7618 loader: dosfs can corrupt memory

Reviewed by: Andrew Stormont <andyjstormont@gmail.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>
Approved by: Richard Lowe <richlowe@richlowe.net>

14 files changed, 125 insertions, 156 deletions

diff --git a/usr/src/boot/lib/libstand/cd9660.c b/usr/src/boot/lib/libstand/cd9660.c
index c28a8b222d..8b8aa36d6c 100644
--- a/usr/src/boot/lib/libstand/cd9660.c
+++ b/usr/src/boot/lib/libstand/cd9660.c
@@ -143,7 +143,7 @@ susp_lookup_record(struct open_file *f, const char *identifier,
 		if (bcmp(sh->type, SUSP_CONTINUATION, 2) == 0) {
 			shc = (ISO_RRIP_CONT *)sh;
 			error = f->f_dev->dv_strategy(f->f_devdata, F_READ,
-			    cdb2devb(isonum_733(shc->location)), 0,
+			    cdb2devb(isonum_733(shc->location)),
 			    ISO_DEFAULT_BLOCK_SIZE, susp_buffer, &read);
 
 			/* Bail if it fails. */
@@ -288,7 +288,7 @@ cd9660_open(const char *path, struct open_file *f)
 	for (bno = 16;; bno++) {
 		twiddle(1);
 		rc = f->f_dev->dv_strategy(f->f_devdata, F_READ, cdb2devb(bno),
-		    0, ISO_DEFAULT_BLOCK_SIZE, buf, &read);
+		    ISO_DEFAULT_BLOCK_SIZE, buf, &read);
 		if (rc)
 			goto out;
 		if (read != ISO_DEFAULT_BLOCK_SIZE) {
@@ -323,7 +323,7 @@ cd9660_open(const char *path, struct open_file *f)
 				rc = f->f_dev->dv_strategy
 					(f->f_devdata, F_READ,
 					 cdb2devb(bno + boff),
-					 0, ISO_DEFAULT_BLOCK_SIZE,
+					 ISO_DEFAULT_BLOCK_SIZE,
 					 buf, &read);
 				if (rc)
 					goto out;
@@ -387,7 +387,7 @@ cd9660_open(const char *path, struct open_file *f)
 		bno = isonum_733(rec.extent) + isonum_711(rec.ext_attr_length);
 		twiddle(1);
 		rc = f->f_dev->dv_strategy(f->f_devdata, F_READ, cdb2devb(bno),
-		    0, ISO_DEFAULT_BLOCK_SIZE, buf, &read);
+		    ISO_DEFAULT_BLOCK_SIZE, buf, &read);
 		if (rc)
 			goto out;
 		if (read != ISO_DEFAULT_BLOCK_SIZE) {
@@ -444,7 +444,7 @@ buf_read_file(struct open_file *f, char **buf_p, size_t *size_p)
 
 		twiddle(16);
 		rc = f->f_dev->dv_strategy(f->f_devdata, F_READ,
-		    cdb2devb(blkno), 0, ISO_DEFAULT_BLOCK_SIZE,
+		    cdb2devb(blkno), ISO_DEFAULT_BLOCK_SIZE,
 		    fp->f_buf, &read);
 		if (rc)
 			return (rc);
diff --git a/usr/src/boot/lib/libstand/dosfs.c b/usr/src/boot/lib/libstand/dosfs.c
index 652ac92cae..6cf50b8ba2 100644
--- a/usr/src/boot/lib/libstand/dosfs.c
+++ b/usr/src/boot/lib/libstand/dosfs.c
@@ -154,7 +154,7 @@ static int fatcnt(DOS_FS *, u_int);
 static int fatget(DOS_FS *, u_int *);
 static int fatend(u_int, u_int);
 static int ioread(DOS_FS *, u_int, void *, u_int);
-static int ioget(struct open_file *, daddr_t, size_t, void *, u_int);
+static int ioget(struct open_file *, daddr_t, void *, u_int);
 
 static void
 dos_read_fat(DOS_FS *fs, struct open_file *fd)
@@ -172,7 +172,7 @@ dos_read_fat(DOS_FS *fs, struct open_file *fd)
 	fat.buf = malloc(secbyt(fs->spf));
 
     if (fat.buf != NULL) {
-	if (ioget(fd, fs->lsnfat, 0, fat.buf, secbyt(fs->spf)) == 0) {
+	if (ioget(fd, fs->lsnfat, fat.buf, secbyt(fs->spf)) == 0) {
 	    fat.size = fs->spf;
 	    fat.unit = dd->d_unit;
 	    return;
@@ -199,12 +199,12 @@ dos_mount(DOS_FS *fs, struct open_file *fd)
     fs->fd = fd;
 
     if ((err = !(buf = malloc(secbyt(1))) ? errno : 0) ||
-        (err = ioget(fs->fd, 0, 0, buf, secbyt(1))) ||
+        (err = ioget(fs->fd, 0, buf, secbyt(1))) ||
         (err = parsebs(fs, (DOS_BS *)buf))) {
 	if (buf != NULL)
 	    free(buf);
         (void)dosunmount(fs);
-        return(err);
+        return (err);
     }
     free(buf);
 
