Add __sync_val_compare_and_swap_{1,2} aliases for _atomic_cas_{8,16}

(matt)

OR1K support

(matt)

Changes for OR1K

(matt)

or1k support <fenv.h>

(matt)

Fix SUBDIR commit

(matt)

Add OR1K support

(matt)

Add MIDs for OR1K and RISCV

(matt)

or1k does not support --with-float

(matt)

Add or1k

(matt)

The nop instruction on or1k is l.nop

(matt)

Change to support OR1K

(matt)

OR1K configury for NetBSD

(matt)

OR1K configury support for NetBSD

(matt)

OR1K configury for NetBSD

(matt)

Merge OR1K support from OR1K GCC 4.9 git tree and extend it to support NetBSD.

(matt)

Merge in OR1K support from top of binutils-gdb GIT repository.  This replaces
the existing support and most imporantly adds support for shared libraries.

(matt)

The cond_timedwait_race test case is no longer expected to fail; it
has been consistently passing since CVS date 2014.01.31.19.22.00.
See also PR lib/44756.

(gson)

Improve POSIX compliance of FUSE filesystems through PERUSE
- access denied is EPERM and not EACCES
- access to file owned by someone else in a sticy-bit directory should
  be allowed for the sticy-bit directory owner
- setting sticky-bit on a non directory should produce EFTYPE
- implement PATHCONF method as much as we can.

(manu)

Add i2c bits for gpio to the connected GPIO pins for Exynos5

(reinoud)

wm(4): Add internal SERDES support for 82575 and newer controllers.

(msaitoh)

Now all of the internal SERDES systems are supported, so update BUGS section.

(msaitoh)

Read SFF SFP ROM and configure driver from the value.

(msaitoh)

Adapt the NAK holdoff scheme for FS/LS devices from the Raspberry Pi
Foundation driver.

Should fix PR/49019 - RPI: interrupt storm when url0 is up

(skrll)

Ticket 1338 and 1339.

(msaitoh)

Pull up following revision(s) (requested by tls in ticket #1339):
UPDATING: revision 1.209 via patch
Note shared objects extension change, and stalled files.

(msaitoh)

Pull up following revision(s) (requested by tls in ticket #1338):
share/mk/bsd.README: revision 1.265
share/mk/bsd.lib.mk: revision 1.304
Change shared object file extension from .so to .pico, to avoid
conflicts with shared libaries names libXX.so; as recently seen with
MKUPDATE=yes builds for libelf and libnvpair.
All now stalled regular .so files need to be manually removed from
object directories.

(msaitoh)

dwc2_hubd appears to be unused so #if 0 it in order to appease clang

(macallan)

capture peer version; if less than 2, bail out as bulk mode is not supported. report the peer version with "audioctl version"

(jmcneill)

expose vchi_get_peer_version

(jmcneill)

Add i2c to the exynos5 locators

(reinoud)

Add CPU descriminator _P() for Exynos 5422

(reinoud)

support ioctl() WSDISPLAYIO_SVIDEO, _GVIDEO and _GET_EDID
now xf86-video-crime can actually turn the monitor off

(macallan)

Use IPL_SCHED for dwctwo(4) - no need for the KERNEL_LOCK.

(skrll)

Dump the PLL frequencies on startup on VERBOSE_INIT_ARM

(reinoud)

Fix typos

(reinoud)

improved playback error handling, and get rid of junk+silence insertion at the beginning of playback

(jmcneill)

use a fixed frequency (48kHz) and configure the audio server at attach time, instead of at the beginning of playback

(jmcneill)

IPL_VM -> IPL_SCHED, and callout_stop -> callout_halt

(jmcneill)

IPL_VM -> IPL_SCHED

(jmcneill)

Provide real error messages.
Inspired by PR 49169 from David H. Gutteridge, but a much broader patch :-)

(dholland)

Remove redundant test for rl == NULL, that's already established
right after its allocation, and rl isn't re-assigned later.

(he)

cpu_boot_secondary_processors() needs a platform independent way to get the cpu id, so use cpu_myid() instead of sun4u specific CPU_UPAID

(palle)

Plug memory leak in add_peb_to_free() and add_peb_to_in_use()
in case there's a duplicate in the tree.

