pcmcia_cis.c revision 1.50
1/*	$NetBSD: pcmcia_cis.c,v 1.50 2006/11/16 01:33:20 christos Exp $	*/
2
3/*
4 * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 *    must display the following acknowledgement:
16 *	This product includes software developed by Marc Horowitz.
17 * 4. The name of the author may not be used to endorse or promote products
18 *    derived from this software without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: pcmcia_cis.c,v 1.50 2006/11/16 01:33:20 christos Exp $");
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/device.h>
38#include <sys/malloc.h>
39
40#include <dev/pcmcia/pcmciareg.h>
41#include <dev/pcmcia/pcmciachip.h>
42#include <dev/pcmcia/pcmciavar.h>
43
44#ifdef PCMCIACISDEBUG
45int	pcmciacis_debug = 0;
46#define	DPRINTF(arg) if (pcmciacis_debug) printf arg
47#else
48#define	DPRINTF(arg)
49#endif
50
51#define	PCMCIA_CIS_SIZE		1024
52
53struct cis_state {
54	int	count;
55	int	gotmfc;
56	struct pcmcia_config_entry temp_cfe;
57	struct pcmcia_config_entry *default_cfe;
58	struct pcmcia_card *card;
59	struct pcmcia_function *pf;
60};
61
62int	pcmcia_parse_cis_tuple(struct pcmcia_tuple *, void *);
63static void create_pf(struct cis_state *);
64
65static void decode_end(struct pcmcia_tuple *, struct cis_state *);
66static void decode_longlink_mfc(struct pcmcia_tuple *, struct cis_state *);
67static void decode_device(struct pcmcia_tuple *, struct cis_state *);
68static void decode_vers_1(struct pcmcia_tuple *, struct cis_state *);
69static void decode_manfid(struct pcmcia_tuple *, struct cis_state *);
70static void decode_funcid(struct pcmcia_tuple *, struct cis_state *);
71static void decode_funce(struct pcmcia_tuple *, struct cis_state *);
72static void decode_config(struct pcmcia_tuple *, struct cis_state *);
73static void decode_cftable_entry(struct pcmcia_tuple *, struct cis_state *);
74
75
76static void
77create_pf(struct cis_state *state)
78{
79	state->pf = malloc(sizeof(*state->pf), M_DEVBUF, M_NOWAIT|M_ZERO);
80	state->pf->number = state->count++;
81	state->pf->last_config_index = -1;
82	SIMPLEQ_INIT(&state->pf->cfe_head);
83	SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list);
84}
85
86void
87pcmcia_free_pf(struct pcmcia_function_head *pfhead)
88{
89	struct pcmcia_function *pf, *npf;
90	struct pcmcia_config_entry *cfe, *ncfe;
91
92	for (pf = SIMPLEQ_FIRST(pfhead); pf != NULL; pf = npf) {
93		npf = SIMPLEQ_NEXT(pf, pf_list);
94		for (cfe = SIMPLEQ_FIRST(&pf->cfe_head); cfe != NULL;
95		    cfe = ncfe) {
96			ncfe = SIMPLEQ_NEXT(cfe, cfe_list);
97			free(cfe, M_DEVBUF);
98		}
99		free(pf, M_DEVBUF);
100	}
101
102	SIMPLEQ_INIT(pfhead);
103}
104
105void
106pcmcia_read_cis(sc)
107	struct pcmcia_softc *sc;
108{
109	struct cis_state state;
110
111	memset(&state, 0, sizeof state);
112
113	state.card = &sc->card;
114
115	state.card->error = 0;
116	state.card->cis1_major = -1;
117	state.card->cis1_minor = -1;
118	state.card->cis1_info[0] = NULL;
119	state.card->cis1_info[1] = NULL;
120	state.card->cis1_info[2] = NULL;
121	state.card->cis1_info[3] = NULL;
122	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
123	state.card->product = PCMCIA_PRODUCT_INVALID;
124	SIMPLEQ_INIT(&state.card->pf_head);
125
126	state.pf = NULL;
127
128	if (pcmcia_scan_cis((struct device *)sc, pcmcia_parse_cis_tuple,
129	    &state) == -1)
130		state.card->error++;
131}
132
133int
134pcmcia_scan_cis(dev, fct, arg)
135	struct device *dev;
136	int (*fct)(struct pcmcia_tuple *, void *);
137	void *arg;
138{
139	struct pcmcia_softc *sc = (struct pcmcia_softc *) dev;
140	pcmcia_chipset_tag_t pct;
141	pcmcia_chipset_handle_t pch;
142	int window;
143	struct pcmcia_mem_handle pcmh;
144	struct pcmcia_tuple tuple;
145	int longlink_present;
146	int longlink_common;
147	u_long longlink_addr;
148	int mfc_count;
149	int mfc_index;
150	struct {
151		int	common;
152		u_long	addr;
153	} mfc[256 / 5];
154	int ret;
155
156	ret = 0;
157
158	pct = sc->pct;
159	pch = sc->pch;
160
161	/* allocate some memory */
162
163	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
164#ifdef DIAGNOSTIC
165		printf("%s: can't alloc memory to read attributes\n",
166		    sc->dev.dv_xname);
167#endif
168		return -1;
169	}
170	/* initialize state for the primary tuple chain */
171	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
172	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
173		pcmcia_chip_mem_free(pct, pch, &pcmh);
174#ifdef DIAGNOSTIC
175		printf("%s: can't map memory to read attributes\n",
176		    sc->dev.dv_xname);
177#endif
178		return -1;
179	}
180	tuple.memt = pcmh.memt;
181	tuple.memh = pcmh.memh;
182
183	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
184
185	tuple.mult = 2;
186
187	longlink_present = 1;
188	longlink_common = 1;
189	longlink_addr = 0;
190
191	mfc_count = 0;
192	mfc_index = 0;
193
194	DPRINTF(("%s: CIS tuple chain:\n", sc->dev.dv_xname));
195
196	while (1) {
197		DELAY(1000);
198
199		while (1) {
200			/*
201			 * Perform boundary check for insane cards.
