- Providing fine-grained malloc statistic by replacing M_DEVBUF with

  module-specific malloc types.  These should help us to pinpoint the
  possible memory leakage in the future.
- Implementing xpt_alloc_ccb_nowait() and replacing all malloc/free based
  CCB memory management with xpt_alloc_ccb[_nowait]/xpt_free_ccb.  Hopefully
  this would be helpful if someday we move the CCB allocator to use UMA
  instead of malloc().

Encouraged by:	jeffr, rwatson
Reviewed by:	gibbs, scottl
Approved by:	re (scottl)

9 files changed, 98 insertions, 66 deletions

diff --git a/sys/cam/cam_periph.c b/sys/cam/cam_periph.c
index 8a9a89f65066..604d08fc9405 100644
--- a/sys/cam/cam_periph.c
+++ b/sys/cam/cam_periph.c
@@ -34,6 +34,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/types.h>
 #include <sys/malloc.h>
+#include <sys/kernel.h>
 #include <sys/linker_set.h>
 #include <sys/bio.h>
 #include <sys/lock.h>
@@ -83,6 +84,8 @@ static	int		camperiphscsisenseerror(union ccb *ccb,
 static int nperiph_drivers;
 struct periph_driver **periph_drivers;
 
+MALLOC_DEFINE(M_CAMPERIPH, "CAM periph", "CAM peripheral buffers");
+
 void
 periphdriver_register(void *data)
 {
@@ -144,7 +147,7 @@ cam_periph_alloc(periph_ctor_t *periph_ctor,
 		return (CAM_REQ_INVALID);
 	}
 	
-	periph = (struct cam_periph *)malloc(sizeof(*periph), M_DEVBUF,
+	periph = (struct cam_periph *)malloc(sizeof(*periph), M_CAMPERIPH,
 					     M_NOWAIT);
 
 	if (periph == NULL)
@@ -220,7 +223,7 @@ failure:
 		xpt_free_path(periph->path);
 		/* FALLTHROUGH */
 	case 1:
-		free(periph, M_DEVBUF);
+		free(periph, M_CAMPERIPH);
 		/* FALLTHROUGH */
 	case 0:
 		/* No cleanup to perform. */
@@ -485,7 +488,7 @@ camperiphfree(struct cam_periph *periph)
 					  periph->path, arg);
 	}
 	xpt_free_path(periph->path);
-	free(periph, M_DEVBUF);
+	free(periph, M_CAMPERIPH);
 }
 
 /*
diff --git a/sys/cam/cam_queue.c b/sys/cam/cam_queue.c
index 6e74e9eb3581..1e756d2e89a8 100644
--- a/sys/cam/cam_queue.c
+++ b/sys/cam/cam_queue.c
@@ -33,12 +33,17 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/types.h>
 #include <sys/malloc.h>
+#include <sys/kernel.h>
 
 #include <cam/cam.h>
 #include <cam/cam_ccb.h>
 #include <cam/cam_queue.h>
 #include <cam/cam_debug.h>
 
+MALLOC_DEFINE(M_CAMQ, "CAM queue", "CAM queue buffers");
+MALLOC_DEFINE(M_CAMDEVQ, "CAM dev queue", "CAM dev queue buffers");
+MALLOC_DEFINE(M_CAMCCBQ, "CAM ccb queue", "CAM ccb queue buffers");
+
 static __inline int
 		queue_cmp(cam_pinfo **queue_array, int i, int j);
 static __inline void
@@ -52,10 +57,10 @@ camq_alloc(int size)
 {
 	struct camq *camq;
 
