pcmcia_cis.c revision 1.47
1/*	$NetBSD: pcmcia_cis.c,v 1.47 2006/09/02 18:58:02 christos Exp $	*/
2
3/*
4 * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 *    must display the following acknowledgement:
16 *	This product includes software developed by Marc Horowitz.
17 * 4. The name of the author may not be used to endorse or promote products
18 *    derived from this software without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: pcmcia_cis.c,v 1.47 2006/09/02 18:58:02 christos Exp $");
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/device.h>
38#include <sys/malloc.h>
39
40#include <dev/pcmcia/pcmciareg.h>
41#include <dev/pcmcia/pcmciachip.h>
42#include <dev/pcmcia/pcmciavar.h>
43
44#ifdef PCMCIACISDEBUG
45int	pcmciacis_debug = 0;
46#define	DPRINTF(arg) if (pcmciacis_debug) printf arg
47#else
48#define	DPRINTF(arg)
49#endif
50
51#define	PCMCIA_CIS_SIZE		1024
52
53struct cis_state {
54	int	count;
55	int	gotmfc;
56	struct pcmcia_config_entry temp_cfe;
57	struct pcmcia_config_entry *default_cfe;
58	struct pcmcia_card *card;
59	struct pcmcia_function *pf;
60};
61
62int	pcmcia_parse_cis_tuple(struct pcmcia_tuple *, void *);
63static void create_pf(struct cis_state *);
64
65static void decode_end(struct pcmcia_tuple *, struct cis_state *);
66static void decode_longlink_mfc(struct pcmcia_tuple *, struct cis_state *);
67static void decode_device(struct pcmcia_tuple *, struct cis_state *);
68static void decode_vers_1(struct pcmcia_tuple *, struct cis_state *);
69static void decode_manfid(struct pcmcia_tuple *, struct cis_state *);
70static void decode_funcid(struct pcmcia_tuple *, struct cis_state *);
71static void decode_funce(struct pcmcia_tuple *, struct cis_state *);
72static void decode_config(struct pcmcia_tuple *, struct cis_state *);
73static void decode_cftable_entry(struct pcmcia_tuple *, struct cis_state *);
74
75
76static void
77create_pf(struct cis_state *state)
78{
79	state->pf = malloc(sizeof(*state->pf), M_DEVBUF, M_NOWAIT|M_ZERO);
80	state->pf->number = state->count++;
81	state->pf->last_config_index = -1;
82	SIMPLEQ_INIT(&state->pf->cfe_head);
83	SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list);
84}
85
86void
87pcmcia_free_pf(struct pcmcia_function_head *pfhead)
88{
89	struct pcmcia_function *pf, *npf;
90	struct pcmcia_config_entry *cfe, *ncfe;
91
92	for (pf = SIMPLEQ_FIRST(pfhead); pf != NULL; pf = npf) {
93		npf = SIMPLEQ_NEXT(pf, pf_list);
94		for (cfe = SIMPLEQ_FIRST(&pf->cfe_head); cfe != NULL;
95		    cfe = ncfe) {
96			ncfe = SIMPLEQ_NEXT(cfe, cfe_list);
97			free(cfe, M_DEVBUF);
98		}
99		free(pf, M_DEVBUF);
100	}
101
102	SIMPLEQ_INIT(pfhead);
103}
104
105void
106pcmcia_read_cis(sc)
107	struct pcmcia_softc *sc;
108{
109	struct cis_state state;
110
111	memset(&state, 0, sizeof state);
112
113	state.card = &sc->card;
114
115	state.card->error = 0;
116	state.card->cis1_major = -1;
117	state.card->cis1_minor = -1;
118	state.card->cis1_info[0] = NULL;
119	state.card->cis1_info[1] = NULL;
120	state.card->cis1_info[2] = NULL;
121	state.card->cis1_info[3] = NULL;
122	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
123	state.card->product = PCMCIA_PRODUCT_INVALID;
124	SIMPLEQ_INIT(&state.card->pf_head);
125
126	state.pf = NULL;
127
128	if (pcmcia_scan_cis((struct device *)sc, pcmcia_parse_cis_tuple,
129	    &state) == -1)
130		state.card->error++;
131}
132
133int
134pcmcia_scan_cis(dev, fct, arg)
135	struct device *dev;
136	int (*fct)(struct pcmcia_tuple *, void *);
137	void *arg;
138{
139	struct pcmcia_softc *sc = (struct pcmcia_softc *) dev;
140	pcmcia_chipset_tag_t pct;
141	pcmcia_chipset_handle_t pch;
142	int window;
143	struct pcmcia_mem_handle pcmh;
144	struct pcmcia_tuple tuple;
145	int longlink_present;
146	int longlink_common;
147	u_long longlink_addr;
148	int mfc_count;
149	int mfc_index;
150	struct {
151		int	common;
152		u_long	addr;
153	} mfc[256 / 5];
154	int ret;
155
156	ret = 0;
157
158	pct = sc->pct;
159	pch = sc->pch;
160
161	/* allocate some memory */
162
163	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
164#ifdef DIAGNOSTIC
165		printf("%s: can't alloc memory to read attributes\n",
166		    sc->dev.dv_xname);
167#endif
168		return -1;
169	}
170	/* initialize state for the primary tuple chain */
171	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
172	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
173		pcmcia_chip_mem_free(pct, pch, &pcmh);
174#ifdef DIAGNOSTIC
175		printf("%s: can't map memory to read attributes\n",
176		    sc->dev.dv_xname);
177#endif
178		return -1;
179	}
180	tuple.memt = pcmh.memt;
181	tuple.memh = pcmh.memh;
182
183	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
184
185	tuple.mult = 2;
186
187	longlink_present = 1;
188	longlink_common = 1;
189	longlink_addr = 0;
190
191	mfc_count = 0;
192	mfc_index = 0;
193
194	DPRINTF(("%s: CIS tuple chain:\n", sc->dev.dv_xname));
195
196	while (1) {
197		DELAY(1000);
198
199		while (1) {
200			/*
201			 * Perform boundary check for insane cards.
