xref: /netbsd-src/sys/dev/pcmcia/pcmcia_cis.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: pcmcia_cis.c,v 1.50 2006/11/16 01:33:20 christos Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Marc Horowitz.
17  * 4. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 #include <sys/cdefs.h>
33 __KERNEL_RCSID(0, "$NetBSD: pcmcia_cis.c,v 1.50 2006/11/16 01:33:20 christos Exp $");
34 
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/device.h>
38 #include <sys/malloc.h>
39 
40 #include <dev/pcmcia/pcmciareg.h>
41 #include <dev/pcmcia/pcmciachip.h>
42 #include <dev/pcmcia/pcmciavar.h>
43 
44 #ifdef PCMCIACISDEBUG
45 int	pcmciacis_debug = 0;
46 #define	DPRINTF(arg) if (pcmciacis_debug) printf arg
47 #else
48 #define	DPRINTF(arg)
49 #endif
50 
51 #define	PCMCIA_CIS_SIZE		1024
52 
53 struct cis_state {
54 	int	count;
55 	int	gotmfc;
56 	struct pcmcia_config_entry temp_cfe;
57 	struct pcmcia_config_entry *default_cfe;
58 	struct pcmcia_card *card;
59 	struct pcmcia_function *pf;
60 };
61 
62 int	pcmcia_parse_cis_tuple(struct pcmcia_tuple *, void *);
63 static void create_pf(struct cis_state *);
64 
65 static void decode_end(struct pcmcia_tuple *, struct cis_state *);
66 static void decode_longlink_mfc(struct pcmcia_tuple *, struct cis_state *);
67 static void decode_device(struct pcmcia_tuple *, struct cis_state *);
68 static void decode_vers_1(struct pcmcia_tuple *, struct cis_state *);
69 static void decode_manfid(struct pcmcia_tuple *, struct cis_state *);
70 static void decode_funcid(struct pcmcia_tuple *, struct cis_state *);
71 static void decode_funce(struct pcmcia_tuple *, struct cis_state *);
72 static void decode_config(struct pcmcia_tuple *, struct cis_state *);
73 static void decode_cftable_entry(struct pcmcia_tuple *, struct cis_state *);
74 
75 
76 static void
77 create_pf(struct cis_state *state)
78 {
79 	state->pf = malloc(sizeof(*state->pf), M_DEVBUF, M_NOWAIT|M_ZERO);
80 	state->pf->number = state->count++;
81 	state->pf->last_config_index = -1;
82 	SIMPLEQ_INIT(&state->pf->cfe_head);
83 	SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list);
84 }
85 
86 void
87 pcmcia_free_pf(struct pcmcia_function_head *pfhead)
88 {
89 	struct pcmcia_function *pf, *npf;
90 	struct pcmcia_config_entry *cfe, *ncfe;
91 
92 	for (pf = SIMPLEQ_FIRST(pfhead); pf != NULL; pf = npf) {
93 		npf = SIMPLEQ_NEXT(pf, pf_list);
94 		for (cfe = SIMPLEQ_FIRST(&pf->cfe_head); cfe != NULL;
95 		    cfe = ncfe) {
96 			ncfe = SIMPLEQ_NEXT(cfe, cfe_list);
97 			free(cfe, M_DEVBUF);
98 		}
99 		free(pf, M_DEVBUF);
100 	}
101 
102 	SIMPLEQ_INIT(pfhead);
103 }
104 
105 void
106 pcmcia_read_cis(sc)
107 	struct pcmcia_softc *sc;
108 {
109 	struct cis_state state;
110 
111 	memset(&state, 0, sizeof state);
112 
113 	state.card = &sc->card;
114 
115 	state.card->error = 0;
116 	state.card->cis1_major = -1;
117 	state.card->cis1_minor = -1;
118 	state.card->cis1_info[0] = NULL;
119 	state.card->cis1_info[1] = NULL;
120 	state.card->cis1_info[2] = NULL;
121 	state.card->cis1_info[3] = NULL;
122 	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
123 	state.card->product = PCMCIA_PRODUCT_INVALID;
124 	SIMPLEQ_INIT(&state.card->pf_head);
125 
126 	state.pf = NULL;
127 
128 	if (pcmcia_scan_cis((struct device *)sc, pcmcia_parse_cis_tuple,
129 	    &state) == -1)
130 		state.card->error++;
131 }
132 
133 int
134 pcmcia_scan_cis(dev, fct, arg)
135 	struct device *dev;
136 	int (*fct)(struct pcmcia_tuple *, void *);
137 	void *arg;
138 {
139 	struct pcmcia_softc *sc = (struct pcmcia_softc *) dev;
140 	pcmcia_chipset_tag_t pct;
141 	pcmcia_chipset_handle_t pch;
142 	int window;
143 	struct pcmcia_mem_handle pcmh;
144 	struct pcmcia_tuple tuple;
145 	int longlink_present;
146 	int longlink_common;
147 	u_long longlink_addr;
148 	int mfc_count;
149 	int mfc_index;
150 	struct {
151 		int	common;
152 		u_long	addr;
153 	} mfc[256 / 5];
154 	int ret;
155 
156 	ret = 0;
157 
158 	pct = sc->pct;
159 	pch = sc->pch;
160 
161 	/* allocate some memory */
162 
163 	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
164 #ifdef DIAGNOSTIC
165 		printf("%s: can't alloc memory to read attributes\n",
166 		    sc->dev.dv_xname);
167 #endif
168 		return -1;
169 	}
170 	/* initialize state for the primary tuple chain */
171 	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
172 	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
173 		pcmcia_chip_mem_free(pct, pch, &pcmh);
174 #ifdef DIAGNOSTIC
175 		printf("%s: can't map memory to read attributes\n",
176 		    sc->dev.dv_xname);
177 #endif
178 		return -1;
179 	}
180 	tuple.memt = pcmh.memt;
181 	tuple.memh = pcmh.memh;
182 
183 	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
184 
185 	tuple.mult = 2;
186 
187 	longlink_present = 1;
188 	longlink_common = 1;
189 	longlink_addr = 0;
190 
191 	mfc_count = 0;
192 	mfc_index = 0;
193 
194 	DPRINTF(("%s: CIS tuple chain:\n", sc->dev.dv_xname));
195 
196 	while (1) {
197 		DELAY(1000);
198 
199 		while (1) {
200 			/*
201 			 * Perform boundary check for insane cards.
