12 files changed, 62 insertions, 27 deletions
diff --git a/sys/dev/aac/aac.c b/sys/dev/aac/aac.c
index 1e53ac3..69e6ec5 100644
--- a/sys/dev/aac/aac.c
+++ b/sys/dev/aac/aac.c
@@ -3103,18 +3103,30 @@ aac_ioctl_send_raw_srb(struct aac_softc *sc, caddr_t arg)
 	/* Retrieve correct SG entries. */
 	if (fibsize == (sizeof(struct aac_srb) +
 	    srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry))) {
+		struct aac_sg_entry sg;
+
 		sge = srbcmd->sg_map.SgEntry;
 		sge64 = NULL;
-		srb_sg_bytecount = sge->SgByteCount;
-		srb_sg_address = (void *)(uintptr_t)sge->SgAddress;
+
+		if ((error = copyin(sge, &sg, sizeof(sg))) != 0)
+			goto out;
+
+		srb_sg_bytecount = sg.SgByteCount;
+		srb_sg_address = (void *)(uintptr_t)sg.SgAddress;
 	}
 #ifdef __amd64__
 	else if (fibsize == (sizeof(struct aac_srb) +
 	    srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry64))) {
+		struct aac_sg_entry64 sg;
+
 		sge = NULL;
 		sge64 = (struct aac_sg_entry64 *)srbcmd->sg_map.SgEntry;
-		srb_sg_bytecount = sge64->SgByteCount;
-		srb_sg_address = (void *)sge64->SgAddress;
+
+		if ((error = copyin(sge64, &sg, sizeof(sg))) != 0)
+			goto out;
+
+		srb_sg_bytecount = sg.SgByteCount;
+		srb_sg_address = (void *)sg.SgAddress;
 		if (sge64->SgAddress > 0xffffffffull &&
 		    (sc->flags & AAC_FLAGS_SG_64BIT) == 0) {
 			error = EINVAL;
diff --git a/sys/dev/aacraid/aacraid.c b/sys/dev/aacraid/aacraid.c
index 7c300a6..b0ab8a1 100644
--- a/sys/dev/aacraid/aacraid.c
+++ b/sys/dev/aacraid/aacraid.c
@@ -2873,15 +2873,25 @@ aac_ioctl_send_raw_srb(struct aac_softc *sc, caddr_t arg)
 	if (fibsize == (sizeof(struct aac_srb) + 
 		srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry))) {
 		struct aac_sg_entry *sgp = srbcmd->sg_map.SgEntry;
-		srb_sg_bytecount = sgp->SgByteCount;
-		srb_sg_address = (u_int64_t)sgp->SgAddress;
+		struct aac_sg_entry sg;
+
+		if ((error = copyin(sgp, &sg, sizeof(sg))) != 0)
+			goto out;
+
+		srb_sg_bytecount = sg.SgByteCount;
+		srb_sg_address = (u_int64_t)sg.SgAddress;
 	} else if (fibsize == (sizeof(struct aac_srb) + 
 		srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry64))) {
 #ifdef __LP64__
 		struct aac_sg_entry64 *sgp = 
 			(struct aac_sg_entry64 *)srbcmd->sg_map.SgEntry;
-		srb_sg_bytecount = sgp->SgByteCount;
-		srb_sg_address = sgp->SgAddress;
+		struct aac_sg_entry64 sg;
+
+		if ((error = copyin(sgp, &sg, sizeof(sg))) != 0)
+			goto out;
+
+		srb_sg_bytecount = sg.SgByteCount;
+		srb_sg_address = sg.SgAddress;
 		if (srb_sg_address > 0xffffffffull && 
 			!(sc->flags & AAC_FLAGS_SG_64BIT))
 #endif	
diff --git a/sys/dev/e1000/if_em.c b/sys/dev/e1000/if_em.c
index b77d0e9..a81cf58 100644
--- a/sys/dev/e1000/if_em.c
+++ b/sys/dev/e1000/if_em.c
@@ -2099,7 +2099,7 @@ retry:
 		txr->tx_tso = FALSE;
 	}
 
-        if (nsegs > (txr->tx_avail - EM_MAX_SCATTER)) {
+        if (txr->tx_avail < (nsegs + EM_MAX_SCATTER)) {
                 txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);
diff --git a/sys/dev/e1000/if_igb.c b/sys/dev/e1000/if_igb.c
index 4945950..ab445f6 100644
--- a/sys/dev/e1000/if_igb.c
+++ b/sys/dev/e1000/if_igb.c
@@ -1829,7 +1829,7 @@ retry:
 	}
 
