Index: sys/external/bsd/drm2/dist/drm/nouveau/core/core/nouveau_core_gpuobj.c
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/dist/drm/nouveau/core/core/nouveau_core_gpuobj.c,v
retrieving revision 1.1.1.1
diff -p -u -r1.1.1.1 nouveau_core_gpuobj.c
--- sys/external/bsd/drm2/dist/drm/nouveau/core/core/nouveau_core_gpuobj.c	6 Aug 2014 12:36:23 -0000	1.1.1.1
+++ sys/external/bsd/drm2/dist/drm/nouveau/core/core/nouveau_core_gpuobj.c	15 Feb 2016 00:23:30 -0000
@@ -84,6 +84,10 @@ nouveau_gpuobj_create_(struct nouveau_ob
 			return -EINVAL;
 		}
 
+		nv_error(parent, "this is the parent, handle=%"PRIx32"\n",
+		    parent->oclass->handle);
+		nv_error(pargpu, "this is the pargpu, handle=%"PRIx32"\n",
+		    pargpu->oclass->handle);
 		addr =  nv_gpuobj(pargpu)->addr;
 		heap = &nv_gpuobj(pargpu)->heap;
 		atomic_inc(&parent->refcount);
@@ -118,6 +122,7 @@ nouveau_gpuobj_create_(struct nouveau_ob
 	gpuobj->flags = flags;
 	gpuobj->addr = addr;
 	gpuobj->size = size;
+	nv_error(gpuobj, "%p parent %p flags %"PRIx32" addr %"PRIx64" size %"PRIx32"\n", gpuobj, pargpu, flags, addr, size);
 
 	if (heap) {
 		ret = nouveau_mm_head(heap, 1, size, size,
@@ -126,6 +131,8 @@ nouveau_gpuobj_create_(struct nouveau_ob
 			return ret;
 
 		gpuobj->addr += gpuobj->node->offset;
+		nv_error(gpuobj, "addr offset %"PRIx32" -> %"PRIx64"\n",
+		    gpuobj->node->offset, gpuobj->addr);
 	}
 
 	if (gpuobj->flags & NVOBJ_FLAG_HEAP) {
@@ -204,7 +211,10 @@ _nouveau_gpuobj_wr32(struct nouveau_obje
 	struct nouveau_ofuncs *pfuncs = nv_ofuncs(gpuobj->parent);
 	if (gpuobj->node)
 		addr += gpuobj->node->offset;
+	void (*volatile x)(struct nouveau_object *, u64, u32) = pfuncs->wr32;
 	pfuncs->wr32(gpuobj->parent, addr, data);
+	__insn_barrier();
+	void (*volatile y)(struct nouveau_object *, u64, u32) __unused = x;
 }
 
