xref: /openbsd/sys/dev/pcmcia/pcmcia_cis.c (revision 29dd1b42)
1 /*	$OpenBSD: pcmcia_cis.c,v 1.22 2021/03/07 06:20:09 jsg Exp $	*/
2 /*	$NetBSD: pcmcia_cis.c,v 1.9 1998/08/22 23:41:48 msaitoh Exp $	*/
3 
4 /*
5  * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Marc Horowitz.
18  * 4. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/device.h>
36 #include <sys/malloc.h>
37 
38 #include <dev/pcmcia/pcmciareg.h>
39 #include <dev/pcmcia/pcmciachip.h>
40 #include <dev/pcmcia/pcmciavar.h>
41 
42 #ifdef PCMCIACISDEBUG
43 #define	DPRINTF(arg) printf arg
44 #else
45 #define	DPRINTF(arg)
46 #endif
47 
48 #define	PCMCIA_CIS_SIZE		1024
49 
50 struct cis_state {
51 	int	count;
52 	int	gotmfc;
53 	struct pcmcia_config_entry temp_cfe;
54 	struct pcmcia_config_entry *default_cfe;
55 	struct pcmcia_card *card;
56 	struct pcmcia_function *pf;
57 };
58 
59 int	pcmcia_parse_cis_tuple(struct pcmcia_tuple *, void *);
60 
61 uint8_t
pcmcia_cis_read_1(struct pcmcia_tuple * tuple,bus_size_t idx)62 pcmcia_cis_read_1(struct pcmcia_tuple *tuple, bus_size_t idx)
63 {
64 	if (tuple->flags & PTF_INDIRECT) {
65 		bus_space_write_1(tuple->memt, tuple->memh,
66 		    tuple->indirect_ptr + PCMCIA_INDR_CONTROL, PCMCIA_ICR_ATTR);
67 		idx <<= tuple->addrshift;
68 		bus_space_write_1(tuple->memt, tuple->memh,
69 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 0, idx >> 0);
70 		bus_space_write_1(tuple->memt, tuple->memh,
71 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 1, idx >> 8);
72 		bus_space_write_1(tuple->memt, tuple->memh,
73 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 2, idx >> 16);
74 		bus_space_write_1(tuple->memt, tuple->memh,
75 		    tuple->indirect_ptr + PCMCIA_INDR_ADDRESS + 3, idx >> 24);
76 		return bus_space_read_1(tuple->memt, tuple->memh,
77 		    tuple->indirect_ptr + PCMCIA_INDR_DATA);
78 	} else
79 		return bus_space_read_1(tuple->memt, tuple->memh,
80 		    idx << tuple->addrshift);
81 }
82 
83 void
pcmcia_read_cis(struct pcmcia_softc * sc)84 pcmcia_read_cis(struct pcmcia_softc *sc)
85 {
86 	struct cis_state state;
87 
88 	memset(&state, 0, sizeof state);
89 
90 	state.card = &sc->card;
91 
92 	state.card->error = 0;
93 	state.card->cis1_major = -1;
94 	state.card->cis1_minor = -1;
95 	state.card->cis1_info[0] = NULL;
96 	state.card->cis1_info[1] = NULL;
97 	state.card->cis1_info[2] = NULL;
98 	state.card->cis1_info[3] = NULL;
99 	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
100 	state.card->product = PCMCIA_PRODUCT_INVALID;
101 	SIMPLEQ_INIT(&state.card->pf_head);
102 
103 	state.pf = NULL;
104 
105 	if (pcmcia_scan_cis((struct device *)sc, pcmcia_parse_cis_tuple,
106 	    &state) == -1)
107 		state.card->error++;
108 }
109 
110 int
pcmcia_scan_cis(struct device * dev,int (* fct)(struct pcmcia_tuple *,void *),void * arg)111 pcmcia_scan_cis(struct device *dev, int (*fct)(struct pcmcia_tuple *, void *),
112     void *arg)
113 {
114 	struct pcmcia_softc *sc = (struct pcmcia_softc *) dev;
115 	pcmcia_chipset_tag_t pct;
116 	pcmcia_chipset_handle_t pch;
117 	int window;
118 	struct pcmcia_mem_handle pcmh;
119 	struct pcmcia_tuple tuple;
120 	int indirect_present;
121 	int longlink_present;
122 	int longlink_common;
123 	u_long longlink_addr;
124 	int mfc_count;
125 	int mfc_index;
126 	struct {
127 		int	common;
128 		u_long	addr;
129 	} mfc[256 / 5];
130 	int ret;
131 
132 	ret = 0;
133 
134 	pct = sc->pct;
135 	pch = sc->pch;
136 
137 	/* allocate some memory */
138 
139 	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
140 #ifdef DIAGNOSTIC
141 		printf("%s: can't alloc memory to read attributes\n",
142 		    sc->dev.dv_xname);
143 #endif
144 		return -1;
145 	}
146 
147 	/* initialize state for the primary tuple chain */
148 	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
149 	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
150 		pcmcia_chip_mem_free(pct, pch, &pcmh);
151 #ifdef DIAGNOSTIC
152 		printf("%s: can't map memory to read attributes\n",
153 		    sc->dev.dv_xname);
154 #endif
155 		return -1;
156 	}
157 	tuple.memt = pcmh.memt;
158 	tuple.memh = pcmh.memh;
159 
160 	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
161 
162 	tuple.addrshift = 1;
163 	tuple.flags = 0;
164 
165 	indirect_present = 0;
166 	longlink_present = 1;
167 	longlink_common = 1;
168 	longlink_addr = 0;
169 
170 	mfc_count = 0;
171 	mfc_index = 0;
172 
173 	DPRINTF(("%s: CIS tuple chain:\n", sc->dev.dv_xname));
174 
175 	while (1) {
176 		while (1) {
177 			/*
178 			 * Perform boundary check for insane cards.
179 			 * If CIS is too long, simulate CIS end.
180 			 * (This check may not be sufficient for
181 			 * malicious cards.)