-	camq = (struct camq *)malloc(sizeof(*camq), M_DEVBUF, M_NOWAIT);
+	camq = (struct camq *)malloc(sizeof(*camq), M_CAMQ, M_NOWAIT);
 	if (camq != NULL) {
 		if (camq_init(camq, size) != 0) {
-			free(camq, M_DEVBUF);
+			free(camq, M_CAMQ);
 			camq = NULL;
 		}
 	}
@@ -69,7 +74,7 @@ camq_init(struct camq *camq, int size)
 	camq->array_size = size;
 	if (camq->array_size != 0) {
 		camq->queue_array = (cam_pinfo**)malloc(size*sizeof(cam_pinfo*),
-							M_DEVBUF, M_NOWAIT);
+							M_CAMQ, M_NOWAIT);
 		if (camq->queue_array == NULL) {
 			printf("camq_init: - cannot malloc array!\n");
 			return (1);
@@ -94,7 +99,7 @@ camq_free(struct camq *queue)
 {
 	if (queue != NULL) {
 		camq_fini(queue);
-		free(queue, M_DEVBUF);
+		free(queue, M_CAMQ);
 	}
 }
 
@@ -107,7 +112,7 @@ camq_fini(struct camq *queue)
 		 * our pointer into the heap array is offset by one element.
 		 */
 		queue->queue_array++;
-		free(queue->queue_array, M_DEVBUF);
+		free(queue->queue_array, M_CAMQ);
 	}
 }
 
@@ -122,7 +127,7 @@ camq_resize(struct camq *queue, int new_size)
 		      "queued entries.");
 #endif
 	new_array = (cam_pinfo **)malloc(new_size * sizeof(cam_pinfo *),
-					 M_DEVBUF, M_NOWAIT);
+					 M_CAMQ, M_NOWAIT);
 	if (new_array == NULL) {
 		/* Couldn't satisfy request */
 		return (CAM_RESRC_UNAVAIL);
@@ -136,7 +141,7 @@ camq_resize(struct camq *queue, int new_size)
 		queue->queue_array++;
 		bcopy(queue->queue_array, new_array,
 		      queue->entries * sizeof(cam_pinfo *));
-		free(queue->queue_array, M_DEVBUF);
+		free(queue->queue_array, M_CAMQ);
 	}
 	queue->queue_array = new_array-1;
 	queue->array_size = new_size;
@@ -210,13 +215,13 @@ cam_devq_alloc(int devices, int openings)
 {
 	struct cam_devq *devq;
 
-	devq = (struct cam_devq *)malloc(sizeof(*devq), M_DEVBUF, M_NOWAIT);
+	devq = (struct cam_devq *)malloc(sizeof(*devq), M_CAMDEVQ, M_NOWAIT);
 	if (devq == NULL) {
 		printf("cam_devq_alloc: - cannot malloc!\n");
 		return (NULL);
 	}
 	if (cam_devq_init(devq, devices, openings) != 0) {
-		free(devq, M_DEVBUF);
+		free(devq, M_CAMDEVQ);
 		return (NULL);		
 	}
 	
@@ -246,7 +251,7 @@ cam_devq_free(struct cam_devq *devq)
 {
 	camq_fini(&devq->alloc_queue);
 	camq_fini(&devq->send_queue);
-	free(devq, M_DEVBUF);
+	free(devq, M_CAMDEVQ);
 }
 
 u_int32_t
@@ -267,13 +272,13 @@ cam_ccbq_alloc(int openings)
 {
 	struct cam_ccbq *ccbq;
 
-	ccbq = (struct cam_ccbq *)malloc(sizeof(*ccbq), M_DEVBUF, M_NOWAIT);
+	ccbq = (struct cam_ccbq *)malloc(sizeof(*ccbq), M_CAMCCBQ, M_NOWAIT);
 	if (ccbq == NULL) {
 		printf("cam_ccbq_alloc: - cannot malloc!\n");
 		return (NULL);
 	}
 	if (cam_ccbq_init(ccbq, openings) != 0) {
-		free(ccbq, M_DEVBUF);
+		free(ccbq, M_CAMCCBQ);
 		return (NULL);		
 	}
 	
@@ -285,7 +290,7 @@ cam_ccbq_free(struct cam_ccbq *ccbq)
 {
 	if (ccbq) {
 		camq_fini(&ccbq->queue);
-		free(ccbq, M_DEVBUF);
+		free(ccbq, M_CAMCCBQ);
 	}
 }
 
diff --git a/sys/cam/cam_sim.c b/sys/cam/cam_sim.c
index 28b16b686331..322915f20795 100644
--- a/sys/cam/cam_sim.c
+++ b/sys/cam/cam_sim.c
@@ -32,6 +32,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
+#include <sys/kernel.h>
 
