Change useracc() and kernacc() to use VM_PROT_{READ|WRITE|EXECUTE} for the

"rw" argument, rather than hijacking B_{READ|WRITE}.

Fix two bugs (physio & cam) resulting by the confusion caused by this.

Submitted by:   Tor.Egge@fast.no
Reviewed by:    alc, ken (partly)

20 files changed, 77 insertions, 64 deletions

diff --git a/share/man/man9/kernacc.9 b/share/man/man9/kernacc.9
index feead90..06d412b 100644
--- a/share/man/man9/kernacc.9
+++ b/share/man/man9/kernacc.9
@@ -64,10 +64,11 @@ and
 .Fa len .
 The possible values of
 .Fa rw
-are
-.Dv B_READ
+are any bitwise combination of
+.Dv VM_PROT_READ ,
+.Dv VM_PROT_WRITE 
 and
-.Dv B_WRITE .
+.Dv VM_PROT_EXECUTE . 
 .Fn kernacc
 checks addresses in the kernel address space, while
 .Fn useracc
@@ -78,9 +79,11 @@ operation is taken from the global variable
 .Va curproc .
 .Pp
 .Sh RETURN VALUES
-Both functions return 1 if the type of access specified by
+Both functions return boolean true if the type of access specified 
+by
 .Fa rw
-is permitted. Otherwise 0 is returned.
+is permitted. Otherwise boolean false is returned.
 .Pp
 .Sh BUGS
-The process pointer should be passed in as an argument.
+The process pointer should be passed in as an argument to 
+.Fn useracc .
diff --git a/sys/alpha/alpha/machdep.c b/sys/alpha/alpha/machdep.c
index 27c6cf3..99450ac 100644
--- a/sys/alpha/alpha/machdep.c
+++ b/sys/alpha/alpha/machdep.c
@@ -1192,7 +1192,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 		sip = (osiginfo_t *)(alpha_pal_rdusp() - rndfsize);
 
 	(void)grow_stack(p, (u_long)sip);
-	if (useracc((caddr_t)sip, fsize, B_WRITE) == 0) {
+	if (!useracc((caddr_t)sip, fsize, VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -1319,7 +1319,7 @@ sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 		printf("sendsig(%d): sig %d ssp %p usp %p\n", p->p_pid,
 		       sig, &sf, sfp);
 #endif
-	if (useracc((caddr_t)sfp, sizeof(sf), B_WRITE) == 0) {
+	if (!useracc((caddr_t)sfp, sizeof(sf), VM_PROT_WRITE)) {
 #ifdef DEBUG
 		if ((sigdebug & SDB_KSTACK) && p->p_pid == sigpid)
 			printf("sendsig(%d): useracc failed on sig %d\n",
@@ -1421,7 +1421,7 @@ osigreturn(struct proc *p,
 	 * Test and fetch the context structure.
 	 * We grab it all at once for speed.
 	 */
-	if (useracc((caddr_t)scp, sizeof (*scp), B_WRITE) == 0 ||
+	if (useracc((caddr_t)scp, sizeof (*scp), VM_PROT_WRITE) == 0 ||
 	    copyin((caddr_t)scp, (caddr_t)&ksc, sizeof ksc))
 		return (EINVAL);
 
@@ -1491,7 +1491,7 @@ sigreturn(struct proc *p,
 	 * Test and fetch the context structure.
 	 * We grab it all at once for speed.
 	 */
-	if (useracc((caddr_t)ucp, sizeof(ucontext_t), B_WRITE) == 0 ||
+	if (useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_WRITE) == 0 ||
 	    copyin((caddr_t)ucp, (caddr_t)&uc, sizeof(ucontext_t)))
 		return (EINVAL);
 