 	/* Make certain there are enough descriptors */
-	if (nsegs > txr->tx_avail - 2) {
+	if (txr->tx_avail < (nsegs + 2)) {
 		txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);
diff --git a/sys/dev/e1000/if_lem.c b/sys/dev/e1000/if_lem.c
index 9d3be4c..b8310a1 100644
--- a/sys/dev/e1000/if_lem.c
+++ b/sys/dev/e1000/if_lem.c
@@ -1694,7 +1694,7 @@ lem_xmit(struct adapter *adapter, struct mbuf **m_headp)
 		return (error);
 	}
 
-        if (nsegs > (adapter->num_tx_desc_avail - 2)) {
+        if (adapter->num_tx_desc_avail < (nsegs + 2)) {
                 adapter->no_tx_desc_avail2++;
 		bus_dmamap_unload(adapter->txtag, map);
 		return (ENOBUFS);
diff --git a/sys/dev/firewire/fwdev.c b/sys/dev/firewire/fwdev.c
index d26810d..442eb9c 100644
--- a/sys/dev/firewire/fwdev.c
+++ b/sys/dev/firewire/fwdev.c
@@ -98,7 +98,6 @@ struct cdevsw firewire_cdevsw = {
 	.d_mmap =	fw_mmap,
 	.d_strategy =	fw_strategy,
 	.d_name =	"fw",
-	.d_flags =	D_MEM
 #else
 #define CDEV_MAJOR 127
 	fw_open, fw_close, fw_read, fw_write, fw_ioctl,
diff --git a/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c b/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c
index 7582aec..0159a9d 100644
--- a/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c
+++ b/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c
@@ -1273,6 +1273,7 @@ storvsc_timeout_test(struct hv_storvsc_request *reqp,
 }
 #endif /* HVS_TIMEOUT_TEST */
 
+#ifdef notyet
 /**
  * @brief timeout handler for requests
  *
@@ -1320,6 +1321,7 @@ storvsc_timeout(void *arg)
 	storvsc_timeout_test(reqp, MODE_SELECT_10, 1);
 #endif
 }
+#endif
 
 /**
  * @brief StorVSC device poll function
@@ -1472,6 +1474,7 @@ storvsc_action(struct cam_sim *sim, union ccb *ccb)
 			return;
 		}
 
+#ifdef notyet
 		if (ccb->ccb_h.timeout != CAM_TIME_INFINITY) {
 			callout_init(&reqp->callout, CALLOUT_MPSAFE);
 			callout_reset_sbt(&reqp->callout,
@@ -1491,6 +1494,7 @@ storvsc_action(struct cam_sim *sim, union ccb *ccb)
 			}
 #endif /* HVS_TIMEOUT_TEST */
 		}
+#endif
 
 		if ((res = hv_storvsc_io_request(sc->hs_dev, reqp)) != 0) {
 			xpt_print(ccb->ccb_h.path,
@@ -2039,6 +2043,7 @@ storvsc_io_done(struct hv_storvsc_request *reqp)
 		mtx_unlock(&sc->hs_lock);
 	}
 
+#ifdef notyet
 	/*
 	 * callout_drain() will wait for the timer handler to finish
 	 * if it is running. So we don't need any lock to synchronize
@@ -2049,6 +2054,7 @@ storvsc_io_done(struct hv_storvsc_request *reqp)
 	if (ccb->ccb_h.timeout != CAM_TIME_INFINITY) {
 		callout_drain(&reqp->callout);
 	}
+#endif
 
 	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
 	ccb->ccb_h.status &= ~CAM_STATUS_MASK;
diff --git a/sys/dev/ixgbe/ix_txrx.c b/sys/dev/ixgbe/ix_txrx.c
index 8c311c1..70c7701 100644
--- a/sys/dev/ixgbe/ix_txrx.c
+++ b/sys/dev/ixgbe/ix_txrx.c
@@ -404,7 +404,7 @@ retry:
 	}
 