(he)

Plug memory leak in error returns and normal operation in
chfs_gcollect_pristine().

(he)

Fix a bug that wm_get_swsm_semaphore() timed out when attaching device on some
machines.
- Calculate NVM word size correctly.
- Determine timeout value based on the NVM word size.

(msaitoh)

Plug memory leaks in error returns in chfs_readvnode().

(he)

Plug memory leak in a corner case in chfs_get_data_nodes().

(he)

Plug leak in chfs_scan_eraseblock() of the allocated buffer.
Make sure to release it both on success and failure returns.
OK'ed by ttoth@

(he)

Update the cycle counter i.e. our CPU frequency for all CPUs on setting the
cpu frequency.

(reinoud)

Add tools/README, to collect hints like how to use

.if defined(HOSTPROG)

and

#if HAVE_NBTOOL_CONFIG_H
#include "nbtool_config.h"
#endif /* HAVE_NBTOOL_CONFIG_H */

(apb)

Increase the `freqbuf' buffer that holds the result of humanize_number(). Now
it prints 1600 Mhz instead of 1 Ghz.
Pitty enough humanize_number(9) doesn't do 1.6 Ghz type output.

(reinoud)

If HAVE_NBTOOL_CONFIG_H is set, then include "nbtool_config.h",
because this file is compiled as part of tools/makefs.

(apb)

Revert previous; test secs > __type_max(time_t) again, now
that __type_max is available in tools/compat/compat_defs.h.

(apb)

Copy definitions of __type_min(t), __type_max(t), and some related macros,
from <sys/cdefs.h>, for use when building tools.

(apb)

Make msdosfs time conversion use the y/m/d/h/m/s conversion functions
from clock_subr.c and compile that into the userland (and tools)
makefs as well.

(martin)

Avoid trigraphs

(matt)

Reformulate an overflow test so it can be used in tool builds (i.e. does
not depend on netbsd specific macros).

(martin)

Add a slightly stripped down version of sys/dev/clock/clock_subr.h to make
this code available for tools.

(martin)

float32_is_signalling_nan needs a prototype if SOFTFLOATM68K_FOR_GCC is
defined.

(matt)

Make random.S invisible for coldfire too (e.g. anything not "m68k")

(matt)

read and write commands for pcictl, from riastradh@ and wiz@
http://mail-index.netbsd.org/tech-kern/2014/08/26/msg017572.html

(manu)

The t_ldp_regen test frequently fails under qemu, but reliably passes
on real hardware.  The failures are hardly surprising given that qemu
timing is off by a is off by a factor of two as reported in
PR kern/43997.  Disabling the test on qemu for now; it should be
re-enabled once 43997 has been fixed to see if it still fails then.

(gson)

Regen.

(msaitoh)

Add Samsung Electronics XP941 M.2 SSD

(msaitoh)

Remove (now duplicated) target computation.

(joerg)

These have been moved to evbarm/awin or conf/*.awin

(matt)

Move away from cubie to awin since "cubie" will actually work on non-cubie
boards.  Let the config file specify what board is being built for.

(matt)

sun4v: Split the NORMAL_GLOBALS and ALTERNATE_GLOBALS macros to _SUN4U and _SUN4V variants. Rework the return_from_trap logic to use the new variants so it is possible to use a global register as scratch register.

(palle)

Tickets 58, 73.

(riz)

Pull up following revision(s) (requested by christos in ticket #73):
usr.bin/cksum/cksum.1: revision 1.46
usr.bin/cksum/cksum.1: revision 1.47
usr.bin/cksum/cksum.c: revision 1.47
PR/49134: Kamil Rytarowski: Add -q flag.
New sentence, new line.

(riz)

Pull up following revision(s) (requested by martin in ticket #58):
sys/dev/usb/umcs.c: revision 1.8
Fix a few logical vs. physical port number confusions to make this
driver work with two port variants.

(riz)

Sort options.

(wiz)

add -N option to print the driver name as returned by pci_drvname(3).

(mrg)

Make this compile- and usable from userland as well.

