From 168b6c715bcfc5c0e81b2b0be0980bceb87e9d50 Mon Sep 17 00:00:00 2001
From: riastradh <riastradh@NetBSD.org>
Date: Tue, 12 Apr 2016 15:12:12 +0000
Subject: [PATCH] Use only the low 32 bits of the bar object's vma offset as
 intended.

Should fix PR kern/50372, seen by everyone trying to use nouveau on
amd64 with hardware that uses nv50-style BARs and not nvc0-style
BARs.
---
 .../core/subdev/bar/nouveau_subdev_bar_base.c  | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c b/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c
index e1d6bcceb748..773e7c97fcd5 100644
--- a/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c
+++ b/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nouveau_subdev_bar_base.c,v 1.4 2016/02/14 03:06:06 riastradh Exp $	*/
+/*	$NetBSD: nouveau_subdev_bar_base.c,v 1.5 2016/04/12 15:12:12 riastradh Exp $	*/
 
 /*
  * Copyright 2012 Red Hat Inc.
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nouveau_subdev_bar_base.c,v 1.4 2016/02/14 03:06:06 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nouveau_subdev_bar_base.c,v 1.5 2016/04/12 15:12:12 riastradh Exp $");
 
 #include <core/object.h>
 
@@ -65,13 +65,21 @@ nouveau_barobj_ctor(struct nouveau_object *parent,
 		return ret;
 
 #ifdef __NetBSD__
+    {
+	/* Yes, truncation is really intended here.  */
+	uint32_t offset = barobj->vma.offset & 0xffffffffUL;
+
+	KASSERTMSG(offset < bar->iomemsz,
+	    "bar object vma exceeds range: %"PRIx32" > %"PRIxMAX,
+	    offset, (uintmax_t)bar->iomemsz);
+
 	barobj->iomemt = bar->iomemt;
 	/* XXX errno NetBSD->Linux */
-	ret = -bus_space_subregion(bar->iomemt, bar->iomemh,
-	    barobj->vma.offset, bar->iomemsz - barobj->vma.offset,
-	    &barobj->iomemh);
+	ret = -bus_space_subregion(bar->iomemt, bar->iomemh, offset,
+	    bar->iomemsz - offset, &barobj->iomemh);
 	if (ret)
 		return ret;
+    }
 #else
 	barobj->iomem = bar->iomem + (u32)barobj->vma.offset;
 #endif