202			 * If CIS is too long, simulate CIS end.
203			 * (This check may not be sufficient for
204			 * malicious cards.)
205			 */
206			if (tuple.mult * tuple.ptr >= PCMCIA_CIS_SIZE - 1
207			    - 32 /* ad hoc value */ ) {
208				DPRINTF(("CISTPL_END (too long CIS)\n"));
209				tuple.code = PCMCIA_CISTPL_END;
210				goto cis_end;
211			}
212
213			/* get the tuple code */
214
215			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
216
217			/* two special-case tuples */
218
219			if (tuple.code == PCMCIA_CISTPL_NULL) {
220				DPRINTF((" 00\nCISTPL_NONE\n"));
221				tuple.ptr++;
222				continue;
223			} else if (tuple.code == PCMCIA_CISTPL_END) {
224				DPRINTF((" ff\nCISTPL_END\n"));
225			cis_end:
226				/* Call the function for the END tuple, since
227				   the CIS semantics depend on it */
228				if ((*fct) (&tuple, arg)) {
229					pcmcia_chip_mem_unmap(pct, pch,
230							      window);
231					ret = 1;
232					goto done;
233				}
234				tuple.ptr++;
235				break;
236			}
237
238			/* now all the normal tuples */
239
240			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
241#ifdef PCMCIACISDEBUG
242			/* print the tuple */
243			{
244				int i;
245
246				DPRINTF((" %02x %02x", tuple.code,
247				    tuple.length));
248
249				for (i = 0; i < tuple.length; i++) {
250					DPRINTF((" %02x",
251					    pcmcia_tuple_read_1(&tuple, i)));
252					if ((i % 16) == 13)
253						DPRINTF(("\n"));
254				}
255				if ((i % 16) != 14)
256					DPRINTF(("\n"));
257			}
258#endif
259			switch (tuple.code) {
260			case PCMCIA_CISTPL_LONGLINK_A:
261			case PCMCIA_CISTPL_LONGLINK_C:
262				if (tuple.length < 4) {
263					DPRINTF(("CISTPL_LONGLINK_%s too "
264					    "short %d\n",
265					    longlink_common ? "C" : "A",
266					    tuple.length));
267					break;
268				}
269				longlink_present = 1;
270				longlink_common = (tuple.code ==
271				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
272				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
273				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
274				    longlink_common ? "C" : "A",
275				    longlink_addr));
276				break;
277			case PCMCIA_CISTPL_NO_LINK:
278				longlink_present = 0;
279				DPRINTF(("CISTPL_NO_LINK\n"));
280				break;
281			case PCMCIA_CISTPL_CHECKSUM:
282				if (tuple.length < 5) {
283					DPRINTF(("CISTPL_CHECKSUM too "
284					    "short %d\n", tuple.length));
285					break;
286				} {
287					int16_t offset;
288					u_long addr, length;
289					u_int cksum, sum;
290					int i;
291
292					*((u_int16_t *) & offset) =
293					    pcmcia_tuple_read_2(&tuple, 0);
294					length = pcmcia_tuple_read_2(&tuple, 2);
295					cksum = pcmcia_tuple_read_1(&tuple, 4);
296
297					addr = tuple.ptr + offset;
298
299					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
300					    "len=%lx cksum=%x",
301					    addr, length, cksum));
302
303					/*
304					 * XXX do more work to deal with
305					 * distant regions
306					 */
307					if ((addr >= PCMCIA_CIS_SIZE) ||
308#if 0
309					    ((addr + length) < 0) ||
310#endif
311					    ((addr + length) >=
312					      PCMCIA_CIS_SIZE)) {
313						DPRINTF((" skipped, "
314						    "too distant\n"));
315						break;
316					}
317					sum = 0;
318					for (i = 0; i < length; i++)
319						sum +=
320						    bus_space_read_1(tuple.memt,
321						    tuple.memh,
322						    addr + tuple.mult * i);
323					if (cksum != (sum & 0xff)) {
324						DPRINTF((" failed sum=%x\n",
325						    sum));
326						printf("%s: CIS checksum "
327						    "failed\n",
328						    sc->dev.dv_xname);
329#if 0
330						/*
331						 * XXX Some working cards have
332						 * XXX bad checksums!!
333						 */
334						ret = -1;
335#endif
336					} else {
337						DPRINTF((" ok\n"));
338					}
339				}
340				break;
341			case PCMCIA_CISTPL_LONGLINK_MFC:
342				if (tuple.length < 1) {
343					DPRINTF(("CISTPL_LONGLINK_MFC too "
344					    "short %d\n", tuple.length));
345					break;
346				}
347				if (((tuple.length - 1) % 5) != 0) {
348					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
349					    "length %d\n", tuple.length));
350					break;
351				}
352				/*
353				 * this is kind of ad hoc, as I don't have
354				 * any real documentation
355				 */
356				{
357					int i, tmp_count;
358
359					/*
360					 * put count into tmp var so that
361					 * if we have to bail (because it's
362					 * a bogus count) it won't be
363					 * remembered for later use.
364					 */
365					tmp_count =
366					    pcmcia_tuple_read_1(&tuple, 0);
367					DPRINTF(("CISTPL_LONGLINK_MFC %d",
368					    tmp_count));
369
370					/*
371					 * make _sure_ it's the right size;
372					 * if too short, it may be a weird
373					 * (unknown/undefined) format
374					 */
375					if (tuple.length != (tmp_count*5 + 1)) {
376						DPRINTF((" bogus length %d\n",
377						    tuple.length));
378						break;
379					}
380
381#ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
382					/*
383					 * sanity check for a programming
384					 * error which is difficult to find
385					 * when debugging.
