Home | History | Annotate | Line # | Download | only in pcmcia
      1 /*	$NetBSD: pcmcia_cis.c,v 1.57 2019/11/10 21:16:36 chs Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  * 3. All advertising materials mentioning features or use of this software
     15  *    must display the following acknowledgement:
     16  *	This product includes software developed by Marc Horowitz.
     17  * 4. The name of the author may not be used to endorse or promote products
     18  *    derived from this software without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #include <sys/cdefs.h>
     33 __KERNEL_RCSID(0, "$NetBSD: pcmcia_cis.c,v 1.57 2019/11/10 21:16:36 chs Exp $");
     34 
     35 #include <sys/param.h>
     36 #include <sys/systm.h>
     37 #include <sys/device.h>
     38 #include <sys/malloc.h>
     39 
     40 #include <dev/pcmcia/pcmciareg.h>
     41 #include <dev/pcmcia/pcmciachip.h>
     42 #include <dev/pcmcia/pcmciavar.h>
     43 
     44 #ifdef PCMCIACISDEBUG
     45 int	pcmciacis_debug = 0;
     46 #define	DPRINTF(arg) if (pcmciacis_debug) printf arg
     47 #else
     48 #define	DPRINTF(arg)
     49 #endif
     50 
     51 #define	PCMCIA_CIS_SIZE		1024
     52 
     53 struct cis_state {
     54 	int	count;
     55 	int	gotmfc;
     56 	struct pcmcia_config_entry temp_cfe;
     57 	struct pcmcia_config_entry *default_cfe;
     58 	struct pcmcia_card *card;
     59 	struct pcmcia_function *pf;
     60 };
     61 
     62 int	pcmcia_parse_cis_tuple(struct pcmcia_tuple *, void *);
     63 static void create_pf(struct cis_state *);
     64 
     65 static void decode_end(struct pcmcia_tuple *, struct cis_state *);
     66 static void decode_longlink_mfc(struct pcmcia_tuple *, struct cis_state *);
     67 static void decode_device(struct pcmcia_tuple *, struct cis_state *);
     68 static void decode_vers_1(struct pcmcia_tuple *, struct cis_state *);
     69 static void decode_manfid(struct pcmcia_tuple *, struct cis_state *);
     70 static void decode_funcid(struct pcmcia_tuple *, struct cis_state *);
     71 static void decode_funce(struct pcmcia_tuple *, struct cis_state *);
     72 static void decode_config(struct pcmcia_tuple *, struct cis_state *);
     73 static void decode_cftable_entry(struct pcmcia_tuple *, struct cis_state *);
     74 
     75 
     76 static void
     77 create_pf(struct cis_state *state)
     78 {
     79 	state->pf = malloc(sizeof(*state->pf), M_DEVBUF, M_WAITOK|M_ZERO);
     80 	state->pf->number = state->count++;
     81 	state->pf->last_config_index = -1;
     82 	SIMPLEQ_INIT(&state->pf->cfe_head);
     83 	SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list);
     84 }
     85 
     86 void
     87 pcmcia_free_pf(struct pcmcia_function_head *pfhead)
     88 {
     89 	struct pcmcia_function *pf, *npf;
     90 	struct pcmcia_config_entry *cfe, *ncfe;
     91 
     92 	for (pf = SIMPLEQ_FIRST(pfhead); pf != NULL; pf = npf) {
     93 		npf = SIMPLEQ_NEXT(pf, pf_list);
     94 		for (cfe = SIMPLEQ_FIRST(&pf->cfe_head); cfe != NULL;
     95 		    cfe = ncfe) {
     96 			ncfe = SIMPLEQ_NEXT(cfe, cfe_list);
     97 			free(cfe, M_DEVBUF);
     98 		}
     99 		free(pf, M_DEVBUF);
    100 	}
    101 
    102 	SIMPLEQ_INIT(pfhead);
    103 }
    104 
    105 void
    106 pcmcia_read_cis(struct pcmcia_softc *sc)
    107 {
    108 	struct cis_state state;
    109 
    110 	memset(&state, 0, sizeof state);
    111 
    112 	state.card = &sc->card;
    113 
    114 	state.card->error = 0;
    115 	state.card->cis1_major = -1;
    116 	state.card->cis1_minor = -1;
    117 	state.card->cis1_info[0] = NULL;
    118 	state.card->cis1_info[1] = NULL;
    119 	state.card->cis1_info[2] = NULL;
    120 	state.card->cis1_info[3] = NULL;
    121 	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
    122 	state.card->product = PCMCIA_PRODUCT_INVALID;
    123 	SIMPLEQ_INIT(&state.card->pf_head);
    124 
    125 	state.pf = NULL;
    126 
    127 	if (pcmcia_scan_cis(sc->dev, pcmcia_parse_cis_tuple,
    128 	    &state) == -1)
    129 		state.card->error++;
    130 }
    131 
    132 int
    133 pcmcia_scan_cis(device_t dev,
    134 	int (*fct)(struct pcmcia_tuple *, void *),
    135 	void *arg)
    136 {
    137 	struct pcmcia_softc *sc = device_private(dev);
    138 	pcmcia_chipset_tag_t pct;
    139 	pcmcia_chipset_handle_t pch;
    140 	int window;
    141 	struct pcmcia_mem_handle pcmh;
    142 	struct pcmcia_tuple tuple;
    143 	int longlink_present;
    144 	int longlink_common;
    145 	u_long longlink_addr;
    146 	int mfc_count;
    147 	int mfc_index;
    148 	struct {
    149 		int	common;
    150 		u_long	addr;
    151 	} mfc[256 / 5];
    152 	int ret;
    153 
    154 	ret = 0;
    155 
    156 	pct = sc->pct;
    157 	pch = sc->pch;
    158 
    159 	/* allocate some memory */
    160 
    161 	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
    162 #ifdef DIAGNOSTIC
    163 		aprint_error_dev(sc->dev,
    164 				 "can't alloc memory to read attributes\n");
    165 #endif
    166 		return -1;
    167 	}
    168 	/* initialize state for the primary tuple chain */
    169 	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
    170 	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
    171 		pcmcia_chip_mem_free(pct, pch, &pcmh);
    172 #ifdef DIAGNOSTIC
    173 		aprint_error_dev(sc->dev,
    174 				 "can't map memory to read attributes\n");
    175 #endif
    176 		return -1;
    177 	}
    178 	tuple.memt = pcmh.memt;
    179 	tuple.memh = pcmh.memh;
    180 
    181 	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
    182 
    183 	tuple.mult = 2;
    184 
    185 	longlink_present = 1;
    186 	longlink_common = 1;
    187 	longlink_addr = 0;
    188 
    189 	mfc_count = 0;
    190 	mfc_index = 0;
    191 
    192 	DPRINTF(("%s: CIS tuple chain:\n", device_xname(sc->dev)));
    193 
    194 	while (1) {
    195 		DELAY(1000);
    196 
    197 		while (1) {
    198 			/*
    199 			 * Perform boundary check for insane cards.
