Eliminate potential overflows by allocating softc dynamically,

removing at the same time the need for this to be a "count" config
option.

Found by:       FlexeLint

5 files changed, 23 insertions, 34 deletions

diff --git a/sys/conf/files.i386 b/sys/conf/files.i386
index 8f188b5..ca3f95d 100644
--- a/sys/conf/files.i386
+++ b/sys/conf/files.i386
@@ -259,7 +259,7 @@ i386/ibcs2/imgact_coff.c	optional	ibcs2
 i386/isa/asc.c			count		asc
 i386/isa/clock.c		standard
 i386/isa/cronyx.c		optional	cx
-i386/isa/ctx.c			count		ctx
+i386/isa/ctx.c			optional	ctx
 i386/isa/cx.c			count		cx
 i386/isa/cy.c			count		cy
 i386/isa/elink.c		optional	ep
diff --git a/sys/conf/files.pc98 b/sys/conf/files.pc98
index b83c162..90cfc1e 100644
--- a/sys/conf/files.pc98
+++ b/sys/conf/files.pc98
@@ -222,7 +222,7 @@ i386/isa/bs/bsfunc.c		optional	bs
 i386/isa/bs/bshw.c		optional	bs
 i386/isa/bs/bsif.c		count		bs
 i386/isa/cronyx.c		optional	cx
-i386/isa/ctx.c			count		ctx
+i386/isa/ctx.c			optional	ctx
 i386/isa/cx.c			count		cx
 i386/isa/cy.c			count		cy
 i386/isa/elink.c		optional	ep
diff --git a/sys/i386/conf/NOTES b/sys/i386/conf/NOTES
index fd42e45..b6a0789 100644
--- a/sys/i386/conf/NOTES
+++ b/sys/i386/conf/NOTES
@@ -660,7 +660,7 @@ hint.wt.0.at="isa"
 hint.wt.0.port="0x300"
 hint.wt.0.irq="5"
 hint.wt.0.drq="1"
-device		ctx	1
+device		ctx
 hint.ctx.0.at="isa"
 hint.ctx.0.port="0x230"
 hint.ctx.0.maddr="0xd0000"
diff --git a/sys/i386/isa/ctx.c b/sys/i386/isa/ctx.c
index 659c27b..bc6564e 100644
--- a/sys/i386/isa/ctx.c
+++ b/sys/i386/isa/ctx.c
@@ -108,8 +108,6 @@
  *
  */
 
-#include "ctx.h"
-
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
@@ -131,8 +129,6 @@ static int     waitvb(int port);
 /* state flags */
 #define   OPEN        (0x01)	/* device is open */
 
-#define   UNIT(x) ((x) & 0x07)
-
 static int	ctxprobe(struct isa_device *devp);
 static int	ctxattach(struct isa_device *devp);
 struct isa_driver ctxdriver = {
@@ -168,7 +164,7 @@ static struct cdevsw ctx_cdevsw = {
  *  Per unit shadow registers (because the dumb hardware is RO)
 */
 
-static struct ctx_soft_registers {
+struct ctx_soft_registers {
 	u_char *lutp;
 	u_char  cp0;
 	u_char  cp1;
@@ -176,7 +172,7 @@ static struct ctx_soft_registers {
 	int     iobase;
 	caddr_t maddr;
 	int     msize;
-}       ctx_sr[NCTX];
+};
 
 
 static int
@@ -196,15 +192,18 @@ static int
 ctxattach(struct isa_device * devp)
 {
 	struct ctx_soft_registers *sr;
+	dev_t dev;
 
-	sr = &(ctx_sr[devp->id_unit]);
+	sr = malloc(sizeof *sr, M_DEVBUF, M_WAITOK | M_ZERO);
 	sr->cp0 = 0;	/* zero out the shadow registers */
 	sr->cp1 = 0;	/* and the open flag.  wait for  */
 	sr->flag = 0;	/* open to malloc the LUT space  */
 	sr->iobase = devp->id_iobase;
 	sr->maddr = devp->id_maddr;
 	sr->msize = devp->id_msize;
-	make_dev(&ctx_cdevsw, 0, 0, 0, 0600, "ctx%d", devp->id_unit);
+	dev = make_dev(&ctx_cdevsw, 0, 0, 0, 0600, "ctx%d", devp->id_unit);
+	dev->si_drv1 = sr;
+	
 	return (1);
 }
 
@@ -212,16 +211,9 @@ static int
 ctxopen(dev_t dev, int flags, int fmt, struct thread *td)
 {
 	struct ctx_soft_registers *sr;
-	u_char  unit;
 	int     i;
 
-	unit = UNIT(minor(dev));
-
-	/* minor number out of range? */
-
-	if (unit >= NCTX)
-		return (ENXIO);
-	sr = &(ctx_sr[unit]);
+	sr = dev->si_drv1;
 
 	if (sr->flag != 0)	/* someone has already opened us */
 		return (EBUSY);
@@ -266,24 +258,23 @@ ctxopen(dev_t dev, int flags, int fmt, struct thread *td)
 static int
 ctxclose(dev_t dev, int flags, int fmt, struct thread *td)
 {
-	int     unit;
+	struct ctx_soft_registers *sr;
 
-	unit = UNIT(minor(dev));
-	ctx_sr[unit].flag = 0;
-	free(ctx_sr[unit].lutp, M_DEVBUF);
-	ctx_sr[unit].lutp = NULL;
+	sr = dev->si_drv1;
+	sr->flag = 0;
+	free(sr->lutp, M_DEVBUF);
+	sr->lutp = NULL;
 	return (0);
 }
 
 static int
 ctxwrite(dev_t dev, struct uio * uio, int ioflag)
 {
-	int     unit, status = 0;
+	int     status = 0;
 	int     page, count, offset;
 	struct ctx_soft_registers *sr;
 
-	unit = UNIT(minor(dev));
-	sr = &(ctx_sr[unit]);
+	sr = dev->si_drv1;
 
 	if (uio->uio_offset < 0)
 		return (EINVAL);
@@ -328,12 +319,11 @@ ctxwrite(dev_t dev, struct uio * uio, int ioflag)
 static int
 ctxread(dev_t dev, struct uio * uio, int ioflag)
 {
-	int     unit, status = 0;
+	int     status = 0;
 	int     page, count, offset;
 	struct ctx_soft_registers *sr;
 
-	unit = UNIT(minor(dev));
-	sr = &(ctx_sr[unit]);
+	sr = dev->si_drv1;
 
 	if (uio->uio_offset < 0)
 		return (EINVAL);
@@ -377,12 +367,11 @@ static int
 ctxioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct thread *td)
 {
 	int     error;
-	int     unit, i;
+	int     i;
 	struct ctx_soft_registers *sr;
 
 	error = 0;
-	unit = UNIT(minor(dev));
-	sr = &(ctx_sr[unit]);
+	sr = dev->si_drv1;
 
 	switch (cmd) {
 	case CTX_LIVE:
diff --git a/sys/pc98/conf/NOTES b/sys/pc98/conf/NOTES
index 9d702c3..4b7ac0f 100644
--- a/sys/pc98/conf/NOTES
+++ b/sys/pc98/conf/NOTES
@@ -591,7 +591,7 @@ hint.wt.0.at="isa"
 hint.wt.0.port="0x300"
 hint.wt.0.irq="5"
 hint.wt.0.drq="1"
-device		ctx	1
+device		ctx
 hint.ctx.0.at="isa"
 hint.ctx.0.port="0x230"
 hint.ctx.0.maddr="0xd0000"