@@ -219,7 +219,7 @@ dos_mount(DOS_FS *fs, struct open_file *fd)
         fs->root.dex.h_clus[0] = (fs->rdcl >> 16) & 0xff;
         fs->root.dex.h_clus[1] = (fs->rdcl >> 24) & 0xff;
     }
-    return 0;
+    return (0);
 }
 
 /*
@@ -231,10 +231,10 @@ dos_unmount(DOS_FS *fs)
     int err;
 
     if (fs->links)
-        return(EBUSY);
+        return (EBUSY);
     if ((err = dosunmount(fs)))
-        return(err);
-    return 0;
+        return (err);
+    return (0);
 }
 
 /*
@@ -244,7 +244,7 @@ static int
 dosunmount(DOS_FS *fs)
 {
     free(fs);
-    return(0);
+    return (0);
 }
 
 /*
@@ -285,7 +285,7 @@ dos_open(const char *path, struct open_file *fd)
     fd->f_fsdata = (void *)f;
 
  out:
-    return(err);
+    return (err);
 }
 
 /*
@@ -307,7 +307,7 @@ dos_read(struct open_file *fd, void *buf, size_t nbyte, size_t *resid)
     twiddle(4);
     nb = (u_int)nbyte;
     if ((size = fsize(f->fs, &f->de)) == -1)
-	return EINVAL;
+	return (EINVAL);
     if (nb > (n = size - f->offset))
 	nb = n;
     off = f->offset;
@@ -344,7 +344,7 @@ dos_read(struct open_file *fd, void *buf, size_t nbyte, size_t *resid)
  out:
     if (resid)
 	*resid = nbyte - nb + cnt;
-    return(err);
+    return (err);
 }
 
 /*
@@ -370,16 +370,16 @@ dos_seek(struct open_file *fd, off_t offset, int whence)
         break;
     default:
 	errno = EINVAL;
-	return(-1);
+	return (-1);
     }
     off += offset;
     if (off < 0 || off > size) {
 	errno = EINVAL;
-        return(-1);
+        return (-1);
     }
     f->offset = (u_int)off;
     f->c = 0;
-    return(off);
+    return (off);
 }
 
 /*
@@ -394,7 +394,7 @@ dos_close(struct open_file *fd)
     f->fs->links--;
     free(f);
     dos_unmount(fs);
-    return 0;
+    return (0);
 }
 
 /*
@@ -411,7 +411,7 @@ dos_stat(struct open_file *fd, struct stat *sb)
     sb->st_uid = 0;
     sb->st_gid = 0;
     if ((sb->st_size = fsize(f->fs, &f->de)) == -1)
-	return EINVAL;
+	return (EINVAL);
     return (0);
 }
 
@@ -501,7 +501,7 @@ dos_readdir(struct open_file *fd, struct dirent *d)
     d->d_reclen = sizeof(*d);
     d->d_type = (dd.de.attr & FA_DIR) ? DT_DIR : DT_REG;
     memcpy(d->d_name, fn, sizeof(d->d_name));
-    return(0);
+    return (0);
 }
 
 /*
@@ -516,41 +516,41 @@ parsebs(DOS_FS *fs, DOS_BS *bs)
          bs->jmp[0] != 0xe9 &&
          (bs->jmp[0] != 0xeb || bs->jmp[2] != 0x90)) ||
         bs->bpb.media < 0xf0)
-        return EINVAL;
+        return (EINVAL);
     if (cv2(bs->bpb.secsiz) != SECSIZ)
-        return EINVAL;
+        return (EINVAL);
     if (!(fs->spc = bs->bpb.spc) || fs->spc & (fs->spc - 1))
-        return EINVAL;
+        return (EINVAL);
     fs->bsize = secbyt(fs->spc);
     fs->bshift = ffs(fs->bsize) - 1;
     if ((fs->spf = cv2(bs->bpb.spf))) {
         if (bs->bpb.fats != 2)
-            return EINVAL;
+            return (EINVAL);
         if (!(fs->dirents = cv2(bs->bpb.dirents)))
-            return EINVAL;
+            return (EINVAL);
     } else {
         if (!(fs->spf = cv4(bs->bpb.lspf)))
-            return EINVAL;
+            return (EINVAL);
         if (!bs->bpb.fats || bs->bpb.fats > 16)
-            return EINVAL;
+            return (EINVAL);
         if ((fs->rdcl = cv4(bs->bpb.rdcl)) < LOCLUS)
-            return EINVAL;
+            return (EINVAL);
     }
     if (!(fs->lsnfat = cv2(bs->bpb.ressec)))
-        return EINVAL;
+        return (EINVAL);
     fs->lsndir = fs->lsnfat + fs->spf * bs->bpb.fats;
     fs->lsndta = fs->lsndir + entsec(fs->dirents);
     if (!(sc = cv2(bs->bpb.secs)) && !(sc = cv4(bs->bpb.lsecs)))
-        return EINVAL;
+        return (EINVAL);
     if (fs->lsndta > sc)
-        return EINVAL;
+        return (EINVAL);
     if ((fs->xclus = secblk(fs, sc - fs->lsndta) + 1) < LOCLUS)
-        return EINVAL;
+        return (EINVAL);
     fs->fatsz = fs->dirents ? fs->xclus < 0xff6 ? 12 : 16 : 32;
     sc = (secbyt(fs->spf) << 1) / (fs->fatsz >> 2) - 1;
     if (fs->xclus > sc)
         fs->xclus = sc;
-    return 0;
+    return (0);
 }
 