diff --git a/sys/alpha/alpha/mem.c b/sys/alpha/alpha/mem.c
index ce09425..e204b43 100644
--- a/sys/alpha/alpha/mem.c
+++ b/sys/alpha/alpha/mem.c
@@ -202,7 +202,8 @@ kmemphys:
 				return (EFAULT);
 #else
 			if (!kernacc((caddr_t)v, c,
-			    uio->uio_rw == UIO_READ ? B_READ : B_WRITE))
+			    uio->uio_rw == UIO_READ ? 
+			    VM_PROT_READ : VM_PROT_WRITE))
 				return (EFAULT);
 #endif
 			error = uiomove((caddr_t)v, c, uio);
diff --git a/sys/alpha/alpha/trap.c b/sys/alpha/alpha/trap.c
index 19d5339..06e5b24 100644
--- a/sys/alpha/alpha/trap.c
+++ b/sys/alpha/alpha/trap.c
@@ -961,7 +961,7 @@ unaligned_fixup(va, opcode, reg, p)
 	 * Even if it's an unknown opcode, SEGV if the access
 	 * should have failed.
 	 */
-	if (!useracc((caddr_t)va, size ? size : 1, B_WRITE)) {
+	if (!useracc((caddr_t)va, size ? size : 1, VM_PROT_WRITE)) {
 		signal = SIGSEGV;
 		goto out;
 	}
diff --git a/sys/alpha/linux/linux_sysvec.c b/sys/alpha/linux/linux_sysvec.c
index 4d0def0..eaf2a04 100644
--- a/sys/alpha/linux/linux_sysvec.c
+++ b/sys/alpha/linux/linux_sysvec.c
@@ -221,7 +221,8 @@ linux_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	 *	if access is denied.
 	 */
 	if ((grow_stack (p, (int)fp) == FALSE) ||
-	    (useracc((caddr_t)fp, sizeof (struct linux_sigframe), B_WRITE) == FALSE)) {
+	    !useracc((caddr_t)fp, sizeof (struct linux_sigframe), 
+	    VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
diff --git a/sys/amd64/amd64/machdep.c b/sys/amd64/amd64/machdep.c
index 5aa445a..c965466 100644
--- a/sys/amd64/amd64/machdep.c
+++ b/sys/amd64/amd64/machdep.c
@@ -501,7 +501,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	 *	if access is denied.
 	 */
 	if (grow_stack(p, (int)fp) == FALSE ||
-	    useracc((caddr_t)fp, sizeof(struct osigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)fp, sizeof(struct osigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -648,7 +648,7 @@ sendsig(catcher, sig, mask, code)
 	 * access is denied.
 	 */
 	if (grow_stack(p, (int)sfp) == FALSE ||
-	    useracc((caddr_t)sfp, sizeof(struct sigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)sfp, sizeof(struct sigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -769,7 +769,7 @@ osigreturn(p, uap)
 
 	scp = uap->sigcntxp;
 
-	if (useracc((caddr_t)scp, sizeof (struct osigcontext), B_WRITE) == 0)
+	if (!useracc((caddr_t)scp, sizeof (struct osigcontext), VM_PROT_WRITE))
 		return(EFAULT);
 
 	eflags = scp->sc_ps;
@@ -880,7 +880,7 @@ sigreturn(p, uap)
 	ucp = uap->sigcntxp;
 	eflags = ucp->uc_mcontext.mc_eflags;
 
-	if (useracc((caddr_t)ucp, sizeof(ucontext_t), B_WRITE) == 0)
+	if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_WRITE))
 		return(EFAULT);
 
 	if (eflags & PSL_VM) {
diff --git a/sys/amd64/amd64/mem.c b/sys/amd64/amd64/mem.c
index 70dac4e..92c7b2d 100644
--- a/sys/amd64/amd64/mem.c
+++ b/sys/amd64/amd64/mem.c
@@ -204,7 +204,8 @@ mmrw(dev, uio, flags)
 					return EFAULT;
 			