    200 			 * If CIS is too long, simulate CIS end.
    201 			 * (This check may not be sufficient for
    202 			 * malicious cards.)
    203 			 */
    204 			if (tuple.mult * tuple.ptr >= PCMCIA_CIS_SIZE - 1
    205 			    - 32 /* ad hoc value */ ) {
    206 				DPRINTF(("CISTPL_END (too long CIS)\n"));
    207 				tuple.code = PCMCIA_CISTPL_END;
    208 				goto cis_end;
    209 			}
    210 
    211 			/* get the tuple code */
    212 
    213 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
    214 
    215 			/* two special-case tuples */
    216 
    217 			if (tuple.code == PCMCIA_CISTPL_NULL) {
    218 				DPRINTF((" 00\nCISTPL_NONE\n"));
    219 				tuple.ptr++;
    220 				continue;
    221 			} else if (tuple.code == PCMCIA_CISTPL_END) {
    222 				DPRINTF((" ff\nCISTPL_END\n"));
    223 			cis_end:
    224 				/* Call the function for the END tuple, since
    225 				   the CIS semantics depend on it */
    226 				if ((*fct) (&tuple, arg)) {
    227 					pcmcia_chip_mem_unmap(pct, pch,
    228 							      window);
    229 					ret = 1;
    230 					goto done;
    231 				}
    232 				tuple.ptr++;
    233 				break;
    234 			}
    235 
    236 			/* now all the normal tuples */
    237 
    238 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
    239 #ifdef PCMCIACISDEBUG
    240 			/* print the tuple */
    241 			{
    242 				int i;
    243 
    244 				DPRINTF((" %02x %02x", tuple.code,
    245 				    tuple.length));
    246 
    247 				for (i = 0; i < tuple.length; i++) {
    248 					DPRINTF((" %02x",
    249 					    pcmcia_tuple_read_1(&tuple, i)));
    250 					if ((i % 16) == 13)
    251 						DPRINTF(("\n"));
    252 				}
    253 				if ((i % 16) != 14)
    254 					DPRINTF(("\n"));
    255 			}
    256 #endif
    257 			switch (tuple.code) {
    258 			case PCMCIA_CISTPL_LONGLINK_A:
    259 			case PCMCIA_CISTPL_LONGLINK_C:
    260 				if (tuple.length < 4) {
    261 					DPRINTF(("CISTPL_LONGLINK_%s too "
    262 					    "short %d\n",
    263 					    longlink_common ? "C" : "A",
    264 					    tuple.length));
    265 					break;
    266 				}
    267 				longlink_present = 1;
    268 				longlink_common = (tuple.code ==
    269 				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
    270 				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
    271 				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
    272 				    longlink_common ? "C" : "A",
    273 				    longlink_addr));
    274 				break;
    275 			case PCMCIA_CISTPL_NO_LINK:
    276 				longlink_present = 0;
    277 				DPRINTF(("CISTPL_NO_LINK\n"));
    278 				break;
    279 			case PCMCIA_CISTPL_CHECKSUM:
    280 				if (tuple.length < 5) {
    281 					DPRINTF(("CISTPL_CHECKSUM too "
    282 					    "short %d\n", tuple.length));
    283 					break;
    284 				} {
    285 					int16_t offset;
    286 					u_long addr, length;
    287 					u_int cksum, sum;
    288 					int i;
    289 
    290 					*((u_int16_t *) & offset) =
    291 					    pcmcia_tuple_read_2(&tuple, 0);
    292 					length = pcmcia_tuple_read_2(&tuple, 2);
    293 					cksum = pcmcia_tuple_read_1(&tuple, 4);
    294 
    295 					addr = tuple.ptr + offset;
    296 
    297 					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
    298 					    "len=%lx cksum=%x",
    299 					    addr, length, cksum));
    300 
    301 					/*
    302 					 * XXX do more work to deal with
    303 					 * distant regions
    304 					 */
    305 					if ((addr >= PCMCIA_CIS_SIZE) ||
    306 #if 0
    307 					    ((addr + length) < 0) ||
    308 #endif
    309 					    ((addr + length) >=
    310 					      PCMCIA_CIS_SIZE)) {
    311 						DPRINTF((" skipped, "
    312 						    "too distant\n"));
    313 						break;
    314 					}
    315 					sum = 0;
    316 					for (i = 0; i < length; i++)
    317 						sum +=
    318 						    bus_space_read_1(tuple.memt,
    319 						    tuple.memh,
    320 						    addr + tuple.mult * i);
    321 					if (cksum != (sum & 0xff)) {
    322 						DPRINTF((" failed sum=%x\n",
    323 						    sum));
    324 						aprint_error_dev(sc->dev,
    325 						 "CIS checksum failed\n");
    326 #if 0
    327 						/*
    328 						 * XXX Some working cards have
    329 						 * XXX bad checksums!!
    330 						 */
    331 						ret = -1;
    332 #endif
    333 					} else {
    334 						DPRINTF((" ok\n"));
    335 					}
    336 				}
    337 				break;
    338 			case PCMCIA_CISTPL_LONGLINK_MFC:
    339 				if (tuple.length < 1) {
    340 					DPRINTF(("CISTPL_LONGLINK_MFC too "
    341 					    "short %d\n", tuple.length));
    342 					break;
    343 				}
    344 				if (((tuple.length - 1) % 5) != 0) {
    345 					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
    346 					    "length %d\n", tuple.length));
    347 					break;
    348 				}
    349 				/*
    350 				 * this is kind of ad hoc, as I don't have
    351 				 * any real documentation
    352 				 */
    353 				{
    354 					int i, tmp_count;
    355 
    356 					/*
    357 					 * put count into tmp var so that
    358 					 * if we have to bail (because it's
    359 					 * a bogus count) it won't be
    360 					 * remembered for later use.
    361 					 */
    362 					tmp_count =
    363 					    pcmcia_tuple_read_1(&tuple, 0);
    364 					DPRINTF(("CISTPL_LONGLINK_MFC %d",
    365 					    tmp_count));
    366 
    367 					/*
    368 					 * make _sure_ it's the right size;
    369 					 * if too short, it may be a weird
    370 					 * (unknown/undefined) format
    371 					 */
    372 					if (tuple.length != (tmp_count*5 + 1)) {
    373 						DPRINTF((" bogus length %d\n",
    374 						    tuple.length));
    375 						break;
    376 					}
    377 
    378 #ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
    379 					/*
    380 					 * sanity check for a programming
    381 					 * error which is difficult to find
    382 					 * when debugging.