 /*
@@ -575,17 +575,17 @@ namede(DOS_FS *fs, const char *path, DOS_DE **dep)
         if (!(s = strchr(path, '/')))
             s = strchr(path, 0);
         if ((n = s - path) > 255)
-            return ENAMETOOLONG;
+            return (ENAMETOOLONG);
         memcpy(name, path, n);
         name[n] = 0;
         path = s;
         if (!(de->attr & FA_DIR))
-            return ENOTDIR;
+            return (ENOTDIR);
         if ((err = lookup(fs, stclus(fs->fatsz, de), name, &de)))
-            return err;
+            return (err);
     }
     *dep = de;
-    return 0;
+    return (0);
 }
 
 /*
@@ -604,7 +604,7 @@ lookup(DOS_FS *fs, u_int clus, const char *name, DOS_DE **dep)
         for (ent = 0; ent < 2; ent++)
             if (!strcasecmp(name, dotstr[ent])) {
                 *dep = dot + ent;
-                return 0;
+                return (0);
             }
     if (!clus && fs->fatsz == 32)
         clus = fs->rdcl;
@@ -617,13 +617,13 @@ lookup(DOS_FS *fs, u_int clus, const char *name, DOS_DE **dep)
         else if (okclus(fs, clus))
             lsec = blklsn(fs, clus);
         else
-            return EINVAL;
+            return (EINVAL);
         for (sec = 0; sec < nsec; sec++) {
-            if ((err = ioget(fs->fd, lsec + sec, 0, dir, secbyt(1))))
-                return err;
+            if ((err = ioget(fs->fd, lsec + sec, dir, secbyt(1))))
+                return (err);
             for (ent = 0; ent < DEPSEC; ent++) {
                 if (!*dir[ent].de.name)
-                    return ENOENT;
+                    return (ENOENT);
                 if (*dir[ent].de.name != 0xe5) {
                     if ((dir[ent].de.attr & FA_MASK) == FA_XDE) {
                         x = dir[ent].xde.seq;
@@ -651,7 +651,7 @@ lookup(DOS_FS *fs, u_int clus, const char *name, DOS_DE **dep)
                         }
                         if (ok) {
                             *dep = &dir[ent].de;
-                            return 0;
+                            return (0);
                         }
                     }
 		}
@@ -661,11 +661,11 @@ lookup(DOS_FS *fs, u_int clus, const char *name, DOS_DE **dep)
         if (!clus)
             break;
         if ((err = fatget(fs, &clus)))
-            return err;
+            return (err);
         if (fatend(fs->fatsz, clus))
             break;
     }
-    return ENOENT;
+    return (ENOENT);
 }
 
 /*
@@ -739,11 +739,11 @@ fsize(DOS_FS *fs, DOS_DE *de)
          size = fs->dirents * sizeof(DOS_DE);
       else {
          if ((n = fatcnt(fs, c)) == -1)
-            return n;
+            return (n);
          size = blkbyt(fs, n);
       }
    }
-   return size;
+   return (size);
 }
 
 /*
@@ -756,8 +756,8 @@ fatcnt(DOS_FS *fs, u_int c)
 
    for (n = 0; okclus(fs, c); n++)
       if (fatget(fs, &c))
-	  return -1;
-   return fatend(fs->fatsz, c) ? n : -1;
+	  return (-1);
+   return (fatend(fs->fatsz, c) ? n : -1);
 }
 
 /*
@@ -768,8 +768,7 @@ static int
 fatget(DOS_FS *fs, u_int *c)
 {
     u_char buf[4];
-    u_char *s;
-    u_int x, offset, off, n, nbyte, lsec;
+    u_int x, offset, n, nbyte;
     struct devdesc *dd = fs->fd->f_devdata;
     int err = 0;
 
@@ -783,25 +782,9 @@ fatget(DOS_FS *fs, u_int *c)
 	offset = fatoff(fs->fatsz, *c);
 	nbyte = fs->fatsz != 32 ? 2 : 4;
 
-	s = buf;
-	if ((off = offset & (SECSIZ - 1))) {
-	    offset -= off;
-	    lsec = bytsec(offset);
-	    offset += SECSIZ;
-	    if ((n = SECSIZ - off) > nbyte)
-		n = nbyte;
-	    memcpy(s, fat.buf + secbyt(lsec) + off, n);
-	    s += n;
-	    nbyte -= n;
-	}
-	n = nbyte & (SECSIZ - 1);
-	if (nbyte -= n) {
-	    memcpy(s, fat.buf + secbyt(bytsec(offset)), nbyte);
-	    offset += nbyte;
-	    s += nbyte;
-	}
-	if (n)
-	    memcpy(s, fat.buf + secbyt(bytsec(offset)), n);
+	if (offset + nbyte > secbyt(fat.size))
+	    return (EINVAL);
+	memcpy(buf, fat.buf + offset, nbyte);
     }
 
     x = fs->fatsz != 32 ? cv2(buf) : cv4(buf);
@@ -815,7 +798,7 @@ fatget(DOS_FS *fs, u_int *c)
 static int
 fatend(u_int sz, u_int c)
 {
-    return c > (sz == 12 ? 0xff7U : sz == 16 ? 0xfff7U : 0xffffff7);
+    return (c > (sz == 12 ? 0xff7U : sz == 16 ? 0xfff7U : 0xffffff7));
 }
 