 			if (!kernacc((caddr_t)(int)uio->uio_offset, c,
-			    uio->uio_rw == UIO_READ ? B_READ : B_WRITE))
+			    uio->uio_rw == UIO_READ ? 
+			    VM_PROT_READ : VM_PROT_WRITE))
 				return (EFAULT);
 			error = uiomove((caddr_t)(int)uio->uio_offset, (int)c, uio);
 			continue;
diff --git a/sys/cam/cam_periph.c b/sys/cam/cam_periph.c
index 089c5f0..c787c54 100644
--- a/sys/cam/cam_periph.c
+++ b/sys/cam/cam_periph.c
@@ -560,8 +560,9 @@ cam_periph_mapmem(union ccb *ccb, struct cam_periph_map_info *mapinfo)
 		}
 
 		if (dirs[i] & CAM_DIR_OUT) {
-			flags[i] = B_READ;
-			if (useracc(*data_ptrs[i], lengths[i], B_READ) == 0){
+			flags[i] = B_WRITE;
+			if (!useracc(*data_ptrs[i], lengths[i], 
+				     VM_PROT_READ)) {
 				printf("cam_periph_mapmem: error, "
 					"address %p, length %lu isn't "
 					"user accessible for READ\n",
@@ -576,8 +577,9 @@ cam_periph_mapmem(union ccb *ccb, struct cam_periph_map_info *mapinfo)
 		 * is all 0's, and so it is "set" all the time.
 		 */
 		if (dirs[i] & CAM_DIR_IN) {
-			flags[i] |= B_WRITE;
-			if (useracc(*data_ptrs[i], lengths[i], B_WRITE) == 0){
+			flags[i] |= B_READ;
+			if (!useracc(*data_ptrs[i], lengths[i], 
+				     VM_PROT_WRITE)) {
 				printf("cam_periph_mapmem: error, "
 					"address %p, length %lu isn't "
 					"user accessible for WRITE\n",
diff --git a/sys/dev/pci/pci.c b/sys/dev/pci/pci.c
index 9a756a8..2e6d548 100644
--- a/sys/dev/pci/pci.c
+++ b/sys/dev/pci/pci.c
@@ -663,7 +663,7 @@ pci_ioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 			 * Check the user's buffer to make sure it's readable.
 			 */
 			if (!useracc((caddr_t)cio->patterns,
-				    cio->pat_buf_len, B_READ)) {
+				    cio->pat_buf_len, VM_PROT_READ)) {
 				printf("pci_ioctl: pattern buffer %p, "
 				       "length %u isn't user accessible for"
 				       " READ\n", cio->patterns,
@@ -699,7 +699,7 @@ pci_ioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 		 * Make sure we can write to the match buffer.
 		 */
 		if (!useracc((caddr_t)cio->matches,
-			     cio->match_buf_len, B_WRITE)) {
+			     cio->match_buf_len, VM_PROT_WRITE)) {
 			printf("pci_ioctl: match buffer %p, length %u "
 			       "isn't user accessible for WRITE\n",
 			       cio->matches, cio->match_buf_len);
diff --git a/sys/i386/i386/machdep.c b/sys/i386/i386/machdep.c
index 5aa445a..c965466 100644
--- a/sys/i386/i386/machdep.c
+++ b/sys/i386/i386/machdep.c
@@ -501,7 +501,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	 *	if access is denied.
 	 */
 	if (grow_stack(p, (int)fp) == FALSE ||
-	    useracc((caddr_t)fp, sizeof(struct osigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)fp, sizeof(struct osigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -648,7 +648,7 @@ sendsig(catcher, sig, mask, code)
 	 * access is denied.
 	 */
 	if (grow_stack(p, (int)sfp) == FALSE ||
-	    useracc((caddr_t)sfp, sizeof(struct sigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)sfp, sizeof(struct sigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -769,7 +769,7 @@ osigreturn(p, uap)
 
 	scp = uap->sigcntxp;
 
-	if (useracc((caddr_t)scp, sizeof (struct osigcontext), B_WRITE) == 0)
+	if (!useracc((caddr_t)scp, sizeof (struct osigcontext), VM_PROT_WRITE))
 		return(EFAULT);
 
 	eflags = scp->sc_ps;
@@ -880,7 +880,7 @@ sigreturn(p, uap)
 	ucp = uap->sigcntxp;
 	eflags = ucp->uc_mcontext.mc_eflags;
 