 #include <cam/cam.h>
 #include <cam/cam_ccb.h>
@@ -40,6 +41,8 @@ __FBSDID("$FreeBSD$");
 
 #define CAM_PATH_ANY (u_int32_t)-1
 
+MALLOC_DEFINE(M_CAMSIM, "CAM SIM", "CAM SIM buffers");
+
 struct cam_devq *
 cam_simq_alloc(u_int32_t max_sim_transactions)
 {
@@ -68,10 +71,10 @@ cam_sim_alloc(sim_action_func sim_action, sim_poll_func sim_poll,
 	 */
 	if (strcmp(sim_name, "xpt") == 0)
 		sim = (struct cam_sim *)malloc(sizeof(struct cam_sim),
-					       M_DEVBUF, M_WAITOK);
+					       M_CAMSIM, M_WAITOK);
 	else
 		sim = (struct cam_sim *)malloc(sizeof(struct cam_sim),
-					       M_DEVBUF, M_NOWAIT);
+					       M_CAMSIM, M_NOWAIT);
 
 	if (sim != NULL) {
 		sim->sim_action = sim_action;
@@ -96,7 +99,7 @@ cam_sim_free(struct cam_sim *sim, int free_devq)
 {
 	if (free_devq)
 		cam_simq_free(sim->devq);
-	free(sim, M_DEVBUF);
+	free(sim, M_CAMSIM);
 }
 
 void
diff --git a/sys/cam/cam_xpt.c b/sys/cam/cam_xpt.c
index 8b4a679da514..49a527c1c963 100644
--- a/sys/cam/cam_xpt.c
+++ b/sys/cam/cam_xpt.c
@@ -65,6 +65,7 @@ __FBSDID("$FreeBSD$");
 #include "opt_cam.h"
 
 /* Datastructures internal to the xpt layer */
+MALLOC_DEFINE(M_CAMXPT, "CAM XPT", "CAM XPT buffers");
 
 /*
  * Definition of an async handler callback block.  These are used to add
@@ -3401,12 +3402,12 @@ xpt_action(union ccb *start_ccb)
 				SLIST_REMOVE(async_head, cur_entry,
 					     async_node, links);
 				csa->ccb_h.path->device->refcount--;
-				free(cur_entry, M_DEVBUF);
+				free(cur_entry, M_CAMXPT);
 			} else {
 				cur_entry->event_enable = csa->event_enable;
 			}
 		} else {
-			cur_entry = malloc(sizeof(*cur_entry), M_DEVBUF,
+			cur_entry = malloc(sizeof(*cur_entry), M_CAMXPT,
 					   M_NOWAIT);
 			if (cur_entry == NULL) {
 				splx(s);
@@ -4015,7 +4016,7 @@ xpt_create_path(struct cam_path **new_path_ptr, struct cam_periph *perph,
 
 	GIANT_REQUIRED;
 
-	path = (struct cam_path *)malloc(sizeof(*path), M_DEVBUF, M_NOWAIT);
+	path = (struct cam_path *)malloc(sizeof(*path), M_CAMXPT, M_NOWAIT);
 
 	if (path == NULL) {
 		status = CAM_RESRC_UNAVAIL;
@@ -4023,7 +4024,7 @@ xpt_create_path(struct cam_path **new_path_ptr, struct cam_periph *perph,
 	}
 	status = xpt_compile_path(path, perph, path_id, target_id, lun_id);
 	if (status != CAM_REQ_CMP) {
-		free(path, M_DEVBUF);
+		free(path, M_CAMXPT);
 		path = NULL;
 	}
 	*new_path_ptr = path;
@@ -4129,7 +4130,7 @@ xpt_free_path(struct cam_path *path)
 