 /*
@@ -827,38 +810,41 @@ ioread(DOS_FS *fs, u_int offset, void *buf, u_int nbyte)
     char *s;
     u_int off, n;
     int err;
+    u_char local_buf[SECSIZ];
 
     s = buf;
     if ((off = offset & (SECSIZ - 1))) {
         offset -= off;
         if ((n = SECSIZ - off) > nbyte)
             n = nbyte;
-        if ((err = ioget(fs->fd, bytsec(offset), off, s, n)))
-            return err;
+        if ((err = ioget(fs->fd, bytsec(offset), local_buf, sizeof(local_buf))))
+            return (err);
+	memcpy(s, local_buf + off, n);
         offset += SECSIZ;
         s += n;
         nbyte -= n;
     }
     n = nbyte & (SECSIZ - 1);
     if (nbyte -= n) {
-        if ((err = ioget(fs->fd, bytsec(offset), 0, s, nbyte)))
-            return err;
+        if ((err = ioget(fs->fd, bytsec(offset), s, nbyte)))
+            return (err);
         offset += nbyte;
         s += nbyte;
     }
     if (n) {
-        if ((err = ioget(fs->fd, bytsec(offset), 0, s, n)))
-            return err;
+        if ((err = ioget(fs->fd, bytsec(offset), local_buf, sizeof(local_buf))))
+            return (err);
+	memcpy(s, local_buf, n);
     }
-    return 0;
+    return (0);
 }
 
 /*
  * Sector-based I/O primitive
  */
 static int
-ioget(struct open_file *fd, daddr_t lsec, size_t offset, void *buf, u_int size)
+ioget(struct open_file *fd, daddr_t lsec, void *buf, u_int size)
 {
-    return ((fd->f_dev->dv_strategy)(fd->f_devdata, F_READ, lsec, offset,
+    return ((fd->f_dev->dv_strategy)(fd->f_devdata, F_READ, lsec,
 	size, buf, NULL));
 }
diff --git a/usr/src/boot/lib/libstand/read.c b/usr/src/boot/lib/libstand/read.c
index 32f7084a8b..aa1f74df60 100644
--- a/usr/src/boot/lib/libstand/read.c
+++ b/usr/src/boot/lib/libstand/read.c
@@ -79,7 +79,7 @@ read(int fd, void *dest, size_t bcount)
     if (f->f_flags & F_RAW) {
 	twiddle(8);
 	errno = (f->f_dev->dv_strategy)(f->f_devdata, F_READ,
-	    btodb(f->f_offset), 0, bcount, dest, &resid);
+	    btodb(f->f_offset), bcount, dest, &resid);
 	if (errno)
 	    return (-1);
 	f->f_offset += resid;
diff --git a/usr/src/boot/lib/libstand/stand.h b/usr/src/boot/lib/libstand/stand.h
index 3f193e9c3a..7653242656 100644
--- a/usr/src/boot/lib/libstand/stand.h
+++ b/usr/src/boot/lib/libstand/stand.h
@@ -139,7 +139,7 @@ struct devsw {
     int		dv_type;		/* opaque type constant, arch-dependant */
     int		(*dv_init)(void);	/* early probe call */
     int		(*dv_strategy)(void *devdata, int rw, daddr_t blk,
-			size_t offset, size_t size, char *buf, size_t *rsize);
+			size_t size, char *buf, size_t *rsize);
     int		(*dv_open)(struct open_file *f, ...);
     int		(*dv_close)(struct open_file *f);
     int		(*dv_ioctl)(struct open_file *f, u_long cmd, void *data);
diff --git a/usr/src/boot/lib/libstand/ufs.c b/usr/src/boot/lib/libstand/ufs.c
index d0a096693d..7d2ff148f4 100644
--- a/usr/src/boot/lib/libstand/ufs.c
+++ b/usr/src/boot/lib/libstand/ufs.c
@@ -157,7 +157,7 @@ read_inode(inumber, f)
 	buf = malloc(fs->fs_bsize);
 	twiddle(1);
 	rc = (f->f_dev->dv_strategy)(f->f_devdata, F_READ,
-		fsbtodb(fs, ino_to_fsba(fs, inumber)), 0, fs->fs_bsize,
+		fsbtodb(fs, ino_to_fsba(fs, inumber)), fs->fs_bsize,
 		buf, &rsize);
 	if (rc)
 		goto out;
@@ -267,7 +267,7 @@ block_map(f, file_block, disk_block_p)
 					malloc(fs->fs_bsize);
 			twiddle(1);
 			rc = (f->f_dev->dv_strategy)(f->f_devdata, F_READ,
-				fsbtodb(fp->f_fs, ind_block_num), 0,
+				fsbtodb(fp->f_fs, ind_block_num),
 				fs->fs_bsize,
 				fp->f_blk[level],
 				&fp->f_blksize[level]);
@@ -348,7 +348,7 @@ buf_write_file(f, buf_p, size_p)
 