 	/* Make certain there are enough descriptors */
-	if (nsegs > txr->tx_avail - 2) {
+	if (txr->tx_avail < (nsegs + 2)) {
 		txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);
diff --git a/sys/dev/mlx5/driver.h b/sys/dev/mlx5/driver.h
index 83793d5..8136e57 100644
--- a/sys/dev/mlx5/driver.h
+++ b/sys/dev/mlx5/driver.h
@@ -542,6 +542,7 @@ struct mlx5_core_dev {
 	atomic_t		num_qps;
 	u32			issi;
 	struct mlx5_special_contexts special_contexts;
+	unsigned int module_status[MLX5_MAX_PORTS];
 };
 
 enum {
@@ -835,6 +836,7 @@ int mlx5_set_port_mtu(struct mlx5_core_dev *dev, int mtu);
 int mlx5_query_port_max_mtu(struct mlx5_core_dev *dev, int *max_mtu);
 int mlx5_query_port_oper_mtu(struct mlx5_core_dev *dev, int *oper_mtu);
 
+unsigned int mlx5_query_module_status(struct mlx5_core_dev *dev, int module_num);
 int mlx5_query_module_num(struct mlx5_core_dev *dev, int *module_num);
 int mlx5_query_eeprom(struct mlx5_core_dev *dev, int i2c_addr, int page_num,
 		      int device_addr, int size, int module_num, u32 *data,
diff --git a/sys/dev/mlx5/mlx5_core/mlx5_eq.c b/sys/dev/mlx5/mlx5_core/mlx5_eq.c
index 0cbfc31..e314bb9 100644
--- a/sys/dev/mlx5/mlx5_core/mlx5_eq.c
+++ b/sys/dev/mlx5/mlx5_core/mlx5_eq.c
@@ -581,6 +581,13 @@ static const char *mlx5_port_module_event_error_type_to_string(u8 error_type)
 	}
 }
 
+unsigned int mlx5_query_module_status(struct mlx5_core_dev *dev, int module_num)
+{
+	if (module_num < 0 || module_num >= MLX5_MAX_PORTS)
+		return 0;		/* undefined */
+	return dev->module_status[module_num];
+}
+
 static void mlx5_port_module_event(struct mlx5_core_dev *dev,
 				   struct mlx5_eqe *eqe)
 {
@@ -614,5 +621,8 @@ static void mlx5_port_module_event(struct mlx5_core_dev *dev,
 	default:
 		device_printf((&pdev->dev)->bsddev, "INFO: ""Module %u, unknown status", module_num);
 	}
+	/* store module status */
+	if (module_num < MLX5_MAX_PORTS)
+		dev->module_status[module_num] = module_status;
 }
 
diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
index 3676910..a76d32e 100644
--- a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
+++ b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
@@ -2559,9 +2559,15 @@ out:
 		if (error) {
 			if_printf(ifp, "Query module num failed, eeprom "
 			    "reading is not supported\n");
+			error = EINVAL;
+			goto err_i2c;
+		}
+		/* Check if module is present before doing an access */
+		if (mlx5_query_module_status(priv->mdev, module_num) !=
+		    MLX5_MODULE_STATUS_PLUGGED) {
+			error = EINVAL;
 			goto err_i2c;
 		}
-
 		/*
 		 * Currently 0XA0 and 0xA2 are the only addresses permitted.
 		 * The internal conversion is as follows:
@@ -2583,6 +2589,7 @@ out:
 		if (error) {
 			if_printf(ifp, "Query eeprom failed, eeprom "
 			    "reading is not supported\n");
+			error = EINVAL;
 			goto err_i2c;
 		}
 
@@ -2596,6 +2603,7 @@ out:
 		if (error) {
 			if_printf(ifp, "Query eeprom failed, eeprom "
 			    "reading is not supported\n");
+			error = EINVAL;
 			goto err_i2c;
 		}
 
diff --git a/sys/dev/streams/streams.c b/sys/dev/streams/streams.c
index 3ddbcc7..7b4dcb9 100644
--- a/sys/dev/streams/streams.c
+++ b/sys/dev/streams/streams.c
@@ -176,6 +176,7 @@ static moduledata_t streams_mod = {
 };
 DECLARE_MODULE(streams, streams_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);
 MODULE_VERSION(streams, 1);
+MODULE_DEPEND(streams, svr4elf, 1, 1, 1);
 
 /*
  * We only need open() and close() routines.  open() calls socreate()
@@ -329,19 +330,6 @@ svr4_ptm_alloc(td)
 }
 
 
-struct svr4_strm *
-svr4_stream_get(fp)
-	struct file *fp;
-{
-	struct socket *so;
-
-	if (fp == NULL || fp->f_type != DTYPE_SOCKET)
-		return NULL;
-
-	so = fp->f_data;
-	return so->so_emuldata;
-}
-
 static int
 svr4_soo_close(struct file *fp, struct thread *td)
 {