182 			 */
183 			if ((tuple.ptr << tuple.addrshift) >=
184 			    PCMCIA_CIS_SIZE - 1 - 32 /* ad hoc value */) {
185 				DPRINTF(("CISTPL_END (too long CIS)\n"));
186 				tuple.code = PCMCIA_CISTPL_END;
187 				goto cis_end;
188 			}
189 
190 			/* get the tuple code */
191 
192 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
193 
194 			/* two special-case tuples */
195 
196 			if (tuple.code == PCMCIA_CISTPL_NULL) {
197 				DPRINTF(("CISTPL_NONE\n 00\n"));
198 				tuple.ptr++;
199 				continue;
200 			} else if (tuple.code == PCMCIA_CISTPL_END) {
201 				DPRINTF(("CISTPL_END\n ff\n"));
202 			cis_end:
203 				/* Call the function for the END tuple, since
204 				   the CIS semantics depend on it */
205 				if ((*fct) (&tuple, arg)) {
206 					pcmcia_chip_mem_unmap(pct, pch,
207 							      window);
208 					ret = 1;
209 					goto done;
210 				}
211 				tuple.ptr++;
212 				break;
213 			}
214 			/* now all the normal tuples */
215 
216 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
217 			switch (tuple.code) {
218 			case PCMCIA_CISTPL_INDIRECT:
219 				indirect_present = 1;
220 				DPRINTF(("CISTPL_INDIRECT\n"));
221 				break;
222 			case PCMCIA_CISTPL_LONGLINK_A:
223 			case PCMCIA_CISTPL_LONGLINK_C:
224 				if (tuple.length < 4) {
225 					DPRINTF(("CISTPL_LONGLINK_%s too "
226 					    "short %d\n",
227 					    longlink_common ? "C" : "A",
228 					    tuple.length));
229 					break;
230 				}
231 				longlink_present = 1;
232 				longlink_common = (tuple.code ==
233 				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
234 				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
235 				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
236 				    longlink_common ? "C" : "A",
237 				    longlink_addr));
238 				break;
239 			case PCMCIA_CISTPL_NO_LINK:
240 				longlink_present = 0;
241 				DPRINTF(("CISTPL_NO_LINK\n"));
242 				break;
243 			case PCMCIA_CISTPL_CHECKSUM:
244 				if (tuple.length < 5) {
245 					DPRINTF(("CISTPL_CHECKSUM too "
246 					    "short %d\n", tuple.length));
247 					break;
248 				} {
249 					int16_t offset;
250 					u_long addr, length;
251 					u_int cksum, sum;
252 					int i;
253 
254 					*((u_int16_t *) & offset) =
255 					    pcmcia_tuple_read_2(&tuple, 0);
256 					length = pcmcia_tuple_read_2(&tuple, 2);
257 					cksum = pcmcia_tuple_read_1(&tuple, 4);
258 
259 					addr = tuple.ptr + offset;
260 
261 					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
262 					    "len=%lx cksum=%x",
263 					    addr, length, cksum));
264 
265 					/*
266 					 * XXX do more work to deal with
267 					 * distant regions
268 					 */
269 					if ((addr >= PCMCIA_CIS_SIZE) ||
270 					    ((addr + length) >=
271 					      PCMCIA_CIS_SIZE)) {
272 						DPRINTF((" skipped, "
273 						    "too distant\n"));
274 						break;
275 					}
276 					sum = 0;
277 					for (i = 0; i < length; i++)
278 						sum += pcmcia_cis_read_1(&tuple,
279 						    addr + i);
280 					if (cksum != (sum & 0xff)) {
281 						DPRINTF((" failed sum=%x\n",
282 						    sum));
283 						printf("%s: CIS checksum "
284 						    "failed\n",
285 						    sc->dev.dv_xname);
286 #if 0
287 						/*
288 						 * XXX Some working cards have
289 						 * XXX bad checksums!!
290 						 */
291 						ret = -1;
292 #endif
293 					} else {
294 						DPRINTF((" ok\n"));
295 					}
296 				}
297 				break;
298 			case PCMCIA_CISTPL_LONGLINK_MFC:
299 				if (tuple.length < 6) {
300 					DPRINTF(("CISTPL_LONGLINK_MFC too "
301 					    "short %d\n", tuple.length));
302 					break;
303 				}
304 				if (((tuple.length - 1) % 5) != 0) {
305 					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
306 					    "length %d\n", tuple.length));
307 					break;
308 				}
309 				{
310 					int i, tmp_count;
311 
312 					/*
313 					 * put count into tmp var so that
314 					 * if we have to bail (because it's
315 					 * a bogus count) it won't be
316 					 * remembered for later use.
317 					 */
318 					tmp_count =
319 					    pcmcia_tuple_read_1(&tuple, 0);
320 					DPRINTF(("CISTPL_LONGLINK_MFC %d",
321 					    tmp_count));
322 
323 					/*
324 					 * make _sure_ it's the right size;
325 					 * if too short, it may be a weird
326 					 * (unknown/undefined) format
327 					 */
328 					if (tuple.length != (tmp_count*5 + 1)) {
329 						DPRINTF((" bogus length %d\n",
330 						    tuple.length));
331 						break;
332 					}
333 
334 #ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
335 					/*
336 					 * sanity check for a programming
337 					 * error which is difficult to find
338 					 * when debugging.
339 					 */
340 					if (tmp_count >
341 					    howmany(sizeof mfc, sizeof mfc[0]))
342 						panic("CISTPL_LONGLINK_MFC mfc "
343 						    "count would blow stack");
344 #endif
345 
346 					mfc_count = tmp_count;
347 					for (i = 0; i < mfc_count; i++) {
348 						mfc[i].common =
349 						    (pcmcia_tuple_read_1(&tuple,
350 						    1 + 5 * i) ==
351 						    PCMCIA_MFC_MEM_COMMON) ?
352 						    1 : 0;
353 						mfc[i].addr =
354 						    pcmcia_tuple_read_4(&tuple,
355 						    1 + 5 * i + 1);
356 						DPRINTF((" %s:%lx",
357 						    mfc[i].common ? "common" :
358 						    "attr", mfc[i].addr));
359 					}
360 					DPRINTF(("\n"));
361 				}
362 				/*
363 				 * for LONGLINK_MFC, fall through to the
364 				 * function.  This tuple has structural and
365 				 * semantic content.