202			 * If CIS is too long, simulate CIS end.
203			 * (This check may not be sufficient for
204			 * malicious cards.)
205			 */
206			if (tuple.mult * tuple.ptr >= PCMCIA_CIS_SIZE - 1
207			    - 32 /* ad hoc value */ ) {
208				DPRINTF(("CISTPL_END (too long CIS)\n"));
209				tuple.code = PCMCIA_CISTPL_END;
210				goto cis_end;
211			}
212
213			/* get the tuple code */
214
215			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
216
217			/* two special-case tuples */
218
219			if (tuple.code == PCMCIA_CISTPL_NULL) {
220				DPRINTF((" 00\nCISTPL_NONE\n"));
221				tuple.ptr++;
222				continue;
223			} else if (tuple.code == PCMCIA_CISTPL_END) {
224				DPRINTF((" ff\nCISTPL_END\n"));
225			cis_end:
226				/* Call the function for the END tuple, since
227				   the CIS semantics depend on it */
228				if ((*fct) (&tuple, arg)) {
229					pcmcia_chip_mem_unmap(pct, pch,
230							      window);
231					ret = 1;
232					goto done;
233				}
234				tuple.ptr++;
235				break;
236			}
237
238			/* now all the normal tuples */
239
240			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
241#ifdef PCMCIACISDEBUG
242			/* print the tuple */
243			{
244				int i;
245
246				DPRINTF((" %02x %02x", tuple.code,
247				    tuple.length));
248
249				for (i = 0; i < tuple.length; i++) {
250					DPRINTF((" %02x",
251					    pcmcia_tuple_read_1(&tuple, i)));
252					if ((i % 16) == 13)
253						DPRINTF(("\n"));
254				}
255				if ((i % 16) != 14)
256					DPRINTF(("\n"));
257			}
258#endif
259			switch (tuple.code) {
260			case PCMCIA_CISTPL_LONGLINK_A:
261			case PCMCIA_CISTPL_LONGLINK_C:
262				if (tuple.length < 4) {
263					DPRINTF(("CISTPL_LONGLINK_%s too "
264					    "short %d\n",
265					    longlink_common ? "C" : "A",
266					    tuple.length));
267					break;
268				}
269				longlink_present = 1;
270				longlink_common = (tuple.code ==
271				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
272				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
273				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
274				    longlink_common ? "C" : "A",
275				    longlink_addr));
276				break;
277			case PCMCIA_CISTPL_NO_LINK:
278				longlink_present = 0;
279				DPRINTF(("CISTPL_NO_LINK\n"));
280				break;
281			case PCMCIA_CISTPL_CHECKSUM:
282				if (tuple.length < 5) {
283					DPRINTF(("CISTPL_CHECKSUM too "
284					    "short %d\n", tuple.length));
285					break;
286				} {
287					int16_t offset;
288					u_long addr, length;
289					u_int cksum, sum;
290					int i;
291
292					*((u_int16_t *) & offset) =
293					    pcmcia_tuple_read_2(&tuple, 0);
294					length = pcmcia_tuple_read_2(&tuple, 2);
295					cksum = pcmcia_tuple_read_1(&tuple, 4);
296
297					addr = tuple.ptr + offset;
298
299					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
300					    "len=%lx cksum=%x",
301					    addr, length, cksum));
302
303					/*
304					 * XXX do more work to deal with
305					 * distant regions
306					 */
307					if ((addr >= PCMCIA_CIS_SIZE) ||
308#if 0
309					    ((addr + length) < 0) ||
310#endif
311					    ((addr + length) >=
312					      PCMCIA_CIS_SIZE)) {
313						DPRINTF((" skipped, "
314						    "too distant\n"));
315						break;
316					}
317					sum = 0;
318					for (i = 0; i < length; i++)
319						sum +=
320						    bus_space_read_1(tuple.memt,
321						    tuple.memh,
322						    addr + tuple.mult * i);
323					if (cksum != (sum & 0xff)) {
324						DPRINTF((" failed sum=%x\n",
325						    sum));
326						printf("%s: CIS checksum "
327						    "failed\n",
328						    sc->dev.dv_xname);
329#if 0
330						/*
331						 * XXX Some working cards have
332						 * XXX bad checksums!!
333						 */
334						ret = -1;
335#endif
336					} else {
337						DPRINTF((" ok\n"));
338					}
339				}
340				break;
341			case PCMCIA_CISTPL_LONGLINK_MFC:
342				if (tuple.length < 1) {
343					DPRINTF(("CISTPL_LONGLINK_MFC too "
344					    "short %d\n", tuple.length));
345					break;
346				}
347				if (((tuple.length - 1) % 5) != 0) {
348					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
349					    "length %d\n", tuple.length));
350					break;
351				}
352				/*
353				 * this is kind of ad hoc, as I don't have
354				 * any real documentation
355				 */
356				{
357					int i, tmp_count;
358
359					/*
360					 * put count into tmp var so that
361					 * if we have to bail (because it's
362					 * a bogus count) it won't be
363					 * remembered for later use.
364					 */
365					tmp_count =
366					    pcmcia_tuple_read_1(&tuple, 0);
367					DPRINTF(("CISTPL_LONGLINK_MFC %d",
368					    tmp_count));
369
370					/*
371					 * make _sure_ it's the right size;
372					 * if too short, it may be a weird
373					 * (unknown/undefined) format
374					 */
375					if (tuple.length != (tmp_count*5 + 1)) {
376						DPRINTF((" bogus length %d\n",
377						    tuple.length));
378						break;
379					}
380
381#ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
382					/*
383					 * sanity check for a programming
384					 * error which is difficult to find
385					 * when debugging.