202 			 * If CIS is too long, simulate CIS end.
203 			 * (This check may not be sufficient for
204 			 * malicious cards.)
205 			 */
206 			if (tuple.mult * tuple.ptr >= PCMCIA_CIS_SIZE - 1
207 			    - 32 /* ad hoc value */ ) {
208 				DPRINTF(("CISTPL_END (too long CIS)\n"));
209 				tuple.code = PCMCIA_CISTPL_END;
210 				goto cis_end;
211 			}
212 
213 			/* get the tuple code */
214 
215 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
216 
217 			/* two special-case tuples */
218 
219 			if (tuple.code == PCMCIA_CISTPL_NULL) {
220 				DPRINTF((" 00\nCISTPL_NONE\n"));
221 				tuple.ptr++;
222 				continue;
223 			} else if (tuple.code == PCMCIA_CISTPL_END) {
224 				DPRINTF((" ff\nCISTPL_END\n"));
225 			cis_end:
226 				/* Call the function for the END tuple, since
227 				   the CIS semantics depend on it */
228 				if ((*fct) (&tuple, arg)) {
229 					pcmcia_chip_mem_unmap(pct, pch,
230 							      window);
231 					ret = 1;
232 					goto done;
233 				}
234 				tuple.ptr++;
235 				break;
236 			}
237 
238 			/* now all the normal tuples */
239 
240 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
241 #ifdef PCMCIACISDEBUG
242 			/* print the tuple */
243 			{
244 				int i;
245 
246 				DPRINTF((" %02x %02x", tuple.code,
247 				    tuple.length));
248 
249 				for (i = 0; i < tuple.length; i++) {
250 					DPRINTF((" %02x",
251 					    pcmcia_tuple_read_1(&tuple, i)));
252 					if ((i % 16) == 13)
253 						DPRINTF(("\n"));
254 				}
255 				if ((i % 16) != 14)
256 					DPRINTF(("\n"));
257 			}
258 #endif
259 			switch (tuple.code) {
260 			case PCMCIA_CISTPL_LONGLINK_A:
261 			case PCMCIA_CISTPL_LONGLINK_C:
262 				if (tuple.length < 4) {
263 					DPRINTF(("CISTPL_LONGLINK_%s too "
264 					    "short %d\n",
265 					    longlink_common ? "C" : "A",
266 					    tuple.length));
267 					break;
268 				}
269 				longlink_present = 1;
270 				longlink_common = (tuple.code ==
271 				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
272 				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
273 				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
274 				    longlink_common ? "C" : "A",
275 				    longlink_addr));
276 				break;
277 			case PCMCIA_CISTPL_NO_LINK:
278 				longlink_present = 0;
279 				DPRINTF(("CISTPL_NO_LINK\n"));
280 				break;
281 			case PCMCIA_CISTPL_CHECKSUM:
282 				if (tuple.length < 5) {
283 					DPRINTF(("CISTPL_CHECKSUM too "
284 					    "short %d\n", tuple.length));
285 					break;
286 				} {
287 					int16_t offset;
288 					u_long addr, length;
289 					u_int cksum, sum;
290 					int i;
291 
292 					*((u_int16_t *) & offset) =
293 					    pcmcia_tuple_read_2(&tuple, 0);
294 					length = pcmcia_tuple_read_2(&tuple, 2);
295 					cksum = pcmcia_tuple_read_1(&tuple, 4);
296 
297 					addr = tuple.ptr + offset;
298 
299 					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
300 					    "len=%lx cksum=%x",
301 					    addr, length, cksum));
302 
303 					/*
304 					 * XXX do more work to deal with
305 					 * distant regions
306 					 */
307 					if ((addr >= PCMCIA_CIS_SIZE) ||
308 #if 0
309 					    ((addr + length) < 0) ||
310 #endif
311 					    ((addr + length) >=
312 					      PCMCIA_CIS_SIZE)) {
313 						DPRINTF((" skipped, "
314 						    "too distant\n"));
315 						break;
316 					}
317 					sum = 0;
318 					for (i = 0; i < length; i++)
319 						sum +=
320 						    bus_space_read_1(tuple.memt,
321 						    tuple.memh,
322 						    addr + tuple.mult * i);
323 					if (cksum != (sum & 0xff)) {
324 						DPRINTF((" failed sum=%x\n",
325 						    sum));
326 						printf("%s: CIS checksum "
327 						    "failed\n",
328 						    sc->dev.dv_xname);
329 #if 0
330 						/*
331 						 * XXX Some working cards have
332 						 * XXX bad checksums!!
333 						 */
334 						ret = -1;
335 #endif
336 					} else {
337 						DPRINTF((" ok\n"));
338 					}
339 				}
340 				break;
341 			case PCMCIA_CISTPL_LONGLINK_MFC:
342 				if (tuple.length < 1) {
343 					DPRINTF(("CISTPL_LONGLINK_MFC too "
344 					    "short %d\n", tuple.length));
345 					break;
346 				}
347 				if (((tuple.length - 1) % 5) != 0) {
348 					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
349 					    "length %d\n", tuple.length));
350 					break;
351 				}
352 				/*
353 				 * this is kind of ad hoc, as I don't have
354 				 * any real documentation
355 				 */
356 				{
357 					int i, tmp_count;
358 
359 					/*
360 					 * put count into tmp var so that
361 					 * if we have to bail (because it's
362 					 * a bogus count) it won't be
363 					 * remembered for later use.
364 					 */
365 					tmp_count =
366 					    pcmcia_tuple_read_1(&tuple, 0);
367 					DPRINTF(("CISTPL_LONGLINK_MFC %d",
368 					    tmp_count));
369 
370 					/*
371 					 * make _sure_ it's the right size;
372 					 * if too short, it may be a weird
373 					 * (unknown/undefined) format
374 					 */
375 					if (tuple.length != (tmp_count*5 + 1)) {
376 						DPRINTF((" bogus length %d\n",
377 						    tuple.length));
378 						break;
379 					}
380 
381 #ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
382 					/*
383 					 * sanity check for a programming
384 					 * error which is difficult to find
385 					 * when debugging.