 	CAM_DEBUG(path, CAM_DEBUG_TRACE, ("xpt_free_path\n"));
 	xpt_release_path(path);
-	free(path, M_DEVBUF);
+	free(path, M_CAMXPT);
 }
 
 
@@ -4355,7 +4356,7 @@ xpt_bus_register(struct cam_sim *sim, u_int32_t bus)
 
 	sim->bus_id = bus;
 	new_bus = (struct cam_eb *)malloc(sizeof(*new_bus),
-					  M_DEVBUF, M_NOWAIT);
+					  M_CAMXPT, M_NOWAIT);
 	if (new_bus == NULL) {
 		/* Couldn't satisfy request */
 		return (CAM_RESRC_UNAVAIL);
@@ -4869,14 +4870,25 @@ xpt_alloc_ccb()
 
 	GIANT_REQUIRED;
 
-	new_ccb = malloc(sizeof(*new_ccb), M_DEVBUF, M_WAITOK);
+	new_ccb = malloc(sizeof(*new_ccb), M_CAMXPT, M_WAITOK);
+	return (new_ccb);
+}
+
+union ccb *
+xpt_alloc_ccb_nowait()
+{
+	union ccb *new_ccb;
+
+	GIANT_REQUIRED;
+
+	new_ccb = malloc(sizeof(*new_ccb), M_CAMXPT, M_NOWAIT);
 	return (new_ccb);
 }
 
 void
 xpt_free_ccb(union ccb *free_ccb)
 {
-	free(free_ccb, M_DEVBUF);
+	free(free_ccb, M_CAMXPT);
 }
 
 
@@ -4898,7 +4910,7 @@ xpt_get_ccb(struct cam_ed *device)
 
 	s = splsoftcam();
 	if ((new_ccb = (union ccb *)SLIST_FIRST(&ccb_freeq)) == NULL) {
-		new_ccb = malloc(sizeof(*new_ccb), M_DEVBUF, M_NOWAIT);
+		new_ccb = xpt_alloc_ccb_nowait();
                 if (new_ccb == NULL) {
 			splx(s);
 			return (NULL);
@@ -4925,7 +4937,7 @@ xpt_release_bus(struct cam_eb *bus)
 		TAILQ_REMOVE(&xpt_busses, bus, links);
 		bus_generation++;
 		splx(s);
-		free(bus, M_DEVBUF);
+		free(bus, M_CAMXPT);
 	} else
 		splx(s);
 }
@@ -4935,7 +4947,7 @@ xpt_alloc_target(struct cam_eb *bus, target_id_t target_id)
 {
 	struct cam_et *target;
 
-	target = (struct cam_et *)malloc(sizeof(*target), M_DEVBUF, M_NOWAIT);
+	target = (struct cam_et *)malloc(sizeof(*target), M_CAMXPT, M_NOWAIT);
 	if (target != NULL) {
 		struct cam_et *cur_target;
 
@@ -4977,7 +4989,7 @@ xpt_release_target(struct cam_eb *bus, struct cam_et *target)
 		TAILQ_REMOVE(&bus->et_entries, target, links);
 		bus->generation++;
 		splx(s);
-		free(target, M_DEVBUF);
+		free(target, M_CAMXPT);
 		xpt_release_bus(bus);
 	} else
 		splx(s);
@@ -5001,7 +5013,7 @@ xpt_alloc_device(struct cam_eb *bus, struct cam_et *target, lun_id_t lun_id)
 		device = NULL;
 	} else {
 		device = (struct cam_ed *)malloc(sizeof(*device),
-						 M_DEVBUF, M_NOWAIT);
+						 M_CAMXPT, M_NOWAIT);
 	}
 