366 				 */
367 			default:
368 				{
369 					if ((*fct) (&tuple, arg)) {
370 						pcmcia_chip_mem_unmap(pct,
371 						    pch, window);
372 						ret = 1;
373 						goto done;
374 					}
375 				}
376 				break;
377 			}	/* switch */
378 #ifdef PCMCIACISDEBUG
379 			/* print the tuple */
380 			{
381 				int i;
382 
383 				DPRINTF((" %02x %02x", tuple.code,
384 				    tuple.length));
385 
386 				for (i = 0; i < tuple.length; i++) {
387 					DPRINTF((" %02x",
388 					    pcmcia_tuple_read_1(&tuple, i)));
389 					if ((i % 16) == 13)
390 						DPRINTF(("\n"));
391 				}
392 				if ((i % 16) != 14)
393 					DPRINTF(("\n"));
394 			}
395 #endif
396 			/* skip to the next tuple */
397 			tuple.ptr += 2 + tuple.length;
398 		}
399 
400 		/*
401 		 * the chain is done.  Clean up and move onto the next one,
402 		 * if any.  The loop is here in the case that there is an MFC
403 		 * card with no longlink (which defaults to existing, == 0).
404 		 * In general, this means that if one pointer fails, it will
405 		 * try the next one, instead of just bailing.
406 		 */
407 
408 		while (1) {
409 			pcmcia_chip_mem_unmap(pct, pch, window);
410 
411 			if (indirect_present) {
412 				/*
413 				 * Indirect CIS data needs to be obtained
414 				 * from specific registers accessible at
415 				 * a fixed location in the common window,
416 				 * but otherwise is similar to longlink
417 				 * in attribute memory.
418 				 */
419 
420 				pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_COMMON,
421 				    0, PCMCIA_INDR_SIZE,
422 				    &pcmh, &tuple.indirect_ptr, &window);
423 
424 				DPRINTF(("cis mem map %x ind %x\n",
425 				    (unsigned int) tuple.memh,
426 				    (unsigned int) tuple.indirect_ptr));
427 
428 				tuple.addrshift = 1;
429 				tuple.flags |= PTF_INDIRECT;
430 				tuple.ptr = 0;
431 				longlink_present = 0;
432 				indirect_present = 0;
433 			} else if (longlink_present) {
434 				/*
435 				 * if the longlink is to attribute memory,
436 				 * then it is unindexed.  That is, if the
437 				 * link value is 0x100, then the actual
438 				 * memory address is 0x200.  This means that
439 				 * we need to multiply by 2 before calling
440 				 * mem_map, and then divide the resulting ptr
441 				 * by 2 after.
442 				 */
443 
444 				if (!longlink_common)
445 					longlink_addr *= 2;
446 
447 				pcmcia_chip_mem_map(pct, pch, longlink_common ?
448 				    PCMCIA_MEM_COMMON : PCMCIA_MEM_ATTR,
449 				    longlink_addr, PCMCIA_CIS_SIZE,
450 				    &pcmh, &tuple.ptr, &window);
451 
452 				if (!longlink_common)
453 					tuple.ptr /= 2;
454 
455 				DPRINTF(("cis mem map %x\n",
456 				    (unsigned int) tuple.memh));
457 
458 				tuple.addrshift = longlink_common ? 0 : 1;
459 				longlink_present = 0;
460 				longlink_common = 1;
461 				longlink_addr = 0;
462 			} else if (mfc_count && (mfc_index < mfc_count)) {
463 				if (!mfc[mfc_index].common)
464 					mfc[mfc_index].addr *= 2;
465 
466 				pcmcia_chip_mem_map(pct, pch,
467 				    mfc[mfc_index].common ?
468 				    PCMCIA_MEM_COMMON : PCMCIA_MEM_ATTR,
469 				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
470 				    &pcmh, &tuple.ptr, &window);
471 
472 				if (!mfc[mfc_index].common)
473 					tuple.ptr /= 2;
474 
475 				DPRINTF(("cis mem map %x\n",
476 				    (unsigned int) tuple.memh));
477 
478 				/* set parse state, and point at the next one */
479 
480 				tuple.addrshift = mfc[mfc_index].common ? 0 : 1;
481 
482 				mfc_index++;
483 			} else {
484 				goto done;
485 			}
486 
487 			/* make sure that the link is valid */
488 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
489 			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
490 				DPRINTF(("CISTPL_LINKTARGET expected, "
491 				    "code %02x observed\n", tuple.code));
492 				continue;
493 			}
494 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
495 			if (tuple.length < 3) {
496 				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
497 				    tuple.length));
498 				continue;
499 			}
500 			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
501 			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
502 			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
503 				DPRINTF(("CISTPL_LINKTARGET magic "
504 				    "%02x%02x%02x incorrect\n",
505 				    pcmcia_tuple_read_1(&tuple, 0),
506 				    pcmcia_tuple_read_1(&tuple, 1),
507 				    pcmcia_tuple_read_1(&tuple, 2)));
508 				continue;
509 			}
510 			tuple.ptr += 2 + tuple.length;
511 
512 			break;
513 		}
514 	}
515 
516 	pcmcia_chip_mem_unmap(pct, pch, window);
517 
518 done:
519 	/* Last, free the allocated memory block */
520 	pcmcia_chip_mem_free(pct, pch, &pcmh);
521 
522 	return (ret);
523 }
524 
525 /* XXX this is incredibly verbose.  Not sure what trt is */
526 
527 void
pcmcia_print_cis(struct pcmcia_softc * sc)528 pcmcia_print_cis(struct pcmcia_softc *sc)
529 {
530 	struct pcmcia_card *card = &sc->card;
531 	struct pcmcia_function *pf;
532 	struct pcmcia_config_entry *cfe;
533 	int i;
534 
535 	printf("%s: CIS version ", sc->dev.dv_xname);
536 	if (card->cis1_major == 4) {
537 		if (card->cis1_minor == 0)
538 			printf("PCMCIA 1.0\n");
539 		else if (card->cis1_minor == 1)
540 			printf("PCMCIA 2.0 or 2.1\n");
541 	} else if (card->cis1_major >= 5)
542 		printf("PC Card Standard %d.%d\n", card->cis1_major,