 static struct nouveau_oclass
Index: sys/external/bsd/drm2/dist/drm/nouveau/core/engine/fifo/nouveau_engine_fifo_base.c
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/dist/drm/nouveau/core/engine/fifo/nouveau_engine_fifo_base.c,v
retrieving revision 1.4
diff -p -u -r1.4 nouveau_engine_fifo_base.c
--- sys/external/bsd/drm2/dist/drm/nouveau/core/engine/fifo/nouveau_engine_fifo_base.c	10 Feb 2016 17:10:47 -0000	1.4
+++ sys/external/bsd/drm2/dist/drm/nouveau/core/engine/fifo/nouveau_engine_fifo_base.c	15 Feb 2016 00:23:30 -0000
@@ -148,6 +148,10 @@ _nouveau_fifo_channel_rd32(struct nouvea
 {
 	struct nouveau_fifo_chan *chan = (void *)object;
 #ifdef __NetBSD__
+	KASSERTMSG((addr < chan->size),
+	    "nouveau fifo read address out of bounds"
+	    ": addr 0x%"PRIx64" > size 0x%"PRIxMAX,
+	    addr, (uintmax_t)chan->size);
 	return bus_space_read_4(chan->bst, chan->bsh, addr);
 #else
 	return ioread32_native(chan->user + addr);
@@ -159,6 +163,10 @@ _nouveau_fifo_channel_wr32(struct nouvea
 {
 	struct nouveau_fifo_chan *chan = (void *)object;
 #ifdef __NetBSD__
+	KASSERTMSG((addr < chan->size),
+	    "nouveau fifo write address out of bounds"
+	    ": addr 0x%"PRIx64" > size 0x%"PRIxMAX", data 0x%08"PRIx32,
+	    addr, (uintmax_t)chan->size, data);
 	bus_space_write_4(chan->bst, chan->bsh, addr, data);
 #else
 	iowrite32_native(data, chan->user + addr);
Index: sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h,v
retrieving revision 1.2
diff -p -u -r1.2 subdev.h
--- sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h	6 Aug 2014 13:35:13 -0000	1.2
+++ sys/external/bsd/drm2/dist/drm/nouveau/core/include/core/subdev.h	15 Feb 2016 00:23:30 -0000
@@ -93,6 +93,10 @@ nv_rd32(void *obj, u32 addr)
 {
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 #ifdef __NetBSD__
+	KASSERTMSG((addr < subdev->mmiosz),
+	    "nouveau mmio read address out of bounds"
+	    ": addr 0x%"PRIx32" > size 0x%"PRIxMAX,
+	    addr, (uintmax_t)subdev->mmiosz);
 	u32 data = bus_space_read_stream_4(subdev->mmiot, subdev->mmioh, addr);
 #else
 	u32 data = ioread32_native(subdev->mmio + addr);
@@ -131,6 +135,10 @@ nv_wr32(void *obj, u32 addr, u32 data)
 	struct nouveau_subdev *subdev = nv_subdev(obj);
 	nv_spam(subdev, "nv_wr32 0x%06x 0x%08x\n", addr, data);
 #ifdef __NetBSD__
+	KASSERTMSG((addr < subdev->mmiosz),
+	    "nouveau mmio write address out of bounds"
+	    ": addr 0x%"PRIx32" > size 0x%"PRIxMAX", data 0x%08"PRIx32,
+	    addr, (uintmax_t)subdev->mmiosz, data);
 	bus_space_write_stream_4(subdev->mmiot, subdev->mmioh, addr, data);
 #else
 	iowrite32_native(data, subdev->mmio + addr);
Index: sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c,v
retrieving revision 1.4
diff -p -u -r1.4 nouveau_subdev_bar_base.c
--- sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c	14 Feb 2016 03:06:06 -0000	1.4
+++ sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/bar/nouveau_subdev_bar_base.c	15 Feb 2016 00:23:30 -0000
@@ -40,6 +40,7 @@ struct nouveau_barobj {
 #ifdef __NetBSD__
 	bus_space_tag_t iomemt;
 	bus_space_handle_t iomemh;
+	bus_size_t iomemsz;
 #else
 	void __iomem *iomem;
 #endif
@@ -72,6 +73,7 @@ nouveau_barobj_ctor(struct nouveau_objec
 	    &barobj->iomemh);
 	if (ret)
 		return ret;
+	barobj->iomemsz = bar->iomemsz - barobj->vma.offset;
 #else
 	barobj->iomem = bar->iomem + (u32)barobj->vma.offset;
 #endif
@@ -93,6 +95,10 @@ nouveau_barobj_rd32(struct nouveau_objec
 {
 	struct nouveau_barobj *barobj = (void *)object;
 #ifdef __NetBSD__
+	KASSERTMSG((addr < barobj->iomemsz),
+	    "nouveau bar read address out of bounds"
+	    ": addr 0x%"PRIx64" > size 0x%"PRIxMAX,
+	    addr, (uintmax_t)barobj->iomemsz);
 	return bus_space_read_4(barobj->iomemt, barobj->iomemh, addr);
 #else
 	return ioread32_native(barobj->iomem + addr);
@@ -104,6 +110,10 @@ nouveau_barobj_wr32(struct nouveau_objec
 {
 	struct nouveau_barobj *barobj = (void *)object;
 #ifdef __NetBSD__
+	KASSERTMSG((addr < barobj->iomemsz),
+	    "nouveau bar write address out of bounds"
+	    ": addr 0x%"PRIx64" > size 0x%"PRIxMAX", data 0x%08"PRIx32,
+	    addr, (uintmax_t)barobj->iomemsz, data);
 	bus_space_write_4(barobj->iomemt, barobj->iomemh, addr, data);
 #else
 	iowrite32_native(data, barobj->iomem + addr);
Index: sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/instmem/nouveau_subdev_instmem_nv40.c
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/instmem/nouveau_subdev_instmem_nv40.c,v
retrieving revision 1.2
diff -p -u -r1.2 nouveau_subdev_instmem_nv40.c
--- sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/instmem/nouveau_subdev_instmem_nv40.c	23 Aug 2014 08:03:34 -0000	1.2
+++ sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/instmem/nouveau_subdev_instmem_nv40.c	15 Feb 2016 00:23:30 -0000
@@ -40,6 +40,10 @@ nv40_instmem_rd32(struct nouveau_object 
 {
 	struct nv04_instmem_priv *priv = (void *)object;
 #ifdef __NetBSD__
+	KASSERTMSG((addr < priv->iomemsz),
+	    "nv40 instmem read address out of bounds"
+	    ": addr 0x%"PRIx64" > size 0x%"PRIxMAX,
+	    addr, (uintmax_t)priv->iomemsz);
 	return bus_space_read_4(priv->iomemt, priv->iomemh, addr);
 #else
 	return ioread32_native(priv->iomem + addr);
@@ -51,6 +55,10 @@ nv40_instmem_wr32(struct nouveau_object 
 {
 	struct nv04_instmem_priv *priv = (void *)object;
 #ifdef __NetBSD__
+	KASSERTMSG((addr < priv->iomemsz),
+	    "nv40 instmem write address out of bounds"
+	    ": addr 0x%"PRIx64" > size 0x%"PRIxMAX", data 0x%08"PRIx32,
+	    addr, (uintmax_t)priv->iomemsz, data);
 	bus_space_write_4(priv->iomemt, priv->iomemh, addr, data);
 #else
 	iowrite32_native(data, priv->iomem + addr);