On Mon, Mar 21, 2005 at 02:58:40AM +0900, Izumi Tsutsui wrote:
> Index: mips/vm_machdep.c
> ===================================================================
...
> @@ -333,7 +321,8 @@
>  		if (pmap_extract(upmap, uva, &pa) == FALSE)
>  			panic("vmapbuf: null page frame");
>  		pmap_enter(vm_map_pmap(phys_map), kva, pa,
> -		    VM_PROT_READ | VM_PROT_WRITE, PMAP_WIRED);
> +		    VM_PROT_READ | VM_PROT_WRITE,
> +		    VM_PROT_READ | VM_PROT_WRITE | PMAP_WIRED);
>  		uva += PAGE_SIZE;
>  		kva += PAGE_SIZE;
>  		len -= PAGE_SIZE;

we shouldn't pass VM_PROT_WRITE in the pmap_enter() flags (the last arg)
if the user memory isn't going to be modified.  the buffer's read/write flags
are from the perspective of the device, so the user memory is only modified
if B_READ is set.

-Chuck