386 					 */
387 					if (tmp_count >
388 					    howmany(sizeof mfc, sizeof mfc[0]))
389 						panic("CISTPL_LONGLINK_MFC mfc "
390 						    "count would blow stack");
391 #endif
392 
393 					mfc_count = tmp_count;
394 					for (i = 0; i < mfc_count; i++) {
395 						mfc[i].common =
396 						    (pcmcia_tuple_read_1(&tuple,
397 						    1 + 5 * i) ==
398 						    PCMCIA_MFC_MEM_COMMON) ?
399 						    1 : 0;
400 						mfc[i].addr =
401 						    pcmcia_tuple_read_4(&tuple,
402 						    1 + 5 * i + 1);
403 						DPRINTF((" %s:%lx",
404 						    mfc[i].common ? "common" :
405 						    "attr", mfc[i].addr));
406 					}
407 					DPRINTF(("\n"));
408 				}
409 				/*
410 				 * for LONGLINK_MFC, fall through to the
411 				 * function.  This tuple has structural and
412 				 * semantic content.
413 				 */
414 			default:
415 				{
416 					if ((*fct) (&tuple, arg)) {
417 						pcmcia_chip_mem_unmap(pct,
418 						    pch, window);
419 						ret = 1;
420 						goto done;
421 					}
422 				}
423 				break;
424 			}	/* switch */
425 			/* skip to the next tuple */
426 			tuple.ptr += 2 + tuple.length;
427 		}
428 
429 		/*
430 		 * the chain is done.  Clean up and move onto the next one,
431 		 * if any.  The loop is here in the case that there is an MFC
432 		 * card with no longlink (which defaults to existing, == 0).
433 		 * In general, this means that if one pointer fails, it will
434 		 * try the next one, instead of just bailing.
435 		 */
436 
437 		while (1) {
438 			pcmcia_chip_mem_unmap(pct, pch, window);
439 
440 			if (longlink_present) {
441 				/*
442 				 * if the longlink is to attribute memory,
443 				 * then it is unindexed.  That is, if the
444 				 * link value is 0x100, then the actual
445 				 * memory address is 0x200.  This means that
446 				 * we need to multiply by 2 before calling
447 				 * mem_map, and then divide the resulting ptr
448 				 * by 2 after.
449 				 */
450 
451 				if (!longlink_common)
452 					longlink_addr *= 2;
453 
454 				pcmcia_chip_mem_map(pct, pch, longlink_common ?
455 				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
456 				    PCMCIA_MEM_ATTR,
457 				    longlink_addr, PCMCIA_CIS_SIZE,
458 				    &pcmh, &tuple.ptr, &window);
459 
460 				tuple.memt = pcmh.memt;
461 				tuple.memh = pcmh.memh;
462 
463 				if (!longlink_common)
464 					tuple.ptr /= 2;
465 
466 				DPRINTF(("cis mem map %x\n",
467 				    (unsigned int) tuple.memh));
468 
469 				tuple.mult = longlink_common ? 1 : 2;
470 				longlink_present = 0;
471 				longlink_common = 1;
472 				longlink_addr = 0;
473 			} else if (mfc_count && (mfc_index < mfc_count)) {
474 				if (!mfc[mfc_index].common)
475 					mfc[mfc_index].addr *= 2;
476 
477 				pcmcia_chip_mem_map(pct, pch,
478 				    mfc[mfc_index].common ?
479 				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
480 				    PCMCIA_MEM_ATTR,
481 				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
482 				    &pcmh, &tuple.ptr, &window);
483 
484 				if (!mfc[mfc_index].common)
485 					tuple.ptr /= 2;
486 
487 				DPRINTF(("cis mem map %x\n",
488 				    (unsigned int) tuple.memh));
489 
490 				/* set parse state, and point at the next one */
491 
492 				tuple.mult = mfc[mfc_index].common ? 1 : 2;
493 
494 				mfc_index++;
495 			} else {
496 				goto done;
497 			}
498 
499 			/* make sure that the link is valid */
500 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
501 			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
502 				DPRINTF(("CISTPL_LINKTARGET expected, "
503 				    "code %02x observed\n", tuple.code));
504 				continue;
505 			}
506 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
507 			if (tuple.length < 3) {
508 				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
509 				    tuple.length));
510 				continue;
511 			}
512 			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
513 			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
514 			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
515 				DPRINTF(("CISTPL_LINKTARGET magic "
516 				    "%02x%02x%02x incorrect\n",
517 				    pcmcia_tuple_read_1(&tuple, 0),
518 				    pcmcia_tuple_read_1(&tuple, 1),
519 				    pcmcia_tuple_read_1(&tuple, 2)));
520 				continue;
521 			}
522 			tuple.ptr += 2 + tuple.length;
523 
524 			break;
525 		}
526 	}
527 
528 	pcmcia_chip_mem_unmap(pct, pch, window);
529 
530 done:
531 	/* Last, free the allocated memory block */
532 	pcmcia_chip_mem_free(pct, pch, &pcmh);
533 
534 	return (ret);
535 }
536 
537 /* XXX this is incredibly verbose.  Not sure what trt is */
538 
539 void
540 pcmcia_print_cis(sc)
541 	struct pcmcia_softc *sc;
542 {
543 	struct pcmcia_card *card = &sc->card;
544 	struct pcmcia_function *pf;
545 	struct pcmcia_config_entry *cfe;
546 	int i;
547 
548 	printf("%s: CIS version ", sc->dev.dv_xname);
549 	if (card->cis1_major == 4) {
550 		if (card->cis1_minor == 0)
551 			printf("PCMCIA 1.0\n");
552 		else if (card->cis1_minor == 1)
553 			printf("PCMCIA 2.0 or 2.1\n");
554 	} else if (card->cis1_major >= 5)
555 		printf("PC Card Standard %d.%d\n", card->cis1_major, card->cis1_minor);
556 	else
557 		printf("unknown (major=%d, minor=%d)\n",
558 		    card->cis1_major, card->cis1_minor);
559 
560 	printf("%s: CIS info: ", sc->dev.dv_xname);
561 	for (i = 0; i < 4; i++) {
562 		if (card->cis1_info[i] == NULL)
563 			break;
564 		if (i)
565 			printf(", ");
566 		printf("%s", card->cis1_info[i]);
567 	}
568 	printf("\n");
569 
570 	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
571 	       sc->dev.dv_xname, card->manufacturer, card->product);
572 
573 	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