    383 					 */
    384 					if (tmp_count >
    385 					    howmany(sizeof mfc, sizeof mfc[0]))
    386 						panic("CISTPL_LONGLINK_MFC mfc "
    387 						    "count would blow stack");
    388 #endif
    389 
    390 					mfc_count = tmp_count;
    391 					for (i = 0; i < mfc_count; i++) {
    392 						mfc[i].common =
    393 						    (pcmcia_tuple_read_1(&tuple,
    394 						    1 + 5 * i) ==
    395 						    PCMCIA_MFC_MEM_COMMON) ?
    396 						    1 : 0;
    397 						mfc[i].addr =
    398 						    pcmcia_tuple_read_4(&tuple,
    399 						    1 + 5 * i + 1);
    400 						DPRINTF((" %s:%lx",
    401 						    mfc[i].common ? "common" :
    402 						    "attr", mfc[i].addr));
    403 					}
    404 					DPRINTF(("\n"));
    405 				}
    406 				/*
    407 				 * for LONGLINK_MFC, fall through to the
    408 				 * function.  This tuple has structural and
    409 				 * semantic content.
    410 				 */
    411 				/* FALLTHROUGH */
    412 			default:
    413 				{
    414 					if ((*fct) (&tuple, arg)) {
    415 						pcmcia_chip_mem_unmap(pct,
    416 						    pch, window);
    417 						ret = 1;
    418 						goto done;
    419 					}
    420 				}
    421 				break;
    422 			}	/* switch */
    423 			/* skip to the next tuple */
    424 			tuple.ptr += 2 + tuple.length;
    425 		}
    426 
    427 		/*
    428 		 * the chain is done.  Clean up and move onto the next one,
    429 		 * if any.  The loop is here in the case that there is an MFC
    430 		 * card with no longlink (which defaults to existing, == 0).
    431 		 * In general, this means that if one pointer fails, it will
    432 		 * try the next one, instead of just bailing.
    433 		 */
    434 
    435 		while (1) {
    436 			pcmcia_chip_mem_unmap(pct, pch, window);
    437 
    438 			if (longlink_present) {
    439 				/*
    440 				 * if the longlink is to attribute memory,
    441 				 * then it is unindexed.  That is, if the
    442 				 * link value is 0x100, then the actual
    443 				 * memory address is 0x200.  This means that
    444 				 * we need to multiply by 2 before calling
    445 				 * mem_map, and then divide the resulting ptr
    446 				 * by 2 after.
    447 				 */
    448 
    449 				if (!longlink_common)
    450 					longlink_addr *= 2;
    451 
    452 				pcmcia_chip_mem_map(pct, pch, longlink_common ?
    453 				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
    454 				    PCMCIA_MEM_ATTR,
    455 				    longlink_addr, PCMCIA_CIS_SIZE,
    456 				    &pcmh, &tuple.ptr, &window);
    457 
    458 				tuple.memt = pcmh.memt;
    459 				tuple.memh = pcmh.memh;
    460 
    461 				if (!longlink_common)
    462 					tuple.ptr /= 2;
    463 
    464 				DPRINTF(("cis mem map %x\n",
    465 				    (unsigned int) tuple.memh));
    466 
    467 				tuple.mult = longlink_common ? 1 : 2;
    468 				longlink_present = 0;
    469 				longlink_common = 1;
    470 				longlink_addr = 0;
    471 			} else if (mfc_count && (mfc_index < mfc_count)) {
    472 				if (!mfc[mfc_index].common)
    473 					mfc[mfc_index].addr *= 2;
    474 
    475 				pcmcia_chip_mem_map(pct, pch,
    476 				    mfc[mfc_index].common ?
    477 				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
    478 				    PCMCIA_MEM_ATTR,
    479 				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
    480 				    &pcmh, &tuple.ptr, &window);
    481 
    482 				if (!mfc[mfc_index].common)
    483 					tuple.ptr /= 2;
    484 
    485 				DPRINTF(("cis mem map %x\n",
    486 				    (unsigned int) tuple.memh));
    487 
    488 				/* set parse state, and point at the next one */
    489 
    490 				tuple.mult = mfc[mfc_index].common ? 1 : 2;
    491 
    492 				mfc_index++;
    493 			} else {
    494 				goto done;
    495 			}
    496 
    497 			/* make sure that the link is valid */
    498 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
    499 			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
    500 				DPRINTF(("CISTPL_LINKTARGET expected, "
    501 				    "code %02x observed\n", tuple.code));
    502 				continue;
    503 			}
    504 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
    505 			if (tuple.length < 3) {
    506 				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
    507 				    tuple.length));
    508 				continue;
    509 			}
    510 			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
    511 			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
    512 			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
    513 				DPRINTF(("CISTPL_LINKTARGET magic "
    514 				    "%02x%02x%02x incorrect\n",
    515 				    pcmcia_tuple_read_1(&tuple, 0),
    516 				    pcmcia_tuple_read_1(&tuple, 1),
    517 				    pcmcia_tuple_read_1(&tuple, 2)));
    518 				continue;
    519 			}
    520 			tuple.ptr += 2 + tuple.length;
    521 
    522 			break;
    523 		}
    524 	}
    525 
    526 	pcmcia_chip_mem_unmap(pct, pch, window);
    527 
    528 done:
    529 	/* Last, free the allocated memory block */
    530 	pcmcia_chip_mem_free(pct, pch, &pcmh);
    531 
    532 	return (ret);
    533 }
    534 
    535 /* XXX this is incredibly verbose.  Not sure what trt is */
    536 
    537 void
    538 pcmcia_print_cis(struct pcmcia_softc *sc)
    539 {
    540 	struct pcmcia_card *card = &sc->card;
    541 	struct pcmcia_function *pf;
    542 	struct pcmcia_config_entry *cfe;
    543 	int i;
    544 
    545 	printf("%s: CIS version ", device_xname(sc->dev));
    546 	if (card->cis1_major == 4) {
    547 		if (card->cis1_minor == 0)
    548 			printf("PCMCIA 1.0\n");
    549 		else if (card->cis1_minor == 1)
    550 			printf("PCMCIA 2.0 or 2.1\n");
    551 	} else if (card->cis1_major >= 5)
    552 		printf("PC Card Standard %d.%d\n", card->cis1_major, card->cis1_minor);
    553 	else
    554 		printf("unknown (major=%d, minor=%d)\n",
    555 		    card->cis1_major, card->cis1_minor);
    556 
    557 	printf("%s: CIS info: ", device_xname(sc->dev));
    558 	for (i = 0; i < 4; i++) {
    559 		if (card->cis1_info[i] == NULL)
    560 			break;
    561 		if (i)
    562 			printf(", ");
    563 		printf("%s", card->cis1_info[i]);
    564 	}
    565 	printf("\n");
    566 