 	if (device != NULL) {
@@ -5015,13 +5027,13 @@ xpt_alloc_device(struct cam_eb *bus, struct cam_et *target, lun_id_t lun_id)
 		device->lun_id = lun_id;
 		/* Initialize our queues */
 		if (camq_init(&device->drvq, 0) != 0) {
-			free(device, M_DEVBUF);
+			free(device, M_CAMXPT);
 			return (NULL);
 		}
 		if (cam_ccbq_init(&device->ccbq,
 				  bus->sim->max_dev_openings) != 0) {
 			camq_fini(&device->drvq);
-			free(device, M_DEVBUF);
+			free(device, M_CAMXPT);
 			return (NULL);
 		}
 		SLIST_INIT(&device->asyncs);
@@ -5109,7 +5121,7 @@ xpt_release_device(struct cam_eb *bus, struct cam_et *target,
 		splx(s);
 		camq_fini(&device->drvq);
 		camq_fini(&device->ccbq.queue);
-		free(device, M_DEVBUF);
+		free(device, M_CAMXPT);
 		xpt_release_target(bus, target);
 	} else
 		splx(s);
@@ -5957,7 +5969,7 @@ probedone(struct cam_periph *periph, union ccb *done_ccb)
 
 		/* Clean up from previous instance of this device */
 		if (path->device->serial_num != NULL) {
-			free(path->device->serial_num, M_DEVBUF);
+			free(path->device->serial_num, M_CAMXPT);
 			path->device->serial_num = NULL;
 			path->device->serial_num_len = 0;
 		}
@@ -5972,7 +5984,7 @@ probedone(struct cam_periph *periph, union ccb *done_ccb)
 			have_serialnum = 1;
 			path->device->serial_num =
 				(u_int8_t *)malloc((serial_buf->length + 1),
-						   M_DEVBUF, M_NOWAIT);
+						   M_CAMXPT, M_NOWAIT);
 			if (path->device->serial_num != NULL) {
 				bcopy(serial_buf->serial_num,
 				      path->device->serial_num,
diff --git a/sys/cam/cam_xpt_periph.h b/sys/cam/cam_xpt_periph.h
index 129c53e8de62..c6b8cc26748f 100644
--- a/sys/cam/cam_xpt_periph.h
+++ b/sys/cam/cam_xpt_periph.h
@@ -39,6 +39,7 @@
 #ifdef _KERNEL
 void		xpt_polled_action(union ccb *ccb);
 union ccb	*xpt_alloc_ccb(void);
+union ccb	*xpt_alloc_ccb_nowait(void);
 void		xpt_free_ccb(union ccb *free_ccb);
 void		xpt_release_ccb(union ccb *released_ccb);
 void		xpt_schedule(struct cam_periph *perph, u_int32_t new_priority);
diff --git a/sys/cam/scsi/scsi_low.c b/sys/cam/scsi/scsi_low.c
index 2249559dd6bd..dc9a492ab912 100644
--- a/sys/cam/scsi/scsi_low.c
+++ b/sys/cam/scsi/scsi_low.c
@@ -111,6 +111,7 @@ __FBSDID("$FreeBSD$");
 #include <cam/cam_sim.h>
 #include <cam/cam_debug.h>
 #include <cam/cam_periph.h>
+#include <cam/cam_xpt_periph.h>
 
 #include <cam/scsi/scsi_all.h>
 #include <cam/scsi/scsi_message.h>
@@ -144,6 +145,8 @@ __FBSDID("$FreeBSD$");
 #define	SCSI_LOW_DISK_LFLAGS	0x0000ffff
 #define	SCSI_LOW_DISK_TFLAGS	0xffff0000
 
+MALLOC_DEFINE(M_SCSILOW, "SCSI low", "SCSI low buffers");
+
 /**************************************************************
  * Declarations
  **************************************************************/
@@ -394,8 +397,8 @@ scsi_low_translate_error_code(cb, tp)
  * SCSI INTERFACE (XS)
  **************************************************************/
 #define	SCSI_LOW_MINPHYS		0x10000
-#define	SCSI_LOW_MALLOC(size)		malloc((size), M_DEVBUF, M_NOWAIT)
-#define	SCSI_LOW_FREE(pt)		free((pt), M_DEVBUF)
+#define	SCSI_LOW_MALLOC(size)		malloc((size), M_SCSILOW, M_NOWAIT)
+#define	SCSI_LOW_FREE(pt)		free((pt), M_SCSILOW)
 #define	SCSI_LOW_ALLOC_CCB(flags)	scsi_low_get_ccb((flags))
 #define	SCSI_LOW_XS_POLL_HZ		1000
 