 		twiddle(8);
 		rc = (f->f_dev->dv_strategy)(f->f_devdata, F_READ,
-			fsbtodb(fs, disk_block), 0,
+			fsbtodb(fs, disk_block),
 			block_size, fp->f_buf, &fp->f_buf_size);
 		if (rc)
 			return (rc);
@@ -367,7 +367,7 @@ buf_write_file(f, buf_p, size_p)
 
 	twiddle(4);
 	rc = (f->f_dev->dv_strategy)(f->f_devdata, F_WRITE,
-		fsbtodb(fs, disk_block), 0,
+		fsbtodb(fs, disk_block),
 		block_size, fp->f_buf, &fp->f_buf_size);
 	return (rc);
 }
@@ -408,7 +408,7 @@ buf_read_file(f, buf_p, size_p)
 		} else {
 			twiddle(4);
 			rc = (f->f_dev->dv_strategy)(f->f_devdata,
-				F_READ, fsbtodb(fs, disk_block), 0,
+				F_READ, fsbtodb(fs, disk_block),
 				block_size, fp->f_buf, &fp->f_buf_size);
 			if (rc)
 				return (rc);
@@ -516,7 +516,7 @@ ufs_open(upath, f)
 	 */
 	for (i = 0; sblock_try[i] != -1; i++) {
 		rc = (f->f_dev->dv_strategy)(f->f_devdata, F_READ,
-		    sblock_try[i] / DEV_BSIZE, 0, SBLOCKSIZE,
+		    sblock_try[i] / DEV_BSIZE, SBLOCKSIZE,
 		    (char *)fs, &buf_size);
 		if (rc)
 			goto out;
@@ -646,7 +646,7 @@ ufs_open(upath, f)
 				
 				twiddle(1);
 				rc = (f->f_dev->dv_strategy)(f->f_devdata,
-					F_READ, fsbtodb(fs, disk_block), 0,
+					F_READ, fsbtodb(fs, disk_block),
 					fs->fs_bsize, buf, &buf_size);
 				if (rc)
 					goto out;
diff --git a/usr/src/boot/lib/libstand/write.c b/usr/src/boot/lib/libstand/write.c
index daf33cfca1..9e02f083f2 100644
--- a/usr/src/boot/lib/libstand/write.c
+++ b/usr/src/boot/lib/libstand/write.c
@@ -82,7 +82,7 @@ write(fd, dest, bcount)
 	if (f->f_flags & F_RAW) {
 		twiddle(4);
 		errno = (f->f_dev->dv_strategy)(f->f_devdata, F_WRITE,
-			btodb(f->f_offset), 0, bcount, dest, &resid);
+			btodb(f->f_offset), bcount, dest, &resid);
 		if (errno)
 			return (-1);
 		f->f_offset += resid;
diff --git a/usr/src/boot/sys/boot/common/bcache.c b/usr/src/boot/sys/boot/common/bcache.c
index 3ac38d9b18..4c155625be 100644
--- a/usr/src/boot/sys/boot/common/bcache.c
+++ b/usr/src/boot/sys/boot/common/bcache.c
@@ -182,8 +182,8 @@ bcache_free(void *cache)
  * cache with the new values.
  */
 static int
-write_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
-    size_t size, char *buf, size_t *rsize)
+write_strategy(void *devdata, int rw, daddr_t blk, size_t size,
+    char *buf, size_t *rsize)
 {
     struct bcache_devdata	*dd = (struct bcache_devdata *)devdata;
     struct bcache		*bc = dd->dv_cache;
@@ -197,7 +197,7 @@ write_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
     }
 
     /* Write the blocks */
-    return (dd->dv_strategy(dd->dv_devdata, rw, blk, offset, size, buf, rsize));
+    return (dd->dv_strategy(dd->dv_devdata, rw, blk, size, buf, rsize));
 }
 
 /*
@@ -206,8 +206,8 @@ write_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
  * device I/O and then use the I/O results to populate the cache. 
  */
 static int
-read_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
-    size_t size, char *buf, size_t *rsize)
+read_strategy(void *devdata, int rw, daddr_t blk, size_t size,
+    char *buf, size_t *rsize)
 {
     struct bcache_devdata	*dd = (struct bcache_devdata *)devdata;
     struct bcache		*bc = dd->dv_cache;
@@ -225,7 +225,7 @@ read_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 	*rsize = 0;
 
     nblk = size / bcache_blksize;
-    if ((nblk == 0 && size != 0) || offset != 0)
+    if (nblk == 0 && size != 0)
 	nblk++;
     result = 0;
     complete = 1;
@@ -246,8 +246,7 @@ read_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
    if (complete) {	/* whole set was in cache, return it */
 	if (bc->ra < BCACHE_READAHEAD)
 		bc->ra <<= 1;	/* increase read ahead */
-	bcopy(bc->bcache_data + (bcache_blksize * BHASH(bc, blk)) + offset,
-	    buf, size);
+	bcopy(bc->bcache_data + (bcache_blksize * BHASH(bc, blk)), buf, size);
 	goto done;
    }
 