386					 */
387					if (tmp_count >
388					    howmany(sizeof mfc, sizeof mfc[0]))
389						panic("CISTPL_LONGLINK_MFC mfc "
390						    "count would blow stack");
391#endif
392
393					mfc_count = tmp_count;
394					for (i = 0; i < mfc_count; i++) {
395						mfc[i].common =
396						    (pcmcia_tuple_read_1(&tuple,
397						    1 + 5 * i) ==
398						    PCMCIA_MFC_MEM_COMMON) ?
399						    1 : 0;
400						mfc[i].addr =
401						    pcmcia_tuple_read_4(&tuple,
402						    1 + 5 * i + 1);
403						DPRINTF((" %s:%lx",
404						    mfc[i].common ? "common" :
405						    "attr", mfc[i].addr));
406					}
407					DPRINTF(("\n"));
408				}
409				/*
410				 * for LONGLINK_MFC, fall through to the
411				 * function.  This tuple has structural and
412				 * semantic content.
413				 */
414			default:
415				{
416					if ((*fct) (&tuple, arg)) {
417						pcmcia_chip_mem_unmap(pct,
418						    pch, window);
419						ret = 1;
420						goto done;
421					}
422				}
423				break;
424			}	/* switch */
425			/* skip to the next tuple */
426			tuple.ptr += 2 + tuple.length;
427		}
428
429		/*
430		 * the chain is done.  Clean up and move onto the next one,
431		 * if any.  The loop is here in the case that there is an MFC
432		 * card with no longlink (which defaults to existing, == 0).
433		 * In general, this means that if one pointer fails, it will
434		 * try the next one, instead of just bailing.
435		 */
436
437		while (1) {
438			pcmcia_chip_mem_unmap(pct, pch, window);
439
440			if (longlink_present) {
441				/*
442				 * if the longlink is to attribute memory,
443				 * then it is unindexed.  That is, if the
444				 * link value is 0x100, then the actual
445				 * memory address is 0x200.  This means that
446				 * we need to multiply by 2 before calling
447				 * mem_map, and then divide the resulting ptr
448				 * by 2 after.
449				 */
450
451				if (!longlink_common)
452					longlink_addr *= 2;
453
454				pcmcia_chip_mem_map(pct, pch, longlink_common ?
455				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
456				    PCMCIA_MEM_ATTR,
457				    longlink_addr, PCMCIA_CIS_SIZE,
458				    &pcmh, &tuple.ptr, &window);
459
460				tuple.memt = pcmh.memt;
461				tuple.memh = pcmh.memh;
462
463				if (!longlink_common)
464					tuple.ptr /= 2;
465
466				DPRINTF(("cis mem map %x\n",
467				    (unsigned int) tuple.memh));
468
469				tuple.mult = longlink_common ? 1 : 2;
470				longlink_present = 0;
471				longlink_common = 1;
472				longlink_addr = 0;
473			} else if (mfc_count && (mfc_index < mfc_count)) {
474				if (!mfc[mfc_index].common)
475					mfc[mfc_index].addr *= 2;
476
477				pcmcia_chip_mem_map(pct, pch,
478				    mfc[mfc_index].common ?
479				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
480				    PCMCIA_MEM_ATTR,
481				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
482				    &pcmh, &tuple.ptr, &window);
483
484				if (!mfc[mfc_index].common)
485					tuple.ptr /= 2;
486
487				DPRINTF(("cis mem map %x\n",
488				    (unsigned int) tuple.memh));
489
490				/* set parse state, and point at the next one */
491
492				tuple.mult = mfc[mfc_index].common ? 1 : 2;
493
494				mfc_index++;
495			} else {
496				goto done;
497			}
498
499			/* make sure that the link is valid */
500			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
501			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
502				DPRINTF(("CISTPL_LINKTARGET expected, "
503				    "code %02x observed\n", tuple.code));
504				continue;
505			}
506			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
507			if (tuple.length < 3) {
508				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
509				    tuple.length));
510				continue;
511			}
512			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
513			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
514			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
515				DPRINTF(("CISTPL_LINKTARGET magic "
516				    "%02x%02x%02x incorrect\n",
517				    pcmcia_tuple_read_1(&tuple, 0),
518				    pcmcia_tuple_read_1(&tuple, 1),
519				    pcmcia_tuple_read_1(&tuple, 2)));
520				continue;
521			}
522			tuple.ptr += 2 + tuple.length;
523
524			break;
525		}
526	}
527
528	pcmcia_chip_mem_unmap(pct, pch, window);
529
530done:
531	/* Last, free the allocated memory block */
532	pcmcia_chip_mem_free(pct, pch, &pcmh);
533
534	return (ret);
535}
536
537/* XXX this is incredibly verbose.  Not sure what trt is */
538
539void
540pcmcia_print_cis(sc)
541	struct pcmcia_softc *sc;
542{
543	struct pcmcia_card *card = &sc->card;
544	struct pcmcia_function *pf;
545	struct pcmcia_config_entry *cfe;
546	int i;
547
548	printf("%s: CIS version ", sc->dev.dv_xname);
549	if (card->cis1_major == 4) {
550		if (card->cis1_minor == 0)
551			printf("PCMCIA 1.0\n");
552		else if (card->cis1_minor == 1)
553			printf("PCMCIA 2.0 or 2.1\n");
554	} else if (card->cis1_major >= 5)
555		printf("PC Card Standard %d.%d\n", card->cis1_major, card->cis1_minor);
556	else
557		printf("unknown (major=%d, minor=%d)\n",
558		    card->cis1_major, card->cis1_minor);
559
560	printf("%s: CIS info: ", sc->dev.dv_xname);
561	for (i = 0; i < 4; i++) {
562		if (card->cis1_info[i] == NULL)
563			break;
564		if (i)
565			printf(", ");
566		printf("%s", card->cis1_info[i]);
567	}
568	printf("\n");
569
570	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
571	       sc->dev.dv_xname, card->manufacturer, card->product);
572