(martin)

Ticket 72

(martin)

Pull up following revision(s) (requested by jmcneill in ticket #72):
gnu/dist/texinfo/config.guess: revision 1.3
external/gpl3/gcc/dist/gcc/config.host: revision 1.3
Support building on cygwin64.

(martin)

New sentence, new line.

(wiz)

PR/49134: Kamil Rytarowski: Add -q flag.

(christos)

Updated import script for tzdata2014g.
Aso added "cd" commands that were missed in the recent move from
src/share/zoneinfo to external/public-domain/tz.

(apb)

zoneinfo: Import tzdata2014g. [apb 20140831]

(apb)

tzcode2014g/tzdata2014g have been released.  We have updated tzdata.

(apb)

Replace use of $() with ${}
$() means something special to the shell, so ${} reduces confusion
and is used almost exclusively in the rest of the makefiles.

Discussed with: christos

(sjg)

cygwin64 support

(jmcneill)

Ticket 71

(martin)

Pull up following revision(s) (requested by manu in ticket #71):
lib/libperfuse/ops.c: revision 1.70
We used to remove the trailing zeros in FUSE readlink replies, but
it seems it does not always happen. Just remove them if present.

(martin)

recognize cygwin64

(jmcneill)

Pad L4 WAKEUP to 1M, like omap2_reg.h.

(kiyohara)

clock_secs_to_ymdhms(9) takes seconds as a time_t, not int.

(martin)

Revert stupid and untested changes. There was no extra copy in the macros.

Christos, you should reread our commit guideline as a Core member.

(tsutsui)

Tickets 68 - 70

(martin)

Pull up following revision(s) (requested by christos in ticket #70):
external/gpl3/gdb/dist/gdb/sparc-nat.c: revision 1.7
Cleanup the confusion with getting the pid of a sparc debugged process.
If the comments were correct, then this should be factored out to the
OS-specific native code, and the general code should remain sane.

(martin)

Pull up following revision(s) (requested by manu in ticket #69):
sys/kern/subr_tftproot.c: revision 1.13
Fix build with TFTPROOT option enabled

(martin)

Pull up following revision(s) (requested by manu in ticket #68):
usr.bin/flock/flock.c: revision 1.9 - 1.11
usr.bin/flock/flock.1: revision 1.10
Annotate functions using format strings.
Improve Linux compatibility, by making exclusive lock the default.
Also check for file descriptor value being sane.

(martin)

Move options __HAVE_MM_MD_DIRECT_MAPPED_PHYS from MIRABOX to ARMADAXP.
It is must required.

(kiyohara)

Add options __HAVE_MM_MD_DIRECT_MAPPED_PHYS and set KERNEL_BASE_{EXT,VIRT}.
And support VFP.

(kiyohara)

Fix initialize PJ4B.

(kiyohara)

Fix broken registers.

(kiyohara)

Support __HAVE_MM_MD_DIRECT_MAPPED_PHYS.

(kiyohara)

Use armreg_ttbr_read() instead of __asm("mrc ...").

(kiyohara)

remove extra copy of the macro.

(christos)

It expects return value 'va != NULL' from uvm_km_alloc().

(kiyohara)

Rename padding macros to reflect and clarify the original intention.

No binary changes on luna68k (which has -DLIBSA_PRINTF_WIDTH_SUPPORT).

(tsutsui)

On systems that have only 32M of memory, the stress_short and
stress_long tests thrash a lot, and the stress_long test sometimes
times out, so skip them if we don't have at least 64M.

(gson)

When converting a disklabel partition type integer to a wedge partition
type string, use the strings defined in DKW_PTYPE_* in <sys/disk.h>, not
the strings defined in FSTYPE_DEFN in <sys/disklabel.h>.

This corrects a problem introduced in revision 1.21 dated 2014-08-18.
That change was intended to add additional case to the list, but it
accidentally also changed from the strings in the DKW_PTYPE_* macros to
the strings in the FSTYPE_DEFN macro.  Many of the strings are the same,
but there are differences such as "RAID" versus "raidframe" and "MSDOS"
versus "FAT".

XXX: There seems to be no good reason for the differences in string
names for partition types.  One or both of the lists should probably be
edited to align them.

(apb)

Ensure each symbol used in FSTYPE_DEFN in <sys/disklabel.h>
has a corresponding DKW_PTYPE_* definition, by adding some aliases.

