xref: /openbsd/sys/dev/pcmcia/pcmcia_cis.c (revision 3d8817e4)
1 /*	$OpenBSD: pcmcia_cis.c,v 1.18 2010/09/04 13:14:49 miod Exp $	*/
2 /*	$NetBSD: pcmcia_cis.c,v 1.9 1998/08/22 23:41:48 msaitoh Exp $	*/
3 
4 /*
5  * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Marc Horowitz.
18  * 4. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/device.h>
37 #include <sys/malloc.h>
38 
39 #include <dev/pcmcia/pcmciareg.h>
40 #include <dev/pcmcia/pcmciachip.h>
41 #include <dev/pcmcia/pcmciavar.h>
42 
43 #ifdef PCMCIACISDEBUG
44 #define	DPRINTF(arg) printf arg
45 #else
46 #define	DPRINTF(arg)
47 #endif
48 
49 #define	PCMCIA_CIS_SIZE		1024
50 
51 struct cis_state {
52 	int	count;
53 	int	gotmfc;
54 	struct pcmcia_config_entry temp_cfe;
55 	struct pcmcia_config_entry *default_cfe;
56 	struct pcmcia_card *card;
57 	struct pcmcia_function *pf;
58 };
59 
60 int	pcmcia_parse_cis_tuple(struct pcmcia_tuple *, void *);
61 
62 uint8_t
63 pcmcia_cis_read_1(struct pcmcia_tuple *tuple, bus_size_t idx)
64 {
65 	if (tuple->flags & PTF_INDIRECT) {
66 		bus_space_write_1(tuple->memt, tuple->memh,
67 		    tuple->indirect_ptr + PCMCIA_INDR_CONTROL, PCMCIA_ICR_ATTR);
68 		idx <<= tuple->addrshift;
69 		bus_space_write_1(tuple->memt, tuple->memh,
70 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 0, idx >> 0);
71 		bus_space_write_1(tuple->memt, tuple->memh,
72 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 1, idx >> 8);
73 		bus_space_write_1(tuple->memt, tuple->memh,
74 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 2, idx >> 16);
75 		bus_space_write_1(tuple->memt, tuple->memh,
76 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 3, idx >> 24);
77 		return bus_space_read_1(tuple->memt, tuple->memh,
78 		    tuple->indirect_ptr + PCMCIA_INDR_DATA);
79 	} else
80 		return bus_space_read_1(tuple->memt, tuple->memh,
81 		    idx << tuple->addrshift);
82 }
83 
84 void
85 pcmcia_read_cis(sc)
86 	struct pcmcia_softc *sc;
87 {
88 	struct cis_state state;
89 
90 	memset(&state, 0, sizeof state);
91 
92 	state.card = &sc->card;
93 
94 	state.card->error = 0;
95 	state.card->cis1_major = -1;
96 	state.card->cis1_minor = -1;
97 	state.card->cis1_info[0] = NULL;
98 	state.card->cis1_info[1] = NULL;
99 	state.card->cis1_info[2] = NULL;
100 	state.card->cis1_info[3] = NULL;
101 	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
102 	state.card->product = PCMCIA_PRODUCT_INVALID;
103 	SIMPLEQ_INIT(&state.card->pf_head);
104 
105 	state.pf = NULL;
106 
107 	if (pcmcia_scan_cis((struct device *)sc, pcmcia_parse_cis_tuple,
108 	    &state) == -1)
109 		state.card->error++;
110 }
111 
112 int
113 pcmcia_scan_cis(dev, fct, arg)
114 	struct device *dev;
115 	int (*fct)(struct pcmcia_tuple *, void *);
116 	void *arg;
117 {
118 	struct pcmcia_softc *sc = (struct pcmcia_softc *) dev;
119 	pcmcia_chipset_tag_t pct;
120 	pcmcia_chipset_handle_t pch;
121 	int window;
122 	struct pcmcia_mem_handle pcmh;
123 	struct pcmcia_tuple tuple;
124 	int indirect_present;
125 	int longlink_present;
126 	int longlink_common;
127 	u_long longlink_addr;
128 	int mfc_count;
129 	int mfc_index;
130 	struct {
131 		int	common;
132 		u_long	addr;
133 	} mfc[256 / 5];
134 	int ret;
135 
136 	ret = 0;
137 
138 	pct = sc->pct;
139 	pch = sc->pch;
140 
141 	/* allocate some memory */
142 
143 	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
144 #ifdef DIAGNOSTIC
145 		printf("%s: can't alloc memory to read attributes\n",
146 		    sc->dev.dv_xname);
147 #endif
148 		return -1;
149 	}
150 
151 	/* initialize state for the primary tuple chain */
152 	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
153 	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
154 		pcmcia_chip_mem_free(pct, pch, &pcmh);
155 #ifdef DIAGNOSTIC
156 		printf("%s: can't map memory to read attributes\n",
157 		    sc->dev.dv_xname);
158 #endif
159 		return -1;
160 	}
161 	tuple.memt = pcmh.memt;
162 	tuple.memh = pcmh.memh;
163 
164 	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
165 
166 	tuple.addrshift = 1;
167 	tuple.flags = 0;
168 
169 	indirect_present = 0;
170 	longlink_present = 1;
171 	longlink_common = 1;
172 	longlink_addr = 0;
173 
174 	mfc_count = 0;
175 	mfc_index = 0;
176 
177 	DPRINTF(("%s: CIS tuple chain:\n", sc->dev.dv_xname));
178 
179 	while (1) {
180 		while (1) {
181 			/*
182 			 * Perform boundary check for insane cards.
183 			 * If CIS is too long, simulate CIS end.
184 			 * (This check may not be sufficient for
185 			 * malicious cards.)