543 		    card->cis1_minor);
544 	else
545 		printf("unknown (major=%d, minor=%d)\n",
546 		    card->cis1_major, card->cis1_minor);
547 
548 	printf("%s: CIS info: ", sc->dev.dv_xname);
549 	for (i = 0; i < 4; i++) {
550 		if (card->cis1_info[i] == NULL)
551 			break;
552 		if (i)
553 			printf(", ");
554 		printf("%s", card->cis1_info[i]);
555 	}
556 	printf("\n");
557 
558 	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
559 	       sc->dev.dv_xname, card->manufacturer, card->product);
560 
561 	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
562 		printf("%s: function %d: ", sc->dev.dv_xname, pf->number);
563 
564 		switch (pf->function) {
565 		case PCMCIA_FUNCTION_UNSPEC:
566 			printf("unspecified");
567 			break;
568 		case PCMCIA_FUNCTION_MULTIFUNCTION:
569 			printf("multi-function");
570 			break;
571 		case PCMCIA_FUNCTION_MEMORY:
572 			printf("memory");
573 			break;
574 		case PCMCIA_FUNCTION_SERIAL:
575 			printf("serial port");
576 			break;
577 		case PCMCIA_FUNCTION_PARALLEL:
578 			printf("parallel port");
579 			break;
580 		case PCMCIA_FUNCTION_DISK:
581 			printf("fixed disk");
582 			break;
583 		case PCMCIA_FUNCTION_VIDEO:
584 			printf("video adapter");
585 			break;
586 		case PCMCIA_FUNCTION_NETWORK:
587 			printf("network adapter");
588 			break;
589 		case PCMCIA_FUNCTION_AIMS:
590 			printf("auto incrementing mass storage");
591 			break;
592 		case PCMCIA_FUNCTION_SCSI:
593 			printf("SCSI bridge");
594 			break;
595 		case PCMCIA_FUNCTION_SECURITY:
596 			printf("Security services");
597 			break;
598 		case PCMCIA_FUNCTION_INSTRUMENT:
599 			printf("Instrument");
600 			break;
601 		case PCMCIA_FUNCTION_IOBUS:
602 			printf("Serial I/O Bus Adapter");
603 			break;
604 		default:
605 			printf("unknown (%d)", pf->function);
606 			break;
607 		}
608 
609 		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
610 
611 		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
612 			printf("%s: function %d, config table entry %d: ",
613 			    sc->dev.dv_xname, pf->number, cfe->number);
614 
615 			switch (cfe->iftype) {
616 			case PCMCIA_IFTYPE_MEMORY:
617 				printf("memory card");
618 				break;
619 			case PCMCIA_IFTYPE_IO:
620 				printf("I/O card");
621 				break;
622 			default:
623 				printf("card type unknown");
624 				break;
625 			}
626 
627 			printf("; irq mask %x", cfe->irqmask);
628 
629 			if (cfe->num_iospace) {
630 				printf("; iomask %lx, iospace", cfe->iomask);
631 
632 				for (i = 0; i < cfe->num_iospace; i++)
633 					printf(" %lx%s%lx",
634 					    cfe->iospace[i].start,
635 					    cfe->iospace[i].length ? "-" : "",
636 					    cfe->iospace[i].start +
637 					      cfe->iospace[i].length - 1);
638 			}
639 			if (cfe->num_memspace) {
640 				printf("; memspace");
641 
642 				for (i = 0; i < cfe->num_memspace; i++)
643 					printf(" %lx%s%lx%s%lx",
644 					    cfe->memspace[i].cardaddr,
645 					    cfe->memspace[i].length ? "-" : "",
646 					    cfe->memspace[i].cardaddr +
647 					      cfe->memspace[i].length - 1,
648 					    cfe->memspace[i].hostaddr ?
649 					      "@" : "",
650 					    cfe->memspace[i].hostaddr);
651 			}
652 			if (cfe->maxtwins)
653 				printf("; maxtwins %d", cfe->maxtwins);
654 
655 			printf(";");
656 
657 			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
658 				printf(" mwait_required");
659 			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
660 				printf(" rdybsy_active");
661 			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
662 				printf(" wp_active");
663 			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
664 				printf(" bvd_active");
665 			if (cfe->flags & PCMCIA_CFE_IO8)
666 				printf(" io8");
667 			if (cfe->flags & PCMCIA_CFE_IO16)
668 				printf(" io16");
669 			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
670 				printf(" irqshare");
671 			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
672 				printf(" irqpulse");
673 			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
674 				printf(" irqlevel");
675 			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
676 				printf(" powerdown");
677 			if (cfe->flags & PCMCIA_CFE_READONLY)
678 				printf(" readonly");
679 			if (cfe->flags & PCMCIA_CFE_AUDIO)
680 				printf(" audio");
681 
682 			printf("\n");
683 		}
684 	}
685 
686 	if (card->error)
687 		printf("%s: %d errors found while parsing CIS\n",
688 		    sc->dev.dv_xname, card->error);
689 }
690 
691 int
pcmcia_parse_cis_tuple(struct pcmcia_tuple * tuple,void * arg)692 pcmcia_parse_cis_tuple(struct pcmcia_tuple *tuple, void *arg)
693 {
694 	/* most of these are educated guesses */
695 	static struct pcmcia_config_entry init_cfe = {
696 		-1, PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
697 		PCMCIA_CFE_BVD_ACTIVE, PCMCIA_IFTYPE_MEMORY,
698 	};
699 
700 	struct cis_state *state = arg;
701 
702 	switch (tuple->code) {
703 	case PCMCIA_CISTPL_END:
704 		/*
705 		 * If we've seen a LONGLINK_MFC, and this is the first
706 		 * END after it, reset the function list.
707 		 *
708 		 * XXX This might also be the right place to start a
709 		 * new function, but that assumes that a function
710 		 * definition never crosses any longlink, and I'm not
711 		 * sure about that.  This is probably safe for MFC
712 		 * cards, but what we have now isn't broken, so I'd
713 		 * rather not change it.