-	if (useracc((caddr_t)ucp, sizeof(ucontext_t), B_WRITE) == 0)
+	if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_WRITE))
 		return(EFAULT);
 
 	if (eflags & PSL_VM) {
diff --git a/sys/i386/i386/mem.c b/sys/i386/i386/mem.c
index 70dac4e..92c7b2d 100644
--- a/sys/i386/i386/mem.c
+++ b/sys/i386/i386/mem.c
@@ -204,7 +204,8 @@ mmrw(dev, uio, flags)
 					return EFAULT;
 			
 			if (!kernacc((caddr_t)(int)uio->uio_offset, c,
-			    uio->uio_rw == UIO_READ ? B_READ : B_WRITE))
+			    uio->uio_rw == UIO_READ ? 
+			    VM_PROT_READ : VM_PROT_WRITE))
 				return (EFAULT);
 			error = uiomove((caddr_t)(int)uio->uio_offset, (int)c, uio);
 			continue;
diff --git a/sys/i386/linux/linux_sysvec.c b/sys/i386/linux/linux_sysvec.c
index 4d0def0..eaf2a04 100644
--- a/sys/i386/linux/linux_sysvec.c
+++ b/sys/i386/linux/linux_sysvec.c
@@ -221,7 +221,8 @@ linux_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	 *	if access is denied.
 	 */
 	if ((grow_stack (p, (int)fp) == FALSE) ||
-	    (useracc((caddr_t)fp, sizeof (struct linux_sigframe), B_WRITE) == FALSE)) {
+	    !useracc((caddr_t)fp, sizeof (struct linux_sigframe), 
+	    VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
diff --git a/sys/kern/kern_physio.c b/sys/kern/kern_physio.c
index 6a4034e..128283f 100644
--- a/sys/kern/kern_physio.c
+++ b/sys/kern/kern_physio.c
@@ -101,7 +101,8 @@ physio(dev_t dev, struct uio *uio, int ioflag)
 
 			if (uio->uio_segflg == UIO_USERSPACE) {
 				if (!useracc(bp->b_data, bp->b_bufsize,
-				    bp->b_flags & B_READ)) {
+				    bp->b_flags & B_READ ?
+				    VM_PROT_WRITE : VM_PROT_READ)) {
 					error = EFAULT;
 					goto doerror;
 				}
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index af6c32a..a00d7a1 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -845,13 +845,13 @@ userland_sysctl(struct proc *p, int *name, u_int namelen, void *old, size_t *old
 	}
 
 	if (old) {
-		if (!useracc(old, req.oldlen, B_WRITE))
+		if (!useracc(old, req.oldlen, VM_PROT_WRITE))
 			return (EFAULT);
 		req.oldptr= old;
 	}
 
 	if (newlen) {
-		if (!useracc(new, req.newlen, B_READ))
+		if (!useracc(new, req.newlen, VM_PROT_READ))
 			return (EFAULT);
 		req.newlen = newlen;
 		req.newptr = new;
diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c
index 032b038..7c06c50 100644
--- a/sys/kern/kern_time.c
+++ b/sys/kern/kern_time.c
@@ -276,7 +276,8 @@ nanosleep(p, uap)
 	if (error)
 		return (error);
 	if (SCARG(uap, rmtp))
-		if (!useracc((caddr_t)SCARG(uap, rmtp), sizeof(rmt), B_WRITE))
+		if (!useracc((caddr_t)SCARG(uap, rmtp), sizeof(rmt), 
+		    VM_PROT_WRITE))
 			return (EFAULT);
 	error = nanosleep1(p, &rqt, &rmt);
 	if (error && SCARG(uap, rmtp)) {
diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c
index c1e7d9a..ea75c56 100644
--- a/sys/kern/vfs_aio.c
+++ b/sys/kern/vfs_aio.c
@@ -916,7 +916,6 @@ aio_qphysio(p, aiocbe)
 	struct aiocb *cb;
 	struct file *fp;
 	struct buf *bp;
-	int bflags;
 	struct vnode *vp;
 	struct kaioinfo *ki;
 	struct filedesc *fdp;
@@ -924,7 +923,6 @@ aio_qphysio(p, aiocbe)
 	int fd;
 	int s;
 	int cnt;
-	int rw;
 	struct cdevsw *cdev;
 