186 			 */
187 			if ((tuple.ptr << tuple.addrshift) >=
188 			    PCMCIA_CIS_SIZE - 1 - 32 /* ad hoc value */) {
189 				DPRINTF(("CISTPL_END (too long CIS)\n"));
190 				tuple.code = PCMCIA_CISTPL_END;
191 				goto cis_end;
192 			}
193 
194 			/* get the tuple code */
195 
196 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
197 
198 			/* two special-case tuples */
199 
200 			if (tuple.code == PCMCIA_CISTPL_NULL) {
201 				DPRINTF(("CISTPL_NONE\n 00\n"));
202 				tuple.ptr++;
203 				continue;
204 			} else if (tuple.code == PCMCIA_CISTPL_END) {
205 				DPRINTF(("CISTPL_END\n ff\n"));
206 			cis_end:
207 				/* Call the function for the END tuple, since
208 				   the CIS semantics depend on it */
209 				if ((*fct) (&tuple, arg)) {
210 					pcmcia_chip_mem_unmap(pct, pch,
211 							      window);
212 					ret = 1;
213 					goto done;
214 				}
215 				tuple.ptr++;
216 				break;
217 			}
218 			/* now all the normal tuples */
219 
220 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
221 			switch (tuple.code) {
222 			case PCMCIA_CISTPL_INDIRECT:
223 				indirect_present = 1;
224 				DPRINTF(("CISTPL_INDIRECT\n"));
225 				break;
226 			case PCMCIA_CISTPL_LONGLINK_A:
227 			case PCMCIA_CISTPL_LONGLINK_C:
228 				if (tuple.length < 4) {
229 					DPRINTF(("CISTPL_LONGLINK_%s too "
230 					    "short %d\n",
231 					    longlink_common ? "C" : "A",
232 					    tuple.length));
233 					break;
234 				}
235 				longlink_present = 1;
236 				longlink_common = (tuple.code ==
237 				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
238 				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
239 				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
240 				    longlink_common ? "C" : "A",
241 				    longlink_addr));
242 				break;
243 			case PCMCIA_CISTPL_NO_LINK:
244 				longlink_present = 0;
245 				DPRINTF(("CISTPL_NO_LINK\n"));
246 				break;
247 			case PCMCIA_CISTPL_CHECKSUM:
248 				if (tuple.length < 5) {
249 					DPRINTF(("CISTPL_CHECKSUM too "
250 					    "short %d\n", tuple.length));
251 					break;
252 				} {
253 					int16_t offset;
254 					u_long addr, length;
255 					u_int cksum, sum;
256 					int i;
257 
258 					*((u_int16_t *) & offset) =
259 					    pcmcia_tuple_read_2(&tuple, 0);
260 					length = pcmcia_tuple_read_2(&tuple, 2);
261 					cksum = pcmcia_tuple_read_1(&tuple, 4);
262 
263 					addr = tuple.ptr + offset;
264 
265 					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
266 					    "len=%lx cksum=%x",
267 					    addr, length, cksum));
268 
269 					/*
270 					 * XXX do more work to deal with
271 					 * distant regions
272 					 */
273 					if ((addr >= PCMCIA_CIS_SIZE) ||
274 					    ((addr + length) < 0) ||
275 					    ((addr + length) >=
276 					      PCMCIA_CIS_SIZE)) {
277 						DPRINTF((" skipped, "
278 						    "too distant\n"));
279 						break;
280 					}
281 					sum = 0;
282 					for (i = 0; i < length; i++)
283 						sum += pcmcia_cis_read_1(&tuple,
284 						    addr + i);
285 					if (cksum != (sum & 0xff)) {
286 						DPRINTF((" failed sum=%x\n",
287 						    sum));
288 						printf("%s: CIS checksum "
289 						    "failed\n",
290 						    sc->dev.dv_xname);
291 #if 0
292 						/*
293 						 * XXX Some working cards have
294 						 * XXX bad checksums!!
295 						 */
296 						ret = -1;
297 #endif
298 					} else {
299 						DPRINTF((" ok\n"));
300 					}
301 				}
302 				break;
303 			case PCMCIA_CISTPL_LONGLINK_MFC:
304 				if (tuple.length < 6) {
305 					DPRINTF(("CISTPL_LONGLINK_MFC too "
306 					    "short %d\n", tuple.length));
307 					break;
308 				}
309 				if (((tuple.length - 1) % 5) != 0) {
310 					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
311 					    "length %d\n", tuple.length));
312 					break;
313 				}
314 				{
315 					int i, tmp_count;
316 
317 					/*
318 					 * put count into tmp var so that
319 					 * if we have to bail (because it's
320 					 * a bogus count) it won't be
321 					 * remembered for later use.
322 					 */
323 					tmp_count =
324 					    pcmcia_tuple_read_1(&tuple, 0);
325 					DPRINTF(("CISTPL_LONGLINK_MFC %d",
326 					    tmp_count));
327 
328 					/*
329 					 * make _sure_ it's the right size;
330 					 * if too short, it may be a weird
331 					 * (unknown/undefined) format
332 					 */
333 					if (tuple.length != (tmp_count*5 + 1)) {
334 						DPRINTF((" bogus length %d\n",
335 						    tuple.length));
336 						break;
337 					}
338 
339 #ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
340 					/*
341 					 * sanity check for a programming
342 					 * error which is difficult to find
343 					 * when debugging.
344 					 */
345 					if (tmp_count >
346 					    howmany(sizeof mfc, sizeof mfc[0]))
347 						panic("CISTPL_LONGLINK_MFC mfc "
348 						    "count would blow stack");
349 #endif
350 
351 					mfc_count = tmp_count;
352 					for (i = 0; i < mfc_count; i++) {
353 						mfc[i].common =
354 						    (pcmcia_tuple_read_1(&tuple,
355 						    1 + 5 * i) ==
356 						    PCMCIA_MFC_MEM_COMMON) ?
357 						    1 : 0;
358 						mfc[i].addr =
359 						    pcmcia_tuple_read_4(&tuple,
360 						    1 + 5 * i + 1);
361 						DPRINTF((" %s:%lx",
362 						    mfc[i].common ? "common" :
363 						    "attr", mfc[i].addr));
364 					}
365 					DPRINTF(("\n"));
366 				}
367 				/*
368 				 * for LONGLINK_MFC, fall through to the
369 				 * function.  This tuple has structural and
370 				 * semantic content.