574 		printf("%s: function %d: ", sc->dev.dv_xname, pf->number);
575 
576 		switch (pf->function) {
577 		case PCMCIA_FUNCTION_UNSPEC:
578 			printf("unspecified");
579 			break;
580 		case PCMCIA_FUNCTION_MULTIFUNCTION:
581 			printf("multi-function");
582 			break;
583 		case PCMCIA_FUNCTION_MEMORY:
584 			printf("memory");
585 			break;
586 		case PCMCIA_FUNCTION_SERIAL:
587 			printf("serial port");
588 			break;
589 		case PCMCIA_FUNCTION_PARALLEL:
590 			printf("parallel port");
591 			break;
592 		case PCMCIA_FUNCTION_DISK:
593 			printf("fixed disk");
594 			switch (pf->pf_funce_disk_interface) {
595 			case PCMCIA_TPLFE_DDI_PCCARD_ATA:
596 				printf("(ata)");
597 				break;
598 			default:
599 				break;
600 			}
601 			break;
602 		case PCMCIA_FUNCTION_VIDEO:
603 			printf("video adapter");
604 			break;
605 		case PCMCIA_FUNCTION_NETWORK:
606 			printf("network adapter");
607 			break;
608 		case PCMCIA_FUNCTION_AIMS:
609 			printf("auto incrementing mass storage");
610 			break;
611 		case PCMCIA_FUNCTION_SCSI:
612 			printf("SCSI bridge");
613 			break;
614 		case PCMCIA_FUNCTION_SECURITY:
615 			printf("Security services");
616 			break;
617 		case PCMCIA_FUNCTION_INSTRUMENT:
618 			printf("Instrument");
619 			break;
620 		default:
621 			printf("unknown (%d)", pf->function);
622 			break;
623 		}
624 
625 		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
626 
627 		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
628 			printf("%s: function %d, config table entry %d: ",
629 			    sc->dev.dv_xname, pf->number, cfe->number);
630 
631 			switch (cfe->iftype) {
632 			case PCMCIA_IFTYPE_MEMORY:
633 				printf("memory card");
634 				break;
635 			case PCMCIA_IFTYPE_IO:
636 				printf("I/O card");
637 				break;
638 			default:
639 				printf("card type unknown");
640 				break;
641 			}
642 
643 			printf("; irq mask %x", cfe->irqmask);
644 
645 			if (cfe->num_iospace) {
646 				printf("; iomask %lx, iospace", cfe->iomask);
647 
648 				for (i = 0; i < cfe->num_iospace; i++) {
649 					printf(" %lx", cfe->iospace[i].start);
650 					if (cfe->iospace[i].length)
651 						printf("-%lx",
652 						    cfe->iospace[i].start +
653 						    cfe->iospace[i].length - 1);
654 				}
655 			}
656 			if (cfe->num_memspace) {
657 				printf("; memspace");
658 
659 				for (i = 0; i < cfe->num_memspace; i++) {
660 					printf(" %lx",
661 					    cfe->memspace[i].cardaddr);
662 					if (cfe->memspace[i].length)
663 						printf("-%lx",
664 						    cfe->memspace[i].cardaddr +
665 						    cfe->memspace[i].length - 1);
666 					if (cfe->memspace[i].hostaddr)
667 						printf("@%lx",
668 						    cfe->memspace[i].hostaddr);
669 				}
670 			}
671 			if (cfe->maxtwins)
672 				printf("; maxtwins %d", cfe->maxtwins);
673 
674 			printf(";");
675 
676 			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
677 				printf(" mwait_required");
678 			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
679 				printf(" rdybsy_active");
680 			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
681 				printf(" wp_active");
682 			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
683 				printf(" bvd_active");
684 			if (cfe->flags & PCMCIA_CFE_IO8)
685 				printf(" io8");
686 			if (cfe->flags & PCMCIA_CFE_IO16)
687 				printf(" io16");
688 			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
689 				printf(" irqshare");
690 			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
691 				printf(" irqpulse");
692 			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
693 				printf(" irqlevel");
694 			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
695 				printf(" powerdown");
696 			if (cfe->flags & PCMCIA_CFE_READONLY)
697 				printf(" readonly");
698 			if (cfe->flags & PCMCIA_CFE_AUDIO)
699 				printf(" audio");
700 
701 			printf("\n");
702 		}
703 	}
704 
705 	if (card->error)
706 		printf("%s: %d errors found while parsing CIS\n",
707 		    sc->dev.dv_xname, card->error);
708 }
709 
710 int
711 pcmcia_parse_cis_tuple(tuple, arg)
712 	struct pcmcia_tuple *tuple;
713 	void *arg;
714 {
715 	struct cis_state *state = arg;
716 
717 	switch (tuple->code) {
718 	case PCMCIA_CISTPL_END:
719 		decode_end(tuple, state);
720 		break;
721 
722 	case PCMCIA_CISTPL_LONGLINK_MFC:
723 		decode_longlink_mfc(tuple, state);
724 		break;
725 
726 	case PCMCIA_CISTPL_DEVICE:
727 	case PCMCIA_CISTPL_DEVICE_A:
728 		decode_device(tuple, state);
729 		break;
730 
731 	case PCMCIA_CISTPL_VERS_1:
732 		decode_vers_1(tuple, state);
733 		break;
734 
735 	case PCMCIA_CISTPL_MANFID:
736 		decode_manfid(tuple, state);
737 		break;
738 
739 	case PCMCIA_CISTPL_FUNCID:
740 		decode_funcid(tuple, state);
741 		break;
742 
743 	case PCMCIA_CISTPL_FUNCE:
744 		decode_funce(tuple, state);
745 		break;
746 
747 	case PCMCIA_CISTPL_CONFIG:
748 		decode_config(tuple, state);
749 		break;
750 
751 	case PCMCIA_CISTPL_CFTABLE_ENTRY:
752 		decode_cftable_entry(tuple, state);
753 		break;
754 	default:
755 		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
756 		break;
757 	}
758 
759 	return (0);
760 }
761 
762 static void
763 decode_end(struct pcmcia_tuple *tuple, struct cis_state *state)
764 {
765 	/* if we've seen a LONGLINK_MFC, and this is the first
766 	 * END after it, reset the function list.
767 	 *
768 	 * XXX This might also be the right place to start a
769 	 * new function, but that assumes that a function
770 	 * definition never crosses any longlink, and I'm not
771 	 * sure about that.  This is probably safe for MFC
772 	 * cards, but what we have now isn't broken, so I'd
773 	 * rather not change it.