    567 	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
    568 	       device_xname(sc->dev), card->manufacturer, card->product);
    569 
    570 	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
    571 		printf("%s: function %d: ", device_xname(sc->dev), pf->number);
    572 
    573 		switch (pf->function) {
    574 		case PCMCIA_FUNCTION_UNSPEC:
    575 			printf("unspecified");
    576 			break;
    577 		case PCMCIA_FUNCTION_MULTIFUNCTION:
    578 			printf("multi-function");
    579 			break;
    580 		case PCMCIA_FUNCTION_MEMORY:
    581 			printf("memory");
    582 			break;
    583 		case PCMCIA_FUNCTION_SERIAL:
    584 			printf("serial port");
    585 			break;
    586 		case PCMCIA_FUNCTION_PARALLEL:
    587 			printf("parallel port");
    588 			break;
    589 		case PCMCIA_FUNCTION_DISK:
    590 			printf("fixed disk");
    591 			switch (pf->pf_funce_disk_interface) {
    592 			case PCMCIA_TPLFE_DDI_PCCARD_ATA:
    593 				printf("(ata)");
    594 				break;
    595 			default:
    596 				break;
    597 			}
    598 			break;
    599 		case PCMCIA_FUNCTION_VIDEO:
    600 			printf("video adapter");
    601 			break;
    602 		case PCMCIA_FUNCTION_NETWORK:
    603 			printf("network adapter");
    604 			break;
    605 		case PCMCIA_FUNCTION_AIMS:
    606 			printf("auto incrementing mass storage");
    607 			break;
    608 		case PCMCIA_FUNCTION_SCSI:
    609 			printf("SCSI bridge");
    610 			break;
    611 		case PCMCIA_FUNCTION_SECURITY:
    612 			printf("Security services");
    613 			break;
    614 		case PCMCIA_FUNCTION_INSTRUMENT:
    615 			printf("Instrument");
    616 			break;
    617 		default:
    618 			printf("unknown (%d)", pf->function);
    619 			break;
    620 		}
    621 
    622 		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
    623 
    624 		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
    625 			printf("%s: function %d, config table entry %d: ",
    626 			    device_xname(sc->dev), pf->number, cfe->number);
    627 
    628 			switch (cfe->iftype) {
    629 			case PCMCIA_IFTYPE_MEMORY:
    630 				printf("memory card");
    631 				break;
    632 			case PCMCIA_IFTYPE_IO:
    633 				printf("I/O card");
    634 				break;
    635 			default:
    636 				printf("card type unknown");
    637 				break;
    638 			}
    639 
    640 			printf("; irq mask %x", cfe->irqmask);
    641 
    642 			if (cfe->num_iospace) {
    643 				printf("; iomask %lx, iospace", cfe->iomask);
    644 
    645 				for (i = 0; i < cfe->num_iospace; i++) {
    646 					printf(" %lx", cfe->iospace[i].start);
    647 					if (cfe->iospace[i].length)
    648 						printf("-%lx",
    649 						    cfe->iospace[i].start +
    650 						    cfe->iospace[i].length - 1);
    651 				}
    652 			}
    653 			if (cfe->num_memspace) {
    654 				printf("; memspace");
    655 
    656 				for (i = 0; i < cfe->num_memspace; i++) {
    657 					printf(" %lx",
    658 					    cfe->memspace[i].cardaddr);
    659 					if (cfe->memspace[i].length)
    660 						printf("-%lx",
    661 						    cfe->memspace[i].cardaddr +
    662 						    cfe->memspace[i].length - 1);
    663 					if (cfe->memspace[i].hostaddr)
    664 						printf("@%lx",
    665 						    cfe->memspace[i].hostaddr);
    666 				}
    667 			}
    668 			if (cfe->maxtwins)
    669 				printf("; maxtwins %d", cfe->maxtwins);
    670 
    671 			printf(";");
    672 
    673 			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
    674 				printf(" mwait_required");
    675 			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
    676 				printf(" rdybsy_active");
    677 			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
    678 				printf(" wp_active");
    679 			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
    680 				printf(" bvd_active");
    681 			if (cfe->flags & PCMCIA_CFE_IO8)
    682 				printf(" io8");
    683 			if (cfe->flags & PCMCIA_CFE_IO16)
    684 				printf(" io16");
    685 			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
    686 				printf(" irqshare");
    687 			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
    688 				printf(" irqpulse");
    689 			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
    690 				printf(" irqlevel");
    691 			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
    692 				printf(" powerdown");
    693 			if (cfe->flags & PCMCIA_CFE_READONLY)
    694 				printf(" readonly");
    695 			if (cfe->flags & PCMCIA_CFE_AUDIO)
    696 				printf(" audio");
    697 
    698 			printf("\n");
    699 		}
    700 	}
    701 
    702 	if (card->error)
    703 		printf("%s: %d errors found while parsing CIS\n",
    704 		    device_xname(sc->dev), card->error);
    705 }
    706 
    707 int
    708 pcmcia_parse_cis_tuple(struct pcmcia_tuple *tuple, void *arg)
    709 {
    710 	struct cis_state *state = arg;
    711 
    712 	switch (tuple->code) {
    713 	case PCMCIA_CISTPL_END:
    714 		decode_end(tuple, state);
    715 		break;
    716 
    717 	case PCMCIA_CISTPL_LONGLINK_MFC:
    718 		decode_longlink_mfc(tuple, state);
    719 		break;
    720 
    721 	case PCMCIA_CISTPL_DEVICE:
    722 	case PCMCIA_CISTPL_DEVICE_A:
    723 		decode_device(tuple, state);
    724 		break;
    725 
    726 	case PCMCIA_CISTPL_VERS_1:
    727 		decode_vers_1(tuple, state);
    728 		break;
    729 
    730 	case PCMCIA_CISTPL_MANFID:
    731 		decode_manfid(tuple, state);
    732 		break;
    733 
    734 	case PCMCIA_CISTPL_FUNCID:
    735 		decode_funcid(tuple, state);
    736 		break;
    737 
    738 	case PCMCIA_CISTPL_FUNCE:
    739 		decode_funce(tuple, state);
    740 		break;
    741 
    742 	case PCMCIA_CISTPL_CONFIG:
    743 		decode_config(tuple, state);
    744 		break;
    745 
    746 	case PCMCIA_CISTPL_CFTABLE_ENTRY:
    747 		decode_cftable_entry(tuple, state);
    748 		break;
    749 	default:
    750 		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
    751 		break;
    752 	}
    753 
    754 	return (0);
    755 }
    756 
    757 static void
    758 decode_end(struct pcmcia_tuple *tuple, struct cis_state *state)
    759 {
    760 	/* if we've seen a LONGLINK_MFC, and this is the first
    761 	 * END after it, reset the function list.