@@ -884,8 +887,8 @@ scsi_low_target_open(link, cf)
 /**************************************************************
  * SCSI INTERFACE (CAM)
  **************************************************************/
-#define	SCSI_LOW_MALLOC(size)		malloc((size), M_DEVBUF, M_NOWAIT)
-#define	SCSI_LOW_FREE(pt)		free((pt), M_DEVBUF)
+#define	SCSI_LOW_MALLOC(size)		malloc((size), M_SCSILOW, M_NOWAIT)
+#define	SCSI_LOW_FREE(pt)		free((pt), M_SCSILOW)
 #define	SCSI_LOW_ALLOC_CCB(flags)	scsi_low_get_ccb()
 
 static void scsi_low_poll_cam(struct cam_sim *);
@@ -955,7 +958,7 @@ scsi_low_cam_rescan_callback(periph, ccb)
 {
 
 	xpt_free_path(ccb->ccb_h.path);
-	free(ccb, M_DEVBUF);
+	xpt_free_ccb(ccb);
 }
 
 static void
@@ -963,7 +966,7 @@ scsi_low_rescan_bus_cam(slp)
 	struct scsi_low_softc *slp;
 {
   	struct cam_path *path;
-	union ccb *ccb = malloc(sizeof(union ccb), M_DEVBUF, M_WAITOK);
+	union ccb *ccb = xpt_alloc_ccb();
 	cam_status status;
 
 	bzero(ccb, sizeof(union ccb));
@@ -1412,7 +1415,7 @@ scsi_low_attach_cam(slp)
 	}
 
 	if (xpt_bus_register(slp->sl_si.sim, 0) != CAM_SUCCESS) {
-		free(slp->sl_si.sim, M_DEVBUF);
+		free(slp->sl_si.sim, M_SCSILOW);
 	 	return ENODEV;
 	}
        
diff --git a/sys/cam/scsi/scsi_sa.c b/sys/cam/scsi/scsi_sa.c
index 88ad7a25ea61..f970cf909117 100644
--- a/sys/cam/scsi/scsi_sa.c
+++ b/sys/cam/scsi/scsi_sa.c
@@ -101,6 +101,7 @@ __FBSDID("$FreeBSD$");
  * Driver states
  */
 
+MALLOC_DEFINE(M_SCSISA, "SCSI sa", "SCSI sequential access buffers");
 
 typedef enum {
 	SA_STATE_NORMAL, SA_STATE_ABNORMAL
@@ -1354,7 +1355,7 @@ sacleanup(struct cam_periph *periph)
 
 	xpt_print_path(periph->path);
 	printf("removing device entry\n");
-	free(softc, M_DEVBUF);
+	free(softc, M_SCSISA);
 }
 
 static void
@@ -1420,7 +1421,7 @@ saregister(struct cam_periph *periph, void *arg)
 	}
 
 	softc = (struct sa_softc *)
-	    malloc(sizeof (*softc), M_DEVBUF, M_NOWAIT | M_ZERO);
+	    malloc(sizeof (*softc), M_SCSISA, M_NOWAIT | M_ZERO);
 	if (softc == NULL) {
 		printf("saregister: Unable to probe new device. "
 		       "Unable to allocate softc\n");				
diff --git a/sys/cam/scsi/scsi_ses.c b/sys/cam/scsi/scsi_ses.c
index a25fd9014c71..608290dc85b5 100644
--- a/sys/cam/scsi/scsi_ses.c
+++ b/sys/cam/scsi/scsi_ses.c
@@ -51,6 +51,8 @@ __FBSDID("$FreeBSD$");
 