386					 */
387					if (tmp_count >
388					    howmany(sizeof mfc, sizeof mfc[0]))
389						panic("CISTPL_LONGLINK_MFC mfc "
390						    "count would blow stack");
391#endif
392
393					mfc_count = tmp_count;
394					for (i = 0; i < mfc_count; i++) {
395						mfc[i].common =
396						    (pcmcia_tuple_read_1(&tuple,
397						    1 + 5 * i) ==
398						    PCMCIA_MFC_MEM_COMMON) ?
399						    1 : 0;
400						mfc[i].addr =
401						    pcmcia_tuple_read_4(&tuple,
402						    1 + 5 * i + 1);
403						DPRINTF((" %s:%lx",
404						    mfc[i].common ? "common" :
405						    "attr", mfc[i].addr));
406					}
407					DPRINTF(("\n"));
408				}
409				/*
410				 * for LONGLINK_MFC, fall through to the
411				 * function.  This tuple has structural and
412				 * semantic content.
413				 */
414			default:
415				{
416					if ((*fct) (&tuple, arg)) {
417						pcmcia_chip_mem_unmap(pct,
418						    pch, window);
419						ret = 1;
420						goto done;
421					}
422				}
423				break;
424			}	/* switch */
425			/* skip to the next tuple */
426			tuple.ptr += 2 + tuple.length;
427		}
428
429		/*
430		 * the chain is done.  Clean up and move onto the next one,
431		 * if any.  The loop is here in the case that there is an MFC
432		 * card with no longlink (which defaults to existing, == 0).
433		 * In general, this means that if one pointer fails, it will
434		 * try the next one, instead of just bailing.
435		 */
436
437		while (1) {
438			pcmcia_chip_mem_unmap(pct, pch, window);
439
440			if (longlink_present) {
441				/*
442				 * if the longlink is to attribute memory,
443				 * then it is unindexed.  That is, if the
444				 * link value is 0x100, then the actual
445				 * memory address is 0x200.  This means that
446				 * we need to multiply by 2 before calling
447				 * mem_map, and then divide the resulting ptr
448				 * by 2 after.
449				 */
450
451				if (!longlink_common)
452					longlink_addr *= 2;
453
454				pcmcia_chip_mem_map(pct, pch, longlink_common ?
455				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
456				    PCMCIA_MEM_ATTR,
457				    longlink_addr, PCMCIA_CIS_SIZE,
458				    &pcmh, &tuple.ptr, &window);
459
460				tuple.memt = pcmh.memt;
461				tuple.memh = pcmh.memh;
462
463				if (!longlink_common)
464					tuple.ptr /= 2;
465
466				DPRINTF(("cis mem map %x\n",
467				    (unsigned int) tuple.memh));
468
469				tuple.mult = longlink_common ? 1 : 2;
470				longlink_present = 0;
471				longlink_common = 1;
472				longlink_addr = 0;
473			} else if (mfc_count && (mfc_index < mfc_count)) {
474				if (!mfc[mfc_index].common)
475					mfc[mfc_index].addr *= 2;
476
477				pcmcia_chip_mem_map(pct, pch,
478				    mfc[mfc_index].common ?
479				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
480				    PCMCIA_MEM_ATTR,
481				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
482				    &pcmh, &tuple.ptr, &window);
483
484				if (!mfc[mfc_index].common)
485					tuple.ptr /= 2;
486
487				DPRINTF(("cis mem map %x\n",
488				    (unsigned int) tuple.memh));
489
490				/* set parse state, and point at the next one */
491
492				tuple.mult = mfc[mfc_index].common ? 1 : 2;
493
494				mfc_index++;
495			} else {
496				goto done;
497			}
498
499			/* make sure that the link is valid */
500			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
501			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
502				DPRINTF(("CISTPL_LINKTARGET expected, "
503				    "code %02x observed\n", tuple.code));
504				continue;
505			}
506			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
507			if (tuple.length < 3) {
508				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
509				    tuple.length));
510				continue;
511			}
512			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
513			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
514			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
515				DPRINTF(("CISTPL_LINKTARGET magic "
516				    "%02x%02x%02x incorrect\n",
517				    pcmcia_tuple_read_1(&tuple, 0),
518				    pcmcia_tuple_read_1(&tuple, 1),
519				    pcmcia_tuple_read_1(&tuple, 2)));
520				continue;
521			}
522			tuple.ptr += 2 + tuple.length;
523
524			break;
525		}
526	}
527
528	pcmcia_chip_mem_unmap(pct, pch, window);
529
530done:
531	/* Last, free the allocated memory block */
532	pcmcia_chip_mem_free(pct, pch, &pcmh);
533
534	return (ret);
535}
536
537/* XXX this is incredibly verbose.  Not sure what trt is */
538
539void
540pcmcia_print_cis(sc)
541	struct pcmcia_softc *sc;
542{
543	struct pcmcia_card *card = &sc->card;
544	struct pcmcia_function *pf;
545	struct pcmcia_config_entry *cfe;
546	int i;
547
548	printf("%s: CIS version ", sc->dev.dv_xname);
549	if (card->cis1_major == 4) {
550		if (card->cis1_minor == 0)
551			printf("PCMCIA 1.0\n");
552		else if (card->cis1_minor == 1)
553			printf("PCMCIA 2.0 or 2.1\n");
554	} else if (card->cis1_major >= 5)
555		printf("PC Card Standard %d.%d\n", card->cis1_major, card->cis1_minor);
556	else
557		printf("unknown (major=%d, minor=%d)\n",
558		    card->cis1_major, card->cis1_minor);
559
560	printf("%s: CIS info: ", sc->dev.dv_xname);
561	for (i = 0; i < 4; i++) {
562		if (card->cis1_info[i] == NULL)
563			break;
564		if (i)
565			printf(", ");
566		printf("%s", card->cis1_info[i]);
567	}
568	printf("\n");
