Index: sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h,v
retrieving revision 1.2
diff -p -u -r1.2 subdev.h
--- sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h	6 Aug 2014 13:35:13 -0000	1.2
+++ sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h	16 Apr 2016 19:00:08 -0000
@@ -67,6 +67,9 @@ nv_rd08(void *obj, u32 addr)
 {
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 #ifdef __NetBSD__
+	KASSERTMSG(addr < subdev->mmiosz,
+	    "out of range addr 0x%"PRIx32" mmiosz %"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	u8 data = bus_space_read_stream_1(subdev->mmiot, subdev->mmioh, addr);
 #else
 	u8 data = ioread8(subdev->mmio + addr);
@@ -80,6 +83,9 @@ nv_rd16(void *obj, u32 addr)
 {
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 #ifdef __NetBSD__
+	KASSERTMSG(addr < subdev->mmiosz - 1,
+	    "out of range addr 0x%"PRIx32" mmiosz %"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	u16 data = bus_space_read_stream_2(subdev->mmiot, subdev->mmioh, addr);
 #else
 	u16 data = ioread16_native(subdev->mmio + addr);
@@ -93,6 +99,9 @@ nv_rd32(void *obj, u32 addr)
 {
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 #ifdef __NetBSD__
+	KASSERTMSG(addr < subdev->mmiosz - 3,
+	    "out of range addr 0x%"PRIx32" mmiosz %"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	u32 data = bus_space_read_stream_4(subdev->mmiot, subdev->mmioh, addr);
 #else
 	u32 data = ioread32_native(subdev->mmio + addr);
@@ -107,6 +116,9 @@ nv_wr08(void *obj, u32 addr, u8 data)
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 	nv_spam(subdev, "nv_wr08 0x%06x 0x%02x\n", addr, data);
 #ifdef __NetBSD__
+	KASSERTMSG(addr < subdev->mmiosz,
+	    "out of range addr 0x%"PRIx32" mmiosz %"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	bus_space_write_stream_1(subdev->mmiot, subdev->mmioh, addr, data);
 #else
 	iowrite8(data, subdev->mmio + addr);
@@ -119,6 +131,9 @@ nv_wr16(void *obj, u32 addr, u16 data)
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 	nv_spam(subdev, "nv_wr16 0x%06x 0x%04x\n", addr, data);
 #ifdef __NetBSD__
+	KASSERTMSG(addr < subdev->mmiosz - 1,
+	    "out of range addr 0x%"PRIx32" mmiosz %"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	bus_space_write_stream_2(subdev->mmiot, subdev->mmioh, addr, data);
 #else
 	iowrite16_native(data, subdev->mmio + addr);
@@ -131,6 +146,9 @@ nv_wr32(void *obj, u32 addr, u32 data)
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 	nv_spam(subdev, "nv_wr32 0x%06x 0x%08x\n", addr, data);
 #ifdef __NetBSD__
+	KASSERTMSG(addr < subdev->mmiosz - 3,
+	    "out of range addr 0x%"PRIx32" mmiosz %"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	bus_space_write_stream_4(subdev->mmiot, subdev->mmioh, addr, data);
 #else
 	iowrite32_native(data, subdev->mmio + addr);