573	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
574		printf("%s: function %d: ", sc->dev.dv_xname, pf->number);
575
576		switch (pf->function) {
577		case PCMCIA_FUNCTION_UNSPEC:
578			printf("unspecified");
579			break;
580		case PCMCIA_FUNCTION_MULTIFUNCTION:
581			printf("multi-function");
582			break;
583		case PCMCIA_FUNCTION_MEMORY:
584			printf("memory");
585			break;
586		case PCMCIA_FUNCTION_SERIAL:
587			printf("serial port");
588			break;
589		case PCMCIA_FUNCTION_PARALLEL:
590			printf("parallel port");
591			break;
592		case PCMCIA_FUNCTION_DISK:
593			printf("fixed disk");
594			switch (pf->pf_funce_disk_interface) {
595			case PCMCIA_TPLFE_DDI_PCCARD_ATA:
596				printf("(ata)");
597				break;
598			default:
599				break;
600			}
601			break;
602		case PCMCIA_FUNCTION_VIDEO:
603			printf("video adapter");
604			break;
605		case PCMCIA_FUNCTION_NETWORK:
606			printf("network adapter");
607			break;
608		case PCMCIA_FUNCTION_AIMS:
609			printf("auto incrementing mass storage");
610			break;
611		case PCMCIA_FUNCTION_SCSI:
612			printf("SCSI bridge");
613			break;
614		case PCMCIA_FUNCTION_SECURITY:
615			printf("Security services");
616			break;
617		case PCMCIA_FUNCTION_INSTRUMENT:
618			printf("Instrument");
619			break;
620		default:
621			printf("unknown (%d)", pf->function);
622			break;
623		}
624
625		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
626
627		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
628			printf("%s: function %d, config table entry %d: ",
629			    sc->dev.dv_xname, pf->number, cfe->number);
630
631			switch (cfe->iftype) {
632			case PCMCIA_IFTYPE_MEMORY:
633				printf("memory card");
634				break;
635			case PCMCIA_IFTYPE_IO:
636				printf("I/O card");
637				break;
638			default:
639				printf("card type unknown");
640				break;
641			}
642
643			printf("; irq mask %x", cfe->irqmask);
644
645			if (cfe->num_iospace) {
646				printf("; iomask %lx, iospace", cfe->iomask);
647
648				for (i = 0; i < cfe->num_iospace; i++) {
649					printf(" %lx", cfe->iospace[i].start);
650					if (cfe->iospace[i].length)
651						printf("-%lx",
652						    cfe->iospace[i].start +
653						    cfe->iospace[i].length - 1);
654				}
655			}
656			if (cfe->num_memspace) {
657				printf("; memspace");
658
659				for (i = 0; i < cfe->num_memspace; i++) {
660					printf(" %lx",
661					    cfe->memspace[i].cardaddr);
662					if (cfe->memspace[i].length)
663						printf("-%lx",
664						    cfe->memspace[i].cardaddr +
665						    cfe->memspace[i].length - 1);
666					if (cfe->memspace[i].hostaddr)
667						printf("@%lx",
668						    cfe->memspace[i].hostaddr);
669				}
670			}
671			if (cfe->maxtwins)
672				printf("; maxtwins %d", cfe->maxtwins);
673
674			printf(";");
675
676			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
677				printf(" mwait_required");
678			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
679				printf(" rdybsy_active");
680			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
681				printf(" wp_active");
682			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
683				printf(" bvd_active");
684			if (cfe->flags & PCMCIA_CFE_IO8)
685				printf(" io8");
686			if (cfe->flags & PCMCIA_CFE_IO16)
687				printf(" io16");
688			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
689				printf(" irqshare");
690			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
691				printf(" irqpulse");
692			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
693				printf(" irqlevel");
694			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
695				printf(" powerdown");
696			if (cfe->flags & PCMCIA_CFE_READONLY)
697				printf(" readonly");
698			if (cfe->flags & PCMCIA_CFE_AUDIO)
699				printf(" audio");
700
701			printf("\n");
702		}
703	}
704
705	if (card->error)
706		printf("%s: %d errors found while parsing CIS\n",
707		    sc->dev.dv_xname, card->error);
708}
709
710int
711pcmcia_parse_cis_tuple(tuple, arg)
712	struct pcmcia_tuple *tuple;
713	void *arg;
714{
715	struct cis_state *state = arg;
716
717	switch (tuple->code) {
718	case PCMCIA_CISTPL_END:
719		decode_end(tuple, state);
720		break;
721
722	case PCMCIA_CISTPL_LONGLINK_MFC:
723		decode_longlink_mfc(tuple, state);
724		break;
725
726	case PCMCIA_CISTPL_DEVICE:
727	case PCMCIA_CISTPL_DEVICE_A:
728		decode_device(tuple, state);
729		break;
730
731	case PCMCIA_CISTPL_VERS_1:
732		decode_vers_1(tuple, state);
733		break;
734
735	case PCMCIA_CISTPL_MANFID:
736		decode_manfid(tuple, state);
737		break;
738
739	case PCMCIA_CISTPL_FUNCID:
740		decode_funcid(tuple, state);
741		break;
742
743	case PCMCIA_CISTPL_FUNCE:
744		decode_funce(tuple, state);
745		break;
746
747	case PCMCIA_CISTPL_CONFIG:
748		decode_config(tuple, state);
749		break;
750
751	case PCMCIA_CISTPL_CFTABLE_ENTRY:
752		decode_cftable_entry(tuple, state);
753		break;
754	default:
755		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
756		break;
757	}
758
759	return (0);
760}
761
762static void
763decode_end(struct pcmcia_tuple *tuple, struct cis_state *state)
764{
765	/* if we've seen a LONGLINK_MFC, and this is the first
766	 * END after it, reset the function list.
767	 *
768	 * XXX This might also be the right place to start a
769	 * new function, but that assumes that a function
770	 * definition never crosses any longlink, and I'm not
771	 * sure about that.  This is probably safe for MFC
772	 * cards, but what we have now isn't broken, so I'd
773	 * rather not change it.