714 		 */
715 		if (state->gotmfc == 1) {
716 			struct pcmcia_function *pf, *pfnext;
717 
718 			for (pf = SIMPLEQ_FIRST(&state->card->pf_head);
719 			    pf != NULL; pf = pfnext) {
720 				pfnext = SIMPLEQ_NEXT(pf, pf_list);
721 				free(pf, M_DEVBUF, 0);
722 			}
723 
724 			SIMPLEQ_INIT(&state->card->pf_head);
725 
726 			state->count = 0;
727 			state->gotmfc = 2;
728 			state->pf = NULL;
729 		}
730 		break;
731 
732 	case PCMCIA_CISTPL_LONGLINK_MFC:
733 		/*
734 		 * This tuple's structure was dealt with in scan_cis.  here,
735 		 * record the fact that the MFC tuple was seen, so that
736 		 * functions declared before the MFC link can be cleaned
737 		 * up.
738 		 */
739 		state->gotmfc = 1;
740 		break;
741 
742 #ifdef PCMCIACISDEBUG
743 	case PCMCIA_CISTPL_DEVICE:
744 	case PCMCIA_CISTPL_DEVICE_A:
745 		{
746 			u_int reg, dtype, dspeed;
747 
748 			reg = pcmcia_tuple_read_1(tuple, 0);
749 			dtype = reg & PCMCIA_DTYPE_MASK;
750 			dspeed = reg & PCMCIA_DSPEED_MASK;
751 
752 			DPRINTF(("CISTPL_DEVICE%s type=",
753 			(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
754 			switch (dtype) {
755 			case PCMCIA_DTYPE_NULL:
756 				DPRINTF(("null"));
757 				break;
758 			case PCMCIA_DTYPE_ROM:
759 				DPRINTF(("rom"));
760 				break;
761 			case PCMCIA_DTYPE_OTPROM:
762 				DPRINTF(("otprom"));
763 				break;
764 			case PCMCIA_DTYPE_EPROM:
765 				DPRINTF(("eprom"));
766 				break;
767 			case PCMCIA_DTYPE_EEPROM:
768 				DPRINTF(("eeprom"));
769 				break;
770 			case PCMCIA_DTYPE_FLASH:
771 				DPRINTF(("flash"));
772 				break;
773 			case PCMCIA_DTYPE_SRAM:
774 				DPRINTF(("sram"));
775 				break;
776 			case PCMCIA_DTYPE_DRAM:
777 				DPRINTF(("dram"));
778 				break;
779 			case PCMCIA_DTYPE_FUNCSPEC:
780 				DPRINTF(("funcspec"));
781 				break;
782 			case PCMCIA_DTYPE_EXTEND:
783 				DPRINTF(("extend"));
784 				break;
785 			default:
786 				DPRINTF(("reserved"));
787 				break;
788 			}
789 			DPRINTF((" speed="));
790 			switch (dspeed) {
791 			case PCMCIA_DSPEED_NULL:
792 				DPRINTF(("null"));
793 				break;
794 			case PCMCIA_DSPEED_250NS:
795 				DPRINTF(("250ns"));
796 				break;
797 			case PCMCIA_DSPEED_200NS:
798 				DPRINTF(("200ns"));
799 				break;
800 			case PCMCIA_DSPEED_150NS:
801 				DPRINTF(("150ns"));
802 				break;
803 			case PCMCIA_DSPEED_100NS:
804 				DPRINTF(("100ns"));
805 				break;
806 			case PCMCIA_DSPEED_EXT:
807 				DPRINTF(("ext"));
808 				break;
809 			default:
810 				DPRINTF(("reserved"));
811 				break;
812 			}
813 		}
814 		DPRINTF(("\n"));
815 		break;
816 #endif
817 
818 	case PCMCIA_CISTPL_VERS_1:
819 		if (tuple->length < 6) {
820 			DPRINTF(("CISTPL_VERS_1 too short %d\n",
821 			    tuple->length));
822 			break;
823 		} {
824 			int start, i, ch, count;
825 
826 			state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
827 			state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
828 
829 			for (count = 0, start = 0, i = 0;
830 			    (count < 4) && ((i + 4) < 256); i++) {
831 				ch = pcmcia_tuple_read_1(tuple, 2 + i);
832 				if (ch == 0xff)
833 					break;
834 				state->card->cis1_info_buf[i] = ch;
835 				if (ch == 0) {
836 					state->card->cis1_info[count] =
837 					    state->card->cis1_info_buf + start;
838 					start = i + 1;
839 					count++;
840 				}
841 			}
842 			DPRINTF(("CISTPL_VERS_1\n"));
843 		}
844 		break;
845 
846 	case PCMCIA_CISTPL_MANFID:
847 		if (tuple->length < 4) {
848 			DPRINTF(("CISTPL_MANFID too short %d\n",
849 			    tuple->length));
850 			break;
851 		}
852 		state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
853 		state->card->product = pcmcia_tuple_read_2(tuple, 2);
854 		DPRINTF(("CISTPL_MANFID\n"));
855 		break;
856 
857 	case PCMCIA_CISTPL_FUNCID:
858 		if (tuple->length < 2) {
859 			DPRINTF(("CISTPL_FUNCID too short %d\n",
860 			    tuple->length));
861 			break;
862 		}
863 
864 		/*
865 		 * As far as I understand this, manufacturers do multifunction
866 		 * cards in various ways.  Sadly enough I do not have the
867 		 * PC-Card standard (donate!) so I can only guess what can
868 		 * be done.
869 		 * The original code implies FUNCID nodes are above CONFIG
870 		 * nodes in the CIS tree, however Xircom does it the other
871 		 * way round, which of course makes things a bit hard.
872 		 * --niklas@openbsd.org
873 		 */
874 		if (state->pf) {
875 			if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
876 				/*
877 				 * This looks like a opportunistic function
878 				 * created by a CONFIG tuple.  Just keep it.
879 				 */
880 			} else {
881 				/*
882 				 * A function is being defined, end it.
