Add support for:

	- 3COM 3CXEM556 (Ethernet/Modem)
	- SVEC Combo and Lancard
	- Corega PCC-T
Add pcmcia_check_cis_quirks to fix some cards whose CIS flat-out lies.
Add more products to pcmciadevs.
Correctly read 1 controller if CL-PD6729.
Remove some unused vars.

1 files changed, 37 insertions, 10 deletions

diff --git a/sys/dev/pcmcia/pcmcia_cis.c b/sys/dev/pcmcia/pcmcia_cis.c
index 1653f1aea6d..772bd6a863d 100644
--- a/sys/dev/pcmcia/pcmcia_cis.c
+++ b/sys/dev/pcmcia/pcmcia_cis.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pcmcia_cis.c,v 1.1 1998/09/11 10:47:15 fgsch Exp $	*/
+/*	$OpenBSD: pcmcia_cis.c,v 1.2 1999/01/28 04:58:31 fgsch Exp $	*/
 /*	$NetBSD: pcmcia_cis.c,v 1.9 1998/08/22 23:41:48 msaitoh Exp $	*/
 
 /*
@@ -41,8 +41,7 @@
 #include <dev/pcmcia/pcmciavar.h>
 
 #ifdef PCMCIACISDEBUG
-int	pcmciacis_debug = 1;
-#define	DPRINTF(arg) if (pcmciacis_debug) printf arg
+#define	DPRINTF(arg) printf arg
 #else
 #define	DPRINTF(arg)
 #endif
@@ -329,6 +328,7 @@ pcmcia_scan_cis(dev, fct, arg)
 			/* skip to the next tuple */
 			tuple.ptr += 2 + tuple.length;
 		}
+
 		/*
 		 * the chain is done.  Clean up and move onto the next one,
 		 * if any.  The loop is here in the case that there is an MFC
@@ -985,6 +985,12 @@ pcmcia_parse_cis_tuple(tuple, arg)
 					idx++;
 			}
 			if (iospace) {
+				if (tuple->length <= idx) {
+					DPRINTF(("ran out of space before TPCE_IO\n"));
+
+					goto abort_cfe;
+				}
+
 				reg = pcmcia_tuple_read_1(tuple, idx);
 				idx++;
 
@@ -1057,6 +1063,12 @@ pcmcia_parse_cis_tuple(tuple, arg)
 				}
 			}
 			if (irq) {
+				if (tuple->length <= idx) {
+					DPRINTF(("ran out of space before TPCE_IR\n"));
+
+					goto abort_cfe;
+				}
+
 				reg = pcmcia_tuple_read_1(tuple, idx);
 				idx++;
 
@@ -1082,7 +1094,14 @@ pcmcia_parse_cis_tuple(tuple, arg)
 				}
 			}
 			if (memspace) {
-				if (memspace == PCMCIA_TPCE_FS_MEMSPACE_LENGTH) {
+				if (tuple->length <= idx) {
+					DPRINTF(("ran out of space before TPCE_MS\n"));
+					goto abort_cfe;
+				}
+
+				if (memspace == PCMCIA_TPCE_FS_MEMSPACE_NONE) {
+					cfe->num_memspace = 0;
+				} else if (memspace == PCMCIA_TPCE_FS_MEMSPACE_LENGTH) {
 					cfe->num_memspace = 1;
 					cfe->memspace[0].length = 256 *
 					    pcmcia_tuple_read_2(tuple, idx);
@@ -1098,7 +1117,7 @@ pcmcia_parse_cis_tuple(tuple, arg)
 					cfe->memspace[0].cardaddr = 256 *
 					    pcmcia_tuple_read_2(tuple, idx);
 					idx += 2;
-					cfe->memspace[0].hostaddr = 0;
+					cfe->memspace[0].hostaddr = cfe->memspace[0].cardaddr;
 				} else {
 					int lengthsize;
 					int cardaddrsize;
@@ -1120,13 +1139,13 @@ pcmcia_parse_cis_tuple(tuple, arg)
 						break;
 					}
 					lengthsize =
-					    ((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
-					    PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
+						((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
+						 PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
 					cardaddrsize =
-					    ((reg & PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
-					    PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
+						((reg & PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
+						 PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
 					hostaddrsize =
-					(reg & PCMCIA_TPCE_MS_HOSTADDR) ? cardaddrsize : 0;
+						(reg & PCMCIA_TPCE_MS_HOSTADDR) ? cardaddrsize : 0;
 
 					if (lengthsize == 0) {
 						DPRINTF(("cfe memspace "
@@ -1167,6 +1186,12 @@ pcmcia_parse_cis_tuple(tuple, arg)
 				}
 			}
 			if (misc) {
+				if (tuple->length <= idx) {
+					DPRINTF(("ran out of space before TPCE_MI\n"));
+
+					goto abort_cfe;
+				}
+
 				reg = pcmcia_tuple_read_1(tuple, idx);
 				idx++;
 
@@ -1185,6 +1210,8 @@ pcmcia_parse_cis_tuple(tuple, arg)
 			}
 			/* skip all the subtuples */
 		}
+
+	abort_cfe:
 		DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
 		break;
 	default: