee77 100644
--- a/sys/scsi/st.c
+++ b/sys/scsi/st.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: st.c,v 1.116 2010/12/24 02:45:33 krw Exp $	*/
+/*	$OpenBSD: st.c,v 1.117 2011/03/17 21:30:24 deraadt Exp $	*/
 /*	$NetBSD: st.c,v 1.71 1997/02/21 23:03:49 thorpej Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
 #include <sys/errno.h>
 #include <sys/ioctl.h>
 #include <sys/stat.h>
-#include <sys/malloc.h>
+#include <sys/pool.h>
 #include <sys/buf.h>
 #include <sys/proc.h>
 #include <sys/mtio.h>
@@ -1409,21 +1409,28 @@ st_read(struct st_softc *st, char *buf, int size, int flags)
 int
 st_read_block_limits(struct st_softc *st, int flags)
 {
-	struct scsi_block_limits_data block_limits;
+	struct scsi_block_limits_data *block_limits = NULL;
 	struct scsi_block_limits *cmd;
 	struct scsi_link *sc_link = st->sc_link;
 	struct scsi_xfer *xs;
-	int error;
+	int error = 0;
 
 	if ((sc_link->flags & SDEV_MEDIA_LOADED))
 		return (0);
 
-	xs = scsi_xs_get(sc_link, flags | SCSI_DATA_IN);
-	if (xs == NULL)
+	block_limits = dma_alloc(sizeof(*block_limits), PR_NOWAIT);
+	if (block_limits == NULL)
 		return (ENOMEM);
+
+	xs = scsi_xs_get(sc_link, flags | SCSI_DATA_IN);
+	if (xs == NULL) {
+		error = ENOMEM;
+		goto done;
+	}
+
 	xs->cmdlen = sizeof(*cmd);
-	xs->data = (void *)&block_limits;
-	xs->datalen = sizeof(block_limits);
+	xs->data = (void *)block_limits;
+	xs->datalen = sizeof(*block_limits);
 	xs->timeout = ST_CTL_TIME;
 
 	cmd = (struct scsi_block_limits *)xs->cmd;
@@ -1433,12 +1440,15 @@ st_read_block_limits(struct st_softc *st, int flags)
 	scsi_xs_put(xs);
 
 	if (error == 0) {
-		st->blkmin = _2btol(block_limits.min_length);
-		st->blkmax = _3btol(block_limits.max_length);
+		st->blkmin = _2btol(block_limits->min_length);
+		st->blkmax = _3btol(block_limits->max_length);
 		SC_DEBUG(sc_link, SDEV_DB3,
 		    ("(%d <= blksize <= %d)\n", st->blkmin, st->blkmax));
 	}
 
+done:
+	if (block_limits)
+		dma_free(block_limits, sizeof(*block_limits));
 	return (error);
 }
 
@@ -1455,15 +1465,15 @@ st_read_block_limits(struct st_softc *st, int flags)
 int
 st_mode_sense(struct st_softc *st, int flags)
 {
-	union scsi_mode_sense_buf *data;
+	union scsi_mode_sense_buf *data = NULL;
 	struct scsi_link *sc_link = st->sc_link;
 	u_int64_t block_count;
 	u_int32_t density, block_size;
 	u_char *page0 = NULL;
 	u_int8_t dev_spec;
-	int error, big;
+	int error = 0, big;
 
-	data = malloc(sizeof(*data), M_TEMP, M_NOWAIT);
+	data = dma_alloc(sizeof(*data), PR_NOWAIT);
 	if (data == NULL)
 		return (ENOMEM);
 
@@ -1472,10 +1482,8 @@ st_mode_sense(struct st_softc *st, int flags)
 	 */
 	error = scsi_do_mode_sense(sc_link, 0, data, (void **)&page0,
 	    &density, &block_count, &block_size, 1, flags | SCSI_SILENT, &big);
-	if (error != 0) {
-		free(data, M_TEMP);
-		return (error);
-	}
+	if (error != 0)
+		goto done;
 
 	/* It is valid for no page0 to be available. */
 
@@ -1502,8 +1510,10 @@ st_mode_sense(struct st_softc *st, int flags)
 
 	sc_link->flags |= SDEV_MEDIA_LOADED;
 
-	free(data, M_TEMP);
-	return (0);
+done:
+	if (data)
+		dma_free(data, sizeof(*data));
+	return (error);
 }
 
 /*
@@ -1513,19 +1523,21 @@ st_mode_sense(struct st_softc *st, int flags)
 int
 st_mode_select(struct st_softc *st, int flags)
 {
-	union scsi_mode_sense_buf *inbuf, *outbuf;
+	union scsi_mode_sense_buf *inbuf = NULL, *outbuf = NULL;
 	struct scsi_blk_desc general;
 	struct scsi_link *sc_link = st->sc_link;
 	u_int8_t *page0 = NULL;
-	int error, big, page0_size;
+	int error = 0, big, page0_size;
 