883 				 */
884 				state->pf = NULL;
885 			}
886 		}
887 		if (state->pf == NULL) {
888 			state->pf = malloc(sizeof(*state->pf), M_DEVBUF,
889 			    M_NOWAIT | M_ZERO);
890 			if (state->pf == NULL)
891 				panic("pcmcia_parse_cis_tuple");
892 			state->pf->number = state->count++;
893 			state->pf->last_config_index = -1;
894 			SIMPLEQ_INIT(&state->pf->cfe_head);
895 
896 			SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf,
897 			    pf_list);
898 		}
899 		state->pf->function = pcmcia_tuple_read_1(tuple, 0);
900 
901 		DPRINTF(("CISTPL_FUNCID\n"));
902 		break;
903 
904 	case PCMCIA_CISTPL_CONFIG:
905 		if (tuple->length < 3) {
906 			DPRINTF(("CISTPL_CONFIG too short %d\n",
907 			    tuple->length));
908 			break;
909 		} {
910 			u_int reg, rasz, rmsz, rfsz;
911 			int i;
912 
913 			reg = pcmcia_tuple_read_1(tuple, 0);
914 			rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
915 			    PCMCIA_TPCC_RASZ_SHIFT);
916 			rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
917 			    PCMCIA_TPCC_RMSZ_SHIFT);
918 			rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
919 			    PCMCIA_TPCC_RFSZ_SHIFT);
920 
921 			if (tuple->length < 2 + rasz + rmsz + rfsz) {
922 				DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too "
923 				    "short %d\n", rasz, rmsz, rfsz,
924 				    tuple->length));
925 				break;
926 			}
927 			if (state->pf == NULL) {
928 				state->pf = malloc(sizeof(*state->pf),
929 				    M_DEVBUF, M_NOWAIT | M_ZERO);
930 				if (state->pf == NULL)
931 					panic("pcmcia_parse_cis_tuple");
932 				state->pf->number = state->count++;
933 				state->pf->last_config_index = -1;
934 				SIMPLEQ_INIT(&state->pf->cfe_head);
935 
936 				SIMPLEQ_INSERT_TAIL(&state->card->pf_head,
937 				    state->pf, pf_list);
938 
939 				state->pf->function = PCMCIA_FUNCTION_UNSPEC;
940 			}
941 			state->pf->last_config_index =
942 			    pcmcia_tuple_read_1(tuple, 1);
943 
944 			state->pf->ccr_base = 0;
945 			for (i = 0; i < rasz; i++)
946 				state->pf->ccr_base |=
947 				    ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
948 				    (i * 8));
949 
950 			state->pf->ccr_mask = 0;
951 			for (i = 0; i < rmsz; i++)
952 				state->pf->ccr_mask |=
953 				    ((pcmcia_tuple_read_1(tuple,
954 				    2 + rasz + i)) << (i * 8));
955 
956 			/* skip the reserved area and subtuples */
957 
958 			/* reset the default cfe for each cfe list */
959 			state->temp_cfe = init_cfe;
960 			state->default_cfe = &state->temp_cfe;
961 		}
962 		DPRINTF(("CISTPL_CONFIG\n"));
963 		break;
964 
965 	case PCMCIA_CISTPL_CFTABLE_ENTRY:
966 		if (tuple->length < 2) {
967 			DPRINTF(("CISTPL_CFTABLE_ENTRY too short %d\n",
968 			    tuple->length));
969 			break;
970 		} {
971 			int idx, i, j;
972 			u_int reg, reg2;
973 			u_int intface, def, num;
974 			u_int power, timing, iospace, irq, memspace, misc;
975 			struct pcmcia_config_entry *cfe;
976 
977 			idx = 0;
978 
979 			reg = pcmcia_tuple_read_1(tuple, idx);
980 			idx++;
981 			intface = reg & PCMCIA_TPCE_INDX_INTFACE;
982 			def = reg & PCMCIA_TPCE_INDX_DEFAULT;
983 			num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
984 
985 			/*
986 			 * this is a little messy.  Some cards have only a
987 			 * cfentry with the default bit set.  So, as we go
988 			 * through the list, we add new indexes to the queue,
989 			 * and keep a pointer to the last one with the
990 			 * default bit set.  if we see a record with the same
991 			 * index, as the default, we stash the default and
992 			 * replace the queue entry. otherwise, we just add
993 			 * new entries to the queue, pointing the default ptr
994 			 * at them if the default bit is set.  if we get to
995 			 * the end with the default pointer pointing at a
996 			 * record which hasn't had a matching index, that's
997 			 * ok; it just becomes a cfentry like any other.
998 			 */
999 
1000 			/*
1001 			 * if the index in the cis differs from the default
1002 			 * cis, create new entry in the queue and start it
1003 			 * with the current default
1004 			 */
1005 			if (state->default_cfe == NULL) {
1006 				DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
1007 				    "default\n"));
1008 				break;
1009 			}
1010 			if (num != state->default_cfe->number) {
1011 				cfe = (struct pcmcia_config_entry *)
1012 				    malloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT);
1013 				if (cfe == NULL)
1014 					panic("pcmcia_parse_cis_tuple");
1015 
1016 				*cfe = *state->default_cfe;
1017 
1018 				SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head,
1019 				    cfe, cfe_list);
1020 
1021 				cfe->number = num;
1022 
1023 				/*
1024 				 * if the default bit is set in the cis, then
1025 				 * point the new default at whatever is being
1026 				 * filled in
1027 				 */
1028 				if (def)
1029 					state->default_cfe = cfe;
1030 			} else {
1031 				/*
1032 				 * the cis index matches the default index,
1033 				 * fill in the default cfentry.  It is
1034 				 * assumed that the cfdefault index is in the
1035 				 * queue.  For it to be otherwise, the cis
1036 				 * index would have to be -1 (initial
1037 				 * condition) which is not possible, or there
1038 				 * would have to be a preceding cis entry
1039 				 * which had the same cis index and had the
1040 				 * default bit unset. Neither condition
1041 				 * should happen.  If it does, this cfentry
1042 				 * is lost (written into temp space), which
1043 				 * is an acceptable failure mode.