371 				 */
372 			default:
373 				{
374 					if ((*fct) (&tuple, arg)) {
375 						pcmcia_chip_mem_unmap(pct,
376 						    pch, window);
377 						ret = 1;
378 						goto done;
379 					}
380 				}
381 				break;
382 			}	/* switch */
383 #ifdef PCMCIACISDEBUG
384 			/* print the tuple */
385 			{
386 				int i;
387 
388 				DPRINTF((" %02x %02x", tuple.code,
389 				    tuple.length));
390 
391 				for (i = 0; i < tuple.length; i++) {
392 					DPRINTF((" %02x",
393 					    pcmcia_tuple_read_1(&tuple, i)));
394 					if ((i % 16) == 13)
395 						DPRINTF(("\n"));
396 				}
397 				if ((i % 16) != 14)
398 					DPRINTF(("\n"));
399 			}
400 #endif
401 			/* skip to the next tuple */
402 			tuple.ptr += 2 + tuple.length;
403 		}
404 
405 		/*
406 		 * the chain is done.  Clean up and move onto the next one,
407 		 * if any.  The loop is here in the case that there is an MFC
408 		 * card with no longlink (which defaults to existing, == 0).
409 		 * In general, this means that if one pointer fails, it will
410 		 * try the next one, instead of just bailing.
411 		 */
412 
413 		while (1) {
414 			pcmcia_chip_mem_unmap(pct, pch, window);
415 
416 			if (indirect_present) {
417 				/*
418 				 * Indirect CIS data needs to be obtained
419 				 * from specific registers accessible at
420 				 * a fixed location in the common window,
421 				 * but otherwise is similar to longlink
422 				 * in attribute memory.
423 				 */
424 
425 				pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_COMMON,
426 				    0, PCMCIA_INDR_SIZE,
427 				    &pcmh, &tuple.indirect_ptr, &window);
428 
429 				DPRINTF(("cis mem map %x ind %x\n",
430 				    (unsigned int) tuple.memh,
431 				    (unsigned int) tuple.indirect_ptr));
432 
433 				tuple.addrshift = 1;
434 				tuple.flags |= PTF_INDIRECT;
435 				tuple.ptr = 0;
436 				longlink_present = 0;
437 				indirect_present = 0;
438 			} else if (longlink_present) {
439 				/*
440 				 * if the longlink is to attribute memory,
441 				 * then it is unindexed.  That is, if the
442 				 * link value is 0x100, then the actual
443 				 * memory address is 0x200.  This means that
444 				 * we need to multiply by 2 before calling
445 				 * mem_map, and then divide the resulting ptr
446 				 * by 2 after.
447 				 */
448 
449 				if (!longlink_common)
450 					longlink_addr *= 2;
451 
452 				pcmcia_chip_mem_map(pct, pch, longlink_common ?
453 				    PCMCIA_MEM_COMMON : PCMCIA_MEM_ATTR,
454 				    longlink_addr, PCMCIA_CIS_SIZE,
455 				    &pcmh, &tuple.ptr, &window);
456 
457 				if (!longlink_common)
458 					tuple.ptr /= 2;
459 
460 				DPRINTF(("cis mem map %x\n",
461 				    (unsigned int) tuple.memh));
462 
463 				tuple.addrshift = longlink_common ? 0 : 1;
464 				longlink_present = 0;
465 				longlink_common = 1;
466 				longlink_addr = 0;
467 			} else if (mfc_count && (mfc_index < mfc_count)) {
468 				if (!mfc[mfc_index].common)
469 					mfc[mfc_index].addr *= 2;
470 
471 				pcmcia_chip_mem_map(pct, pch,
472 				    mfc[mfc_index].common ?
473 				    PCMCIA_MEM_COMMON : PCMCIA_MEM_ATTR,
474 				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
475 				    &pcmh, &tuple.ptr, &window);
476 
477 				if (!mfc[mfc_index].common)
478 					tuple.ptr /= 2;
479 
480 				DPRINTF(("cis mem map %x\n",
481 				    (unsigned int) tuple.memh));
482 
483 				/* set parse state, and point at the next one */
484 
485 				tuple.addrshift = mfc[mfc_index].common ? 0 : 1;
486 
487 				mfc_index++;
488 			} else {
489 				goto done;
490 			}
491 
492 			/* make sure that the link is valid */
493 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
494 			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
495 				DPRINTF(("CISTPL_LINKTARGET expected, "
496 				    "code %02x observed\n", tuple.code));
497 				continue;
498 			}
499 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
500 			if (tuple.length < 3) {
501 				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
502 				    tuple.length));
503 				continue;
504 			}
505 			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
506 			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
507 			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
508 				DPRINTF(("CISTPL_LINKTARGET magic "
509 				    "%02x%02x%02x incorrect\n",
510 				    pcmcia_tuple_read_1(&tuple, 0),
511 				    pcmcia_tuple_read_1(&tuple, 1),
512 				    pcmcia_tuple_read_1(&tuple, 2)));
513 				continue;
514 			}
515 			tuple.ptr += 2 + tuple.length;
516 
517 			break;
518 		}
519 	}
520 
521 	pcmcia_chip_mem_unmap(pct, pch, window);
522 
523 done:
524 	/* Last, free the allocated memory block */
525 	pcmcia_chip_mem_free(pct, pch, &pcmh);
526 
527 	return (ret);
528 }
529 
530 /* XXX this is incredibly verbose.  Not sure what trt is */
531 
532 void
533 pcmcia_print_cis(sc)
534 	struct pcmcia_softc *sc;
535 {
536 	struct pcmcia_card *card = &sc->card;
537 	struct pcmcia_function *pf;
538 	struct pcmcia_config_entry *cfe;
539 	int i;
540 
541 	printf("%s: CIS version ", sc->dev.dv_xname);
542 	if (card->cis1_major == 4) {
543 		if (card->cis1_minor == 0)
544 			printf("PCMCIA 1.0\n");
545 		else if (card->cis1_minor == 1)
546 			printf("PCMCIA 2.0 or 2.1\n");
547 	} else if (card->cis1_major >= 5)
548 		printf("PC Card Standard %d.%d\n", card->cis1_major,