    762 	 *
    763 	 * XXX This might also be the right place to start a
    764 	 * new function, but that assumes that a function
    765 	 * definition never crosses any longlink, and I'm not
    766 	 * sure about that.  This is probably safe for MFC
    767 	 * cards, but what we have now isn't broken, so I'd
    768 	 * rather not change it.
    769 	 */
    770 	if (state->gotmfc == 1) {
    771 		state->gotmfc = 2;
    772 		state->count = 0;
    773 		state->pf = NULL;
    774 
    775 		pcmcia_free_pf(&state->card->pf_head);
    776 	}
    777 }
    778 
    779 static void
    780 decode_longlink_mfc(struct pcmcia_tuple *tuple,
    781     struct cis_state *state)
    782 {
    783 	/*
    784 	 * this tuple's structure was dealt with in scan_cis.  here,
    785 	 * record the fact that the MFC tuple was seen, so that
    786 	 * functions declared before the MFC link can be cleaned
    787 	 * up.
    788 	 */
    789 	if (state->gotmfc == 0) {
    790 		state->gotmfc = 1;
    791 	} else {
    792 		DPRINTF(("got LONGLINK_MFC again!"));
    793 	}
    794 }
    795 
    796 static void
    797 decode_device(struct pcmcia_tuple *tuple,
    798     struct cis_state *state)
    799 {
    800 #ifdef PCMCIACISDEBUG
    801 	u_int reg, dtype, dspeed;
    802 
    803 	reg = pcmcia_tuple_read_1(tuple, 0);
    804 	dtype = reg & PCMCIA_DTYPE_MASK;
    805 	dspeed = reg & PCMCIA_DSPEED_MASK;
    806 
    807 	DPRINTF(("CISTPL_DEVICE%s type=",
    808 	(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
    809 	switch (dtype) {
    810 	case PCMCIA_DTYPE_NULL:
    811 		DPRINTF(("null"));
    812 		break;
    813 	case PCMCIA_DTYPE_ROM:
    814 		DPRINTF(("rom"));
    815 		break;
    816 	case PCMCIA_DTYPE_OTPROM:
    817 		DPRINTF(("otprom"));
    818 		break;
    819 	case PCMCIA_DTYPE_EPROM:
    820 		DPRINTF(("eprom"));
    821 		break;
    822 	case PCMCIA_DTYPE_EEPROM:
    823 		DPRINTF(("eeprom"));
    824 		break;
    825 	case PCMCIA_DTYPE_FLASH:
    826 		DPRINTF(("flash"));
    827 		break;
    828 	case PCMCIA_DTYPE_SRAM:
    829 		DPRINTF(("sram"));
    830 		break;
    831 	case PCMCIA_DTYPE_DRAM:
    832 		DPRINTF(("dram"));
    833 		break;
    834 	case PCMCIA_DTYPE_FUNCSPEC:
    835 		DPRINTF(("funcspec"));
    836 		break;
    837 	case PCMCIA_DTYPE_EXTEND:
    838 		DPRINTF(("extend"));
    839 		break;
    840 	default:
    841 		DPRINTF(("reserved"));
    842 		break;
    843 	}
    844 	DPRINTF((" speed="));
    845 	switch (dspeed) {
    846 	case PCMCIA_DSPEED_NULL:
    847 		DPRINTF(("null"));
    848 		break;
    849 	case PCMCIA_DSPEED_250NS:
    850 		DPRINTF(("250ns"));
    851 		break;
    852 	case PCMCIA_DSPEED_200NS:
    853 		DPRINTF(("200ns"));
    854 		break;
    855 	case PCMCIA_DSPEED_150NS:
    856 		DPRINTF(("150ns"));
    857 		break;
    858 	case PCMCIA_DSPEED_100NS:
    859 		DPRINTF(("100ns"));
    860 		break;
    861 	case PCMCIA_DSPEED_EXT:
    862 		DPRINTF(("ext"));
    863 		break;
    864 	default:
    865 		DPRINTF(("reserved"));
    866 		break;
    867 	}
    868 	DPRINTF(("\n"));
    869 #endif
    870 }
    871 
    872 static void
    873 decode_vers_1(struct pcmcia_tuple *tuple, struct cis_state *state)
    874 {
    875 	int start, i, ch, count;
    876 
    877 	if (tuple->length < 6) {
    878 		DPRINTF(("CISTPL_VERS_1 too short %d\n",
    879 		    tuple->length));
    880 		return;
    881 	}
    882 	state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
    883 	state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
    884 
    885 	for (count = 0, start = 0, i = 0;
    886 	    (count < 4) && ((i + 4) < 256); i++) {
    887 		ch = pcmcia_tuple_read_1(tuple, 2 + i);
    888 		if (ch == 0xff) {
    889 			if (i > start) {
    890 				state->card->cis1_info_buf[i] = 0;
    891 				state->card->cis1_info[count] =
    892 				    state->card->cis1_info_buf + start;
    893 			}
    894 			break;
    895 		}
    896 		state->card->cis1_info_buf[i] = ch;
    897 		if (ch == 0) {
    898 			state->card->cis1_info[count] =
    899 			    state->card->cis1_info_buf + start;
    900 			start = i + 1;
    901 			count++;
    902 		}
    903 	}
    904 	DPRINTF(("CISTPL_VERS_1\n"));
    905 }
    906 
    907 static void
    908 decode_manfid(struct pcmcia_tuple *tuple, struct cis_state *state)
    909 {
    910 	if (tuple->length < 4) {
    911 		DPRINTF(("CISTPL_MANFID too short %d\n",
    912 		    tuple->length));
    913 		return;
    914 	}
    915 	state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
    916 	state->card->product = pcmcia_tuple_read_2(tuple, 2);
    917 	DPRINTF(("CISTPL_MANFID\n"));
    918 }
    919 
    920 static void
    921 decode_funcid(struct pcmcia_tuple *tuple, struct cis_state *state)
    922 {
    923 	if (tuple->length < 1) {
    924 		DPRINTF(("CISTPL_FUNCID too short %d\n",
    925 		    tuple->length));
    926 		return;
    927 	}
    928 	if (state->pf) {
    929 		if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
    930 			/*
    931 			 * This looks like a opportunistic function
    932 			 * created by a CONFIG tuple.  Just keep it.
    933 			 */
    934 		} else {
    935 			/*
    936 			 * A function is being defined, end it.