 	cb = &aiocbe->uaiocb;
@@ -996,29 +994,26 @@ aio_qphysio(p, aiocbe)
 	bp->b_dev = vp->v_rdev;
 	error = bp->b_error = 0;
 
-	if (cb->aio_lio_opcode == LIO_WRITE) {
-		rw = 0;
-		bflags = B_WRITE;
-	} else {
-		rw = 1;
-		bflags = B_READ;
-	}
-	
 	bp->b_bcount = cb->aio_nbytes;
 	bp->b_bufsize = cb->aio_nbytes;
-	bp->b_flags = B_PHYS | B_CALL | bflags;
+	bp->b_flags = B_PHYS | B_CALL;
 	bp->b_iodone = aio_physwakeup;
 	bp->b_saveaddr = bp->b_data;
 	bp->b_data = (void *) cb->aio_buf;
 	bp->b_blkno = btodb(cb->aio_offset);
 
-	if (rw && !useracc(bp->b_data, bp->b_bufsize, B_WRITE)) {
-		error = EFAULT;
-		goto doerror;
-	}
-	if (!rw && !useracc(bp->b_data, bp->b_bufsize, B_READ)) {
-		error = EFAULT;
-		goto doerror;
+	if (cb->aio_lio_opcode == LIO_WRITE) {
+		bp->b_flags |= B_WRITE;
+		if (!useracc(bp->b_data, bp->b_bufsize, VM_PROT_READ)) {
+			error = EFAULT;
+			goto doerror;
+		}
+	} else {
+		bp->b_flags |= B_READ;
+		if (!useracc(bp->b_data, bp->b_bufsize, VM_PROT_WRITE)) {
+			error = EFAULT;
+			goto doerror;
+		}
 	}
 
 	/* bring buffer into kernel space */
diff --git a/sys/pc98/i386/machdep.c b/sys/pc98/i386/machdep.c
index 95025ea..ed1e1a2 100644
--- a/sys/pc98/i386/machdep.c
+++ b/sys/pc98/i386/machdep.c
@@ -514,7 +514,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	 *	if access is denied.
 	 */
 	if (grow_stack(p, (int)fp) == FALSE ||
-	    useracc((caddr_t)fp, sizeof(struct osigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)fp, sizeof(struct osigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -661,7 +661,7 @@ sendsig(catcher, sig, mask, code)
 	 * access is denied.
 	 */
 	if (grow_stack(p, (int)sfp) == FALSE ||
-	    useracc((caddr_t)sfp, sizeof(struct sigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)sfp, sizeof(struct sigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -782,7 +782,7 @@ osigreturn(p, uap)
 
 	scp = uap->sigcntxp;
 
-	if (useracc((caddr_t)scp, sizeof (struct osigcontext), B_WRITE) == 0)
+	if (!useracc((caddr_t)scp, sizeof (struct osigcontext), VM_PROT_WRITE))
 		return(EFAULT);
 
 	eflags = scp->sc_ps;
@@ -893,7 +893,7 @@ sigreturn(p, uap)
 	ucp = uap->sigcntxp;
 	eflags = ucp->uc_mcontext.mc_eflags;
 
