From nms@Brigada-A.Ethereal.RU  Mon Feb 14 10:12:30 2000
Return-Path: <nms@Brigada-A.Ethereal.RU>
Received: from Brigada-A.Ethereal.RU (Brigada-A.ethereal.ru [195.230.65.30])
	by builder.freebsd.org (Postfix) with ESMTP id C1AC84A23
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 14 Feb 2000 10:12:29 -0800 (PST)
Received: by Brigada-A.Ethereal.RU (Postfix, from userid 1002)
	id 506D31D6; Mon, 14 Feb 2000 21:12:30 +0300 (MSK)
Message-Id: <20000214181230.506D31D6@Brigada-A.Ethereal.RU>
Date: Mon, 14 Feb 2000 21:12:30 +0300 (MSK)
From: nms@Brigada-A.Ethereal.RU
Reply-To: nms@Brigada-A.Ethereal.RU
To: FreeBSD-gnats-submit@freebsd.org
Subject: PNP memory range size calculated wrong
X-Send-Pr-Version: 3.2

>Number:         16712
>Category:       kern
>Synopsis:       ISA PNP memory range size calculated wrong
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Feb 14 10:20:01 PST 2000
>Closed-Date:    Thu Mar 30 23:23:28 PST 2000
>Last-Modified:  Thu Mar 30 23:24:02 PST 2000
>Originator:     Nikolai Saoukh
>Release:        FreeBSD 4.0-CURRENT i386
>Organization:
>Environment:

	FreeBSD Manor 4.0-CURRENT FreeBSD 4.0-CURRENT #8: Mon Feb 14 12:59:41 MSK 2000     nms@Manor:/usr/src/sys/compile/MANOR i386

>Description:

	File src/sys/isa/pnpparse.c (version 1.2), lines 270-271, 286-287
	treat memory range size as byte size, while it is expressed in
	256 byte chucks.

>How-To-Repeat:

	Any PNP card with io memory should reveal this bug.

>Fix:


--- pnpparse.c	Fri Oct 15 01:03:01 1999
+++ pnpparse.c.new	Thu Feb 10 12:42:14 2000
@@ -262,4 +262,6 @@
 			case PNP_TAG_MEMORY_RANGE:
 				if (bootverbose) {
+					int temp = I16(resinfo + 7) << 8;
+
 					printf("%s: adding memory range "
 					       "%#x-%#x, size=%#x, "
@@ -267,7 +269,6 @@
 					       pnp_eisaformat(id),
 					       I16(resinfo + 1)<<8,
-					       (I16(resinfo + 3)<<8)
-					       + I16(resinfo + 7) - 1,
-					       I16(resinfo + 7),
+					       (I16(resinfo + 3)<<8) + temp - 1,
+					       temp,
 					       I16(resinfo + 5));
 				}
@@ -283,7 +284,7 @@
 				config->ic_mem[config->ic_nmem].ir_end =
 					(I16(resinfo + 3)<<8)
-					+ I16(resinfo + 7) - 1;
+					+ (I16(resinfo + 7) << 8) - 1;
 				config->ic_mem[config->ic_nmem].ir_size =
-					I16(resinfo + 7);
+					I16(resinfo + 7) << 8;
 				config->ic_mem[config->ic_nmem].ir_align =
 					I16(resinfo + 5);

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: dfr 
State-Changed-When: Thu Mar 30 23:23:28 PST 2000 
State-Changed-Why:  
Fixed in revisions 1.3 and 1.2.2.1 of pnpparse.c 
>Unformatted:
