--- Net2/vm/vm_glue.c	2018/04/24 18:09:21	1.1.1.3
+++ Net2/vm/vm_glue.c	2018/04/24 18:14:57	1.1.1.4
@@ -33,7 +33,8 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)vm_glue.c	7.8 (Berkeley) 5/15/91
+ *	from: @(#)vm_glue.c	7.8 (Berkeley) 5/15/91
+ *	vm_glue.c,v 1.10.2.1 1993/07/31 12:20:51 cgd Exp
  *
  *
  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
@@ -59,7 +60,6 @@
  * any improvements or extensions that they make and grant Carnegie the
  * rights to redistribute these changes.
  */
-static char rcsid[] = "$Header: /var/lib/cvsd/net2/Net2/vm/vm_glue.c,v 1.1.1.3 2018/04/24 18:09:21 root Exp $";
 
 #include "param.h"
 #include "systm.h"
@@ -85,7 +85,7 @@ kernacc(addr, len, rw)
 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
 
 	saddr = trunc_page(addr);
-	eaddr = round_page(addr+len-1);
+	eaddr = round_page(addr+len);
 	rv = vm_map_check_protection(kernel_map, saddr, eaddr, prot);
 	/*
 	 * XXX there are still some things (e.g. the buffer cache) that
@@ -109,8 +109,24 @@ useracc(addr, len, rw)
 	boolean_t rv;
 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
 
+	/*
+	 * XXX - specially disallow access to user page tables - they are
+	 * in the map.
+	 *
+	 * XXX - don't specially disallow access to the user area - treat
+	 * it as incorrectly as elsewhere.
+	 *
+	 * XXX - VM_MAXUSER_ADDRESS is an end address, not a max.  It was
+	 * only used (as an end address) in trap.c.  Use it as an end
+	 * address here too.
+	 */
+	if ((vm_offset_t) addr >= VM_MAXUSER_ADDRESS
+	    || (vm_offset_t) addr + len > VM_MAXUSER_ADDRESS
+	    || (vm_offset_t) addr + len <= (vm_offset_t) addr)
+		return (FALSE);
+
 	rv = vm_map_check_protection(&curproc->p_vmspace->vm_map,
-	    trunc_page(addr), round_page(addr+len-1), prot);
+	    trunc_page(addr), round_page(addr+len), prot);
 	return(rv == TRUE);
 }
 
@@ -127,7 +143,7 @@ chgkprot(addr, len, rw)
 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
 
 	vm_map_protect(kernel_map, trunc_page(addr),
-		       round_page(addr+len-1), prot, FALSE);
+		       round_page(addr+len), prot, FALSE);
 }
 #endif
 
@@ -136,7 +152,7 @@ vslock(addr, len)
 	u_int	len;
 {
 	vm_map_pageable(&curproc->p_vmspace->vm_map, trunc_page(addr),
-			round_page(addr+len-1), FALSE);
+			round_page(addr+len), FALSE);
 }
 
 vsunlock(addr, len, dirtied)
@@ -148,7 +164,7 @@ vsunlock(addr, len, dirtied)
 	dirtied++;
 #endif	lint
 	vm_map_pageable(&curproc->p_vmspace->vm_map, trunc_page(addr),
-			round_page(addr+len-1), TRUE);
+			round_page(addr+len), TRUE);
 }
 
 /*
@@ -220,6 +236,12 @@ vm_fork(p1, p2, isvfork)
 	/* ream out old pagetables and kernel stack */
 	(void)vm_deallocate(vp, addr, UPT_MAX_ADDRESS - addr);
 	(void)vm_allocate(vp, &addr, UPT_MAX_ADDRESS - addr, FALSE);
+
+	/* protect from the user area from user accesses. :-)
+	   addr -> addr + UPAGES*NBPG don't seem to be protected without
+	   this; the rest seems to be OK, and doesn't like being protected
+	   - andrew@werple.apana.org.au */
+	vm_protect(vp, addr, UPAGES*NBPG, FALSE, VM_PROT_NONE);
 	}
 #endif
 	/*
@@ -236,6 +258,7 @@ vm_fork(p1, p2, isvfork)
  * Set default limits for VM system.
  * Called for proc 0, and then inherited by all others.
  */
+void
 vm_init_limits(p)
 	register struct proc *p;
 {
@@ -272,6 +295,7 @@ int	swapdebug = 0;
  *	2. If not enough memory, wake the pageout daemon and let it
  *	   clear some space.
  */
+void
 sched()
 {
 	register struct proc *p;
@@ -307,7 +331,7 @@ noswap:
 	 * Nothing to do, back to sleep
 	 */
 	if ((p = pp) == NULL) {
-		sleep((caddr_t)&proc0, PVM);
+		tsleep((caddr_t)&proc0, PVM, "sched", 0);
 		goto loop;
 	}
 
@@ -487,7 +511,7 @@ thread_block()
 	int s = splhigh();
 
 	if (curproc->p_thread)
-		sleep((caddr_t)curproc->p_thread, PVM);
+		tsleep((caddr_t)curproc->p_thread, PVM, "thrd_block", 0);
 	splx(s);
 }
 
@@ -504,7 +528,7 @@ thread_sleep(event, lock, ruptible)
 	curproc->p_thread = event;
 	simple_unlock(lock);
 	if (curproc->p_thread)
-		sleep((caddr_t)event, PVM);
+		tsleep((caddr_t)event, PVM, "thrd_sleep", 0);
 	splx(s);
 }