774 	 */
775 	if (state->gotmfc == 1) {
776 		state->gotmfc = 2;
777 		state->count = 0;
778 		state->pf = NULL;
779 
780 		pcmcia_free_pf(&state->card->pf_head);
781 	}
782 }
783 
784 static void
785 decode_longlink_mfc(struct pcmcia_tuple *tuple,
786     struct cis_state *state)
787 {
788 	/*
789 	 * this tuple's structure was dealt with in scan_cis.  here,
790 	 * record the fact that the MFC tuple was seen, so that
791 	 * functions declared before the MFC link can be cleaned
792 	 * up.
793 	 */
794 	if (state->gotmfc == 0) {
795 		state->gotmfc = 1;
796 	} else {
797 		DPRINTF(("got LONGLINK_MFC again!"));
798 	}
799 }
800 
801 static void
802 decode_device(struct pcmcia_tuple *tuple,
803     struct cis_state *state)
804 {
805 #ifdef PCMCIACISDEBUG
806 	u_int reg, dtype, dspeed;
807 
808 	reg = pcmcia_tuple_read_1(tuple, 0);
809 	dtype = reg & PCMCIA_DTYPE_MASK;
810 	dspeed = reg & PCMCIA_DSPEED_MASK;
811 
812 	DPRINTF(("CISTPL_DEVICE%s type=",
813 	(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
814 	switch (dtype) {
815 	case PCMCIA_DTYPE_NULL:
816 		DPRINTF(("null"));
817 		break;
818 	case PCMCIA_DTYPE_ROM:
819 		DPRINTF(("rom"));
820 		break;
821 	case PCMCIA_DTYPE_OTPROM:
822 		DPRINTF(("otprom"));
823 		break;
824 	case PCMCIA_DTYPE_EPROM:
825 		DPRINTF(("eprom"));
826 		break;
827 	case PCMCIA_DTYPE_EEPROM:
828 		DPRINTF(("eeprom"));
829 		break;
830 	case PCMCIA_DTYPE_FLASH:
831 		DPRINTF(("flash"));
832 		break;
833 	case PCMCIA_DTYPE_SRAM:
834 		DPRINTF(("sram"));
835 		break;
836 	case PCMCIA_DTYPE_DRAM:
837 		DPRINTF(("dram"));
838 		break;
839 	case PCMCIA_DTYPE_FUNCSPEC:
840 		DPRINTF(("funcspec"));
841 		break;
842 	case PCMCIA_DTYPE_EXTEND:
843 		DPRINTF(("extend"));
844 		break;
845 	default:
846 		DPRINTF(("reserved"));
847 		break;
848 	}
849 	DPRINTF((" speed="));
850 	switch (dspeed) {
851 	case PCMCIA_DSPEED_NULL:
852 		DPRINTF(("null"));
853 		break;
854 	case PCMCIA_DSPEED_250NS:
855 		DPRINTF(("250ns"));
856 		break;
857 	case PCMCIA_DSPEED_200NS:
858 		DPRINTF(("200ns"));
859 		break;
860 	case PCMCIA_DSPEED_150NS:
861 		DPRINTF(("150ns"));
862 		break;
863 	case PCMCIA_DSPEED_100NS:
864 		DPRINTF(("100ns"));
865 		break;
866 	case PCMCIA_DSPEED_EXT:
867 		DPRINTF(("ext"));
868 		break;
869 	default:
870 		DPRINTF(("reserved"));
871 		break;
872 	}
873 	DPRINTF(("\n"));
874 #endif
875 }
876 
877 static void
878 decode_vers_1(struct pcmcia_tuple *tuple, struct cis_state *state)
879 {
880 	int start, i, ch, count;
881 
882 	if (tuple->length < 6) {
883 		DPRINTF(("CISTPL_VERS_1 too short %d\n",
884 		    tuple->length));
885 		return;
886 	}
887 	state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
888 	state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
889 
890 	for (count = 0, start = 0, i = 0;
891 	    (count < 4) && ((i + 4) < 256); i++) {
892 		ch = pcmcia_tuple_read_1(tuple, 2 + i);
893 		if (ch == 0xff) {
894 			if (i > start) {
895 				state->card->cis1_info_buf[i] = 0;
896 				state->card->cis1_info[count] =
897 				    state->card->cis1_info_buf + start;
898 			}
899 			break;
900 		}
901 		state->card->cis1_info_buf[i] = ch;
902 		if (ch == 0) {
903 			state->card->cis1_info[count] =
904 			    state->card->cis1_info_buf + start;
905 			start = i + 1;
906 			count++;
907 		}
908 	}
909 	DPRINTF(("CISTPL_VERS_1\n"));
910 }
911 
912 static void
913 decode_manfid(struct pcmcia_tuple *tuple, struct cis_state *state)
914 {
915 	if (tuple->length < 4) {
916 		DPRINTF(("CISTPL_MANFID too short %d\n",
917 		    tuple->length));
918 		return;
919 	}
920 	state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
921 	state->card->product = pcmcia_tuple_read_2(tuple, 2);
922 	DPRINTF(("CISTPL_MANFID\n"));
923 }
924 
925 static void
926 decode_funcid(struct pcmcia_tuple *tuple, struct cis_state *state)
927 {
928 	if (tuple->length < 1) {
929 		DPRINTF(("CISTPL_FUNCID too short %d\n",
930 		    tuple->length));
931 		return;
932 	}
933 	if (state->pf) {
934 		if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
935 			/*
936 			 * This looks like a opportunistic function
937 			 * created by a CONFIG tuple.  Just keep it.
938 			 */
939 		} else {
940 			/*
941 			 * A function is being defined, end it.