XXX: Compatibility between the symbols in FSTYPE_DEFN and the symbols
in DKW_PTYPE_* could be addressed by renaming some of them, instead of
by adding aliases here, but that's a job for the future.

(apb)

Cleanup the confusion with getting the pid of a sparc debugged process.
If the comments were correct, then this should be factored out to the
OS-specific native code, and the general code should remain sane.

(christos)

*.rawout are out-of-date if ${TEST_MAKE} is newer.

(sjg)

Don't pass an uninitialized variable as the times[] argument of
rump_sys_utimes().  Instead, pass combinations of values representing
edge cases: the farthest possible past, the epoch, and the farthest
possible future.  Now the excessive runtime reported in PR bin/49144
occurs reliably, on multiple architectures, and not only with udf, but
also with msdosfs.

(gson)

posix1.mk and suffixes.mk need to cleanup in order to achieve
repeatable results.
posix1.mk's lib.a target still looks dubious.

(sjg)

Don't forget to lock wq_lock around handling wq_delayed.

(riastradh)

No binary change:
- Move some NVM related macros fromk if_wm.c to if_wmreg.h.
- Rename some macros for consistency.

(msaitoh)

Tickets 55, 56, 58, 59 - 67

(martin)

Pull up following revision(s) (requested by hannken in ticket #67):
sys/fs/puffs/puffs_sys.h: revision 1.86
sys/fs/puffs/puffs_vfsops.c: revision 1.114
sys/fs/puffs/puffs_msgif.c: revision 1.95
sys/fs/puffs/puffs_node.c: revision 1.32
sys/fs/puffs/puffs_vnops.c: revision 1.184
Change puffs from hashlist to vcache.
- field "pa_nhashbuckets" of struct "puffs_kargs" becomes a no-op.
and should be removed on the next protocol version bump.

(martin)

Pull up following revision(s) (requested by mrg in ticket #66):
sys/external/bsd/drm2/dist/drm/radeon/atombios_dp.c: revision 1.3
hack around an evergreen attach crash for now: provide a hard coded
name for the i2c.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #65):
sys/dev/dkwedge/dk.c: revision 1.73
Make dk(4) discard from partition start, not from disk start.
Otherwise, anything mounted with `-o discard' will pretty quickly
munch itself up and barf up an unrecoverably corrupted file system!
XXX pullup to netbsd-7

(martin)

Pull up following revision(s) (requested by joerg in ticket #64):
usr.bin/ldd/elf64/Makefile: revision 1.8
Fix ldd on LP64 platforms by splitting the symbol versioning stuff for
elf64 as well.

(martin)

Pull up following revision(s) (requested by bouyer in ticket #63):
tests/lib/libpthread/t_swapcontext.c: revision 1.2
Go back to the initial context (as tests/lib/libc/sys/t_swapcontext.c does)
after checking pthread_self() didn't change. Otherwise the process exits
outside of atf context.
Should fix "Test case exited normally but failed to create the results file: Results file is empty" reports from atf-run.

(martin)

Pull up following revision(s) (requested by tsutsui in ticket #62):
sys/arch/hp300/conf/files.hp300: revision 1.89
share/man/man4/arcofi.4: revision 1.1
share/man/man4/arcofi.4: revision 1.2
share/man/man4/Makefile: revision 1.617
sys/arch/hp300/hp300/intr.c: revision 1.41
sys/conf/files: revision 1.1100
sys/arch/hp300/hp300/locore.s: revision 1.171
distrib/sets/lists/man/mi: revision 1.1486
sys/dev/ic/arcofivar.h: revision 1.1
sys/arch/hp300/conf/majors.hp300: revision 1.26
sys/arch/hp300/dev/arcofi_dio.c: revision 1.1
sys/arch/hp300/conf/GENERIC: revision 1.188
sys/dev/ic/arcofi.c: revision 1.1
Add new arcofi(4) audio driver for NetBSD/hp300, ported from OpenBSD.
The arcofi(4) is a driver for the HP "Audio1" device
(Siemens PSB 2160 "ARCOFI" phone quality audio chip)
found on the HP9000/425e and HP9000/{705,710,745,747} models
(but only hp300 attachment is ported for now).
The chip supports 8-bit mono 8kHz U-law, A-law and
16-bit mono slinear_be formats.
The old HP9000/425e playing tunes with this new arcofi(4) audio driver
was also demonstrated at Open Source Conference 2014 Shimane.
Add a man page for arcofi(4) driver.  From OpenBSD.
Fix date.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #61):
sys/dev/pci/if_wm.c: revision 1.290
sys/dev/pci/if_wmvar.h: revision 1.20
Set the WM_F_ATTACHED flag if wm_attach() finished succesfully and check
the flag in wm_detach(). It will avoid to panic in wm_detach().
Fixes PR#49102.