 #include <opt_ses.h>
 
+MALLOC_DEFINE(M_SCSISES, "SCSI SES", "SCSI SES buffers");
+
 /*
  * Platform Independent Driver Internal Definitions for SES devices.
  */
@@ -120,8 +122,8 @@ static int safte_set_objstat(ses_softc_t *, ses_objstat *, int);
 #define	SES_DLOG		if (0) ses_log
 #endif
 #define	SES_VLOG		if (bootverbose) ses_log
-#define	SES_MALLOC(amt)		malloc(amt, M_DEVBUF, M_NOWAIT)
-#define	SES_FREE(ptr, amt)	free(ptr, M_DEVBUF)
+#define	SES_MALLOC(amt)		malloc(amt, M_SCSISES, M_NOWAIT)
+#define	SES_FREE(ptr, amt)	free(ptr, M_SCSISES)
 #define	MEMZERO			bzero
 #define	MEMCPY(dest, src, amt)	bcopy(src, dest, amt)
 
@@ -250,7 +252,7 @@ sescleanup(struct cam_periph *periph)
 
 	xpt_print_path(periph->path);
 	printf("removing device entry\n");
-	free(softc, M_DEVBUF);
+	free(softc, M_SCSISES);
 }
 
 static void
@@ -324,7 +326,7 @@ sesregister(struct cam_periph *periph, void *arg)
 		return (CAM_REQ_CMP_ERR);
 	}
 
-	softc = malloc(sizeof (struct ses_softc), M_DEVBUF, M_NOWAIT);
+	softc = malloc(sizeof (struct ses_softc), M_SCSISES, M_NOWAIT);
 	if (softc == NULL) {
 		printf("sesregister: Unable to probe new device. "
 		       "Unable to allocate softc\n");				
@@ -359,7 +361,7 @@ sesregister(struct cam_periph *periph, void *arg)
 		break;
 	case SES_NONE:
 	default:
-		free(softc, M_DEVBUF);
+		free(softc, M_SCSISES);
 		return (CAM_REQ_CMP_ERR);
 	}
 
diff --git a/sys/cam/scsi/scsi_targ_bh.c b/sys/cam/scsi/scsi_targ_bh.c
index 828cbbb7c249..e755f2f60122 100644
--- a/sys/cam/scsi/scsi_targ_bh.c
+++ b/sys/cam/scsi/scsi_targ_bh.c
@@ -50,6 +50,8 @@ __FBSDID("$FreeBSD$");
 #include <cam/scsi/scsi_all.h>
 #include <cam/scsi/scsi_message.h>
 
+MALLOC_DEFINE(M_SCSIBH, "SCSI bh", "SCSI blackhole buffers");
+
 typedef enum {
 	TARGBH_STATE_NORMAL,
 	TARGBH_STATE_EXCEPTION,
@@ -276,7 +278,7 @@ targbhenlun(struct cam_periph *periph)
 	for (i = 0; i < MAX_ACCEPT; i++) {
 		struct ccb_accept_tio *atio;
 
-		atio = (struct ccb_accept_tio*)malloc(sizeof(*atio), M_DEVBUF,
+		atio = (struct ccb_accept_tio*)malloc(sizeof(*atio), M_SCSIBH,
 						      M_NOWAIT);
 		if (atio == NULL) {
 			status = CAM_RESRC_UNAVAIL;
@@ -286,7 +288,7 @@ targbhenlun(struct cam_periph *periph)
 		atio->ccb_h.ccb_descr = targbhallocdescr();
 
 		if (atio->ccb_h.ccb_descr == NULL) {
-			free(atio, M_DEVBUF);
+			free(atio, M_SCSIBH);
 			status = CAM_RESRC_UNAVAIL;
 			break;
 		}
@@ -298,7 +300,7 @@ targbhenlun(struct cam_periph *periph)
 		status = atio->ccb_h.status;
 		if (status != CAM_REQ_INPROG) {
 			targbhfreedescr(atio->ccb_h.ccb_descr);
-			free(atio, M_DEVBUF);
+			free(atio, M_SCSIBH);
 			break;
 		}
 		((struct targbh_cmd_desc*)atio->ccb_h.ccb_descr)->atio_link =
@@ -321,7 +323,7 @@ targbhenlun(struct cam_periph *periph)
 	for (i = 0; i < MAX_ACCEPT; i++) {
 		struct ccb_immed_notify *inot;
 