942 			 */
943 			state->pf = NULL;
944 		}
945 	}
946 	if (state->pf == NULL)
947 		create_pf(state);
948 	state->pf->function = pcmcia_tuple_read_1(tuple, 0);
949 
950 	DPRINTF(("CISTPL_FUNCID\n"));
951 }
952 
953 static void
954 decode_funce(struct pcmcia_tuple *tuple, struct cis_state *state)
955 {
956 	struct pcmcia_function *pf = state->pf;
957 	int type = pcmcia_tuple_read_1(tuple, 0);
958 
959 	if (state->pf == NULL || state->pf->function <= 0) {
960 		DPRINTF(("CISTPL_FUNCE is not followed by "
961 		    "valid CISTPL_FUNCID\n"));
962 		return;
963 	}
964 	if (tuple->length < 2)
965 		return;
966 	switch (pf->function) {
967 	case PCMCIA_FUNCTION_DISK:
968 		if (type == PCMCIA_TPLFE_TYPE_DISK_DEVICE_INTERFACE) {
969 			pf->pf_funce_disk_interface
970 			    = pcmcia_tuple_read_1(tuple, 1);
971 		}
972 		break;
973 	case PCMCIA_FUNCTION_NETWORK:
974 		if (type == PCMCIA_TPLFE_TYPE_LAN_NID) {
975 			int i;
976 			int len = pcmcia_tuple_read_1(tuple, 1);
977 			if (tuple->length < 2 + len || len > 8) {
978 				/* tuple length not enough or nid too long */
979 				break;
980 			}
981 			for (i = 0; i < len; ++i) {
982 				pf->pf_funce_lan_nid[i]
983 				    = pcmcia_tuple_read_1(tuple, 2 + i);
984 			}
985 			pf->pf_funce_lan_nidlen = len;
986 		}
987 		break;
988 	default:
989 		break;
990 	}
991 
992 	return;
993 }
994 
995 static void
996 decode_config(struct pcmcia_tuple *tuple, struct cis_state *state)
997 {
998 	u_int reg, rasz, rmsz, rfsz;
999 	int i;
1000 	/* most of these are educated guesses */
1001 	static const struct pcmcia_config_entry init_cfe = {
1002 		.number	= -1,
1003 		.flags	= PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
1004 			  PCMCIA_CFE_BVD_ACTIVE,
1005 		.iftype	= PCMCIA_IFTYPE_MEMORY,
1006 	};
1007 
1008 	if (tuple->length < 3) {
1009 		DPRINTF(("CISTPL_CONFIG too short %d\n", tuple->length));
1010 		return;
1011 	}
1012 	reg = pcmcia_tuple_read_1(tuple, 0);
1013 	rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
1014 	    PCMCIA_TPCC_RASZ_SHIFT);
1015 	rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
1016 	    PCMCIA_TPCC_RMSZ_SHIFT);
1017 	rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
1018 	    PCMCIA_TPCC_RFSZ_SHIFT);
1019 
1020 	if (tuple->length < (rasz + rmsz + rfsz)) {
1021 		DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too short %d\n",
1022 		    rasz, rmsz, rfsz, tuple->length));
1023 		return;
1024 	}
1025 	if (state->pf == NULL) {
1026 		create_pf(state);
1027 		state->pf->function = PCMCIA_FUNCTION_UNSPEC;
1028 	}
1029 	state->pf->last_config_index =
1030 	    pcmcia_tuple_read_1(tuple, 1);
1031 
1032 	state->pf->ccr_base = 0;
1033 	for (i = 0; i < rasz; i++)
1034 		state->pf->ccr_base |= ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
1035 		    (i * 8));
1036 
1037 	state->pf->ccr_mask = 0;
1038 	for (i = 0; i < rmsz; i++)
1039 		state->pf->ccr_mask |= ((pcmcia_tuple_read_1(tuple,
1040 		    2 + rasz + i)) << (i * 8));
1041 
1042 	/* skip the reserved area and subtuples */
1043 
1044 	/* reset the default cfe for each cfe list */
1045 	state->temp_cfe = init_cfe;
1046 	state->default_cfe = &state->temp_cfe;
1047 	DPRINTF(("CISTPL_CONFIG\n"));
1048 }
1049 
1050 static void
1051 decode_cftable_entry(struct pcmcia_tuple *tuple, struct cis_state *state)
1052 {
1053 	int idx, i, j;
1054 	u_int reg, reg2;
1055 	u_int intface, def, num;
1056 	u_int power, timing, iospace, irq, memspace, misc;
1057 	struct pcmcia_config_entry *cfe;
1058 
1059 	idx = 0;
1060 
1061 	reg = pcmcia_tuple_read_1(tuple, idx);
1062 	idx++;
1063 	intface = reg & PCMCIA_TPCE_INDX_INTFACE;
1064 	def = reg & PCMCIA_TPCE_INDX_DEFAULT;
1065 	num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
1066 
1067 	/*
1068 	 * this is a little messy.  Some cards have only a
1069 	 * cfentry with the default bit set.  So, as we go
1070 	 * through the list, we add new indexes to the queue,
1071 	 * and keep a pointer to the last one with the
1072 	 * default bit set.  if we see a record with the same
1073 	 * index, as the default, we stash the default and
1074 	 * replace the queue entry. otherwise, we just add
1075 	 * new entries to the queue, pointing the default ptr
1076 	 * at them if the default bit is set.  if we get to
1077 	 * the end with the default pointer pointing at a
1078 	 * record which hasn't had a matching index, that's
1079 	 * ok; it just becomes a cfentry like any other.
1080 	 */
1081 
1082 	/*
1083 	 * if the index in the cis differs from the default
1084 	 * cis, create new entry in the queue and start it
1085 	 * with the current default
1086 	 */
1087 	if (state->default_cfe == NULL) {
1088 		DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
1089 		    "default\n"));
1090 		return;
1091 	}
1092 	if (num != state->default_cfe->number) {
1093 		cfe = malloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT);
1094 		if (cfe == NULL) {
1095 			printf("Cannot allocate cfe entry\n");
1096 			return;
1097 		}
1098 
1099 		*cfe = *state->default_cfe;
1100 
1101 		SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head, cfe, cfe_list);
1102 
1103 		cfe->number = num;
1104 
1105 		/*
1106 		 * if the default bit is set in the cis, then
1107 		 * point the new default at whatever is being
1108 		 * filled in
1109 		 */
1110 		if (def)
1111 			state->default_cfe = cfe;
1112 	} else {
1113 		/*
1114 		 * the cis index matches the default index,
1115 		 * fill in the default cfentry.  It is
1116 		 * assumed that the cfdefault index is in the
1117 		 * queue.  For it to be otherwise, the cis
1118 		 * index would have to be -1 (initial
1119 		 * condition) which is not possible, or there
1120 		 * would have to be a preceding cis entry
1121 		 * which had the same cis index and had the
1122 		 * default bit unset. Neither condition
1123 		 * should happen.  If it does, this cfentry
1124 		 * is lost (written into temp space), which
1125 		 * is an acceptable failure mode.