1044 				 */
1045 
1046 				cfe = state->default_cfe;
1047 
1048 				/*
1049 				 * if the cis entry does not have the default
1050 				 * bit set, copy the default out of the way
1051 				 * first.
1052 				 */
1053 				if (!def) {
1054 					state->temp_cfe = *state->default_cfe;
1055 					state->default_cfe = &state->temp_cfe;
1056 				}
1057 			}
1058 
1059 			if (intface) {
1060 				reg = pcmcia_tuple_read_1(tuple, idx);
1061 				idx++;
1062 				cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
1063 				    | PCMCIA_CFE_RDYBSY_ACTIVE
1064 				    | PCMCIA_CFE_WP_ACTIVE
1065 				    | PCMCIA_CFE_BVD_ACTIVE);
1066 				if (reg & PCMCIA_TPCE_IF_MWAIT)
1067 					cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
1068 				if (reg & PCMCIA_TPCE_IF_RDYBSY)
1069 					cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
1070 				if (reg & PCMCIA_TPCE_IF_WP)
1071 					cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
1072 				if (reg & PCMCIA_TPCE_IF_BVD)
1073 					cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
1074 				cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
1075 			}
1076 			reg = pcmcia_tuple_read_1(tuple, idx);
1077 			idx++;
1078 
1079 			power = reg & PCMCIA_TPCE_FS_POWER_MASK;
1080 			timing = reg & PCMCIA_TPCE_FS_TIMING;
1081 			iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
1082 			irq = reg & PCMCIA_TPCE_FS_IRQ;
1083 			memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
1084 			misc = reg & PCMCIA_TPCE_FS_MISC;
1085 
1086 			if (power) {
1087 				/* skip over power, don't save */
1088 				/* for each parameter selection byte */
1089 				for (i = 0; i < power; i++) {
1090 					reg = pcmcia_tuple_read_1(tuple, idx);
1091 					idx++;
1092 					/* for each bit */
1093 					for (j = 0; j < 7; j++) {
1094 						/* if the bit is set */
1095 						if ((reg >> j) & 0x01) {
1096 							/* skip over bytes */
1097 							do {
1098 								reg2 = pcmcia_tuple_read_1(tuple, idx);
1099 								idx++;
1100 								/*
1101 								 * until
1102 								 * non-
1103 								 * extension
1104 								 * byte
1105 								 */
1106 							} while (reg2 & 0x80);
1107 						}
1108 					}
1109 				}
1110 			}
1111 			if (timing) {
1112 				/* skip over timing, don't save */
1113 				reg = pcmcia_tuple_read_1(tuple, idx);
1114 				idx++;
1115 
1116 				if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
1117 				    PCMCIA_TPCE_TD_RESERVED_MASK)
1118 					idx++;
1119 				if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
1120 				    PCMCIA_TPCE_TD_RDYBSY_MASK)
1121 					idx++;
1122 				if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
1123 				    PCMCIA_TPCE_TD_WAIT_MASK)
1124 					idx++;
1125 			}
1126 			if (iospace) {
1127 				if (tuple->length <= idx) {
1128 					DPRINTF(("ran out of space before TPCE_IO\n"));
1129 
1130 					goto abort_cfe;
1131 				}
1132 
1133 				reg = pcmcia_tuple_read_1(tuple, idx);
1134 				idx++;
1135 
1136 				cfe->flags &=
1137 				    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
1138 				if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
1139 					cfe->flags |= PCMCIA_CFE_IO8;
1140 				if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
1141 					cfe->flags |= PCMCIA_CFE_IO16;
1142 				cfe->iomask =
1143 				    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
1144 
1145 				if (reg & PCMCIA_TPCE_IO_HASRANGE) {
1146 					reg = pcmcia_tuple_read_1(tuple, idx);
1147 					idx++;
1148 
1149 					cfe->num_iospace = 1 + (reg &
1150 					    PCMCIA_TPCE_IO_RANGE_COUNT);
1151 
1152 					if (cfe->num_iospace >
1153 					    (sizeof(cfe->iospace) /
1154 					     sizeof(cfe->iospace[0]))) {
1155 						DPRINTF(("too many io "
1156 						    "spaces %d",
1157 						    cfe->num_iospace));
1158 						state->card->error++;
1159 						break;
1160 					}
1161 					for (i = 0; i < cfe->num_iospace; i++) {
1162 						switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
1163 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
1164 							cfe->iospace[i].start =
1165 								pcmcia_tuple_read_1(tuple, idx);
1166 							idx++;
1167 							break;
1168 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
1169 							cfe->iospace[i].start =
1170 								pcmcia_tuple_read_2(tuple, idx);
1171 							idx += 2;
1172 							break;
1173 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
1174 							cfe->iospace[i].start =
1175 								pcmcia_tuple_read_4(tuple, idx);
1176 							idx += 4;
1177 							break;
1178 						}
1179 						switch (reg &
1180 							PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
1181 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
1182 							cfe->iospace[i].length =
1183 								pcmcia_tuple_read_1(tuple, idx);
1184 							idx++;
1185 							break;
1186 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
1187 							cfe->iospace[i].length =
1188 								pcmcia_tuple_read_2(tuple, idx);
1189 							idx += 2;
1190 							break;
1191 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
1192 							cfe->iospace[i].length =
1193 								pcmcia_tuple_read_4(tuple, idx);
1194 							idx += 4;
1195 							break;
1196 						}
1197 						cfe->iospace[i].length++;
1198 					}
1199 				} else {
1200 					cfe->num_iospace = 1;
1201 					cfe->iospace[0].start = 0;
1202 					cfe->iospace[0].length =