-		inot = (struct ccb_immed_notify*)malloc(sizeof(*inot), M_DEVBUF,
+		inot = (struct ccb_immed_notify*)malloc(sizeof(*inot), M_SCSIBH,
 						        M_NOWAIT);
 
 		if (inot == NULL) {
@@ -335,7 +337,7 @@ targbhenlun(struct cam_periph *periph)
 		xpt_action((union ccb *)inot);
 		status = inot->ccb_h.status;
 		if (status != CAM_REQ_INPROG) {
-			free(inot, M_DEVBUF);
+			free(inot, M_SCSIBH);
 			break;
 		}
 		SLIST_INSERT_HEAD(&softc->immed_notify_slist, &inot->ccb_h,
@@ -409,7 +411,7 @@ targbhctor(struct cam_periph *periph, void *arg)
 
 	/* Allocate our per-instance private storage */
 	softc = (struct targbh_softc *)malloc(sizeof(*softc),
-					      M_DEVBUF, M_NOWAIT);
+					      M_SCSIBH, M_NOWAIT);
 	if (softc == NULL) {
 		printf("targctor: unable to malloc softc\n");
 		return (CAM_REQ_CMP_ERR);
@@ -446,7 +448,7 @@ targbhdtor(struct cam_periph *periph)
 	default:
 		/* XXX Wait for callback of targbhdislun() */
 		tsleep(softc, PRIBIO, "targbh", hz/2);
-		free(softc, M_DEVBUF);
+		free(softc, M_SCSIBH);
 		break;
 	}
 }
@@ -576,7 +578,7 @@ targbhdone(struct cam_periph *periph, union ccb *done_ccb)
 		if (softc->state == TARGBH_STATE_TEARDOWN
 		 || atio->ccb_h.status == CAM_REQ_ABORTED) {
 			targbhfreedescr(descr);
-			free(done_ccb, M_DEVBUF);
+			xpt_free_ccb(done_ccb);
 			return;
 		}
 
@@ -725,7 +727,7 @@ targbhdone(struct cam_periph *periph, union ccb *done_ccb)
 			break;
 		} else {
 			targbhfreedescr(desc);
-			free(atio, M_DEVBUF);
+			free(atio, M_SCSIBH);
 		}
 		break;
 	}
@@ -737,7 +739,7 @@ targbhdone(struct cam_periph *periph, union ccb *done_ccb)
 		if (softc->state == TARGBH_STATE_TEARDOWN
 		 || done_ccb->ccb_h.status == CAM_REQ_ABORTED) {
 			printf("Freed an immediate notify\n");
-			free(done_ccb, M_DEVBUF);
+			xpt_free_ccb(done_ccb);
 		} else {
 			/* Requeue for another immediate event */
 			xpt_action(done_ccb);
@@ -771,16 +773,16 @@ targbhallocdescr()
 
 	/* Allocate the targbh_descr structure */
 	descr = (struct targbh_cmd_desc *)malloc(sizeof(*descr),
-					       M_DEVBUF, M_NOWAIT);
+					       M_SCSIBH, M_NOWAIT);
 	if (descr == NULL)
 		return (NULL);
 
 	bzero(descr, sizeof(*descr));
 
 	/* Allocate buffer backing store */
-	descr->backing_store = malloc(MAX_BUF_SIZE, M_DEVBUF, M_NOWAIT);
+	descr->backing_store = malloc(MAX_BUF_SIZE, M_SCSIBH, M_NOWAIT);
 	if (descr->backing_store == NULL) {
-		free(descr, M_DEVBUF);
+		free(descr, M_SCSIBH);
 		return (NULL);
 	}
 	descr->max_size = MAX_BUF_SIZE;
@@ -790,6 +792,6 @@ targbhallocdescr()
 static void
 targbhfreedescr(struct targbh_cmd_desc *descr)
 {
-	free(descr->backing_store, M_DEVBUF);
-	free(descr, M_DEVBUF);
+	free(descr->backing_store, M_SCSIBH);
+	free(descr, M_SCSIBH);
 }