--- Net2/vm/vm_glue.c	2018/04/24 18:03:57	1.1
+++ Net2/vm/vm_glue.c	2018/04/24 18:14:57	1.1.1.4
@@ -33,7 +33,8 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)vm_glue.c	7.8 (Berkeley) 5/15/91
+ *	from: @(#)vm_glue.c	7.8 (Berkeley) 5/15/91
+ *	vm_glue.c,v 1.10.2.1 1993/07/31 12:20:51 cgd Exp
  *
  *
  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
@@ -84,7 +85,7 @@ kernacc(addr, len, rw)
 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
 
 	saddr = trunc_page(addr);
-	eaddr = round_page(addr+len-1);
+	eaddr = round_page(addr+len);
 	rv = vm_map_check_protection(kernel_map, saddr, eaddr, prot);
 	/*
 	 * XXX there are still some things (e.g. the buffer cache) that
@@ -108,8 +109,24 @@ useracc(addr, len, rw)
 	boolean_t rv;
 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
 
+	/*
+	 * XXX - specially disallow access to user page tables - they are
+	 * in the map.
+	 *
+	 * XXX - don't specially disallow access to the user area - treat
+	 * it as incorrectly as elsewhere.
+	 *
+	 * XXX - VM_MAXUSER_ADDRESS is an end address, not a max.  It was
+	 * only used (as an end address) in trap.c.  Use it as an end
+	 * address here too.
+	 */
+	if ((vm_offset_t) addr >= VM_MAXUSER_ADDRESS
+	    || (vm_offset_t) addr + len > VM_MAXUSER_ADDRESS
+	    || (vm_offset_t) addr + len <= (vm_offset_t) addr)
+		return (FALSE);
+
 	rv = vm_map_check_protection(&curproc->p_vmspace->vm_map,
-	    trunc_page(addr), round_page(addr+len-1), prot);
+	    trunc_page(addr), round_page(addr+len), prot);
 	return(rv == TRUE);
 }
 
@@ -126,7 +143,7 @@ chgkprot(addr, len, rw)
 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
 
 	vm_map_protect(kernel_map, trunc_page(addr),
-		       round_page(addr+len-1), prot, FALSE);
+		       round_page(addr+len), prot, FALSE);
 }
 #endif
 
@@ -135,7 +152,7 @@ vslock(addr, len)
 	u_int	len;
 {
 	vm_map_pageable(&curproc->p_vmspace->vm_map, trunc_page(addr),
-			round_page(addr+len-1), FALSE);
+			round_page(addr+len), FALSE);
 }
 
 vsunlock(addr, len, dirtied)
@@ -147,7 +164,7 @@ vsunlock(addr, len, dirtied)
 	dirtied++;
 #endif	lint
 	vm_map_pageable(&curproc->p_vmspace->vm_map, trunc_page(addr),
-			round_page(addr+len-1), TRUE);
+			round_page(addr+len), TRUE);
 }
 
 /*
@@ -186,8 +203,12 @@ vm_fork(p1, p2, isvfork)
 	/*
 	 * Allocate a wired-down (for now) pcb and kernel stack for the process
 	 */
+#ifdef notyet
 	addr = kmem_alloc_pageable(kernel_map, ctob(UPAGES));
 	vm_map_pageable(kernel_map, addr, addr + ctob(UPAGES), FALSE);
+#else
+	addr = kmem_alloc(kernel_map, ctob(UPAGES));
+#endif
 	up = (struct user *)addr;
 	p2->p_addr = up;
 
@@ -211,10 +232,16 @@ vm_fork(p1, p2, isvfork)
 	{ u_int addr = UPT_MIN_ADDRESS - UPAGES*NBPG; struct vm_map *vp;
 
 	vp = &p2->p_vmspace->vm_map;
-	(void)vm_map_pageable(vp, addr, 0xfe000000 - addr, TRUE);
-	(void)vm_deallocate(vp, addr, 0xfe000000 - addr);
+
+	/* ream out old pagetables and kernel stack */
+	(void)vm_deallocate(vp, addr, UPT_MAX_ADDRESS - addr);
 	(void)vm_allocate(vp, &addr, UPT_MAX_ADDRESS - addr, FALSE);
-	(void)vm_map_inherit(vp, addr, UPT_MAX_ADDRESS, VM_INHERIT_NONE);
+
+	/* protect from the user area from user accesses. :-)
+	   addr -> addr + UPAGES*NBPG don't seem to be protected without
+	   this; the rest seems to be OK, and doesn't like being protected
+	   - andrew@werple.apana.org.au */
+	vm_protect(vp, addr, UPAGES*NBPG, FALSE, VM_PROT_NONE);
 	}
 #endif
 	/*
@@ -231,6 +258,7 @@ vm_fork(p1, p2, isvfork)
  * Set default limits for VM system.
  * Called for proc 0, and then inherited by all others.
  */
+void
 vm_init_limits(p)
 	register struct proc *p;
 {
@@ -267,6 +295,7 @@ int	swapdebug = 0;
  *	2. If not enough memory, wake the pageout daemon and let it
  *	   clear some space.
  */
+void
 sched()
 {
 	register struct proc *p;
@@ -302,7 +331,7 @@ noswap:
 	 * Nothing to do, back to sleep
 	 */
 	if ((p = pp) == NULL) {
-		sleep((caddr_t)&proc0, PVM);
+		tsleep((caddr_t)&proc0, PVM, "sched", 0);
 		goto loop;
 	}
 
@@ -429,6 +458,7 @@ swapout(p)
 #endif
 	size = round_page(ctob(UPAGES));
 	addr = (vm_offset_t) p->p_addr;
+#ifdef notyet
 #ifdef hp300
 	/*
 	 * Ugh!  u-area is double mapped to a fixed address behind the
@@ -451,6 +481,7 @@ swapout(p)
 #endif
 	vm_map_pageable(kernel_map, addr, addr+size, TRUE);
 	pmap_collect(vm_map_pmap(&p->p_vmspace->vm_map));
+#endif
 	(void) splhigh();
 	p->p_flag &= ~SLOAD;
 	if (p->p_stat == SRUN)
@@ -480,7 +511,7 @@ thread_block()
 	int s = splhigh();
 
 	if (curproc->p_thread)
-		sleep((caddr_t)curproc->p_thread, PVM);
+		tsleep((caddr_t)curproc->p_thread, PVM, "thrd_block", 0);
 	splx(s);
 }
 
@@ -497,7 +528,7 @@ thread_sleep(event, lock, ruptible)
 	curproc->p_thread = event;
 	simple_unlock(lock);
 	if (curproc->p_thread)
-		sleep((caddr_t)event, PVM);
+		tsleep((caddr_t)event, PVM, "thrd_sleep", 0);
 	splx(s);
 }