sti colormap fixes:

- correct bounds checking in colormap ioctls.
- force the scment() pointer to NULL on < 8.04 revisions; 8.02 provide a
  non-NULL pointer, but it does not point to any meaningful piece of code.

2 files changed, 21 insertions, 8 deletions

diff --git a/sys/dev/ic/sti.c b/sys/dev/ic/sti.c
index 59495e8a184..1980bd930ca 100644
--- a/sys/dev/ic/sti.c
+++ b/sys/dev/ic/sti.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sti.c,v 1.40 2005/01/23 16:55:18 miod Exp $	*/
+/*	$OpenBSD: sti.c,v 1.41 2005/01/24 19:20:04 miod Exp $	*/
 
 /*
  * Copyright (c) 2000-2003 Michael Shalayeff
@@ -260,6 +260,14 @@ sti_attach_common(sc, codebase)
 	sc->pmgr	= (sti_pmgr_t)	O(STI_PROC_MGR);
 	sc->util	= (sti_util_t)	O(STI_UTIL);
 
+	/*
+	 * Set colormap entry is not implemented until 8.04, so force
+	 * a NULL pointer here.
+	 */
+	if (dd->dd_grrev < STI_REVISION(8,4)) {
+		sc->scment = NULL;
+	}
+
 	if ((error = uvm_map_protect(kernel_map, sc->sc_code,
 	    sc->sc_code + round_page(size), UVM_PROT_RX, FALSE))) {
 		printf(": uvm_map_protect failed (%d)\n", error);
@@ -668,7 +676,10 @@ sti_ioctl(v, cmd, data, flag, p)
 		wdf->height = sc->sc_cfg.scr_height;
 		wdf->width  = sc->sc_cfg.scr_width;
 		wdf->depth  = sc->sc_bpp;
-		wdf->cmsize = STI_NCMAP;
+		if (sc->scment == NULL)
+			wdf->cmsize = 0;
+		else
+			wdf->cmsize = STI_NCMAP;
 		break;
 
 	case WSDISPLAYIO_LINEBYTES:
@@ -677,11 +688,11 @@ sti_ioctl(v, cmd, data, flag, p)
 
 	case WSDISPLAYIO_GETCMAP:
 		if (sc->scment == NULL)
-			return ENOTTY;
+			return ENODEV;
 		cmapp = (struct wsdisplay_cmap *)data;
 		idx = cmapp->index;
 		count = cmapp->count;
-		if (idx > STI_NCMAP || idx + count >= STI_NCMAP)
+		if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
 			return EINVAL;
 		if ((ret = copyout(&sc->sc_rcmap[idx], cmapp->red, count)))
 			break;
@@ -693,11 +704,11 @@ sti_ioctl(v, cmd, data, flag, p)
 
 	case WSDISPLAYIO_PUTCMAP:
 		if (sc->scment == NULL)
-			return ENOTTY;
+			return ENODEV;
 		cmapp = (struct wsdisplay_cmap *)data;
 		idx = cmapp->index;
 		count = cmapp->count;
-		if (idx > STI_NCMAP || idx + count >= STI_NCMAP)
+		if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
 			return EINVAL;
 		if ((ret = copyin(cmapp->red, &sc->sc_rcmap[idx], count)))
 			break;
@@ -730,7 +741,7 @@ sti_ioctl(v, cmd, data, flag, p)
 	case WSDISPLAYIO_GCURSOR:
 	case WSDISPLAYIO_SCURSOR:
 	default:
-		return (ENOTTY);	/* not supported yet */
+		return (-1);		/* not supported yet */
 	}
 
 	return (ret);
diff --git a/sys/dev/ic/stireg.h b/sys/dev/ic/stireg.h
index efe9979b2d3..6880845e260 100644
--- a/sys/dev/ic/stireg.h
+++ b/sys/dev/ic/stireg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: stireg.h,v 1.9 2005/01/23 16:53:21 miod Exp $	*/
+/*	$OpenBSD: stireg.h,v 1.10 2005/01/24 19:20:04 miod Exp $	*/
 
 /*
  * Copyright (c) 2000 Michael Shalayeff
@@ -158,6 +158,8 @@ struct	sti_dd {
 	u_int32_t	dd_altcode[16];	/* 0x80 routines for m68k/i386 */
 };
 
+#define	STI_REVISION(maj, min)	(((maj) << 4) | ((min) & 0x0f))
+
 /* after the last region there is one indirect list ptr */
 struct sti_region {
 	u_int	offset  :14;	/* page offset dev io space relative */