549 		    card->cis1_minor);
550 	else
551 		printf("unknown (major=%d, minor=%d)\n",
552 		    card->cis1_major, card->cis1_minor);
553 
554 	printf("%s: CIS info: ", sc->dev.dv_xname);
555 	for (i = 0; i < 4; i++) {
556 		if (card->cis1_info[i] == NULL)
557 			break;
558 		if (i)
559 			printf(", ");
560 		printf("%s", card->cis1_info[i]);
561 	}
562 	printf("\n");
563 
564 	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
565 	       sc->dev.dv_xname, card->manufacturer, card->product);
566 
567 	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
568 		printf("%s: function %d: ", sc->dev.dv_xname, pf->number);
569 
570 		switch (pf->function) {
571 		case PCMCIA_FUNCTION_UNSPEC:
572 			printf("unspecified");
573 			break;
574 		case PCMCIA_FUNCTION_MULTIFUNCTION:
575 			printf("multi-function");
576 			break;
577 		case PCMCIA_FUNCTION_MEMORY:
578 			printf("memory");
579 			break;
580 		case PCMCIA_FUNCTION_SERIAL:
581 			printf("serial port");
582 			break;
583 		case PCMCIA_FUNCTION_PARALLEL:
584 			printf("parallel port");
585 			break;
586 		case PCMCIA_FUNCTION_DISK:
587 			printf("fixed disk");
588 			break;
589 		case PCMCIA_FUNCTION_VIDEO:
590 			printf("video adapter");
591 			break;
592 		case PCMCIA_FUNCTION_NETWORK:
593 			printf("network adapter");
594 			break;
595 		case PCMCIA_FUNCTION_AIMS:
596 			printf("auto incrementing mass storage");
597 			break;
598 		case PCMCIA_FUNCTION_SCSI:
599 			printf("SCSI bridge");
600 			break;
601 		case PCMCIA_FUNCTION_SECURITY:
602 			printf("Security services");
603 			break;
604 		case PCMCIA_FUNCTION_INSTRUMENT:
605 			printf("Instrument");
606 			break;
607 		case PCMCIA_FUNCTION_IOBUS:
608 			printf("Serial I/O Bus Adapter");
609 			break;
610 		default:
611 			printf("unknown (%d)", pf->function);
612 			break;
613 		}
614 
615 		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
616 
617 		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
618 			printf("%s: function %d, config table entry %d: ",
619 			    sc->dev.dv_xname, pf->number, cfe->number);
620 
621 			switch (cfe->iftype) {
622 			case PCMCIA_IFTYPE_MEMORY:
623 				printf("memory card");
624 				break;
625 			case PCMCIA_IFTYPE_IO:
626 				printf("I/O card");
627 				break;
628 			default:
629 				printf("card type unknown");
630 				break;
631 			}
632 
633 			printf("; irq mask %x", cfe->irqmask);
634 
635 			if (cfe->num_iospace) {
636 				printf("; iomask %lx, iospace", cfe->iomask);
637 
638 				for (i = 0; i < cfe->num_iospace; i++)
639 					printf(" %lx%s%lx",
640 					    cfe->iospace[i].start,
641 					    cfe->iospace[i].length ? "-" : "",
642 					    cfe->iospace[i].start +
643 					      cfe->iospace[i].length - 1);
644 			}
645 			if (cfe->num_memspace) {
646 				printf("; memspace");
647 
648 				for (i = 0; i < cfe->num_memspace; i++)
649 					printf(" %lx%s%lx%s%lx",
650 					    cfe->memspace[i].cardaddr,
651 					    cfe->memspace[i].length ? "-" : "",
652 					    cfe->memspace[i].cardaddr +
653 					      cfe->memspace[i].length - 1,
654 					    cfe->memspace[i].hostaddr ?
655 					      "@" : "",
656 					    cfe->memspace[i].hostaddr);
657 			}
658 			if (cfe->maxtwins)
659 				printf("; maxtwins %d", cfe->maxtwins);
660 
661 			printf(";");
662 
663 			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
664 				printf(" mwait_required");
665 			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
666 				printf(" rdybsy_active");
667 			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
668 				printf(" wp_active");
669 			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
670 				printf(" bvd_active");
671 			if (cfe->flags & PCMCIA_CFE_IO8)
672 				printf(" io8");
673 			if (cfe->flags & PCMCIA_CFE_IO16)
674 				printf(" io16");
675 			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
676 				printf(" irqshare");
677 			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
678 				printf(" irqpulse");
679 			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
680 				printf(" irqlevel");
681 			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
682 				printf(" powerdown");
683 			if (cfe->flags & PCMCIA_CFE_READONLY)
684 				printf(" readonly");
685 			if (cfe->flags & PCMCIA_CFE_AUDIO)
686 				printf(" audio");
687 
688 			printf("\n");
689 		}
690 	}
691 
692 	if (card->error)
693 		printf("%s: %d errors found while parsing CIS\n",
694 		    sc->dev.dv_xname, card->error);
695 }
696 
697 int
698 pcmcia_parse_cis_tuple(tuple, arg)
699 	struct pcmcia_tuple *tuple;
700 	void *arg;
701 {
702 	/* most of these are educated guesses */
703 	static struct pcmcia_config_entry init_cfe = {
704 		-1, PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
705 		PCMCIA_CFE_BVD_ACTIVE, PCMCIA_IFTYPE_MEMORY,
706 	};
707 
708 	struct cis_state *state = arg;
709 
710 	switch (tuple->code) {
711 	case PCMCIA_CISTPL_END:
712 		/*
713 		 * If we've seen a LONGLINK_MFC, and this is the first
714 		 * END after it, reset the function list.
715 		 *
716 		 * XXX This might also be the right place to start a
717 		 * new function, but that assumes that a function
718 		 * definition never crosses any longlink, and I'm not
719 		 * sure about that.  This is probably safe for MFC
720 		 * cards, but what we have now isn't broken, so I'd
721 		 * rather not change it.