774	 */
775	if (state->gotmfc == 1) {
776		state->gotmfc = 2;
777		state->count = 0;
778		state->pf = NULL;
779
780		pcmcia_free_pf(&state->card->pf_head);
781	}
782}
783
784static void
785decode_longlink_mfc(struct pcmcia_tuple *tuple,
786    struct cis_state *state)
787{
788	/*
789	 * this tuple's structure was dealt with in scan_cis.  here,
790	 * record the fact that the MFC tuple was seen, so that
791	 * functions declared before the MFC link can be cleaned
792	 * up.
793	 */
794	if (state->gotmfc == 0) {
795		state->gotmfc = 1;
796	} else {
797		DPRINTF(("got LONGLINK_MFC again!"));
798	}
799}
800
801static void
802decode_device(struct pcmcia_tuple *tuple,
803    struct cis_state *state)
804{
805#ifdef PCMCIACISDEBUG
806	u_int reg, dtype, dspeed;
807
808	reg = pcmcia_tuple_read_1(tuple, 0);
809	dtype = reg & PCMCIA_DTYPE_MASK;
810	dspeed = reg & PCMCIA_DSPEED_MASK;
811
812	DPRINTF(("CISTPL_DEVICE%s type=",
813	(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
814	switch (dtype) {
815	case PCMCIA_DTYPE_NULL:
816		DPRINTF(("null"));
817		break;
818	case PCMCIA_DTYPE_ROM:
819		DPRINTF(("rom"));
820		break;
821	case PCMCIA_DTYPE_OTPROM:
822		DPRINTF(("otprom"));
823		break;
824	case PCMCIA_DTYPE_EPROM:
825		DPRINTF(("eprom"));
826		break;
827	case PCMCIA_DTYPE_EEPROM:
828		DPRINTF(("eeprom"));
829		break;
830	case PCMCIA_DTYPE_FLASH:
831		DPRINTF(("flash"));
832		break;
833	case PCMCIA_DTYPE_SRAM:
834		DPRINTF(("sram"));
835		break;
836	case PCMCIA_DTYPE_DRAM:
837		DPRINTF(("dram"));
838		break;
839	case PCMCIA_DTYPE_FUNCSPEC:
840		DPRINTF(("funcspec"));
841		break;
842	case PCMCIA_DTYPE_EXTEND:
843		DPRINTF(("extend"));
844		break;
845	default:
846		DPRINTF(("reserved"));
847		break;
848	}
849	DPRINTF((" speed="));
850	switch (dspeed) {
851	case PCMCIA_DSPEED_NULL:
852		DPRINTF(("null"));
853		break;
854	case PCMCIA_DSPEED_250NS:
855		DPRINTF(("250ns"));
856		break;
857	case PCMCIA_DSPEED_200NS:
858		DPRINTF(("200ns"));
859		break;
860	case PCMCIA_DSPEED_150NS:
861		DPRINTF(("150ns"));
862		break;
863	case PCMCIA_DSPEED_100NS:
864		DPRINTF(("100ns"));
865		break;
866	case PCMCIA_DSPEED_EXT:
867		DPRINTF(("ext"));
868		break;
869	default:
870		DPRINTF(("reserved"));
871		break;
872	}
873	DPRINTF(("\n"));
874#endif
875}
876
877static void
878decode_vers_1(struct pcmcia_tuple *tuple, struct cis_state *state)
879{
880	int start, i, ch, count;
881
882	if (tuple->length < 6) {
883		DPRINTF(("CISTPL_VERS_1 too short %d\n",
884		    tuple->length));
885		return;
886	}
887	state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
888	state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
889
890	for (count = 0, start = 0, i = 0;
891	    (count < 4) && ((i + 4) < 256); i++) {
892		ch = pcmcia_tuple_read_1(tuple, 2 + i);
893		if (ch == 0xff) {
894			if (i > start) {
895				state->card->cis1_info_buf[i] = 0;
896				state->card->cis1_info[count] =
897				    state->card->cis1_info_buf + start;
898			}
899			break;
900		}
901		state->card->cis1_info_buf[i] = ch;
902		if (ch == 0) {
903			state->card->cis1_info[count] =
904			    state->card->cis1_info_buf + start;
905			start = i + 1;
906			count++;
907		}
908	}
909	DPRINTF(("CISTPL_VERS_1\n"));
910}
911
912static void
913decode_manfid(struct pcmcia_tuple *tuple, struct cis_state *state)
914{
915	if (tuple->length < 4) {
916		DPRINTF(("CISTPL_MANFID too short %d\n",
917		    tuple->length));
918		return;
919	}
920	state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
921	state->card->product = pcmcia_tuple_read_2(tuple, 2);
922	DPRINTF(("CISTPL_MANFID\n"));
923}
924
925static void
926decode_funcid(struct pcmcia_tuple *tuple, struct cis_state *state)
927{
928	if (tuple->length < 1) {
929		DPRINTF(("CISTPL_FUNCID too short %d\n",
930		    tuple->length));
931		return;
932	}
933	if (state->pf) {
934		if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
935			/*
936			 * This looks like a opportunistic function
937			 * created by a CONFIG tuple.  Just keep it.
938			 */
939		} else {
940			/*
941			 * A function is being defined, end it.