(martin)

Pull up following revision(s) (requested by mrg in ticket #60):
external/mit/xorg/server/drivers/xf86-video-openchrome/Makefile: revision 1.6
fix the sources list to match the upstream Makefile.am.
fixes problems reported by jdbaker.
XXX: pullup-7.

(martin)

Pull up following revision(s) (requested by riastradh):
common/lib/libc/gen/rb.c: revision 1.12
common/lib/libc/gen/rb.c: revision 1.13
Fix failure case in rb_tree_find_node_leq/geq.
Return NULL, not `NULL - offset'.
XXX pullup to netbsd-5, netbsd-6, netbsd-7
Remove enclosing parens on return.

(martin)

Pull up following revision(s) (requested by skrll in ticket #57):
sys/arch/arm/allwinner/awin_reg.h: revision 1.15
sys/arch/arm/allwinner/awin_mmc.c: revision 1.4
Correct the mmc clock.  Banana Pi can now find an SD card.

(martin)

Pull up following revision(s) (requested by rmind in ticket #56):
sys/net/npf/npf_ctl.c: revision 1.39
usr.sbin/npf/npfctl/npfctl.c: revision 1.43
lib/libnpf/npf.c: revision 1.33
lib/libnpf/npf.c: revision 1.34
sys/net/npf/npf_impl.h: revision 1.59
sys/net/npf/npf_ctl.c: revision 1.40
sys/net/npf/npf_conn.c: revision 1.11
sys/net/npf/npf_alg.c: revision 1.15
sys/net/npf/npf_conn.c: revision 1.12
sys/net/npf/npf_nat.c: revision 1.33
sys/net/npf/npf_nat.c: revision 1.34
Add and use npf_alg_export().
npf_conn_import: handle NAT metadata correctly.
npf_nat_newpolicy: restore the policy ID.
npfctl_load: fix error code handling for the limit cases.
npf_config_import: fix the inverted logic.
npfctl_load: improve error handling.
npf_conn_import: add a missing stat counter increment.
npf_nat_import: add a missing reference and make a comment.
npf_config_submit: finally, include the saved connections.

(martin)

Pull up following revision(s) (requested by christos in ticket #55):
sys/dev/dm/dm_target_stripe.c: revision 1.20-1.21
Avoid a memory leak - from maxv.
Cleanup properly on error.

(martin)

remove unused assignment

(christos)

undo eating the trailing backslash now that the shell has been fixed.

(christos)

Eat trailing backslash like bash and pdksh (not zsh). CBACK+CEOF = TEOF

(christos)

Instead of printing cubie, use the BOARDTYPE instead.  This allows other
boards to use the cubie code but see a more useful BOARDTYPE.  We could
also use it to enable more apporpriate configuration for the board.

(matt)

We used to remove the trailing zeros in FUSE readlink replies, but
it seems it does not always happen. Just remove them if present.

(manu)

hack around an evergreen attach crash for now: provide a hard coded
name for the i2c.

(mrg)

tyop police

(snj)

Enter/leave flag is -w not -dw

(sjg)

Make dk(4) discard from partition start, not from disk start.

Otherwise, anything mounted with `-o discard' will pretty quickly
munch itself up and barf up an unrecoverably corrupted file system!

XXX pullup to netbsd-7

(riastradh)

Implement CPU speed control for Exynos4 and Exynos5 CPUs using APLL frequency
adjustment.