1126 		 */
1127 
1128 		cfe = state->default_cfe;
1129 
1130 		/*
1131 		 * if the cis entry does not have the default
1132 		 * bit set, copy the default out of the way
1133 		 * first.
1134 		 */
1135 		if (!def) {
1136 			state->temp_cfe = *state->default_cfe;
1137 			state->default_cfe = &state->temp_cfe;
1138 		}
1139 	}
1140 
1141 	if (intface) {
1142 		reg = pcmcia_tuple_read_1(tuple, idx);
1143 		idx++;
1144 		cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
1145 		    | PCMCIA_CFE_RDYBSY_ACTIVE
1146 		    | PCMCIA_CFE_WP_ACTIVE
1147 		    | PCMCIA_CFE_BVD_ACTIVE);
1148 		if (reg & PCMCIA_TPCE_IF_MWAIT)
1149 			cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
1150 		if (reg & PCMCIA_TPCE_IF_RDYBSY)
1151 			cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
1152 		if (reg & PCMCIA_TPCE_IF_WP)
1153 			cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
1154 		if (reg & PCMCIA_TPCE_IF_BVD)
1155 			cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
1156 		cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
1157 	}
1158 	reg = pcmcia_tuple_read_1(tuple, idx);
1159 	idx++;
1160 
1161 	power = reg & PCMCIA_TPCE_FS_POWER_MASK;
1162 	timing = reg & PCMCIA_TPCE_FS_TIMING;
1163 	iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
1164 	irq = reg & PCMCIA_TPCE_FS_IRQ;
1165 	memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
1166 	misc = reg & PCMCIA_TPCE_FS_MISC;
1167 
1168 	if (power) {
1169 		/* skip over power, don't save */
1170 		/* for each parameter selection byte */
1171 		for (i = 0; i < power; i++) {
1172 			reg = pcmcia_tuple_read_1(tuple, idx);
1173 			idx++;
1174 			/* for each bit */
1175 			for (j = 0; j < 7; j++) {
1176 				/* if the bit is set */
1177 				if ((reg >> j) & 0x01) {
1178 					/* skip over bytes */
1179 					do {
1180 						reg2 = pcmcia_tuple_read_1(tuple, idx);
1181 						idx++;
1182 						/*
1183 						 * until
1184 						 * non-
1185 						 * extension
1186 						 * byte
1187 						 */
1188 					} while (reg2 & 0x80);
1189 				}
1190 			}
1191 		}
1192 	}
1193 	if (timing) {
1194 		/* skip over timing, don't save */
1195 		reg = pcmcia_tuple_read_1(tuple, idx);
1196 		idx++;
1197 
1198 		if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
1199 		    PCMCIA_TPCE_TD_RESERVED_MASK)
1200 			idx++;
1201 		if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
1202 		    PCMCIA_TPCE_TD_RDYBSY_MASK)
1203 			idx++;
1204 		if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
1205 		    PCMCIA_TPCE_TD_WAIT_MASK)
1206 			idx++;
1207 	}
1208 	if (iospace) {
1209 		if (tuple->length <= idx) {
1210 			DPRINTF(("ran out of space before TCPE_IO\n"));
1211 			goto abort_cfe;
1212 		}
1213 
1214 		reg = pcmcia_tuple_read_1(tuple, idx);
1215 		idx++;
1216 
1217 		cfe->flags &=
1218 		    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
1219 		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
1220 			cfe->flags |= PCMCIA_CFE_IO8;
1221 		if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
1222 			cfe->flags |= PCMCIA_CFE_IO16;
1223 		cfe->iomask =
1224 		    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
1225 
1226 		if (reg & PCMCIA_TPCE_IO_HASRANGE) {
1227 			reg = pcmcia_tuple_read_1(tuple, idx);
1228 			idx++;
1229 
1230 			cfe->num_iospace = 1 + (reg &
1231 			    PCMCIA_TPCE_IO_RANGE_COUNT);
1232 
1233 			if (cfe->num_iospace >
1234 			    (sizeof(cfe->iospace) /
1235 			     sizeof(cfe->iospace[0]))) {
1236 				DPRINTF(("too many io "
1237 				    "spaces %d",
1238 				    cfe->num_iospace));
1239 				state->card->error++;
1240 				return;
1241 			}
1242 			for (i = 0; i < cfe->num_iospace; i++) {
1243 				switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
1244 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_NONE:
1245 					cfe->iospace[i].start =
1246 					    0;
1247 					break;
1248 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
1249 					cfe->iospace[i].start =
1250 						pcmcia_tuple_read_1(tuple, idx);
1251 					idx++;
1252 					break;
1253 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
1254 					cfe->iospace[i].start =
1255 						pcmcia_tuple_read_2(tuple, idx);
1256 					idx += 2;
1257 					break;
1258 				case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
1259 					cfe->iospace[i].start =
1260 						pcmcia_tuple_read_4(tuple, idx);
1261 					idx += 4;
1262 					break;
1263 				}
1264 				switch (reg &
1265 					PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
1266 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_NONE:
1267 					cfe->iospace[i].length =
1268 					    0;
1269 					break;
1270 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
1271 					cfe->iospace[i].length =
1272 						pcmcia_tuple_read_1(tuple, idx);
1273 					idx++;
1274 					break;
1275 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
1276 					cfe->iospace[i].length =
1277 						pcmcia_tuple_read_2(tuple, idx);
1278 					idx += 2;
1279 					break;
1280 				case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
1281 					cfe->iospace[i].length =
1282 						pcmcia_tuple_read_4(tuple, idx);
1283 					idx += 4;
1284 					break;