942			 */
943			state->pf = NULL;
944		}
945	}
946	if (state->pf == NULL)
947		create_pf(state);
948	state->pf->function = pcmcia_tuple_read_1(tuple, 0);
949
950	DPRINTF(("CISTPL_FUNCID\n"));
951}
952
953static void
954decode_funce(struct pcmcia_tuple *tuple, struct cis_state *state)
955{
956	struct pcmcia_function *pf = state->pf;
957	int type = pcmcia_tuple_read_1(tuple, 0);
958
959	if (state->pf == NULL || state->pf->function <= 0) {
960		DPRINTF(("CISTPL_FUNCE is not followed by "
961		    "valid CISTPL_FUNCID\n"));
962		return;
963	}
964	if (tuple->length < 2)
965		return;
966	switch (pf->function) {
967	case PCMCIA_FUNCTION_DISK:
968		if (type == PCMCIA_TPLFE_TYPE_DISK_DEVICE_INTERFACE) {
969			pf->pf_funce_disk_interface
970			    = pcmcia_tuple_read_1(tuple, 1);
971		}
972		break;
973	case PCMCIA_FUNCTION_NETWORK:
974		if (type == PCMCIA_TPLFE_TYPE_LAN_NID) {
975			int i;
976			int len = pcmcia_tuple_read_1(tuple, 1);
977			if (tuple->length < 2 + len || len > 8) {
978				/* tuple length not enough or nid too long */
979				break;
980			}
981			for (i = 0; i < len; ++i) {
982				pf->pf_funce_lan_nid[i]
983				    = pcmcia_tuple_read_1(tuple, 2 + i);
984			}
985			pf->pf_funce_lan_nidlen = len;
986		}
987		break;
988	default:
989		break;
990	}
991
992	return;
993}
994
995static void
996decode_config(struct pcmcia_tuple *tuple, struct cis_state *state)
997{
998	u_int reg, rasz, rmsz, rfsz;
999	int i;
1000	/* most of these are educated guesses */
1001	static const struct pcmcia_config_entry init_cfe = {
1002		.number	= -1,
1003		.flags	= PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
1004			  PCMCIA_CFE_BVD_ACTIVE,
1005		.iftype	= PCMCIA_IFTYPE_MEMORY,
1006	};
1007
1008	if (tuple->length < 3) {
1009		DPRINTF(("CISTPL_CONFIG too short %d\n", tuple->length));
1010		return;
1011	}
1012	reg = pcmcia_tuple_read_1(tuple, 0);
1013	rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
1014	    PCMCIA_TPCC_RASZ_SHIFT);
1015	rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
1016	    PCMCIA_TPCC_RMSZ_SHIFT);
1017	rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
1018	    PCMCIA_TPCC_RFSZ_SHIFT);
1019
1020	if (tuple->length < (rasz + rmsz + rfsz)) {
1021		DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too short %d\n",
1022		    rasz, rmsz, rfsz, tuple->length));
1023		return;
1024	}
1025	if (state->pf == NULL) {
1026		create_pf(state);
1027		state->pf->function = PCMCIA_FUNCTION_UNSPEC;
1028	}
1029	state->pf->last_config_index =
1030	    pcmcia_tuple_read_1(tuple, 1);
1031
1032	state->pf->ccr_base = 0;
1033	for (i = 0; i < rasz; i++)
1034		state->pf->ccr_base |= ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
1035		    (i * 8));
1036
1037	state->pf->ccr_mask = 0;
1038	for (i = 0; i < rmsz; i++)
1039		state->pf->ccr_mask |= ((pcmcia_tuple_read_1(tuple,
1040		    2 + rasz + i)) << (i * 8));
1041
1042	/* skip the reserved area and subtuples */
1043
1044	/* reset the default cfe for each cfe list */
1045	state->temp_cfe = init_cfe;
1046	state->default_cfe = &state->temp_cfe;
1047	DPRINTF(("CISTPL_CONFIG\n"));
1048}
1049
1050static void
1051decode_cftable_entry(struct pcmcia_tuple *tuple, struct cis_state *state)
1052{
1053	int idx, i, j;
1054	u_int reg, reg2;
1055	u_int intface, def, num;
1056	u_int power, timing, iospace, irq, memspace, misc;
1057	struct pcmcia_config_entry *cfe;
1058
1059	idx = 0;
1060
1061	reg = pcmcia_tuple_read_1(tuple, idx);
1062	idx++;
1063	intface = reg & PCMCIA_TPCE_INDX_INTFACE;
1064	def = reg & PCMCIA_TPCE_INDX_DEFAULT;
1065	num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
1066
1067	/*
1068	 * this is a little messy.  Some cards have only a
1069	 * cfentry with the default bit set.  So, as we go
1070	 * through the list, we add new indexes to the queue,
1071	 * and keep a pointer to the last one with the
1072	 * default bit set.  if we see a record with the same
1073	 * index, as the default, we stash the default and
1074	 * replace the queue entry. otherwise, we just add
1075	 * new entries to the queue, pointing the default ptr
1076	 * at them if the default bit is set.  if we get to
1077	 * the end with the default pointer pointing at a
1078	 * record which hasn't had a matching index, that's
1079	 * ok; it just becomes a cfentry like any other.
1080	 */
1081
1082	/*
1083	 * if the index in the cis differs from the default
1084	 * cis, create new entry in the queue and start it
1085	 * with the current default
1086	 */
1087	if (state->default_cfe == NULL) {
1088		DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
1089		    "default\n"));
1090		return;
1091	}
1092	if (num != state->default_cfe->number) {
1093		cfe = malloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT);
1094		if (cfe == NULL) {
1095			printf("Cannot allocate cfe entry\n");
1096			return;
1097		}
1098
1099		*cfe = *state->default_cfe;
1100
1101		SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head, cfe, cfe_list);
1102
1103		cfe->number = num;
1104
1105		/*
1106		 * if the default bit is set in the cis, then
1107		 * point the new default at whatever is being
1108		 * filled in
1109		 */
1110		if (def)
1111			state->default_cfe = cfe;
1112	} else {
1113		/*
1114		 * the cis index matches the default index,
1115		 * fill in the default cfentry.  It is
1116		 * assumed that the cfdefault index is in the
1117		 * queue.  For it to be otherwise, the cis
1118		 * index would have to be -1 (initial
1119		 * condition) which is not possible, or there
1120		 * would have to be a preceding cis entry
1121		 * which had the same cis index and had the
1122		 * default bit unset. Neither condition
1123		 * should happen.  If it does, this cfentry
1124		 * is lost (written into temp space), which
1125		 * is an acceptable failure mode.