569
570	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
571	       sc->dev.dv_xname, card->manufacturer, card->product);
572
573	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
574		printf("%s: function %d: ", sc->dev.dv_xname, pf->number);
575
576		switch (pf->function) {
577		case PCMCIA_FUNCTION_UNSPEC:
578			printf("unspecified");
579			break;
580		case PCMCIA_FUNCTION_MULTIFUNCTION:
581			printf("multi-function");
582			break;
583		case PCMCIA_FUNCTION_MEMORY:
584			printf("memory");
585			break;
586		case PCMCIA_FUNCTION_SERIAL:
587			printf("serial port");
588			break;
589		case PCMCIA_FUNCTION_PARALLEL:
590			printf("parallel port");
591			break;
592		case PCMCIA_FUNCTION_DISK:
593			printf("fixed disk");
594			switch (pf->pf_funce_disk_interface) {
595			case PCMCIA_TPLFE_DDI_PCCARD_ATA:
596				printf("(ata)");
597				break;
598			default:
599				break;
600			}
601			break;
602		case PCMCIA_FUNCTION_VIDEO:
603			printf("video adapter");
604			break;
605		case PCMCIA_FUNCTION_NETWORK:
606			printf("network adapter");
607			break;
608		case PCMCIA_FUNCTION_AIMS:
609			printf("auto incrementing mass storage");
610			break;
611		case PCMCIA_FUNCTION_SCSI:
612			printf("SCSI bridge");
613			break;
614		case PCMCIA_FUNCTION_SECURITY:
615			printf("Security services");
616			break;
617		case PCMCIA_FUNCTION_INSTRUMENT:
618			printf("Instrument");
619			break;
620		default:
621			printf("unknown (%d)", pf->function);
622			break;
623		}
624
625		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
626
627		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
628			printf("%s: function %d, config table entry %d: ",
629			    sc->dev.dv_xname, pf->number, cfe->number);
630
631			switch (cfe->iftype) {
632			case PCMCIA_IFTYPE_MEMORY:
633				printf("memory card");
634				break;
635			case PCMCIA_IFTYPE_IO:
636				printf("I/O card");
637				break;
638			default:
639				printf("card type unknown");
640				break;
641			}
642
643			printf("; irq mask %x", cfe->irqmask);
644
645			if (cfe->num_iospace) {
646				printf("; iomask %lx, iospace", cfe->iomask);
647
648				for (i = 0; i < cfe->num_iospace; i++) {
649					printf(" %lx", cfe->iospace[i].start);
650					if (cfe->iospace[i].length)
651						printf("-%lx",
652						    cfe->iospace[i].start +
653						    cfe->iospace[i].length - 1);
654				}
655			}
656			if (cfe->num_memspace) {
657				printf("; memspace");
658
659				for (i = 0; i < cfe->num_memspace; i++) {
660					printf(" %lx",
661					    cfe->memspace[i].cardaddr);
662					if (cfe->memspace[i].length)
663						printf("-%lx",
664						    cfe->memspace[i].cardaddr +
665						    cfe->memspace[i].length - 1);
666					if (cfe->memspace[i].hostaddr)
667						printf("@%lx",
668						    cfe->memspace[i].hostaddr);
669				}
670			}
671			if (cfe->maxtwins)
672				printf("; maxtwins %d", cfe->maxtwins);
673
674			printf(";");
675
676			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
677				printf(" mwait_required");
678			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
679				printf(" rdybsy_active");
680			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
681				printf(" wp_active");
682			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
683				printf(" bvd_active");
684			if (cfe->flags & PCMCIA_CFE_IO8)
685				printf(" io8");
686			if (cfe->flags & PCMCIA_CFE_IO16)
687				printf(" io16");
688			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
689				printf(" irqshare");
690			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
691				printf(" irqpulse");
692			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
693				printf(" irqlevel");
694			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
695				printf(" powerdown");
696			if (cfe->flags & PCMCIA_CFE_READONLY)
697				printf(" readonly");
698			if (cfe->flags & PCMCIA_CFE_AUDIO)
699				printf(" audio");
700
701			printf("\n");
702		}
703	}
704
705	if (card->error)
706		printf("%s: %d errors found while parsing CIS\n",
707		    sc->dev.dv_xname, card->error);
708}
709
710int
711pcmcia_parse_cis_tuple(tuple, arg)
712	struct pcmcia_tuple *tuple;
713	void *arg;
714{
715	struct cis_state *state = arg;
716
717	switch (tuple->code) {
718	case PCMCIA_CISTPL_END:
719		decode_end(tuple, state);
720		break;
721
722	case PCMCIA_CISTPL_LONGLINK_MFC:
723		decode_longlink_mfc(tuple, state);
724		break;
725
726	case PCMCIA_CISTPL_DEVICE:
727	case PCMCIA_CISTPL_DEVICE_A:
728		decode_device(tuple, state);
729		break;
730
731	case PCMCIA_CISTPL_VERS_1:
732		decode_vers_1(tuple, state);
733		break;
734
735	case PCMCIA_CISTPL_MANFID:
736		decode_manfid(tuple, state);
737		break;
738
739	case PCMCIA_CISTPL_FUNCID:
740		decode_funcid(tuple, state);
741		break;
742
743	case PCMCIA_CISTPL_FUNCE:
744		decode_funce(tuple, state);
745		break;
746
747	case PCMCIA_CISTPL_CONFIG:
748		decode_config(tuple, state);
749		break;
750
751	case PCMCIA_CISTPL_CFTABLE_ENTRY:
752		decode_cftable_entry(tuple, state);
753		break;
754	default:
755		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
756		break;
757	}
758
759	return (0);
760}
761
762static void
763decode_end(struct pcmcia_tuple *tuple, struct cis_state *state)
764{
765	/* if we've seen a LONGLINK_MFC, and this is the first
766	 * END after it, reset the function list.