722 		 */
723 		if (state->gotmfc == 1) {
724 			struct pcmcia_function *pf, *pfnext;
725 
726 			for (pf = SIMPLEQ_FIRST(&state->card->pf_head);
727 			    pf != NULL; pf = pfnext) {
728 				pfnext = SIMPLEQ_NEXT(pf, pf_list);
729 				free(pf, M_DEVBUF);
730 			}
731 
732 			SIMPLEQ_INIT(&state->card->pf_head);
733 
734 			state->count = 0;
735 			state->gotmfc = 2;
736 			state->pf = NULL;
737 		}
738 		break;
739 
740 	case PCMCIA_CISTPL_LONGLINK_MFC:
741 		/*
742 		 * This tuple's structure was dealt with in scan_cis.  here,
743 		 * record the fact that the MFC tuple was seen, so that
744 		 * functions declared before the MFC link can be cleaned
745 		 * up.
746 		 */
747 		state->gotmfc = 1;
748 		break;
749 
750 #ifdef PCMCIACISDEBUG
751 	case PCMCIA_CISTPL_DEVICE:
752 	case PCMCIA_CISTPL_DEVICE_A:
753 		{
754 			u_int reg, dtype, dspeed;
755 
756 			reg = pcmcia_tuple_read_1(tuple, 0);
757 			dtype = reg & PCMCIA_DTYPE_MASK;
758 			dspeed = reg & PCMCIA_DSPEED_MASK;
759 
760 			DPRINTF(("CISTPL_DEVICE%s type=",
761 			(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
762 			switch (dtype) {
763 			case PCMCIA_DTYPE_NULL:
764 				DPRINTF(("null"));
765 				break;
766 			case PCMCIA_DTYPE_ROM:
767 				DPRINTF(("rom"));
768 				break;
769 			case PCMCIA_DTYPE_OTPROM:
770 				DPRINTF(("otprom"));
771 				break;
772 			case PCMCIA_DTYPE_EPROM:
773 				DPRINTF(("eprom"));
774 				break;
775 			case PCMCIA_DTYPE_EEPROM:
776 				DPRINTF(("eeprom"));
777 				break;
778 			case PCMCIA_DTYPE_FLASH:
779 				DPRINTF(("flash"));
780 				break;
781 			case PCMCIA_DTYPE_SRAM:
782 				DPRINTF(("sram"));
783 				break;
784 			case PCMCIA_DTYPE_DRAM:
785 				DPRINTF(("dram"));
786 				break;
787 			case PCMCIA_DTYPE_FUNCSPEC:
788 				DPRINTF(("funcspec"));
789 				break;
790 			case PCMCIA_DTYPE_EXTEND:
791 				DPRINTF(("extend"));
792 				break;
793 			default:
794 				DPRINTF(("reserved"));
795 				break;
796 			}
797 			DPRINTF((" speed="));
798 			switch (dspeed) {
799 			case PCMCIA_DSPEED_NULL:
800 				DPRINTF(("null"));
801 				break;
802 			case PCMCIA_DSPEED_250NS:
803 				DPRINTF(("250ns"));
804 				break;
805 			case PCMCIA_DSPEED_200NS:
806 				DPRINTF(("200ns"));
807 				break;
808 			case PCMCIA_DSPEED_150NS:
809 				DPRINTF(("150ns"));
810 				break;
811 			case PCMCIA_DSPEED_100NS:
812 				DPRINTF(("100ns"));
813 				break;
814 			case PCMCIA_DSPEED_EXT:
815 				DPRINTF(("ext"));
816 				break;
817 			default:
818 				DPRINTF(("reserved"));
819 				break;
820 			}
821 		}
822 		DPRINTF(("\n"));
823 		break;
824 #endif
825 
826 	case PCMCIA_CISTPL_VERS_1:
827 		if (tuple->length < 6) {
828 			DPRINTF(("CISTPL_VERS_1 too short %d\n",
829 			    tuple->length));
830 			break;
831 		} {
832 			int start, i, ch, count;
833 
834 			state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
835 			state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
836 
837 			for (count = 0, start = 0, i = 0;
838 			    (count < 4) && ((i + 4) < 256); i++) {
839 				ch = pcmcia_tuple_read_1(tuple, 2 + i);
840 				if (ch == 0xff)
841 					break;
842 				state->card->cis1_info_buf[i] = ch;
843 				if (ch == 0) {
844 					state->card->cis1_info[count] =
845 					    state->card->cis1_info_buf + start;
846 					start = i + 1;
847 					count++;
848 				}
849 			}
850 			DPRINTF(("CISTPL_VERS_1\n"));
851 		}
852 		break;
853 
854 	case PCMCIA_CISTPL_MANFID:
855 		if (tuple->length < 4) {
856 			DPRINTF(("CISTPL_MANFID too short %d\n",
857 			    tuple->length));
858 			break;
859 		}
860 		state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
861 		state->card->product = pcmcia_tuple_read_2(tuple, 2);
862 		DPRINTF(("CISTPL_MANFID\n"));
863 		break;
864 
865 	case PCMCIA_CISTPL_FUNCID:
866 		if (tuple->length < 2) {
867 			DPRINTF(("CISTPL_FUNCID too short %d\n",
868 			    tuple->length));
869 			break;
870 		}
871 
872 		/*
873 		 * As far as I understand this, manufacturers do multifunction
874 		 * cards in various ways.  Sadly enough I do not have the
875 		 * PC-Card standard (donate!) so I can only guess what can
876 		 * be done.
877 		 * The original code implies FUNCID nodes are above CONFIG
878 		 * nodes in the CIS tree, however Xircom does it the other
879 		 * way round, which of course makes things a bit hard.
880 		 * --niklas@openbsd.org
881 		 */
882 		if (state->pf) {
883 			if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
884 				/*
885 				 * This looks like a opportunistic function
886 				 * created by a CONFIG tuple.  Just keep it.
887 				 */
888 			} else {
889 				/*
890 				 * A function is being defined, end it.