1285 				}
1286 				cfe->iospace[i].length++;
1287 			}
1288 		} else {
1289 			cfe->num_iospace = 1;
1290 			cfe->iospace[0].start = 0;
1291 			cfe->iospace[0].length =
1292 			    (1 << cfe->iomask);
1293 		}
1294 	}
1295 	if (irq) {
1296 		if (tuple->length <= idx) {
1297 			DPRINTF(("ran out of space before TCPE_IR\n"));
1298 			goto abort_cfe;
1299 		}
1300 
1301 		reg = pcmcia_tuple_read_1(tuple, idx);
1302 		idx++;
1303 
1304 		cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
1305 		    | PCMCIA_CFE_IRQPULSE
1306 		    | PCMCIA_CFE_IRQLEVEL);
1307 		if (reg & PCMCIA_TPCE_IR_SHARE)
1308 			cfe->flags |= PCMCIA_CFE_IRQSHARE;
1309 		if (reg & PCMCIA_TPCE_IR_PULSE)
1310 			cfe->flags |= PCMCIA_CFE_IRQPULSE;
1311 		if (reg & PCMCIA_TPCE_IR_LEVEL)
1312 			cfe->flags |= PCMCIA_CFE_IRQLEVEL;
1313 
1314 		if (reg & PCMCIA_TPCE_IR_HASMASK) {
1315 			/*
1316 			 * it's legal to ignore the
1317 			 * special-interrupt bits, so I will
1318 			 */
1319 
1320 			cfe->irqmask =
1321 			    pcmcia_tuple_read_2(tuple, idx);
1322 			idx += 2;
1323 		} else {
1324 			cfe->irqmask =
1325 			    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
1326 		}
1327 	}
1328 	if (memspace) {
1329 		int lengthsize;
1330 		int cardaddrsize;
1331 		int hostaddrsize;
1332 
1333 		if (tuple->length <= idx) {
1334 			DPRINTF(("ran out of space before TCPE_MS\n"));
1335 			goto abort_cfe;
1336 		}
1337 
1338 		switch (memspace) {
1339 #ifdef notdef	/* This is 0 */
1340 		case PCMCIA_TPCE_FS_MEMSPACE_NONE:
1341 			cfe->num_memspace = 0;
1342 			break;
1343 #endif
1344 
1345 		case PCMCIA_TPCE_FS_MEMSPACE_LENGTH:
1346 			cfe->num_memspace = 1;
1347 			cfe->memspace[0].length = 256 *
1348 			    pcmcia_tuple_read_2(tuple, idx);
1349 			idx += 2;
1350 			cfe->memspace[0].cardaddr = 0;
1351 			cfe->memspace[0].hostaddr = 0;
1352 			break;
1353 
1354 		case PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR:
1355 			cfe->num_memspace = 1;
1356 			cfe->memspace[0].length = 256 *
1357 			    pcmcia_tuple_read_2(tuple, idx);
1358 			idx += 2;
1359 			cfe->memspace[0].cardaddr = 256 *
1360 			    pcmcia_tuple_read_2(tuple, idx);
1361 			idx += 2;
1362 			cfe->memspace[0].hostaddr =
1363 			    cfe->memspace[0].cardaddr;
1364 			break;
1365 
1366 		default:
1367 			reg = pcmcia_tuple_read_1(tuple, idx);
1368 			idx++;
1369 
1370 			cfe->num_memspace = (reg & PCMCIA_TPCE_MS_COUNT)
1371 			    + 1;
1372 
1373 			if (cfe->num_memspace >
1374 			    (sizeof(cfe->memspace) /
1375 				sizeof(cfe->memspace[0]))) {
1376 				DPRINTF(("too many mem spaces %d",
1377 				    cfe->num_memspace));
1378 				state->card->error++;
1379 				return;
1380 			}
1381 			lengthsize =
1382 			    ((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
1383 				PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
1384 			cardaddrsize =
1385 			    ((reg &
1386 				PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
1387 				  PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
1388 			hostaddrsize =
1389 			    (reg & PCMCIA_TPCE_MS_HOSTADDR) ?
1390 			    cardaddrsize : 0;
1391 
1392 			if (lengthsize == 0) {
1393 				DPRINTF(("cfe memspace "
1394 				    "lengthsize == 0"));
1395 				state->card->error++;
1396 			}
1397 			for (i = 0; i < cfe->num_memspace; i++) {
1398 				if (lengthsize) {
1399 					cfe->memspace[i].length = 256 *
1400 					    pcmcia_tuple_read_n(tuple,
1401 						lengthsize, idx);
1402 					idx += lengthsize;
1403 				} else {
1404 					cfe->memspace[i].length = 0;
1405 				}
1406 				if (cfe->memspace[i].length == 0) {
1407 					DPRINTF(("cfe->memspace"
1408 					    "[%d].length == 0", i));
1409 					state->card->error++;
1410 				}
1411 				if (cardaddrsize) {
1412 					cfe->memspace[i].cardaddr =
1413 					    256 *
1414 					    pcmcia_tuple_read_n(tuple,
1415 						cardaddrsize, idx);
1416 					idx += cardaddrsize;
1417 				} else {
1418 					cfe->memspace[i].cardaddr = 0;
1419 				}
1420 				if (hostaddrsize) {
1421 					cfe->memspace[i].hostaddr =
1422 					    256 *
1423 					    pcmcia_tuple_read_n(tuple,
1424 						hostaddrsize, idx);
1425 					idx += hostaddrsize;
1426 				} else {
1427 					cfe->memspace[i].hostaddr = 0;
1428 				}
1429 			}
1430 		}
1431 	}
1432 
1433 	if (misc) {
1434 		if (tuple->length <= idx) {
1435 			DPRINTF(("ran out of space before TCPE_MI\n"));
1436 			goto abort_cfe;
1437 		}
1438 
1439 		reg = pcmcia_tuple_read_1(tuple, idx);
1440 		idx++;
1441 
1442 		cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
1443 		    | PCMCIA_CFE_READONLY
1444 		    | PCMCIA_CFE_AUDIO);
1445 		if (reg & PCMCIA_TPCE_MI_PWRDOWN)
1446 			cfe->flags |= PCMCIA_CFE_POWERDOWN;
1447 		if (reg & PCMCIA_TPCE_MI_READONLY)
1448 			cfe->flags |= PCMCIA_CFE_READONLY;
1449 		if (reg & PCMCIA_TPCE_MI_AUDIO)
1450 			cfe->flags |= PCMCIA_CFE_AUDIO;
1451 		cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
1452 
1453 		while (reg & PCMCIA_TPCE_MI_EXT) {
1454 			reg = pcmcia_tuple_read_1(tuple, idx);
1455 			idx++;
1456 		}
1457 	}
1458 
1459 	/* skip all the subtuples */
1460 abort_cfe:
1461 	DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
1462 }
1463