    937 			 */
    938 			state->pf = NULL;
    939 		}
    940 	}
    941 	if (state->pf == NULL)
    942 		create_pf(state);
    943 	state->pf->function = pcmcia_tuple_read_1(tuple, 0);
    944 
    945 	DPRINTF(("CISTPL_FUNCID\n"));
    946 }
    947 
    948 static void
    949 decode_funce(struct pcmcia_tuple *tuple, struct cis_state *state)
    950 {
    951 	struct pcmcia_function *pf = state->pf;
    952 	int type = pcmcia_tuple_read_1(tuple, 0);
    953 
    954 	if (state->pf == NULL || state->pf->function <= 0) {
    955 		DPRINTF(("CISTPL_FUNCE is not followed by "
    956 		    "valid CISTPL_FUNCID\n"));
    957 		return;
    958 	}
    959 	if (tuple->length < 2)
    960 		return;
    961 	switch (pf->function) {
    962 	case PCMCIA_FUNCTION_DISK:
    963 		if (type == PCMCIA_TPLFE_TYPE_DISK_DEVICE_INTERFACE) {
    964 			pf->pf_funce_disk_interface
    965 			    = pcmcia_tuple_read_1(tuple, 1);
    966 		}
    967 		break;
    968 	case PCMCIA_FUNCTION_NETWORK:
    969 		if (type == PCMCIA_TPLFE_TYPE_LAN_NID) {
    970 			int i;
    971 			int len = pcmcia_tuple_read_1(tuple, 1);
    972 			if (tuple->length < 2 + len || len > 8) {
    973 				/* tuple length not enough or nid too long */
    974 				break;
    975 			}
    976 			for (i = 0; i < len; ++i) {
    977 				pf->pf_funce_lan_nid[i]
    978 				    = pcmcia_tuple_read_1(tuple, 2 + i);
    979 			}
    980 			pf->pf_funce_lan_nidlen = len;
    981 		}
    982 		break;
    983 	default:
    984 		break;
    985 	}
    986 
    987 	return;
    988 }
    989 
    990 static void
    991 decode_config(struct pcmcia_tuple *tuple, struct cis_state *state)
    992 {
    993 	u_int reg, rasz, rmsz, rfsz;
    994 	int i;
    995 	/* most of these are educated guesses */
    996 	static const struct pcmcia_config_entry init_cfe = {
    997 		.number	= -1,
    998 		.flags	= PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
    999 			  PCMCIA_CFE_BVD_ACTIVE,
   1000 		.iftype	= PCMCIA_IFTYPE_MEMORY,
   1001 	};
   1002 
   1003 	if (tuple->length < 3) {
   1004 		DPRINTF(("CISTPL_CONFIG too short %d\n", tuple->length));
   1005 		return;
   1006 	}
   1007 	reg = pcmcia_tuple_read_1(tuple, 0);
   1008 	rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
   1009 	    PCMCIA_TPCC_RASZ_SHIFT);
   1010 	rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
   1011 	    PCMCIA_TPCC_RMSZ_SHIFT);
   1012 	rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
   1013 	    PCMCIA_TPCC_RFSZ_SHIFT);
   1014 
   1015 	if (tuple->length < (rasz + rmsz + rfsz)) {
   1016 		DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too short %d\n",
   1017 		    rasz, rmsz, rfsz, tuple->length));
   1018 		return;
   1019 	}
   1020 	if (state->pf == NULL) {
   1021 		create_pf(state);
   1022 		state->pf->function = PCMCIA_FUNCTION_UNSPEC;
   1023 	}
   1024 	state->pf->last_config_index =
   1025 	    pcmcia_tuple_read_1(tuple, 1);
   1026 
   1027 	state->pf->ccr_base = 0;
   1028 	for (i = 0; i < rasz; i++)
   1029 		state->pf->ccr_base |= ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
   1030 		    (i * 8));
   1031 
   1032 	state->pf->ccr_mask = 0;
   1033 	for (i = 0; i < rmsz; i++)
   1034 		state->pf->ccr_mask |= ((pcmcia_tuple_read_1(tuple,
   1035 		    2 + rasz + i)) << (i * 8));
   1036 
   1037 	/* skip the reserved area and subtuples */
   1038 
   1039 	/* reset the default cfe for each cfe list */
   1040 	state->temp_cfe = init_cfe;
   1041 	state->default_cfe = &state->temp_cfe;
   1042 	DPRINTF(("CISTPL_CONFIG\n"));
   1043 }
   1044 
   1045 static void
   1046 decode_cftable_entry(struct pcmcia_tuple *tuple, struct cis_state *state)
   1047 {
   1048 	int idx, i, j;
   1049 	u_int reg, reg2;
   1050 	u_int intface, def, num;
   1051 	u_int power, timing, iospace, irq, memspace, misc;
   1052 	struct pcmcia_config_entry *cfe;
   1053 
   1054 	idx = 0;
   1055 
   1056 	reg = pcmcia_tuple_read_1(tuple, idx);
   1057 	idx++;
   1058 	intface = reg & PCMCIA_TPCE_INDX_INTFACE;
   1059 	def = reg & PCMCIA_TPCE_INDX_DEFAULT;
   1060 	num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
   1061 
   1062 	/*
   1063 	 * this is a little messy.  Some cards have only a
   1064 	 * cfentry with the default bit set.  So, as we go
   1065 	 * through the list, we add new indexes to the queue,
   1066 	 * and keep a pointer to the last one with the
   1067 	 * default bit set.  if we see a record with the same
   1068 	 * index, as the default, we stash the default and
   1069 	 * replace the queue entry. otherwise, we just add
   1070 	 * new entries to the queue, pointing the default ptr
   1071 	 * at them if the default bit is set.  if we get to
   1072 	 * the end with the default pointer pointing at a
   1073 	 * record which hasn't had a matching index, that's
   1074 	 * ok; it just becomes a cfentry like any other.
   1075 	 */
   1076 
   1077 	/*
   1078 	 * if the index in the cis differs from the default
   1079 	 * cis, create new entry in the queue and start it
   1080 	 * with the current default
   1081 	 */
   1082 	if (state->default_cfe == NULL) {
   1083 		DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
   1084 		    "default\n"));
   1085 		return;
   1086 	}
   1087 	if (num != state->default_cfe->number) {
   1088 		cfe = malloc(sizeof(*cfe), M_DEVBUF, M_WAITOK);
   1089 		*cfe = *state->default_cfe;
   1090 
   1091 		SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head, cfe, cfe_list);
   1092 
   1093 		cfe->number = num;
   1094 
   1095 		/*
   1096 		 * if the default bit is set in the cis, then
   1097 		 * point the new default at whatever is being
   1098 		 * filled in
   1099 		 */
   1100 		if (def)
   1101 			state->default_cfe = cfe;
   1102 	} else {
   1103 		/*
   1104 		 * the cis index matches the default index,
   1105 		 * fill in the default cfentry.  It is
   1106 		 * assumed that the cfdefault index is in the
   1107 		 * queue.  For it to be otherwise, the cis
   1108 		 * index would have to be -1 (initial
   1109 		 * condition) which is not possible, or there
   1110 		 * would have to be a preceding cis entry
   1111 		 * which had the same cis index and had the
   1112 		 * default bit unset. Neither condition
   1113 		 * should happen.  If it does, this cfentry
   1114 		 * is lost (written into temp space), which
   1115 		 * is an acceptable failure mode.