891 				 */
892 				state->pf = NULL;
893 			}
894 		}
895 		if (state->pf == NULL) {
896 			state->pf = malloc(sizeof(*state->pf), M_DEVBUF,
897 			    M_NOWAIT | M_ZERO);
898 			if (state->pf == NULL)
899 				panic("pcmcia_parse_cis_tuple");
900 			state->pf->number = state->count++;
901 			state->pf->last_config_index = -1;
902 			SIMPLEQ_INIT(&state->pf->cfe_head);
903 
904 			SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf,
905 			    pf_list);
906 		}
907 		state->pf->function = pcmcia_tuple_read_1(tuple, 0);
908 
909 		DPRINTF(("CISTPL_FUNCID\n"));
910 		break;
911 
912 	case PCMCIA_CISTPL_CONFIG:
913 		if (tuple->length < 3) {
914 			DPRINTF(("CISTPL_CONFIG too short %d\n",
915 			    tuple->length));
916 			break;
917 		} {
918 			u_int reg, rasz, rmsz, rfsz;
919 			int i;
920 
921 			reg = pcmcia_tuple_read_1(tuple, 0);
922 			rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
923 			    PCMCIA_TPCC_RASZ_SHIFT);
924 			rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
925 			    PCMCIA_TPCC_RMSZ_SHIFT);
926 			rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
927 			    PCMCIA_TPCC_RFSZ_SHIFT);
928 
929 			if (tuple->length < 2 + rasz + rmsz + rfsz) {
930 				DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too "
931 				    "short %d\n", rasz, rmsz, rfsz,
932 				    tuple->length));
933 				break;
934 			}
935 			if (state->pf == NULL) {
936 				state->pf = malloc(sizeof(*state->pf),
937 				    M_DEVBUF, M_NOWAIT | M_ZERO);
938 				if (state->pf == NULL)
939 					panic("pcmcia_parse_cis_tuple");
940 				state->pf->number = state->count++;
941 				state->pf->last_config_index = -1;
942 				SIMPLEQ_INIT(&state->pf->cfe_head);
943 
944 				SIMPLEQ_INSERT_TAIL(&state->card->pf_head,
945 				    state->pf, pf_list);
946 
947 				state->pf->function = PCMCIA_FUNCTION_UNSPEC;
948 			}
949 			state->pf->last_config_index =
950 			    pcmcia_tuple_read_1(tuple, 1);
951 
952 			state->pf->ccr_base = 0;
953 			for (i = 0; i < rasz; i++)
954 				state->pf->ccr_base |=
955 				    ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
956 				    (i * 8));
957 
958 			state->pf->ccr_mask = 0;
959 			for (i = 0; i < rmsz; i++)
960 				state->pf->ccr_mask |=
961 				    ((pcmcia_tuple_read_1(tuple,
962 				    2 + rasz + i)) << (i * 8));
963 
964 			/* skip the reserved area and subtuples */
965 
966 			/* reset the default cfe for each cfe list */
967 			state->temp_cfe = init_cfe;
968 			state->default_cfe = &state->temp_cfe;
969 		}
970 		DPRINTF(("CISTPL_CONFIG\n"));
971 		break;
972 
973 	case PCMCIA_CISTPL_CFTABLE_ENTRY:
974 		if (tuple->length < 2) {
975 			DPRINTF(("CISTPL_CFTABLE_ENTRY too short %d\n",
976 			    tuple->length));
977 			break;
978 		} {
979 			int idx, i, j;
980 			u_int reg, reg2;
981 			u_int intface, def, num;
982 			u_int power, timing, iospace, irq, memspace, misc;
983 			struct pcmcia_config_entry *cfe;
984 
985 			idx = 0;
986 
987 			reg = pcmcia_tuple_read_1(tuple, idx);
988 			idx++;
989 			intface = reg & PCMCIA_TPCE_INDX_INTFACE;
990 			def = reg & PCMCIA_TPCE_INDX_DEFAULT;
991 			num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
992 
993 			/*
994 			 * this is a little messy.  Some cards have only a
995 			 * cfentry with the default bit set.  So, as we go
996 			 * through the list, we add new indexes to the queue,
997 			 * and keep a pointer to the last one with the
998 			 * default bit set.  if we see a record with the same
999 			 * index, as the default, we stash the default and
1000 			 * replace the queue entry. otherwise, we just add
1001 			 * new entries to the queue, pointing the default ptr
1002 			 * at them if the default bit is set.  if we get to
1003 			 * the end with the default pointer pointing at a
1004 			 * record which hasn't had a matching index, that's
1005 			 * ok; it just becomes a cfentry like any other.
1006 			 */
1007 
1008 			/*
1009 			 * if the index in the cis differs from the default
1010 			 * cis, create new entry in the queue and start it
1011 			 * with the current default
1012 			 */
1013 			if (state->default_cfe == NULL) {
1014 				DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
1015 				    "default\n"));
1016 				break;
1017 			}
1018 			if (num != state->default_cfe->number) {
1019 				cfe = (struct pcmcia_config_entry *)
1020 				    malloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT);
1021 				if (cfe == NULL)
1022 					panic("pcmcia_parse_cis_tuple");
1023 
1024 				*cfe = *state->default_cfe;
1025 
1026 				SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head,
1027 				    cfe, cfe_list);
1028 
1029 				cfe->number = num;
1030 
1031 				/*
1032 				 * if the default bit is set in the cis, then
1033 				 * point the new default at whatever is being
1034 				 * filled in
1035 				 */
1036 				if (def)
1037 					state->default_cfe = cfe;
1038 			} else {
1039 				/*
1040 				 * the cis index matches the default index,
1041 				 * fill in the default cfentry.  It is
1042 				 * assumed that the cfdefault index is in the
1043 				 * queue.  For it to be otherwise, the cis
1044 				 * index would have to be -1 (initial
1045 				 * condition) which is not possible, or there
1046 				 * would have to be a preceding cis entry
1047 				 * which had the same cis index and had the
1048 				 * default bit unset. Neither condition
1049 				 * should happen.  If it does, this cfentry
1050 				 * is lost (written into temp space), which
1051 				 * is an acceptable failure mode.