@@ -282,7 +281,7 @@ read_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
      * in either case we should return the data in bcache and only
      * return error if there is no data.
      */
-    result = dd->dv_strategy(dd->dv_devdata, rw, p_blk, 0,
+    result = dd->dv_strategy(dd->dv_devdata, rw, p_blk,
 	p_size * bcache_blksize, p_buf, &r_size);
 
     r_size /= bcache_blksize;
@@ -307,8 +306,7 @@ read_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 	size = i * bcache_blksize;
 
     if (size != 0) {
-	bcopy(bc->bcache_data + (bcache_blksize * BHASH(bc, blk)) + offset,
-	    buf, size);
+	bcopy(bc->bcache_data + (bcache_blksize * BHASH(bc, blk)), buf, size);
 	result = 0;
     }
 
@@ -323,8 +321,8 @@ read_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
  * directly to the disk.  XXX tune this.
  */
 int
-bcache_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
-    size_t size, char *buf, size_t *rsize)
+bcache_strategy(void *devdata, int rw, daddr_t blk, size_t size,
+    char *buf, size_t *rsize)
 {
     struct bcache_devdata	*dd = (struct bcache_devdata *)devdata;
     struct bcache		*bc = dd->dv_cache;
@@ -339,23 +337,16 @@ bcache_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 
     /* bypass large requests, or when the cache is inactive */
     if (bc == NULL ||
-	(offset == 0 && ((size * 2 / bcache_blksize) > bcache_nblks))) {
+	((size * 2 / bcache_blksize) > bcache_nblks)) {
 	DEBUG("bypass %d from %d", size / bcache_blksize, blk);
 	bcache_bypasses++;
-	return (dd->dv_strategy(dd->dv_devdata, rw, blk, offset, size, buf,
-	    rsize));
-    }
-
-    /* normalize offset */
-    while (offset >= bcache_blksize) {
-	blk++;
-	offset -= bcache_blksize;
+	return (dd->dv_strategy(dd->dv_devdata, rw, blk, size, buf, rsize));
     }
 
     switch (rw) {
     case F_READ:
 	nblk = size / bcache_blksize;
-	if (offset || (size != 0 && nblk == 0))
+	if (size != 0 && nblk == 0)
 	    nblk++;	/* read at least one block */
 
 	ret = 0;
@@ -366,14 +357,10 @@ bcache_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 
 	    if (size <= bcache_blksize)
 		csize = size;
-	    else {
+	    else
 		csize = cblk * bcache_blksize;
-		if (offset)
-		    csize -= (bcache_blksize - offset);
-	    }
 
-	    ret = read_strategy(devdata, rw, blk, offset,
-		csize, buf+total, &isize);
+	    ret = read_strategy(devdata, rw, blk, csize, buf+total, &isize);
 
 	    /*
 	     * we may have error from read ahead, if we have read some data
@@ -384,8 +371,7 @@ bcache_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 		    ret = 0;
 		break;
 	    }
-	    blk += (offset+isize) / bcache_blksize;
-	    offset = 0;
+	    blk += isize / bcache_blksize;
 	    total += isize;
 	    size -= isize;
 	    nblk = size / bcache_blksize;
@@ -396,7 +382,7 @@ bcache_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 
 	return (ret);
     case F_WRITE:
-	return write_strategy(devdata, rw, blk, offset, size, buf, rsize);
+	return write_strategy(devdata, rw, blk, size, buf, rsize);
     }
     return -1;
 }
diff --git a/usr/src/boot/sys/boot/common/bootstrap.h b/usr/src/boot/sys/boot/common/bootstrap.h
index 9539180cb3..fb2201f5d4 100644
--- a/usr/src/boot/sys/boot/common/bootstrap.h
+++ b/usr/src/boot/sys/boot/common/bootstrap.h
@@ -78,7 +78,7 @@ void	bcache_add_dev(int);
 void	*bcache_allocate(void);
 void	bcache_free(void *);
 int	bcache_strategy(void *devdata, int rw, daddr_t blk,
-    size_t offset, size_t size, char *buf, size_t *rsize);
+    size_t size, char *buf, size_t *rsize);
 
 /*
  * Disk block cache
@@ -86,7 +86,7 @@ int	bcache_strategy(void *devdata, int rw, daddr_t blk,
 struct bcache_devdata
 {
     int         (*dv_strategy)(void *devdata, int rw, daddr_t blk,
-		    size_t offset, size_t size, char *buf, size_t *rsize);
+		    size_t size, char *buf, size_t *rsize);
     void	*dv_devdata;
     void	*dv_cache;
 };
diff --git a/usr/src/boot/sys/boot/common/disk.c b/usr/src/boot/sys/boot/common/disk.c
index c7eab49fe9..bad0a700c4 100644
--- a/usr/src/boot/sys/boot/common/disk.c
+++ b/usr/src/boot/sys/boot/common/disk.c
@@ -178,7 +178,7 @@ ptblread(void *d, void *buf, size_t blocks, uint64_t offset)
 
 	dev = (struct disk_devdesc *)d;
 	od = (struct open_disk *)dev->d_opendata;
-	return (dev->d_dev->dv_strategy(dev, F_READ, offset, 0,
+	return (dev->d_dev->dv_strategy(dev, F_READ, offset,
 	    blocks * od->sectorsize, (char *)buf, NULL));
 }
 