-	if (useracc((caddr_t)ucp, sizeof(ucontext_t), B_WRITE) == 0)
+	if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_WRITE))
 		return(EFAULT);
 
 	if (eflags & PSL_VM) {
diff --git a/sys/pc98/pc98/machdep.c b/sys/pc98/pc98/machdep.c
index 95025ea..ed1e1a2 100644
--- a/sys/pc98/pc98/machdep.c
+++ b/sys/pc98/pc98/machdep.c
@@ -514,7 +514,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	 *	if access is denied.
 	 */
 	if (grow_stack(p, (int)fp) == FALSE ||
-	    useracc((caddr_t)fp, sizeof(struct osigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)fp, sizeof(struct osigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -661,7 +661,7 @@ sendsig(catcher, sig, mask, code)
 	 * access is denied.
 	 */
 	if (grow_stack(p, (int)sfp) == FALSE ||
-	    useracc((caddr_t)sfp, sizeof(struct sigframe), B_WRITE) == FALSE) {
+	    !useracc((caddr_t)sfp, sizeof(struct sigframe), VM_PROT_WRITE)) {
 		/*
 		 * Process has trashed its stack; give it an illegal
 		 * instruction to halt it in its tracks.
@@ -782,7 +782,7 @@ osigreturn(p, uap)
 
 	scp = uap->sigcntxp;
 
-	if (useracc((caddr_t)scp, sizeof (struct osigcontext), B_WRITE) == 0)
+	if (!useracc((caddr_t)scp, sizeof (struct osigcontext), VM_PROT_WRITE))
 		return(EFAULT);
 
 	eflags = scp->sc_ps;
@@ -893,7 +893,7 @@ sigreturn(p, uap)
 	ucp = uap->sigcntxp;
 	eflags = ucp->uc_mcontext.mc_eflags;
 
-	if (useracc((caddr_t)ucp, sizeof(ucontext_t), B_WRITE) == 0)
+	if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_WRITE))
 		return(EFAULT);
 
 	if (eflags & PSL_VM) {
diff --git a/sys/pci/pci.c b/sys/pci/pci.c
index 9a756a8..2e6d548 100644
--- a/sys/pci/pci.c
+++ b/sys/pci/pci.c
@@ -663,7 +663,7 @@ pci_ioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 			 * Check the user's buffer to make sure it's readable.
 			 */
 			if (!useracc((caddr_t)cio->patterns,
-				    cio->pat_buf_len, B_READ)) {
+				    cio->pat_buf_len, VM_PROT_READ)) {
 				printf("pci_ioctl: pattern buffer %p, "
 				       "length %u isn't user accessible for"
 				       " READ\n", cio->patterns,
@@ -699,7 +699,7 @@ pci_ioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 		 * Make sure we can write to the match buffer.
 		 */
 		if (!useracc((caddr_t)cio->matches,
-			     cio->match_buf_len, B_WRITE)) {
+			     cio->match_buf_len, VM_PROT_WRITE)) {
 			printf("pci_ioctl: match buffer %p, length %u "
 			       "isn't user accessible for WRITE\n",
 			       cio->matches, cio->match_buf_len);
diff --git a/sys/vm/vm_glue.c b/sys/vm/vm_glue.c
index 5fe78fd..3caa562 100644
--- a/sys/vm/vm_glue.c
+++ b/sys/vm/vm_glue.c
@@ -118,8 +118,11 @@ kernacc(addr, len, rw)
 {
 	boolean_t rv;
 	vm_offset_t saddr, eaddr;
-	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
+	vm_prot_t prot;
 
+	KASSERT(rw & (~VM_PROT_ALL),
+	    ("illegal ``rw'' argument to kernacc (%x)\n", rw));
+	prot = rw;
 	saddr = trunc_page((vm_offset_t)addr);
 	eaddr = round_page((vm_offset_t)addr + len);
 	vm_map_lock_read(kernel_map);
@@ -134,10 +137,13 @@ useracc(addr, len, rw)
 	int len, rw;
 {
 	boolean_t rv;
-	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
+	vm_prot_t prot;
 	vm_map_t map;
 	vm_map_entry_t save_hint;
 
+	KASSERT(rw & (~VM_PROT_ALL),
+	    ("illegal ``rw'' argument to useracc (%x)\n", rw));
+	prot = rw;
 	/*
 	 * XXX - check separately to disallow access to user area and user
 	 * page tables - they are in the map.