1052 				 */
1053 
1054 				cfe = state->default_cfe;
1055 
1056 				/*
1057 				 * if the cis entry does not have the default
1058 				 * bit set, copy the default out of the way
1059 				 * first.
1060 				 */
1061 				if (!def) {
1062 					state->temp_cfe = *state->default_cfe;
1063 					state->default_cfe = &state->temp_cfe;
1064 				}
1065 			}
1066 
1067 			if (intface) {
1068 				reg = pcmcia_tuple_read_1(tuple, idx);
1069 				idx++;
1070 				cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
1071 				    | PCMCIA_CFE_RDYBSY_ACTIVE
1072 				    | PCMCIA_CFE_WP_ACTIVE
1073 				    | PCMCIA_CFE_BVD_ACTIVE);
1074 				if (reg & PCMCIA_TPCE_IF_MWAIT)
1075 					cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
1076 				if (reg & PCMCIA_TPCE_IF_RDYBSY)
1077 					cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
1078 				if (reg & PCMCIA_TPCE_IF_WP)
1079 					cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
1080 				if (reg & PCMCIA_TPCE_IF_BVD)
1081 					cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
1082 				cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
1083 			}
1084 			reg = pcmcia_tuple_read_1(tuple, idx);
1085 			idx++;
1086 
1087 			power = reg & PCMCIA_TPCE_FS_POWER_MASK;
1088 			timing = reg & PCMCIA_TPCE_FS_TIMING;
1089 			iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
1090 			irq = reg & PCMCIA_TPCE_FS_IRQ;
1091 			memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
1092 			misc = reg & PCMCIA_TPCE_FS_MISC;
1093 
1094 			if (power) {
1095 				/* skip over power, don't save */
1096 				/* for each parameter selection byte */
1097 				for (i = 0; i < power; i++) {
1098 					reg = pcmcia_tuple_read_1(tuple, idx);
1099 					idx++;
1100 					/* for each bit */
1101 					for (j = 0; j < 7; j++) {
1102 						/* if the bit is set */
1103 						if ((reg >> j) & 0x01) {
1104 							/* skip over bytes */
1105 							do {
1106 								reg2 = pcmcia_tuple_read_1(tuple, idx);
1107 								idx++;
1108 								/*
1109 								 * until
1110 								 * non-
1111 								 * extension
1112 								 * byte
1113 								 */
1114 							} while (reg2 & 0x80);
1115 						}
1116 					}
1117 				}
1118 			}
1119 			if (timing) {
1120 				/* skip over timing, don't save */
1121 				reg = pcmcia_tuple_read_1(tuple, idx);
1122 				idx++;
1123 
1124 				if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
1125 				    PCMCIA_TPCE_TD_RESERVED_MASK)
1126 					idx++;
1127 				if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
1128 				    PCMCIA_TPCE_TD_RDYBSY_MASK)
1129 					idx++;
1130 				if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
1131 				    PCMCIA_TPCE_TD_WAIT_MASK)
1132 					idx++;
1133 			}
1134 			if (iospace) {
1135 				if (tuple->length <= idx) {
1136 					DPRINTF(("ran out of space before TPCE_IO\n"));
1137 
1138 					goto abort_cfe;
1139 				}
1140 
1141 				reg = pcmcia_tuple_read_1(tuple, idx);
1142 				idx++;
1143 
1144 				cfe->flags &=
1145 				    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
1146 				if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
1147 					cfe->flags |= PCMCIA_CFE_IO8;
1148 				if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
1149 					cfe->flags |= PCMCIA_CFE_IO16;
1150 				cfe->iomask =
1151 				    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
1152 
1153 				if (reg & PCMCIA_TPCE_IO_HASRANGE) {
1154 					reg = pcmcia_tuple_read_1(tuple, idx);
1155 					idx++;
1156 
1157 					cfe->num_iospace = 1 + (reg &
1158 					    PCMCIA_TPCE_IO_RANGE_COUNT);
1159 
1160 					if (cfe->num_iospace >
1161 					    (sizeof(cfe->iospace) /
1162 					     sizeof(cfe->iospace[0]))) {
1163 						DPRINTF(("too many io "
1164 						    "spaces %d",
1165 						    cfe->num_iospace));
1166 						state->card->error++;
1167 						break;
1168 					}
1169 					for (i = 0; i < cfe->num_iospace; i++) {
1170 						switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
1171 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
1172 							cfe->iospace[i].start =
1173 								pcmcia_tuple_read_1(tuple, idx);
1174 							idx++;
1175 							break;
1176 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
1177 							cfe->iospace[i].start =
1178 								pcmcia_tuple_read_2(tuple, idx);
1179 							idx += 2;
1180 							break;
1181 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
1182 							cfe->iospace[i].start =
1183 								pcmcia_tuple_read_4(tuple, idx);
1184 							idx += 4;
1185 							break;
1186 						}
1187 						switch (reg &
1188 							PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
1189 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
1190 							cfe->iospace[i].length =
1191 								pcmcia_tuple_read_1(tuple, idx);
1192 							idx++;
1193 							break;
1194 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
1195 							cfe->iospace[i].length =
1196 								pcmcia_tuple_read_2(tuple, idx);
1197 							idx += 2;
1198 							break;
1199 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
1200 							cfe->iospace[i].length =
1201 								pcmcia_tuple_read_4(tuple, idx);
1202 							idx += 4;
1203 							break;
1204 						}
1205 						cfe->iospace[i].length++;
1206 					}
1207 				} else {
1208 					cfe->num_iospace = 1;
1209 					cfe->iospace[0].start = 0;
1210 					cfe->iospace[0].length =