@@ -243,7 +243,7 @@ disk_read(struct disk_devdesc *dev, void *buf, uint64_t offset, u_int blocks)
 	int ret;
 
 	od = (struct open_disk *)dev->d_opendata;
-	ret = dev->d_dev->dv_strategy(dev, F_READ, dev->d_offset + offset, 0,
+	ret = dev->d_dev->dv_strategy(dev, F_READ, dev->d_offset + offset,
 	    blocks * od->sectorsize, buf, NULL);
 
 	return (ret);
@@ -256,7 +256,7 @@ disk_write(struct disk_devdesc *dev, void *buf, uint64_t offset, u_int blocks)
 	int ret;
 
 	od = (struct open_disk *)dev->d_opendata;
-	ret = dev->d_dev->dv_strategy(dev, F_WRITE, dev->d_offset + offset, 0,
+	ret = dev->d_dev->dv_strategy(dev, F_WRITE, dev->d_offset + offset,
 	    blocks * od->sectorsize, buf, NULL);
 
 	return (ret);
diff --git a/usr/src/boot/sys/boot/efi/libefi/efipart.c b/usr/src/boot/sys/boot/efi/libefi/efipart.c
index 9ba52bb626..56cba4af47 100644
--- a/usr/src/boot/sys/boot/efi/libefi/efipart.c
+++ b/usr/src/boot/sys/boot/efi/libefi/efipart.c
@@ -42,10 +42,8 @@ static EFI_GUID blkio_guid = BLOCK_IO_PROTOCOL;
 static EFI_GUID devpath_guid = DEVICE_PATH_PROTOCOL;
 
 static int efipart_init(void);
-static int efipart_strategy(void *, int, daddr_t, size_t, size_t, char *,
-    size_t *);
-static int efipart_realstrategy(void *, int, daddr_t, size_t, size_t, char *,
-    size_t *);
+static int efipart_strategy(void *, int, daddr_t, size_t, char *, size_t *);
+static int efipart_realstrategy(void *, int, daddr_t, size_t, char *, size_t *);
 static int efipart_open(struct open_file *, ...);
 static int efipart_close(struct open_file *);
 static int efipart_print(int);
@@ -296,8 +294,8 @@ efipart_readwrite(EFI_BLOCK_IO *blkio, int rw, daddr_t blk, daddr_t nblks,
 }
 
 static int
-efipart_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
-    size_t size, char *buf, size_t *rsize)
+efipart_strategy(void *devdata, int rw, daddr_t blk, size_t size,
+    char *buf, size_t *rsize)
 {
 	struct bcache_devdata bcd;
 	struct devdesc *dev;
@@ -306,13 +304,12 @@ efipart_strategy(void *devdata, int rw, daddr_t blk, size_t offset,
 	bcd.dv_strategy = efipart_realstrategy;
 	bcd.dv_devdata = devdata;
 	bcd.dv_cache = PD(dev).pd_bcache;
-	return (bcache_strategy(&bcd, rw, blk, offset, size,
-	    buf, rsize));
+	return (bcache_strategy(&bcd, rw, blk, size, buf, rsize));
 }
 
 static int
-efipart_realstrategy(void *devdata, int rw, daddr_t blk, size_t offset,
-    size_t size, char *buf, size_t *rsize)
+efipart_realstrategy(void *devdata, int rw, daddr_t blk, size_t size,
+    char *buf, size_t *rsize)
 {
 	struct devdesc *dev = (struct devdesc *)devdata;
 	EFI_BLOCK_IO *blkio;
diff --git a/usr/src/boot/sys/boot/i386/libi386/bioscd.c b/usr/src/boot/sys/boot/i386/libi386/bioscd.c
index 0d51bd29db..6a27f80060 100644
--- a/usr/src/boot/sys/boot/i386/libi386/bioscd.c
+++ b/usr/src/boot/sys/boot/i386/libi386/bioscd.c
@@ -95,9 +95,9 @@ static int nbcinfo = 0;
 static int	bc_read(int unit, daddr_t dblk, int blks, caddr_t dest);
 static int	bc_init(void);
 static int	bc_strategy(void *devdata, int flag, daddr_t dblk,
-    size_t offset, size_t size, char *buf, size_t *rsize);
+    size_t size, char *buf, size_t *rsize);
 static int	bc_realstrategy(void *devdata, int flag, daddr_t dblk,
-    size_t offset, size_t size, char *buf, size_t *rsize);
+    size_t size, char *buf, size_t *rsize);
 static int	bc_open(struct open_file *f, ...);
 static int	bc_close(struct open_file *f);
 static int	bc_print(int verbose);
@@ -238,7 +238,7 @@ bc_close(struct open_file *f)
 }
 
 static int
-bc_strategy(void *devdata, int rw, daddr_t dblk, size_t offset, size_t size,
+bc_strategy(void *devdata, int rw, daddr_t dblk, size_t size,
     char *buf, size_t *rsize)
 {
 	struct bcache_devdata bcd;
@@ -249,11 +249,11 @@ bc_strategy(void *devdata, int rw, daddr_t dblk, size_t offset, size_t size,
 	bcd.dv_devdata = devdata;
 	bcd.dv_cache = BC(dev).bc_bcache;
 