(reinoud)

Add comments to Exynos4 PLL registers and add Exynos5 PLL registers

(reinoud)

Add Internal SERDES mode support newer than or equal to 82575.
Currently, it supports fiber device only. If you use 1000BaseT SFP module,
it won't work. We have to write code to read SFP ROM and set SGMII mode
if the module is copper.

(msaitoh)

don't leave trailing backlashes on commands, just like gmake does. What does
POSIX have to say?

(christos)

Make Linux io_mapping actually work.

Can't use bus_space_map/bus_space_unmap in interrupt context, where
Linux uses this io_mapping abstraction.  Instead, do uvm_km_alloc up
front and then use bus_space_mmap/pmap_kenter_pa to map it.

XXX Should bus_space_reserve the region (but that's x86-only for now).
XXX Should use direct map if possible.
XXX Should set an MTRR WC too in case of direct map or no PAT.

(riastradh)

Fix ldd on LP64 platforms by splitting the symbol versioning stuff for
elf64 as well.

(joerg)

Substract just one each time instead of the periods missed. This will create a
more even representation of missed interrupts.

Also fix typo

(reinoud)

Add PLL registers and PLL conversion macros

(reinoud)

Add CMU PLL offsets

(reinoud)

Move the mct's interrupt from a shared SPI interrupt to a private PPI
interrupt so all possible cpus get them.

(reinoud)

Change puffs from hashlist to vcache.
- field "pa_nhashbuckets" of struct "puffs_kargs" becomes a no-op.
  and should be removed on the next protocol version bump.

(hannken)

pull in opt_arm_debug.h for VERBOSE_INIT_ARM

(skrll)

Lock irq_lock around i915_error_wake_up in i915_error_work_func.

(riastradh)

Use device_lookup() to locate device instances

(palle)

Pull up following revision(s) (requested by maxv in ticket #1920):
sys/netinet6/ip6_output.c 1.158 via patch

Fix a memory leak in calling setsockopt() on an INET6 socket.

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1920):
sys/netinet6/ip6_output.c 1.158 via patch

Fix a memory leak in calling setsockopt() on an INET6 socket.

(msaitoh)

Use direct map if available in linux_kmap.

Yields 20% increase in glxgears framerate.

(riastradh)

Tweak style.

No functional change intended.  Assembly differences appear to be
only related to kassert line numbers.

(riastradh)

__diagused, not __unused.

(riastradh)

Assert sleepable in Linux kmap/kunmap.

(riastradh)

Simplify empty test for linux_kmap_entries.

(riastradh)

Convert linux_kmap_lock to an adaptive lock.

kmap/kunmap can't be used in interrupt context anyway, so there is no
need for this to be a spin lock.

(riastradh)

Fix two mistakes in previous.

- i915_error_wake_up is given irq_lock, so it need not take that.
- Unlock irq_lock on exit from i915_hangcheck_elapsed if ring_hung.

XXX This introduces the lock order irq_lock -> pending_flip_lock.
How about just using irq_lock for pending flips?

(riastradh)

Ticket 54.

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #54):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes > 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@

(msaitoh)

Ticket 1114-1115 and 1141.

(msaitoh)

Ticket 1114-1115 and 1141.

(msaitoh)

Ticket 1113, 1114, 1115 and 1141.

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1141):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes > 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1141):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes > 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1141):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes > 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args->version >= PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
  means that zero is returned, and the kernel keeps mounting (and it
  probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
  check to ensure they are greater than zero. Since they are used to
  compute the size of two copyin's, a user can control the copied size
  by giving a negative value (like 128-2^29), and thus overwrite kernel
  memory.
Both triggerable from root only.

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args->version >= PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
  means that zero is returned, and the kernel keeps mounting (and it
  probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
  check to ensure they are greater than zero. Since they are used to
  compute the size of two copyin's, a user can control the copied size
  by giving a negative value (like 128-2^29), and thus overwrite kernel
  memory.
Both triggerable from root only.

(msaitoh)

Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args->version >= PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
  means that zero is returned, and the kernel keeps mounting (and it
  probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
  check to ensure they are greater than zero. Since they are used to
  compute the size of two copyin's, a user can control the copied size
  by giving a negative value (like 128-2^29), and thus overwrite kernel
  memory.
Both triggerable from root only.

(msaitoh)