767	 *
768	 * XXX This might also be the right place to start a
769	 * new function, but that assumes that a function
770	 * definition never crosses any longlink, and I'm not
771	 * sure about that.  This is probably safe for MFC
772	 * cards, but what we have now isn't broken, so I'd
773	 * rather not change it.
774	 */
775	if (state->gotmfc == 1) {
776		state->gotmfc = 2;
777		state->count = 0;
778		state->pf = NULL;
779
780		pcmcia_free_pf(&state->card->pf_head);
781	}
782}
783
784static void
785decode_longlink_mfc(struct pcmcia_tuple *tuple, struct cis_state *state)
786{
787	/*
788	 * this tuple's structure was dealt with in scan_cis.  here,
789	 * record the fact that the MFC tuple was seen, so that
790	 * functions declared before the MFC link can be cleaned
791	 * up.
792	 */
793	if (state->gotmfc == 0) {
794		state->gotmfc = 1;
795	} else {
796		DPRINTF(("got LONGLINK_MFC again!"));
797	}
798}
799
800static void
801decode_device(struct pcmcia_tuple *tuple, struct cis_state *state)
802{
803#ifdef PCMCIACISDEBUG
804	u_int reg, dtype, dspeed;
805
806	reg = pcmcia_tuple_read_1(tuple, 0);
807	dtype = reg & PCMCIA_DTYPE_MASK;
808	dspeed = reg & PCMCIA_DSPEED_MASK;
809
810	DPRINTF(("CISTPL_DEVICE%s type=",
811	(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
812	switch (dtype) {
813	case PCMCIA_DTYPE_NULL:
814		DPRINTF(("null"));
815		break;
816	case PCMCIA_DTYPE_ROM:
817		DPRINTF(("rom"));
818		break;
819	case PCMCIA_DTYPE_OTPROM:
820		DPRINTF(("otprom"));
821		break;
822	case PCMCIA_DTYPE_EPROM:
823		DPRINTF(("eprom"));
824		break;
825	case PCMCIA_DTYPE_EEPROM:
826		DPRINTF(("eeprom"));
827		break;
828	case PCMCIA_DTYPE_FLASH:
829		DPRINTF(("flash"));
830		break;
831	case PCMCIA_DTYPE_SRAM:
832		DPRINTF(("sram"));
833		break;
834	case PCMCIA_DTYPE_DRAM:
835		DPRINTF(("dram"));
836		break;
837	case PCMCIA_DTYPE_FUNCSPEC:
838		DPRINTF(("funcspec"));
839		break;
840	case PCMCIA_DTYPE_EXTEND:
841		DPRINTF(("extend"));
842		break;
843	default:
844		DPRINTF(("reserved"));
845		break;
846	}
847	DPRINTF((" speed="));
848	switch (dspeed) {
849	case PCMCIA_DSPEED_NULL:
850		DPRINTF(("null"));
851		break;
852	case PCMCIA_DSPEED_250NS:
853		DPRINTF(("250ns"));
854		break;
855	case PCMCIA_DSPEED_200NS:
856		DPRINTF(("200ns"));
857		break;
858	case PCMCIA_DSPEED_150NS:
859		DPRINTF(("150ns"));
860		break;
861	case PCMCIA_DSPEED_100NS:
862		DPRINTF(("100ns"));
863		break;
864	case PCMCIA_DSPEED_EXT:
865		DPRINTF(("ext"));
866		break;
867	default:
868		DPRINTF(("reserved"));
869		break;
870	}
871	DPRINTF(("\n"));
872#endif
873}
874
875static void
876decode_vers_1(struct pcmcia_tuple *tuple, struct cis_state *state)
877{
878	int start, i, ch, count;
879
880	if (tuple->length < 6) {
881		DPRINTF(("CISTPL_VERS_1 too short %d\n",
882		    tuple->length));
883		return;
884	}
885	state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
886	state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
887
888	for (count = 0, start = 0, i = 0;
889	    (count < 4) && ((i + 4) < 256); i++) {
890		ch = pcmcia_tuple_read_1(tuple, 2 + i);
891		if (ch == 0xff) {
892			if (i > start) {
893				state->card->cis1_info_buf[i] = 0;
894				state->card->cis1_info[count] =
895				    state->card->cis1_info_buf + start;
896			}
897			break;
898		}
899		state->card->cis1_info_buf[i] = ch;
900		if (ch == 0) {
901			state->card->cis1_info[count] =
902			    state->card->cis1_info_buf + start;
903			start = i + 1;
904			count++;
905		}
906	}
907	DPRINTF(("CISTPL_VERS_1\n"));
908}
909
910static void
911decode_manfid(struct pcmcia_tuple *tuple, struct cis_state *state)
912{
913	if (tuple->length < 4) {
914		DPRINTF(("CISTPL_MANFID too short %d\n",
915		    tuple->length));
916		return;
917	}
918	state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
919	state->card->product = pcmcia_tuple_read_2(tuple, 2);
920	DPRINTF(("CISTPL_MANFID\n"));
921}
922
923static void
924decode_funcid(struct pcmcia_tuple *tuple, struct cis_state *state)
925{
926	if (tuple->length < 1) {
927		DPRINTF(("CISTPL_FUNCID too short %d\n",
928		    tuple->length));
929		return;
930	}
931	if (state->pf) {
932		if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
933			/*
934			 * This looks like a opportunistic function
935			 * created by a CONFIG tuple.  Just keep it.
936			 */
937		} else {
938			/*
939			 * A function is being defined, end it.