-	return (bcache_strategy(&bcd, rw, dblk, offset, size, buf, rsize));
+	return (bcache_strategy(&bcd, rw, dblk, size, buf, rsize));
 }
 
 static int
-bc_realstrategy(void *devdata, int rw, daddr_t dblk, size_t offset, size_t size,
+bc_realstrategy(void *devdata, int rw, daddr_t dblk, size_t size,
     char *buf, size_t *rsize)
 {
 	struct i386_devdesc *dev;
diff --git a/usr/src/boot/sys/boot/i386/libi386/biosdisk.c b/usr/src/boot/sys/boot/i386/libi386/biosdisk.c
index eb0316e77a..d4e7a4b2d8 100644
--- a/usr/src/boot/sys/boot/i386/libi386/biosdisk.c
+++ b/usr/src/boot/sys/boot/i386/libi386/biosdisk.c
@@ -100,10 +100,10 @@ static int bd_write(struct disk_devdesc *dev, daddr_t dblk, int blks,
 static int bd_int13probe(struct bdinfo *bd);
 
 static int bd_init(void);
-static int bd_strategy(void *devdata, int flag, daddr_t dblk, size_t offset,
-    size_t size, char *buf, size_t *rsize);
-static int bd_realstrategy(void *devdata, int flag, daddr_t dblk, size_t offset,
-    size_t size, char *buf, size_t *rsize);
+static int bd_strategy(void *devdata, int flag, daddr_t dblk, size_t size,
+    char *buf, size_t *rsize);
+static int bd_realstrategy(void *devdata, int flag, daddr_t dblk, size_t size,
+    char *buf, size_t *rsize);
 static int bd_open(struct open_file *f, ...);
 static int bd_close(struct open_file *f);
 static int bd_ioctl(struct open_file *f, u_long cmd, void *data);
@@ -388,7 +388,7 @@ bd_ioctl(struct open_file *f, u_long cmd, void *data)
 }
 
 static int
-bd_strategy(void *devdata, int rw, daddr_t dblk, size_t offset, size_t size,
+bd_strategy(void *devdata, int rw, daddr_t dblk, size_t size,
     char *buf, size_t *rsize)
 {
 	struct bcache_devdata bcd;
@@ -399,12 +399,12 @@ bd_strategy(void *devdata, int rw, daddr_t dblk, size_t offset, size_t size,
 	bcd.dv_devdata = devdata;
 	bcd.dv_cache = BD(dev).bd_bcache;
 
-	return (bcache_strategy(&bcd, rw, dblk + dev->d_offset, offset, size,
+	return (bcache_strategy(&bcd, rw, dblk + dev->d_offset, size,
 	    buf, rsize));
 }
 
 static int
-bd_realstrategy(void *devdata, int rw, daddr_t dblk, size_t offset, size_t size,
+bd_realstrategy(void *devdata, int rw, daddr_t dblk, size_t size,
     char *buf, size_t *rsize)
 {
     struct disk_devdesc *dev = (struct disk_devdesc *)devdata;
diff --git a/usr/src/boot/sys/boot/i386/libi386/pxe.c b/usr/src/boot/sys/boot/i386/libi386/pxe.c
index de2e45c10a..f943ef5ec8 100644
--- a/usr/src/boot/sys/boot/i386/libi386/pxe.c
+++ b/usr/src/boot/sys/boot/i386/libi386/pxe.c
@@ -71,7 +71,7 @@ static void	bangpxe_call(int func);
 
 static int	pxe_init(void);
 static int	pxe_strategy(void *devdata, int flag, daddr_t dblk,
-    size_t offset, size_t size, char *buf, size_t *rsize);
+    size_t size, char *buf, size_t *rsize);
 static int	pxe_open(struct open_file *f, ...);
 static int	pxe_close(struct open_file *f);
 static int	pxe_print(int verbose);
@@ -246,7 +246,7 @@ pxe_init(void)
 
 
 static int
-pxe_strategy(void *devdata, int flag, daddr_t dblk, size_t offset, size_t size,
+pxe_strategy(void *devdata, int flag, daddr_t dblk, size_t size,
     char *buf, size_t *rsize)
 {
 	return (EIO);
diff --git a/usr/src/boot/sys/boot/zfs/zfs.c b/usr/src/boot/sys/boot/zfs/zfs.c
index b298618771..b9e6be06eb 100644
--- a/usr/src/boot/sys/boot/zfs/zfs.c
+++ b/usr/src/boot/sys/boot/zfs/zfs.c
@@ -593,8 +593,8 @@ zfs_dev_close(struct open_file *f)
 }
 
 static int
-zfs_dev_strategy(void *devdata, int rw, daddr_t dblk, size_t offset,
-    size_t size, char *buf, size_t *rsize)
+zfs_dev_strategy(void *devdata, int rw, daddr_t dblk, size_t size,
+    char *buf, size_t *rsize)
 {
 
 	return (ENOSYS);