Fix various pmap_extract() buglets:

- for kernel space addresses, check the page number fits in Sysmap before
  accessing the array.
- for user space addresses, return the right (in-page) address bits.

2 files changed, 20 insertions, 17 deletions

diff --git a/sys/arch/vax/vax/pmap.c b/sys/arch/vax/vax/pmap.c
index 2bf2c257396..6fa7e4f97bc 100644
--- a/sys/arch/vax/vax/pmap.c
+++ b/sys/arch/vax/vax/pmap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pmap.c,v 1.49 2008/08/30 20:45:31 martin Exp $ */
+/*	$OpenBSD: pmap.c,v 1.50 2008/09/30 20:00:29 miod Exp $ */
 /*	$NetBSD: pmap.c,v 1.74 1999/11/13 21:32:25 matt Exp $	   */
 /*
  * Copyright (c) 1994, 1998, 1999 Ludd, University of Lule}, Sweden.
@@ -67,6 +67,7 @@ vaddr_t	istack;
 struct pmap kernel_pmap_store;
 
 pt_entry_t *Sysmap;		/* System page table */
+unsigned int sysptsize;
 vaddr_t scratch;
 vaddr_t	iospace;
 
@@ -120,7 +121,7 @@ vaddr_t   virtual_avail, virtual_end; /* Available virtual memory	*/
 void
 pmap_bootstrap()
 {
-	unsigned int sysptsize, i;
+	unsigned int i;
 	extern	unsigned int etext, proc0paddr;
 	struct pcb *pcb = (struct pcb *)proc0paddr;
 	pmap_t pmap = pmap_kernel();
@@ -853,21 +854,19 @@ pmap_extract(pmap, va, pap)
 	vaddr_t va;
 	paddr_t *pap;
 {
-	paddr_t pa = 0;
 	int	*pte, sva;
 
 #ifdef PMAPDEBUG
 if(startpmapdebug)printf("pmap_extract: pmap %p, va %lx\n",pmap, va);
 #endif
 
-	if (va & KERNBASE) {
-		pa = kvtophys(va); /* Is 0 if not mapped */
-		*pap = pa;
-		return (TRUE);
-	}
-
 	sva = PG_PFNUM(va);
-	if (va < 0x40000000) {
+
+	if (va & KERNBASE) {
+		if (sva >= sysptsize)
+			return (FALSE);
+		pte = Sysmap;
+	} else if (va < 0x40000000) {
 		if (sva > (pmap->pm_p0lr & ~AST_MASK))
 			return (FALSE);
 		pte = (int *)pmap->pm_p0br;
@@ -876,8 +875,10 @@ if(startpmapdebug)printf("pmap_extract: pmap %p, va %lx\n",pmap, va);
 			return (FALSE);
 		pte = (int *)pmap->pm_p1br;
 	}
+
 	if ((*kvtopte(&pte[sva]) & PG_FRAME) != 0) {
-		*pap = ((pte[sva] & PG_FRAME) << VAX_PGSHIFT);
+		*pap = ((pte[sva] & PG_FRAME) << VAX_PGSHIFT) |
+		    (va & VAX_PGOFSET);
 		return (TRUE);
 	}
 	
diff --git a/sys/arch/vax/vax/sgmap.c b/sys/arch/vax/vax/sgmap.c
index 5be7a4d043a..8cc63758db5 100644
--- a/sys/arch/vax/vax/sgmap.c
+++ b/sys/arch/vax/vax/sgmap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sgmap.c,v 1.9 2008/06/26 05:42:14 ray Exp $	*/
+/*	$OpenBSD: sgmap.c,v 1.10 2008/09/30 20:00:29 miod Exp $	*/
 /* $NetBSD: sgmap.c,v 1.8 2000/06/29 07:14:34 mrg Exp $ */
 
 /*-
@@ -184,6 +184,12 @@ vax_sgmap_load(t, map, buf, buflen, p, flags, sgmap)
 	bus_size_t dmalen;
 	long *pte, *page_table = (long *)sgmap->aps_pt;
 	int pteidx, error;
+	struct pmap *pmap;
+
+	if (p != NULL)
+		pmap = p->p_vmspace->vm_map.pmap;
+	else
+		pmap = pmap_kernel();
 
 	/*
 	 * Make sure that on error condition we return "no valid mappings".
@@ -223,7 +229,6 @@ vax_sgmap_load(t, map, buf, buflen, p, flags, sgmap)
 	map->dm_segs[0].ds_addr = map->_dm_sgva + dmaoffset;
 	map->dm_segs[0].ds_len = dmalen;
 
-
 	map->_dm_pteidx = pteidx;
 	map->_dm_ptecnt = 0;
 
@@ -235,10 +240,7 @@ vax_sgmap_load(t, map, buf, buflen, p, flags, sgmap)
 		/*
 		 * Get the physical address for this segment.
 		 */
-		if (p != NULL)
-			pmap_extract(p->p_vmspace->vm_map.pmap, va, &pa);
-		else
-			pa = kvtophys(va);
+		(void)pmap_extract(pmap, va, &pa);
 
 		/*
 		 * Load the current PTE with this page.