   1116 		 */
   1117 
   1118 		cfe = state->default_cfe;
   1119 
   1120 		/*
   1121 		 * if the cis entry does not have the default
   1122 		 * bit set, copy the default out of the way
   1123 		 * first.
   1124 		 */
   1125 		if (!def) {
   1126 			state->temp_cfe = *state->default_cfe;
   1127 			state->default_cfe = &state->temp_cfe;
   1128 		}
   1129 	}
   1130 
   1131 	if (intface) {
   1132 		reg = pcmcia_tuple_read_1(tuple, idx);
   1133 		idx++;
   1134 		cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
   1135 		    | PCMCIA_CFE_RDYBSY_ACTIVE
   1136 		    | PCMCIA_CFE_WP_ACTIVE
   1137 		    | PCMCIA_CFE_BVD_ACTIVE);
   1138 		if (reg & PCMCIA_TPCE_IF_MWAIT)
   1139 			cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
   1140 		if (reg & PCMCIA_TPCE_IF_RDYBSY)
   1141 			cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
   1142 		if (reg & PCMCIA_TPCE_IF_WP)
   1143 			cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
   1144 		if (reg & PCMCIA_TPCE_IF_BVD)
   1145 			cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
   1146 		cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
   1147 	}
   1148 	reg = pcmcia_tuple_read_1(tuple, idx);
   1149 	idx++;
   1150 
   1151 	power = reg & PCMCIA_TPCE_FS_POWER_MASK;
   1152 	timing = reg & PCMCIA_TPCE_FS_TIMING;
   1153 	iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
   1154 	irq = reg & PCMCIA_TPCE_FS_IRQ;
   1155 	memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
   1156 	misc = reg & PCMCIA_TPCE_FS_MISC;
   1157 
   1158 	if (power) {
   1159 		/* skip over power, don't save */
   1160 		/* for each parameter selection byte */
   1161 		for (i = 0; i < power; i++) {
   1162 			reg = pcmcia_tuple_read_1(tuple, idx);
   1163 			idx++;
   1164 			/* for each bit */
   1165 			for (j = 0; j < 7; j++) {
   1166 				/* if the bit is set */
   1167 				if ((reg >> j) & 0x01) {
   1168 					/* skip over bytes */
   1169 					do {
   1170 						reg2 = pcmcia_tuple_read_1(tuple, idx);
   1171 						idx++;
   1172 						/*
   1173 						 * until
   1174 						 * non-
   1175 						 * extension
   1176 						 * byte
   1177 						 */
   1178 					} while (reg2 & 0x80);
   1179 				}
   1180 			}
   1181 		}
   1182 	}
   1183 	if (timing) {
   1184 		/* skip over timing, don't save */
   1185 		reg = pcmcia_tuple_read_1(tuple, idx);
   1186 		idx++;
   1187 
   1188 		if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
   1189 		    PCMCIA_TPCE_TD_RESERVED_MASK)
   1190 			idx++;
   1191 		if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
   1192 		    PCMCIA_TPCE_TD_RDYBSY_MASK)
   1193 			idx++;
   1194 		if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
   1195 		    PCMCIA_TPCE_TD_WAIT_MASK)
   1196 			idx++;
   1197 	}
   1198 	if (iospace) {
   1199 		if (tuple->length <= idx) {
   1200 			DPRINTF(("ran out of space before TCPE_IO\n"));
   1201 			goto abort_cfe;
   1202 		}
   1203 
   1204 		reg = pcmcia_tuple_read_1(tuple, idx);
   1205 		idx++;
   1206 
   1207 		cfe->flags &=
   1208 		    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
   1209 		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
   1210 			cfe->flags |= PCMCIA_CFE_IO8;
   1211 		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
   1212 			cfe->flags |= PCMCIA_CFE_IO16;
   1213 		cfe->iomask =
   1214 		    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
   1215 
   1216 		if (reg & PCMCIA_TPCE_IO_HASRANGE) {
   1217 			reg = pcmcia_tuple_read_1(tuple, idx);
   1218 			idx++;
   1219 
   1220 			cfe->num_iospace = 1 + (reg &
   1221 			    PCMCIA_TPCE_IO_RANGE_COUNT);
   1222 
   1223 			if (cfe->num_iospace >
   1224 			    (sizeof(cfe->iospace) /
   1225 			     sizeof(cfe->iospace[0]))) {
   1226 				DPRINTF(("too many io "
   1227 				    "spaces %d",
   1228 				    cfe->num_iospace));
   1229 				state->card->error++;
   1230 				return;
   1231 			}
   1232 			for (i = 0; i < cfe->num_iospace; i++) {
   1233 				switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
   1234 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_NONE:
   1235 					cfe->iospace[i].start =
   1236 					    0;
   1237 					break;
   1238 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
   1239 					cfe->iospace[i].start =
   1240 						pcmcia_tuple_read_1(tuple, idx);
   1241 					idx++;
   1242 					break;
   1243 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
   1244 					cfe->iospace[i].start =
   1245 						pcmcia_tuple_read_2(tuple, idx);
   1246 					idx += 2;
   1247 					break;
   1248 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
   1249 					cfe->iospace[i].start =
   1250 						pcmcia_tuple_read_4(tuple, idx);
   1251 					idx += 4;
   1252 					break;
   1253 				}
   1254 				switch (reg &
   1255 					PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
   1256 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_NONE:
   1257 					cfe->iospace[i].length =
   1258 					    0;
   1259 					break;
   1260 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
   1261 					cfe->iospace[i].length =
   1262 						pcmcia_tuple_read_1(tuple, idx);
   1263 					idx++;
   1264 					break;
   1265 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
   1266 					cfe->iospace[i].length =
   1267 						pcmcia_tuple_read_2(tuple, idx);
   1268 					idx += 2;
   1269 					break;
   1270 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
   1271 					cfe->iospace[i].length =
   1272 						pcmcia_tuple_read_4(tuple, idx);
   1273 					idx += 4;
   1274 					break;
   1275 				}
   1276 				cfe->iospace[i].length++;
