 @@ -1,14 +1,14 @@
-/*      $NetBSD: xenevt.c,v 1.29.4.2 2009/09/30 00:08:03 snj Exp $      */
+/*      $NetBSD: xenevt.c,v 1.29.4.2.6.1 2015/05/22 11:44:25 sborrill Exp $      */
 /*
  * Copyright (c) 2005 Manuel Bouyer.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. All advertising materials mentioning features or use of this software
 @@ -21,27 +21,27 @@
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xenevt.c,v 1.29.4.2 2009/09/30 00:08:03 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xenevt.c,v 1.29.4.2.6.1 2015/05/22 11:44:25 sborrill Exp $");
 #include "opt_xen.h"
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
 #include <sys/systm.h>
 #include <sys/device.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
 #include <sys/poll.h>
 #include <sys/select.h>
 #include <sys/proc.h>
 #include <sys/conf.h>
 @@ -486,27 +486,27 @@ done:
+}
 static int
 xenevt_fwrite(struct file *fp, off_t *offp, struct uio *uio,
     kauth_cred_t cred, int flags)
+{
 	struct xenevt_d *d = fp->f_data;
 	uint16_t *chans;
 	int i, nentries, error;
 	if (uio->uio_resid == 0)
 		return (0);
 	nentries = uio->uio_resid / sizeof(uint16_t);
-	if (nentries > NR_EVENT_CHANNELS)
+	if (nentries >= NR_EVENT_CHANNELS)
 		return EMSGSIZE;
 	chans = kmem_alloc(nentries * sizeof(uint16_t), KM_SLEEP);
 	if (chans == NULL)
 		return ENOMEM;
 	error = uiomove(chans, uio->uio_resid, uio);
 	if (error)
 		goto out;
 	for (i = 0; i < nentries; i++) {
 		if (chans[i] < NR_EVENT_CHANNELS &&
 		    devevent[chans[i]] == d) {
 			hypervisor_unmask_event(chans[i]);
+		}
+	}
 @@ -570,43 +570,43 @@ xenevt_fioctl(struct file *fp, u_long cm
 		op.u.alloc_unbound.dom = DOMID_SELF;
 		op.u.alloc_unbound.remote_dom = bind_unbound->remote_domain;
 		if ((error = HYPERVISOR_event_channel_op(&op)))
 			return -error;
 		bind_unbound->port = op.u.alloc_unbound.port;
 		devevent[bind_unbound->port] = d;
 		hypervisor_unmask_event(bind_unbound->port);
 		break;
+	}
 	case IOCTL_EVTCHN_UNBIND:
+	{
 		struct ioctl_evtchn_unbind *unbind = addr;
-		if (unbind->port > NR_EVENT_CHANNELS)
+		if (unbind->port >= NR_EVENT_CHANNELS)
 			return EINVAL;
 		if (devevent[unbind->port] != d)
 			return ENOTCONN;
 		devevent[unbind->port] = NULL;
 		hypervisor_mask_event(unbind->port);
 		op.cmd = EVTCHNOP_close;
 		op.u.close.port = unbind->port;
 		if ((error = HYPERVISOR_event_channel_op(&op)))
 			return -error;
 		break;
+	}
 	case IOCTL_EVTCHN_NOTIFY:
+	{
 		struct ioctl_evtchn_notify *notify = addr;
-		if (notify->port > NR_EVENT_CHANNELS)
+		if (notify->port >= NR_EVENT_CHANNELS)
 			return EINVAL;
 		if (devevent[notify->port] != d)
 			return ENOTCONN;
 		hypervisor_notify_via_evtchn(notify->port);
 		break;
+	}
 #else /* !XEN3 */
 	case EVTCHN_BIND:
 		if (*arg > NR_EVENT_CHANNELS)
 			return EINVAL;
 		if (devevent[*arg] != NULL)
 			return EISCONN;
 		devevent[*arg] = d;