1203 					    (1 << cfe->iomask);
1204 				}
1205 			}
1206 
1207 			if (irq) {
1208 				if (tuple->length <= idx) {
1209 					DPRINTF(("ran out of space before TPCE_IR\n"));
1210 
1211 					goto abort_cfe;
1212 				}
1213 
1214 				reg = pcmcia_tuple_read_1(tuple, idx);
1215 				idx++;
1216 
1217 				cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
1218 				    | PCMCIA_CFE_IRQPULSE
1219 				    | PCMCIA_CFE_IRQLEVEL);
1220 				if (reg & PCMCIA_TPCE_IR_SHARE)
1221 					cfe->flags |= PCMCIA_CFE_IRQSHARE;
1222 				if (reg & PCMCIA_TPCE_IR_PULSE)
1223 					cfe->flags |= PCMCIA_CFE_IRQPULSE;
1224 				if (reg & PCMCIA_TPCE_IR_LEVEL)
1225 					cfe->flags |= PCMCIA_CFE_IRQLEVEL;
1226 
1227 				if (reg & PCMCIA_TPCE_IR_HASMASK) {
1228 					/*
1229 					 * it's legal to ignore the
1230 					 * special-interrupt bits, so I will
1231 					 */
1232 
1233 					cfe->irqmask =
1234 					    pcmcia_tuple_read_2(tuple, idx);
1235 					idx += 2;
1236 				} else {
1237 					cfe->irqmask =
1238 					    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
1239 				}
1240 			}
1241 			if (memspace) {
1242 				if (tuple->length <= idx) {
1243 					DPRINTF(("ran out of space before TPCE_MS\n"));
1244 					goto abort_cfe;
1245 				}
1246 
1247 				if (memspace == PCMCIA_TPCE_FS_MEMSPACE_NONE) {
1248 					cfe->num_memspace = 0;
1249 				} else if (memspace == PCMCIA_TPCE_FS_MEMSPACE_LENGTH) {
1250 					cfe->num_memspace = 1;
1251 					cfe->memspace[0].length = 256 *
1252 					    pcmcia_tuple_read_2(tuple, idx);
1253 					idx += 2;
1254 					cfe->memspace[0].cardaddr = 0;
1255 					cfe->memspace[0].hostaddr = 0;
1256 				} else if (memspace ==
1257 				    PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR) {
1258 					cfe->num_memspace = 1;
1259 					cfe->memspace[0].length = 256 *
1260 					    pcmcia_tuple_read_2(tuple, idx);
1261 					idx += 2;
1262 					cfe->memspace[0].cardaddr = 256 *
1263 					    pcmcia_tuple_read_2(tuple, idx);
1264 					idx += 2;
1265 					cfe->memspace[0].hostaddr = cfe->memspace[0].cardaddr;
1266 				} else {
1267 					int lengthsize;
1268 					int cardaddrsize;
1269 					int hostaddrsize;
1270 
1271 					reg = pcmcia_tuple_read_1(tuple, idx);
1272 					idx++;
1273 
1274 					cfe->num_memspace = (reg &
1275 					    PCMCIA_TPCE_MS_COUNT) + 1;
1276 
1277 					if (cfe->num_memspace >
1278 					    (sizeof(cfe->memspace) /
1279 					     sizeof(cfe->memspace[0]))) {
1280 						DPRINTF(("too many mem "
1281 						    "spaces %d",
1282 						    cfe->num_memspace));
1283 						state->card->error++;
1284 						break;
1285 					}
1286 					lengthsize =
1287 						((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
1288 						 PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
1289 					cardaddrsize =
1290 						((reg & PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
1291 						 PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
1292 					hostaddrsize =
1293 						(reg & PCMCIA_TPCE_MS_HOSTADDR) ? cardaddrsize : 0;
1294 
1295 					if (lengthsize == 0) {
1296 						DPRINTF(("cfe memspace "
1297 						    "lengthsize == 0"));
1298 						state->card->error++;
1299 					}
1300 					for (i = 0; i < cfe->num_memspace; i++) {
1301 						if (lengthsize) {
1302 							cfe->memspace[i].length =
1303 								256 * pcmcia_tuple_read_n(tuple, lengthsize,
1304 								       idx);
1305 							idx += lengthsize;
1306 						} else {
1307 							cfe->memspace[i].length = 0;
1308 						}
1309 						if (cfe->memspace[i].length == 0) {
1310 							DPRINTF(("cfe->memspace[%d].length == 0",
1311 								 i));
1312 							state->card->error++;
1313 						}
1314 						if (cardaddrsize) {
1315 							cfe->memspace[i].cardaddr =
1316 								256 * pcmcia_tuple_read_n(tuple, cardaddrsize,
1317 								       idx);
1318 							idx += cardaddrsize;
1319 						} else {
1320 							cfe->memspace[i].cardaddr = 0;
1321 						}
1322 						if (hostaddrsize) {
1323 							cfe->memspace[i].hostaddr =
1324 								256 * pcmcia_tuple_read_n(tuple, hostaddrsize,
1325 								       idx);
1326 							idx += hostaddrsize;
1327 						} else {
1328 							cfe->memspace[i].hostaddr = 0;
1329 						}
1330 					}
1331 				}
1332 			}
1333 			if (misc) {
1334 				if (tuple->length <= idx) {
1335 					DPRINTF(("ran out of space before TPCE_MI\n"));
1336 
1337 					goto abort_cfe;
1338 				}
1339 
1340 				reg = pcmcia_tuple_read_1(tuple, idx);
1341 				idx++;
1342 
1343 				cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
1344 				    | PCMCIA_CFE_READONLY
1345 				    | PCMCIA_CFE_AUDIO);
1346 				if (reg & PCMCIA_TPCE_MI_PWRDOWN)
1347 					cfe->flags |= PCMCIA_CFE_POWERDOWN;
1348 				if (reg & PCMCIA_TPCE_MI_READONLY)
1349 					cfe->flags |= PCMCIA_CFE_READONLY;
1350 				if (reg & PCMCIA_TPCE_MI_AUDIO)
1351 					cfe->flags |= PCMCIA_CFE_AUDIO;
1352 				cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
1353 
1354 				while (reg & PCMCIA_TPCE_MI_EXT) {
1355 					reg = pcmcia_tuple_read_1(tuple, idx);
1356 					idx++;
1357 				}
1358 			}
1359 			/* skip all the subtuples */
1360 		}
1361 
1362 	abort_cfe:
1363 		DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
1364 		break;
1365 
1366 	default:
1367 		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
1368 		break;
1369 	}
1370 
1371 	return (0);
1372 }
1373