   1277 			}
   1278 		} else {
   1279 			cfe->num_iospace = 1;
   1280 			cfe->iospace[0].start = 0;
   1281 			cfe->iospace[0].length =
   1282 			    (1 << cfe->iomask);
   1283 		}
   1284 	}
   1285 	if (irq) {
   1286 		if (tuple->length <= idx) {
   1287 			DPRINTF(("ran out of space before TCPE_IR\n"));
   1288 			goto abort_cfe;
   1289 		}
   1290 
   1291 		reg = pcmcia_tuple_read_1(tuple, idx);
   1292 		idx++;
   1293 
   1294 		cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
   1295 		    | PCMCIA_CFE_IRQPULSE
   1296 		    | PCMCIA_CFE_IRQLEVEL);
   1297 		if (reg & PCMCIA_TPCE_IR_SHARE)
   1298 			cfe->flags |= PCMCIA_CFE_IRQSHARE;
   1299 		if (reg & PCMCIA_TPCE_IR_PULSE)
   1300 			cfe->flags |= PCMCIA_CFE_IRQPULSE;
   1301 		if (reg & PCMCIA_TPCE_IR_LEVEL)
   1302 			cfe->flags |= PCMCIA_CFE_IRQLEVEL;
   1303 
   1304 		if (reg & PCMCIA_TPCE_IR_HASMASK) {
   1305 			/*
   1306 			 * it's legal to ignore the
   1307 			 * special-interrupt bits, so I will
   1308 			 */
   1309 
   1310 			cfe->irqmask =
   1311 			    pcmcia_tuple_read_2(tuple, idx);
   1312 			idx += 2;
   1313 		} else {
   1314 			cfe->irqmask =
   1315 			    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
   1316 		}
   1317 	}
   1318 	if (memspace) {
   1319 		int lengthsize;
   1320 		int cardaddrsize;
   1321 		int hostaddrsize;
   1322 
   1323 		if (tuple->length <= idx) {
   1324 			DPRINTF(("ran out of space before TCPE_MS\n"));
   1325 			goto abort_cfe;
   1326 		}
   1327 
   1328 		switch (memspace) {
   1329 #ifdef notdef	/* This is 0 */
   1330 		case PCMCIA_TPCE_FS_MEMSPACE_NONE:
   1331 			cfe->num_memspace = 0;
   1332 			break;
   1333 #endif
   1334 
   1335 		case PCMCIA_TPCE_FS_MEMSPACE_LENGTH:
   1336 			cfe->num_memspace = 1;
   1337 			cfe->memspace[0].length = 256 *
   1338 			    pcmcia_tuple_read_2(tuple, idx);
   1339 			idx += 2;
   1340 			cfe->memspace[0].cardaddr = 0;
   1341 			cfe->memspace[0].hostaddr = 0;
   1342 			break;
   1343 
   1344 		case PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR:
   1345 			cfe->num_memspace = 1;
   1346 			cfe->memspace[0].length = 256 *
   1347 			    pcmcia_tuple_read_2(tuple, idx);
   1348 			idx += 2;
   1349 			cfe->memspace[0].cardaddr = 256 *
   1350 			    pcmcia_tuple_read_2(tuple, idx);
   1351 			idx += 2;
   1352 			cfe->memspace[0].hostaddr =
   1353 			    cfe->memspace[0].cardaddr;
   1354 			break;
   1355 
   1356 		default:
   1357 			reg = pcmcia_tuple_read_1(tuple, idx);
   1358 			idx++;
   1359 
   1360 			cfe->num_memspace = (reg & PCMCIA_TPCE_MS_COUNT)
   1361 			    + 1;
   1362 
   1363 			if (cfe->num_memspace >
   1364 			    (sizeof(cfe->memspace) /
   1365 				sizeof(cfe->memspace[0]))) {
   1366 				DPRINTF(("too many mem spaces %d",
   1367 				    cfe->num_memspace));
   1368 				state->card->error++;
   1369 				return;
   1370 			}
   1371 			lengthsize =
   1372 			    ((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
   1373 				PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
   1374 			cardaddrsize =
   1375 			    ((reg &
   1376 				PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
   1377 				  PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
   1378 			hostaddrsize =
   1379 			    (reg & PCMCIA_TPCE_MS_HOSTADDR) ?
   1380 			    cardaddrsize : 0;
   1381 
   1382 			if (lengthsize == 0) {
   1383 				DPRINTF(("cfe memspace "
   1384 				    "lengthsize == 0"));
   1385 				state->card->error++;
   1386 			}
   1387 			for (i = 0; i < cfe->num_memspace; i++) {
   1388 				if (lengthsize) {
   1389 					cfe->memspace[i].length = 256 *
   1390 					    pcmcia_tuple_read_n(tuple,
   1391 						lengthsize, idx);
   1392 					idx += lengthsize;
   1393 				} else {
   1394 					cfe->memspace[i].length = 0;
   1395 				}
   1396 				if (cfe->memspace[i].length == 0) {
   1397 					DPRINTF(("cfe->memspace"
   1398 					    "[%d].length == 0", i));
   1399 					state->card->error++;
   1400 				}
   1401 				if (cardaddrsize) {
   1402 					cfe->memspace[i].cardaddr =
   1403 					    256 *
   1404 					    pcmcia_tuple_read_n(tuple,
   1405 						cardaddrsize, idx);
   1406 					idx += cardaddrsize;
   1407 				} else {
   1408 					cfe->memspace[i].cardaddr = 0;
   1409 				}
   1410 				if (hostaddrsize) {
   1411 					cfe->memspace[i].hostaddr =
   1412 					    256 *
   1413 					    pcmcia_tuple_read_n(tuple,
   1414 						hostaddrsize, idx);
   1415 					idx += hostaddrsize;
   1416 				} else {
   1417 					cfe->memspace[i].hostaddr = 0;
   1418 				}
   1419 			}
   1420 		}
   1421 	}
   1422 
   1423 	if (misc) {
   1424 		if (tuple->length <= idx) {
   1425 			DPRINTF(("ran out of space before TCPE_MI\n"));
   1426 			goto abort_cfe;
   1427 		}
   1428 
   1429 		reg = pcmcia_tuple_read_1(tuple, idx);
   1430 		idx++;
   1431 
   1432 		cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
   1433 		    | PCMCIA_CFE_READONLY
   1434 		    | PCMCIA_CFE_AUDIO);
   1435 		if (reg & PCMCIA_TPCE_MI_PWRDOWN)
   1436 			cfe->flags |= PCMCIA_CFE_POWERDOWN;
   1437 		if (reg & PCMCIA_TPCE_MI_READONLY)
   1438 			cfe->flags |= PCMCIA_CFE_READONLY;
   1439 		if (reg & PCMCIA_TPCE_MI_AUDIO)
   1440 			cfe->flags |= PCMCIA_CFE_AUDIO;
   1441 		cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
   1442 
   1443 		while (reg & PCMCIA_TPCE_MI_EXT) {
   1444 			reg = pcmcia_tuple_read_1(tuple, idx);
   1445 			idx++;
   1446 		}
   1447 	}
   1448 
   1449 	/* skip all the subtuples */
   1450 abort_cfe:
   1451 	DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
   1452 }
   1453