-	inbuf = malloc(sizeof(*inbuf), M_TEMP, M_NOWAIT);
-	if (inbuf == NULL)
-		return (ENOMEM);
-	outbuf = malloc(sizeof(*outbuf), M_TEMP, M_NOWAIT | M_ZERO);
+	inbuf = dma_alloc(sizeof(*inbuf), PR_NOWAIT);
+	if (inbuf == NULL) {
+		error = ENOMEM;
+		goto done;
+	}
+	outbuf = dma_alloc(sizeof(*outbuf), PR_NOWAIT | PR_ZERO);
 	if (outbuf == NULL) {
-		free(inbuf, M_TEMP);
-		return (ENOMEM);
+		error = ENOMEM;
+		goto done;
 	}
 
 	/*
@@ -1537,15 +1549,13 @@ st_mode_select(struct st_softc *st, int flags)
 		SC_DEBUG(sc_link, SDEV_DB3,
 		    ("not setting density 0x%x blksize 0x%x\n",
 		    st->density, st->blksize));
-		free(inbuf, M_TEMP);
-		free(outbuf, M_TEMP);
-		return (0);
+		error = 0;
+		goto done;
 	}
 
 	if (sc_link->flags & SDEV_ATAPI) {
-		free(inbuf, M_TEMP);
-		free(outbuf, M_TEMP);
-		return (0);
+		error = 0;
+		goto done;
 	}
 
 	bzero(&general, sizeof(general));
@@ -1559,11 +1569,8 @@ st_mode_select(struct st_softc *st, int flags)
 	 */
 	error = scsi_do_mode_sense(sc_link, 0, inbuf, (void **)&page0, NULL,
 	    NULL, NULL, 1, flags | SCSI_SILENT, &big);
-	if (error != 0) {
-		free(inbuf, M_TEMP);
-		free(outbuf, M_TEMP);
-		return (error);
-	}
+	if (error != 0)
+		goto done;
 
 	if (page0 == NULL) {
 		page0_size = 0;
@@ -1596,9 +1603,7 @@ st_mode_select(struct st_softc *st, int flags)
 		    &general, sizeof(general));
 		error = scsi_mode_select(st->sc_link, 0, &outbuf->hdr,
 		    flags, ST_CTL_TIME);
-		free(inbuf, M_TEMP);
-		free(outbuf, M_TEMP);
-		return (error);
+		goto done;
 	}
 
 	/* MODE SENSE (10) header was returned, so use MODE SELECT (10). */
@@ -1612,8 +1617,11 @@ st_mode_select(struct st_softc *st, int flags)
 
 	error = scsi_mode_select_big(st->sc_link, 0, &outbuf->hdr_big,
 	    flags, ST_CTL_TIME);
-	free(inbuf, M_TEMP);
-	free(outbuf, M_TEMP);
+done:
+	if (inbuf)
+		dma_free(inbuf, sizeof(*inbuf));
+	if (outbuf)
+		dma_free(outbuf, sizeof(*outbuf));
 	return (error);
 }
 
@@ -2108,16 +2116,18 @@ st_interpret_sense(struct scsi_xfer *xs)
 int
 st_touch_tape(struct st_softc *st)
 {
-	char *buf;
-	int readsize;
-	int error;
-
-	buf = malloc(1024, M_TEMP, M_NOWAIT);
-	if (!buf)
-		return ENOMEM;
+	char *buf = NULL;
+	int readsize, maxblksize = 1024;
+	int error = 0;
 
 	if ((error = st_mode_sense(st, 0)) != 0)
-		goto bad;
+		goto done;
+	buf = dma_alloc(maxblksize, PR_NOWAIT);
+	if (!buf) {
+		error = ENOMEM;
+		goto done;
+	}
+
 	st->blksize = 1024;
 	do {
 		switch (st->blksize) {
@@ -2131,16 +2141,14 @@ st_touch_tape(struct st_softc *st)
 			st->flags &= ~ST_FIXEDBLOCKS;
 		}
 		if ((error = st_mode_select(st, 0)) != 0)
-			goto bad;
+			goto done;
 		st_read(st, buf, readsize, SCSI_SILENT);	/* XXX */
-		if ((error = st_rewind(st, 0, 0)) != 0) {
-bad:			free(buf, M_TEMP);
-			return error;
-		}
+		if ((error = st_rewind(st, 0, 0)) != 0)
+			goto done;
 	} while (readsize != 1 && readsize > st->blksize);
-
-	free(buf, M_TEMP);
-	return 0;
+done:
+	dma_free(buf, maxblksize);
+	return (error);
 }
 
 int