1211 					    (1 << cfe->iomask);
1212 				}
1213 			}
1214 
1215 			if (irq) {
1216 				if (tuple->length <= idx) {
1217 					DPRINTF(("ran out of space before TPCE_IR\n"));
1218 
1219 					goto abort_cfe;
1220 				}
1221 
1222 				reg = pcmcia_tuple_read_1(tuple, idx);
1223 				idx++;
1224 
1225 				cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
1226 				    | PCMCIA_CFE_IRQPULSE
1227 				    | PCMCIA_CFE_IRQLEVEL);
1228 				if (reg & PCMCIA_TPCE_IR_SHARE)
1229 					cfe->flags |= PCMCIA_CFE_IRQSHARE;
1230 				if (reg & PCMCIA_TPCE_IR_PULSE)
1231 					cfe->flags |= PCMCIA_CFE_IRQPULSE;
1232 				if (reg & PCMCIA_TPCE_IR_LEVEL)
1233 					cfe->flags |= PCMCIA_CFE_IRQLEVEL;
1234 
1235 				if (reg & PCMCIA_TPCE_IR_HASMASK) {
1236 					/*
1237 					 * it's legal to ignore the
1238 					 * special-interrupt bits, so I will
1239 					 */
1240 
1241 					cfe->irqmask =
1242 					    pcmcia_tuple_read_2(tuple, idx);
1243 					idx += 2;
1244 				} else {
1245 					cfe->irqmask =
1246 					    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
1247 				}
1248 			}
1249 			if (memspace) {
1250 				if (tuple->length <= idx) {
1251 					DPRINTF(("ran out of space before TPCE_MS\n"));
1252 					goto abort_cfe;
1253 				}
1254 
1255 				if (memspace == PCMCIA_TPCE_FS_MEMSPACE_NONE) {
1256 					cfe->num_memspace = 0;
1257 				} else if (memspace == PCMCIA_TPCE_FS_MEMSPACE_LENGTH) {
1258 					cfe->num_memspace = 1;
1259 					cfe->memspace[0].length = 256 *
1260 					    pcmcia_tuple_read_2(tuple, idx);
1261 					idx += 2;
1262 					cfe->memspace[0].cardaddr = 0;
1263 					cfe->memspace[0].hostaddr = 0;
1264 				} else if (memspace ==
1265 				    PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR) {
1266 					cfe->num_memspace = 1;
1267 					cfe->memspace[0].length = 256 *
1268 					    pcmcia_tuple_read_2(tuple, idx);
1269 					idx += 2;
1270 					cfe->memspace[0].cardaddr = 256 *
1271 					    pcmcia_tuple_read_2(tuple, idx);
1272 					idx += 2;
1273 					cfe->memspace[0].hostaddr = cfe->memspace[0].cardaddr;
1274 				} else {
1275 					int lengthsize;
1276 					int cardaddrsize;
1277 					int hostaddrsize;
1278 
1279 					reg = pcmcia_tuple_read_1(tuple, idx);
1280 					idx++;
1281 
1282 					cfe->num_memspace = (reg &
1283 					    PCMCIA_TPCE_MS_COUNT) + 1;
1284 
1285 					if (cfe->num_memspace >
1286 					    (sizeof(cfe->memspace) /
1287 					     sizeof(cfe->memspace[0]))) {
1288 						DPRINTF(("too many mem "
1289 						    "spaces %d",
1290 						    cfe->num_memspace));
1291 						state->card->error++;
1292 						break;
1293 					}
1294 					lengthsize =
1295 						((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
1296 						 PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
1297 					cardaddrsize =
1298 						((reg & PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
1299 						 PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
1300 					hostaddrsize =
1301 						(reg & PCMCIA_TPCE_MS_HOSTADDR) ? cardaddrsize : 0;
1302 
1303 					if (lengthsize == 0) {
1304 						DPRINTF(("cfe memspace "
1305 						    "lengthsize == 0"));
1306 						state->card->error++;
1307 					}
1308 					for (i = 0; i < cfe->num_memspace; i++) {
1309 						if (lengthsize) {
1310 							cfe->memspace[i].length =
1311 								256 * pcmcia_tuple_read_n(tuple, lengthsize,
1312 								       idx);
1313 							idx += lengthsize;
1314 						} else {
1315 							cfe->memspace[i].length = 0;
1316 						}
1317 						if (cfe->memspace[i].length == 0) {
1318 							DPRINTF(("cfe->memspace[%d].length == 0",
1319 								 i));
1320 							state->card->error++;
1321 						}
1322 						if (cardaddrsize) {
1323 							cfe->memspace[i].cardaddr =
1324 								256 * pcmcia_tuple_read_n(tuple, cardaddrsize,
1325 								       idx);
1326 							idx += cardaddrsize;
1327 						} else {
1328 							cfe->memspace[i].cardaddr = 0;
1329 						}
1330 						if (hostaddrsize) {
1331 							cfe->memspace[i].hostaddr =
1332 								256 * pcmcia_tuple_read_n(tuple, hostaddrsize,
1333 								       idx);
1334 							idx += hostaddrsize;
1335 						} else {
1336 							cfe->memspace[i].hostaddr = 0;
1337 						}
1338 					}
1339 				}
1340 			}
1341 			if (misc) {
1342 				if (tuple->length <= idx) {
1343 					DPRINTF(("ran out of space before TPCE_MI\n"));
1344 
1345 					goto abort_cfe;
1346 				}
1347 
1348 				reg = pcmcia_tuple_read_1(tuple, idx);
1349 				idx++;
1350 
1351 				cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
1352 				    | PCMCIA_CFE_READONLY
1353 				    | PCMCIA_CFE_AUDIO);
1354 				if (reg & PCMCIA_TPCE_MI_PWRDOWN)
1355 					cfe->flags |= PCMCIA_CFE_POWERDOWN;
1356 				if (reg & PCMCIA_TPCE_MI_READONLY)
1357 					cfe->flags |= PCMCIA_CFE_READONLY;
1358 				if (reg & PCMCIA_TPCE_MI_AUDIO)
1359 					cfe->flags |= PCMCIA_CFE_AUDIO;
1360 				cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
1361 
1362 				while (reg & PCMCIA_TPCE_MI_EXT) {
1363 					reg = pcmcia_tuple_read_1(tuple, idx);
1364 					idx++;
1365 				}
1366 			}
1367 			/* skip all the subtuples */
1368 		}
1369 
1370 	abort_cfe:
1371 		DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
1372 		break;
1373 
1374 	default:
1375 		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
1376 		break;
1377 	}
1378 
1379 	return (0);
1380 }
1381