940			 */
941			state->pf = NULL;
942		}
943	}
944	if (state->pf == NULL)
945		create_pf(state);
946	state->pf->function = pcmcia_tuple_read_1(tuple, 0);
947
948	DPRINTF(("CISTPL_FUNCID\n"));
949}
950
951static void
952decode_funce(struct pcmcia_tuple *tuple, struct cis_state *state)
953{
954	struct pcmcia_function *pf = state->pf;
955	int type = pcmcia_tuple_read_1(tuple, 0);
956
957	if (state->pf == NULL || state->pf->function <= 0) {
958		DPRINTF(("CISTPL_FUNCE is not followed by "
959		    "valid CISTPL_FUNCID\n"));
960		return;
961	}
962	if (tuple->length < 2)
963		return;
964	switch (pf->function) {
965	case PCMCIA_FUNCTION_DISK:
966		if (type == PCMCIA_TPLFE_TYPE_DISK_DEVICE_INTERFACE) {
967			pf->pf_funce_disk_interface
968			    = pcmcia_tuple_read_1(tuple, 1);
969		}
970		break;
971	case PCMCIA_FUNCTION_NETWORK:
972		if (type == PCMCIA_TPLFE_TYPE_LAN_NID) {
973			int i;
974			int len = pcmcia_tuple_read_1(tuple, 1);
975			if (tuple->length < 2 + len || len > 8) {
976				/* tuple length not enough or nid too long */
977				break;
978			}
979			for (i = 0; i < len; ++i) {
980				pf->pf_funce_lan_nid[i]
981				    = pcmcia_tuple_read_1(tuple, 2 + i);
982			}
983			pf->pf_funce_lan_nidlen = len;
984		}
985		break;
986	default:
987		break;
988	}
989
990	return;
991}
992
993static void
994decode_config(struct pcmcia_tuple *tuple, struct cis_state *state)
995{
996	u_int reg, rasz, rmsz, rfsz;
997	int i;
998	/* most of these are educated guesses */
999	static const struct pcmcia_config_entry init_cfe = {
1000		-1, PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
1001		PCMCIA_CFE_BVD_ACTIVE, PCMCIA_IFTYPE_MEMORY, 0,
1002	};
1003
1004	if (tuple->length < 3) {
1005		DPRINTF(("CISTPL_CONFIG too short %d\n", tuple->length));
1006		return;
1007	}
1008	reg = pcmcia_tuple_read_1(tuple, 0);
1009	rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
1010	    PCMCIA_TPCC_RASZ_SHIFT);
1011	rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
1012	    PCMCIA_TPCC_RMSZ_SHIFT);
1013	rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
1014	    PCMCIA_TPCC_RFSZ_SHIFT);
1015
1016	if (tuple->length < (rasz + rmsz + rfsz)) {
1017		DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too short %d\n",
1018		    rasz, rmsz, rfsz, tuple->length));
1019		return;
1020	}
1021	if (state->pf == NULL) {
1022		create_pf(state);
1023		state->pf->function = PCMCIA_FUNCTION_UNSPEC;
1024	}
1025	state->pf->last_config_index =
1026	    pcmcia_tuple_read_1(tuple, 1);
1027
1028	state->pf->ccr_base = 0;
1029	for (i = 0; i < rasz; i++)
1030		state->pf->ccr_base |= ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
1031		    (i * 8));
1032
1033	state->pf->ccr_mask = 0;
1034	for (i = 0; i < rmsz; i++)
1035		state->pf->ccr_mask |= ((pcmcia_tuple_read_1(tuple,
1036		    2 + rasz + i)) << (i * 8));
1037
1038	/* skip the reserved area and subtuples */
1039
1040	/* reset the default cfe for each cfe list */
1041	state->temp_cfe = init_cfe;
1042	state->default_cfe = &state->temp_cfe;
1043	DPRINTF(("CISTPL_CONFIG\n"));
1044}
1045
1046static void
1047decode_cftable_entry(struct pcmcia_tuple *tuple, struct cis_state *state)
1048{
1049	int idx, i, j;
1050	u_int reg, reg2;
1051	u_int intface, def, num;
1052	u_int power, timing, iospace, irq, memspace, misc;
1053	struct pcmcia_config_entry *cfe;
1054
1055	idx = 0;
1056
1057	reg = pcmcia_tuple_read_1(tuple, idx);
1058	idx++;
1059	intface = reg & PCMCIA_TPCE_INDX_INTFACE;
1060	def = reg & PCMCIA_TPCE_INDX_DEFAULT;
1061	num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
1062
1063	/*
1064	 * this is a little messy.  Some cards have only a
1065	 * cfentry with the default bit set.  So, as we go
1066	 * through the list, we add new indexes to the queue,
1067	 * and keep a pointer to the last one with the
1068	 * default bit set.  if we see a record with the same
1069	 * index, as the default, we stash the default and
1070	 * replace the queue entry. otherwise, we just add
1071	 * new entries to the queue, pointing the default ptr
1072	 * at them if the default bit is set.  if we get to
1073	 * the end with the default pointer pointing at a
1074	 * record which hasn't had a matching index, that's
1075	 * ok; it just becomes a cfentry like any other.
1076	 */
1077
1078	/*
1079	 * if the index in the cis differs from the default
1080	 * cis, create new entry in the queue and start it
1081	 * with the current default
1082	 */
1083	if (state->default_cfe == NULL) {
1084		DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
1085		    "default\n"));
1086		return;
1087	}
1088	if (num != state->default_cfe->number) {
1089		cfe = malloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT);
1090		if (cfe == NULL) {
1091			printf("Cannot allocate cfe entry\n");
1092			return;
1093		}
1094
1095		*cfe = *state->default_cfe;
1096
1097		SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head, cfe, cfe_list);
1098
1099		cfe->number = num;
1100
1101		/*
1102		 * if the default bit is set in the cis, then
1103		 * point the new default at whatever is being
1104		 * filled in
1105		 */
1106		if (def)
1107			state->default_cfe = cfe;
1108	} else {
1109		/*
1110		 * the cis index matches the default index,
1111		 * fill in the default cfentry.  It is
1112		 * assumed that the cfdefault index is in the
1113		 * queue.  For it to be otherwise, the cis
1114		 * index would have to be -1 (initial
1115		 * condition) which is not possible, or there
1116		 * would have to be a preceding cis entry
1117		 * which had the same cis index and had the
1118		 * default bit unset. Neither condition
1119		 * should happen.  If it does, this cfentry
1120		 * is lost (written into temp space), which
1121		 * is an acceptable failure mode.