1126		 */
1127
1128		cfe = state->default_cfe;
1129
1130		/*
1131		 * if the cis entry does not have the default
1132		 * bit set, copy the default out of the way
1133		 * first.
1134		 */
1135		if (!def) {
1136			state->temp_cfe = *state->default_cfe;
1137			state->default_cfe = &state->temp_cfe;
1138		}
1139	}
1140
1141	if (intface) {
1142		reg = pcmcia_tuple_read_1(tuple, idx);
1143		idx++;
1144		cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
1145		    | PCMCIA_CFE_RDYBSY_ACTIVE
1146		    | PCMCIA_CFE_WP_ACTIVE
1147		    | PCMCIA_CFE_BVD_ACTIVE);
1148		if (reg & PCMCIA_TPCE_IF_MWAIT)
1149			cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
1150		if (reg & PCMCIA_TPCE_IF_RDYBSY)
1151			cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
1152		if (reg & PCMCIA_TPCE_IF_WP)
1153			cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
1154		if (reg & PCMCIA_TPCE_IF_BVD)
1155			cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
1156		cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
1157	}
1158	reg = pcmcia_tuple_read_1(tuple, idx);
1159	idx++;
1160
1161	power = reg & PCMCIA_TPCE_FS_POWER_MASK;
1162	timing = reg & PCMCIA_TPCE_FS_TIMING;
1163	iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
1164	irq = reg & PCMCIA_TPCE_FS_IRQ;
1165	memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
1166	misc = reg & PCMCIA_TPCE_FS_MISC;
1167
1168	if (power) {
1169		/* skip over power, don't save */
1170		/* for each parameter selection byte */
1171		for (i = 0; i < power; i++) {
1172			reg = pcmcia_tuple_read_1(tuple, idx);
1173			idx++;
1174			/* for each bit */
1175			for (j = 0; j < 7; j++) {
1176				/* if the bit is set */
1177				if ((reg >> j) & 0x01) {
1178					/* skip over bytes */
1179					do {
1180						reg2 = pcmcia_tuple_read_1(tuple, idx);
1181						idx++;
1182						/*
1183						 * until
1184						 * non-
1185						 * extension
1186						 * byte
1187						 */
1188					} while (reg2 & 0x80);
1189				}
1190			}
1191		}
1192	}
1193	if (timing) {
1194		/* skip over timing, don't save */
1195		reg = pcmcia_tuple_read_1(tuple, idx);
1196		idx++;
1197
1198		if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
1199		    PCMCIA_TPCE_TD_RESERVED_MASK)
1200			idx++;
1201		if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
1202		    PCMCIA_TPCE_TD_RDYBSY_MASK)
1203			idx++;
1204		if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
1205		    PCMCIA_TPCE_TD_WAIT_MASK)
1206			idx++;
1207	}
1208	if (iospace) {
1209		if (tuple->length <= idx) {
1210			DPRINTF(("ran out of space before TCPE_IO\n"));
1211			goto abort_cfe;
1212		}
1213
1214		reg = pcmcia_tuple_read_1(tuple, idx);
1215		idx++;
1216
1217		cfe->flags &=
1218		    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
1219		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
1220			cfe->flags |= PCMCIA_CFE_IO8;
1221		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
1222			cfe->flags |= PCMCIA_CFE_IO16;
1223		cfe->iomask =
1224		    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
1225
1226		if (reg & PCMCIA_TPCE_IO_HASRANGE) {
1227			reg = pcmcia_tuple_read_1(tuple, idx);
1228			idx++;
1229
1230			cfe->num_iospace = 1 + (reg &
1231			    PCMCIA_TPCE_IO_RANGE_COUNT);
1232
1233			if (cfe->num_iospace >
1234			    (sizeof(cfe->iospace) /
1235			     sizeof(cfe->iospace[0]))) {
1236				DPRINTF(("too many io "
1237				    "spaces %d",
1238				    cfe->num_iospace));
1239				state->card->error++;
1240				return;
1241			}
1242			for (i = 0; i < cfe->num_iospace; i++) {
1243				switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
1244				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_NONE:
1245					cfe->iospace[i].start =
1246					    0;
1247					break;
1248				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
1249					cfe->iospace[i].start =
1250						pcmcia_tuple_read_1(tuple, idx);
1251					idx++;
1252					break;
1253				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
1254					cfe->iospace[i].start =
1255						pcmcia_tuple_read_2(tuple, idx);
1256					idx += 2;
1257					break;
1258				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
1259					cfe->iospace[i].start =
1260						pcmcia_tuple_read_4(tuple, idx);
1261					idx += 4;
1262					break;
1263				}
1264				switch (reg &
1265					PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
1266				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_NONE:
1267					cfe->iospace[i].length =
1268					    0;
1269					break;
1270				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
1271					cfe->iospace[i].length =
1272						pcmcia_tuple_read_1(tuple, idx);
1273					idx++;
1274					break;
1275				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
1276					cfe->iospace[i].length =
1277						pcmcia_tuple_read_2(tuple, idx);
1278					idx += 2;
1279					break;
1280				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
1281					cfe->iospace[i].length =
1282						pcmcia_tuple_read_4(tuple, idx);
1283					idx += 4;