1122		 */
1123
1124		cfe = state->default_cfe;
1125
1126		/*
1127		 * if the cis entry does not have the default
1128		 * bit set, copy the default out of the way
1129		 * first.
1130		 */
1131		if (!def) {
1132			state->temp_cfe = *state->default_cfe;
1133			state->default_cfe = &state->temp_cfe;
1134		}
1135	}
1136
1137	if (intface) {
1138		reg = pcmcia_tuple_read_1(tuple, idx);
1139		idx++;
1140		cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
1141		    | PCMCIA_CFE_RDYBSY_ACTIVE
1142		    | PCMCIA_CFE_WP_ACTIVE
1143		    | PCMCIA_CFE_BVD_ACTIVE);
1144		if (reg & PCMCIA_TPCE_IF_MWAIT)
1145			cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
1146		if (reg & PCMCIA_TPCE_IF_RDYBSY)
1147			cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
1148		if (reg & PCMCIA_TPCE_IF_WP)
1149			cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
1150		if (reg & PCMCIA_TPCE_IF_BVD)
1151			cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
1152		cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
1153	}
1154	reg = pcmcia_tuple_read_1(tuple, idx);
1155	idx++;
1156
1157	power = reg & PCMCIA_TPCE_FS_POWER_MASK;
1158	timing = reg & PCMCIA_TPCE_FS_TIMING;
1159	iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
1160	irq = reg & PCMCIA_TPCE_FS_IRQ;
1161	memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
1162	misc = reg & PCMCIA_TPCE_FS_MISC;
1163
1164	if (power) {
1165		/* skip over power, don't save */
1166		/* for each parameter selection byte */
1167		for (i = 0; i < power; i++) {
1168			reg = pcmcia_tuple_read_1(tuple, idx);
1169			idx++;
1170			/* for each bit */
1171			for (j = 0; j < 7; j++) {
1172				/* if the bit is set */
1173				if ((reg >> j) & 0x01) {
1174					/* skip over bytes */
1175					do {
1176						reg2 = pcmcia_tuple_read_1(tuple, idx);
1177						idx++;
1178						/*
1179						 * until
1180						 * non-
1181						 * extension
1182						 * byte
1183						 */
1184					} while (reg2 & 0x80);
1185				}
1186			}
1187		}
1188	}
1189	if (timing) {
1190		/* skip over timing, don't save */
1191		reg = pcmcia_tuple_read_1(tuple, idx);
1192		idx++;
1193
1194		if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
1195		    PCMCIA_TPCE_TD_RESERVED_MASK)
1196			idx++;
1197		if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
1198		    PCMCIA_TPCE_TD_RDYBSY_MASK)
1199			idx++;
1200		if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
1201		    PCMCIA_TPCE_TD_WAIT_MASK)
1202			idx++;
1203	}
1204	if (iospace) {
1205		if (tuple->length <= idx) {
1206			DPRINTF(("ran out of space before TCPE_IO\n"));
1207			goto abort_cfe;
1208		}
1209
1210		reg = pcmcia_tuple_read_1(tuple, idx);
1211		idx++;
1212
1213		cfe->flags &=
1214		    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
1215		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
1216			cfe->flags |= PCMCIA_CFE_IO8;
1217		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
1218			cfe->flags |= PCMCIA_CFE_IO16;
1219		cfe->iomask =
1220		    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
1221
1222		if (reg & PCMCIA_TPCE_IO_HASRANGE) {
1223			reg = pcmcia_tuple_read_1(tuple, idx);
1224			idx++;
1225
1226			cfe->num_iospace = 1 + (reg &
1227			    PCMCIA_TPCE_IO_RANGE_COUNT);
1228
1229			if (cfe->num_iospace >
1230			    (sizeof(cfe->iospace) /
1231			     sizeof(cfe->iospace[0]))) {
1232				DPRINTF(("too many io "
1233				    "spaces %d",
1234				    cfe->num_iospace));
1235				state->card->error++;
1236				return;
1237			}
1238			for (i = 0; i < cfe->num_iospace; i++) {
1239				switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
1240				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_NONE:
1241					cfe->iospace[i].start =
1242					    0;
1243					break;
1244				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
1245					cfe->iospace[i].start =
1246						pcmcia_tuple_read_1(tuple, idx);
1247					idx++;
1248					break;
1249				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
1250					cfe->iospace[i].start =
1251						pcmcia_tuple_read_2(tuple, idx);
1252					idx += 2;
1253					break;
1254				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
1255					cfe->iospace[i].start =
1256						pcmcia_tuple_read_4(tuple, idx);
1257					idx += 4;
1258					break;
1259				}
1260				switch (reg &
1261					PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
1262				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_NONE:
1263					cfe->iospace[i].length =
1264					    0;
1265					break;
1266				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
1267					cfe->iospace[i].length =
1268						pcmcia_tuple_read_1(tuple, idx);
1269					idx++;
1270					break;
1271				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
1272					cfe->iospace[i].length =
1273						pcmcia_tuple_read_2(tuple, idx);
1274					idx += 2;
1275					break;
1276				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
1277					cfe->iospace[i].length =
1278						pcmcia_tuple_read_4(tuple, idx);
1279					idx += 4;