1284					break;
1285				}
1286				cfe->iospace[i].length++;
1287			}
1288		} else {
1289			cfe->num_iospace = 1;
1290			cfe->iospace[0].start = 0;
1291			cfe->iospace[0].length =
1292			    (1 << cfe->iomask);
1293		}
1294	}
1295	if (irq) {
1296		if (tuple->length <= idx) {
1297			DPRINTF(("ran out of space before TCPE_IR\n"));
1298			goto abort_cfe;
1299		}
1300
1301		reg = pcmcia_tuple_read_1(tuple, idx);
1302		idx++;
1303
1304		cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
1305		    | PCMCIA_CFE_IRQPULSE
1306		    | PCMCIA_CFE_IRQLEVEL);
1307		if (reg & PCMCIA_TPCE_IR_SHARE)
1308			cfe->flags |= PCMCIA_CFE_IRQSHARE;
1309		if (reg & PCMCIA_TPCE_IR_PULSE)
1310			cfe->flags |= PCMCIA_CFE_IRQPULSE;
1311		if (reg & PCMCIA_TPCE_IR_LEVEL)
1312			cfe->flags |= PCMCIA_CFE_IRQLEVEL;
1313
1314		if (reg & PCMCIA_TPCE_IR_HASMASK) {
1315			/*
1316			 * it's legal to ignore the
1317			 * special-interrupt bits, so I will
1318			 */
1319
1320			cfe->irqmask =
1321			    pcmcia_tuple_read_2(tuple, idx);
1322			idx += 2;
1323		} else {
1324			cfe->irqmask =
1325			    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
1326		}
1327	}
1328	if (memspace) {
1329		int lengthsize;
1330		int cardaddrsize;
1331		int hostaddrsize;
1332
1333		if (tuple->length <= idx) {
1334			DPRINTF(("ran out of space before TCPE_MS\n"));
1335			goto abort_cfe;
1336		}
1337
1338		switch (memspace) {
1339#ifdef notdef	/* This is 0 */
1340		case PCMCIA_TPCE_FS_MEMSPACE_NONE:
1341			cfe->num_memspace = 0;
1342			break;
1343#endif
1344
1345		case PCMCIA_TPCE_FS_MEMSPACE_LENGTH:
1346			cfe->num_memspace = 1;
1347			cfe->memspace[0].length = 256 *
1348			    pcmcia_tuple_read_2(tuple, idx);
1349			idx += 2;
1350			cfe->memspace[0].cardaddr = 0;
1351			cfe->memspace[0].hostaddr = 0;
1352			break;
1353
1354		case PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR:
1355			cfe->num_memspace = 1;
1356			cfe->memspace[0].length = 256 *
1357			    pcmcia_tuple_read_2(tuple, idx);
1358			idx += 2;
1359			cfe->memspace[0].cardaddr = 256 *
1360			    pcmcia_tuple_read_2(tuple, idx);
1361			idx += 2;
1362			cfe->memspace[0].hostaddr =
1363			    cfe->memspace[0].cardaddr;
1364			break;
1365
1366		default:
1367			reg = pcmcia_tuple_read_1(tuple, idx);
1368			idx++;
1369
1370			cfe->num_memspace = (reg & PCMCIA_TPCE_MS_COUNT)
1371			    + 1;
1372
1373			if (cfe->num_memspace >
1374			    (sizeof(cfe->memspace) /
1375				sizeof(cfe->memspace[0]))) {
1376				DPRINTF(("too many mem spaces %d",
1377				    cfe->num_memspace));
1378				state->card->error++;
1379				return;
1380			}
1381			lengthsize =
1382			    ((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
1383				PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
1384			cardaddrsize =
1385			    ((reg &
1386				PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
1387				  PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
1388			hostaddrsize =
1389			    (reg & PCMCIA_TPCE_MS_HOSTADDR) ?
1390			    cardaddrsize : 0;
1391
1392			if (lengthsize == 0) {
1393				DPRINTF(("cfe memspace "
1394				    "lengthsize == 0"));
1395				state->card->error++;
1396			}
1397			for (i = 0; i < cfe->num_memspace; i++) {
1398				if (lengthsize) {
1399					cfe->memspace[i].length = 256 *
1400					    pcmcia_tuple_read_n(tuple,
1401						lengthsize, idx);
1402					idx += lengthsize;
1403				} else {
1404					cfe->memspace[i].length = 0;
1405				}
1406				if (cfe->memspace[i].length == 0) {
1407					DPRINTF(("cfe->memspace"
1408					    "[%d].length == 0", i));
1409					state->card->error++;
1410				}
1411				if (cardaddrsize) {
1412					cfe->memspace[i].cardaddr =
1413					    256 *
1414					    pcmcia_tuple_read_n(tuple,
1415						cardaddrsize, idx);
1416					idx += cardaddrsize;
1417				} else {
1418					cfe->memspace[i].cardaddr = 0;
1419				}
1420				if (hostaddrsize) {
1421					cfe->memspace[i].hostaddr =
1422					    256 *
1423					    pcmcia_tuple_read_n(tuple,
1424						hostaddrsize, idx);
1425					idx += hostaddrsize;
1426				} else {
1427					cfe->memspace[i].hostaddr = 0;
1428				}
1429			}
1430		}
1431	}
1432
1433	if (misc) {
1434		if (tuple->length <= idx) {
1435			DPRINTF(("ran out of space before TCPE_MI\n"));
1436			goto abort_cfe;
1437		}
1438
1439		reg = pcmcia_tuple_read_1(tuple, idx);
1440		idx++;
1441
1442		cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
1443		    | PCMCIA_CFE_READONLY
1444		    | PCMCIA_CFE_AUDIO);
1445		if (reg & PCMCIA_TPCE_MI_PWRDOWN)
1446			cfe->flags |= PCMCIA_CFE_POWERDOWN;
1447		if (reg & PCMCIA_TPCE_MI_READONLY)
1448			cfe->flags |= PCMCIA_CFE_READONLY;
1449		if (reg & PCMCIA_TPCE_MI_AUDIO)
1450			cfe->flags |= PCMCIA_CFE_AUDIO;
1451		cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
1452
1453		while (reg & PCMCIA_TPCE_MI_EXT) {
1454			reg = pcmcia_tuple_read_1(tuple, idx);
1455			idx++;
1456		}
1457	}
1458
1459	/* skip all the subtuples */
1460abort_cfe:
1461	DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
1462}
1463