1280					break;
1281				}
1282				cfe->iospace[i].length++;
1283			}
1284		} else {
1285			cfe->num_iospace = 1;
1286			cfe->iospace[0].start = 0;
1287			cfe->iospace[0].length =
1288			    (1 << cfe->iomask);
1289		}
1290	}
1291	if (irq) {
1292		if (tuple->length <= idx) {
1293			DPRINTF(("ran out of space before TCPE_IR\n"));
1294			goto abort_cfe;
1295		}
1296
1297		reg = pcmcia_tuple_read_1(tuple, idx);
1298		idx++;
1299
1300		cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
1301		    | PCMCIA_CFE_IRQPULSE
1302		    | PCMCIA_CFE_IRQLEVEL);
1303		if (reg & PCMCIA_TPCE_IR_SHARE)
1304			cfe->flags |= PCMCIA_CFE_IRQSHARE;
1305		if (reg & PCMCIA_TPCE_IR_PULSE)
1306			cfe->flags |= PCMCIA_CFE_IRQPULSE;
1307		if (reg & PCMCIA_TPCE_IR_LEVEL)
1308			cfe->flags |= PCMCIA_CFE_IRQLEVEL;
1309
1310		if (reg & PCMCIA_TPCE_IR_HASMASK) {
1311			/*
1312			 * it's legal to ignore the
1313			 * special-interrupt bits, so I will
1314			 */
1315
1316			cfe->irqmask =
1317			    pcmcia_tuple_read_2(tuple, idx);
1318			idx += 2;
1319		} else {
1320			cfe->irqmask =
1321			    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
1322		}
1323	}
1324	if (memspace) {
1325		int lengthsize;
1326		int cardaddrsize;
1327		int hostaddrsize;
1328
1329		if (tuple->length <= idx) {
1330			DPRINTF(("ran out of space before TCPE_MS\n"));
1331			goto abort_cfe;
1332		}
1333
1334		switch (memspace) {
1335#ifdef notdef	/* This is 0 */
1336		case PCMCIA_TPCE_FS_MEMSPACE_NONE:
1337			cfe->num_memspace = 0;
1338			break;
1339#endif
1340
1341		case PCMCIA_TPCE_FS_MEMSPACE_LENGTH:
1342			cfe->num_memspace = 1;
1343			cfe->memspace[0].length = 256 *
1344			    pcmcia_tuple_read_2(tuple, idx);
1345			idx += 2;
1346			cfe->memspace[0].cardaddr = 0;
1347			cfe->memspace[0].hostaddr = 0;
1348			break;
1349
1350		case PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR:
1351			cfe->num_memspace = 1;
1352			cfe->memspace[0].length = 256 *
1353			    pcmcia_tuple_read_2(tuple, idx);
1354			idx += 2;
1355			cfe->memspace[0].cardaddr = 256 *
1356			    pcmcia_tuple_read_2(tuple, idx);
1357			idx += 2;
1358			cfe->memspace[0].hostaddr =
1359			    cfe->memspace[0].cardaddr;
1360			break;
1361
1362		default:
1363			reg = pcmcia_tuple_read_1(tuple, idx);
1364			idx++;
1365
1366			cfe->num_memspace = (reg & PCMCIA_TPCE_MS_COUNT)
1367			    + 1;
1368
1369			if (cfe->num_memspace >
1370			    (sizeof(cfe->memspace) /
1371				sizeof(cfe->memspace[0]))) {
1372				DPRINTF(("too many mem spaces %d",
1373				    cfe->num_memspace));
1374				state->card->error++;
1375				return;
1376			}
1377			lengthsize =
1378			    ((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
1379				PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
1380			cardaddrsize =
1381			    ((reg &
1382				PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
1383				  PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
1384			hostaddrsize =
1385			    (reg & PCMCIA_TPCE_MS_HOSTADDR) ?
1386			    cardaddrsize : 0;
1387
1388			if (lengthsize == 0) {
1389				DPRINTF(("cfe memspace "
1390				    "lengthsize == 0"));
1391				state->card->error++;
1392			}
1393			for (i = 0; i < cfe->num_memspace; i++) {
1394				if (lengthsize) {
1395					cfe->memspace[i].length = 256 *
1396					    pcmcia_tuple_read_n(tuple,
1397						lengthsize, idx);
1398					idx += lengthsize;
1399				} else {
1400					cfe->memspace[i].length = 0;
1401				}
1402				if (cfe->memspace[i].length == 0) {
1403					DPRINTF(("cfe->memspace"
1404					    "[%d].length == 0", i));
1405					state->card->error++;
1406				}
1407				if (cardaddrsize) {
1408					cfe->memspace[i].cardaddr =
1409					    256 *
1410					    pcmcia_tuple_read_n(tuple,
1411						cardaddrsize, idx);
1412					idx += cardaddrsize;
1413				} else {
1414					cfe->memspace[i].cardaddr = 0;
1415				}
1416				if (hostaddrsize) {
1417					cfe->memspace[i].hostaddr =
1418					    256 *
1419					    pcmcia_tuple_read_n(tuple,
1420						hostaddrsize, idx);
1421					idx += hostaddrsize;
1422				} else {
1423					cfe->memspace[i].hostaddr = 0;
1424				}
1425			}
1426		}
1427	}
1428
1429	if (misc) {
1430		if (tuple->length <= idx) {
1431			DPRINTF(("ran out of space before TCPE_MI\n"));
1432			goto abort_cfe;
1433		}
1434
1435		reg = pcmcia_tuple_read_1(tuple, idx);
1436		idx++;
1437
1438		cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
1439		    | PCMCIA_CFE_READONLY
1440		    | PCMCIA_CFE_AUDIO);
1441		if (reg & PCMCIA_TPCE_MI_PWRDOWN)
1442			cfe->flags |= PCMCIA_CFE_POWERDOWN;
1443		if (reg & PCMCIA_TPCE_MI_READONLY)
1444			cfe->flags |= PCMCIA_CFE_READONLY;
1445		if (reg & PCMCIA_TPCE_MI_AUDIO)
1446			cfe->flags |= PCMCIA_CFE_AUDIO;
1447		cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
1448
1449		while (reg & PCMCIA_TPCE_MI_EXT) {
1450			reg = pcmcia_tuple_read_1(tuple, idx);
1451			idx++;
1452		}
1453	}
1454
1455	/* skip all the subtuples */
1456abort_cfe:
1457	DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
1458}
1459